Re: [PATCH v2] KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts

[Sean Christopherson]

On Thu, 23 Jul 2026 14:13:06 -0700, Sean Christopherson wrote:
> When {de,en}crypting memory of an SEV or SEV-ES guest on an SNP-enabled
> host via a temporary buffer, allocate a full 4KiB page for the buffer to
> ensure the page containing the buffer is wholly owned by KVM, i.e. won't
> be concurrently allocated and accessed by other kernel code while KVM is
> using the buffer to {de,en}crypt memory.  On SNP-enabled platforms, when
> sending SEV/SEV-ES commands that trigger firmware writes to memory, the
> to-be-written page(s) must be (temporarily) assigned to Firmware (as
> required by the SNP architecture, to guard against using such commands as
> gadgets to attack SNP guests).  See snp_map_cmd_buf_desc() and friends.
> 
> [...]

Applied to kvm-x86 svm, thanks!

[1/1] KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts
      https://github.com/kvm-x86/linux/commit/a33c40b93ccf

--
https://github.com/kvm-x86/linux/tree/next