[PATCH v4 00/75] x86: SEV-ES Guest Support

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Hi, here is the fourth version of the SEV-ES Guest Support patches. I addressed the review comments sent to me for the previous version and rebased the code v5.8-rc5. The biggest change in this version is the IST handling code for the #VC handler. I adapted the entry code

[PATCH v4 14/75] x86/boot/compressed/64: Add page-fault handler

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Install a page-fault handler to add an identity mapping to addresses not yet mapped. Also do some checking whether the error code is sane. This makes non SEV-ES machines use the exception handling infrastructure in the pre-decompressions boot code too, making it less likely

[PATCH v4 15/75] x86/boot/compressed/64: Always switch to own page-table

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel When booted through startup_64 the kernel keeps running on the EFI page-table until the KASLR code sets up its own page-table. Without KASLR the pre-decompression boot code never switches off the EFI page-table. Change that by unconditionally switching to a kernel controlled

[PATCH v4 13/75] x86/boot/compressed/64: Rename kaslr_64.c to ident_map_64.c

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel The file contains only code related to identity mapped page-tables. Rename the file and compile it always in. Signed-off-by: Joerg Roedel --- arch/x86/boot/compressed/Makefile | 2 +- arch/x86/boot/compressed/{kaslr_64.c => ident_map_64.c}

[PATCH v4 19/75] x86/boot/compressed/64: Call set_sev_encryption_mask earlier

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Call set_sev_encryption_mask() while still on the stage 1 #VC-handler, because the stage 2 handler needs our own page-tables to be set up, to which calling set_sev_encryption_mask() is a prerequisite. Signed-off-by: Joerg Roedel --- arch/x86/boot/compressed/head_64.S

[PATCH v4 12/75] x86/boot/compressed/64: Add IDT Infrastructure

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Add code needed to setup an IDT in the early pre-decompression boot-code. The IDT is loaded first in startup_64, which is after EfiExitBootServices() has been called, and later reloaded when the kernel image has been relocated to the end of the decompression area. This allows

[PATCH v4 10/75] x86/insn: Add insn_has_rep_prefix() helper

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Add a function to check whether an instruction has a REP prefix. Signed-off-by: Joerg Roedel --- arch/x86/include/asm/insn-eval.h | 1 + arch/x86/lib/insn-eval.c | 24 2 files changed, 25 insertions(+) diff --git a/arch/x86/include/asm

[PATCH v4 17/75] x86/boot/compressed/64: Change add_identity_map() to take start and end

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Changing the function to take start and end as parameters instead of start and size simplifies the callers, which don't need to calculate the size if they already have start and end. Signed-off-by: Joerg Roedel --- arch/x86/boot/compressed/ident_map_64.c | 15

[PATCH v4 25/75] x86/fpu: Move xgetbv()/xsetbv() into separate header

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel The xgetbv() function is needed in pre-decompression boot code, but asm/fpu/internal.h can't be included there directly. Doing so opens the door to include-hell due to various include-magic in boot/compressed/misc.h. Avoid that by moving xgetbv()/xsetbv() to a separate header

[PATCH v4 29/75] x86/idt: Move two function from k/idt.c to i/a/desc.h

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Move these two functions from kernel/idt.c to include/asm/desc.h: * init_idt_data() * idt_init_desc() These functions are needed to setup IDT entries very early and need to be called from head64.c. To be usable this early these functions need to be compiled

[PATCH v4 18/75] x86/boot/compressed/64: Add stage1 #VC handler

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Add the first handler for #VC exceptions. At stage 1 there is no GHCB yet becaue the kernel might still be running on the EFI page table. The stage 1 handler is limited to the MSR based protocol to talk to the hypervisor and can only support CPUID exit-codes

[PATCH v4 21/75] x86/boot/compressed/64: Add set_page_en/decrypted() helpers

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel The functions are needed to map the GHCB for SEV-ES guests. The GHCB is used for communication with the hypervisor, so its content must not be encrypted. After the GHCB is not needed anymore it must be mapped encrypted again so that the running kernel image can safely re-use

[PATCH v4 28/75] x86/idt: Split idt_data setup out of set_intr_gate()

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel The code to setup idt_data is needed for early exception handling, but set_intr_gate() can't be used that early because it has pv-ops in its code path, which don't work that early. Split out the idt_data initialization part from set_intr_gate() so that it can be used

[PATCH v4 20/75] x86/boot/compressed/64: Check return value of kernel_ident_mapping_init()

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel The function can fail to create an identity mapping, check for that and bail out if it happens. Signed-off-by: Joerg Roedel --- arch/x86/boot/compressed/ident_map_64.c | 7 +-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/x86/boot/compressed

[PATCH v4 22/75] x86/boot/compressed/64: Setup GHCB Based VC Exception handler

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Install an exception handler for #VC exception that uses a GHCB. Also add the infrastructure for handling different exit-codes by decoding the instruction that caused the exception and error handling. Signed-off-by: Joerg Roedel --- arch/x86/Kconfig

