diff mbox

[RFC,v3,15/18] i386: register memory encryption ops

Message ID 147801566367.18237.2189379113640562484.stgit@brijesh-build-machine
State New
Headers show

Commit Message

Brijesh Singh Nov. 1, 2016, 3:54 p.m. UTC 
If guest is launched with memory encryption enabled then register
PC.BIOS and PC.RAM memory regions with memory encryption handler.

Registering PC.BIOS memory region will ensure that memory encryption
routines will be used when rom_reset copies the BIOS image into guest memory.

A typical sequence look like:
qemy_system_reset
  rom_reset
    cpu_physical_memory_write_rom
      cpu_phyiscal_memory_rw_debug_internal
        memory_encryption->write


Similarly registering PC.RAM region will ensure that any debug accesses from
qemu monitor or gdbserver will go through the memory encryption routines to
decrypt/encrypt the guest RAM regions.

A sequence looks like:
cpu_phyiscal_memory_rw_debug
  cpu_phyiscal_memory_rw_debug_internal
    memory_encryption->write

Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
---
 hw/i386/pc.c       |    7 +++++++
 hw/i386/pc_sysfw.c |    4 ++++
 2 files changed, 11 insertions(+)
diff mbox

Patch

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index f56ea0f..1b76159 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1402,6 +1402,13 @@  void pc_memory_init(PCMachineState *pcms,
         e820_add_entry(0x100000000ULL, pcms->above_4g_mem_size, E820_RAM);
     }
 
+    /* if memory encryption is enabled then set the memory encryption
+     * ops so that any debug read and write to guest memory from hypervisor will
+     * go through encryption routines. */
+    if (kvm_memory_encryption_enabled()) {
+        kvm_memory_encryption_set_debug_ops(ram);
+    }
+
     if (!pcmc->has_reserved_memory &&
         (machine->ram_slots ||
          (machine->maxram_size > machine->ram_size))) {
diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
index f915ad0..243beda 100644
--- a/hw/i386/pc_sysfw.c
+++ b/hw/i386/pc_sysfw.c
@@ -208,6 +208,9 @@  static void old_pc_system_rom_init(MemoryRegion *rom_memory, bool isapc_ram_fw)
     }
     g_free(filename);
 
+    if (kvm_memory_encryption_enabled()) {
+        kvm_memory_encryption_set_debug_ops(bios);
+    }
     /* map the last 128KB of the BIOS in ISA space */
     isa_bios_size = bios_size;
     if (isa_bios_size > (128 * 1024)) {
@@ -228,6 +231,7 @@  static void old_pc_system_rom_init(MemoryRegion *rom_memory, bool isapc_ram_fw)
     memory_region_add_subregion(rom_memory,
                                 (uint32_t)(-bios_size),
                                 bios);
+
 }
 
 void pc_system_firmware_init(MemoryRegion *rom_memory, bool isapc_ram_fw)