| Message ID | cover.1607620209.git.thomas.lendacky@amd.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | SEV-ES hypervisor support | expand |
On 10/12/20 18:09, Tom Lendacky wrote: > From: Tom Lendacky <thomas.lendacky@amd.com> > > This patch series provides support for running SEV-ES guests under KVM. > > Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on the > SEV support to protect the guest register state from the hypervisor. See > "AMD64 Architecture Programmer's Manual Volume 2: System Programming", > section "15.35 Encrypted State (SEV-ES)" [1]. > > In order to allow a hypervisor to perform functions on behalf of a guest, > there is architectural support for notifying a guest's operating system > when certain types of VMEXITs are about to occur. This allows the guest to > selectively share information with the hypervisor to satisfy the requested > function. The notification is performed using a new exception, the VMM > Communication exception (#VC). The information is shared through the > Guest-Hypervisor Communication Block (GHCB) using the VMGEXIT instruction. > The GHCB format and the protocol for using it is documented in "SEV-ES > Guest-Hypervisor Communication Block Standardization" [2]. > > Under SEV-ES, a vCPU save area (VMSA) must be encrypted. SVM is updated to > build the initial VMSA and then encrypt it before running the guest. Once > encrypted, it must not be modified by the hypervisor. Modification of the > VMSA will result in the VMRUN instruction failing with a SHUTDOWN exit > code. KVM must support the VMGEXIT exit code in order to perform the > necessary functions required of the guest. The GHCB is used to exchange > the information needed by both the hypervisor and the guest. > > Register data from the GHCB is copied into the KVM register variables and > accessed as usual during handling of the exit. Upon return to the guest, > updated registers are copied back to the GHCB for the guest to act upon. > > There are changes to some of the intercepts that are needed under SEV-ES. > For example, CR0 writes cannot be intercepted, so the code needs to ensure > that the intercept is not enabled during execution or that the hypervisor > does not try to read the register as part of exit processing. Another > example is shutdown processing, where the vCPU cannot be directly reset. > > Support is added to handle VMGEXIT events and implement the GHCB protocol. > This includes supporting standard exit events, like a CPUID instruction > intercept, to new support, for things like AP processor booting. Much of > the existing SVM intercept support can be re-used by setting the exit > code information from the VMGEXIT and calling the appropriate intercept > handlers. > > Finally, to launch and run an SEV-ES guest requires changes to the vCPU > initialization, loading and execution. > > [1] https://www.amd.com/system/files/TechDocs/24593.pdf > [2] https://developer.amd.com/wp-content/resources/56421.pdf > > --- > > These patches are based on the KVM queue branch: > https://git.kernel.org/pub/scm/virt/kvm/kvm.git queue > > dc924b062488 ("KVM: SVM: check CR4 changes against vcpu->arch") > > A version of the tree can also be found at: > https://github.com/AMDESE/linux/tree/sev-es-v5 > This tree has one addition patch that is not yet part of the queue > tree that is required to run any SEV guest: > [PATCH] KVM: x86: adjust SEV for commit 7e8e6eed75e > https://lore.kernel.org/kvm/20201130143959.3636394-1-pbonzini@redhat.com/ > > Changes from v4: > - Updated the tracking support for CR0/CR4 > > Changes from v3: > - Some krobot fixes. > - Some checkpatch cleanups. > > Changes from v2: > - Update the freeing of the VMSA page to account for the encrypted memory > cache coherency feature as well as the VM page flush feature. > - Update the GHCB dump function with a bit more detail. > - Don't check for RAX being present as part of a string IO operation. > - Include RSI when syncing from GHCB to support KVM hypercall arguments. > - Add GHCB usage field validation check. > > Changes from v1: > - Removed the VMSA indirection