Re: [PATCH v9 18/43] x86/kernel: Validate ROM memory before accessing when SEV-SNP is active

Borislav Petkov
2022-02-02T15:41:59Z

On Fri, Jan 28, 2022 at 11:17:39AM -0600, Brijesh Singh wrote:
> @@ -197,11 +198,21 @@ static int __init romchecksum(const unsigned char *rom, unsigned long length)
>
> void __init probe_roms(void)
> {
> - const unsigned char *rom;
> unsigned long start, length, upper;
> + const unsigned char *rom;
> unsigned char c;
> int i;
>
> + /*
> + * The ROM memory is not part of the E820 system RAM and is not pre-validated
> + * by the BIOS. The kernel page table maps the ROM region as encrypted memory,
> + * the SEV-SNP requires the encrypted memory must be validated before the
> + * access. Validate the ROM before accessing it.
> + */

Lemme massage it:

/*
* The ROM memory range is not part of the e820 table and is therefore not
* pre-validated by BIOS. The kernel page table maps the ROM region as encrypted
* memory, and SEV-SNP requires encrypted memory to be validated before access.
* Do that here.
*/

--
Regards/Gruss,
Boris.