From: Peter Gonda <pgonda@google.com>
To: kvm@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, marcorr@google.com,
seanjc@google.com, michael.roth@amd.com, thomas.lendacky@amd.com,
joro@8bytes.org, mizhang@google.com, pbonzini@redhat.com,
Peter Gonda <pgonda@google.com>
Subject: [V2 03/11] KVM: selftests: add hooks for managing encrypted guest memory
Date: Mon, 1 Aug 2022 13:11:01 -0700 [thread overview]
Message-ID: <20220801201109.825284-4-pgonda@google.com> (raw)
In-Reply-To: <20220801201109.825284-1-pgonda@google.com>
From: Michael Roth <michael.roth@amd.com>
VM implementations that make use of encrypted memory need a way to
configure things like the encryption/shared bit position for page
table handling, the default encryption policy for internal allocations
made by the core library, and a way to fetch the list/bitmap of
encrypted pages to do the actual memory encryption. Add an interface to
configure these parameters. Also introduce a sparsebit map to track
allocations/mappings that should be treated as encrypted, and provide
a way for VM implementations to retrieve it to handle operations
related memory encryption.
Reviewed-by: Mingwei Zhang <mizhang@google.com>
Signed-off-by: Michael Roth <michael.roth@amd.com>
Signed-off-by: Peter Gonda <pgonda@google.com>
---
.../selftests/kvm/include/kvm_util_base.h | 17 ++++++
tools/testing/selftests/kvm/lib/kvm_util.c | 52 +++++++++++++++++--
2 files changed, 66 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/kvm/include/kvm_util_base.h b/tools/testing/selftests/kvm/include/kvm_util_base.h
index 24fde97f6121..3928351e497e 100644
--- a/tools/testing/selftests/kvm/include/kvm_util_base.h
+++ b/tools/testing/selftests/kvm/include/kvm_util_base.h
@@ -32,6 +32,7 @@ typedef uint64_t vm_vaddr_t; /* Virtual Machine (Guest) virtual address */
struct userspace_mem_region {
struct kvm_userspace_memory_region region;
struct sparsebit *unused_phy_pages;
+ struct sparsebit *encrypted_phy_pages;
int fd;
off_t offset;
void *host_mem;
@@ -64,6 +65,14 @@ struct userspace_mem_regions {
DECLARE_HASHTABLE(slot_hash, 9);
};
+/* Memory encryption policy/configuration. */
+struct vm_memcrypt {
+ bool enabled;
+ int8_t enc_by_default;
+ bool has_enc_bit;
+ int8_t enc_bit;
+};
+
struct kvm_vm {
int mode;
unsigned long type;
@@ -87,6 +96,7 @@ struct kvm_vm {
vm_vaddr_t idt;
vm_vaddr_t handlers;
uint32_t dirty_ring_size;
+ struct vm_memcrypt memcrypt;
/* Cache of information for binary stats interface */
int stats_fd;
@@ -834,4 +844,11 @@ static inline int __vm_disable_nx_huge_pages(struct kvm_vm *vm)
return __vm_enable_cap(vm, KVM_CAP_VM_DISABLE_NX_HUGE_PAGES, 0);
}
+void vm_set_memory_encryption(struct kvm_vm *vm, bool enc_by_default, bool has_enc_bit,
+ uint8_t enc_bit);
+
+const struct sparsebit *vm_get_encrypted_phy_pages(struct kvm_vm *vm, int slot,
+ vm_paddr_t *gpa_start,
+ uint64_t *size);
+
#endif /* SELFTEST_KVM_UTIL_BASE_H */
diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
index cb3a5f8a53b7..c6b87b411186 100644
--- a/tools/testing/selftests/kvm/lib/kvm_util.c
+++ b/tools/testing/selftests/kvm/lib/kvm_util.c
@@ -542,6 +542,7 @@ static void __vm_mem_region_delete(struct kvm_vm *vm,
vm_ioctl(vm, KVM_SET_USER_MEMORY_REGION, ®ion->region);
sparsebit_free(®ion->unused_phy_pages);
+ sparsebit_free(®ion->encrypted_phy_pages);
ret = munmap(region->mmap_start, region->mmap_size);
TEST_ASSERT(!ret, __KVM_SYSCALL_ERROR("munmap()", ret));
@@ -882,6 +883,7 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm,
}
region->unused_phy_pages = sparsebit_alloc();
+ region->encrypted_phy_pages = sparsebit_alloc();
sparsebit_set_num(region->unused_phy_pages,
guest_paddr >> vm->page_shift, npages);
region->region.slot = slot;
@@ -1097,6 +1099,7 @@ struct kvm_vcpu *__vm_vcpu_add(struct kvm_vm *vm, uint32_t vcpu_id)
* num - number of pages
* paddr_min - Physical address minimum
* memslot - Memory region to allocate page from
+ * encrypt - Whether to treat the pages as encrypted
*
* Output Args: None
*
@@ -1108,8 +1111,9 @@ struct kvm_vcpu *__vm_vcpu_add(struct kvm_vm *vm, uint32_t vcpu_id)
* and their base address is returned. A TEST_ASSERT failure occurs if
* not enough pages are available at or above paddr_min.
*/
-vm_paddr_t vm_phy_pages_alloc(struct kvm_vm *vm, size_t num,
- vm_paddr_t paddr_min, uint32_t memslot)
+static vm_paddr_t
+_vm_phy_pages_alloc(struct kvm_vm *vm, size_t num, vm_paddr_t paddr_min,
+ uint32_t memslot, bool encrypt)
{
struct userspace_mem_region *region;
sparsebit_idx_t pg, base;
@@ -1141,12 +1145,22 @@ vm_paddr_t vm_phy_pages_alloc(struct kvm_vm *vm, size_t num,
abort();
}
- for (pg = base; pg < base + num; ++pg)
+ for (pg = base; pg < base + num; ++pg) {
sparsebit_clear(region->unused_phy_pages, pg);
+ if (encrypt)
+ sparsebit_set(region->encrypted_phy_pages, pg);
+ }
return base * vm->page_size;
}
+vm_paddr_t vm_phy_pages_alloc(struct kvm_vm *vm, size_t num,
+ vm_paddr_t paddr_min, uint32_t memslot)
+{
+ return _vm_phy_pages_alloc(vm, num, paddr_min, memslot,
+ vm->memcrypt.enc_by_default);
+}
+
vm_paddr_t vm_phy_page_alloc(struct kvm_vm *vm, vm_paddr_t paddr_min,
uint32_t memslot)
{
@@ -1730,6 +1744,10 @@ void vm_dump(FILE *stream, struct kvm_vm *vm, uint8_t indent)
region->host_mem);
fprintf(stream, "%*sunused_phy_pages: ", indent + 2, "");
sparsebit_dump(stream, region->unused_phy_pages, 0);
+ if (vm->memcrypt.enabled) {
+ fprintf(stream, "%*sencrypted_phy_pages: ", indent + 2, "");
+ sparsebit_dump(stream, region->encrypted_phy_pages, 0);
+ }
}
fprintf(stream, "%*sMapped Virtual Pages:\n", indent, "");
sparsebit_dump(stream, vm->vpages_mapped, indent + 2);
@@ -1978,3 +1996,31 @@ void __vm_get_stat(struct kvm_vm *vm, const char *stat_name, uint64_t *data,
break;
}
}
+
+void vm_set_memory_encryption(struct kvm_vm *vm, bool enc_by_default, bool has_enc_bit,
+ uint8_t enc_bit)
+{
+ vm->memcrypt.enabled = true;
+ vm->memcrypt.enc_by_default = enc_by_default;
+ vm->memcrypt.has_enc_bit = has_enc_bit;
+ vm->memcrypt.enc_bit = enc_bit;
+}
+
+const struct sparsebit *
+vm_get_encrypted_phy_pages(struct kvm_vm *vm, int slot, vm_paddr_t *gpa_start,
+ uint64_t *size)
+{
+ struct userspace_mem_region *region;
+
+ if (!vm->memcrypt.enabled)
+ return NULL;
+
+ region = memslot2region(vm, slot);
+ if (!region)
+ return NULL;
+
+ *size = region->region.memory_size;
+ *gpa_start = region->region.guest_phys_addr;
+
+ return region->encrypted_phy_pages;
+}
--
2.37.1.455.g008518b4e5-goog
next prev parent reply other threads:[~2022-08-01 20:11 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-01 20:10 [V2 00/11] KVM: selftests: Add simple SEV test Peter Gonda
2022-08-01 20:10 ` [V2 01/11] KVM: selftests: move vm_phy_pages_alloc() earlier in file Peter Gonda
2022-08-02 9:59 ` Andrew Jones
2022-08-01 20:11 ` [V2 02/11] KVM: selftests: sparsebit: add const where appropriate Peter Gonda
2022-08-02 10:00 ` Andrew Jones
2022-08-01 20:11 ` Peter Gonda [this message]
2022-08-01 20:11 ` [V2 04/11] KVM: selftests: handle encryption bits in page tables Peter Gonda
2022-08-01 20:11 ` [V2 05/11] KVM: selftests: add support for encrypted vm_vaddr_* allocations Peter Gonda
2022-08-01 20:11 ` [V2 06/11] KVM: selftests: Consolidate common code for popuplating Peter Gonda
2022-08-02 10:09 ` Andrew Jones
2022-08-02 14:45 ` Peter Gonda
2022-08-01 20:11 ` [V2 07/11] KVM: selftests: Consolidate boilerplate code in get_ucall() Peter Gonda
2022-08-02 8:37 ` Andrew Jones
2022-08-02 9:54 ` Andrew Jones
2022-08-02 14:46 ` Peter Gonda
2022-08-01 20:11 ` [V2 08/11] tools: Add atomic_test_and_set_bit() Peter Gonda
2022-08-01 20:11 ` [V2 09/11] KVM: selftests: Make ucall work with encrypted guests Peter Gonda
2022-08-02 9:49 ` Andrew Jones
2022-08-02 13:51 ` Peter Gonda
2022-08-02 14:26 ` Andrew Jones
2022-08-02 14:36 ` Peter Gonda
2022-08-01 20:11 ` [V2 10/11] KVM: selftests: add library for creating/interacting with SEV guests Peter Gonda
2022-08-01 20:11 ` [V2 11/11] KVM: selftests: Add simple sev vm testing Peter Gonda
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220801201109.825284-4-pgonda@google.com \
--to=pgonda@google.com \
--cc=joro@8bytes.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcorr@google.com \
--cc=michael.roth@amd.com \
--cc=mizhang@google.com \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=thomas.lendacky@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).