Re: [RFC PATCH 00/35] SEV-ES hypervisor support

2020-11-30 Thread Paolo Bonzini
On 30/11/20 20:35, Sean Christopherson wrote: Delayed interrupts are fine, since they are injected according to RVI and the posted interrupt descriptor. I'm thinking more of events (exceptions and interrupts) that caused an EPT violation exit and were recorded in the IDT-vectored info field. Ah

Re: [RFC PATCH 00/35] SEV-ES hypervisor support

2020-11-30 Thread Sean Christopherson
+Isaku and Xiaoyao On Mon, Nov 30, 2020, Paolo Bonzini wrote: > On 30/11/20 19:14, Sean Christopherson wrote: > > > > TDX also selectively blocks/skips portions of other ioctl()s so that the > > > > TDX code itself can yell loudly if e.g. .get_cpl() is invoked. The > > > > event > > > > injectio

Re: [RFC PATCH 00/35] SEV-ES hypervisor support

2020-11-30 Thread Paolo Bonzini
On 30/11/20 19:14, Sean Christopherson wrote: TDX also selectively blocks/skips portions of other ioctl()s so that the TDX code itself can yell loudly if e.g. .get_cpl() is invoked. The event injection restrictions are due to direct injection not being allowed (except for NMIs); all IRQs have to

Re: [RFC PATCH 00/35] SEV-ES hypervisor support

2020-11-30 Thread Sean Christopherson
On Mon, Nov 30, 2020, Tom Lendacky wrote: > On 11/30/20 9:31 AM, Paolo Bonzini wrote: > > On 16/09/20 02:19, Sean Christopherson wrote: > >> > >> TDX also selectively blocks/skips portions of other ioctl()s so that the > >> TDX code itself can yell loudly if e.g. .get_cpl() is invoked.  The event >

Re: [RFC PATCH 00/35] SEV-ES hypervisor support

2020-11-30 Thread Sean Christopherson
On Mon, Nov 30, 2020, Paolo Bonzini wrote: > On 16/09/20 02:19, Sean Christopherson wrote: > > > > TDX also selectively blocks/skips portions of other ioctl()s so that the > > TDX code itself can yell loudly if e.g. .get_cpl() is invoked. The event > > injection restrictions are due to direct inj

Re: [RFC PATCH 00/35] SEV-ES hypervisor support

2020-11-30 Thread Tom Lendacky
On 11/30/20 9:31 AM, Paolo Bonzini wrote: > On 16/09/20 02:19, Sean Christopherson wrote: >> >> TDX also selectively blocks/skips portions of other ioctl()s so that the >> TDX code itself can yell loudly if e.g. .get_cpl() is invoked.  The event >> injection restrictions are due to direct injection

Re: [RFC PATCH 00/35] SEV-ES hypervisor support

2020-11-30 Thread Paolo Bonzini
On 16/09/20 02:19, Sean Christopherson wrote: TDX also selectively blocks/skips portions of other ioctl()s so that the TDX code itself can yell loudly if e.g. .get_cpl() is invoked. The event injection restrictions are due to direct injection not being allowed (except for NMIs); all IRQs have t

Re: [RFC PATCH 00/35] SEV-ES hypervisor support

2020-10-13 Thread Tom Lendacky
Apologies, Sean. I thought I had replied to this but found it instead in my drafts folder... I've taken much of your feedback and incorporated that into the next version of the patches that I submitted and updated this response based on that, too. On 9/15/20 7:19 PM, Sean Christopherson wrote: >

Re: [RFC PATCH 00/35] SEV-ES hypervisor support

2020-09-15 Thread Sean Christopherson
On Tue, Sep 15, 2020 at 12:22:05PM -0500, Tom Lendacky wrote: > On 9/14/20 5:59 PM, Sean Christopherson wrote: > > Given that we don't yet have publicly available KVM code for TDX, what if I > > generate and post a list of ioctls() that are denied by either SEV-ES or > > TDX, > > organized by the

Re: [RFC PATCH 00/35] SEV-ES hypervisor support

2020-09-15 Thread Brijesh Singh
On 9/15/20 12:32 PM, Sean Christopherson wrote: > On Tue, Sep 15, 2020 at 12:22:05PM -0500, Tom Lendacky wrote: >> On 9/14/20 5:59 PM, Sean Christopherson wrote: >>> On Mon, Sep 14, 2020 at 03:15:14PM -0500, Tom Lendacky wrote: From: Tom Lendacky This patch series provides support

Re: [RFC PATCH 00/35] SEV-ES hypervisor support

2020-09-15 Thread Sean Christopherson
On Tue, Sep 15, 2020 at 12:22:05PM -0500, Tom Lendacky wrote: > On 9/14/20 5:59 PM, Sean Christopherson wrote: > > On Mon, Sep 14, 2020 at 03:15:14PM -0500, Tom Lendacky wrote: > >> From: Tom Lendacky > >> > >> This patch series provides support for running SEV-ES guests under KVM. > > > > From t

Re: [RFC PATCH 00/35] SEV-ES hypervisor support

2020-09-15 Thread Tom Lendacky
On 9/14/20 5:59 PM, Sean Christopherson wrote: > On Mon, Sep 14, 2020 at 03:15:14PM -0500, Tom Lendacky wrote: >> From: Tom Lendacky >> >> This patch series provides support for running SEV-ES guests under KVM. > > From the x86/VMX side of things, the GPR hooks are the only changes that I > stron

Re: [RFC PATCH 00/35] SEV-ES hypervisor support

2020-09-14 Thread Sean Christopherson
On Mon, Sep 14, 2020 at 03:15:14PM -0500, Tom Lendacky wrote: > From: Tom Lendacky > > This patch series provides support for running SEV-ES guests under KVM. >From the x86/VMX side of things, the GPR hooks are the only changes that I strongly dislike. For the vmsa_encrypted flag and related th

[RFC PATCH 00/35] SEV-ES hypervisor support

2020-09-14 Thread Tom Lendacky
From: Tom Lendacky This patch series provides support for running SEV-ES guests under KVM. Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on the SEV support to protect the guest register state from the hypervisor. See "AMD64 Architecture Programmer's Manual Volume 2: System P