From patchwork Mon Jul 24 20:02:38 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brijesh Singh X-Patchwork-Id: 9860233 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 1919360349 for ; Mon, 24 Jul 2017 20:03:41 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 092A428592 for ; Mon, 24 Jul 2017 20:03:41 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id F1B9A285A2; Mon, 24 Jul 2017 20:03:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1AB012859F for ; Mon, 24 Jul 2017 20:03:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752766AbdGXUDg (ORCPT ); Mon, 24 Jul 2017 16:03:36 -0400 Received: from mail-dm3nam03on0066.outbound.protection.outlook.com ([104.47.41.66]:3232 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751753AbdGXUD0 (ORCPT ); Mon, 24 Jul 2017 16:03:26 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector1-amd-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=o26q/A+d//cqPdCFIgm5I4EIWkwTuTlINiqfYZN5ShM=; b=JM9p5lSfh28zw7hyOBW7o7sHwXIi6+A2WWu3lsIM+96GBRjKrRGQu0Ef21S/nVkGbInfg9HYsih17Hf01B6qq3I39oR7T5ebJighXUtFvxSSOP07So1/589I6BMHjR/vRonSGpWYSUOTgRuVYhmtOUCVQAXGqmAQtn0CIB2bzo4= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; Received: from ubuntu-010236106000.amd.com (165.204.78.1) by BY2PR12MB0145.namprd12.prod.outlook.com (10.162.82.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1282.10; Mon, 24 Jul 2017 20:03:20 +0000 From: Brijesh Singh To: linux-kernel@vger.kernel.org, x86@kernel.org, kvm@vger.kernel.org Cc: Thomas Gleixner , Borislav Petkov , Joerg Roedel , "Michael S . Tsirkin" , Paolo Bonzini , =?UTF-8?q?=5C=22Radim=20Kr=C4=8Dm=C3=A1=C5=99=5C=22?= , Tom Lendacky , Brijesh Singh Subject: [RFC Part2 PATCH v3 01/26] Documentation/virtual/kvm: Add AMD Secure Encrypted Virtualization (SEV) Date: Mon, 24 Jul 2017 15:02:38 -0500 Message-Id: <20170724200303.12197-2-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.4 In-Reply-To: <20170724200303.12197-1-brijesh.singh@amd.com> References: <20170724200303.12197-1-brijesh.singh@amd.com> MIME-Version: 1.0 X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: DM3PR12CA0049.namprd12.prod.outlook.com (10.161.151.17) To BY2PR12MB0145.namprd12.prod.outlook.com (10.162.82.18) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: f78b70c5-b1f8-4d0d-28b7-08d4d2cf08c4 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(48565401081)(300000503095)(300135400095)(201703131423075)(201703031133081)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095); SRVR:BY2PR12MB0145; X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0145; 3:Xwa+V6by1ZsH5zAui17BszqueNFGHkc7YD3jQlYoPkeJbW7H8mlQITNxZWYPLsYG9Qe8EnXnvZXz963i++Vluxy4YJMkTEsJ70GUMRNYcMSkzF4b2yi1UB2Q/IP7HqUyYz4voLqETvoI/0eQaHhXPbL9cEaP/IFqng99cvoRnZdUuVBDhprMIXFvYlRJO9/MtutAtq41Plc2n9YjAWOtwQEbghUSIyh7xr6ESPQQ6aZcUTAZU26dIm2/K05KTVsY++5HkJxlcLDM2FlCA8eNYixISIts3C1jSiif9t/SoSWoMs1QybsfbS07++d534Nt+Eit8FPRnP3BYYxKZJynFdlY+1ZR38bT3apj1ntt1cAiog3xcnIdDBfF9X5p2LNcgxsNkd6Bczv6ZSg2/I9XZDd8n9jLEFGJdqB4VDVw4sbyRL2dFCd2TORhRPSxVx85cLyaS3zpgUjnpXwuFYIa7cuVSc+TGuSxKFL7BTijIGDzSCAfw66MNSxypDcG8OFNFQ2zOKKOrTeLzf1QP3OHxzCmCm8pGWNnH3gcO2MpY91hpaqLEfpxKmmLErgOCTjsmXABZnuUvJz3U7PxvlzkVVmJrVKY4bw8pqX6zfP0ab5b2Je2OfUTjN4lXg4GGAyVxJxk8o0qqeCm0MZITfrpWhMg7FRI+39QlZ21FiM2ksrFZ+S5NbrEsfqqm/MRUr+wT4KEr5lCKIh/9iY96EMPKsjZ+dYnaU06xyhqza3TffvcrOodpmGU5O8SQStXKdPh3/eBVq3hxyMvtsXHp65ocA== X-MS-TrafficTypeDiagnostic: BY2PR12MB0145: X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0145; 25:UkMK1rInP3AYvijiQPd/WaoKK55PEf+W26eyJIZ5mmTOZCmll05oar2E4U5RQyzWlmEgga89WtEELK7ReoiZ2IDb8UJg36Ct9FdxhmUQ68tn4fBv3vErUvTTr9I8AYtxWD+3TKhmFFQR3UZwXt3H9Pc1Xxm0IpZ24ZpSBhNAYSVZkWFVr/yAM/XmaYWj0JCBuitBl93WwSKUalzuy1/W8SCrYNiS9D2IY21HEmCCsSpkawvlNk6+fSVKJoOQJBs8kLAujETTnJ7CYnly1bpHQL8PyP6IVfyr5hQbGO4oOBA4D+EtTOubN6rMKl3jr3r3M2c6vyjcvXd4cckzXdM9HB13JbOuzD6w3RJiRcUN4fbdjsQPXPpi8SeS3y0/+lwYM7khutJYsRUsYS5zDqS/NF5CjnNJMmZo2jLL6jQK+Wsl9+/xPVZjr2vSj7PE2+ES3XRCEDAOot++B3S3iyUAZ41DpYUVaQ6y5D2wisJ60+YNHu52+ZWM0eK2PHmv7uPawJ9BCpFEmab0FzwvQDve6c5SmOw8aOZhLD8LmUCt+EhjY0hwbsTMqh/eXvrOSBzgh3GempgX3p+VCltnLbRHRyjjmGzS4ln3ja4OqSkqj1AdvdPG8TtBz6ePMDkkhKdUJrGmKyrxfxG+4UJYPTud0AP9eQUgAOe1pldyg2cBqbrfKHHwm3AJuuExKHc3BUTytZ/I2Q2BLSKPMbcvitJ65oJ67jVVD6Tw5rjIqShbtCUXWCOBjFG6XDKz9hiVNCov42gyhctechrHVzbFqkSBeLOqcDDg7b2fmSVA3UH+aa3JLSmzx98Q9szlR+sftTmKxfvyD8LsNH4B7QEpr59Gw0Nqc90+CXGTr3+i02gUAjr1rpEaqE0b3Ye4PHBbBAkxU9ePC8eBfR6fpUJq7fRHMc3LoG4OWk7ZKMLmRH0gj /I= X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0145; 31:G650zKZUsv/ZRpykf3YMTtQPtEupspW1ljqdvcePV6WHU4gY6RsnMfAzXXVSBMXUljiznYTJOR/+2ph9fE4ZOvxOGWXS29fnjOxGUcjQlrAbqILmUE4ods0hvYC5uMqpBXR/AWGckzeHwkZSBPiiprrI5G1OHmbzzc2SAiKGGLcH+5GUEhPriHtmn0UU70HRhAIEgXfh6kHaEGYJHslhd9cHmhdMLFnJZOOLTb+JFvUguYffxLqgWF4uh3kpcX6mvCryJE6b0TJbNE5T8EAknnb+NUC6LMy+ux+pF5lPFH3X+W/NIyEsf3YEXYK2jfc/EcTyAm0j9f2BpRArJnpwKq9ubaZX6A4LDsEXEhA98XW7gw0B17dho37p6KE4FITPQKC2j/sY9lv5lUg1imto3cJBQdGCyj+SLwwU1TDP1ZfDdykMTIWKDR4MWKXVJNUpc9j+p0YAFs6qCskQDl4oKiLCk1kLdfV3710syjdndZEbPZm8ndRtu9XPN6G3RBBSVxtx9YGHE1wOTosydnFwg0+1SLszCgT8TQkmfk2Ydcrvo8QSHWb1o7K57yw6WO9S+/KJwe8U5qrFQ50EMoHKMYBmzFC9891HS+922Z19NlZYgmBSx+Bl/GIvOzNEcQr7duI5DZL1EETCAEp4BzB9Z/QKXYNQrFCulg8DxWdTp+M= X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0145; 20:t0AxNGXOijwtkm3nOlZbbtypqe9hWASeSRpWz75WXgeUalm/oi5OTHpj/1OYlIYVQ6kcdmr13sxGw7mh2thM6vtLMyaSH3Ij4VcYhulYAD1ux5BcW+Q4MpPrhJKT7O0XzzojDpRqWjt/I9QJjOU+ui/jmLFDedDxXshEQAyWmgdVfcr2+Z2uJ7RMjINcKbTyNiSeFb3A7nF05jCmTAdp0UzjSKidM94L3TvKR67XmRVxTKJ1GIga3OeidcSakrcXY29CXFywR/bnZmGDuFUFo9pCXCMLd9deTxgGLu/s2es+cqQKGMXpp9NwQzEeuKDfjxpp/tbfFc9KCSPzskggXA+J6RH9JW2qZZYysIR7NhGR3nU+XJOCeMQp6uqQjY28WJe4Cj00LQK9BMqxmFxiyDg+2ZNbMd3vi1nH5oPEWq0kpgumRgHJtqSYGe3mjY7I9auqkRU6cEhlwsiGmCGVnqYwR8NqFX5/iRVYkvm0eAh7Ucla2K73XhymtF3h17w6 X-Exchange-Antispam-Report-Test: UriScan:(20558992708506)(767451399110)(17755550239193); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(601004)(2401047)(5005006)(8121501046)(3002001)(93006095)(93001095)(100000703101)(100105400095)(10201501046)(6055026)(6041248)(20161123562025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123564025)(20161123555025)(6072148)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:BY2PR12MB0145; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:BY2PR12MB0145; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BY2PR12MB0145; 4:Kop1cZfMLPcF3Bgr524I1JF2Mtv8JFhkakt9dLyOte?