1 /* 2 * QEMU SEV support 3 * 4 * Copyright Advanced Micro Devices 2016-2018 5 * 6 * Author: 7 * Brijesh Singh <brijesh.singh@amd.com> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 */ 13 14 #include "qemu/osdep.h" 15 16 #include <linux/kvm.h> 17 #include <linux/kvm_para.h> 18 #include <linux/psp-sev.h> 19 20 #include <sys/ioctl.h> 21 22 #include "qapi/error.h" 23 #include "qom/object_interfaces.h" 24 #include "qemu/base64.h" 25 #include "qemu/module.h" 26 #include "qemu/uuid.h" 27 #include "qemu/error-report.h" 28 #include "crypto/hash.h" 29 #include "exec/target_page.h" 30 #include "system/kvm.h" 31 #include "kvm/kvm_i386.h" 32 #include "sev.h" 33 #include "system/system.h" 34 #include "system/runstate.h" 35 #include "trace.h" 36 #include "migration/blocker.h" 37 #include "qom/object.h" 38 #include "monitor/monitor.h" 39 #include "monitor/hmp-target.h" 40 #include "qapi/qapi-commands-misc-target.h" 41 #include "confidential-guest.h" 42 #include "hw/i386/pc.h" 43 #include "system/address-spaces.h" 44 #include "qemu/queue.h" 45 46 OBJECT_DECLARE_TYPE(SevCommonState, SevCommonStateClass, SEV_COMMON) 47 OBJECT_DECLARE_TYPE(SevGuestState, SevCommonStateClass, SEV_GUEST) 48 OBJECT_DECLARE_TYPE(SevSnpGuestState, SevCommonStateClass, SEV_SNP_GUEST) 49 50 /* hard code sha256 digest size */ 51 #define HASH_SIZE 32 52 53 typedef struct QEMU_PACKED SevHashTableEntry { 54 QemuUUID guid; 55 uint16_t len; 56 uint8_t hash[HASH_SIZE]; 57 } SevHashTableEntry; 58 59 typedef struct QEMU_PACKED SevHashTable { 60 QemuUUID guid; 61 uint16_t len; 62 SevHashTableEntry cmdline; 63 SevHashTableEntry initrd; 64 SevHashTableEntry kernel; 65 } SevHashTable; 66 67 /* 68 * Data encrypted by sev_encrypt_flash() must be padded to a multiple of 69 * 16 bytes. 70 */ 71 typedef struct QEMU_PACKED PaddedSevHashTable { 72 SevHashTable ht; 73 uint8_t padding[ROUND_UP(sizeof(SevHashTable), 16) - sizeof(SevHashTable)]; 74 } PaddedSevHashTable; 75 76 QEMU_BUILD_BUG_ON(sizeof(PaddedSevHashTable) % 16 != 0); 77 78 #define SEV_INFO_BLOCK_GUID "00f771de-1a7e-4fcb-890e-68c77e2fb44e" 79 typedef struct __attribute__((__packed__)) SevInfoBlock { 80 /* SEV-ES Reset Vector Address */ 81 uint32_t reset_addr; 82 } SevInfoBlock; 83 84 #define SEV_HASH_TABLE_RV_GUID "7255371f-3a3b-4b04-927b-1da6efa8d454" 85 typedef struct QEMU_PACKED SevHashTableDescriptor { 86 /* SEV hash table area guest address */ 87 uint32_t base; 88 /* SEV hash table area size (in bytes) */ 89 uint32_t size; 90 } SevHashTableDescriptor; 91 92 struct SevCommonState { 93 X86ConfidentialGuest parent_obj; 94 95 int kvm_type; 96 97 /* configuration parameters */ 98 char *sev_device; 99 uint32_t cbitpos; 100 uint32_t reduced_phys_bits; 101 bool kernel_hashes; 102 103 /* runtime state */ 104 uint8_t api_major; 105 uint8_t api_minor; 106 uint8_t build_id; 107 int sev_fd; 108 SevState state; 109 110 uint32_t reset_cs; 111 uint32_t reset_ip; 112 bool reset_data_valid; 113 }; 114 115 struct SevCommonStateClass { 116 X86ConfidentialGuestClass parent_class; 117 118 /* public */ 119 bool (*build_kernel_loader_hashes)(SevCommonState *sev_common, 120 SevHashTableDescriptor *area, 121 SevKernelLoaderContext *ctx, 122 Error **errp); 123 int (*launch_start)(SevCommonState *sev_common); 124 void (*launch_finish)(SevCommonState *sev_common); 125 int (*launch_update_data)(SevCommonState *sev_common, hwaddr gpa, uint8_t *ptr, size_t len); 126 int (*kvm_init)(ConfidentialGuestSupport *cgs, Error **errp); 127 }; 128 129 /** 130 * SevGuestState: 131 * 132 * The SevGuestState object is used for creating and managing a SEV 133 * guest. 134 * 135 * # $QEMU \ 136 * -object sev-guest,id=sev0 \ 137 * -machine ...,memory-encryption=sev0 138 */ 139 struct SevGuestState { 140 SevCommonState parent_obj; 141 gchar *measurement; 142 143 /* configuration parameters */ 144 uint32_t handle; 145 uint32_t policy; 146 char *dh_cert_file; 147 char *session_file; 148 OnOffAuto legacy_vm_type; 149 }; 150 151 struct SevSnpGuestState { 152 SevCommonState parent_obj; 153 154 /* configuration parameters */ 155 char *guest_visible_workarounds; 156 char *id_block_base64; 157 uint8_t *id_block; 158 char *id_auth_base64; 159 uint8_t *id_auth; 160 char *host_data; 161 162 struct kvm_sev_snp_launch_start kvm_start_conf; 163 struct kvm_sev_snp_launch_finish kvm_finish_conf; 164 165 uint32_t kernel_hashes_offset; 166 PaddedSevHashTable *kernel_hashes_data; 167 }; 168 169 #define DEFAULT_GUEST_POLICY 0x1 /* disable debug */ 170 #define DEFAULT_SEV_DEVICE "/dev/sev" 171 #define DEFAULT_SEV_SNP_POLICY 0x30000 172 173 typedef struct SevLaunchUpdateData { 174 QTAILQ_ENTRY(SevLaunchUpdateData) next; 175 hwaddr gpa; 176 void *hva; 177 size_t len; 178 int type; 179 } SevLaunchUpdateData; 180 181 static QTAILQ_HEAD(, SevLaunchUpdateData) launch_update; 182 183 static Error *sev_mig_blocker; 184 185 static const char *const sev_fw_errlist[] = { 186 [SEV_RET_SUCCESS] = "", 187 [SEV_RET_INVALID_PLATFORM_STATE] = "Platform state is invalid", 188 [SEV_RET_INVALID_GUEST_STATE] = "Guest state is invalid", 189 [SEV_RET_INAVLID_CONFIG] = "Platform configuration is invalid", 190 [SEV_RET_INVALID_LEN] = "Buffer too small", 191 [SEV_RET_ALREADY_OWNED] = "Platform is already owned", 192 [SEV_RET_INVALID_CERTIFICATE] = "Certificate is invalid", 193 [SEV_RET_POLICY_FAILURE] = "Policy is not allowed", 194 [SEV_RET_INACTIVE] = "Guest is not active", 195 [SEV_RET_INVALID_ADDRESS] = "Invalid address", 196 [SEV_RET_BAD_SIGNATURE] = "Bad signature", 197 [SEV_RET_BAD_MEASUREMENT] = "Bad measurement", 198 [SEV_RET_ASID_OWNED] = "ASID is already owned", 199 [SEV_RET_INVALID_ASID] = "Invalid ASID", 200 [SEV_RET_WBINVD_REQUIRED] = "WBINVD is required", 201 [SEV_RET_DFFLUSH_REQUIRED] = "DF_FLUSH is required", 202 [SEV_RET_INVALID_GUEST] = "Guest handle is invalid", 203 [SEV_RET_INVALID_COMMAND] = "Invalid command", 204 [SEV_RET_ACTIVE] = "Guest is active", 205 [SEV_RET_HWSEV_RET_PLATFORM] = "Hardware error", 206 [SEV_RET_HWSEV_RET_UNSAFE] = "Hardware unsafe", 207 [SEV_RET_UNSUPPORTED] = "Feature not supported", 208 [SEV_RET_INVALID_PARAM] = "Invalid parameter", 209 [SEV_RET_RESOURCE_LIMIT] = "Required firmware resource depleted", 210 [SEV_RET_SECURE_DATA_INVALID] = "Part-specific integrity check failure", 211 }; 212 213 #define SEV_FW_MAX_ERROR ARRAY_SIZE(sev_fw_errlist) 214 215 /* <linux/kvm.h> doesn't expose this, so re-use the max from kvm.c */ 216 #define KVM_MAX_CPUID_ENTRIES 100 217 218 typedef struct KvmCpuidInfo { 219 struct kvm_cpuid2 cpuid; 220 struct kvm_cpuid_entry2 entries[KVM_MAX_CPUID_ENTRIES]; 221 } KvmCpuidInfo; 222 223 #define SNP_CPUID_FUNCTION_MAXCOUNT 64 224 #define SNP_CPUID_FUNCTION_UNKNOWN 0xFFFFFFFF 225 226 typedef struct { 227 uint32_t eax_in; 228 uint32_t ecx_in; 229 uint64_t xcr0_in; 230 uint64_t xss_in; 231 uint32_t eax; 232 uint32_t ebx; 233 uint32_t ecx; 234 uint32_t edx; 235 uint64_t reserved; 236 } __attribute__((packed)) SnpCpuidFunc; 237 238 typedef struct { 239 uint32_t count; 240 uint32_t reserved1; 241 uint64_t reserved2; 242 SnpCpuidFunc entries[SNP_CPUID_FUNCTION_MAXCOUNT]; 243 } __attribute__((packed)) SnpCpuidInfo; 244 245 static int 246 sev_ioctl(int fd, int cmd, void *data, int *error) 247 { 248 int r; 249 struct kvm_sev_cmd input; 250 251 memset(&input, 0x0, sizeof(input)); 252 253 input.id = cmd; 254 input.sev_fd = fd; 255 input.data = (uintptr_t)data; 256 257 r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_OP, &input); 258 259 if (error) { 260 *error = input.error; 261 } 262 263 return r; 264 } 265 266 static int 267 sev_platform_ioctl(int fd, int cmd, void *data, int *error) 268 { 269 int r; 270 struct sev_issue_cmd arg; 271 272 arg.cmd = cmd; 273 arg.data = (unsigned long)data; 274 r = ioctl(fd, SEV_ISSUE_CMD, &arg); 275 if (error) { 276 *error = arg.error; 277 } 278 279 return r; 280 } 281 282 static const char * 283 fw_error_to_str(int code) 284 { 285 if (code < 0 || code >= SEV_FW_MAX_ERROR) { 286 return "unknown error"; 287 } 288 289 return sev_fw_errlist[code]; 290 } 291 292 static bool 293 sev_check_state(const SevCommonState *sev_common, SevState state) 294 { 295 assert(sev_common); 296 return sev_common->state == state ? true : false; 297 } 298 299 static void 300 sev_set_guest_state(SevCommonState *sev_common, SevState new_state) 301 { 302 assert(new_state < SEV_STATE__MAX); 303 assert(sev_common); 304 305 trace_kvm_sev_change_state(SevState_str(sev_common->state), 306 SevState_str(new_state)); 307 sev_common->state = new_state; 308 } 309 310 static void 311 sev_ram_block_added(RAMBlockNotifier *n, void *host, size_t size, 312 size_t max_size) 313 { 314 int r; 315 struct kvm_enc_region range; 316 ram_addr_t offset; 317 MemoryRegion *mr; 318 319 /* 320 * The RAM device presents a memory region that should be treated 321 * as IO region and should not be pinned. 322 */ 323 mr = memory_region_from_host(host, &offset); 324 if (mr && memory_region_is_ram_device(mr)) { 325 return; 326 } 327 328 range.addr = (uintptr_t)host; 329 range.size = max_size; 330 331 trace_kvm_memcrypt_register_region(host, max_size); 332 r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_REG_REGION, &range); 333 if (r) { 334 error_report("%s: failed to register region (%p+%#zx) error '%s'", 335 __func__, host, max_size, strerror(errno)); 336 exit(1); 337 } 338 } 339 340 static void 341 sev_ram_block_removed(RAMBlockNotifier *n, void *host, size_t size, 342 size_t max_size) 343 { 344 int r; 345 struct kvm_enc_region range; 346 ram_addr_t offset; 347 MemoryRegion *mr; 348 349 /* 350 * The RAM device presents a memory region that should be treated 351 * as IO region and should not have been pinned. 352 */ 353 mr = memory_region_from_host(host, &offset); 354 if (mr && memory_region_is_ram_device(mr)) { 355 return; 356 } 357 358 range.addr = (uintptr_t)host; 359 range.size = max_size; 360 361 trace_kvm_memcrypt_unregister_region(host, max_size); 362 r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_UNREG_REGION, &range); 363 if (r) { 364 error_report("%s: failed to unregister region (%p+%#zx)", 365 __func__, host, max_size); 366 } 367 } 368 369 static struct RAMBlockNotifier sev_ram_notifier = { 370 .ram_block_added = sev_ram_block_added, 371 .ram_block_removed = sev_ram_block_removed, 372 }; 373 374 bool 375 sev_enabled(void) 376 { 377 ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs; 378 379 return !!object_dynamic_cast(OBJECT(cgs), TYPE_SEV_COMMON); 380 } 381 382 bool 383 sev_snp_enabled(void) 384 { 385 ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs; 386 387 return !!object_dynamic_cast(OBJECT(cgs), TYPE_SEV_SNP_GUEST); 388 } 389 390 bool 391 sev_es_enabled(void) 392 { 393 ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs; 394 395 return sev_snp_enabled() || 396 (sev_enabled() && SEV_GUEST(cgs)->policy & SEV_POLICY_ES); 397 } 398 399 uint32_t 400 sev_get_cbit_position(void) 401 { 402 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); 403 404 return sev_common ? sev_common->cbitpos : 0; 405 } 406 407 uint32_t 408 sev_get_reduced_phys_bits(void) 409 { 410 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); 411 412 return sev_common ? sev_common->reduced_phys_bits : 0; 413 } 414 415 static SevInfo *sev_get_info(void) 416 { 417 SevInfo *info; 418 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); 419 420 info = g_new0(SevInfo, 1); 421 info->enabled = sev_enabled(); 422 423 if (info->enabled) { 424 info->api_major = sev_common->api_major; 425 info->api_minor = sev_common->api_minor; 426 info->build_id = sev_common->build_id; 427 info->state = sev_common->state; 428 429 if (sev_snp_enabled()) { 430 info->sev_type = SEV_GUEST_TYPE_SEV_SNP; 431 info->u.sev_snp.snp_policy = 432 object_property_get_uint(OBJECT(sev_common), "policy", NULL); 433 } else { 434 info->sev_type = SEV_GUEST_TYPE_SEV; 435 info->u.sev.handle = SEV_GUEST(sev_common)->handle; 436 info->u.sev.policy = 437 (uint32_t)object_property_get_uint(OBJECT(sev_common), 438 "policy", NULL); 439 } 440 } 441 442 return info; 443 } 444 445 SevInfo *qmp_query_sev(Error **errp) 446 { 447 SevInfo *info; 448 449 info = sev_get_info(); 450 if (!info) { 451 error_setg(errp, "SEV feature is not available"); 452 return NULL; 453 } 454 455 return info; 456 } 457 458 void hmp_info_sev(Monitor *mon, const QDict *qdict) 459 { 460 SevInfo *info = sev_get_info(); 461 462 if (!info || !info->enabled) { 463 monitor_printf(mon, "SEV is not enabled\n"); 464 goto out; 465 } 466 467 monitor_printf(mon, "SEV type: %s\n", SevGuestType_str(info->sev_type)); 468 monitor_printf(mon, "state: %s\n", SevState_str(info->state)); 469 monitor_printf(mon, "build: %d\n", info->build_id); 470 monitor_printf(mon, "api version: %d.%d\n", info->api_major, 471 info->api_minor); 472 473 if (sev_snp_enabled()) { 474 monitor_printf(mon, "debug: %s\n", 475 info->u.sev_snp.snp_policy & SEV_SNP_POLICY_DBG ? "on" 476 : "off"); 477 monitor_printf(mon, "SMT allowed: %s\n", 478 info->u.sev_snp.snp_policy & SEV_SNP_POLICY_SMT ? "on" 479 : "off"); 480 } else { 481 monitor_printf(mon, "handle: %d\n", info->u.sev.handle); 482 monitor_printf(mon, "debug: %s\n", 483 info->u.sev.policy & SEV_POLICY_NODBG ? "off" : "on"); 484 monitor_printf(mon, "key-sharing: %s\n", 485 info->u.sev.policy & SEV_POLICY_NOKS ? "off" : "on"); 486 } 487 488 out: 489 qapi_free_SevInfo(info); 490 } 491 492 static int 493 sev_get_pdh_info(int fd, guchar **pdh, size_t *pdh_len, guchar **cert_chain, 494 size_t *cert_chain_len, Error **errp) 495 { 496 guchar *pdh_data = NULL; 497 guchar *cert_chain_data = NULL; 498 struct sev_user_data_pdh_cert_export export = {}; 499 int err, r; 500 501 /* query the certificate length */ 502 r = sev_platform_ioctl(fd, SEV_PDH_CERT_EXPORT, &export, &err); 503 if (r < 0) { 504 if (err != SEV_RET_INVALID_LEN) { 505 error_setg(errp, "SEV: Failed to export PDH cert" 506 " ret=%d fw_err=%d (%s)", 507 r, err, fw_error_to_str(err)); 508 return 1; 509 } 510 } 511 512 pdh_data = g_new(guchar, export.pdh_cert_len); 513 cert_chain_data = g_new(guchar, export.cert_chain_len); 514 export.pdh_cert_address = (unsigned long)pdh_data; 515 export.cert_chain_address = (unsigned long)cert_chain_data; 516 517 r = sev_platform_ioctl(fd, SEV_PDH_CERT_EXPORT, &export, &err); 518 if (r < 0) { 519 error_setg(errp, "SEV: Failed to export PDH cert ret=%d fw_err=%d (%s)", 520 r, err, fw_error_to_str(err)); 521 goto e_free; 522 } 523 524 *pdh = pdh_data; 525 *pdh_len = export.pdh_cert_len; 526 *cert_chain = cert_chain_data; 527 *cert_chain_len = export.cert_chain_len; 528 return 0; 529 530 e_free: 531 g_free(pdh_data); 532 g_free(cert_chain_data); 533 return 1; 534 } 535 536 static int sev_get_cpu0_id(int fd, guchar **id, size_t *id_len, Error **errp) 537 { 538 guchar *id_data; 539 struct sev_user_data_get_id2 get_id2 = {}; 540 int err, r; 541 542 /* query the ID length */ 543 r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err); 544 if (r < 0 && err != SEV_RET_INVALID_LEN) { 545 error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)", 546 r, err, fw_error_to_str(err)); 547 return 1; 548 } 549 550 id_data = g_new(guchar, get_id2.length); 551 get_id2.address = (unsigned long)id_data; 552 553 r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err); 554 if (r < 0) { 555 error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)", 556 r, err, fw_error_to_str(err)); 557 goto err; 558 } 559 560 *id = id_data; 561 *id_len = get_id2.length; 562 return 0; 563 564 err: 565 g_free(id_data); 566 return 1; 567 } 568 569 static SevCapability *sev_get_capabilities(Error **errp) 570 { 571 SevCapability *cap = NULL; 572 guchar *pdh_data = NULL; 573 guchar *cert_chain_data = NULL; 574 guchar *cpu0_id_data = NULL; 575 size_t pdh_len = 0, cert_chain_len = 0, cpu0_id_len = 0; 576 uint32_t ebx; 577 int fd; 578 SevCommonState *sev_common; 579 char *sev_device; 