Commit c7b5254b authored by Michael Kelley's avatar Michael Kelley Committed by Borislav Petkov (AMD)

x86/mm: Handle decryption/re-encryption of bss_decrypted consistently

sme_postprocess_startup() decrypts the bss_decrypted section when
sme_me_mask is non-zero.

mem_encrypt_free_decrypted_mem() re-encrypts the unused portion based
on CC_ATTR_MEM_ENCRYPT.

In a Hyper-V guest VM using vTOM, these conditions are not equivalent
as sme_me_mask is always zero when using vTOM. Consequently,
mem_encrypt_free_decrypted_mem() attempts to re-encrypt memory that was
never decrypted.

So check sme_me_mask in mem_encrypt_free_decrypted_mem() too.

Hyper-V guests using vTOM don't need the bss_decrypted section to be
decrypted, so skipping the decryption/re-encryption doesn't cause a
problem.
Signed-off-by: default avatarMichael Kelley <mikelley@microsoft.com>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/1678329614-3482-5-git-send-email-mikelley@microsoft.com
parent d33ddc92
...@@ -513,10 +513,14 @@ void __init mem_encrypt_free_decrypted_mem(void) ...@@ -513,10 +513,14 @@ void __init mem_encrypt_free_decrypted_mem(void)
npages = (vaddr_end - vaddr) >> PAGE_SHIFT; npages = (vaddr_end - vaddr) >> PAGE_SHIFT;
/* /*
* The unused memory range was mapped decrypted, change the encryption * If the unused memory range was mapped decrypted, change the encryption
* attribute from decrypted to encrypted before freeing it. * attribute from decrypted to encrypted before freeing it. Base the
* re-encryption on the same condition used for the decryption in
* sme_postprocess_startup(). Higher level abstractions, such as
* CC_ATTR_MEM_ENCRYPT, aren't necessarily equivalent in a Hyper-V VM
* using vTOM, where sme_me_mask is always zero.
*/ */
if (cc_platform_has(CC_ATTR_MEM_ENCRYPT)) { if (sme_me_mask) {
r = set_memory_encrypted(vaddr, npages); r = set_memory_encrypted(vaddr, npages);
if (r) { if (r) {
pr_warn("failed to free unused decrypted pages\n"); pr_warn("failed to free unused decrypted pages\n");
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment