Received-SPF: pass (google.com: domain of linux-kernel+bounces-205274-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Message-ID: <fcfe8637-01df-4c0a-a2c1-1243dd5f32a4@amd.com>
Date: Fri, 7 Jun 2024 09:18:28 +0530
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] KVM: SEV-ES: Fix svm_get_msr()/svm_set_msr() for
 KVM_SEV_ES_INIT guests
To: Michael Roth <michael.roth@amd.com>, Paolo Bonzini <pbonzini@redhat.com>
Cc: linux-kernel@vger.kernel.org, Sean Christopherson <seanjc@google.com>,
 Nikunj A Dadhania <nikunj@amd.com>, Srikanth Aithal <sraithal@amd.com>,
 ravi.bangoria@amd.com, kvm@vger.kernel.org
References: <20240604233510.764949-1-michael.roth@amd.com>
Content-Language: en-US
From: Ravi Bangoria <ravi.bangoria@amd.com>
In-Reply-To: <20240604233510.764949-1-michael.roth@amd.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?utf-8?B?dTRLZjlva1Fud0swZ2VUQW9LRDliQWZnSDVqODlKbnY3eUpnQmovczBiNGMw?=
 =?utf-8?B?V1NrZm1UTVZ0MjZMa1pRQWc2ZDhQY1MwOWNRMXB5dWIyS1lCN1lFajFnYWF0?=
 =?utf-8?B?OEdXUXlGOFRyNVZWZWJLNnJ4Q0w0ZUxFTzFSNFBheTdNamQvalBsS2s2UWoy?=
 =?utf-8?B?bnhBOXE4MGdTUUEwZU85VjNoRnBidkxhc2p0VTdiYlBvNmJlYS90akFqU1Ir?=
 =?utf-8?B?SGFsd1BtRWhKMzBoMU10aHdZd2Z4ZDFBU1JRUngreUhzbERXYStsSDFic3dm?=
 =?utf-8?B?VncwaHhsVlEvdWxrMVFwUURBUWxjaUo2cEFlMWthK1VXWHRMNkhXdjZiRkVM?=
 =?utf-8?B?STJnczV6eWVGd0dVS25xaUNhRk0wN0tKdHJacUw4Riswem0rTnArUXhsQVlv?=
 =?utf-8?B?MnJjUUFyTlI4eWgzYU9rOGtmbmY5T2R1SGJUREJJY0xieGs0VU8wRW1mdVo4?=
 =?utf-8?B?Tmw3L3BiRG5JU3E4K1FnZFNBOGR5R0p2eFpTTTUyNGhQTS83TythUWJmRlll?=
 =?utf-8?B?RHdpNjFyNnFXQyt3N3c4SFBFajZ0TVZBZjZhV3RUWWpFaDdIaUp5eXNIK3kw?=
 =?utf-8?B?L2szVWE3ZE0xNWQ2anRqbUk1L3JiRVRUL3hmaHBXODNtd0wrWExqQ0NNTUZT?=
 =?utf-8?B?UXd2OHAwbnBxTTQ4SjArbjRWV2VkSitMTE1jQ0tGVTFTZ1JGQ2t6TkIzSnly?=
 =?utf-8?B?SkhFVDJ0ZkVEdU5SNytodXE4S00yb0lzVG5tUTIzR2tZSEErUUxGcjdpaUZV?=
 =?utf-8?B?WTRiZDVFb1hyVWI3WHZwZTRqWUcra2d6ODdneHBIWmlHWnhQV1pBbE1KUU5z?=
 =?utf-8?B?amZUS1NRMWEwNDJBa00yYU80R1dLdGV0aTFpVHY4RzRGS0dibTg5QUMzQSti?=
 =?utf-8?B?WnI1WExTZkJkYXUvTWxjalFhc3E1b0xRNSs0ZGw0WUxzOFpHUDNyTXBJTEZs?=
 =?utf-8?B?V0RFelhkS3hUbVlxMlozeWdsajcwNmh3VEJrTGdnK204WDdsZ0FNaW5HMGh0?=
 =?utf-8?B?cnNZV0ZwY3V0Lzh1ZmZCWSttaEJiQUpiTXYwV1BCWnRkL2VpWnQwaDFNcFBS?=
 =?utf-8?B?bkFVZEVXWGplUjVlb05DUGRqVjdCZkpMWUdkN2VZQ3Y0K1Nta3FoZnl0aURs?=
 =?utf-8?B?OW5BYk41SXQrR1JleXR0R011U2I0Qk54MU4yeHN4aVZVaE5BVkFxRW1iMjJQ?=
 =?utf-8?B?d1ZZOFMrcXQyRElPQVNKT08rNTRjQVlYclN6am13SDhPbjZnaFB0bkVlVFQ0?=
 =?utf-8?B?Q2hnb2R5WUZZQW9sUXB2VGsvbHM5dXdKOWgxZDF6VE1RTUVsSWJJdXlYVVN5?=
 =?utf-8?B?TkxxRnJ5alZWcytGN200ZFhLWU5LQmVuYTFGVlozMVZoTXJRSFQ2Y1FTQzhC?=
 =?utf-8?B?M1V5NGlPMmlXSHl4djVIWHJpR0ZTVVNDNUJ6YUkwdmhFeVBYSzE1djVHcmF2?=
 =?utf-8?B?WkpQL1NubFBqUTlGemNKcit2Wkd1SUQ3cHI5TVpCbFA4RW5nTEo0MzluL2xK?=
 =?utf-8?B?VmI3aFRxRjR3UTRDN0FnbHhtL3VYVFVNS2VmTFlCWituQTRiRHNaUE1sS1JL?=
 =?utf-8?B?MmpZZEtYcWlSTkdXWEd6aUx6SVpPUlI5dCtVTWt1U0M1a29RQk9udjZUaHc3?=
 =?utf-8?B?cEJhcWxEWTlUWmJMSk1LMjVTMGhsT3hVQTlhZHUzZUJycGJQVWtXMTJjZFBy?=
 =?utf-8?B?cWltU1drZ2xVa09KOVBDK2pFZXE2d2hHR1pNcTc3dnZFdFo4UE5sVTIxaDhN?=
 =?utf-8?B?R0hvMDBTNEhxcjR1RUtJTHhCbjRSb0t3a0cwRVlISjVFYUVkSGFOUEpvVmM3?=
 =?utf-8?B?OFJoNlBvMnhCWFRibFEzRlRKL291eXRZWW9NbnNiKyt0ZWFySWc3dFhSQ1Rl?=
 =?utf-8?B?VzF1RXZuZFpJMjFtNFI3ZkVRdExVSEpBL29hOWV6R2RNY3VRek1ibFprSFFF?=
 =?utf-8?B?eW1IUVlGb2Ryb09BT3kvSWdzV3JVTHlSMlprdzRXTVJtVitqT1Q3aEtsS0Vt?=
 =?utf-8?B?OTlXb2UranF5SE5nL1ExTjN5SFhjS2xPZE5hQ3hHeGpOTTlSMTFFRmI1ei9q?=
 =?utf-8?B?Z1hLdGpXdEhubU40alZTRXZJOXplVS9WYXZwbXNBU2pMaFdrWHFJOGJETzIy?=
 =?utf-8?Q?Wj89YP/40Mk2MiwyLEAUdEyXn?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 51f1d06b-d3df-489a-ca66-08dc86a4b6ab
X-MS-Exchange-CrossTenant-AuthSource: PH7PR12MB6588.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jun 2024 03:48:38.0485
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: dxCDz+uEj7Ow4YJceq777wOdGXsoefCInMoHZhnQ2cfQCu+aA7Z92w3C9FLWEVcMvOF/nXAOjPImL/Cah+xXAA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR12MB6992

