From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM11-BN8-obe.outbound.protection.outlook.com (NAM11-BN8-obe.outbound.protection.outlook.com [40.107.236.62]) by mx.groups.io with SMTP id smtpd.web10.12501.1625753290551824810 for ; Thu, 08 Jul 2021 07:08:10 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@amd.com header.s=selector1 header.b=WIBCTI2e; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.236.62, mailfrom: ashish.kalra@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=OjLeEK1W0/XYi0xplELvwTu+FuepMl+jND+peAcm3Lk+ZbxZdX+ZEbbZe7AJoZvT7EhQyc6ztEcF+mqWONzO74690Dx6hloJNpf+yAYgwz0zRPHKa8E1jBn4ojSd6FJEIxxzJxfF5dWqBMOOByfep3gkeox1/WXMS11djNnp5eGBXGsMqOJVD4A8Bwx2c1I2Pvq43xc7KVnP8qYpEBFXLkohgKkqUfkyyXjmSp1yLpuegYHXckKKKM0z3i401hjTA4AbHZbtjMgWBp9BzKZNv/5XUbPopJOorWsVpt7C4jN/uHakkC4c90+V7ckNUG/B7VDZhP0J2/XX7ttaPlwucg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/MRCvCfnCL1x5RkXsP8i5+BKgiOMddTQS+CfgxGwM8Q=; b=SfK0ftZphbJt008S2GiOgQfT27tw+bJuAK0RB0TB9EzbKCJ+jLVtHjSipswyQKqLiIg6NeRSDP0eT0OmmcBSQtsu+s32jaAUIR/oWLAEc6lcYXeaAJmSmHa6fkTXxWlg6ST5vBvmotIckZ6h9V5M7k/yHjXXDrSd6n3rUyr7fbW5vGDCFM+886X+2Me257NsXCkKwXQeAJXJeFxXvy2GUgk1HFY3Mfn00vx8DWOZVMznD3KXUkI24YQ8sROIxkwKEbgvQTmhs826bSJ8ox5elhRvYiblcXDSCqGC1eihPS3Wb4F8eS2DFiWGYt0AOaHRTVrZ+ECUIQBJqa0YZc91gA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/MRCvCfnCL1x5RkXsP8i5+BKgiOMddTQS+CfgxGwM8Q=; b=WIBCTI2e7aW+GqXZuLRX82Nm4pVjv7mWUR/fKc7xrYAnmnlKfIlHehq5iQgVN6Xw4uxNoWz6FFvMxKTEu+6VOpy0Lb34tmXFq5ygkwfhUYL+6114QsNHMzxvRas21WNM6lYgAHdF1NTh+nE5uU2UiEPv/Qkm2EJcwOC5TgRI2nw= Authentication-Results: edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) by SA0PR12MB4592.namprd12.prod.outlook.com (2603:10b6:806:9b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.22; Thu, 8 Jul 2021 14:08:08 +0000 Received: from SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::e8b2:38db:240f:b3ec]) by SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::e8b2:38db:240f:b3ec%7]) with mapi id 15.20.4287.035; Thu, 8 Jul 2021 14:08:08 +0000 From: "Ashish Kalra" To: devel@edk2.groups.io Cc: dovmurik@linux.vnet.ibm.com, brijesh.singh@amd.com, tobin@ibm.com, Thomas.Lendacky@amd.com, jejb@linux.ibm.com, lersek@redhat.com, jordan.l.justen@intel.com, ard.biesheuvel@arm.com, erdemaktas@google.com, jiewen.yao@intel.com, min.m.xu@intel.com Subject: [PATCH v5 1/4] OvmfPkg/BaseMemEncryptLib: Support to issue unencrypted hypercall Date: Thu, 8 Jul 2021 14:07:56 +0000 Message-Id: <332172b262929880ef753a3bef36228115b7051a.1625687246.git.ashish.kalra@amd.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: References: X-ClientProxiedBy: SA9PR13CA0083.namprd13.prod.outlook.com (2603:10b6:806:23::28) To SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) Return-Path: Ashish.Kalra@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from ashkalra_ubuntu_server.amd.com (165.204.77.1) by SA9PR13CA0083.namprd13.prod.outlook.com (2603:10b6:806:23::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.11 via Frontend Transport; Thu, 8 Jul 2021 