diff options
| author | Joerg Roedel <jroedel@suse.de> | 2020-10-28 17:46:58 +0100 |
|---|---|---|
| committer | Borislav Petkov <bp@suse.de> | 2020-10-29 18:09:59 +0100 |
| commit | c9f09539e16e281f92a27760fdfae71e8af036f6 (patch) | |
| tree | 6e0eb9706062025102be18c76c366f339ce909ff /arch/x86/mm | |
| parent | 86ce43f7dde81562f58b24b426cef068bd9f7595 (diff) | |
| download | linux-c9f09539e16e281f92a27760fdfae71e8af036f6.tar.bz2 | |
x86/head/64: Check SEV encryption before switching to kernel page-table
When SEV is enabled, the kernel requests the C-bit position again from
the hypervisor to build its own page-table. Since the hypervisor is an
untrusted source, the C-bit position needs to be verified before the
kernel page-table is used.
Call sev_verify_cbit() before writing the CR3.
[ bp: Massage. ]
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://lkml.kernel.org/r/20201028164659.27002-5-joro@8bytes.org
Diffstat (limited to 'arch/x86/mm')
| -rw-r--r-- | arch/x86/mm/mem_encrypt.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c index efbb3de472df..bc0833713be9 100644 --- a/arch/x86/mm/mem_encrypt.c +++ b/arch/x86/mm/mem_encrypt.c @@ -39,6 +39,7 @@ */ u64 sme_me_mask __section(".data") = 0; u64 sev_status __section(".data") = 0; +u64 sev_check_data __section(".data") = 0; EXPORT_SYMBOL(sme_me_mask); DEFINE_STATIC_KEY_FALSE(sev_enable_key); EXPORT_SYMBOL_GPL(sev_enable_key); |