From mboxrd@z Thu Jan 1 00:00:00 1970 From: Brijesh Singh Subject: [Part2 PATCH v4 12/29] KVM: Introduce KVM_MEMORY_ENCRYPT_REGISTER_REGION ioctl Date: Tue, 19 Sep 2017 15:46:10 -0500 Message-ID: <20170919204627.3875-13-brijesh.singh@amd.com> References: <20170919204627.3875-1-brijesh.singh@amd.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Brijesh Singh , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Joerg Roedel , Borislav Petkov , Tom Lendacky , x86@kernel.org To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Return-path: In-Reply-To: <20170919204627.3875-1-brijesh.singh@amd.com> Sender: linux-kernel-owner@vger.kernel.org List-Id: kvm.vger.kernel.org If hardware supports memory encryption then KVM_MEMORY_ENCRYPT_REGISTER_REGION and KVM_MEMORY_ENCRYPT_UNREGISTER_REGION ioctl's can be used by userspace to register/unregister the guest memory regions which may contain the encrypted data (e.g guest RAM, PCI BAR, SMRAM etc). Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Paolo Bonzini Cc: "Radim Krčmář" Cc: Joerg Roedel Cc: Borislav Petkov Cc: Tom Lendacky Cc: x86@kernel.org Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Brijesh Singh --- Documentation/virtual/kvm/api.txt | 22 ++++++++++++++++++++++ arch/x86/include/asm/kvm_host.h | 2 ++ arch/x86/kvm/x86.c | 36 ++++++++++++++++++++++++++++++++++++ include/uapi/linux/kvm.h | 9 +++++++++ 4 files changed, 69 insertions(+) diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt index 3f0dc33d8a8b..f07b7b87cba9 100644 --- a/Documentation/virtual/kvm/api.txt +++ b/Documentation/virtual/kvm/api.txt @@ -3405,6 +3405,28 @@ VMs. Currently, this ioctl is used for issuing Secure Encrypted Virtualization (SEV) commands on AMD Processors. +4.110 KVM_MEMORY_ENCRYPTION_REGISTER_REGION + +Capability: basic +Architectures: x86 +Type: system +Parameters: struct kvm_enc_region (in) +Returns: 0 on success; -1 on error + +This ioctl can be used to register the guest memory region which may contain the +encrypted data (e.g guest RAM, SMRAM etc). + +4.111 KVM_MEMORY_ENCRYPTION_UNREGISTER_REGION + +Capability: basic +Architectures: x86 +Type: system +Parameters: struct kvm_enc_region (in) +Returns: 0 on success; -1 on error + +This ioctl can be used to unregister the memory region registered with +KVM_MEMORY_ENCRYPTION_REGISTER_REGION ioctl. + 5. The kvm_run structure ------------------------ diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index 48001ca48c14..20fba8bfa727 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -1063,6 +1063,8 @@ struct kvm_x86_ops { void (*setup_mce)(struct kvm_vcpu *vcpu); int (*mem_enc_op)(struct kvm *kvm, void __user *argp); + int (*mem_enc_register_region)(struct kvm *kvm, struct kvm_enc_region *argp); + int (*mem_enc_unregister_region)(struct kvm *kvm, struct kvm_enc_region *argp); }; struct kvm_arch_async_pf { diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index ec9f634b75f0..b00035488569 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -4018,6 +4018,24 @@ static int kvm_vm_ioctl_mem_enc_op(struct kvm *kvm, void __user *argp) return -ENOTTY; } +static int kvm_vm_ioctl_mem_enc_register_region(struct kvm *kvm, + struct kvm_enc_region *region) +{ + if (kvm_x86_ops->mem_enc_register_region) + return kvm_x86_ops->mem_enc_register_region(kvm, region); + + return -ENOTTY; +} + +static int kvm_vm_ioctl_mem_enc_unregister_region(struct kvm *kvm, + struct kvm_enc_region *region) +{ + if (kvm_x86_ops->mem_enc_unregister_region) + return kvm_x86_ops->mem_enc_unregister_region(kvm, region); + + return -ENOTTY; +} + long kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg) { @@ -4282,6 +4300,24 @@ long kvm_arch_vm_ioctl(struct file *filp, r = kvm_vm_ioctl_mem_enc_op(kvm, argp); break; } + case KVM_MEMORY_ENCRYPTION_REGISTER_REGION: { + struct kvm_enc_region region; + + r = -EFAULT; + if (copy_from_user(®ion, argp, sizeof(region))) + goto out; + r = kvm_vm_ioctl_mem_enc_register_region(kvm, ®ion); + break; + } + case KVM_MEMORY_ENCRYPTION_UNREGISTER_REGION: { + struct kvm_enc_region region; + + r = -EFAULT; + if (copy_from_user(®ion, argp, sizeof(region))) + goto out; + r = kvm_vm_ioctl_mem_enc_unregister_region(kvm, ®ion); + break; + } default: r = -ENOTTY; } diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h index 23028a78f12f..fc1825440a14 100644 --- a/include/uapi/linux/kvm.h +++ b/include/uapi/linux/kvm.h @@ -1358,6 +1358,15 @@ struct kvm_s390_ucas_mapping { #define KVM_S390_SET_CMMA_BITS _IOW(KVMIO, 0xb9, struct kvm_s390_cmma_log) /* Memory Encryption Commands */ #define KVM_MEMORY_ENCRYPTION_OP _IOWR(KVMIO, 0xba, unsigned long) +#define KVM_MEMORY_ENCRYPTION_REGISTER_REGION _IOR(KVMIO, 0xbb,\ + struct kvm_enc_region) +#define KVM_MEMORY_ENCRYPTION_UNREGISTER_REGION _IOR(KVMIO, 0xbc,\ + struct kvm_enc_region) + +struct kvm_enc_region { + __u64 addr; + __u64 size; +}; #define KVM_DEV_ASSIGN_ENABLE_IOMMU (1 << 0) #define KVM_DEV_ASSIGN_PCI_2_3 (1 << 1) -- 2.9.5