Adding Coconut-SVSM support #19

ramagali24 · 2024-09-13T08:02:33Z

Coconut-SVSM support leverages AMD-ES/AMD-SEV for setting up the host, launching the guest VM (by directly setting up snpguest within the guest VM), and performing attestation and measurement verification (using igvmmeasure versus snpguest).

larrydewey

There are a number of points needing adjustment. The biggest one is this PR needs to be re-based on upstream. Please adjust and re-request review.

tools/snp.sh

DGonzalezVillal

Good fixes! This is what we were looking for per our previous discussions, just a couple more things to adjust.

Please fix the boolean logic for the svsm flag.

Also your verify measurement is adding repetitive code.

You will also need to rebase again because there were some prs merged yesterday, your code is behind.

tools/snp.sh

ramagali24 · 2024-09-13T21:46:09Z

To ensure that SNP is given priority over SVSM and that any SVSM-specific code changes fall back to the else condition, .
-s|--svsm)
SVSM=false

@larrydewey , I rebased my fork branch and submitted the commit earlier. Now, I have rebased my fork's main branch and then rebased and submitted the changes. This resolves most of your suggestions.

DGonzalezVillal · 2024-09-13T21:55:41Z

Every time you are doing SNP workflows you are checking to see if SVSM is True, which in itself is confusing because it reads like SVSM is "enabled" let met do the SNP only workflows. This doesn't "give priority to SNP".

If SVSM is set to true you can do whatever small workflow you need for an svsm and if its false you can default to SNP. It reads better and it will make it easier to consolidate your logic.

Or at least that's how I see it. @larrydewey @ryansavino idk what you guys think about that.

ramagali24 · 2024-09-16T14:09:35Z

I am thinking of adding SVSM="${SVSM:-false}", or using the function below:
is_svsm_true() {
[ "$SVSM" = "true" ]
}
This makes the code more readable whenever there's a check for SVSM, and it always falls back to the ELSE loop if the condition is not met. Let me know your suggestions.

tools/snp.sh

ryansavino · 2024-09-16T16:43:58Z

There's a lot of comments here that need to be addressed. Please try to clean things up, and then I'll a look at the rest of the PR to provide my review.

tools/snp.sh

pegahnikbakht · 2024-09-20T07:48:53Z

Does this pull request prepare both host and guest kernel for svsm support or only it prepares the host kernel?

ramagali24 · 2024-09-20T12:15:31Z

Does this pull request prepare both host and guest kernel for svsm support or only it prepares the host kernel?

Yes, it prepares both host and guest kernel build's of svsm.

…t, launching the guest (directly setting up snpguest in the guest VM), and performing attestation & measurement verification (using igvmmeasure vs snpguest)

tools/snp.sh

larrydewey

I think this addressed my concerns. @ryansavino and @DGonzalezVillal What are your thoughts?

pegahnikbakht · 2024-09-23T10:25:06Z

I tried the PR and this what I get, after setting up the host and doing reboot:

sudo dmesg | grep SEV
[    0.000000] SEV-SNP: RMP table physical range [0x0000000097f00000 - 0x00000000a84fffff]
[   15.971036] ccp 0000:47:00.1: SEV firmware update successful
[   16.957109] ccp 0000:47:00.1: SEV API:1.55 build:17
[   16.968043] ccp 0000:47:00.1: SEV-SNP API:1.55 build:17
[   17.001398] kvm_amd: SEV enabled (ASIDs 100 - 509)
[   17.001400] kvm_amd: SEV-ES enabled (ASIDs 1 - 99)
[   17.001402] kvm_amd: SEV-SNP enabled (ASIDs 1 - 99)
[   55.694404] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[   69.696023] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[   83.714032] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[   98.741790] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  112.706735] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  126.726123] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  138.749160] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  151.755308] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  162.736310] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  177.706665] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  189.709388] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  201.727346] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  216.711789] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  229.729728] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  254.713263] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  270.741829] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  286.746275] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  300.714161] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  315.665391] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  326.740066] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  340.334649] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  352.739657] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  364.751004] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  377.723099] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  391.715254] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  404.725178] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  418.724743] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  429.734649] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  444.723452] kvm_amd: SEV-SNP requires private memory support via guest_memfd.
[  456.752758] kvm_amd: SEV-SNP requires private memory support via guest_memfd.

Same error I get when setting up the SVSM directly from coconut svsm github repo.

ramagali24 · 2024-09-23T13:39:07Z

@pegahnikbakht , Could you please open a new issue so we can discuss and provide suggestions for your setup problems? I don't see the same issue you're experiencing with the PR; it seems more related to your setup and installation

DGonzalezVillal

Only a couple of suggestions and one general question, but overall I'm good with how it looks now!

DGonzalezVillal · 2024-09-23T17:11:49Z

tools/snp.sh

@@ -116,6 +119,7 @@ usage() {
  >&2 echo "    stop-guests           Stop all SNP guests started by this script"
  >&2 echo "  where OPTIONS are:"
  >&2 echo "    -n|--non-upm          Build AMDSEV non UPM kernel (sev-snp-devel)"
+  >&2 echo "    -s|--svsm             Build coconut-svsm components, launch guest and verify attestation & measurement"


Suggested change

>&2 echo " -s|--svsm Build coconut-svsm components, launch guest and verify attestation & measurement"

>&2 echo " -s|--svsm Build, launch and attest coconut-svsm"

DGonzalezVillal · 2024-09-23T17:14:56Z

tools/snp.sh

+  if $SVSM; then
+    sudo apt install -y libcunit1 libcunit1-dev build-essential libclang-dev autoconf \
+      autoconf-archive pkg-config automake libssl-dev libc6-dev gcc-multilib binutils make musl musl-tools
+  fi


Some of these are already being installed (build-essential, libssl-dev, pkg-config)

DGonzalezVillal · 2024-09-23T17:21:00Z

tools/snp.sh

+  if "$SVSM"; then
+    cargo build --release --target x86_64-unknown-linux-musl
+    scp_guest_command target/x86_64-unknown-linux-musl/release/snpguest "${GUEST_USER}@localhost:/home/${GUEST_USER}"
+  else
+    cargo build -r
+    scp_guest_command target/release/snpguest "${GUEST_USER}@localhost:/home/${GUEST_USER}"
+  fi


@larrydewey & @ryansavino Not the biggest deal, but Rama had to add this due to dependency differences in Ubuntu 22.04 and 24.04. Do we want to default to musl builds? If I'm not mistaken this will happen to anyone that has a 24.04 host that tries to use the script to launch a 22.04 guest. It's unrelated to svsm.

DGonzalezVillal · 2024-09-23T20:33:29Z

Oh also I just thought of this, but maybe update the snp.md documentation with updated instructions to use the SVSM flag. Or do you want that to be a separate PR @ryansavino

larrydewey requested changes Sep 13, 2024

View reviewed changes

ramagali24 force-pushed the svsm_sev_utils branch from 9aad362 to 2332446 Compare September 13, 2024 19:48

DGonzalezVillal suggested changes Sep 13, 2024

View reviewed changes

larrydewey requested changes Sep 16, 2024

View reviewed changes

ramagali24 force-pushed the svsm_sev_utils branch 2 times, most recently from 54a5f26 to bb710f8 Compare September 17, 2024 06:45

larrydewey requested changes Sep 17, 2024

View reviewed changes

tools/snp.sh Outdated Show resolved Hide resolved

tools/snp.sh Outdated Show resolved Hide resolved

tools/snp.sh Outdated Show resolved Hide resolved

tools/snp.sh Outdated Show resolved Hide resolved

ramagali24 force-pushed the svsm_sev_utils branch 2 times, most recently from 3024550 to 47e28f2 Compare September 17, 2024 20:51

ramagali24 requested a review from larrydewey September 18, 2024 05:05

larrydewey requested changes Sep 18, 2024

View reviewed changes

tools/snp.sh Outdated Show resolved Hide resolved

tools/snp.sh Outdated Show resolved Hide resolved

tools/snp.sh Outdated Show resolved Hide resolved

DGonzalezVillal reviewed Sep 18, 2024

View reviewed changes

tools/snp.sh Outdated Show resolved Hide resolved

ramagali24 force-pushed the svsm_sev_utils branch 2 times, most recently from 6a34b8a to 630b85c Compare September 19, 2024 20:05

ramagali24 requested review from larrydewey and DGonzalezVillal September 19, 2024 20:09

Coconut-SVSM support to invoke AMD-ES/AMD-SEV for setting up the hos…

aa795ab

…t, launching the guest (directly setting up snpguest in the guest VM), and performing attestation & measurement verification (using igvmmeasure vs snpguest)

larrydewey requested changes Sep 20, 2024

View reviewed changes

ramagali24 force-pushed the svsm_sev_utils branch 2 times, most recently from 082727a to 296b43a Compare September 20, 2024 15:25

larrydewey requested changes Sep 20, 2024

View reviewed changes

tools/snp.sh Outdated Show resolved Hide resolved

ramagali24 force-pushed the svsm_sev_utils branch from 296b43a to 5b819ba Compare September 20, 2024 16:19

chnages made based on latest reviews

c91431e

ramagali24 force-pushed the svsm_sev_utils branch from 5b819ba to c91431e Compare September 20, 2024 16:42

larrydewey reviewed Sep 20, 2024

View reviewed changes

tools/snp.sh Show resolved Hide resolved

larrydewey approved these changes Sep 20, 2024

View reviewed changes

larrydewey added the enhancement New feature or request label Sep 20, 2024

DGonzalezVillal reviewed Sep 23, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding Coconut-SVSM support #19

Adding Coconut-SVSM support #19

ramagali24 commented Sep 13, 2024

larrydewey left a comment

DGonzalezVillal left a comment

ramagali24 commented Sep 13, 2024

DGonzalezVillal commented Sep 13, 2024

ramagali24 commented Sep 16, 2024

ryansavino commented Sep 16, 2024

pegahnikbakht commented Sep 20, 2024

ramagali24 commented Sep 20, 2024

larrydewey left a comment

pegahnikbakht commented Sep 23, 2024

ramagali24 commented Sep 23, 2024

DGonzalezVillal left a comment

DGonzalezVillal Sep 23, 2024

DGonzalezVillal Sep 23, 2024

DGonzalezVillal Sep 23, 2024

DGonzalezVillal commented Sep 23, 2024

	>&2 echo " -s\|--svsm Build coconut-svsm components, launch guest and verify attestation & measurement"
	>&2 echo " -s\|--svsm Build, launch and attest coconut-svsm"

Adding Coconut-SVSM support #19

Are you sure you want to change the base?

Adding Coconut-SVSM support #19

Conversation

ramagali24 commented Sep 13, 2024

larrydewey left a comment

Choose a reason for hiding this comment

DGonzalezVillal left a comment

Choose a reason for hiding this comment

ramagali24 commented Sep 13, 2024

DGonzalezVillal commented Sep 13, 2024

ramagali24 commented Sep 16, 2024

ryansavino commented Sep 16, 2024

pegahnikbakht commented Sep 20, 2024

ramagali24 commented Sep 20, 2024

larrydewey left a comment

Choose a reason for hiding this comment

pegahnikbakht commented Sep 23, 2024

ramagali24 commented Sep 23, 2024

DGonzalezVillal left a comment

Choose a reason for hiding this comment

DGonzalezVillal Sep 23, 2024

Choose a reason for hiding this comment

DGonzalezVillal Sep 23, 2024

Choose a reason for hiding this comment

DGonzalezVillal Sep 23, 2024

Choose a reason for hiding this comment

DGonzalezVillal commented Sep 23, 2024