From patchwork Wed Feb 7 16:06:30 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brijesh Singh X-Patchwork-Id: 870506 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=2001:4830:134:3::11; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=amdcloud.onmicrosoft.com header.i=@amdcloud.onmicrosoft.com header.b="MnMdyc9j"; dkim-atps=neutral Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zc6Lk1PYcz9s71 for ; Thu, 8 Feb 2018 03:32:46 +1100 (AEDT) Received: from localhost ([::1]:56238 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ejSeK-00006I-77 for incoming@patchwork.ozlabs.org; Wed, 07 Feb 2018 11:32:44 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51745) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ejSFw-00064l-3U for qemu-devel@nongnu.org; Wed, 07 Feb 2018 11:07:36 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ejSFr-0006yF-1R for qemu-devel@nongnu.org; Wed, 07 Feb 2018 11:07:32 -0500 Received: from mail-bl2nam02on0057.outbound.protection.outlook.com ([104.47.38.57]:21504 helo=NAM02-BL2-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ejSFq-0006y1-Qh for qemu-devel@nongnu.org; Wed, 07 Feb 2018 11:07:26 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector1-amd-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=um5RfvulQoAxgpw45xBg82BFHP7k5hr8M6GIpj72puw=; b=MnMdyc9jV81HrzyZY2GAKUwxbLeJFApjJ/LpO2RWaE69023cl7x+hpV++5bylzSowLqxVjF0T+e184FoM5wFvQoyaL/lGWoFY+WzqD61JtJVuRFnCFoz1hoxZS0eUT2U/+p8hYffBnM/Dv7AKnIKS+uIkEYowt2WEpmZpeFfw6U= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; Received: from wsp141597wss.amd.com (165.204.78.1) by CY1PR12MB0152.namprd12.prod.outlook.com (10.161.173.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.464.11; Wed, 7 Feb 2018 16:07:24 +0000 From: Brijesh Singh To: qemu-devel@nongnu.org Date: Wed, 7 Feb 2018 10:06:30 -0600 Message-Id: <20180207160638.98872-18-brijesh.singh@amd.com> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20180207160638.98872-1-brijesh.singh@amd.com> References: <20180207160638.98872-1-brijesh.singh@amd.com> MIME-Version: 1.0 X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: DM3PR12CA0071.namprd12.prod.outlook.com (10.161.151.143) To CY1PR12MB0152.namprd12.prod.outlook.com (10.161.173.22) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: a4fa4484-0c9b-4b11-88da-08d56e44e0cd X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(4534165)(4627221)(201703031133081)(201702281549075)(48565401081)(5600026)(4604075)(2017052603307)(7153060)(7193020); SRVR:CY1PR12MB0152; X-Microsoft-Exchange-Diagnostics: 1; CY1PR12MB0152; 3:153Z2EWl1B9dsk1Jcr8EHeT+Pfy0zOBUAuEChh4cY/GJh7QLI0fR4cOMs8oyWNQBQCaICdz7HUu1ggjhUju33w7jl9kX+Fe2A7kiVFiJAYyJddBzk9IZIIqfzmP09y+YFGEPEsk3mZAoe1k5FgPJnYO+18pRHsgvr43MtGc9GOuHoF63XrW3z0HlufLkL8D4DqRj44d8JI6P7DxEMJXpkJmJ8WPcxCWQbHtlZYfUamZdPajM/b8eDS9qebZeckhm; 