672f70aa3d
Update to 2.11.1, plus a few other fixes. OBS-URL: https://build.opensuse.org/request/show/579209 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=392
97 lines
3.2 KiB
Diff
97 lines
3.2 KiB
Diff
From c6101a4c186abcc2d3b78972a534cbe1907bea57 Mon Sep 17 00:00:00 2001
|
|
From: Brijesh Singh <brijesh.singh@amd.com>
|
|
Date: Thu, 15 Feb 2018 09:03:21 -0600
|
|
Subject: [PATCH] sev/i386: register the guest memory range which may contain
|
|
encrypted data
|
|
|
|
When SEV is enabled, the hardware encryption engine uses a tweak such
|
|
that the two identical plaintext at different location will have a
|
|
different ciphertexts. So swapping or moving a ciphertexts of two guest
|
|
pages will not result in plaintexts being swapped. Hence relocating
|
|
a physical backing pages of the SEV guest will require some additional
|
|
steps in KVM driver. The KVM_MEMORY_ENCRYPT_{UN,}REG_REGION ioctl can be
|
|
used to register/unregister the guest memory region which may contain the
|
|
encrypted data. KVM driver will internally handle the relocating physical
|
|
backing pages of registered memory regions.
|
|
|
|
Cc: Paolo Bonzini <pbonzini@redhat.com>
|
|
Cc: Richard Henderson <rth@twiddle.net>
|
|
Cc: Eduardo Habkost <ehabkost@redhat.com>
|
|
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
|
|
[BR: FATE#322124]
|
|
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
|
---
|
|
target/i386/sev.c | 41 +++++++++++++++++++++++++++++++++++++++++
|
|
target/i386/trace-events | 2 ++
|
|
2 files changed, 43 insertions(+)
|
|
|
|
diff --git a/target/i386/sev.c b/target/i386/sev.c
|
|
index f9a8748d19..de5c8d4675 100644
|
|
--- a/target/i386/sev.c
|
|
+++ b/target/i386/sev.c
|
|
@@ -88,6 +88,45 @@ fw_error_to_str(int code)
|
|
return sev_fw_errlist[code];
|
|
}
|
|
|
|
+static void
|
|
+sev_ram_block_added(RAMBlockNotifier *n, void *host, size_t size)
|
|
+{
|
|
+ int r;
|
|
+ struct kvm_enc_region range;
|
|
+
|
|
+ range.addr = (__u64)host;
|
|
+ range.size = size;
|
|
+
|
|
+ trace_kvm_memcrypt_register_region(host, size);
|
|
+ r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_REG_REGION, &range);
|
|
+ if (r) {
|
|
+ error_report("%s: failed to register region (%p+%#lx)",
|
|
+ __func__, host, size);
|
|
+ }
|
|
+}
|
|
+
|
|
+static void
|
|
+sev_ram_block_removed(RAMBlockNotifier *n, void *host, size_t size)
|
|
+{
|
|
+ int r;
|
|
+ struct kvm_enc_region range;
|
|
+
|
|
+ range.addr = (__u64)host;
|
|
+ range.size = size;
|
|
+
|
|
+ trace_kvm_memcrypt_unregister_region(host, size);
|
|
+ r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_UNREG_REGION, &range);
|
|
+ if (r) {
|
|
+ error_report("%s: failed to unregister region (%p+%#lx)",
|
|
+ __func__, host, size);
|
|
+ }
|
|
+}
|
|
+
|
|
+static struct RAMBlockNotifier sev_ram_notifier = {
|
|
+ .ram_block_added = sev_ram_block_added,
|
|
+ .ram_block_removed = sev_ram_block_removed,
|
|
+};
|
|
+
|
|
static void
|
|
qsev_guest_finalize(Object *obj)
|
|
{
|
|
@@ -404,6 +443,8 @@ sev_guest_init(const char *id)
|
|
x86_reduced_phys_bits = reduced_phys_bits;
|
|
x86_cbitpos = cbitpos;
|
|
sev_active = true;
|
|
+ ram_block_notifier_add(&sev_ram_notifier);
|
|
+
|
|
return s;
|
|
err:
|
|
g_free(s);
|
|
diff --git a/target/i386/trace-events b/target/i386/trace-events
|
|
index 797b716751..ffa3d22504 100644
|
|
--- a/target/i386/trace-events
|
|
+++ b/target/i386/trace-events
|
|
@@ -8,3 +8,5 @@ kvm_x86_update_msi_routes(int num) "Updated %d MSI routes"
|
|
|
|
# target/i386/sev.c
|
|
kvm_sev_init(void) ""
|
|
+kvm_memcrypt_register_region(void *addr, size_t len) "addr %p len 0x%lu"
|
|
+kvm_memcrypt_unregister_region(void *addr, size_t len) "addr %p len 0x%lu"
|