= =?us-ascii?Q?HMewrXtwfZ4T4IWADkDgMCTfe5TSddZCFYfSJ9doPYnXlQl6eJtNsl+GLA1W?= =?us-ascii?Q?mCSCcrgky9M7WrUYBN5+hh4x03N2yL+IGFgTiHTa9hUI2cz0SgDnsFYDqv8Z?= =?us-ascii?Q?SuPyV4titkhJb0ebMJ8Wjm4SxzGT9kjllQ0qTLC7oXuIHn7s/JMu93vZB8j5?= =?us-ascii?Q?RaJreIf0tO6hDZ7NVbQ1zh5i+TAlc7NNYoRZXPc48XCQhKcAgwB4LMlMnGge?= =?us-ascii?Q?QLEK22fiZkm/d2K0HjaHH1ph+w9k95cD574YmFj68M9R1rCLcexb80Iz2a6j?= =?us-ascii?Q?fwGSGDy4OjnsecipA9tetnIA9oVdEYE6C6w6Yw/IcX3KaVshkG9aNhU+ZjPh?= =?us-ascii?Q?KTpIqiDfyUmsPCw8CBC58zsTv8XlXmONdahBHQ3mO9ia7gpHD51NKSZhKDi8?= =?us-ascii?Q?QzNHcwFB6OSKjL+q1JRdaHJvVLBNjQn0NDwoDUddbxQKsI79+psWCZf+ZmQd?= =?us-ascii?Q?FOt5B9lpI0Kct91NsQ2K1rrRtN2LsaTE+bIbAdB8X7haFOzUUFUku3424Bvd?= =?us-ascii?Q?u0vTN7gPQiQAU7sZL9JLCtVT8HnBCYKzubXvTRxPSG1plAOz7TYqlpjwKICF?= =?us-ascii?Q?0f0DycmwGxzyt0lUOO94SlURNvpoadzgRgSzk5hs8LonsS7dK9XOTjwPH3Ka?= =?us-ascii?Q?yKxBRQ4XmsQoyC+xbjqsrVVObKNpTmBnFS9urfakGyPFPHFtV0iGl8a4RnQd?= =?us-ascii?Q?1LlWQBhCTqgRWO8PkrlFm2SVAg3kF7xvXF/mydmUcRTDVDWn0B+RtyoUf28l?= =?us-ascii?Q?pPo3RrPy5siUv38TAzvhwzTLCIAPZ1mXu4Ngvlb9u1voXty0SXxkV8SA0kVK?= =?us-ascii?Q?mN2Epp87IpFIKfdY/h/tfb7ucLJPeIHOpsURp3D7c3jHBamvVUziYOlwULkl?= =?us-ascii?Q?63WVJP1+daTiGMTr9vzM/gHM1AIkZ7h8Oe1AMNL/eruw2v+0cXWLMyYDSEMO?= =?us-ascii?Q?i9MyiexLzZZyQPFqRB/UE7W/U+8ZjTvXAbto5yqXFKoas8zHam+WTQEdBiCp?= =?us-ascii?Q?uhgJWxjJkio/KYLGSRs3uUJa+06WftWiJxUIg5nTatQ8NHZVquDKlujeUBY7?= =?us-ascii?Q?KpzPkmdisgrf5xmsZ9bfeN9xUb1ivDAEh35ANgrKW492+FJ9iD8ViiGGob65?= =?us-ascii?Q?EwoY+t4p26I98PeCMUcQ6Kvx+ZwTHBGsxW/mqt3yl946gGDt8P6nC6iZqqbA?= =?us-ascii?Q?Ft9mdANQdywDetzo6/pCA/oCZSFmAC7qoBLp8p?= X-Forefront-PRVS: 0378F1E47A X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(4630300001)(7370300001)(6009001)(39450400003)(39410400002)(39400400002)(39850400002)(39860400002)(39840400002)(189002)(199003)(7350300001)(68736007)(53416004)(105586002)(6306002)(54906002)(97736004)(50466002)(6486002)(48376002)(2906002)(106356001)(33646002)(6116002)(1076002)(53936002)(3846002)(189998001)(101416001)(6666003)(2950100002)(478600001)(50986999)(76176999)(81156014)(50226002)(38730400002)(47776003)(5003940100001)(86362001)(25786009)(4326008)(36756003)(42186005)(8676002)(81166006)(110136004)(5660300001)(66066001)(7736002)(305945005); DIR:OUT; SFP:1101; SCL:1; SRVR:BY2PR12MB0145; H:ubuntu-010236106000.amd.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BY2PR12MB0145; 23:g3HQ0MVABbBhgUx7XO8S+RROdfpBibzXfDqjU3rzn?= =?us-ascii?Q?xvr5gfQ5RV5vu3JI1PopqkaMzIckoTXsswL0noR6NjNJG/nnBnXBdKT0CvUg?= =?us-ascii?Q?32LdTDUrIjEmJqVsQvPDOOZEBcgZ+wNEb2kfHgOK80PEOo5/h5Tx9/ftfhgh?= =?us-ascii?Q?4mo/Oz60m8JW7KHf8CMFyyFflymcRLn5/MbE5nbpHgYM/Wf/3OHZLmSYOd3N?= =?us-ascii?Q?FiG3DM1gm/QKjBUy7ruemyknMpAifOQmb9mRHpcvNML5y2Ubc942R8Bysv9Z?= =?us-ascii?Q?fnWiM7dh8Zm6IouNfux9QL9RKuytf0av4fD8xsfZYB4DLItrxWnZ7T+MpS8l?