Lines Matching +full:kernel +full:- +full:policy
4 * Copyright Advanced Micro Devices 2016-2018
10 * See the COPYING file in the top-level directory.
18 #include <linux/psp-sev.h>
27 #include "qemu/error-report.h"
39 #include "monitor/hmp-target.h"
40 #include "qapi/qapi-commands-misc-i386.h"
41 #include "confidential-guest.h"
43 #include "system/address-spaces.h"
64 SevHashTableEntry kernel; member
73 uint8_t padding[ROUND_UP(sizeof(SevHashTable), 16) - sizeof(SevHashTable)];
78 #define SEV_INFO_BLOCK_GUID "00f771de-1a7e-4fcb-890e-68c77e2fb44e"
80 /* SEV-ES Reset Vector Address */
84 #define SEV_HASH_TABLE_RV_GUID "7255371f-3a3b-4b04-927b-1da6efa8d454"
136 * -object sev-guest,id=sev0 \
137 * -machine ...,memory-encryption=sev0
145 uint32_t policy; member
193 [SEV_RET_POLICY_FAILURE] = "Policy is not allowed",
210 [SEV_RET_SECURE_DATA_INVALID] = "Part-specific integrity check failure",
288 return sev_common->state == state ? true : false; in sev_check_state()
297 trace_kvm_sev_change_state(SevState_str(sev_common->state), in sev_set_guest_state()
299 sev_common->state = new_state; in sev_set_guest_state()
369 ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs; in sev_enabled()
377 ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs; in sev_snp_enabled()
385 ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs; in sev_es_enabled()
388 (sev_enabled() && SEV_GUEST(cgs)->policy & SEV_POLICY_ES); in sev_es_enabled()
394 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); in sev_get_cbit_position()
396 return sev_common ? sev_common->cbitpos : 0; in sev_get_cbit_position()
402 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); in sev_get_reduced_phys_bits()
404 return sev_common ? sev_common->reduced_phys_bits : 0; in sev_get_reduced_phys_bits()
410 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); in sev_get_info()
413 info->enabled = sev_enabled(); in sev_get_info()
415 if (info->enabled) { in sev_get_info()
416 info->api_major = sev_common->api_major; in sev_get_info()
417 info->api_minor = sev_common->api_minor; in sev_get_info()
418 info->build_id = sev_common->build_id; in sev_get_info()
419 info->state = sev_common->state; in sev_get_info()
422 info->sev_type = SEV_GUEST_TYPE_SEV_SNP; in sev_get_info()
423 info->u.sev_snp.snp_policy = in sev_get_info()
424 object_property_get_uint(OBJECT(sev_common), "policy", NULL); in sev_get_info()
426 info->sev_type = SEV_GUEST_TYPE_SEV; in sev_get_info()
427 info->u.sev.handle = SEV_GUEST(sev_common)->handle; in sev_get_info()
428 info->u.sev.policy = in sev_get_info()
430 "policy", NULL); in sev_get_info()
454 if (!info || !info->enabled) { in hmp_info_sev()
459 monitor_printf(mon, "SEV type: %s\n", SevGuestType_str(info->sev_type)); in hmp_info_sev()
460 monitor_printf(mon, "state: %s\n", SevState_str(info->state)); in hmp_info_sev()
461 monitor_printf(mon, "build: %d\n", info->build_id); in hmp_info_sev()
462 monitor_printf(mon, "api version: %d.%d\n", info->api_major, in hmp_info_sev()
463 info->api_minor); in hmp_info_sev()
467 info->u.sev_snp.snp_policy & SEV_SNP_POLICY_DBG ? "on" in hmp_info_sev()
470 info->u.sev_snp.snp_policy & SEV_SNP_POLICY_SMT ? "on" in hmp_info_sev()
473 monitor_printf(mon, "handle: %d\n", info->u.sev.handle); in hmp_info_sev()
475 info->u.sev.policy & SEV_POLICY_NODBG ? "off" : "on"); in hmp_info_sev()
476 monitor_printf(mon, "key-sharing: %s\n", in hmp_info_sev()
477 info->u.sev.policy & SEV_POLICY_NOKS ? "off" : "on"); in hmp_info_sev()
582 sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); in sev_get_capabilities()
584 sev_device = object_property_get_str(OBJECT(sev_common), "sev-device", in sev_get_capabilities()
609 cap->pdh = g_base64_encode(pdh_data, pdh_len); in sev_get_capabilities()
610 cap->cert_chain = g_base64_encode(cert_chain_data, cert_chain_len); in sev_get_capabilities()
611 cap->cpu0_id = g_base64_encode(cpu0_id_data, cpu0_id_len); in sev_get_capabilities()
614 cap->cbitpos = ebx & 0x3f; in sev_get_capabilities()
620 cap->reduced_phys_bits = 1; in sev_get_capabilities()
637 #define OVMF_SEV_META_DATA_GUID "dc886566-984a-4798-A75e-5585a7bf67cc"
657 metadata = (OvmfSevMetadata *)(flash_ptr + flash_size - data->offset); in pc_system_parse_sev_metadata()
658 if (memcmp(metadata->signature, "ASEV", 4) != 0 || in pc_system_parse_sev_metadata()
659 metadata->len < sizeof(OvmfSevMetadata) || in pc_system_parse_sev_metadata()
660 metadata->len > flash_size - data->offset) { in pc_system_parse_sev_metadata()
664 ovmf_sev_metadata_table = g_memdup2(metadata, metadata->len); in pc_system_parse_sev_metadata()
697 sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); in sev_get_attestation_report()
700 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT, in sev_get_attestation_report()
716 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT, in sev_get_attestation_report()
725 report->data = g_base64_encode(data, input.len); in sev_get_attestation_report()
727 trace_kvm_sev_attestation_report(mnonce, report->data); in sev_get_attestation_report()
746 error_report("SEV: Failed to read '%s' (%s)", filename, error->message); in sev_read_file_base64()
748 return -1; in sev_read_file_base64()
760 struct kvm_sev_snp_launch_start *start = &sev_snp_guest->kvm_start_conf; in sev_snp_launch_start()
762 trace_kvm_sev_snp_launch_start(start->policy, in sev_snp_launch_start()
763 sev_snp_guest->guest_visible_workarounds); in sev_snp_launch_start()
769 rc = sev_ioctl(sev_common->sev_fd, KVM_SEV_SNP_LAUNCH_START, in sev_snp_launch_start()
792 .handle = sev_guest->handle, .policy = sev_guest->policy in sev_launch_start()
796 if (sev_guest->session_file) { in sev_launch_start()
797 if (sev_read_file_base64(sev_guest->session_file, &session, &sz) < 0) { in sev_launch_start()
804 if (sev_guest->dh_cert_file) { in sev_launch_start()
805 if (sev_read_file_base64(sev_guest->dh_cert_file, &dh_cert, &sz) < 0) { in sev_launch_start()
812 trace_kvm_sev_launch_start(start.policy, session, dh_cert); in sev_launch_start()
813 rc = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_START, &start, &fw_error); in sev_launch_start()
821 sev_guest->handle = start.handle; in sev_launch_start()
836 if (old->count != new->count) { in sev_snp_cpuid_report_mismatches()
837 error_report("SEV-SNP: CPUID validation failed due to count mismatch, " in sev_snp_cpuid_report_mismatches()
838 "provided: %d, expected: %d", old->count, new->count); in sev_snp_cpuid_report_mismatches()
842 for (i = 0; i < old->count; i++) { in sev_snp_cpuid_report_mismatches()
845 old_func = &old->entries[i]; in sev_snp_cpuid_report_mismatches()
846 new_func = &new->entries[i]; in sev_snp_cpuid_report_mismatches()
849 error_report("SEV-SNP: CPUID validation failed for function 0x%x, index: 0x%x, " in sev_snp_cpuid_report_mismatches()
852 old_func->eax_in, old_func->ecx_in, in sev_snp_cpuid_report_mismatches()
853 old_func->eax, old_func->ebx, old_func->ecx, old_func->edx, in sev_snp_cpuid_report_mismatches()
854 new_func->eax, new_func->ebx, new_func->ecx, new_func->edx); in sev_snp_cpuid_report_mismatches()
880 if (!data->hva || !data->len) { in sev_snp_launch_update()
883 data->hva, data->len); in sev_snp_launch_update()
887 if (data->type == KVM_SEV_SNP_PAGE_TYPE_CPUID) { in sev_snp_launch_update()
889 memcpy(&snp_cpuid_info, data->hva, sizeof(snp_cpuid_info)); in sev_snp_launch_update()
892 update.uaddr = (__u64)(unsigned long)data->hva; in sev_snp_launch_update()
893 update.gfn_start = data->gpa >> TARGET_PAGE_BITS; in sev_snp_launch_update()
894 update.len = data->len; in sev_snp_launch_update()
895 update.type = data->type; in sev_snp_launch_update()
901 ret = kvm_set_memory_attributes_private(data->gpa, data->len); in sev_snp_launch_update()
903 error_report("SEV-SNP: failed to configure initial" in sev_snp_launch_update()
908 while (update.len || ret == -EAGAIN) { in sev_snp_launch_update()
913 ret = sev_ioctl(SEV_COMMON(sev_snp_guest)->sev_fd, in sev_snp_launch_update()
916 if (ret && ret != -EAGAIN) { in sev_snp_launch_update()
920 if (data->type == KVM_SEV_SNP_PAGE_TYPE_CPUID) { in sev_snp_launch_update()
921 sev_snp_cpuid_report_mismatches(&snp_cpuid_info, data->hva); in sev_snp_launch_update()
