From patchwork Thu Sep 14 17:58:28 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tyler Fanelli X-Patchwork-Id: 1834377 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=aQy89sP7; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=patchwork.ozlabs.org) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RmlTf3Kqnz1yhn for ; Fri, 15 Sep 2023 04:00:06 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qgqc6-0003Kv-Hk; Thu, 14 Sep 2023 13:58:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqc5-0003KO-9M for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:58:49 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqc2-0002ER-I5 for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:58:48 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1694714324; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=yhhRFK0ZCoglrBy3GmbzRXf2oYIiYOmczFpn9U0TMwE=; b=aQy89sP7TOTwK2w5meoqKPc2GQMcs7HZSLdy2k6efrrihM4nMquOVOcDHbIFQOGpB7zbni Ca/v1P3Rdb0GdGKGX9DElLal3iLPSMHO6WabTIZtQIZLzdc8Q/zpzlXZ8ziMjB74VNOUMR DSZw/WpxCESRusI83CiFfN5zLQUBISs= Received: from mail-qv1-f71.google.com (mail-qv1-f71.google.com [209.85.219.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-340-Pt1WoCarOKGgs0fC9lJz3g-1; Thu, 14 Sep 2023 13:58:43 -0400 X-MC-Unique: Pt1WoCarOKGgs0fC9lJz3g-1 Received: by mail-qv1-f71.google.com with SMTP id 6a1803df08f44-655d7107e70so14181006d6.1 for ; Thu, 14 Sep 2023 10:58:43 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694714322; x=1695319122; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=yhhRFK0ZCoglrBy3GmbzRXf2oYIiYOmczFpn9U0TMwE=; b=s7RPUXB8ijP6uhq7AnQZzyqyeBwkZ/x/tZa4WI43mUdDVsZX9cx8ZOO+benit6SO1T o9PJm4OQPt1MdwOdZuTfzHeYyaB2ntLziPTckprX0y94YKzIRHwDWKL5Y/LyFfqFLoGK RiqGuVc+gXiOzeqi+igIP5IWYbMPiYC3nwF3AgVfWb0eT/Yk4062PLQBoz+RV/26G9mm RFZWH+JMsIVpr/XjGvbvn+yWO7Dx7AcdS38wkBNPWu78bkxybbxdiQabM+m9j3Vg2xok cfAHJdBAPUdCRjsLwUroQIaweJgf1WWgdG0lkaKlJybEzIQNJzsSLyTnkn8daO4zQfHz xsFA== X-Gm-Message-State: AOJu0YyShzT4kg81pjnHAKj9H4eCWuTRpXKEnZHv/e04R+Zm52vUlnL0 HDBeoYeF5sAAwRE7XUF3Aryq8rqha9XQqLQRjgL+m5YUhAmKTA4iUQpFcQYrtxo4oF9njqoj+xf reMBoD065+nJhCAZ/VFUQyVbmP9x/UbKJrkZkxtI24vL4LIBqc+UlZ7RLHhqAG8gz/TSjBxmsfd ElZw== X-Received: by 2002:a0c:ed4d:0:b0:64f:3bec:9b29 with SMTP id v13-20020a0ced4d000000b0064f3bec9b29mr6910288qvq.39.1694714321798; Thu, 14 Sep 2023 10:58:41 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFzo9lelr4NQTAzGe2D1O+I9Nxb6+S7xkx1vnm1PmEcgPIv/P4mZVUwP+UK1g/OkkCeA9eLVw== X-Received: by 2002:a0c:ed4d:0:b0:64f:3bec:9b29 with SMTP id v13-20020a0ced4d000000b0064f3bec9b29mr6910274qvq.39.1694714321486; Thu, 14 Sep 2023 10:58:41 -0700 (PDT) Received: from fedora.redhat.com ([2600:4040:7c46:e800:32a2:d966:1af4:8863]) by smtp.gmail.com with ESMTPSA id d1-20020a0cf0c1000000b0064733ac9a9dsm628489qvl.122.2023.09.14.10.58.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 Sep 2023 10:58:39 -0700 (PDT) From: Tyler Fanelli To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, mtosatti@redhat.com, stefanha@redhat.com, Tyler Fanelli Subject: [RFC PATCH 1/8] Add SEV Rust library as dependency with CONFIG_SEV Date: Thu, 14 Sep 2023 13:58:28 -0400 Message-Id: <20230914175835.382972-2-tfanelli@redhat.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230914175835.382972-1-tfanelli@redhat.com> References: <20230914175835.382972-1-tfanelli@redhat.com> MIME-Version: 1.0 Received-SPF: pass client-ip=170.10.133.124; envelope-from=tfanelli@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org The Rust sev library provides a type-safe implementation of the AMD Secure Encrypted Virtualization (SEV) APIs. Signed-off-by: Tyler Fanelli --- meson.build | 7 +++++++ meson_options.txt | 2 ++ scripts/meson-buildoptions.sh | 3 +++ target/i386/meson.build | 2 +- 4 files changed, 13 insertions(+), 1 deletion(-) diff --git a/meson.build b/meson.build index 5150a74831..7114a4a2b9 100644 --- a/meson.build +++ b/meson.build @@ -1079,6 +1079,12 @@ if targetos == 'linux' and (have_system or have_tools) method: 'pkg-config', required: get_option('libudev')) endif +sev = not_found +if not get_option('sev').auto() + sev = dependency('sev', version: '1.2.1', + method: 'pkg-config', + required: get_option('sev')) +endif mpathlibs = [libudev] mpathpersist = not_found @@ -4283,6 +4289,7 @@ summary_info += {'PAM': pam} summary_info += {'iconv support': iconv} summary_info += {'virgl support': virgl} summary_info += {'blkio support': blkio} +summary_info += {'sev support': sev} summary_info += {'curl support': curl} summary_info += {'Multipath support': mpathpersist} summary_info += {'Linux AIO support': libaio} diff --git a/meson_options.txt b/meson_options.txt index f82d88b7c6..c57d542c0b 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -134,6 +134,8 @@ option('cap_ng', type : 'feature', value : 'auto', description: 'cap_ng support') option('blkio', type : 'feature', value : 'auto', description: 'libblkio block device driver') +option('sev', type : 'feature', value : 'auto', + description: 'SEV Rust library') option('bpf', type : 'feature', value : 'auto', description: 'eBPF support') option('cocoa', type : 'feature', value : 'auto', diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh index e1d178370c..d7deb50bda 100644 --- a/scripts/meson-buildoptions.sh +++ b/scripts/meson-buildoptions.sh @@ -83,6 +83,7 @@ meson_options_help() { printf "%s\n" ' avx512bw AVX512BW optimizations' printf "%s\n" ' avx512f AVX512F optimizations' printf "%s\n" ' blkio libblkio block device driver' + printf "%s\n" ' sev SEV Rust library' printf "%s\n" ' bochs bochs image format support' printf "%s\n" ' bpf eBPF support' printf "%s\n" ' brlapi brlapi character device driver' @@ -227,6 +228,8 @@ _meson_option_parse() { --disable-lto) printf "%s" -Db_lto=false ;; --enable-blkio) printf "%s" -Dblkio=enabled ;; --disable-blkio) printf "%s" -Dblkio=disabled ;; + --enable-sev) printf "%s" -Dsev=enabled ;; + --disable-sev) printf "%s" -Dsev=disabled ;; --block-drv-ro-whitelist=*) quote_sh "-Dblock_drv_ro_whitelist=$2" ;; --block-drv-rw-whitelist=*) quote_sh "-Dblock_drv_rw_whitelist=$2" ;; --enable-block-drv-whitelist-in-tools) printf "%s" -Dblock_drv_whitelist_in_tools=true ;; diff --git a/target/i386/meson.build b/target/i386/meson.build index 6f1036d469..18450dc134 100644 --- a/target/i386/meson.build +++ b/target/i386/meson.build @@ -6,7 +6,7 @@ i386_ss.add(files( 'xsave_helper.c', 'cpu-dump.c', )) -i386_ss.add(when: 'CONFIG_SEV', if_true: files('host-cpu.c')) +i386_ss.add(when: 'CONFIG_SEV', if_true: [sev, files('host-cpu.c')]) # x86 cpu type i386_ss.add(when: 'CONFIG_KVM', if_true: files('host-cpu.c')) From patchwork Thu Sep 14 17:58:29 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tyler Fanelli X-Patchwork-Id: 1834376 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=M8Q8yucX; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=patchwork.ozlabs.org) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RmlTb56TSz1yh0 for ; Fri, 15 Sep 2023 04:00:03 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qgqc5-0003KY-Rl; Thu, 14 Sep 2023 13:58:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqc4-0003KG-VZ for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:58:48 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqc3-0002Es-Cc for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:58:48 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1694714326; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5VBskaJXZziliJm4qr2RVmqGx7fudPW2YJcT+hAMbW0=; b=M8Q8yucXe7XIM1tZsgankyagWiZha7t4MDFEFtwEWC/Yc823lFEIfR4a8IYUIj9hHe68EV 6jYtkdhVicb0ULNRw+iDyKbcmrLb2B9ptR323rl0iynFyIMMaUPolPuLE6lxc1138uK9sL RyUVNFZerIfAx/NjY9TMmr6Pwv3+hf4= Received: from mail-qv1-f70.google.com (mail-qv1-f70.google.com [209.85.219.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-542-JLQtxqIPOImShJvJSLwAog-1; Thu, 14 Sep 2023 13:58:45 -0400 X-MC-Unique: JLQtxqIPOImShJvJSLwAog-1 Received: by mail-qv1-f70.google.com with SMTP id 6a1803df08f44-6562fff4a2fso2912166d6.3 for ; Thu, 14 Sep 2023 10:58:45 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694714324; x=1695319124; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=5VBskaJXZziliJm4qr2RVmqGx7fudPW2YJcT+hAMbW0=; b=hX7leFd+Sf17JRD/wPE2bVkkxOUqO+DMqKEAaebtKn+f6jAek7WiANnV5XHaW7ib7e VXtmCzLaFsMu2GQKP+VDVrK9g9znQXdMRWIh85WN5EfeIsnUsEu1XlewL7EWTvb99pnU VkFSU5Dw5Gx1NfL33nuZKla35BmZhaLfLcwtzM360Jo80IicJOAJrevub2IlbxuQRYLN Br3g3YqhhDOv1Tk9JD/nx8v/AMzWzkEckaFEHk7We075AA2ns0WnAYpDuUcuHQ19r6tI mBYTWbMEdTq9hTj/WkDNXxfPsWaYxzpzqGqJcGbmytGX7i4XFbTspCDD6v8NTidjCL8c OfzA== X-Gm-Message-State: AOJu0YxjelJg/0VmOlwlxHm1NlUGLqPPSwjERPZRmddrmrs2QWTQTNIF dDXjsPf9wg+koQKjCOESQw7zy38yuuk9776yCKKxaB0aO9luYsFS+wjBsXyx5LcWVs29WrdFAXw XOJE/V/3IJONPDGEzWr3mmgkNT8/0EfL2MoLUFgDWB7XtidunK8nZ0JbuqZT7gZ/WDYHOgHND4T fAKw== X-Received: by 2002:a0c:f10b:0:b0:651:5b77:1ab5 with SMTP id i11-20020a0cf10b000000b006515b771ab5mr7275951qvl.22.1694714324084; Thu, 14 Sep 2023 10:58:44 -0700 (PDT) X-Google-Smtp-Source: AGHT+IG/C3ZzQf/VrPFSK1890wSlPyBMkHQsQpaVv3m+QuVGKsDzg0cvU6R2E5puh2W7fBe2LDq4gg== X-Received: by 2002:a0c:f10b:0:b0:651:5b77:1ab5 with SMTP id i11-20020a0cf10b000000b006515b771ab5mr7275928qvl.22.1694714323765; Thu, 14 Sep 2023 10:58:43 -0700 (PDT) Received: from fedora.redhat.com ([2600:4040:7c46:e800:32a2:d966:1af4:8863]) by smtp.gmail.com with ESMTPSA id d1-20020a0cf0c1000000b0064733ac9a9dsm628489qvl.122.2023.09.14.10.58.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 Sep 2023 10:58:41 -0700 (PDT) From: Tyler Fanelli To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, mtosatti@redhat.com, stefanha@redhat.com, Tyler Fanelli Subject: [RFC PATCH 2/8] i386/sev: Replace INIT and ES_INIT ioctls with sev library equivalents Date: Thu, 14 Sep 2023 13:58:29 -0400 Message-Id: <20230914175835.382972-3-tfanelli@redhat.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230914175835.382972-1-tfanelli@redhat.com> References: <20230914175835.382972-1-tfanelli@redhat.com> MIME-Version: 1.0 Received-SPF: pass client-ip=170.10.133.124; envelope-from=tfanelli@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org The sev library offers APIs for SEV_INIT and SEV_ES_INIT, both taking the file descriptors of the encrypting VM and /dev/sev as input. If this API ioctl call fails, fw_error will be set accordingly. Signed-off-by: Tyler Fanelli --- target/i386/sev.c | 14 +++++++++----- target/i386/trace-events | 1 + 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index fe2144c038..f0fd291e68 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -18,6 +18,8 @@ #include +#include + #include "qapi/error.h" #include "qom/object_interfaces.h" #include "qemu/base64.h" @@ -27,6 +29,7 @@ #include "crypto/hash.h" #include "sysemu/kvm.h" #include "sev.h" +#include "sysemu/kvm_int.h" #include "sysemu/sysemu.h" #include "sysemu/runstate.h" #include "trace.h" @@ -911,10 +914,11 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) SevGuestState *sev = (SevGuestState *)object_dynamic_cast(OBJECT(cgs), TYPE_SEV_GUEST); char *devname; - int ret, fw_error, cmd; + int ret, fw_error; uint32_t ebx; uint32_t host_cbitpos; struct sev_user_data_status status = {}; + KVMState *s = kvm_state; if (!sev) { return 0; @@ -990,13 +994,13 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) __func__); goto err; } - cmd = KVM_SEV_ES_INIT; + trace_kvm_sev_es_init(); + ret = sev_es_init(s->vmfd, sev->sev_fd, &fw_error); } else { - cmd = KVM_SEV_INIT; + trace_kvm_sev_init(); + ret = sev_init(s->vmfd, sev->sev_fd, &fw_error); } - trace_kvm_sev_init(); - ret = sev_ioctl(sev->sev_fd, cmd, NULL, &fw_error); if (ret) { error_setg(errp, "%s: failed to initialize ret=%d fw_error=%d '%s'", __func__, ret, fw_error, fw_error_to_str(fw_error)); diff --git a/target/i386/trace-events b/target/i386/trace-events index 2cd8726eeb..2dca4ee117 100644 --- a/target/i386/trace-events +++ b/target/i386/trace-events @@ -2,6 +2,7 @@ # sev.c kvm_sev_init(void) "" +kvm_sev_es_init(void) "" kvm_memcrypt_register_region(void *addr, size_t len) "addr %p len 0x%zx" kvm_memcrypt_unregister_region(void *addr, size_t len) "addr %p len 0x%zx" kvm_sev_change_state(const char *old, const char *new) "%s -> %s" From patchwork Thu Sep 14 17:58:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tyler Fanelli X-Patchwork-Id: 1834374 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=TVPu+mF/; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=patchwork.ozlabs.org) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RmlT64qLTz1yh0 for ; Fri, 15 Sep 2023 03:59:37 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qgqc9-0003LV-5n; Thu, 14 Sep 2023 13:58:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqc7-0003LD-IW for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:58:51 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqc6-0002Fm-0h for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:58:51 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1694714329; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2sK9qSi08IdhuNBweHKbDKawtZ28B4JO2EvdjNn6LOA=; b=TVPu+mF/2+HY0apeHOwRLEaV1R/RsybzfN5oWj+Eg+q7tmT/ykEtteGZlsTVwwbRBXVYUS 7R96lzr+cfq/gnhevQBnSvMOo1s8Sbonj/3Wy5eczGdjr5GmKgSKCFLrrGUJWLHNc5tIji azjXA5oGv9tf76wMwpnZJLUnVNMt63E= Received: from mail-ua1-f72.google.com (mail-ua1-f72.google.com [209.85.222.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-507-NN_NtLURN26ln2MOCgnpDw-1; Thu, 14 Sep 2023 13:58:48 -0400 X-MC-Unique: NN_NtLURN26ln2MOCgnpDw-1 Received: by mail-ua1-f72.google.com with SMTP id a1e0cc1a2514c-7a515393474so467219241.0 for ; Thu, 14 Sep 2023 10:58:47 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694714326; x=1695319126; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=2sK9qSi08IdhuNBweHKbDKawtZ28B4JO2EvdjNn6LOA=; b=g/br0QGTIcWtiJF3BD1i1qiwKFMvywvrw2W1gArSVrzy594jxoEKWTDQ4/O++/C53e LpJiX5mIRY9MwkYmBlh6qsIOgEsGf/atvP+aIgSHxjU1VBys/vVuEmqtCddwWU1fUQpu hYveHheO2raYF1UVRoyIKV+Xdn9KHh+32hMHWwznYN6x/wVZ754XntY3DGojiF1bMU3Z cXFmUNUtW1ZfV3vyvJbaUfOBCWOS3XshgSKoptWXOTu4FUt/55+np+f6Cg5YSkZFq6+O odxUR/wvfH1D05qUCRVyaoosT+ozxhzFf5iHWaI5HLcVRCLLlNoR/72VKTowk7SR8qNR 0FGw== X-Gm-Message-State: AOJu0YzFE+yW4oqzijndEzwL293/hd6bPARBM6EOstGYARofRx9RHBUk 8Ssq3y3nME0v7swhIPZi5O4gcK7GKoh5LdjmX5LHsHxHO5qKCwUuPBm3T5zb0DEqi7KfLPxWK4W g/+F3YkT6xIWg2cjigZjLEGuKdrh/33pk+0jyWtSYeegTXc2VRl+Dt0s8rkQp1Xrq0zSSCMt8AA BUWQ== X-Received: by 2002:a67:ea88:0:b0:44e:9c7a:949 with SMTP id f8-20020a67ea88000000b0044e9c7a0949mr6004357vso.30.1694714326224; Thu, 14 Sep 2023 10:58:46 -0700 (PDT) X-Google-Smtp-Source: AGHT+IEOEMGoUr16zI6c1HLnM0MEFWL6G1/5xzBumzVNh+/MxGyqaXgK7Kw4IbzsJ68LnmuwXyqnZA== X-Received: by 2002:a67:ea88:0:b0:44e:9c7a:949 with SMTP id f8-20020a67ea88000000b0044e9c7a0949mr6004342vso.30.1694714325954; Thu, 14 Sep 2023 10:58:45 -0700 (PDT) Received: from fedora.redhat.com ([2600:4040:7c46:e800:32a2:d966:1af4:8863]) by smtp.gmail.com with ESMTPSA id d1-20020a0cf0c1000000b0064733ac9a9dsm628489qvl.122.2023.09.14.10.58.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 Sep 2023 10:58:44 -0700 (PDT) From: Tyler Fanelli To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, mtosatti@redhat.com, stefanha@redhat.com, Tyler Fanelli Subject: [RFC PATCH 3/8] i386/sev: Replace LAUNCH_START ioctl with sev library equivalent Date: Thu, 14 Sep 2023 13:58:30 -0400 Message-Id: <20230914175835.382972-4-tfanelli@redhat.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230914175835.382972-1-tfanelli@redhat.com> References: <20230914175835.382972-1-tfanelli@redhat.com> MIME-Version: 1.0 Received-SPF: pass client-ip=170.10.129.124; envelope-from=tfanelli@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org The sev library offers an equivalent API for SEV_LAUNCH_START. The library contains some internal state for each VM it's currently running, and organizes the internal state for each VM via it's file descriptor. Therefore, the VM's file descriptor must be provided as input. If this API ioctl call fails, fw_error will be set accordingly. Signed-off-by: Tyler Fanelli --- target/i386/sev.c | 80 ++++++++++++++++++----------------------------- 1 file changed, 30 insertions(+), 50 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index f0fd291e68..49be072cbc 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -715,51 +715,6 @@ sev_read_file_base64(const char *filename, guchar **data, gsize *len) return 0; } -static int -sev_launch_start(SevGuestState *sev) -{ - gsize sz; - int ret = 1; - int fw_error, rc; - struct kvm_sev_launch_start start = { - .handle = sev->handle, .policy = sev->policy - }; - guchar *session = NULL, *dh_cert = NULL; - - if (sev->session_file) { - if (sev_read_file_base64(sev->session_file, &session, &sz) < 0) { - goto out; - } - start.session_uaddr = (unsigned long)session; - start.session_len = sz; - } - - if (sev->dh_cert_file) { - if (sev_read_file_base64(sev->dh_cert_file, &dh_cert, &sz) < 0) { - goto out; - } - start.dh_uaddr = (unsigned long)dh_cert; - start.dh_len = sz; - } - - trace_kvm_sev_launch_start(start.policy, session, dh_cert); - rc = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_START, &start, &fw_error); - if (rc < 0) { - error_report("%s: LAUNCH_START ret=%d fw_error=%d '%s'", - __func__, ret, fw_error, fw_error_to_str(fw_error)); - goto out; - } - - sev_set_guest_state(sev, SEV_STATE_LAUNCH_UPDATE); - sev->handle = start.handle; - ret = 0; - -out: - g_free(session); - g_free(dh_cert); - return ret; -} - static int sev_launch_update_data(SevGuestState *sev, uint8_t *addr, uint64_t len) { @@ -913,11 +868,13 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) { SevGuestState *sev = (SevGuestState *)object_dynamic_cast(OBJECT(cgs), TYPE_SEV_GUEST); + gsize sz; char *devname; - int ret, fw_error; + int ret = -1, fw_error; uint32_t ebx; uint32_t host_cbitpos; struct sev_user_data_status status = {}; + guchar *session = NULL, *dh_cert = NULL; KVMState *s = kvm_state; if (!sev) { @@ -1007,23 +964,46 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) goto err; } - ret = sev_launch_start(sev); + if (!sev->session_file || !sev->dh_cert_file) { + goto err; + } + + if (sev_read_file_base64(sev->session_file, &session, &sz) < 0) { + goto err; + } + + if (sev_read_file_base64(sev->dh_cert_file, &dh_cert, &sz) < 0) { + goto err; + } + + ret = sev_launch_start(s->vmfd, sev->policy, (void *) dh_cert, + (void *) session, &fw_error); if (ret) { - error_setg(errp, "%s: failed to create encryption context", __func__); + error_setg(errp, "%s: LAUNCH_START ret=%d fw_error=%d '%s'", + __func__, ret, fw_error, fw_error_to_str(fw_error)); goto err; } + sev_set_guest_state(sev, SEV_STATE_LAUNCH_UPDATE); + ram_block_notifier_add(&sev_ram_notifier); qemu_add_machine_init_done_notifier(&sev_machine_done_notify); qemu_add_vm_change_state_handler(sev_vm_state_change, sev); cgs->ready = true; - return 0; + ret = 0; + goto out; + err: sev_guest = NULL; ram_block_discard_disable(false); - return -1; +out: + g_free(session); + g_free(dh_cert); + + return ret; + } int From patchwork Thu Sep 14 17:58:31 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tyler Fanelli X-Patchwork-Id: 1834375 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=dXdJ9ZfT; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=patchwork.ozlabs.org) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RmlTQ6KFyz1yh0 for ; Fri, 15 Sep 2023 03:59:54 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qgqcC-0003MR-OD; Thu, 14 Sep 2023 13:58:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqcA-0003Lp-RD for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:58:54 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqc9-0002HG-CD for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:58:54 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1694714332; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Fc30G/UJj9VkKOdSEvlN0aV0jjSWQajqBHdMdcHorNc=; b=dXdJ9ZfT4Na/BfAiCv2xbMThHbh2wk4AhjZ9Q4IzwFfT7j0xVyQF3k+tmEIbwK/goiEI4E ulOTTdRU2zZRnSGrGIPDV0i+xqGvCFXieXERWuH7XnWyeaLbwnKPFJMRA0IKw08L4Rhgop LG1pgZ2QkXcHi6jFUflo5FL7AcR4zG8= Received: from mail-qv1-f72.google.com (mail-qv1-f72.google.com [209.85.219.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-237-cgpwFhLEMRikvSle-ZUSUw-1; Thu, 14 Sep 2023 13:58:51 -0400 X-MC-Unique: cgpwFhLEMRikvSle-ZUSUw-1 Received: by mail-qv1-f72.google.com with SMTP id 6a1803df08f44-6495ac57250so13168196d6.3 for ; Thu, 14 Sep 2023 10:58:50 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694714328; x=1695319128; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Fc30G/UJj9VkKOdSEvlN0aV0jjSWQajqBHdMdcHorNc=; b=cFfHJzW/WtUEZVL6HiiDKbJXSgKkey+ae1wwSO9FHtOziLbzPK1KwK7LpLmgw1yXft h40vfZ20egg87LsMU+OehCAizwO87VIGUjTe9FZz1ncbylALImGoXgZWbGS7mCmClu/y HUfoNpgxcqWGmaXsWG1/g1DF4WIEbFQeUxpyRUxM0fKshL0xYHT2G/g4gPaYroaSc6Jo RVpgbX/h2itQLAwTe/ED9MOz5Tzyf7rk3EkBGs+FIe5aji0ZP2GVltBwx4T9WqLEvxLX B50D5xbxDAxgxAKUSn1iTwGSkFrUyerX8CYnsI/asfXsgFybYiWImGzD5cP/Oi21avCk ogFQ== X-Gm-Message-State: AOJu0YwhfnH62fgXinmbR0/l/sfDUWycdOZfcUz/z1ulK47Z9++KQrW2 njkyjOnf1b6aOOp0//Q5K4l8q+/AxeepXotaBflhH488+KWx8mRDkZgyJRmgXU3RAWS5vygn8PQ YBPVF/E9RccHZUySGNouFMdUr5Y3QSvFYsWlsplFZjLD2WIo/02DcOjnWrXeTmGD3AafLWOhhiW ptsg== X-Received: by 2002:a05:6214:8ce:b0:64f:518d:ac91 with SMTP id da14-20020a05621408ce00b0064f518dac91mr6242805qvb.8.1694714328601; Thu, 14 Sep 2023 10:58:48 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGCyTtH29ryVrkL0tTOhFmHY4U4QnhAjF2aQCL5Zssvhw+C560iHL24WbqaFZDWWXU5xuRBuA== X-Received: by 2002:a05:6214:8ce:b0:64f:518d:ac91 with SMTP id da14-20020a05621408ce00b0064f518dac91mr6242790qvb.8.1694714328341; Thu, 14 Sep 2023 10:58:48 -0700 (PDT) Received: from fedora.redhat.com ([2600:4040:7c46:e800:32a2:d966:1af4:8863]) by smtp.gmail.com with ESMTPSA id d1-20020a0cf0c1000000b0064733ac9a9dsm628489qvl.122.2023.09.14.10.58.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 Sep 2023 10:58:46 -0700 (PDT) From: Tyler Fanelli To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, mtosatti@redhat.com, stefanha@redhat.com, Tyler Fanelli Subject: [RFC PATCH 4/8] i386/sev: Replace UPDATE_DATA ioctl with sev library equivalent Date: Thu, 14 Sep 2023 13:58:31 -0400 Message-Id: <20230914175835.382972-5-tfanelli@redhat.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230914175835.382972-1-tfanelli@redhat.com> References: <20230914175835.382972-1-tfanelli@redhat.com> MIME-Version: 1.0 Received-SPF: pass client-ip=170.10.129.124; envelope-from=tfanelli@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org UPDATE_DATA takes the VM's file descriptor, a guest memory region to be encrypted, as well as the size of the aforementioned guest memory region. If this API ioctl call fails, fw_error will be set accordingly. Signed-off-by: Tyler Fanelli --- target/i386/sev.c | 31 ++++++------------------------- 1 file changed, 6 insertions(+), 25 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index 49be072cbc..615021a1a3 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -715,29 +715,6 @@ sev_read_file_base64(const char *filename, guchar **data, gsize *len) return 0; } -static int -sev_launch_update_data(SevGuestState *sev, uint8_t *addr, uint64_t len) -{ - int ret, fw_error; - struct kvm_sev_launch_update_data update; - - if (!addr || !len) { - return 1; - } - - update.uaddr = (__u64)(unsigned long)addr; - update.len = len; - trace_kvm_sev_launch_update_data(addr, len); - ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA, - &update, &fw_error); - if (ret) { - error_report("%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'", - __func__, ret, fw_error, fw_error_to_str(fw_error)); - } - - return ret; -} - static int sev_launch_update_vmsa(SevGuestState *sev) { @@ -1009,15 +986,19 @@ out: int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp) { + KVMState *s = kvm_state; + int fw_error; + if (!sev_guest) { return 0; } /* if SEV is in update state then encrypt the data else do nothing */ if (sev_check_state(sev_guest, SEV_STATE_LAUNCH_UPDATE)) { - int ret = sev_launch_update_data(sev_guest, ptr, len); + int ret = sev_launch_update_data(s->vmfd, (__u64) ptr, len, &fw_error); if (ret < 0) { - error_setg(errp, "SEV: Failed to encrypt pflash rom"); + error_setg(errp, "SEV: Failed to encrypt pflash rom fw_err=%d", + fw_error); return ret; } } From patchwork Thu Sep 14 17:58:32 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tyler Fanelli X-Patchwork-Id: 1834379 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=OiCkkwwS; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=patchwork.ozlabs.org) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RmlTk62fNz1yh0 for ; Fri, 15 Sep 2023 04:00:10 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qgqcE-0003Mm-Ag; Thu, 14 Sep 2023 13:58:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqcC-0003M6-ED for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:58:56 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqcB-0002HV-03 for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:58:56 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1694714334; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=u2NK0kTh0JhgbuxHuwB20u7hC6VkkacylDJv8O/TVLI=; b=OiCkkwwSkaQZqdQXaeWQxb7HcrszKJcX85tafxkEFicVBtP2cGI5ioyDCJ7zt44Ixb2gp7 Xd63NlybV9LlLtN3/aXsRFKeCFm31wUMjhpMbt7BFLl1JfYLowlAz4uY+zecqovYSMgkHb eafrqOczLYNiHjScBLWxbCSariLL5NE= Received: from mail-qv1-f70.google.com (mail-qv1-f70.google.com [209.85.219.