25:uktUQ5NRmSW/B7M9hRTkmwBZHU/ck2pHyEvTiRuKJN3SbSH+JkTCkrJtLY2yri0YOCRx4MiFwS8cXXMXqq3FjZxh1kwOo7xV6JTxoTe/E7kui6IxR/l0GfGU7Tsy2kPmex74Qfxx2WHsRPX7NjLdBVKcSdssMU6VIxiqIlFy6Y48IZdKGKzRCM6gGWn+SH2nn6MNjf8sJp7KEEeiqRt/2RudsGuQuvULEJA1wSDXlZexCICFKxmZZsElQxB5J5iCe+LkH+IelvtRWM7LJuAdGmuX4pKLomJw3ciV080cgTsfc3hHFc7swsMy0MllwQPf/k+7k3cd5qIgeYPW73OmLA==; 31:mAimB1t7/u5WzZBs5x+CcJwQ+fw/p+NZ5rmInodajkcRO66zhKqjhx8LnOnTXdaG6kXzNGmAKazV6xSRDJw3Se0ZuG4nvPXUKPf/WGMAXgLIwpLzFncjPYHIFpkPSd6D81i2wDel8FWsQYDhGpsgLTEo7PyKV7YwR8pk6OVNdpraQQNhNXIBqIUTpyoLw+rMhMa1iWS26MYcUARCCoeQ912eYarbRPbkvp3GkLkD/mg= X-MS-TrafficTypeDiagnostic: CY1PR12MB0152: X-Microsoft-Exchange-Diagnostics: 1; CY1PR12MB0152; 20:5rnm5TadcyT16H/+CGp4+3Kz40x2iU5hZDamZnMELFKf0tblAArD1sFLNW6Jj8r0KqAC1c0ewsZT4A4/YWLNt9GoR5NS5veKsUfji9oh7VWLPx1NQSOPu7BvPxrMU13mSdyJ+WIds4ria8ZMOM/IS26KXXJKsvYqGaJtCTtWq7c3q98Pg7VLCUhp3sDcoKcePE4vs2GOj36NCtUkqvUz1MMqbnJuj1dJ3DB9I5LM3wGmuke68Mut5gzvNQrbS0W996I62m/46ccCWBvaailmW/6W1gYOICNLwPlqZcMF0L5lowR6gGhdHwXrTioSWFL36opInNTzQFk+sEOJE3FebZRwwZcdEko0RK3IGejkZ5dmqL+PpF3E4viHNUx665cc9PozomMtD9LrB9EE/kzr/2DAHU80a38/d/V53vGEIvAjM0usNzF/DfH6/C1mtf3nrSosZ6f6/HiPapv4wXRzd4XrJ0au8FKV/po/l5X/BxJjWeykPkuqaMJMq2fL5OI9; 4:uQaBg5wKJoXA1e8O0J5RM5+FepOluePfWiypPj8q+zrwa7LE0TmPS24oxfHo0Kvksg3U99iayNKfTesutYjAcz/rsd1nvC6psCY7sDzEw7aksKX9lmb9/4CunkZqMLsP340zs6MH/6vMKWCuXs92c/E6OPOvqbOUQMuUOVL3P9ipNzrYRENLVzF434PSPPhl90NNyI87IFO82U1Kt2xj/W9KruSY2s1jLRXneXtwgFZguP+RALDCzoBfigiD4fx5v3kERvKjo7AKtvPuMFLd7zymCjLcHVkzHV1r8mPDA6T1M42iTz7waLBXBbJsJwUJcCn8Z71EGOgs8+Uhf3YgGA== X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(767451399110); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040501)(2401047)(5005006)(8121501046)(3002001)(93006095)(93001095)(10201501046)(3231101)(2400082)(944501161)(6055026)(6041288)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(20161123558120)(20161123564045)(20161123560045)(6072148)(201708071742011); SRVR:CY1PR12MB0152; BCL:0; PCL:0; RULEID:; SRVR:CY1PR12MB0152; X-Forefront-PRVS: 0576145E86 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(1496009)(39860400002)(366004)(39380400002)(346002)(396003)(376002)(199004)(189003)(50226002)(68736007)(8666007)(51416003)(6916009)(7696005)(16526019)(1076002)(50466002)(6486002)(53416004)(7736002)(575784001)(305945005)(53936002)(8656006)(8936002)(8676002)(7416002)(86362001)(4326008)(81156014)(81166006)(52116002)(6666003)(2950100002)(478600001)(2351001)(66066001)(16586007)(2906002)(54906003)(5660300001)(106356001)(2361001)(47776003)(48376002)(105586002)(3846002)(59450400001)(6116002)(36756003)(386003)(316002)(39060400002)(26005)(97736004)(186003)(76176011)(25786009); DIR:OUT; SFP:1101; SCL:1; SRVR:CY1PR12MB0152; H:wsp141597wss.amd.