kvm.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v3 00/11] Add AMD SEV guest live migration support
@ 2019-07-10 20:12 Singh, Brijesh
  2019-07-10 20:13 ` [PATCH v3 01/11] KVM: SVM: Add KVM_SEV SEND_START command Singh, Brijesh
                   ` (11 more replies)
  0 siblings, 12 replies; 42+ messages in thread
From: Singh, Brijesh @ 2019-07-10 20:12 UTC (permalink / raw)
  To: kvm; +Cc: Singh, Brijesh

The series add support for AMD SEV guest live migration commands. To protect the
confidentiality of an SEV protected guest memory while in transit we need to
use the SEV commands defined in SEV API spec [1].

SEV guest VMs have the concept of private and shared memory. Private memory
is encrypted with the guest-specific key, while shared memory may be encrypted
with hypervisor key. The commands provided by the SEV FW are meant to be used
for the private memory only. The patch series introduces a new hypercall.
The guest OS can use this hypercall to notify the page encryption status.
If the page is encrypted with guest specific-key then we use SEV command during
the migration. If page is not encrypted then fallback to default.

The patch adds new ioctls KVM_{SET,GET}_PAGE_ENC_BITMAP. The ioctl can be used
by the qemu to get the page encrypted bitmap. Qemu can consult this bitmap
during the migration to know whether the page is encrypted.

[1] https://developer.amd.com/wp-content/resources/55766.PDF

While implementing the migration I stumbled on the follow question:

- Since there is a guest OS changes required to support the migration,
  so how do we know whether guest OS is updated? Should we extend KVM
  capabilities/feature bits to check this?

The complete tree with patch is available at:
https://github.com/codomania/kvm/tree/sev-migration-v3

Changes since v2:
 - reset the page encryption bitmap on vcpu reboot

Changes since v1:
 - Add support to share the page encryption between the source and target
   machine.
 - Fix review feedbacks from Tom Lendacky.
 - Add check to limit the session blob length.
 - Update KVM_GET_PAGE_ENC_BITMAP icotl to use the base_gfn instead of
   the memory slot when querying the bitmap.

Brijesh Singh (11):
  KVM: SVM: Add KVM_SEV SEND_START command
  KVM: SVM: Add KVM_SEND_UPDATE_DATA command
  KVM: SVM: Add KVM_SEV_SEND_FINISH command
  KVM: SVM: Add support for KVM_SEV_RECEIVE_START command
  KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command
  KVM: SVM: Add KVM_SEV_RECEIVE_FINISH command
  KVM: x86: Add AMD SEV specific Hypercall3
  KVM: X86: Introduce KVM_HC_PAGE_ENC_STATUS hypercall
  KVM: x86: Introduce KVM_GET_PAGE_ENC_BITMAP ioctl
  mm: x86: Invoke hypercall when page encryption status is changed
  KVM: x86: Introduce KVM_SET_PAGE_ENC_BITMAP ioctl

 .../virtual/kvm/amd-memory-encryption.rst     | 120 ++++
 Documentation/virtual/kvm/api.txt             |  48 ++
 Documentation/virtual/kvm/hypercalls.txt      |  14 +
 arch/x86/include/asm/kvm_host.h               |   4 +
 arch/x86/include/asm/kvm_para.h               |  12 +
 arch/x86/include/asm/mem_encrypt.h            |   3 +
 arch/x86/kvm/svm.c                            | 580 +++++++++++++++++-
 arch/x86/kvm/vmx/vmx.c                        |   1 +
 arch/x86/kvm/x86.c                            |  29 +
 arch/x86/mm/mem_encrypt.c                     |  45 +-
 arch/x86/mm/pageattr.c                        |  15 +
 include/uapi/linux/kvm.h                      |  52 ++
 include/uapi/linux/kvm_para.h                 |   1 +
 13 files changed, 919 insertions(+), 5 deletions(-)

-- 
2.17.1


^ permalink raw reply	[flat|nested] 42+ messages in thread

end of thread, other threads:[~2019-11-25 19:07 UTC | newest]

Thread overview: 42+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-10 20:12 [PATCH v3 00/11] Add AMD SEV guest live migration support Singh, Brijesh
2019-07-10 20:13 ` [PATCH v3 01/11] KVM: SVM: Add KVM_SEV SEND_START command Singh, Brijesh
2019-08-22 10:08   ` Borislav Petkov
2019-08-22 13:23     ` Singh, Brijesh
2019-11-12 18:35   ` Peter Gonda
2019-11-12 22:27     ` Brijesh Singh
2019-11-14 19:27       ` Peter Gonda
2019-11-19 14:06         ` Brijesh Singh
2019-07-10 20:13 ` [PATCH v3 02/11] KVM: SVM: Add KVM_SEND_UPDATE_DATA command Singh, Brijesh
2019-08-22 12:02   ` Borislav Petkov
2019-08-22 13:27     ` Singh, Brijesh
2019-08-22 13:34       ` Borislav Petkov
2019-11-12 22:23   ` Peter Gonda
2019-07-10 20:13 ` [PATCH v3 03/11] KVM: SVM: Add KVM_SEV_SEND_FINISH command Singh, Brijesh
2019-08-26 13:29   ` Borislav Petkov
2019-07-10 20:13 ` [PATCH v3 04/11] KVM: SVM: Add support for KVM_SEV_RECEIVE_START command Singh, Brijesh
2019-07-10 20:13 ` [PATCH v3 05/11] KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command Singh, Brijesh
2019-08-27 12:09   ` Borislav Petkov
2019-11-14 21:02   ` Peter Gonda
2019-07-10 20:13 ` [PATCH v3 06/11] KVM: SVM: Add KVM_SEV_RECEIVE_FINISH command Singh, Brijesh
2019-08-27 12:19   ` Borislav Petkov
2019-07-10 20:13 ` [PATCH v3 07/11] KVM: x86: Add AMD SEV specific Hypercall3 Singh, Brijesh
2019-07-10 20:13 ` [PATCH v3 08/11] KVM: X86: Introduce KVM_HC_PAGE_ENC_STATUS hypercall Singh, Brijesh
2019-07-21 20:57   ` David Rientjes
2019-07-22 17:12     ` Cfir Cohen
2019-07-23 15:31       ` Singh, Brijesh
2019-07-23 15:16     ` Singh, Brijesh
2019-11-25 19:07   ` Peter Gonda
2019-07-10 20:13 ` [PATCH v3 09/11] KVM: x86: Introduce KVM_GET_PAGE_ENC_BITMAP ioctl Singh, Brijesh
2019-08-29 16:26   ` Borislav Petkov
2019-08-29 16:41     ` Singh, Brijesh
2019-08-29 16:56       ` Borislav Petkov
2019-07-10 20:13 ` [PATCH v3 10/11] mm: x86: Invoke hypercall when page encryption status is changed Singh, Brijesh
2019-08-29 16:52   ` Borislav Petkov
2019-08-29 18:07   ` Borislav Petkov
2019-08-29 18:21     ` Thomas Gleixner
2019-08-29 18:32       ` Thomas Gleixner
2019-07-10 20:13 ` [PATCH v3 11/11] KVM: x86: Introduce KVM_SET_PAGE_ENC_BITMAP ioctl Singh, Brijesh
2019-11-15  1:22   ` Steve Rutherford
2019-11-15  1:39     ` Steve Rutherford
2019-07-12 15:52 ` [PATCH v3 00/11] Add AMD SEV guest live migration support Konrad Rzeszutek Wilk
2019-07-12 16:31   ` Singh, Brijesh

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).