Add support for SEV-SNP

Bug #2001605 reported by Khaled El Mously
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux-gcp (Ubuntu)
Fix Released
Undecided
Unassigned
Jammy
Fix Released
Critical
Khaled El Mously

Bug Description

Version 3 of AMD's Secure Encrypted Virtualization is called SNP (Secure Nested Pages). Support for this has been added to the kernel, mostly in v5.19 with some prerequisites from v5.16. This feature is requested to be backported to Jammy (5.15).

More information at https://canonical.lightning.force.com/lightning/r/Case/5004K00000EA2meQAD/view

[Impact]
No support for SEV-SNP on AMD EPYC2 CPUs currently

[Fix]
Add SEV-SNP support patches.

[Test]
Extensive testing by the cloud team over several months, testing general functionality under SEV-SNP.

[Regression Potential]
This was never working so there should be no risk of regression for SEV-SNP.As it does change those files it can have an effect on existing SEV functionality in case of a bug. The code is limited so no regression outside of SEV is expected.

no longer affects: linux-aws (Ubuntu)
description: updated
description: updated
description: updated
Changed in linux-gcp (Ubuntu Jammy):
assignee: nobody → Khaled El Mously (kmously)
importance: Undecided → Critical
status: New → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-gcp/5.15.0-1028.35 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-jammy-linux-gcp verification-needed-jammy
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (61.1 KiB)

This bug was fixed in the package linux-gcp - 5.15.0-1029.36

---------------
linux-gcp (5.15.0-1029.36) jammy; urgency=medium

  * jammy/linux-gcp: 5.15.0-1029.36 -proposed tracker (LP: #2003429)

  [ Ubuntu: 5.15.0-60.66 ]

  * jammy/linux: 5.15.0-60.66 -proposed tracker (LP: #2003450)
  * Revoke & rotate to new signing key (LP: #2002812)
    - [Packaging] Revoke and rotate to new signing key

linux-gcp (5.15.0-1028.35) jammy; urgency=medium

  * jammy/linux-gcp: 5.15.0-1028.35 -proposed tracker (LP: #2001767)

  * Add support for SEV-SNP (LP: #2001605)
    - KVM: SVM: Define sev_features and vmpl field in the VMSA
    - KVM: SEV: Refactor out sev_es_state struct
    - KVM: SVM: Create a separate mapping for the SEV-ES save area
    - KVM: SVM: Create a separate mapping for the GHCB save area
    - KVM: SVM: Update the SEV-ES save area mapping
    - x86/boot: Introduce helpers for MSR reads/writes
    - x86/boot: Use MSR read/write helpers instead of inline assembly
    - SAUCE: x86/compressed/64: Detect/setup SEV/SME features earlier in boot
    - x86/sev: Detect/setup SEV/SME features earlier in boot
    - x86/sev: Use CC_ATTR attribute to generalize string I/O unroll
    - x86/mm: Extend cc_attr to include AMD SEV-SNP
    - x86/sev: Shorten GHCB terminate macro names
    - SAUCE: x86/sev: Define the Linux specific guest termination reasons
    - x86/sev: Save the negotiated GHCB version
    - x86/sev: Carve out HV call's return value verification
    - x86/sev: Expose sev_es_ghcb_hv_call() for use by HyperV
    - x86/sev: Check SEV-SNP features support
    - x86/sev: Add a helper for the PVALIDATE instruction
    - x86/sev: Check the vmpl level
    - x86/compressed: Add helper for validating pages in the decompression stage
    - x86/compressed: Register GHCB memory when SEV-SNP is active
    - x86/sev: Register GHCB memory when SEV-SNP is active
    - x86/sev: Rename mem_encrypt.c to mem_encrypt_amd.c
    - x86/sev: Add helper for validating pages in early enc attribute changes
    - treewide: Replace the use of mem_encrypt_active() with cc_platform_has()
    - x86/head64: Carve out the guest encryption postprocessing into a helper
    - SAUCE: x86/kernel: Make the .bss..decrypted section shared in RMP table
    - x86/kernel: Validate ROM memory before accessing when SEV-SNP is active
    - SAUCE: x86/mm: Add support to validate memory when changing C-bit
    - x86/sev: Remove do_early_exception() forward declarations
    - x86/sev: Use SEV-SNP AP creation to start secondary CPUs
    - x86/head/64: Re-enable stack protection
    - x86/compressed/acpi: Move EFI detection to helper
    - x86/compressed/acpi: Move EFI system table lookup to helper
    - x86/compressed/acpi: Move EFI config table lookup to helper
    - x86/compressed/acpi: Move EFI vendor table lookup to helper
    - x86/compressed/acpi: Move EFI kexec handling into common code
    - x86/boot: Add Confidential Computing type to setup_data
    - KVM: x86: Move lookup of indexed CPUID leafs to helper
    - x86/sev: Move MSR-based VMGEXITs for CPUID to helper
    - x86/compressed/64: Add support for SEV-SNP CPUID table in #VC handlers
    - x86/boot: Add a pointer to Confident...

Changed in linux-gcp (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-gcp/6.5.0-1018.18 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-mantic-linux-gcp' to 'verification-done-mantic-linux-gcp'. If the problem still exists, change the tag 'verification-needed-mantic-linux-gcp' to 'verification-failed-mantic-linux-gcp'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-mantic-linux-gcp-v2 verification-needed-mantic-linux-gcp
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package linux-gcp - 6.5.0-1018.18

---------------
linux-gcp (6.5.0-1018.18) mantic; urgency=medium

  * mantic/linux-gcp: 6.5.0-1018.18 -proposed tracker (LP: #2059690)

  * Add support for SEV-SNP (LP: #2001605)
    - [config] Keep sev-guest as built-in by defaults
    - [Config]: gcp: CONFIG_TSM_REPORTS=y due to recent CONFIG_SEV_GUEST=y change

  * Include cifs.ko in linux-modules package (LP: #2042546)
    - [Packaging] Replace fs/cifs with fs/smb/client in inclusion list

  [ Ubuntu: 6.5.0-28.29 ]

  * mantic/linux: 6.5.0-28.29 -proposed tracker (LP: #2059706)
  * Packaging resync (LP: #1786013)
    - [Packaging] drop getabis data
  * Remove getabis scripts (LP: #2059143)
    - [Packaging] Remove getabis
  * CVE-2023-52600
    - jfs: fix uaf in jfs_evict_inode
  * Mantic update: upstream stable patchset 2024-03-27 (LP: #2059284) //
    CVE-2023-52603
    - UBSAN: array-index-out-of-bounds in dtSplitRoot
  * CVE-2024-26581
    - netfilter: nft_set_rbtree: skip end interval element from gc
  * Mantic update: upstream stable patchset 2024-03-07 (LP: #2056403) //
    CVE-2024-26589
    - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  * Mantic update: upstream stable patchset 2024-03-07 (LP: #2056403) //
    CVE-2024-26591
    - bpf: Fix re-attachment branch in bpf_tracing_prog_attach
  * iwlwifi disconnect and crash - intel wifi7 (LP: #2058808)
    - wifi: iwlwifi: pcie: fix RB status reading

 -- John Cabaj <email address hidden> Thu, 04 Apr 2024 20:40:52 -0500

Changed in linux-gcp (Ubuntu):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.