| Message ID | 20230411125718.2297768-7-aik@amd.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: SEV: Enable AMD SEV-ES DebugSwap | expand |
On Tue, Apr 11, 2023, Alexey Kardashevskiy wrote: > With MSR_AMD64_SEV_DEBUG_SWAP enabled, the guest is not expected to > receive a #VC for reads or writes of DR7. > > Update the SNP_FEATURES_PRESENT mask with MSR_AMD64_SNP_DEBUG_SWAP so > an SNP guest doesn't gracefully terminate during SNP feature negotiation > if MSR_AMD64_SEV_DEBUG_SWAP is enabled. > > Since a guest is not expected to receive a #VC on DR7 accesses when > MSR_AMD64_SEV_DEBUG_SWAP is enabled, return an error from the #VC > handler in this situation. > > Signed-off-by: Alexey Kardashevskiy <aik@amd.com> > Reviewed-by: Carlos Bilbao <carlos.bilbao@amd.com> > Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> > Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com> > --- > Changes: > v4: > * rebased on top of SNP feature negotiation > > v2: > * use new bit definition > --- > arch/x86/boot/compressed/sev.c | 2 +- > arch/x86/kernel/sev.c | 6 ++++++ > 2 files changed, 7 insertions(+), 1 deletion(-) Can you post this separately (or bribe Boris to grab it)? IIUC, this has no dependency on the KVM enabling, i.e. can/should go through the tip tree without waiting for the KVM patches to be applied.
On 23/5/23 09:44, Sean Christopherson wrote: > On Tue, Apr 11, 2023, Alexey Kardashevskiy wrote: >> With MSR_AMD64_SEV_DEBUG_SWAP enabled, the guest is not expected to >> receive a #VC for reads or writes of DR7. >> >> Update the SNP_FEATURES_PRESENT mask with MSR_AMD64_SNP_DEBUG_SWAP so >> an SNP guest doesn't gracefully terminate during SNP feature negotiation >> if MSR_AMD64_SEV_DEBUG_SWAP is enabled. >> >> Since a guest is not expected to receive a #VC on DR7 accesses when >> MSR_AMD64_SEV_DEBUG_SWAP is enabled, return an error from the #VC >> handler in this situation. >> >> Signed-off-by: Alexey Kardashevskiy <aik@amd.com> >> Reviewed-by: Carlos Bilbao <carlos.bilbao@amd.com> >> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> >> Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com> >> --- >> Changes: >> v4: >> * rebased on top of SNP feature negotiation >> >> v2: >> * use new bit definition >> --- >> arch/x86/boot/compressed/sev.c | 2 +- >> arch/x86/kernel/sev.c | 6 ++++++ >> 2 files changed, 7 insertions(+), 1 deletion(-) > > Can you post this separately (or bribe Boris to grab it)? IIUC, this has no > dependency on the KVM enabling, i.e. can/should go through the tip tree without > waiting for the KVM patches to be applied. I definitely can, do you mind adding yours "rb"/"ab"? Thanks!
diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c index 014b89c89088..f6123808be42 100644 --- a/arch/x86/boot/compressed/sev.c +++ b/arch/x86/boot/compressed/sev.c @@ -313,7 +313,7 @@ static void enforce_vmpl0(void) * by the guest kernel. As and when a new feature is implemented in the * guest kernel, a corresponding bit should be added to the mask. */ -#define SNP_FEATURES_PRESENT (0) +#define SNP_FEATURES_PRESENT MSR_AMD64_SNP_DEBUG_SWAP void snp_check_features(void) { diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c index b031244d6d2d..a515eb880970 100644 --- a/arch/x86/kernel/sev.c +++ b/arch/x86/kernel/sev.c @@ -1620,6 +1620,9 @@ static enum es_result vc_handle_dr7_write(struct ghcb *ghcb, long val, *reg = vc_insn_get_rm(ctxt); enum es_result ret; + if (sev_status & MSR_AMD64_SNP_DEBUG_SWAP) + return ES_VMM_ERROR; + if (!reg) return ES_DECODE_FAILED; @@ -1657,6 +1660,9 @@ static enum es_result vc_handle_dr7_read(struct ghcb *ghcb, struct sev_es_runtime_data *data = this_cpu_read(runtime_data); long *reg = vc_insn_get_rm(ctxt); + if (sev_status & MSR_AMD64_SNP_DEBUG_SWAP) + return ES_VMM_ERROR; + if (!reg) return ES_DECODE_FAILED;