From: Brijesh Singh <brijesh.singh@amd.com> To: qemu-devel@nongnu.org Cc: Peter Maydell <peter.maydell@linaro.org>, Brijesh Singh <brijesh.singh@amd.com>, kvm@vger.kernel.org, "Michael S. Tsirkin" <mst@redhat.com>, Stefan Hajnoczi <stefanha@gmail.com>, Alexander Graf <agraf@suse.de>, "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>, Markus Armbruster <armbru@redhat.com>, Bruce Rogers <brogers@suse.com>, Christian Borntraeger <borntraeger@de.ibm.com>, Marcel Apfelbaum <marcel@redhat.com>, Borislav Petkov <bp@suse.de>, Thomas Lendacky <Thomas.Lendacky@amd.com>, Eduardo Habkost <ehabkost@redhat.com>, Richard Henderson <richard.henderson@linaro.org>, "Dr. David Alan Gilbert" <dgilbert@redhat.com>, Alistair Francis <alistair.francis@xilinx.com>, Cornelia Huck <cornelia.huck@de.ibm.com>, Richard Henderson <rth@twiddle.net>, Peter Crosthwaite <crosthwaite.peter@gmail.com>, Paolo Bonzini <pbonzini@redhat.com> Subject: [PATCH v12 20/28] hw/i386: set ram_debug_ops when memory encryption is enabled Date: Thu, 8 Mar 2018 06:48:53 -0600 [thread overview] Message-ID: <20180308124901.83533-21-brijesh.singh@amd.com> (raw) In-Reply-To: <20180308124901.83533-1-brijesh.singh@amd.com> When memory encryption is enabled, the guest RAM and boot flash ROM will contain the encrypted data. By setting the debug ops allow us to invoke encryption APIs when accessing the memory for the debug purposes. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> --- hw/i386/pc.c | 9 +++++++++ hw/i386/pc_sysfw.c | 6 ++++++ 2 files changed, 15 insertions(+) diff --git a/hw/i386/pc.c b/hw/i386/pc.c index 35fcb6efdfb9..69364b6856b5 100644 --- a/hw/i386/pc.c +++ b/hw/i386/pc.c @@ -1360,6 +1360,15 @@ void pc_memory_init(PCMachineState *pcms, e820_add_entry(0x100000000ULL, pcms->above_4g_mem_size, E820_RAM); } + /* + * When memory encryption is enabled, the guest RAM will be encrypted with + * a guest unique key. Set the debug ops so that any debug access to the + * guest RAM will go through the memory encryption APIs. + */ + if (kvm_memcrypt_enabled()) { + kvm_memcrypt_set_debug_ops(ram); + } + if (!pcmc->has_reserved_memory && (machine->ram_slots || (machine->maxram_size > machine->ram_size))) { diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c index 73ac783f2055..845240f97293 100644 --- a/hw/i386/pc_sysfw.c +++ b/hw/i386/pc_sysfw.c @@ -181,6 +181,12 @@ static void pc_system_flash_init(MemoryRegion *rom_memory) error_report("failed to encrypt pflash rom"); exit(1); } + + /* + * The pflash ROM is encrypted, set the debug ops so that any + * debug accesses will use memory encryption APIs. + */ + kvm_memcrypt_set_debug_ops(flash_mem); } } } -- 2.14.3
WARNING: multiple messages have this Message-ID (diff)
From: Brijesh Singh <brijesh.singh@amd.com> To: qemu-devel@nongnu.org Cc: Alistair Francis <alistair.francis@xilinx.com>, Christian Borntraeger <borntraeger@de.ibm.com>, Cornelia Huck <cornelia.huck@de.ibm.com>, "Daniel P . Berrange" <berrange@redhat.com>, "Dr. David Alan Gilbert" <dgilbert@redhat.com>, "Michael S. Tsirkin" <mst@redhat.com>, "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>, Eduardo Habkost <ehabkost@redhat.com>, Eric Blake <eblake@redhat.com>, kvm@vger.kernel.org, Marcel Apfelbaum <marcel@redhat.com>, Markus Armbruster <armbru@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>, Peter Crosthwaite <crosthwaite.peter@gmail.com>, Peter Maydell <peter.maydell@linaro.org>, Richard Henderson <richard.henderson@linaro.org>, Stefan Hajnoczi <stefanha@gmail.com>, Thomas Lendacky <Thomas.Lendacky@amd.com>, Borislav Petkov <bp@suse.de>, Alexander Graf <agraf@suse.de>, Bruce Rogers <brogers@suse.com>, Brijesh Singh <brijesh.singh@amd.com>, Richard Henderson <rth@twiddle.net> Subject: [Qemu-devel] [PATCH v12 20/28] hw/i386: set ram_debug_ops when memory encryption is enabled Date: Thu, 8 Mar 2018 06:48:53 -0600 [thread overview] Message-ID: <20180308124901.83533-21-brijesh.singh@amd.com> (raw) In-Reply-To: <20180308124901.83533-1-brijesh.singh@amd.com> When memory encryption is enabled, the guest RAM and boot flash ROM will contain the encrypted data. By setting the debug ops allow us to invoke encryption APIs when accessing the memory for the debug purposes. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> --- hw/i386/pc.c | 9 +++++++++ hw/i386/pc_sysfw.c | 6 ++++++ 2 files changed, 15 insertions(+) diff --git a/hw/i386/pc.c b/hw/i386/pc.c index 35fcb6efdfb9..69364b6856b5 100644 --- a/hw/i386/pc.c +++ b/hw/i386/pc.c @@ -1360,6 +1360,15 @@ void pc_memory_init(PCMachineState *pcms, e820_add_entry(0x100000000ULL, pcms->above_4g_mem_size, E820_RAM); } + /* + * When memory encryption is enabled, the guest RAM will be encrypted with + * a guest unique key. Set the debug ops so that any debug access to the + * guest RAM will go through the memory encryption APIs. + */ + if (kvm_memcrypt_enabled()) { + kvm_memcrypt_set_debug_ops(ram); + } + if (!pcmc->has_reserved_memory && (machine->ram_slots || (machine->maxram_size > machine->ram_size))) { diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c index 73ac783f2055..845240f97293 100644 --- a/hw/i386/pc_sysfw.c +++ b/hw/i386/pc_sysfw.c @@ -181,6 +181,12 @@ static void pc_system_flash_init(MemoryRegion *rom_memory) error_report("failed to encrypt pflash rom"); exit(1); } + + /* + * The pflash ROM is encrypted, set the debug ops so that any + * debug accesses will use memory encryption APIs. + */ + kvm_memcrypt_set_debug_ops(flash_mem); } } } -- 2.14.3
next prev parent reply other threads:[~2018-03-08 12:48 UTC|newest] Thread overview: 114+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-03-08 12:48 [PATCH v12 00/28] x86: Secure Encrypted Virtualization (AMD) Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 01/28] memattrs: add debug attribute Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 02/28] exec: add ram_debug_ops support Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 03/28] exec: add debug version of physical memory read and write API Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 04/28] monitor/i386: use debug APIs when accessing guest memory Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 05/28] machine: add -memory-encryption property Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 16:43 ` Daniel P. Berrangé 2018-03-08 16:43 ` [Qemu-devel] " Daniel P. Berrangé 2018-03-08 12:48 ` [PATCH v12 06/28] kvm: update kvm.h to include memory encryption ioctls Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 07/28] docs: add AMD Secure Encrypted Virtualization (SEV) Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 08/28] target/i386: add Secure Encrypted Virtulization (SEV) object Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 16:49 ` Daniel P. Berrangé 2018-03-08 16:49 ` [Qemu-devel] " Daniel P. Berrangé 2018-03-08 22:22 ` Brijesh Singh 2018-03-08 22:22 ` [Qemu-devel] " Brijesh Singh 2018-03-08 22:44 ` Eduardo Habkost 2018-03-08 22:44 ` [Qemu-devel] " Eduardo Habkost 2018-03-13 8:42 ` Paolo Bonzini 2018-03-13 8:42 ` [Qemu-devel] " Paolo Bonzini 2018-03-13 18:49 ` Eduardo Habkost 2018-03-13 18:49 ` [Qemu-devel] " Eduardo Habkost 2018-03-13 19:04 ` Paolo Bonzini 2018-03-13 19:04 ` [Qemu-devel] " Paolo Bonzini 2018-03-13 19:20 ` Eduardo Habkost 2018-03-13 19:20 ` [Qemu-devel] " Eduardo Habkost 2018-03-13 19:49 ` Dr. David Alan Gilbert 2018-03-13 19:49 ` [Qemu-devel] " Dr. David Alan Gilbert 2018-03-08 12:48 ` [PATCH v12 09/28] qmp: add query-sev command Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 16:52 ` Daniel P. Berrangé 2018-03-08 16:52 ` [Qemu-devel] " Daniel P. Berrangé 2018-03-08 12:48 ` [PATCH v12 10/28] include: add psp-sev.h header file Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 16:54 ` Daniel P. Berrangé 2018-03-08 16:54 ` [Qemu-devel] " Daniel P. Berrangé 2018-03-09 12:24 ` Dr. David Alan Gilbert 2018-03-09 12:24 ` [Qemu-devel] " Dr. David Alan Gilbert 2018-03-12 10:32 ` Daniel P. Berrangé 2018-03-12 10:32 ` [Qemu-devel] " Daniel P. Berrangé 2018-03-08 12:48 ` [PATCH v12 11/28] sev/i386: add command to initialize the memory encryption context Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 16:57 ` Daniel P. Berrangé 2018-03-08 16:57 ` [Qemu-devel] " Daniel P. Berrangé 2018-03-08 12:48 ` [PATCH v12 12/28] sev/i386: register the guest memory range which may contain encrypted data Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 13/28] kvm: introduce memory encryption APIs Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 14/28] hmp: add 'info sev' command Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 15/28] sev/i386: add command to create launch memory encryption context Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 16/28] sev/i386: add command to encrypt guest memory region Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 17/28] target/i386: encrypt bios rom Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 18/28] sev/i386: add support to LAUNCH_MEASURE command Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 19/28] sev/i386: finalize the SEV guest launch flow Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` Brijesh Singh [this message] 2018-03-08 12:48 ` [Qemu-devel] [PATCH v12 20/28] hw/i386: set ram_debug_ops when memory encryption is enabled Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 21/28] sev/i386: add debug encrypt and decrypt commands Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 22/28] target/i386: clear C-bit when walking SEV guest page table Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 23/28] qmp: add query-sev-launch-measure command Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 17:03 ` Daniel P. Berrangé 2018-03-08 17:03 ` [Qemu-devel] " Daniel P. Berrangé 2018-03-08 12:48 ` [PATCH v12 24/28] sev/i386: add migration blocker Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-13 9:33 ` Paolo Bonzini 2018-03-13 9:33 ` [Qemu-devel] " Paolo Bonzini 2018-03-13 11:28 ` Brijesh Singh 2018-03-13 11:28 ` [Qemu-devel] " Brijesh Singh 2018-03-13 11:36 ` Paolo Bonzini 2018-03-13 11:36 ` [Qemu-devel] " Paolo Bonzini 2018-03-08 12:48 ` [PATCH v12 25/28] cpu/i386: populate CPUID 0x8000_001F when SEV is active Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:48 ` [PATCH v12 26/28] qmp: add query-sev-capabilities command Brijesh Singh 2018-03-08 12:48 ` [Qemu-devel] " Brijesh Singh 2018-03-08 17:05 ` Daniel P. Berrangé 2018-03-08 17:05 ` [Qemu-devel] " Daniel P. Berrangé 2018-03-08 22:52 ` Brijesh Singh 2018-03-08 22:52 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:49 ` [PATCH v12 27/28] sev/i386: add sev_get_capabilities() Brijesh Singh 2018-03-08 12:49 ` [Qemu-devel] " Brijesh Singh 2018-03-08 12:49 ` [PATCH v12 28/28] tests/qmp-test: blacklist sev specific qmp commands Brijesh Singh 2018-03-08 12:49 ` [Qemu-devel] " Brijesh Singh 2018-03-08 17:08 ` Daniel P. Berrangé 2018-03-08 17:08 ` [Qemu-devel] " Daniel P. Berrangé 2018-03-08 20:18 ` Brijesh Singh 2018-03-08 20:18 ` [Qemu-devel] " Brijesh Singh 2018-03-08 21:45 ` Eduardo Habkost 2018-03-08 21:45 ` [Qemu-devel] " Eduardo Habkost 2018-03-08 23:22 ` Daniel P. Berrange 2018-03-08 23:22 ` [Qemu-devel] " Daniel P. Berrange 2018-03-09 10:12 ` Dr. David Alan Gilbert 2018-03-09 10:12 ` [Qemu-devel] " Dr. David Alan Gilbert 2018-03-13 9:07 ` Paolo Bonzini 2018-03-13 9:07 ` [Qemu-devel] " Paolo Bonzini 2018-03-13 11:21 ` Brijesh Singh 2018-03-13 11:21 ` [Qemu-devel] " Brijesh Singh 2018-03-13 11:36 ` Paolo Bonzini 2018-03-13 11:36 ` [Qemu-devel] " Paolo Bonzini
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180308124901.83533-21-brijesh.singh@amd.com \ --to=brijesh.singh@amd.com \ --cc=Thomas.Lendacky@amd.com \ --cc=agraf@suse.de \ --cc=alistair.francis@xilinx.com \ --cc=armbru@redhat.com \ --cc=borntraeger@de.ibm.com \ --cc=bp@suse.de \ --cc=brogers@suse.com \ --cc=cornelia.huck@de.ibm.com \ --cc=crosthwaite.peter@gmail.com \ --cc=dgilbert@redhat.com \ --cc=edgar.iglesias@xilinx.com \ --cc=ehabkost@redhat.com \ --cc=kvm@vger.kernel.org \ --cc=marcel@redhat.com \ --cc=mst@redhat.com \ --cc=pbonzini@redhat.com \ --cc=peter.maydell@linaro.org \ --cc=qemu-devel@nongnu.org \ --cc=richard.henderson@linaro.org \ --cc=rth@twiddle.net \ --cc=stefanha@gmail.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.