kvm: introduce memory encryption APIs

Inorder to integerate the Secure Encryption Virtualization (SEV) support
add few high-level memory encryption APIs which can be used for encrypting
the guest memory region.

Cc: Paolo Bonzini <[email protected]>
Cc: [email protected]
Signed-off-by: Brijesh Singh <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index e0e43fd148dbfb83f3361827c93bb03954941aa7..ffee68e6032f6101e1e7429177a3f8d9eebdaa7a 100644 (file)
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -107,6 +107,7 @@ struct KVMState
 
     /* memory encryption */
     void *memcrypt_handle;
+    int (*memcrypt_encrypt_data)(void *handle, uint8_t *ptr, uint64_t len);
 };
 
 KVMState *kvm_state;
@@ -151,6 +152,17 @@ bool kvm_memcrypt_enabled(void)
     return false;
 }
 
+int kvm_memcrypt_encrypt_data(uint8_t *ptr, uint64_t len)
+{
+    if (kvm_state->memcrypt_handle &&
+        kvm_state->memcrypt_encrypt_data) {
+        return kvm_state->memcrypt_encrypt_data(kvm_state->memcrypt_handle,
+                                              ptr, len);
+    }
+
+    return 1;
+}
+
 static KVMSlot *kvm_get_free_slot(KVMMemoryListener *kml)
 {
     KVMState *s = kvm_state;
@@ -1659,6 +1671,8 @@ static int kvm_init(MachineState *ms)
             ret = -1;
             goto err;
         }
+
+        kvm_state->memcrypt_encrypt_data = sev_encrypt_data;
     }
 
     ret = kvm_arch_init(ms, s);

diff --git a/accel/kvm/sev-stub.c b/accel/kvm/sev-stub.c
index 4a5cc5569e5f6bbb284a6bd6216f6475b5896096..4f9745258593a5903d5fcc778a5035816aa6e414 100644 (file)
--- a/accel/kvm/sev-stub.c
+++ b/accel/kvm/sev-stub.c
@@ -15,6 +15,11 @@
 #include "qemu-common.h"
 #include "sysemu/sev.h"
 
+int sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len)
+{
+    abort();
+}
+
 void *sev_guest_init(const char *id)
 {
     return NULL;

diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c
index f83192d6f63eeed44143efbed54bf6a2fdbe0b7e..02d51700311f74c9e6299b9e11a5bbd1641a9b24 100644 (file)
--- a/accel/stubs/kvm-stub.c
+++ b/accel/stubs/kvm-stub.c
@@ -110,6 +110,11 @@ bool kvm_memcrypt_enabled(void)
     return false;
 }
 
+int kvm_memcrypt_encrypt_data(uint8_t *ptr, uint64_t len)
+{
+  return 1;
+}
+
 #ifndef CONFIG_USER_ONLY
 int kvm_irqchip_add_msi_route(KVMState *s, int vector, PCIDevice *dev)
 {

diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 84017a0dcf538674c0e8aa49c9132a666ff6bbcd..23669c4d5a230bc76d7071cef495d2f5d67d5575 100644 (file)
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -239,6 +239,14 @@ bool kvm_arm_supports_user_irq(void);
  */
 bool kvm_memcrypt_enabled(void);
 
+/**
+ * kvm_memcrypt_encrypt_data: encrypt the memory range
+ *
+ * Return: 1 failed to encrypt the range
+ *         0 succesfully encrypted memory region
+ */
+int kvm_memcrypt_encrypt_data(uint8_t *ptr, uint64_t len);
+
 
 #ifdef NEED_CPU_H
 #include "cpu.h"

diff --git a/include/sysemu/sev.h b/include/sysemu/sev.h
index f7a6057d4908a2ae7272c0195f5c6ae439deba69..98c1ec8d38aaf8d11f882bee40101f522887ab78 100644 (file)
--- a/include/sysemu/sev.h
+++ b/include/sysemu/sev.h
@@ -17,4 +17,5 @@
 #include "sysemu/kvm.h"
 
 void *sev_guest_init(const char *id);
+int sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len);
 #endif