lkml.org 
[lkml]   [2023]   [Mar]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[PATCH v2 00/11] Add Secure TSC support for SNP guests
    Date
    Secure TSC allows guest to securely use RDTSC/RDTSCP instructions as the
    parameters being used cannot be changed by hypervisor once the guest is
    launched. More details in the AMD64 APM Vol 2, Section "Secure TSC".

    During the boot-up of the secondary cpus, SecureTSC enabled guests need to
    query TSC info from Security processor (PSP). This communication channel is
    encrypted between the security processor and the guest, hypervisor is just
    the conduit to deliver the guest messages to the security processor. Each
    message is protected with an AEAD (AES-256 GCM). See "SEV Secure Nested
    Paging Firmware ABI Specification" document (currently at
    https://www.amd.com/system/files/TechDocs/56860.pdf) section "TSC Info"

    Use minimal GCM library to encrypt/decrypt SNP Guest messages to
    communicate with the PSP which is available at earlyboot.

    SEV-guest driver has the implementation for guest and security coprocessor
    communication. As the TSC_INFO needs to be initialized during early boot
    before smp cpus are started, move most of the sev-guest driver code as part
    to kernel/sev.c and provide well defined APIs to the sev-guest driver to
    use the interface to avoid code-duplication.

    Patches:
    01-05: Preparation and movement of sev-guest driver code
    06: Adds generic guest initialization hook
    07-11: SecureTSC enablement patches.

    Testing SecureTSC
    -----------------

    SecureTSC hypervisor patches based on top of SEV-SNP UPM series:
    https://github.com/nikunjad/linux/tree/upmv10-snpv8_securetsc

    QEMU changes:
    https://github.com/nikunjad/qemu/tree/upmv10b-snpv3-wip-securetsc

    QEMU commandline SEV-SNP-UPM with SecureTSC:

    qemu-system-x86_64 -cpu EPYC-Milan-v2 \
    -object memory-backend-memfd-private,id=ram1,size=1G,share=true \
    -object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1,secure-tsc=on \
    -machine q35,confidential-guest-support=sev0,memory-backend=ram1,kvm-type=protected \
    ...

    Changelog:
    ----------
    v2:
    * Rebased on top of v6.3-rc3 that has Boris's sev-guest cleanup series
    https://lore.kernel.org/r/20230307192449.24732-1-bp@alien8.de/

    v1: https://lore.kernel.org/r/20230130120327.977460-1-nikunj@amd.com/

    Nikunj A Dadhania (11):
    virt: sev-guest: Use AES GCM crypto library
    virt: sev-guest: Move mutex to SNP guest device structure
    virt: sev-guest: Add snp_guest_req structure
    virt: sev-guest: Add simplified helper to assign vmpck
    x86/sev: Move and reorganize sev guest request api
    x86/mm: Add generic guest initialization hook
    x86/sev: Change TSC MSR behavior for Secure TSC enabled guests
    x86/sev: Add Secure TSC support for SNP guests
    x86/kvmclock: Use Secure TSC as clock if available
    x86/tsc: Mark Secure TSC as reliable clocksource
    x86/sev: Enable Secure TSC for SNP guests

    arch/x86/Kconfig | 1 +
    arch/x86/boot/compressed/sev.c | 2 +-
    arch/x86/coco/core.c | 3 +
    .../x86/include/asm}/sev-guest.h | 46 ++
    arch/x86/include/asm/sev.h | 24 +
    arch/x86/include/asm/svm.h | 6 +-
    arch/x86/include/asm/x86_init.h | 2 +
    arch/x86/kernel/kvmclock.c | 2 +-
    arch/x86/kernel/sev-shared.c | 7 +
    arch/x86/kernel/sev.c | 541 +++++++++++++++-
    arch/x86/kernel/tsc.c | 2 +-
    arch/x86/kernel/x86_init.c | 2 +
    arch/x86/mm/mem_encrypt.c | 13 +-
    arch/x86/mm/mem_encrypt_amd.c | 6 +
    drivers/virt/coco/sev-guest/Kconfig | 2 -
    drivers/virt/coco/sev-guest/sev-guest.c | 592 ++----------------
    include/linux/cc_platform.h | 8 +
    17 files changed, 708 insertions(+), 551 deletions(-)
    rename {drivers/virt/coco/sev-guest => arch/x86/include/asm}/sev-guest.h (54%)


    base-commit: e8d018dd0257f744ca50a729e3d042cf2ec9da65
    --
    2.34.1

    \
     
     \ /
      Last update: 2023-03-27 01:17    [W:2.755 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site