= =?us-ascii?Q?RgBVUtwq8umE/dVaBs/Lr8LctCzfKLzxWr4tFsydbiXIZ9ugQn4wuwEmoDdj?= =?us-ascii?Q?9b/a7Imp8hxV4hrr6qRrGrXRElMMTTaPNbwGsbJKXVDb4CC+ES/BhWUHsdWz?= =?us-ascii?Q?aI6+fWVfEe0L+SB/Ks/RgT/PYEWzXnHolNH0jftcc5X44r5zrrBLv1M3ERm6?= =?us-ascii?Q?sjFotyq1sOSXhD81rJjutdu+98HsC2TeA9l1+NitlFwMaYlO46oDigoKdntW?= =?us-ascii?Q?6nSAwkDBvyBDjhQDwIzGH1r1JtxLDVw6XZMmMah6KJcmfuxu6b1vexnc73At?= =?us-ascii?Q?+1SNv+vKS4FJqAKSjl/kai9OdyL16VKtFWP5IQy2uVnzDsYq0FJ7PH9P1WYy?= =?us-ascii?Q?8nqC6Yd1jn/7PD7cHYxhdbL45LWk+dkmmfjh0BzzCUjNxVmmnsNI7EBu91oe?= =?us-ascii?Q?biXczEEyO0BEfMdIKzm/e+E8RcShNgaFp9FalZcj6QdXOm++Kj3TQ8DxvEUP?= =?us-ascii?Q?7yOR+NffPV4i3NMkiEtlkaA3C0TbFnAhehmOVrrVsIxtBuX6v53NFl4k7B1U?= =?us-ascii?Q?3/HkwsxOfSSZcSM4qltKm/Q9xW0HAAnSq4eV2mv/yi7MRr+C5W2JphUlkF9Z?= =?us-ascii?Q?Z8lXBO/zoaJ8iIXVQqI6pZ+e7lr+i+DwaeSo7APhqE0YavrRtI+fym03Uh7A?= =?us-ascii?Q?PMsD1ZeH/yMZXTAQu9GQHhjydEJZDNAM0sOfkYEU7e+ZizspIS/oiuBaXqCS?= =?us-ascii?Q?f7I+t/pkUwAN3yJftET/99saDzqHvuiRBYmrXBjD+wTzz1DpWeP1dBbadWze?= =?us-ascii?Q?wXroCaJi+OY6lOTWjXdM44bnvMSPy9av0tIrFwVTAk9BQF/5U858v9uTkh4Z?= =?us-ascii?Q?iC7cVB8O+1ZJA+ugYvEL8Ln33O6ygbcF6FpiE3Mo0dHTDzc/dWCUnO0Jvfvr?= =?us-ascii?Q?IwQ+rUeJ9Xv/VA9bxslp3fz8iidT0IzcxLZjzJhwUspIA7IehhBEEvEiNKxc?= =?us-ascii?B?dz09?= X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BY2PR12MB0145; 6:gvjRLgmq/0OmgTIuoacp74bfoLEKzHL6ncNTSQn3wH?= =?us-ascii?Q?UcuMKxaGSCg/vAp5g+buki4peH8e0jW3rh3YypyVANi04yt30qP3kdihlcsi?= =?us-ascii?Q?kSHou1EF6gJmx6E3hhBH6jSfVAyeeqQIYy5n0y0WNutDBlfCVrH6TvCP66so?= =?us-ascii?Q?qIQqNt06hfYMzRcYABaxxkXLvTTWT6yE9uww1Bishs8kp7ucq3xmT3i3BR0I?= =?us-ascii?Q?4kQNmMBbhsRu/qRJveyaX16MpAFUdKuV7SfGx+A012+XfpZbq1ovCstNw/ij?= =?us-ascii?Q?6hCdpMzDUBsVbf31U3lgMhLxrv02FaFGSko2Py0CS3+IoyUv1I04ztoGJREa?= =?us-ascii?Q?hcP7L8LKsafeX0Ar2VOlg1Rsg6fIXd/pqWM5VqfMyJKF+98aa9BFjR7/Bprw?= =?us-ascii?Q?Mz/6iQ1U7IUezf64zhU3Tipe9AqFXg76xcIpw5rp4NvPTI/e+idGu+IYMUmn?= =?us-ascii?Q?v9KNlfYNKcDPpW6S2I4HLnCaTS4/oFgXPGwB2ywQzf3W26+tEeRFGCV0EJb2?= =?us-ascii?Q?QrS2phLvx21xwCaE2zh2T9ZWbqfbkAmJvJlrv/vW2zxivF62PrlYF7/s+JLF?= =?us-ascii?Q?jBjigq4ma2LBW6crreO22YNm9F445+fVB+1tPWfzG6fDzlvbdgnIkd1kAfck?= =?us-ascii?Q?bGEDCq03xu4LtLwyQeX3WhVjjhKz7q0kVx1CHePZrHPeiWnKSdNrSxLMKwwt?= =?us-ascii?Q?tLxkncyTAI5mV4B6xdEjZed44OWTWUUoU2wd/eX/BHgihtHyo1I9OkKsdJR6?= =?us-ascii?Q?aoX0ZHv8rsxvOTv/ahWuW1s0Ac//h3VXaeDeLqIHoDOp51iZ4Kz98vAam/LF?= =?us-ascii?Q?zSUoCGBYPx0Io0UKeH0tJ8xN+SNIwn+B0FpM6hIb6u1qgq+2jkWgRt/6rOLl?= =?us-ascii?Q?Aq9WxqoOmoQyNInVuhInsI+MU/syPnVeYr3hukOcao7PoNj/x4oOwLAjbNTi?= =?us-ascii?Q?4F45z+G3BUvOY1OvP3+T0qE0ZzFbEka8bWq4ilX16lZfoYUvCAPxUicWNes7?= =?us-ascii?Q?GEMN0QXQ8mEj84lyRdTrvC?= X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0145; 5:IANQMkdBeMlJYbdd4MJ2KVjSwrW0VFJWMpUP1MzOB7zT3lMVy5LwJ18OnoZHtZnZfnDMhHRsp19VSI506eD1u8fEDN0wNVg1CNOECGSNwjoyvkkfqPhrY7+Vjc9z5QcYeWE47rGrjK39fHCj83vS7l0DP7+EBpCw8ZiYM7S4ToJTl619NBq82c5cEfyrlB3NLqwZGXNxrv+D3ptHOyDRQHEpieL1rXszcOiXLU9tglDi0TMNa0cDHYFeCwTN2SdY3wTis3+Ux1DfvPe9QodX7AqxXdub7ujRvjPMObM19+luCyi1EktLtP0MAUv2Dj2SpVcEjk/YWAbpGDKmEiiSI64MTLLu0WtcX4a3WDsxTnMz0995m4Fa4poLLvYbaLX7Bpe3rZrYSvN21bAaRORkz0HtvsNudZ3fATQjLHFArsbwK4Hi0UmfHdiay2iNyKFMV1i3Wy08bjPHx2dTaB20QvTR0My1cvDAHpMtuGDbxjNamXj0FcBiyQXT7Xr7s1Yx; 