Received-SPF: pass (google.com: domain of linux-kernel+bounces-66824-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Message-ID: <434e65bd-49ec-40f1-bd2b-68765ecbb86d@amd.com>
Date: Thu, 15 Feb 2024 17:13:45 +0530
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] x86/sev: Dump SEV_STATUS
To: Borislav Petkov <bp@alien8.de>, Ashish Kalra <ashish.kalra@amd.com>,
 Michael Roth <michael.roth@amd.com>, Tom Lendacky <thomas.lendacky@amd.com>
Cc: X86 ML <x86@kernel.org>, LKML <linux-kernel@vger.kernel.org>
References: <20240213163311.32130-1-bp@alien8.de>
Content-Language: en-US
From: "Nikunj A. Dadhania" <nikunj@amd.com>
In-Reply-To: <20240213163311.32130-1-bp@alien8.de>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?utf-8?B?MXlCa1V0NFg3Zi9zZGRtSlk5cGVsUGJDcmxYZDFQZHBiT29NcFY3RWVESis3?=
 =?utf-8?B?clVvWk05blgxcXV5VDNPUisrOE5zaGkxam04NUNmZHZjR3c0dXdBQ2tFTTNz?=
 =?utf-8?B?SUloNHMzWGVkakJDUUNNU0Rua1paTTQ1ZE5SWEpVcHBQODlOazhsaEFQWXJ4?=
 =?utf-8?B?WURyN2tKTHltaU13bzg3VDVCVzJWT1kvUU56MnIrcjFxc2F3bEtwVWZCRWRq?=
 =?utf-8?B?cTlaK2hYNVAxMW9KbUF0a0NKNkVQaTJ2UWk5RGgrRUJ1M0lzZG9IUmt3UDdl?=
 =?utf-8?B?N1hLTlowdWhQRk9Rc1ZnRmEzTVlITDR1ZG9EaVJtZ0xaNm9SV3h0QldNbWc1?=
 =?utf-8?B?RURVZ2w4SElPM1VVYzFVaVBVYlAyc0FjQi83bGh4SUxWY3pzandFQUh4WHA1?=
 =?utf-8?B?SVE3di9vR0FabDJyT21NcWg4SWZ4UStMdTZ3b05TMmZVTlViNTliTzFwcEVu?=
 =?utf-8?B?UXdEN2dNK2M3NHlxd2F4Z1Z3Ni9tSFZSNnoxRDg2aGsxOUVLUDNSN3FqdjZL?=
 =?utf-8?B?Z3h5Q0xySEljNXkzRGtZU3h4VE54MHZJQUlZUzF4TDk3ZHY1OHZtU3N2czA3?=
 =?utf-8?B?WWlXVVBiT1ZQTEt1ZW0zdnIzaDRTUi9KL2xWcWRmVng4dWFKa0psaEtiZDFQ?=
 =?utf-8?B?a3FFd1VMcGhhVERsMnEvd0hjVngrbDA3dUhtdG5LaTdIT0FxNEZMSEZyc0p3?=
 =?utf-8?B?S1FpdU91WkVCaUxlRVowNmR5c3JEejZxcSt4bW1XN21nY1U5NkJzM0VWVXNo?=
 =?utf-8?B?bldYcUpzRnN2LzlvNG1aVjVLbTI2SWJGSzd0dTBkNFZRTDJONjJ1cjZIbHds?=
 =?utf-8?B?SVhtUU1sSWpneWhHeWYxc1JBTTd6OXluVHhwNFhjakVaWEhnY2tnTUc3Ulpp?=
 =?utf-8?B?V09rQldEZHNHQUpNSFc3YnJzTG1Rak1xWHdMbHBpUnJ0QnBJSHJkOHV0OU9z?=
 =?utf-8?B?RDNXaFFMdlpiWDlkdW05WmlTd0Z4Yk9ZaDZjTnA5NGFwaE9QWjBrbk5nY1NR?=
 =?utf-8?B?TWx1THYrZTduTlR5YU54Qk15QmttVEJvV2VONFRDVmRsZHVqbkF1eHNBTTRF?=
 =?utf-8?B?RXU2QS8zTERlU0dDd1BjUWs2K3lKZHNzQ01pbExobXZWYjJwbUxGdEtJdjI2?=
 =?utf-8?B?enZhblpwTEVOZjVsSEo0L1BVREFiTzhvaUpUOUFjYU9HS1duMUN2K091RExy?=
 =?utf-8?B?azlrU1dqZUNIUFZHY0FNV3lzdmIraENDRXdiajZLbVptaWk3aHlxWW8xNG1P?=
 =?utf-8?B?MG1ZN0NyWUsrZDVGa1JkR3ZicUpkLzdwaFRyeUZIY3o0cGRCQnZ6SnQ0cy9V?=
 =?utf-8?B?eW5BMnc4UXZXR05nYnREY20wTU9XMjhJMHpLaDJkMzdtM1NwWll1K3lMTmNJ?=
 =?utf-8?B?ZVFGUWllandJTFJMWUExYlZWc1pLNGsycjBGK1FaSUlsMERQem5xTEFjZitz?=
 =?utf-8?B?RkZaM1phWWMybmk5UXR6Wm5NT0h3b1dTRXNCUnpFWFBaTFJxOUtQSzhqcVNt?=
 =?utf-8?B?K0VhUEt0dWIveWJKdW1ualk1dW5tRDlGc1pKTWNOQWRuUkVzZjZvL2UxVDFS?=
 =?utf-8?B?QjlmaC90Q2wwckk3NVlxaHNtdXdJSGZtQmJ5V041Sms1dXFIaHk0NzFVUEh3?=
 =?utf-8?B?UFMrNGVQS1Y3L0hCQWY2NkV3UW1vQThiVi92ZlZ3ZTlZOENObktkZHg4bVlk?=
 =?utf-8?B?YVltRzRnT3JvYy84SWwzT1dvRHY3S2pxQ0pGNG1nQWpwY2JyTWpyclRvdTZB?=
 =?utf-8?B?SnhiZkJuN282K0lXdDBDSlR3bHhvSHVtZmpSSHdCODV4d0ZWTitYRnZVMmFt?=
 =?utf-8?B?ODBPMUV1OTVNMEswVll1QkZFQXdJN3IwYlcrdUNwSkpIQjNXMjFraHpwQ1g5?=
 =?utf-8?B?UVhZYmRFcW1ZMEpvV3R6WDhsK3pVT29LbGVEbzN5dEZ5Z3dwcng3b1B1K3RU?=
 =?utf-8?B?RURnb0VERWFqRWVFZzhrYWtsNGR2elZKZ1pCTHlVMzFqRXRES0Z4ZlY1OE01?=
 =?utf-8?B?Y0h3amcvRnBsL1lPVW5ER1EvTUF5YW9zM1lZZWhYd0U3WGZBVmNQQWVZcmhO?=
 =?utf-8?B?bFJRSjJqMjg4YUc1SHRpZVlOWEFDM25mazh1WHVoNlBWWHplUnlYNWtkV2hX?=
 =?utf-8?Q?buYGwc92KjjlwyjW1HQ8HD0iK?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8fbdf4c9-04f3-4ea7-4d53-08dc2e1b62e8
X-MS-Exchange-CrossTenant-AuthSource: DS7PR12MB6309.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Feb 2024 11:43:54.1843
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: FhJ9w9aeR2e4G12JdOTOr+VF5cVCRHUesWm3I5qCxbohPPOcq3zLtAImaeE/nPYQPsJizS05Hik4lrTnSDJIJg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW3PR12MB4378

On 2/13/2024 10:03 PM, Borislav Petkov wrote:
> From: "Borislav Petkov (AMD)" <bp@alien8.de>
> 
> It is, and will be even more useful in the future, to dump the SEV
> features enabled according to SEV_STATUS. Do so:
> 
>   [    0.542753] Memory Encryption Features active: AMD SEV SEV-ES SEV-SNP
>   [    0.544425] SEV: Status: SEV SEV-ES SEV-SNP DebugSwap
> 
> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>

Definitely very useful:

Reviewed-by: Nikunj A Dadhania <nikunj@amd.com>

> ---
>  arch/x86/boot/compressed/sev.c   |  2 +-
>  arch/x86/include/asm/msr-index.h | 59 +++++++++++++++++++-------------
>  arch/x86/include/asm/sev.h       |  2 ++
>  arch/x86/kernel/sev.c            | 35 +++++++++++++++++++
>  arch/x86/mm/mem_encrypt.c        |  5 +++
>  5 files changed, 78 insertions(+), 25 deletions(-)
> 
> diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c
> index fffdba4ae806..97561eabfbef 100644
> --- a/arch/x86/boot/compressed/sev.c
> +++ b/arch/x86/boot/compressed/sev.c
> @@ -370,7 +370,7 @@ static void enforce_vmpl0(void)
>  				 MSR_AMD64_SNP_VMPL_SSS |		\
