[RFC,0/7] KVM: SEV-SNP support for running an SVSM

Message

Tom Lendacky Aug. 27, 2024, 9:59 p.m. UTC

This series is meant to start the discussion around running a guest with
a Secure VM Service Module (SVSM) and how to transition a vCPU between
one VM Privilege Level (VMPL) and another. This is Proof-of-Concept level
code, so definitely not something looking to be merged.

When running under an SVSM, VMPL switches are needed for validating memory
and creating vCPU VM Save Area (VMSA) pages. Going forward, different
services running in the SVSM will require VMPL switching, e.g. a virtual
TPM service or Alternate Injection support. Therefore VMPL switches need
to be as fast as possible. The implementation in this series has KVM
managing the creation of VMPL levels and transitioning between the levels
without transitioning to the userspace VMM.

Going forward, the userspace VMM may need to be aware of VMPL levels. It
may be necessary to transition VMPL creation (AP Creation at a specific
VMPL level) to the userspace VMM. But keeping VMPL switching within KVM
is highly desired for performance reasons.

This PoC code does have some restrictions. For example, when running with
Restricted Injection, all injections are blocked as the SVSM is not
expecting any injections (currently). This allows for a single APIC
instance for now.

The patches can be further split and the change logs improved, but wanted
to get this out and get the discussion going.

Implemented in this RFC:
  - APIC ID list retrieval to allow for only measuring the BSP and
    allowing the guest to start all of the APs without having to use a
    broadcast SIPI
  - vCPU creation at a specific VMPL
  - vCPU execution at a specific VMPL
  - Maintain per-VMPL SEV features
  - Implement minimal Restricted Injection
    - Blocks all injection when enabled
  - SVSM support
     - SNP init flag for SVSM support
     - Measuring data with specific VMPL permissions
     - Measuring only the BSP

Things not yet implemented:
  - APIC instance separation
  - Restricted Injection support that is multi-VMPL aware


The series is based off of a slightly older kvm next branch:
  git://git.kernel.org/pub/scm/virt/kvm/kvm.git next

  7c626ce4bae1 ("Linux 6.11-rc3")

---

Carlos Bilbao (1):
  KVM: SVM: Maintain per-VMPL SEV features in kvm_sev_info

Tom Lendacky (6):
  KVM: SVM: Implement GET_AP_APIC_IDS NAE event
  KVM: SEV: Allow for VMPL level specification in AP create
  KVM: SVM: Invoke a specified VMPL level VMSA for the vCPU
  KVM: SVM: Prevent injection when restricted injection is active
  KVM: SVM: Support launching an SVSM with Restricted Injection set
  KVM: SVM: Support initialization of an SVSM

 arch/x86/include/asm/sev-common.h |   7 +
 arch/x86/include/asm/svm.h        |   9 +
 arch/x86/include/uapi/asm/kvm.h   |  10 +
 arch/x86/include/uapi/asm/svm.h   |   3 +
 arch/x86/kvm/svm/sev.c            | 530 +++++++++++++++++++++++++-----
 arch/x86/kvm/svm/svm.c            |  25 +-
 arch/x86/kvm/svm/svm.h            |  71 +++-
 arch/x86/kvm/x86.c                |   9 +
 include/uapi/linux/kvm.h          |   3 +
 9 files changed, 575 insertions(+), 92 deletions(-)