This series adds support for creating and managing AMD SEV-SNP
confidential virtual machines through the Microsoft Hypervisor root
partition driver.
The series adds fixed-size MSHV UAPI definitions, the required Microsoft
Hypervisor ABI definitions and hypercall helpers, partition ioctls,
capability discovery, processor-feature handling, ordered encrypted-memory
teardown, and nested-root SynIC handling.
The patches are based on the current hyperv-next branch.
Testing:
- Built the complete seven-patch series on x86_64.
- Verified the installed UAPI in 64-bit and 32-bit userspace builds.
- Generated rust-vmm MSHV bindings from the kernel headers.
- Booted Linux as an MSHV root partition with SEV-SNP available.
- Passed Cloud Hypervisor's common_cvm::test_focal_simple_launch.
- Booted a four-vCPU SEV-SNP guest to login.
The development host needs two additional local patches to boot as a
nested MSHV root partition: the EFI HvLoader enablement and the
non-upstreamable nested-VMBus interrupt-vector workaround. Neither patch
is part of this series.
Changes since v2:
- Rebase onto current hyperv-next.
- Drop the system-property structure fix, which is already upstream as
commit d6f0248f04a9 ("mshv: fix hv_input_get_system_property struct").
- Drop the EFI HvLoader patch as requested; alternative root-partition
boot mechanisms will be explored separately.
- Drop the panic-notifier SNP unlock patch. A panic notifier is not a
guaranteed pre-crash-kexec hook and cannot safely traverse mutable
memory-region state in all contexts.
- Redesign variable-length ioctls to use fixed-size headers and aligned
userspace pointers. Name GPA and PFN inputs explicitly and add the
isolated-page size to the UAPI.
- Replace public bitfields and the large by-value launch payload with a
naturally aligned pointer-based ABI and field-by-field kernel
translation.
- Process userspace page arrays in bounded batches, yield between
batches, validate large-page alignment and contiguity, and improve
partial-progress diagnostics.
- Keep encrypted pages pinned until mappings are removed, the SNP
partition state is destroyed, and host access is restored. Quarantine
the partition and retain the module if a safety-critical phase fails.
- Remove the unbounded delayed-work teardown retry.
- Treat rejected SNP capability queries (including L1VH) as non-fatal,
and copy per-CPU results before restoring interrupts.
- Preserve nested virtualization in the legacy safe feature defaults.
- Reject device opens until parent-partition initialization completes.
- Remove redundant SNP operations from the generic passthrough
hypercall interface.
Link:
https://lore.kernel.org/linux-hyperv/[email protected]/
Wei Hu (1):
mshv: set up own SynIC registers on a nested root partition
Wei Liu (6):
mshv: add SEV-SNP UAPI definitions
mshv: add SEV-SNP PSP request hypercall
mshv: add SEV-SNP isolated page hypercalls
mshv: wire SEV-SNP partition ioctls
mshv: detect and report SEV-SNP support at init
mshv: use safe partition CPU feature defaults
drivers/hv/mshv_regions.c | 10 +-
drivers/hv/mshv_root.h | 29 ++
drivers/hv/mshv_root_hv_call.c | 190 +++++++-
drivers/hv/mshv_root_main.c | 854 +++++++++++++++++++++++++++++++--
drivers/hv/mshv_synic.c | 16 +-
include/hyperv/hvgdk_mini.h | 31 ++
include/hyperv/hvhdk.h | 124 ++++-
include/hyperv/hvhdk_mini.h | 53 ++
include/uapi/linux/mshv.h | 99 +++-
9 files changed, 1365 insertions(+), 41 deletions(-)
base-commit: be0cfab740e58b70047ef6e7e3d578f00ed5d258
--
2.43.0