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; CY1PR12MB0152; 23:bmt/N8JyTnKXtpTEgiq0YqhTAXVb2yRwQBkb9HGZX?= IxaNpnhsZXqxLOKn1AunuOklPJMUjGR5MyRVn2kqADnyGKVRHf+L6qIOmvGlNZTwCa5U8ynDjy/6YrESy9xRVvld0Q3azMImZVpLQkBdJqCXE91LF0eaKrhmIKwgHgr3yKd0RwO75rENVcIitHamyhyjgLOsoW/jW20fhPg5L9mrhXOXS+fj9ILxoiB229dUmkgfEPW+KmbugkT5GAQ6d7RJFdMZnNK7euP+mXDDc0/9/MgOxv0w3kxdNs7N21nvwmibG7tXK38rIZ5pZFwBuydz99T4duUjYaWECqYgIqzxkAXk57k/v8z/T1TgASpyRNsr6tH+4rIQbQsYr97O6Lx1XzIhqdZKkied2Xb+HRyVkNBn8KXcP2JsAJy4W9N8Eeyv/+LrgzNBkegy7qROMGJy1PjmFxES+7L6yPEqLxgyt8CxjLuV+u2Cvd5qTb2n6ohwJqx+dhsTiSanGZc9KVLwsrfTQd3UBEuG0EnkRo3HpZpBkTgkXMixNUrNwCpvqu6X2U5UDDNn3vGFRdKqAk5OG7zluo3Pj7u/nMi+PAouBB2+gutLfz7CQbPtQepZGjyrKU9Ii1fCmJYQDhgWqkUYZ2XiPzfu+X7xuMo+pPIyOy1+lPUGqANvEJQn6fegXELZfbHUL6BS4sYUPw3m8DcGtIgUNDUJlBeCXC7bnpXb1JNk9o+u2v+ZtKfAtM3M2im+xyCWkbYB8+DpygUhIR/7XWy2C6rZ+JHozy1LZ/GkH1m+8fDvtvI8uQjvc0E80ql5y/0wnu6lkovLBNdqhQoaaIOeVGzYY1+4bLOE8uUEHnShxCICGWrnEKsMOGydNQlfLhP8l4pjdHtIvt37NjWwU4Q51rT16dQfOg7rFl8qxLgHW9+baLVAqpPbPaqw1oaGoxwMExN7zufTAIRJk72qxq9+3dXdjSrrs3WBoAWBZrHWmkQeYkb9fF+UeZTck8uPDK/yOxcuSJlj9RQhZpZhr0BizfXVC4oidh1nT5EWo4vV9lRt7u1+oZ4JeeXDrKoKOl334Xf8hZ1YiKdWO73d3WyLHp0pthYHZEXG5q8nPGCddUJ59CwbMzi/kfMd2QeBmCVDDBVoI2so4q+pORR1zWMbVXknpMJnX85dK+/PAsMBkg9DG0atPZdtI1HrYS7vmY4c5wrZ1kYIodApa5pzuaJmthJ6GbKo4wpbyujZuMelZ+WZ79xy9x5m8H3zHAFElhg9JkuV1byXsxyHpVaT813teXeGsYELIYN0qtD4wcLN9/rmOGQlqPynU/dE9YIS8rNTJde1qYGLtGXtb1x X-Microsoft-Exchange-Diagnostics: 1; CY1PR12MB0152; 6:mFQTpyfggYvtaKvS8H3TifvzgfgCUBK7rgOPOIOm6AYIFVOije56lSPFB7CuCGl4we7mDk6LcGIO3hCx+qLSEWVRl+4FccmTZBZRpvQnyQu5j2ZSlfdgpuAjY7qmh8I/LKe4hAN2luv/FntwLGoqOJOiYmym1gcv2TLqRg+wDjJF2zqrQsNinErr+HwrprNOw6NJX9brkLgsH6XHkYhyw6YCVh5FECF+GXdSEjCAqzk5fbn95qSLJlk6ppFDesXhJ2bJgPspfGnuLAvqqsTUjdxK0Y9lIuuM1YyGX6sI1YBWGVIQiqDqwHNCG/lkFoTcWEt8aQi0DWDC8dmptWKP5a1IpyUR56j8n87eLrLYzyw=; 5:2OT1K1WRyOhSBAnt8HHuSId7pZXxKNxsbERdz3agKCJNSU6VXQPkp8MGpE3lJ6q27untEo0Bn1JK68ZqXDn11P0EklmFttsOlHVTk5oLfubNnhrNHgfRj+eGlqVQ3F+isLFbmU/N9NYPiQO/orTknX5gyLdbjbNgUsZ4wBWG2TI=; 24:gjcpSKjyuehOiqRmSErCXHSJ1JoIEZAEiweZvG01xkXDzTp/VTC+P32aUuhpR1ZWQqu2efG/NijTOqt2zs3JjnHZGzYVA/KhlDIyMWTFWsM=; 7:LDbHXM2FLgoggEMpLFb3syFowsITi87fmhouaREknP5zCsu4Q4fuWmc+GwV6nommhUrIBJSpRuf8ZsSwbmKMAOEWJtc1JKW0IM8/p/dlFSC0MQa0RC7XvtGn0ffrytWZ2pJutYxvfQIO3XPcBq9mhAsDPLHPzER+gY0CvGPN1nsKgL/Usax6gFcZHE0U28HbS/WxqH+FQJ8S6+NVkxz1E6IJzx5bw20oEx6nvX54tUbc2LS9fOXd9UiMHXBbNvi4 SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; CY1PR12MB0152; 20:5MBqlHtWGQ5criT+EC5/IZD9nqkmR6QAdzUBBW/H7IzXfnbZ7+S3ARpNvIvAWPfAVGfmTWCAB1sJrXOt5OS4bEGcqUd/vW86D/EoIZeS0TI/bhYNfJMXOZBzXcjPKSdM7C4sxhfZ+wlATwwdYUxLfO+6ZGHCOtdHQsmLMKHARI+c7Xho1PlMDFPnPhPeCywVEZS+DPPlR0NU4dYATrSzm9RxXdrAyfPsNrEfAmZ4TIrXdDmywfDT4gmBtRrRsNi9 