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-662-EZ_CAyhBNxWXNsvLiA5Csg-1; Thu, 14 Sep 2023 13:58:53 -0400 X-MC-Unique: EZ_CAyhBNxWXNsvLiA5Csg-1 Received: by mail-qv1-f70.google.com with SMTP id 6a1803df08f44-64943195f29so13168356d6.2 for ; Thu, 14 Sep 2023 10:58:53 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694714331; x=1695319131; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=u2NK0kTh0JhgbuxHuwB20u7hC6VkkacylDJv8O/TVLI=; b=dNxZHmXseqyIbpWVVlKM7saravOWU3LzI7YlAsdcmKp+3fOFv0eOA/x9Q31rdeK8Pf aT1THKy1oGjCxMLQnpphCpb6Z9TRSDNLHkN+5OxmFqDz4DG9gsWvWOB+Tgy4IFFKeZEc 36UUa5wnIAfO6Wtd+ioiBQbjDOzm5gxQBUcUhetPonGZbUwQ8ZR1qfoQOxVmStN9cnAc zI7vcNIl0Q7A1BbOV4xaDuarypRNXOgZLOBSvX3rF2b3kk4cU2FEq5ik2NtfTN07uIBL 29tzY7o3A2yzqbYQ/5rJgIMMQNug/45B8vWgdBzwQxfIqFtSDgNftxiJODXmbywojJVf bWzQ== X-Gm-Message-State: AOJu0YzlSbjGotJAAF+l0Yki9UlWSldxscgbmMVd3VNi6VqwoTTs/d3M sG9ZM6gjEU9LzGwW2xliXyENsCk3Ldg1rOHDZmTH0vwjeWRGGYzHaEe9kzIyyzC2bsD5sp4SioW OclAAnwYferX8aToh2tkpd0qIkE1Z4NqrUcUUUnW3TfZ9uedrQYnWGx45s8wvzwZh/uA24G24sg AADQ== X-Received: by 2002:a05:6214:808:b0:64f:7d13:3757 with SMTP id df8-20020a056214080800b0064f7d133757mr6208135qvb.11.1694714331553; Thu, 14 Sep 2023 10:58:51 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGyktXMUFZV4CX2wfMtgCaT2t+6wAFrWNvyKXODckkpmvOWMvdpPUN+Xa2E7yarq7j0cz9ORA== X-Received: by 2002:a05:6214:808:b0:64f:7d13:3757 with SMTP id df8-20020a056214080800b0064f7d133757mr6208122qvb.11.1694714331282; Thu, 14 Sep 2023 10:58:51 -0700 (PDT) Received: from fedora.redhat.com ([2600:4040:7c46:e800:32a2:d966:1af4:8863]) by smtp.gmail.com with ESMTPSA id d1-20020a0cf0c1000000b0064733ac9a9dsm628489qvl.122.2023.09.14.10.58.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 Sep 2023 10:58:48 -0700 (PDT) From: Tyler Fanelli To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, mtosatti@redhat.com, stefanha@redhat.com, Tyler Fanelli Subject: [RFC PATCH 5/8] i386/sev: Replace LAUNCH_UPDATE_VMSA ioctl with sev library equivalent Date: Thu, 14 Sep 2023 13:58:32 -0400 Message-Id: <20230914175835.382972-6-tfanelli@redhat.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230914175835.382972-1-tfanelli@redhat.com> References: <20230914175835.382972-1-tfanelli@redhat.com> MIME-Version: 1.0 Received-SPF: pass client-ip=170.10.133.124; envelope-from=tfanelli@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org The LAUNCH_UPDATE_VMSA API takes the VM's file descriptor, as well as a field for any firmware errors as input. If this API ioctl call fails, fw_error will be set accordingly. Signed-off-by: Tyler Fanelli --- target/i386/sev.c | 29 +++++++++-------------------- 1 file changed, 9 insertions(+), 20 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index 615021a1a3..adb35291e8 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -715,27 +715,14 @@ sev_read_file_base64(const char *filename, guchar **data, gsize *len) return 0; } -static int -sev_launch_update_vmsa(SevGuestState *sev) -{ - int ret, fw_error; - - ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_UPDATE_VMSA, NULL, &fw_error); - if (ret) { - error_report("%s: LAUNCH_UPDATE_VMSA ret=%d fw_error=%d '%s'", - __func__, ret, fw_error, fw_error_to_str(fw_error)); - } - - return ret; -} - static void sev_launch_get_measure(Notifier *notifier, void *unused) { SevGuestState *sev = sev_guest; - int ret, error; + int ret, fw_error; g_autofree guchar *data = NULL; struct kvm_sev_launch_measure measurement = {}; + KVMState *s = kvm_state; if (!sev_check_state(sev, SEV_STATE_LAUNCH_UPDATE)) { return; @@ -743,18 +730,20 @@ sev_launch_get_measure(Notifier *notifier, void *unused) if (sev_es_enabled()) { /* measure all the VM save areas before getting launch_measure */ - ret = sev_launch_update_vmsa(sev); + ret = sev_launch_update_vmsa(s->vmfd, &fw_error); if (ret) { + error_report("%s: LAUNCH_UPDATE_VMSA ret=%d fw_error=%d '%s'", + __func__, ret, fw_error, fw_error_to_str(fw_error)); exit(1); } } /* query the measurement blob length */ ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_MEASURE, - &measurement, &error); + &measurement, &fw_error); if (!measurement.len) { error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'", - __func__, ret, error, fw_error_to_str(errno)); + __func__, ret, fw_error, fw_error_to_str(fw_error)); return; } @@ -763,10 +752,10 @@ sev_launch_get_measure(Notifier *notifier, void *unused) /* get the measurement blob */ ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_MEASURE, - &measurement, &error); + &measurement, &fw_error); if (ret) { error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'", - __func__, ret, error, fw_error_to_str(errno)); + __func__, ret, fw_error, fw_error_to_str(fw_error)); return; } From patchwork Thu Sep 14 17:58:33 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tyler Fanelli X-Patchwork-Id: 1834378 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=FX61t6c9; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=patchwork.ozlabs.org) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RmlTf70Hsz1yh0 for ; Fri, 15 Sep 2023 04:00:06 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qgqcI-0003Nd-Qy; Thu, 14 Sep 2023 13:59:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqcG-0003N0-En for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:59:00 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqcE-0002Hy-Ht for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:58:59 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1694714337; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ug4FqkMiYbFT/Zpgx7iTP8cWdhAiF2GO+LZBA3MJDko=; b=FX61t6c9TxZ4Q7/0HYmskJreSZz5hBH4ksu/mAaPtL9YmuuWXlcVToyqx6CMRg4cER9E5m LgRl72kU0WQKSQIIfoh0jbhYMNavfssNViqA532wAIsbDyYf6SQsnKv+gq6xu2zMEnVOj1 XnB4H1a6wvDWefggKwGZmZq8tFmgiHY= Received: from mail-vs1-f71.google.com (mail-vs1-f71.google.com [209.85.217.