linux-kernel - Re: [PATCH] x86/sev: Make SEV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250305153705.GKZ8hvoaz2GPt2rGtu@fat_crate.local>
Date: Wed, 5 Mar 2025 16:37:05 +0100
From: Borislav Petkov <bp@...en8.de>
To: Joerg Roedel <jroedel@...e.de>, Dave Hansen <dave.hansen@...el.com>,
	"Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
Cc: Ingo Molnar <mingo@...nel.org>, Joerg Roedel <joro@...tes.org>,
	x86@...nel.org, hpa@...or.com,
	Tom Lendacky <thomas.lendacky@....com>,
	Nikunj A Dadhania <nikunj@....com>, linux-kernel@...r.kernel.org,
	Larry.Dewey@....com
Subject: Re: [PATCH] x86/sev: Make SEV_STATUS available via SYSFS

On Wed, Mar 05, 2025 at 02:56:34PM +0100, Joerg Roedel wrote:
> On Wed, Mar 05, 2025 at 12:50:35PM +0100, Borislav Petkov wrote:
> > On Wed, Mar 05, 2025 at 12:42:41PM +0100, Ingo Molnar wrote:
> > > So if the convenience of tooling is the argument, the raw feature mask 
> > > exposed is the best option overall.
> > 
> > The convenience of tooling *and* user. I want both. I want to be able to boot
> > a guest and see what features are enabled without needing a tool.
> > 
> > And, at the same time, tools should be able to use the same interface.
> > 
> > Exactly like we *and glibc* use /proc/cpuinfo today. Now think the same thing
> > but for confidential guests.
> 
> So this question boils down to whether the parsing of the bits happens
> in kernel- or user-space. Actually there is already parsing in
> kernel-space to print the status bits into the kernel log:
> 
> 	SEV: Status: SEV SEV-ES SEV-SNP
> 
> ... which is great for a quick glance without needing any tools. The
> user-space tools which already exist have their own parsing of the bits
> and for them it is much easier to consume the raw value of the
> SEV_STATUS MSR. See my changes to snpguest:
> 
> 	https://github.com/virtee/snpguest/pull/88/files

Well, I guess we can do both:

cat /sys/...

SEV_STATUS(0xdeadbeef): SEV SEV-ES SEV-SNP

So that people don't have to pick apart the MSR hex value.

> Btw, what is the equivalent on the Intel TDX side for these feature
> bits?

There is none, AFAICT. That's why the whole discussion.

Lemme add TDX folks.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette