Messages in this thread |  | | Date | Wed, 20 Oct 2021 23:09:03 +0800 | Subject | Re: [PATCH] x86/sev-es: Expose __sev_es_ghcb_hv_call() to call ghcb hv call out of sev code | From | Tianyu Lan <> |
| |
On 10/20/2021 10:39 PM, Borislav Petkov wrote: > On Wed, Oct 20, 2021 at 10:23:06PM +0800, Tianyu Lan wrote: >> This follows Joreg's previous comment and I implemented similar version in >> the V! patchset([PATCH 05/13] HV: Add Write/Read MSR registers via ghcb page >> https://lkml.org/lkml/2021/7/28/668). >> "Instead, factor out a helper function which contains what Hyper-V needs and >> use that in sev_es_ghcb_hv_call() and Hyper-V code." >> >> https://lkml.org/lkml/2021/8/2/375 > > If you wanna point to mails on a mailing list, you simply do > > https://lore.kernel.org/r/<Message-id> > > No need to use some random, unreliable web pages.
OK. Thanks for suggestion.
> > As to Joerg's suggestion, in the version I'm seeing, you're checking the > *context* - and the one you sent today, avoids the __pa(ghcb) MSR write. > > So which is it? > > Because your current version will look at the context too, see > > return verify_exception_info(ghcb, ctxt); > > at the end of the function. Both old and new patches are to avoid setting GHCB page address via MSR. Paravisor is in charge of doing that and un-enlightened guest should not change it. The old one was in the patchset v1 "x86/Hyper-V: Add Hyper-V Isolation VM support". The patch I sent today is based on your clean up patch and for review first. It should be in patchset "x86/Hyper-V: Add Hyper-V Isolation VM support."
> > So is the issue what Tom said that "the paravisor uses the same GHCB MSR > and GHCB protocol, it just can't use __pa() to get the address of the > GHCB."?
Yes, hyper-V enables vTOM in the CVM and GHCB page PA reported by paravisor contains vTOM bit. We need to use memremap() to map ghcb page before accessing GHCB page. __pa() doesn't work for PA with vTOM bit. Otherwise, guest should not set GHCB page address and avoid conflict with paravisor.
> > If that is the case and the only thing you want is to avoid the GHCB PA > write, then, in the future, we might drop that MSR write altogether on > the enlightened Linux guests too and then the same function will be used > by your paravisor and the Linux guest.
Yes, this is the target of the patch. Can we put the change in the Hyper-V patchset? Other patch has been fully reviewed.
Thanks.
|  |