[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 12/22] sev/i386: add command to create launch memory
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 12/22] sev/i386: add command to create launch memory encryption context |
Date: |
Tue, 13 Mar 2018 13:56:28 +0100 |
From: Brijesh Singh <address@hidden>
The KVM_SEV_LAUNCH_START command creates a new VM encryption key (VEK).
The encryption key created with the command will be used for encrypting
the bootstrap images (such as guest bios).
Cc: Paolo Bonzini <address@hidden>
Cc: Richard Henderson <address@hidden>
Cc: Eduardo Habkost <address@hidden>
Signed-off-by: Brijesh Singh <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
target/i386/sev.c | 86 ++++++++++++++++++++++++++++++++++++++++++++++++
target/i386/trace-events | 2 ++
2 files changed, 88 insertions(+)
diff --git a/target/i386/sev.c b/target/i386/sev.c
index c63012a..d855dd5 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -106,6 +106,17 @@ fw_error_to_str(int code)
}
static void
+sev_set_guest_state(SevState new_state)
+{
+ assert(new_state < SEV_STATE__MAX);
+ assert(sev_state);
+
+ trace_kvm_sev_change_state(SevState_str(sev_state->state),
+ SevState_str(new_state));
+ sev_state->state = new_state;
+}
+
+static void
sev_ram_block_added(RAMBlockNotifier *n, void *host, size_t size)
{
int r;
@@ -406,6 +417,75 @@ sev_get_info(void)
return info;
}
+static int
+sev_read_file_base64(const char *filename, guchar **data, gsize *len)
+{
+ gsize sz;
+ gchar *base64;
+ GError *error = NULL;
+
+ if (!g_file_get_contents(filename, &base64, &sz, &error)) {
+ error_report("failed to read '%s' (%s)", filename, error->message);
+ return -1;
+ }
+
+ *data = g_base64_decode(base64, len);
+ return 0;
+}
+
+static int
+sev_launch_start(SEVState *s)
+{
+ gsize sz;
+ int ret = 1;
+ int fw_error;
+ QSevGuestInfo *sev = s->sev_info;
+ struct kvm_sev_launch_start *start;
+ guchar *session = NULL, *dh_cert = NULL;
+
+ start = g_new0(struct kvm_sev_launch_start, 1);
+
+ start->handle = object_property_get_int(OBJECT(sev), "handle",
+ &error_abort);
+ start->policy = object_property_get_int(OBJECT(sev), "policy",
+ &error_abort);
+ if (sev->session_file) {
+ if (sev_read_file_base64(sev->session_file, &session, &sz) < 0) {
+ return 1;
+ }
+ start->session_uaddr = (unsigned long)session;
+ start->session_len = sz;
+ }
+
+ if (sev->dh_cert_file) {
+ if (sev_read_file_base64(sev->dh_cert_file, &dh_cert, &sz) < 0) {
+ return 1;
+ }
+ start->dh_uaddr = (unsigned long)dh_cert;
+ start->dh_len = sz;
+ }
+
+ trace_kvm_sev_launch_start(start->policy, session, dh_cert);
+ ret = sev_ioctl(s->sev_fd, KVM_SEV_LAUNCH_START, start, &fw_error);
+ if (ret < 0) {
+ error_report("%s: LAUNCH_START ret=%d fw_error=%d '%s'",
+ __func__, ret, fw_error, fw_error_to_str(fw_error));
+ return 1;
+ }
+
+ object_property_set_int(OBJECT(sev), start->handle, "handle",
+ &error_abort);
+ sev_set_guest_state(SEV_STATE_LAUNCH_UPDATE);
+ s->handle = start->handle;
+ s->policy = start->policy;
+
+ g_free(start);
+ g_free(session);
+ g_free(dh_cert);
+
+ return 0;
+}
+
void *
sev_guest_init(const char *id)
{
@@ -476,6 +556,12 @@ sev_guest_init(const char *id)
goto err;
}
+ ret = sev_launch_start(s);
+ if (ret) {
+ error_report("%s: failed to create encryption context", __func__);
+ goto err;
+ }
+
ram_block_notifier_add(&sev_ram_notifier);
return s;
diff --git a/target/i386/trace-events b/target/i386/trace-events
index ffa3d22..9402251 100644
--- a/target/i386/trace-events
+++ b/target/i386/trace-events
@@ -10,3 +10,5 @@ kvm_x86_update_msi_routes(int num) "Updated %d MSI routes"
kvm_sev_init(void) ""
kvm_memcrypt_register_region(void *addr, size_t len) "addr %p len 0x%lu"
kvm_memcrypt_unregister_region(void *addr, size_t len) "addr %p len 0x%lu"
+kvm_sev_change_state(const char *old, const char *new) "%s -> %s"
+kvm_sev_launch_start(int policy, void *session, void *pdh) "policy 0x%x
session %p pdh %p"
--
1.8.3.1
- [Qemu-devel] [PULL 02/22] KVM: x86: Add support for save/load MSR_SMI_COUNT, (continued)
- [Qemu-devel] [PULL 02/22] KVM: x86: Add support for save/load MSR_SMI_COUNT, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 04/22] docs: add AMD Secure Encrypted Virtualization (SEV), Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 05/22] kvm: add memory encryption context, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 06/22] kvm: introduce memory encryption APIs, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 01/22] update Linux headers to 4.16-rc5, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 09/22] include: add psp-sev.h header file, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 07/22] target/i386: add Secure Encrypted Virtualization (SEV) object, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 13/22] sev/i386: add command to encrypt guest memory region, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 11/22] sev/i386: register the guest memory range which may contain encrypted data, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 08/22] sev/i386: qmp: add query-sev command, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 12/22] sev/i386: add command to create launch memory encryption context,
Paolo Bonzini <=
- [Qemu-devel] [PULL 10/22] sev/i386: add command to initialize the memory encryption context, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 14/22] target/i386: encrypt bios rom, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 15/22] sev/i386: add support to LAUNCH_MEASURE command, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 16/22] sev/i386: finalize the SEV guest launch flow, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 18/22] cpu/i386: populate CPUID 0x8000_001F when SEV is active, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 19/22] sev/i386: hmp: add 'info sev' command, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 17/22] sev/i386: add migration blocker, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 20/22] sev/i386: qmp: add query-sev-launch-measure command, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 21/22] sev/i386: qmp: add query-sev-capabilities command, Paolo Bonzini, 2018/03/13
- [Qemu-devel] [PULL 22/22] sev/i386: add sev_get_capabilities(), Paolo Bonzini, 2018/03/13