similar to: [PATCH 18/70] x86/boot/compressed/64: Add stage1 #VC handler

From: Joerg Roedel <jroedel at suse.de> Add the first handler for #VC exceptions. At stage 1 there is no GHCB yet becaue we might still be on the EFI page table and thus can't map memory unencrypted. The stage 1 handler is limited to the MSR based protocol to talk to the hypervisor and can only support CPUID exit-codes, but that is enough to get to stage 2. Signed-off-by: Joerg Roedel

On Tue, Feb 11, 2020 at 5:53 AM Joerg Roedel <joro at 8bytes.org> wrote: > > From: Joerg Roedel <jroedel at suse.de> > > Add the first handler for #VC exceptions. At stage 1 there is no GHCB > yet becaue we might still be on the EFI page table and thus can't map > memory unencrypted. > > The stage 1 handler is limited to the MSR based protocol to talk to

On Tue, Feb 11, 2020 at 5:53 AM Joerg Roedel <joro at 8bytes.org> wrote: > > From: Joerg Roedel <jroedel at suse.de> > > Add the first handler for #VC exceptions. At stage 1 there is no GHCB > yet becaue we might still be on the EFI page table and thus can't map > memory unencrypted. > > The stage 1 handler is limited to the MSR based protocol to talk to

On Thu, Mar 19, 2020 at 10:13:11AM +0100, Joerg Roedel wrote: > From: Joerg Roedel <jroedel at suse.de> > > Install a page-fault handler to add an identity mapping to addresses > not yet mapped. Also do some checking whether the error code is sane. > > This makes non SEV-ES machines use the exception handling > infrastructure in the pre-decompressions boot code too,

From: Joerg Roedel <jroedel at suse.de> Add the first handler for #VC exceptions. At stage 1 there is no GHCB yet becaue we might still be on the EFI page table and thus can't map memory unencrypted. The stage 1 handler is limited to the MSR based protocol to talk to the hypervisor and can only support CPUID exit-codes, but that is enough to get to stage 2. Signed-off-by: Joerg Roedel

From: Joerg Roedel <jroedel at suse.de> Add the first handler for #VC exceptions. At stage 1 there is no GHCB yet becaue the kernel might still be running on the EFI page table. The stage 1 handler is limited to the MSR based protocol to talk to the hypervisor and can only support CPUID exit-codes, but that is enough to get to stage 2. Signed-off-by: Joerg Roedel <jroedel at

From: Joerg Roedel <jroedel at suse.de> Install an exception handler for #VC exception that uses a GHCB. Also add the infrastructure for handling different exit-codes by decoding the instruction that caused the exception and error handling. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/Kconfig | 1 + arch/x86/boot/compressed/idt_64.c

From: Joerg Roedel <jroedel at suse.de> Install an exception handler for #VC exception that uses a GHCB. Also add the infrastructure for handling different exit-codes by decoding the instruction that caused the exception and error handling. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/Kconfig | 1 + arch/x86/boot/compressed/Makefile

From: Joerg Roedel <jroedel at suse.de> Install a page-fault handler to add an identity mapping to addresses not yet mapped. Also do some checking whether the error code is sane. This makes non SEV-ES machines use the exception handling infrastructure in the pre-decompressions boot code too, making it less likely to break in the future. Signed-off-by: Joerg Roedel <jroedel at

From: Joerg Roedel <jroedel at suse.de> Add code needed to setup an IDT in the early pre-decompression boot-code. The IDT is loaded first in startup_64, which is after EfiExitBootServices() has been called, and later reloaded when the kernel image has been relocated to the end of the decompression area. This allows to setup different IDT handlers before and after the relocation.

From: Joerg Roedel <jroedel at suse.de> Add code needed to setup an IDT in the early pre-decompression boot-code. The IDT is loaded first in startup_64, which is after EfiExitBootServices() has been called, and later reloaded when the kernel image has been relocated to the end of the decompression area. This allows to setup different IDT handlers before and after the relocation.

On Tue, Feb 11, 2020 at 5:53 AM Joerg Roedel <joro at 8bytes.org> wrote: > > From: Joerg Roedel <jroedel at suse.de> > > Add code needed to setup an IDT in the early pre-decompression > boot-code. The IDT is loaded first in startup_64, which is after > EfiExitBootServices() has been called, and later reloaded when the > kernel image has been relocated to the end of

On Tue, Apr 28, 2020 at 05:16:23PM +0200, Joerg Roedel wrote: > diff --git a/arch/x86/boot/compressed/idt_handlers_64.S b/arch/x86/boot/compressed/idt_handlers_64.S > new file mode 100644 > index 000000000000..f86ea872d860 > --- /dev/null > +++ b/arch/x86/boot/compressed/idt_handlers_64.S > @@ -0,0 +1,69 @@ > +/* SPDX-License-Identifier: GPL-2.0-only */ > +/* > + * Early

On Tue, Apr 28, 2020 at 05:16:23PM +0200, Joerg Roedel wrote: > diff --git a/arch/x86/boot/compressed/idt_handlers_64.S b/arch/x86/boot/compressed/idt_handlers_64.S > new file mode 100644 > index 000000000000..f86ea872d860 > --- /dev/null > +++ b/arch/x86/boot/compressed/idt_handlers_64.S > @@ -0,0 +1,69 @@ > +/* SPDX-License-Identifier: GPL-2.0-only */ > +/* > + * Early

On Mon, May 04, 2020 at 12:54:45PM +0200, Borislav Petkov wrote: > On Tue, Apr 28, 2020 at 05:16:23PM +0200, Joerg Roedel wrote: > > diff --git a/arch/x86/boot/compressed/idt_handlers_64.S b/arch/x86/boot/compressed/idt_handlers_64.S > > new file mode 100644 > > index 000000000000..f86ea872d860 > > --- /dev/null > > +++ b/arch/x86/boot/compressed/idt_handlers_64.S

Hi, here is the first public post of the patch-set to enable Linux to run under SEV-ES enabled hypervisors. The code is mostly feature-complete, but there are still a couple of bugs to fix. Nevertheless, given the size of the patch-set, I think it is about time to ask for initial feedback of the changes that come with it. To better understand the code here is a quick explanation of SEV-ES first.

Hi, here is the first public post of the patch-set to enable Linux to run under SEV-ES enabled hypervisors. The code is mostly feature-complete, but there are still a couple of bugs to fix. Nevertheless, given the size of the patch-set, I think it is about time to ask for initial feedback of the changes that come with it. To better understand the code here is a quick explanation of SEV-ES first.

From: Joerg Roedel <jroedel at suse.de> Setup an early handler for #VC exceptions. There is no GHCB mapped yet, so just re-use the vc_no_ghcb_handler. It can only handle CPUID exit-codes, but that should be enough to get the kernel through verify_cpu() and __startup_64() until it runs on virtual addresses. Signed-off-by: Joerg Roedel <jroedel at suse.de> ---

From: Joerg Roedel <jroedel at suse.de> Setup an early handler for #VC exceptions. There is no GHCB mapped yet, so just re-use the vc_no_ghcb_handler. It can only handle CPUID exit-codes, but that should be enough to get the kernel through verify_cpu() and __startup_64() until it runs on virtual addresses. Signed-off-by: Joerg Roedel <jroedel at suse.de> Link:

From: Joerg Roedel <jroedel at suse.de> The file contains only code related to identity mapped page-tables. Rename the file and compile it always in. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/boot/compressed/Makefile | 2 +- arch/x86/boot/compressed/{kaslr_64.c => ident_map_64.c} | 9 +++++++++ arch/x86/boot/compressed/kaslr.c