[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 11/22] sev/i386: register the guest memory range whic
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 11/22] sev/i386: register the guest memory range which may contain encrypted data |
Date: |
Tue, 13 Mar 2018 13:56:27 +0100 |
From: Brijesh Singh <address@hidden>
When SEV is enabled, the hardware encryption engine uses a tweak such
that the two identical plaintext at different location will have a
different ciphertexts. So swapping or moving a ciphertexts of two guest
pages will not result in plaintexts being swapped. Hence relocating
a physical backing pages of the SEV guest will require some additional
steps in KVM driver. The KVM_MEMORY_ENCRYPT_{UN,}REG_REGION ioctl can be
used to register/unregister the guest memory region which may contain the
encrypted data. KVM driver will internally handle the relocating physical
backing pages of registered memory regions.
Cc: Paolo Bonzini <address@hidden>
Cc: Richard Henderson <address@hidden>
Cc: Eduardo Habkost <address@hidden>
Signed-off-by: Brijesh Singh <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
target/i386/sev.c | 42 ++++++++++++++++++++++++++++++++++++++++++
target/i386/trace-events | 2 ++
2 files changed, 44 insertions(+)
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 91b5190..c63012a 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -106,6 +106,46 @@ fw_error_to_str(int code)
}
static void
+sev_ram_block_added(RAMBlockNotifier *n, void *host, size_t size)
+{
+ int r;
+ struct kvm_enc_region range;
+
+ range.addr = (__u64)host;
+ range.size = size;
+
+ trace_kvm_memcrypt_register_region(host, size);
+ r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_REG_REGION, &range);
+ if (r) {
+ error_report("%s: failed to register region (%p+%#lx) error '%s'",
+ __func__, host, size, strerror(errno));
+ exit(1);
+ }
+}
+
+static void
+sev_ram_block_removed(RAMBlockNotifier *n, void *host, size_t size)
+{
+ int r;
+ struct kvm_enc_region range;
+
+ range.addr = (__u64)host;
+ range.size = size;
+
+ trace_kvm_memcrypt_unregister_region(host, size);
+ r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_UNREG_REGION, &range);
+ if (r) {
+ error_report("%s: failed to unregister region (%p+%#lx)",
+ __func__, host, size);
+ }
+}
+
+static struct RAMBlockNotifier sev_ram_notifier = {
+ .ram_block_added = sev_ram_block_added,
+ .ram_block_removed = sev_ram_block_removed,
+};
+
+static void
qsev_guest_finalize(Object *obj)
{
}
@@ -436,6 +476,8 @@ sev_guest_init(const char *id)
goto err;
}
+ ram_block_notifier_add(&sev_ram_notifier);
+
return s;
err:
g_free(sev_state);
diff --git a/target/i386/trace-events b/target/i386/trace-events
index 797b716..ffa3d22 100644
--- a/target/i386/trace-events
+++ b/target/i386/trace-events
@@ -8,3 +8,5 @@ kvm_x86_update_msi_routes(int num) "Updated %d MSI routes"
# target/i386/sev.c
kvm_sev_init(void) ""
+kvm_memcrypt_register_region(void *addr, size_t len) "addr %p len 0x%lu"
+kvm_memcrypt_unregister_region(void *addr, size_t len) "addr %p len 0x%lu"
--
1.8.3.1
- [Qemu-devel] [PULL 00/22] KVM patches for QEMU 2.12 soft freeze, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 03/22] machine: add memory-encryption option, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 02/22] KVM: x86: Add support for save/load MSR_SMI_COUNT, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 04/22] docs: add AMD Secure Encrypted Virtualization (SEV), Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 05/22] kvm: add memory encryption context, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 06/22] kvm: introduce memory encryption APIs, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 01/22] update Linux headers to 4.16-rc5, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 09/22] include: add psp-sev.h header file, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 07/22] target/i386: add Secure Encrypted Virtualization (SEV) object, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 13/22] sev/i386: add command to encrypt guest memory region, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 11/22] sev/i386: register the guest memory range which may contain encrypted data,
Paolo Bonzini <=
- [Qemu-devel] [PULL 08/22] sev/i386: qmp: add query-sev command, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 12/22] sev/i386: add command to create launch memory encryption context, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 10/22] sev/i386: add command to initialize the memory encryption context, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 14/22] target/i386: encrypt bios rom, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 15/22] sev/i386: add support to LAUNCH_MEASURE command, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 16/22] sev/i386: finalize the SEV guest launch flow, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 18/22] cpu/i386: populate CPUID 0x8000_001F when SEV is active, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 19/22] sev/i386: hmp: add 'info sev' command, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 17/22] sev/i386: add migration blocker, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 20/22] sev/i386: qmp: add query-sev-launch-measure command, Paolo Bonzini, 2018/03/13