[PATCH v4 27/75] x86/idt: Move IDT to data segment

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel With SEV-ES, exception handling is needed very early, even before the kernel has cleared the bss segment. In order to prevent clearing the currently used IDT, move the IDT to the data segment. Signed-off-by: Joerg Roedel --- arch/x86/kernel/idt.c | 2 +- 1 file changed, 1

[PATCH v4 16/75] x86/boot/compressed/64: Don't pre-map memory in KASLR code

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel With the page-fault handler in place the identity mapping can be built on-demand. So remove the code which manually creates the mappings and unexport/remove the functions used for it. Signed-off-by: Joerg Roedel --- arch/x86/boot/compressed/ident_map_64.c | 6 ++ arch

[PATCH v4 33/75] x86/head/64: Switch to initial stack earlier

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Make sure there is a stack once the kernel runs from virual addresses. At this stage any secondary CPU which boots will have lost its stack because the kernel switched to a new page-table which does not map the real-mode stack anymore. This is needed for handling early #VC

[PATCH v4 34/75] x86/head/64: Build k/head64.c with -fno-stack-protector

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel The code inserted by the stack protector does not work in the early boot environment because it uses the GS segment, at least with memory encryption enabled. Make sure the early code is compiled without this feature enabled. Signed-off-by: Joerg Roedel --- arch/x86/kernel

[PATCH v4 35/75] x86/head/64: Load IDT earlier

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Load the IDT right after switching to virtual addresses in head_64.S so that the kernel can handle #VC exceptions. Signed-off-by: Joerg Roedel --- arch/x86/include/asm/setup.h | 2 ++ arch/x86/kernel/head64.c | 18 ++ arch/x86/kernel/head_64.S| 28

[PATCH v4 32/75] x86/head/64: Load segment registers earlier

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Make sure segments are properly set up before setting up an IDT and doing anything that might cause a #VC exception. This is later needed for early exception handling. Signed-off-by: Joerg Roedel --- arch/x86/kernel/head_64.S | 52 +++ 1

[PATCH v4 36/75] x86/head/64: Move early exception dispatch to C code

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Move the assembly coded dispatch between page-faults and all other exceptions to C code to make it easier to maintain and extend. Also change the return-type of early_make_pgtable() to bool and make it static. Signed-off-by: Joerg Roedel --- arch/x86/include/asm/pgtable.h

[PATCH v4 30/75] x86/head/64: Install boot GDT

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Handling exceptions during boot requires a working GDT. The kernel GDT is not yet ready for use, so install a temporary boot GDT. Signed-off-by: Joerg Roedel --- arch/x86/kernel/head64.c | 19 +++ arch/x86/kernel/head_64.S | 20 2 files

[PATCH v4 40/75] x86/sev-es: Setup early #VC handler

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Setup an early handler for #VC exceptions. There is no GHCB mapped yet, so just re-use the vc_no_ghcb_handler. It can only handle CPUID exit-codes, but that should be enough to get the kernel through verify_cpu() and __startup_64() until it runs on virtual addresses. Signed

[PATCH v4 37/75] x86/sev-es: Add SEV-ES Feature Detection

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Add the sev_es_active function for checking whether SEV-ES is enabled. Also cache the value of MSR_AMD64_SEV at boot to speed up the feature checking in the running code. Signed-off-by: Joerg Roedel --- arch/x86/include/asm/mem_encrypt.h | 3 +++ arch/x86/include/asm/msr

[PATCH v4 38/75] x86/sev-es: Print SEV-ES info into kernel log

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Refactor the message printed to the kernel log which indicates whether SEV or SME is active to print a list of enabled encryption features. This will scale better in the future when more memory encryption features might be added. Also add SEV-ES to the list of features

[PATCH v4 43/75] x86/sev-es: Allocate and Map stacks for #VC handler

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Allocate and map an IST stack and a fall-back stack for the #VC handler. The memory for the stacks is allocated only when SEV-ES is active. The #VC handler needs to use an IST stack because it could be raised from kernel space with unsafe stack, e.g. in the SYSCALL entry path

[PATCH v4 47/75] x86/entry/64: Add entry code for #VC handler

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel The #VC handler needs special entry code because: 1. It runs on an IST stack 2. It needs to be able to handle nested #VC exceptions To make this work the entry code is implemented to pretend it doesn't use an IST stack. When entered from user-mode or early

[PATCH v4 44/75] x86/sev-es: Allocate and setup IST entry for #VC

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Allocate IST entry number 4 for the #VC handler and setup it up in the per-cpu TSS. This will setup the TSS for all CPUs before they even start, so that the boot-code for secondary CPUs can handle #VC exceptions. Signed-off-by: Joerg Roedel --- arch/x86/include/asm

[PATCH v4 46/75] x86/dumpstack/64: Add noinstr version of get_stack_info()

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel The get_stack_info functionality is needed in the entry code for the #VC exception handler. Provide a version of it in the .text.noinstr section which can be called safely from there. Signed-off-by: Joerg Roedel --- arch/x86/include/asm/stacktrace.h | 2 ++ arch/x86/kernel

[PATCH v4 42/75] x86/sev-es: Setup per-cpu GHCBs for the runtime handler

2020-07-14 Thread Joerg Roedel
From: Tom Lendacky The runtime handler needs a GHCB per CPU. Set them up and map them unencrypted. Signed-off-by: Tom Lendacky Signed-off-by: Joerg Roedel --- arch/x86/include/asm/mem_encrypt.h | 2 ++ arch/x86/kernel/sev-es.c | 56 +- arch/x86/kernel

[PATCH v4 39/75] x86/sev-es: Compile early handler code into kernel image

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Setup sev-es.c and include the code from the pre-decompression stage to also build it into the image of the running kernel. Temporarily add __maybe_unused annotations to avoid build warnings until the functions get used. Signed-off-by: Joerg Roedel --- arch/x86/kernel

[PATCH v4 26/75] x86/sev-es: Add CPUID handling to #VC handler

2020-07-14 Thread Joerg Roedel
From: Tom Lendacky Handle #VC exceptions caused by CPUID instructions. These happen in early boot code when the KASLR code checks for RDTSC. Signed-off-by: Tom Lendacky [ jroe...@suse.de: Adapt to #VC handling framework ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg Roedel --- arch

[PATCH v4 57/75] x86/sev-es: Handle RDPMC Events

2020-07-14 Thread Joerg Roedel
From: Tom Lendacky Implement a handler for #VC exceptions caused by RDPMC instructions. Signed-off-by: Tom Lendacky [ jroe...@suse.de: Adapt to #VC handling infrastructure ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg Roedel --- arch/x86/kernel/sev-es.c | 22 ++ 1

[PATCH v4 45/75] x86/sev-es: Adjust #VC IST Stack on entering NMI handler

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel When an NMI hits in the #VC handler entry code before it switched to another stack, any subsequent #VC exception in the NMI code-path will overwrite the interrupted #VC handlers stack. Make sure this doesn't happen by explicitly adjusting the #VC IST entry in the NMI handler

[PATCH v4 31/75] x86/head/64: Reload GDT after switch to virtual addresses

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Reload the GDT after switching to virtual addresses to make sure it will not go away when the lower mappings are removed. This will also reload the GDT for booting APs, which will need a working GDT too to handle #VC exceptions. Signed-off-by: Joerg Roedel --- arch/x86

[PATCH v4 53/75] x86/sev-es: Handle MSR events

2020-07-14 Thread Joerg Roedel
From: Tom Lendacky Implement a handler for #VC exceptions caused by RDMSR/WRMSR instructions. Signed-off-by: Tom Lendacky [ jroe...@suse.de: Adapt to #VC handling infrastructure ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg Roedel --- arch/x86/kernel/sev-es.c | 28

[PATCH v4 54/75] x86/sev-es: Handle DR7 read/write events

2020-07-14 Thread Joerg Roedel
register. For now, cache the value written to DR7 and return it on read attempts, but do not touch the real hardware DR7. Signed-off-by: Tom Lendacky [ jroe...@suse.de: - Adapt to #VC handling framework - Support early usage ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg

[PATCH v4 52/75] x86/sev-es: Handle MMIO String Instructions

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Add handling for emulation the MOVS instruction on MMIO regions, as done by the memcpy_toio() and memcpy_fromio() functions. Signed-off-by: Joerg Roedel --- arch/x86/kernel/sev-es.c | 77 1 file changed, 77 insertions(+) diff --git

[PATCH v4 48/75] x86/sev-es: Add Runtime #VC Exception Handler

2020-07-14 Thread Joerg Roedel
From: Tom Lendacky Add the handlers for #VC exceptions invoked at runtime. Signed-off-by: Tom Lendacky Signed-off-by: Joerg Roedel --- arch/x86/include/asm/idtentry.h | 5 + arch/x86/kernel/idt.c | 11 +- arch/x86/kernel/sev-es.c| 231 +++- 3

[PATCH v4 58/75] x86/sev-es: Handle INVD Events

2020-07-14 Thread Joerg Roedel
From: Tom Lendacky Implement a handler for #VC exceptions caused by INVD instructions. Since Linux should never use INVD, just mark it as unsupported. Signed-off-by: Tom Lendacky [ jroe...@suse.de: Adapt to #VC handling infrastructure ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg

[PATCH v4 65/75] x86/kvm: Add KVM specific VMMCALL handling under SEV-ES

2020-07-14 Thread Joerg Roedel
From: Tom Lendacky Implement the callbacks to copy the processor state required by KVM to the GHCB. Signed-off-by: Tom Lendacky [ jroe...@suse.de: - Split out of a larger patch - Adapt to different callback functions ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg

[PATCH v4 60/75] x86/sev-es: Handle MWAIT/MWAITX Events

2020-07-14 Thread Joerg Roedel
From: Tom Lendacky Implement a handler for #VC exceptions caused by MWAIT and MWAITX instructions. Signed-off-by: Tom Lendacky [ jroe...@suse.de: Adapt to #VC handling infrastructure ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg Roedel --- arch/x86/kernel/sev-es.c | 10 ++ 1

[PATCH v4 59/75] x86/sev-es: Handle MONITOR/MONITORX Events

2020-07-14 Thread Joerg Roedel
From: Tom Lendacky Implement a handler for #VC exceptions caused by MONITOR and MONITORX instructions. Signed-off-by: Tom Lendacky [ jroe...@suse.de: Adapt to #VC handling infrastructure ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg Roedel --- arch/x86/kernel/sev-es.c | 13

[PATCH v4 62/75] x86/sev-es: Handle #AC Events

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Implement a handler for #VC exceptions caused by #AC exceptions. The #AC exception is just forwarded to do_alignment_check() and not pushed down to the hypervisor, as requested by the SEV-ES GHCB Standardization Specification. Signed-off-by: Joerg Roedel --- arch/x86/kernel

[PATCH v4 70/75] x86/head/64: Don't call verify_cpu() on starting APs

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel The APs are not ready to handle exceptions when verify_cpu() is called in secondary_startup_64. Signed-off-by: Joerg Roedel --- arch/x86/include/asm/realmode.h | 1 + arch/x86/kernel/head_64.S | 1 + arch/x86/realmode/init.c| 6 ++ 3 files changed, 8

[PATCH v4 69/75] x86/head/64: Setup TSS early for secondary CPUs

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel The #VC exception will trigger very early in head_64.S, when the first CPUID instruction is executed. When secondary CPUs boot, they already load the real system IDT, which has the #VC handler configured to use an IST stack. IST stacks require a TSS to be loaded, so set up

[PATCH v4 64/75] x86/paravirt: Allow hypervisor specific VMMCALL handling under SEV-ES

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Add two new paravirt callbacks to provide hypervisor specific processor state in the GHCB and to copy state from the hypervisor back to the processor. Signed-off-by: Joerg Roedel --- arch/x86/include/asm/x86_init.h | 16 +++- arch/x86/kernel/sev-es.c| 12

[PATCH v4 68/75] x86/realmode: Setup AP jump table

2020-07-14 Thread Joerg Roedel
sparse warnings ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg Roedel --- arch/x86/include/asm/sev-es.h | 5 +++ arch/x86/include/uapi/asm/svm.h | 3 ++ arch/x86/kernel/sev-es.c| 68 + arch/x86/realmode/init.c| 18 - 4 files changed

[PATCH v4 66/75] x86/vmware: Add VMware specific handling for VMMCALL under SEV-ES

2020-07-14 Thread Joerg Roedel
From: Doug Covelli Add VMware specific handling for #VC faults caused by VMMCALL instructions. Signed-off-by: Doug Covelli Signed-off-by: Tom Lendacky [ jroe...@suse.de: - Adapt to different paravirt interface ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg Roedel --- arch/x86/kernel

[PATCH v4 67/75] x86/realmode: Add SEV-ES specific trampoline entry point

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel The code at the trampoline entry point is executed in real-mode. In real-mode #VC exceptions can't be handled, so anything that might cause such an exception must be avoided. In the standard trampoline entry code this is the WBINVD instruction and the call to verify_cpu

[PATCH v4 55/75] x86/sev-es: Handle WBINVD Events

2020-07-14 Thread Joerg Roedel
From: Tom Lendacky Implement a handler for #VC exceptions caused by WBINVD instructions. Signed-off-by: Tom Lendacky [ jroe...@suse.de: Adapt to #VC handling framework ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg Roedel --- arch/x86/kernel/sev-es.c | 9 + 1 file changed, 9

[PATCH v4 71/75] x86/head/64: Rename start_cpu0

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel For SEV-ES this entry point will be used for restarting APs after they have been offlined. Remove the '0' from the name to reflect that. Signed-off-by: Joerg Roedel --- arch/x86/include/asm/cpu.h | 2 +- arch/x86/kernel/head_32.S | 4 ++-- arch/x86/kernel/head_64.S | 6

[PATCH v4 75/75] x86/sev-es: Check required CPU features for SEV-ES

2020-07-14 Thread Joerg Roedel
From: Martin Radev Make sure the machine supports RDRAND, otherwise there is no trusted source of of randomness in the system. Signed-off-by: Martin Radev Signed-off-by: Joerg Roedel --- arch/x86/boot/compressed/sev-es.c | 3 +++ arch/x86/kernel/sev-es-shared.c | 15 +++ arch

[PATCH v4 56/75] x86/sev-es: Handle RDTSC(P) Events

2020-07-14 Thread Joerg Roedel
[ jroe...@suse.de: - Adapt to #VC handling infrastructure - Make it available early ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg Roedel --- arch/x86/boot/compressed/sev-es.c | 4 arch/x86/kernel/sev-es-shared.c | 23 +++ arch/x86/kernel/sev-es.c