14:08:07 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b6a036c4-04e0-43c5-2d6b-08d94219d004 X-MS-TrafficTypeDiagnostic: SA0PR12MB4592: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: kSZ9/7akH1Yu76Bn/NGjzJ6YL6cunTqpHNbSe5NhFjKXvO4anKNghC7heD/TU+fhTB/nY2OQRryGzEU4MyX+VJPIgx8CHcXOKesZ9CwUV0DNccbrrxfn3gAH2+Fz6oJp+2Ieg3gW2QgPV8XWZyNjBhYm9S7NZJAhBInD4fVREsjA67jXMsX/dQn9Ug7Sg/yw4t7juNm81IK9L1zYS2eTslUWCYd3J72d3AuQrvwmeTRjTRsDeTgb2Y5T5PLAu/VrRcn+AUMKEJtEoyXcnLrMnWz3f+UsZpbDqlqzDg2QpbH3/LkBT5XvJfFXgcI1mUSwVWSSq9T38to95aGW7lPX+nptkoQCzxPvRbGw7gUytTFZn/Jv1o29qINP5enYWCooEmNkM1pT3W/sGdqxBvs4OKgZpaGX+//6I2CCSKbieTBNApc09X39PsEMYK5nNFd6iQmOZlLp1gi/zJy7lNgZOzRnvc8uzYmRTLv9q8GNEN550o3Y8b6koOwmnUuWLjwRTsE8P+fsYoFv4Ugw9Ztwr5E+aF8OCRKuE2F648IKwzSsR5vFG1E9/T0Tk0ZBDO0mLeECAiymZE2pGKH4pPmGnH6bI4vjVY2Fh7JIRQUX1O8YldjKb2Bvd/pc7FAAVvcOQOUWaDPwaunFOS4iDTw2cJ7pdeRIWD5EvWfUWjFJruYqLVDyJu9ihwG8L4oVsdxiK2m7YBxBQnITE8BCW80T7Q== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2767.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(396003)(376002)(136003)(346002)(39860400002)(6486002)(86362001)(7416002)(36756003)(6916009)(52116002)(316002)(7696005)(8676002)(83380400001)(2616005)(30864003)(956004)(66946007)(8936002)(26005)(478600001)(5660300002)(186003)(4326008)(66476007)(66556008)(19627235002)(6666004)(38100700002)(38350700002)(2906002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?8rc2/8hMkejyun/1n+zqKqvrRZG4hAUlK1T0Aa0EWp8Soo+aCCh9CnTvXroA?= =?us-ascii?Q?xbjO+WmV+QbuUaNdq+TGoifXXAGPQntaF33ZF/jfFFpvOYv60aLhU25emVoF?= =?us-ascii?Q?rZ8pCDu+Qu1MVygZVU6xiXWi6pyfUtttN3XLl5pQkItLJ1310yM+5stWCQ0b?= =?us-ascii?Q?azmm5fwm+yyieSYx5QVy4CWYjQI5ByDJhv3mhSy6lUAi+TUFOh0/afPKTbRv?= =?us-ascii?Q?iGXzZ8ubBruQ1NMqJ1YO995PMVQ9RRLbGmiIEDkZ4cpLO2d+ceYkqLzah6OX?= =?us-ascii?Q?3tXS1vbssrT3z857/Kv3ZAU+pBkyCtztGxd6gynKMiC0xn/RbvIliytlIfr/?= =?us-ascii?Q?PboX71c43aHr0n26AApqkJi/p9tRAcQxRdGyKYCLicVG81BPhGUBCIcEOgpY?= =?us-ascii?Q?CauVVjVHtJ5YQDPpqTzCpht7WvhMFRm6+VTCMd37PrTyD2ruBAO2+EGaEeuT?= =?us-ascii?Q?mM84r8PSr9Wy56Vjvlb3VacPnlDgN2l8B4t39lmuonOO9PeAI7tOS7LCcJIv?= =?us-ascii?Q?9IOEKHP6F9Mg5r06rFMtZsn99GSg+7nc5kMRRqso9z7wR7W36DsVDwspZGQF?= =?us-ascii?Q?9hu3m7yMKdizKQ0TBIoVgpCBffCID87CNQ9lbMHC+8Y2FmSrPhTSuKHmGyYr?= =?us-ascii?Q?Xtzl9fVapFJu3dzBrshf5IHWECz7nba4UvNqdDb6PHgFbgDW4Ovm/o6XoN57?= =?us-ascii?Q?WvaxG4gXd0uJeU9wPOmRqvH3W4+CEX1+Agc1azQnesaRewZKLZmuy1NKUYsC?= =?us-ascii?Q?LBrAjBT6lecZ0UId+fcFNYUDz/6iVckRFs2PQcRsewqA29VB0cR2Y/yhVkWG?= =?us-ascii?Q?ORbJKVO6qwx7f6nrBESxyIVmsxD5+LGZI90bw4ba53vlR/Xaby/weQmrSScD?= =?us-ascii?Q?Vr+GMFVO/r4gTXkwG58eNonsNOasJYjijZ3i/wfGUZ5HswG8ZRo0cIJUUJXx?= =?us-ascii?Q?QvoKHsrswznDLxT/eIMhretzDZjQrqhVfpKj0VCFJLuTxE6Cni+MXaATIydR?= =?us-ascii?Q?nsGzC8o4D6MAvSizgB4/kCmOGoVGcAx798ULviAKrGlLHKTZr129wpQ21mZk?= =?us-ascii?Q?JeX16kguGbjs/oufG/TqfrZny+Zcgolr70GxYnBHqx5GmWoHY7Zo0wk6SWdn?= =?us-ascii?Q?1Kusq0QR1dw3k9mD0upY24cOxZjBL0PMDx0wtbHgGxzbcdaamL2O1ktzRDis?= =?us-ascii?Q?NRncQCCW09TO82ijAV8aDbSAGNbzTcFNAdrLQ1NZhsdj+Mt/YSqsZQE0O4tG?= =?us-ascii?Q?7NWgBpNBwkHJJAeHWbW4avAfYSUkbRf8eLG08KGFrRKbN/Rg5O9ETViv0KKe?= =?us-ascii?Q?YvLZrjlSytjWGjZD5gBuSRlw?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: b6a036c4-04e0-43c5-2d6b-08d94219d004 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2767.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Jul 2021 14:08:08.3374 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: WwmhdDYr2eAiM2zwfv5ADBakdEppxXxcUh6L1r8IcoLcCPQkBtU2KdIvklyn0sb241L/SjIHQP5xfnHzzdYLeg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4592 Content-Type: text/plain From: Ashish Kalra By default all the SEV guest memory regions are considered encrypted, if a guest changes the encryption attribute of the page (e.g mark a page as decrypted) then notify hypervisor. Hypervisor will need to track the unencrypted pages. The information will be used during guest live migration, guest page migration and guest debugging. This hypercall is used to notify hypervisor when the page's encryption state changes. Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Signed-off-by: Brijesh Singh Signed-off-by: Ashish Kalra --- OvmfPkg/Include/Library/MemEncryptSevLib.h | 69 ++++++++++++++++++++ OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf | 1 + OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c | 39 +++++++++++ OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c | 27 ++++++++ OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSevLibInternal.c | 51 +++++++++++++++ OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf | 1 + OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c | 39 +++++++++++ OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c | 38 +++++++++++ OvmfPkg/Library/BaseMemEncryptSevLib/X64/AsmHelperStub.nasm | 33 ++++++++++ OvmfPkg/Library/BaseMemEncryptSevLib/X64/MemEncryptSevLib.c | 54 +++++++++++++++ OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c | 22 ++++++- 11 files changed, 373 insertions(+), 1 deletion(-) diff --git a/OvmfPkg/Include/Library/MemEncryptSevLib.h b/OvmfPkg/Include/Library/MemEncryptSevLib.h index 76d06c206c..c2b2a99a08 100644 --- a/OvmfPkg/Include/Library/MemEncryptSevLib.h +++ b/OvmfPkg/Include/Library/MemEncryptSevLib.h @@ -90,6 +90,18 @@ MemEncryptSevIsEnabled ( VOID ); +/** + Returns a boolean to indicate whether SEV live migration is enabled. + + @retval TRUE SEV live migration is enabled + @retval FALSE SEV live migration is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevLiveMigrationIsEnabled ( + VOID + ); + /** This function clears memory encryption bit for the memory region specified by BaseAddress and NumPages from the current page table context. @@ -222,4 +234,61 @@ MemEncryptSevClearMmioPageEncMask ( IN UINTN NumPages ); +/** + This hypercall is used to notify hypervisor when the page's encryption + state changes. + + @param[in] PhysicalAddress The physical address that is the start address + of a memory region. The PhysicalAddress is + expected to be PAGE_SIZE aligned. + @param[in] Pages Number of pages in memory region. + @param[in] Status Encrypted(1) or Decrypted(0). + +@retval RETURN_SUCCESS Hypercall returned success. +**/ +RETURN_STATUS +EFIAPI +SetMemoryEncDecHypercall3 ( + IN UINTN PhysicalAddress, + IN UINTN Pages, + IN UINTN Status + ); + +#define KVM_HC_MAP_GPA_RANGE 12 +#define KVM_MAP_GPA_RANGE_PAGE_SZ_4K 0 +#define KVM_MAP_GPA_RANGE_PAGE_SZ_2M BIT0 +#define KVM_MAP_GPA_RANGE_PAGE_SZ_1G BIT1 +#define KVM_MAP_GPA_RANGE_ENC_STAT(n) ((n) << 4) +#define KVM_MAP_GPA_RANGE_ENCRYPTED KVM_MAP_GPA_RANGE_ENC_STAT(1) +#define KVM_MAP_GPA_RANGE_DECRYPTED KVM_MAP_GPA_RANGE_ENC_STAT(0) + +#define KVM_FEATURE_MIGRATION_CONTROL BIT17 + +/** + Figures out if we are running inside KVM HVM and + KVM HVM supports SEV Live Migration feature. + + @retval TRUE SEV live migration is supported. + @retval FALSE SEV live migration is not supported. +**/ +BOOLEAN +EFIAPI +KvmDetectSevLiveMigrationFeature( + VOID + ); + +/** + Interface exposed by the ASM implementation of the core hypercall + + @retval Hypercall returned status. +**/ +UINTN +EFIAPI +SetMemoryEncDecHypercall3AsmStub ( + IN UINTN HypercallNum, + IN UINTN PhysicalAddress, + IN UINTN Pages, + IN UINTN Attributes + ); + #endif // _MEM_ENCRYPT_SEV_LIB_H_ diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf index f2e162d680..0c28afadee 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf @@ -38,6 +38,7 @@ X64/PeiDxeVirtualMemory.c X64/VirtualMemory.c X64/VirtualMemory.h + X64/AsmHelperStub.nasm [Sources.IA32] Ia32/MemEncryptSevLib.c diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c index 2816f859a0..ead754cd7b 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c @@ -20,6 +20,8 @@ STATIC BOOLEAN mSevStatus = FALSE; STATIC BOOLEAN mSevEsStatus = FALSE; STATIC BOOLEAN mSevStatusChecked = FALSE; +STATIC BOOLEAN mSevLiveMigrationStatus = FALSE; +STATIC BOOLEAN mSevLiveMigrationStatusChecked = FALSE; STATIC UINT64 mSevEncryptionMask = 0; STATIC BOOLEAN mSevEncryptionMaskSaved = FALSE; @@ -87,6 +89,24 @@ InternalMemEncryptSevStatus ( mSevStatusChecked = TRUE; } +/** + Figures out if we are running inside KVM HVM and + KVM HVM supports SEV Live Migration feature. +**/ +STATIC +VOID +EFIAPI +InternalDetectSevLiveMigrationFeature( + VOID + ) +{ + if (KvmDetectSevLiveMigrationFeature()) { + mSevLiveMigrationStatus = TRUE; + } + + mSevLiveMigrationStatusChecked = TRUE; +} + /** Returns a boolean to indicate whether SEV-ES is enabled. @@ -125,6 +145,25 @@ MemEncryptSevIsEnabled ( return mSevStatus; } +/** + Returns a boolean to indicate whether SEV live migration is enabled. + + @retval TRUE SEV live migration is enabled + @retval FALSE SEV live migration is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevLiveMigrationIsEnabled ( + VOID + ) +{ + if (!mSevLiveMigrationStatusChecked) { + InternalDetectSevLiveMigrationFeature (); + } + + return mSevLiveMigrationStatus; +} + /** Returns the SEV encryption mask. diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c b/OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c index be260e0d10..62392309fe 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c @@ -136,3 +136,30 @@ MemEncryptSevClearMmioPageEncMask ( // return RETURN_UNSUPPORTED; } + +/** + This hyercall is used to notify hypervisor when the page's encryption + state changes. + + @param[in] PhysicalAddress The physical address that is the start address + of a memory region. The physical address is + expected to be PAGE_SIZE aligned. + @param[in] Pages Number of Pages in the memory region. + @param[in] Status Encrypted(1) or Decrypted(0). + +@retval RETURN_SUCCESS Hypercall returned success. +**/ +RETURN_STATUS +EFIAPI +SetMemoryEncDecHypercall3 ( + IN UINTN PhysicalAddress, + IN UINTN Pages, + IN UINTN Status + ) +{ + // + // Memory encryption bit is not accessible in 32-bit mode + // + return RETURN_UNSUPPORTED; +} + diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSevLibInternal.c index b4a9f464e2..0c9f7e17ba 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSevLibInternal.c @@ -61,3 +61,54 @@ MemEncryptSevLocateInitialSmramSaveStateMapPages ( return RETURN_SUCCESS; } + +/** + Figures out if we are running inside KVM HVM and + KVM HVM supports SEV Live Migration feature. + + @retval TRUE SEV live migration is supported. + @retval FALSE SEV live migration is not supported. +**/ +BOOLEAN +EFIAPI +KvmDetectSevLiveMigrationFeature( + VOID + ) +{ + CHAR8 Signature[13]; + UINT32 mKvmLeaf; + UINT32 RegEax, RegEbx, RegEcx, RegEdx; + + Signature[12] = '\0'; + for (mKvmLeaf = 0x40000000; mKvmLeaf < 0x40010000; mKvmLeaf += 0x100) { + AsmCpuid (mKvmLeaf, + NULL, + (UINT32 *) &Signature[0], + (UINT32 *) &Signature[4], + (UINT32 *) &Signature[8]); + + if (AsciiStrCmp ((CHAR8 *) Signature, "KVMKVMKVM\0\0\0") == 0) { + DEBUG (( + DEBUG_INFO, + "%a: KVM Detected, signature = %s\n", + __FUNCTION__, + Signature + )); + + RegEax = mKvmLeaf + 1; + RegEcx = 0; + AsmCpuid (mKvmLeaf + 1, &RegEax, &RegEbx, &RegEcx, &RegEdx); + if ((RegEax & KVM_FEATURE_MIGRATION_CONTROL) != 0) { + DEBUG (( + DEBUG_INFO, + "%a: Live Migration feature supported\n", + __FUNCTION__ + )); + + return TRUE; + } + } + } + + return FALSE; +} diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf index 03a78c32df..3233ca7979 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf @@ -38,6 +38,7 @@ X64/PeiDxeVirtualMemory.c X64/VirtualMemory.c X64/VirtualMemory.h + X64/AsmHelperStub.nasm [Sources.IA32] Ia32/MemEncryptSevLib.c diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c index e2fd109d12..9db6c2ef71 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c @@ -20,6 +20,8 @@ STATIC BOOLEAN mSevStatus = FALSE; STATIC BOOLEAN mSevEsStatus = FALSE; STATIC BOOLEAN mSevStatusChecked = FALSE; +STATIC BOOLEAN mSevLiveMigrationStatus = FALSE; +STATIC BOOLEAN mSevLiveMigrationStatusChecked = FALSE; STATIC UINT64 mSevEncryptionMask = 0; STATIC BOOLEAN mSevEncryptionMaskSaved = FALSE; @@ -87,6 +89,24 @@ InternalMemEncryptSevStatus ( mSevStatusChecked = TRUE; } +/** + Figures out if we are running inside KVM HVM and + KVM HVM supports SEV Live Migration feature. +**/ +STATIC +VOID +EFIAPI +InternalDetectSevLiveMigrationFeature( + VOID + ) +{ + if (KvmDetectSevLiveMigrationFeature()) { + mSevLiveMigrationStatus = TRUE; + } + + mSevLiveMigrationStatusChecked = TRUE; +} + /** Returns a boolean to indicate whether SEV-ES is enabled. @@ -125,6 +145,25 @@ MemEncryptSevIsEnabled ( return mSevStatus; } +/** + Returns a boolean to indicate whether SEV live migration is enabled. + + @retval TRUE SEV live migration is enabled + @retval FALSE SEV live migration is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevLiveMigrationIsEnabled ( + VOID + ) +{ + if (!mSevLiveMigrationStatusChecked) { + InternalDetectSevLiveMigrationFeature (); + } + + return mSevLiveMigrationStatus; +} + /** Returns the SEV encryption mask. diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c index 56d8f3f318..b926c7b786 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c @@ -100,6 +100,44 @@ MemEncryptSevIsEnabled ( return Msr.Bits.SevBit ? TRUE : FALSE; } +/** + Interface exposed by the ASM implementation of the core hypercall + + @retval Hypercall returned status. +**/ +UINTN +EFIAPI +SetMemoryEncDecHypercall3AsmStub ( + IN UINTN HypercallNum, + IN UINTN PhysicalAddress, + IN UINTN Pages, + IN UINTN Attributes + ) +{ + // + // Not used in SEC phase. + // + return RETURN_UNSUPPORTED; +} + +/** + Returns a boolean to indicate whether SEV live migration is enabled. + + @retval TRUE SEV live migration is enabled + @retval FALSE SEV live migration is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevLiveMigrationIsEnabled ( + VOID + ) +{ + // + // Not used in SEC phase. + // + return FALSE; +} + /** Returns the SEV encryption mask. diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/AsmHelperStub.nasm b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/AsmHelperStub.nasm new file mode 100644 index 0000000000..c7c11f77f1 --- /dev/null +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/AsmHelperStub.nasm @@ -0,0 +1,33 @@ +/** @file + + ASM helper stub to invoke hypercall + + Copyright (c) 2021, AMD Incorporated. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +DEFAULT REL +SECTION .text + +; UINTN +; EFIAPI +; SetMemoryEncDecHypercall3AsmStub ( +; IN UINTN HypercallNum, +; IN UINTN Arg1, +; IN UINTN Arg2, +; IN UINTN Arg3 +; ); +global ASM_PFX(SetMemoryEncDecHypercall3AsmStub) +ASM_PFX(SetMemoryEncDecHypercall3AsmStub): + ; UEFI calling conventions require RBX to + ; be nonvolatile/callee-saved. + push rbx + mov rax, rcx ; Copy HypercallNumber to rax + mov rbx, rdx ; Copy Arg1 to the register expected by KVM + mov rcx, r8 ; Copy Arg2 to register expected by KVM + mov rdx, r9 ; Copy Arg2 to register expected by KVM + vmmcall ; Call VMMCALL + pop rbx + ret diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/MemEncryptSevLib.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/MemEncryptSevLib.c index a57e8fd37f..57447e69dc 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/MemEncryptSevLib.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/MemEncryptSevLib.c @@ -143,3 +143,57 @@ MemEncryptSevClearMmioPageEncMask ( ); } + +/** + This hyercall is used to notify hypervisor when the page's encryption + state changes. + + @param[in] PhysicalAddress The physical address that is the start address + of a memory region. The physical address is + expected to be PAGE_SIZE aligned. + @param[in] Pages Number of Pages in the memory region. + @param[in] Status Encrypted(1) or Decrypted(0). + +@retval RETURN_SUCCESS Hypercall returned success. +**/ +RETURN_STATUS +EFIAPI +SetMemoryEncDecHypercall3 ( + IN UINTN PhysicalAddress, + IN UINTN Pages, + IN UINTN Status + ) +{ + RETURN_STATUS Ret; + INTN Error; + + Ret = RETURN_UNSUPPORTED; + + if (MemEncryptSevLiveMigrationIsEnabled ()) { + Ret = EFI_SUCCESS; + // + // The encryption bit is set/clear on the smallest page size, hence + // use the 4k page size in MAP_GPA_RANGE hypercall below. + // Also, the hypercall expects the guest physical address to be + // page-aligned. + // + Error = SetMemoryEncDecHypercall3AsmStub ( + KVM_HC_MAP_GPA_RANGE, + (PhysicalAddress & (~(EFI_PAGE_SIZE-1))), + Pages, + KVM_MAP_GPA_RANGE_PAGE_SZ_4K | KVM_MAP_GPA_RANGE_ENC_STAT(Status) + ); + + if (Error != 0) { + DEBUG ((DEBUG_ERROR, + "SetMemoryEncDecHypercall3 failed, Phys = %Lx, Pages = %Ld, Err = %Ld\n", + PhysicalAddress, + Pages, + (INT64)Error)); + + Ret = RETURN_NO_MAPPING; + } + } + + return Ret; +} diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c index c696745f9d..0b1588a4c1 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c @@ -536,7 +536,6 @@ EnableReadOnlyPageWriteProtect ( AsmWriteCr0 (AsmReadCr0() | BIT16); } - /** This function either sets or clears memory encryption bit for the memory region specified by PhysicalAddress and Length from the current page table @@ -585,6 +584,9 @@ SetMemoryEncDec ( UINT64 AddressEncMask; BOOLEAN IsWpEnabled; RETURN_STATUS Status; + UINTN Size; + BOOLEAN CBitChanged; + PHYSICAL_ADDRESS OrigPhysicalAddress; // // Set PageMapLevel4Entry to suppress incorrect compiler/analyzer warnings. @@ -636,6 +638,10 @@ SetMemoryEncDec ( Status = EFI_SUCCESS; + Size = Length; + CBitChanged = FALSE; + OrigPhysicalAddress = PhysicalAddress; + while (Length != 0) { // @@ -695,6 +701,7 @@ SetMemoryEncDec ( )); PhysicalAddress += BIT30; Length -= BIT30; + CBitChanged = TRUE; } else { // // We must split the page @@ -749,6 +756,7 @@ SetMemoryEncDec ( SetOrClearCBit (&PageDirectory2MEntry->Uint64, Mode); PhysicalAddress += BIT21; Length -= BIT21; + CBitChanged = TRUE; } else { // // We must split up this page into 4K pages @@ -791,6 +799,7 @@ SetMemoryEncDec ( SetOrClearCBit (&PageTableEntry->Uint64, Mode); PhysicalAddress += EFI_PAGE_SIZE; Length -= EFI_PAGE_SIZE; + CBitChanged = TRUE; } } } @@ -808,6 +817,17 @@ SetMemoryEncDec ( // CpuFlushTlb(); + // + // Notify Hypervisor on C-bit status + // + if (CBitChanged) { + Status = SetMemoryEncDecHypercall3 ( + OrigPhysicalAddress, + EFI_SIZE_TO_PAGES(Size), + !Mode + ); + } + Done: // // Restore page table write protection, if any. -- 2.17.1