From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM12-MW2-obe.outbound.protection.outlook.com (NAM12-MW2-obe.outbound.protection.outlook.com [40.107.244.71]) by mx.groups.io with SMTP id smtpd.web09.43.1649179703539839223 for ; Tue, 05 Apr 2022 10:28:23 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="body hash did not verify" header.i=@amd.com header.s=selector1 header.b=3uE9wL26; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.244.71, mailfrom: ashish.kalra@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=gXyt92vlpU3C7De1yl9cVP8E1GS8OMWVBAVgeLZUqhAabTpnPSMjnI7Fe2i2r4HrRB54in95kqoXnDWaDLK3vWKu4saiVKdA/bWg2qLMM2m4JgERJD3MGQlqz6pZxmLVyq/dr6Mh2rPeyesR8bCTLQyT49axa+bw8bIXVayAy5XB0DMr0/4phEyeclZ9smi2GlmA0RqVXYVOfbMg6t25FfNs//HqPd9NVk8fY5Rm/KPKOi+0EeXllnW3xQb4xL6wkKzY09ndXfPNGtHyHt7GUdhLYt7AnMglWKE0EwBLdGvWFlCZaYWhAwsW1FtiekpaJ4LrOhG51eeJaGgFCQTamw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=0y7mIfwbtEWs+9Qr5fXEIRL86Q95o9DuUyK+WUxRYwI=; b=mNdq9wFu8hSzjE/inLVnnl2QYYg963Ht3x9PpmMJyxILkn4T3nYB2EGtewj99dBFPCkUQcK+jY2IvSXMS4zks/69aTPDsQ0aExNWtUe0FNISeWwAt9LioMGPSPsPvFoL5rUQnJvTqibn+8Jg9YPdd3qAaCQ693G2ZMe6r0745Q1vgtdh8OGYEjZTFwyUMSDPd3KTgiuK71D2rGX2j2dka7Q0T/rr1Yrqrfi86Zlze91VCln28Q4eXt/nvIwKiVX/+35CvrNYAY1uWB17PNxPKrc9KDMeOrbWp6l0q8Ww53+zacUm31U5Aq0jAO7zNk4YXfCjfiwM7GPegkqfooBnvw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=0y7mIfwbtEWs+9Qr5fXEIRL86Q95o9DuUyK+WUxRYwI=; b=3uE9wL265GshnP321iVjVxpXx4NAE/sViNrxjWR6soxq5XADijuBoTBq2jSTDuXuH8Dl5vh8z8vvV4vJQmhKBKuojdKw0qK4JDRFtRHyaD02UVtF3/1Kouj4oyVNQewBw9tNp5+yUv5GKCsGlXR3IER3qz+vMXO2316DpI83TEg= Received: from BN9PR03CA0749.namprd03.prod.outlook.com (2603:10b6:408:110::34) by CY4PR12MB1144.namprd12.prod.outlook.com (2603:10b6:903:3f::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.31; Tue, 5 Apr 2022 17:28:17 +0000 Received: from BN8NAM11FT016.eop-nam11.prod.protection.outlook.com (2603:10b6:408:110:cafe::80) by BN9PR03CA0749.outlook.office365.com (2603:10b6:408:110::34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.31 via Frontend Transport; Tue, 5 Apr 2022 17:28:17 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; Received: from SATLEXMB04.amd.com (165.204.84.17) by BN8NAM11FT016.mail.protection.outlook.com (10.13.176.97) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.5144.20 via Frontend Transport; Tue, 5 Apr 2022 17:28:16 +0000 Received: from ashkalraubuntuserver.amd.com (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 5 Apr 2022 12:28:15 -0500 From: "Ashish Kalra" To: CC: , , , , , , , , Subject: [PATCH v8 0/6] SEV Live Migration support for OVMF. Date: Tue, 5 Apr 2022 17:28:06 +0000 Message-ID: X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Return-Path: Ashish.Kalra@amd.com X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: f09b8065-3128-4a74-1831-08da1729abd6 X-MS-TrafficTypeDiagnostic: CY4PR12MB1144:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: z86dvz2KEQXi+kOhuVCweBw29osE92lPlpbs1qt2pJtN+CTG3k2ibIGrMMuQZPDCzH9cAmfjgF9lSLWocJgK95IpmGZ+KgPH5s292ZAPhgOaNrJqEqACVCPoayN/hdUUlowEXPjTOYpqp2tIeKMF5LtMLhIG0CPb6aE1dDKO8DOOzjS9ilPUPo7mBdNNIWDE6tglQmQW56FRiNs02vkL/pqOK86Fv0Rnt0EIeb29R2m/HE8UYX3c9bfMdqrK1NRTU9i5Fa5Phcc0dy67IMoukKRSaDkO57+UqLF/JeTgPf2uJYIxPAcIGj9kTybEtqTD18B+xNhtdM2N+r3jRz0RibV3vA8klW2SwPos5k1B61zlsedeVsJSNxA8RaEz6v+LE2Ck9TtoLcG/gBtdg7oI3yCtUKCHu07BJSNiGS0JTDw4IuDa9N4w/eGUBUoCMMmuELCXsZHeicN2SQwBIWuWK7dFosEbkvLHTOI3yEKRNNevAOHbMlhklFmKpFE7GPEUcuPFWmdH6kjhp5C41BMHQScDsvvpZopxwjaCWWhcY0LqyvLdnjo3csEZlUBt14AcPTTHehqoxJPHOIajsI60tNZzHoGTH4/G+CTX7z2X9ZK+OULVuWg0SBzEBgiOU2MOGx38qJeZjzrvrm/BlAX6SkPXLWD217WyT267Pyao409sV7sayynli5XhDPZpDAjwrpTl3bGQv17qiSrwx+T+hNyL0LjHUGJqO4XSz+T5jDUdj+HMGtAIwz5i77+B+aDx+H1oY+OdnkUCrU+v+mPgrgppncHGUcVYfnCeW/nJPSc= X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:SATLEXMB04.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230001)(4636009)(40470700004)(46966006)(36840700001)(186003)(16526019)(2616005)(6666004)(6916009)(26005)(82310400005)(19627235002)(316002)(966005)(508600001)(81166007)(336012)(54906003)(356005)(40460700003)(7696005)(8676002)(86362001)(426003)(47076005)(36860700001)(83380400001)(4326008)(2906002)(36756003)(5660300002)(70586007)(70206006)(8936002)(36900700001);DIR:OUT;SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Apr 2022 17:28:16.9598 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f09b8065-3128-4a74-1831-08da1729abd6 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT016.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR12MB1144 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain From: Ashish Kalra BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3467 By default all the SEV guest memory regions are considered encrypted, if a guest changes the encryption attribute of the page (e.g mark a page as decrypted) then notify hypervisor. Hypervisor will need to track the unencrypted pages. The information will be used during guest live migration, guest page migration and guest debugging. The patch-set detects if it is running under KVM hypervisor and then checks for SEV live migration feature support via KVM_FEATURE_CPUID, if detected setup a new UEFI enviroment variable to indicate OVMF support for SEV live migration. This environment variable is created by UEFI but consumed by the (guest) linux kernel. This is actually part of a 3-way negotiation of the live migration feature between hypervisor, guest OVMF and guest kernel. Host indicates support for live migration, which is detected by OVMF and correspondingly OVMF sets this SetLiveMigrationEnabled UEFI variable, which is read by the guest kernel and it indicates to the guest kernel that both host and OVMF support and have enabled the live migration feature. A branch containing these patches is available here: https://github.com/ashkalra/edk2-1/tree/sev_live_migration_v5_23 Changes since v7: - Rebase to master Changes since v6: - Move KvmDetectSevLiveMigrationFeature() function in a new header file PeiDxeMemEncryptSevLibInternal.h as this function is only used internally. - Code Style fixes. - More descriptive comments for use of SetLiveMigrationEnabled UEFI variable. Changes since v5: - Split first patch into three components, one patch for the MemEncryptSevLiveMigrationIsEnabled() API, one patch for the SetMemoryEncDecHypercall3() API, one patch to make use of the SetMemoryEncDecHypercall3() API.