History

Merge tag 'x86_urgent_for_v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Borislav Petkov: - Update the 'mitigations=' kernel param documentation - Check the IBPB feature flag before enabling IBPB in firmware calls because cloud vendors' fantasy when it comes to creating guest configurations is unlimited - Unexport sev_es_ghcb_hv_call() before 5.19 releases now that HyperV doesn't need it anymore - Remove dead CONFIG_* items * tag 'x86_urgent_for_v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: docs/kernel-parameters: Update descriptions for "mitigations=" param with retbleed x86/bugs: Do not enable IBPB at firmware entry when IBPB is not available Revert "x86/sev: Expose sev_es_ghcb_hv_call() for use by HyperV" x86/configs: Update configs in x86_debug.config

Linus Torvalds committed 4 years ago

Commit 89caf572 parents 5e4823e ea304a86 files · +22 −33Browse files

Unified · Split

6 files
  1. Documentation/admin-guide/kernel-parameters.txt +2 −0
  2. arch/x86/include/asm/sev.h +1 −6
  3. arch/x86/kernel/cpu/bugs.c +1 −0
  4. arch/x86/kernel/sev-shared.c +9 −16
  5. arch/x86/kernel/sev.c +8 −9
  6. kernel/configs/x86_debug.config +1 −2
Documentation/admin-guide/kernel-parameters.txt+2−0
@@ -3176,6 +3176,7 @@ · 3175 unmodified lines
3176 no_entry_flush [PPC]3176 no_entry_flush [PPC]
3177 no_uaccess_flush [PPC]3177 no_uaccess_flush [PPC]
3178 mmio_stale_data=off [X86]3178 mmio_stale_data=off [X86]
3179 retbleed=off [X86]
3179 3180
3180 Exceptions:3181 Exceptions:
3181 This does not have any effect on3182 This does not have any effect on
@@ -3198,6 +3199,7 @@ · 16 unmodified lines
3198 mds=full,nosmt [X86]3199 mds=full,nosmt [X86]
3199 tsx_async_abort=full,nosmt [X86]3200 tsx_async_abort=full,nosmt [X86]
3200 mmio_stale_data=full,nosmt [X86]3201 mmio_stale_data=full,nosmt [X86]
3202 retbleed=auto,nosmt [X86]
3201 3203
3202 mminit_loglevel=3204 mminit_loglevel=
3203 [KNL] When CONFIG_DEBUG_MEMORY_INIT is set, this3205 [KNL] When CONFIG_DEBUG_MEMORY_INIT is set, this
arch/x86/include/asm/sev.h+1−6
@@ -72,7 +72,6 @@ static inline u64 lower_bits(u64 val, unsigned int bits) · 71 unmodified lines
72 72
73struct real_mode_header;73struct real_mode_header;
74enum stack_type;74enum stack_type;
75struct ghcb;
76 75
77/* Early IDT entry points for #VC handler */76/* Early IDT entry points for #VC handler */
78extern void vc_no_ghcb(void);77extern void vc_no_ghcb(void);
@@ -156,11 +155,7 @@ static __always_inline void sev_es_nmi_complete(void) · 77 unmodified lines
156 __sev_es_nmi_complete();155 __sev_es_nmi_complete();
157}156}
158extern int __init sev_es_efi_map_ghcbs(pgd_t *pgd);157extern int __init sev_es_efi_map_ghcbs(pgd_t *pgd);
159extern enum es_result sev_es_ghcb_hv_call(struct ghcb *ghcb,158
160 bool set_ghcb_msr,
161 struct es_em_ctxt *ctxt,
162 u64 exit_code, u64 exit_info_1,
163 u64 exit_info_2);
164static inline int rmpadjust(unsigned long vaddr, bool rmp_psize, unsigned long attrs)159static inline int rmpadjust(unsigned long vaddr, bool rmp_psize, unsigned long attrs)
165{160{
166 int rc;161 int rc;
arch/x86/kernel/cpu/bugs.c+1−0
@@ -1520,6 +1520,7 @@ static void __init spectre_v2_select_mitigation(void) · 1519 unmodified lines
1520 * enable IBRS around firmware calls.1520 * enable IBRS around firmware calls.