[PATCH v4 51/75] x86/sev-es: Handle MMIO events

2020-07-14 Thread Joerg Roedel
From: Tom Lendacky Add handler for VC exceptions caused by MMIO intercepts. These intercepts come along as nested page faults on pages with reserved bits set. Signed-off-by: Tom Lendacky [ jroe...@suse.de: Adapt to VC handling framework ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg

[PATCH v4 61/75] x86/sev-es: Handle VMMCALL Events

2020-07-14 Thread Joerg Roedel
handling infrastructure ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg Roedel --- arch/x86/kernel/sev-es.c | 23 +++ 1 file changed, 23 insertions(+) diff --git a/arch/x86/kernel/sev-es.c b/arch/x86/kernel/sev-es.c index 541f8994eb21..013dcdfeb613 100644 --- a/arch/x86

[PATCH v4 74/75] x86/efi: Add GHCB mappings when SEV-ES is active

2020-07-14 Thread Joerg Roedel
page faults. Signed-off-by: Tom Lendacky [ jroe...@suse.de: Moved GHCB mapping loop to sev-es.c ] Signed-off-by: Joerg Roedel --- arch/x86/boot/compressed/sev-es.c | 1 + arch/x86/include/asm/sev-es.h | 2 ++ arch/x86/kernel/sev-es.c | 30 ++ arch/x86

[PATCH v4 72/75] x86/sev-es: Support CPU offline/online

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Add a play_dead handler when running under SEV-ES. This is needed because the hypervisor can't deliver an SIPI request to restart the AP. Instead the kernel has to issue a VMGEXIT to halt the VCPU until the hypervisor wakes it up again. Signed-off-by: Joerg Roedel --- arch

[PATCH v4 73/75] x86/sev-es: Handle NMI State

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel When running under SEV-ES the kernel has to tell the hypervisor when to open the NMI window again after an NMI was injected. This is done with an NMI-complete message to the hypervisor. Add code to the kernels NMI handler to send this message right at the beginning of do_nmi

[PATCH v4 63/75] x86/sev-es: Handle #DB Events

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Handle #VC exceptions caused by #DB exceptions in the guest. Those must be handled outside of instrumentation_begin()/end() so that the handler will not be raised recursivly. Handle them by calling the kernels debug exception handler. Signed-off-by: Joerg Roedel --- arch

[PATCH v4 49/75] x86/sev-es: Wire up existing #VC exit-code handlers

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Re-use the handlers for CPUID and IOIO caused #VC exceptions in the early boot handler. Signed-off-by: Joerg Roedel --- arch/x86/kernel/sev-es-shared.c | 7 +++ arch/x86/kernel/sev-es.c| 6 ++ 2 files changed, 9 insertions(+), 4 deletions(-) diff --git

[PATCH v4 41/75] x86/sev-es: Setup GHCB based boot #VC handler

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Add the infrastructure to handle #VC exceptions when the kernel runs on virtual addresses and has a GHCB mapped. This handler will be used until the runtime #VC handler takes over. Signed-off-by: Joerg Roedel --- arch/x86/include/asm/segment.h | 2 +- arch/x86/include

[PATCH v4 23/75] x86/boot/compressed/64: Unmap GHCB page before booting the kernel

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Force a page-fault on any further accesses to the GHCB page when they shouldn't happen anymore. This will catch the bugs where a #VC exception is raised when no one is expected anymore. Signed-off-by: Joerg Roedel --- arch/x86/boot/compressed/ident_map_64.c | 17

[PATCH v4 24/75] x86/sev-es: Add support for handling IOIO exceptions

2020-07-14 Thread Joerg Roedel
From: Tom Lendacky Add support for decoding and handling #VC exceptions for IOIO events. Signed-off-by: Tom Lendacky [ jroe...@suse.de: Adapted code to #VC handling framework ] Co-developed-by: Joerg Roedel Signed-off-by: Joerg Roedel --- arch/x86/boot/compressed/sev-es.c | 32 + arch

[PATCH v4 50/75] x86/sev-es: Handle instruction fetches from user-space

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel When a #VC exception is triggered by user-space the instruction decoder needs to read the instruction bytes from user addresses. Enhance vc_decode_insn() to safely fetch kernel and user instructions. Signed-off-by: Joerg Roedel --- arch/x86/kernel/sev-es.c | 31

[PATCH v4 08/75] x86/umip: Factor out instruction decoding

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Factor out the code used to decode an instruction with the correct address and operand sizes to a helper function. No functional changes. Signed-off-by: Joerg Roedel --- arch/x86/include/asm/insn-eval.h | 2 ++ arch/x86/kernel/umip.c | 23 +--- arch

[PATCH v4 09/75] x86/insn: Add insn_get_modrm_reg_off()

