Re: [PATCH v4 70/75] x86/head/64: Don't call verify_cpu() on starting APs

2020-07-20 Thread Joerg Roedel
On Wed, Jul 15, 2020 at 12:49:23PM -0700, Kees Cook wrote: > Aaah. I see. Thanks for the details there. So ... can you add a bunch > more comments about why/when the new entry path is being used? I really > don't want to accidentally discover some unrelated refactoring down > the road (in months,

Re: [PATCH v4 70/75] x86/head/64: Don't call verify_cpu() on starting APs

2020-07-15 Thread Kees Cook
On Wed, Jul 15, 2020 at 05:48:56PM +0200, Joerg Roedel wrote: > It is actually the CPUID instructions that cause #VC exceptions. The > MSRs that are accessed on AMD processors are not intercepted in the > hypervisors this code has been tested on, so these will not cause #VC > exceptions. Aaah. I

Re: [PATCH v4 70/75] x86/head/64: Don't call verify_cpu() on starting APs

2020-07-15 Thread Joerg Roedel
Hi Kees, as a general note: With SEV-ES the guest kernel will get #VC exceptions for events that, without SEV-ES, would just cause a #VMEXIT to the hypervisor. On Wed, Jul 15, 2020 at 08:26:14AM -0700, Kees Cook wrote: > On Wed, Jul 15, 2020 at 11:26:38AM +0200, Joerg Roedel wrote: > > That MSR

Re: [PATCH v4 70/75] x86/head/64: Don't call verify_cpu() on starting APs

2020-07-15 Thread Kees Cook
On Wed, Jul 15, 2020 at 11:26:38AM +0200, Joerg Roedel wrote: > Hi Kees, > > thanks for your reviews! > > On Tue, Jul 14, 2020 at 06:40:30PM -0700, Kees Cook wrote: > > Eek, no. MSR_IA32_MISC_ENABLE_XD_DISABLE needs to be cleared very early > > during CPU startup; this can't just be skipped. >

Re: [PATCH v4 70/75] x86/head/64: Don't call verify_cpu() on starting APs

2020-07-15 Thread Joerg Roedel
Hi Kees, thanks for your reviews! On Tue, Jul 14, 2020 at 06:40:30PM -0700, Kees Cook wrote: > Eek, no. MSR_IA32_MISC_ENABLE_XD_DISABLE needs to be cleared very early > during CPU startup; this can't just be skipped. That MSR is Intel-only, right? The boot-path installed here is only used for

Re: [PATCH v4 70/75] x86/head/64: Don't call verify_cpu() on starting APs

2020-07-14 Thread Kees Cook
On Tue, Jul 14, 2020 at 02:09:12PM +0200, Joerg Roedel wrote: > From: Joerg Roedel > > The APs are not ready to handle exceptions when verify_cpu() is called > in secondary_startup_64. Eek, no. MSR_IA32_MISC_ENABLE_XD_DISABLE needs to be cleared very early during CPU startup; this can't just be

[PATCH v4 70/75] x86/head/64: Don't call verify_cpu() on starting APs

2020-07-14 Thread Joerg Roedel
From: Joerg Roedel The APs are not ready to handle exceptions when verify_cpu() is called in secondary_startup_64. Signed-off-by: Joerg Roedel --- arch/x86/include/asm/realmode.h | 1 + arch/x86/kernel/head_64.S | 1 + arch/x86/realmode/init.c| 6 ++ 3 files changed, 8