On 6/5/2024 5:05 AM, Michael Roth wrote:
> With commit 27bd5fdc24c0 ("KVM: SEV-ES: Prevent MSR access post VMSA
> encryption"), older VMMs like QEMU 9.0 and older will fail when booting
> SEV-ES guests with something like the following error:
> 
>   qemu-system-x86_64: error: failed to get MSR 0x174
>   qemu-system-x86_64: ../qemu.git/target/i386/kvm/kvm.c:3950: kvm_get_msrs: Assertion `ret == cpu->kvm_msr_buf->nmsrs' failed.
> 
> This is because older VMMs that might still call
> svm_get_msr()/svm_set_msr() for SEV-ES guests after guest boot even if
> those interfaces were essentially just noops because of the vCPU state
> being encrypted and stored separately in the VMSA. Now those VMMs will
> get an -EINVAL and generally crash.
> 
> Newer VMMs that are aware of KVM_SEV_INIT2 however are already aware of
> the stricter limitations of what vCPU state can be sync'd during
> guest run-time, so newer QEMU for instance will work both for legacy
> KVM_SEV_ES_INIT interface as well as KVM_SEV_INIT2.
> 
> So when using KVM_SEV_INIT2 it's okay to assume userspace can deal with
> -EINVAL, whereas for legacy KVM_SEV_ES_INIT the kernel might be dealing
> with either an older VMM and so it needs to assume that returning
> -EINVAL might break the VMM.
> 
> Address this by only returning -EINVAL if the guest was started with
> KVM_SEV_INIT2. Otherwise, just silently return.
> 
> Cc: Ravi Bangoria <ravi.bangoria@amd.com>
> Cc: Nikunj A Dadhania <nikunj@amd.com>
> Reported-by: Srikanth Aithal <sraithal@amd.com>
> Closes: https://lore.kernel.org/lkml/37usuu4yu4ok7be2hqexhmcyopluuiqj3k266z4gajc2rcj4yo@eujb23qc3zcm/
> Fixes: 27bd5fdc24c0 ("KVM: SEV-ES: Prevent MSR access post VMSA encryption")
> Signed-off-by: Michael Roth <michael.roth@amd.com>

Thanks for the fix.

Reviewed-by: Ravi Bangoria <ravi.bangoria@amd.com>