Skip to content

Conversation

@wojiaohanliyang
Copy link

Add firmware API and host ioctl interface to support migrate CSV3 guest:

crypto: ccp: Define CSV3 migration command id
be2eec84e527 KVM: SVM: CSV: Add KVM_CSV3_SEND_ENCRYPT_DATA command
67f9642a4b5d KVM: SVM: CSV: Add KVM_CSV3_SEND_ENCRYPT_CONTEXT command
378add72843f KVM: SVM: CSV: Add KVM_CSV3_RECEIVE_ENCRYPT_DATA command
70d320515147 KVM: SVM: CSV: Add KVM_CSV3_RECEIVE_ENCRYPT_CONTEXT command

Add ioctl interface to manage shared pages and optimize the shared page management:

25e3de37d5e6 KVM: SVM: CSV: Add ioctl API to unpin shared pages of CSV3 guest
a6c78812aa2d KVM: SVM: CSV: Manage CSV3 guest's shared pages by rbtree

Optimize the notification of guest's page enc status:

f465bdc842ff x86/mm: Merge contiguous pages into a large range when notifying pages enc status changes

Explicit enable LBRV when the target machine accept source context successfully:

102928eb9da4 KVM: SVM: CSV: Explicitly enable LBR Virtualization after succeed to RECEIVE_ENCRYPT_CONTEXT

Xin Jiang and others added 9 commits September 3, 2024 11:58
hygon inclusion
category: feature
CVE: NA

---------------------------

Define CSV3 migration command id and structure. The command
definition is available in CSV3 spec.

Signed-off-by: Xin Jiang <jiangxin@hygon.cn>
Signed-off-by: hanliyang <hanliyang@hygon.cn>
hygon inclusion
category: feature
CVE: NA

---------------------------

The command is used for encrypting the guest memory page using the
encryption context.

Signed-off-by: Xin Jiang <jiangxin@hygon.cn>
Signed-off-by: hanliyang <hanliyang@hygon.cn>
hygon inclusion
category: feature
CVE: NA

---------------------------

The command is used for encrypting the guest cpu context using the
encryption context.

Signed-off-by: Xin Jiang <jiangxin@hygon.cn>
Signed-off-by: hanliyang <hanliyang@hygon.cn>
hygon inclusion
category: feature
CVE: NA

---------------------------

The command is used for copying the incoming buffer into the
CSV3 guest's private memory.

Signed-off-by: Xin Jiang <jiangxin@hygon.cn>
Signed-off-by: hanliyang <hanliyang@hygon.cn>
hygon inclusion
category: feature
CVE: NA

---------------------------

The command is used for copying the incoming context into the
CSV3 guest's private memory.

Signed-off-by: Xin Jiang <jiangxin@hygon.cn>
Signed-off-by: hanliyang <hanliyang@hygon.cn>
hygon inclusion
category: feature
CVE: NA

---------------------------

The shared pages between CSV3 guest and host are pinned in memory,
and managed in list, they will be released to system till the guest
VM was destroyed.

The new ioctl API supports to unpin the shared pages, and remove
them from the list.

For shared memory allocated from guest user-space process, they
must be unpinned dynamically when the process exits.

Signed-off-by: yangwencheng <yangwencheng@hygon.cn>
Signed-off-by: hanliyang <hanliyang@hygon.cn>
hygon inclusion
category: feature
CVE: NA

---------------------------

Managing shared pages in list makes it very costly when to search or
remove a node from the list.

Adopt rbtree to manage shared pages simplifies code logic and obtains
performance improvement.

Signed-off-by: yangwencheng <yangwencheng@hygon.cn>
Signed-off-by: hanliyang <hanliyang@hygon.cn>
…s enc status changes

hygon inclusion
category: feature
CVE: NA

---------------------------

It's not performance friendly in the loop invoking
notify_page_enc_status_changed() just handling one page, if those pages
are physically contiguous, merge them into a large range to get
better performance.

Signed-off-by: yangwencheng <yangwencheng@hygon.cn>
Signed-off-by: hanliyang <hanliyang@hygon.cn>
…RECEIVE_ENCRYPT_CONTEXT

hygon inclusion
category: feature
CVE: NA

---------------------------

Before the commit b7e4be0 ("KVM: SEV-ES: Delegate LBR
virtualization to the processor"), the LBR Virtualization is enabled
during init VMCB:
    init_vmcb() -> sev_init_vmcb() -> sev_es_init_vmcb()

While the commit b7e4be0 ("KVM: SEV-ES: Delegate LBR
virtualization to the processor") enable LBR Virtualization after
succeed to LAUNCH_UPDATE_VMSA for each vCPUs. The process to enable LBR
Virtualization will not be executed in common code path. To ensure the
CSV3 guest to work properly after migrate to target machine, we should
explicitly to enable LBR Virtualization after succeed to
RECEIVE_ENCRYPT_CONTEXT for each vCPUs.

Fixes: b7e4be0 ("KVM: SEV-ES: Delegate LBR virtualization to the processor")
Signed-off-by: hanliyang <hanliyang@hygon.cn>
@deepin-ci-robot
Copy link

Hi @wojiaohanliyang. Thanks for your PR.

I'm waiting for a deepin-community member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants