Starting a virtual machine with SEV-SNP parameters (qemu-system-x86-64)

[miloserdoff]

ISSUE TYPE

• Improvement Request
• Enhancement Request

COMPONENT NAME

QEMU

CLOUDSTACK VERSION

4.18.2.5 

CONFIGURATION

OS / ENVIRONMENT

SUMMARY

Launching a virtual machine via qemu-system-x86-64 with its own sev-snp parameters

EXPECTED RESULTS

Path to a script that starts a virtual machine using qemu-system-x86-64 with parameters

[miloserdoff]

Ubuntu 18.04

[miloserdoff]

@DaanHoogland Hi. I need your help. I need to test the implementation of AMD SEV-SNP technology. SEV-SNP support is enabled on the host machine, tests complete without errors. SEV-SNP support is also enabled on the guest OS, the kernel is configured for this technology. I launched a virtual machine on Cloudstack using a prepared guest OS image. When checking snpguest, the tests fail when checking SEV-SNP support. However, if I run it on my machine via launch-qemu, my tests complete without errors. How can I use Cloudstack to test this technology? Which script runs qemu-system-x86-64? Or how can I use Cloudstack to check all this?

[DaanHoogland]

@miloserdoff cloudstack uses libvirt to start a VM using dumpxml format. in the kvm plugin you will find the libvertXmlParser and LibvirtVMDef which read and write the VM definition respectively. I think a good way to about this is to

• launch a vm
• dumpxml for the domain
• compare what you see with what ACS makes of starting the same image
• adjust the system to pass and add the missing elements

hope this help, don't hesitate to reach out if it doesn't

[miloserdoff]

@DaanHoogland Is it possible to do this if I deployed Cloudstack via apt package manager instead of cloning from GitHub?

[weizhouapache]

sev-snp

@miloserdoff

you can use "virsh dumpxml" to get the vm definition of cloudstack vm and the other vm, then get the difference (especially the cpu part)

from what I read on https://libvirt.org/kbase/launch_security_sev.html, it is only supported by some cpu models

cloudstack supports cpu mode/model/feature customizations.
you may refer to https://docs.cloudstack.apache.org/en/latest/installguide/hypervisor/kvm.html#configure-cpu-model-for-kvm-guest-optional
you can probably test with host-passthrough

you also need to enable and configure UEFI, you can find some info on the same page

[miloserdoff]

@weizhouapache When restarting the virtual machine, this dumpxml is overwritten with the old parameters. Is it possible to make this somehow static so that it remains unchanged?

[weizhouapache]

@weizhouapache When restarting the virtual machine, this dumpxml is overwritten with the old parameters. Is it possible to make this somehow static so that it remains unchanged?

what settings you want to persist ?

[miloserdoff]

@weizhouapache

I need to add the line to the tag
/home/test/AMDSEV/snp-release-2024-11-18/Ubuntudd.fd

And add to the end of the file

47
1
0x0003

[miloserdoff]

@weizhouapache I'm sorry

[weizhouapache]

@weizhouapache I'm sorry

@miloserdoff
you can try vm extraconfig, please refer to
https://www.shapeblue.com/cloudstack-feature-first-look-enable-sending-of-arbitrary-configuration-data-to-vms/

[miloserdoff]

@DaanHoogland @weizhouapache I need to start a virtual machine using libvirt and qemu via virsh start.

I enabled SEV, SEV-ES, SEV-SNP support in the system.
root@test:~# dmesg | grep -i sev
[ 0.000000] Command line: BOOT_IMAGE=/vmlinuz-6.11.0-rc3-snp-host-85ef1ac03941 root=/dev/mapper/ubuntu--vg-lv--2 ro kvm_amd.sev=1 quiet splash systemd.unified_cgroup_hierarchy=1 vt.handoff=1
[ 0.000000] SEV-SNP: RMP table physical range [0x0000007fcd100000 - 0x000000804d6fffff]
[ 0.003473] SEV-SNP: Reserving start/end of RMP table on a 2MB boundary [0x0000007fcd000000]
[ 0.003478] SEV-SNP: Reserving start/end of RMP table on a 2MB boundary [0x000000804d600000]
[ 0.364249] Kernel command line: BOOT_IMAGE=/vmlinuz-6.11.0-rc3-snp-host-85ef1ac03941 root=/dev/mapper/ubuntu--vg-lv--2 ro kvm_amd.sev=1 quiet splash systemd.unified_cgroup_hierarchy=1 vt.handoff=1
[ 9.138296] ccp 0000:05:00.5: sev enabled
[ 14.697860] ccp 0000:05:00.5: SEV API:1.55 build:24
[ 14.697866] ccp 0000:05:00.5: SEV-SNP API:1.55 build:24
[ 14.705531] kvm_amd: SEV enabled (ASIDs 253 - 1006)
[ 14.705533] kvm_amd: SEV-ES enabled (ASIDs 1 - 252)
[ 14.705534] kvm_amd: SEV-SNP enabled (ASIDs 1 - 252)

And to launch SEV and SEV-ES I use in domainXml block

Test results:
root@UbuntuSevTest:~# snpguest ok
[PASS] - SEV: ENABLED
[PASS] - SEV-ES: ENABLED
[FAIL] - SNP: DISABLED
[PASS] - Optional Features statuses:
[PASS] - VTOM: DISABLED
[PASS] - ReflectVC: DISABLED
[PASS] - Restricted Injection: DISABLED
[PASS] - Alternate Injection: DISABLED
[PASS] - Debug Swap: DISABLED
[PASS] - Prevent Host IBS: DISABLED
[PASS] - SNP BTB Isolation: DISABLED
[PASS] - VMPL SSS: DISABLED
[PASS] - Secure TSE: DISABLED
[PASS] - VMG Exit Parameter: DISABLED
[ PASS ] - IBS Virtualization: DISABLED
[ PASS ] - VMSA Reg Prot: DISABLED
[ PASS ] - SMT Protection: DISABLED
ERROR: One or more tests in snpguest-ok reported a failure
Error: One or more tests in snpguest-ok reported a failure

To launch SEV-SNP, use the appropriate sev-snp type

And when I enter the virsh start command, an error appears
root@test:~# virsh start i-2-323-VM
error: Failed to start domain 'i-2-323-VM'
error: internal error: process exited while connecting to monitor: 2024-12-06T11:38:36.268734Z qemu-system-x86_64: -accel kvm: sev_snp_launch_start: SNP_LAUNCH_START ret=-22 fw_error=0 ''
2024-12-06T11:38:36.268772Z qemu-system-x86_64: -accel kvm: sev_common_kvm_init: failed to create encryption context
2024-12-06T11:38:36.313032Z qemu-system-x86_64: -accel kvm: failed to initialize kvm: Operation not permitted

root@test:# ls -la /dev/kvm
crw-rw---- 1 root kvm 10, 232 Dec 6 12:21 /dev/kvm
root@test:# virsh --version
10.5.0
root@test:~# qemu-system-x86_64 --version
QEMU emulator version 9.1.0
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers

The libvirtd and QEMU version support sev, sev-es and snp

[weizhouapache]

@miloserdoff
are you able to launch vm with SEV-SNP through other ways, for example, virt-manager, virsh command, etc ?