From: Brijesh Singh <brijesh.singh@amd.com>
To: Dov Murik <dovmurik@linux.ibm.com>,
Michael Roth <michael.roth@amd.com>,
qemu-devel@nongnu.org
Cc: "Connor Kuehl" <ckuehl@redhat.com>,
"Philippe Mathieu-Daudé" <philmd@redhat.com>,
"Michael S . Tsirkin" <mst@redhat.com>,
"James Bottomley" <jejb@linux.ibm.com>,
"Dr . David Alan Gilbert" <dgilbert@redhat.com>,
"Tom Lendacky" <thomas.lendacky@amd.com>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"David Gibson" <david@gibson.dropbear.id.au>,
"Daniel P . Berrangé" <berrange@redhat.com>,
kvm@vger.kernel.org, "Eduardo Habkost" <ehabkost@redhat.com>,
"Markus Armbruster" <armbru@redhat.com>,
"Eric Blake" <eblake@redhat.com>
Subject: Re: [RFC PATCH v2 04/12] i386/sev: initialize SNP context
Date: Sun, 5 Sep 2021 08:58:38 -0500 [thread overview]
Message-ID: <c930872e-8c13-55af-f431-1c99dd277f12@amd.com> (raw)
In-Reply-To: <48bcd5d9-c5da-1ae3-4943-4c3bd9a91c7b@linux.ibm.com>
Hi Dov,
On 9/5/21 2:07 AM, Dov Murik wrote:
...
>
>>
>> uint64_t
>> @@ -1074,6 +1083,7 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
>> uint32_t ebx;
>> uint32_t host_cbitpos;
>> struct sev_user_data_status status = {};
>> + void *init_args = NULL;
>>
>> if (!sev_common) {
>> return 0;
>> @@ -1126,7 +1136,18 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
>> sev_common->api_major = status.api_major;
>> sev_common->api_minor = status.api_minor;
> Not visible here in the context: the code here is using the
> SEV_PLATFORM_STATUS command to get the build_id, api_major, and api_minor.
>
> I see that SNP has a new command SNP_PLATFORM_STATUS, which fills a
> struct sev_data_snp_platform_status (hmmm, I can't find the struct's
> definition; I assume it should look like Table 38 in 8.3.2 in SNP FW ABI
> document).
The API version can be queries either through the SNP_PLATFORM_STATUS or
SEV_PLATFORM_STATUS and they both report the same info. As the
definition of the sev_data_platform_status is concerned it should be
defined in the kernel include/linux/psp-sev.h.
> My questions are:
>
> 1. Is it OK to call the "legacy" SEV_PLATFORM_STATUS when about to init
> an SNP guest?
Yes, the legacy platform status command can be called on the SNP
initialized host.
I choose not to new command because we only care about the verison
string and that is available through either of these commands (SNP or
SEV platform status).
> 2. Do we want to save some info like installed TCB version and reported
> TCB version, and maybe other fields from SNP platform status?
If we decide to add a new QMP (query-sev-snp) then it makes sense to
export those fields so that a hypervisor console can give additional
information; But note that for the guest, all these are available in the
attestation report.
> 3. Should we check the state field in the platform status?
>
>
Good point, we could use the SNP platform status. I don't expect the
state to be different between the SNP platform_status and SEV
platform_status.
>>
>> - if (sev_es_enabled()) {
>> + if (sev_snp_enabled()) {
>> + SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(sev_common);
>> + if (!kvm_kernel_irqchip_allowed()) {
>> + error_report("%s: SEV-SNP guests require in-kernel irqchip support",
>> + __func__);
> Most errors in this function use error_setg(errp, ...). This should follow.
>
>
>> + goto err;
>> + }
>> +
>> + cmd = KVM_SEV_SNP_INIT;
>> + init_args = (void *)&sev_snp_guest->kvm_init_conf;
>> +
>> + } else if (sev_es_enabled()) {
>> if (!kvm_kernel_irqchip_allowed()) {
>> error_report("%s: SEV-ES guests require in-kernel irqchip support",
>> __func__);
> Not part of this patch, but this error_report (and another one in the
> SEV-ES case) should be converted to error_setg similarly. Maybe add a
> separate patch for fixing this for SEV-ES.
>
>
>
>> @@ -1145,7 +1166,7 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
>> }
>>
>> trace_kvm_sev_init();
> Suggestions:
>
> 1. log the guest type (SEV / SEV-ES / SEV-SNP)
> 2. log the SNP init flags value when initializing an SNP guest
Noted.
thanks
next prev parent reply other threads:[~2021-09-05 13:58 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-26 22:26 [RFC PATCH v2 00/12] Add AMD Secure Nested Paging (SEV-SNP) support Michael Roth
2021-08-26 22:26 ` [RFC PATCH v2 01/12] i386/sev: introduce "sev-common" type to encapsulate common SEV state Michael Roth
[not found] ` <87pmtsqt02.fsf@dusky.pond.sub.org>
2021-09-03 15:11 ` Michael Roth
2021-08-26 22:26 ` [RFC PATCH v2 02/12] linux-header: add the SNP specific command Michael Roth
2021-09-03 20:36 ` Dov Murik
2021-09-07 14:27 ` Michael Roth
2021-08-26 22:26 ` [RFC PATCH v2 03/12] i386/sev: introduce 'sev-snp-guest' object Michael Roth
[not found] ` <87bl5cqsi8.fsf@dusky.pond.sub.org>
2021-09-03 15:15 ` Michael Roth
2021-09-03 21:12 ` Dov Murik
2021-09-07 14:20 ` Michael Roth
2021-08-26 22:26 ` [RFC PATCH v2 04/12] i386/sev: initialize SNP context Michael Roth
2021-09-05 7:07 ` Dov Murik
2021-09-05 13:58 ` Brijesh Singh [this message]
2021-09-05 17:09 ` Dov Murik
2021-09-05 9:19 ` Dov Murik
2021-09-05 14:05 ` Brijesh Singh
2021-09-05 17:03 ` Dov Murik
2021-08-26 22:26 ` [RFC PATCH v2 05/12] i386/sev: add the SNP launch start context Michael Roth
2021-08-26 22:26 ` [RFC PATCH v2 06/12] i386/sev: add support to encrypt BIOS when SEV-SNP is enabled Michael Roth
2021-08-26 22:26 ` [RFC PATCH v2 07/12] i386/sev: populate secrets and cpuid page and finalize the SNP launch Michael Roth
2021-09-03 20:24 ` Dov Murik
2021-09-07 16:18 ` Michael Roth
2021-08-26 22:26 ` [RFC PATCH v2 08/12] target/i386: set SEV-SNP CPUID bit when SNP enabled Michael Roth
2021-08-26 22:26 ` [RFC PATCH v2 09/12] target/i386: allow versioned CPUs to specify new cache_info Michael Roth
2021-08-26 22:26 ` [RFC PATCH v2 10/12] target/i386: add new EPYC CPU versions with updated cache_info Michael Roth
2021-08-26 22:26 ` [RFC PATCH v2 11/12] i386/sev: sev-snp: add support for CPUID validation Michael Roth
2021-09-05 10:02 ` Dov Murik
2021-09-07 16:50 ` Michael Roth
2021-09-07 17:44 ` Dov Murik
2021-08-26 22:26 ` [RFC PATCH v2 12/12] i386/sev: update query-sev QAPI format to handle SEV-SNP Michael Roth
2021-09-03 15:27 ` Daniel P. Berrangé
[not found] ` <87tuj4qt71.fsf@dusky.pond.sub.org>
2021-09-03 15:13 ` Michael Roth
2021-09-03 15:30 ` Daniel P. Berrangé
2021-09-03 15:43 ` Michael Roth
2021-09-03 15:58 ` Daniel P. Berrangé
2021-09-03 16:01 ` Daniel P. Berrangé
2021-09-07 11:52 ` Dr. David Alan Gilbert
2021-09-07 14:33 ` Michael Roth
2021-11-16 9:23 ` [RFC PATCH v2 00/12] Add AMD Secure Nested Paging (SEV-SNP) support Daniel P. Berrangé
2021-11-16 11:54 ` Brijesh Singh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c930872e-8c13-55af-f431-1c99dd277f12@amd.com \
--to=brijesh.singh@amd.com \
--cc=armbru@redhat.com \
--cc=berrange@redhat.com \
--cc=ckuehl@redhat.com \
--cc=david@gibson.dropbear.id.au \
--cc=dgilbert@redhat.com \
--cc=dovmurik@linux.ibm.com \
--cc=eblake@redhat.com \
--cc=ehabkost@redhat.com \
--cc=jejb@linux.ibm.com \
--cc=kvm@vger.kernel.org \
--cc=michael.roth@amd.com \
--cc=mst@redhat.com \
--cc=pbonzini@redhat.com \
--cc=philmd@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=thomas.lendacky@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).