linux-toradex.git/arch/x86/coco, branch master

x86/sev: Make vTPM SVSM calls preemption-safe

2026-09-22T02:59:25+00:00

Two functions in the SVSM vTPM guest implementation do not disable
preemption when fetching the SVSM Calling Area Address (CAA).

The SVSM CAA is a per-CPU structure. When a thread is preempted and migrated
to a different CPU after fetching the per-CPU CAA, the SVSM call will execute
on the new CPU with the original CPU's CAA. Which is wrong.

Move the CAA fetching operation inside svsm_perform_call_protocol() which
disables interrupts around the SVSM call and thus runs preemption-safe.

Fixes: 770de678bc28 ("x86/sev: Add SVSM vTPM probe/send_command functions")
Signed-off-by: Melody Wang 
Signed-off-by: Borislav Petkov (AMD) 
Reviewed-by: Stefano Garzarella 
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/a5bc0d4a2c462a0089109e145c21626b244b2ff0.1789345277.git.huibo.wang@amd.com

Merge tag 'x86_tdx_for_7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-19T00:41:36+00:00

Pull x86 TDX updates from Dave Hansen:
 "TDX guests cause #VE exceptions whenever they do port I/O. The guest
  then does some instruction decoding and makes a call up to the host
  for help. That decoding had a couple of bugs.

  Fix those bugs. Use an existing and now shared KVM helper for one of
  them"

* tag 'x86_tdx_for_7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/tdx: Fix zero-extension for 32-bit port I/O
  x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
  x86/tdx: Fix off-by-one in port I/O handling

x86/sev: Remove obsolete virtual address check

2026-07-23T16:30:29+00:00

Virtual addresses used with the AES-GCM library don't have to be in the
linear mapping.  Remove the virt_addr_valid() checks from
snp_send_guest_request(), which were a workaround left over from when
this code used crypto_aead, which required scatterlists.

Link: https://lore.kernel.org/all/20251010151036.42241-2-ardb+git@google.com/
Reviewed-by: Alexey Kardashevskiy 
Tested-by: Alexey Kardashevskiy 
Tested-by: Nikunj A Dadhania 
Reviewed-by: Ard Biesheuvel 
Link: https://patch.msgid.link/20260722025338.33354-3-ebiggers@kernel.org
Signed-off-by: Eric Biggers

x86/sev: Use new AES-GCM library

2026-07-23T16:30:29+00:00

The old AES-GCM library code is being replaced as part of an overhaul
that is adding support for all the common AES encryption modes with
consistent conventions.  The SEV code is the only user of the old
AES-GCM library.  Update it to use the new API instead.

Besides adjustments to the key struct name, function names, return
value, and parameter order, the only notable changes are:

- Replace the direct accesses to the auth tag length field (which should
  be considered private until someone truly needs it) with the
  AUTHTAG_LEN constant which is already defined in .

- Replace kfree() with kfree_sensitive() on lines being changed anyway.

Tested-by: Nikunj A Dadhania 
Reviewed-by: Ard Biesheuvel 
Link: https://patch.msgid.link/20260722025338.33354-2-ebiggers@kernel.org
Signed-off-by: Eric Biggers

x86/tdx: Fix zero-extension for 32-bit port I/O

2026-07-13T21:45:07+00:00

According to x86 architecture rules, 32-bit operations zero-extend the
result to 64 bits. The current implementation of handle_in() only masks
the lower 32 bits, which preserves the upper 32 bits of RAX when a
32-bit port IN instruction is emulated.

Use insn_assign_reg() to write the result back into RAX with proper
partial-register-write semantics: 1- and 2-byte forms leave the upper
bits untouched, the 4-byte form zero-extends to the full register.

Fixes: 03149948832a ("x86/tdx: Port I/O: Add runtime hypercalls")
Reported-by: Borys Tsyrulnikov 
Signed-off-by: Kiryl Shutsemau (Meta) 
Signed-off-by: Dave Hansen 
Reviewed-by: Binbin Wu 
Link: https://lore.kernel.org/all/CAKw_Dz96rfSQc6Rn+9QBcUFHhmkK+9zu+P=bxowfZwxrATCBRg@mail.gmail.com/
Cc:stable@vger.kernel.org
Link: https://patch.msgid.link/20260713133753.223947-4-kirill@shutemov.name

x86/tdx: Fix off-by-one in port I/O handling

2026-07-13T21:45:07+00:00

handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c use:

    u64 mask = GENMASK(BITS_PER_BYTE * size, 0);

GENMASK(h, l) includes bit h. For size=1 (INB), this produces
GENMASK(8, 0) = 0x1FF (9 bits) instead of GENMASK(7, 0) = 0xFF (8
bits). The mask is one bit too wide for all I/O sizes.

Fix the mask calculation.

Fixes: 03149948832a ("x86/tdx: Port I/O: Add runtime hypercalls")
Reported-by: Borys Tsyrulnikov 
Signed-off-by: Kiryl Shutsemau (Meta) 
Signed-off-by: Dave Hansen 
Reviewed-by: Kai Huang 
Reviewed-by: Kuppuswamy Sathyanarayanan 
Reviewed-by: Binbin Wu 
Reviewed-by: Rick Edgecombe 
Link: https://lore.kernel.org/all/CAKw_Dz96rfSQc6Rn+9QBcUFHhmkK+9zu+P=bxowfZwxrATCBRg@mail.gmail.com/
Cc:stable@vger.kernel.org
Link: https://patch.msgid.link/20260713133753.223947-2-kirill@shutemov.name

Merge tag 'x86_sev_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

2026-06-16T00:27:30+00:00

Pull x86 SEV updates from Borislav Petkov:

 - Remove redundant GHCB initialization guards in the SEV page state and
   SVSM call paths now that the GHCB helpers handle early-boot fallback
   internally

 - Skip SNP initialization in the CCP driver immediately when the
   preparation step fails rather than proceeding to an operation that
   will certainly fail

 - Abort SNP preparation and return an error when not all CPUs are
   online, since the firmware enforces that every CPU enables SNP and
   will fail init if not

 - Simplify the VMM communication exception entry path by replacing
   separate kernel and user mode macros with a single handler that
   dispatches based on the current privilege level

* tag 'x86_sev_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  x86/sev: Remove redundant ghcbs_initialized checks around __sev_{get,put}_ghcb()
  crypto/ccp: Skip SNP_INIT if preparation fails
  x86/sev: Do not initialize SNP if missing CPUs
  x86/entry: Zap the #VC entry user and kernel macros

x86/sev: Remove redundant ghcbs_initialized checks around __sev_{get,put}_ghcb()

2026-05-19T20:31:29+00:00

After

  3645eb7e3915 ("x86/fred: Fix early boot failures on SEV-ES/SNP guests"),

__sev_{get,put}_ghcb() handle the early-boot GHCB fallback internally, making
the ghcbs_initialized guards in __set_pages_state() and
svsm_perform_call_protocol() redundant.

Remove them.

Also initialize state->ghcb to NULL in the early-boot path of
__sev_get_ghcb() so that the ghcb_state is well-defined for all callers,
even though __sev_put_ghcb() currently returns early before reading it.

No functional change intended.

Suggested-by: Tom Lendacky 
Signed-off-by: Nikunj A Dadhania 
Signed-off-by: Borislav Petkov (AMD) 
Reviewed-by: Tom Lendacky 
Link: https://patch.msgid.link/20260518102230.3394603-1-nikunj@amd.com

treewide: Explicitly include the x86 CPUID headers

2026-05-06T12:29:59+00:00

Modify all CPUID call sites which implicitly include any of the CPUID
headers to explicitly include them instead.

For KVM's reverse_cpuid.h, just include  since it
references the CPUID_EAX..EDX symbols without using the CPUID APIs.

Note, this allows removing the inclusion of  from within
 next.  That allows the CPUID API headers to include
 without introducing a circular dependency.

Signed-off-by: Ahmed S. Darwish 
Signed-off-by: Borislav Petkov (AMD) 
Link: https://lore.kernel.org/20260327021645.555257-1-darwi@linutronix.de

x86/entry: Zap the #VC entry user and kernel macros

2026-05-04T09:18:41+00:00

Drop the separate kernel and user macros in favor of calling a single #VC
C handler which multiplexes between the kernel and user #VC entry points
by looking at CS's RPL.

Zap unused DEFINE_IDTENTRY_VC while at it.

There should be no functionality change resulting from this - just code
simplification.

Signed-off-by: Borislav Petkov (AMD) 
Reviewed-by: Nikunj A. Dadhania 
Reviewed-by: Tom Lendacky 
Acked-by: Joerg Roedel 
Tested-by: Nikunj A. Dadhania 
Link: https://patch.msgid.link/20260420164352.32129-1-bp@kernel.org