From patchwork Thu Jun 20 18:03:15 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brijesh Singh X-Patchwork-Id: 1119666 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=amd.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=amdcloud.onmicrosoft.com header.i=@amdcloud.onmicrosoft.com header.b="ngwuUudk"; dkim-atps=neutral Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 45V9MJ4P0Mz9sPS for ; Fri, 21 Jun 2019 04:29:16 +1000 (AEST) Received: from localhost ([::1]:52086 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1he1o6-0002M7-SE for incoming@patchwork.ozlabs.org; Thu, 20 Jun 2019 14:29:10 -0400 Received: from eggs.gnu.org ([209.51.188.92]:43365) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1he1cV-0005N6-LN for qemu-devel@nongnu.org; Thu, 20 Jun 2019 14:17:13 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1he1PA-0003vK-QH for qemu-devel@nongnu.org; Thu, 20 Jun 2019 14:03:47 -0400 Received: from mail-co1nam05on062b.outbound.protection.outlook.com ([2a01:111:f400:fe50::62b]:38112 helo=NAM05-CO1-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1he1PA-0003tz-Jt for qemu-devel@nongnu.org; Thu, 20 Jun 2019 14:03:24 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector1-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OK7h8pxuTS47T82sKhCXzKmckLFAoeBKV06Ie45lRNM=; b=ngwuUudkGdmfCPn82MD5KJLnzKhByEbdzv/WzXgFjNzTB5SkW/ZJfBNYAgme75vF9758gBo/MTucBDjimSlfkWZKhl3kddnEOQuSwJjRbWAiQU6hwCzL8db6LJqy9FGprDi6+Ak0i+/lrMTjISScC14GV6oOnbLwEYupaZH5yEc= Received: from DM6PR12MB2682.namprd12.prod.outlook.com (20.176.116.31) by DM6PR12MB3260.namprd12.prod.outlook.com (20.179.105.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1987.15; Thu, 20 Jun 2019 18:03:17 +0000 Received: from DM6PR12MB2682.namprd12.prod.outlook.com ([fe80::b9c1:b235:fff3:dba2]) by DM6PR12MB2682.namprd12.prod.outlook.com ([fe80::b9c1:b235:fff3:dba2%6]) with mapi id 15.20.1987.014; Thu, 20 Jun 2019 18:03:17 +0000 From: "Singh, Brijesh" To: "qemu-devel@nongnu.org" Thread-Topic: [RFC PATCH v1 04/12] kvm: add support to sync the page encryption state bitmap Thread-Index: AQHVJ5Ju4VS6djRjvkaGkMwqb7aRwg== Date: Thu, 20 Jun 2019 18:03:15 +0000 Message-ID: <20190620180247.8825-5-brijesh.singh@amd.com> References: <20190620180247.8825-1-brijesh.singh@amd.com> In-Reply-To: <20190620180247.8825-1-brijesh.singh@amd.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: DM5PR16CA0025.namprd16.prod.outlook.com (2603:10b6:4:15::11) To DM6PR12MB2682.namprd12.prod.outlook.com (2603:10b6:5:4a::31) authentication-results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; x-ms-exchange-messagesentrepresentingtype: 1 x-mailer: git-send-email 2.17.1 x-originating-ip: [165.204.77.1] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ec67198f-819a-434c-710e-08d6f5a98d38 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:DM6PR12MB3260; x-ms-traffictypediagnostic: DM6PR12MB3260: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:203; x-forefront-prvs: 0074BBE012 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(396003)(376002)(136003)(39860400002)(346002)(199004)(189003)(43544003)(2351001)(53936002)(486006)(2616005)(11346002)(81156014)(8676002)(14444005)(6436002)(446003)(5640700003)(50226002)(6512007)(476003)(102836004)(6916009)(99286004)(2501003)(6486002)(76176011)(8936002)(52116002)(81166006)(316002)(186003)(6506007)(26005)(478600001)(256004)(3846002)(2906002)(386003)(66066001)(14454004)(54906003)(6116002)(305945005)(25786009)(1076003)(66946007)(66556008)(73956011)(64756008)(66446008)(71190400001)(71200400001)(68736007)(36756003)(66476007)(5660300002)(7736002)(86362001)(4326008); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR12MB3260; H:DM6PR12MB2682.namprd12.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: amd.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: zvOaUUm42Sjb45SIGyNnWZkbLH0lsmemCt/jnGFpwmxKzNheGW/nPqpMF2FacDTqUKp1MQUDSjxc4nEWFJbNySFa2/+lK+ANnVP6IKEb0xEe3YMCFPhU3V9OIJ9c1Q3PaU/SElh1mqz/NAyhTXIMPsGIhiNjuArVEVba6yt48lcnt2MMDPdp9/hhwI9H/xwJg3RpirP1U/rlnzK5z4V43Xxt9Dosmm37pv9/r2gSVRqTYhRG6xxUDK+Qj3DCwPnjpb1z1ZGUSvpoQMb6eK3KkPzYCvPJbZuH67amJqgEnZGelWIYwd//6h4UwvugUF5MvV8BHeGh8s2b08ogitBkv5GCLnT3wAb9tsymBfJg7XucMK9lEzCEzIv634+Kv0TOoMhKj3i8qYBzonpGQtf5VRew/BJJ83DXaZMA7W3Q3m4= MIME-Version: 1.0 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: ec67198f-819a-434c-710e-08d6f5a98d38 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jun 2019 18:03:15.8278 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: sbrijesh@amd.