On 10/30/22 21:07, Guorui Yu wrote:Yes, "Instead of" should be "Addtionally,".
We have encountered similar problems on SEV-ES, here are their fixes
on Kernel [1] and OVMF[2].
SEV-ES and TDX are very different beasts in this area.
Instead of enforcing the ATTR_SEPT_VE_DISABLE in TDX guest kernel, I
think the fix should also include necessary check on the MMIO path of
the #VE routine.
Instead?
Without ATTR_SEPT_VE_DISABLE, a #VE can occur on basically any
instruction. We call those kinds of exceptions "paranoid entry" points.
They need special handling like the NMI or #MC handlers.
I'd be happy to look at a patch that does the MMIO path check *and*
turns the #VE handler into a robust entry point.
Bonus points if you can do ~5 lines of C like the approach in this thread.