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel Add a function to the instruction decoder which returns the pt_regs offset of the register specified in the reg field of the modrm byte. Signed-off-by: Joerg Roedel Acked-by: Masami Hiramatsu --- arch/x86/include/asm/insn-eval.h | 1 + arch/x86/lib/insn-eval.c

[git pull] IOMMU Fixes for Linux v5.8-rc5

2020-07-13 Thread Joerg Roedel
. Geert Uytterhoeven (1): iommu: SUN50I_IOMMU should depend on HAS_DMA Joerg Roedel (1): iommu/amd: Make amd_iommu_apply_ivrs_quirks() static inline Jordan Crouse (1): iommu/arm-smmu: Mark qcom_smmu_client_of_match as possibly unused

Re: [PATCH v2] iommu/arm-smmu: Mark qcom_smmu_client_of_match as possibly unused

2020-07-13 Thread Joerg Roedel
On Mon, Jul 13, 2020 at 02:33:26PM +0100, Will Deacon wrote: > I can't see this in Joerg's tree or in linux-next. Joerg: did you pick this > one up? (I thought you did, but I can't find it!). Yes, its in the tree and and will be pushed soon. I'll also send it to Linus today. Joerg

Re: [PATCH v6 00/10] MT6779 IOMMU SUPPORT

2020-07-13 Thread Joerg Roedel
On Sat, Jul 11, 2020 at 03:11:33PM +0800, Yong Wu wrote: > The SMI part always go with the IOMMU, Could you also help apply the > mt6779 SMI basical part [1][2]. Both has already got reviewed-by from > Rob and Matthias. and the [3] in that patchset is for performance > improvement, it's not so

Re: [PATCH 2/2] iommu/dma: Avoid SAC address trick for PCIe devices

2020-07-13 Thread Joerg Roedel
On Wed, Jul 08, 2020 at 12:32:42PM +0100, Robin Murphy wrote: > As for the intel-iommu implementation, relegate the opportunistic > attempt to allocate a SAC address to the domain of conventional PCI > devices only, to avoid it increasingly causing far more performance > issues than possible

[PATCH] iommu/mediatek: Include liunx/dma-mapping.h

2020-07-13 Thread Joerg Roedel
From: Joerg Roedel This fixes a compile error when cross-compiling the driver on x86-32. Signed-off-by: Joerg Roedel --- drivers/iommu/mtk_iommu.h | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iommu/mtk_iommu.h b/drivers/iommu/mtk_iommu.h index 6ff62452bbf9..122925dbe547 100644

Re: [PATCH v4 4/4] PCI/ACS: Enable PCI_ACS_TB for untrusted/external-facing devices

2020-07-13 Thread Joerg Roedel
On Sat, Jul 11, 2020 at 09:58:38PM -0500, Bjorn Helgaas wrote: > If BIOS handed off with ATS enabled and we somehow relied on it being > already enabled, something might break if we start disabling ATS. > Just a theoretical possibility, doesn't seem likely to me. I don't think this will be a

Re: [Ksummit-discuss] [PATCH v3] CodingStyle: Inclusive Terminology

2020-07-13 Thread Joerg Roedel
On Wed, Jul 08, 2020 at 11:14:27AM -0700, Dan Williams wrote: > Linux maintains a coding-style and its own idiomatic set of terminology. > Update the style guidelines to recommend replacements for the terms > master/slave and blacklist/whitelist. Acked-by: Joerg Roedel

Re: [PATCH 1/2] iommu/intel: Avoid SAC address trick for PCIe devices

2020-07-10 Thread Joerg Roedel
On Wed, Jul 08, 2020 at 12:32:41PM +0100, Robin Murphy wrote: > For devices stuck behind a conventional PCI bus, saving extra cycles at > 33MHz is probably fairly significant. However since native PCI Express > is now the norm for high-performance devices, the optimisation to always > prefer

Re: [PATCH] IOMMU DRIVERS: Replace HTTP links with HTTPS ones

2020-07-10 Thread Joerg Roedel
On Wed, Jul 08, 2020 at 11:04:34PM +0200, Alexander A. Klimov wrote: > drivers/iommu/omap-iommu.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Queued, thanks.

Re: [PATCH] iommu: Remove unused IOMMU_SYS_CACHE_ONLY flag

2020-07-10 Thread Joerg Roedel
Hi Will, On Fri, Jul 10, 2020 at 02:05:27PM +0100, Will Deacon wrote: > Ah, I'd already got this queued for 5.9: > > https://git.kernel.org/pub/scm/linux/kernel/git/will/linux.git/log/?h=for-joerg/arm-smmu/updates > > and I've queued a small number of patches on top of it now. > > Are you

Re: [PATCH v6 00/10] MT6779 IOMMU SUPPORT

2020-07-10 Thread Joerg Roedel
On Fri, Jul 03, 2020 at 12:41:17PM +0800, Chao Hao wrote: > Chao Hao (10): > dt-bindings: mediatek: Add bindings for MT6779 > iommu/mediatek: Rename the register STANDARD_AXI_MODE(0x48) to MISC_CTRL > iommu/mediatek: Use a u32 flags to describe different HW features > iommu/mediatek:

Re: [PATCH] iommu: Remove unused IOMMU_SYS_CACHE_ONLY flag

2020-07-10 Thread Joerg Roedel
On Fri, Jul 03, 2020 at 05:25:48PM +0100, Will Deacon wrote: > The IOMMU_SYS_CACHE_ONLY flag was never exposed via the DMA API and > has no in-tree users. Remove it. > > Cc: Robin Murphy > Cc: "Isaac J. Manjarres" > Cc: Joerg Roedel > Cc: Christoph Hellwig >

Re: a question of split_huge_page

2020-07-10 Thread Joerg Roedel
Adding Robin. On Fri, Jul 10, 2020 at 05:34:52PM +0800, Alex Shi wrote: > 在 2020/7/10 下午1:28, Mika Penttilä 写道: > > > > > > On 10.7.2020 7.51, Alex Shi wrote: > >> > >> 在 2020/7/10 上午12:07, Kirill A. Shutemov 写道: > >>> On Thu, Jul 09, 2020 at 04:50:02PM +0100, Matthew Wilcox wrote: > On

Re: [PATCH v3 00/34] iommu: Move iommu_group setup to IOMMU core code

2020-07-09 Thread Joerg Roedel
On Fri, Jul 03, 2020 at 08:17:09PM -0400, Qian Cai wrote: > FYI, I have just sent a patch to fix this, > > https://lore.kernel.org/linux-iommu/20200704001003.2303-1-...@lca.pw/ Just queued that fix, thanks. Please don't send patches to my suse email address, use only the 8bytes.org one. Thanks,

Re: [PATCH v3 07/34] iommu: Add probe_device() and release_device() call-backs

2020-07-09 Thread Joerg Roedel
On Sat, Jul 04, 2020 at 05:09:57PM +0800, Hillf Danton wrote: > > + group = iommu_group_get_for_dev(dev); > > + if (!IS_ERR(group)) { > > Typo? Yes, fortunatly it gets fixed again in patch 11 of this series. Regards, Joerg

[PATCH] x86/idt: Make sure idt_table takes a whole page

2020-07-09 Thread Joerg Roedel
From: Joerg Roedel On x86-32 the idt_table with 256 entries needs only 2048 bytes. It is page-aligned, but the end of the .bss..page_aligned section is not guaranteed to be page-aligned. As a result, symbols from other .bss sections may end up on the same 4k page as the idt_table

[PATCH v2 3/3] x86/mm/64: Make sync_global_pgds() static

2020-07-01 Thread Joerg Roedel
From: Joerg Roedel The function is only called from within init_64.c by now and can be static. Also remove it from pgtable_64.h. Signed-off-by: Joerg Roedel --- arch/x86/include/asm/pgtable_64.h | 2 -- arch/x86/mm/init_64.c | 2 +- 2 files changed, 1 insertion(+), 3 deletions

[PATCH v2 1/3] x86/mm/64: Pre-allocate p4d/pud pages for vmalloc area

2020-07-01 Thread Joerg Roedel
From: Joerg Roedel Pre-allocate the page-table pages for the vmalloc area at the level which needs synchronization on x86. This is P4D for 5-level and PUD for 4-level paging. Doing this at boot makes sure all page-tables in the system have these pages already and do not need to be synchronized

[PATCH v2 2/3] x86/mm/64: Do not sync vmalloc/ioremap mappings

2020-07-01 Thread Joerg Roedel
From: Joerg Roedel Remove the code to sync the vmalloc and ioremap ranges for x86-64. The page-table pages are all pre-allocated now so that synchronizing the top-level page happens at page-table creation. Signed-off-by: Joerg Roedel --- arch/x86/include/asm/pgtable_64_types.h | 2 -- arch

[PATCH v2 0/3] x86/mm/64: Remove vmalloc/ioremap pgtable synchronization

2020-07-01 Thread Joerg Roedel
to v1: - Made failure at pre-allocation stage fatal - As a consequence removed the arch_sync_kernel_mappings() implementation for x86-64 - Unexported sync_global_pgds() - Removed some left-over debug code from the first patch Joerg Roedel (3): x86/mm/64

[PATCH] iommu/amd: Make amd_iommu_apply_ivrs_quirks() static inline

2020-06-30 Thread Joerg Roedel
From: Joerg Roedel At least the version in the header file to fix a compile warning about the function being unused. Reported-by: Borislav Petkov Signed-off-by: Joerg Roedel --- drivers/iommu/amd/amd_iommu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu

Re: [PATCH] iommu: add include/uapi/linux/iommu.h to MAINTAINERS file

2020-06-30 Thread Joerg Roedel
On Fri, Jun 05, 2020 at 12:00:25AM -0700, Jerry Snitselaar wrote: > When include/uapi/linux/iommu.h was created it was never > added to the file list in MAINTAINERS. > > Cc: Joerg Roedel > Signed-off-by: Jerry Snitselaar > --- > MAINTAINERS | 1 + > 1 file changed,

