* [PATCH kernel v5] x86/sev: Do not handle #VC for DR7 read/write
@ 2023-08-16 2:21 Alexey Kardashevskiy
2023-08-16 8:19 ` Borislav Petkov
2023-08-16 8:26 ` [tip: x86/sev] " tip-bot2 for Alexey Kardashevskiy
0 siblings, 2 replies; 3+ messages in thread
From: Alexey Kardashevskiy @ 2023-08-16 2:21 UTC (permalink / raw)
To: x86
Cc: linux-kernel, Borislav Petkov, Alexey Kardashevskiy,
Carlos Bilbao, Tom Lendacky, Pankaj Gupta
With MSR_AMD64_SEV_DEBUG_SWAP enabled, the guest is not expected to
receive a #VC for reads or writes of DR7.
Update the SNP_FEATURES_PRESENT mask with MSR_AMD64_SNP_DEBUG_SWAP so
an SNP guest doesn't gracefully terminate during SNP feature negotiation
if MSR_AMD64_SEV_DEBUG_SWAP is enabled.
Since a guest is not expected to receive a #VC on DR7 accesses when
MSR_AMD64_SEV_DEBUG_SWAP is enabled, return an error from the #VC
handler in this situation.
Signed-off-by: Alexey Kardashevskiy <aik@amd.com>
Reviewed-by: Carlos Bilbao <carlos.bilbao@amd.com>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
---
The KVM part of DebugSwap went to kvm-x86 tree:
https://lore.kernel.org/all/169058576410.1024559.1052772292093755719.b4-ty@google.com/
but it is been suggested that this one can go via TIP:
https://lore.kernel.org/all/ZGv+Y60qvbjeTY57@google.com/
I am trying to bribe now by reviewing patches (internally), does this
work? :) Thanks,
---
Changes:
v5:
* rebased on latest TIP
v4:
* rebased on top of SNP feature negotiation
v2:
* use new bit definition
---
arch/x86/boot/compressed/sev.c | 2 +-
arch/x86/kernel/sev.c | 6 ++++++
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c
index 199155b8af3b..dc8c876fbd8f 100644
--- a/arch/x86/boot/compressed/sev.c
+++ b/arch/x86/boot/compressed/sev.c
@@ -365,7 +365,7 @@ static void enforce_vmpl0(void)
* by the guest kernel. As and when a new feature is implemented in the
* guest kernel, a corresponding bit should be added to the mask.
*/
-#define SNP_FEATURES_PRESENT (0)
+#define SNP_FEATURES_PRESENT MSR_AMD64_SNP_DEBUG_SWAP
u64 snp_get_unsupported_features(u64 status)
{
diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c
index a2b50ae61b72..2787826d9f60 100644
--- a/arch/x86/kernel/sev.c
+++ b/arch/x86/kernel/sev.c
@@ -1575,6 +1575,9 @@ static enum es_result vc_handle_dr7_write(struct ghcb *ghcb,
long val, *reg = vc_insn_get_rm(ctxt);
enum es_result ret;
+ if (sev_status & MSR_AMD64_SNP_DEBUG_SWAP)
+ return ES_VMM_ERROR;
+
if (!reg)
return ES_DECODE_FAILED;
@@ -1612,6 +1615,9 @@ static enum es_result vc_handle_dr7_read(struct ghcb *ghcb,
struct sev_es_runtime_data *data = this_cpu_read(runtime_data);
long *reg = vc_insn_get_rm(ctxt);
+ if (sev_status & MSR_AMD64_SNP_DEBUG_SWAP)
+ return ES_VMM_ERROR;
+
if (!reg)
return ES_DECODE_FAILED;
--
2.41.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH kernel v5] x86/sev: Do not handle #VC for DR7 read/write
2023-08-16 2:21 [PATCH kernel v5] x86/sev: Do not handle #VC for DR7 read/write Alexey Kardashevskiy
@ 2023-08-16 8:19 ` Borislav Petkov
2023-08-16 8:26 ` [tip: x86/sev] " tip-bot2 for Alexey Kardashevskiy
1 sibling, 0 replies; 3+ messages in thread
From: Borislav Petkov @ 2023-08-16 8:19 UTC (permalink / raw)
To: Alexey Kardashevskiy
Cc: x86, linux-kernel, Carlos Bilbao, Tom Lendacky, Pankaj Gupta
On Wed, Aug 16, 2023 at 12:21:22PM +1000, Alexey Kardashevskiy wrote:
> With MSR_AMD64_SEV_DEBUG_SWAP enabled, the guest is not expected to
> receive a #VC for reads or writes of DR7.
>
> Update the SNP_FEATURES_PRESENT mask with MSR_AMD64_SNP_DEBUG_SWAP so
> an SNP guest doesn't gracefully terminate during SNP feature negotiation
> if MSR_AMD64_SEV_DEBUG_SWAP is enabled.
>
> Since a guest is not expected to receive a #VC on DR7 accesses when
> MSR_AMD64_SEV_DEBUG_SWAP is enabled, return an error from the #VC
> handler in this situation.
>
> Signed-off-by: Alexey Kardashevskiy <aik@amd.com>
> Reviewed-by: Carlos Bilbao <carlos.bilbao@amd.com>
> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
> Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
> ---
>
> The KVM part of DebugSwap went to kvm-x86 tree:
> https://lore.kernel.org/all/169058576410.1024559.1052772292093755719.b4-ty@google.com/
> but it is been suggested that this one can go via TIP:
> https://lore.kernel.org/all/ZGv+Y60qvbjeTY57@google.com/
> I am trying to bribe now by reviewing patches (internally), does this
> work? :) Thanks,
Oh yeah, most definitely! Anyone can bribe me when helping out with
review.
I very much appreciate people helping out with review so thanks!
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
^ permalink raw reply [flat|nested] 3+ messages in thread
* [tip: x86/sev] x86/sev: Do not handle #VC for DR7 read/write
2023-08-16 2:21 [PATCH kernel v5] x86/sev: Do not handle #VC for DR7 read/write Alexey Kardashevskiy
2023-08-16 8:19 ` Borislav Petkov
@ 2023-08-16 8:26 ` tip-bot2 for Alexey Kardashevskiy
1 sibling, 0 replies; 3+ messages in thread
From: tip-bot2 for Alexey Kardashevskiy @ 2023-08-16 8:26 UTC (permalink / raw)
To: linux-tip-commits
Cc: Alexey Kardashevskiy, Borislav Petkov (AMD),
Carlos Bilbao, Tom Lendacky, Pankaj Gupta, x86, linux-kernel
The following commit has been merged into the x86/sev branch of tip:
Commit-ID: e221804dad4e6fe3a0cf192ba3c42cd2f328bdac
Gitweb: https://git.kernel.org/tip/e221804dad4e6fe3a0cf192ba3c42cd2f328bdac
Author: Alexey Kardashevskiy <aik@amd.com>
AuthorDate: Wed, 16 Aug 2023 12:21:22 +10:00
Committer: Borislav Petkov (AMD) <bp@alien8.de>
CommitterDate: Wed, 16 Aug 2023 10:13:42 +02:00
x86/sev: Do not handle #VC for DR7 read/write
With MSR_AMD64_SEV_DEBUG_SWAP enabled, the guest is not expected to
receive a #VC for reads or writes of DR7.
Update the SNP_FEATURES_PRESENT mask with MSR_AMD64_SNP_DEBUG_SWAP so
an SNP guest doesn't gracefully terminate during SNP feature negotiation
if MSR_AMD64_SEV_DEBUG_SWAP is enabled.
Since a guest is not expected to receive a #VC on DR7 accesses when
MSR_AMD64_SEV_DEBUG_SWAP is enabled, return an error from the #VC
handler in this situation.
Signed-off-by: Alexey Kardashevskiy <aik@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Carlos Bilbao <carlos.bilbao@amd.com>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
Link: https://lore.kernel.org/r/20230816022122.981998-1-aik@amd.com
---
arch/x86/boot/compressed/sev.c | 2 +-
arch/x86/kernel/sev.c | 6 ++++++
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c
index c3e343b..e83e710 100644
--- a/arch/x86/boot/compressed/sev.c
+++ b/arch/x86/boot/compressed/sev.c
@@ -365,7 +365,7 @@ static void enforce_vmpl0(void)
* by the guest kernel. As and when a new feature is implemented in the
* guest kernel, a corresponding bit should be added to the mask.
*/
-#define SNP_FEATURES_PRESENT (0)
+#define SNP_FEATURES_PRESENT MSR_AMD64_SNP_DEBUG_SWAP
void snp_check_features(void)
{
diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c
index 1ee7bed..d380c93 100644
--- a/arch/x86/kernel/sev.c
+++ b/arch/x86/kernel/sev.c
@@ -1575,6 +1575,9 @@ static enum es_result vc_handle_dr7_write(struct ghcb *ghcb,
long val, *reg = vc_insn_get_rm(ctxt);
enum es_result ret;
+ if (sev_status & MSR_AMD64_SNP_DEBUG_SWAP)
+ return ES_VMM_ERROR;
+
if (!reg)
return ES_DECODE_FAILED;
@@ -1612,6 +1615,9 @@ static enum es_result vc_handle_dr7_read(struct ghcb *ghcb,
struct sev_es_runtime_data *data = this_cpu_read(runtime_data);
long *reg = vc_insn_get_rm(ctxt);
+ if (sev_status & MSR_AMD64_SNP_DEBUG_SWAP)
+ return ES_VMM_ERROR;
+
if (!reg)
return ES_DECODE_FAILED;
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-08-16 8:27 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-08-16 2:21 [PATCH kernel v5] x86/sev: Do not handle #VC for DR7 read/write Alexey Kardashevskiy
2023-08-16 8:19 ` Borislav Petkov
2023-08-16 8:26 ` [tip: x86/sev] " tip-bot2 for Alexey Kardashevskiy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).