On Thu, Mar 18, 2021, Maxim Levitsky wrote: > On Thu, 2021-03-18 at 16:35 +0000, Sean Christopherson wrote: > > Skipping SEV-ES guests should not be difficult; KVM could probably even > > print a message stating that the debug hook is being ignored. One thought would > > be to snapshot debug_intercept_exceptions at VM creation, and simply zero it out > > for incompatible guests. That would also allow changing debug_intercept_exceptions > > without reloading KVM, which IMO would be very convenient. > > > So all right I'll disable this for SEV-ES. Belated thought. KVM doesn't know a guest will be an SEV-ES guest until sev_es_guest_init(), and KVM currently doesn't prevent creating vCPUs before KVM_SEV_ES_INIT. But, I'm 99% confident that's a KVM bug. For your purposes, I think you can assume kvm->arch.debug_intercept_exceptions will _not_ change after vCPU creation. > The idea to change the debug_intercept_exceptions on the fly is also a good idea, > I will implement it in next version of the patches. Can you also move the module param to x86? It doesn't need to be wired up for VMX right away, but it makes sense to do it at some point, and ideally folks won't have to update their scripts when that happens.
