similar to: [PATCH 12/70] x86/boot/compressed/64: Add IDT Infrastructure

From: Joerg Roedel <jroedel at suse.de> Add code needed to setup an IDT in the early pre-decompression boot-code. The IDT is loaded first in startup_64, which is after EfiExitBootServices() has been called, and later reloaded when the kernel image has been relocated to the end of the decompression area. This allows to setup different IDT handlers before and after the relocation.

Hi Arvind, On Thu, Aug 27, 2020 at 11:26:57AM -0400, Arvind Sankar wrote: > On Mon, Aug 24, 2020 at 10:54:08AM +0200, Joerg Roedel wrote: > > + pushq %rsi > > + call load_stage1_idt > > + popq %rsi > > + > > Do we need the functions later in the series or could this just use lidt > directly? The function also sets up the actual IDT entries in the table before

From: Joerg Roedel <jroedel at suse.de> Add code needed to setup an IDT in the early pre-decompression boot-code. The IDT is loaded first in startup_64, which is after EfiExitBootServices() has been called, and later reloaded when the kernel image has been relocated to the end of the decompression area. This allows to setup different IDT handlers before and after the relocation.

On Tue, Feb 11, 2020 at 5:53 AM Joerg Roedel <joro at 8bytes.org> wrote: > > From: Joerg Roedel <jroedel at suse.de> > > Add code needed to setup an IDT in the early pre-decompression > boot-code. The IDT is loaded first in startup_64, which is after > EfiExitBootServices() has been called, and later reloaded when the > kernel image has been relocated to the end of

Joerg Roedel <joro at 8bytes.org> writes: > + addq $8, %rsp > + > + /* > + * Make sure we return to __KERNEL_CS - the CS selector on > + * the IRET frame might still be from an old BIOS GDT > + */ > + movq $__KERNEL_CS, 8(%rsp) This doesn't make sense. Either it's running on the correct CS before the exception or not. Likely there's some other problem

On Mon, May 18, 2020 at 10:23:13AM +0200, Borislav Petkov wrote: > On Tue, Apr 28, 2020 at 05:16:41PM +0200, Joerg Roedel wrote: > > @@ -480,6 +500,22 @@ SYM_DATA_LOCAL(early_gdt_descr_base, .quad INIT_PER_CPU_VAR(gdt_page)) > > SYM_DATA(phys_base, .quad 0x0) > > EXPORT_SYMBOL(phys_base) > > > > +/* Boot GDT used when kernel addresses are not mapped yet */ >

From: Joerg Roedel <jroedel at suse.de> When the pre-decompression code loads its first GDT in startup_64, it is still running on the CS value of the previous GDT. In the case of SEV-ES this is the EFI GDT. To make exception handling work (especially IRET) the CPU needs to switch to a CS value in the current GDT, so jump to __KERNEL_CS after the first GDT is loaded. Signed-off-by: Joerg

On Tue, Apr 28, 2020 at 05:16:23PM +0200, Joerg Roedel wrote: > diff --git a/arch/x86/boot/compressed/idt_handlers_64.S b/arch/x86/boot/compressed/idt_handlers_64.S > new file mode 100644 > index 000000000000..f86ea872d860 > --- /dev/null > +++ b/arch/x86/boot/compressed/idt_handlers_64.S > @@ -0,0 +1,69 @@ > +/* SPDX-License-Identifier: GPL-2.0-only */ > +/* > + * Early

On Tue, Apr 28, 2020 at 05:16:23PM +0200, Joerg Roedel wrote: > diff --git a/arch/x86/boot/compressed/idt_handlers_64.S b/arch/x86/boot/compressed/idt_handlers_64.S > new file mode 100644 > index 000000000000..f86ea872d860 > --- /dev/null > +++ b/arch/x86/boot/compressed/idt_handlers_64.S > @@ -0,0 +1,69 @@ > +/* SPDX-License-Identifier: GPL-2.0-only */ > +/* > + * Early

On Tue, Apr 28, 2020 at 05:16:22PM +0200, Joerg Roedel wrote: > From: Joerg Roedel <jroedel at suse.de> > > When the pre-decompression code loads its first GDT in startup_64, it is > still running on the CS value of the previous GDT. In the case of SEV-ES > this is the EFI GDT. > > To make exception handling work (especially IRET) the CPU needs to > switch to a CS

On Mon, May 04, 2020 at 12:54:45PM +0200, Borislav Petkov wrote: > On Tue, Apr 28, 2020 at 05:16:23PM +0200, Joerg Roedel wrote: > > diff --git a/arch/x86/boot/compressed/idt_handlers_64.S b/arch/x86/boot/compressed/idt_handlers_64.S > > new file mode 100644 > > index 000000000000..f86ea872d860 > > --- /dev/null > > +++ b/arch/x86/boot/compressed/idt_handlers_64.S

From: Joerg Roedel <jroedel at suse.de> Handling exceptions during boot requires a working GDT. The kernel GDT is not yet ready for use, so install a temporary boot GDT. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/kernel/head_64.S | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S

From: Joerg Roedel <jroedel at suse.de> Handling exceptions during boot requires a working GDT. The kernel GDT is not yet ready for use, so install a temporary boot GDT. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/kernel/head_64.S | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/arch/x86/kernel/head_64.S

Descriptor and trap table cleanups. Add cleanly written accessors for IDT and GDT gates so the subarch may override them. Note that this allows the hypervisor to transparently tweak the DPL of the descriptors as well as the RPL of segments in those descriptors, with no unnecessary kernel code modification. It also allows the hypervisor implementation of the VMI to tweak the gates, allowing for

Descriptor and trap table cleanups. Add cleanly written accessors for IDT and GDT gates so the subarch may override them. Note that this allows the hypervisor to transparently tweak the DPL of the descriptors as well as the RPL of segments in those descriptors, with no unnecessary kernel code modification. It also allows the hypervisor implementation of the VMI to tweak the gates, allowing for

On Tue, Feb 11, 2020 at 5:53 AM Joerg Roedel <joro at 8bytes.org> wrote: > > From: Joerg Roedel <jroedel at suse.de> > > Handling exceptions during boot requires a working GDT. The kernel GDT > is not yet ready for use, so install a temporary boot GDT. > > Signed-off-by: Joerg Roedel <jroedel at suse.de> > --- > arch/x86/kernel/head_64.S | 26

From: Sylvain Gault <sylvain.gault at gmail.com> The assembly instruction lgdt take a segment limit that is one less than the actual size, so that base+limit points to the last byte. Signed-off-by: Sylvain Gault <sylvain.gault at gmail.com> --- efi/main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/efi/main.c b/efi/main.c index 94878f9..bdf9353 100644

From: Joerg Roedel <jroedel at suse.de> Call set_sev_encryption_mask() while still on the stage 1 #VC-handler, because the stage 2 handler needs our own page-tables to be set up, to which calling set_sev_encryption_mask() is a prerequisite. Signed-off-by: Joerg Roedel <jroedel at suse.de> Link: https://lore.kernel.org/r/20200724160336.5435-20-joro at 8bytes.org ---

From: Joerg Roedel <jroedel at suse.de> The IDT on 64bit contains vectors which use paranoid_entry() and/or IST stacks. To make these vectors work the TSS and the getcpu GDT entry need to be set up before the IDT is loaded. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/include/asm/processor.h | 1 + arch/x86/kernel/cpu/common.c | 23 +++++++++++++++++++++++

On Thu, Aug 27, 2020 at 12:01:13PM -0400, Arvind Sankar wrote: > Wouldn't we rather just remove the checks? I think that's a different topic to be discussed with the KVM maintainers. For now I will add defines for the magic numbers. Regards, Joerg