linux-kernel - Re: [PATCH v2 2/2] x86/sev: let sev_es_efi_map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <rite3te5udzekwbbujmga5kyyjjm5gfphhqoxlhtsncgckq6rm@7m7owl5jgubz>
Date: Wed, 25 Jun 2025 13:52:58 +0200
From: Gerd Hoffmann <kraxel@...hat.com>
To: Borislav Petkov <bp@...en8.de>
Cc: linux-coco@...ts.linux.dev, kvm@...r.kernel.org, 
	Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, 
	Dave Hansen <dave.hansen@...ux.intel.com>, 
	"maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86@...nel.org>, "H. Peter Anvin" <hpa@...or.com>, 
	Ard Biesheuvel <ardb@...nel.org>, 
	"open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <linux-kernel@...r.kernel.org>, 
	"open list:EXTENSIBLE FIRMWARE INTERFACE (EFI)" <linux-efi@...r.kernel.org>
Subject: Re: [PATCH v2 2/2] x86/sev: let sev_es_efi_map_ghcbs map the caa
 pages too

>  	for_each_possible_cpu(cpu) {
>  		data = per_cpu(runtime_data, cpu);
> @@ -1066,6 +1069,14 @@ int __init sev_es_efi_map_ghcbs(pgd_t *pgd)
>  
>  		if (kernel_map_pages_in_pgd(pgd, pfn, address, 1, pflags))
>  			return 1;
> +
> +		address = per_cpu(svsm_caa_pa, cpu);
> +		if (!address)
> +			return 1;
> +
> +		pfn = address >> PAGE_SHIFT;
> +		if (kernel_map_pages_in_pgd(pgd, pfn, address, 1, pflags_enc))
> +			return 1;
>  	}

The kernel allocates the caa page(s) only when running under svsm, see
alloc_runtime_data(), so this is not correct.  I think we either have to
return to the original behavior of only doing something in case address
is not NULL, or wrap the caa code block into a 'if (snp_vmpl) { ... }',
following what alloc_runtime_data() is doing.

take care,
  Gerd