From patchwork Wed Apr 24 16:09:58 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Brijesh Singh X-Patchwork-Id: 1090212 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=amd.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=amdcloud.onmicrosoft.com header.i=@amdcloud.onmicrosoft.com header.b="N3BZeE+b"; dkim-atps=neutral Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 44q50R1gq3z9sB3 for ; Thu, 25 Apr 2019 02:11:19 +1000 (AEST) Received: from localhost ([127.0.0.1]:44000 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hJKUO-00027P-Qv for incoming@patchwork.ozlabs.org; Wed, 24 Apr 2019 12:11:16 -0400 Received: from eggs.gnu.org ([209.51.188.92]:38661) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hJKTP-0001wP-NL for qemu-devel@nongnu.org; Wed, 24 Apr 2019 12:10:28 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hJKTG-0003YR-1L for qemu-devel@nongnu.org; Wed, 24 Apr 2019 12:10:15 -0400 Received: from mail-eopbgr780073.outbound.protection.outlook.com ([40.107.78.73]:27328 helo=NAM03-BY2-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1hJKTD-0003PD-9e for qemu-devel@nongnu.org; Wed, 24 Apr 2019 12:10:04 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector1-amd-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dui2qMpD3nJ6b1BVahn6iBrgETSYyXno8AljJD17ha4=; b=N3BZeE+bQZ8c4X3VgIIr2VhQ0mC1fsrRlaE64GezV4d8iKKi9ck83DdMQf9taExCIFvtnwek5Me0AVYlsb/O5zqaPCGziKWPoM+mfOs5aPDp1BX84tZdWPh4FQ6IFd35T0tCnWcayrcCq4Deb+rkusz9E55qq4Cu5OWoZ1rGQq8= Received: from DM6PR12MB2682.namprd12.prod.outlook.com (20.176.116.31) by DM6PR12MB2907.namprd12.prod.outlook.com (20.179.71.213) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1835.12; Wed, 24 Apr 2019 16:09:58 +0000 Received: from DM6PR12MB2682.namprd12.prod.outlook.com ([fe80::9183:846f:a93e:9a43]) by DM6PR12MB2682.namprd12.prod.outlook.com ([fe80::9183:846f:a93e:9a43%5]) with mapi id 15.20.1813.017; Wed, 24 Apr 2019 16:09:58 +0000 From: "Singh, Brijesh" To: "kvm@vger.kernel.org" Thread-Topic: [RFC PATCH v1 00/10] Add AMD SEV guest live migration support Thread-Index: AQHU+rgpwai7tJB3uUaULXjJMShjVQ== Date: Wed, 24 Apr 2019 16:09:58 +0000 Message-ID: <20190424160942.13567-1-brijesh.singh@amd.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: SN4PR0601CA0019.namprd06.prod.outlook.com (2603:10b6:803:2f::29) To DM6PR12MB2682.namprd12.prod.outlook.com (2603:10b6:5:4a::31) authentication-results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; x-ms-exchange-messagesentrepresentingtype: 1 x-mailer: git-send-email 2.17.1 x-originating-ip: [165.204.77.1] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a232132e-0b1d-4919-222b-08d6c8cf4c35 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4618075)(2017052603328)(7193020); SRVR:DM6PR12MB2907; x-ms-traffictypediagnostic: DM6PR12MB2907: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-forefront-prvs: 00179089FD x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(136003)(366004)(396003)(376002)(346002)(189003)(199004)(1730700003)(99286004)(2501003)(73956011)(478600001)(6506007)(14454004)(966005)(6116002)(52116002)(386003)(476003)(25786009)(66946007)(486006)(4326008)(71200400001)(66446008)(66556008)(3846002)(66476007)(64756008)(1076003)(66574012)(71190400001)(186003)(2616005)(5660300002)(2351001)(102836004)(97736004)(26005)(14444005)(86362001)(6512007)(8676002)(66066001)(6306002)(8936002)(68736007)(2906002)(50226002)(256004)(81156014)(305945005)(36756003)(316002)(6436002)(54906003)(7736002)(5640700003)(81166006)(53936002)(6916009)(6486002)(7416002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR12MB2907; H:DM6PR12MB2682.namprd12.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: amd.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: tpAzzmY9nbv5hx+9QFqMOOeF98xVZM/etoQR5Nlj+G5/jKvCiH/+TDZ3N8YtTZAS8CilOgNzWX8zjlbKpzPsSFCR1IROlb6z/zyk2ZIbcU6XpYBDBgZI3sqAKG1dpWvK7m7UGLfDVjC/uQ81cRcH4ryY/iOovc4J5Z8aBbF14jpRUHSMEwb1Sy7TRHXq5WYIq4MtkY+P3SsfG4P5xQmqzCH7yeJKiAAjQgZkxhn4m1pwijPqICQuW0A3FfQfD27zsZXggJ6yPvwd95ibZqjg7Tf+YreIWOiJA0+L8z2lXCDCS05RQ+RGvqBurw4eppHdTKygCPeAVOVv6bqOMUbGyPWkTrA2I7oC71lUYaOGjvFAJB+OOcZzAXqqEz+TRk1hdqAalX/HEq5TdiGSDJQJh5mFfaMiEBeW5t77SpiynBI= Content-ID: MIME-Version: 1.0 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: a232132e-0b1d-4919-222b-08d6c8cf4c35 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Apr 2019 16:09:58.5242 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB2907 X-detected-operating-system: by eggs.gnu.org: Windows 7 or 8 [fuzzy] X-Received-From: 40.107.78.73 Subject: [Qemu-devel] [RFC PATCH v1 00/10] Add AMD SEV guest live migration support X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "Lendacky, Thomas" , "Singh, Brijesh" , =?utf-8?b?UmFkaW0gS3LEjW3DocWZ?= , Joerg Roedel , "x86@kernel.org" , "qemu-devel@nongnu.org" , "linux-kernel@vger.kernel.org" , Ingo Molnar , "H. Peter Anvin" , Paolo Bonzini , Thomas Gleixner , Borislav Petkov Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" The series add support for AMD SEV guest live migration commands. To protect the confidentiality of an SEV protected guest memory while in transit we need to use the SEV commands defined in SEV API spec [1]. SEV guest VMs have the concept of private and shared memory. Private memory is encrypted with the guest-specific key, while shared memory may be encrypted with hypervisor key. The commands provided by the SEV FW are meant to be used for the private memory only. The patch series introduces a new hypercall. The guest OS can use this hypercall to notify the page encryption status. If the page is encrypted with guest specific-key then we use SEV command during the migration. If page is not encrypted then fallback to default. The patch adds a new ioctl KVM_GET_PAGE_ENC_BITMAP. The ioctl can be used by the qemu to get the page encrypted bitmap. Qemu can consult this bitmap during the migration to know whether the page is encrypted. [1] https://developer.amd.com/wp-content/resources/55766.PDF The series is tested with the Qemu, I am in process of cleaning up the Qemu code and will submit soon. While implementing the migration I stumbled on the follow question: - Since there is a guest OS changes required to support the migration, so how do we know whether guest OS is updated? Should we extend KVM capabilities/feature bits to check this? TODO: - add an ioctl to build encryption bitmap. The encryption bitmap is built during the guest bootup/execution. We should provide an ioctl so that destination can build the bitmap as it receives the pages. - reset the bitmap on guest reboot. The complete tree with patch is available at: https://github.com/codomania/kvm/tree/sev-migration-rfc-v1 Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Paolo Bonzini Cc: "Radim Krčmář" Cc: Joerg Roedel Cc: Borislav Petkov Cc: Tom Lendacky Cc: x86@kernel.org Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Brijesh Singh (10): KVM: SVM: Add KVM_SEV SEND_START command KVM: SVM: Add KVM_SEND_UPDATE_DATA command KVM: SVM: Add KVM_SEV_SEND_FINISH command KVM: SVM: Add support for KVM_SEV_RECEIVE_START command KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command KVM: SVM: Add KVM_SEV_RECEIVE_FINISH command KVM: x86: Add AMD SEV specific Hypercall3 KVM: X86: Introduce KVM_HC_PAGE_ENC_STATUS hypercall KVM: x86: Introduce KVM_GET_PAGE_ENC_BITMAP ioctl mm: x86: Invoke hypercall when page encryption status is changed .../virtual/kvm/amd-memory-encryption.rst | 116 ++++ Documentation/virtual/kvm/hypercalls.txt | 14 + arch/x86/include/asm/kvm_host.h | 3 + arch/x86/include/asm/kvm_para.h | 12 + arch/x86/include/asm/mem_encrypt.h | 3 + arch/x86/kvm/svm.c | 560 +++++++++++++++++- arch/x86/kvm/vmx/vmx.c | 1 + arch/x86/kvm/x86.c | 17 + arch/x86/mm/mem_encrypt.c | 45 +- arch/x86/mm/pageattr.c | 15 + include/uapi/linux/kvm.h | 51 ++ include/uapi/linux/kvm_para.h | 1 + 12 files changed, 834 insertions(+), 4 deletions(-)