From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751955AbdISUys (ORCPT ); Tue, 19 Sep 2017 16:54:48 -0400 Received: from mail-by2nam01on0052.outbound.protection.outlook.com ([104.47.34.52]:32170 "EHLO NAM01-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751830AbdISUrK (ORCPT ); Tue, 19 Sep 2017 16:47:10 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: Brijesh Singh , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Joerg Roedel , Borislav Petkov , Tom Lendacky , x86@kernel.org Subject: [Part2 PATCH v4 12/29] KVM: Introduce KVM_MEMORY_ENCRYPT_REGISTER_REGION ioctl Date: Tue, 19 Sep 2017 15:46:10 -0500 Message-Id: <20170919204627.3875-13-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20170919204627.3875-1-brijesh.singh@amd.com> References: <20170919204627.3875-1-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: CY4PR04CA0071.namprd04.prod.outlook.com (10.171.243.164) To SN1PR12MB0158.namprd12.prod.outlook.com (10.162.3.145) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: a037a8c6-2533-416c-1791-08d4ff9f9353 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254152)(48565401081)(300000503095)(300135400095)(2017052603199)(201703131423075)(201703031133081)(201702281549075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095);SRVR:SN1PR12MB0158; X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;3:y428saaafriGiFyYrNh5G61idYNiMgd+byxmP3EeryJToukvMaiN2C3FCvs+9Ec5pEZ8yfA8wHo22Qn423RgLion0cqMuMMRV5M7F8Anve+ZMdDq8WUQPcaEn1odVWV5980XkHc3l7uS1h6SWXws4xotD5hykIAKs1krLBJOrGhNiyBbJ+B6bHuQe1xSkoeplhMqdx305326U0SyQQfhRVDKZl2c2ylfeUPF7aVloac+g72FALizjVfvfd0tR8Db;25:PFRf31pTBqub3LhaWi7ISj3GF5A8Lpmyney4zlbPaw/qvPB3kGg9rkcqrRWyowC6Lfk1dm3JHO66EHxiC2R/4Zb8gKC6KivSlod/2e1M8R3knD2Py5444DAe4EIw9RR4EJ3EVuc1qXrN5EKt24uTOxbRQB4YPSRKTyt3Salb+lHcNnezt94xEpDUNd9qypAEhr9t1XOB/mf2Qj1Hx3yA2FFiJUt+TzNJPCJA5jGXi4V4QtYm5yfd55tNgOnEPHG3LllI3c76ZVDeIpT3f7UgJ8XNiqJH9hqXyzpUIbCWygyg3GEZ+3UOIOb9Wfs8IrkZGc8lwth2lKXrbCqA5FAYmg==;31:jBKVlHjETfSE9O7c0PkzVtw6qYsYUQfaPwwIrMCqeEinRQ1AOZi2yOn3a9Fp/HVTa7U2LwVKN9+AvAilbZahTcwAxWX51L0//2n9C+ltlAl/xw03AWFVJ9x9Gahscbe4/svtZeRBEfo3j9lCAi22efmouZExGNKh7VzAmvCn7DalprzmXs8nrO5aY8Ic1XTjmyP+9igviFsbV7OGKhmp/Z153O45zH6x0u4XqOU3PlE= X-MS-TrafficTypeDiagnostic: SN1PR12MB0158: X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;20:GS3aHqY854AicvNUM8m7cHtNamac49W7pBhCMTfX2JlrJazF6FXju/2hqIzycwEz45rALcMy0UVovtTd8u+XqpdZmqPNSErxkRLzuUfucm0tFak0Tk+d4LVfOOHHQY5s5/wPCc/PguTIptQo0xSCC//1XR7f7zva2KSjafGjne7GzvGyw/pfm4bMp0XDoJ8pV9wiqv01W1Ati6FI1VIsw2xMnkvTpuy4wwJjhfWanig9+EJCK/6FTwbyKwoHLFBYh5/rJgg2QkbmiKftgUjZm9Q2v6llUUtEAsCQLSIlMDCEej0ztk0YnbVquYzPRGSEqexUEcx/N4Si96y1juNy+en01ikRWaNMS783U+N9UQRJs+cMVi/YA6Sd/U2Y0GWGo3Zu+l4tHbNw47PZqFAkcGTb/2s57Kj9cHDj9+hxr12NhLQu45Piys3tArBISZ1bJo+vSCX997hqYrPneh3CSc6HG7+NeLf+jkkNGqwvmnHqsNjGuUmDfCyYtGKtaRH3;4:zYNh9NxQTAi1PodrUPspEs0N0HF3VWM7oQ/5CKxgf8h+KByTO7u67h/kUN33uTo+tsrg8r02Ac0BVJl4P0z5XGaJ+m/Y9XUWC5OpORlJDo35XabPuw+dZyCNIVZ/ys7+bGQYJLb2pbm2XOsfBBNbYVUEwRC7w6w1qsHrHowFvwn5Cp8WoSg5dmH5EnaUzBgLZv1P2mznDbZlHl045NCb/JQli82Z7zzwsZPbwEBhuOiicMyfXxsAWMzLS1Fwtz976JsrkXqPEaPTuCggw0D2AXyIbRozG8hrSTF0NZ/CcALYJOPXMAUtsIUM1eREUDjcbmvpxh158JB1MrtbAibw+A== X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(93006095)(93001095)(100000703101)(100105400095)(3002001)(10201501046)(6055026)(6041248)(20161123560025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123562025)(20161123564025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN1PR12MB0158;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN1PR12MB0158; X-Forefront-PRVS: 04359FAD81 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6009001)(346002)(376002)(39860400002)(199003)(189002)(86362001)(50466002)(8936002)(97736004)(6116002)(3846002)(7416002)(81156014)(8676002)(50226002)(2950100002)(575784001)(81166006)(316002)(478600001)(16526017)(6666003)(7736002)(66066001)(305945005)(47776003)(6486002)(189998001)(53416004)(25786009)(101416001)(2870700001)(50986999)(76176999)(53936002)(2906002)(68736007)(36756003)(106356001)(1076002)(4326008)(5660300001)(105586002)(33646002)(23676002)(54906003);DIR:OUT;SFP:1101;SCL:1;SRVR:SN1PR12MB0158;H:ubuntu-010236106000.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtTTjFQUjEyTUIwMTU4OzIzOnhTMitWUlZVeWNnYWF1VElpVTVRRDFsVktp?= =?utf-8?B?UEJIa1pRUFFER3d5Y3lGcEdqSVp4ZTl0T2FNRVVCMHNHZ0RHT084amk1L2tU?= =?utf-8?B?d0ovSkc1ZzZuK05hdTdZODRwLzVZbmIwYUltcm9nRXlmODk1S0pFRnNldVBD?= =?utf-8?B?cHFxY3R5NTBPbGpFc2Y0TktjWEtRb0x1Z2xCMzVGeFVQMGdpajZqWDcrY05C?= =?utf-8?B?TjBnOVh1U3NtcG1mVTNCL0xmTjk1bTBuZnovU0U0VmFtR3hWS0dJUGNSd1l6?= =?utf-8?B?VUt4ZWdhM2RHVHNQSiszbklWbTJzRWNnMVJVeHFoalkzb09MRXBwK0xsYkcv?= =?utf-8?B?NUcxWXZXYm9nM0cyZ3VIWXNyVlUrNmpJTDdJaVA4UUt3YWxvK2xyaHJJb1JO?= =?utf-8?B?TUJIOVB6Kzc2Z2JHK2dYdG85bmNHeTR5c1hmdlh0TEhSQXZ3SlUxZzRKR0ZR?= =?utf-8?B?RTV1dXloMkVjK0JRWGtuUGhnZ0tVOVgvZ1JZSUhJSk5EVkZsY2ZrRFBzRVl1?= =?utf-8?B?RDIvN3h3b201TFpJNFRlVmg2eFpLME8yOEhHZTZmRmN4TkQ3R09zRWQ1YW1x?= =?utf-8?B?TVRrTUJrVFB4b3NPM3l1QTI5WUU3L3ArbE51WElJZzNqZS9xMDJmTEwyOGs2?= =?utf-8?B?TzFNWXArelFDN0lJaEc1RldwbFNONXdXQndKTUVSbGF5aUFKZHM1TU9IVk5w?= =?utf-8?B?QUlnRHczRTNPeUlEblNQemc0V081U2w3TTdCWFlMN1NkZnRpZVpGLy9WTit3?= =?utf-8?B?anBCZm95MmFGY1FjUGNUUStNSDl0OGpxVHN2S2tqVTV3WENMRDd0eE9MNVA3?= =?utf-8?B?ZVl6Wmt6azVUb1NORWRxMmplMnE1S3pHeWFCcEFBNnFmL1FkbklTQW1wTTg2?= =?utf-8?B?cHBPVDhIaUlaNTF2MkhRZXkwaFp5N05wc2w0SE1VcnFKTitLbFA0b25aUi8z?= =?utf-8?B?YmE3QkpSVnRUUzdMaUVOc2tqd3ExemZjVVFtUlRabDZwbFY3aDlIL3pUck5D?= =?utf-8?B?SEFKcm1WTW52ZUk3bTl2djFVNTJQeXNPeE9PVWdQbmZmVTZ6SXp2dGtqU1pX?= =?utf-8?B?QklSV2N1U2NDaHlQUVFFcWRybVhHY3VwcHZuUjNYZ2FQcys4MlFtSzhrb0tu?= =?utf-8?B?cHk2djk0UFFnZk5sY1gvakpNQlVPbFM0Tkl0M1doQy9FVnlpUnZySk4rdXRK?= =?utf-8?B?eUhiSk5MdURiSDNLdTJveTR0TXdSWWFxeDZhRldUM3RXeStucWIwTTBONXhW?= =?utf-8?B?ZVdua0xMMHRpeUozQ1cvcXF5MjRRT1hOKzlNYSs2Wnd2eWdRMytKN2JNbnc3?= =?utf-8?B?aTZCeDhHY01XaU01YXhhYTZQUkhjWmpFdTJ1dUJXRmNYd2Zsdjlub0grSUNY?