kvm.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Joerg Roedel <joro@8bytes.org>
To: x86@kernel.org
Cc: Joerg Roedel <joro@8bytes.org>, Joerg Roedel <jroedel@suse.de>,
	hpa@zytor.com, Andy Lutomirski <luto@kernel.org>,
	Dave Hansen <dave.hansen@linux.intel.com>,
	Peter Zijlstra <peterz@infradead.org>,
	Jiri Slaby <jslaby@suse.cz>,
	Dan Williams <dan.j.williams@intel.com>,
	Tom Lendacky <thomas.lendacky@amd.com>,
	Juergen Gross <jgross@suse.com>,
	Kees Cook <keescook@chromium.org>,
	David Rientjes <rientjes@google.com>,
	Cfir Cohen <cfir@google.com>, Erdem Aktas <erdemaktas@google.com>,
	Masami Hiramatsu <mhiramat@kernel.org>,
	Mike Stunes <mstunes@vmware.com>,
	Sean Christopherson <sean.j.christopherson@intel.com>,
	Martin Radev <martin.b.radev@gmail.com>,
	linux-kernel@vger.kernel.org, kvm@vger.kernel.org,
	virtualization@lists.linux-foundation.org
Subject: [PATCH v7 33/72] x86/head/64: Install a CPU bringup IDT
Date: Mon,  7 Sep 2020 15:15:34 +0200	[thread overview]
Message-ID: <20200907131613.12703-34-joro@8bytes.org> (raw)
In-Reply-To: <20200907131613.12703-1-joro@8bytes.org>

From: Joerg Roedel <jroedel@suse.de>

Add a separate bringup IDT used by CPU bringup code that will be used
until the kernel switches to the idt_table. There are two reasons for
a separate IDT:

	1) When the idt_table is set up and the secondary CPUs are
	   booted, it contains entries (e.g. IST entries) which
	   require certain CPU state to be set up. This includes a
	   working TSS (for IST), MSR_GS_BASE (for stack protector) or
	   CR4.FSGSBASE (for paranoid_entry) path. By using a
	   dedicated IDT for early boot this state need not to be set
	   up early.

	2) The idt_table is static to idt.c, so any function
	   using/modifying must be in idt.c too. That means that all
	   compiler driven instrumentation like tracing or KASAN is
	   also active in this code. But during early CPU bringup the
	   environment is not set up for this instrumentation to work
	   correctly.

To avoid all of these hassles and make early exception handling
robust, use a dedicated bringup IDT.

The IDT is loaded two times, first on the boot CPU while the kernel is
still running on direct mapped addresses, and again later when the
switch to kernel addresses happened. The second IDT load happens on
the boot and secondary CPUs.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
---
 arch/x86/include/asm/setup.h |  1 +
 arch/x86/kernel/head64.c     | 39 ++++++++++++++++++++++++++++++++++++
 arch/x86/kernel/head_64.S    |  5 +++++
 3 files changed, 45 insertions(+)

diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h
index 5c2fd05bd52c..4b3ca5ade2fd 100644
--- a/arch/x86/include/asm/setup.h
+++ b/arch/x86/include/asm/setup.h
@@ -50,6 +50,7 @@ extern unsigned long __startup_64(unsigned long physaddr, struct boot_params *bp
 extern unsigned long __startup_secondary_64(void);
 extern void startup_64_setup_env(unsigned long physbase);
 extern int early_make_pgtable(unsigned long address);
+extern void early_setup_idt(void);
 
 #ifdef CONFIG_X86_INTEL_MID
 extern void x86_intel_mid_early_setup(void);
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 8c82be44be94..7bfd5c27c773 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -36,6 +36,8 @@
 #include <asm/microcode.h>
 #include <asm/kasan.h>
 #include <asm/fixmap.h>
+#include <asm/realmode.h>
+#include <asm/desc.h>
 
 /*
  * Manage page tables very early on.
@@ -508,6 +510,41 @@ void __init x86_64_start_reservations(char *real_mode_data)
 	start_kernel();
 }
 