922 error_report("SEV-SNP: failed update CPUID page"); in sev_snp_launch_update()
929 if (!ret && update.gfn_start << TARGET_PAGE_BITS != data->gpa + data->len) { in sev_snp_launch_update()
930 error_report("SEV-SNP: expected update of GPA range %" in sev_snp_launch_update()
931 HWADDR_PRIx "-%" HWADDR_PRIx "," in sev_snp_launch_update()
932 "got GPA range %" HWADDR_PRIx "-%llx", in sev_snp_launch_update()
933 data->gpa, data->gpa + data->len, data->gpa, in sev_snp_launch_update()
935 ret = -EIO; in sev_snp_launch_update()
987 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA, in sev_launch_update_data()
1002 ret = sev_ioctl(SEV_COMMON(sev_guest)->sev_fd, KVM_SEV_LAUNCH_UPDATE_VMSA, in sev_launch_update_vmsa()
1015 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); in sev_launch_get_measure()
1035 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_MEASURE, in sev_launch_get_measure()
1047 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_MEASURE, in sev_launch_get_measure()
1058 sev_guest->measurement = g_base64_encode(data, measurement.len); in sev_launch_get_measure()
1059 trace_kvm_sev_launch_measurement(sev_guest->measurement); in sev_launch_get_measure()
1064 ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs; in sev_get_launch_measurement()
1069 SEV_COMMON(sev_guest)->state >= SEV_STATE_LAUNCH_SECRET) { in sev_get_launch_measurement()
1070 return g_strdup(sev_guest->measurement); in sev_get_launch_measurement()
1088 info->data = data; in qmp_query_sev_launch_measure()
1103 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_FINISH, 0, in sev_launch_finish()
1125 data->gpa = gpa; in snp_launch_update_data()
1126 data->hva = hva; in snp_launch_update_data()
1127 data->len = len; in snp_launch_update_data()
1128 data->type = type; in snp_launch_update_data()
1150 if (kvm_cpuid_info->cpuid.nent > SNP_CPUID_FUNCTION_MAXCOUNT) { in sev_snp_cpuid_info_fill()
1151 error_report("SEV-SNP: CPUID entry count (%d) exceeds max (%d)", in sev_snp_cpuid_info_fill()
1152 kvm_cpuid_info->cpuid.nent, SNP_CPUID_FUNCTION_MAXCOUNT); in sev_snp_cpuid_info_fill()
1153 return -1; in sev_snp_cpuid_info_fill()
1158 for (i = 0; i < kvm_cpuid_info->cpuid.nent; i++) { in sev_snp_cpuid_info_fill()
1162 kvm_cpuid_entry = &kvm_cpuid_info->entries[i]; in sev_snp_cpuid_info_fill()
1163 snp_cpuid_entry = &snp_cpuid_info->entries[i]; in sev_snp_cpuid_info_fill()
1165 snp_cpuid_entry->eax_in = kvm_cpuid_entry->function; in sev_snp_cpuid_info_fill()
1166 if (kvm_cpuid_entry->flags == KVM_CPUID_FLAG_SIGNIFCANT_INDEX) { in sev_snp_cpuid_info_fill()
1167 snp_cpuid_entry->ecx_in = kvm_cpuid_entry->index; in sev_snp_cpuid_info_fill()
1169 snp_cpuid_entry->eax = kvm_cpuid_entry->eax; in sev_snp_cpuid_info_fill()
1170 snp_cpuid_entry->ebx = kvm_cpuid_entry->ebx; in sev_snp_cpuid_info_fill()
1171 snp_cpuid_entry->ecx = kvm_cpuid_entry->ecx; in sev_snp_cpuid_info_fill()
1172 snp_cpuid_entry->edx = kvm_cpuid_entry->edx; in sev_snp_cpuid_info_fill()
1180 if (snp_cpuid_entry->eax_in == 0xD && in sev_snp_cpuid_info_fill()
1181 (snp_cpuid_entry->ecx_in == 0x0 || snp_cpuid_entry->ecx_in == 0x1)) { in sev_snp_cpuid_info_fill()
1182 snp_cpuid_entry->ebx = 0x240; in sev_snp_cpuid_info_fill()
1183 snp_cpuid_entry->xcr0_in = 1; in sev_snp_cpuid_info_fill()
1184 snp_cpuid_entry->xss_in = 0; in sev_snp_cpuid_info_fill()
1188 snp_cpuid_info->count = i; in sev_snp_cpuid_info_fill()
1208 } while (ret == -E2BIG); in snp_launch_update_cpuid()
1211 error_report("SEV-SNP: unable to query CPUID values for CPU: '%s'", in snp_launch_update_cpuid()
1212 strerror(-ret)); in snp_launch_update_cpuid()
1218 error_report("SEV-SNP: failed to generate CPUID table information"); in snp_launch_update_cpuid()
1233 if (sev_snp->parent_obj.kernel_hashes) { in snp_launch_update_kernel_hashes()
1234 assert(sev_snp->kernel_hashes_data); in snp_launch_update_kernel_hashes()
1235 assert((sev_snp->kernel_hashes_offset + in snp_launch_update_kernel_hashes()
1236 sizeof(*sev_snp->kernel_hashes_data)) <= len); in snp_launch_update_kernel_hashes()
1238 memcpy(hva + sev_snp->kernel_hashes_offset, sev_snp->kernel_hashes_data, in snp_launch_update_kernel_hashes()
1239 sizeof(*sev_snp->kernel_hashes_data)); in snp_launch_update_kernel_hashes()
1267 for (i = 0; i < metadata->num_desc; i++) { in snp_populate_metadata_pages()
1268 desc = &metadata->descs[i]; in snp_populate_metadata_pages()
1270 type = snp_metadata_desc_to_page_type(desc->type); in snp_populate_metadata_pages()
1272 hva = gpa2hva(&mr, desc->base, desc->len, NULL); in snp_populate_metadata_pages()
1275 __func__, desc->base, desc->len); in snp_populate_metadata_pages()
1280 ret = snp_launch_update_cpuid(desc->base, hva, desc->len); in snp_populate_metadata_pages()
1281 } else if (desc->type == SEV_DESC_TYPE_SNP_KERNEL_HASHES) { in snp_populate_metadata_pages()
1282 ret = snp_launch_update_kernel_hashes(sev_snp, desc->base, hva, in snp_populate_metadata_pages()
1283 desc->len); in snp_populate_metadata_pages()
1285 ret = snp_launch_update_data(desc->base, hva, desc->len, type); in snp_populate_metadata_pages()
1290 __func__, desc->base, desc->len, desc->type); in snp_populate_metadata_pages()
1304 struct kvm_sev_snp_launch_finish *finish = &sev_snp->kvm_finish_conf; in sev_snp_launch_finish()
1327 trace_kvm_sev_snp_launch_finish(sev_snp->id_block_base64, sev_snp->id_auth_base64, in sev_snp_launch_finish()
1328 sev_snp->host_data); in sev_snp_launch_finish()
1329 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_SNP_LAUNCH_FINISH, in sev_snp_launch_finish()
1342 "SEV-SNP: Migration is not implemented"); in sev_snp_launch_finish()
1360 klass->launch_finish(sev_common); in sev_vm_state_change()
1366 * This helper is to examine sev-guest properties and determine if any options
1372 /* Currently no KVM_SEV_INIT2-specific options are exposed via QEMU */ in sev_init2_required()
1382 if (sev_common->kvm_type != -1) { in sev_kvm_type()
1387 if (sev_guest->legacy_vm_type == ON_OFF_AUTO_ON || in sev_kvm_type()
1388 (sev_guest->legacy_vm_type == ON_OFF_AUTO_AUTO && in sev_kvm_type()
1390 sev_common->kvm_type = KVM_X86_DEFAULT_VM; in sev_kvm_type()
1395 * Newer VM types are required, either explicitly via legacy-vm-type=on, or in sev_kvm_type()
1396 * implicitly via legacy-vm-type=auto along with additional sev-guest in sev_kvm_type()
1399 kvm_type = (sev_guest->policy & SEV_POLICY_ES) ? in sev_kvm_type()
1402 if (sev_guest->legacy_vm_type == ON_OFF_AUTO_AUTO) { in sev_kvm_type()
1403 … error_report("SEV: host kernel does not support requested %s VM type, which is required " in sev_kvm_type()
1406 "compatible with the legacy VM type, or upgrade your kernel.", in sev_kvm_type()
1409 error_report("SEV: host kernel does not support requested %s VM type. To allow use of " in sev_kvm_type()
1410 "the legacy KVM_X86_DEFAULT_VM VM type, the 'legacy-vm-type' argument " in sev_kvm_type()
1411 "must be set to 'on' or 'auto' for the sev-guest object.", in sev_kvm_type()
1415 return -1; in sev_kvm_type()
1418 sev_common->kvm_type = kvm_type; in sev_kvm_type()
1420 return sev_common->kvm_type; in sev_kvm_type()
1440 sev_common->state = SEV_STATE_UNINIT; in sev_common_kvm_init()
1450 if (host_cbitpos != sev_common->cbitpos) { in sev_common_kvm_init()
1452 __func__, host_cbitpos, sev_common->cbitpos); in sev_common_kvm_init()
1453 return -1; in sev_common_kvm_init()
1457 * The reduced-phys-bits value will be placed in bit positions 11:6 of in sev_common_kvm_init()
1461 if (sev_common->reduced_phys_bits < 1 || in sev_common_kvm_init()
1462 sev_common->reduced_phys_bits > 63) { in sev_common_kvm_init()
1465 __func__, sev_common->reduced_phys_bits); in sev_common_kvm_init()
1466 return -1; in sev_common_kvm_init()
1469 devname = object_property_get_str(OBJECT(sev_common), "sev-device", NULL); in sev_common_kvm_init()
1470 sev_common->sev_fd = open(devname, O_RDWR); in sev_common_kvm_init()
1471 if (sev_common->sev_fd < 0) { in sev_common_kvm_init()
1475 return -1; in sev_common_kvm_init()
1479 ret = sev_platform_ioctl(sev_common->sev_fd, SEV_PLATFORM_STATUS, &status, in sev_common_kvm_init()
1485 return -1; in sev_common_kvm_init()
1487 sev_common->build_id = status.build; in sev_common_kvm_init()
