From: Brijesh Singh <brijesh.singh@amd.com> To: qemu-devel@nongnu.org Cc: Alistair Francis <alistair.francis@xilinx.com>, Christian Borntraeger <borntraeger@de.ibm.com>, Cornelia Huck <cornelia.huck@de.ibm.com>, "Daniel P . Berrange" <berrange@redhat.com>, "Dr. David Alan Gilbert" <dgilbert@redhat.com>, "Edgar E . Iglesias " <edgar.iglesias@xilinx.com>, Eduardo Habkost <ehabkost@redhat.com>, Eric Blake <eblake@redhat.com>, kvm@vger.kernel.org, Marcel Apfelbaum <marcel@redhat.com>, Markus Armbruster <armbru@redhat.com>, "Michael S. Tsirkin" <mst@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>, Peter Crosthwaite <crosthwaite.peter@gmail.com>, Peter Maydell <peter.maydell@linaro.org>, Richard Henderson <richard.henderson@linaro.org>, Richard Henderson <rth@twiddle.net>, Stefan Hajnoczi <stefanha@gmail.com>, Thomas Lendacky < Subject: [PATCH v5 21/23] sev: add debug encrypt and decrypt commands Date: Wed, 6 Dec 2017 14:03:44 -0600 [thread overview] Message-ID: <20171206200346.116537-22-brijesh.singh@amd.com> (raw) In-Reply-To: <20171206200346.116537-1-brijesh.singh@amd.com> KVM_SEV_DBG_DECRYPT and KVM_SEV_DBG_ENCRYPT commands are used for decrypting and encrypting guest memory region. The command works only if the guest policy allows the debugging. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: kvm@vger.kernel.org Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> --- accel/kvm/kvm-all.c | 1 + accel/kvm/sev.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++++ include/sysemu/sev.h | 1 + 3 files changed, 72 insertions(+) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index d35eebb97901..b069261de32a 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -1677,6 +1677,7 @@ static int kvm_init(MachineState *ms) } kvm_state->memcrypt_encrypt_data = sev_encrypt_data; + kvm_state->memcrypt_debug_ops = sev_set_debug_ops; } ret = kvm_arch_init(ms, s); diff --git a/accel/kvm/sev.c b/accel/kvm/sev.c index fbbd99becc0a..3edfb5b08416 100644 --- a/accel/kvm/sev.c +++ b/accel/kvm/sev.c @@ -22,6 +22,7 @@ #define DEFAULT_GUEST_POLICY 0x1 /* disable debug */ #define DEFAULT_SEV_DEVICE "/dev/sev" +#define GUEST_POLICY_DBG_BIT 0x1 #define DEBUG_SEV #ifdef DEBUG_SEV @@ -34,6 +35,7 @@ static int sev_fd; static SEVState *sev_state; +static MemoryRegionRAMReadWriteOps sev_ops; #define SEV_FW_MAX_ERROR 0x17 @@ -483,6 +485,49 @@ sev_vm_state_change(void *opaque, int running, RunState state) } } +static int +sev_dbg_enc_dec(uint8_t *dst, const uint8_t *src, uint32_t len, bool write) +{ + int ret, error; + struct kvm_sev_dbg *dbg; + dbg = g_malloc0(sizeof(*dbg)); + if (!dbg) { + return 1; + } + + dbg->src_uaddr = (unsigned long)src; + dbg->dst_uaddr = (unsigned long)dst; + dbg->len = len; + + ret = sev_ioctl(write ? KVM_SEV_DBG_ENCRYPT : KVM_SEV_DBG_DECRYPT, + dbg, &error); + if (ret) { + error_report("%s (%s) %#llx->%#llx+%#x ret=%d fw_error=%d '%s'", + __func__, write ? "write" : "read", dbg->src_uaddr, + dbg->dst_uaddr, dbg->len, ret, error, + fw_error_to_str(error)); + } + + g_free(dbg); + return ret; +} + +static int +sev_mem_read(uint8_t *dst, const uint8_t *src, uint32_t len, MemTxAttrs attrs) +{ + assert(attrs.debug); + + return sev_dbg_enc_dec(dst, src, len, false); +} + +static int +sev_mem_write(uint8_t *dst, const uint8_t *src, uint32_t len, MemTxAttrs attrs) +{ + assert(attrs.debug); + + return sev_dbg_enc_dec(dst, src, len, true); +} + void * sev_guest_init(const char *id) { @@ -549,6 +594,31 @@ sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len) return 0; } +void +sev_set_debug_ops(void *handle, MemoryRegion *mr) +{ + int policy; + SEVState *s = (SEVState *)handle; + + policy = object_property_get_int(OBJECT(s->sev_info), + "policy", &error_abort); + + /* + * Check if guest policy supports debugging + * Bit 0 : + * 0 - debug allowed + * 1 - debug is not allowed + */ + if (policy & GUEST_POLICY_DBG_BIT) { + return; + } + + sev_ops.read = sev_mem_read; + sev_ops.write = sev_mem_write; + + memory_region_set_ram_debug_ops(mr, &sev_ops); +} + static void sev_register_types(void) { diff --git a/include/sysemu/sev.h b/include/sysemu/sev.h index 3af945935b60..7c50d33af4a9 100644 --- a/include/sysemu/sev.h +++ b/include/sysemu/sev.h @@ -71,6 +71,7 @@ typedef struct SEVState SEVState; void *sev_guest_init(const char *id); int sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len); +void sev_set_debug_ops(void *handle, MemoryRegion *mr); #endif -- 2.9.5
WARNING: multiple messages have this Message-ID (diff)