>  				 MSR_AMD64_SNP_SECURE_TSC |		\
>  				 MSR_AMD64_SNP_VMGEXIT_PARAM |		\
> -				 MSR_AMD64_SNP_VMSA_REG_PROTECTION |	\
> +				 MSR_AMD64_SNP_VMSA_REG_PROT |		\
>  				 MSR_AMD64_SNP_RESERVED_BIT13 |		\
>  				 MSR_AMD64_SNP_RESERVED_BIT15 |		\
>  				 MSR_AMD64_SNP_RESERVED_MASK)
> diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
> index 237c50cc1c72..24c575cdd6b9 100644
> --- a/arch/x86/include/asm/msr-index.h
> +++ b/arch/x86/include/asm/msr-index.h
> @@ -605,36 +605,47 @@
>  #define MSR_AMD64_SEV_ES_GHCB		0xc0010130
>  #define MSR_AMD64_SEV			0xc0010131
>  #define MSR_AMD64_SEV_ENABLED_BIT	0
> -#define MSR_AMD64_SEV_ES_ENABLED_BIT	1
> -#define MSR_AMD64_SEV_SNP_ENABLED_BIT	2
>  #define MSR_AMD64_SEV_ENABLED		BIT_ULL(MSR_AMD64_SEV_ENABLED_BIT)
> +#define MSR_AMD64_SEV_ES_ENABLED_BIT	1
>  #define MSR_AMD64_SEV_ES_ENABLED	BIT_ULL(MSR_AMD64_SEV_ES_ENABLED_BIT)
> +#define MSR_AMD64_SEV_SNP_ENABLED_BIT	2
>  #define MSR_AMD64_SEV_SNP_ENABLED	BIT_ULL(MSR_AMD64_SEV_SNP_ENABLED_BIT)
> -#define MSR_AMD64_RMP_BASE		0xc0010132
> -#define MSR_AMD64_RMP_END		0xc0010133
> -
> -/* SNP feature bits enabled by the hypervisor */
> -#define MSR_AMD64_SNP_VTOM			BIT_ULL(3)
> -#define MSR_AMD64_SNP_REFLECT_VC		BIT_ULL(4)
> -#define MSR_AMD64_SNP_RESTRICTED_INJ		BIT_ULL(5)
> -#define MSR_AMD64_SNP_ALT_INJ			BIT_ULL(6)
> -#define MSR_AMD64_SNP_DEBUG_SWAP		BIT_ULL(7)
> -#define MSR_AMD64_SNP_PREVENT_HOST_IBS		BIT_ULL(8)
> -#define MSR_AMD64_SNP_BTB_ISOLATION		BIT_ULL(9)
> -#define MSR_AMD64_SNP_VMPL_SSS			BIT_ULL(10)
> -#define MSR_AMD64_SNP_SECURE_TSC		BIT_ULL(11)
> -#define MSR_AMD64_SNP_VMGEXIT_PARAM		BIT_ULL(12)
> -#define MSR_AMD64_SNP_IBS_VIRT			BIT_ULL(14)
> -#define MSR_AMD64_SNP_VMSA_REG_PROTECTION	BIT_ULL(16)
> -#define MSR_AMD64_SNP_SMT_PROTECTION		BIT_ULL(17)
> -
> -/* SNP feature bits reserved for future use. */
> -#define MSR_AMD64_SNP_RESERVED_BIT13		BIT_ULL(13)
> -#define MSR_AMD64_SNP_RESERVED_BIT15		BIT_ULL(15)
> -#define MSR_AMD64_SNP_RESERVED_MASK		GENMASK_ULL(63, 18)
> +#define MSR_AMD64_SNP_VTOM_BIT		3
> +#define MSR_AMD64_SNP_VTOM		BIT_ULL(MSR_AMD64_SNP_VTOM_BIT)
> +#define MSR_AMD64_SNP_REFLECT_VC_BIT	4
> +#define MSR_AMD64_SNP_REFLECT_VC	BIT_ULL(MSR_AMD64_SNP_REFLECT_VC_BIT)
> +#define MSR_AMD64_SNP_RESTRICTED_INJ_BIT 5
> +#define MSR_AMD64_SNP_RESTRICTED_INJ	BIT_ULL(MSR_AMD64_SNP_RESTRICTED_INJ_BIT)
> +#define MSR_AMD64_SNP_ALT_INJ_BIT	6
