1. 04 Dec, 2017 25 commits
    • Brijesh Singh's avatar
      KVM: SVM: Add KVM_SEV_INIT command · 1654efcb
      Brijesh Singh authored
      
      
      The command initializes the SEV platform context and allocates a new ASID
      for this guest from the SEV ASID pool. The firmware must be initialized
      before we issue any guest launch commands to create a new memory encryption
      context.
      
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: x86@kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      1654efcb
    • Brijesh Singh's avatar
      KVM: Define SEV key management command id · dc48bae0
      Brijesh Singh authored
      Define Secure Encrypted Virtualization (SEV) key management command id
      and structure. The command definition is available in SEV KM spec
      0.14 (http://support.amd.com/TechDocs/55766_SEV-KM
      
       API_Specification.pdf)
      and Documentation/virtual/kvm/amd-memory-encryption.txt.
      
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: Jonathan Corbet <corbet@lwn.net>
      Cc: x86@kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Improvements-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      dc48bae0
    • Brijesh Singh's avatar
      KVM: SVM: Add sev module_param · e9df0942
      Brijesh Singh authored
      
      
      The module parameter can be used to control the SEV feature support.
      
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: x86@kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      e9df0942
    • Brijesh Singh's avatar
      KVM: SVM: Reserve ASID range for SEV guest · ed3cd233
      Brijesh Singh authored
      
      
      A SEV-enabled guest must use ASIDs from the defined subset, while non-SEV
      guests can use the remaining ASID range. The range of allowed SEV guest
      ASIDs is [1 - CPUID_8000_001F[ECX][31:0]].
      
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: x86@kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Improvements-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      ed3cd233
    • Brijesh Singh's avatar
      KVM: X86: Add CONFIG_KVM_AMD_SEV · 5dd0a57c
      Brijesh Singh authored
      
      
      The config option can be used to enable SEV support on AMD Processors.
      
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: x86@kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      5dd0a57c
    • Brijesh Singh's avatar
      crypto: ccp: Implement SEV_PDH_CERT_EXPORT ioctl command · 76a2b524
      Brijesh Singh authored
      
      
      The SEV_PDH_CERT_EXPORT command can be used to export the PDH and its
      certificate chain. The command is defined in SEV spec section 5.10.
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Gary Hook <gary.hook@amd.com>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: linux-crypto@vger.kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Improvements-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Acked-by: default avatarGary R Hook <gary.hook@amd.com>
      76a2b524
    • Brijesh Singh's avatar
      crypto: ccp: Implement SEV_PEK_CERT_IMPORT ioctl command · 7360e4b1
      Brijesh Singh authored
      
      
      The SEV_PEK_CERT_IMPORT command can be used to import the signed PEK
      certificate. The command is defined in SEV spec section 5.8.
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Gary Hook <gary.hook@amd.com>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: linux-crypto@vger.kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Improvements-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Acked-by: default avatarGary R Hook <gary.hook@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      7360e4b1
    • Brijesh Singh's avatar
      crypto: ccp: Implement SEV_PEK_CSR ioctl command · e7990356
      Brijesh Singh authored
      
      
      The SEV_PEK_CSR command can be used to generate a PEK certificate
      signing request. The command is defined in SEV spec section 5.7.
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Gary Hook <gary.hook@amd.com>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: linux-crypto@vger.kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Improvements-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Acked-by: default avatarGary R Hook <gary.hook@amd.com>
      e7990356
    • Brijesh Singh's avatar
      crypto: ccp: Implement SEV_PDH_GEN ioctl command · 77f65327
      Brijesh Singh authored
      
      
      The SEV_PDH_GEN command is used to re-generate the Platform
      Diffie-Hellman (PDH) key. The command is defined in SEV spec section
      5.6.
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Gary Hook <gary.hook@amd.com>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: linux-crypto@vger.kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Acked-by: default avatarGary R Hook <gary.hook@amd.com>
      77f65327
    • Brijesh Singh's avatar
      crypto: ccp: Implement SEV_PEK_GEN ioctl command · 4d84b726
      Brijesh Singh authored
      
      
      The SEV_PEK_GEN command is used to generate a new Platform Endorsement
      Key (PEK). The command is defined in SEV spec section 5.6.
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Gary Hook <gary.hook@amd.com>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: linux-crypto@vger.kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Improvements-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Acked-by: default avatarGary R Hook <gary.hook@amd.com>
      4d84b726
    • Brijesh Singh's avatar
      crypto: ccp: Implement SEV_PLATFORM_STATUS ioctl command · efe1829b
      Brijesh Singh authored
      
      
      The SEV_PLATFORM_STATUS command can be used by the platform owner to
      get the current status of the platform. The command is defined in
      SEV spec section 5.5.
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Gary Hook <gary.hook@amd.com>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: linux-crypto@vger.kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Improvements-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Acked-by: default avatarGary R Hook <gary.hook@amd.com>
      efe1829b
    • Brijesh Singh's avatar
      crypto: ccp: Implement SEV_FACTORY_RESET ioctl command · 2960f9a5
      Brijesh Singh authored
      
      
      The SEV_FACTORY_RESET command can be used by the platform owner to
      reset the non-volatile SEV related data. The command is defined in
      SEV spec section 5.4
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Gary Hook <gary.hook@amd.com>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: linux-crypto@vger.kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Improvements-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      2960f9a5
    • Brijesh Singh's avatar
      crypto: ccp: Add Secure Encrypted Virtualization (SEV) command support · 200664d5
      Brijesh Singh authored
      AMD's new Secure Encrypted Virtualization (SEV) feature allows the
      memory contents of virtual machines to be transparently encrypted with a
      key unique to the VM. The programming and management of the encryption
      keys are handled by the AMD Secure Processor (AMD-SP) which exposes the
      commands for these tasks. The complete spec is available at:
      
      http://support.amd.com/TechDocs/55766_SEV-KM%20API_Specification.pdf
      
      
      
      Extend the AMD-SP driver to provide the following support:
      
       - an in-kernel API to communicate with the SEV firmware. The API can be
         used by the hypervisor to create encryption context for a SEV guest.
      
       - a userspace IOCTL to manage the platform certificates.
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Gary Hook <gary.hook@amd.com>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: linux-crypto@vger.kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Improvements-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      200664d5
    • Brijesh Singh's avatar
      crypto: ccp: Add Platform Security Processor (PSP) device support · 2a6170df
      Brijesh Singh authored
      
      
      The Platform Security Processor (PSP) is part of the AMD Secure
      Processor (AMD-SP) functionality. The PSP is a dedicated processor
      that provides support for key management commands in Secure Encrypted
      Virtualization (SEV) mode, along with software-based Trusted Execution
      Environment (TEE) to enable third-party trusted applications.
      
      Note that the key management functionality provided by the SEV firmware
      can be used outside of the kvm-amd driver hence it doesn't need to
      depend on CONFIG_KVM_AMD.
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Gary Hook <gary.hook@amd.com>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: linux-crypto@vger.kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Improvements-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      2a6170df
    • Brijesh Singh's avatar
      crypto: ccp: Define SEV key management command id · 592d5e74
      Brijesh Singh authored
      Define Secure Encrypted Virtualization (SEV) key management command id
      and structure. The command definition is available in SEV KM spec
      0.14 (http://support.amd.com/TechDocs/55766_SEV-KM
      
       API_Specification.pdf)
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Gary Hook <gary.hook@amd.com>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: linux-crypto@vger.kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Improvements-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Acked-by: default avatarGary R Hook <gary.hook@amd.com>
      592d5e74
    • Brijesh Singh's avatar
      crypto: ccp: Define SEV userspace ioctl and command id · 1d57b17c
      Brijesh Singh authored
      
      
      Add a include file which defines the ioctl and command id used for
      issuing SEV platform management specific commands.
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Gary Hook <gary.hook@amd.com>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: linux-crypto@vger.kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Improvements-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Acked-by: default avatarGary R Hook <gary.hook@amd.com>
      1d57b17c
    • Borislav Petkov's avatar
      crypto: ccp: Build the AMD secure processor driver only with AMD CPU support · 016db9c5
      Borislav Petkov authored
      
      
      This is AMD-specific hardware so present it in Kconfig only when AMD
      CPU support is enabled or on ARM64 where it is also used.
      Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarGary R Hook <gary.hook@amd.com>
      Cc: Brijesh Singh <brijesh.singh@amd.com>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: Gary Hook <gary.hook@amd.com>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: linux-crypto@vger.kernel.org
      016db9c5
    • Brijesh Singh's avatar
      KVM: Introduce KVM_MEMORY_ENCRYPT_{UN,}REG_REGION ioctl · 69eaedee
      Brijesh Singh authored
      
      
      If hardware supports memory encryption then KVM_MEMORY_ENCRYPT_REG_REGION
      and KVM_MEMORY_ENCRYPT_UNREG_REGION ioctl's can be used by userspace to
      register/unregister the guest memory regions which may contain the encrypted
      data (e.g guest RAM, PCI BAR, SMRAM etc).
      
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: x86@kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Improvements-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      69eaedee
    • Brijesh Singh's avatar
      KVM: Introduce KVM_MEMORY_ENCRYPT_OP ioctl · 5acc5c06
      Brijesh Singh authored
      
      
      If the hardware supports memory encryption then the
      KVM_MEMORY_ENCRYPT_OP ioctl can be used by qemu to issue a platform
      specific memory encryption commands.
      
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: x86@kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      5acc5c06
    • Brijesh Singh's avatar
      KVM: X86: Extend CPUID range to include new leaf · 8765d753
      Brijesh Singh authored
      
      
      This CPUID leaf provides the memory encryption support information on
      AMD Platform. Its complete description is available in APM volume 2,
      Section 15.34
      
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: x86@kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      8765d753
    • Brijesh Singh's avatar
      KVM: SVM: Prepare to reserve asid for SEV guest · 4faefff3
      Brijesh Singh authored
      
      
      Currently, ASID allocation start at 1. Add a svm_vcpu_data.min_asid
      which allows supplying a dynamic start ASID.
      
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: x86@kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      4faefff3
    • Tom Lendacky's avatar
      kvm: svm: Add SEV feature definitions to KVM · ba7c3398
      Tom Lendacky authored
      
      
      Define the SEV enable bit for the VMCB control structure. The hypervisor
      will use this bit to enable SEV in the guest.
      
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: x86@kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      ba7c3398
    • Tom Lendacky's avatar
      kvm: svm: prepare for new bit definition in nested_ctl · cea3a19b
      Tom Lendacky authored
      
      
      Currently the nested_ctl variable in the vmcb_control_area structure is
      used to indicate nested paging support. The nested paging support field
      is actually defined as bit 0 of the field. In order to support a new
      feature flag the usage of the nested_ctl and nested paging support must
      be converted to operate on a single bit.
      
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: x86@kernel.org
      Cc: kvm@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      cea3a19b
    • Tom Lendacky's avatar
      x86/CPU/AMD: Add the Secure Encrypted Virtualization CPU feature · 18c71ce9
      Tom Lendacky authored
      
      
      Update the CPU features to include identifying and reporting on the
      Secure Encrypted Virtualization (SEV) feature.  SEV is identified by
      CPUID 0x8000001f, but requires BIOS support to enable it (set bit 23 of
      MSR_K8_SYSCFG and set bit 0 of MSR_K7_HWCR).  Only show the SEV feature
      as available if reported by CPUID and enabled by BIOS.
      
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: kvm@vger.kernel.org
      Cc: x86@kernel.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      18c71ce9
    • Brijesh Singh's avatar
      Documentation/virtual/kvm: Add AMD Secure Encrypted Virtualization (SEV) · b38defdb
      Brijesh Singh authored
      
      
      Create a Documentation entry to describe the AMD Secure Encrypted
      Virtualization (SEV) feature.
      
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Jonathan Corbet <corbet@lwn.net>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: kvm@vger.kernel.org
      Cc: x86@kernel.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      b38defdb
  2. 27 Nov, 2017 1 commit
  3. 26 Nov, 2017 8 commits
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm · bbecb1cf
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
      
       - LPAE fixes for kernel-readonly regions
      
       - Fix for get_user_pages_fast on LPAE systems
      
       - avoid tying decompressor to a particular platform if DEBUG_LL is
         enabled
      
       - BUG if we attempt to return to userspace but the to-be-restored PSR
         value keeps us in privileged mode (defeating an issue that ftracetest
         found)
      
      * 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm:
        ARM: BUG if jumping to usermode address in kernel mode
        ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
        ARM: 8721/1: mm: dump: check hardware RO bit for LPAE
        ARM: make decompressor debug output user selectable
        ARM: fix get_user_pages_fast
      bbecb1cf
    • Linus Torvalds's avatar
      Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · dec0029a
      Linus Torvalds authored
      Pull irq fixes from Thomas Glexiner:
      
