From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.groups.io with SMTP id smtpd.web08.32.1624382463618079185 for ; Tue, 22 Jun 2021 10:21:03 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=hdl4mBO5; spf=pass (domain: redhat.com, ip: 170.10.133.124, mailfrom: lersek@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1624382462; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=qU5cd72e0rMSMEIMmOIvv24jRNYZdYbaUo3f1kkMlGg=; b=hdl4mBO5xWAacIyCPP7txcq7Pl7v6PJ3BRkBfhtQAjr7bPKyFhTIdkz24enyVeQFXxeIct ti5SY6CN2jRVew4RfkNW3OVPr+I3CA+QmXAi+nhiW6ybD2xr3F0hr+Md/JP1dTZjbWcDFt PhapI9PXNE3ANFZKWQL7UxzsrePARqk= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-534-xha_JNAqOFq4BOPur9S4rQ-1; Tue, 22 Jun 2021 13:20:59 -0400 X-MC-Unique: xha_JNAqOFq4BOPur9S4rQ-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id BF3E8BBEE3; Tue, 22 Jun 2021 17:20:57 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-115-52.ams2.redhat.com [10.36.115.52]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 1494F19D7C; Tue, 22 Jun 2021 17:20:54 +0000 (UTC) Subject: Re: [PATCH v4 0/4] SEV Live Migration support for OVMF. To: Ashish Kalra , devel@edk2.groups.io Cc: brijesh.singh@amd.com, Thomas.Lendacky@amd.com, jejb@linux.ibm.com, erdemaktas@google.com, jiewen.yao@intel.com, min.m.xu@intel.com, jordan.l.justen@intel.com, ard.biesheuvel@arm.com, "Dr. David Alan Gilbert" , Paolo Bonzini References: From: "Laszlo Ersek" Message-ID: Date: Tue, 22 Jun 2021 19:20:53 +0200 MIME-Version: 1.0 In-Reply-To: X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=lersek@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Hi Ashish, (+Dave, +Paolo) On 06/21/21 15:56, Ashish Kalra wrote: > From: Ashish Kalra > > By default all the SEV guest memory regions are considered encrypted, > if a guest changes the encryption attribute of the page (e.g mark a > page as decrypted) then notify hypervisor. Hypervisor will need to > track the unencrypted pages. The information will be used during > guest live migration, guest page migration and guest debugging. > > The patch-set adds a new SEV and SEV-ES hypercall abstraction > library to support SEV Page encryption/decryption status hypercalls > for SEV and SEV-ES guests. > > BaseMemEncryptSevLib invokes hypercalls via this new hypercall library. > > The patch-set detects if it is running under KVM hypervisor and then > checks for SEV live migration feature support via KVM_FEATURE_CPUID, > if detected setup a new UEFI enviroment variable to indicate OVMF > support for SEV live migration. > > A branch containing these patches is available here: > https://github.com/ashkalra/edk2/tree/sev_live_migration_v4 > > Changes since v3: > - Fix all DSC files under OvmfPkg except X64 to add support for > BaseMemEncryptLib and add NULL instance of BaseMemEncryptLib > for 32 bit platforms. > - Add the MemEncryptHypercallLib-related files to Maintainers.txt, > in section "OvmfPkg: Confidential Computing". > - Add support for the new KVM_HC_MAP_GPA_RANGE hypercall interface. > - Add patch for SEV live migration support. I have absolutely zero context in my mind about this work. By v1 / v2 / v3, are you referring to the following patch series (from December 2020): - [PATCH v1 0/2] SEV Page Encryption Bitmap support for OVMF. https://listman.redhat.com/archives/edk2-devel-archive/2020-December/msg00081.html - [PATCH v2 0/3] SEV Page Encryption Bitmap support for OVMF. https://listman.redhat.com/archives/edk2-devel-archive/2020-December/msg00198.html - [PATCH v3 0/3] SEV Page Encryption Bitmap support for OVMF. https://listman.redhat.com/archives/edk2-devel-archive/2020-December/msg00202.html We certainly need a new TianoCore BZ for tracking this feature; I only found the above patch set versions because I have full text search for my complete email traffic on my laptop. Sending v4 after half a year hiatus is like sending it in the next century. :) Anyway, where I'm particularly lost is that I (very vaguely) recall conflicting approaches from AMD and IBM on migration. Has an agreement been reached there? I certainly apologize for missing the context here; had someone asked me if I had seen any version of this patch set before, I would have *sworn* that I hadn't. I'm basically incapable of tracking this volume of development around confidential computing; sorry. Laszlo > > Changes since v2: > - GHCB_BASE setup during reset-vector as decrypted is marked explicitly > in the hypervisor page encryption bitmap after setting the > PcdSevEsIsEnabled PCD. > > Changes since v1: > - Mark GHCB_BASE setup during reset-vector as decrypted explicitly in > the hypervisor page encryption bitmap. > - Resending the series with correct shallow threading. > > Ashish Kalra (3): > OvmfPkg/MemEncryptHypercallLib: add library to support SEV hypercalls. > OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall > OvmfPkg/PlatformDxe: Add support for SEV live migration. > > Brijesh Singh (1): > OvmfPkg/BaseMemEncryptLib: Support to issue unencrypted hypercall > > Maintainers.txt | 2 + > OvmfPkg/Include/Guid/MemEncryptLib.h | 20 ++++ > .../Include/Library/MemEncryptHypercallLib.h | 43 +++++++ > .../DxeMemEncryptSevLib.inf | 1 + > .../PeiMemEncryptSevLib.inf | 1 + > .../X64/PeiDxeVirtualMemory.c | 22 ++++ > .../Ia32/MemEncryptHypercallLib.c | 37 ++++++ > .../MemEncryptHypercallLib.inf | 42 +++++++ > .../X64/AsmHelperStub.nasm | 28 +++++ > .../X64/MemEncryptHypercallLib.c | 105 +++++++++++++++++ > OvmfPkg/OvmfPkg.dec | 1 + > OvmfPkg/OvmfPkgIa32.dsc | 1 + > OvmfPkg/OvmfPkgIa32X64.dsc | 1 + > OvmfPkg/OvmfPkgX64.dsc | 1 + > OvmfPkg/OvmfXen.dsc | 1 + > OvmfPkg/PlatformDxe/AmdSev.c | 108 ++++++++++++++++++ > OvmfPkg/PlatformDxe/Platform.c | 5 + > OvmfPkg/PlatformDxe/Platform.inf | 2 + > OvmfPkg/PlatformDxe/PlatformConfig.h | 5 + > OvmfPkg/PlatformPei/AmdSev.c | 10 ++ > 20 files changed, 436 insertions(+) > create mode 100644 OvmfPkg/Include/Guid/MemEncryptLib.h > create mode 100644 OvmfPkg/Include/Library/MemEncryptHypercallLib.h > create mode 100644 OvmfPkg/Library/MemEncryptHypercallLib/Ia32/MemEncryptHypercallLib.c > create mode 100644 OvmfPkg/Library/MemEncryptHypercallLib/MemEncryptHypercallLib.inf > create mode 100644 OvmfPkg/Library/MemEncryptHypercallLib/X64/AsmHelperStub.nasm > create mode 100644 OvmfPkg/Library/MemEncryptHypercallLib/X64/MemEncryptHypercallLib.c > create mode 100644 OvmfPkg/PlatformDxe/AmdSev.c >