From patchwork Tue Apr 11 12:57:13 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexey Kardashevskiy X-Patchwork-Id: 13207524 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51CD0C77B6F for ; Tue, 11 Apr 2023 12:58:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229862AbjDKM6M (ORCPT ); Tue, 11 Apr 2023 08:58:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51306 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229477AbjDKM6J (ORCPT ); Tue, 11 Apr 2023 08:58:09 -0400 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (mail-co1nam11on2046.outbound.protection.outlook.com [40.107.220.46]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DBBB1ED; Tue, 11 Apr 2023 05:58:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=euT1s5Lk/y5WmAIXcBQB9inBQ6svBoexutAEtPHOVygTGbTAqBgRgpRQkdJXMMtQjJFwwfacFpH1yRBmoUdKOtuFWGUk8fg8da4pCTqm89+QN5ZWuouV9olUiM/2XF8HlpV8c2//5yyeJWQ14M7QTQbHibsOqK3m0lDKPMrqaCzwDXQObjOk52n2P60gY5X5MwS7l1f7gvXemY4+mnydCcMRQwS4csaGdNj1K4NAL8warYdiUNOpI7DVSx033+YE4J2vHcTJDCeZawbZLli8EnGKwXYrdurT5eZkar8zAK1brwx5bLbxkq1uXyyXurRTALsu99rH3JevJbgakci5bw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ZldQZbVfyxm+JxRPm5ZrtW35+VCndOiNJLwQFrZH3/g=; b=QlwG9H9J4DQflOVzt9vGPvxB7yOshC24U3cokkqhFgXc3c7sA4L8IBDZcpW5Fv+TbU/Vpd1kusuiC77ZxCETRKJ8kXG1rOXtWAc61LkQ9xb/3/wvKQaKP1EQRqX/r+XlOB4MXkpkAqYQT76CCwQoYd9DcmtP6on8omHCH3LegLOn+/nbjrmKmNnO+EaXoDbIuvxjlJy48CTz++Zh2OnUJEEK+rF4qjQnVcm6qDBXIaeGSO64c6z3n0dfZhM+fcDph8wM/9UUhZ73dtbIhLDUTZmnmXdMPHs/EtladZP+2AbCVmjID3/To8Fs8dUfSzD3txk50J5CpOq+QT1437kzyA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZldQZbVfyxm+JxRPm5ZrtW35+VCndOiNJLwQFrZH3/g=; b=358hOxhCuQVwgB63wvtTKQhFZVB1T3ZH/H7tjmVZp6C/eo3IRVvTJQUlhy8CMPl5ktmk5un2aK0aSL4SKawDtEHjLhk0Rh1107mdBiCipykE4TK/MDhHJPjmxFfFUpwULCh9m666cBkJWo+XdV0f78pN5shkyzc7d5xhqXQg6Y0= Received: from MW4PR04CA0172.namprd04.prod.outlook.com (2603:10b6:303:85::27) by MW3PR12MB4489.namprd12.prod.outlook.com (2603:10b6:303:5e::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.38; Tue, 11 Apr 2023 12:57:59 +0000 Received: from CO1NAM11FT108.eop-nam11.prod.protection.outlook.com (2603:10b6:303:85:cafe::b7) by MW4PR04CA0172.outlook.office365.com (2603:10b6:303:85::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.39 via Frontend Transport; Tue, 11 Apr 2023 12:57:59 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by CO1NAM11FT108.mail.protection.outlook.com (10.13.175.226) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.6298.28 via Frontend Transport; Tue, 11 Apr 2023 12:57:59 +0000 Received: from aiemdeew.1.ozlabs.ru (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.34; Tue, 11 Apr 2023 07:57:54 -0500 From: Alexey Kardashevskiy To: CC: , , Tom Lendacky , Sean Christopherson , "Pankaj Gupta" , Nikunj A Dadhania , "Santosh Shukla" , Carlos Bilbao , Alexey Kardashevskiy Subject: [PATCH kernel v5 1/6] KVM: SEV: move set_dr_intercepts/clr_dr_intercepts from the header Date: Tue, 11 Apr 2023 22:57:13 +1000 Message-ID: <20230411125718.2297768-2-aik@amd.com> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230411125718.2297768-1-aik@amd.com> References: <20230411125718.2297768-1-aik@amd.com> MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB04.amd.com (10.181.40.145) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CO1NAM11FT108:EE_|MW3PR12MB4489:EE_ X-MS-Office365-Filtering-Correlation-Id: 43e13825-4d49-4e59-91ec-08db3a8c60c5 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: cBR+Q+L/lx6c6jx5lhStzeuMZNBBYFFdipt5Q7bVw5xttBXw/g3WxZvSMj63cRYR1inFkIBvxemPhtqMYpsEA23tIaM27C98xgDMNp3QLCtq9pH0QQAYnWDsD/9hOwEqfVel7T8cMlixs2wxqeou5kJhjJoBUbPj4Q4kiBedS/knot9wAPSbDFnzcxqhKhJ3ctvxnZreOsrduANfX2fH3jDS0jSMWSxfLn9fPIckXAUsJzdDZIqvbSlhnztx+bJ5czr3dAfdNo7T1HS0xlKb5RVzSm6jiEgFNfa3o5+275SZw9hBqFyDNtgs9c7s4FwNiGxP74Vpih0sbWKki6T8RnTbn/W+GamZKCtQBZL8NKbcek8gIhBRx3wBVkS5BzqPqaE1gFjrPNq5SF+LlDXnRH29VC6Fdb1XXp4ER/a92WvyehYWITZK6+/b73uqvp6SseSP+5vqgXM9V+3/dCwUGOZEvAO7gP5QJmlOqBmEG+guf++/TxOA0VkKdOLDsJ3U0ikgHcdyk1BkgPc1xh7ipzIi4hnaBdreB8SydFG2i0cxsdnQoOK+SxtdTNCU26F1Ew50V2vxU6OT08qcyT3/i1LAwLJNakTc1gNwLLaVapbychV+W1nVAoKOKFoKiq9mmaWjGWvRYFkCKUA6c9Wp99LFxjMLvYpJ09hQ0VhNR0bxtRCSdwZiHuv2LQUb/aKYRxHt+nDZYfW/roCR82MdVqNodVToarcuwaPkn4b7yBE= X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:SATLEXMB04.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230028)(4636009)(136003)(39860400002)(396003)(376002)(346002)(451199021)(46966006)(40470700004)(36840700001)(40460700003)(478600001)(4326008)(6916009)(54906003)(8676002)(70206006)(41300700001)(316002)(70586007)(36756003)(83380400001)(426003)(336012)(2616005)(26005)(1076003)(6666004)(2906002)(8936002)(40480700001)(5660300002)(82310400005)(36860700001)(82740400003)(356005)(16526019)(186003)(81166007)(47076005)(36900700001);DIR:OUT;SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Apr 2023 12:57:59.4887 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 43e13825-4d49-4e59-91ec-08db3a8c60c5 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT108.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW3PR12MB4489 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org Static functions set_dr_intercepts() and clr_dr_intercepts() are only called from SVM so move them to .c. No functional change intended. Signed-off-by: Alexey Kardashevskiy Reviewed-by: Carlos Bilbao Reviewed-by: Tom Lendacky Reviewed-by: Santosh Shukla --- Changes: v5: * new in the series --- arch/x86/kvm/svm/svm.h | 42 -------------------- arch/x86/kvm/svm/svm.c | 42 ++++++++++++++++++++ 2 files changed, 42 insertions(+), 42 deletions(-) diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 839809972da1..4deec59be71b 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -403,48 +403,6 @@ static inline bool vmcb12_is_intercept(struct vmcb_ctrl_area_cached *control, u3 return test_bit(bit, (unsigned long *)&control->intercepts); } -static inline void set_dr_intercepts(struct vcpu_svm *svm) -{ - struct vmcb *vmcb = svm->vmcb01.ptr; - - if (!sev_es_guest(svm->vcpu.kvm)) { - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR0_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR1_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR2_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR3_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR4_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR5_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR6_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR0_WRITE); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR1_WRITE); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR2_WRITE); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR3_WRITE); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR4_WRITE); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR5_WRITE); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR6_WRITE); - } - - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_WRITE); - - recalc_intercepts(svm); -} - -static inline void clr_dr_intercepts(struct vcpu_svm *svm) -{ - struct vmcb *vmcb = svm->vmcb01.ptr; - - vmcb->control.intercepts[INTERCEPT_DR] = 0; - - /* DR7 access must remain intercepted for an SEV-ES guest */ - if (sev_es_guest(svm->vcpu.kvm)) { - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_WRITE); - } - - recalc_intercepts(svm); -} - static inline void set_exception_intercept(struct vcpu_svm *svm, u32 bit) { struct vmcb *vmcb = svm->vmcb01.ptr; diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index a1b08359769b..1e1c1eb13392 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -687,6 +687,48 @@ static int svm_cpu_init(int cpu) } +static void set_dr_intercepts(struct vcpu_svm *svm) +{ + struct vmcb *vmcb = svm->vmcb01.ptr; + + if (!sev_es_guest(svm->vcpu.kvm)) { + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR0_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR1_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR2_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR3_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR4_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR5_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR6_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR0_WRITE); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR1_WRITE); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR2_WRITE); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR3_WRITE); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR4_WRITE); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR5_WRITE); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR6_WRITE); + } + + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_WRITE); + + recalc_intercepts(svm); +} + +static void clr_dr_intercepts(struct vcpu_svm *svm) +{ + struct vmcb *vmcb = svm->vmcb01.ptr; + + vmcb->control.intercepts[INTERCEPT_DR] = 0; + + /* DR7 access must remain intercepted for an SEV-ES guest */ + if (sev_es_guest(svm->vcpu.kvm)) { + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_WRITE); + } + + recalc_intercepts(svm); +} + static int direct_access_msr_slot(u32 msr) { u32 i; From patchwork Tue Apr 11 12:57:14 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexey Kardashevskiy X-Patchwork-Id: 13207525 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8CDEAC77B6F for ; Tue, 11 Apr 2023 12:58:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229787AbjDKM63 (ORCPT ); Tue, 11 Apr 2023 08:58:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51988 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229458AbjDKM61 (ORCPT ); Tue, 11 Apr 2023 08:58:27 -0400 Received: from NAM04-MW2-obe.outbound.protection.outlook.com (mail-mw2nam04on2088.outbound.protection.outlook.com [40.107.101.88]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D17BF49CF; Tue, 11 Apr 2023 05:58:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dX5dSqxCKp/8uvRSy5+ooB4aBs1vNfvk6J3Jcwb7YCs8hfXCO1Juubia5QRTPkaYyVVvHWrDkoTfHU67dgs+uTQXdYiYmF2US1pQwwshLz0iuElkZx0cyCmgE6qLNEwaErkodhJd0iXQGEP48y/3zALe7vHJq3CQ/uWFGZ6BWwPBPeSUf+8XMGEp3evauiWqUFZeX248aHVqpJcYMwWOTYCm03ofBjuvf2n29mSNjeGHH4sqTd/qKXMMaEsWlFyhSWdZhmEogIYGyviet1043WmjF4iD9qT79S8wFe/UWTQX1g8t2/hARbb6gsN44vVeDWqMc7CI4rem2ecNxPnWhg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=FuByVT643bdw8QFPZxSQ5U8zZSAol1+19KDcOn4tXEc=; b=Xwl5jRPcICSdGMMiF2go4UtBwVmOQMoITeP+IMdrqxIL3mXbfzC9ZCOflMLOlEOv8PtsBuJJwoT1P7j3aJA/f6+jBoWfoLvs1GzfskshiIn+/VB5R05Qzgt02XMqxq6GTFVp+Y/ndzvco286ZENcwN/MBuHSloQCowS00gTVecSBSxsxdu4eCJ0mlxpq4ZHGwtcOGcL67snjELm/Hzz/nGDBlwVKPB6KlwEmvPGxk2F3yVqlvG7vs3meHSV/2bGhEUFMB2zQGABnEy8PTOFEugconNG+1IufsqXstG7gAswpsQk1apawgy0+txCSK4x7XaErcQjFVLi8efmTD/7DDg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FuByVT643bdw8QFPZxSQ5U8zZSAol1+19KDcOn4tXEc=; b=LdDpqjDA7S6J/ct14OF+BjS0Nr4egfWcZxUqcK68a63/AylYEmVGHyj30TS+n0Y/IFKAEeOtXiQWOMsi3gnZPanpFk8wvbUJ48fUmDAhaIsqVQxk1GgFF8K66AOC2GtV6UxkumMytL2Iv7DULbUe7PfbKbQzCcejJWhSfsyEGHk= Received: from MW4PR03CA0222.namprd03.prod.outlook.com (2603:10b6:303:b9::17) by BL1PR12MB5922.namprd12.prod.outlook.com (2603:10b6:208:399::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.31; Tue, 11 Apr 2023 12:58:20 +0000 Received: from CO1NAM11FT109.eop-nam11.prod.protection.outlook.com (2603:10b6:303:b9:cafe::6b) by MW4PR03CA0222.outlook.office365.com (2603:10b6:303:b9::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.38 via Frontend Transport; Tue, 11 Apr 2023 12:58:19 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by CO1NAM11FT109.mail.protection.outlook.com (10.13.174.176) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.6298.28 via Frontend Transport; Tue, 11 Apr 2023 12:58:19 +0000 Received: from aiemdeew.1.ozlabs.ru (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.34; Tue, 11 Apr 2023 07:58:14 -0500 From: Alexey Kardashevskiy To: CC: , , Tom Lendacky , Sean Christopherson , "Pankaj Gupta" , Nikunj A Dadhania , "Santosh Shukla" , Carlos Bilbao , Alexey Kardashevskiy Subject: [PATCH kernel v5 2/6] KVM: SEV: Move SEV's GP_VECTOR intercept setup to SEV Date: Tue, 11 Apr 2023 22:57:14 +1000 Message-ID: <20230411125718.2297768-3-aik@amd.com> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230411125718.2297768-1-aik@amd.com> References: <20230411125718.2297768-1-aik@amd.com> MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB04.amd.com (10.181.40.145) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CO1NAM11FT109:EE_|BL1PR12MB5922:EE_ X-MS-Office365-Filtering-Correlation-Id: e283461c-13e7-42e3-7a32-08db3a8c6ccd X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: WG/EdI/MH68MVcPGu1YEf6QHXxNsvScgK9p0j73iiS9NDneeEBDtpheXTEdmawOhp8ehFYxAqGNPmc347TM9iN4vK/NOejLc/NkyCpxIA2WZMNcCNqKQ9fi9nsd/V5JDCazd9RDq8lnDdc8+KMm0y3tq3FO4ULuKZjdxJ2m/S7mX3urINqUUjZJIs9k2vqvIPm2irI2CC4OvUz3cNmWotJ1qMUDOh7pNOzcsADXyxkEPAd3HzIx92/GS/ewH979rTLt6M2SqK9DrjJ5J5QLw3H1amIPLTiV6SC2qCro5dcUc6R4SS2K01rSK6FO7tZrtwdnS8+36V9RrHtwTBYOCVJP2QTE8JSfqkX5lBvYj3bm3z9mVj9J+9BesQKIy8SIb01e44qdzSQ2sKlUlkCLw2w8etvcBToR7poVMFE82P1HZ+VPLylkVEER1xACjNnCL8TviAB9WZ/TIo3NTLfA8HVqo4gL8M8TFAGifzMKmrJZFqVmzQTANUVr5tI/XkbADJR+XliF0+ELne0E0u+T8umlivLFxYc6jI4Z/b1Y+pWVlv602M9H/7HoH89KWdA2qcFYiMGg5nDkgBS7OMic2ur+rcEsNxLPIMtOOKYg8ep69UcZaHlz+R1xUQcDw3L2ljE/2W2+7UrIzNakPRrbsqmFp+4qJsVHsv9owaMxiFUiX+42Y/8NVF++KY1780wM6ckJWXOgQ7QvEfWZHsriOojQUZLBh874mcgtXj/6tHjg= X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:SATLEXMB04.