All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v6 00/23] x86: Secure Encrypted Virtualization (AMD)
@ 2018-01-29 17:41 ` Brijesh Singh
  0 siblings, 0 replies; 118+ messages in thread
From: Brijesh Singh @ 2018-01-29 17:41 UTC (permalink / raw)
  To: qemu-devel
  Cc: kvm, Paolo Bonzini, Tom Lendacky, Peter Maydell,
	Richard Henderson, Edgar E. Iglesias, Dr. David Alan Gilbert,
	Eduardo Habkost, Stefan Hajnoczi, Eric Blake, Michael S. Tsirkin,
	Daniel P . Berrange, Brijesh Singh

This patch series provides support for AMD's new Secure Encrypted 
Virtualization (SEV) feature.

SEV is an extension to the AMD-V architecture which supports running
multiple VMs under the control of a hypervisor. The SEV feature allows
the memory contents of a virtual machine (VM) to be transparently encrypted
with a key unique to the guest VM. The memory controller contains a
high performance encryption engine which can be programmed with multiple
keys for use by a different VMs in the system. The programming and
management of these keys is handled by the AMD Secure Processor firmware
which exposes a commands for these tasks.

The KVM SEV patch series introduced a new ioctl (KVM_MEMORY_ENCRYPTION_OP)
which is used by qemu to issue the SEV commands to assist performing
common hypervisor activities such as a launching, running, snapshooting,
migration and debugging guests.

The following links provide additional details:

AMD Memory Encryption whitepaper:
 
http://amd-dev.wpengine.netdna-cdn.com/wordpress/media/2013/12/AMD_Memory_Encryption_Whitepaper_v7-Public.pdf

AMD64 Architecture Programmer's Manual:
http://support.amd.com/TechDocs/24593.pdf
SME is section 7.10
SEV is section 15.34

Secure Encrypted Virutualization Key Management:
http://support.amd.com/TechDocs/55766_SEV-KM API_Specification.pdf

KVM Forum slides:
http://www.linux-kvm.org/images/7/74/02x08A-Thomas_Lendacky-AMDs_Virtualizatoin_Memory_Encryption_Technology.pdf

Video of the KVM Forum Talk:
https://www.youtube.com/watch?v=RcvQ1xN55Ew

---

The complete patch series is available :
https://github.com/codomania/qemu/tree/v6

Using these patches we have succesfully booted and tested a guest both with and
without SEV enabled.

TODO:

* Add SEV guest migration support
* Add SEV guest snapshot and restore support

Changes since v5:
- drop MEMTXTATTRS_DEBUG macro, caller now specify attrs.debug=1 when needed.
- drop DPRINTF and use trace points to output the debug messages

Changes since v4:
- extend sev-guest object to add new properties 'dh-cert-file', 'session-file' etc.
- emit SEV_MEASUREMENT event when measurement is available
- add migration blocker
- add memory encryption cpuid support
- rebase the series with recent qemu tree

Changes since v3:
- update to newer SEV spec (0.12 -> 0.14)
- update to newer KVM RFC and use KVM_MEMORY_ENCRYPTION_OP ioctl instead
of KVM_ISSUE_SEV.
- add support to encrypt plfash

Changes since v2:
- rename ram_ops to ram_debug_ops
- use '-' rather than '_' when adding new member in KvmInfo struct
- update sev object to use link properties when referencing other objects
- use ldq_phys_debug in tlb_info_64 and mem_info_64.
- remove sev-guest-policy object, we will revisit it after basic SEV
guest support is merged.
- remove kernel API from doc and add SEV guest LAUNCH model. The doc will
be updated as we integerate the remaining SEV APIs.

Changes since v1:
- Added Documentation
- Added security-policy object.
- Drop sev config parsing support and create new objects to get/set SEV
specific parameters
- Added sev-guest-info object.
- Added sev-launch-info object.
- Added kvm_memory_encrytion_* APIs. The idea behind this was to allow adding
a non SEV memory encrytion object without modifying interfaces.
- Drop patch to load OS image at fixed location.
- updated LAUNCH_FINISH command structure. Now the structure contains
just 'measurement' field. Other fields are not used and will also be removed
from newer SEV firmware API spec.

