From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932691AbdKFS1T (ORCPT ); Mon, 6 Nov 2017 13:27:19 -0500 Received: from mail-dm3nam03on0078.outbound.protection.outlook.com ([104.47.41.78]:9872 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932375AbdKFSMA (ORCPT ); Mon, 6 Nov 2017 13:12:00 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: bp@alien8.de, Brijesh Singh , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Jonathan Corbet , Borislav Petkov , Tom Lendacky , x86@kernel.org Subject: [Part2 PATCH v8 01/38] Documentation/virtual/kvm: Add AMD Secure Encrypted Virtualization (SEV) Date: Mon, 6 Nov 2017 12:10:53 -0600 Message-Id: <20171106181130.68491-2-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20171106181130.68491-1-brijesh.singh@amd.com> References: <20171106181130.68491-1-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: BN6PR10CA0031.namprd10.prod.outlook.com (10.175.102.145) To SN1PR12MB0159.namprd12.prod.outlook.com (10.162.3.146) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: c8e44a3b-5ace-4d8b-b643-08d52541ddb4 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(48565401081)(2017052603199);SRVR:SN1PR12MB0159; X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0159;3:JXwVNlS/8mKSEQdVGDJVeEqvVxxysi/RLOi0IUsRorUd69FoEC4gw2oHl1AIcp+0QjaC95upfEwAnkxy5NJOQG5qBEGbuLRKrAxY1mccT6EEXH1aT3h3X3myKLY/9qIX/I3sC6Ng08N++bD/iYkuPK4xGV0ATfY7caobXCCzblceSzGyRH7yjSk9KmfmyWPSMsjYDxe3HMTKpL0rPV8BaC0wEu2xokCdgy+xS10hloGJGeCMawJ2gbLD6SDX9F13;25:bBvfVY/tL5O0OjMqeLLGLqfrSg4PeZdl7NE6rtyg6Wexiu2CXJzUlnTx6dd65ZcvCFDb656UFTrNX0y9GAGSXReRugQGUAcehKgkiy6uXkOVBKHu8aNkUaQPLdq2UddaBFWIlYlMFffz7UPmqthtd9kl+oTh6pkKdfYduhms+2mIRC6+GiUmqdY7B2JFgVrNzp74Xk50haFB5MEViLYGoWQjBBse8zgyyJzdgKSjs3AvSGwJVJsd7/a5lyyaVHBoFb/7zMR5r+h0o/Tc/Xd0HXT+QUJlLQWFu54LNZNmwvZE21/lbMEliPruwzyxdNR+fy/c6TIRn2RgRxG1CDTEcw==;31:/5C+6R7m4jbQM396N2Ydy6dn8hkZ7sNF9ovcb17ZZIU6Xifw/bfkZuoXWAOhnIGr+vFS8cSZmK2/qPJjHcyQDbb9HESWBO3Iil3ikQGIVkgl6GLkLg7nKxIGGlaE/2muCbfJAMyfdZu6YNf+5cADBYfGngVfozjHvC7Z1kEZ7SxaBtT6zvbA/wKkFHNv8tujwSyeocc1zul+jgpYR/+Ox+0RUk/D/gDX7rWEqwa+oB8= X-MS-TrafficTypeDiagnostic: SN1PR12MB0159: X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0159;20:qY2YtCGVDA1ZC4ztjcLQ60VFqp7GFnBQ/8jE74BwkEB2FxglWXK+0WSDBgW57nKvHlgODZGWYr66+SwftpLehfN1lDejTnzIs8kYQew8pejNyxw5qDyiWj3oe7JSra31V5ab8P72wuQpJ4+g8XLyJW2ISnD72wGnlQISLi6ChCUSEeUdl19W31FNTHTxhifVzpEpVxliPzjrIeJOs6gye7+h00twt7KoWIJ6iIlvEp2ADS8uQCM6MIlUEfnqbZbI4i2x30ykDP5gCY8aHSh3gPrDX7V1mRGZLWfOOHrbwABhcVhzFSdWo8o4IRuugVeENodqlGpqI5Dtm7hq9Xd2zXlS5YGUVZ1Na+x6vBJDQwxbx39G152GbXfCe4yVFXA25yhSVyabBUyBPGnyxwezhat8KzBL7Cjzoz42myqSR9g1olwogo06/v0nzdnwPbyuCGf+TDFBvNZk7JbCisacCn/kRCHHZPxujV31f8GpOj3gx5YVnQrYf6PZDYGvWFv7;4:8x/GpLb8RLhiB7NUnY1GmcdgEDF43lTLGcIL1QmrPBTZBXP711LYGEqi/7KQICvapz1ePyzVZo+ajKePtIcDo3jNk+FoUk6m7ucnkBoSeXQEkX85Qs61wBV8O8uUEb3x2u7KHx5oEkxk4EqpsGwGx9rk+bPe1CdfngQ2KiWPT2aM2+e6iBTTqh77FIKVt95sMtGMNUKHhS4M/rvF2LuLVfFw873PDzUK8yYEkFkmXiklsv4oWhTiCtZzakqQiT81b7tNSiRy6CtgTHBd9J/ZPCfODbqKNWHhy2vb12Zp97p6FU30FtjAa3SO7jp1/tChvU2xuhPuh/Q9a+V7gpGpiEQPvr9SaMDEeXcDAtB3fwKe3L/Zpw7qrmvjy2Fsukid X-Exchange-Antispam-Report-Test: UriScan:(20558992708506)(9452136761055)(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(3231021)(100000703101)(100105400095)(3002001)(93006095)(93001095)(10201501046)(6055026)(6041248)(20161123564025)(20161123562025)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123558100)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN1PR12MB0159;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN1PR12MB0159; X-Forefront-PRVS: 048396AFA0 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6009001)(346002)(376002)(39860400002)(189002)(199003)(68736007)(97736004)(4326008)(316002)(16526018)(54906003)(7736002)(8936002)(2906002)(81166006)(81156014)(25786009)(53936002)(8676002)(2870700001)(1076002)(6116002)(23676003)(50226002)(189998001)(305945005)(86362001)(3846002)(50466002)(33646002)(66066001)(36756003)(53416004)(47776003)(5660300001)(7416002)(76176999)(478600001)(6486002)(105586002)(50986999)(2950100002)(101416001)(106356001)(19627235001);DIR:OUT;SFP:1101;SCL:1;SRVR:SN1PR12MB0159;H:wsp141597wss.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtTTjFQUjEyTUIwMTU5OzIzOkNESDJNWVRrSUhNcGh1QXBkMWs1cTd0T2t6?= =?utf-8?B?V1ZtTHpUbTJaYWdYTnZQMmVTaU9pMDQ2M0JMQ3A5elEyNHpKbVJTeEtPblBQ?= =?utf-8?B?T3ZtRFlNRDMwdE0rV2ZiQllHdUR0aTRxcGdRM3lUZHFvVUVrYmU3RWVuejBP?= =?utf-8?B?WC8zL3o0bWIvYWpiODNLWWxvTkk2MGlqd1ZVNGQ0N0hMcDI1djJLY1dQeC8z?= =?utf-8?B?WVBDUlpKdDVJcTZMT2V0MkV2ZCt5OWFvS21TekZQWi92V3JrbUxiOFRFUmdB?= =?utf-8?B?SHpjbjBoTWtpaTVvcGZmMVJneWR1Um1mM3FaQXBUUC84ZkEwLzIreThjdDcy?= =?utf-8?B?NE5FamJWczJib0VGK0U4ajdFL1E0ZStDNTdmSWFLeVNuM2lZZzhPVVN3MnVT?= =?utf-8?B?SkVhQzVkWDVPemJMMkJodEFPamhlY3NlcDlxUGFtdWJrMjBOYXM3dTdxaWt4?= =?utf-8?B?UW9Qb0ZvVm9jYndOdi8xR3FxdE5SZnBwbktBZFQ5ZXFKYWFPdi9uWm1UemJ3?= =?utf-8?B?NCtVTmd2WUhVbi84MWZ2MXlOQkZGWWt1RTVkZktId1BvZFRnV2FublYvN3Fq?= =?utf-8?B?TEQyQTM0V3Bsbm55SVVVYVAzTnpmL1lmU3RZSmIyNFJVbThiZWlFMy90RmxL?= =?utf-8?B?MVUrTlVSV0JrTWZJcVFtc0pWRWFiK2cyVDhtSWtMWE1vNituNGg0M0MyRG5R?= =?utf-8?B?Y0NZMnlPNDArUDhCZGVPSGFpbW56QlJXVGVPaGRnNEY0UlZkbmpQLy9HOUhm?= =?utf-8?B?Y1RlRkxNTTc5T3N1WTVIZHhpaXl5N0tkaTNwOUdTblErMEh3QS8xVm83ZDJO?