1521 */1521 */
1522 if (boot_cpu_has_bug(X86_BUG_RETBLEED) &&1522 if (boot_cpu_has_bug(X86_BUG_RETBLEED) &&
1523 boot_cpu_has(X86_FEATURE_IBPB) &&
1523 (boot_cpu_data.x86_vendor == X86_VENDOR_AMD ||1524 (boot_cpu_data.x86_vendor == X86_VENDOR_AMD ||
1524 boot_cpu_data.x86_vendor == X86_VENDOR_HYGON)) {1525 boot_cpu_data.x86_vendor == X86_VENDOR_HYGON)) {
1525 1526
arch/x86/kernel/sev-shared.c+9−16
@@ -219,9 +219,10 @@ static enum es_result verify_exception_info(struct ghcb *ghcb, struct es_em_ctxt · 218 unmodified lines
219 return ES_VMM_ERROR;219 return ES_VMM_ERROR;
220}220}
221 221
222enum es_result sev_es_ghcb_hv_call(struct ghcb *ghcb, bool set_ghcb_msr,222static enum es_result sev_es_ghcb_hv_call(struct ghcb *ghcb,
223 struct es_em_ctxt *ctxt, u64 exit_code,223 struct es_em_ctxt *ctxt,
224 u64 exit_info_1, u64 exit_info_2)224 u64 exit_code, u64 exit_info_1,
225 u64 exit_info_2)
225{226{
226 /* Fill in protocol and format specifiers */227 /* Fill in protocol and format specifiers */
227 ghcb->protocol_version = ghcb_version;228 ghcb->protocol_version = ghcb_version;
@@ -231,14 +232,7 @@ enum es_result sev_es_ghcb_hv_call(struct ghcb *ghcb, bool set_ghcb_msr, · 3 unmodified lines
231 ghcb_set_sw_exit_info_1(ghcb, exit_info_1);232 ghcb_set_sw_exit_info_1(ghcb, exit_info_1);
232 ghcb_set_sw_exit_info_2(ghcb, exit_info_2);233 ghcb_set_sw_exit_info_2(ghcb, exit_info_2);
233 234
234 /*235 sev_es_wr_ghcb_msr(__pa(ghcb));
235 * Hyper-V unenlightened guests use a paravisor for communicating and
236 * GHCB pages are being allocated and set up by that paravisor. Linux
237 * should not change the GHCB page's physical address.
238 */
239 if (set_ghcb_msr)
240 sev_es_wr_ghcb_msr(__pa(ghcb));
241
242 VMGEXIT();236 VMGEXIT();
243 237
244 return verify_exception_info(ghcb, ctxt);238 return verify_exception_info(ghcb, ctxt);
@@ -795,7 +789,7 @@ static enum es_result vc_handle_ioio(struct ghcb *ghcb, struct es_em_ctxt *ctxt) · 550 unmodified lines
795 */789 */
796 sw_scratch = __pa(ghcb) + offsetof(struct ghcb, shared_buffer);790 sw_scratch = __pa(ghcb) + offsetof(struct ghcb, shared_buffer);
797 ghcb_set_sw_scratch(ghcb, sw_scratch);791 ghcb_set_sw_scratch(ghcb, sw_scratch);
798 ret = sev_es_ghcb_hv_call(ghcb, true, ctxt, SVM_EXIT_IOIO,792 ret = sev_es_ghcb_hv_call(ghcb, ctxt, SVM_EXIT_IOIO,
799 exit_info_1, exit_info_2);793 exit_info_1, exit_info_2);
800 if (ret != ES_OK)794 if (ret != ES_OK)
801 return ret;795 return ret;
@@ -837,8 +831,7 @@ static enum es_result vc_handle_ioio(struct ghcb *ghcb, struct es_em_ctxt *ctxt) · 35 unmodified lines
837 831
838 ghcb_set_rax(ghcb, rax);832 ghcb_set_rax(ghcb, rax);
839 833
840 ret = sev_es_ghcb_hv_call(ghcb, true, ctxt,834 ret = sev_es_ghcb_hv_call(ghcb, ctxt, SVM_EXIT_IOIO, exit_info_1, 0);
841 SVM_EXIT_IOIO, exit_info_1, 0);
842 if (ret != ES_OK)835 if (ret != ES_OK)
843 return ret;836 return ret;
844 837
@@ -894,7 +887,7 @@ static enum es_result vc_handle_cpuid(struct ghcb *ghcb, · 49 unmodified lines
