SEV "sev" library usage and introduced SEV-SNP support

[tylerfanelli]

This PR adds a few new features to the TEE capabilities of libkrun:

• Modifies the amd-sev module to utilize the sev library APIs for creating a SEV-encrypted VM.
• Introduces a new module tee, which serves to group all TEE-specific modules in one place.
• Introduces the ability to create AMD SEV-SNP encrypted VMs through the amd-snp module.

One thing missing in this PR is that although SEV-SNP VMs can be created, there is no interface for attesting a SEV-SNP VM. Attestation support is currently a WIP.

[tylerfanelli]

CC @slp

[slp]

Nice work here! A couple of comments:

• Please update arch/src/x86_64/ references from amd-sev to tee, as we need this behavior on SNP and TDX too.
• We need to measure more regions for SNP, but I'm inclined to merge this as is, and the update that on a later PR, if you're fine with it.

[tylerfanelli]

@slp

Nice work here! A couple of comments:

• Please update arch/src/x86_64/ references from amd-sev to tee, as we need this behavior on SNP and TDX too.

Sure, will re-push with these changes.

• We need to measure more regions for SNP, but I'm inclined to merge this as is, and the update that on a later PR, if you're fine with it.

If you're comfortable doing that, then I'm fine with it. What other regions (besides our previously discussed CPUID page) are you referring to?

[tylerfanelli]

@slp All amd-sev references in arch/src/x86_64 references have been changed to tee

[slp]

Now that we have a unified kernel+qboot-krunfw bundle that works for both SEV and SNP, I think we should update this PR to use a single feature for enabling both amd-sev and amd-snp. Probably the most reasonable way is keeping amd-sev and having it enable both SEV and SNP code paths. Then, the decision to use one or the other can be taken using the field tee from TeeConfig.

That said, I would keep the tee build conditionals as they are, as they'll be useful once we add TDX support next.

[tylerfanelli]

So, essentially what you are saying is to remove the amd-snp flag altogether, and encase all SNP code/data in the amd-sev config instead. So although both code paths will be included, the paths taken for encryption would be handled by the TeeConfig.tee field? Am I understanding correctly?

[slp]

So, essentially what you are saying is to remove the amd-snp flag altogether, and encase all SNP code/data in the amd-sev config instead. So although both code paths will be included, the paths taken for encryption would be handled by the TeeConfig.tee field? Am I understanding correctly?

Exactly. Keeping what in the current state of this PR is tee as tee, so we can reuse that work for introducing TDX later on.

[slp]

@tylerfanelli Should we merge this one as-is and improve on top of it, or do we want to improve it beforehand?

[tylerfanelli]

@slp I've added some commits and tested them on virtlab. They work nicely with the updated libkrunfw.

• Require input of a TeeConfig file
• Merge amd-sev + amd-snp modules (which one will be used is determined by the inputted TeeConfig)
• Add snp-config-noattest.json example

[tylerfanelli]

@slp My latest commit fixes the cargo test issue. All checks are now passing.

[slp]

@tylerfanelli I've made some changes to the PR, please take a look.

• Dropped vmm/vstate: Format Error and vmm/builder: Format StartMicrovmError. I agree with they improve the readability, but changing in the format just for them introduces an inconsistency with the other Error declarations along the project.
• Dropped WiP commit adding CPUID page generation. We'll do a proper implementation after this PR is merged.
• Changed tee: Make TeeConfig required to keep using Option in src/libkrun/src/lib.rs to avoid having to compare against an empty path.
• Changed vmm/tee: Merge amd-sev and amd-snp modules to add missing documentation for InvalidTee.

[tylerfanelli]

LGTM. I'm fine with these changes.