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230028)(4636009)(396003)(39860400002)(136003)(376002)(346002)(451199021)(40470700004)(46966006)(36840700001)(47076005)(336012)(2616005)(83380400001)(36860700001)(16526019)(478600001)(316002)(1076003)(26005)(54906003)(2906002)(4326008)(5660300002)(81166007)(36756003)(426003)(40460700003)(82740400003)(70206006)(82310400005)(41300700001)(70586007)(6916009)(8676002)(8936002)(356005)(40480700001)(186003)(36900700001);DIR:OUT;SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Apr 2023 12:58:19.6732 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: e283461c-13e7-42e3-7a32-08db3a8c6ccd X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT109.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR12MB5922 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org Currently SVM setup is done sequentially in init_vmcb() -> sev_init_vmcb() -> sev_es_init_vmcb() and tries keeping SVM/SEV/SEV-ES bits separated. One of the exceptions is #GP intercept which init_vmcb() skips setting for SEV guests and then sev_es_init_vmcb() needlessly clears it. Remove the SEV check from init_vmcb(). Clear the #GP intercept in sev_init_vmcb(). SEV-ES will use the SEV setting. No functional change intended. Suggested-by: Sean Christopherson Signed-off-by: Alexey Kardashevskiy Reviewed-by: Carlos Bilbao Reviewed-by: Tom Lendacky Reviewed-by: Santosh Shukla --- Changes: v5: * new in the series --- arch/x86/kvm/svm/sev.c | 9 ++++++--- arch/x86/kvm/svm/svm.c | 5 ++--- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index c25aeb550cd9..0f4761a57d86 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -2968,9 +2968,6 @@ static void sev_es_init_vmcb(struct vcpu_svm *svm) svm_set_intercept(svm, TRAP_CR4_WRITE); svm_set_intercept(svm, TRAP_CR8_WRITE); - /* No support for enable_vmware_backdoor */ - clr_exception_intercept(svm, GP_VECTOR); - /* Can't intercept XSETBV, HV can't modify XCR0 directly */ svm_clr_intercept(svm, INTERCEPT_XSETBV); @@ -2996,6 +2993,12 @@ void sev_init_vmcb(struct vcpu_svm *svm) svm->vmcb->control.nested_ctl |= SVM_NESTED_CTL_SEV_ENABLE; clr_exception_intercept(svm, UD_VECTOR); + /* + * Don't intercept #GP for SEV guests, e.g. for the VMware backdoor, as + * KVM can't decrypt guest memory to decode the faulting instruction. + */ + clr_exception_intercept(svm, GP_VECTOR); + if (sev_es_guest(svm->vcpu.kvm)) sev_es_init_vmcb(svm); } diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 1e1c1eb13392..dc12de325cca 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -1253,10 +1253,9 @@ static void init_vmcb(struct kvm_vcpu *vcpu) * Guest access to VMware backdoor ports could legitimately * trigger #GP because of TSS I/O permission bitmap. * We intercept those #GP and allow access to them anyway - * as VMware does. Don't intercept #GP for SEV guests as KVM can't - * decrypt guest memory to decode the faulting instruction. + * as VMware does. */ - if (enable_vmware_backdoor && !sev_guest(vcpu->kvm)) + if (enable_vmware_backdoor) set_exception_intercept(svm, GP_VECTOR); svm_set_intercept(svm, INTERCEPT_INTR); From patchwork Tue Apr 11 12:57:15 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexey Kardashevskiy X-Patchwork-Id: 13207526 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE475C76196 for ; Tue, 11 Apr 2023 12:58:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229913AbjDKM6y (ORCPT ); Tue, 11 Apr 2023 08:58:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52702 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229541AbjDKM6w (ORCPT ); Tue, 11 Apr 2023 08:58:52 -0400 Received: from NAM12-MW2-obe.outbound.protection.outlook.com (mail-mw2nam12on2088.outbound.protection.outlook.com [40.107.244.88]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B1FD240C5; Tue, 11 Apr 2023 05:58:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Qxab7iNme55cD0WZn4XrHYjuwROodxkE3B7QASuqnrYJLGolTD0333MCQOCXurarXZS/dJkUHyO/4KGGTZJgOBHJizRwhf6BSfsCyFHM3Ry7OPxWQycuh5oYqokO8sW6dDNgsSRtjNgo5gbDrTM+8EBqkwJc7o31Zc00eB0p6yZscfzZnZWzCjzaSZzQYUxNXd1/cn845mAtRiR8KoPcQPfPeXbsTfNZ1BCNV7QX0T/3Cu8EuCgsBHJRQRewGZfJUydToPyRuVEejsvT2vfFB+A71F+4dIv4QLwZS+Bn6jCcMAjMaL4TUnRi8z3CRcFnkhnQWQgNi6HOjoJ4/1Je7w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=XLk7VBPfze9OJx6BGagdTGqDhaqyBjbltGGUNS6/MsA=; b=djLQi6vfAsCKL7+a/YAD7k1jSYbQ3V7xEfN9/zFrObRJmn+bl4ruvEz299fs8gk2rbLG/b6r/ydnj7GUUyew6+sWtcw5nNHta5jIj91UzF5SBXIji16bGhqPdk0e4xqvUyG+auWJ/3ZXHZfXidoXSjHQp8hUhJomZW2yJKuOm0q1clC4gzmhA5RRn51dCvfMF20/dAZsoDwQSiU/Dco0TqQCfVEsXPjXiRPyvPQ/gTlQzbMgQT4QM7ct9U0O0+M4QMrcFhcO4Jdk4xRIqQoh+1DSXjGw9SNtTsELZAO3FD+RfiEI/KmLbi8q3Z4vbOX5GipuIp/AR2ZFDBL+iDAMSA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=XLk7VBPfze9OJx6BGagdTGqDhaqyBjbltGGUNS6/MsA=; b=Z8oOm9AypWkW6ENNjUSpoMBUcs5Qw2jMxXLCM2+buIpSEadxV02kPpbg030vvhkiZXCKPTU9Pc2sOgGtoBc9VHVBt+N2vqx4Or213Ug2Tjz9sdXuATAJd2GstjQkt2vfxT6l+IDV0/ifaqgcjHc/rwTSD9GRyxQ1msAF1cSO77Q= Received: from MW4PR03CA0341.namprd03.prod.outlook.com (2603:10b6:303:dc::16) by SN7PR12MB6958.namprd12.prod.outlook.com (2603:10b6:806:262::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.38; Tue, 11 Apr 2023 12:58:40 +0000 Received: from CO1NAM11FT089.eop-nam11.prod.protection.outlook.com (2603:10b6:303:dc:cafe::fe) by MW4PR03CA0341.outlook.office365.com (2603:10b6:303:dc::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6298.28 via Frontend Transport; Tue, 11 Apr 2023 12:58:40 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by CO1NAM11FT089.mail.protection.outlook.com (10.13.175.179) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.6298.28 via Frontend Transport; Tue, 11 Apr 2023 12:58:39 +0000 Received: from aiemdeew.1.ozlabs.ru (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.34; Tue, 11 Apr 2023 07:58:34 -0500 From: Alexey Kardashevskiy To: CC: , , Tom Lendacky , Sean Christopherson , "Pankaj Gupta" , Nikunj A Dadhania , "Santosh Shukla" , Carlos Bilbao , Alexey Kardashevskiy Subject: [PATCH kernel v5 3/6] KVM: SEV-ES: explicitly disable debug Date: Tue, 11 Apr 2023 22:57:15 +1000 Message-ID: <20230411125718.2297768-4-aik@amd.com> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230411125718.2297768-1-aik@amd.com> References: <20230411125718.2297768-1-aik@amd.com> MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB04.amd.com (10.181.40.145) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CO1NAM11FT089:EE_|SN7PR12MB6958:EE_ X-MS-Office365-Filtering-Correlation-Id: 3bd2c18b-18c5-4892-ba83-08db3a8c78de X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: RHRR3y3cOVO73s88rZrkj68VRDRN6uzpwVsDTkkz2M9bKyerqIZte3xA5co1LPzOL7SgfvVbYO762NASmqvpMKOCAuuqIkj5IxB0ladY+TchiFTAfPjirZJNo5WwjEyaeoD/SBQCnemQsa3Jr4XHwYDMOb/XXNEZatlSVsmcSoOdwEq/pWaIpMMXrgvq3+9qwx2Ac1hlarNIk18CWnsPpqECvScKNaV185h3TIHVhY3Qln+B2cXdSASCs3DJuVuItWi546uKww4T/zLm52KxOc1s93n8JgC/so2b1sFwZYr1dgNZAWdCq8CqR3cDFnZ6neXVJ3CFNUVKC09v485GIltbDV2Tx06d/GUBJOh/TSyrGUsKgiMCUaI+nAR6mhXe48WV/kxhj0Spr1cWgvEZ7upa0pzs1z5/Pw5pb8+66JOHtoRcmyzQcKCBbZgPKBaJOwBFq4CShvj/TEh6/de7K3N2+A7EyKBKBBKKJdC5UUBq0zTj0RXTEuI6Z+be+msE5QB+nf8Jje/t7lB5eutqzU9nIhgE5PfaPsNRxqNkHemQZAzxGJNcIqN7fennWR96pYgeABp8zCvOWewdrFEOAUn2gIsPx50y3UXroUrHdT/1052rrVOAd9ur2ISJOT8elswkvkM03bEN0mdlp3gECz+Bk4QPMjWXt0q9ciULJVuMf6nOmNBGZ+4zcIwwrW9XfeIHUe+Ec3VHdK3l9kt4rl/R6Q1wD8Pojg7+ehzZeC0= X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:SATLEXMB04.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230028)(4636009)(39860400002)(396003)(376002)(346002)(136003)(451199021)(40470700004)(36840700001)(46966006)(40460700003)(8936002)(336012)(426003)(6666004)(5660300002)(36860700001)(41300700001)(82310400005)(478600001)(54906003)(36756003)(70206006)(70586007)(8676002)(6916009)(4326008)(83380400001)(316002)(40480700001)(47076005)(186003)(16526019)(2906002)(356005)(81166007)(2616005)(1076003)(26005)(82740400003)(36900700001);DIR:OUT;SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Apr 2023 12:58:39.9346 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 3bd2c18b-18c5-4892-ba83-08db3a8c78de X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT089.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN7PR12MB6958 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org SVM/SEV enable debug registers intercepts to skip swapping DRs on entering/exiting the guest. When the guest is in control of debug registers (vcpu->guest_debug == 0), there is an optimisation to reduce the number of context switches: intercepts are cleared and the KVM_DEBUGREG_WONT_EXIT flag is set to tell KVM to do swapping on guest enter/exit. The same code also executes for SEV-ES, however it has no effect as - it always takes (vcpu->guest_debug == 0) branch; - KVM_DEBUGREG_WONT_EXIT is set but DR7 intercept is not cleared; - vcpu_enter_guest() writes DRs but VMRUN for SEV-ES swaps them with the values from _encrypted_ VMSA. Be explicit about SEV-ES not supporting debug: - return right away from dr_interception() and skip unnecessary processing; - clear vcpu->guest_debug at SEV-ES' LAUNCH_UPDATE_VMSA if debugging was already enabled; after that point the generic x86's KVM_SET_GUEST_DEBUG ioctl disallows enabling debug. Add WARN_ON to kvm_x86::sync_dirty_debug_regs() (saves guest DRs on guest exit) to signify that SEV-ES won't hit that path. Suggested-by: Sean Christopherson Signed-off-by: Alexey Kardashevskiy Reviewed-by: Tom Lendacky --- Changes: v5: * new in the series --- arch/x86/kvm/svm/sev.c | 6 ++++++ arch/x86/kvm/svm/svm.c | 10 +++++++++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 0f4761a57d86..b4365622222b 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -639,6 +639,12 @@ static int __sev_launch_update_vmsa(struct kvm *kvm, struct kvm_vcpu *vcpu, return ret; vcpu->arch.guest_state_protected = true; + + if (vcpu->guest_debug) + pr_warn_ratelimited("guest_debug (%lx) not supported for SEV-ES", + vcpu->guest_debug); + vcpu->guest_debug = 0; + return 0; } diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index dc12de325cca..179952a31d3b 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -1980,7 +1980,7 @@ static void svm_sync_dirty_debug_regs(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm = to_svm(vcpu); - if (vcpu->arch.guest_state_protected) + if (WARN_ON_ONCE(sev_es_guest(vcpu->kvm))) return; get_debugreg(vcpu->arch.db[0], 0); @@ -2698,6 +2698,14 @@ static int dr_interception(struct kvm_vcpu *vcpu) unsigned long val; int err = 0; + /* + * SEV-ES intercepts DR7 only to disable guest debugging + * and the guest issues a VMGEXIT for DR7 write only. KVM cannot + * change DR7 (always swapped as type 'A') so return early. + */ + if (sev_es_guest(vcpu->kvm)) + return 1; + if (vcpu->guest_debug == 0) { /* * No more DR vmexits; force a reload of the debug registers From patchwork Tue Apr 11 12:57:16 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexey Kardashevskiy X-Patchwork-Id: 13207528 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 805DBC76196 for ; Tue, 11 Apr 2023 12:59:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229977AbjDKM7M (ORCPT ); Tue, 11 Apr 2023 08:59:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53214 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229955AbjDKM7G (ORCPT ); Tue, 11 Apr 2023 08:59:06 -0400 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12on2073.outbound.protection.outlook.com [40.107.237.73]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5BCB549EF; Tue, 11 Apr 2023 05:59:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=WYCZe4jLDrFYeaKW7Ww8Gdd6fHF0D31FCXFS+JgHaA8nPI5HjnkMjZmvT6XqUXZCOhWT+g84E3bcgFtWgBNdOc4f0TITwjqM3GuK/yqZ1MJ2CkIWbhxGuSGVaixyumxsaMxO6SnjOE7XEfp+hTZjUoGPI6z/AVa1X3FC/R1jSZ8zuh0uXhyY3DljnX5LNhrjcb51mJ/MejuQyww7h89FaxMCgqxTeDkSANaRutK/VDUFkH75fHChvak8OMiskqlVv5UPjLyTIRL3/BnxteN6Itijvsv4oUQbDT7JPvI5lUiFQJlqzLIx/Qk108zqsTaF3YS4VJcbGNoHdfsCMVPoTw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=LmWgDFoO8XYqPujwhh3z5yBn7YhL0mbclmsq+ahhdcc=; b=lXHIWOWaLWgzM85KaAIM8OIO37MAb86r9Q2B7Uwx1xEf9tLQTEuiUb44lFjPFBlqlWzL4BHk1jcDbNxjXvGHJSUzd/TAtfr8WrGiwyPsVfKHk3MhZj1IWHLGUm7/RgsrNcfLChycbph9bRFfBzF1XN75Rc8QHsLxLDwf6aDAnKgOTSRsdJwJQ8TQSeg8gicV3RrqEkywgEEtCc0eMbP8fcmUsquItzEfCUthgU5pqNmnrH3Sg0g2t1NWZHz0cccl13qb0blOBbd6Zh6SotaixcpothFCg6VIoHyXZxc/1OifH42vNpeltXdd5NZyrkHxP/10Kt9mve6xUk6vuLcYog== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LmWgDFoO8XYqPujwhh3z5yBn7YhL0mbclmsq+ahhdcc=; b=iHW8wnxJAHzQzqZim+Iph78/feuySiJ2wFcPyWrc4Ngq6fY1avQm4H1GJVyhd1fcpW6HKMTaNsETPOLLJh9sCl0qyZvxK2fWiOMrFbGJYtTDaYKcg45OLWie7qsrMy09jPyp8TTb2zOT+n3z7G/O34o8XyyutmaK5stNEfRxrrY= Received: from MW4PR04CA0103.namprd04.prod.outlook.com (2603:10b6:303:83::18) by LV2PR12MB5965.namprd12.prod.outlook.com (2603:10b6:408:172::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.38; Tue, 11 Apr 2023 12:59:01 +0000 Received: from CO1NAM11FT089.eop-nam11.prod.protection.outlook.com (2603:10b6:303:83:cafe::33) by