1488 sev_common->api_major = status.api_major; in sev_common_kvm_init()
1489 sev_common->api_minor = status.api_minor; in sev_common_kvm_init()
1493 error_setg(errp, "%s: SEV-ES guests require in-kernel irqchip" in sev_common_kvm_init()
1495 return -1; in sev_common_kvm_init()
1501 error_setg(errp, "%s: guest policy requires SEV-ES, but " in sev_common_kvm_init()
1502 "host SEV-ES support unavailable", in sev_common_kvm_init()
1504 return -1; in sev_common_kvm_init()
1509 switch (x86_klass->kvm_type(X86_CONFIDENTIAL_GUEST(sev_common))) { in sev_common_kvm_init()
1513 ret = sev_ioctl(sev_common->sev_fd, cmd, NULL, &fw_error); in sev_common_kvm_init()
1520 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_INIT2, &args, &fw_error); in sev_common_kvm_init()
1524 error_setg(errp, "%s: host kernel does not support the requested SEV configuration.", in sev_common_kvm_init()
1526 return -1; in sev_common_kvm_init()
1532 return -1; in sev_common_kvm_init()
1535 ret = klass->launch_start(sev_common); in sev_common_kvm_init()
1539 return -1; in sev_common_kvm_init()
1542 if (klass->kvm_init && klass->kvm_init(cgs, errp)) { in sev_common_kvm_init()
1543 return -1; in sev_common_kvm_init()
1548 cgs->ready = true; in sev_common_kvm_init()
1558 * SEV/SEV-ES rely on pinned memory to back guest RAM so discarding in sev_kvm_init()
1566 return -1; in sev_kvm_init()
1578 * measurement of the encrypted images. When SEV-SNP is enabled, the in sev_kvm_init()
1593 if (x86ms->smm == ON_OFF_AUTO_AUTO) { in sev_snp_kvm_init()
1594 x86ms->smm = ON_OFF_AUTO_OFF; in sev_snp_kvm_init()
1595 } else if (x86ms->smm == ON_OFF_AUTO_ON) { in sev_snp_kvm_init()
1596 error_setg(errp, "SEV-SNP does not support SMM."); in sev_snp_kvm_init()
1597 return -1; in sev_snp_kvm_init()
1606 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); in sev_encrypt_flash()
1618 ret = klass->launch_update_data(sev_common, gpa, ptr, len); in sev_encrypt_flash()
1638 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); in sev_inject_launch_secret()
1648 sev_common->state); in sev_inject_launch_secret()
1682 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_SECRET, in sev_inject_launch_secret()
1693 #define SEV_SECRET_GUID "4c2eb361-7d9b-4cc3-8081-127c90d3d294"
1718 gpa = area->base; in qmp_sev_inject_launch_secret()
1727 if (!info->reset_addr) { in sev_es_parse_reset_block()
1728 error_report("SEV-ES reset address is zero"); in sev_es_parse_reset_block()
1732 *addr = info->reset_addr; in sev_es_parse_reset_block()
1748 * return code indicates that SEV-ES is not active. in sev_es_find_reset_vector()
1753 * Extract the AP reset vector for SEV-ES guests by locating the SEV GUID. in sev_es_find_reset_vector()
1768 data = flash_ptr + flash_size - 0x20; in sev_es_find_reset_vector()
1773 guid = (QemuUUID *)(data - sizeof(info_guid)); in sev_es_find_reset_vector()
1779 len = (uint16_t *)((uint8_t *)guid - sizeof(*len)); in sev_es_find_reset_vector()
1780 info = (SevInfoBlock *)(data - le16_to_cpu(*len)); in sev_es_find_reset_vector()
1789 ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs; in sev_es_set_reset_vector()
1794 if (!sev_common || !sev_common->reset_data_valid) { in sev_es_set_reset_vector()
1799 if (cpu->cpu_index == 0) { in sev_es_set_reset_vector()
1804 env = &x86->env; in sev_es_set_reset_vector()
1806 cpu_x86_load_seg_cache(env, R_CS, 0xf000, sev_common->reset_cs, 0xffff, in sev_es_set_reset_vector()
1810 env->eip = sev_common->reset_ip; in sev_es_set_reset_vector()
1818 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); in sev_es_save_reset_vector()
1832 sev_common->reset_cs = addr & 0xffff0000; in sev_es_save_reset_vector()
1833 sev_common->reset_ip = addr & 0x0000ffff; in sev_es_save_reset_vector()
1834 sev_common->reset_data_valid = true; in sev_es_save_reset_vector()
1874 * Calculate hash of kernel command-line with the terminating null byte. If in build_kernel_loader_hashes()
1875 * the user doesn't supply a command-line via -append, the 1-byte "\0" will in build_kernel_loader_hashes()
1879 if (qcrypto_hash_bytes(QCRYPTO_HASH_ALGO_SHA256, ctx->cmdline_data, in build_kernel_loader_hashes()
