tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

x86/sev: Use MSR protocol only for early SVSM PVALIDATE call

The early page state change API performs an SVSM call to PVALIDATE each page
when running under a SVSM, and this involves either a GHCB page based call or
a call based on the MSR protocol.

The GHCB page based variant involves VA to PA translation of the GHCB address,
and this is best avoided in the startup code, where virtual addresses are
ambiguous (1:1 or kernel virtual).

As this is the last remaining occurrence of svsm_perform_call_protocol() in
the startup code, switch to the MSR protocol exclusively in this particular
case, so that the GHCB based plumbing can be moved out of the startup code
entirely in a subsequent patch.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/20250828102202.1849035-27-ardb+git@google.com

authored by

Ard Biesheuvel and committed by
Borislav Petkov (AMD) 7cb7b6de c15a4705

+6 -23
-20
arch/x86/boot/compressed/sev.c
··· 50 50 return boot_svsm_caa_pa; 51 51 } 52 52 53 - int svsm_perform_call_protocol(struct svsm_call *call); 54 - 55 53 u8 snp_vmpl; 56 54 57 55 /* Include code for early handlers */ 58 56 #include "../../boot/startup/sev-shared.c" 59 - 60 - int svsm_perform_call_protocol(struct svsm_call *call) 61 - { 62 - struct ghcb *ghcb; 63 - int ret; 64 - 65 - if (boot_ghcb) 66 - ghcb = boot_ghcb; 67 - else 68 - ghcb = NULL; 69 - 70 - do { 71 - ret = ghcb ? svsm_perform_ghcb_protocol(ghcb, call) 72 - : svsm_perform_msr_protocol(call); 73 - } while (ret == -EAGAIN); 74 - 75 - return ret; 76 - } 77 57 78 58 static bool sev_snp_enabled(void) 79 59 {
+6 -3
arch/x86/boot/startup/sev-shared.c
··· 741 741 struct svsm_call call = {}; 742 742 unsigned long flags; 743 743 u64 pc_pa; 744 - int ret; 745 744 746 745 /* 747 746 * This can be called very early in the boot, use native functions in ··· 765 766 call.rax = SVSM_CORE_CALL(SVSM_CORE_PVALIDATE); 766 767 call.rcx = pc_pa; 767 768 768 - ret = svsm_perform_call_protocol(&call); 769 - if (ret) 769 + /* 770 + * Use the MSR protocol exclusively, so that this code is usable in 771 + * startup code where VA/PA translations of the GHCB page's address may 772 + * be problematic. 773 + */ 774 + if (svsm_call_msr_protocol(&call)) 770 775 sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_PVALIDATE); 771 776 772 777 native_local_irq_restore(flags);