49812da5a8
- Add AMD SEV (Secure Encrypted Virtualization) support by taking the v7 series of the patches posted to qemu ml. (fate#322124) - Update python3 related patches now that they are upstream OBS-URL: https://build.opensuse.org/request/show/574394 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=390
127 lines
3.5 KiB
Diff
127 lines
3.5 KiB
Diff
From bcbe925e0f93234b0f0f6ecf4e5b8d400a46a691 Mon Sep 17 00:00:00 2001
|
|
From: Brijesh Singh <brijesh.singh@amd.com>
|
|
Date: Tue, 6 Feb 2018 19:08:10 -0600
|
|
Subject: [PATCH] sev: add command to encrypt guest memory region
|
|
|
|
The KVM_SEV_LAUNCH_UPDATE_DATA command is used to encrypt a guest memory
|
|
region using the VM Encryption Key created using LAUNCH_START.
|
|
|
|
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
|
|
[BR: FATE#322124]
|
|
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
|
---
|
|
accel/kvm/kvm-all.c | 2 ++
|
|
accel/kvm/sev.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
|
|
accel/kvm/trace-events | 1 +
|
|
include/sysemu/sev.h | 1 +
|
|
4 files changed, 53 insertions(+)
|
|
|
|
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
|
|
index f1fb826f06..37f7c442dc 100644
|
|
--- a/accel/kvm/kvm-all.c
|
|
+++ b/accel/kvm/kvm-all.c
|
|
@@ -1675,6 +1675,8 @@ static int kvm_init(MachineState *ms)
|
|
if (!kvm_state->memcrypt_handle) {
|
|
goto err;
|
|
}
|
|
+
|
|
+ kvm_state->memcrypt_encrypt_data = sev_encrypt_data;
|
|
}
|
|
|
|
ret = kvm_arch_init(ms, s);
|
|
diff --git a/accel/kvm/sev.c b/accel/kvm/sev.c
|
|
index 2ecc6a1d1a..4414bda255 100644
|
|
--- a/accel/kvm/sev.c
|
|
+++ b/accel/kvm/sev.c
|
|
@@ -97,6 +97,12 @@ fw_error_to_str(int code)
|
|
return sev_fw_errlist[code];
|
|
}
|
|
|
|
+static bool
|
|
+sev_check_state(SevGuestState state)
|
|
+{
|
|
+ return current_sev_guest_state == state ? true : false;
|
|
+}
|
|
+
|
|
static void
|
|
sev_set_guest_state(SevGuestState new_state)
|
|
{
|
|
@@ -447,6 +453,36 @@ sev_launch_start(SEVState *s)
|
|
return 0;
|
|
}
|
|
|
|
+static int
|
|
+sev_launch_update_data(uint8_t *addr, uint64_t len)
|
|
+{
|
|
+ int ret, fw_error;
|
|
+ struct kvm_sev_launch_update_data *update;
|
|
+
|
|
+ if (addr == NULL || len <= 0) {
|
|
+ return 1;
|
|
+ }
|
|
+
|
|
+ update = g_malloc0(sizeof(*update));
|
|
+ if (!update) {
|
|
+ return 1;
|
|
+ }
|
|
+
|
|
+ update->uaddr = (__u64)addr;
|
|
+ update->len = len;
|
|
+ trace_kvm_sev_launch_update_data(addr, len);
|
|
+ ret = sev_ioctl(KVM_SEV_LAUNCH_UPDATE_DATA, update, &fw_error);
|
|
+ if (ret) {
|
|
+ error_report("%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'",
|
|
+ __func__, ret, fw_error, fw_error_to_str(fw_error));
|
|
+ goto err;
|
|
+ }
|
|
+
|
|
+err:
|
|
+ g_free(update);
|
|
+ return ret;
|
|
+}
|
|
+
|
|
void *
|
|
sev_guest_init(const char *id)
|
|
{
|
|
@@ -506,6 +542,19 @@ err:
|
|
return NULL;
|
|
}
|
|
|
|
+int
|
|
+sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len)
|
|
+{
|
|
+ assert(handle);
|
|
+
|
|
+ /* if SEV is in update state then encrypt the data else do nothing */
|
|
+ if (sev_check_state(SEV_STATE_LUPDATE)) {
|
|
+ return sev_launch_update_data(ptr, len);
|
|
+ }
|
|
+
|
|
+ return 0;
|
|
+}
|
|
+
|
|
static void
|
|
sev_register_types(void)
|
|
{
|
|
diff --git a/accel/kvm/trace-events b/accel/kvm/trace-events
|
|
index 5d993ca08e..bd92f868b7 100644
|
|
--- a/accel/kvm/trace-events
|
|
+++ b/accel/kvm/trace-events
|
|
@@ -19,3 +19,4 @@ kvm_memcrypt_register_region(void *addr, size_t len) "addr %p len 0x%lu"
|
|
kvm_memcrypt_unregister_region(void *addr, size_t len) "addr %p len 0x%lu"
|
|
kvm_sev_change_state(const char *old, const char *new) "%s -> %s"
|
|
kvm_sev_launch_start(int policy, void *session, void *pdh) "policy 0x%x session %p pdh %p"
|
|
+kvm_sev_launch_update_data(void *addr, uint64_t len) "addr %p len 0x%" PRIu64
|
|
diff --git a/include/sysemu/sev.h b/include/sysemu/sev.h
|
|
index 08014a9c94..f7af1a00c5 100644
|
|
--- a/include/sysemu/sev.h
|
|
+++ b/include/sysemu/sev.h
|
|
@@ -75,6 +75,7 @@ struct SEVState {
|
|
typedef struct SEVState SEVState;
|
|
|
|
void *sev_guest_init(const char *id);
|
|
+int sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len);
|
|
|
|
#endif
|
|
|