linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Brijesh Singh <brijesh.singh@amd.com>
To: Sean Christopherson <sean.j.christopherson@intel.com>,
	Tom Lendacky <thomas.lendacky@amd.com>
Cc: brijesh.singh@amd.com, kvm@vger.kernel.org,
	linux-kernel@vger.kernel.org, x86@kernel.org,
	Paolo Bonzini <pbonzini@redhat.com>,
	Jim Mattson <jmattson@google.com>, Joerg Roedel <joro@8bytes.org>,
	Vitaly Kuznetsov <vkuznets@redhat.com>,
	Wanpeng Li <wanpengli@tencent.com>,
	Borislav Petkov <bp@alien8.de>, Ingo Molnar <mingo@redhat.com>,
	Thomas Gleixner <tglx@linutronix.de>
Subject: Re: [RFC PATCH 00/35] SEV-ES hypervisor support
Date: Tue, 15 Sep 2020 15:05:13 -0500	[thread overview]
Message-ID: <06d33abf-28aa-5f1e-2d7e-0b62e77e01e0@amd.com> (raw)
In-Reply-To: <20200915173202.GF8420@sjchrist-ice>


On 9/15/20 12:32 PM, Sean Christopherson wrote:
> On Tue, Sep 15, 2020 at 12:22:05PM -0500, Tom Lendacky wrote:
>> On 9/14/20 5:59 PM, Sean Christopherson wrote:
>>> On Mon, Sep 14, 2020 at 03:15:14PM -0500, Tom Lendacky wrote:
>>>> From: Tom Lendacky <thomas.lendacky@amd.com>
>>>>
>>>> This patch series provides support for running SEV-ES guests under KVM.
>>> From the x86/VMX side of things, the GPR hooks are the only changes that I
>>> strongly dislike.
>>>
>>> For the vmsa_encrypted flag and related things like allow_debug(), I'd
>>> really like to aim for a common implementation between SEV-ES and TDX[*] from
>>> the get go, within reason obviously.  From a code perspective, I don't think
>>> it will be too onerous as the basic tenets are quite similar, e.g. guest
>>> state is off limits, FPU state is autoswitched, etc..., but I suspect (or
>>> maybe worry?) that there are enough minor differences that we'll want a more
>>> generic way of marking ioctls() as disallowed to avoid having one-off checks
>>> all over the place.
>>>
>>> That being said, it may also be that there are some ioctls() that should be
>>> disallowed under SEV-ES, but aren't in this series.  E.g. I assume
>>> kvm_vcpu_ioctl_smi() should be rejected as KVM can't do the necessary
>>> emulation (I assume this applies to vanilla SEV as well?).
>> Right, SMM isn't currently supported under SEV-ES. SEV does support SMM,
>> though, since the register state can be altered to change over to the SMM
>> register state. So the SMI ioctl() is ok for SEV.
> But isn't guest memory inaccessible for SEV?  E.g. how does KVM emulate the
> save/restore to/from SMRAM?


In SEV, to support the SMM, the guest BIOS (Ovmf) maps the SMM state
save area as unencrypted. This allows the KVM to access the SMM state
saved area as unencrypted.  SVM also provides intercepts for the RSM, so
KVM does not need to fetch and decode the instruction bytes to know
whether the VMEXIT was due to exiting from the SMM mode.



  reply	other threads:[~2020-09-15 20:05 UTC|newest]

