[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v5 11/23] sev: register the guest memory range which
From: |
Brijesh Singh |
Subject: |
[Qemu-devel] [PATCH v5 11/23] sev: register the guest memory range which may contain encrypted data |
Date: |
Wed, 6 Dec 2017 14:03:34 -0600 |
When SEV is enabled, the hardware encryption engine uses a tweak such
that the two identical plaintext at different location will have a
different ciphertexts. So swapping or moving a ciphertexts of two guest
pages will not result in plaintexts being swapped. Hence relocating
a physical backing pages of the SEV guest will require some additional
steps in KVM driver. The KVM_MEMORY_ENCRYPT_{UN,}REG_REGION ioctl can be
used to register/unregister the guest memory region which may contain the
encrypted data. KVM driver will internally handle the relocating physical
backing pages of registered memory regions.
Cc: Paolo Bonzini <address@hidden>
Signed-off-by: Brijesh Singh <address@hidden>
---
accel/kvm/sev.c | 39 +++++++++++++++++++++++++++++++++++++++
1 file changed, 39 insertions(+)
diff --git a/accel/kvm/sev.c b/accel/kvm/sev.c
index 37020751bd14..7b5318993969 100644
--- a/accel/kvm/sev.c
+++ b/accel/kvm/sev.c
@@ -84,6 +84,43 @@ fw_error_to_str(int code)
}
static void
+sev_ram_block_added(RAMBlockNotifier *n, void *host, size_t size)
+{
+ int r;
+ struct kvm_enc_region range;
+
+ range.addr = (__u64)host;
+ range.size = size;
+
+ r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_REG_REGION, &range);
+ if (r) {
+ error_report("%s: failed to register region (%#llx+%#llx)",
+ __func__, range.addr, range.size);
+ }
+}
+
+static void
+sev_ram_block_removed(RAMBlockNotifier *n, void *host, size_t size)
+{
+ int r;
+ struct kvm_enc_region range;
+
+ range.addr = (__u64)host;
+ range.size = size;
+
+ r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_UNREG_REGION, &range);
+ if (r) {
+ error_report("%s: failed to unregister region (%#llx+%#llx)",
+ __func__, range.addr, range.size);
+ }
+}
+
+static struct RAMBlockNotifier sev_ram_notifier = {
+ .ram_block_added = sev_ram_block_added,
+ .ram_block_removed = sev_ram_block_removed,
+};
+
+static void
qsev_guest_finalize(Object *obj)
{
}
@@ -286,6 +323,8 @@ sev_guest_init(const char *id)
goto err;
}
+ ram_block_notifier_add(&sev_ram_notifier);
+
return s;
err:
g_free(s);
--
2.9.5
- Re: [Qemu-devel] [PATCH v5 01/23] memattrs: add debug attribute, (continued)
- [Qemu-devel] [PATCH v5 02/23] exec: add ram_debug_ops support, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 03/23] exec: add debug version of physical memory read and write API, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 05/23] target/i386: add memory encryption feature cpuid support, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 04/23] monitor/i386: use debug APIs when accessing guest memory, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 06/23] machine: add -memory-encryption property, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 07/23] kvm: update kvm.h to include memory encryption ioctls, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 08/23] docs: add AMD Secure Encrypted Virtualization (SEV), Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 09/23] accel: add Secure Encrypted Virtulization (SEV) object, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 10/23] sev: add command to initialize the memory encryption context, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 11/23] sev: register the guest memory range which may contain encrypted data,
Brijesh Singh <=
- [Qemu-devel] [PATCH v5 12/23] kvm: introduce memory encryption APIs, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 13/23] hmp: display memory encryption support in 'info kvm', Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 14/23] sev: add command to create launch memory encryption context, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 15/23] sev: add command to encrypt guest memory region, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 17/23] qapi: add SEV_MEASUREMENT event, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 16/23] target/i386: encrypt bios rom, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 18/23] sev: emit the SEV_MEASUREMENT event, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 19/23] sev: Finalize the SEV guest launch flow, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 20/23] hw: i386: set ram_debug_ops when memory encryption is enabled, Brijesh Singh, 2017/12/06
- [Qemu-devel] [PATCH v5 21/23] sev: add debug encrypt and decrypt commands, Brijesh Singh, 2017/12/06