[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v8 00/28] x86: Secure Encrypted Virtualization (AMD)
From: |
Brijesh Singh |
Subject: |
[Qemu-devel] [PATCH v8 00/28] x86: Secure Encrypted Virtualization (AMD) |
Date: |
Mon, 12 Feb 2018 09:36:47 -0600 |
This patch series provides support for AMD's new Secure Encrypted
Virtualization (SEV) feature.
SEV is an extension to the AMD-V architecture which supports running
multiple VMs under the control of a hypervisor. The SEV feature allows
the memory contents of a virtual machine (VM) to be transparently encrypted
with a key unique to the guest VM. The memory controller contains a
high performance encryption engine which can be programmed with multiple
keys for use by a different VMs in the system. The programming and
management of these keys is handled by the AMD Secure Processor firmware
which exposes a commands for these tasks.
The KVM SEV patch series introduced a new ioctl (KVM_MEMORY_ENCRYPTION_OP)
which is used by qemu to issue the SEV commands to assist performing
common hypervisor activities such as a launching, running, snapshooting,
migration and debugging guests.
The following links provide additional details:
AMD Memory Encryption whitepaper:
http://amd-dev.wpengine.netdna-cdn.com/wordpress/media/2013/12/AMD_Memory_Encryption_Whitepaper_v7-Public.pdf
AMD64 Architecture Programmer's Manual:
http://support.amd.com/TechDocs/24593.pdf
SME is section 7.10
SEV is section 15.34
Secure Encrypted Virutualization Key Management:
http://support.amd.com/TechDocs/55766_SEV-KM API_Specification.pdf
KVM Forum slides:
http://www.linux-kvm.org/images/7/74/02x08A-Thomas_Lendacky-AMDs_Virtualizatoin_Memory_Encryption_Technology.pdf
Video of the KVM Forum Talk:
https://www.youtube.com/watch?v=RcvQ1xN55Ew
---
The complete patch series is available :
https://github.com/codomania/qemu/tree/v8
Using these patches we have succesfully booted and tested a guest both with and
without SEV enabled.
TODO:
* Add SEV guest migration support
* Add SEV guest snapshot and restore support
Changes since v8:
- move sev.c from accel/kvm to target/i386
- update query-sev-launch-measure to return error when measurement is not
available
- update flatview_read to use slow path when attrs.debug=1 is set
- fix the buffer overflow
- use '-' when adding new member in SevInfo QMP structure
Changes since v6:
- add support to specify cbitpos in sev-guest object
- add 'info sev' HMP command
- add 'query-sev' and 'query-launch-measure' QMP commands
- rework the logic to query the memory encryption mask when walking
guest pagetable for debug
Changes since v5:
- drop MEMTXTATTRS_DEBUG macro, caller now specify attrs.debug=1 when needed.
- drop DPRINTF and use trace points to output the debug messages
Changes since v4:
- extend sev-guest object to add new properties 'dh-cert-file', 'session-file'
etc.
- emit SEV_MEASUREMENT event when measurement is available
- add migration blocker
- add memory encryption cpuid support
- rebase the series with recent qemu tree
Changes since v3:
- update to newer SEV spec (0.12 -> 0.14)
- update to newer KVM RFC and use KVM_MEMORY_ENCRYPTION_OP ioctl instead
of KVM_ISSUE_SEV.
- add support to encrypt plfash
Changes since v2:
- rename ram_ops to ram_debug_ops
- use '-' rather than '_' when adding new member in KvmInfo struct
- update sev object to use link properties when referencing other objects
- use ldq_phys_debug in tlb_info_64 and mem_info_64.
- remove sev-guest-policy object, we will revisit it after basic SEV
guest support is merged.
- remove kernel API from doc and add SEV guest LAUNCH model. The doc will
be updated as we integerate the remaining SEV APIs.
Changes since v1:
- Added Documentation
- Added security-policy object.
- Drop sev config parsing support and create new objects to get/set SEV
specific parameters
- Added sev-guest-info object.
- Added sev-launch-info object.
- Added kvm_memory_encrytion_* APIs. The idea behind this was to allow adding
a non SEV memory encrytion object without modifying interfaces.
- Drop patch to load OS image at fixed location.
- updated LAUNCH_FINISH command structure. Now the structure contains
just 'measurement' field. Other fields are not used and will also be removed
from newer SEV firmware API spec.
Brijesh Singh (28):
memattrs: add debug attribute
exec: add ram_debug_ops support
exec: add debug version of physical memory read and write API
monitor/i386: use debug APIs when accessing guest memory
target/i386: add memory encryption feature cpuid support
machine: add -memory-encryption property
kvm: update kvm.h to include memory encryption ioctls
docs: add AMD Secure Encrypted Virtualization (SEV)
target/i386: add Secure Encrypted Virtulization (SEV) object
sev/i386: add command to initialize the memory encryption context
sev/i386: register the guest memory range which may contain encrypted
data
kvm: introduce memory encryption APIs
qmp: add query-sev command
hmp: add 'info sev' command
sev/i386: add command to create launch memory encryption context
sev/i386: add command to encrypt guest memory region
target/i386: encrypt bios rom
sev/i386: add support to LAUNCH_MEASURE command
sev/i386: finalize the SEV guest launch flow
hw/i386: set ram_debug_ops when memory encryption is enabled
sev/i386: add debug encrypt and decrypt commands
target/i386: clear C-bit when walking SEV guest page table
include: add psp-sev.h header file
sev/i386: add support to query PLATFORM_STATUS command
sev/i386: add support to KVM_SEV_GUEST_STATUS
qmp: add query-sev-launch-measure command
tests/qmp-test: blacklist query-sev-launch-measure command
sev/i386: add migration blocker
accel/kvm/kvm-all.c | 48 +++
accel/stubs/kvm-stub.c | 14 +
cpus.c | 2 +-
disas.c | 2 +-
docs/amd-memory-encryption.txt | 109 ++++++
exec.c | 83 ++++-
hmp-commands-info.hx | 14 +
hmp.c | 19 +
hmp.h | 1 +
hw/core/machine.c | 22 ++
hw/i386/pc.c | 9 +
hw/i386/pc_sysfw.c | 19 +
include/exec/cpu-common.h | 15 +
include/exec/memattrs.h | 2 +
include/exec/memory.h | 30 +-
include/hw/boards.h | 1 +
include/sysemu/kvm.h | 25 ++
include/sysemu/sev.h | 84 +++++
linux-headers/linux/kvm.h | 90 +++++
linux-headers/linux/psp-sev.h | 142 ++++++++
monitor.c | 6 +-
qapi-schema.json | 76 ++++
qemu-options.hx | 38 ++
qmp.c | 33 ++
stubs/Makefile.objs | 1 +
stubs/sev.c | 57 +++
target/i386/Makefile.objs | 2 +-
target/i386/cpu.c | 36 ++
target/i386/cpu.h | 3 +
target/i386/helper.c | 31 +-
target/i386/monitor.c | 129 ++++---
target/i386/sev.c | 795 +++++++++++++++++++++++++++++++++++++++++
target/i386/trace-events | 11 +
tests/qmp-test.c | 2 +
34 files changed, 1868 insertions(+), 83 deletions(-)
create mode 100644 docs/amd-memory-encryption.txt
create mode 100644 include/sysemu/sev.h
create mode 100644 linux-headers/linux/psp-sev.h
create mode 100644 stubs/sev.c
create mode 100644 target/i386/sev.c
--
2.14.3
- [Qemu-devel] [PATCH v8 00/28] x86: Secure Encrypted Virtualization (AMD),
Brijesh Singh <=
- [Qemu-devel] [PATCH v8 03/28] exec: add debug version of physical memory read and write API, Brijesh Singh, 2018/02/12
- [Qemu-devel] [PATCH v8 01/28] memattrs: add debug attribute, Brijesh Singh, 2018/02/12
- [Qemu-devel] [PATCH v8 02/28] exec: add ram_debug_ops support, Brijesh Singh, 2018/02/12
- [Qemu-devel] [PATCH v8 04/28] monitor/i386: use debug APIs when accessing guest memory, Brijesh Singh, 2018/02/12
- [Qemu-devel] [PATCH v8 05/28] target/i386: add memory encryption feature cpuid support, Brijesh Singh, 2018/02/12