Hi Boris,


On 11/2/21 11:53 AM, Borislav Petkov wrote:

On Fri, Oct 08, 2021 at 01:04:25PM -0500, Brijesh Singh wrote:

quoted

+	/* SEV-SNP guest requires that GHCB must be registered. */
+	if (cc_platform_has(CC_ATTR_SEV_SNP))
+		snp_register_ghcb(data, __pa(ghcb));

This looks like more of that "let's register a GHCB at the time the
first #VC fires".

There are two #VC handlers:

1) early exception handler [do_vc_no_ghcb()]. The handler uses the MSR 
protocol based VMGEXIT.

https://elixir.bootlin.com/linux/latest/source/arch/x86/kernel/sev-shared.c#L147


2) exception handler setup during the idt bringup 
[handle_vc_boot_ghcb()]. The handler uses the full GHCB.
https://elixir.bootlin.com/linux/latest/source/arch/x86/kernel/sev.c#L1472

To answer your question, GHCB is registered at the time of first #VC 
handling by the second exception handler. Mike can correct me, the CPUID 
page check is going to happen on first #VC handling inside the early 
exception handler (i.e case 1). The early exception handler uses the MSR 
protocol, so, there is no need to register the GHCB page. Before 
registering the page we need to map it unencrypted.

And there already is setup_ghcb() which is called in the #VC handler.
And that thing registers a GHCB GPA.

There are two cases that need to be covered 1) BSP GHCB page and 2) APs 
GHCB page. The setup_ghcb() is called for the BSP. Later on, per-cpu 
GHCB page is used by the APs. APs need to register their GHCB page 
before using it.

But then you have to do it here again.

I think this should be changed together with the CPUID page detection
stuff we talked about earlier, where, after you've established that this
is an SNP guest, you call setup_ghcb() *once* and after that you have
everything set up, including the GHCB GPA. And then the #VC exceptions
can come.

See if my above explanation make sense. Based on it, I don't think it 
makes sense to register the GHCB during the CPUID page detection. The 
CPUID page detection will occur in early VC handling.

Right?

Or is there a chicken-and-an-egg issue here which I'm not thinking
about?