search

AMDESE / AMDSEV

AMD Secure Encrypted Virtualization
298 stars 87 forks source link

`-net` does not work with SNP #243

Closed ghe0 closed 2 hours ago

ghe0 commented 6 hours ago

Using -net interfaces together with -object sev-snp-guest will cause the following error:

qemu-system-x86_64: kvm_set_user_memory_region: KVM_SET_USER_MEMORY_REGION2 failed, slot=4, start=0x80000000, size=0x40000, flags=0x2, guest_memfd=-1, guest_memfd_offset=0x0: Invalid argument
kvm_set_phys_mem: error registering slot: Invalid argument

Software versions:

$ uname -r 
6.11.5-300.fc41.x86_64
$ qemu-system-x86_64 --version
QEMU emulator version 9.1.1 (qemu-9.1.1-1.fc41)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
$ cat /etc/fedora-release 
Fedora release 41 (Forty One)

Full command:

qemu-system-x86_64 \
   -net nic,model=virtio,addr=$(cat /sys/class/net/macvtap0/address) \
   -net tap,fd=3 3<>/dev/tap$(cat /sys/class/net/macvtap0/ifindex) \
   -enable-kvm -cpu EPYC-v4 -vga none \
   -machine q35,confidential-guest-support=sev0,memory-backend=ram1 \
   -smp 4,maxcpus=255 -m 2G,slots=5,maxmem=10240M \
   -no-reboot -bios /usr/share/edk2/ovmf/OVMF.amdsev.fd \
   -netdev user,id=vmnic,hostfwd=tcp::8000-:22 \
   -device e1000,netdev=vmnic,romfile= \
   -drive file=/root/images/sev-guest-1.qcow2,if=none,id=disk0,format=qcow2 \
   -device virtio-scsi-pci,id=scsi0,disable-legacy=on,iommu_platform=true,romfile= \
   -device scsi-hd,drive=disk0 \
   -object memory-backend-memfd,id=ram1,size=2G,share=true,prealloc=false \
   -object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1,kernel-hashes=on \
   -kernel /root/images/vmlinuz-6.10.0-snp-guest-0c3836482481 \
   -append "console=ttyS0 earlyprintk=serial root=/dev/sda2" \
   -initrd /root/images/initrd.img-6.10.0-snp-guest-0c3836482481
   -nographic -monitor pty -monitor unix:monitor,server,nowait

The problem is combining the two macvtap lines with SNP. -net will however work with -object sev-guest.

ghe0 commented 2 hours ago

Add macvtap device and get info:

$ ip link add link eno8303 name macvtap2 type macvtap
$ ip link set macvtap2 up
$ cat /sys/class/net/macvtap2/ifindex
6
$ cat /sys/class/net/macvtap2/address
de:07:36:a7:54:ba

and add it to the VM settings:

    -netdev tap,id=hostnet1,fd=3 3<>/dev/tap6 \
    -device e1000,netdev=hostnet1,mac=de:07:36:a7:54:ba,romfile= \

Thank me later.