Re: [PATCH] x86/sev: Make SEV_STATUS available via SYSFS

[Borislav Petkov]

On Wed, Mar 05, 2025 at 02:56:34PM +0100, Joerg Roedel wrote:
> On Wed, Mar 05, 2025 at 12:50:35PM +0100, Borislav Petkov wrote:
> > On Wed, Mar 05, 2025 at 12:42:41PM +0100, Ingo Molnar wrote:
> > > So if the convenience of tooling is the argument, the raw feature mask 
> > > exposed is the best option overall.
> > 
> > The convenience of tooling *and* user. I want both. I want to be able to boot
> > a guest and see what features are enabled without needing a tool.
> > 
> > And, at the same time, tools should be able to use the same interface.
> > 
> > Exactly like we *and glibc* use /proc/cpuinfo today. Now think the same thing
> > but for confidential guests.
> 
> So this question boils down to whether the parsing of the bits happens
> in kernel- or user-space. Actually there is already parsing in
> kernel-space to print the status bits into the kernel log:
> 
> 	SEV: Status: SEV SEV-ES SEV-SNP
> 
> ... which is great for a quick glance without needing any tools. The
> user-space tools which already exist have their own parsing of the bits
> and for them it is much easier to consume the raw value of the
> SEV_STATUS MSR. See my changes to snpguest:
> 
> 	https://github.com/virtee/snpguest/pull/88/files

Well, I guess we can do both:

cat /sys/...

SEV_STATUS(0xdeadbeef): SEV SEV-ES SEV-SNP

So that people don't have to pick apart the MSR hex value.

> Btw, what is the equivalent on the Intel TDX side for these feature
> bits?

There is none, AFAICT. That's why the whole discussion.

Lemme add TDX folks.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette