public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Ashish Kalra" <ashish.kalra@amd.com>
To: devel@edk2.groups.io
Cc: dovmurik@linux.vnet.ibm.com, brijesh.singh@amd.com,
	tobin@ibm.com, Thomas.Lendacky@amd.com, jejb@linux.ibm.com,
	lersek@redhat.com, jordan.l.justen@intel.com,
	ard.biesheuvel@arm.com, erdemaktas@google.com,
	jiewen.yao@intel.com, min.m.xu@intel.com
Subject: [PATCH v5 0/4] SEV Live Migration support for OVMF.
Date: Thu,  8 Jul 2021 14:07:12 +0000	[thread overview]
Message-ID: <cover.1625687246.git.ashish.kalra@amd.com> (raw)

From: Ashish Kalra <ashish.kalra@amd.com>

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3467

By default all the SEV guest memory regions are considered encrypted,
if a guest changes the encryption attribute of the page (e.g mark a
page as decrypted) then notify hypervisor. Hypervisor will need to
track the unencrypted pages. The information will be used during
guest live migration, guest page migration and guest debugging.

The patch-set detects if it is running under KVM hypervisor and then
checks for SEV live migration feature support via KVM_FEATURE_CPUID,
if detected setup a new UEFI enviroment variable to indicate OVMF
support for SEV live migration.

A branch containing these patches is available here:
https://github.com/ashkalra/edk2-1/tree/sev_live_migration_v5_7

Changes since v4:
 - Remove MemEncryptHypercallLib Library and add support to issue
   hypercall in the BaseMemEncryptSevLib library itself.
 - For SEV-ES, make the VC handler hypercall aware by comparing
   the hypercall number and add the additional register values
   in the GHCB.
 - Fix comments in the hypercall API interface.
 - The encryption bit is set/clear on the smallest page size, hence
   use the 4k page size in MAP_GPA_RANGE hypercall.
 - Make the hypercall expect the guest physical address to be
   page-aligned.
 - Add KVM live migration feature flag check in BaseMemEncryptSevLib
   library similar to how BaseMemEncryptSevLib does for the
   MemEncryptSevIsEnabled() and check it before invoking HC. Also
   export the MemEncryptSevLiveMigrationIsEnabled() function as 
   part of the library.
 - Add error handling on hypercall return, on failure, return error
   code to caller which potentially will cause an assert() and
   terminate the boot.
 
Changes since v3:
 - Fix all DSC files under OvmfPkg except X64 to add support for 
   BaseMemEncryptLib and add NULL instance of BaseMemEncryptLib
   for 32 bit platforms.
 - Add the MemEncryptHypercallLib-related files to Maintainers.txt,
   in section "OvmfPkg: Confidential Computing".
 - Add support for the new KVM_HC_MAP_GPA_RANGE hypercall interface.
 - Add patch for SEV live migration support.

Changes since v2:
 - GHCB_BASE setup during reset-vector as decrypted is marked explicitly
   in the hypervisor page encryption bitmap after setting the 
   PcdSevEsIsEnabled PCD.

Changes since v1:
 - Mark GHCB_BASE setup during reset-vector as decrypted explicitly in
   the hypervisor page encryption bitmap.
 - Resending the series with correct shallow threading.


Ashish Kalra (4):
  OvmfPkg/BaseMemEncryptLib: Support to issue unencrypted hypercall
  OvmfPkg/VmgExitLib: Add support for hypercalls with SEV-ES.
  OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall
  OvmfPkg/AmdSevDxe: Add support for SEV live migration.

 OvmfPkg/AmdSevDxe/AmdSevDxe.c                 | 59 ++++++++++++++++
 OvmfPkg/AmdSevDxe/AmdSevDxe.inf               |  4 ++
 OvmfPkg/Include/Guid/MemEncryptLib.h          | 20 ++++++
 OvmfPkg/Include/Library/MemEncryptSevLib.h    | 69 +++++++++++++++++++
 .../DxeMemEncryptSevLib.inf                   |  1 +
 .../DxeMemEncryptSevLibInternal.c             | 39 +++++++++++
 .../Ia32/MemEncryptSevLib.c                   | 27 ++++++++
 .../PeiDxeMemEncryptSevLibInternal.c          | 51 ++++++++++++++
 .../PeiMemEncryptSevLib.inf                   |  1 +
 .../PeiMemEncryptSevLibInternal.c             | 39 +++++++++++
 .../SecMemEncryptSevLibInternal.c             | 38 ++++++++++
 .../X64/AsmHelperStub.nasm                    | 33 +++++++++
 .../X64/MemEncryptSevLib.c                    | 54 +++++++++++++++
 .../X64/PeiDxeVirtualMemory.c                 | 22 +++++-
 OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c |  9 +++
 OvmfPkg/OvmfPkg.dec                           |  1 +
 OvmfPkg/PlatformPei/AmdSev.c                  |  9 +++
 17 files changed, 475 insertions(+), 1 deletion(-)
 create mode 100644 OvmfPkg/Include/Guid/MemEncryptLib.h
 create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/AsmHelperStub.nasm

-- 
2.17.1


             reply	other threads:[~2021-07-08 14:07 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-08 14:07 Ashish Kalra [this message]
2021-07-08 14:07 ` [PATCH v5 1/4] OvmfPkg/BaseMemEncryptLib: Support to issue unencrypted hypercall Ashish Kalra
2021-07-15 20:58   ` Dov Murik
2021-07-16 12:29     ` Ashish Kalra
2021-07-19  8:04       ` Dov Murik
2021-07-19 15:30         ` Ashish Kalra
2021-07-16 14:11   ` Lendacky, Thomas
2021-07-19 20:24     ` Ashish Kalra
2021-07-08 14:08 ` [PATCH v5 2/4] OvmfPkg/VmgExitLib: Add support for hypercalls with SEV-ES Ashish Kalra
2021-07-16 14:16   ` Lendacky, Thomas
2021-07-19 20:25     ` Ashish Kalra
2021-07-08 14:08 ` [PATCH v5 3/4] OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall Ashish Kalra
2021-07-16 14:22   ` Lendacky, Thomas
2021-07-19 20:27     ` Ashish Kalra
2021-07-08 14:09 ` [PATCH v5 4/4] OvmfPkg/AmdSevDxe: Add support for SEV live migration Ashish Kalra
2021-07-19  7:31   ` Dov Murik
2021-07-19 15:22     ` Ashish Kalra

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=cover.1625687246.git.ashish.kalra@amd.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox