kvm.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Ashish Kalra <Ashish.Kalra@amd.com>
To: pbonzini@redhat.com
Cc: tglx@linutronix.de, mingo@redhat.com, hpa@zytor.com,
	joro@8bytes.org, bp@suse.de, thomas.lendacky@amd.com,
	x86@kernel.org, kvm@vger.kernel.org,
	linux-kernel@vger.kernel.org, rientjes@google.com,
	srutherford@google.com, luto@kernel.org, brijesh.singh@amd.com
Subject: [PATCH v6 00/14] Add AMD SEV guest live migration support
Date: Mon, 30 Mar 2020 06:19:27 +0000	[thread overview]
Message-ID: <cover.1585548051.git.ashish.kalra@amd.com> (raw)

From: Ashish Kalra <ashish.kalra@amd.com>

The series add support for AMD SEV guest live migration commands. To protect the
confidentiality of an SEV protected guest memory while in transit we need to
use the SEV commands defined in SEV API spec [1].

SEV guest VMs have the concept of private and shared memory. Private memory
is encrypted with the guest-specific key, while shared memory may be encrypted
with hypervisor key. The commands provided by the SEV FW are meant to be used
for the private memory only. The patch series introduces a new hypercall.
The guest OS can use this hypercall to notify the page encryption status.
If the page is encrypted with guest specific-key then we use SEV command during
the migration. If page is not encrypted then fallback to default.

The patch adds new ioctls KVM_{SET,GET}_PAGE_ENC_BITMAP. The ioctl can be used
by the qemu to get the page encrypted bitmap. Qemu can consult this bitmap
during the migration to know whether the page is encrypted.

[1] https://developer.amd.com/wp-content/resources/55766.PDF

Changes since v5:
- Fix build errors as
  Reported-by: kbuild test robot <lkp@intel.com>

Changes since v4:
- Host support has been added to extend KVM capabilities/feature bits to 
  include a new KVM_FEATURE_SEV_LIVE_MIGRATION, which the guest can
  query for host-side support for SEV live migration and a new custom MSR
  MSR_KVM_SEV_LIVE_MIG_EN is added for guest to enable the SEV live
  migration feature.
- Ensure that _bss_decrypted section is marked as decrypted in the
  page encryption bitmap.
- Fixing KVM_GET_PAGE_ENC_BITMAP ioctl to return the correct bitmap
  as per the number of pages being requested by the user. Ensure that
  we only copy bmap->num_pages bytes in the userspace buffer, if
  bmap->num_pages is not byte aligned we read the trailing bits
  from the userspace and copy those bits as is. This fixes guest
  page(s) corruption issues observed after migration completion.
- Add kexec support for SEV Live Migration to reset the host's
  page encryption bitmap related to kernel specific page encryption
  status settings before we load a new kernel by kexec. We cannot
  reset the complete page encryption bitmap here as we need to
  retain the UEFI/OVMF firmware specific settings.

Changes since v3:
- Rebasing to mainline and testing.
- Adding a new KVM_PAGE_ENC_BITMAP_RESET ioctl, which resets the 
  page encryption bitmap on a guest reboot event.
- Adding a more reliable sanity check for GPA range being passed to
  the hypercall to ensure that guest MMIO ranges are also marked
  in the page encryption bitmap.

Changes since v2:
 - reset the page encryption bitmap on vcpu reboot

Changes since v1:
 - Add support to share the page encryption between the source and target
   machine.
 - Fix review feedbacks from Tom Lendacky.
 - Add check to limit the session blob length.
 - Update KVM_GET_PAGE_ENC_BITMAP icotl to use the base_gfn instead of
   the memory slot when querying the bitmap.

Ashish Kalra (3):
  KVM: x86: Introduce KVM_PAGE_ENC_BITMAP_RESET ioctl
  KVM: x86: Introduce new KVM_FEATURE_SEV_LIVE_MIGRATION feature &
    Custom MSR.
  KVM: x86: Add kexec support for SEV Live Migration.

Brijesh Singh (11):
  KVM: SVM: Add KVM_SEV SEND_START command
  KVM: SVM: Add KVM_SEND_UPDATE_DATA command
  KVM: SVM: Add KVM_SEV_SEND_FINISH command
  KVM: SVM: Add support for KVM_SEV_RECEIVE_START command
  KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command
  KVM: SVM: Add KVM_SEV_RECEIVE_FINISH command
  KVM: x86: Add AMD SEV specific Hypercall3
  KVM: X86: Introduce KVM_HC_PAGE_ENC_STATUS hypercall
  KVM: x86: Introduce KVM_GET_PAGE_ENC_BITMAP ioctl
  mm: x86: Invoke hypercall when page encryption status is changed
  KVM: x86: Introduce KVM_SET_PAGE_ENC_BITMAP ioctl

 .../virt/kvm/amd-memory-encryption.rst        | 120 +++
 Documentation/virt/kvm/api.rst                |  62 ++
 Documentation/virt/kvm/cpuid.rst              |   4 +
 Documentation/virt/kvm/hypercalls.rst         |  15 +
 Documentation/virt/kvm/msr.rst                |  10 +
 arch/x86/include/asm/kvm_host.h               |  10 +
 arch/x86/include/asm/kvm_para.h               |  12 +
 arch/x86/include/asm/paravirt.h               |  10 +
 arch/x86/include/asm/paravirt_types.h         |   2 +
 arch/x86/include/uapi/asm/kvm_para.h          |   5 +
 arch/x86/kernel/kvm.c                         |  32 +
 arch/x86/kernel/paravirt.c                    |   1 +
 arch/x86/kvm/cpuid.c                          |   3 +-
 arch/x86/kvm/svm.c                            | 699 +++++++++++++++++-
 arch/x86/kvm/vmx/vmx.c                        |   1 +
 arch/x86/kvm/x86.c                            |  43 ++
 arch/x86/mm/mem_encrypt.c                     |  69 +-
 arch/x86/mm/pat/set_memory.c                  |   7 +
 include/linux/psp-sev.h                       |   8 +-
 include/uapi/linux/kvm.h                      |  53 ++
 include/uapi/linux/kvm_para.h                 |   1 +
 21 files changed, 1157 insertions(+), 10 deletions(-)

-- 
2.17.1


             reply	other threads:[~2020-03-30  6:20 UTC|newest]

Thread overview: 107+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-30  6:19 Ashish Kalra [this message]
2020-03-30  6:19 ` [PATCH v6 01/14] KVM: SVM: Add KVM_SEV SEND_START command Ashish Kalra
2020-04-02  6:27   ` Venu Busireddy
2020-04-02 12:59     ` Brijesh Singh
2020-04-02 16:37       ` Venu Busireddy
2020-04-02 18:04         ` Brijesh Singh
2020-04-02 18:57           ` Venu Busireddy
2020-04-02 19:17             ` Brijesh Singh
2020-04-02 19:43               ` Venu Busireddy
2020-04-02 20:04                 ` Brijesh Singh
2020-04-02 20:19                   ` Venu Busireddy
2020-04-02 17:51   ` Krish Sadhukhan
2020-04-02 18:38     ` Brijesh Singh
2020-03-30  6:20 ` [PATCH v6 02/14] KVM: SVM: Add KVM_SEND_UPDATE_DATA command Ashish Kalra
2020-04-02 17:55   ` Venu Busireddy
2020-04-02 20:13   ` Krish Sadhukhan
2020-03-30  6:20 ` [PATCH v6 03/14] KVM: SVM: Add KVM_SEV_SEND_FINISH command Ashish Kalra
2020-04-02 18:17   ` Venu Busireddy
2020-04-02 20:15   ` Krish Sadhukhan
2020-03-30  6:21 ` [PATCH v6 04/14] KVM: SVM: Add support for KVM_SEV_RECEIVE_START command Ashish Kalra
2020-04-02 21:35   ` Venu Busireddy
2020-04-02 22:09   ` Krish Sadhukhan
2020-03-30  6:21 ` [PATCH v6 05/14] KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command Ashish Kalra
2020-04-02 22:25   ` Krish Sadhukhan
2020-04-02 22:29   ` Venu Busireddy
2020-04-07  0:49     ` Steve Rutherford
2020-03-30  6:21 ` [PATCH v6 06/14] KVM: SVM: Add KVM_SEV_RECEIVE_FINISH command Ashish Kalra
2020-04-02 22:24   ` Venu Busireddy
2020-04-02 22:27   ` Krish Sadhukhan
2020-04-07  0:57     ` Steve Rutherford
2020-03-30  6:21 ` [PATCH v6 07/14] KVM: x86: Add AMD SEV specific Hypercall3 Ashish Kalra
2020-04-02 22:36   ` Venu Busireddy
2020-04-02 23:54   ` Krish Sadhukhan
2020-04-07  1:22     ` Steve Rutherford
2020-03-30  6:22 ` [PATCH v6 08/14] KVM: X86: Introduce KVM_HC_PAGE_ENC_STATUS hypercall Ashish Kalra
2020-04-03  0:00   ` Venu Busireddy
2020-04-03  1:31   ` Krish Sadhukhan
2020-04-03  1:57     ` Ashish Kalra
2020-04-03  2:58       ` Ashish Kalra
2020-04-06 22:27         ` Krish Sadhukhan
2020-04-07  2:17   ` Steve Rutherford
2020-04-07  5:27     ` Ashish Kalra
2020-04-08  0:01       ` Steve Rutherford
2020-04-08  0:29         ` Brijesh Singh
2020-04-08  0:35           ` Steve Rutherford
2020-04-08  1:17             ` Ashish Kalra
2020-04-08  1:38               ` Steve Rutherford
2020-04-08  2:34                 ` Brijesh Singh
2020-04-08  3:18                   ` Ashish Kalra
2020-04-09 16:18                     ` Ashish Kalra
2020-04-09 20:41                       ` Steve Rutherford
2020-03-30  6:22 ` [PATCH v6 09/14] KVM: x86: Introduce KVM_GET_PAGE_ENC_BITMAP ioctl Ashish Kalra
2020-04-03 18:30   ` Venu Busireddy
2020-04-03 20:18   ` Krish Sadhukhan
2020-04-03 20:47     ` Ashish Kalra
2020-04-06 22:07       ` Krish Sadhukhan
2020-04-03 20:55     ` Venu Busireddy
2020-04-03 21:01       ` Ashish Kalra
2020-03-30  6:22 ` [PATCH v6 10/14] mm: x86: Invoke hypercall when page encryption status is changed Ashish Kalra
2020-04-03 21:07   ` Krish Sadhukhan
2020-04-03 21:30     ` Ashish Kalra
2020-04-03 21:36   ` Venu Busireddy
2020-03-30  6:22 ` [PATCH v6 11/14] KVM: x86: Introduce KVM_SET_PAGE_ENC_BITMAP ioctl Ashish Kalra
2020-04-03 21:10   ` Krish Sadhukhan
2020-04-03 21:46   ` Venu Busireddy
2020-04-08  0:26   ` Steve Rutherford
2020-04-08  1:48     ` Ashish Kalra
2020-04-10  0:06       ` Steve Rutherford
2020-04-10  1:23         ` Ashish Kalra
2020-04-10 18:08           ` Steve Rutherford
2020-03-30  6:23 ` [PATCH v6 12/14] KVM: x86: Introduce KVM_PAGE_ENC_BITMAP_RESET ioctl Ashish Kalra
2020-04-03 21:14   ` Krish Sadhukhan
2020-04-03 21:45     ` Ashish Kalra
2020-04-06 18:52       ` Krish Sadhukhan
2020-04-08  1:25         ` Steve Rutherford
2020-04-08  1:52           ` Ashish Kalra
2020-04-10  0:59             ` Steve Rutherford
2020-04-10  1:34               ` Ashish Kalra
2020-04-10 18:14                 ` Steve Rutherford
2020-04-10 20:16                   ` Steve Rutherford
2020-04-10 20:18                     ` Steve Rutherford
2020-04-10 20:55                       ` Kalra, Ashish
2020-04-10 21:42                         ` Brijesh Singh
2020-04-10 21:46                           ` Sean Christopherson
2020-04-10 21:58                             ` Brijesh Singh
2020-04-10 22:02                         ` Brijesh Singh
2020-04-11  0:35                           ` Ashish Kalra
2020-04-03 22:01   ` Venu Busireddy
2020-03-30  6:23 ` [PATCH v6 13/14] KVM: x86: Introduce new KVM_FEATURE_SEV_LIVE_MIGRATION feature & Custom MSR Ashish Kalra
2020-03-30 15:52   ` Brijesh Singh
2020-03-30 16:42     ` Ashish Kalra
     [not found]     ` <20200330162730.GA21567@ashkalra_ubuntu_server>
     [not found]       ` <1de5e95f-4485-f2ff-aba8-aa8b15564796@amd.com>
     [not found]         ` <20200331171336.GA24050@ashkalra_ubuntu_server>
     [not found]           ` <20200401070931.GA8562@ashkalra_ubuntu_server>
2020-04-02 23:29             ` Ashish Kalra
2020-04-03 23:46   ` Krish Sadhukhan
2020-03-30  6:23 ` [PATCH v6 14/14] KVM: x86: Add kexec support for SEV Live Migration Ashish Kalra
2020-03-30 16:00   ` Brijesh Singh
2020-03-30 16:45     ` Ashish Kalra
2020-03-31 14:26       ` Brijesh Singh
2020-04-02 23:34         ` Ashish Kalra
2020-04-03 12:57   ` Dave Young
2020-04-04  0:55   ` Krish Sadhukhan
2020-04-04 21:57     ` Ashish Kalra
2020-04-06 18:37       ` Krish Sadhukhan
2020-03-30 17:24 ` [PATCH v6 00/14] Add AMD SEV guest live migration support Venu Busireddy
2020-03-30 18:28   ` Ashish Kalra
2020-03-30 19:13     ` Venu Busireddy
2020-03-30 21:52       ` Ashish Kalra
2020-03-31 14:42         ` Venu Busireddy

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=cover.1585548051.git.ashish.kalra@amd.com \
    --to=ashish.kalra@amd.com \
    --cc=bp@suse.de \
    --cc=brijesh.singh@amd.com \
    --cc=hpa@zytor.com \
    --cc=joro@8bytes.org \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=mingo@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=rientjes@google.com \
    --cc=srutherford@google.com \
    --cc=tglx@linutronix.de \
    --cc=thomas.lendacky@amd.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).