support: > - On LAUNCH_UPDATE_VMSA, sync traditional VMSA over to the new SEV-ES > VMSA area to be encrypted. > - On VMGEXIT VMEXIT, directly copy valid registers into vCPU arch > register array from GHCB. On VMRUN (following a VMGEXIT), directly > copy dirty vCPU arch registers to GHCB. > - Removed reg_read_override()/reg_write_override() KVM ops. > - Added VMGEXIT exit-reason validation. > - Changed kvm_vcpu_arch variable vmsa_encrypted to guest_state_protected > - Updated the tracking support for EFER/CR0/CR4/CR8 to minimize changes > to the x86.c code > - Updated __set_sregs to not set any register values (previously supported > setting the tracked values of EFER/CR0/CR4/CR8) > - Added support for reporting SMM capability at the VM-level. This allows > an SEV-ES guest to indicate SMM is not supported > - Updated FPU support to check for a guest FPU save area before using it. > Updated SVM to free guest FPU for an SEV-ES guest during KVM create_vcpu > op. > - Removed changes to the kvm_skip_emulated_instruction() > - Added VMSA validity checks before invoking LAUNCH_UPDATE_VMSA > - Minor code restructuring in areas for better readability > > Cc: Paolo Bonzini <pbonzini@redhat.com> > Cc: Jim Mattson <jmattson@google.com> > Cc: Joerg Roedel <joro@8bytes.org> > Cc: Sean Christopherson <sean.j.christopherson@intel.com> > Cc: Vitaly Kuznetsov <vkuznets@redhat.com> > Cc: Wanpeng Li <wanpengli@tencent.com> > Cc: Borislav Petkov <bp@alien8.de> > Cc: Ingo Molnar <mingo@redhat.com> > Cc: Thomas Gleixner <tglx@linutronix.de> > Cc: Brijesh Singh <brijesh.singh@amd.com> I'm queuing everything except patch 27, there's time to include it later in 5.11. Regarding MSRs, take a look at the series I'm sending shortly (or perhaps in a couple hours). For now I'll keep it in kvm/queue, but the plan is to get acks quickly and/or just include it in 5.11. Please try the kvm/queue branch to see if I screwed up anything. Paolo
On 12/14/20 12:13 PM, Paolo Bonzini wrote: > On 10/12/20 18:09, Tom Lendacky wrote: >> From: Tom Lendacky <thomas.lendacky@amd.com> >> >> This patch series provides support for running SEV-ES guests under KVM. >> > > I'm queuing everything except patch 27, there's time to include it later > in 5.11. Thanks, Paolo! I'll start looking at updating patch 27. > > Regarding MSRs, take a look at the series I'm sending shortly (or perhaps > in a couple hours). For now I'll keep it in kvm/queue, but the plan is to > get acks quickly and/or just include it in 5.11. Please try the kvm/queue > branch to see if I screwed up anything. Ok, I'll take a look at the kvm/queue tree. Thanks, Tom > > Paolo >
On 12/14/20 12:13 PM, Paolo Bonzini wrote: > On 10/12/20 18:09, Tom Lendacky wrote: >> From: Tom Lendacky <thomas.lendacky@amd.com> >> >> This patch series provides support for running SEV-ES guests under KVM. >> > > I'm queuing everything except patch 27, there's time to include it later > in 5.11. > > Regarding MSRs, take a look at the series I'm sending shortly (or perhaps > in a couple hours). For now I'll keep it in kvm/queue, but the plan is to > get acks quickly and/or just include it in 5.11. Please try the kvm/queue > branch to see if I screwed up anything. I pulled and built kvm/queue and was able to launch a single vCPU SEV-ES guest through OVMF and part way into the kernel before I hit an error. The kernel tries to get the AP jump table address (which was part of patch 27). If I apply the following patch (just the jump table support from patch 27), I can successfully boot a single vCPU SEV-ES guest: KVM: SVM: Add AP_JUMP_TABLE support in prep for AP booting From: Tom Lendacky <thomas.lendacky@amd.com> The GHCB specification requires the hypervisor to save the address of an AP Jump Table so that, for example, vCPUs that have been parked by UEFI can be started by the OS. Provide support for the AP Jump Table set/get exit code. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> --- arch/x86/kvm/svm/sev.c | 28 ++++++++++++++++++++++++++++ arch/x86/kvm/svm/svm.h | 1 + 2 files changed, 29 insertions(+) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 6eb097714d43..8b5ef0fe4490 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -18,6 +18,8 @@ #include <linux/trace_events.h> #include <asm/fpu/internal.h> +#include <asm/trapnr.h> + #include "x86.h" #include "svm.h" #include "cpuid.h" @@ -1559,6 +1561,7 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *svm) goto vmgexit_err; break; case SVM_VMGEXIT_NMI_COMPLETE: + case SVM_VMGEXIT_AP_JUMP_TABLE: case SVM_VMGEXIT_UNSUPPORTED_EVENT: break; default: @@ -1883,6 +1886,31 @@ int sev_handle_vmgexit(struct vcpu_svm *svm) case SVM_VMGEXIT_NMI_COMPLETE: ret = svm_invoke_exit_handler(svm, SVM_EXIT_IRET); break; + case SVM_VMGEXIT_AP_JUMP_TABLE: { + struct kvm_sev_info *sev = &to_kvm_svm(svm->vcpu.kvm)->sev_info; + + switch (control->exit_info_1) { + case 0: + /* Set AP jump table address */ + sev->ap_jump_table = control->exit_info_2; + break; + case 1: + /* Get AP jump table address */ + ghcb_set_sw_exit_info_2(ghcb, sev->ap_jump_table); + break; + default: + pr_err("svm: vmgexit: unsupported AP jump table request - exit_info_1=%#llx\n", + control->exit_info_1); + ghcb_set_sw_exit_info_1(ghcb, 1); + ghcb_set_sw_exit_info_2(ghcb, + X86_TRAP_UD | + SVM_EVTINJ_TYPE_EXEPT | + SVM_EVTINJ_VALID); + } + + ret = 1; + break; + } case SVM_VMGEXIT_UNSUPPORTED_EVENT: vcpu_unimpl(&svm->vcpu, "vmgexit: unsupported event - exit_info_1=%#llx, exit_info_2=%#llx\n", diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index a5067f776ce0..5431e6335e2e 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -78,6 +78,7 @@ struct kvm_sev_info { int fd; /* SEV device fd */ unsigned long pages_locked; /* Number of pages locked */ struct list_head regions_list; /* List of registered regions */ + u64 ap_jump_table; /* SEV-ES AP Jump Table address */ }; struct kvm_svm {
On 15/12/20 17:46, Tom Lendacky wrote: > KVM: SVM: Add AP_JUMP_TABLE support in prep for AP booting Great, thanks! Paolo > From: Tom Lendacky<thomas.lendacky@amd.com> > > The GHCB specification requires the hypervisor to save the address of an > AP Jump Table so that, for example, vCPUs that have been parked by UEFI > can be started by the OS. Provide support for the AP Jump Table set/get > exit code. > > Signed-off-by: Tom Lendacky<thomas.lendacky@amd.com> > --- > arch/x86/kvm/svm/sev.c | 28 ++++++++++++++++++++++++++++ > arch/x86/kvm/svm/svm.h | 1 + > 2 files changed, 29 insertions(+) > > diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c > index 6eb097714d43..8b5ef0fe4490 100644 > --- a/arch/x86/kvm/svm/sev.c > +++ b/arch/x86/kvm/svm/sev.c > @@ -18,6 +18,8 @@ > #include <linux/trace_events.h> > #include <asm/fpu/internal.h> > > +#include <asm/trapnr.h> > + > #include "x86.h" > #include "svm.h" > #include "cpuid.h" > @@ -1559,6 +1561,7 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *svm) > goto vmgexit_err; > break; > case SVM_VMGEXIT_NMI_COMPLETE: > + case SVM_VMGEXIT_AP_JUMP_TABLE: > case SVM_VMGEXIT_UNSUPPORTED_EVENT: > break; > default: > @@ -1883,6 +1886,31 @@ int sev_handle_vmgexit(struct vcpu_svm *svm) > case SVM_VMGEXIT_NMI_COMPLETE: > ret = svm_invoke_exit_handler(svm, SVM_EXIT_IRET); > break; > + case SVM_VMGEXIT_AP_JUMP_TABLE: { > + struct kvm_sev_info *sev = &to_kvm_svm(svm->vcpu.kvm)->sev_info; > + > + switch (control->exit_info_1) { > + case 0: > + /* Set AP jump table address */ > + sev->ap_jump_table = control->exit_info_2; > + break; > + case 1: > + /* Get AP jump table address */ > + ghcb_set_sw_exit_info_2(ghcb, sev->ap_jump_table); > + break; > + default: > + pr_err("svm: vmgexit: unsupported AP jump table request - exit_info_1=%#llx\n", > + control->exit_info_1); > + ghcb_set_sw_exit_info_1(ghcb, 1); > + ghcb_set_sw_exit_info_2(ghcb, > + X86_TRAP_UD | > + SVM_EVTINJ_TYPE_EXEPT | > + SVM_EVTINJ_VALID); > + } > + > + ret = 1; > + break; > + } > case SVM_VMGEXIT_UNSUPPORTED_EVENT: > vcpu_unimpl(&svm->vcpu, > "vmgexit: unsupported event - exit_info_1=%#llx, exit_info_2=%#llx\n", > diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h > index a5067f776ce0..5431e6335e2e 100644 > --- a/arch/x86/kvm/svm/svm.h > +++ b/arch/x86/kvm/svm/svm.h > @@ -78,6 +78,7 @@ struct kvm_sev_info { > int fd; /* SEV device fd */ > unsigned long pages_locked; /* Number of pages locked */ > struct list_head regions_list; /* List of registered regions */ > + u64 ap_jump_table; /* SEV-ES AP Jump Table address */ > }; > > struct kvm_svm { >
From: Tom Lendacky <thomas.lendacky@amd.com> This patch series provides support for running SEV-ES guests under KVM. Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on the SEV support to protect the guest register state from the hypervisor. See "AMD64 Architecture Programmer's Manual Volume 2: System Programming", section "15.35 Encrypted State (SEV-ES)" [1]. In order to allow a hypervisor to perform functions on behalf of a guest, there is architectural support for notifying a guest's operating system when certain types of VMEXITs are about to occur. This allows the guest to selectively share information with the hypervisor to satisfy the requested function. The notification is performed using a new exception, the VMM Communication exception (#VC). The information is shared through the Guest-Hypervisor Communication Block (GHCB) using the VMGEXIT instruction. The GHCB format and the protocol for using it is documented in "SEV-ES Guest-Hypervisor Communication Block Standardization" [2]. Under SEV-ES, a vCPU save area (VMSA) must be encrypted. SVM is updated to build the initial VMSA and then encrypt it before running the guest. Once encrypted, it must not be modified by the hypervisor. Modification of the VMSA will result in the VMRUN instruction failing with a SHUTDOWN exit code. KVM must support the VMGEXIT exit code in order to perform the necessary functions required of the guest. The GHCB is used to exchange the information needed by both the hypervisor and the guest. Register data from the GHCB is copied into the KVM register variables and accessed as usual during handling of the exit. Upon return to the guest, updated registers are copied back to the GHCB for the guest to act upon. There are changes to some of the intercepts that are needed under SEV-ES. For example, CR0 writes cannot be intercepted, so the code needs to ensure that the intercept is not enabled during execution or that the hypervisor does not try to read the register as part of exit processing. Another example is shutdown processing, where the vCPU cannot be directly reset. Support is added to handle VMGEXIT events and implement the GHCB protocol. This includes supporting standard exit events, like a CPUID instruction intercept, to new support, for things like AP processor booting. Much of the existing SVM intercept support can be re-used by setting the exit code information from the VMGEXIT and calling the appropriate intercept handlers. Finally, to launch and run an SEV-ES guest requires changes to the vCPU initialization, loading and execution. [1] https://www.amd.com/system/files/TechDocs/24593.pdf [2] https://developer.amd.com/wp-content/resources/56421.pdf --- These patches are based on the KVM queue branch: https://git.kernel.org/pub/scm/virt/kvm/kvm.git queue dc924b062488 ("KVM: SVM: check CR4 changes against vcpu->arch") A version of the tree can also be found at: https://github.com/AMDESE/linux/tree/sev-es-v5 This tree has one addition patch that is not yet part of the queue tree that is required to run any SEV guest: [PATCH] KVM: x86: adjust SEV for commit 7e8e6eed75e https://lore.kernel.org/kvm/20201130143959.3636394-1-pbonzini@redhat.com/ Changes from v4: - Updated the tracking support for CR0/CR4 Changes from v3: - Some krobot fixes. - Some checkpatch cleanups. Changes from v2: - Update the freeing of the VMSA page to account for the encrypted memory cache coherency feature as well as the VM page flush feature. - Update the GHCB dump function with a bit more detail. - Don't check for RAX being present as part of a string IO operation. - Include RSI when syncing from GHCB to support KVM hypercall arguments. - Add GHCB usage field validation check. Changes from v1: - Removed the VMSA indirection support: - On LAUNCH_UPDATE_VMSA, sync traditional VMSA over to the new SEV-ES VMSA area