The Linux Kernel Now Seeing Patches For AMD SEV-ES "Encrypted State" Support

[phoronix]

Phoronix: The Linux Kernel Now Seeing Patches For AMD SEV-ES "Encrypted State" Support

While since 2016~2017 AMD has been posting Linux kernel patches for Secure Memory Encryption (SME) and Secure Encrypted Virtualization, coming out this morning is finally the first public patch series wiring up the Linux kernel for SEV-ES as further enhancing virtualization encryption...

http://www.phoronix.com/scan.php?page=news_item&px=AMD-SEV-ES-Linux-2020-Patches

[itoffshore]

hopefully one of these patches fixes the bug in amdgpu in linux-hardened

[bridgman]

I think we discussed this previously, but I would not expect these changes in CPU encryption to affect the issue you linked.

My recollection is that the underlying issue here is that CPUs can access encrypted memory but GPUs can not - so one way or another memory buffers intended for use by GPU need to be non-encrypted. Not sure what default kernel does with DMA buffers when encryption is enabled by default (will check) but seems like the solution would lie in that direction.

[agd5f]

This thread provides some background:

https://www.mail-archive.com/[email protected]&q=subject:%22Re%5C%3A+%5C%5BRFC+PATCH%5C%5D+drm%5C%2Fttm%2C+drm%5C%2Fvmwgfx%5C%3A+Have+TTM+support+AMD+SEV+encryption%22&o=newest

[chithanh]

hopefully one of these patches fixes the bug in amdgpu in linux-hardened

The patch that you are looking for is probably https://patchwork.kernel.org/patch/10850833/

Relevant fdo bugs are

https://gitlab.freedesktop.org/drm/amd/issues/285

https://gitlab.freedesktop.org/drm/amd/issues/832

My recollection is that the underlying issue here is that CPUs can access encrypted memory but GPUs can not

Interestingly, nouveau and radeon are not affected by SME/TSME, while amdgpu is.

[Imroy]

This thread provides some background:

https://www.mail-archive.com/[email protected]&q=subject:%22Re%5C%3A+%5C%5BRFC+PATCH%5C%5D+drm%5C%2Fttm%2C+drm%5C%2Fvmwgfx%5C%3A+Have+TTM+support+AMD+SEV+encryption%22&o=newest

From the titles, that looks like work to make the virtual vmwgfx driver support SVE i.e where each VM has its memory encrypted by a different key.
The original problem is getting amdgpu to work with SME i.e where main memory is encrypted.

[agd5f]

From the titles, that looks like work to make the virtual vmwgfx driver support SVE i.e where each VM has its memory encrypted by a different key.
The original problem is getting amdgpu to work with SME i.e where main memory is encrypted.

That was the original intent of the thread, but the subsequent discussion is relevant to either. The underlying mechanisms are the same. See:

https://developer.amd.com/wordpress/media/2013/12/AMD_Memory_Encryption_Whitepaper_v7-Public.pdf

[azdaha]

Exciting news. However, still seems too long to wait until 5.7

[itoffshore]

The patch that you are looking for is probably https://patchwork.kernel.org/patch/10850833/

Relevant fdo bugs are

https://gitlab.freedesktop.org/drm/amd/issues/285

https://gitlab.freedesktop.org/drm/amd/issues/832

Interestingly, nouveau and radeon are not affected by SME/TSME, while amdgpu is.

Many thanks for the pointer - I tried applying the patch but it seems to already be in the kernel

  -> Applying patch drm-fallback-to-dma_alloc_coherent-when-memory-encryption-is-active.patch...
patching file drivers/gpu/drm/drm_memory.c
Reversed (or previously applied) patch detected!  Skipping patch.

booting linux-hardened with mem_encrypt=off on Ryzen cpus still required for the moment

[azdaha]

booting linux-hardened with mem_encrypt=off on Ryzen cpus still required for the moment

Yup. Still that dangling carrot until kernel version 5.7 (hopefully)