= =?utf-8?B?aEwrOHp2cHA5ZUUxZE9LbWRFZEttaGM5TG1xeXFkeDhjUktDcy8xUnlvZmFT?= =?utf-8?B?L0ZXbVhyVmgwRjRJNktXbmUrSktQdC9nVVJpVTlzOHBlamxjWHlJSW1hNG5q?= =?utf-8?B?aVNIOStwYWorTXBvZlhKTTk5QzM0cGcxeS83cysvYUV2MTRlSlpzVnZUS205?= =?utf-8?B?S0tSKzlFZmxqOE1TUndFeVoremRlYS84S2NmSmZYYWliRC90YlFMaWNEQ3RO?= =?utf-8?B?cnN2OHhyYUplaWMyOFdkWHR3M3QwQ3ZQY0lZZ2xPMzNaTzdGVG1xVUEzdHRz?= =?utf-8?B?ZzRnYVhKZHdjVWh0WTNQUTdWQ3VPTWRBOXVKVGlIdWtORjZETWYrZWhSRUJt?= =?utf-8?B?MFlxMThBMjNFRzdEZG85TzcwK3MwWFhuY2FzNzVkMVFVbUM2OFZzcmlmZS9p?= =?utf-8?B?aWtWS05nS0R4a0NWZ1BELy8yc1NBeE1wNzllVnNjb3d2cXZtTDIzbnhlZFJy?= =?utf-8?B?SkVXeFBFT1QwaG1jWjlmeXl3cXdqNU5HSnc1aEpHUVk5TTNKUjhBdmlNK2Rl?= =?utf-8?B?SXhDY2FjR3R2QzZDYlJMNUxaSW9vaDh2c0ExZXBwOFl5VHlGekI5QXJpcnJt?= =?utf-8?B?SjErNXJJb1dQdWF5alViWVg2M1RKT2I0NVc2aUxhRnVpaFdVM09OblIwYkVP?= =?utf-8?B?OE1ZZz09?= X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0159;6:SYkvr7xyLEV7xAcMjV6ZHYcs/27O/NxKkqYzTk642oVf6rNKTLnNak9u3iBP5NNkjFC+PMdhuOy+uBJszcfmWpaiKdZx/Fe/eLlCj78K50vVnWNA4AYdg+Q7iZf13ZigGV4ub1l+rKN1pRx5p8z+YS3W31OdILMS3aY1wedTQZGhG7fmkjYvOKc/cT4vLaJ7ctsK98HXDfZWeO9JgOMrZlue3U8i7lRv+VfZi04tIBJu9pplxpsWHAsNSP0Cw6Q+MfNb0AURtz70+87smY2HbX7B3M2UoGF0xFIqlNjolOsgy9yakusBm5zZpFdWE97FkyF37tpeKeKUhLvkmNS02f0n7ZcwdzGM5X6bLhjwsyQ=;5:ebdAsZnky/DD1MzF/nDFP5uHr5vQ6OO54x9drErahaxR/5HTaCbsHF5XvADU7epZsVGrEc8b9UX18XcExqjd+om3M3NQKdu5XBqDMreV2QXkAMxqr5E69N3ZCSj+ftt3ni3qMQax35DM6LthlMRBQK+1Fj8chim9ieD+kiisk0U=;24:SHniQS/LBDL6A8okRufTgq/TFgoY15aLhMt0btu8JSzTs1MmlpQNvMncP4LpVoDxTELuiUgeIYlF97j6lVSx15siODQXSHNJlpU1dhASOQI=;7:n9fwc9N9+5VakbScj13rWqw9/CmOeo3KTr2UHZ3Remb2yvrYQrRE2Oocthx+plxxwAbaYGLauSWMY8uBDbnhhySg8sVcoobOt2m6j96jtdHCyzrVy3WwGdPHXkAS8DoS8AGhSRdp4yFGaI+ZSBZ6uKPx6TFE3INUWC2JGR/HG9lbCPhKfY92CJtFpgN0T2VurKrBbq20979ZTESkqhmGbGbXXVRUuiM2P8L+SiYY042j25DAn8i4pY/5nLysxD/s SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0159;20:ClbFLAHzz4BrLyT2LtZlotBw/cQ4hh4MFvjDvR+qnuR5JE0EYmZLxc7ssDhXd+l4hYI3FWAqGhA+bxrrtbYKAe/p91Lfj4Jg5fJqKKzdbs8nSbkEE0oZ05heLLTBfXkjBtMFN6cHh72Zd7Tsn0EfBrQeazPTwkBtpxAQ0+Vi2Co2j324SbzO477K6bvfIxDBdz8MSBlnjcyd6hYG7RS6iDUWwvcfEZhXdYZiKsngQ1WPaH4j6G+fA0qcjMy07kNc X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Nov 2017 18:11:55.5034 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: c8e44a3b-5ace-4d8b-b643-08d52541ddb4 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB0159 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Create a Documentation entry to describe the AMD Secure Encrypted Virtualization (SEV) feature. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Paolo Bonzini Cc: "Radim Krčmář" Cc: Jonathan Corbet Cc: Borislav Petkov Cc: Tom Lendacky Cc: kvm@vger.kernel.org Cc: x86@kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Brijesh Singh Reviewed-by: Borislav Petkov --- Documentation/virtual/kvm/00-INDEX | 3 ++ .../virtual/kvm/amd-memory-encryption.rst | 45 ++++++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 Documentation/virtual/kvm/amd-memory-encryption.rst diff --git a/Documentation/virtual/kvm/00-INDEX b/Documentation/virtual/kvm/00-INDEX index 69fe1a8b7ad1..3da73aabff5a 100644 --- a/Documentation/virtual/kvm/00-INDEX +++ b/Documentation/virtual/kvm/00-INDEX @@ -26,3 +26,6 @@ s390-diag.txt - Diagnose hypercall description (for IBM S/390) timekeeping.txt - timekeeping virtualization for x86-based architectures. +amd-memory-encryption.txt + - notes on AMD Secure Encrypted Virtualization feature and SEV firmware + command description diff --git a/Documentation/virtual/kvm/amd-memory-encryption.rst b/Documentation/virtual/kvm/amd-memory-encryption.rst new file mode 100644 index 000000000000..a8ef21e737db --- /dev/null +++ b/Documentation/virtual/kvm/amd-memory-encryption.rst @@ -0,0 +1,45 @@ +====================================== +Secure Encrypted Virtualization (SEV) +====================================== + +Overview +======== + +Secure Encrypted Virtualization (SEV) is a feature found on AMD processors. + +SEV is an extension to the AMD-V architecture which supports running +virtual machines (VMs) under the control of a hypervisor. When enabled, +the memory contents of a VM will be transparently encrypted with a key +unique to that VM. + +The hypervisor can determine the SEV support through the CPUID +instruction. The CPUID function 0x8000001f reports information related +to SEV:: + + 0x8000001f[eax]: + Bit[1] indicates support for SEV + ... + [ecx]: + Bits[31:0] Number of encrypted guests supported simultaneously + +If support for SEV is present, MSR 0xc001_0010 (MSR_K8_SYSCFG) and MSR 0xc001_0015 +(MSR_K7_HWCR) can be used to determine if it can be enabled:: + + 0xc001_0010: + Bit[23] 1 = memory encryption can be enabled + 0 = memory encryption can not be enabled + + 0xc001_0015: + Bit[0] 1 = memory encryption can be enabled + 0 = memory encryption can not be enabled + +When SEV support is available, it can be enabled in a specific VM by +setting the SEV bit before executing VMRUN.:: + + VMCB[0x90]: + Bit[1] 1 = SEV is enabled + 0 = SEV is disabled + +SEV hardware uses ASIDs to associate a memory encryption key with a VM. +Hence, the ASID for the SEV-enabled guests must be from 1 to a maximum value +defined in the CPUID 0x8000001f[ecx] field. -- 2.9.5