From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751742AbdJDKMB (ORCPT ); Wed, 4 Oct 2017 06:12:01 -0400 Received: from mx2.suse.de ([195.135.220.15]:55447 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751639AbdJDKL7 (ORCPT ); Wed, 4 Oct 2017 06:11:59 -0400 Date: Wed, 4 Oct 2017 12:11:40 +0200 From: Borislav Petkov To: Brijesh Singh Cc: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Paolo Bonzini , Radim =?utf-8?B?S3LEjW3DocWZ?= , Jonathan Corbet , Tom Lendacky , x86@kernel.org Subject: [PATCH v5] Documentation/virtual/kvm: Add AMD Secure Encrypted Virtualization (SEV) Message-ID: <20171004101140.u5vh5yryr5m76pb7@pd.tnic> References: <20170919204627.3875-1-brijesh.singh@amd.com> <20170919204627.3875-2-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20170919204627.3875-2-brijesh.singh@amd.com> User-Agent: NeoMutt/20170113 (1.7.2) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Pasting v5 here. > From: Brijesh Singh > > Create a Documentation entry to describe the AMD Secure Encrypted > Virtualization (SEV) feature. > > Cc: Thomas Gleixner > Cc: Ingo Molnar > Cc: "H. Peter Anvin" > Cc: Paolo Bonzini > Cc: "Radim Krčmář" > Cc: Jonathan Corbet > Cc: Borislav Petkov > Cc: Tom Lendacky > Cc: kvm@vger.kernel.org > Cc: x86@kernel.org > Cc: linux-kernel@vger.kernel.org > Signed-off-by: Brijesh Singh > --- > Documentation/virtual/kvm/00-INDEX | 3 ++ > .../virtual/kvm/amd-memory-encryption.txt | 38 ++++++++++++++++++++++ > 2 files changed, 41 insertions(+) > create mode 100644 Documentation/virtual/kvm/amd-memory-encryption.txt Nice and sweet. Reviewed-by: Borislav Petkov (Leaving in the rest for reference). > diff --git a/Documentation/virtual/kvm/00-INDEX b/Documentation/virtual/kvm/00-INDEX > index 69fe1a8b7ad1..3da73aabff5a 100644 > --- a/Documentation/virtual/kvm/00-INDEX > +++ b/Documentation/virtual/kvm/00-INDEX > @@ -26,3 +26,6 @@ s390-diag.txt > - Diagnose hypercall description (for IBM S/390) > timekeeping.txt > - timekeeping virtualization for x86-based architectures. > +amd-memory-encryption.txt > + - notes on AMD Secure Encrypted Virtualization feature and SEV firmware > + command description > diff --git a/Documentation/virtual/kvm/amd-memory-encryption.txt b/Documentation/virtual/kvm/amd-memory-encryption.txt > new file mode 100644 > index 000000000000..26472b4cdbaf > --- /dev/null > +++ b/Documentation/virtual/kvm/amd-memory-encryption.txt > @@ -0,0 +1,38 @@ > +Secure Encrypted Virtualization (SEV) is a feature found on AMD processors. > + > +SEV is an extension to the AMD-V architecture which supports running > +virtual machines (VMs) under the control of a hypervisor. When enabled, > +the memory contents of a VM will be transparently encrypted with a key > +unique to that VM. > + > +The hypervisor can determine the SEV support through the CPUID > +instruction. The CPUID function 0x8000001f reports information related > +to SEV: > + > + 0x8000001f[eax]: > + Bit[1] indicates support for SEV > + ... > + [ecx]: > + Bits[31:0] Number of encrypted guests supported simultaneously > + > +If support for SEV is present, MSR 0xc001_0010 (MSR_K8_SYSCFG) and MSR 0xc001_0015 > +(MSR_K7_HWCR) can be used to determine if it can be enabled: > + > + 0xc001_0010: > + Bit[23] 1 = memory encryption can be enabled > + 0 = memory encryption can not be enabled > + > + 0xc001_0015: > + Bit[0] 1 = memory encryption can be enabled > + 0 = memory encryption can not be enabled > + > +When SEV support is available, it can be enabled in a specific VM by > +setting the SEV bit before executing VMRUN. > + > + VMCB[0x90]: > + Bit[1] 1 = SEV is enabled > + 0 = SEV is disabled > + > +SEV hardware uses ASIDs to associate a memory encryption key with a VM. > +Hence, the ASID for the SEV-enabled guests must be from 1 to a maximum value > +defined in the CPUID 0x8000001f[ecx] field. > -- > 2.13.0 SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) --