[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v9 15/29] sev/i386: add command to create launch mem
From: |
Brijesh Singh |
Subject: |
[Qemu-devel] [PATCH v9 15/29] sev/i386: add command to create launch memory encryption context |
Date: |
Thu, 15 Feb 2018 09:39:41 -0600 |
The KVM_SEV_LAUNCH_START command creates a new VM encryption key (VEK).
The encryption key created with the command will be used for encrypting
the bootstrap images (such as guest bios).
Cc: Paolo Bonzini <address@hidden>
Cc: Richard Henderson <address@hidden>
Cc: Eduardo Habkost <address@hidden>
Signed-off-by: Brijesh Singh <address@hidden>
---
target/i386/sev.c | 91 +++++++++++++++++++++++++++++++++++++++++++++++-
target/i386/trace-events | 2 ++
2 files changed, 92 insertions(+), 1 deletion(-)
diff --git a/target/i386/sev.c b/target/i386/sev.c
index de5c8d4675a6..6f767084fd57 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -29,6 +29,8 @@ static int sev_fd;
static uint32_t x86_cbitpos;
static uint32_t x86_reduced_phys_bits;
+static SevState current_sev_guest_state = SEV_STATE_UNINIT;
+
static const char *const sev_fw_errlist[] = {
"",
"Platform state is invalid",
@@ -88,6 +90,16 @@ fw_error_to_str(int code)
return sev_fw_errlist[code];
}
+static void
+sev_set_guest_state(SevState new_state)
+{
+ assert(new_state < SEV_STATE__MAX);
+
+ trace_kvm_sev_change_state(SevState_str(current_sev_guest_state),
+ SevState_str(new_state));
+ current_sev_guest_state = new_state;
+}
+
static void
sev_ram_block_added(RAMBlockNotifier *n, void *host, size_t size)
{
@@ -365,7 +377,7 @@ sev_get_reduced_phys_bits(void)
SevState
sev_get_current_state(void)
{
- return SEV_STATE_UNINIT;
+ return current_sev_guest_state;
}
bool
@@ -384,6 +396,76 @@ sev_get_policy(uint32_t *policy)
{
}
+static int
+sev_read_file_base64(const char *filename, guchar **data, gsize *len)
+{
+ gsize sz;
+ gchar *base64;
+ GError *error = NULL;
+
+ if (!g_file_get_contents(filename, &base64, &sz, &error)) {
+ error_report("failed to read '%s' (%s)", filename, error->message);
+ return -1;
+ }
+
+ *data = g_base64_decode(base64, len);
+ return 0;
+}
+
+static int
+sev_launch_start(SEVState *s)
+{
+ gsize sz;
+ int ret = 1;
+ int fw_error;
+ QSevGuestInfo *sev = s->sev_info;
+ struct kvm_sev_launch_start *start;
+ guchar *session = NULL, *dh_cert = NULL;
+
+ start = g_malloc0(sizeof(*start));
+ if (!start) {
+ return 1;
+ }
+
+ start->handle = object_property_get_int(OBJECT(sev), "handle",
+ &error_abort);
+ start->policy = object_property_get_int(OBJECT(sev), "policy",
+ &error_abort);
+ if (sev->session_file) {
+ if (sev_read_file_base64(sev->session_file, &session, &sz) < 0) {
+ return 1;
+ }
+ start->session_uaddr = (unsigned long)session;
+ start->session_len = sz;
+ }
+
+ if (sev->dh_cert_file) {
+ if (sev_read_file_base64(sev->dh_cert_file, &dh_cert, &sz) < 0) {
+ return 1;
+ }
+ start->dh_uaddr = (unsigned long)dh_cert;
+ start->dh_len = sz;
+ }
+
+ trace_kvm_sev_launch_start(start->policy, session, dh_cert);
+ ret = sev_ioctl(KVM_SEV_LAUNCH_START, start, &fw_error);
+ if (ret < 0) {