Brijesh Singh (23):
  memattrs: add debug attribute
  exec: add ram_debug_ops support
  exec: add debug version of physical memory read and write API
  monitor/i386: use debug APIs when accessing guest memory
  target/i386: add memory encryption feature cpuid support
  machine: add -memory-encryption property
  kvm: update kvm.h to include memory encryption ioctls
  docs: add AMD Secure Encrypted Virtualization (SEV)
  accel: add Secure Encrypted Virtulization (SEV) object
  sev: add command to initialize the memory encryption context
  sev: register the guest memory range which may contain encrypted data
  kvm: introduce memory encryption APIs
  hmp: display memory encryption support in 'info kvm'
  sev: add command to create launch memory encryption context
  sev: add command to encrypt guest memory region
  target/i386: encrypt bios rom
  qapi: add SEV_MEASUREMENT event
  sev: emit the SEV_MEASUREMENT event
  sev: Finalize the SEV guest launch flow
  hw: i386: set ram_debug_ops when memory encryption is enabled
  sev: add debug encrypt and decrypt commands
  target/i386: clear C-bit when walking SEV guest page table
  sev: add migration blocker

 accel/kvm/Makefile.objs        |   2 +-
 accel/kvm/kvm-all.c            |  48 +++
 accel/kvm/sev.c                | 661 +++++++++++++++++++++++++++++++++++++++++
 accel/kvm/trace-events         |  10 +
 accel/stubs/kvm-stub.c         |  14 +
 cpus.c                         |   2 +-
 disas.c                        |   2 +-
 docs/amd-memory-encryption.txt | 109 +++++++
 exec.c                         | 107 ++++++-
 hmp.c                          |   2 +
 hw/core/machine.c              |  22 ++
 hw/i386/pc.c                   |   9 +
 hw/i386/pc_sysfw.c             |  19 ++
 include/exec/cpu-common.h      |  15 +
 include/exec/memattrs.h        |   2 +
 include/exec/memory.h          |  27 ++
 include/hw/boards.h            |   1 +
 include/sysemu/kvm.h           |  25 ++
 include/sysemu/sev.h           |  76 +++++
 linux-headers/linux/kvm.h      |  90 ++++++
 monitor.c                      |   8 +-
 qapi-schema.json               |  18 +-
 qemu-options.hx                |  36 +++
 qmp.c                          |   1 +
 target/i386/cpu.c              |  36 +++
 target/i386/cpu.h              |   6 +
 target/i386/helper.c           |  46 ++-
 target/i386/monitor.c          | 145 +++++----
 28 files changed, 1450 insertions(+), 89 deletions(-)
 create mode 100644 accel/kvm/sev.c
 create mode 100644 docs/amd-memory-encryption.txt
 create mode 100644 include/sysemu/sev.h

-- 
2.9.5

^ permalink raw reply	[flat|nested] 118+ messages in thread

end of thread, other threads:[~2018-02-08 16:22 UTC | newest]

Thread overview: 118+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-01-29 17:41 [PATCH v6 00/23] x86: Secure Encrypted Virtualization (AMD) Brijesh Singh
2018-01-29 17:41 ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 01/23] memattrs: add debug attribute Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-30 21:59   ` Edgar E. Iglesias
2018-01-30 21:59     ` [Qemu-devel] " Edgar E. Iglesias
2018-01-29 17:41 ` [PATCH v6 02/23] exec: add ram_debug_ops support Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-30 21:59   ` Edgar E. Iglesias
2018-01-30 21:59     ` [Qemu-devel] " Edgar E. Iglesias
2018-01-30 22:34     ` Brijesh Singh
2018-01-30 22:34       ` [Qemu-devel] " Brijesh Singh
2018-01-30 22:37       ` Edgar E. Iglesias
2018-01-30 22:37         ` [Qemu-devel] " Edgar E. Iglesias
2018-01-30 23:26         ` Brijesh Singh
2018-01-30 23:26           ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 03/23] exec: add debug version of physical memory read and write API Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 04/23] monitor/i386: use debug APIs when accessing guest memory Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 05/23] target/i386: add memory encryption feature cpuid support Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-30 17:49   ` Dr. David Alan Gilbert
2018-01-30 17:49     ` [Qemu-devel] " Dr. David Alan Gilbert
2018-01-30 21:46     ` Brijesh Singh
2018-01-30 21:46       ` [Qemu-devel] " Brijesh Singh
2018-01-30 22:15       ` Brijesh Singh
2018-01-30 22:15         ` [Qemu-devel] " Brijesh Singh
2018-01-31  9:57       ` Dr. David Alan Gilbert
2018-01-31  9:57         ` [Qemu-devel] " Dr. David Alan Gilbert
2018-01-31 13:41       ` Eduardo Habkost
2018-01-31 13:41         ` [Qemu-devel] " Eduardo Habkost
2018-01-31 16:05         ` Brijesh Singh
2018-01-31 16:05           ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 06/23] machine: add -memory-encryption property Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 07/23] kvm: update kvm.h to include memory encryption ioctls Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 08/23] docs: add AMD Secure Encrypted Virtualization (SEV) Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 09/23] accel: add Secure Encrypted Virtulization (SEV) object Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 10/23] sev: add command to initialize the memory encryption context Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-02-01 12:13   ` Dr. David Alan Gilbert
2018-02-01 12:13     ` [Qemu-devel] " Dr. David Alan Gilbert
2018-02-01 15:33     ` Brijesh Singh
2018-02-01 15:33       ` [Qemu-devel] " Brijesh Singh
2018-02-01 15:46       ` Dr. David Alan Gilbert
2018-02-01 15:46         ` [Qemu-devel] " Dr. David Alan Gilbert
2018-01-29 17:41 ` [PATCH v6 11/23] sev: register the guest memory range which may contain encrypted data Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 12/23] kvm: introduce memory encryption APIs Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 13/23] hmp: display memory encryption support in 'info kvm' Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-31 17:43   ` Markus Armbruster
2018-02-01 15:21     ` Brijesh Singh
2018-02-01 17:58   ` Dr. David Alan Gilbert
2018-02-01 17:58     ` [Qemu-devel] " Dr. David Alan Gilbert
2018-02-01 19:55     ` Brijesh Singh
2018-02-01 19:55       ` [Qemu-devel] " Brijesh Singh
2018-02-01 20:04       ` Dr. David Alan Gilbert
2018-02-01 20:04         ` [Qemu-devel] " Dr. David Alan Gilbert
2018-02-02 13:08         ` Daniel P. Berrangé
2018-02-02 13:08           ` [Qemu-devel] " Daniel P. Berrangé
2018-02-02 13:46           ` Brijesh Singh
2018-02-02 13:46             ` [Qemu-devel] " Brijesh Singh
2018-02-02 15:24             ` Dr. David Alan Gilbert
2018-02-02 15:24               ` [Qemu-devel] " Dr. David Alan Gilbert
2018-01-29 17:41 ` [PATCH v6 14/23] sev: add command to create launch memory encryption context Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 15/23] sev: add command to encrypt guest memory region Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 16/23] target/i386: encrypt bios rom Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 17/23] qapi: add SEV_MEASUREMENT event Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-31 17:45   ` Markus Armbruster
2018-02-01 15:25     ` Brijesh Singh
2018-02-01 15:28       ` Eric Blake
2018-02-01 15:28         ` Eric Blake
2018-01-29 17:41 ` [PATCH v6 18/23] sev: emit the " Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-30 20:08   ` Dr. David Alan Gilbert
2018-01-30 20:08     ` [Qemu-devel] " Dr. David Alan Gilbert
2018-01-30 22:13     ` Brijesh Singh
2018-01-30 22:13       ` [Qemu-devel] " Brijesh Singh
2018-02-01 17:27       ` Dr. David Alan Gilbert
2018-02-01 17:27         ` [Qemu-devel] " Dr. David Alan Gilbert
2018-02-02 15:11         ` Brijesh Singh
2018-02-02 15:11           ` [Qemu-devel] " Brijesh Singh
2018-02-02 15:16           ` Daniel P. Berrangé
2018-02-02 15:16             ` [Qemu-devel] " Daniel P. Berrangé
2018-02-08 16:17             ` Brijesh Singh
2018-02-08 16:17               ` [Qemu-devel] " Brijesh Singh
2018-02-08 16:22               ` Daniel P. Berrangé
2018-01-29 17:41 ` [PATCH v6 19/23] sev: Finalize the SEV guest launch flow Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 20/23] hw: i386: set ram_debug_ops when memory encryption is enabled Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 21/23] sev: add debug encrypt and decrypt commands Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 22/23] target/i386: clear C-bit when walking SEV guest page table Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 17:41 ` [PATCH v6 23/23] sev: add migration blocker Brijesh Singh
2018-01-29 17:41   ` [Qemu-devel] " Brijesh Singh
2018-01-29 18:13 ` [Qemu-devel] [PATCH v6 00/23] x86: Secure Encrypted Virtualization (AMD) no-reply
2018-01-29 18:13   ` no-reply
2018-01-29 18:17 ` no-reply
2018-01-29 18:17   ` [Qemu-devel] " no-reply
2018-01-29 18:19 ` no-reply
2018-01-29 18:19   ` no-reply
2018-01-29 18:31 ` no-reply
2018-01-29 18:31   ` [Qemu-devel] " no-reply
2018-02-06 15:51 ` Bruce Rogers
2018-02-06 15:51   ` Bruce Rogers
2018-02-07  1:07   ` Brijesh Singh

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.