From: Brijesh Singh <brijesh.singh@amd.com> To: qemu-devel@nongnu.org Cc: Alistair Francis <alistair.francis@xilinx.com>, Christian Borntraeger <borntraeger@de.ibm.com>, Cornelia Huck <cornelia.huck@de.ibm.com>, "Daniel P . Berrange" <berrange@redhat.com>, "Dr. David Alan Gilbert" <dgilbert@redhat.com>, "Edgar E . Iglesias " <edgar.iglesias@xilinx.com>, Eduardo Habkost <ehabkost@redhat.com>, Eric Blake <eblake@redhat.com>, kvm@vger.kernel.org, Marcel Apfelbaum <marcel@redhat.com>, Markus Armbruster <armbru@redhat.com>, "Michael S. Tsirkin" <mst@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>, Peter Crosthwaite <crosthwaite.peter@gmail.com>, Peter Maydell <peter.maydell@linaro.org>, Richard Henderson <richard.henderson@linaro.org>, Richard Henderson <rth@twiddle.net>, Stefan Hajnoczi <stefanha@gmail.com>, Thomas Lendacky <Thomas.Lendacky@amd.com>, Borislav Petkov <bp@suse.de>, Brijesh Singh <brijesh.singh@amd.com> Subject: [Qemu-devel] [PATCH v5 21/23] sev: add debug encrypt and decrypt commands Date: Wed, 6 Dec 2017 14:03:44 -0600 [thread overview] Message-ID: <20171206200346.116537-22-brijesh.singh@amd.com> (raw) In-Reply-To: <20171206200346.116537-1-brijesh.singh@amd.com> KVM_SEV_DBG_DECRYPT and KVM_SEV_DBG_ENCRYPT commands are used for decrypting and encrypting guest memory region. The command works only if the guest policy allows the debugging. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: kvm@vger.kernel.org Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> --- accel/kvm/kvm-all.c | 1 + accel/kvm/sev.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++++ include/sysemu/sev.h | 1 + 3 files changed, 72 insertions(+) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index d35eebb97901..b069261de32a 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -1677,6 +1677,7 @@ static int kvm_init(MachineState *ms) } kvm_state->memcrypt_encrypt_data = sev_encrypt_data; + kvm_state->memcrypt_debug_ops = sev_set_debug_ops; } ret = kvm_arch_init(ms, s); diff --git a/accel/kvm/sev.c b/accel/kvm/sev.c index fbbd99becc0a..3edfb5b08416 100644 --- a/accel/kvm/sev.c +++ b/accel/kvm/sev.c @@ -22,6 +22,7 @@ #define DEFAULT_GUEST_POLICY 0x1 /* disable debug */ #define DEFAULT_SEV_DEVICE "/dev/sev" +#define GUEST_POLICY_DBG_BIT 0x1 #define DEBUG_SEV #ifdef DEBUG_SEV @@ -34,6 +35,7 @@ static int sev_fd; static SEVState *sev_state; +static MemoryRegionRAMReadWriteOps sev_ops; #define SEV_FW_MAX_ERROR 0x17 @@ -483,6 +485,49 @@ sev_vm_state_change(void *opaque, int running, RunState state) } } +static int +sev_dbg_enc_dec(uint8_t *dst, const uint8_t *src, uint32_t len, bool write) +{ + int ret, error; + struct kvm_sev_dbg *dbg; + dbg = g_malloc0(sizeof(*dbg)); + if (!dbg) { + return 1; + } + + dbg->src_uaddr = (unsigned long)src; + dbg->dst_uaddr = (unsigned long)dst; + dbg->len = len; + + ret = sev_ioctl(write ? KVM_SEV_DBG_ENCRYPT : KVM_SEV_DBG_DECRYPT, + dbg, &error); + if (ret) { + error_report("%s (%s) %#llx->%#llx+%#x ret=%d fw_error=%d '%s'", + __func__, write ? "write" : "read", dbg->src_uaddr, + dbg->dst_uaddr, dbg->len, ret, error, + fw_error_to_str(error)); + } + + g_free(dbg); + return ret; +} + +static int +sev_mem_read(uint8_t *dst, const uint8_t *src, uint32_t len, MemTxAttrs attrs) +{ + assert(attrs.debug); + + return sev_dbg_enc_dec(dst, src, len, false); +} + +static int +sev_mem_write(uint8_t *dst, const uint8_t *src, uint32_t len, MemTxAttrs attrs) +{ + assert(attrs.debug); + + return sev_dbg_enc_dec(dst, src, len, true); +} + void * sev_guest_init(const char *id) { @@ -549,6 +594,31 @@ sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len) return 0; } +void +sev_set_debug_ops(void *handle, MemoryRegion *mr) +{ + int policy; + SEVState *s = (SEVState *)handle; + + policy = object_property_get_int(OBJECT(s->sev_info), + "policy", &error_abort); + + /* + * Check if guest policy supports debugging + * Bit 0 : + * 0 - debug allowed + * 1 - debug is not allowed + */ + if (policy & GUEST_POLICY_DBG_BIT) { + return; + } + + sev_ops.read = sev_mem_read; + sev_ops.write = sev_mem_write; + + memory_region_set_ram_debug_ops(mr, &sev_ops); +} + static void sev_register_types(void) { diff --git a/include/sysemu/sev.h b/include/sysemu/sev.h index 3af945935b60..7c50d33af4a9 100644 --- a/include/sysemu/sev.h +++ b/include/sysemu/sev.h @@ -71,6 +71,7 @@ typedef struct SEVState SEVState; void *sev_guest_init(const char *id); int sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len); +void sev_set_debug_ops(void *handle, MemoryRegion *mr); #endif -- 2.9.5
next prev parent reply other threads:[~2017-12-06 20:05 UTC|newest] Thread overview: 68+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-12-06 20:03 [PATCH v5 00/23] x86: Secure Encrypted Virtualization (AMD) Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 01/23] memattrs: add debug attribute Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 22:03 ` Peter Maydell 2017-12-06 22:03 ` [Qemu-devel] " Peter Maydell 2017-12-07 21:20 ` Brijesh Singh 2017-12-07 21:20 ` [Qemu-devel] " Brijesh Singh 2017-12-08 9:55 ` Peter Maydell 2017-12-08 9:55 ` [Qemu-devel] " Peter Maydell 2017-12-08 10:24 ` Edgar E. Iglesias 2017-12-08 10:24 ` [Qemu-devel] " Edgar E. Iglesias 2017-12-08 22:57 ` Brijesh Singh 2017-12-08 22:57 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 02/23] exec: add ram_debug_ops support Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 03/23] exec: add debug version of physical memory read and write API Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 04/23] monitor/i386: use debug APIs when accessing guest memory Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 05/23] target/i386: add memory encryption feature cpuid support Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 06/23] machine: add -memory-encryption property Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 07/23] kvm: update kvm.h to include memory encryption ioctls Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 08/23] docs: add AMD Secure Encrypted Virtualization (SEV) Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 09/23] accel: add Secure Encrypted Virtulization (SEV) object Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 10/23] sev: add command to initialize the memory encryption context Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 11/23] sev: register the guest memory range which may contain encrypted data Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 12/23] kvm: introduce memory encryption APIs Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 13/23] hmp: display memory encryption support in 'info kvm' Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 14/23] sev: add command to create launch memory encryption context Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 15/23] sev: add command to encrypt guest memory region Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 16/23] target/i386: encrypt bios rom Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 17/23] qapi: add SEV_MEASUREMENT event Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 18/23] sev: emit the " Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 19/23] sev: Finalize the SEV guest launch flow Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 20/23] hw: i386: set ram_debug_ops when memory encryption is enabled Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` Brijesh Singh [this message] 2017-12-06 20:03 ` [Qemu-devel] [PATCH v5 21/23] sev: add debug encrypt and decrypt commands Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 22/23] target/i386: clear C-bit when walking SEV guest page table Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-06 20:03 ` [PATCH v5 23/23] sev: add migration blocker Brijesh Singh 2017-12-06 20:03 ` [Qemu-devel] " Brijesh Singh 2017-12-07 11:03 ` Dr. David Alan Gilbert 2017-12-07 11:03 ` [Qemu-devel] " Dr. David Alan Gilbert 2017-12-07 11:10 ` Peter Maydell 2017-12-07 11:10 ` [Qemu-devel] " Peter Maydell 2017-12-07 11:27 ` Dr. David Alan Gilbert 2017-12-07 11:27 ` [Qemu-devel] " Dr. David Alan Gilbert 2017-12-07 21:25 ` Brijesh Singh 2017-12-07 21:25 ` [Qemu-devel] " Brijesh Singh 2017-12-07 22:50 ` Brijesh Singh 2017-12-07 22:50 ` [Qemu-devel] " Brijesh Singh
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20171206200346.116537-22-brijesh.singh@amd.com \ --to=brijesh.singh@amd.com \ --cc=alistair.francis@xilinx.com \ --cc=armbru@redhat.com \ --cc=berrange@redhat.com \ --cc=borntraeger@de.ibm.com \ --cc=cornelia.huck@de.ibm.com \ --cc=crosthwaite.peter@gmail.com \ --cc=dgilbert@redhat.com \ --cc=eblake@redhat.com \ --cc=edgar.iglesias@xilinx.com \ --cc=ehabkost@redhat.com \ --cc=kvm@vger.kernel.org \ --cc=marcel@redhat.com \ --cc=mst@redhat.com \ --cc=pbonzini@redhat.com \ --cc=peter.maydell@linaro.org \ --cc=qemu-devel@nongnu.org \ --cc=richard.henderson@linaro.org \ --cc=rth@twiddle.net \ --cc=stefanha@gmail.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.