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Feb 2018 16:07:24.1972 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: a4fa4484-0c9b-4b11-88da-08d56e44e0cd X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR12MB0152 X-detected-operating-system: by eggs.gnu.org: Windows 7 or 8 [fuzzy] X-Received-From: 104.47.38.57 Subject: [Qemu-devel] [PATCH v7 18/26] sev: add support to LAUNCH_MEASURE command X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "Edgar E. Iglesias" , Peter Maydell , Eduardo Habkost , kvm@vger.kernel.org, "Michael S. Tsirkin" , Marcel Apfelbaum , Markus Armbruster , Peter Crosthwaite , Richard Henderson , "Dr. David Alan Gilbert" , Alistair Francis , Christian Borntraeger , Brijesh Singh , Stefan Hajnoczi , Cornelia Huck , Paolo Bonzini , Thomas Lendacky , Borislav Petkov Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" During machine creation we encrypted the guest bios image, the LAUNCH_MEASURE command can be used to retrieve the measurement of the encrypted memory region. This measurement is a signature of the memory contents that can be sent to the guest owner as an attestation that the memory was encrypted correctly by the firmware. VM management tools like libvirt can query the measurement using query-launch-measure QMP command. Cc: Paolo Bonzini Cc: kvm@vger.kernel.org Signed-off-by: Brijesh Singh --- accel/kvm/sev.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++++++ accel/kvm/trace-events | 1 + accel/stubs/kvm-stub.c | 5 ++++ include/sysemu/sev.h | 2 ++ 4 files changed, 75 insertions(+) diff --git a/accel/kvm/sev.c b/accel/kvm/sev.c index 4414bda25509..8d99c6cda4d2 100644 --- a/accel/kvm/sev.c +++ b/accel/kvm/sev.c @@ -19,6 +19,7 @@ #include "sysemu/sev.h" #include "sysemu/sysemu.h" #include "trace.h" +#include "qapi-event.h" #define DEFAULT_GUEST_POLICY 0x1 /* disable debug */ #define DEFAULT_SEV_DEVICE "/dev/sev" @@ -26,6 +27,7 @@ static uint64_t me_mask; static bool sev_active; static int sev_fd; +static SEVState *sev_state; #define SEV_FW_MAX_ERROR 0x17 @@ -483,6 +485,68 @@ err: return ret; } +static void +sev_launch_get_measure(Notifier *notifier, void *unused) +{ + int ret, error; + guchar *data; + SEVState *s = sev_state; + struct kvm_sev_launch_measure *measurement; + + if (!sev_check_state(SEV_STATE_LUPDATE)) { + return; + } + + measurement = g_malloc0(sizeof(*measurement)); + if (!measurement) { + return; + } + + /* query the measurement blob length */ + ret = sev_ioctl(KVM_SEV_LAUNCH_MEASURE, measurement, &error); + if (!measurement->len) { + error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'", + __func__, ret, error, fw_error_to_str(errno)); + goto