x86/efi: Add GHCB mappings when SEV-ES is active

Browse source

Calling down to EFI runtime services can result in the firmware
performing VMGEXIT calls. The firmware is likely to use the GHCB of the
OS (e.g., for setting EFI variables), so each GHCB in the system needs
to be identity-mapped in the EFI page tables, as unencrypted, to avoid
page faults.

Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
[ jroedel@suse.de: Moved GHCB mapping loop to sev-es.c ]
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lkml.kernel.org/r/20200907131613.12703-72-joro@8bytes.org

...

This commit is contained in:

Tom Lendacky 2020-09-07 15:16:12 +02:00 • committed by Borislav Petkov

parent 4ca68e023b

commit 39336f4ffb

4 changed files with 43 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

arch/x86/boot/compressed/sev-es.c

View file

2

arch/x86/include/asm/sev-es.h

View file

30

arch/x86/kernel/sev-es.c

View file

10

arch/x86/platform/efi/efi_64.c

View file