commit: 0a9d19d1cdac2b8749a0d11ee55554609df56cc8 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Aug 31 12:10:53 2022 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Aug 31 12:10:53 2022 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=0a9d19d1
x86/sev: Don't use cc_platform_has() for early SEV-SNP calls Bug: https://bugs.gentoo.org/865831 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 ++ 1800_x86-sev-cc-platform-SEV-SNP-fix.patch | 72 ++++++++++++++++++++++++++++++ 2 files changed, 76 insertions(+) diff --git a/0000_README b/0000_README index 54d13e58..309b3933 100644 --- a/0000_README +++ b/0000_README @@ -75,6 +75,10 @@ Patch: 1700_sparc-address-warray-bound-warnings.patch From: https://github.com/KSPP/linux/issues/109 Desc: Address -Warray-bounds warnings +Patch: 1800_x86-sev-cc-platform-SEV-SNP-fix.patch +From: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/arch/x86/kernel/sev.c?id=cdaa0a407f1acd3a44861e3aea6e3c7349e668f1 +Desc: Don't use cc_platform_has() for early SEV-SNP calls + Patch: 2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch From: https://lore.kernel.org/linux-bluetooth/20190522070540.48895-1-mar...@holtmann.org/raw Desc: Bluetooth: Check key sizes only when Secure Simple Pairing is enabled. See bug #686758 diff --git a/1800_x86-sev-cc-platform-SEV-SNP-fix.patch b/1800_x86-sev-cc-platform-SEV-SNP-fix.patch new file mode 100644 index 00000000..8d8ceca5 --- /dev/null +++ b/1800_x86-sev-cc-platform-SEV-SNP-fix.patch @@ -0,0 +1,72 @@ +From cdaa0a407f1acd3a44861e3aea6e3c7349e668f1 Mon Sep 17 00:00:00 2001 +From: Tom Lendacky <thomas.lenda...@amd.com> +Date: Tue, 23 Aug 2022 16:55:51 -0500 +Subject: x86/sev: Don't use cc_platform_has() for early SEV-SNP calls + +When running identity-mapped and depending on the kernel configuration, +it is possible that the compiler uses jump tables when generating code +for cc_platform_has(). + +This causes a boot failure because the jump table uses un-mapped kernel +virtual addresses, not identity-mapped addresses. This has been seen +with CONFIG_RETPOLINE=n. + +Similar to sme_encrypt_kernel(), use an open-coded direct check for the +status of SNP rather than trying to eliminate the jump table. This +preserves any code optimization in cc_platform_has() that can be useful +post boot. It also limits the changes to SEV-specific files so that +future compiler features won't necessarily require possible build changes +just because they are not compatible with running identity-mapped. + + [ bp: Massage commit message. ] + +Fixes: 5e5ccff60a29 ("x86/sev: Add helper for validating pages in early enc attribute changes") +Reported-by: Sean Christopherson <sea...@google.com> +Suggested-by: Sean Christopherson <sea...@google.com> +Signed-off-by: Tom Lendacky <thomas.lenda...@amd.com> +Signed-off-by: Borislav Petkov <b...@suse.de> +Cc: <sta...@vger.kernel.org> # 5.19.x +Link: https://lore.kernel.org/all/yqfabntrxfsm+...@google.com/ +--- + arch/x86/kernel/sev.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +(limited to 'arch/x86/kernel/sev.c') + +diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c +index 63dc626627a03..4f84c3f11af5b 100644 +--- a/arch/x86/kernel/sev.c ++++ b/arch/x86/kernel/sev.c +@@ -701,7 +701,13 @@ e_term: + void __init early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr, + unsigned int npages) + { +- if (!cc_platform_has(CC_ATTR_GUEST_SEV_SNP)) ++ /* ++ * This can be invoked in early boot while running identity mapped, so ++ * use an open coded check for SNP instead of using cc_platform_has(). ++ * This eliminates worries about jump tables or checking boot_cpu_data ++ * in the cc_platform_has() function. ++ */ ++ if (!(sev_status & MSR_AMD64_SEV_SNP_ENABLED)) + return; + + /* +@@ -717,7 +723,13 @@ void __init early_snp_set_memory_private(unsigned long vaddr, unsigned long padd + void __init early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr, + unsigned int npages) + { +- if (!cc_platform_has(CC_ATTR_GUEST_SEV_SNP)) ++ /* ++ * This can be invoked in early boot while running identity mapped, so ++ * use an open coded check for SNP instead of using cc_platform_has(). ++ * This eliminates worries about jump tables or checking boot_cpu_data ++ * in the cc_platform_has() function. ++ */ ++ if (!(sev_status & MSR_AMD64_SEV_SNP_ENABLED)) + return; + + /* Invalidate the memory pages before they are marked shared in the RMP table. */ +-- +cgit +