MW4PR04CA0103.outlook.office365.com (2603:10b6:303:83::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.40 via Frontend Transport; Tue, 11 Apr 2023 12:59:00 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by CO1NAM11FT089.mail.protection.outlook.com (10.13.175.179) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.6298.28 via Frontend Transport; Tue, 11 Apr 2023 12:59:00 +0000 Received: from aiemdeew.1.ozlabs.ru (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.34; Tue, 11 Apr 2023 07:58:54 -0500 From: Alexey Kardashevskiy To: CC: , , Tom Lendacky , Sean Christopherson , "Pankaj Gupta" , Nikunj A Dadhania , "Santosh Shukla" , Carlos Bilbao , Alexey Kardashevskiy Subject: [PATCH kernel v5 4/6] KVM: SVM/SEV/SEV-ES: Rework intercepts Date: Tue, 11 Apr 2023 22:57:16 +1000 Message-ID: <20230411125718.2297768-5-aik@amd.com> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230411125718.2297768-1-aik@amd.com> References: <20230411125718.2297768-1-aik@amd.com> MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB04.amd.com (10.181.40.145) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CO1NAM11FT089:EE_|LV2PR12MB5965:EE_ X-MS-Office365-Filtering-Correlation-Id: 9b79b31a-e60b-4801-4f01-08db3a8c851b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: aU2nC9HQYw67ymgnvyO1IlA3Cs/2Z0qnIYrmRHWSrw6MBuXtbRVwwE80XW6ZhZyLwjL+TFkbHuhJ2zpSb6oj8ClNZ+qpgyZsjnZ4MpF7pqelo9ktwtH0LVm5XUO1dXcOpLaIz8QGGvKu8SuPmKSGxbE+cCxTlkZZC+m5wzS3iBnB7akiu20faFEqDV6S2zdzxICqKUAp0Elb6I4fdgmUz/TJPpavIbNVRW1M+qjYnp3RzO8ijwJ7VZGSRo6PbU1/SORReCVHTAGoZ0RWKJgtUEZdGo6vFYOqEDcv/YVnDwxP+SObkjipejVkSG/6EDpQBPKkuJU/SLDQxpif451QYYmJJw+9QeYYQ7giDrZKwZr+xakkw6oETR/FkFcHLN4RfcCvvMDLp4Qy8fS3DE4M6/nwaC1xt8qat3RzDX4sZ10RWGtrs/6oCJ1bIJTJaWydtOIDyc3oNVcQtKSEL8fVUH56bvaqggoY9i4kP3Ew3eZyjynY/iSPT/OWMKPciiXJkcInGEFrBvaGo7AcRSUyrka7cPhZd9KtqSoqRVBHBsB4a3e2d9MGb2t8cEh1bJGaH5JfV+xY2XHPSXhA2a0UeIaWWTUNyenE+LOIeifF9zJ7caAtdUFqT97hQMJ1i6KcvtAql1K4W91KmeVexmzWt7SamSwDtYot/LK43uVixjIuN2tfJvuxxFLb/ZdFkCByDIjfpiuSMberSSTx/c+mb4zzXw7w3InL8EeGtmCmQ7I= X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:SATLEXMB04.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230028)(4636009)(39860400002)(396003)(376002)(346002)(136003)(451199021)(40470700004)(36840700001)(46966006)(40460700003)(8936002)(336012)(426003)(6666004)(5660300002)(36860700001)(41300700001)(82310400005)(478600001)(54906003)(36756003)(70206006)(70586007)(8676002)(6916009)(4326008)(83380400001)(316002)(40480700001)(47076005)(186003)(16526019)(2906002)(356005)(81166007)(2616005)(1076003)(26005)(82740400003)(36900700001);DIR:OUT;SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Apr 2023 12:59:00.4642 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 9b79b31a-e60b-4801-4f01-08db3a8c851b X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT089.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV2PR12MB5965 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org Currently SVM setup is done sequentially in init_vmcb() -> sev_init_vmcb() -> sev_es_init_vmcb() and tries keeping SVM/SEV/SEV-ES bits separated. One of the exceptions is DR intercepts which is for SEV-ES before sev_es_init_vmcb() runs. Move the SEV-ES intercept setup to sev_es_init_vmcb(). From now on set_dr_intercepts()/clr_dr_intercepts() handle SVM/SEV only. No functional change intended. Suggested-by: Sean Christopherson Signed-off-by: Alexey Kardashevskiy Reviewed-by: Santosh Shukla Reviewed-by: Tom Lendacky --- Changes: v5: * updated the comments * removed sev_es_guest() checks from set_dr_intercepts()/clr_dr_intercepts() * removed remaining intercepts from clr_dr_intercepts() --- arch/x86/kvm/svm/sev.c | 11 ++++++ arch/x86/kvm/svm/svm.c | 37 ++++++++------------ 2 files changed, 25 insertions(+), 23 deletions(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index b4365622222b..f0885250252d 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -2946,6 +2946,7 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in) static void sev_es_init_vmcb(struct vcpu_svm *svm) { + struct vmcb *vmcb = svm->vmcb01.ptr; struct kvm_vcpu *vcpu = &svm->vcpu; svm->vmcb->control.nested_ctl |= SVM_NESTED_CTL_SEV_ES_ENABLE; @@ -2974,6 +2975,16 @@ static void sev_es_init_vmcb(struct vcpu_svm *svm) svm_set_intercept(svm, TRAP_CR4_WRITE); svm_set_intercept(svm, TRAP_CR8_WRITE); + /* + * DR7 access must remain intercepted for an SEV-ES guest to disallow + * the guest kernel enable debugging as otherwise a VM writing to DR7 + * from the #DB handler may trigger infinite loop of #DB's. + */ + vmcb->control.intercepts[INTERCEPT_DR] = 0; + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_WRITE); + recalc_intercepts(svm); + /* Can't intercept XSETBV, HV can't modify XCR0 directly */ svm_clr_intercept(svm, INTERCEPT_XSETBV); diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 179952a31d3b..0271360e8fde 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -691,23 +691,20 @@ static void set_dr_intercepts(struct vcpu_svm *svm) { struct vmcb *vmcb = svm->vmcb01.ptr; - if (!sev_es_guest(svm->vcpu.kvm)) { - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR0_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR1_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR2_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR3_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR4_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR5_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR6_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR0_WRITE); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR1_WRITE); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR2_WRITE); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR3_WRITE); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR4_WRITE); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR5_WRITE); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR6_WRITE); - } - + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR0_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR1_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR2_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR3_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR4_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR5_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR6_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR0_WRITE); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR1_WRITE); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR2_WRITE); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR3_WRITE); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR4_WRITE); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR5_WRITE); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR6_WRITE); vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_READ); vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_WRITE); @@ -720,12 +717,6 @@ static void clr_dr_intercepts(struct vcpu_svm *svm) vmcb->control.intercepts[INTERCEPT_DR] = 0; - /* DR7 access must remain intercepted for an SEV-ES guest */ - if (sev_es_guest(svm->vcpu.kvm)) { - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_WRITE); - } - recalc_intercepts(svm); } From patchwork Tue Apr 11 12:57:17 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Alexey Kardashevskiy X-Patchwork-Id: 13207529 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9800BC77B6F for ; Tue, 11 Apr 2023 13:00:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230206AbjDKM75 (ORCPT ); Tue, 11 Apr 2023 08:59:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54258 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230226AbjDKM7m (ORCPT ); Tue, 11 Apr 2023 08:59:42 -0400 Received: from NAM12-DM6-obe.outbound.protection.outlook.com (mail-dm6nam12on2081.outbound.protection.outlook.com [40.107.243.81]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C4B77525A; Tue, 11 Apr 2023 05:59:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=R59mKn87htRCDIlYSdychMje2Su0AAH2nRjB7eKgcLdh3SDCJO33Xq3vVMwFATF0Cd3XjrcELCYKvTyMobv+5FBDiUTDgnyTMODIdON6a0W1uIRGncfhjuJuinTnYr5P1wzFrwQ0q3cKzAq17FmqJeWb1Wa9XM+vZLd4trjChj2QSynWx3/I8avzejyPT/+6kuf7Bl0h8D2Txdb9kw68q5eoyibHT1cTXGiOB+RfdO7tiiLeCb2w4l/DGdhxxxI466bU1uBgN3RYd5PoVFxSaQ55jzYvsd3aKv/vVozRZa9SAE9GTxf7GqbJ7wwwcsNCXZ7klt0zPeCyG7/hLCUhog== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=CIW0h8/Qm6mnE3Ce8k2cfEK7Nnv2b/n5SmnjoDjNels=; b=byGTfSgme1yKBfYIL93fa13WWce3MxHPL8HwMlCWg5TMPA9L9ujA5mCJYQHCffcTuq2W8dOyyv/KOnZ5+CRMs/mnvtQ308GidhdOuY6fK1+2ruTtb+B5EjOuYSVls5UySaRsioL6GmnV1PKKzyB7Fg9w6nuQEua41J+DWOZhAumxmpQ8hdKozx7b94hrU/LiyQ4VdpWdAb9mxBZHKqTe/cUuAnXvHt3WpRgBcdtDoNlAhJkz3edKM4arZ+MFJD5kYqnfUAXfBJmM6+Kl8JIBd8QBtz+OtvjqO5XcSDgso3LZjJFg12QkZ+EkhK83tyw8M2ooAAI41foNWE/YQHVLSg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CIW0h8/Qm6mnE3Ce8k2cfEK7Nnv2b/n5SmnjoDjNels=; b=BeUKh4l+DV3G3f1u1PfCbnj05EIQgwWiF28xE41ENujLG9yVNCOLemEQl/IdV/I8YmJGmQBRhSFjiLjygJmwoyrcasueBtQV+Tvr6yRAB/uO1IVQREJLiP6nCicX4R0O8/5RGn11lBs1HsfOMzt87FLg8yQlAfHNMdBVTIzqK7k= Received: from MW2PR16CA0058.namprd16.prod.outlook.com (2603:10b6:907:1::35) by DS0PR12MB8247.namprd12.prod.outlook.com (2603:10b6:8:f5::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.35; Tue, 11 Apr 2023 12:59:21 +0000 Received: from CO1NAM11FT087.eop-nam11.prod.protection.outlook.com (2603:10b6:907:1:cafe::a6) by MW2PR16CA0058.outlook.office365.com (2603:10b6:907:1::35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.36 via Frontend Transport; Tue, 11 Apr 2023 12:59:21 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by CO1NAM11FT087.mail.protection.outlook.com (10.13.174.68) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.6298.28 via Frontend Transport; Tue, 11 Apr 2023 12:59:20 +0000 Received: from aiemdeew.1.ozlabs.ru (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.34; Tue, 11 Apr 2023 07:59:15 -0500 From: Alexey Kardashevskiy To: CC: , , Tom Lendacky , Sean Christopherson , "Pankaj Gupta" , Nikunj A Dadhania , "Santosh Shukla" , Carlos Bilbao , Alexey Kardashevskiy Subject: [PATCH kernel v5 5/6] KVM: SEV: Enable data breakpoints in SEV-ES Date: Tue, 11 Apr 2023 22:57:17 +1000 Message-ID: <20230411125718.2297768-6-aik@amd.com> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230411125718.2297768-1-aik@amd.com> References: <20230411125718.2297768-1-aik@amd.com> MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB04.amd.com (10.181.40.145) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CO1NAM11FT087:EE_|DS0PR12MB8247:EE_ X-MS-Office365-Filtering-Correlation-Id: 1459e85c-cea1-4d7a-60cb-08db3a8c9142 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: wn5PX14lhWx7ZZepMf9jm/RfHuynjB6MrZWgA4XHVzHvfLe3Hut2u5MixDPJyBPOg4GYCT8RXxBluQK0vo0DqNtjcce8uiDqvcZMDLdBRVvC0hInQT8mG4EObQNBuLdNNy3yA43NrHlUzeVQVmErXEXpdPrPouUFhn2zBQfBEWXuCGmybEwDDkKZvGxWJ4I9ncerm6q2+Zuf3snKkDt8t7UJc2dA3sqHSopFcqcH5aZtJRtEUfYr3i2ctsXhVF5e6Y9f5QkAGbBypkTzKl4fir4D2mQgBtWqjMRQ7tecpQzeZ/6hsg3VHFRpGuAkryeNmmvDY/SvHHvXgpRlW4dMDTMZJ0XkhMGDEW28WgTCJ/cDfBQ8cPUqvtWCtBmPWHqzRSLIvLX3TcANwVNDETh2d5PdBwohUg5WHWFNyaem4+t07YXA7OREB9cD//NzZcA/E3CIa+E0R4XDYBN/6lpqIvgtYXEKf1MoVf6Xqe8CaeRlxR1mnuD6R6kDvljX13Mo6prt1u4N0QqQiwHs48bkWQE4yZO00Jes0zGGrxzyUpX3Y77hW0khmdNsSilZYdV0/sbdRXL6gJEWJLmPp8qI78/K7dh8Mu073MLXUf+kim2W21zwK4R2grOmiUTq+nv4GB1U4Qbo7PfNDGk+5rD0JpSJTCUR6h/rq42El1dWKjdlsOUgi2lIGNR2GhWCvH2vx5uRsHUv0qEyRiFCoS0USHSRoe2eb3In7nkZbHz6+QRmHYLH8v/ZAJBMuMr6xzVC9H0miu5ruWXCq0adr/BQVg== X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:SATLEXMB04.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230028)(4636009)(396003)(376002)(39860400002)(346002)(136003)(451199021)(46966006)(40470700004)(36840700001)(478600001)(47076005)(40460700003)(40480700001)(36756003)(83380400001)(82740400003)(356005)(81166007)(426003)(2616005)(336012)(36860700001)(2906002)(54906003)(316002)(1076003)(186003)(16526019)(26005)(5660300002)(41300700001)(8936002)(6916009)(82310400005)(8676002)(70206006)(4326008)(70586007)(36900700001);DIR:OUT;SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Apr 2023 12:59:20.8529 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 1459e85c-cea1-4d7a-60cb-08db3a8c9142 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT087.