SEV Live Migration Support in OVMF

SEV Live Migration Support in OVMF

[Ashish Kalra]

This is with reference to adding SEV Live migration support in OVMF,
which basically is adding a hypercall as part of the
MemEncryptSevClearPageEncMask() function. 

We unconditionally make a hypercall and if the hypercall succeeds 
then it can sets a new UEFI environment variable
"SevLiveMigrationEnabled" which indicates it supports the feature to the OS. 
OS can later query whether feature is supported by OVMF by checking for
this variable using the UEFI runtime services. 

I tried doing this by setting the UEFI variable if the hypercall 
succeeds using the UEFI runtime services SetVariable() function, but 
it looks like the UEFI runtime services table library is only 
available to DXE and UEFI module types.

As OVMF's BaseMemEncryptLib module (which is doing the hypercall and then 
setting the variable) is a PEIM module, hence, it cannot call the 
UEFI runtime services and the build fails.

Now i am returning the hypercall return status up the caller chain, i.e, all the way upto
MemEncryptSevClearPageEncMask() and then set the Uefi variable 
in the above function which is running in DXE environment, so i believe that should work.

Sharing the above on the development list for any feedback, comments or
suggestions on this support and our current approach for the same.

Thanks,
Ashish

Re: SEV Live Migration Support in OVMF

[Ashish Kalra]

While testing this i found that the Uefi Variable module is loaded much 
later after AmdSevDxe module is loaded, hence the SetVariable() runtime
service is available much later, so now i am setting this new
Uefi variable as part of AmdIoMmuDxe module IoMmuMap() call.

Thanks,
Ashish

On Fri, Apr 17, 2020 at 08:26:19PM +0000, Ashish Kalra wrote:
> 
> This is with reference to adding SEV Live migration support in OVMF,
> which basically is adding a hypercall as part of the
> MemEncryptSevClearPageEncMask() function. 
> 
> We unconditionally make a hypercall and if the hypercall succeeds 
> then it can sets a new UEFI environment variable
> "SevLiveMigrationEnabled" which indicates it supports the feature to the OS. 
> OS can later query whether feature is supported by OVMF by checking for
> this variable using the UEFI runtime services. 
> 
> I tried doing this by setting the UEFI variable if the hypercall 
> succeeds using the UEFI runtime services SetVariable() function, but 
> it looks like the UEFI runtime services table library is only 
> available to DXE and UEFI module types.
> 
> As OVMF's BaseMemEncryptLib module (which is doing the hypercall and then 
> setting the variable) is a PEIM module, hence, it cannot call the 
> UEFI runtime services and the build fails.
> 
> Now i am returning the hypercall return status up the caller chain, i.e, all the way upto
> MemEncryptSevClearPageEncMask() and then set the Uefi variable 
> in the above function which is running in DXE environment, so i believe that should work.
> 
> Sharing the above on the development list for any feedback, comments or
> suggestions on this support and our current approach for the same.
> 
> Thanks,
> Ashish