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-633-xAh1yKg-NTqjex_7o121XA-1; Thu, 14 Sep 2023 13:58:56 -0400 X-MC-Unique: xAh1yKg-NTqjex_7o121XA-1 Received: by mail-vs1-f71.google.com with SMTP id ada2fe7eead31-44d4c4ff288so554998137.1 for ; Thu, 14 Sep 2023 10:58:56 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694714334; x=1695319134; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ug4FqkMiYbFT/Zpgx7iTP8cWdhAiF2GO+LZBA3MJDko=; b=K65P8BAEJNVn5xijQJGx8c3Q/ZlpYOi2ec90jwQZSzlT0ddhKbwVvbkRFBf8/D3Scr Xnnvw56atyRp2n4Yo936V3nf/CVMed3RX9uLvbaHaUsDIIEohqTEUKKotYhrtKcjoQoy TX8mx41pXpoIs9VtUOuUoJj+JukkXghogXOw8i9wEQZ+qM02s1SgqdGX7BKjuaeBGKCR z77cOGDsYsXIWqv0nabenQqluCe3Y+welhRH/gjtS2G/tI/kRIq4kuGTAu4EtecQi0lW 9L1YBqiSCH3zRim0AvMQKYxowhXVck76q5ueRN1D+8hADBRjjwgPZe8NDeh0C2+9kjPI 2mkQ== X-Gm-Message-State: AOJu0Yxfmp6bPtPJist+tfBnE1nlXInamlDlMQ8LXIiw61RH6LiCESfc j6TmDEVYLaov1WD/0DzTpVgVO04ASCE+69ET23Qs8ouNN6yqv0QBvpmzKZ5V5Cso6bIU+OJmQCZ PQO7jHhU2fUCXUKwkoDpoi2907zCxiZXq9SzyhtlR8sM7g2ncgeouQiFrDpb5V5slq6FAuQ2W0B stHQ== X-Received: by 2002:a05:6102:443:b0:44e:bf83:4a19 with SMTP id e3-20020a056102044300b0044ebf834a19mr6118993vsq.15.1694714334656; Thu, 14 Sep 2023 10:58:54 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGaUcsIKRimpihSQX9ffH+ZFEFGMu+EBmaX5dty4FQTdDeaOMktKG+MAhQaM27QoXdzcVNCNA== X-Received: by 2002:a05:6102:443:b0:44e:bf83:4a19 with SMTP id e3-20020a056102044300b0044ebf834a19mr6118979vsq.15.1694714334419; Thu, 14 Sep 2023 10:58:54 -0700 (PDT) Received: from fedora.redhat.com ([2600:4040:7c46:e800:32a2:d966:1af4:8863]) by smtp.gmail.com with ESMTPSA id d1-20020a0cf0c1000000b0064733ac9a9dsm628489qvl.122.2023.09.14.10.58.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 Sep 2023 10:58:51 -0700 (PDT) From: Tyler Fanelli To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, mtosatti@redhat.com, stefanha@redhat.com, Tyler Fanelli Subject: [RFC PATCH 6/8] i386/sev: Replace LAUNCH_MEASURE ioctl with sev library equivalent Date: Thu, 14 Sep 2023 13:58:33 -0400 Message-Id: <20230914175835.382972-7-tfanelli@redhat.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230914175835.382972-1-tfanelli@redhat.com> References: <20230914175835.382972-1-tfanelli@redhat.com> MIME-Version: 1.0 Received-SPF: pass client-ip=170.10.129.124; envelope-from=tfanelli@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -5 X-Spam_score: -0.6 X-Spam_bar: / X-Spam_report: (-0.6 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SORBS_WEB=1.5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org The LAUNCH_MEASURE API returns the measurement of the launched guest's memory pages (and VMCB save areas if ES is enabled). The caller is responsible for ensuring that the pointer (identified as the "data" argument) is a valid pointer that can hold the guest's measurement (a measurement in SEV is 48 bytes in size). If this API ioctl call fails, fw_error will be set accordingly. Signed-off-by: Tyler Fanelli --- target/i386/sev.c | 24 ++++++------------------ target/i386/sev.h | 2 ++ 2 files changed, 8 insertions(+), 18 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index adb35291e8..f53ff140e3 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -721,7 +721,6 @@ sev_launch_get_measure(Notifier *notifier, void *unused) SevGuestState *sev = sev_guest; int ret, fw_error; g_autofree guchar *data = NULL; - struct kvm_sev_launch_measure measurement = {}; KVMState *s = kvm_state; if (!sev_check_state(sev, SEV_STATE_LAUNCH_UPDATE)) { @@ -738,31 +737,20 @@ sev_launch_get_measure(Notifier *notifier, void *unused) } } - /* query the measurement blob length */ - ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_MEASURE, - &measurement, &fw_error); - if (!measurement.len) { - error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'", - __func__, ret, fw_error, fw_error_to_str(fw_error)); - return; - } + data = g_malloc(SEV_MEASUREMENT_SIZE); - data = g_new0(guchar, measurement.len); - measurement.uaddr = (unsigned long)data; - - /* get the measurement blob */ - ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_MEASURE, - &measurement, &fw_error); + ret = sev_launch_measure(s->vmfd, data, &fw_error); if (ret) { - error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'", - __func__, ret, fw_error, fw_error_to_str(fw_error)); + error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'", __func__, + ret, fw_error, fw_error_to_str(fw_error)); + return; } sev_set_guest_state(sev, SEV_STATE_LAUNCH_SECRET); /* encode the measurement value and emit the event */ - sev->measurement = g_base64_encode(data, measurement.len); + sev->measurement = g_base64_encode(data, SEV_MEASUREMENT_SIZE); trace_kvm_sev_launch_measurement(sev->measurement); } diff --git a/target/i386/sev.h b/target/i386/sev.h index e7499c95b1..acb181358e 100644 --- a/target/i386/sev.h +++ b/target/i386/sev.h @@ -38,6 +38,8 @@ typedef struct SevKernelLoaderContext { size_t cmdline_size; } SevKernelLoaderContext; +#define SEV_MEASUREMENT_SIZE 48 + #ifdef CONFIG_SEV bool sev_enabled(void); bool sev_es_enabled(void); From patchwork Thu Sep 14 17:58:34 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tyler Fanelli X-Patchwork-Id: 1834380 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=Wjwkc9g8; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=patchwork.ozlabs.org) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RmlTm6Stqz1yh0 for ; Fri, 15 Sep 2023 04:00:12 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qgqcL-0003OW-S2; Thu, 14 Sep 2023 13:59:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqcK-0003O3-02 for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:59:04 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqcH-0002IH-DV for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:59:03 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1694714339; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3fu8ktLm0OkYnObZYuT5ndv2RWlsc6KNoxE7MI7M9Gk=; b=Wjwkc9g8lhIbZoPdIPdNuj+uZqQOvCaSuwUBh8fP9SWzjx0hpByu2762oXoNW5vhiUkhZG +DnjMj9cfOdc0XEJ0+3KhMMv34ziNcle8dWUFAiimAdSgXFFFGLKBPZVyVi+61hUKDNCga f2Szu3fyMqnBWrnAjH2/MF/Vp5jLX0U= Received: from mail-qv1-f72.google.com (mail-qv1-f72.google.com [209.85.219.