Re: [PATCH] iommu: move sg_table wrapper out of CONFIG_IOMMU_SUPPORT

2020-06-30 Thread Joerg Roedel
On Tue, Jun 30, 2020 at 10:17:56AM +0200, Marek Szyprowski wrote: > Move the recently added sg_table wrapper out of CONFIG_IOMMU_SUPPORT to > let the client code copile also when IOMMU support is disabled. > > Fixes: 48530d9fab0d ("iommu: add generic helper for mapping sgtable objects") >

Re: [PATCH] iommu: SUN50I_IOMMU should depend on HAS_DMA

2020-06-30 Thread Joerg Roedel
On Mon, Jun 29, 2020 at 05:29:36PM +0100, Robin Murphy wrote: > On 2020-06-29 13:11, Geert Uytterhoeven wrote: > > If NO_DMA=y (e.g. Sun-3 all{mod,yes}-config): > > > > drivers/iommu/dma-iommu.o: In function `iommu_dma_mmap': > > dma-iommu.c:(.text+0x92e): undefined reference to

Re: [PATCH 00/13] iommu: Remove usage of dev->archdata.iommu

2020-06-30 Thread Joerg Roedel
On Thu, Jun 25, 2020 at 03:08:23PM +0200, Joerg Roedel wrote: > Joerg Roedel (13): > iommu/exynos: Use dev_iommu_priv_get/set() > iommu/vt-d: Use dev_iommu_priv_get/set() > iommu/msm: Use dev_iommu_priv_get/set() > iommu/omap: Use dev_iommu_priv_get/set() > i

Re: [PATCH v2 0/2] iommu/amd: Don't use atomic64_t for domain->pt_root

2020-06-30 Thread Joerg Roedel
On Fri, Jun 26, 2020 at 08:30:21AM -0400, Qian Cai wrote: > BTW, from the previous discussion, Linus mentioned, > > “ > The thing is, the 64-bit atomic reads/writes are very expensive on > 32-bit x86. If it was just a native pointer, it would be much cheaper > than an "atomic64_t". > “ > >

Re: [PATCH 1/2] iommu/vt-d: Move Kconfig and Makefile bits down into intel directory

2020-06-30 Thread Joerg Roedel
Hi Jerry, On Fri, Jun 12, 2020 at 04:10:59PM -0700, Jerry Snitselaar wrote: > Move Intel Kconfig and Makefile bits down into intel directory > with the rest of the Intel specific files. > > Cc: Joerg Roedel > Cc: Lu Baolu > Signed-off-by: Jerry Snitselaar > --- >

Re: [Possible PATCH] iommu/qcom: Change CONFIG_BIG_ENDIAN to CONFIG_CPU_BIG_ENDIAN

2020-06-30 Thread Joerg Roedel
On Sat, Jun 06, 2020 at 12:16:17PM -0700, Joe Perches wrote: > CONFIG_BIG_ENDIAN does not exist as a Kconfig symbol. > > Signed-off-by: Joe Perches > --- > > I don't have the hardware, so I can't tell if this is a > correct change, but it is a logical one. > > Found by a test script that looks

Re: [PATCH] iommu/iova: Don't BUG on invalid PFNs

2020-06-30 Thread Joerg Roedel
On Tue, Jun 02, 2020 at 02:08:18PM +0100, Robin Murphy wrote: > Unlike the other instances which represent a complete loss of > consistency within the rcache mechanism itself, or a fundamental > and obvious misconfiguration by an IOMMU driver, the BUG_ON() in > iova_magazine_free_pfns() can be

[git pull] IOMMU Fixes for Linux v5.8-rc2

2020-06-26 Thread Joerg Roedel
Hi Linus, The following changes since commit 48778464bb7d346b47157d21ffde2af6b2d39110: Linux 5.8-rc2 (2020-06-21 15:45:29 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu.git tags/iommu-fixes-v5.8-rc2 for you to fetch changes up to

Re: [PATCH] x86/mm: Pre-allocate p4d/pud pages for vmalloc area

2020-06-26 Thread Joerg Roedel
On Fri, Jun 26, 2020 at 01:32:15PM +0200, Peter Zijlstra wrote: > That is, this is boot time only, right? clone() would return -ENOMEM, as > it's part of the normal page-table copy. Yes, the pre-allocation happens shortly after the buddy allocator took over from bootmem. I don't quite get what

Re: [PATCH] x86/mm: Pre-allocate p4d/pud pages for vmalloc area

2020-06-26 Thread Joerg Roedel
On Fri, Jun 26, 2020 at 01:07:31PM +0200, Peter Zijlstra wrote: > Can't we now remove arch_sync_kernel_mappings() from this same file? Only if we panic on allocation failure. Joerg

<    3   4   5   6   7   8   9   10   11   12   >