RFC KVM: SEV-SNP support for running an SVSM

This series is meant to start the discussion around running a guest with a Secure VM Service Module (SVSM) and how to transition a vCPU between one VM Privilege Level (VMPL) and another. This is Proof-of-Concept level code, so definitely not something looking to be merged.

When running under an SVSM, VMPL switches are needed for validating memory and creating vCPU VM Save Area (VMSA) pages. Going forward, different services running in the SVSM will require VMPL switching, e.g. a virtual TPM service or Alternate Injection support. Therefore VMPL switches need to be as fast as possible. The implementation in this series has KVM managing the creation of VMPL levels and transitioning between the levels without transitioning to the userspace VMM.

Going forward, the userspace VMM may need to be aware of VMPL levels. It may be necessary to transition VMPL creation (AP Creation at a specific VMPL level) to the userspace VMM. But keeping VMPL switching within KVM is highly desired for performance reasons.

This PoC code does have some restrictions. For example, when running with Restricted Injection, all injections are blocked as the SVSM is not expecting any injections (currently). This allows for a single APIC instance for now.

The patches can be further split and the change logs improved, but wanted to get this out and get the discussion going.

Implemented in this RFC:
- APIC ID list retrieval to allow for only measuring the BSP and allowing the guest to start all of the APs without having to use a broadcast SIPI
- vCPU creation at a specific VMPL
- vCPU execution at a specific VMPL
- Maintain per-VMPL SEV features
- Implement minimal Restricted Injection
- Blocks all injection when enabled
- SVSM support
- SNP init flag for SVSM support
- Measuring data with specific VMPL permissions
- Measuring only the BSP

Things not yet implemented:
- APIC instance separation
- Restricted Injection support that is multi-VMPL aware

The series is based off of a slightly older kvm next branch:
git://git.kernel.org/pub/scm/virt/kvm/kvm.git next

7c626ce4bae1 ("Linux 6.11-rc3")

---

Carlos Bilbao (1):
KVM: SVM: Maintain per-VMPL SEV features in kvm_sev_info

Tom Lendacky (6):
KVM: SVM: Implement GET_AP_APIC_IDS NAE event
KVM: SEV: Allow for VMPL level specification in AP create
KVM: SVM: Invoke a specified VMPL level VMSA for the vCPU
KVM: SVM: Prevent injection when restricted injection is active
KVM: SVM: Support launching an SVSM with Restricted Injection set
KVM: SVM: Support initialization of an SVSM

 arch/x86/include/asm/sev-common.h |   7 +
 arch/x86/include/asm/svm.h        |   9 +
 arch/x86/include/uapi/asm/kvm.h   |  10 +
 arch/x86/include/uapi/asm/svm.h   |   3 +
 arch/x86/kvm/svm/sev.c            | 530 +++++++++++++++++++++++++-----
 arch/x86/kvm/svm/svm.c            |  25 +-
 arch/x86/kvm/svm/svm.h            |  71 +++-
 arch/x86/kvm/x86.c                |   9 +
 include/uapi/linux/kvm.h          |   3 +
 9 files changed, 575 insertions(+), 92 deletions(-)

2.43.2