       - unbreak the irq trigger type check for legacy platforms
      
       - a handful fixes for ARM GIC v3/4 interrupt controllers
      
       - a few trivial fixes all over the place
      
      * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        genirq/matrix: Make - vs ?: Precedence explicit
        irqchip/imgpdc: Use resource_size function on resource object
        irqchip/qcom: Fix u32 comparison with value less than zero
        irqchip/exiu: Fix return value check in exiu_init()
        irqchip/gic-v3-its: Remove artificial dependency on PCI
        irqchip/gic-v4: Add forward definition of struct irq_domain_ops
        irqchip/gic-v3: pr_err() strings should end with newlines
        irqchip/s3c24xx: pr_err() strings should end with newlines
        irqchip/gic-v3: Fix ppi-partitions lookup
        irqchip/gic-v4: Clear IRQ_DISABLE_UNLAZY again if mapping fails
        genirq: Track whether the trigger type has been set
      dec0029a
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 02fc87b1
      Linus Torvalds authored
      Pull misc x86 fixes from Ingo Molnar:
       - topology enumeration fixes
       - KASAN fix
       - two entry fixes (not yet the big series related to KASLR)
       - remove obsolete code
       - instruction decoder fix
       - better /dev/mem sanity checks, hopefully working better this time
       - pkeys fixes
       - two ACPI fixes
       - 5-level paging related fixes
       - UMIP fixes that should make application visible faults more debuggable
       - boot fix for weird virtualization environment
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (24 commits)
        x86/decoder: Add new TEST instruction pattern
        x86/PCI: Remove unused HyperTransport interrupt support
        x86/umip: Fix insn_get_code_seg_params()'s return value
        x86/boot/KASLR: Remove unused variable
        x86/entry/64: Add missing irqflags tracing to native_load_gs_index()
        x86/mm/kasan: Don't use vmemmap_populate() to initialize shadow
        x86/entry/64: Fix entry_SYSCALL_64_after_hwframe() IRQ tracing
        x86/pkeys/selftests: Fix protection keys write() warning
        x86/pkeys/selftests: Rename 'si_pkey' to 'siginfo_pkey'
        x86/mpx/selftests: Fix up weird arrays
        x86/pkeys: Update documentation about availability
        x86/umip: Print a warning into the syslog if UMIP-protected instructions are used
        x86/smpboot: Fix __max_logical_packages estimate
        x86/topology: Avoid wasting 128k for package id array
        perf/x86/intel/uncore: Cache logical pkg id in uncore driver
        x86/acpi: Reduce code duplication in mp_override_legacy_irq()
        x86/acpi: Handle SCI interrupts above legacy space gracefully
        x86/boot: Fix boot failure when SMP MP-table is based at 0
        x86/mm: Limit mmap() of /dev/mem to valid physical addresses
        x86/selftests: Add test for mapping placement for 5-level paging
        ...
      02fc87b1
    • Linus Torvalds's avatar
      Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 6830c8db
      Linus Torvalds authored
      Pull scheduler fixes from Ingo Molnar:
       "Misc fixes: a documentation fix, a Sparse warning fix and a debugging
        fix"
      
      * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/debug: Fix task state recording/printout
        sched/deadline: Don't use dubious signed bitfields
        sched/deadline: Fix the description of runtime accounting in the documentation
      6830c8db
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 580e3d55
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "Misc fixes: two PMU driver fixes and a memory leak fix"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/core: Fix memory leak triggered by perf --namespace
        perf/x86/intel/uncore: Add event constraint for BDX PCU
        perf/x86/intel: Hide TSX events when RTM is not supported
      580e3d55
    • Linus Torvalds's avatar
      Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · cd4b5d5d
      Linus Torvalds authored
      Pull static key fix from Ingo Molnar:
       "Fix a boot warning related to bad init ordering of the static keys
        self-test"
      
      * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        jump_label: Invoke jump_label_test() via early_initcall()
      cd4b5d5d
    • Linus Torvalds's avatar
      Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · fcbc38b1
      Linus Torvalds authored
      Pull objtool fixes from Ingo Molnar:
       "A handful of objtool fixes, most of them related to making the UAPI
        header-syncing warnings easier to read and easier to act upon"
      
      * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        tools/headers: Sync objtool UAPI header
        objtool: Fix cross-build
        objtool: Move kernel headers/code sync check to a script
        objtool: Move synced files to their original relative locations
        objtool: Make unreachable annotation inline asms explicitly volatile
        objtool: Add a comment for the unreachable annotation macros
      fcbc38b1
    • Russell King's avatar
      ARM: BUG if jumping to usermode address in kernel mode · 8bafae20
      Russell King authored
      
      
      Detect if we are returning to usermode via the normal kernel exit paths
      but the saved PSR value indicates that we are in kernel mode.  This
      could occur due to corrupted stack state, which has been observed with
      "ftracetest".
      
      This ensures that we catch the problem case before we get to user code.
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      8bafae20
  4. 25 Nov, 2017 6 commits
    • Linus Torvalds's avatar
      Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 844056fd
      Linus Torvalds authored
      Pull timer updates from Thomas Gleixner:
      
       - The final conversion of timer wheel timers to timer_setup().
      
         A few manual conversions and a large coccinelle assisted sweep and
         the removal of the old initialization mechanisms and the related
         code.
      
       - Remove the now unused VSYSCALL update code
      
       - Fix permissions of /proc/timer_list. I still need to get rid of that
         file completely
      
       - Rename a misnomed clocksource function and remove a stale declaration
      
      * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (27 commits)
        m68k/macboing: Fix missed timer callback assignment
        treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts
        timer: Remove redundant __setup_timer*() macros
        timer: Pass function down to initialization routines
        timer: Remove unused data arguments from macros
        timer: Switch callback prototype to take struct timer_list * argument
        timer: Pass timer_list pointer to callbacks unconditionally
        Coccinelle: Remove setup_timer.cocci
        timer: Remove setup_*timer() interface
        timer: Remove init_timer() interface
        treewide: setup_timer() -> timer_setup() (2 field)
        treewide: setup_timer() -> timer_setup()
        treewide: init_timer() -> setup_timer()
        treewide: Switch DEFINE_TIMER callbacks to struct timer_list *
        s390: cmm: Convert timers to use timer_setup()
        lightnvm: Convert timers to use timer_setup()
        drivers/net: cris: Convert timers to use timer_setup()
        drm/vc4: Convert timers to use timer_setup()
        block/laptop_mode: Convert timers to use timer_setup()
        net/atm/mpc: Avoid open-coded assignment of timer callback function
        ...
      844056fd
    • Linus Torvalds's avatar
      Merge tag 'arc-4.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc · ca122fe3
      Linus Torvalds authored
      Pull ARC updates from Vineet Gupta:
      
       - more changes for HS48 cores: supporting MMUv5, detecting new
         micro-arch gizmos
      
       - axs10x platform wiring up reset driver merged in this cycle
      
       - ARC perf driver optimizations
      
      * tag 'arc-4.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
        ARC: perf: avoid vmalloc backed mmap
        ARCv2: perf: optimize given that num counters <= 32
        ARCv2: perf: tweak overflow interrupt
        ARC: [plat-axs10x] DTS: Add reset controller node to manage ethernet reset
        ARCv2: boot log: updates for HS48: dual-issue, ECC, Loop Buffer
        ARCv2: Accomodate HS48 MMUv5 by relaxing MMU ver checking
        ARC: [plat-axs10x] auto-select AXS101 or AXS103 given the  ISA config
      ca122fe3
    • Linus Torvalds's avatar
      Merge tag 'kbuild-v4.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild · 5e2fda47
      Linus Torvalds authored
      Pull more Kbuild updates from Masahiro Yamada:
      
       - use 'pwd' instead of '/bin/pwd' for portability
      
       - clean up Makefiles
      
       - fix ld-option for clang
      
       - fix malloc'ed data size in Kconfig
      
       - fix parallel building along with coccicheck
      
       - fix a minor issue of package building
      
       - prompt to use "rpm-pkg" instead of "rpm"
      
       - clean up *.i and *.lst patterns by "make clean"
      
      * tag 'kbuild-v4.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        kbuild: drop $(extra-y) from real-objs-y
        kbuild: clean up *.i and *.lst patterns by make clean
        kbuild: rpm: prompt to use "rpm-pkg" if "rpm" target is used
        kbuild: pkg: use --transform option to prefix paths in tar
        coccinelle: fix parallel build with CHECK=scripts/coccicheck
        kconfig/symbol.c: use correct pointer type argument for sizeof
        kbuild: Set KBUILD_CFLAGS before incl. arch Makefile
        kbuild: remove all dummy assignments to obj-
        kbuild: create built-in.o automatically if parent directory wants it
        kbuild: /bin/pwd -> pwd
      5e2fda47
    • Linus Torvalds's avatar
      Merge tag 'afs-fixes-20171124' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs · f61ec2c9
      Linus Torvalds authored
      Pull AFS fixes from David Howells:
      
       - Make AFS file locking work again.
      
