Commit 2b308e44 authored by Brijesh Singh's avatar Brijesh Singh Committed by Paolo Bonzini
Browse files

sev/i386: register the guest memory range which may contain encrypted data 



When SEV is enabled, the hardware encryption engine uses a tweak such
that the two identical plaintext at different location will have a
different ciphertexts. So swapping or moving a ciphertexts of two guest
pages will not result in plaintexts being swapped. Hence relocating
a physical backing pages of the SEV guest will require some additional
steps in KVM driver. The KVM_MEMORY_ENCRYPT_{UN,}REG_REGION ioctl can be
used to register/unregister the guest memory region which may contain the
encrypted data. KVM driver will internally handle the relocating physical
backing pages of registered memory regions.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent d8575c6c

target/i386/sev.c

+42 −0
Original line number Diff line number Diff line
@@ -105,6 +105,46 @@ fw_error_to_str(int code) 
    return sev_fw_errlist[code];

}



static void

sev_ram_block_added(RAMBlockNotifier *n, void *host, size_t size)

{

    int r;

    struct kvm_enc_region range;



    range.addr = (__u64)(unsigned long)host;

    range.size = size;



    trace_kvm_memcrypt_register_region(host, size);

    r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_REG_REGION, &range);

    if (r) {

        error_report("%s: failed to register region (%p+%#zx) error '%s'",

                     __func__, host, size, strerror(errno));

        exit(1);

    }

}



static void

sev_ram_block_removed(RAMBlockNotifier *n, void *host, size_t size)

{

    int r;

    struct kvm_enc_region range;



    range.addr = (__u64)(unsigned long)host;

    range.size = size;



    trace_kvm_memcrypt_unregister_region(host, size);

    r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_UNREG_REGION, &range);

    if (r) {

        error_report("%s: failed to unregister region (%p+%#zx)",

                     __func__, host, size);

    }

}



static struct RAMBlockNotifier sev_ram_notifier = {

    .ram_block_added = sev_ram_block_added,

    .ram_block_removed = sev_ram_block_removed,

};



static void

qsev_guest_finalize(Object *obj)

{
@@ -436,6 +476,8 @@ sev_guest_init(const char *id) 
        goto err;

    }



    ram_block_notifier_add(&sev_ram_notifier);



    return s;

err:

    g_free(sev_state);

target/i386/trace-events

+2 −0
Original line number Diff line number Diff line
@@ -8,3 +8,5 @@ kvm_x86_update_msi_routes(int num) "Updated %d MSI routes" 


# target/i386/sev.c

kvm_sev_init(void) ""

kvm_memcrypt_register_region(void *addr, size_t len) "addr %p len 0x%zu"

kvm_memcrypt_unregister_region(void *addr, size_t len) "addr %p len 0x%zu"