Re: [EXTERNAL] Debug_swap in sev_features

On 3/11/26 11:51, Rodel, Jorg wrote:
> [AMD Official Use Only - AMD Internal Distribution Only]
> 
> I think the problem was that OVMF does not expect DEBUG_SWP to be enabled, therefore it needs to be disabled in VMPL2 for now. You can update your KVM branch to accept this configuration (or live with your hack for now until the new planes code is ready for testing).

Actually OVMF does support DEBUG_SWP.

I think the issue is that the VMPL2 VMSA SEV_FEATURES is set with the
VMPL0 SEV_FEATURES and so the VMPL2 BSP creation fails because the
compare fails in validate_sev_features():

	mismatched AP sev_features [0x11] != [0x29]

0x29 is SNP_ACTIVE | RESTRICTED_INJECTION | DEBUG_SWAP
  which is what is set for the SVSM.

0x11 is SNP_ACTIVE | ALTERNATE_INJECTION

Note that the comparison OR's in RESTRICTED_INJECTION and
ALTERNATE_INJECTION, so the comparison actually ends up looking like:

	0x19 == 0x39

which is why removing DEBUG_SWP from the SVSM work as the comparison
ends up being:

	0x19 == 0x39

Thanks,
Tom

> 
> -Joerg
> 
>> -----Original Message-----
>> From: Jon Lange <[email protected]>
>> Sent: Monday, March 9, 2026 7:39 PM
>> To: Wang, Huibo <[email protected]>; Rodel, Jorg
>> <[email protected]>; Lendacky, Thomas <[email protected]>
>> Cc: [email protected]
>> Subject: RE: [EXTERNAL] Debug_swap in sev_features
>>
>> Joerg identified a similar issue at one point about consistency of SEV features
>> across different VMPLs.  I believe he had an opinion about the right way to solve
>> this.
>>
>> -Jon
>>
>> -----Original Message-----
>> From: Melody Wang <[email protected]>
>> Sent: Monday, March 9, 2026 11:36 AM
>> To: Jon Lange <[email protected]>; Rödel, Jörg <[email protected]>;
>> thomas.lendacky <[email protected]>
>> Cc: [email protected]
>> Subject: [EXTERNAL] Debug_swap in sev_features
>>
>> ( Sorry for resending, had mail issue. )
>>
>> Hi guys,
>>
>> I am working on PoC of Alternate Injection with Planes support.
>>
>> I have run into one issue where the AP_CREATION for VMPL2 fails.
>>
>> The failure happens in validate_sev_features() in kvm as it requires the creating
>> vcpu and new vcpu have the same sev_features, but the new vcpu does not have
>> debug_swap enabled:
>>
>> [2561459.191929] kvm_amd: kvm [675275]: vcpu0, guest rIP: 0x0
>> validate_sev_features: vmgexit: mismatched AP sev_features [0x11] != [0x29]
>> from guest, vmpl: 2
>>
>> I checked back to the SVSM and found when the guest vmsa is initialized in the
>> init_guest_vmsa, where debug_swap is removed, the comment there says:
>>
>>    // TODO: find a way to make this optional so guests that expect debug
>>    // register protection can achieve it.
>>
>> After I commented out this code:
>>
>>   sev_status.remove(SEVStatusFlags::DBGSWP);
>>
>> The issue is resolved.
>>
>> This works as a dirty hack but I thought I should let you know and perhaps hear
>> your opinions about it and what would the right fix be.
>>
>> --
>> Thanks,
>> Melody
>