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-96-vajxAb8PNTixoA_O_aFZSw-1; Thu, 14 Sep 2023 13:58:58 -0400 X-MC-Unique: vajxAb8PNTixoA_O_aFZSw-1 Received: by mail-qv1-f72.google.com with SMTP id 6a1803df08f44-63d0c38e986so13831056d6.1 for ; Thu, 14 Sep 2023 10:58:58 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694714337; x=1695319137; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=3fu8ktLm0OkYnObZYuT5ndv2RWlsc6KNoxE7MI7M9Gk=; b=hrP14mt6M6qK72fQ+b06stWfOeigMaT+gMC42l9GvkfJG4HZtvPte9YoNc7KYkhwoK MMQbyqypglyJ1E+EMjMHiUogoP9DAr5Z+tolCgCP+LfpCoze80/WUHMuQyXuhk8I1HYr WM6y9UC3m5yvt9eDNMyODLznReLGqt0CfUlVhV/K7VhgO+t9qqBR7cbQZZtAdO6prQZc Yi7598SOC3OL4jIRCbPunGdhVibGzS1e5UB4RyXoK9VyTOiND+Amej7TmkTRkCx+fr1o oNHQ7uvRbgDZVQAU6QLWBHwUNIIKyhTLGwKT0lM2VkVaR2BSW2Qr/ylyFXGY1RxxR9DK 09nQ== X-Gm-Message-State: AOJu0YzJU9p29s+md0rIP14U7YEXJhPIWMUgvZYvaK4dRrDJ3ZuNGp4m V0AxoWBlzRKZ4Bvv40vundjnk1zHUi0HFvuz/YvyOfKj/KK6Oakgj1gXSvx5vHWXYciQykRpN9+ HOuRx2LExyudvoURp9ZmMydPtn0ZewvEhrTnZxxPYStFouQkJXSW6gHFIPwqqel3DCNmsPQgIiy O+UA== X-Received: by 2002:a0c:ebc2:0:b0:651:6edd:c6c7 with SMTP id k2-20020a0cebc2000000b006516eddc6c7mr6019868qvq.31.1694714337059; Thu, 14 Sep 2023 10:58:57 -0700 (PDT) X-Google-Smtp-Source: AGHT+IE8vdVwR/lq17Q/TOoGHaygSrsEDrIBgD69MbbeSs4etIhsoMxdLz74duh/XtOvyvb8PDkf9A== X-Received: by 2002:a0c:ebc2:0:b0:651:6edd:c6c7 with SMTP id k2-20020a0cebc2000000b006516eddc6c7mr6019851qvq.31.1694714336793; Thu, 14 Sep 2023 10:58:56 -0700 (PDT) Received: from fedora.redhat.com ([2600:4040:7c46:e800:32a2:d966:1af4:8863]) by smtp.gmail.com with ESMTPSA id d1-20020a0cf0c1000000b0064733ac9a9dsm628489qvl.122.2023.09.14.10.58.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 Sep 2023 10:58:54 -0700 (PDT) From: Tyler Fanelli To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, mtosatti@redhat.com, stefanha@redhat.com, Tyler Fanelli Subject: [RFC PATCH 7/8] i386/sev: Replace LAUNCH_SECRET ioctl with sev library equivalent Date: Thu, 14 Sep 2023 13:58:34 -0400 Message-Id: <20230914175835.382972-8-tfanelli@redhat.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230914175835.382972-1-tfanelli@redhat.com> References: <20230914175835.382972-1-tfanelli@redhat.com> MIME-Version: 1.0 Received-SPF: pass client-ip=170.10.133.124; envelope-from=tfanelli@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org The LAUNCH_SECRET API can inject a secret into the VM once the measurement has been retrieved. If this API ioctl call fails, fw_error will be set accordingly. Signed-off-by: Tyler Fanelli --- target/i386/sev.c | 105 ++++++++++++++++------------------------------ target/i386/sev.h | 2 - 2 files changed, 36 insertions(+), 71 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index f53ff140e3..a4510b5437 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -983,88 +983,44 @@ sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp) return 0; } -int sev_inject_launch_secret(const char *packet_hdr, const char *secret, - uint64_t gpa, Error **errp) -{ - struct kvm_sev_launch_secret input; - g_autofree guchar *data = NULL, *hdr = NULL; - int error, ret = 1; - void *hva; - gsize hdr_sz = 0, data_sz = 0; - MemoryRegion *mr = NULL; - - if (!sev_guest) { - error_setg(errp, "SEV not enabled for guest"); - return 1; - } - - /* secret can be injected only in this state */ - if (!sev_check_state(sev_guest, SEV_STATE_LAUNCH_SECRET)) { - error_setg(errp, "SEV: Not in correct state. (LSECRET) %x", - sev_guest->state); - return 1; - } - - hdr = g_base64_decode(packet_hdr, &hdr_sz); - if (!hdr || !hdr_sz) { - error_setg(errp, "SEV: Failed to decode sequence header"); - return 1; - } - - data = g_base64_decode(secret, &data_sz); - if (!data || !data_sz) { - error_setg(errp, "SEV: Failed to decode data"); - return 1; - } - - hva = gpa2hva(&mr, gpa, data_sz, errp); - if (!hva) { - error_prepend(errp, "SEV: Failed to calculate guest address: "); - return 1; - } - - input.hdr_uaddr = (uint64_t)(unsigned long)hdr; - input.hdr_len = hdr_sz; - - input.trans_uaddr = (uint64_t)(unsigned long)data; - input.trans_len = data_sz; - - input.guest_uaddr = (uint64_t)(unsigned long)hva; - input.guest_len = data_sz; - - trace_kvm_sev_launch_secret(gpa, input.guest_uaddr, - input.trans_uaddr, input.trans_len); - - ret = sev_ioctl(sev_guest->sev_fd, KVM_SEV_LAUNCH_SECRET, - &input, &error); - if (ret) { - error_setg(errp, "SEV: failed to inject secret ret=%d fw_error=%d '%s'", - ret, error, fw_error_to_str(error)); - return ret; - } - - return 0; -} - #define SEV_SECRET_GUID "4c2eb361-7d9b-4cc3-8081-127c90d3d294" struct sev_secret_area { uint32_t base; uint32_t size; }; -void qmp_sev_inject_launch_secret(const char *packet_hdr, - const char *secret, +void qmp_sev_inject_launch_secret(const char *hdr_b64, + const char *secret_b64, bool has_gpa, uint64_t gpa, Error **errp) { + int ret, fw_error = 0; + g_autofree guchar *hdr = NULL, *secret = NULL; + uint8_t *data = NULL; + KVMState *s = kvm_state; + gsize hdr_sz = 0, secret_sz = 0; + MemoryRegion *mr = NULL; + void *hva; + struct sev_secret_area *area = NULL; + if (!sev_enabled()) { error_setg(errp, "SEV not enabled for guest"); return; } - if (!has_gpa) { - uint8_t *data; - struct sev_secret_area *area; + hdr = g_base64_decode(hdr_b64, &hdr_sz); + if (!hdr || !hdr_sz) { + error_setg(errp, "SEV: Failed to decode sequence header"); + return; + } + + secret = g_base64_decode(secret_b64, &secret_sz); + if (!secret || !secret_sz) { + error_setg(errp, "SEV: Failed to decode secret"); + return; + } + + if (!has_gpa) { if (!pc_system_ovmf_table_find(SEV_SECRET_GUID, &data, NULL)) { error_setg(errp, "SEV: no secret area found in OVMF," " gpa must be specified."); @@ -1074,7 +1030,18 @@ void qmp_sev_inject_launch_secret(const char *packet_hdr, gpa = area->base; } - sev_inject_launch_secret(packet_hdr, secret, gpa, errp); + hva = gpa2hva(&mr, gpa, secret_sz, errp); + if (!hva) { + error_prepend(errp, "SEV: Failed to calculate guest address: "); + return; + } + + ret = sev_inject_launch_secret(s->vmfd, hdr, secret, secret_sz, + hva, &fw_error); + if (ret < 0) { + error_setg(errp, "%s: LAUNCH_SECRET ret=%d fw_error=%d '%s'", __func__, + ret, fw_error, fw_error_to_str(fw_error)); + } } static int diff --git a/target/i386/sev.h b/target/i386/sev.h index acb181358e..f1af28eca0 100644 --- a/target/i386/sev.h +++ b/target/i386/sev.h @@ -53,8 +53,6 @@ uint32_t sev_get_reduced_phys_bits(void); bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp); int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp); -int sev_inject_launch_secret(const char *hdr, const char *secret, - uint64_t gpa, Error **errp); int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size); void sev_es_set_reset_vector(CPUState *cpu); From patchwork Thu Sep 14 17:58:35 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tyler Fanelli X-Patchwork-Id: 1834382 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=KvmncdtT; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=patchwork.ozlabs.org) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RmlVD5BlRz1yh0 for ; Fri, 15 Sep 2023 04:00:36 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qgqcL-0003OT-Cw; Thu, 14 Sep 2023 13:59:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqcJ-0003Nk-Mv for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:59:03 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgqcI-0002IU-Ao for qemu-devel@nongnu.org; Thu, 14 Sep 2023 13:59:03 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1694714341; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ubf6Ym3Oq8P1zXfUv1TaYbk1/ksNBIfco122yAwkkCU=; b=KvmncdtTbYoxV0WJ2Eku79aEeei0dPSxO2ObwN0aHxAkYdCgCgUl4/y+FEgGPIxwRiTUHE at/cfaDSjxBqubd6wqDijvhHEP38KMOU04HAd138ZM3b+mZ3DiGCEECA8h29BdX1sect55 GZnlYS9WF7GGJYttQcsWJmbA05sgt8o= Received: from mail-qv1-f71.google.com (mail-qv1-f71.google.com [209.85.219.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-272-8ZDP6eGPOo6nk-W9rfSNUg-1; Thu, 14 Sep 2023 13:59:00 -0400 X-MC-Unique: 8ZDP6eGPOo6nk-W9rfSNUg-1 Received: by mail-qv1-f71.google.com with SMTP id 6a1803df08f44-655d3c7e27bso14374456d6.0 for ; Thu, 14 Sep 2023 10:59:00 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694714339; x=1695319139; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ubf6Ym3Oq8P1zXfUv1TaYbk1/ksNBIfco122yAwkkCU=; b=IHNEgdgjsbl/Ko0oUBhGm5H2qdC6z1pf7d04l++KsolQxshl1sctBaqeegU+1HQv6i azdWDzJdbJD3UyHZzdVDIrlAyJotbbcm9xJVVuY/GwacOYKyNOCUA6FI6jil4sbk0RJV dn5yzxcdStQ5qixcjQ7xHbh0cXjIeX6Uybt+aygOP19+An9OiCa8fEz0ln+PDOdNJjnd pwykGmmVzn+VzjyKdAgeUNeca5uDeFBx41zfNeTvXt9cG9W/uscXi8riQL0QyRHwO7ip q/sWe0v/91betHkQXGZOEx5TPaAFeRljpozVbowaP4Pb2AMADzzo7A+iwA74QsS/o7jG KA5g== X-Gm-Message-State: AOJu0YzM0NSLbjohpjPCpr3M7LyGYYqZr/YquXoST2lsrHppymZCHoyv AhLJ4TZAzQr4eAY7r8mKXkxgKYgzVKJhwGzaAKql/MWLWOPn8qLVdkd+3isGjqivQvHYANJaV8h /wJ49qKTca58C397maAmcI/nIwoYLtp4d6uYxcPyqjc20lFsGN+DbNBgjtKnAuuTYJTanjKcytA 6hXQ== X-Received: by 2002:a05:6214:4a90:b0:64f:92dc:3de2 with SMTP id pi16-20020a0562144a9000b0064f92dc3de2mr6784207qvb.53.1694714339196; Thu, 14 Sep 2023 10:58:59 -0700 (PDT) X-Google-Smtp-Source: AGHT+IG0d0qkKXvyyHs1MRiX9eIp0V1nRA4A5Z5QxKY6W4kB32tHimgTImPWpQehxpTp9NFkLh6vWw== X-Received: by 2002:a05:6214:4a90:b0:64f:92dc:3de2 with SMTP id pi16-20020a0562144a9000b0064f92dc3de2mr6784197qvb.53.1694714338996; Thu, 14 Sep 2023 10:58:58 -0700 (PDT) Received: from fedora.redhat.com ([2600:4040:7c46:e800:32a2:d966:1af4:8863]) by smtp.gmail.com with ESMTPSA id d1-20020a0cf0c1000000b0064733ac9a9dsm628489qvl.122.2023.09.14.10.58.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 Sep 2023 10:58:57 -0700 (PDT) From: Tyler Fanelli To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, mtosatti@redhat.com, stefanha@redhat.com, Tyler Fanelli Subject: [RFC PATCH 8/8] i386/sev: Replace LAUNCH_FINISH ioctl with sev library equivalent Date: Thu, 14 Sep 2023 13:58:35 -0400 Message-Id: <20230914175835.382972-9-tfanelli@redhat.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230914175835.382972-1-tfanelli@redhat.com> References: <20230914175835.382972-1-tfanelli@redhat.com> MIME-Version: 1.0 Received-SPF: pass client-ip=170.10.133.124; envelope-from=tfanelli@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org The LAUNCH_FINISH ioctl finishes the guest launch flow and transitions the guest into a state ready to be run. If this API ioctl call fails, fw_error will be set accordingly. Signed-off-by: Tyler Fanelli --- target/i386/sev.c | 38 ++++++++++++++++---------------------- 1 file changed, 16 insertions(+), 22 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index a4510b5437..e52dcc67c3 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -785,35 +785,29 @@ static Notifier sev_machine_done_notify = { .notify = sev_launch_get_measure, }; -static void -sev_launch_finish(SevGuestState *sev) -{ - int ret, error; - - trace_kvm_sev_launch_finish(); - ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_FINISH, 0, &error); - if (ret) { - error_report("%s: LAUNCH_FINISH ret=%d fw_error=%d '%s'", - __func__, ret, error, fw_error_to_str(error)); - exit(1); - } - - sev_set_guest_state(sev, SEV_STATE_RUNNING); - - /* add migration blocker */ - error_setg(&sev_mig_blocker, - "SEV: Migration is not implemented"); - migrate_add_blocker(sev_mig_blocker, &error_fatal); -} - static void sev_vm_state_change(void *opaque, bool running, RunState state) { SevGuestState *sev = opaque; + int ret, fw_error; + KVMState *s = kvm_state; if (running) { if (!sev_check_state(sev, SEV_STATE_RUNNING)) { - sev_launch_finish(sev); + trace_kvm_sev_launch_finish(); + ret = sev_launch_finish(s->vmfd, &fw_error); + if (ret) { + error_report("%s: LAUNCH_FINISH ret=%d fw_error=%d '%s'", + __func__, ret, fw_error, + fw_error_to_str(fw_error)); + exit(1); + } + + sev_set_guest_state(sev, SEV_STATE_RUNNING); + + // add migration blocker. + error_setg(&sev_mig_blocker, "SEV: Migration is not implemented"); + migrate_add_blocker(sev_mig_blocker, &error_fatal); } } }