Thread overview: 86+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-14 20:15 [RFC PATCH 00/35] SEV-ES hypervisor support Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 01/35] KVM: SVM: Remove the call to sev_platform_status() during setup Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 02/35] KVM: SVM: Add support for SEV-ES capability in KVM Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 03/35] KVM: SVM: Add indirect access to the VM save area Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 04/35] KVM: SVM: Make GHCB accessor functions available to the hypervisor Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 05/35] KVM: SVM: Add initial support for SEV-ES GHCB access to KVM Tom Lendacky
     [not found]   ` <20200914205801.GA7084@sjchrist-ice>
2020-09-15 13:24     ` Tom Lendacky
2020-09-15 16:28       ` Sean Christopherson
2020-09-16 14:54         ` Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 06/35] KVM: SVM: Add required changes to support intercepts under SEV-ES Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 07/35] KVM: SVM: Modify DRx register intercepts for an SEV-ES guest Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 08/35] KVM: SVM: Prevent debugging under SEV-ES Tom Lendacky
2020-09-14 21:26   ` Sean Christopherson
2020-09-15 13:37     ` Tom Lendacky
2020-09-15 16:30       ` Sean Christopherson
2020-09-15 20:13         ` Tom Lendacky
2020-09-16 15:11           ` Tom Lendacky
2020-09-16 16:02             ` Sean Christopherson
2020-09-16 16:38               ` Tom Lendacky
2020-09-16 16:49                 ` Sean Christopherson
2020-09-16 20:27                   ` Tom Lendacky
2020-09-16 22:50                     ` Sean Christopherson
2020-09-17 16:27                       ` Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 09/35] KVM: SVM: Do not emulate MMIO " Tom Lendacky
2020-09-14 21:33   ` Sean Christopherson
2020-09-15 13:38     ` Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 10/35] KVM: SVM: Cannot re-initialize the VMCB after shutdown with SEV-ES Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 11/35] KVM: SVM: Prepare for SEV-ES exit handling in the sev.c file Tom Lendacky
     [not found]   ` <20200915172148.GE8420@sjchrist-ice>
2020-09-16 16:22     ` Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 12/35] KVM: SVM: Add initial support for a VMGEXIT VMEXIT Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 13/35] KVM: SVM: Create trace events for VMGEXIT processing Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 14/35] KVM: SVM: Add support for SEV-ES GHCB MSR protocol function 0x002 Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 15/35] KVM: SVM: Add support for SEV-ES GHCB MSR protocol function 0x004 Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 16/35] KVM: SVM: Add support for SEV-ES GHCB MSR protocol function 0x100 Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 17/35] KVM: SVM: Create trace events for VMGEXIT MSR protocol processing Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 18/35] KVM: SVM: Support MMIO for an SEV-ES guest Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 19/35] KVM: SVM: Support port IO operations " Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 20/35] KVM: SVM: Add SEV/SEV-ES support for intercepting INVD Tom Lendacky
2020-09-14 22:00   ` Sean Christopherson
2020-09-15 15:08     ` Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 21/35] KVM: SVM: Add support for EFER write traps for an SEV-ES guest Tom Lendacky
     [not found]   ` <20200914220800.GI7192@sjchrist-ice>
2020-09-15 15:45     ` Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 22/35] KVM: SVM: Add support for CR0 " Tom Lendacky
2020-09-14 22:13   ` Sean Christopherson
2020-09-15 15:56     ` Tom Lendacky
2020-11-30 18:15     ` Paolo Bonzini
2020-09-14 20:15 ` [RFC PATCH 23/35] KVM: SVM: Add support for CR4 " Tom Lendacky
2020-09-14 22:16   ` Sean Christopherson
2020-11-30 18:16     ` Paolo Bonzini
2020-09-14 20:15 ` [RFC PATCH 24/35] KVM: SVM: Add support for CR8 " Tom Lendacky
2020-09-14 22:19   ` Sean Christopherson
2020-09-15 15:57     ` Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 25/35] KVM: x86: Update __get_sregs() / __set_sregs() to support SEV-ES Tom Lendacky
2020-09-14 21:37   ` Sean Christopherson
2020-09-15 14:19     ` Tom Lendacky
     [not found]       ` <20200915163342.GC8420@sjchrist-ice>
2020-09-15 20:37         ` Tom Lendacky
2020-09-15 22:44           ` Sean Christopherson
2020-11-30 18:28             ` Paolo Bonzini
2020-11-30 19:39               ` Sean Christopherson
2020-09-14 20:15 ` [RFC PATCH 26/35] KVM: SVM: Guest FPU state save/restore not needed for SEV-ES guest Tom Lendacky
     [not found]   ` <20200914213917.GD7192@sjchrist-ice>
2020-09-15 14:25     ` Tom Lendacky
2020-09-15 16:34       ` Sean Christopherson
2020-09-14 20:15 ` [RFC PATCH 27/35] KVM: SVM: Add support for booting APs for an " Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 28/35] KVM: X86: Update kvm_skip_emulated_instruction() " Tom Lendacky
2020-09-14 21:51   ` Sean Christopherson
2020-09-15 14:57     ` Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 29/35] KVM: SVM: Add NMI support " Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 30/35] KVM: SVM: Set the encryption mask for the SVM host save area Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 31/35] KVM: SVM: Update ASID allocation to support SEV-ES guests Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 32/35] KVM: SVM: Provide support for SEV-ES vCPU creation/loading Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 33/35] KVM: SVM: Provide support for SEV-ES vCPU loading Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 34/35] KVM: SVM: Provide an updated VMRUN invocation for SEV-ES guests Tom Lendacky
2020-09-14 20:15 ` [RFC PATCH 35/35] KVM: SVM: Provide support to launch and run an SEV-ES guest Tom Lendacky
2020-09-14 22:59 ` [RFC PATCH 00/35] SEV-ES hypervisor support Sean Christopherson
2020-09-15 17:22   ` Tom Lendacky
2020-09-15 17:32     ` Sean Christopherson
2020-09-15 20:05       ` Brijesh Singh [this message]
2020-09-16  0:19     ` Sean Christopherson
2020-10-13 20:26       ` Tom Lendacky
2020-11-30 15:31       ` Paolo Bonzini
2020-11-30 16:06         ` Tom Lendacky
2020-11-30 18:18           ` Sean Christopherson
2020-11-30 18:14         ` Sean Christopherson
2020-11-30 18:35           ` Paolo Bonzini
2020-11-30 19:35             ` Sean Christopherson
2020-11-30 20:24               ` Paolo Bonzini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=06d33abf-28aa-5f1e-2d7e-0b62e77e01e0@amd.com \
    --to=brijesh.singh@amd.com \
    --cc=bp@alien8.de \
    --cc=jmattson@google.com \
    --cc=joro@8bytes.org \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=sean.j.christopherson@intel.com \
    --cc=tglx@linutronix.de \
    --cc=thomas.lendacky@amd.com \
    --cc=vkuznets@redhat.com \
    --cc=wanpengli@tencent.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).