x86/sev: Do the C-bit verification only on the BSP

There's no need to do it on every AP.

The C-bit value read on the BSP and also verified there, is used
everywhere from now on.

No functional changes - just a bit faster booting APs.

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/20231130132601.10317-1-bp@alien8.de

diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index 086a2c3aaaa044b93a96d4eb7c6db508e4bafee2..d1dc39af6771eb00e02c942119e0f9f93cb030b1 100644 (file)
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -114,6 +114,28 @@ SYM_CODE_START_NOALIGN(startup_64)
 
        /* Form the CR3 value being sure to include the CR3 modifier */
        addq    $(early_top_pgt - __START_KERNEL_map), %rax
+
+#ifdef CONFIG_AMD_MEM_ENCRYPT
+       mov     %rax, %rdi
+       mov     %rax, %r14
+
+       addq    phys_base(%rip), %rdi
+
+       /*
+        * For SEV guests: Verify that the C-bit is correct. A malicious
+        * hypervisor could lie about the C-bit position to perform a ROP
+        * attack on the guest by writing to the unencrypted stack and wait for
+        * the next RET instruction.
+        */
+       call    sev_verify_cbit
+
+       /*
+        * Restore CR3 value without the phys_base which will be added
+        * below, before writing %cr3.
+        */
+        mov    %r14, %rax
+#endif
+
        jmp 1f
 SYM_CODE_END(startup_64)
 
@@ -192,15 +214,6 @@ SYM_INNER_LABEL(secondary_startup_64_no_verify, SYM_L_GLOBAL)
        /* Setup early boot stage 4-/5-level pagetables. */
        addq    phys_base(%rip), %rax
 
-       /*
-        * For SEV guests: Verify that the C-bit is correct. A malicious
-        * hypervisor could lie about the C-bit position to perform a ROP
-        * attack on the guest by writing to the unencrypted stack and wait for
-        * the next RET instruction.
-        */
-       movq    %rax, %rdi
-       call    sev_verify_cbit
-
        /*
         * Switch to new page-table
         *