[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [RFC PATCH v3 15/18] i386: register memory encryption ops
From: |
Brijesh Singh |
Subject: |
[Qemu-devel] [RFC PATCH v3 15/18] i386: register memory encryption ops |
Date: |
Tue, 1 Nov 2016 11:54:23 -0400 |
User-agent: |
StGit/0.17.1-dirty |
If guest is launched with memory encryption enabled then register
PC.BIOS and PC.RAM memory regions with memory encryption handler.
Registering PC.BIOS memory region will ensure that memory encryption
routines will be used when rom_reset copies the BIOS image into guest memory.
A typical sequence look like:
qemy_system_reset
rom_reset
cpu_physical_memory_write_rom
cpu_phyiscal_memory_rw_debug_internal
memory_encryption->write
Similarly registering PC.RAM region will ensure that any debug accesses from
qemu monitor or gdbserver will go through the memory encryption routines to
decrypt/encrypt the guest RAM regions.
A sequence looks like:
cpu_phyiscal_memory_rw_debug
cpu_phyiscal_memory_rw_debug_internal
memory_encryption->write
Signed-off-by: Brijesh Singh <address@hidden>
---
hw/i386/pc.c | 7 +++++++
hw/i386/pc_sysfw.c | 4 ++++
2 files changed, 11 insertions(+)
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index f56ea0f..1b76159 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1402,6 +1402,13 @@ void pc_memory_init(PCMachineState *pcms,
e820_add_entry(0x100000000ULL, pcms->above_4g_mem_size, E820_RAM);
}
+ /* if memory encryption is enabled then set the memory encryption
+ * ops so that any debug read and write to guest memory from hypervisor
will
+ * go through encryption routines. */
+ if (kvm_memory_encryption_enabled()) {
+ kvm_memory_encryption_set_debug_ops(ram);
+ }
+
if (!pcmc->has_reserved_memory &&
(machine->ram_slots ||
(machine->maxram_size > machine->ram_size))) {
diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
index f915ad0..243beda 100644
--- a/hw/i386/pc_sysfw.c
+++ b/hw/i386/pc_sysfw.c
@@ -208,6 +208,9 @@ static void old_pc_system_rom_init(MemoryRegion
*rom_memory, bool isapc_ram_fw)
}
g_free(filename);
+ if (kvm_memory_encryption_enabled()) {
+ kvm_memory_encryption_set_debug_ops(bios);
+ }
/* map the last 128KB of the BIOS in ISA space */
isa_bios_size = bios_size;
if (isa_bios_size > (128 * 1024)) {
@@ -228,6 +231,7 @@ static void old_pc_system_rom_init(MemoryRegion
*rom_memory, bool isapc_ram_fw)
memory_region_add_subregion(rom_memory,
(uint32_t)(-bios_size),
bios);
+
}
void pc_system_firmware_init(MemoryRegion *rom_memory, bool isapc_ram_fw)
- [Qemu-devel] [RFC PATCH v3 08/18] hmp: display memory encryption support in 'info kvm', (continued)
- [Qemu-devel] [RFC PATCH v3 08/18] hmp: display memory encryption support in 'info kvm', Brijesh Singh, 2016/11/01
- [Qemu-devel] [RFC PATCH v3 09/18] core: loader: create memory encryption context before copying data, Brijesh Singh, 2016/11/01
- [Qemu-devel] [RFC PATCH v3 10/18] sev: add LAUNCH_START command, Brijesh Singh, 2016/11/01
- [Qemu-devel] [RFC PATCH v3 11/18] sev: add LAUNCH_UPDATE command, Brijesh Singh, 2016/11/01
- [Qemu-devel] [RFC PATCH v3 12/18] sev: add LAUNCH_FINISH command, Brijesh Singh, 2016/11/01
- [Qemu-devel] [RFC PATCH v3 13/18] sev: add DEBUG_DECRYPT command, Brijesh Singh, 2016/11/01
- [Qemu-devel] [RFC PATCH v3 14/18] sev: add DEBUG_ENCRYPT command, Brijesh Singh, 2016/11/01
- [Qemu-devel] [RFC PATCH v3 16/18] target-i386: add cpuid Fn8000_001f, Brijesh Singh, 2016/11/01
- [Qemu-devel] [RFC PATCH v3 17/18] i386: clear C-bit in SEV guest page table walk, Brijesh Singh, 2016/11/01
- [Qemu-devel] [RFC PATCH v3 18/18] migration: disable save/restore and migration on SEV guest, Brijesh Singh, 2016/11/01
- [Qemu-devel] [RFC PATCH v3 15/18] i386: register memory encryption ops,
Brijesh Singh <=
- Re: [Qemu-devel] [RFC PATCH v3 00/18] x86: Secure Encrypted Virtualization (AMD), no-reply, 2016/11/01
- Re: [Qemu-devel] [RFC PATCH v3 00/18] x86: Secure Encrypted Virtualization (AMD), no-reply, 2016/11/01