Patch "x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM_ENCRYPT" has been added to the 6.12-stable tree

This is a note to let you know that I've just added the patch titled

x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM_ENCRYPT

to the 6.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
x86-sev-guard-sev_evict_cache-with-config_amd_mem_encrypt.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From [email protected] Mon Sep 22 01:18:07 2025
From: Sasha Levin <[email protected]>
Date: Sun, 21 Sep 2025 19:17:59 -0400
Subject: x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM_ENCRYPT
To: [email protected]
Cc: Tom Lendacky <[email protected]>, "Borislav Petkov (AMD)" <[email protected]>, [email protected], Sasha Levin <[email protected]>
Message-ID: <[email protected]>

From: Tom Lendacky <[email protected]>

[ Upstream commit 7f830e126dc357fc086905ce9730140fd4528d66 ]

The sev_evict_cache() is guest-related code and should be guarded by CONFIG_AMD_MEM_ENCRYPT, not CONFIG_KVM_AMD_SEV.

CONFIG_AMD_MEM_ENCRYPT=y is required for a guest to run properly as an SEV-SNP guest, but a guest kernel built with CONFIG_KVM_AMD_SEV=n would get the stub function of sev_evict_cache() instead of the version that performs the actual eviction. Move the function declarations under the appropriate #ifdef.

Fixes 7b306dfa326f ("x86/sev: Evict cache lines during SNP memory validation")

Signed-off-by Tom Lendacky <[email protected]>

Signed-off-by Borislav Petkov (AMD) <[email protected]>

Cc [email protected] # 6.16.x

Link https://lore.kernel.org/r/70e38f2c4a549063de54052c9f64929705313526.1757708959.git.thomas.lendacky@amd.com open here

[ Move sev_evict_cache() out of shared.c ]

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/coco/sev/shared.c |   18 ------------------
 arch/x86/include/asm/sev.h |   19 +++++++++++++++++++
 2 files changed, 19 insertions(+), 18 deletions(-)

arch/x86/coco/sev/shared.c +0 -18

@@ -1243,24 +1243,6 @@ static void svsm_pval_terminate(struct s
 	__pval_terminate(pfn, action, page_size, ret, svsm_ret);
 }
 
-static inline void sev_evict_cache(void *va, int npages)
-{
-	volatile u8 val __always_unused;
-	u8 *bytes = va;
-	int page_idx;
-
-	/*
-	 * For SEV guests, a read from the first/last cache-lines of a 4K page
-	 * using the guest key is sufficient to cause a flush of all cache-lines
-	 * associated with that 4K page without incurring all the overhead of a
-	 * full CLFLUSH sequence.
-	 */
-	for (page_idx = 0; page_idx < npages; page_idx++) {
-		val = bytes[page_idx * PAGE_SIZE];
-		val = bytes[page_idx * PAGE_SIZE + PAGE_SIZE - 1];
-	}
-}
-
 static void svsm_pval_4k_page(unsigned long paddr, bool validate)
 {
 	struct svsm_pvalidate_call *pc;

arch/x86/include/asm/sev.h +19 -0

@@ -400,6 +400,24 @@ u64 sev_get_status(void);
 void sev_show_status(void);
 void snp_update_svsm_ca(void);
 
+static inline void sev_evict_cache(void *va, int npages)
+{
+	volatile u8 val __always_unused;
+	u8 *bytes = va;
+	int page_idx;
+
+	/*
+	 * For SEV guests, a read from the first/last cache-lines of a 4K page
+	 * using the guest key is sufficient to cause a flush of all cache-lines
+	 * associated with that 4K page without incurring all the overhead of a
+	 * full CLFLUSH sequence.
+	 */
+	for (page_idx = 0; page_idx < npages; page_idx++) {
+		val = bytes[page_idx * PAGE_SIZE];
+		val = bytes[page_idx * PAGE_SIZE + PAGE_SIZE - 1];
+	}
+}
+
 #else	/* !CONFIG_AMD_MEM_ENCRYPT */
 
 #define snp_vmpl 0

@@ -435,6 +453,7 @@ static inline u64 snp_get_unsupported_fe
 static inline u64 sev_get_status(void) { return 0; }
 static inline void sev_show_status(void) { }
 static inline void snp_update_svsm_ca(void) { }
+static inline void sev_evict_cache(void *va, int npages) {}
 
 #endif	/* CONFIG_AMD_MEM_ENCRYPT */
 

Patches currently in stable-queue which might be from [email protected] are

queue-6.12/mptcp-tfo-record-deny-join-id0-info.patch queue-6.12/crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch queue-6.12/asoc-wm8940-correct-pll-rate-rounding.patch queue-6.12/um-virtio_uml-fix-use-after-free-after-put_device-in.patch queue-6.12/x86-sev-guard-sev_evict_cache-with-config_amd_mem_encrypt.patch queue-6.12/mptcp-pm-nl-announce-deny-join-id0-flag.patch queue-6.12/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch queue-6.12/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch queue-6.12/qed-don-t-collect-too-many-protection-override-grc-e.patch queue-6.12/dpaa2-switch-fix-buffer-pool-seeding-for-control-tra.patch queue-6.12/nvme-fix-pi-insert-on-write.patch queue-6.12/xhci-dbc-fix-full-dbc-transfer-ring-after-several-reconnects.patch queue-6.12/pcmcia-omap_cf-mark-driver-struct-with-__refdata-to-.patch queue-6.12/tcp-clear-tcp_sk-sk-fastopen_rsk-in-tcp_disconnect.patch queue-6.12/wifi-mac80211-increase-scan_ies_len-for-s1g.patch queue-6.12/i40e-remove-redundant-memory-barrier-when-cleaning-t.patch queue-6.12/usb-xhci-remove-option-to-change-a-default-ring-s-trb-cycle-bit.patch queue-6.12/btrfs-fix-invalid-extref-key-setup-when-replaying-de.patch queue-6.12/io_uring-fix-incorrect-io_kiocb-reference-in-io_link.patch queue-6.12/ice-fix-rx-page-leak-on-multi-buffer-frames.patch queue-6.12/net-natsemi-fix-rx_dropped-double-accounting-on-neti.patch queue-6.12/drm-xe-tile-release-kobject-for-the-failure-path.patch queue-6.12/wifi-mac80211-fix-incorrect-type-for-ret.patch queue-6.12/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch queue-6.12/net-mlx5e-harden-uplink-netdev-access-against-device.patch queue-6.12/usb-xhci-introduce-macro-for-ring-segment-list-iteration.patch queue-6.12/revert-net-mlx5e-update-and-set-xon-xoff-upon-port-s.patch queue-6.12/net-liquidio-fix-overflow-in-octeon_init_instr_queue.patch queue-6.12/net-tcp-fix-a-null-pointer-dereference-when-using-tc.patch queue-6.12/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch queue-6.12/ice-store-max_frame-and-rx_buf_len-only-in-ice_rx_ri.patch queue-6.12/selftests-mptcp-userspace-pm-validate-deny-join-id0-.patch queue-6.12/bonding-set-random-address-only-when-slaves-already-.patch queue-6.12/drm-xe-fix-a-null-vs-is_err-in-xe_vm_add_compute_exe.patch queue-6.12/cnic-fix-use-after-free-bugs-in-cnic_delete_task.patch queue-6.12/mm-gup-check-ref_count-instead-of-lru-before-migration.patch queue-6.12/tls-make-sure-to-abort-the-stream-if-headers-are-bog.patch queue-6.12/um-fix-fd-copy-size-in-os_rcv_fd_msg.patch queue-6.12/smb-client-let-smbd_destroy-call-disable_work_sync-i.patch queue-6.12/bonding-don-t-set-oif-to-bond-dev-when-getting-ns-ta.patch queue-6.12/xhci-dbc-decouple-endpoint-allocation-from-initialization.patch queue-6.12/mptcp-set-remote_deny_join_id0-on-syn-recv.patch queue-6.12/octeontx2-pf-fix-use-after-free-bugs-in-otx2_sync_ts.patch queue-6.12/smb-client-fix-filename-matching-of-deferred-files.patch queue-6.12/igc-don-t-fail-igc_probe-on-led-setup-error.patch queue-6.12/octeon_ep-fix-vf-mac-address-lifecycle-handling.patch queue-6.12/selftests-mptcp-sockopt-fix-error-messages.patch queue-6.12/cgroup-split-cgroup_destroy_wq-into-3-workqueues.patch queue-6.12/alsa-firewire-motu-drop-epollout-from-poll-return-va.patch queue-6.12/asoc-wm8974-correct-pll-rate-rounding.patch queue-6.12/mm-add-folio_expected_ref_count-for-reference-count-calculation.patch queue-6.12/wifi-wilc1000-avoid-buffer-overflow-in-wid-string-co.patch queue-6.12/asoc-intel-catpt-expose-correct-bit-depth-to-userspa.patch queue-6.12/asoc-wm8940-correct-typo-in-control-name.patch queue-6.12/perf-x86-intel-fix-crash-in-icl_update_topdown_event.patch

Quoted 8 lines · On 9/22/25 00:52, [email protected] wrote:

This is a note to let you know that I've just added the patch titled

x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM_ENCRYPT

to the 6.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

Quoted 6 lines

The filename of the patch is:
x86-sev-guard-sev_evict_cache-with-config_amd_mem_encrypt.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Maybe I didn't use the tag correctly, but I put 6.16.x on the stable tag to indicate that the patch only applied to 6.16 and above. Before 6.16, there isn't a stub version of the function, so all off those releases are fine.

So this patch doesn't need to be part of the 6.12 stable tree.