894 /* xgetbv will cause #GP - use reset value for xcr0 */887 /* xgetbv will cause #GP - use reset value for xcr0 */
895 ghcb_set_xcr0(ghcb, 1);888 ghcb_set_xcr0(ghcb, 1);
896 889
897 ret = sev_es_ghcb_hv_call(ghcb, true, ctxt, SVM_EXIT_CPUID, 0, 0);890 ret = sev_es_ghcb_hv_call(ghcb, ctxt, SVM_EXIT_CPUID, 0, 0);
898 if (ret != ES_OK)891 if (ret != ES_OK)
899 return ret;892 return ret;
900 893
@@ -919,7 +912,7 @@ static enum es_result vc_handle_rdtsc(struct ghcb *ghcb, · 18 unmodified lines
919 bool rdtscp = (exit_code == SVM_EXIT_RDTSCP);912 bool rdtscp = (exit_code == SVM_EXIT_RDTSCP);
920 enum es_result ret;913 enum es_result ret;
921 914
922 ret = sev_es_ghcb_hv_call(ghcb, true, ctxt, exit_code, 0, 0);915 ret = sev_es_ghcb_hv_call(ghcb, ctxt, exit_code, 0, 0);
923 if (ret != ES_OK)916 if (ret != ES_OK)
924 return ret;917 return ret;
925 918
arch/x86/kernel/sev.c+8−9
@@ -786,7 +786,7 @@ static int vmgexit_psc(struct snp_psc_desc *desc) · 785 unmodified lines
786 ghcb_set_sw_scratch(ghcb, (u64)__pa(data));786 ghcb_set_sw_scratch(ghcb, (u64)__pa(data));
787 787
788 /* This will advance the shared buffer data points to. */788 /* This will advance the shared buffer data points to. */
789 ret = sev_es_ghcb_hv_call(ghcb, true, &ctxt, SVM_VMGEXIT_PSC, 0, 0);789 ret = sev_es_ghcb_hv_call(ghcb, &ctxt, SVM_VMGEXIT_PSC, 0, 0);
790 790
791 /*791 /*
792 * Page State Change VMGEXIT can pass error code through792 * Page State Change VMGEXIT can pass error code through
@@ -1212,8 +1212,7 @@ static enum es_result vc_handle_msr(struct ghcb *ghcb, struct es_em_ctxt *ctxt) · 419 unmodified lines
1212 ghcb_set_rdx(ghcb, regs->dx);1212 ghcb_set_rdx(ghcb, regs->dx);
1213 }1213 }
1214 1214
1215 ret = sev_es_ghcb_hv_call(ghcb, true, ctxt, SVM_EXIT_MSR,1215 ret = sev_es_ghcb_hv_call(ghcb, ctxt, SVM_EXIT_MSR, exit_info_1, 0);
1216 exit_info_1, 0);
1217 1216
1218 if ((ret == ES_OK) && (!exit_info_1)) {1217 if ((ret == ES_OK) && (!exit_info_1)) {
1219 regs->ax = ghcb->save.rax;1218 regs->ax = ghcb->save.rax;
@@ -1452,7 +1451,7 @@ static enum es_result vc_do_mmio(struct ghcb *ghcb, struct es_em_ctxt *ctxt, · 232 unmodified lines
1452 1451
1453 ghcb_set_sw_scratch(ghcb, ghcb_pa + offsetof(struct ghcb, shared_buffer));1452 ghcb_set_sw_scratch(ghcb, ghcb_pa + offsetof(struct ghcb, shared_buffer));
1454 1453
1455 return sev_es_ghcb_hv_call(ghcb, true, ctxt, exit_code, exit_info_1, exit_info_2);1454 return sev_es_ghcb_hv_call(ghcb, ctxt, exit_code, exit_info_1, exit_info_2);
1456}1455}
1457 1456
1458/*1457/*
@@ -1628,7 +1627,7 @@ static enum es_result vc_handle_dr7_write(struct ghcb *ghcb, · 169 unmodified lines
1628 1627
1629 /* Using a value of 0 for ExitInfo1 means RAX holds the value */1628 /* Using a value of 0 for ExitInfo1 means RAX holds the value */
1630 ghcb_set_rax(ghcb, val);1629 ghcb_set_rax(ghcb, val);
1631 ret = sev_es_ghcb_hv_call(ghcb, true, ctxt, SVM_EXIT_WRITE_DR7, 0, 0);1630 ret = sev_es_ghcb_hv_call(ghcb, ctxt, SVM_EXIT_WRITE_DR7, 0, 0);
