[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v10 18/28] sev/i386: add support to LAUNCH_MEASURE c
From: |
Brijesh Singh |
Subject: |
[Qemu-devel] [PATCH v10 18/28] sev/i386: add support to LAUNCH_MEASURE command |
Date: |
Wed, 28 Feb 2018 15:10:18 -0600 |
During machine creation we encrypted the guest bios image, the
LAUNCH_MEASURE command can be used to retrieve the measurement of
the encrypted memory region. This measurement is a signature of
the memory contents that can be sent to the guest owner as an
attestation that the memory was encrypted correctly by the firmware.
VM management tools like libvirt can query the measurement using
query-sev-launch-measure QMP command.
Cc: Paolo Bonzini <address@hidden>
Cc: Richard Henderson <address@hidden>
Cc: Eduardo Habkost <address@hidden>
Signed-off-by: Brijesh Singh <address@hidden>
---
target/i386/sev-stub.c | 5 ++++
target/i386/sev.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++
target/i386/sev_i386.h | 2 ++
target/i386/trace-events | 1 +
4 files changed, 71 insertions(+)
diff --git a/target/i386/sev-stub.c b/target/i386/sev-stub.c
index c86d8c139237..2f61c32ec975 100644
--- a/target/i386/sev-stub.c
+++ b/target/i386/sev-stub.c
@@ -39,3 +39,8 @@ uint32_t sev_get_reduced_phys_bits(void)
{
return 0;
}
+
+char *sev_get_launch_measurement(void)
+{
+ return NULL;
+}
diff --git a/target/i386/sev.c b/target/i386/sev.c
index a25722bdb934..a61c100ef47b 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -510,6 +510,68 @@ sev_launch_update_data(uint8_t *addr, uint64_t len)
return ret;
}
+static void
+sev_launch_get_measure(Notifier *notifier, void *unused)
+{
+ int ret, error;
+ guchar *data;
+ SEVState *s = sev_state;
+ struct kvm_sev_launch_measure *measurement;
+
+ if (!sev_check_state(SEV_STATE_LUPDATE)) {
+ return;
+ }
+
+ measurement = g_new0(struct kvm_sev_launch_measure, 1);
+
+ /* query the measurement blob length */
+ ret = sev_ioctl(sev_state->sev_fd, KVM_SEV_LAUNCH_MEASURE,
+ measurement, &error);
+ if (!measurement->len) {
+ error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'",
+ __func__, ret, error, fw_error_to_str(errno));
+ goto free_measurement;
+ }
+
+ data = g_new0(guchar, measurement->len);
+ measurement->uaddr = (unsigned long)data;
+
+ /* get the measurement blob */
+ ret = sev_ioctl(sev_state->sev_fd, KVM_SEV_LAUNCH_MEASURE,
+ measurement, &error);
+ if (ret) {
+ error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'",
+ __func__, ret, error, fw_error_to_str(errno));
+ goto free_data;
+ }
+
+ sev_set_guest_state(SEV_STATE_LSECRET);
+
+ /* encode the measurement value and emit the event */
+ s->measurement = g_base64_encode(data, measurement->len);
+ trace_kvm_sev_launch_measurement(s->measurement);
+
+free_data:
+ g_free(data);
+free_measurement:
+ g_free(measurement);
+}
+
+char *
+sev_get_launch_measurement(void)
+{
+ if (sev_state &&
+ sev_state->state >= SEV_STATE_LSECRET) {
+ return g_strdup(sev_state->measurement);
+ }
+
+ return NULL;
+}
+
+static Notifier sev_machine_done_notify = {
+ .notify = sev_launch_get_measure,
+};
+
void *
sev_guest_init(const char *id)
{
@@ -590,6 +652,7 @@ sev_guest_init(const char *id)
}
ram_block_notifier_add(&sev_ram_notifier);
+ qemu_add_machine_init_done_notifier(&sev_machine_done_notify);
return s;
err:
diff --git a/target/i386/sev_i386.h b/target/i386/sev_i386.h
index 68019d6f39a5..2ecca66f6e64 100644
--- a/target/i386/sev_i386.h
+++ b/target/i386/sev_i386.h
@@ -42,6 +42,7 @@ extern uint64_t sev_get_me_mask(void);
extern SevInfo *sev_get_info(void);
extern uint32_t sev_get_cbit_position(void);
extern uint32_t sev_get_reduced_phys_bits(void);
+extern char *sev_get_launch_measurement(void);
typedef struct QSevGuestInfo QSevGuestInfo;
typedef struct QSevGuestInfoClass QSevGuestInfoClass;
@@ -83,6 +84,7 @@ struct SEVState {
uint32_t handle;
int sev_fd;
SevState state;
+ gchar *measurement;
};
typedef struct SEVState SEVState;
diff --git a/target/i386/trace-events b/target/i386/trace-events
index c0cd8e93217f..f7a1a1e6b85c 100644
--- a/target/i386/trace-events
+++ b/target/i386/trace-events
@@ -13,3 +13,4 @@ kvm_memcrypt_unregister_region(void *addr, size_t len) "addr
%p len 0x%lu"
kvm_sev_change_state(const char *old, const char *new) "%s -> %s"
kvm_sev_launch_start(int policy, void *session, void *pdh) "policy 0x%x
session %p pdh %p"
kvm_sev_launch_update_data(void *addr, uint64_t len) "addr %p len 0x%" PRIu64
+kvm_sev_launch_measurement(const char *value) "data %s"
--
2.14.3
- [Qemu-devel] [PATCH v10 17/28] target/i386: encrypt bios rom, (continued)
- [Qemu-devel] [PATCH v10 17/28] target/i386: encrypt bios rom, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 19/28] sev/i386: finalize the SEV guest launch flow, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 12/28] sev/i386: register the guest memory range which may contain encrypted data, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 11/28] sev/i386: add command to initialize the memory encryption context, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 14/28] hmp: add 'info sev' command, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 16/28] sev/i386: add command to encrypt guest memory region, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 24/28] sev/i386: add migration blocker, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 21/28] sev/i386: add debug encrypt and decrypt commands, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 15/28] sev/i386: add command to create launch memory encryption context, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 22/28] target/i386: clear C-bit when walking SEV guest page table, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 18/28] sev/i386: add support to LAUNCH_MEASURE command,
Brijesh Singh <=
- [Qemu-devel] [PATCH v10 20/28] hw/i386: set ram_debug_ops when memory encryption is enabled, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 23/28] qmp: add query-sev-launch-measure command, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 25/28] cpu/i386: populate CPUID 0x8000_001F when SEV is active, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 26/28] qmp: add query-sev-capabilities command, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 28/28] tests/qmp-test: blacklist sev specific qmp commands, Brijesh Singh, 2018/02/28
- [Qemu-devel] [PATCH v10 27/28] sev/i386: add sev_get_capabilities(), Brijesh Singh, 2018/02/28
- Re: [Qemu-devel] [PATCH v10 00/29] x86: Secure Encrypted Virtualization (AMD), Brijesh Singh, 2018/02/28