Commit 69eaedee authored by Brijesh Singh's avatar Brijesh Singh
Browse files

KVM: Introduce KVM_MEMORY_ENCRYPT_{UN,}REG_REGION ioctl 



If hardware supports memory encryption then KVM_MEMORY_ENCRYPT_REG_REGION
and KVM_MEMORY_ENCRYPT_UNREG_REGION ioctl's can be used by userspace to
register/unregister the guest memory regions which may contain the encrypted
data (e.g guest RAM, PCI BAR, SMRAM etc).

Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: "Radim Krčmář" <rkrcmar@redhat.com>
Cc: Joerg Roedel <joro@8bytes.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: x86@kernel.org
Cc: kvm@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Improvements-by: default avatarBorislav Petkov <bp@suse.de>
Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
parent 5acc5c06

Documentation/virtual/kvm/api.txt

+34 −0
Original line number Diff line number Diff line
@@ -3410,6 +3410,40 @@ Currently, this ioctl is used for issuing Secure Encrypted Virtualization 
(SEV) commands on AMD Processors. The SEV commands are defined in

Documentation/virtual/kvm/amd-memory-encryption.txt.



4.110 KVM_MEMORY_ENCRYPT_REG_REGION



Capability: basic

Architectures: x86

Type: system

Parameters: struct kvm_enc_region (in)

Returns: 0 on success; -1 on error



This ioctl can be used to register a guest memory region which may

contain encrypted data (e.g. guest RAM, SMRAM etc).



It is used in the SEV-enabled guest. When encryption is enabled, a guest

memory region may contain encrypted data. The SEV memory encryption

engine uses a tweak such that two identical plaintext pages, each at

different locations will have differing ciphertexts. So swapping or

moving ciphertext of those pages will not result in plaintext being

swapped. So relocating (or migrating) physical backing pages for the SEV

guest will require some additional steps.



Note: The current SEV key management spec does not provide commands to

swap or migrate (move) ciphertext pages. Hence, for now we pin the guest

memory region registered with the ioctl.



4.111 KVM_MEMORY_ENCRYPT_UNREG_REGION



Capability: basic

Architectures: x86

Type: system

Parameters: struct kvm_enc_region (in)

Returns: 0 on success; -1 on error



This ioctl can be used to unregister the guest memory region registered

with KVM_MEMORY_ENCRYPT_REG_REGION ioctl above.



5. The kvm_run structure

------------------------

arch/x86/include/asm/kvm_host.h

+2 −0
Original line number Diff line number Diff line
@@ -1068,6 +1068,8 @@ struct kvm_x86_ops { 
	int (*enable_smi_window)(struct kvm_vcpu *vcpu);



	int (*mem_enc_op)(struct kvm *kvm, void __user *argp);

	int (*mem_enc_reg_region)(struct kvm *kvm, struct kvm_enc_region *argp);

	int (*mem_enc_unreg_region)(struct kvm *kvm, struct kvm_enc_region *argp);

};



struct kvm_arch_async_pf {

arch/x86/kvm/x86.c

+24 −0
Original line number Diff line number Diff line
@@ -4287,6 +4287,30 @@ set_identity_unlock: 
			r = kvm_x86_ops->mem_enc_op(kvm, argp);

		break;

	}

	case KVM_MEMORY_ENCRYPT_REG_REGION: {

		struct kvm_enc_region region;



		r = -EFAULT;

		if (copy_from_user(&region, argp, sizeof(region)))

			goto out;



		r = -ENOTTY;

		if (kvm_x86_ops->mem_enc_reg_region)

			r = kvm_x86_ops->mem_enc_reg_region(kvm, &region);

		break;

	}

	case KVM_MEMORY_ENCRYPT_UNREG_REGION: {

		struct kvm_enc_region region;



		r = -EFAULT;

		if (copy_from_user(&region, argp, sizeof(region)))

			goto out;



		r = -ENOTTY;

		if (kvm_x86_ops->mem_enc_unreg_region)

			r = kvm_x86_ops->mem_enc_unreg_region(kvm, &region);

		break;

	}

	default:

		r = -ENOTTY;

	}

include/uapi/linux/kvm.h

+8 −0
Original line number Diff line number Diff line
@@ -1361,6 +1361,14 @@ struct kvm_s390_ucas_mapping { 
/* Memory Encryption Commands */

#define KVM_MEMORY_ENCRYPT_OP      _IOWR(KVMIO, 0xba, unsigned long)



struct kvm_enc_region {

	__u64 addr;

	__u64 size;

};



#define KVM_MEMORY_ENCRYPT_REG_REGION    _IOR(KVMIO, 0xbb, struct kvm_enc_region)

#define KVM_MEMORY_ENCRYPT_UNREG_REGION  _IOR(KVMIO, 0xbc, struct kvm_enc_region)



#define KVM_DEV_ASSIGN_ENABLE_IOMMU	(1 << 0)

#define KVM_DEV_ASSIGN_PCI_2_3		(1 << 1)

#define KVM_DEV_ASSIGN_MASK_INTX	(1 << 2)

CRA Git | Maintained and supported by SUSTech CRA and CCSE