similar to: [PATCH 14/70] x86/boot/compressed/64: Add page-fault handler

From: Joerg Roedel <jroedel at suse.de> Install a page-fault handler to add an identity mapping to addresses not yet mapped. Also do some checking whether the error code is sane. This makes non SEV-ES machines use the exception handling infrastructure in the pre-decompressions boot code too, making it less likely to break in the future. Signed-off-by: Joerg Roedel <jroedel at

On Tue, Apr 28, 2020 at 05:16:34PM +0200, Joerg Roedel wrote: > @@ -302,9 +313,13 @@ void do_boot_page_fault(struct pt_regs *regs, unsigned long error_code) > * - User faults > * - Reserved bits set > */ > - if (error_code & (X86_PF_PROT | X86_PF_USER | X86_PF_RSVD)) { > + if (ghcb_fault || > + error_code & (X86_PF_PROT | X86_PF_USER | X86_PF_RSVD)) { >

On Tue, Apr 28, 2020 at 05:16:34PM +0200, Joerg Roedel wrote: > @@ -302,9 +313,13 @@ void do_boot_page_fault(struct pt_regs *regs, unsigned long error_code) > * - User faults > * - Reserved bits set > */ > - if (error_code & (X86_PF_PROT | X86_PF_USER | X86_PF_RSVD)) { > + if (ghcb_fault || > + error_code & (X86_PF_PROT | X86_PF_USER | X86_PF_RSVD)) { >

From: Joerg Roedel <jroedel at suse.de> Add the first handler for #VC exceptions. At stage 1 there is no GHCB yet becaue we might still be on the EFI page table and thus can't map memory unencrypted. The stage 1 handler is limited to the MSR based protocol to talk to the hypervisor and can only support CPUID exit-codes, but that is enough to get to stage 2. Signed-off-by: Joerg Roedel

On Tue, Feb 11, 2020 at 5:53 AM Joerg Roedel <joro at 8bytes.org> wrote: > > From: Joerg Roedel <jroedel at suse.de> > > Add the first handler for #VC exceptions. At stage 1 there is no GHCB > yet becaue we might still be on the EFI page table and thus can't map > memory unencrypted. > > The stage 1 handler is limited to the MSR based protocol to talk to

On Tue, Feb 11, 2020 at 5:53 AM Joerg Roedel <joro at 8bytes.org> wrote: > > From: Joerg Roedel <jroedel at suse.de> > > Add the first handler for #VC exceptions. At stage 1 there is no GHCB > yet becaue we might still be on the EFI page table and thus can't map > memory unencrypted. > > The stage 1 handler is limited to the MSR based protocol to talk to

From: Joerg Roedel <jroedel at suse.de> Install an exception handler for #VC exception that uses a GHCB. Also add the infrastructure for handling different exit-codes by decoding the instruction that caused the exception and error handling. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/Kconfig | 1 + arch/x86/boot/compressed/idt_64.c

From: Joerg Roedel <jroedel at suse.de> Force a page-fault on any further accesses to the GHCB page when they shouldn't happen anymore. This will catch the bugs where a #VC exception is raised when no one is expected anymore. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/boot/compressed/ident_map_64.c | 23 +++++++++++++++++++---- arch/x86/boot/compressed/misc.h

From: Joerg Roedel <jroedel at suse.de> Add the first handler for #VC exceptions. At stage 1 there is no GHCB yet becaue we might still be on the EFI page table and thus can't map memory unencrypted. The stage 1 handler is limited to the MSR based protocol to talk to the hypervisor and can only support CPUID exit-codes, but that is enough to get to stage 2. Signed-off-by: Joerg Roedel

From: Joerg Roedel <jroedel at suse.de> Add the first handler for #VC exceptions. At stage 1 there is no GHCB yet becaue the kernel might still be running on the EFI page table. The stage 1 handler is limited to the MSR based protocol to talk to the hypervisor and can only support CPUID exit-codes, but that is enough to get to stage 2. Signed-off-by: Joerg Roedel <jroedel at

From: Joerg Roedel <jroedel at suse.de> The file contains only code related to identity mapped page-tables. Rename the file and compile it always in. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/boot/compressed/Makefile | 2 +- arch/x86/boot/compressed/{kaslr_64.c => ident_map_64.c} | 9 +++++++++ arch/x86/boot/compressed/kaslr.c

From: Joerg Roedel <jroedel at suse.de> Install an exception handler for #VC exception that uses a GHCB. Also add the infrastructure for handling different exit-codes by decoding the instruction that caused the exception and error handling. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/Kconfig | 1 + arch/x86/boot/compressed/Makefile

From: Joerg Roedel <jroedel at suse.de> Add code needed to setup an IDT in the early pre-decompression boot-code. The IDT is loaded first in startup_64, which is after EfiExitBootServices() has been called, and later reloaded when the kernel image has been relocated to the end of the decompression area. This allows to setup different IDT handlers before and after the relocation.

From: Joerg Roedel <jroedel at suse.de> Add code needed to setup an IDT in the early pre-decompression boot-code. The IDT is loaded first in startup_64, which is after EfiExitBootServices() has been called, and later reloaded when the kernel image has been relocated to the end of the decompression area. This allows to setup different IDT handlers before and after the relocation.

On Tue, Feb 11, 2020 at 5:53 AM Joerg Roedel <joro at 8bytes.org> wrote: > > From: Joerg Roedel <jroedel at suse.de> > > Add code needed to setup an IDT in the early pre-decompression > boot-code. The IDT is loaded first in startup_64, which is after > EfiExitBootServices() has been called, and later reloaded when the > kernel image has been relocated to the end of

Hi, here is the first public post of the patch-set to enable Linux to run under SEV-ES enabled hypervisors. The code is mostly feature-complete, but there are still a couple of bugs to fix. Nevertheless, given the size of the patch-set, I think it is about time to ask for initial feedback of the changes that come with it. To better understand the code here is a quick explanation of SEV-ES first.

Hi, here is the first public post of the patch-set to enable Linux to run under SEV-ES enabled hypervisors. The code is mostly feature-complete, but there are still a couple of bugs to fix. Nevertheless, given the size of the patch-set, I think it is about time to ask for initial feedback of the changes that come with it. To better understand the code here is a quick explanation of SEV-ES first.

On Thu, Mar 19, 2020 at 10:13:15AM +0100, Joerg Roedel wrote: > diff --git a/arch/x86/boot/compressed/idt_handlers_64.S b/arch/x86/boot/compressed/idt_handlers_64.S > index bfb3fc5aa144..67ddafab2943 100644 > --- a/arch/x86/boot/compressed/idt_handlers_64.S > +++ b/arch/x86/boot/compressed/idt_handlers_64.S > @@ -75,3 +75,7 @@ SYM_FUNC_END(\name) > .code64 > >

From: Joerg Roedel <jroedel at suse.de> Changing the function to take start and end as parameters instead of start and size simplifies the callers, which don't need to calculate the size if they already have start and end. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/boot/compressed/ident_map_64.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10

Hi, here is the next version of changes to enable Linux to run as an SEV-ES guest. The code was rebased to v5.7-rc3 and got a fair number of changes since the last version. What is SEV-ES ============== SEV-ES is an acronym for 'Secure Encrypted Virtualization - Encrypted State' and means a hardware feature of AMD processors which hides the register state of VCPUs to the hypervisor by