[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[RFC PATCH v2 00/12] Add AMD Secure Nested Paging (SEV-SNP) support

From: Michael Roth
Subject: [RFC PATCH v2 00/12] Add AMD Secure Nested Paging (SEV-SNP) support
Date: Thu, 26 Aug 2021 17:26:15 -0500

These patches implement SEV-SNP along with CPUID enforcement support for QEMU,
and are also available at:


They are based on the initial RFC submitted by Brijesh:


Changes since RFC v1:

 - rebased onto latest master
 - drop SNP config file in favor of a new 'sev-snp-guest' object where all
   SNP-related params are passed as strings/integers via command-line
 - report specific error if BIOS reports invalid address/len for
   reserved/pre-validated regions (Connor)
 - use Range helpers for handling validated region overlaps (Dave)
 - simplify error handling in sev_snp_launch_start, and report the correct
   return code when handling LAUNCH_START failures (Dov)
 - add SEV-SNP bit to CPUID 0x8000001f when SNP enabled
 - updated query-sev to handle differences between SEV and SEV-SNP
 - updated to work against v5 of SEV-SNP host kernel / hypervisor patches


SEV-SNP builds upon existing SEV and SEV-ES functionality while adding
new hardware-based memory protections. SEV-SNP adds strong memory integrity
protection to help prevent malicious hypervisor-based attacks like data
replay, memory re-mapping and more in order to create an isolated memory
encryption environment.

This series depends on the following patches to support SEV-SNP in Linux
kernel and OVMF:

  guest kernel (v5, part 1):
  host kernel (v5, part 2):
  OVMF (v5):

The Qemu patches uses the command id added by the SEV-SNP hypervisor
patches to bootstrap the SEV-SNP VMs.

Additional resources
SEV-SNP whitepaper

APM 2: https://www.amd.com/system/files/TechDocs/24593.pdf (section 15.36)

GHCB spec:

SEV-SNP firmware specification:

Brijesh Singh (6):
      linux-header: add the SNP specific command
      i386/sev: introduce 'sev-snp-guest' object
      i386/sev: initialize SNP context
      i386/sev: add the SNP launch start context
      i386/sev: add support to encrypt BIOS when SEV-SNP is enabled
      i386/sev: populate secrets and cpuid page and finalize the SNP launch

Michael Roth (6):
      i386/sev: introduce "sev-common" type to encapsulate common SEV state
      target/i386: set SEV-SNP CPUID bit when SNP enabled
      target/i386: allow versioned CPUs to specify new cache_info
      target/i386: add new EPYC CPU versions with updated cache_info
      i386/sev: sev-snp: add support for CPUID validation
      i386/sev: update query-sev QAPI format to handle SEV-SNP

 docs/amd-memory-encryption.txt |  77 +++-
 hw/i386/pc_sysfw.c             |   7 +-
 include/sysemu/sev.h           |   2 +-
 linux-headers/linux/kvm.h      |  50 +++
 qapi/misc-target.json          |  71 ++-
 qapi/qom.json                  |  94 +++-
 target/i386/cpu.c              | 221 ++++++++-
 target/i386/monitor.c          |  29 +-
 target/i386/sev-stub.c         |   8 +-
 target/i386/sev.c              | 989 +++++++++++++++++++++++++++++++++++------
 target/i386/sev_i386.h         |   4 +
 target/i386/trace-events       |   4 +
 12 files changed, 1374 insertions(+), 182 deletions(-)

reply via email to

[Prev in Thread] Current Thread [Next in Thread]