> +#define MSR_AMD64_SNP_ALT_INJ		BIT_ULL(MSR_AMD64_SNP_ALT_INJ_BIT)
> +#define MSR_AMD64_SNP_DEBUG_SWAP_BIT	7
> +#define MSR_AMD64_SNP_DEBUG_SWAP	BIT_ULL(MSR_AMD64_SNP_DEBUG_SWAP_BIT)
> +#define MSR_AMD64_SNP_PREVENT_HOST_IBS_BIT 8
> +#define MSR_AMD64_SNP_PREVENT_HOST_IBS	BIT_ULL(MSR_AMD64_SNP_PREVENT_HOST_IBS_BIT)
> +#define MSR_AMD64_SNP_BTB_ISOLATION_BIT	9
> +#define MSR_AMD64_SNP_BTB_ISOLATION	BIT_ULL(MSR_AMD64_SNP_BTB_ISOLATION_BIT)
> +#define MSR_AMD64_SNP_VMPL_SSS_BIT	10
> +#define MSR_AMD64_SNP_VMPL_SSS		BIT_ULL(MSR_AMD64_SNP_VMPL_SSS_BIT)
> +#define MSR_AMD64_SNP_SECURE_TSC_BIT	11
> +#define MSR_AMD64_SNP_SECURE_TSC	BIT_ULL(MSR_AMD64_SNP_SECURE_TSC_BIT)
> +#define MSR_AMD64_SNP_VMGEXIT_PARAM_BIT	12
> +#define MSR_AMD64_SNP_VMGEXIT_PARAM	BIT_ULL(MSR_AMD64_SNP_VMGEXIT_PARAM_BIT)
> +#define MSR_AMD64_SNP_RESERVED_BIT13	BIT_ULL(13)
> +#define MSR_AMD64_SNP_IBS_VIRT_BIT	14
> +#define MSR_AMD64_SNP_IBS_VIRT		BIT_ULL(MSR_AMD64_SNP_IBS_VIRT_BIT)
> +#define MSR_AMD64_SNP_RESERVED_BIT15	BIT_ULL(15)
> +#define MSR_AMD64_SNP_VMSA_REG_PROT_BIT	16
> +#define MSR_AMD64_SNP_VMSA_REG_PROT	BIT_ULL(MSR_AMD64_SNP_VMSA_REG_PROT_BIT)
> +#define MSR_AMD64_SNP_SMT_PROT_BIT	17
> +#define MSR_AMD64_SNP_SMT_PROT		BIT_ULL(MSR_AMD64_SNP_SMT_PROT_BIT)
> +#define MSR_AMD64_SNP_RESV_BIT		18
> +#define MSR_AMD64_SNP_RESERVED_MASK	GENMASK_ULL(63, MSR_AMD64_SNP_RESV_BIT)
>  
>  #define MSR_AMD64_VIRT_SPEC_CTRL	0xc001011f
>  
> +#define MSR_AMD64_RMP_BASE		0xc0010132
> +#define MSR_AMD64_RMP_END		0xc0010133
> +
>  /* AMD Collaborative Processor Performance Control MSRs */
>  #define MSR_AMD_CPPC_CAP1		0xc00102b0
>  #define MSR_AMD_CPPC_ENABLE		0xc00102b1
> diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h
> index d7b27cb34c2b..10f9f1b259c3 100644
> --- a/arch/x86/include/asm/sev.h
> +++ b/arch/x86/include/asm/sev.h
> @@ -229,6 +229,7 @@ void snp_accept_memory(phys_addr_t start, phys_addr_t end);
>  u64 snp_get_unsupported_features(u64 status);
>  u64 sev_get_status(void);
>  void kdump_sev_callback(void);
> +void sev_show_status(void);
>  #else
>  static inline void sev_es_ist_enter(struct pt_regs *regs) { }
>  static inline void sev_es_ist_exit(void) { }
> @@ -258,6 +259,7 @@ static inline void snp_accept_memory(phys_addr_t start, phys_addr_t end) { }
>  static inline u64 snp_get_unsupported_features(u64 status) { return 0; }
>  static inline u64 sev_get_status(void) { return 0; }
>  static inline void kdump_sev_callback(void) { }
> +static inline void sev_show_status(void) { }
>  #endif
>  
>  #ifdef CONFIG_KVM_AMD_SEV
> diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c
> index 1ef7ae806a01..081d1391bc18 100644
> --- a/arch/x86/kernel/sev.c
> +++ b/arch/x86/kernel/sev.c
> @@ -59,6 +59,25 @@
>  #define AP_INIT_CR0_DEFAULT		0x60000010
>  #define AP_INIT_MXCSR_DEFAULT		0x1f80
>  
> +static const char * const sev_status_feat_names[] = {
> +	[MSR_AMD64_SEV_ENABLED_BIT]		= "SEV",
> +	[MSR_AMD64_SEV_ES_ENABLED_BIT]		= "SEV-ES",
> +	[MSR_AMD64_SEV_SNP_ENABLED_BIT]		= "SEV-SNP",
> +	[MSR_AMD64_SNP_VTOM_BIT]		= "vTom",
> +	[MSR_AMD64_SNP_REFLECT_VC_BIT]		= "Reflect VC",
> +	[MSR_AMD64_SNP_RESTRICTED_INJ_BIT]	= "RI",
> +	[MSR_AMD64_SNP_ALT_INJ_BIT]		= "AI",
> +	[MSR_AMD64_SNP_DEBUG_SWAP_BIT]		= "DebugSwap",
> +	[MSR_AMD64_SNP_PREVENT_HOST_IBS_BIT]	= "No HostIBS",
> +	[MSR_AMD64_SNP_BTB_ISOLATION_BIT]	= "BTB Isol",
> +	[MSR_AMD64_SNP_VMPL_SSS_BIT]		= "VmplSSS",
> +	[MSR_AMD64_SNP_SECURE_TSC_BIT]		= "Secure TSC",
> +	[MSR_AMD64_SNP_VMGEXIT_PARAM_BIT]	= "VMGExit param",
> +	[MSR_AMD64_SNP_IBS_VIRT_BIT]		= "IBS Virt",
> +	[MSR_AMD64_SNP_VMSA_REG_PROT_BIT]	= "VMSA reg prot",
> +	[MSR_AMD64_SNP_SMT_PROT_BIT]		= "SMT prot",
> +};
> +
>  /* For early boot hypervisor communication in SEV-ES enabled guests */
>  static struct ghcb boot_ghcb_page __bss_decrypted __aligned(PAGE_SIZE);
>  
> @@ -2275,3 +2294,19 @@ void kdump_sev_callback(void)
>  	if (cpu_feature_enabled(X86_FEATURE_SEV_SNP))
>  		wbinvd();
>  }
> +
> +void sev_show_status(void)
> +{
> +	int i;
> +
> +	pr_info("Status: ");
> +	for (i = 0; i < MSR_AMD64_SNP_RESV_BIT; i++) {
> +		if (sev_status & BIT_ULL(i)) {
> +			if (!sev_status_feat_names[i])
> +				continue;
> +
> +			pr_cont("%s ", sev_status_feat_names[i]);
> +		}
> +	}
> +	pr_cont("\n");
> +}
> diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c
> index d035bce3a2b0..6f3b3e028718 100644
> --- a/arch/x86/mm/mem_encrypt.c
> +++ b/arch/x86/mm/mem_encrypt.c
> @@ -14,6 +14,8 @@
>  #include <linux/mem_encrypt.h>
>  #include <linux/virtio_anchor.h>
>  
> +#include <asm/sev.h>
> +
>  /* Override for DMA direct allocation check - ARCH_HAS_FORCE_DMA_UNENCRYPTED */
>  bool force_dma_unencrypted(struct device *dev)
>  {
> @@ -74,6 +76,9 @@ static void print_mem_encrypt_feature_info(void)
>  			pr_cont(" SEV-SNP");
>  
>  		pr_cont("\n");
> +
> +		sev_show_status();
> +
>  		break;
>  	default:
>  		pr_cont("Unknown\n");