1880 ctx->cmdline_size, &hashp, &hash_len, errp) < 0) { in build_kernel_loader_hashes()
1887 * -initrd, an empty buffer will be used (ctx->initrd_size == 0). in build_kernel_loader_hashes()
1890 if (qcrypto_hash_bytes(QCRYPTO_HASH_ALGO_SHA256, ctx->initrd_data, in build_kernel_loader_hashes()
1891 ctx->initrd_size, &hashp, &hash_len, errp) < 0) { in build_kernel_loader_hashes()
1896 /* Calculate hash of the kernel */ in build_kernel_loader_hashes()
1899 { .iov_base = ctx->setup_data, .iov_len = ctx->setup_size }, in build_kernel_loader_hashes()
1900 { .iov_base = ctx->kernel_data, .iov_len = ctx->kernel_size } in build_kernel_loader_hashes()
1908 ht = &padded_ht->ht; in build_kernel_loader_hashes()
1910 ht->guid = sev_hash_table_header_guid; in build_kernel_loader_hashes()
1911 ht->len = sizeof(*ht); in build_kernel_loader_hashes()
1913 ht->cmdline.guid = sev_cmdline_entry_guid; in build_kernel_loader_hashes()
1914 ht->cmdline.len = sizeof(ht->cmdline); in build_kernel_loader_hashes()
1915 memcpy(ht->cmdline.hash, cmdline_hash, sizeof(ht->cmdline.hash)); in build_kernel_loader_hashes()
1917 ht->initrd.guid = sev_initrd_entry_guid; in build_kernel_loader_hashes()
1918 ht->initrd.len = sizeof(ht->initrd); in build_kernel_loader_hashes()
1919 memcpy(ht->initrd.hash, initrd_hash, sizeof(ht->initrd.hash)); in build_kernel_loader_hashes()
1921 ht->kernel.guid = sev_kernel_entry_guid; in build_kernel_loader_hashes()
1922 ht->kernel.len = sizeof(ht->kernel); in build_kernel_loader_hashes()
1923 memcpy(ht->kernel.hash, kernel_hash, sizeof(ht->kernel.hash)); in build_kernel_loader_hashes()
1926 memset(padded_ht->padding, 0, sizeof(padded_ht->padding)); in build_kernel_loader_hashes()
1942 sev_snp_guest->kernel_hashes_offset = area->base & ~TARGET_PAGE_MASK; in sev_snp_build_kernel_loader_hashes()
1943 sev_snp_guest->kernel_hashes_data = g_new0(PaddedSevHashTable, 1); in sev_snp_build_kernel_loader_hashes()
1944 return build_kernel_loader_hashes(sev_snp_guest->kernel_hashes_data, ctx, errp); in sev_snp_build_kernel_loader_hashes()
1958 * Populate the hashes table in the guest's memory at the OVMF-designated in sev_build_kernel_loader_hashes()
1961 padded_ht = address_space_map(&address_space_memory, area->base, in sev_build_kernel_loader_hashes()
1969 if (sev_encrypt_flash(area->base, (uint8_t *)padded_ht, in sev_build_kernel_loader_hashes()
1984 * Add the hashes of the linux kernel/initrd/cmdline to an encrypted guest page
1991 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); in sev_add_kernel_loader_hashes()
1995 * Only add the kernel hashes if the sev-guest configuration explicitly in sev_add_kernel_loader_hashes()
1996 * stated kernel-hashes=on. in sev_add_kernel_loader_hashes()
1998 if (!sev_common->kernel_hashes) { in sev_add_kernel_loader_hashes()
2003 error_setg(errp, "SEV: kernel specified but guest firmware " in sev_add_kernel_loader_hashes()
2009 if (!area->base || area->size < sizeof(PaddedSevHashTable)) { in sev_add_kernel_loader_hashes()
2011 "(base=0x%x size=0x%x)", area->base, area->size); in sev_add_kernel_loader_hashes()
2015 return klass->build_kernel_loader_hashes(sev_common, area, ctx, errp); in sev_add_kernel_loader_hashes()
2021 return g_strdup(SEV_COMMON(obj)->sev_device); in sev_common_get_sev_device()
2027 SEV_COMMON(obj)->sev_device = g_strdup(value); in sev_common_set_sev_device()
2032 return SEV_COMMON(obj)->kernel_hashes; in sev_common_get_kernel_hashes()
2037 SEV_COMMON(obj)->kernel_hashes = value; in sev_common_set_kernel_hashes()
2045 klass->kvm_init = sev_common_kvm_init; in sev_common_class_init()
2047 object_class_property_add_str(oc, "sev-device", in sev_common_class_init()
2050 object_class_property_set_description(oc, "sev-device", in sev_common_class_init()
2052 object_class_property_add_bool(oc, "kernel-hashes", in sev_common_class_init()
2055 object_class_property_set_description(oc, "kernel-hashes", in sev_common_class_init()
2056 "add kernel hashes to guest firmware for measured Linux boot"); in sev_common_class_init()
2064 sev_common->kvm_type = -1; in sev_common_instance_init()
