Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 682af543 authored by Tom Lendacky's avatar Tom Lendacky Committed by Thomas Gleixner
Browse files

x86/mm: Don't attempt to encrypt initrd under SEV 



When SEV is active the initrd/initramfs will already have already been
placed in memory encrypted so do not try to encrypt it.

Signed-off-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
Tested-by: default avatarBorislav Petkov <bp@suse.de>
Cc: kvm@vger.kernel.org
Cc: Borislav Petkov <bp@alien8.de>
Cc: Andy Lutomirski <luto@kernel.org>
Link: https://lkml.kernel.org/r/20171020143059.3291-4-brijesh.singh@amd.com
parent d8aa7eea

arch/x86/kernel/setup.c

+4 −2
Original line number Original line Diff line number Diff line
@@ -380,8 +380,10 @@ static void __init reserve_initrd(void) 
	 * If SME is active, this memory will be marked encrypted by the

	 * If SME is active, this memory will be marked encrypted by the

	 * kernel when it is accessed (including relocation). However, the

	 * kernel when it is accessed (including relocation). However, the

	 * ramdisk image was loaded decrypted by the bootloader, so make

	 * ramdisk image was loaded decrypted by the bootloader, so make

	 * sure that it is encrypted before accessing it.

	 * sure that it is encrypted before accessing it. For SEV the

	 * ramdisk will already be encrypted, so only do this for SME.

	 */

	 */

	if (sme_active())

		sme_early_encrypt(ramdisk_image, ramdisk_end - ramdisk_image);

		sme_early_encrypt(ramdisk_image, ramdisk_end - ramdisk_image);





	initrd_start = 0;

	initrd_start = 0;