1632 if (ret != ES_OK)1631 if (ret != ES_OK)
1633 return ret;1632 return ret;
1634 1633
@@ -1658,7 +1657,7 @@ static enum es_result vc_handle_dr7_read(struct ghcb *ghcb, · 23 unmodified lines
1658static enum es_result vc_handle_wbinvd(struct ghcb *ghcb,1657static enum es_result vc_handle_wbinvd(struct ghcb *ghcb,
1659 struct es_em_ctxt *ctxt)1658 struct es_em_ctxt *ctxt)
1660{1659{
1661 return sev_es_ghcb_hv_call(ghcb, true, ctxt, SVM_EXIT_WBINVD, 0, 0);1660 return sev_es_ghcb_hv_call(ghcb, ctxt, SVM_EXIT_WBINVD, 0, 0);
1662}1661}
1663 1662
1664static enum es_result vc_handle_rdpmc(struct ghcb *ghcb, struct es_em_ctxt *ctxt)1663static enum es_result vc_handle_rdpmc(struct ghcb *ghcb, struct es_em_ctxt *ctxt)
@@ -1667,7 +1666,7 @@ static enum es_result vc_handle_rdpmc(struct ghcb *ghcb, struct es_em_ctxt *ctxt · 2 unmodified lines
1667 1666
1668 ghcb_set_rcx(ghcb, ctxt->regs->cx);1667 ghcb_set_rcx(ghcb, ctxt->regs->cx);
1669 1668
1670 ret = sev_es_ghcb_hv_call(ghcb, true, ctxt, SVM_EXIT_RDPMC, 0, 0);1669 ret = sev_es_ghcb_hv_call(ghcb, ctxt, SVM_EXIT_RDPMC, 0, 0);
1671 if (ret != ES_OK)1670 if (ret != ES_OK)
1672 return ret;1671 return ret;
1673 1672
@@ -1708,7 +1707,7 @@ static enum es_result vc_handle_vmmcall(struct ghcb *ghcb, · 34 unmodified lines
1708 if (x86_platform.hyper.sev_es_hcall_prepare)1707 if (x86_platform.hyper.sev_es_hcall_prepare)
1709 x86_platform.hyper.sev_es_hcall_prepare(ghcb, ctxt->regs);1708 x86_platform.hyper.sev_es_hcall_prepare(ghcb, ctxt->regs);
1710 1709
1711 ret = sev_es_ghcb_hv_call(ghcb, true, ctxt, SVM_EXIT_VMMCALL, 0, 0);1710 ret = sev_es_ghcb_hv_call(ghcb, ctxt, SVM_EXIT_VMMCALL, 0, 0);
1712 if (ret != ES_OK)1711 if (ret != ES_OK)
1713 return ret;1712 return ret;
1714 1713
@@ -2197,7 +2196,7 @@ int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, unsigned · 482 unmodified lines
2197 ghcb_set_rbx(ghcb, input->data_npages);2196 ghcb_set_rbx(ghcb, input->data_npages);
2198 }2197 }
2199 2198
2200 ret = sev_es_ghcb_hv_call(ghcb, true, &ctxt, exit_code, input->req_gpa, input->resp_gpa);2199 ret = sev_es_ghcb_hv_call(ghcb, &ctxt, exit_code, input->req_gpa, input->resp_gpa);
2201 if (ret)2200 if (ret)
2202 goto e_put;2201 goto e_put;
2203 2202
kernel/configs/x86_debug.config+1−2
@@ -7,12 +7,11 @@ CONFIG_DEBUG_SLAB=y · 6 unmodified lines
7CONFIG_DEBUG_KMEMLEAK=y7CONFIG_DEBUG_KMEMLEAK=y
8CONFIG_DEBUG_PAGEALLOC=y8CONFIG_DEBUG_PAGEALLOC=y
9CONFIG_SLUB_DEBUG_ON=y9CONFIG_SLUB_DEBUG_ON=y
10CONFIG_KMEMCHECK=y
11CONFIG_DEBUG_OBJECTS=y10CONFIG_DEBUG_OBJECTS=y
12CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=111CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
13CONFIG_GCOV_KERNEL=y12CONFIG_GCOV_KERNEL=y
14CONFIG_LOCKDEP=y13CONFIG_LOCKDEP=y
15CONFIG_PROVE_LOCKING=y14CONFIG_PROVE_LOCKING=y
16CONFIG_SCHEDSTATS=y15CONFIG_SCHEDSTATS=y
17CONFIG_VMLINUX_VALIDATION=y16CONFIG_NOINSTR_VALIDATION=y
18CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y17CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y