2066 sev_common->sev_device = g_strdup(DEFAULT_SEV_DEVICE); in sev_common_instance_init()
2068 object_property_add_uint32_ptr(obj, "cbitpos", &sev_common->cbitpos, in sev_common_instance_init()
2070 object_property_add_uint32_ptr(obj, "reduced-phys-bits", in sev_common_instance_init()
2071 &sev_common->reduced_phys_bits, in sev_common_instance_init()
2075 /* sev guest info common to sev/sev-es/sev-snp */
2093 return g_strdup(SEV_GUEST(obj)->dh_cert_file); in sev_guest_get_dh_cert_file()
2099 SEV_GUEST(obj)->dh_cert_file = g_strdup(value); in sev_guest_set_dh_cert_file()
2107 return sev_guest->session_file ? g_strdup(sev_guest->session_file) : NULL; in sev_guest_get_session_file()
2113 SEV_GUEST(obj)->session_file = g_strdup(value); in sev_guest_set_session_file()
2121 OnOffAuto legacy_vm_type = sev_guest->legacy_vm_type; in sev_guest_get_legacy_vm_type()
2132 visit_type_OnOffAuto(v, name, &sev_guest->legacy_vm_type, errp); in sev_guest_set_legacy_vm_type()
2141 klass->build_kernel_loader_hashes = sev_build_kernel_loader_hashes; in sev_guest_class_init()
2142 klass->launch_start = sev_launch_start; in sev_guest_class_init()
2143 klass->launch_finish = sev_launch_finish; in sev_guest_class_init()
2144 klass->launch_update_data = sev_launch_update_data; in sev_guest_class_init()
2145 klass->kvm_init = sev_kvm_init; in sev_guest_class_init()
2146 x86_klass->kvm_type = sev_kvm_type; in sev_guest_class_init()
2148 object_class_property_add_str(oc, "dh-cert-file", in sev_guest_class_init()
2151 object_class_property_set_description(oc, "dh-cert-file", in sev_guest_class_init()
2153 object_class_property_add_str(oc, "session-file", in sev_guest_class_init()
2156 object_class_property_set_description(oc, "session-file", in sev_guest_class_init()
2158 object_class_property_add(oc, "legacy-vm-type", "OnOffAuto", in sev_guest_class_init()
2161 object_class_property_set_description(oc, "legacy-vm-type", in sev_guest_class_init()
2162 … "use legacy VM type to maintain measurement compatibility with older QEMU or kernel versions."); in sev_guest_class_init()
2170 sev_guest->policy = DEFAULT_GUEST_POLICY; in sev_guest_instance_init()
2171 object_property_add_uint32_ptr(obj, "handle", &sev_guest->handle, in sev_guest_instance_init()
2173 object_property_add_uint32_ptr(obj, "policy", &sev_guest->policy, in sev_guest_instance_init()
2177 sev_guest->legacy_vm_type = ON_OFF_AUTO_AUTO; in sev_guest_instance_init()
2180 /* guest info specific sev/sev-es */
2194 (uint64_t *)&SEV_SNP_GUEST(obj)->kvm_start_conf.policy, in sev_snp_guest_get_policy()
2203 (uint64_t *)&SEV_SNP_GUEST(obj)->kvm_start_conf.policy, in sev_snp_guest_set_policy()
2210 return g_strdup(SEV_SNP_GUEST(obj)->guest_visible_workarounds); in sev_snp_guest_get_guest_visible_workarounds()
2218 struct kvm_sev_snp_launch_start *start = &sev_snp_guest->kvm_start_conf; in sev_snp_guest_set_guest_visible_workarounds()
2222 g_free(sev_snp_guest->guest_visible_workarounds); in sev_snp_guest_set_guest_visible_workarounds()
2224 /* store the base64 str so we don't need to re-encode in getter */ in sev_snp_guest_set_guest_visible_workarounds()
2225 sev_snp_guest->guest_visible_workarounds = g_strdup(value); in sev_snp_guest_set_guest_visible_workarounds()
2227 blob = qbase64_decode(sev_snp_guest->guest_visible_workarounds, in sev_snp_guest_set_guest_visible_workarounds()
2228 -1, &len, errp); in sev_snp_guest_set_guest_visible_workarounds()
2233 if (len != sizeof(start->gosvw)) { in sev_snp_guest_set_guest_visible_workarounds()
2236 len, sizeof(start->gosvw)); in sev_snp_guest_set_guest_visible_workarounds()
2240 memcpy(start->gosvw, blob, len); in sev_snp_guest_set_guest_visible_workarounds()
2248 return g_strdup(sev_snp_guest->id_block_base64); in sev_snp_guest_get_id_block()
2255 struct kvm_sev_snp_launch_finish *finish = &sev_snp_guest->kvm_finish_conf; in sev_snp_guest_set_id_block()
2258 finish->id_block_en = 0; in sev_snp_guest_set_id_block()
2259 g_free(sev_snp_guest->id_block); in sev_snp_guest_set_id_block()
2260 g_free(sev_snp_guest->id_block_base64); in sev_snp_guest_set_id_block()
