Commit a50c5beb authored by Tom Lendacky's avatar Tom Lendacky Committed by Borislav Petkov
Browse files

x86/sev-es: Invalidate the GHCB after completing VMGEXIT 



Since the VMGEXIT instruction can be issued from userspace, invalidate
the GHCB after performing VMGEXIT processing in the kernel.

Invalidation is only required after userspace is available, so call
vc_ghcb_invalidate() from sev_es_put_ghcb(). Update vc_ghcb_invalidate()
to additionally clear the GHCB exit code so that it is always presented
as 0 when VMGEXIT has been issued by anything else besides the kernel.

Fixes: 0786138c ("x86/sev-es: Add a Runtime #VC Exception Handler")
Signed-off-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/5a8130462e4f0057ee1184509cd056eedd78742b.1621273353.git.thomas.lendacky@amd.com
parent fea63d54

arch/x86/kernel/sev-shared.c

+1 −0
Original line number Diff line number Diff line
@@ -63,6 +63,7 @@ static bool sev_es_negotiate_protocol(void) 


static __always_inline void vc_ghcb_invalidate(struct ghcb *ghcb)

{

	ghcb->save.sw_exit_code = 0;

	memset(ghcb->save.valid_bitmap, 0, sizeof(ghcb->save.valid_bitmap));

}

arch/x86/kernel/sev.c

+5 −0
Original line number Diff line number Diff line
@@ -457,6 +457,11 @@ static __always_inline void sev_es_put_ghcb(struct ghcb_state *state) 
		data->backup_ghcb_active = false;

		state->ghcb = NULL;

	} else {

		/*

		 * Invalidate the GHCB so a VMGEXIT instruction issued

		 * from userspace won't appear to be valid.

		 */

		vc_ghcb_invalidate(ghcb);

		data->ghcb_active = false;

	}

}