On 24/05/21 19:03, Sean Christopherson wrote:
Let's introduce a new wrapper is_64_bit_hypercall, and add a
WARN_ON_ONCE(vcpu->arch.guest_state_protected) to is_64_bit_mode.
Can we introduce the WARN(s) in a separate patch, and deploy them much more
widely than just is_64_bit_mode()? I would like to have them lying in wait at
every path that should be unreachable, e.g. get/set segments, get_cpl(), etc...
Each WARN that is added must be audited separately, so this one I'd like
to have now; it is pretty much the motivation for introducing a new
function, as the other caller of is_64_bit_mode, kvm_get_linear_rip() is
already "handling" SEV-ES by always returning 0.
But yes adding more WARNs can only be good.
Paolo
Side topic, kvm_get_cs_db_l_bits() should be moved to svm.c. Functionally, it's
fine to have it as a vendor-agnostic helper, but practically speaking it should
never be called directly.