+/*
+ * Data structures and code used for IDT setup in head_64.S. The bringup-IDT is
+ * used until the idt_table takes over. On the boot CPU this happens in
+ * x86_64_start_kernel(), on secondary CPUs in start_secondary(). In both cases
+ * this happens in the functions called from head_64.S.
+ *
+ * The idt_table can't be used that early because all the code modifying it is
+ * in idt.c and can be instrumented by tracing or KASAN, which both don't work
+ * during early CPU bringup. Also the idt_table has the runtime vectors
+ * configured which require certain CPU state to be setup already (like TSS),
+ * which also hasn't happened yet in early CPU bringup.
+ */
+static gate_desc bringup_idt_table[NUM_EXCEPTION_VECTORS] __page_aligned_data;
+
+static struct desc_ptr bringup_idt_descr = {
+	.size		= (NUM_EXCEPTION_VECTORS * sizeof(gate_desc)) - 1,
+	.address	= 0, /* Set at runtime */
+};
+
+/* This runs while still in the direct mapping */
+static void startup_64_load_idt(unsigned long physbase)
+{
+	struct desc_ptr *desc = fixup_pointer(&bringup_idt_descr, physbase);
+
+	desc->address = (unsigned long)fixup_pointer(bringup_idt_table, physbase);
+	native_load_idt(desc);
+}
+
+/* This is used when running on kernel addresses */
+void early_setup_idt(void)
+{
+	bringup_idt_descr.address = (unsigned long)bringup_idt_table;
+	native_load_idt(&bringup_idt_descr);
+}
+
 /*
  * Setup boot CPU state needed before kernel switches to virtual addresses.
  */
@@ -521,4 +558,6 @@ void __head startup_64_setup_env(unsigned long physbase)
 	asm volatile("movl %%eax, %%ds\n"
 		     "movl %%eax, %%ss\n"
 		     "movl %%eax, %%es\n" : : "a"(__KERNEL_DS) : "memory");
+
+	startup_64_load_idt(physbase);
 }
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index 83050c9e54d9..1de09b58e578 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -198,6 +198,11 @@ SYM_CODE_START(secondary_startup_64)
 	 */
 	movq initial_stack(%rip), %rsp
 
+	/* Setup and Load IDT */
+	pushq	%rsi
+	call	early_setup_idt
+	popq	%rsi
+
 	/* Check if nx is implemented */
 	movl	$0x80000001, %eax
 	cpuid
-- 
2.28.0


  parent reply	other threads:[~2020-09-07 17:26 UTC|newest]

Thread overview: 95+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-07 13:15 [PATCH v7 00/72] x86: SEV-ES Guest Support Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 01/72] KVM: SVM: nested: Don't allocate VMCB structures on stack Joerg Roedel
2020-11-05 16:24   ` Michael Roth
2020-11-05 16:38     ` Borislav Petkov
2020-11-06  0:31       ` Michael Roth
2020-11-06  0:39         ` Borislav Petkov
2020-11-05 17:46     ` Michael Roth
2020-09-07 13:15 ` [PATCH v7 02/72] KVM: SVM: Add GHCB definitions Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 03/72] KVM: SVM: Add GHCB Accessor functions Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 04/72] KVM: SVM: Use __packed shorthand Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 05/72] x86/cpufeatures: Add SEV-ES CPU feature Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 06/72] x86/traps: Move pf error codes to <asm/trap_pf.h> Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 07/72] x86/insn: Make inat-tables.c suitable for pre-decompression code Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 08/72] x86/umip: Factor out instruction fetch Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 09/72] x86/umip: Factor out instruction decoding Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 10/72] x86/insn: Add insn_get_modrm_reg_off() Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 11/72] x86/insn: Add insn_has_rep_prefix() helper Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 12/72] x86/boot/compressed/64: Disable red-zone usage Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 13/72] x86/boot/compressed/64: Add IDT Infrastructure Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 14/72] x86/boot/compressed/64: Rename kaslr_64.c to ident_map_64.c Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 15/72] x86/boot/compressed/64: Add page-fault handler Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 16/72] x86/boot/compressed/64: Always switch to own page-table Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 17/72] x86/boot/compressed/64: Don't pre-map memory in KASLR code Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 18/72] x86/boot/compressed/64: Change add_identity_map() to take start and end Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 19/72] x86/boot/compressed/64: Add stage1 #VC handler Joerg Roedel
2020-09-07 16:58   ` Borislav Petkov
2020-09-07 13:15 ` [PATCH v7 20/72] x86/boot/compressed/64: Call set_sev_encryption_mask() earlier Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 21/72] x86/boot/compressed/64: Check return value of kernel_ident_mapping_init() Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 22/72] x86/boot/compressed/64: Add set_page_en/decrypted() helpers Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 23/72] x86/boot/compressed/64: Setup GHCB Based VC Exception handler Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 24/72] x86/boot/compressed/64: Unmap GHCB page before booting the kernel Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 25/72] x86/sev-es: Add support for handling IOIO exceptions Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 26/72] x86/fpu: Move xgetbv()/xsetbv() into separate header Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 27/72] x86/sev-es: Add CPUID handling to #VC handler Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 28/72] x86/idt: Split idt_data setup out of set_intr_gate() Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 29/72] x86/head/64: Install startup GDT Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 30/72] x86/head/64: Load GDT after switch to virtual addresses Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 31/72] x86/head/64: Load segment registers earlier Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 32/72] x86/head/64: Switch to initial stack earlier Joerg Roedel
2020-09-07 13:15 ` Joerg Roedel [this message]
2020-09-07 13:15 ` [PATCH v7 34/72] x86/idt: Move two function from k/idt.c to i/a/desc.h Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 35/72] x86/head/64: Move early exception dispatch to C code Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 36/72] x86/sev-es: Add SEV-ES Feature Detection Joerg Roedel
2020-09-07 21:02   ` Borislav Petkov
2020-09-07 13:15 ` [PATCH v7 37/72] x86/sev-es: Print SEV-ES info into kernel log Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 38/72] x86/sev-es: Compile early handler code into kernel image Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 39/72] x86/sev-es: Setup early #VC handler Joerg Roedel
2020-09-08 10:22   ` [PATCH v7.1 " Joerg Roedel
2020-09-08 12:35   ` [PATCH v7.2 39/74] " Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 40/72] x86/sev-es: Setup GHCB based boot " Joerg Roedel
2020-09-08 10:24   ` [PATCH v7.1 " Joerg Roedel
2020-09-08 12:38   ` [PATCH v7.2 40/74] " Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 41/72] x86/sev-es: Setup per-cpu GHCBs for the runtime handler Joerg Roedel
2020-09-08 10:51   ` Borislav Petkov
2020-09-07 13:15 ` [PATCH v7 42/72] x86/sev-es: Allocate and Map IST stack for #VC handler Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 43/72] x86/sev-es: Adjust #VC IST Stack on entering NMI handler Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 44/72] x86/dumpstack/64: Add noinstr version of get_stack_info() Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 45/72] x86/entry/64: Add entry code for #VC handler Joerg Roedel
2021-01-24 14:11   ` Lai Jiangshan
2021-01-28 13:18     ` Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 46/72] x86/sev-es: Add Runtime #VC Exception Handler Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 47/72] x86/sev-es: Wire up existing #VC exit-code handlers Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 48/72] x86/sev-es: Handle instruction fetches from user-space Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 49/72] x86/sev-es: Handle MMIO events Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 50/72] x86/sev-es: Handle MMIO String Instructions Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 51/72] x86/sev-es: Handle MSR events Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 52/72] x86/sev-es: Handle DR7 read/write events Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 53/72] x86/sev-es: Handle WBINVD Events Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 54/72] x86/sev-es: Handle RDTSC(P) Events Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 55/72] x86/sev-es: Handle RDPMC Events Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 56/72] x86/sev-es: Handle INVD Events Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 57/72] x86/sev-es: Handle MONITOR/MONITORX Events Joerg Roedel
2020-09-07 13:15 ` [PATCH v7 58/72] x86/sev-es: Handle MWAIT/MWAITX Events Joerg Roedel
2020-09-07 13:16 ` [PATCH v7 59/72] x86/sev-es: Handle VMMCALL Events Joerg Roedel
2020-09-07 13:16 ` [PATCH v7 60/72] x86/sev-es: Handle #AC Events Joerg Roedel
2020-09-07 13:16 ` [PATCH v7 61/72] x86/sev-es: Handle #DB Events Joerg Roedel
2020-09-07 13:16 ` [PATCH v7 62/72] x86/paravirt: Allow hypervisor specific VMMCALL handling under SEV-ES Joerg Roedel
2020-09-07 13:16 ` [PATCH v7 63/72] x86/kvm: Add KVM " Joerg Roedel
2020-09-07 13:16 ` [PATCH v7 64/72] x86/vmware: Add VMware specific handling for VMMCALL " Joerg Roedel
2020-09-07 13:16 ` [PATCH v7 65/72] x86/realmode: Add SEV-ES specific trampoline entry point Joerg Roedel
2020-09-07 13:16 ` [PATCH v7 66/72] x86/realmode: Setup AP jump table Joerg Roedel
2020-09-07 13:16 ` [PATCH v7 67/72] x86/smpboot: Load TSS and getcpu GDT entry before loading IDT Joerg Roedel
2020-09-08 17:20   ` Borislav Petkov
2020-09-08 18:42     ` Joerg Roedel
2020-09-07 13:16 ` [PATCH v7 68/72] x86/head/64: Don't call verify_cpu() on starting APs Joerg Roedel
2020-09-07 13:16 ` [PATCH v7 69/72] x86/sev-es: Support CPU offline/online Joerg Roedel
2020-09-07 13:16 ` [PATCH v7 70/72] x86/sev-es: Handle NMI State Joerg Roedel
2020-09-07 13:16 ` [PATCH v7 71/72] x86/efi: Add GHCB mappings when SEV-ES is active Joerg Roedel
2020-09-08 17:46   ` Borislav Petkov
2020-09-09  8:27     ` Ard Biesheuvel
2020-09-09 12:44       ` Laszlo Ersek
2020-09-09 13:24         ` Laszlo Ersek
2020-09-09 13:49         ` Tom Lendacky
2020-09-10 12:37           ` Ard Biesheuvel
2020-09-07 13:16 ` [PATCH v7 72/72] x86/sev-es: Check required CPU features for SEV-ES Joerg Roedel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200907131613.12703-34-joro@8bytes.org \
    --to=joro@8bytes.org \
    --cc=cfir@google.com \
    --cc=dan.j.williams@intel.com \
    --cc=dave.hansen@linux.intel.com \
    --cc=erdemaktas@google.com \
    --cc=hpa@zytor.com \
    --cc=jgross@suse.com \
    --cc=jroedel@suse.de \
    --cc=jslaby@suse.cz \
    --cc=keescook@chromium.org \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=martin.b.radev@gmail.com \
    --cc=mhiramat@kernel.org \
    --cc=mstunes@vmware.com \
    --cc=peterz@infradead.org \
    --cc=rientjes@google.com \
    --cc=sean.j.christopherson@intel.com \
    --cc=thomas.lendacky@amd.com \
    --cc=virtualization@lists.linux-foundation.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).