Re: [PATCH v8 08/40] x86/sev: Check the vmpl level

Brijesh Singh
2022-01-04T15:23:35Z

On 12/20/21 12:10 PM, Borislav Petkov wrote:
> On Fri, Dec 17, 2021 at 04:33:02PM -0600, Tom Lendacky wrote:
>>>>>> + * There is no straightforward way to query the current VMPL level. The
>>>>>> + * simplest method is to use the RMPADJUST instruction to change a page
>>>>>> + * permission to a VMPL level-1, and if the guest kernel is launched at
>>>>>> + * a level <= 1, then RMPADJUST instruction will return an error.
>>>>> Perhaps a nit. When you say "level <= 1", do you mean a level lower than or
>>>>> equal to 1 semantically, or numerically?
>>>
>>> Its numerically, please see the AMD APM vol 3.
>>
>> Actually it is not numerically... if it was numerically, then 0 <= 1 would
>> return an error, but VMPL0 is the highest permission level.
>
> Just write in that comment exactly what this function does:
>
> "RMPADJUST modifies RMP permissions of a lesser-privileged (numerically
> higher) privilege level. Here, clear the VMPL1 permission mask of the
> GHCB page. If the guest is not running at VMPL0, this will fail.
>
> If the guest is running at VMP0, it will succeed. Even if that operation
> modifies permission bits, it is still ok to do currently because Linux
> SNP guests are supported only on VMPL0 so VMPL1 or higher permission
> masks changing is a don't-care."
>
> and then everything is clear wrt numbering, privilege, etc.
>
> Ok?
>

Noted.

thanks