24:espkIPf9i6RdOY14FH+DNy1YzqKONHadDN+Q5QCqF3X11FFW293clVTfsYZ3NcSakkzWchQNoQZbMsAfztZ1crLaSRaNmhyB8PEftVYwlhE= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0145; 7:u2AD0B3MTtMudJChHciqLMoRMHy4CZMWA0zKG8Henxr6wz1/P83kYPDITnSueMds+BXt4qwScWLqyW/RGPfEG/UJ6GgQ1dAWoud4B+3vnqVA292cg/f+0F/FJFTbSNHDs9eNPcPYtL0koR15goEA5dwLdFggKpj8LQK//Cmqq6k6ojtOD7nswQ4xUr+VJdCId4xQm+2w0nbuTT3Qv9d2is8RYNUvCyY8HsQwnrkep/m7G3rqImCRIYuKBh13y/+1hNDWF5xjt07mNQZESdHDW50XmIzf+2lRAqXCVIVwdsr7asyyGRC7iJNOIGiJ2qM13lTyGTIp4AJH2N1iwPh5NGWlF9x5cziBthv4+gsKeL32xf/wgekRlno4yjbeQXtITLjvKjL81gEIHYlSfv6Z2adjaHrfOwV5ZhQzneIOdC9HZcpdopFS2AiDvowPcLQqi/1Bop0sAHp5+drQVqRQuq1NiGoNZAHxmqJ8KUPxPR3X2xvJc5wwF+Oyt6fndj/zxEh2YFy5ijMZM985pAbdotS264ji3n5VgwmG1FulIuJwupvU5NSkpLQZyzuZrHhJJtgl0fsX7/J/QNoNLNBctNxJcNrCgEkYnDAGCHuugO5Hfor2LBSZLcBkjJbsGT8SKkgj5flix5ygGw2a23kA55NTQtvxffaBxKOc8CoTdHejOIgLaeT+LykkpI066Qf3ffqsLlyJcPQTXnbaBr99KePA4yhcvYk7eUiUG7OMdwuEi4lTqhrZbZZOOkorWzxQa/foS3XXKpu/Gs5QNjCAOgiYRGyL/+Sd+DbSUPn+iNs= X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0145; 20:fvIgR+ByVU4egGBiAyF1WTjrQ7MMB/hDV9/TglCwo2sOwsFTPDxVs6xyJUDmCQka4F8ObPhjX+vKKGXQ5jpm08lsB2chaCBeey1ljrHs2YykBTH5lrVj6cgL2QYzV35HrO0nJWDlj6tTzmj4Wxa7AdWJyaNQ82iBmGXPCaQA9Q57S8sUkkXpNAJK2UwMXQUgDqawrXaP7erPTVSj6DjeJo1KFjyimnQLl2VwOf+37+gA2nO4rZNeqSqzeuD08kvE X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Jul 2017 20:03:20.3531 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2PR12MB0145 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Create a Documentation entry to describe the AMD Secure Encrypted Virtualization (SEV) feature. Signed-off-by: Brijesh Singh --- .../virtual/kvm/amd-memory-encryption.txt | 328 +++++++++++++++++++++ 1 file changed, 328 insertions(+) create mode 100644 Documentation/virtual/kvm/amd-memory-encryption.txt diff --git a/Documentation/virtual/kvm/amd-memory-encryption.txt b/Documentation/virtual/kvm/amd-memory-encryption.txt new file mode 100644 index 0000000..cffed2d --- /dev/null +++ b/Documentation/virtual/kvm/amd-memory-encryption.txt @@ -0,0 +1,328 @@ +Secure Encrypted Virtualization (SEV) is a feature found on AMD processors. + +SEV is an extension to the AMD-V architecture which supports running virtual +machine (VMs) under the control of a hypervisor. When enabled, the memory +contents of VM will be transparently encrypted with a key unique to the VM. + +Hypervisor can determine the SEV support through the CPUID instruction. The CPUID +function 0x8000001f reports information related to SEV: + + 0x8000001f[eax]: + Bit[1] indicates support for SEV + + 0x8000001f[ecx]: + Bits[31:0] Number of encrypted guest supported simultaneously + +If support for SEV is present, MSR 0xc00100010 (MSR_K8_SYSCFG) and MSR +0xc0000015 (MSR_K7_HWCR_SMMLOCK) can be used to determine if it can be enabled: + + 0xc00100010: + Bit[23] 0 = memory encryption can be enabled + 0 = memory encryption can not be enabled + + 0xc00010015: + Bit[0] 0 = memory encryption can not be enabled + 1 = memory encryption can be enabled + +When SEV support is available, it can be enabled on specific VM during the VMRUN +instruction by setting SEV bit in VMCB offset 090h: + + VMCB offset 090h: + Bit[1] 1 = Enable SEV + +SEV hardware uses ASIDs to associate memory encryption key with the guest VMs. +Hence the ASID for the SEV-enabled guests must be from 1 to a maximum value +defined through the CPUID function 0x8000001f[ECX]. + + +SEV Key Management +------------------ + +The Key management for the SEV guest is handled by a seperate processor known as +the AMD Secure Processor (AMD-SP). Firmware running inside the AMD-SP provides a +secure key management interface to perform common hypervisor activities such as +encrypting bootstrap code, snapshotting, migrating and debugging the guest. For +more informaiton, see SEV Key Management spec: + +http://support.amd.com/TechDocs/55766_SEV-KM%20API_Specification.pdf + +1. KVM_SEV_LAUNCH_START + +Parameters: struct kvm_sev_launch_start (in/out) +Returns: 0 on success, -negative on error + +LAUNCH_START command is used to bootstrap a guest by encrypting its memory with +a new VM Encryption Key (VEK). In order to create guest context, hypervisor should +provide guest policy, owners public diffie-hellman (PDH) key and session parameters. + +The guest policy constrains the use and features activated for the lifetime of the +launched guest, such as disallowing debugging, enabling key sharing, or turning on +other SEV related features. + +The guest owners PDH allows the firmware to establish a cryptographic session with +the guest owner to negotiate keys used for attestation. + +The session parameters contains informations such as guest policy MAC, transport +integrity key (TIK), transport encryption key (TEK) etc. + +struct kvm_sev_launch_start { + + /* Guest Hanldle, if zero then FW creates a new handle */ + __u32 handle; + + /* Guest policy */ + __u32 policy; + + /* Address which contains guest owner's PDH certificate blob */ + __u64 dh_cert_address; + __u32 dh_cert_length; + + /* Address which contains guest session information blob */ + __u64 session_address; + __u32 session_length; +}; + +On success, the 'handle' field contain a new handle. + +2. KVM_SEV_LAUNCH_UPDATE_DATA + +Parameters (in): struct kvm_sev_launch_update +Returns: 0 on success, -negative on error + +LAUNCH_UPDATE_DATA encrypts the memory region using the VEK created during +LAUNCH_START. It also calculates a measurement of the memory region. This +measurement can be used as a signature of the memory contents. + +struct kvm_sev_launch_update { + /* address of the data to be encrypted (must be 16-byte aligned) */ + __u64 address; + + /* length of the data to be encrypted (must be 16-byte aligned) */ + __u32 length; +}; + +3. KVM_SEV_LAUNCH_MEASURE + +Parameters (in): struct kvm_sev_launch_measure +Returns: 0 on success, -negative on error + +LAUNCH_MEASURE returns the measurement of the memory region encrypted with +LAUNCH_UPDATE_DATA. The measurement is keyed with the TIK so that