| Message ID | 20240209183743.22030-4-pbonzini@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: SEV: allow customizing VMSA features | expand |
On Fri, Feb 09, 2024 at 01:37:35PM -0500, Paolo Bonzini wrote: > The description of firmware is included part under the "SEV Key Management" > header, part under the KVM_SEV_INIT ioctl. Put these two bits together and > and rename "SEV Key Management" to what it actually is, namely a description > of the KVM_MEMORY_ENCRYPT_OP API. > > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael Roth <michael.roth@amd.com> > --- > .../virt/kvm/x86/amd-memory-encryption.rst | 29 +++++++++++-------- > 1 file changed, 17 insertions(+), 12 deletions(-) > > diff --git a/Documentation/virt/kvm/x86/amd-memory-encryption.rst b/Documentation/virt/kvm/x86/amd-memory-encryption.rst > index 995780088eb2..37c5c37f4f6e 100644 > --- a/Documentation/virt/kvm/x86/amd-memory-encryption.rst > +++ b/Documentation/virt/kvm/x86/amd-memory-encryption.rst > @@ -46,14 +46,8 @@ SEV hardware uses ASIDs to associate a memory encryption key with a VM. > Hence, the ASID for the SEV-enabled guests must be from 1 to a maximum value > defined in the CPUID 0x8000001f[ecx] field. > > -SEV Key Management > -================== > - > -The SEV guest key management is handled by a separate processor called the AMD > -Secure Processor (AMD-SP). Firmware running inside the AMD-SP provides a secure > -key management interface to perform common hypervisor activities such as > -encrypting bootstrap code, snapshot, migrating and debugging the guest. For more > -information, see the SEV Key Management spec [api-spec]_ > +``KVM_MEMORY_ENCRYPT_OP`` API > +============================= > > The main ioctl to access SEV is KVM_MEMORY_ENCRYPT_OP. If the argument > to KVM_MEMORY_ENCRYPT_OP is NULL, the ioctl returns 0 if SEV is enabled > @@ -87,10 +81,6 @@ guests, such as launching, running, snapshotting, migrating and decommissioning. > The KVM_SEV_INIT command is used by the hypervisor to initialize the SEV platform > context. In a typical workflow, this command should be the first command issued. > > -The firmware can be initialized either by using its own non-volatile storage or > -the OS can manage the NV storage for the firmware using the module parameter > -``init_ex_path``. If the file specified by ``init_ex_path`` does not exist or > -is invalid, the OS will create or override the file with output from PSP. > > Returns: 0 on success, -negative on error > > @@ -434,6 +424,21 @@ issued by the hypervisor to make the guest ready for execution. > > Returns: 0 on success, -negative on error > > +Firmware Management > +=================== > + > +The SEV guest key management is handled by a separate processor called the AMD > +Secure Processor (AMD-SP). Firmware running inside the AMD-SP provides a secure > +key management interface to perform common hypervisor activities such as > +encrypting bootstrap code, snapshot, migrating and debugging the guest. For more > +information, see the SEV Key Management spec [api-spec]_ > + > +The AMD-SP firmware can be initialized either by using its own non-volatile > +storage or the OS can manage the NV storage for the firmware using > +parameter ``init_ex_path`` of the ``ccp`` module. If the file specified > +by ``init_ex_path`` does not exist or is invalid, the OS will create or > +override the file with PSP non-volatile storage. > + > References > ========== > > -- > 2.39.0 > > >
diff --git a/Documentation/virt/kvm/x86/amd-memory-encryption.rst b/Documentation/virt/kvm/x86/amd-memory-encryption.rst index 995780088eb2..37c5c37f4f6e 100644 --- a/Documentation/virt/kvm/x86/amd-memory-encryption.rst +++ b/Documentation/virt/kvm/x86/amd-memory-encryption.rst @@ -46,14 +46,8 @@ SEV hardware uses ASIDs to associate a memory encryption key with a VM. Hence, the ASID for the SEV-enabled guests must be from 1 to a maximum value defined in the CPUID 0x8000001f[ecx] field. -SEV Key Management -================== - -The SEV guest key management is handled by a separate processor called the AMD -Secure Processor (AMD-SP). Firmware running inside the AMD-SP provides a secure -key management interface to perform common hypervisor activities such as -encrypting bootstrap code, snapshot, migrating and debugging the guest. For more -information, see the SEV Key Management spec [api-spec]_ +``KVM_MEMORY_ENCRYPT_OP`` API +============================= The main ioctl to access SEV is KVM_MEMORY_ENCRYPT_OP. If the argument to KVM_MEMORY_ENCRYPT_OP is NULL, the ioctl returns 0 if SEV is enabled @@ -87,10 +81,6 @@ guests, such as launching, running, snapshotting, migrating and decommissioning. The KVM_SEV_INIT command is used by the hypervisor to initialize the SEV platform context. In a typical workflow, this command should be the first command issued. -The firmware can be initialized either by using its own non-volatile storage or -the OS can manage the NV storage for the firmware using the module parameter -``init_ex_path``. If the file specified by ``init_ex_path`` does not exist or -is invalid, the OS will create or override the file with output from PSP. Returns: 0 on success, -negative on error @@ -434,6 +424,21 @@ issued by the hypervisor to make the guest ready for execution. Returns: 0 on success, -negative on error +Firmware Management +=================== + +The SEV guest key management is handled by a separate processor called the AMD +Secure Processor (AMD-SP). Firmware running inside the AMD-SP provides a secure +key management interface to perform common hypervisor activities such as +encrypting bootstrap code, snapshot, migrating and debugging the guest. For more +information, see the SEV Key Management spec [api-spec]_ + +The AMD-SP firmware can be initialized either by using its own non-volatile +storage or the OS can manage the NV storage for the firmware using +parameter ``init_ex_path`` of the ``ccp`` module. If the file specified +by ``init_ex_path`` does not exist or is invalid, the OS will create or +override the file with PSP non-volatile storage. + References ==========
The description of firmware is included part under the "SEV Key Management" header, part under the KVM_SEV_INIT ioctl. Put these two bits together and and rename "SEV Key Management" to what it actually is, namely a description of the KVM_MEMORY_ENCRYPT_OP API. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> --- .../virt/kvm/x86/amd-memory-encryption.rst | 29 +++++++++++-------- 1 file changed, 17 insertions(+), 12 deletions(-)