Messages in this thread Patch in this message | | | From | Alexey Kardashevskiy <> | Subject | [PATCH kernel v5] x86/sev: Do not handle #VC for DR7 read/write | Date | Wed, 16 Aug 2023 12:21:22 +1000 |
| |
With MSR_AMD64_SEV_DEBUG_SWAP enabled, the guest is not expected to receive a #VC for reads or writes of DR7.
Update the SNP_FEATURES_PRESENT mask with MSR_AMD64_SNP_DEBUG_SWAP so an SNP guest doesn't gracefully terminate during SNP feature negotiation if MSR_AMD64_SEV_DEBUG_SWAP is enabled.
Since a guest is not expected to receive a #VC on DR7 accesses when MSR_AMD64_SEV_DEBUG_SWAP is enabled, return an error from the #VC handler in this situation.
Signed-off-by: Alexey Kardashevskiy <aik@amd.com> Reviewed-by: Carlos Bilbao <carlos.bilbao@amd.com> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com> ---
The KVM part of DebugSwap went to kvm-x86 tree: https://lore.kernel.org/all/169058576410.1024559.1052772292093755719.b4-ty@google.com/ but it is been suggested that this one can go via TIP: https://lore.kernel.org/all/ZGv+Y60qvbjeTY57@google.com/ I am trying to bribe now by reviewing patches (internally), does this work? :) Thanks,
--- Changes: v5: * rebased on latest TIP
v4: * rebased on top of SNP feature negotiation
v2: * use new bit definition --- arch/x86/boot/compressed/sev.c | 2 +- arch/x86/kernel/sev.c | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c index 199155b8af3b..dc8c876fbd8f 100644 --- a/arch/x86/boot/compressed/sev.c +++ b/arch/x86/boot/compressed/sev.c @@ -365,7 +365,7 @@ static void enforce_vmpl0(void) * by the guest kernel. As and when a new feature is implemented in the * guest kernel, a corresponding bit should be added to the mask. */ -#define SNP_FEATURES_PRESENT (0) +#define SNP_FEATURES_PRESENT MSR_AMD64_SNP_DEBUG_SWAP u64 snp_get_unsupported_features(u64 status) { diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c index a2b50ae61b72..2787826d9f60 100644 --- a/arch/x86/kernel/sev.c +++ b/arch/x86/kernel/sev.c @@ -1575,6 +1575,9 @@ static enum es_result vc_handle_dr7_write(struct ghcb *ghcb, long val, *reg = vc_insn_get_rm(ctxt); enum es_result ret; + if (sev_status & MSR_AMD64_SNP_DEBUG_SWAP) + return ES_VMM_ERROR; + if (!reg) return ES_DECODE_FAILED; @@ -1612,6 +1615,9 @@ static enum es_result vc_handle_dr7_read(struct ghcb *ghcb, struct sev_es_runtime_data *data = this_cpu_read(runtime_data); long *reg = vc_insn_get_rm(ctxt); + if (sev_status & MSR_AMD64_SNP_DEBUG_SWAP) + return ES_VMM_ERROR; + if (!reg) return ES_DECODE_FAILED; -- 2.41.0
| |