You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
123 lines
4.4 KiB
123 lines
4.4 KiB
1 month ago
|
From 0f7432f2b968298b64fd243df793b176f67a538f Mon Sep 17 00:00:00 2001
|
||
|
|
From: Brijesh Singh <brijesh.singh@amd.com>
|
||
|
|
Date: Thu, 30 May 2024 06:16:27 -0500
|
||
|
|
Subject: [PATCH 067/100] i386/sev: Add the SNP launch start context
|
||
|
|
|
||
|
|
RH-Author: Paolo Bonzini <pbonzini@redhat.com>
|
||
|
|
RH-MergeRequest: 245: SEV-SNP support
|
||
|
|
RH-Jira: RHEL-39544
|
||
|
|
RH-Acked-by: Thomas Huth <thuth@redhat.com>
|
||
|
|
RH-Acked-by: Bandan Das <bdas@redhat.com>
|
||
|
|
RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
||
|
|
RH-Commit: [67/91] 63759a25a413a7a9a7274fb4c3b8bc2528634855 (bonzini/rhel-qemu-kvm)
|
||
|
|
|
||
|
|
The SNP_LAUNCH_START is called first to create a cryptographic launch
|
||
|
|
context within the firmware.
|
||
|
|
|
||
|
|
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
|
||
|
|
Signed-off-by: Michael Roth <michael.roth@amd.com>
|
||
|
|
Co-developed-by: Pankaj Gupta <pankaj.gupta@amd.com>
|
||
|
|
Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
|
||
|
|
Message-ID: <20240530111643.1091816-16-pankaj.gupta@amd.com>
|
||
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
||
|
|
(cherry picked from commit d3107f882ec22cfb211eab7efa0c4e95f5ce11bb)
|
||
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
||
|
|
---
|
||
|
|
target/i386/sev.c | 39 +++++++++++++++++++++++++++++++++++++++
|
||
|
|
target/i386/trace-events | 1 +
|
||
|
|
2 files changed, 40 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/target/i386/sev.c b/target/i386/sev.c
|
||
|
|
index 43d1c48bd9..e89b87d2f5 100644
|
||
|
|
--- a/target/i386/sev.c
|
||
|
|
+++ b/target/i386/sev.c
|
||
|
|
@@ -39,6 +39,7 @@
|
||
|
|
#include "confidential-guest.h"
|
||
|
|
#include "hw/i386/pc.h"
|
||
|
|
#include "exec/address-spaces.h"
|
||
|
|
+#include "qemu/queue.h"
|
||
|
|
|
||
|
|
OBJECT_DECLARE_TYPE(SevCommonState, SevCommonStateClass, SEV_COMMON)
|
||
|
|
OBJECT_DECLARE_TYPE(SevGuestState, SevCommonStateClass, SEV_GUEST)
|
||
|
|
@@ -115,6 +116,16 @@ struct SevSnpGuestState {
|
||
|
|
#define DEFAULT_SEV_DEVICE "/dev/sev"
|
||
|
|
#define DEFAULT_SEV_SNP_POLICY 0x30000
|
||
|
|
|
||
|
|
+typedef struct SevLaunchUpdateData {
|
||
|
|
+ QTAILQ_ENTRY(SevLaunchUpdateData) next;
|
||
|
|
+ hwaddr gpa;
|
||
|
|
+ void *hva;
|
||
|
|
+ uint64_t len;
|
||
|
|
+ int type;
|
||
|
|
+} SevLaunchUpdateData;
|
||
|
|
+
|
||
|
|
+static QTAILQ_HEAD(, SevLaunchUpdateData) launch_update;
|
||
|
|
+
|
||
|
|
#define SEV_INFO_BLOCK_GUID "00f771de-1a7e-4fcb-890e-68c77e2fb44e"
|
||
|
|
typedef struct __attribute__((__packed__)) SevInfoBlock {
|
||
|
|
/* SEV-ES Reset Vector Address */
|
||
|
|
@@ -674,6 +685,31 @@ sev_read_file_base64(const char *filename, guchar **data, gsize *len)
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
+static int
|
||
|
|
+sev_snp_launch_start(SevCommonState *sev_common)
|
||
|
|
+{
|
||
|
|
+ int fw_error, rc;
|
||
|
|
+ SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(sev_common);
|
||
|
|
+ struct kvm_sev_snp_launch_start *start = &sev_snp_guest->kvm_start_conf;
|
||
|
|
+
|
||
|
|
+ trace_kvm_sev_snp_launch_start(start->policy,
|
||
|
|
+ sev_snp_guest->guest_visible_workarounds);
|
||
|
|
+
|
||
|
|
+ rc = sev_ioctl(sev_common->sev_fd, KVM_SEV_SNP_LAUNCH_START,
|
||
|
|
+ start, &fw_error);
|
||
|
|
+ if (rc < 0) {
|
||
|
|
+ error_report("%s: SNP_LAUNCH_START ret=%d fw_error=%d '%s'",
|
||
|
|
+ __func__, rc, fw_error, fw_error_to_str(fw_error));
|
||
|
|
+ return 1;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
+ QTAILQ_INIT(&launch_update);
|
||
|
|
+
|
||
|
|
+ sev_set_guest_state(sev_common, SEV_STATE_LAUNCH_UPDATE);
|
||
|
|
+
|
||
|
|
+ return 0;
|
||
|
|
+}
|
||
|
|
+
|
||
|
|
static int
|
||
|
|
sev_launch_start(SevCommonState *sev_common)
|
||
|
|
{
|
||
|
|
@@ -1003,6 +1039,7 @@ static int sev_common_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
|
||
|
|
}
|
||
|
|
|
||
|
|
ret = klass->launch_start(sev_common);
|
||
|
|
+
|
||
|
|
if (ret) {
|
||
|
|
error_setg(errp, "%s: failed to create encryption context", __func__);
|
||
|
|
return -1;
|
||
|
|
@@ -1794,9 +1831,11 @@ sev_snp_guest_class_init(ObjectClass *oc, void *data)
|
||
|
|
SevCommonStateClass *klass = SEV_COMMON_CLASS(oc);
|
||
|
|
X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
|
||
|
|
|
||
|
|
+ klass->launch_start = sev_snp_launch_start;
|
||
|
|
klass->kvm_init = sev_snp_kvm_init;
|
||
|
|
x86_klass->kvm_type = sev_snp_kvm_type;
|
||
|
|
|
||
|
|
+
|
||
|
|
object_class_property_add(oc, "policy", "uint64",
|
||
|
|
sev_snp_guest_get_policy,
|
||
|
|
sev_snp_guest_set_policy, NULL, NULL);
|
||
|
|
diff --git a/target/i386/trace-events b/target/i386/trace-events
|
||
|
|
index 2cd8726eeb..cb26d8a925 100644
|
||
|
|
--- a/target/i386/trace-events
|
||
|
|
+++ b/target/i386/trace-events
|
||
|
|
@@ -11,3 +11,4 @@ kvm_sev_launch_measurement(const char *value) "data %s"
|
||
|
|
kvm_sev_launch_finish(void) ""
|
||
|
|
kvm_sev_launch_secret(uint64_t hpa, uint64_t hva, uint64_t secret, int len) "hpa 0x%" PRIx64 " hva 0x%" PRIx64 " data 0x%" PRIx64 " len %d"
|
||
|
|
kvm_sev_attestation_report(const char *mnonce, const char *data) "mnonce %s data %s"
|
||
|
|
+kvm_sev_snp_launch_start(uint64_t policy, char *gosvw) "policy 0x%" PRIx64 " gosvw %s"
|
||
|
|
--
|
||
|
|
2.39.3
|
||
|
|
|