the guest +owner can use the measurement to verify the guest was properly launched without +tempering. + +struct kvm_sev_launch_measure { + /* where to copy the measurement blob */ + __u64 address; + + /* length of memory region containing measurement */ + __u32 length; +}; + +If measurement length is too small, the required length is returned in the +length field. + +On success, the measurement is copied to the address. + +4. KVM_SEV_LAUNCH_FINISH + +Returns: 0 on success, -negative on error + +LAUNCH_FINISH command finalize the SEV guest launch process. + +5. KVM_SEV_GUEST_STATUS + +Parameters (out): struct kvm_sev_guest_status +Returns: 0 on success, -negative on error + +GUEST_STATUS returns the current SEV state the guest is in. + +struct kvm_sev_guest_status { + + /* guest hanldle */ + __u32 handle; + + /* guest policy */ + __u32 policy; + + /* guest state (see below) */ + __u8 state; +}; + +SEV guest state: + +enum { + /* guest state is not known */ + SEV_STATE_INVALID = 0; + /* guest is currently being launched */ + SEV_STATE_LAUNCHING. + /* guest is being launched and ready to accept the ciphertext data */ + SEV_STATE_SECRET, + /* guest is fully launched and running */ + SEV_STATE_RUNNING, + /* guest is being migrated in from another SEV machine */ + SEV_STATE_RECEIVING, + /* guest is getting migrated out another SEV machine */ + SEV_STATE_SENDING +}; + +6. KVM_SEV_DBG_DECRYPT + +DEBUG_DECRYPT command can be used for decrypting a region of guest memory for +the SEV guest debug purposes. Note that since decrypting protected memory allows +the hypervisor to gain access to guest memory, the guest policy must explicitly +allow debugging for this command to work. + +Parameters (in): struct kvm_sev_dbg +Returns: 0 on success, -negative on error + +struct kvm_sev_dbg { + __u64 src_address; + __u64 dst_address; + + /* length of memory region to decrypt */ + __u32 length; +}; + +7. KVM_SEV_DBG_ENCRYPT + +DEBUG_ENCRYPT command can be used for injecting the data into guest for the SEV +guest debug purposes. Note that since injecting the data into protected memory +allows the hypervisor to modify the guest memory, the guest policy must explicitly +allow debugging for this command to work. + +Parameters (in): struct kvm_sev_dbg +Returns: 0 on success, -negative on error + +struct kvm_sev_dbg { + __u64 src_address; + __u64 dst_address; + + /* length of memory region to encrypt */ + __u32 length; +}; + +8. KVM_SEV_SEND_START + +Parameters (in): struct kvm_sev_send_start +Returns: 0 on success, -negative on error + +SEND_START command is used to export a SEV guest from one platform to another. +It can be used for saving a guest to disk to be resumed later, or it can be +used to migrate a guest across the network to a receiving platform. + +struct kvm_sev_send_start { + /* guest policy */ + __u32 policy; + + /* address which contains receivers PDH key blob */ + __u64 pdh_cert_address; + __u32 pdh_cert_length; + + /* address which contains platform certificate blob */ + __u64 plat_cert_address; + __u32 