linux-kernel - Re: [PATCH 1/2] KVM: SVM: Drop the module param to control SEV-ES DebugSwap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a1b05197-0e0d-4f3c-9b49-a2236df6a0f7@amd.com>
Date: Sun, 11 Jan 2026 11:39:47 -0600
From: Tom Lendacky <thomas.lendacky@....com>
To: Sean Christopherson <seanjc@...gle.com>,
 Paolo Bonzini <pbonzini@...hat.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/2] KVM: SVM: Drop the module param to control SEV-ES
 DebugSwap

On 1/8/26 21:31, Sean Christopherson wrote:
> Rip out the DebugSwap module param, as the sequence of events that led to
> its inclusion was one big mistake, the param no longer serves any purpose.
> 
> Commit d1f85fbe836e ("KVM: SEV: Enable data breakpoints in SEV-ES") goofed
> by not adding a way for the userspace VMM to control the feature.
> Functionally, that was fine, but it broke attestation signatures because
> SEV_FEATURES are included in the signature.
> 
> Commit 5abf6dceb066 ("SEV: disable SEV-ES DebugSwap by default") fixed that
> issue, but the underlying flaw of userspace not having a way to control
> SEV_FEATURES was still there.
> 
> That flaw was addressed by commit 4f5defae7089 ("KVM: SEV: introduce
> KVM_SEV_INIT2 operation"), and so then 4dd5ecacb9a4 ("KVM: SEV: allow
> SEV-ES DebugSwap again") re-enabled DebugSwap by default.
> 
> Now that the dust has settled, the module param doesn't serve any
> meaningful purpose.
> 
> Cc: Tom Lendacky <thomas.lendacky@....com>
> Signed-off-by: Sean Christopherson <seanjc@...gle.com>

Reviewed-by: Tom Lendacky <thomas.lendacky@....com>

> ---
>  arch/x86/kvm/svm/sev.c | 11 +++--------
>  1 file changed, 3 insertions(+), 8 deletions(-)
> 
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index f59c65abe3cf..9b92f0cccfe6 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -53,9 +53,6 @@ module_param_named(sev_es, sev_es_enabled, bool, 0444);
>  static bool sev_snp_enabled = true;
>  module_param_named(sev_snp, sev_snp_enabled, bool, 0444);
>  
> -/* enable/disable SEV-ES DebugSwap support */
> -static bool sev_es_debug_swap_enabled = true;
> -module_param_named(debug_swap, sev_es_debug_swap_enabled, bool, 0444);
>  static u64 sev_supported_vmsa_features;
>  
>  static unsigned int nr_ciphertext_hiding_asids;
> @@ -3150,12 +3147,10 @@ void __init sev_hardware_setup(void)
>  	sev_es_enabled = sev_es_supported;
>  	sev_snp_enabled = sev_snp_supported;
>  
> -	if (!sev_es_enabled || !cpu_feature_enabled(X86_FEATURE_DEBUG_SWAP) ||
> -	    !cpu_feature_enabled(X86_FEATURE_NO_NESTED_DATA_BP))
> -		sev_es_debug_swap_enabled = false;
> -
>  	sev_supported_vmsa_features = 0;
> -	if (sev_es_debug_swap_enabled)
> +
> +	if (sev_es_enabled && cpu_feature_enabled(X86_FEATURE_DEBUG_SWAP) &&
> +	    cpu_feature_enabled(X86_FEATURE_NO_NESTED_DATA_BP))
>  		sev_supported_vmsa_features |= SVM_SEV_FEAT_DEBUG_SWAP;
>  
>  	if (sev_snp_enabled && tsc_khz && cpu_feature_enabled(X86_FEATURE_SNP_SECURE_TSC))