x86/head/64: Check SEV encryption before switching to kernel page-table (c9f09539) · Commits · 戴 / test

arch/x86/kernel/head_64.S

+16 −0

Original line number	Diff line number	Diff line
		@@ -161,6 +161,21 @@ SYM_INNER_LABEL(secondary_startup_64_no_verify, SYM_L_GLOBAL)

		/* Setup early boot stage 4-/5-level pagetables. */
		addq phys_base(%rip), %rax

		/*
		* For SEV guests: Verify that the C-bit is correct. A malicious
		* hypervisor could lie about the C-bit position to perform a ROP
		* attack on the guest by writing to the unencrypted stack and wait for
		* the next RET instruction.
		* %rsi carries pointer to realmode data and is callee-clobbered. Save
		* and restore it.
		*/
		pushq %rsi
		movq %rax, %rdi
		call sev_verify_cbit
		popq %rsi

		/* Switch to new page-table */
		movq %rax, %cr3

		/* Ensure I am executing from virtual addresses */
		@@ -279,6 +294,7 @@ SYM_INNER_LABEL(secondary_startup_64_no_verify, SYM_L_GLOBAL)
		SYM_CODE_END(secondary_startup_64)

		#include "verify_cpu.S"
		#include "sev_verify_cbit.S"

		#ifdef CONFIG_HOTPLUG_CPU
		/*

+1 −0

Original line number	Diff line number	Diff line
		@@ -39,6 +39,7 @@
		*/
		u64 sme_me_mask __section(".data") = 0;
		u64 sev_status __section(".data") = 0;
		u64 sev_check_data __section(".data") = 0;
		EXPORT_SYMBOL(sme_me_mask);
		DEFINE_STATIC_KEY_FALSE(sev_enable_key);
		EXPORT_SYMBOL_GPL(sev_enable_key);