       - Don't write to a page that's being written out, but wait for it to
         complete.
      
       - Do d_drop() and d_add() in the right places.
      
       - Put keys on error paths.
      
       - Remove some redundant code.
      
      * tag 'afs-fixes-20171124' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
        afs: remove redundant assignment of dvnode to itself
        afs: cell: Remove unnecessary code in afs_lookup_cell
        afs: Fix signal handling in some file ops
        afs: Fix some dentry handling in dir ops and missing key_puts
        afs: Make afs_write_begin() avoid writing to a page that's being stored
        afs: Fix file locking
      f61ec2c9
    • Linus Torvalds's avatar
      Merge tag 'kvm-4.15-2' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 7753ea09
      Linus Torvalds authored
      Pull KVM updates from Radim Krčmář:
       "Trimmed second batch of KVM changes for Linux 4.15:
      
         - GICv4 Support for KVM/ARM
      
         - re-introduce support for CPUs without virtual NMI (cc stable) and
           allow testing of KVM without virtual NMI on available CPUs
      
         - fix long-standing performance issues with assigned devices on AMD
           (cc stable)"
      
      * tag 'kvm-4.15-2' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (30 commits)
        kvm: vmx: Allow disabling virtual NMI support
        kvm: vmx: Reinstate support for CPUs without virtual NMI
        KVM: SVM: obey guest PAT
        KVM: arm/arm64: Don't queue VLPIs on INV/INVALL
        KVM: arm/arm64: Fix GICv4 ITS initialization issues
        KVM: arm/arm64: GICv4: Theory of operations
        KVM: arm/arm64: GICv4: Enable VLPI support
        KVM: arm/arm64: GICv4: Prevent userspace from changing doorbell affinity
        KVM: arm/arm64: GICv4: Prevent a VM using GICv4 from being saved
        KVM: arm/arm64: GICv4: Enable virtual cpuif if VLPIs can be delivered
        KVM: arm/arm64: GICv4: Hook vPE scheduling into vgic flush/sync
        KVM: arm/arm64: GICv4: Use the doorbell interrupt as an unblocking source
        KVM: arm/arm64: GICv4: Add doorbell interrupt handling
        KVM: arm/arm64: GICv4: Use pending_last as a scheduling hint
        KVM: arm/arm64: GICv4: Handle INVALL applied to a vPE
        KVM: arm/arm64: GICv4: Propagate property updates to VLPIs
        KVM: arm/arm64: GICv4: Handle MOVALL applied to a vPE
        KVM: arm/arm64: GICv4: Handle CLEAR applied to a VLPI
        KVM: arm/arm64: GICv4: Propagate affinity changes to the physical ITS
        KVM: arm/arm64: GICv4: Unmap VLPI when freeing an LPI
        ...
      7753ea09
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 83ada031
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       "A small batch of fixes, about 50% tagged for stable and the rest for
        recently merged code.
      
        There's one more fix for the >128T handling on hash. Once a process
        had requested a single mmap above 128T we would then always search
        above 128T. The correct behaviour is to consider the hint address in
        isolation for each mmap request.
      
        Then a couple of fixes for the IMC PMU, a missing EXPORT_SYMBOL in
        VAS, a fix for STRICT_KERNEL_RWX on 32-bit, and a fix to correctly
        identify P9 DD2.1 but in code that is currently not used by default.
      
        Thanks to: Aneesh Kumar K.V, Christophe Leroy, Madhavan Srinivasan,
        Sukadev Bhattiprolu"
      
      * tag 'powerpc-4.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/64s: Fix Power9 DD2.1 logic in DT CPU features
        powerpc/perf: Fix IMC_MAX_PMU macro
        powerpc/perf: Fix pmu_count to count only nest imc pmus
        powerpc: Fix boot on BOOK3S_32 with CONFIG_STRICT_KERNEL_RWX
        powerpc/perf/imc: Use cpu_to_node() not topology_physical_package_id()
        powerpc/vas: Export chip_to_vas_id()
        powerpc/64s/slice: Use addr limit when computing slice mask
      83ada031