free_measurement; + } + + data = g_malloc(measurement->len); + if (s->measurement) { + goto free_data; + } + + measurement->uaddr = (unsigned long)data; + + /* get the measurement blob */ + ret = sev_ioctl(KVM_SEV_LAUNCH_MEASURE, measurement, &error); + if (ret) { + error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'", + __func__, ret, error, fw_error_to_str(errno)); + goto free_data; + } + + sev_set_guest_state(SEV_STATE_SECRET); + + /* encode the measurement value and emit the event */ + s->measurement = g_base64_encode(data, measurement->len); + trace_kvm_sev_launch_measurement(s->measurement); + +free_data: + g_free(data); +free_measurement: + g_free(measurement); +} + +char * +sev_get_launch_measurement(void) +{ + return g_strdup(sev_state->measurement); +} + +static Notifier sev_machine_done_notify = { + .notify = sev_launch_get_measure, +}; + void * sev_guest_init(const char *id) { @@ -535,6 +599,9 @@ sev_guest_init(const char *id) sev_active = true; ram_block_notifier_add(&sev_ram_notifier); + qemu_add_machine_init_done_notifier(&sev_machine_done_notify); + + sev_state = s; return s; err: diff --git a/accel/kvm/trace-events b/accel/kvm/trace-events index bd92f868b73a..19742bf9dd30 100644 --- a/accel/kvm/trace-events +++ b/accel/kvm/trace-events @@ -20,3 +20,4 @@ kvm_memcrypt_unregister_region(void *addr, size_t len) "addr %p len 0x%lu" kvm_sev_change_state(const char *old, const char *new) "%s -> %s" kvm_sev_launch_start(int policy, void *session, void *pdh) "policy 0x%x session %p pdh %p" kvm_sev_launch_update_data(void *addr, uint64_t len) "addr %p len 0x%" PRIu64 +kvm_sev_launch_measurement(const char *value) "data %s" diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c index e7d579e3e54f..d0f1aa6d6f9a 100644 --- a/accel/stubs/kvm-stub.c +++ b/accel/stubs/kvm-stub.c @@ -133,6 +133,11 @@ void sev_get_policy(uint32_t *policy) { } +char *sev_get_launch_measurement(void) +{ + return NULL; +} + bool kvm_memcrypt_enabled(void) { return false; diff --git a/include/sysemu/sev.h b/include/sysemu/sev.h index f7af1a00c510..c173ad33f8bb 100644 --- a/include/sysemu/sev.h +++ b/include/sysemu/sev.h @@ -30,6 +30,7 @@ extern uint64_t sev_get_me_mask(void); extern void sev_get_current_state(char **state); extern void sev_get_fw_version(uint8_t *major, uint8_t *minor, uint8_t *build); extern void sev_get_policy(uint32_t *policy); +extern char *sev_get_launch_measurement(void); typedef struct QSevGuestInfo QSevGuestInfo; typedef struct QSevGuestInfoClass QSevGuestInfoClass; @@ -70,6 +71,7 @@ typedef enum { struct SEVState { QSevGuestInfo *sev_info; + gchar *measurement; }; typedef struct SEVState SEVState;