Re: [PATCH v5 08/34] KVM: SVM: Prevent debugging under SEV-ES

2020-12-14 Thread Tom Lendacky
On 12/14/20 9:41 AM, Paolo Bonzini wrote: > On 10/12/20 18:09, Tom Lendacky wrote: >> Additionally, an SEV-ES guest must only and always intercept DR7 reads and >> writes. Update set_dr_intercepts() and clr_dr_intercepts() to account for >> this. > > I cannot see it, where is this documented?

Re: [PATCH v5 08/34] KVM: SVM: Prevent debugging under SEV-ES

2020-12-14 Thread Paolo Bonzini
On 10/12/20 18:09, Tom Lendacky wrote: Additionally, an SEV-ES guest must only and always intercept DR7 reads and writes. Update set_dr_intercepts() and clr_dr_intercepts() to account for this. I cannot see it, where is this documented? Paolo

Re: [PATCH v5 08/34] KVM: SVM: Prevent debugging under SEV-ES

2020-12-14 Thread Paolo Bonzini
On 10/12/20 18:09, Tom Lendacky wrote: +static inline bool sev_guest(struct kvm *kvm) +{ +#ifdef CONFIG_KVM_AMD_SEV + struct kvm_sev_info *sev = _kvm_svm(kvm)->sev_info; + + return sev->active; +#else + return false; +#endif +} + +static inline bool sev_es_guest(struct kvm

[PATCH v5 08/34] KVM: SVM: Prevent debugging under SEV-ES

2020-12-10 Thread Tom Lendacky
From: Tom Lendacky Since the guest register state of an SEV-ES guest is encrypted, debugging is not supported. Update the code to prevent guest debugging when the guest has protected state. Additionally, an SEV-ES guest must only and always intercept DR7 reads and writes. Update