= =?utf-8?B?ZFJSdlk4cWE1Nkx0ajEyUjUvVXlYR0hUWE1KRHhmbEYvR3YxSmMxWDFqSmhw?= =?utf-8?B?SXdma1drNWw0cTdNck1hdmVJWUpWSEEzQWszeHVka2ZBSGJ0Rmppd2VFVk5R?= =?utf-8?Q?zPl2OaLmkjhFVEgiirQ0kHGOI=3D?= X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;6:5yg86p4wIJCcB+nCoS0mMKXGVphWvtfYNRLo05cDdur9EGde1oxFSyM3ZFZVnsVk/tpvLy6M6u0NBJM3O9L6r1i9CEjMN051fdKQXvROVM9vT18nJWQwJ557sv0ecSKjVJwwsxCEv2+CLukMHreHojvDrK1JOPnDp21wu7afAOzK2D8kuY1W86KjUoJRi+pQvMLu6r+N6Z376VL3VAbzh5irJyPIB8xKpLcFygvEWwKrkOyuRCZxy4oewXSvd1JpTwcz5hyGRo/3wq69+62VzzklSZd7HzS1+J6tgeJg8TOhoUMfL7BRkYupNS7j0ohC+4TVKVTI0F1URUQa8pIsKA==;5:+7+xglbilNaQDpYcVZsDOSilTMnTHoPO9VJq1LAFHFd0Afm9MUAmXM0Z0BWnOVJTMgj++vu3Iy6ukiW0tP2UsvH3sgl3l7LOfUKw9bBRgMVk+nb0ybnWSHIqTPvYSYkWs9M+vgNGb54X7Ftxr3iPTA==;24:ywTlkdSfZzG1UvKh/9SlwDKYkZRlgh90i2e1vGB3C9eCYcNwKUGDgydlSqcFNK6lvzr+rxcWa3RVEQ9T6u13UWIuhSO0GgwSBBwA2gpa9cg=;7:u31a68owxoq9MDQnCY0GrR1J6HUTtiLSCfNYUN2tlMjr/KMq9gUCSjceV7UmIYqFGfNBY9wQOqaWKiC5ttnH9xNhQy1MTvAtmkj7aekjxHmUBDM5dwxQU6H+/t6cUBXbt352oSqgg8EM76RCHgjoV6YkQGng3j5M4IEmPG95moqNWXdn/Vta3Ds4ivKGM7ygAJCxQXGwqfYT6kwAhqUnJDQFH3CE44gcJcyufU07I0A= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;20:NHk5+bdS2P6gA2cP2sy6/6bGAHhii54GeojefEGHdUduHRqdXkUybgwlC/CUP1h/3H8ofb6LYkPuGKLgJ6K6Ec0MwSqaFrZny3qrP5SrZelZ1Olp9281Ol8KzTVSqp8dU9r6rjvNiDC7/DT8tLYF2oks0VVmyo7MJCohedSiP2p4TMuTxVn2KGJ0lwOQV5Np+JW7Kt/RgsHnSbuRI2+P3bDcxRyRfRi6Q7jOAEx/qaPIyC9nRE4MVN5/X3NTvieQ X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Sep 2017 20:46:59.3444 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB0158 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If hardware supports memory encryption then KVM_MEMORY_ENCRYPT_REGISTER_REGION and KVM_MEMORY_ENCRYPT_UNREGISTER_REGION ioctl's can be used by userspace to register/unregister the guest memory regions which may contain the encrypted data (e.g guest RAM, PCI BAR, SMRAM etc). Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Paolo Bonzini Cc: "Radim Krčmář" Cc: Joerg Roedel Cc: Borislav Petkov Cc: Tom Lendacky Cc: x86@kernel.org Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Brijesh Singh --- Documentation/virtual/kvm/api.txt | 22 ++++++++++++++++++++++ arch/x86/include/asm/kvm_host.h | 2 ++ arch/x86/kvm/x86.c | 36 ++++++++++++++++++++++++++++++++++++ include/uapi/linux/kvm.h | 9 +++++++++ 4 files changed, 69 insertions(+) diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt index 3f0dc33d8a8b..f07b7b87cba9 100644 --- a/Documentation/virtual/kvm/api.txt +++ b/Documentation/virtual/kvm/api.txt @@ -3405,6 +3405,28 @@ VMs. Currently, this ioctl is used for issuing Secure Encrypted Virtualization (SEV) commands on AMD Processors. +4.110 KVM_MEMORY_ENCRYPTION_REGISTER_REGION + +Capability: basic +Architectures: x86 +Type: system +Parameters: struct kvm_enc_region (in) +Returns: 0 on success; -1 on error + +This ioctl can be used to register the guest memory region which may contain the +encrypted data (e.g guest