| Message ID | 20210826222627.3556-1-michael.roth@amd.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | Add AMD Secure Nested Paging (SEV-SNP) support | expand |
On Thu, Aug 26, 2021 at 05:26:15PM -0500, Michael Roth wrote: > These patches implement SEV-SNP along with CPUID enforcement support for QEMU, > and are also available at: > > https://github.com/mdroth/qemu/commits/snp-rfc-v2-upstream > > They are based on the initial RFC submitted by Brijesh: > > https://lore.kernel.org/qemu-devel/20210722000259.ykepl7t6ptua7im5@amd.com/T/ What's the status of these patches ? Is there going to be any non-RFC version posted in the near future ? Regards, Daniel
On 11/16/21 3:23 AM, Daniel P. Berrangé wrote: > On Thu, Aug 26, 2021 at 05:26:15PM -0500, Michael Roth wrote: >> These patches implement SEV-SNP along with CPUID enforcement support for QEMU, >> and are also available at: >> >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fmdroth%2Fqemu%2Fcommits%2Fsnp-rfc-v2-upstream&data=04%7C01%7Cbrijesh.singh%40amd.com%7C3506c40b7121401945b108d9a8e2c8d0%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637726514264887241%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=HXdG4TmNY157Gz6qLXhAL8FufCTxe9VzSiTaQICGawo%3D&reserved=0 >> >> They are based on the initial RFC submitted by Brijesh: >> >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flore.kernel.org%2Fqemu-devel%2F20210722000259.ykepl7t6ptua7im5%40amd.com%2FT%2F&data=04%7C01%7Cbrijesh.singh%40amd.com%7C3506c40b7121401945b108d9a8e2c8d0%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637726514264887241%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=AhOI%2FoQFq4k%2B6uOqYQqos6FlxE4AD1FFYfIPPiSHioI%3D&reserved=0 > What's the status of these patches ? Is there going to be any non-RFC > version posted in the near future ? I am waiting for the KVM interface to be finalized before spinning the qemu patch. With the recent discussion on KVM patch we may see some change in the interfaces. I am hoping to post updated series after posting the newer KVM series. thanls > > Regards, > Daniel
These patches implement SEV-SNP along with CPUID enforcement support for QEMU, and are also available at: https://github.com/mdroth/qemu/commits/snp-rfc-v2-upstream They are based on the initial RFC submitted by Brijesh: https://lore.kernel.org/qemu-devel/20210722000259.ykepl7t6ptua7im5@amd.com/T/ Changes since RFC v1: - rebased onto latest master - drop SNP config file in favor of a new 'sev-snp-guest' object where all SNP-related params are passed as strings/integers via command-line - report specific error if BIOS reports invalid address/len for reserved/pre-validated regions (Connor) - use Range helpers for handling validated region overlaps (Dave) - simplify error handling in sev_snp_launch_start, and report the correct return code when handling LAUNCH_START failures (Dov) - add SEV-SNP bit to CPUID 0x8000001f when SNP enabled - updated query-sev to handle differences between SEV and SEV-SNP - updated to work against v5 of SEV-SNP host kernel / hypervisor patches Overview -------- SEV-SNP builds upon existing SEV and SEV-ES functionality while adding new hardware-based memory protections. SEV-SNP adds strong memory integrity protection to help prevent malicious hypervisor-based attacks like data replay, memory re-mapping and more in order to create an isolated memory encryption environment. This series depends on the following patches to support SEV-SNP in Linux kernel and OVMF: guest kernel (v5, part 1): https://lore.kernel.org/kvm/20210820151933.22401-1-brijesh.singh@amd.com/T/ host kernel (v5, part 2): https://lore.kernel.org/lkml/20210820155918.7518-1-brijesh.singh@amd.com/ OVMF (v5): https://edk2.groups.io/g/devel/message/77335?p=,,,20,0,0,0::Created,,posterid%3A5969970,20,2,20,83891508 The Qemu patches uses the command id added by the SEV-SNP hypervisor patches to bootstrap the SEV-SNP VMs. Additional resources -------------------- SEV-SNP whitepaper https://www.amd.com/system/files/TechDocs/SEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more.pdf APM 2: https://www.amd.com/system/files/TechDocs/24593.pdf (section 15.36) GHCB spec: https://developer.amd.com/wp-content/resources/56421.pdf SEV-SNP firmware specification: https://www.amd.com/system/files/TechDocs/56860.pdf ---------------------------------------------------------------- Brijesh Singh (6): linux-header: add the SNP specific command i386/sev: introduce 'sev-snp-guest' object i386/sev: initialize SNP context i386/sev: add the SNP launch start context i386/sev: add support to encrypt BIOS when SEV-SNP is enabled i386/sev: populate secrets and cpuid page and finalize the SNP launch Michael Roth (6): i386/sev: introduce "sev-common" type to encapsulate common SEV state target/i386: set SEV-SNP CPUID bit when SNP enabled target/i386: allow versioned CPUs to specify new cache_info target/i386: add new EPYC CPU versions with updated cache_info i386/sev: sev-snp: add support for CPUID validation i386/sev: update query-sev QAPI format to handle SEV-SNP docs/amd-memory-encryption.txt | 77 +++- hw/i386/pc_sysfw.c | 7 +- include/sysemu/sev.h | 2 +- linux-headers/linux/kvm.h | 50 +++ qapi/misc-target.json | 71 ++- qapi/qom.json | 94 +++- target/i386/cpu.c | 221 ++++++++- target/i386/monitor.c | 29 +- target/i386/sev-stub.c | 8 +- target/i386/sev.c | 989 +++++++++++++++++++++++++++++++++++------ target/i386/sev_i386.h | 4 + target/i386/trace-events | 4 + 12 files changed, 1374 insertions(+), 182 deletions(-)