From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9F8EC77B75 for ; Mon, 22 May 2023 13:35:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231567AbjEVNfK (ORCPT ); Mon, 22 May 2023 09:35:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52582 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230293AbjEVNfJ (ORCPT ); Mon, 22 May 2023 09:35:09 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [IPv6:2001:67c:2178:6::1d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4FFD7B3; Mon, 22 May 2023 06:35:08 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 046161FF22; Mon, 22 May 2023 13:35:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1684762507; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZwgZPSVQU88xY0ZuspB0YnyfVDoSsMQeh+w6yWQbG00=; b=V11m+XimLIAJUvZk+8dpYiYuCMTXNW23lbOGhoW3+FIfNNTqjQmH7adJtuLANzfrhW/lpN khCq8DgNcGnBtllWaMw5B0WaGdz5/zvkn4+HIJvglTRLAPpXeR31z2RQfyY/TG8sXGJHek TdtiDK7w7b+Y3Tns3X7cO7vi9jmsUzQ= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1684762507; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZwgZPSVQU88xY0ZuspB0YnyfVDoSsMQeh+w6yWQbG00=; b=i722WT24nV5NvTt1wzMBdAxalDnA6FboXuj30errRw45wTfx3Rdq8MPdRaRX6FPtr6JKvI JaijZ7Xa/f41YpBg== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 7369613336; Mon, 22 May 2023 13:35:06 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id RJmjGopva2Q/fwAAMHmgww (envelope-from ); Mon, 22 May 2023 13:35:06 +0000 Date: Mon, 22 May 2023 15:35:05 +0200 From: Joerg Roedel To: Ard Biesheuvel Cc: Tom Lendacky , linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org, Evgeniy Baskov , Borislav Petkov , Andy Lutomirski , Dave Hansen , Ingo Molnar , Peter Zijlstra , Thomas Gleixner , Alexey Khoroshilov , Peter Jones , Gerd Hoffmann , Dave Young , Mario Limonciello , Kees Cook , "Kirill A . Shutemov" , Linus Torvalds Subject: Re: [PATCH v2 17/20] x86: efistub: Check SEV/SNP support while running in the firmware Message-ID: References: <20230508070330.582131-1-ardb@kernel.org> <20230508070330.582131-18-ardb@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org On Mon, May 22, 2023 at 03:07:12PM +0200, Ard Biesheuvel wrote: > So IIUC, we could just read sev_status much earlier just to perform > the SNP feature check, and fail the boot gracefully on a mismatch. And > the sev_enable() call needs to move after ExitBootServices(), right? Right, sev_enable() negotiates the GHCB protocol version, which needs the GHCB MSR, so that has to stay after ExitBootServices(). The SEV feature check on the other side only needs to read the sev-status MSR, which is no problem before ExitBootServices() (as long as it is only read on SEV platforms). > That would result in only very minor duplication, afaict. I'll have a > stab at implementing this for v4. Thanks, -- Jörg Rödel jroedel@suse.de SUSE Software Solutions Germany GmbH Frankenstraße 146 90461 Nürnberg Germany (HRB 36809, AG Nürnberg) Geschäftsführer: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman