From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) by mx.groups.io with SMTP id smtpd.web11.10409.1624466574147947845 for ; Wed, 23 Jun 2021 09:42:54 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=GsjjLmr6; spf=pass (domain: redhat.com, ip: 216.205.24.124, mailfrom: lersek@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1624466573; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Ap+E2c0rp1N8Zz7NJuNQiJLnrwqJMAwlA4Z4NieZn1Y=; b=GsjjLmr64UQgQZmOwqGAhCuYWJNplIV0QQgObTFeLYK7CkpJH4emQ9w0JQaklOftuGxhGE O9xwHVuZ+lzccYv6/B6uZrxlpDxAFVXW5x5iJ9ysA08wZ58kvKFjAwZqvNiPsQpUFy2JjT jKj0McBvo6L5iBzKBthanMFbL1Rh1rM= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-539-mef-tnhZM-2DHeIUwbSrkA-1; Wed, 23 Jun 2021 12:42:50 -0400 X-MC-Unique: mef-tnhZM-2DHeIUwbSrkA-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 397A0100CF6E; Wed, 23 Jun 2021 16:42:48 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-112-200.ams2.redhat.com [10.36.112.200]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 74D1F5C1A1; Wed, 23 Jun 2021 16:42:44 +0000 (UTC) Subject: Re: [PATCH v4 0/4] SEV Live Migration support for OVMF. To: Ashish Kalra Cc: devel@edk2.groups.io, brijesh.singh@amd.com, Thomas.Lendacky@amd.com, jejb@linux.ibm.com, erdemaktas@google.com, jiewen.yao@intel.com, min.m.xu@intel.com, jordan.l.justen@intel.com, ard.biesheuvel@arm.com, "Dr. David Alan Gilbert" , Paolo Bonzini References: <20210622174603.GA6366@ashkalra_ubuntu_server> From: "Laszlo Ersek" Message-ID: <8d695e5b-a508-27b8-3a1f-dc1317be8d4f@redhat.com> Date: Wed, 23 Jun 2021 18:42:42 +0200 MIME-Version: 1.0 In-Reply-To: <20210622174603.GA6366@ashkalra_ubuntu_server> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=lersek@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit On 06/22/21 19:46, Ashish Kalra wrote: > Hello Laszlo, > > Please see my replies below : > > On Tue, Jun 22, 2021 at 07:20:53PM +0200, Laszlo Ersek wrote: >> Hi Ashish, >> >> (+Dave, +Paolo) >> >> On 06/21/21 15:56, Ashish Kalra wrote: >>> From: Ashish Kalra >>> >>> By default all the SEV guest memory regions are considered encrypted, >>> if a guest changes the encryption attribute of the page (e.g mark a >>> page as decrypted) then notify hypervisor. Hypervisor will need to >>> track the unencrypted pages. The information will be used during >>> guest live migration, guest page migration and guest debugging. >>> >>> The patch-set adds a new SEV and SEV-ES hypercall abstraction >>> library to support SEV Page encryption/decryption status hypercalls >>> for SEV and SEV-ES guests. >>> >>> BaseMemEncryptSevLib invokes hypercalls via this new hypercall library. >>> >>> The patch-set detects if it is running under KVM hypervisor and then >>> checks for SEV live migration feature support via KVM_FEATURE_CPUID, >>> if detected setup a new UEFI enviroment variable to indicate OVMF >>> support for SEV live migration. >>> >>> A branch containing these patches is available here: >>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fashkalra%2Fedk2%2Ftree%2Fsev_live_migration_v4&data=04%7C01%7Cashish.kalra%40amd.com%7Ca402470f4cba428feaac08d935a21c79%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637599792647899814%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=41Jj%2BGNUyEL43UhZgI19iwGcOJcP%2FWg94D8fTopaZxQ%3D&reserved=0 >>> >>> Changes since v3: >>> - Fix all DSC files under OvmfPkg except X64 to add support for >>> BaseMemEncryptLib and add NULL instance of BaseMemEncryptLib >>> for 32 bit platforms. >>> - Add the MemEncryptHypercallLib-related files to Maintainers.txt, >>> in section "OvmfPkg: Confidential Computing". >>> - Add support for the new KVM_HC_MAP_GPA_RANGE hypercall interface. >>> - Add patch for SEV live migration support. >> >> I have absolutely zero context in my mind about this work. >> >> By v1 / v2 / v3, are you referring to the following patch series (from December 2020): >> >> - [PATCH v1 0/2] SEV Page Encryption Bitmap support for OVMF. >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flistman.redhat.com%2Farchives%2Fedk2-devel-archive%2F2020-December%2Fmsg00081.html&data=04%7C01%7Cashish.kalra%40amd.com%7Ca402470f4cba428feaac08d935a21c79%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637599792647899814%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=cVUvWe6VgjR78OAk5LXgBQiKon4Gp%2F62a2hc%2FKwoLw4%3D&reserved=0 >> >> - [PATCH v2 0/3] SEV Page Encryption Bitmap support for OVMF. >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flistman.redhat.com%2Farchives%2Fedk2-devel-archive%2F2020-December%2Fmsg00198.html&data=04%7C01%7Cashish.kalra%40amd.com%7Ca402470f4cba428feaac08d935a21c79%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637599792647899814%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=IXLGA2ttyxdVoC63HeCkPVNuUMH3u5Vd3U1fc6c8LQc%3D&reserved=0 >> >> - [PATCH v3 0/3] SEV Page Encryption Bitmap support for OVMF. >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flistman.redhat.com%2Farchives%2Fedk2-devel-archive%2F2020-December%2Fmsg00202.html&data=04%7C01%7Cashish.kalra%40amd.com%7Ca402470f4cba428feaac08d935a21c79%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637599792647899814%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=cOJBqGyM3a7xMbfhbBAh3IEm7IBJFOGu2ReQMSFJ%2BDw%3D&reserved=0 >> > > Yes, actually the guest kernel API for SEV live migration was not > decided at the time of the last patch-set submission, hence, i am now > submitting this patch-set as the guest kernel API has been discussed and > closed and the corresponding KVM/kernel patches have been queued now. > > And therefore, this is simply not the SEV Page Encryption Bitmap support > anymore, but the SEV live migration support which includes the guest page > encryption status tracking. > >> We certainly need a new TianoCore BZ for tracking this feature; I only found the above patch set versions because I have full text search for my complete email traffic on my laptop. Sending v4 after half a year hiatus is like sending it in the next century. :) >> > > Ok. > > As i mentioned above it took such a long time to re-submit the > patch-set because of the guest kernel API discussions taking some > time and getting closed. > >> Anyway, where I'm particularly lost is that I (very vaguely) recall conflicting approaches from AMD and IBM on migration. Has an agreement been reached there? >> > > Yes, these are the slow SEV live migration patches. The fast migration > support is being developed by IBM and that is a separate effort. > > As this slow live migration support has now been included in KVM, we > will need the corresponding OVMF and QEMU support now. > >> I certainly apologize for missing the context here; had someone asked me if I had seen any version of this patch set before, I would have *sworn* that I hadn't. >> >> I'm basically incapable of tracking this volume of development around confidential computing; sorry. >> >> > > Please find below your reply on v3 of this patch-set : > > Please include such a patch in v4 -- if Tom and Brijesh agree, I'd like to put the new lib explicitly under their reviewership. > > Also, I plan to review this series (v4, at this point) only for formalities. I'd like to receive an R-b from Tom or Brijesh [*], and another from Dov or a colleague at IBM, for this series; those together should suffice for merging the library. > > So, if you are fine with this approach, then probably Tom or Brijesh can > take these patches under their reviewership and provide their R-b for > this patch-set to be accepted and merged. Indeed. This helps. Thanks. I'll keep this patch set in my review queue then, for said "formalities review". Thanks. Laszlo > > I believe that they are anyway the maintainers for confidential computing related stuff. > > Thanks, > Ashish > >>> >>> Changes since v2: >>> - GHCB_BASE setup during reset-vector as decrypted is marked explicitly >>> in the hypervisor page encryption bitmap after setting the >>> PcdSevEsIsEnabled PCD. >>> >>> Changes since v1: >>> - Mark GHCB_BASE setup during reset-vector as decrypted explicitly in >>> the hypervisor page encryption bitmap. >>> - Resending the series with correct shallow threading. >>> >>> Ashish Kalra (3): >>> OvmfPkg/MemEncryptHypercallLib: add library to support SEV hypercalls. >>> OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall >>> OvmfPkg/PlatformDxe: Add support for SEV live migration. >>> >>> Brijesh Singh (1): >>> OvmfPkg/BaseMemEncryptLib: Support to issue unencrypted hypercall >>> >>> Maintainers.txt | 2 + >>> OvmfPkg/Include/Guid/MemEncryptLib.h | 20 ++++ >>> .../Include/Library/MemEncryptHypercallLib.h | 43 +++++++ >>> .../DxeMemEncryptSevLib.inf | 1 + >>> .../PeiMemEncryptSevLib.inf | 1 + >>> .../X64/PeiDxeVirtualMemory.c | 22 ++++ >>> .../Ia32/MemEncryptHypercallLib.c | 37 ++++++ >>> .../MemEncryptHypercallLib.inf | 42 +++++++ >>> .../X64/AsmHelperStub.nasm | 28 +++++ >>> .../X64/MemEncryptHypercallLib.c | 105 +++++++++++++++++ >>> OvmfPkg/OvmfPkg.dec | 1 + >>> OvmfPkg/OvmfPkgIa32.dsc | 1 + >>> OvmfPkg/OvmfPkgIa32X64.dsc | 1 + >>> OvmfPkg/OvmfPkgX64.dsc | 1 + >>> OvmfPkg/OvmfXen.dsc | 1 + >>> OvmfPkg/PlatformDxe/AmdSev.c | 108 ++++++++++++++++++ >>> OvmfPkg/PlatformDxe/Platform.c | 5 + >>> OvmfPkg/PlatformDxe/Platform.inf | 2 + >>> OvmfPkg/PlatformDxe/PlatformConfig.h | 5 + >>> OvmfPkg/PlatformPei/AmdSev.c | 10 ++ >>> 20 files changed, 436 insertions(+) >>> create mode 100644 OvmfPkg/Include/Guid/MemEncryptLib.h >>> create mode 100644 OvmfPkg/Include/Library/MemEncryptHypercallLib.h >>> create mode 100644 OvmfPkg/Library/MemEncryptHypercallLib/Ia32/MemEncryptHypercallLib.c >>> create mode 100644 OvmfPkg/Library/MemEncryptHypercallLib/MemEncryptHypercallLib.inf >>> create mode 100644 OvmfPkg/Library/MemEncryptHypercallLib/X64/AsmHelperStub.nasm >>> create mode 100644 OvmfPkg/Library/MemEncryptHypercallLib/X64/MemEncryptHypercallLib.c >>> create mode 100644 OvmfPkg/PlatformDxe/AmdSev.c >>> >> >