Re: [PATCH 3/6] qemu: check if AMD secure guest support is enabled

On 5/11/20 9:40 PM, Brijesh Singh wrote: > Thanks for the patch Paulo, Few comments. > > On 5/11/20 11:41 AM, Boris Fiuczynski wrote: > > From: Paulo de Rezende Pinatti <ppinatti(a)linux.ibm.com&gt; > > > > Implement secure guest check for AMD SEV (Secure Encrypted > > Virtualization) in order to invalidate the qemu capabilities > > cache in case the availability of the feature changed. > > > > For AMD SEV the verification consists of: > > - checking if /sys/module/kvm_amd/parameters/sev contains the > > value '1': meaning SEV is enabled in the host kernel; > > - checking if the kernel cmdline contains 'mem_encrypt=on': meaning > > SME memory encryption feature on the host is enabled > > > In addition to the kernel module parameter, we probably also need to > check whether QEMU supports the feature. e.g, what if user has newer > kernel but older qemu. e.g kernel > 4.18 but Qemu < 2.12.  To check the > SEV feature support, we should verify the following conditions: > > 1) check kernel module parameter is set Paulo implemented the checks following the documentation in docs/kbase/launch_security_sev.rst. The check for the module parameter sev is included. Is the check for the kernel cmdline parameter "mem_encrypt" not necessary? Or would that be covered by your suggested check in 2)?

> > 2) check if /dev/sev device exist (aka firmware is detected) This seems reasonable. Shouldn't it have been documented in docs/kbase/launch_security_sev.rst?

> > 3) Check if Qemu supports SEV feature (maybe we can detect the existence > of the query-sev QMP command or detect Qemu version >= 2.12)

The idea is to check the host capabilities to detect if qemus capabilities need to be reprobed. Therefore this would be a result if checks 1+2 change but it would not be a cache invalidation trigger.