From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B521CC05027 for ; Wed, 1 Feb 2023 19:32:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232067AbjBATcg (ORCPT ); Wed, 1 Feb 2023 14:32:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51054 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229539AbjBATce (ORCPT ); Wed, 1 Feb 2023 14:32:34 -0500 Received: from mail-pj1-x102a.google.com (mail-pj1-x102a.google.com [IPv6:2607:f8b0:4864:20::102a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A99A37E6F8 for ; Wed, 1 Feb 2023 11:32:33 -0800 (PST) Received: by mail-pj1-x102a.google.com with SMTP id ha3-20020a17090af3c300b00230222051a6so3035503pjb.2 for ; Wed, 01 Feb 2023 11:32:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date:from:to :cc:subject:date:message-id:reply-to; bh=OSNJYInipZ/N9ZUlMjv2BtkVzR+GxKWJaOF0xjf8sH0=; b=n0XHt3yTCHKeaO4XN7poQwSbwm5p0ibDhgBbGgHE1Z51vm2IxOnnotcKpSRhjOBgna SBfZdqOrcJ5CosUP+/2g2+I7mKqa5H86hJuB/LqJqvjrfOMseqnP0NqmgSOst/eGp+Qk SQYmiahkedKUkTF5sUiQtJIT67vRO9EQYHG8yUTnqK3+bBTfFKa5UtL/OZwHJfz/CHSi lK987MpGyEILVvDOc9yQS8r/KkEmcB5uiIMeq0z6Jee9p5FZGX/p9XVixJMp8IACGHmg w3cmn7niWpgWWUNh37jjBMp3pATN98WRIEvHr0A6jTjzRKsuyND8SE/8aJvwTt2J9F7l K7Fg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=OSNJYInipZ/N9ZUlMjv2BtkVzR+GxKWJaOF0xjf8sH0=; b=hiDaUp+BoTu9vh54awxba+Ad0FfFuvebLhnp4Z44zMeAh2L7laWe1zUSiTJ+jAtawJ ar2OqyOhuzV8lpoMQKKW9WSywKGGZiWeyhznDoC/fHUWMNejVEXNeeS795KzNV+IWAOC xnKVAfL31Y1TSfo9CJXcYAsnQko3yvMCqW8yGT6V/Pea0Lyl4QcndfzX+jMqJmkc/Vow 2AIehBzllOsp5U2vv7cXjRIzM9Qs49olgh8et+GLDhw28absmrno2JmKoGiIiaeafH1c a4WVa+tgEFSpIHFkxl9ax0AJ/EPcs9ktybMWBSjruMJ/HVqtVRexD5cwvd1OsxVzKeUv +V/Q== X-Gm-Message-State: AO0yUKWQWOit8r7BUQXK8Ddp9j9C8ojl1jY2pzC4GZTPUru0zpHZRQJ5 w7gSVvACrQo9/ZWC9yZNkWqKGA== X-Google-Smtp-Source: AK7set/zucsS9D2hpiVndzXHJgUmEJcgKvG+FCH2SmbUMSy5FQQHyBGezNmvucp1jzbItlqYuTkWjA== X-Received: by 2002:a17:902:c944:b0:198:af4f:de13 with SMTP id i4-20020a170902c94400b00198af4fde13mr58116pla.19.1675279953012; Wed, 01 Feb 2023 11:32:33 -0800 (PST) Received: from google.com (7.104.168.34.bc.googleusercontent.com. [34.168.104.7]) by smtp.gmail.com with ESMTPSA id z28-20020a63b91c000000b004785a63b44bsm11008653pge.43.2023.02.01.11.32.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 01 Feb 2023 11:32:32 -0800 (PST) Date: Wed, 1 Feb 2023 19:32:29 +0000 From: Sean Christopherson To: Borislav Petkov Cc: Alexey Kardashevskiy , kvm@vger.kernel.org, x86@kernel.org, linux-kernel@vger.kernel.org, Yury Norov , Venu Busireddy , Tony Luck , Tom Lendacky , Thomas Gleixner , Sandipan Das , Pawan Gupta , Paolo Bonzini , Michael Roth , Mario Limonciello , Kim Phillips , Kees Cook , Juergen Gross , Jakub Kicinski , Ingo Molnar , Dave Hansen , Daniel Sneddon , Brijesh Singh , Arnaldo Carvalho de Melo , Andrew Cooper , Alexander Shishkin , Adrian Hunter , "Peter Zijlstra (Intel)" , "Jason A. Donenfeld" , "H. Peter Anvin" Subject: Re: [PATCH kernel v3 2/3] KVM: SEV: Enable data breakpoints in SEV-ES Message-ID: References: <20230120031047.628097-1-aik@amd.com> <20230120031047.628097-3-aik@amd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Feb 01, 2023, Sean Christopherson wrote: > On Tue, Jan 31, 2023, Borislav Petkov wrote: > > Hey Sean, > > > > On Fri, Jan 20, 2023 at 02:10:46PM +1100, Alexey Kardashevskiy wrote: > > > Prior to SEV-ES, KVM stored/loaded host debug registers upon switching > > > to/from a VM. Changing those registers inside a running SEV VM > > > triggered #VC exit to KVM. > > > > > > SEV-ES added the encrypted state (ES) which uses an encrypted guest page > > > for the VM state (VMSA). The hardware saves/restores certain registers on > > > VMRUN/VMEXIT according to a swap type (A, B, C), see > > > "Table B-3. Swap Types" in the AMD Architecture Programmer’s Manual > > > volume 2. > > > > > > AMD Milan (Fam 19h) introduces support for the debug registers swapping. > > > DR6 and DR7 are always swapped. DR[0-3] and DR[0-3]_ADDR_MASK are swapped > > > a type B when SEV_FEATURES[5] ("DebugSwap") is set. > > > > > > Enable DebugSwap in VMSA. But only do so if CPUID Fn80000021_EAX[0] > > > ("NoNestedDataBp", "Processor ignores nested data breakpoints") is > > > supported by the SOC as otherwise a malicious SEV-ES guest can set up > > > data breakpoints on the #VC IDT entry/stack and cause an infinite loop. > > > > > > Eliminate DR7 and #DB intercepts as: > > > - they are not needed when DebugSwap is supported; > > > - #VC for these intercepts is most likely not supported anyway and > > > kills the VM. > > > Keep DR7 intercepted unless DebugSwap enabled to prevent the infinite #DB > > > loop DoS. > > > > ... > > > > ok to take this through the tip tree? > > I would prefer to take this through KVM, there's enough subtle complexity in this > code that it'd be nice to have it close by. > > If you're happy with patch 1, maybe ack that one and take it through KVM, and > route patch 3 through tip? Ah, you've already applied 1. That works too. I don't think KVM support for DebugSwap is going to make v6.3 no matter who takes what, so just base on the next version of this patch on tip/x86/cpu and I'll make a mental note to not try to grab this until after v6.3-rc1.