+ error_report("%s: LAUNCH_START ret=%d fw_error=%d '%s'",
+ __func__, ret, fw_error, fw_error_to_str(fw_error));
+ return 1;
+ }
+
+ object_property_set_int(OBJECT(sev), start->handle, "handle",
+ &error_abort);
+ sev_set_guest_state(SEV_STATE_LUPDATE);
+
+ g_free(start);
+ g_free(session);
+ g_free(dh_cert);
+
+ return 0;
+}
+
void *
sev_guest_init(const char *id)
{
@@ -439,6 +521,13 @@ sev_guest_init(const char *id)
goto err;
}
+ ret = sev_launch_start(s);
+ if (ret) {
+ error_report("%s: failed to create encryption context", __func__);
+ goto err;
+ }
+
+
me_mask = (1UL << cbitpos);
x86_reduced_phys_bits = reduced_phys_bits;
x86_cbitpos = cbitpos;
diff --git a/target/i386/trace-events b/target/i386/trace-events
index ffa3d2250425..9402251e9991 100644
--- a/target/i386/trace-events
+++ b/target/i386/trace-events
@@ -10,3 +10,5 @@ kvm_x86_update_msi_routes(int num) "Updated %d MSI routes"
kvm_sev_init(void) ""
kvm_memcrypt_register_region(void *addr, size_t len) "addr %p len 0x%lu"
kvm_memcrypt_unregister_region(void *addr, size_t len) "addr %p len 0x%lu"
+kvm_sev_change_state(const char *old, const char *new) "%s -> %s"
+kvm_sev_launch_start(int policy, void *session, void *pdh) "policy 0x%x
session %p pdh %p"
--
2.14.3
- [Qemu-devel] [PATCH v9 04/29] monitor/i386: use debug APIs when accessing guest memory, (continued)
- [Qemu-devel] [PATCH v9 04/29] monitor/i386: use debug APIs when accessing guest memory, Brijesh Singh, 2018/02/15
- [Qemu-devel] [PATCH v9 06/29] kvm: update kvm.h to include memory encryption ioctls, Brijesh Singh, 2018/02/15
- [Qemu-devel] [PATCH v9 02/29] exec: add ram_debug_ops support, Brijesh Singh, 2018/02/15
- [Qemu-devel] [PATCH v9 08/29] target/i386: add Secure Encrypted Virtulization (SEV) object, Brijesh Singh, 2018/02/15
- [Qemu-devel] [PATCH v9 07/29] docs: add AMD Secure Encrypted Virtualization (SEV), Brijesh Singh, 2018/02/15
- [Qemu-devel] [PATCH v9 09/29] qmp: add query-sev command, Brijesh Singh, 2018/02/15
- [Qemu-devel] [PATCH v9 10/29] sev/i386: add command to initialize the memory encryption context, Brijesh Singh, 2018/02/15
- [Qemu-devel] [PATCH v9 12/29] sev/i386: register the guest memory range which may contain encrypted data, Brijesh Singh, 2018/02/15
- [Qemu-devel] [PATCH v9 11/29] qmp: populate SevInfo fields with SEV guest information, Brijesh Singh, 2018/02/15
- [Qemu-devel] [PATCH v9 15/29] sev/i386: add command to create launch memory encryption context,
Brijesh Singh <=
- [Qemu-devel] [PATCH v9 14/29] hmp: add 'info sev' command, Brijesh Singh, 2018/02/15
- [Qemu-devel] [PATCH v9 13/29] kvm: introduce memory encryption APIs, Brijesh Singh, 2018/02/15
- [Qemu-devel] [PATCH v9 16/29] sev/i386: add command to encrypt guest memory region, Brijesh Singh, 2018/02/15
- [Qemu-devel] [PATCH v9 18/29] sev/i386: add support to LAUNCH_MEASURE command, Brijesh Singh, 2018/02/15
- [Qemu-devel] [PATCH v9 20/29] hw/i386: set ram_debug_ops when memory encryption is enabled, Brijesh Singh, 2018/02/15
- [Qemu-devel] [PATCH v9 17/29] target/i386: encrypt bios rom, Brijesh Singh, 2018/02/15