Re: [edk2-devel] [PATCH 15/16] Ovmfpkg/CcExitLib: Provide SVSM discovery support

["Lendacky, Thomas via groups.io" <thomas.lendacky=amd.com@groups.io>]

On 1/30/24 05:38, Gerd Hoffmann wrote:
> On Mon, Jan 29, 2024 at 12:04:51PM -0600, Tom Lendacky wrote:
>> On 1/29/24 09:23, Gerd Hoffmann via groups.io wrote:
>>> On Fri, Jan 26, 2024 at 04:13:14PM -0600, Tom Lendacky wrote:
>>>> BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654
>>>>
>>>> The SVSM specification documents an alternative method of discovery for
>>>> the SVSM using a reserved CPUID bit and a reserved MSR.
>>>>
>>>> For the CPUID support, the #VC handler of an SEV-SNP guest should modify
>>>> the returned value in the EAX register for the 0x8000001f CPUID function
>>>> by setting bit 28 when an SVSM is present.
>>>>
>>>> For the MSR support, new reserved MSR 0xc001f000 has been defined. A #VC
>>>> should be generated when accessing this MSR. The #VC handler is expected
>>>> to ignore writes to this MSR and return the physical calling area address
>>>> (CAA) on reads of this MSR.
>>>
>>> I'm wondering why this is handled by the ovmf #vc handler instead of the
>>> svsm #vc handler?
>>
>> OVMF will be running in guest VMPL1 context, not SVSM VMPL0 context, when
>> the CPUID instruction / MSR access is performed. In that case, it is the
>> guest VMPL1 #VC handler that will get control and have to respond.
> 
> IIRC vmpl0 can handle #vc exceptions for vmpl1.
> 
> But maybe only in case vmpl1 hasn't a #vc handler, i.e. vmpl1 can't
> cherry-pick which exceptions it handles itself and which it delegates
> to the SVSM.

Correct. The Reflect-VC feature says that all #VCs in the guest will cause 
an exit to the hypervisor. It is then up to the hypervisor to schedule the 
proper VMPL level to handle the #VC. This is the paravisor concept where 
you can run an unenlightened guest.

> 
> What happens once the linux kernel called ExitBootServices?  Will the
> edk2 #vc handler stay alive?  Or will the linux kernel install its own
> handler?

Once Linux installs its own IDT entry, then the Linux #VC handler is 
invoked for any #VCs that occur.

Thanks,
Tom

> 
> take care,
>    Gerd
> 


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#114793): https://edk2.groups.io/g/devel/message/114793
Mute This Topic: https://groups.io/mt/103986477/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-