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB8247 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org Prior to SEV-ES, KVM saved/restored host debug registers upon switching to/from a VM. Changing those registers inside a running SEV VM triggered #VMEXIT to KVM. SEV-ES added encrypted state (ES) which uses an encrypted page for the VM state (VMSA). The hardware saves/restores certain registers on VMRUN/VMEXIT according to a swap type (A, B, C), see "Table B-3. Swap Types" in the AMD Architecture Programmer’s Manual volume 2. The DR6 and DR7 registers have always been swapped as Type A for SEV-ES guests, but a new feature is available, identified via CPUID Fn8000001F_EAX[14] "DebugSwap for SEV-ES guests", that provides support for swapping additional debug registers. DR[0-3] and DR[0-3]_ADDR_MASK are swapped as Type B when SEV_FEATURES[5] (DebugSwap) is set. Enable DebugSwap for a VMSA but only do so if CPUID Fn80000021_EAX[0] ("NoNestedDataBp", "Processor ignores nested data breakpoints") is supported by the SOC as otherwise a malicious SEV-ES guest can set up data breakpoints on the #DB IDT entry/stack and cause an infinite loop. Set the features bit in sev_es_sync_vmsa() which is the last point when VMSA is not encrypted yet as sev_(es_)init_vmcb() (where the most init happens) is called not only when VCPU is initialized but also on intrahost migration when VMSA is encrypted. Eliminate DR7 and #DB intercepts as: - they are not needed when DebugSwap is supported; - #VC for these intercepts is most likely not supported anyway and kills the VM. Signed-off-by: Alexey Kardashevskiy Reviewed-by: Tom Lendacky Reviewed-by: Pankaj Gupta Signed-off-by: Sean Christopherson --- Changes: v8: * added CPUID's DebugSwap feature * commit log, comments updated * redid the whole thing v4: * removed sev_es_is_debug_swap_enabled() helper * made sev_es_debug_swap_enabled (module param) static * set sev_feature early in sev_es_init_vmcb() and made intercepts dependend on it vs. module param * move set_/clr_dr_intercepts to .c v3: * rewrote the commit log again * rebased on tip/master to use recently defined X86_FEATURE_NO_NESTED_DATA_BP * s/boot_cpu_has/cpu_feature_enabled/ v2: * debug_swap moved from vcpu to module_param * rewrote commit log --- Tested with: === int x; int main(int argc, char *argv[]) { x = 1; return 0; } === gcc -g a.c rsync a.out ruby-954vm:~/ ssh -t ruby-954vm 'gdb -ex "file a.out" -ex "watch x" -ex r' where ruby-954vm is a VM. With "/sys/module/kvm_amd/parameters/debug_swap = 0", gdb does not stop on the watchpoint, with "= 1" - gdb does. --- arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/svm.h | 1 + arch/x86/kvm/svm/sev.c | 36 ++++++++++++++++++-- 3 files changed, 35 insertions(+), 3 deletions(-) diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h index d9c190cdefa9..3a5eeb178778 100644 --- a/arch/x86/include/asm/cpufeatures.h +++ b/arch/x86/include/asm/cpufeatures.h @@ -435,6 +435,7 @@ #define X86_FEATURE_SEV_ES (19*32+ 3) /* AMD Secure Encrypted Virtualization - Encrypted State */ #define X86_FEATURE_V_TSC_AUX (19*32+ 9) /* "" Virtual TSC_AUX */ #define X86_FEATURE_SME_COHERENT (19*32+10) /* "" AMD hardware-enforced cache coherency */ +#define X86_FEATURE_DEBUG_SWAP (19*32+14) /* AMD SEV-ES full debug state swap support */ /* AMD-defined Extended Feature 2 EAX, CPUID level 0x80000021 (EAX), word 20 */ #define X86_FEATURE_NO_NESTED_DATA_BP (20*32+ 0) /* "" No Nested Data Breakpoints */ diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h index 770dcf75eaa9..3a422d213010 100644 --- a/arch/x86/include/asm/svm.h +++ b/arch/x86/include/asm/svm.h @@ -280,6 +280,7 @@ static_assert((X2AVIC_MAX_PHYSICAL_ID & AVIC_PHYSICAL_MAX_INDEX_MASK) == X2AVIC_ #define AVIC_HPA_MASK ~((0xFFFULL << 52) | 0xFFF) #define VMCB_AVIC_APIC_BAR_MASK 0xFFFFFFFFFF000ULL +#define SVM_SEV_FEAT_DEBUG_SWAP BIT(5) struct vmcb_seg { u16 selector; diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index f0885250252d..ba12e7962e94 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -22,6 +22,7 @@ #include #include #include +#include #include "mmu.h" #include "x86.h" @@ -53,9 +54,14 @@ module_param_named(sev, sev_enabled, bool, 0444); /* enable/disable SEV-ES support */ static bool sev_es_enabled = true; module_param_named(sev_es, sev_es_enabled, bool, 0444); + +/* enable/disable SEV-ES DebugSwap support */ +static bool sev_es_debug_swap_enabled = true; +module_param_named(debug_swap, sev_es_debug_swap_enabled, bool, 0444); #else #define sev_enabled false #define sev_es_enabled false +#define sev_es_debug_swap_enabled false #endif /* CONFIG_KVM_AMD_SEV */ static u8 sev_enc_bit; @@ -605,6 +611,9 @@ static int sev_es_sync_vmsa(struct vcpu_svm *svm) save->xss = svm->vcpu.arch.ia32_xss; save->dr6 = svm->vcpu.arch.dr6; + if (sev_es_debug_swap_enabled) + save->sev_features |= SVM_SEV_FEAT_DEBUG_SWAP; + pr_debug("Virtual Machine Save Area (VMSA):\n"); print_hex_dump_debug("", DUMP_PREFIX_NONE, 16, 1, save, sizeof(*save), false); @@ -2256,6 +2265,9 @@ void __init sev_hardware_setup(void) out: sev_enabled = sev_supported; sev_es_enabled = sev_es_supported; + if (!sev_es_enabled || !cpu_feature_enabled(X86_FEATURE_DEBUG_SWAP) || + !cpu_feature_enabled(X86_FEATURE_NO_NESTED_DATA_BP)) + sev_es_debug_swap_enabled = false; #endif } @@ -2976,14 +2988,20 @@ static void sev_es_init_vmcb(struct vcpu_svm *svm) svm_set_intercept(svm, TRAP_CR8_WRITE); /* + * Unless DebugSwap (depends on X86_FEATURE_NO_NESTED_DATA_BP) is enabled, * DR7 access must remain intercepted for an SEV-ES guest to disallow * the guest kernel enable debugging as otherwise a VM writing to DR7 * from the #DB handler may trigger infinite loop of #DB's. */ vmcb->control.intercepts[INTERCEPT_DR] = 0; - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_READ); - vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_WRITE); - recalc_intercepts(svm); + if (sev_es_debug_swap_enabled) { + clr_exception_intercept(svm, DB_VECTOR); + /* clr_exception_intercept() called recalc_intercepts() */ + } else { + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_READ); + vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_WRITE); + recalc_intercepts(svm); + } /* Can't intercept XSETBV, HV can't modify XCR0 directly */ svm_clr_intercept(svm, INTERCEPT_XSETBV); @@ -3048,6 +3066,18 @@ void sev_es_prepare_switch_to_guest(struct sev_es_save_area *hostsa) /* MSR_IA32_XSS is restored on VMEXIT, save the currnet host value */ hostsa->xss = host_xss; + + /* The DebugSwap SEV feature does Type B swaps of DR[0-3] */ + if (sev_es_debug_swap_enabled) { + hostsa->dr0 = native_get_debugreg(0); + hostsa->dr1 = native_get_debugreg(1); + hostsa->dr2 = native_get_debugreg(2); + hostsa->dr3 = native_get_debugreg(3); + hostsa->dr0_addr_mask = amd_get_dr_addr_mask(0); + hostsa->dr1_addr_mask = amd_get_dr_addr_mask(1); + hostsa->dr2_addr_mask = amd_get_dr_addr_mask(2); + hostsa->dr3_addr_mask = amd_get_dr_addr_mask(3); + } } void sev_vcpu_deliver_sipi_vector(struct kvm_vcpu *vcpu, u8 vector) From patchwork Tue Apr 11 12:57:18 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexey Kardashevskiy X-Patchwork-Id: 13207530 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 11EACC76196 for ; Tue, 11 Apr 2023 13:00:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230264AbjDKNAb (ORCPT ); Tue, 11 Apr 2023 09:00:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55324 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230265AbjDKNAQ (ORCPT ); Tue, 11 Apr 2023 09:00:16 -0400 Received: from NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2048.outbound.protection.outlook.com [40.107.93.48]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 88E044EE9; Tue, 11 Apr 2023 05:59:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mfN3s/KEdLu+Sfgku4hUSXscrn4T24xd+ZezvULROuVt5daCnU1Rpew512BAB+dgCdfVimb1JClahGaJpkSsl2Nd2csB3nDQqU6tOfWzbsy9L1aCorvXBPoW8+JNQcu6x77//5qnuhN5xrdw8+oSmcN2bYVKXrzEUWeqJkTBuQBzblNbwxAiAzN9bxX/1qaokVvtABKHyWMoK1JV9C0Em9ZqFlhh9lGqXHAvsPd4JzYxj70URy0fjjifUHiO+komXLFCOUzEXbhq2Nn2VS9EleOOIoF5BLMq1h1wEFnZHSnKZPSPoctI9849xqMrsYWcbKG6zHBKyDYwTkfRAFsh0A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=IPeEDFdX5vcGUJlAVBsJQGUzndsU+cSaBOzQ3pLkLto=; b=k1NIYTyyXPt02B40gyncc2xZV9It1n4EYpQ3Af25ZuhHD0FGDIx3VAFfuHLoPtqQoiLXx5NNe69OiUGougv5jal1Hwm7+rjvXFx1q94P6ch2Ndcw6tbmljM9K44yadMCtwiHezLsF635La+JEFqEX//oSeHSsFIVfOUva7TMtw9AsEj5ef52pxeOXTQntkHsqTWN+I7ZiOIbbNFMztsZoybUElef0yEpDuCt32y6/+Sxr/WH47Um1k1YMw3nM5CewL5NcvKgsi8xYPm7SuKQh7uvk1I6mnUNNqSdMa2uMSt7AGQIYS0UIqvHNd4EJ+8RRDD0In3xiiGUgBOJvImjag== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IPeEDFdX5vcGUJlAVBsJQGUzndsU+cSaBOzQ3pLkLto=; b=czmHmDERV05F1nvMC19XZUIoC3sE/mZkvL2nS7rVJ48tGUyRmdEwXkJgDIoaWHqijPXKNuimWNQypC+cR61SwENGQGRtZ9mqFamO9WBFyoDG4nTpnAIhswZqsQYCEp3Mwg1jK61CWJsqSHh58P84SPSOqlx1QVSyRnUEF0dpGg4= Received: from MW4P221CA0022.NAMP221.PROD.OUTLOOK.COM (2603:10b6:303:8b::27) by MN0PR12MB5737.namprd12.prod.outlook.com (2603:10b6:208:370::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6254.35; Tue, 11 Apr 2023 12:59:40 +0000 Received: from CO1NAM11FT069.eop-nam11.prod.protection.outlook.com (2603:10b6:303:8b:cafe::1a) by MW4P221CA0022.outlook.office365.com (2603:10b6:303:8b::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.39 via Frontend Transport; Tue, 11 Apr 2023 12:59:40 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by CO1NAM11FT069.mail.protection.outlook.com (10.13.174.129) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.6298.28 via Frontend Transport; Tue, 11 Apr 2023 12:59:40 +0000 Received: from aiemdeew.1.ozlabs.ru (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.34; Tue, 11 Apr 2023 07:59:35 -0500 From: Alexey Kardashevskiy To: CC: , , Tom Lendacky , Sean Christopherson , "Pankaj Gupta" , Nikunj A Dadhania , "Santosh Shukla" , Carlos Bilbao , Alexey Kardashevskiy Subject: [PATCH kernel v5 6/6] x86/sev: Do not handle #VC for DR7 read/write Date: Tue, 11 Apr 2023 22:57:18 +1000 Message-ID: <20230411125718.2297768-7-aik@amd.com> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230411125718.2297768-1-aik@amd.com> References: <20230411125718.2297768-1-aik@amd.com> MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB04.amd.com (10.181.40.145) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CO1NAM11FT069:EE_|MN0PR12MB5737:EE_ X-MS-Office365-Filtering-Correlation-Id: 5225a93f-36af-4e7d-5e22-08db3a8c9cf7 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 0Qn9y2HpRL4+L8oLG3lE6w2LsrSwr0+trWD/4Xi/qvHTVKpUIj/hj8OEXbjrEnPB1sDxKzLKV+Fuo+Xhp4LBUy8YL2wugkl9G9gPyv72IvlJ+5IT7Wigf+4RnEZR3YyaV+NF4Tr0jI8LwnMibvL8DOseo5zpS6gvrvkQMZA2xjMcHAUwPXT7JDNqeU/O661TVfbUio8iBq64UEvrBacX3wuf+Oa3HpgpdbA1xxHKWG2XZh9fsXryy7nXrcXHxFSErgsfKU1YOv94ioYCuilwD2T99LaSOTIvYVswWbEeYSkG3z/IeD8unCH7R24BGxr/ZTwU5x+SAPxmfBP3qQ1a0tjX4/4GiuAIgK1F5yFeBjXqZFw/GCVE2Mf0v2RxiyHj9q/lmJhiDbJopFDWztKSFRk2MIAVXMY1Lzm+h6WnjYeM63F1mRBkxMoIW1Vw1NlqFMJ4WRelBcRLdnmJPKB5xTJGabvrD7I21DPKRiPC+d9FY1keA+/Bn8YXvMqgxOFQZDqHB0tsN7EgxGUqk6lbAXhi3v/0RUedsLzmmmUIil5Jt3JmtHRwIc6c+59OkbQ/rUR4VHq7aa+UIc21MZfxlL330L3rBozXpKcfj0AWWsaTKSE1AahKeg2SGP6HBdOgLLJ9plhtrpVjYJAkgbzPrpVZJ+BMl/BR8AoI7ylTYtHHkLjk8w2nEmOshCD/ouQntl48WnC1ZS4ib8JADYXZ4ztyd2Dxgjy1oSl2/0cjXOo= X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:SATLEXMB04.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230028)(4636009)(376002)(346002)(396003)(39860400002)(136003)(451199021)(40470700004)(36840700001)(46966006)(40460700003)(47076005)(16526019)(83380400001)(5660300002)(8936002)(336012)(2906002)(478600001)(36860700001)(8676002)(1076003)(316002)(426003)(26005)(70206006)(6916009)(40480700001)(6666004)(4326008)(70586007)(54906003)(2616005)(186003)(41300700001)(356005)(82740400003)(81166007)(82310400005)(36756003)(36900700001);DIR:OUT;SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Apr 2023 12:59:40.4784 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 5225a93f-36af-4e7d-5e22-08db3a8c9cf7 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT069.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN0PR12MB5737 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org With MSR_AMD64_SEV_DEBUG_SWAP enabled, the guest is not expected to receive a #VC for reads or writes of DR7. Update the SNP_FEATURES_PRESENT mask with MSR_AMD64_SNP_DEBUG_SWAP so an SNP guest doesn't gracefully terminate during SNP feature negotiation if MSR_AMD64_SEV_DEBUG_SWAP is enabled. Since a guest is not expected to receive a #VC on DR7 accesses when MSR_AMD64_SEV_DEBUG_SWAP is enabled, return an error from the #VC handler in this situation. Signed-off-by: Alexey Kardashevskiy Reviewed-by: Carlos Bilbao Reviewed-by: Tom Lendacky Reviewed-by: Pankaj Gupta --- Changes: v4: * rebased on top of SNP feature negotiation v2: * use new bit definition --- arch/x86/boot/compressed/sev.c | 2 +- arch/x86/kernel/sev.c | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c index 014b89c89088..f6123808be42 100644 --- a/arch/x86/boot/compressed/sev.c +++ b/arch/x86/boot/compressed/sev.c @@ -313,7 +313,7 @@ static void enforce_vmpl0(void) * by the guest kernel. As and when a new feature is implemented in the * guest kernel, a corresponding bit should be added to the mask. */ -#define SNP_FEATURES_PRESENT (0) +#define SNP_FEATURES_PRESENT MSR_AMD64_SNP_DEBUG_SWAP void snp_check_features(void) { diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c index b031244d6d2d..a515eb880970 100644 --- a/arch/x86/kernel/sev.c +++ b/arch/x86/kernel/sev.c @@ -1620,6 +1620,9 @@ static enum es_result vc_handle_dr7_write(struct ghcb *ghcb, long val, *reg = vc_insn_get_rm(ctxt); enum es_result ret; + if (sev_status & MSR_AMD64_SNP_DEBUG_SWAP) + return ES_VMM_ERROR; + if (!reg) return ES_DECODE_FAILED; @@ -1657,6 +1660,9 @@ static enum es_result vc_handle_dr7_read(struct ghcb *ghcb, struct sev_es_runtime_data *data = this_cpu_read(runtime_data); long *reg = vc_insn_get_rm(ctxt); + if (sev_status & MSR_AMD64_SNP_DEBUG_SWAP) + return ES_VMM_ERROR; + if (!reg) return ES_DECODE_FAILED;