Re: SEV guest debugging support for Qemu

[Ashish Kalra <ashish.kalra@amd.com>]

Hello Paolo,

On Fri, Sep 25, 2020 at 10:56:10PM +0200, Paolo Bonzini wrote:
> On 25/09/20 22:46, Ashish Kalra wrote:
> > I was also considering abstracting this vendor/SEV specific debug
> > interface via the CPUClass object, the CPUClass object aleady has cpu
> > specific methods for doing things like guest VA to GPA translations like the
> > get_phys_page_attrs_debug() method and it will be a simple and clean
> > approach to override this method with a SEV specific
> > get_phys_page_attrs_debug() if SEV guest is active and SEV debug policy
> > is allowed. [...]
> > 
> > I can probably add new interfaces/methods to this CPUClass object for
> > guest memory read/writes for debugging purpose and then invoke the same
> > from the generic cpu_memory_rw_debug() interface. 
> > 
> > Let me know your thougts on abstracting this debug interface via the
> > CPUClass object ? 
> > 
> > Or the other option is to introduce the new MemoryDebugOps you described
> > above and additionally apply SEV/SEV-ES considerations in CPUClass
> > methods such as gdb_read_register, gdb_write_register, etc.
> 
> Yes, this makes the most sense, however you're right that you don't need
> translate in MemoryDebugOps.  I don't think read/write should be moved
> to CPUClass, however, since you can use a MemTxAttr to tell the
> read/write MemoryDebugOps whether the page is encrypted or not.
> 

Thanks for your input, i have one additional query with reference to this support :

For all explicitly unecrypted guest memory regions such as S/W IOTLB bounce buffers,
dma_decrypted() allocated regions and for guest regions marked as "__bss_decrypted",
we need to ensure that DBG_DECRYPT API calls are bypassed for such
regions and those regions are dumped as un-encrypted.

This guest memory regions encryption status is found using KVM's page encryption bitmap
support which is part of the page encryption bitmap hypercall interface of the
KVM/QEMU SEV live migration patches.

As this additional debug support is dependent on the KVM's page encryption bitmap
support, are there any updates on KVM SEV live migration patches ?

Thanks,
Ashish