similar to: RE: [PATCH] [VT] SMP VMX guest AP bring up need calldo_boot_vcpu in hypervisor

Hi Keir, this patch changes common code of xen hypervisor, but seems we have to, because current call to do_boot_vcpu is always from domains, however, for SMP VMX guest AP bring up, we need call it from xen hypervisor, so we''d like to split it. What''s your opinion? _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com

From: Tom Lendacky <thomas.lendacky at amd.com> As part of the GHCB specification, the booting of APs under SEV-ES requires an AP jump table when transitioning from one layer of code to another (e.g. when going from UEFI to the OS). As a result, each layer that parks an AP must provide the physical address of an AP jump table to the next layer via the hypervisor. Upon booting of the

From: Tom Lendacky <thomas.lendacky at amd.com> Setup the AP jump table to point to the SEV-ES trampoline code so that the APs can boot. Signed-off-by: Tom Lendacky <thomas.lendacky at amd.com> [ jroedel at suse.de: - Adapted to different code base - Moved AP table setup from SIPI sending path to real-mode setup code - Fix sparse warnings ]

This patch clean up VMX builder. Since now we have vmxloader, old code loading linux kernel directly is not needed. 1. remove linux parameters. 2. remove init ramdisk. 3. remove e820 memmap config file parse. Also e820 map handling code is changed in vmx_setup_platform. 4. remove provisional GDT, and construct_init_guest_vmcs is updated greatly. 5. remove some ugly tailing space. Thanks Keir for

On Mon, Aug 24, 2020 at 10:55:04AM +0200, Joerg Roedel wrote: > diff --git a/arch/x86/include/uapi/asm/svm.h b/arch/x86/include/uapi/asm/svm.h > index 8f36ae021a7f..a19ce9681ec2 100644 > --- a/arch/x86/include/uapi/asm/svm.h > +++ b/arch/x86/include/uapi/asm/svm.h > @@ -84,6 +84,9 @@ > /* SEV-ES software-defined VMGEXIT events */ > #define SVM_VMGEXIT_MMIO_READ 0x80000001

Ian, Keir, This patch is to boot 32-bit VMX guest on the 64-bit host. Double-compile is used to make both 64-bit guest and 32-bit guest can work, the shadow page-table uses current 64-bit shadow code''s structure to simulate 32-bit guest''s 2-level page-table. Signed-off-by: Chengyuan Li <chengyuan.li@intel.com> Signed-off-by: Xiaohui Xin <xiaohui.xin@intel.com>

From: Tom Lendacky <thomas.lendacky at amd.com> Add handler for VC exceptions caused by MMIO intercepts. These intercepts come along as nested page faults on pages with reserved bits set. Signed-off-by: Tom Lendacky <thomas.lendacky at amd.com> [ jroedel at suse.de: Adapt to VC handling framework ] Co-developed-by: Joerg Roedel <jroedel at suse.de> Signed-off-by: Joerg Roedel

From: Mihai Don?u <mdontu at bitdefender.com> This is needed in order to be able to support guest code that uses movsd to write into pages that are marked for write tracking. Signed-off-by: Mihai Don?u <mdontu at bitdefender.com> Signed-off-by: Adalbert Laz?r <alazar at bitdefender.com> --- arch/x86/kvm/emulate.c | 32 +++++++++++++++++++++++++++----- 1 file changed, 27

From: Joerg Roedel <jroedel at suse.de> Setup sev-es.c and include the code from the pre-decompression stage to also build it into the image of the running kernel. Temporarily add __maybe_unused annotations to avoid build warnings until the functions get used. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/kernel/Makefile | 1 +

From: Joerg Roedel <jroedel at suse.de> When a #VC exception is triggered by user-space the instruction decoder needs to read the instruction bytes from user addresses. Enhance vc_decode_insn() to safely fetch kernel and user instructions. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/kernel/sev-es.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22

From: Tom Lendacky <thomas.lendacky at amd.com> Add handler for VC exceptions caused by MMIO intercepts. These intercepts come along as nested page faults on pages with reserved bits set. Signed-off-by: Tom Lendacky <thomas.lendacky at amd.com> [ jroedel at suse.de: Adapt to VC handling framework ] Co-developed-by: Joerg Roedel <jroedel at suse.de> Signed-off-by: Joerg Roedel

The following patch (relative to -current) makes PAM a proper kbd-interactive citizen. There are a few limitations (grep for todo), but the code seems to work OK for protocols 1 & 2 with and without privsep. Please have a play! auth2-pam.c is based on code from FreeBSD. Index: auth2-chall.c =================================================================== RCS file:

From: Mike Stunes <mstunes at vmware.com> To avoid a future VMEXIT for a subsequent CPUID function, cache the results returned by CPUID into an xarray. [tl: coding standard changes, register zero extension] Signed-off-by: Mike Stunes <mstunes at vmware.com> Signed-off-by: Tom Lendacky <thomas.lendacky at amd.com> [ jroedel at suse.de: - Wrapped cache handling into

Below is a new PAM kbd-int diff based on FreeBSD's code. This code makes PAM kbd-int work with privilege separation. Contrary to what I have previously stated - it *does* handle multiple prompts. What it does not handle is multiple passes through the PAM conversation function, which would be required for expired password changing. I would really appreciate some additional eyes over the

From: Joerg Roedel <jroedel at suse.de> Add handling for emulation the MOVS instruction on MMIO regions, as done by the memcpy_toio() and memcpy_fromio() functions. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/kernel/sev-es.c | 78 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) diff --git a/arch/x86/kernel/sev-es.c

The following is a patch (based on FreeBSD code) which gets kbd-int working with privsep. It moves the kbd-int PAM conversation to a child process and communicates with it over a socket. The patch has a limitation: it does not handle multiple prompts - I have no idea how common these are in real-life. Furthermore it is not well tested at all (despite my many requests on openssh-unix-dev@). -d

From: Tom Lendacky <thomas.lendacky at amd.com> Add code to handle #VC exceptions on DR7 register reads and writes. This is needed early because show_regs() reads DR7 to print it out. Under SEV-ES there is currently no support for saving/restoring the DRx registers, but software expects to be able to write to the DR7 register. For now, cache the value written to DR7 and return it on read

From: Joerg Roedel <jroedel at suse.de> Install an exception handler for #VC exception that uses a GHCB. Also add the infrastructure for handling different exit-codes by decoding the instruction that caused the exception and error handling. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/Kconfig | 1 + arch/x86/boot/compressed/idt_64.c

>------- Original Message ------- >Sender : Julien Grall<julien.grall@linaro.org> >Date : 2013-10-07 21:49 (GMT+09:00) >Title : Re: [Xen-devel] [PATCH v4 1/9] xen/arm: Implement hvm save and restore > >On 10/04/2013 05:43 AM, Jaeyong Yoo wrote: >> Implement save/restore of hvm context hypercall. In hvm >> context save/restore, we save gic, timer and vfp

From: Joerg Roedel <jroedel at suse.de> Add the infrastructure to handle #VC exceptions when the kernel runs on virtual addresses and has a GHCB mapped. This handler will be used until the runtime #VC handler takes over. Signed-off-by: Joerg Roedel <jroedel at suse.de> --- arch/x86/include/asm/segment.h | 2 +- arch/x86/include/asm/sev-es.h | 1 + arch/x86/kernel/head64.c