to be encrypted. - On VMGEXIT VMEXIT, directly copy valid registers into vCPU arch register array from GHCB. On VMRUN (following a VMGEXIT), directly copy dirty vCPU arch registers to GHCB. - Removed reg_read_override()/reg_write_override() KVM ops. - Added VMGEXIT exit-reason validation. - Changed kvm_vcpu_arch variable vmsa_encrypted to guest_state_protected - Updated the tracking support for EFER/CR0/CR4/CR8 to minimize changes to the x86.c code - Updated __set_sregs to not set any register values (previously supported setting the tracked values of EFER/CR0/CR4/CR8) - Added support for reporting SMM capability at the VM-level. This allows an SEV-ES guest to indicate SMM is not supported - Updated FPU support to check for a guest FPU save area before using it. Updated SVM to free guest FPU for an SEV-ES guest during KVM create_vcpu op. - Removed changes to the kvm_skip_emulated_instruction() - Added VMSA validity checks before invoking LAUNCH_UPDATE_VMSA - Minor code restructuring in areas for better readability Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Jim Mattson <jmattson@google.com> Cc: Joerg Roedel <joro@8bytes.org> Cc: Sean Christopherson <sean.j.christopherson@intel.com> Cc: Vitaly Kuznetsov <vkuznets@redhat.com> Cc: Wanpeng Li <wanpengli@tencent.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Brijesh Singh <brijesh.singh@amd.com> Tom Lendacky (34): x86/cpu: Add VM page flush MSR availablility as a CPUID feature KVM: SVM: Remove the call to sev_platform_status() during setup KVM: SVM: Add support for SEV-ES capability in KVM KVM: SVM: Add GHCB accessor functions for retrieving fields KVM: SVM: Add support for the SEV-ES VMSA KVM: x86: Mark GPRs dirty when written KVM: SVM: Add required changes to support intercepts under SEV-ES KVM: SVM: Prevent debugging under SEV-ES KVM: SVM: Do not allow instruction emulation under SEV-ES KVM: SVM: Cannot re-initialize the VMCB after shutdown with SEV-ES KVM: SVM: Prepare for SEV-ES exit handling in the sev.c file KVM: SVM: Add initial support for a VMGEXIT VMEXIT KVM: SVM: Create trace events for VMGEXIT processing KVM: SVM: Add support for SEV-ES GHCB MSR protocol function 0x002 KVM: SVM: Add support for SEV-ES GHCB MSR protocol function 0x004 KVM: SVM: Add support for SEV-ES GHCB MSR protocol function 0x100 KVM: SVM: Create trace events for VMGEXIT MSR protocol processing KVM: SVM: Support MMIO for an SEV-ES guest KVM: SVM: Support string IO operations for an SEV-ES guest KVM: SVM: Add support for EFER write traps for an SEV-ES guest KVM: SVM: Add support for CR0 write traps for an SEV-ES guest KVM: SVM: Add support for CR4 write traps for an SEV-ES guest KVM: SVM: Add support for CR8 write traps for an SEV-ES guest KVM: x86: Update __get_sregs() / __set_sregs() to support SEV-ES KVM: SVM: Do not report support for SMM for an SEV-ES guest KVM: SVM: Guest FPU state save/restore not needed for SEV-ES guest KVM: SVM: Add support for booting APs for an SEV-ES guest KVM: SVM: Add NMI support for an SEV-ES guest KVM: SVM: Set the encryption mask for the SVM host save area KVM: SVM: Update ASID allocation to support SEV-ES guests KVM: SVM: Provide support for SEV-ES vCPU creation/loading KVM: SVM: Provide support for SEV-ES vCPU loading KVM: SVM: Provide an updated VMRUN invocation for SEV-ES guests KVM: SVM: Provide support to launch and run an SEV-ES guest arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/kvm_host.h | 12 +- arch/x86/include/asm/msr-index.h | 1 + arch/x86/include/asm/svm.h | 40 +- arch/x86/include/uapi/asm/svm.h | 28 + arch/x86/kernel/cpu/scattered.c | 1 + arch/x86/kernel/cpu/vmware.c | 12 +- arch/x86/kvm/Kconfig | 3 +- arch/x86/kvm/kvm_cache_regs.h | 51 +- arch/x86/kvm/svm/sev.c | 933 +++++++++++++++++++++++++++-- arch/x86/kvm/svm/svm.c | 446 +++++++++++--- arch/x86/kvm/svm/svm.h | 166 ++++- arch/x86/kvm/svm/vmenter.S | 50 ++ arch/x86/kvm/trace.h | 97 +++ arch/x86/kvm/vmx/vmx.c | 6 +- arch/x86/kvm/x86.c | 344 +++++++++-- arch/x86/kvm/x86.h | 9 + 17 files changed, 1962 insertions(+), 238 deletions(-) base-commit: dc924b062488a0376aae41d3e0a27dc99f852a5e