From patchwork Thu Jun 20 18:03:08 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brijesh Singh X-Patchwork-Id: 1119700 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=amd.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=amdcloud.onmicrosoft.com header.i=@amdcloud.onmicrosoft.com header.b="UiKQ9oAr"; dkim-atps=neutral Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 45VB0r1Vw1z9s4V for ; Fri, 21 Jun 2019 04:58:20 +1000 (AEST) Received: from localhost ([::1]:52218 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1he2GI-0001eC-8J for incoming@patchwork.ozlabs.org; Thu, 20 Jun 2019 14:58:18 -0400 Received: from eggs.gnu.org ([209.51.188.92]:43402) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1he1cb-0005Nr-Np for qemu-devel@nongnu.org; Thu, 20 Jun 2019 14:17:19 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1he1P9-0003u3-8E for qemu-devel@nongnu.org; Thu, 20 Jun 2019 14:03:47 -0400 Received: from mail-eopbgr720059.outbound.protection.outlook.com ([40.107.72.59]:35920 helo=NAM05-CO1-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1he1P8-0003qK-VF for qemu-devel@nongnu.org; Thu, 20 Jun 2019 14:03:23 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector1-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Mf8jDXjO64YdTGizvevSEpAQhvar0tN+bsG6ZLT84cg=; b=UiKQ9oArWjqAQ94d8FyUw1ggWT34wBcoPeVjIPvf5wByQj7KZXzFeOxWmaI5dZS/lyUHGr79PfzS49FIcrZAkq8M3q2PnTYezCnqymQi7QvRJp2WTlQzfbB0lNDjW2e/qN996htYrusgyLGG2D/uaHnLPmYJM+QTsHT6cQ9+liw= Received: from DM6PR12MB2682.namprd12.prod.outlook.com (20.176.116.31) by DM6PR12MB3260.namprd12.prod.outlook.com (20.179.105.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1987.15; Thu, 20 Jun 2019 18:03:16 +0000 Received: from DM6PR12MB2682.namprd12.prod.outlook.com ([fe80::b9c1:b235:fff3:dba2]) by DM6PR12MB2682.namprd12.prod.outlook.com ([fe80::b9c1:b235:fff3:dba2%6]) with mapi id 15.20.1987.014; Thu, 20 Jun 2019 18:03:16 +0000 From: "Singh, Brijesh" To: "qemu-devel@nongnu.org" Thread-Topic: [RFC PATCH v1 03/12] migration/ram: add support to send encrypted pages Thread-Index: AQHVJ5Jq6KfFwPejbEqFodH5195MuA== Date: Thu, 20 Jun 2019 18:03:08 +0000 Message-ID: <20190620180247.8825-4-brijesh.singh@amd.com> References: <20190620180247.8825-1-brijesh.singh@amd.com> In-Reply-To: <20190620180247.8825-1-brijesh.singh@amd.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: DM5PR16CA0025.namprd16.prod.outlook.com (2603:10b6:4:15::11) To DM6PR12MB2682.namprd12.prod.outlook.com (2603:10b6:5:4a::31) authentication-results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; x-ms-exchange-messagesentrepresentingtype: 1 x-mailer: git-send-email 2.17.1 x-originating-ip: [165.204.77.1] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 1acf7256-1093-42a9-0c03-08d6f5a98c4e x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:DM6PR12MB3260; x-ms-traffictypediagnostic: DM6PR12MB3260: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6430; x-forefront-prvs: 0074BBE012 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(396003)(376002)(136003)(39860400002)(346002)(199004)(189003)(43544003)(2351001)(53936002)(486006)(2616005)(11346002)(81156014)(8676002)(14444005)(6436002)(446003)(5640700003)(50226002)(6512007)(476003)(102836004)(6916009)(99286004)(2501003)(6486002)(76176011)(8936002)(52116002)(81166006)(316002)(186003)(6506007)(26005)(478600001)(256004)(3846002)(2906002)(386003)(66066001)(14454004)(54906003)(6116002)(305945005)(25786009)(1076003)(66946007)(66556008)(73956011)(64756008)(66446008)(71190400001)(71200400001)(68736007)(36756003)(6666004)(66476007)(5660300002)(7736002)(86362001)(4326008); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR12MB3260; H:DM6PR12MB2682.namprd12.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: amd.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: CpOG6ZyeM9A8ipgvDLDcgI5vGNQIsNgGaNm+M4vkW4llszD+J1KQkOmnq3gr68s7KVuzoVWKWf5K3oewqGCfPKaTOpUNnDa1JcFH7DPx1/+LLtNWOg8tHylDoHPrx3LVTUejIfeajmQupXlZ89TLmaGtMbgZ5YsPtPmCGrBTbhA3u5PElWWaAjNxF0RXt7YjYhIwKw4retTYaJK7PW1tDoHejq69grZUtXd+QErdixuMc/Y8isjs6e+c5fcYQhNn/5oVLsEKfVuFjd2ixpikMDwWs/E7BHRlEWr1KziT7atuGLrda5fPOnfKwOOK8fa+VvDkOhyo9Qn9bGflw/SDVMqHWJBQOr+1kVphZ2bPtSfj6IQXCMEDSA75Ql8XxVJwOl928C++qPCmExt5eSRk9LjfsXwprHd6SCUcdKXtCFw= MIME-Version: 1.0 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1acf7256-1093-42a9-0c03-08d6f5a98c4e X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jun 2019 18:03:08.4579 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: sbrijesh@amd.