Commit e221804d authored by Alexey Kardashevskiy's avatar Alexey Kardashevskiy Committed by Borislav Petkov (AMD)
Browse files

x86/sev: Do not handle #VC for DR7 read/write 



With MSR_AMD64_SEV_DEBUG_SWAP enabled, the guest is not expected to
receive a #VC for reads or writes of DR7.

Update the SNP_FEATURES_PRESENT mask with MSR_AMD64_SNP_DEBUG_SWAP so
an SNP guest doesn't gracefully terminate during SNP feature negotiation
if MSR_AMD64_SEV_DEBUG_SWAP is enabled.

Since a guest is not expected to receive a #VC on DR7 accesses when
MSR_AMD64_SEV_DEBUG_SWAP is enabled, return an error from the #VC
handler in this situation.

Signed-off-by: default avatarAlexey Kardashevskiy <aik@amd.com>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: default avatarCarlos Bilbao <carlos.bilbao@amd.com>
Reviewed-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Reviewed-by: default avatarPankaj Gupta <pankaj.gupta@amd.com>
Link: https://lore.kernel.org/r/20230816022122.981998-1-aik@amd.com
parent 2ccdd1b1

arch/x86/boot/compressed/sev.c

+1 −1
Original line number Diff line number Diff line
@@ -365,7 +365,7 @@ static void enforce_vmpl0(void) 
 * by the guest kernel. As and when a new feature is implemented in the

 * guest kernel, a corresponding bit should be added to the mask.

 */

#define SNP_FEATURES_PRESENT (0)

#define SNP_FEATURES_PRESENT	MSR_AMD64_SNP_DEBUG_SWAP



void snp_check_features(void)

{

arch/x86/kernel/sev.c

+6 −0
Original line number Diff line number Diff line
@@ -1575,6 +1575,9 @@ static enum es_result vc_handle_dr7_write(struct ghcb *ghcb, 
	long val, *reg = vc_insn_get_rm(ctxt);

	enum es_result ret;



	if (sev_status & MSR_AMD64_SNP_DEBUG_SWAP)

		return ES_VMM_ERROR;



	if (!reg)

		return ES_DECODE_FAILED;
@@ -1612,6 +1615,9 @@ static enum es_result vc_handle_dr7_read(struct ghcb *ghcb, 
	struct sev_es_runtime_data *data = this_cpu_read(runtime_data);

	long *reg = vc_insn_get_rm(ctxt);



	if (sev_status & MSR_AMD64_SNP_DEBUG_SWAP)

		return ES_VMM_ERROR;



	if (!reg)

		return ES_DECODE_FAILED;