Messages in this thread | | | Date | Mon, 3 Jul 2023 12:01:49 +1000 | Subject | Re: [PATCH kernel 5/9] KVM: SVM/SEV/SEV-ES: Rework intercepts | From | Alexey Kardashevskiy <> |
| |
On 1/7/23 07:49, Sean Christopherson wrote: > On Thu, Jun 15, 2023, Alexey Kardashevskiy wrote: >> @@ -2976,6 +2977,16 @@ static void sev_es_init_vmcb(struct vcpu_svm *svm) >> svm_set_intercept(svm, TRAP_CR4_WRITE); >> svm_set_intercept(svm, TRAP_CR8_WRITE); >> >> + /* >> + * DR7 access must remain intercepted for an SEV-ES guest to disallow >> + * the guest kernel set up a #DB on memory that's needed to vector a #DB >> + * as otherwise the CPU gets stuck in an infinite #DB loop. >> + */ > > This isn't correct. Letting the guest configuring breakpoints would be weird > and nonsensical, but it wouldn't lead to infinite #DBs so long as KVM intercepts > #DB.
True. OTOH not intercepting #DB and intercepting only DR7 would do the same thing.
> KVM intercepts DR7 when DebugSwap isn't enabled because otherwise KVM has no way > of context switching DR[0-3] for the guest. At least, I assume that's the case, > AFAICT the APM never actually says what happens with DR[0-3] when DebugSwap is > disabled.
This is the SEV-ES code, no DR[0-3] context switching anyway, is not it?
The actual immediate reason for intercepting DR7 is "SEV-ES GHCB" but this does not really explain it to me :-/
4.5 Debug Register Support Currently, hardware debug traps are not supported for an SEV-ES guest. The hypervisor must set the intercept for both read and write of the debug control register (DR7). With the intercepts in place, the #VC handler will be invoked when the guest accesses DR7. For a write to DR7, the #VC handler should perform Standard VMGExit processing. The #VC handler must not update the actual DR7 register, but rather it should cache the DR7 value being written. For a read of DR7, the #VC handler should return the cached value of the DR7 register.
-- Alexey
| |