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB3260 X-detected-operating-system: by eggs.gnu.org: Windows 7 or 8 [fuzzy] X-Received-From: 2a01:111:f400:fe50::62b Subject: [Qemu-devel] [RFC PATCH v1 04/12] kvm: add support to sync the page encryption state bitmap X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "Lendacky, Thomas" , "Singh, Brijesh" , "kvm@vger.kernel.org" Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" The SEV VMs have concept of private and shared memory. The private memory is encrypted with guest-specific key, while shared memory may be encrypted with hyperivosr key. The KVM_GET_PAGE_ENC_BITMAP can be used to get a bitmap indicating whether the guest page is private or shared. A private page must be transmitted using the SEV migration commands. Signed-off-by: Brijesh Singh --- accel/kvm/kvm-all.c | 1 + include/exec/ram_addr.h | 2 ++ migration/ram.c | 28 +++++++++++++++++++++++++++- target/i386/sev.c | 27 +++++++++++++++++++++++++++ 4 files changed, 57 insertions(+), 1 deletion(-) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index 4d5ff8b9f5..0654d9a7cd 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -1783,6 +1783,7 @@ static int kvm_init(MachineState *ms) } kvm_state->memcrypt_encrypt_data = sev_encrypt_data; + kvm_state->memcrypt_sync_page_enc_bitmap = sev_sync_page_enc_bitmap; } ret = kvm_arch_init(ms, s); diff --git a/include/exec/ram_addr.h b/include/exec/ram_addr.h index f96777bb99..2145059afc 100644 --- a/include/exec/ram_addr.h +++ b/include/exec/ram_addr.h @@ -51,6 +51,8 @@ struct RAMBlock { unsigned long *unsentmap; /* bitmap of already received pages in postcopy */ unsigned long *receivedmap; + /* bitmap of page encryption state for an encrypted guest */ + unsigned long *encbmap; }; static inline bool offset_in_ramblock(RAMBlock *b, ram_addr_t offset) diff --git a/migration/ram.c b/migration/ram.c index 3c8977d508..a8631c0896 100644 --- a/migration/ram.c +++ b/migration/ram.c @@ -1680,6 +1680,9 @@ static void migration_bitmap_sync_range(RAMState *rs, RAMBlock *rb, rs->migration_dirty_pages += cpu_physical_memory_sync_dirty_bitmap(rb, 0, length, &rs->num_dirty_pages_period); + if (kvm_memcrypt_enabled()) { + kvm_memcrypt_sync_page_enc_bitmap(rb->host, length, rb->encbmap); + } } /** @@ -2465,6 +2468,22 @@ static bool save_compress_page(RAMState *rs, RAMBlock *block, ram_addr_t offset) return false; } +/** + * encrypted_test_bitmap: check if the page is encrypted + * + * Returns a bool indicating whether the page is encrypted. + */ +static bool encrypted_test_bitmap(RAMState *rs, RAMBlock *block, + unsigned long page) +{ + /* ROM devices contains the unencrypted data */ + if (memory_region_is_rom(block->mr)) { + return false; + } + + return test_bit(page, block->encbmap); +} + /** * ram_save_target_page: save one target page * @@ -2491,7 +2510,8 @@ static int ram_save_target_page(RAMState *rs, PageSearchStatus *pss, * will take care of accessing the guest memory and re-encrypt it * for the transport purposes. */ - if (kvm_memcrypt_enabled()) { + if (kvm_memcrypt_enabled() && + encrypted_test_bitmap(rs, pss->block, pss->page)) { return ram_save_encrypted_page(rs, pss, last_stage); } @@ -2724,6 +2744,8 @@ static void ram_save_cleanup(void *opaque) block->bmap = NULL; g_free(block->unsentmap); block->unsentmap = NULL; + g_free(block->encbmap); + block->encbmap = NULL; } xbzrle_cleanup(); @@ -3251,6 +3273,10 @@ static void ram_list_init_bitmaps(void) block->unsentmap = bitmap_new(pages); bitmap_set(block->unsentmap, 0, pages); } + if (kvm_memcrypt_enabled()) { + block->encbmap = bitmap_new(pages); + bitmap_set(block->encbmap, 0, pages); + } } } } diff --git a/target/i386/sev.c b/target/i386/sev.c index 6dbdc3cdf1..dd3814e25f 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -819,6 +819,33 @@ sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len) return 0; } +int sev_sync_page_enc_bitmap(void *handle, uint8_t *host, uint64_t size, + unsigned long *bitmap) +{ + int r; + unsigned long base_gpa; + KVMState *s = kvm_state; + struct kvm_page_enc_bitmap e = {}; + unsigned long pages = size >> TARGET_PAGE_BITS; + + r = kvm_physical_memory_addr_from_host(kvm_state, host, &base_gpa); + if (!r) { + return 1; + } + + e.enc_bitmap = bitmap; + e.start = base_gpa >> TARGET_PAGE_BITS; + e.num_pages = pages; + + if (kvm_vm_ioctl(s, KVM_GET_PAGE_ENC_BITMAP, &e) == -1) { + error_report("%s: get page_enc bitmap start 0x%llx pages 0x%llx", + __func__, e.start, e.num_pages); + return 1; + } + + return 0; +} + static void sev_register_types(void) {