Re: [PATCH Part2 v6 28/49] KVM: SVM: Add KVM_SEV_SNP_LAUNCH_FINISH command

[Tom Lendacky]

On 7/12/22 09:45, Peter Gonda wrote:
> On Mon, Jul 11, 2022 at 4:41 PM Kalra, Ashish <Ashish.Kalra@xxxxxxx> wrote:
> > [AMD Official Use Only - General]
> >
> > Hello Peter,
> >
> > > > The KVM_SEV_SNP_LAUNCH_FINISH finalize the cryptographic digest and
> > > > stores it as the measurement of the guest at launch.
> > > >
> > > > While finalizing the launch flow, it also issues the LAUNCH_UPDATE
> > > > command to encrypt the VMSA pages.
> >
> > > Given the guest uses the SNP NAE AP boot protocol we were expecting that there would be some option to add vCPUs to the VM but mark them as "pending AP boot creation protocol" state. This would allow the LaunchDigest of a VM doesn't change >just because its vCPU count changes. Would it be possible to add a new add an argument to KVM_SNP_LAUNCH_FINISH to tell it which vCPUs to LAUNCH_UPDATE VMSA pages for or similarly a new argument for KVM_CREATE_VCPU?
> >
> > But don't we want/need to measure all vCPUs using LAUNCH_UPDATE_VMSA before we issue SNP_LAUNCH_FINISH command ?
> >
> > If we are going to add vCPUs and mark them as "pending AP boot creation" state then how are we going to do LAUNCH_UPDATE_VMSAs for them after SNP_LAUNCH_FINISH ?
>
> If I understand correctly we don't need or even want the APs to be
> LAUNCH_UPDATE_VMSA'd. LAUNCH_UPDATEing all the VMSAs causes VMs with
> different numbers of vCPUs to have different launch digests. Its my
> understanding the SNP AP Creation protocol was to solve this so that
> VMs with different vcpu counts have the same launch digest.
>
> Looking at patch "[Part2,v6,44/49] KVM: SVM: Support SEV-SNP AP
> Creation NAE event" and section "4.1.9 SNP AP Creation" of the GHCB
> spec. There is no need to mark the LAUNCH_UPDATE the AP's VMSA or mark
> the vCPUs runnable. Instead we can do that only for the BSP. Then in
> the guest UEFI the BSP can: create new VMSAs from guest pages,
> RMPADJUST them into the RMP state VMSA, then use the SNP AP Creation
> NAE to get the hypervisor to mark them runnable. I believe this is all
> setup in the UEFI patch:
> https://www.mail-archive.com/devel@xxxxxxxxxxxxxx/msg38460.html.

Not quite...  there isn't a way to (easily) retrieve the APIC IDs for all 
of the vCPUs, which are required in order to use the AP Create event.

For this version of SNP, all of the vCPUs are measured and started by OVMF 
in the same way as SEV-ES. However, once the vCPUs have run, we now have 
the APIC ID associated with each vCPU and the AP Create event can be used 
going forward.

The SVSM support will introduce a new NAE event to the GHCB spec to 
retrieve all of the APIC IDs from the hypervisor. With that, then you 
would be able be required to perform a LAUNCH_UPDATE_VMSA against the BSP.

Thanks,
Tom