Re: [PATCH v6 14/42] x86/sev: Register GHCB memory when SEV-SNP is active

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Boris,


On 11/2/21 11:53 AM, Borislav Petkov wrote:
On Fri, Oct 08, 2021 at 01:04:25PM -0500, Brijesh Singh wrote:
+	/* SEV-SNP guest requires that GHCB must be registered. */
+	if (cc_platform_has(CC_ATTR_SEV_SNP))
+		snp_register_ghcb(data, __pa(ghcb));

This looks like more of that "let's register a GHCB at the time the
first #VC fires".


There are two #VC handlers:

1) early exception handler [do_vc_no_ghcb()]. The handler uses the MSR protocol based VMGEXIT.

https://elixir.bootlin.com/linux/latest/source/arch/x86/kernel/sev-shared.c#L147


2) exception handler setup during the idt bringup [handle_vc_boot_ghcb()]. The handler uses the full GHCB.
https://elixir.bootlin.com/linux/latest/source/arch/x86/kernel/sev.c#L1472

To answer your question, GHCB is registered at the time of first #VC handling by the second exception handler. Mike can correct me, the CPUID page check is going to happen on first #VC handling inside the early exception handler (i.e case 1). The early exception handler uses the MSR protocol, so, there is no need to register the GHCB page. Before registering the page we need to map it unencrypted.


And there already is setup_ghcb() which is called in the #VC handler.
And that thing registers a GHCB GPA.


There are two cases that need to be covered 1) BSP GHCB page and 2) APs GHCB page. The setup_ghcb() is called for the BSP. Later on, per-cpu GHCB page is used by the APs. APs need to register their GHCB page before using it.

But then you have to do it here again.

I think this should be changed together with the CPUID page detection
stuff we talked about earlier, where, after you've established that this
is an SNP guest, you call setup_ghcb() *once* and after that you have
everything set up, including the GHCB GPA. And then the #VC exceptions
can come.

See if my above explanation make sense. Based on it, I don't think it makes sense to register the GHCB during the CPUID page detection. The CPUID page detection will occur in early VC handling.

Right?

Or is there a chicken-and-an-egg issue here which I'm not thinking
about?




[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux