Re: [PATCH] KVM: SEV: Enforce minimum GHCB version requirement for SEV-SNP guests

[Nikunj A Dadhania <nikunj@amd.com>]

Sean Christopherson <seanjc@google.com> writes:

> On Fri, Jul 11, 2025, Nikunj A Dadhania wrote:
>> Require a minimum GHCB version of 2 when starting SEV-SNP guests through
>> KVM_SEV_INIT2. When a VMM attempts to start an SEV-SNP guest with an
>> incompatible GHCB version (less than 2), reject the request early rather
>> than allowing the guest to start with an incorrect protocol version and
>> fail later.
>
> What happens with ghcb_version==1?   I.e. what failure occurs, and
> when?

SNP guest terminates with following error:

KVM: unknown exit reason 24
EAX=00000000 EBX=00000000 ECX=00000000 EDX=00a00f11
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 00009300
CS =f000 ffff0000 0000ffff 00009b00
SS =0000 00000000 0000ffff 00009300
DS =0000 00000000 0000ffff 00009300
FS =0000 00000000 0000ffff 00009300
GS =0000 00000000 0000ffff 00009300
LDT=0000 00000000 0000ffff 00008200
TR =0000 00000000 0000ffff 00008b00
GDT=     00000000 0000ffff
IDT=     00000000 0000ffff
CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000000
Code=c5 5a 08 2d 00 00 00 00 00 00 00 00 00 00 00 00 56 54 46 00 <0f> 20
c0 a8 01 74 05 e9 2c ff ff ff e9 11 ff 90 00 00 00 00 00 00 00 00 00 00
00 00 00 00

Hypervisor logs the guest termination with GHCB_SNP_UNSUPPORTED error code:

kvm_amd: SEV-ES guest requested termination: 0x0:0x2

Regards
Nikunj