=20 - Fix patch subject, in code and patch comments and=20 additionally add relevant comments. - Replace SetMemoryEncDecHypercall3() API's Status argument with a boolean IsEncrypted argument and corresponding fixes to users of this API call. - Fix AsciiStrCmp() usage in KVM hypervisor detection code. Changes since v4: - Remove MemEncryptHypercallLib Library and add support to issue hypercall in the BaseMemEncryptSevLib library itself. - For SEV-ES, make the VC handler hypercall aware by comparing the hypercall number and add the additional register values in the GHCB. - Fix comments in the hypercall API interface. - The encryption bit is set/clear on the smallest page size, hence use the 4k page size in MAP_GPA_RANGE hypercall. - Make the hypercall expect the guest physical address to be page-aligned. - Add KVM live migration feature flag check in BaseMemEncryptSevLib library similar to how BaseMemEncryptSevLib does for the MemEncryptSevIsEnabled() and check it before invoking HC. Also export the MemEncryptSevLiveMigrationIsEnabled() function as=20 part of the library. - Add error handling on hypercall return, on failure, return error code to caller which potentially will cause an assert() and terminate the boot. =20 Changes since v3: - Fix all DSC files under OvmfPkg except X64 to add support for=20 BaseMemEncryptLib and add NULL instance of BaseMemEncryptLib for 32 bit platforms. - Add the MemEncryptHypercallLib-related files to Maintainers.txt, in section "OvmfPkg: Confidential Computing". - Add support for the new KVM_HC_MAP_GPA_RANGE hypercall interface. - Add patch for SEV live migration support. Changes since v2: - GHCB_BASE setup during reset-vector as decrypted is marked explicitly in the hypervisor page encryption bitmap after setting the=20 PcdSevEsIsEnabled PCD. Changes since v1: - Mark GHCB_BASE setup during reset-vector as decrypted explicitly in the hypervisor page encryption bitmap. - Resending the series with correct shallow threading. Ashish Kalra (6): OvmfPkg/BaseMemEncryptLib: Detect SEV live migration feature. OvmfPkg/BaseMemEncryptLib: Hypercall API for page encryption state change OvmfPkg/BaseMemEncryptLib: Invoke page encryption state change hypercall OvmfPkg/VmgExitLib: Encryption state change hypercall support in VC handler OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall OvmfPkg/AmdSevDxe: Add support for SEV live migration. OvmfPkg/AmdSevDxe/AmdSevDxe.c | 67 +++++++++++++++++++ OvmfPkg/AmdSevDxe/AmdSevDxe.inf | 4 ++ OvmfPkg/Include/Guid/AmdSevMemEncryptLib.h | 20 ++++++ OvmfPkg/Include/Library/MemEncryptSevLib.h | 64 ++++++++++++++++++ .../DxeMemEncryptSevLib.inf | 1 + .../DxeMemEncryptSevLibInternal.c | 49 ++++++++++++-- .../Ia32/MemEncryptSevLib.c | 27 ++++++++ .../PeiDxeMemEncryptSevLibInternal.c | 58 ++++++++++++++++ .../PeiDxeMemEncryptSevLibInternal.h | 31 +++++++++ .../PeiMemEncryptSevLib.inf | 1 + .../PeiMemEncryptSevLibInternal.c | 42 ++++++++++++ .../SecMemEncryptSevLibInternal.c | 38 +++++++++++ .../X64/AsmHelperStub.nasm | 33 +++++++++ .../X64/MemEncryptSevLib.c | 66 ++++++++++++++++++ .../X64/PeiDxeVirtualMemory.c | 16 +++++ OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 13 ++++ OvmfPkg/OvmfPkg.dec | 1 + OvmfPkg/PlatformPei/AmdSev.c | 11 +++ 18 files changed, 538 insertions(+), 4 deletions(-) create mode 100644 OvmfPkg/Include/Guid/AmdSevMemEncryptLib.h create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSe= vLibInternal.h create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/AsmHelperStub.= nasm --=20 2.25.1