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB3260 X-detected-operating-system: by eggs.gnu.org: Windows 7 or 8 [fuzzy] X-Received-From: 40.107.72.59 Subject: [Qemu-devel] [RFC PATCH v1 03/12] migration/ram: add support to send encrypted pages X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "Lendacky, Thomas" , "Singh, Brijesh" , "kvm@vger.kernel.org" Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" When memory encryption is enabled, the guest memory will be encrypted with the guest specific key. The patch introduces RAM_SAVE_FLAG_ENCRYPTED_PAGE flag to distinguish the encrypted data from plaintext. Encrypted pages may need special handling. The kvm_memcrypt_save_outgoing_page() is used by the sender to write the encrypted pages onto the socket, similarly the kvm_memcrypt_load_incoming_page() is used by the target to read the encrypted pages from the socket and load into the guest memory. Signed-off-by: Brijesh Singh --- migration/ram.c | 54 ++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 53 insertions(+), 1 deletion(-) diff --git a/migration/ram.c b/migration/ram.c index 908517fc2b..3c8977d508 100644 --- a/migration/ram.c +++ b/migration/ram.c @@ -57,6 +57,7 @@ #include "qemu/uuid.h" #include "savevm.h" #include "qemu/iov.h" +#include "sysemu/kvm.h" /***********************************************************/ /* ram save/restore */ @@ -76,6 +77,7 @@ #define RAM_SAVE_FLAG_XBZRLE 0x40 /* 0x80 is reserved in migration.h start with 0x100 next */ #define RAM_SAVE_FLAG_COMPRESS_PAGE 0x100 +#define RAM_SAVE_FLAG_ENCRYPTED_PAGE 0x200 static inline bool is_zero_range(uint8_t *p, uint64_t size) { @@ -460,6 +462,9 @@ static QemuCond decomp_done_cond; static bool do_compress_ram_page(QEMUFile *f, z_stream *stream, RAMBlock *block, ram_addr_t offset, uint8_t *source_buf); +static int ram_save_encrypted_page(RAMState *rs, PageSearchStatus *pss, + bool last_stage); + static void *do_data_compress(void *opaque) { CompressParam *param = opaque; @@ -2006,6 +2011,36 @@ static int ram_save_multifd_page(RAMState *rs, RAMBlock *block, return 1; } +/** + * ram_save_encrypted_page - send the given encrypted page to the stream + */ +static int ram_save_encrypted_page(RAMState *rs, PageSearchStatus *pss, + bool last_stage) +{ + int ret; + uint8_t *p; + RAMBlock *block = pss->block; + ram_addr_t offset = pss->page << TARGET_PAGE_BITS; + uint64_t bytes_xmit; + + p = block->host + offset; + + ram_counters.transferred += + save_page_header(rs, rs->f, block, + offset | RAM_SAVE_FLAG_ENCRYPTED_PAGE); + + ret = kvm_memcrypt_save_outgoing_page(rs->f, p, + TARGET_PAGE_SIZE, &bytes_xmit); + if (ret) { + return -1; + } + + ram_counters.transferred += bytes_xmit; + ram_counters.normal++; + + return 1; +} + static bool do_compress_ram_page(QEMUFile *f, z_stream *stream, RAMBlock *block, ram_addr_t offset, uint8_t *source_buf) { @@ -2450,6 +2485,16 @@ static int ram_save_target_page(RAMState *rs, PageSearchStatus *pss, return res; } + /* + * If memory encryption is enabled then use memory encryption APIs + * to write the outgoing buffer to the wire. The encryption APIs + * will take care of accessing the guest memory and re-encrypt it + * for the transport purposes. + */ + if (kvm_memcrypt_enabled()) { + return ram_save_encrypted_page(rs, pss, last_stage); + } + if (save_compress_page(rs, block, offset)) { return 1; } @@ -4271,7 +4316,8 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id) } if (flags & (RAM_SAVE_FLAG_ZERO | RAM_SAVE_FLAG_PAGE | - RAM_SAVE_FLAG_COMPRESS_PAGE | RAM_SAVE_FLAG_XBZRLE)) { + RAM_SAVE_FLAG_COMPRESS_PAGE | RAM_SAVE_FLAG_XBZRLE | + RAM_SAVE_FLAG_ENCRYPTED_PAGE)) { RAMBlock *block = ram_block_from_stream(f, flags); /* @@ -4391,6 +4437,12 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id) break; } break; + case RAM_SAVE_FLAG_ENCRYPTED_PAGE: + if (kvm_memcrypt_load_incoming_page(f, host)) { + error_report("Failed to encrypted incoming data"); + ret = -EINVAL; + } + break; case RAM_SAVE_FLAG_EOS: /* normal exit */ multifd_recv_sync_main();