Re: [PATCH v3 2/2] KVM: SEV: Enforce minimum GHCB version requirement for SEV-SNP guests

[Sean Christopherson <seanjc@google.com>]

On Mon, Aug 04, 2025, Nikunj A Dadhania wrote:
> Require a minimum GHCB version of 2 when starting SEV-SNP guests through
> KVM_SEV_INIT2. When a VMM attempts to start an SEV-SNP guest with an
> incompatible GHCB version (less than 2), reject the request early rather
> than allowing the guest kernel to start with an incorrect protocol version
> and fail later with GHCB_SNP_UNSUPPORTED guest termination.
> 
> Hypervisor logs the guest termination with GHCB_SNP_UNSUPPORTED error code:

s/Hypervisor/KVM, though I don't see any point in saying that KVM is doing
the logging, that's self-evident from the kvm_amd prefix.  Instead, I think
what's important to is to say the guest _typically_ requests termination,
because AFAICT nothing guarantees the guest will fail in this exact way.

  Not enforcing the minimum version typically causes the guest to request
  termination with GHCB_SNP_UNSUPPORTED error code:

    kvm_amd: SEV-ES guest requested termination: 0x0:0x2

> kvm_amd: SEV-ES guest requested termination: 0x0:0x2
> 
> SNP guest fails with the below error message:

This is QEMU output, not guest output.  I don't see any reason to capture this.
The fact that QEMU apparently doesn't handle KVM_EXIT_SYSTEM_EVENT isn't interesting.

> KVM: unknown exit reason 24
> EAX=00000000 EBX=00000000 ECX=00000000 EDX=00a00f11
> ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
> EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
> ES =0000 00000000 0000ffff 00009300
> CS =f000 ffff0000 0000ffff 00009b00
> SS =0000 00000000 0000ffff 00009300
> DS =0000 00000000 0000ffff 00009300
> FS =0000 00000000 0000ffff 00009300
> GS =0000 00000000 0000ffff 00009300
> LDT=0000 00000000 0000ffff 00008200
> TR =0000 00000000 0000ffff 00008b00
> GDT=     00000000 0000ffff
> IDT=     00000000 0000ffff
> CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
> DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
> DR6=00000000ffff0ff0 DR7=0000000000000400
> EFER=0000000000000000


No need for you to send a new version, I'm going to post a combined series for
this and Secure TSC.