linux-kernel - Re: [PATCH v4 2/2] KVM: SEV: Configure "ALLOWED_SEV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <19388b93-c311-4671-902c-096ad1b04650@amd.com>
Date: Thu, 6 Mar 2025 17:04:03 -0600
From: Kim Phillips <kim.phillips@....com>
To: "Gupta, Pankaj" <pankaj.gupta@....com>, <kvm@...r.kernel.org>,
	<linux-coco@...ts.linux.dev>, <linux-kernel@...r.kernel.org>
CC: Tom Lendacky <thomas.lendacky@....com>, Michael Roth
	<michael.roth@....com>, Ashish Kalra <ashish.kalra@....com>, "Nikunj A .
 Dadhania" <nikunj@....com>, Borislav Petkov <bp@...en8.de>, Dave Hansen
	<dave.hansen@...ux.intel.com>, Sean Christopherson <seanjc@...gle.com>,
	"Paolo Bonzini" <pbonzini@...hat.com>, Ingo Molnar <mingo@...hat.com>, "H.
 Peter Anvin" <hpa@...or.com>, Thomas Gleixner <tglx@...utronix.de>, "Kishon
 Vijay Abraham I" <kvijayab@....com>
Subject: Re: [PATCH v4 2/2] KVM: SEV: Configure "ALLOWED_SEV_FEATURES" VMCB
 Field

On 3/5/25 11:28 PM, Gupta, Pankaj wrote:
> On 3/6/2025 1:38 AM, Kim Phillips wrote:
>> diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h
>> index 9b7fa99ae951..b382fd251e5b 100644
>> --- a/arch/x86/include/asm/svm.h
>> +++ b/arch/x86/include/asm/svm.h
>> @@ -159,7 +159,10 @@ struct __attribute__ ((__packed__)) 
>> vmcb_control_area {
>>       u64 avic_physical_id;    /* Offset 0xf8 */
>>       u8 reserved_7[8];
>>       u64 vmsa_pa;        /* Used for an SEV-ES guest */
>> -    u8 reserved_8[720];
>> +    u8 reserved_8[40];
>> +    u64 allowed_sev_features;    /* Offset 0x138 */
>> +    u64 guest_sev_features;        /* Offset 0x140 */
> 
> Just thinking, if dumping error in logs would be
> useful for Admin in case of failure Or maybe we
> want to leave this to userspace?

Agreed.  I'll add the following in the next version:

[  435.580838] kvm_amd: allowed_sev_features:8000000000000001
[  435.587738] kvm_amd: guest_sev_features: 0000000000000081

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 8abeab91d329..bff6e9c34586 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -3435,6 +3435,8 @@ static void dump_vmcb(struct kvm_vcpu *vcpu)
         pr_err("%-20s%016llx\n", "avic_logical_id:", control->avic_logical_id);
         pr_err("%-20s%016llx\n", "avic_physical_id:", control->avic_physical_id);
         pr_err("%-20s%016llx\n", "vmsa_pa:", control->vmsa_pa);
+       pr_err("%-20s%016llx\n", "allowed_sev_features:", control->allowed_sev_features);
+       pr_err("%-20s%016llx\n", "guest_sev_features:", control->guest_sev_features);
         pr_err("VMCB State Save Area:\n");
         pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
                "es:",

Thank you for your review!

Kim