• Nathan Tempelman's avatar
    KVM: x86: Support KVM VMs sharing SEV context · 54526d1f
    Nathan Tempelman authored
    Add a capability for userspace to mirror SEV encryption context from
    one vm to another. On our side, this is intended to support a
    Migration Helper vCPU, but it can also be used generically to support
    other in-guest workloads scheduled by the host. The intention is for
    the primary guest and the mirror to have nearly identical memslots.
    The primary benefits of this are that:
    1) The VMs do not share KVM contexts (think APIC/MSRs/etc), so they
    can't accidentally clobber each other.
    2) The VMs can have different memory-views, which is necessary for post-copy
    migration (the migration vCPUs on the target need to read and write to
    pages, when the primary guest would VMEXIT).
    This does not change the threat model for AMD SEV. Any memory involved
    is still owned by the primary guest and its initial state is still
    attested to through the normal SEV_LAUNCH_* flows. If userspace wanted
    to circumvent SEV, they could achieve the same effect by simply attaching
    a vCPU to the primary VM.
    This patch deliberately leaves userspace in charge of the memslots for the
    mirror, as it already has the power to mess with them in the primary guest.
    This patch does not support SEV-ES (much less SNP), as it does not
    handle handing off attested VMSAs to the mirror.
    For additional context, we need a Migration Helper because SEV PSP
    migration is far too slow for our live migration on its own. Using
    an in-guest migrator lets us speed this up significantly.
    Signed-off-by: default avatarNathan Tempelman <natet@google.com>
    Message-Id: <20210408223214.2582277-1-natet@google.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>