CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/11/11 11:32:23
Modified files:
usr.sbin/vmd : sev.c vmd.h x86_vm.c
Log message:
vmd(8): Keep SEV memory segments within a single memrange
sev_register_encryption() derived the host VA from find_gpa_range()
plus its own offset arithmetic and recorded the caller's length as
a flat span. A segment crossing a memrange boundary thus produced
a host VA range extending past the mapping it was taken from, which
was then handed to the PSP for in-place encryption.
Translate through hvaddr_mem() instead, which enforces that the
whole span lies within one memrange, and align address and length
to the AES-XTS block size before validating so the checked length
is the one sent to the PSP.
Also sort the recorded segments and merge overlapping ones before
LAUNCH_UPDATE_DATA. Segments sharing a 16-byte block (e.g. .symtab
and .strtab) or fully contained in another (.openbsd.randomdata
inside the rodata PT_LOAD) were otherwise encrypted twice, corrupting
the data. Adjacent but non-overlapping segments are kept apart,
as they may live in different memranges.
While there, remove a stray '\n' in a log_warnx() call.
ok dv@
