From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 457B8C43461 for ; Tue, 15 Sep 2020 22:14:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1400C20872 for ; Tue, 15 Sep 2020 22:14:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727971AbgIOWN5 (ORCPT ); Tue, 15 Sep 2020 18:13:57 -0400 Received: from mga01.intel.com ([192.55.52.88]:36764 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727674AbgIOQiy (ORCPT ); Tue, 15 Sep 2020 12:38:54 -0400 IronPort-SDR: 6a2yjuiUcEA9QTSAJMqGvtOw55gSEu5VbyWrbrCyCIGK205wHSfrjHW1LTfQ3PEheZTRTU9Cbt S7djqP73aKBw== X-IronPort-AV: E=McAfee;i="6000,8403,9745"; a="177366563" X-IronPort-AV: E=Sophos;i="5.76,430,1592895600"; d="scan'208";a="177366563" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Sep 2020 09:33:44 -0700 IronPort-SDR: 7k9HOsKnBIpD230s+kK4ULUCDbqylfwCiah/poMJ/8PFsSu0IbQrzbtuIbQzFV8f+C1S7q2b3Y 66JM4ZgWKqVw== X-IronPort-AV: E=Sophos;i="5.76,430,1592895600"; d="scan'208";a="288054778" Received: from sjchrist-ice.jf.intel.com (HELO sjchrist-ice) ([10.54.31.34]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Sep 2020 09:33:43 -0700 Date: Tue, 15 Sep 2020 09:33:42 -0700 From: Sean Christopherson To: Tom Lendacky Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org, Paolo Bonzini , Jim Mattson , Joerg Roedel , Vitaly Kuznetsov , Wanpeng Li , Borislav Petkov , Ingo Molnar , Thomas Gleixner , Brijesh Singh Subject: Re: [RFC PATCH 25/35] KVM: x86: Update __get_sregs() / __set_sregs() to support SEV-ES Message-ID: <20200915163342.GC8420@sjchrist-ice> References: <20200914213708.GC7192@sjchrist-ice> <7fa6b074-6a62-3f8e-f047-c63851ebf7c9@amd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <7fa6b074-6a62-3f8e-f047-c63851ebf7c9@amd.com> User-Agent: Mutt/1.9.4 (2018-02-28) Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org On Tue, Sep 15, 2020 at 09:19:46AM -0500, Tom Lendacky wrote: > On 9/14/20 4:37 PM, Sean Christopherson wrote: > > On Mon, Sep 14, 2020 at 03:15:39PM -0500, Tom Lendacky wrote: > >> From: Tom Lendacky > >> > >> Since many of the registers used by the SEV-ES are encrypted and cannot > >> be read or written, adjust the __get_sregs() / __set_sregs() to only get > >> or set the registers being tracked (efer, cr0, cr4 and cr8) once the VMSA > >> is encrypted. > > > > Is there an actual use case for writing said registers after the VMSA is > > encrypted? Assuming there's a separate "debug mode" and live migration has > > special logic, can KVM simply reject the ioctl() if guest state is protected? > > Yeah, I originally had it that way but one of the folks looking at live > migration for SEV-ES thought it would be easier given the way Qemu does > things. But I think it's easy enough to batch the tracking registers into > the VMSA state that is being transferred during live migration. Let me > check that out and likely the SET ioctl() could just skip all the regs. Hmm, that would be ideal. How are the tracked registers validated when they're loaded at the destination? It seems odd/dangerous that KVM would have full control over efer/cr0/cr4/cr8. I.e. why is KVM even responsibile for migrating that information, e.g. as opposed to migrating an opaque blob that contains encrypted versions of those registers?