plat_cert_length; + + /* address which contains AMD certificate chain */ + __u64 amd_cert_address; + __u32 amd_cert_length; + + /* where to copy the current session information */ + __u64 session_address; + __u32 session_length; +}; + +The command uses PDH key to establish a new cryptographic context with the +remote platform - the new cryptographic context will be used for re-encrypting +the guest memory before sending it to remote platform. + +If length of the certificate blobs are too small, the required length is +returned in the length field and an error is returned. + +9. KVM_SEV_SEND_UPDATE_DATA + +Parameters (in): struct kvm_sev_send_update_data +Returns: 0 on success, -negative on error + +SEND_UPDATE_DATA command is used to re-encrypt the guest memory using the +crytographic context established during SEND_START. A fresh IV is generated +and written to the packet header field. + +struct kvm_sev_send_update_data { + /* address which will contain packet header (IV, MAC etc)*/ + __u64 hdr_data; + __u32 hdr_length; + + /* address of guest memory region containg encrypted data */ + __u64 guest_address; + __u32 guest_length; + + /* address of transport buffer */ + __u64 host_address; + __u32 host_length; +}; + +If the hdr_length is too small, the required length is returned in the length +field and an error is returned. + +10. KVM_SEV_SEND_FINISH + +Returns: 0 on success, -negative on error + +SEND_FINISH command finalize the SEV guest sending process. + +11. KVM_SEV_RECEIVE_START + +Parameters (in): struct kvm_sev_receive_start +Returns: 0 on success, -negative on error + +RECEIVE_START command is used to import a guest from one platform to another. +It can be used for restoring a guest from disk, or it can be used to migrate +a guest across the network from a sending platform. + +struct kvm_sev_receive_start { + /* guest handle (if zero then new handle will be created) */ + __u32 handle; + + /* guest policy */ + __u32 policy; + + /* Address containing senders PDH certificate blob */ + __u64 pdh_cert_address; + __u32 pdh_cert_length; + + /* Address containing sender's session information blob */ + __u64 session_address; + __u32 session_length; +}; + +The RECEIVE_START command creates a new cryptographic context necessary to +re-enrypt the guest memory receieved through the RECEIVE_UPDATE command. + +12. KVM_SEV_RECEIVE_UPDATE_DATA + +Parameters (in): struct kvm_sev_receive_update_data +Returns: 0 on success, -negative on error + +RECEIVE_UPDATE_DATA command is used to re-encrypt the guest memory using the +crytographic context established during RECEIVE_START. + +struct kvm_sev_receive_update_data { + /* packet header receieved from the SEND_UPDATE_DATA command */ + __u64 hdr_data; + __u32 hdr_length; + + /* address of guest memory region */ + __u64 guest_address; + __u32 guest_length; + + /* address of transport buffer */ + __u64 host_address; + __u32 host_length; +}; + +13. KVM_SEV_RECEIVE_FINISH + +Returns: 0 on success, -negative on error + +RECEIVE_FINISH command finalize the SEV guest receiving process.