RAM, SMRAM etc). + +4.111 KVM_MEMORY_ENCRYPTION_UNREGISTER_REGION + +Capability: basic +Architectures: x86 +Type: system +Parameters: struct kvm_enc_region (in) +Returns: 0 on success; -1 on error + +This ioctl can be used to unregister the memory region registered with +KVM_MEMORY_ENCRYPTION_REGISTER_REGION ioctl. + 5. The kvm_run structure ------------------------ diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index 48001ca48c14..20fba8bfa727 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -1063,6 +1063,8 @@ struct kvm_x86_ops { void (*setup_mce)(struct kvm_vcpu *vcpu); int (*mem_enc_op)(struct kvm *kvm, void __user *argp); + int (*mem_enc_register_region)(struct kvm *kvm, struct kvm_enc_region *argp); + int (*mem_enc_unregister_region)(struct kvm *kvm, struct kvm_enc_region *argp); }; struct kvm_arch_async_pf { diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index ec9f634b75f0..b00035488569 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -4018,6 +4018,24 @@ static int kvm_vm_ioctl_mem_enc_op(struct kvm *kvm, void __user *argp) return -ENOTTY; } +static int kvm_vm_ioctl_mem_enc_register_region(struct kvm *kvm, + struct kvm_enc_region *region) +{ + if (kvm_x86_ops->mem_enc_register_region) + return kvm_x86_ops->mem_enc_register_region(kvm, region); + + return -ENOTTY; +} + +static int kvm_vm_ioctl_mem_enc_unregister_region(struct kvm *kvm, + struct kvm_enc_region *region) +{ + if (kvm_x86_ops->mem_enc_unregister_region) + return kvm_x86_ops->mem_enc_unregister_region(kvm, region); + + return -ENOTTY; +} + long kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg) { @@ -4282,6 +4300,24 @@ long kvm_arch_vm_ioctl(struct file *filp, r = kvm_vm_ioctl_mem_enc_op(kvm, argp); break; } + case KVM_MEMORY_ENCRYPTION_REGISTER_REGION: { + struct kvm_enc_region region; + + r = -EFAULT; + if (copy_from_user(®ion, argp, sizeof(region))) + goto out; + r = kvm_vm_ioctl_mem_enc_register_region(kvm, ®ion); + break; + } + case KVM_MEMORY_ENCRYPTION_UNREGISTER_REGION: { + struct kvm_enc_region region; + + r = -EFAULT; + if (copy_from_user(®ion, argp, sizeof(region))) + goto out; + r = kvm_vm_ioctl_mem_enc_unregister_region(kvm, ®ion); + break; + } default: r = -ENOTTY; } diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h index 23028a78f12f..fc1825440a14 100644 --- a/include/uapi/linux/kvm.h +++ b/include/uapi/linux/kvm.h @@ -1358,6 +1358,15 @@ struct kvm_s390_ucas_mapping { #define KVM_S390_SET_CMMA_BITS _IOW(KVMIO, 0xb9, struct kvm_s390_cmma_log) /* Memory Encryption Commands */ #define KVM_MEMORY_ENCRYPTION_OP _IOWR(KVMIO, 0xba, unsigned long) +#define KVM_MEMORY_ENCRYPTION_REGISTER_REGION _IOR(KVMIO, 0xbb,\ + struct kvm_enc_region) +#define KVM_MEMORY_ENCRYPTION_UNREGISTER_REGION _IOR(KVMIO, 0xbc,\ + struct kvm_enc_region) + +struct kvm_enc_region { + __u64 addr; + __u64 size; +}; #define KVM_DEV_ASSIGN_ENABLE_IOMMU (1 << 0) #define KVM_DEV_ASSIGN_PCI_2_3 (1 << 1) -- 2.9.5