SNP bit checks on the host and ubuntu guest from instruction set by LakshmiSaiHarika · Pull Request #12 · amd/sev-utils

LakshmiSaiHarika · 2024-06-26T00:11:24Z

Added CPU check on the host for all host SEV features from cpuid 0x8000001f
Added host SNP enablement check in BIOS from MSR 0xC0010010 bit 23 & 24
Added additional check on the guest to see if guest security bits are active from MSR 0xc0010131 (MSR_AMD64_SEV)

I validated all the added checks in this PR as follows:

Tested CPU support check for SNP on Rome, milan to check the CPU support check which works fine
Tested SNP enablement check in Bios which shows correct error message when SME/SNP are disabled in BIOS
Tested guest SEV/SEV-ES/SNP bit status on SNP guest and normal guest(w/o SNP enabled)

larrydewey

Will you please run these through shellcheck? There are a number of changes which I would like to see applied for this PR before we approve it.

LakshmiSaiHarika · 2024-08-02T21:16:21Z

Hi @larrydewey, I made few changes and did shellcheck... Please let me know if any further changes are required.

LakshmiSaiHarika · 2024-09-28T01:21:15Z

Hi @larrydewey I addressed the changes as per the conversation above, please let me know if any additional changes are required

DGonzalezVillal

Just some nits and some overall functionality questions. But overall it lgtm.

DGonzalezVillal · 2024-10-09T20:36:48Z

+Read the dedicated host cpuid Fn8000_001F[EAX] instruction set to verify if the SNP is on and supported on the host:
+```
+./snp.sh check-host-snp-cpuid
+```
+
+


Do we want this to be it's own individual command? I see that it is being called when people are setting up the host and launching the guest. Is there additional functionality to be it's own individual command?

This module verifies if all the security bits are set to 1 for any given instruction set Signed-off-by: Harika Nittala <lnittala@amd.com>

This verifies if CPU is capable of SNP based on the SNP bit value present in the CPUID 0x8000001f Signed-off-by: Harika Nittala <lnittala@amd.com>

AdithyaKrishnan · 2025-01-27T22:47:27Z

+verify_host_snp_enablement() {
+  echo -e "Verifying if SME, SNP are enabled in the host from MSR 0xC0010010..."
+
+  sudo modprobe msr


if ! sudo modprobe msr; then
>&2 echo "ERROR: Failed to load MSR kernel module. Ensure you have the necessary sudo permissions."
return 1
fi

AdithyaKrishnan · 2025-01-27T22:54:36Z

+
+  case ${guest_linux_distro} in
+    ubuntu)
+      ssh_guest_command "sudo DEBIAN_FRONTEND=noninteractive sudo apt install -y msr-tools > /dev/null 2>&1" > /dev/null 2>&1


Are we assuming that the user will have sudo permissions by default?
If yes, disregard my comments.
Else, we might have to modify the code to handle that permission errors aren't misconstrued as actual errors

yes, I tested this, this works by default

AdithyaKrishnan

I believe this code has already been reviewed multiple times.
I couldn't find any major new suggestions apart from what was already provided to you.

This verifies if SME, SNP are enabled in the host BIOS settings by reading SME and SNP bit status from MSR 0xC0010010 Bit amd#23 corresponds to the SME bit status Bit amd#24 corresponds to the SNP bit status Signed-off-by: Harika Nittala <lnittala@amd.com>

Added MSR 0xC0010010 check to validate if guest SEV, SEV-ES and SNP are enabled by reading SEV, SEV-ES and SNP bits from MSR 0xC0010010 instruction set Bit #0 corresponds to the SEV bit status Bit amd#1 corresponds to SEV-ES bit status Bit amd#2 corresponds to SNP bit status Signed-off-by: Harika Nittala <lnittala@amd.com>

DGonzalezVillal

lgtm

larrydewey suggested changes Jul 8, 2024

View reviewed changes

larrydewey suggested changes Aug 5, 2024

View reviewed changes

LakshmiSaiHarika force-pushed the add-snp-check-via-instruction-set branch from 4ba7408 to 4ff4dcd Compare September 28, 2024 00:58

LakshmiSaiHarika requested a review from larrydewey September 28, 2024 05:29

DGonzalezVillal reviewed Oct 9, 2024

View reviewed changes

LakshmiSaiHarika force-pushed the add-snp-check-via-instruction-set branch from 4ff4dcd to 699d8b1 Compare October 22, 2024 21:48

DGonzalezVillal reviewed Dec 6, 2024

View reviewed changes

Comment thread tools/snp.sh

Comment thread tools/snp.sh Outdated

Comment thread tools/snp.sh Outdated

LakshmiSaiHarika marked this pull request as draft January 15, 2025 21:40

LakshmiSaiHarika force-pushed the add-snp-check-via-instruction-set branch from 699d8b1 to 0c98f29 Compare January 23, 2025 01:19

LakshmiSaiHarika changed the title ~~Added additional SNP checks on the host and guest via verification of SNP bit status from instruction set~~ Added additional SNP checks on the host and ubuntu guest via verification of SNP bit status from instruction set Jan 23, 2025

LakshmiSaiHarika added 2 commits January 24, 2025 00:09

snp.sh: Verify if SNP(security) bits are set

b11f34d

This module verifies if all the security bits are set to 1 for any given instruction set Signed-off-by: Harika Nittala <lnittala@amd.com>

snp.sh: Added CPUID check to verify the SNP feature support in host CPU

49d854c

This verifies if CPU is capable of SNP based on the SNP bit value present in the CPUID 0x8000001f Signed-off-by: Harika Nittala <lnittala@amd.com>

LakshmiSaiHarika force-pushed the add-snp-check-via-instruction-set branch from 0c98f29 to 8e655eb Compare January 24, 2025 04:50

LakshmiSaiHarika marked this pull request as ready for review January 24, 2025 04:53

LakshmiSaiHarika force-pushed the add-snp-check-via-instruction-set branch from 8e655eb to 235f4a8 Compare January 24, 2025 18:11

LakshmiSaiHarika changed the title ~~Added additional SNP checks on the host and ubuntu guest via verification of SNP bit status from instruction set~~ New SNP bit checks on the host and ubuntu guest from instruction set Jan 24, 2025

LakshmiSaiHarika changed the title ~~New SNP bit checks on the host and ubuntu guest from instruction set~~ SNP bit checks on the host and ubuntu guest from instruction set Jan 24, 2025

AdithyaKrishnan reviewed Jan 27, 2025

View reviewed changes

LakshmiSaiHarika requested a review from DGonzalezVillal January 28, 2025 19:24

LakshmiSaiHarika added 2 commits January 28, 2025 11:44

LakshmiSaiHarika force-pushed the add-snp-check-via-instruction-set branch from 235f4a8 to e82f96e Compare January 28, 2025 19:46

LakshmiSaiHarika requested a review from AdithyaKrishnan January 28, 2025 19:47

DGonzalezVillal approved these changes Jan 31, 2025

View reviewed changes

Conversation

LakshmiSaiHarika commented Jun 26, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

larrydewey left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

LakshmiSaiHarika commented Aug 2, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

LakshmiSaiHarika commented Sep 28, 2024

Uh oh!

DGonzalezVillal left a comment

Choose a reason for hiding this comment

Uh oh!

DGonzalezVillal Oct 9, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AdithyaKrishnan Jan 27, 2025

Choose a reason for hiding this comment

Uh oh!

AdithyaKrishnan Jan 27, 2025

Choose a reason for hiding this comment

Uh oh!

LakshmiSaiHarika Jan 27, 2025

Choose a reason for hiding this comment

Uh oh!

AdithyaKrishnan left a comment

Choose a reason for hiding this comment

Uh oh!

DGonzalezVillal left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

LakshmiSaiHarika commented Jun 26, 2024 •

edited

Loading

larrydewey left a comment •

edited

Loading