Messages in this thread |  | | Subject | Re: [PATCH v8 08/40] x86/sev: Check the vmpl level | From | Brijesh Singh <> | Date | Tue, 4 Jan 2022 09:23:25 -0600 |
| |
On 12/20/21 12:10 PM, Borislav Petkov wrote: > On Fri, Dec 17, 2021 at 04:33:02PM -0600, Tom Lendacky wrote: >>>>>> + * There is no straightforward way to query the current VMPL level. The >>>>>> + * simplest method is to use the RMPADJUST instruction to change a page >>>>>> + * permission to a VMPL level-1, and if the guest kernel is launched at >>>>>> + * a level <= 1, then RMPADJUST instruction will return an error. >>>>> Perhaps a nit. When you say "level <= 1", do you mean a level lower than or >>>>> equal to 1 semantically, or numerically? >>> >>> Its numerically, please see the AMD APM vol 3. >> >> Actually it is not numerically... if it was numerically, then 0 <= 1 would >> return an error, but VMPL0 is the highest permission level. > > Just write in that comment exactly what this function does: > > "RMPADJUST modifies RMP permissions of a lesser-privileged (numerically > higher) privilege level. Here, clear the VMPL1 permission mask of the > GHCB page. If the guest is not running at VMPL0, this will fail. > > If the guest is running at VMP0, it will succeed. Even if that operation > modifies permission bits, it is still ok to do currently because Linux > SNP guests are supported only on VMPL0 so VMPL1 or higher permission > masks changing is a don't-care." > > and then everything is clear wrt numbering, privilege, etc. > > Ok? >
Noted.
thanks
|  |