Re: Debug_swap in sev_features

Hi,

On 3/9/26 7:35 PM, Melody Wang wrote:
> ( Sorry for resending, had mail issue. )
> 
> Hi guys,
> 
> I am working on PoC of Alternate Injection with Planes support.
> 
> I have run into one issue where the AP_CREATION for VMPL2 fails.
> 
> The failure happens in validate_sev_features() in kvm as it requires the
> creating vcpu and new vcpu have the same sev_features, but the new vcpu
> does not have debug_swap enabled:

I ran into this same issue, I reported it in some other email on this list.

> [2561459.191929] kvm_amd: kvm [675275]: vcpu0, guest rIP: 0x0
> validate_sev_features: vmgexit: mismatched AP sev_features [0x11] !=
> [0x29] from guest, vmpl: 2
> 
> I checked back to the SVSM and found when the guest vmsa is initialized
> in the
> init_guest_vmsa, where debug_swap is removed, the comment there says:
> 
>   // TODO: find a way to make this optional so guests that expect debug
>   // register protection can achieve it.
> 
> After I commented out this code:
> 
>   sev_status.remove(SEVStatusFlags::DBGSWP);
> 
> The issue is resolved.

Yes, exactly, this was introduced 539624271cb8 ("sev: require the debug
register virtualization feature") in the SVSM, and as Tom points out in
his reply, this is because the SEV features for the guest (VMPL2) VMSA
do not match those of the VMPL0 VMSA, and KVM (with the planes patches
on top) does not tolerate it.

> This works as a dirty hack but I thought I should let you know and perhaps
> hear your opinions about it and what would the right fix be.

My suggestion was to add SVM_SEV_FEAT_DEBUG_SWAP to
GUEST_CONTROLLED_SEV_FEATURES, but I never got around to try it.

Best,
Carlos