linux-kernel - Re: [PATCH] x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <56877590-a7c8-4dbd-b334-ae9cbbf62bf1@amd.com>
Date: Sat, 13 Sep 2025 09:29:47 -0500
From: Tom Lendacky <thomas.lendacky@....com>
To: Borislav Petkov <bp@...en8.de>, Michael Roth <michael.roth@....com>
Cc: linux-kernel@...r.kernel.org, x86@...nel.org,
 Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
 Dave Hansen <dave.hansen@...ux.intel.com>,
 Sean Christopherson <seanjc@...gle.com>, stable@...nel.org
Subject: Re: [PATCH] x86/sev: Guard sev_evict_cache() with
 CONFIG_AMD_MEM_ENCRYPT

On 9/12/25 16:02, Borislav Petkov wrote:
> On Fri, Sep 12, 2025 at 03:49:29PM -0500, Michael Roth wrote:
>> I think that's actually the concerning thing. If someone built a guest
>> kernel with CONFIG_KVM_AMD_SEV=y they might be under the impression that
>> this is performing evictions when it's actually just a stub function.
> 
> That sooo needs to be in the commit message...

I can send a v2 or if you want to modify the commit message with the
following:

 The sev_evict_cache() is guest-related code and should be guarded by
 CONFIG_AMD_MEM_ENCRYPT, not CONFIG_KVM_AMD_SEV.

 CONFIG_AMD_MEM_ENCRYPT=y is required for a guest to run properly as an
 SEV-SNP guest, but a guest kernel built with CONFIG_KVM_AMD_SEV=n would
 get the stub function of sev_evict_cache() instead of the version that
 performs the actual eviction. Move the function declarations under the
 appropriate #ifdef.

Let me know.

Thanks,
Tom

>