Re: [Patch v3 05/14] x86/mm: Handle decryption/re-encryption of bss_decrypted consistently
From: Borislav Petkov <bp@alien8.de>
Date: 2022-11-21 14:48:21
Also in:
linux-arch, linux-hyperv, linux-iommu, linux-pci, lkml
On Wed, Nov 16, 2022 at 10:41:28AM -0800, Michael Kelley wrote:
Current code in sme_postprocess_startup() decrypts the bss_decrypted section when sme_me_mask is non-zero. But code in mem_encrypt_free_decrytped_mem() re-encrypts the unused portion based
^^ letters flipped.
quoted hunk ↗ jump to hunk
@@ -513,10 +513,14 @@ void __init mem_encrypt_free_decrypted_mem(void) npages = (vaddr_end - vaddr) >> PAGE_SHIFT; /* - * The unused memory range was mapped decrypted, change the encryption - * attribute from decrypted to encrypted before freeing it. + * If the unused memory range was mapped decrypted, change the encryption + * attribute from decrypted to encrypted before freeing it. Base the + * re-encryption on the same condition used for the decryption in + * sme_postprocess_startup(). Higher level abstractions, such as + * CC_ATTR_MEM_ENCRYPT, aren't necessarily equivalent in a Hyper-V VM + * using vTOM, where sme_me_mask is always zero.
Good, an example why one needs to pay attention here.
Thx.
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette