|
 |
fbe740 |
From b89b5b577ae05a9f453a55b8e7cbd81db27e95df Mon Sep 17 00:00:00 2001
|
|
|
fbe740 |
Message-Id: <b89b5b577ae05a9f453a55b8e7cbd81db27e95df@dist-git>
|
|
|
fbe740 |
From: Boris Fiuczynski <fiuczy@linux.ibm.com>
|
|
|
fbe740 |
Date: Wed, 24 Jun 2020 13:16:22 +0200
|
|
|
fbe740 |
Subject: [PATCH] docs: Update AMD launch secure description
|
|
|
fbe740 |
MIME-Version: 1.0
|
|
|
fbe740 |
Content-Type: text/plain; charset=UTF-8
|
|
|
fbe740 |
Content-Transfer-Encoding: 8bit
|
|
|
fbe740 |
|
|
|
fbe740 |
Update document with changes in qemu capability caching and the added
|
|
|
fbe740 |
secure guest support checking for AMD SEV in virt-host-validate.
|
|
|
fbe740 |
|
|
|
fbe740 |
Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
|
|
|
fbe740 |
Reviewed-by: Erik Skultety <eskultet@redhat.com>
|
|
|
fbe740 |
(cherry picked from commit 2c3ffa37284b9fa3d1e6c369fa2bb71c6f6dd92a)
|
|
|
fbe740 |
|
|
|
fbe740 |
https://bugzilla.redhat.com/show_bug.cgi?id=1848997
|
|
|
fbe740 |
https://bugzilla.redhat.com/show_bug.cgi?id=1850351
|
|
|
fbe740 |
|
|
|
fbe740 |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
fbe740 |
Message-Id: <1229877019008ac6f0135296af502e596c3e30e5.1592996194.git.jdenemar@redhat.com>
|
|
|
fbe740 |
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
|
|
fbe740 |
---
|
|
|
fbe740 |
docs/kbase/launch_security_sev.rst | 9 ++++++---
|
|
|
fbe740 |
1 file changed, 6 insertions(+), 3 deletions(-)
|
|
|
fbe740 |
|
|
|
fbe740 |
diff --git a/docs/kbase/launch_security_sev.rst b/docs/kbase/launch_security_sev.rst
|
|
|
fbe740 |
index 65f258587d..19b978481a 100644
|
|
|
fbe740 |
--- a/docs/kbase/launch_security_sev.rst
|
|
|
fbe740 |
+++ b/docs/kbase/launch_security_sev.rst
|
|
|
fbe740 |
@@ -30,8 +30,11 @@ Enabling SEV on the host
|
|
|
fbe740 |
========================
|
|
|
fbe740 |
|
|
|
fbe740 |
Before VMs can make use of the SEV feature you need to make sure your
|
|
|
fbe740 |
-AMD CPU does support SEV. You can check whether SEV is among the CPU
|
|
|
fbe740 |
-flags with:
|
|
|
fbe740 |
+AMD CPU does support SEV. You can run ``libvirt-host-validate``
|
|
|
fbe740 |
+(libvirt >= 6.5.0) to check if your host supports secure guests or you
|
|
|
fbe740 |
+can follow the manual checks below.
|
|
|
fbe740 |
+
|
|
|
fbe740 |
+You can manually check whether SEV is among the CPU flags with:
|
|
|
fbe740 |
|
|
|
fbe740 |
::
|
|
|
fbe740 |
|
|
|
fbe740 |
@@ -109,7 +112,7 @@ following:
|
|
|
fbe740 |
</features>
|
|
|
fbe740 |
</domainCapabilities>
|
|
|
fbe740 |
|
|
|
fbe740 |
-Note that if libvirt was already installed and libvirtd running before
|
|
|
fbe740 |
+Note that if libvirt (<6.5.0) was already installed and libvirtd running before
|
|
|
fbe740 |
enabling SEV in the kernel followed by the host reboot you need to force
|
|
|
fbe740 |
libvirtd to re-probe both the host and QEMU capabilities. First stop
|
|
|
fbe740 |
libvirtd:
|
|
|
fbe740 |
--
|
|
|
fbe740 |
2.27.0
|
|
|
fbe740 |
|