2262 /* store the base64 str so we don't need to re-encode in getter */ in sev_snp_guest_set_id_block()
2263 sev_snp_guest->id_block_base64 = g_strdup(value); in sev_snp_guest_set_id_block()
2264 sev_snp_guest->id_block = in sev_snp_guest_set_id_block()
2265 qbase64_decode(sev_snp_guest->id_block_base64, -1, &len, errp); in sev_snp_guest_set_id_block()
2267 if (!sev_snp_guest->id_block) { in sev_snp_guest_set_id_block()
2278 finish->id_block_en = 1; in sev_snp_guest_set_id_block()
2279 finish->id_block_uaddr = (uintptr_t)sev_snp_guest->id_block; in sev_snp_guest_set_id_block()
2287 return g_strdup(sev_snp_guest->id_auth_base64); in sev_snp_guest_get_id_auth()
2294 struct kvm_sev_snp_launch_finish *finish = &sev_snp_guest->kvm_finish_conf; in sev_snp_guest_set_id_auth()
2297 finish->id_auth_uaddr = 0; in sev_snp_guest_set_id_auth()
2298 g_free(sev_snp_guest->id_auth); in sev_snp_guest_set_id_auth()
2299 g_free(sev_snp_guest->id_auth_base64); in sev_snp_guest_set_id_auth()
2301 /* store the base64 str so we don't need to re-encode in getter */ in sev_snp_guest_set_id_auth()
2302 sev_snp_guest->id_auth_base64 = g_strdup(value); in sev_snp_guest_set_id_auth()
2303 sev_snp_guest->id_auth = in sev_snp_guest_set_id_auth()
2304 qbase64_decode(sev_snp_guest->id_auth_base64, -1, &len, errp); in sev_snp_guest_set_id_auth()
2306 if (!sev_snp_guest->id_auth) { in sev_snp_guest_set_id_auth()
2317 finish->id_auth_uaddr = (uintptr_t)sev_snp_guest->id_auth; in sev_snp_guest_set_id_auth()
2325 return !!sev_snp_guest->kvm_finish_conf.auth_key_en; in sev_snp_guest_get_author_key_enabled()
2333 sev_snp_guest->kvm_finish_conf.auth_key_en = value; in sev_snp_guest_set_author_key_enabled()
2341 return !!sev_snp_guest->kvm_finish_conf.vcek_disabled; in sev_snp_guest_get_vcek_disabled()
2349 sev_snp_guest->kvm_finish_conf.vcek_disabled = value; in sev_snp_guest_set_vcek_disabled()
2357 return g_strdup(sev_snp_guest->host_data); in sev_snp_guest_get_host_data()
2364 struct kvm_sev_snp_launch_finish *finish = &sev_snp_guest->kvm_finish_conf; in sev_snp_guest_set_host_data()
2368 g_free(sev_snp_guest->host_data); in sev_snp_guest_set_host_data()
2370 /* store the base64 str so we don't need to re-encode in getter */ in sev_snp_guest_set_host_data()
2371 sev_snp_guest->host_data = g_strdup(value); in sev_snp_guest_set_host_data()
2373 blob = qbase64_decode(sev_snp_guest->host_data, -1, &len, errp); in sev_snp_guest_set_host_data()
2379 if (len != sizeof(finish->host_data)) { in sev_snp_guest_set_host_data()
2382 len, sizeof(finish->host_data)); in sev_snp_guest_set_host_data()
2386 memcpy(finish->host_data, blob, len); in sev_snp_guest_set_host_data()
2395 klass->build_kernel_loader_hashes = sev_snp_build_kernel_loader_hashes; in sev_snp_guest_class_init()
2396 klass->launch_start = sev_snp_launch_start; in sev_snp_guest_class_init()
2397 klass->launch_finish = sev_snp_launch_finish; in sev_snp_guest_class_init()
2398 klass->launch_update_data = sev_snp_launch_update_data; in sev_snp_guest_class_init()
2399 klass->kvm_init = sev_snp_kvm_init; in sev_snp_guest_class_init()
2400 x86_klass->adjust_cpuid_features = sev_snp_adjust_cpuid_features; in sev_snp_guest_class_init()
2401 x86_klass->kvm_type = sev_snp_kvm_type; in sev_snp_guest_class_init()
2403 object_class_property_add(oc, "policy", "uint64", in sev_snp_guest_class_init()
2406 object_class_property_add_str(oc, "guest-visible-workarounds", in sev_snp_guest_class_init()
2409 object_class_property_add_str(oc, "id-block", in sev_snp_guest_class_init()
2412 object_class_property_add_str(oc, "id-auth", in sev_snp_guest_class_init()
2415 object_class_property_add_bool(oc, "author-key-enabled", in sev_snp_guest_class_init()
2418 object_class_property_add_bool(oc, "vcek-disabled", in sev_snp_guest_class_init()
2421 object_class_property_add_str(oc, "host-data", in sev_snp_guest_class_init()
2432 cgs->require_guest_memfd = true; in sev_snp_guest_instance_init()
2435 sev_snp_guest->kvm_start_conf.policy = DEFAULT_SEV_SNP_POLICY; in sev_snp_guest_instance_init()
2438 /* guest info specific to sev-snp */