1. Patchew
  2. EDK2
  3. [edk2-devel] [PATCH v4 0/4] SEV Live Migration support for OVMF.
  4. View patch

[edk2-devel] [PATCH v4 4/4] OvmfPkg/PlatformDxe: Add support for SEV live migration.

Ashish Kalra via groups.io posted 4 patches 4 years, 7 months ago
There is a newer version of this series
[edk2-devel] [PATCH v4 4/4] OvmfPkg/PlatformDxe: Add support for SEV live migration.
Posted by Ashish Kalra via groups.io 4 years, 7 months ago 
From: Ashish Kalra <ashish.kalra@amd.com>

Detect for KVM hypervisor and check for SEV live migration
feature support via KVM_FEATURE_CPUID, if detected setup a new
UEFI enviroment variable to indicate OVMF support for SEV
live migration.

Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
---
 OvmfPkg/Include/Guid/MemEncryptLib.h |  20 ++++
 OvmfPkg/OvmfPkg.dec                  |   1 +
 OvmfPkg/PlatformDxe/AmdSev.c         | 108 ++++++++++++++++++++
 OvmfPkg/PlatformDxe/Platform.c       |   5 +
 OvmfPkg/PlatformDxe/Platform.inf     |   2 +
 OvmfPkg/PlatformDxe/PlatformConfig.h |   5 +
 6 files changed, 141 insertions(+)

diff --git a/OvmfPkg/Include/Guid/MemEncryptLib.h b/OvmfPkg/Include/Guid/MemEncryptLib.h
new file mode 100644
index 0000000000..4c046ba439
--- /dev/null
+++ b/OvmfPkg/Include/Guid/MemEncryptLib.h
@@ -0,0 +1,20 @@
+/** @file
+
+  AMD Memory Encryption GUID, define a new GUID for defining
+  new UEFI enviroment variables assocaiated with SEV Memory Encryption.
+
+  Copyright (c) 2020, AMD Inc. All rights reserved.<BR>
+
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __MEMENCRYPT_LIB_H__
+#define __MEMENCRYPT_LIB_H__
+
+#define MEMENCRYPT_GUID \
+{0x0cf29b71, 0x9e51, 0x433a, {0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8, 0x75}}
+
+extern EFI_GUID gMemEncryptGuid;
+
+#endif
diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec
index 6ae733f6e3..e452dc8494 100644
--- a/OvmfPkg/OvmfPkg.dec
+++ b/OvmfPkg/OvmfPkg.dec
@@ -122,6 +122,7 @@
   gQemuKernelLoaderFsMediaGuid          = {0x1428f772, 0xb64a, 0x441e, {0xb8, 0xc3, 0x9e, 0xbd, 0xd7, 0xf8, 0x93, 0xc7}}
   gGrubFileGuid                         = {0xb5ae312c, 0xbc8a, 0x43b1, {0x9c, 0x62, 0xeb, 0xb8, 0x26, 0xdd, 0x5d, 0x07}}
   gConfidentialComputingSecretGuid      = {0xadf956ad, 0xe98c, 0x484c, {0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47}}
+  gMemEncryptGuid                       = {0x0cf29b71, 0x9e51, 0x433a, {0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8, 0x75}}
 
 [Ppis]
   # PPI whose presence in the PPI database signals that the TPM base address
diff --git a/OvmfPkg/PlatformDxe/AmdSev.c b/OvmfPkg/PlatformDxe/AmdSev.c
new file mode 100644
index 0000000000..3dbf17a8cd
--- /dev/null
+++ b/OvmfPkg/PlatformDxe/AmdSev.c
@@ -0,0 +1,108 @@
+/**@file
+  Detect KVM hypervisor support for SEV live migration and if
+  detected, setup a new UEFI enviroment variable indicating
+  OVMF support for SEV live migration.
+
+  Copyright (c) 2020, Advanced Micro Devices. All rights reserved.<BR>
+
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+//
+// The package level header files this module uses
+//
+
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/UefiBootServicesTableLib.h>
+#include <Library/UefiRuntimeServicesTableLib.h>
+#include <Guid/MemEncryptLib.h>
+
+#define KVM_FEATURE_MIGRATION_CONTROL   17
+
+/**
+  Figures out if we are running inside KVM HVM and
+  KVM HVM supports SEV Live Migration feature.
+
+  @retval TRUE   KVM was detected and Live Migration supported
+  @retval FALSE  KVM was not detected or Live Migration not supported
+
+**/
+BOOLEAN
+KvmDetectSevLiveMigrationFeature(
+  VOID
+  )
+{
+  UINT8 Signature[13];
+  UINT32 mKvmLeaf = 0;
+  UINT32 RegEax, RegEbx, RegEcx, RegEdx;
+
+  Signature[12] = '\0';
+  for (mKvmLeaf = 0x40000000; mKvmLeaf < 0x40010000; mKvmLeaf += 0x100) {
+    AsmCpuid (mKvmLeaf,
+              NULL,
+              (UINT32 *) &Signature[0],
+              (UINT32 *) &Signature[4],
+              (UINT32 *) &Signature[8]);
+
+    if (!AsciiStrCmp ((CHAR8 *) Signature, "KVMKVMKVM\0\0\0")) {
+      DEBUG ((
+        DEBUG_ERROR,
+        "%a: KVM Detected, signature = %s\n",
+        __FUNCTION__,
+        Signature
+        ));
+
+      RegEax = 0x40000001;
+      RegEcx = 0;
+      AsmCpuid (0x40000001, &RegEax, &RegEbx, &RegEcx, &RegEdx);
+      if (RegEax & (1 << KVM_FEATURE_MIGRATION_CONTROL)) {
+        DEBUG ((
+          DEBUG_ERROR,
+          "%a: Live Migration feature supported\n",
+          __FUNCTION__
+          ));
+        return TRUE;
+      }
+    }
+  }
+
+  return FALSE;
+}
+
+/**
+
+  Function checks if SEV Live Migration support is available, if present then it sets
+  a UEFI enviroment variable to be queried later using Runtime services.
+
+  **/
+VOID
+AmdSevSetConfig(
+  VOID
+  )
+{
+  EFI_STATUS Status;
+  BOOLEAN SevLiveMigrationEnabled;
+
+  SevLiveMigrationEnabled = KvmDetectSevLiveMigrationFeature();
+
+  if (SevLiveMigrationEnabled) {
+   Status = gRT->SetVariable (
+                L"SevLiveMigrationEnabled",
+                &gMemEncryptGuid,
+                EFI_VARIABLE_NON_VOLATILE |
+                EFI_VARIABLE_BOOTSERVICE_ACCESS |
+                EFI_VARIABLE_RUNTIME_ACCESS,
+                sizeof (BOOLEAN),
+                &SevLiveMigrationEnabled
+               );
+
+   DEBUG ((
+    DEBUG_ERROR,
+    "%a: Setting SevLiveMigrationEnabled variable, status = %lx\n",
+    __FUNCTION__,
+    Status
+    ));
+  }
+}
diff --git a/OvmfPkg/PlatformDxe/Platform.c b/OvmfPkg/PlatformDxe/Platform.c
index f2e51960ce..f61302d98b 100644
--- a/OvmfPkg/PlatformDxe/Platform.c
+++ b/OvmfPkg/PlatformDxe/Platform.c
@@ -763,6 +763,11 @@ PlatformInit (
 {
   EFI_STATUS Status;
 
+  //
+  // Set Amd Sev configuation
+  //
+  AmdSevSetConfig();
+
   ExecutePlatformConfig ();
 
   mConfigAccess.ExtractConfig = &ExtractConfig;
diff --git a/OvmfPkg/PlatformDxe/Platform.inf b/OvmfPkg/PlatformDxe/Platform.inf
index 14727c1220..2896f0a1d1 100644
--- a/OvmfPkg/PlatformDxe/Platform.inf
+++ b/OvmfPkg/PlatformDxe/Platform.inf
@@ -24,6 +24,7 @@
   PlatformConfig.c
   PlatformConfig.h
   PlatformForms.vfr
+  AmdSev.c
 
 [Packages]
   MdePkg/MdePkg.dec
@@ -56,6 +57,7 @@
 [Guids]
   gEfiIfrTianoGuid
   gOvmfPlatformConfigGuid
+  gMemEncryptGuid
 
 [Depex]
   gEfiHiiConfigRoutingProtocolGuid  AND
diff --git a/OvmfPkg/PlatformDxe/PlatformConfig.h b/OvmfPkg/PlatformDxe/PlatformConfig.h
index 716514da21..4f662aafa4 100644
--- a/OvmfPkg/PlatformDxe/PlatformConfig.h
+++ b/OvmfPkg/PlatformDxe/PlatformConfig.h
@@ -44,6 +44,11 @@ PlatformConfigLoad (
   OUT UINT64          *OptionalElements
   );
 
+VOID
+AmdSevSetConfig(
+  VOID
+  );
+
 //
 // Feature flags for OptionalElements.
 //
-- 
2.17.1



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#76807): https://edk2.groups.io/g/devel/message/76807
Mute This Topic: https://groups.io/mt/83688901/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v4 4/4] OvmfPkg/PlatformDxe: Add support for SEV live migration.
Posted by Lendacky, Thomas via groups.io 4 years, 7 months ago 
On 6/21/21 8:57 AM, Ashish Kalra wrote:
> From: Ashish Kalra <ashish.kalra@amd.com>
> 
> Detect for KVM hypervisor and check for SEV live migration
> feature support via KVM_FEATURE_CPUID, if detected setup a new
> UEFI enviroment variable to indicate OVMF support for SEV
> live migration.
> 
> Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
> ---
>  OvmfPkg/Include/Guid/MemEncryptLib.h |  20 ++++
>  OvmfPkg/OvmfPkg.dec                  |   1 +
>  OvmfPkg/PlatformDxe/AmdSev.c         | 108 ++++++++++++++++++++
>  OvmfPkg/PlatformDxe/Platform.c       |   5 +
>  OvmfPkg/PlatformDxe/Platform.inf     |   2 +
>  OvmfPkg/PlatformDxe/PlatformConfig.h |   5 +
>  6 files changed, 141 insertions(+)
> 
> diff --git a/OvmfPkg/Include/Guid/MemEncryptLib.h b/OvmfPkg/Include/Guid/MemEncryptLib.h
> new file mode 100644
> index 0000000000..4c046ba439
> --- /dev/null
> +++ b/OvmfPkg/Include/Guid/MemEncryptLib.h
> @@ -0,0 +1,20 @@
> +/** @file
> +
> +  AMD Memory Encryption GUID, define a new GUID for defining
> +  new UEFI enviroment variables assocaiated with SEV Memory Encryption.
> +
> +  Copyright (c) 2020, AMD Inc. All rights reserved.<BR>
> +
> +  SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#ifndef __MEMENCRYPT_LIB_H__
> +#define __MEMENCRYPT_LIB_H__
> +
> +#define MEMENCRYPT_GUID \
> +{0x0cf29b71, 0x9e51, 0x433a, {0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8, 0x75}}
> +
> +extern EFI_GUID gMemEncryptGuid;
> +
> +#endif
> diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec
> index 6ae733f6e3..e452dc8494 100644
> --- a/OvmfPkg/OvmfPkg.dec
> +++ b/OvmfPkg/OvmfPkg.dec
> @@ -122,6 +122,7 @@
>    gQemuKernelLoaderFsMediaGuid          = {0x1428f772, 0xb64a, 0x441e, {0xb8, 0xc3, 0x9e, 0xbd, 0xd7, 0xf8, 0x93, 0xc7}}
>    gGrubFileGuid                         = {0xb5ae312c, 0xbc8a, 0x43b1, {0x9c, 0x62, 0xeb, 0xb8, 0x26, 0xdd, 0x5d, 0x07}}
>    gConfidentialComputingSecretGuid      = {0xadf956ad, 0xe98c, 0x484c, {0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47}}
> +  gMemEncryptGuid                       = {0x0cf29b71, 0x9e51, 0x433a, {0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8, 0x75}}
>  
>  [Ppis]
>    # PPI whose presence in the PPI database signals that the TPM base address
> diff --git a/OvmfPkg/PlatformDxe/AmdSev.c b/OvmfPkg/PlatformDxe/AmdSev.c
> new file mode 100644
> index 0000000000..3dbf17a8cd
> --- /dev/null
> +++ b/OvmfPkg/PlatformDxe/AmdSev.c

Can this be done in OvmfPkg/AmdSevDxe/AmdSevDxe.c or is that too early?

> @@ -0,0 +1,108 @@
> +/**@file
> +  Detect KVM hypervisor support for SEV live migration and if
> +  detected, setup a new UEFI enviroment variable indicating
> +  OVMF support for SEV live migration.
> +
> +  Copyright (c) 2020, Advanced Micro Devices. All rights reserved.<BR>
> +
> +  SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +//
> +// The package level header files this module uses
> +//
> +
> +#include <Library/BaseLib.h>
> +#include <Library/BaseMemoryLib.h>
> +#include <Library/DebugLib.h>
> +#include <Library/UefiBootServicesTableLib.h>
> +#include <Library/UefiRuntimeServicesTableLib.h>
> +#include <Guid/MemEncryptLib.h>
> +
> +#define KVM_FEATURE_MIGRATION_CONTROL   17

BIT17

> +
> +/**
> +  Figures out if we are running inside KVM HVM and
> +  KVM HVM supports SEV Live Migration feature.
> +
> +  @retval TRUE   KVM was detected and Live Migration supported
> +  @retval FALSE  KVM was not detected or Live Migration not supported
> +
> +**/
> +BOOLEAN
> +KvmDetectSevLiveMigrationFeature(
> +  VOID
> +  )
> +{
> +  UINT8 Signature[13];
> +  UINT32 mKvmLeaf = 0;
> +  UINT32 RegEax, RegEbx, RegEcx, RegEdx;
> +
> +  Signature[12] = '\0';
> +  for (mKvmLeaf = 0x40000000; mKvmLeaf < 0x40010000; mKvmLeaf += 0x100) {

What's the reason for the loop? I would think that just checking
0x40000000 would be enough, so a comment seems to be warranted.

> +    AsmCpuid (mKvmLeaf,
> +              NULL,
> +              (UINT32 *) &Signature[0],
> +              (UINT32 *) &Signature[4],
> +              (UINT32 *) &Signature[8]);
> +
> +    if (!AsciiStrCmp ((CHAR8 *) Signature, "KVMKVMKVM\0\0\0")) {
> +      DEBUG ((
> +        DEBUG_ERROR,

DEBUG_INFO, it doesn't seem like an error.

> +        "%a: KVM Detected, signature = %s\n",
> +        __FUNCTION__,
> +        Signature
> +        ));
> +> +      RegEax = 0x40000001;

Should this be mKvmLeaf + 1? It is confusing that you may check 0x40000100
and then not do 0x40000101.

> +      RegEcx = 0;
> +      AsmCpuid (0x40000001, &RegEax, &RegEbx, &RegEcx, &RegEdx);
> +      if (RegEax & (1 << KVM_FEATURE_MIGRATION_CONTROL)) {

This needs to be (assuming BIT17 is used above):

  if ((RegEax & KVM_FEATURE_MIGRATION_CONTROL) != 0) {

You must use an actual comparison if the variable is not a boolean.

> +        DEBUG ((
> +          DEBUG_ERROR,
> +          "%a: Live Migration feature supported\n",

DEBUG_INFO again.

> +          __FUNCTION__
> +          ));
> +        return TRUE;
> +      }
> +    }
> +  }
> +
> +  return FALSE;
> +}
> +
> +/**
> +
> +  Function checks if SEV Live Migration support is available, if present then it sets
> +  a UEFI enviroment variable to be queried later using Runtime services.
> +
> +  **/
> +VOID
> +AmdSevSetConfig(

Kind of a generic name for what is being done.

> +  VOID
> +  )
> +{
> +  EFI_STATUS Status;
> +  BOOLEAN SevLiveMigrationEnabled;
> +
> +  SevLiveMigrationEnabled = KvmDetectSevLiveMigrationFeature();
> +
> +  if (SevLiveMigrationEnabled) {
> +   Status = gRT->SetVariable (
> +                L"SevLiveMigrationEnabled",
> +                &gMemEncryptGuid,
> +                EFI_VARIABLE_NON_VOLATILE |
> +                EFI_VARIABLE_BOOTSERVICE_ACCESS |
> +                EFI_VARIABLE_RUNTIME_ACCESS,
> +                sizeof (BOOLEAN),
> +                &SevLiveMigrationEnabled
> +               );
> +
> +   DEBUG ((
> +    DEBUG_ERROR,
> +    "%a: Setting SevLiveMigrationEnabled variable, status = %lx\n",

DEBUG_INFO.

Thanks,
Tom

> +    __FUNCTION__,
> +    Status
> +    ));
> +  }
> +}
> diff --git a/OvmfPkg/PlatformDxe/Platform.c b/OvmfPkg/PlatformDxe/Platform.c
> index f2e51960ce..f61302d98b 100644
> --- a/OvmfPkg/PlatformDxe/Platform.c
> +++ b/OvmfPkg/PlatformDxe/Platform.c
> @@ -763,6 +763,11 @@ PlatformInit (
>  {
>    EFI_STATUS Status;
>  
> +  //
> +  // Set Amd Sev configuation
> +  //
> +  AmdSevSetConfig();
> +
>    ExecutePlatformConfig ();
>  
>    mConfigAccess.ExtractConfig = &ExtractConfig;
> diff --git a/OvmfPkg/PlatformDxe/Platform.inf b/OvmfPkg/PlatformDxe/Platform.inf
> index 14727c1220..2896f0a1d1 100644
> --- a/OvmfPkg/PlatformDxe/Platform.inf
> +++ b/OvmfPkg/PlatformDxe/Platform.inf
> @@ -24,6 +24,7 @@
>    PlatformConfig.c
>    PlatformConfig.h
>    PlatformForms.vfr
> +  AmdSev.c
>  
>  [Packages]
>    MdePkg/MdePkg.dec
> @@ -56,6 +57,7 @@
>  [Guids]
>    gEfiIfrTianoGuid
>    gOvmfPlatformConfigGuid
> +  gMemEncryptGuid
>  
>  [Depex]
>    gEfiHiiConfigRoutingProtocolGuid  AND
> diff --git a/OvmfPkg/PlatformDxe/PlatformConfig.h b/OvmfPkg/PlatformDxe/PlatformConfig.h
> index 716514da21..4f662aafa4 100644
> --- a/OvmfPkg/PlatformDxe/PlatformConfig.h
> +++ b/OvmfPkg/PlatformDxe/PlatformConfig.h
> @@ -44,6 +44,11 @@ PlatformConfigLoad (
>    OUT UINT64          *OptionalElements
>    );
>  
> +VOID
> +AmdSevSetConfig(
> +  VOID
> +  );
> +
>  //
>  // Feature flags for OptionalElements.
>  //
> 


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#76876): https://edk2.groups.io/g/devel/message/76876
Mute This Topic: https://groups.io/mt/83688901/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v4 4/4] OvmfPkg/PlatformDxe: Add support for SEV live migration.
Posted by Ashish Kalra via groups.io 4 years, 7 months ago 
Hello Tom,

On Tue, Jun 22, 2021 at 06:06:24PM -0500, Tom Lendacky wrote:
> > +
> > +/**
> > +  Figures out if we are running inside KVM HVM and
> > +  KVM HVM supports SEV Live Migration feature.
> > +
> > +  @retval TRUE   KVM was detected and Live Migration supported
> > +  @retval FALSE  KVM was not detected or Live Migration not supported
> > +
> > +**/
> > +BOOLEAN
> > +KvmDetectSevLiveMigrationFeature(
> > +  VOID
> > +  )
> > +{
> > +  UINT8 Signature[13];
> > +  UINT32 mKvmLeaf = 0;
> > +  UINT32 RegEax, RegEbx, RegEcx, RegEdx;
> > +
> > +  Signature[12] = '\0';
> > +  for (mKvmLeaf = 0x40000000; mKvmLeaf < 0x40010000; mKvmLeaf += 0x100) {
> 
> What's the reason for the loop? I would think that just checking
> 0x40000000 would be enough, so a comment seems to be warranted.
> 

0x40000000 leaf is the hypervisor CPUID information leaf, so probably
just checking 0x40000000 should be enough.

But i see that other hypervisor detection functions like XenDetect() 
do a loop test on the hypervisor existence function until the
signature match, is there a specific reason for that ?

Is this for some kind of support for another/multiple hypervisors ?

> > +    AsmCpuid (mKvmLeaf,
> > +              NULL,
> > +              (UINT32 *) &Signature[0],
> > +              (UINT32 *) &Signature[4],
> > +              (UINT32 *) &Signature[8]);
> > +
> > +    if (!AsciiStrCmp ((CHAR8 *) Signature, "KVMKVMKVM\0\0\0")) {
> > +      DEBUG ((
> > +        DEBUG_ERROR,
> 
> DEBUG_INFO, it doesn't seem like an error.
> 

Ok.

> > +        "%a: KVM Detected, signature = %s\n",
> > +        __FUNCTION__,
> > +        Signature
> > +        ));
> > +> +      RegEax = 0x40000001;
> 
> Should this be mKvmLeaf + 1? It is confusing that you may check 0x40000100
> and then not do 0x40000101.
> 

Yes, it should be mKvmLeaf + 1, assuming the loop above is being used.

> > +      RegEcx = 0;
> > +      AsmCpuid (0x40000001, &RegEax, &RegEbx, &RegEcx, &RegEdx);
> > +      if (RegEax & (1 << KVM_FEATURE_MIGRATION_CONTROL)) {
> 

Thanks,
Ashish


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#77067): https://edk2.groups.io/g/devel/message/77067
Mute This Topic: https://groups.io/mt/83688901/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-

Patchew 2.1-devel-b67e4c2

© 2016 - 2026 Red Hat, Inc.