580 581 if (!kvm_enabled()) { 582 error_setg(errp, "KVM not enabled"); 583 return NULL; 584 } 585 if (kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_OP, NULL) < 0) { 586 error_setg(errp, "SEV is not enabled in KVM"); 587 return NULL; 588 } 589 590 sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); 591 if (sev_common) { 592 sev_device = object_property_get_str(OBJECT(sev_common), "sev-device", 593 &error_abort); 594 } else { 595 sev_device = g_strdup(DEFAULT_SEV_DEVICE); 596 } 597 598 fd = open(sev_device, O_RDWR); 599 if (fd < 0) { 600 error_setg_errno(errp, errno, "SEV: Failed to open %s", 601 sev_device); 602 g_free(sev_device); 603 return NULL; 604 } 605 g_free(sev_device); 606 607 if (sev_get_pdh_info(fd, &pdh_data, &pdh_len, 608 &cert_chain_data, &cert_chain_len, errp)) { 609 goto out; 610 } 611 612 if (sev_get_cpu0_id(fd, &cpu0_id_data, &cpu0_id_len, errp)) { 613 goto out; 614 } 615 616 cap = g_new0(SevCapability, 1); 617 cap->pdh = g_base64_encode(pdh_data, pdh_len); 618 cap->cert_chain = g_base64_encode(cert_chain_data, cert_chain_len); 619 cap->cpu0_id = g_base64_encode(cpu0_id_data, cpu0_id_len); 620 621 host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL); 622 cap->cbitpos = ebx & 0x3f; 623 624 /* 625 * When SEV feature is enabled, we loose one bit in guest physical 626 * addressing. 627 */ 628 cap->reduced_phys_bits = 1; 629 630 out: 631 g_free(cpu0_id_data); 632 g_free(pdh_data); 633 g_free(cert_chain_data); 634 close(fd); 635 return cap; 636 } 637 638 SevCapability *qmp_query_sev_capabilities(Error **errp) 639 { 640 return sev_get_capabilities(errp); 641 } 642 643 static OvmfSevMetadata *ovmf_sev_metadata_table; 644 645 #define OVMF_SEV_META_DATA_GUID "dc886566-984a-4798-A75e-5585a7bf67cc" 646 typedef struct __attribute__((__packed__)) OvmfSevMetadataOffset { 647 uint32_t offset; 648 } OvmfSevMetadataOffset; 649 650 OvmfSevMetadata *pc_system_get_ovmf_sev_metadata_ptr(void) 651 { 652 return ovmf_sev_metadata_table; 653 } 654 655 void pc_system_parse_sev_metadata(uint8_t *flash_ptr, size_t flash_size) 656 { 657 OvmfSevMetadata *metadata; 658 OvmfSevMetadataOffset *data; 659 660 if (!pc_system_ovmf_table_find(OVMF_SEV_META_DATA_GUID, (uint8_t **)&data, 661 NULL)) { 662 return; 663 } 664 665 metadata = (OvmfSevMetadata *)(flash_ptr + flash_size - data->offset); 666 if (memcmp(metadata->signature, "ASEV", 4) != 0 || 667 metadata->len < sizeof(OvmfSevMetadata) || 668 metadata->len > flash_size - data->offset) { 669 return; 670 } 671 672 ovmf_sev_metadata_table = g_memdup2(metadata, metadata->len); 673 } 674 675 static SevAttestationReport *sev_get_attestation_report(const char *mnonce, 676 Error **errp) 677 { 678 struct kvm_sev_attestation_report input = {}; 679 SevAttestationReport *report = NULL; 680 SevCommonState *sev_common; 681 g_autofree guchar *data = NULL; 682 g_autofree guchar *buf = NULL; 683 gsize len; 684 int err = 0, ret; 685 686 if (!sev_enabled()) { 687 error_setg(errp, "SEV is not enabled"); 688 return NULL; 689 } 690 691 /* lets decode the mnonce string */ 692 buf = g_base64_decode(mnonce, &len); 693 if (!buf) { 694 error_setg(errp, "SEV: failed to decode mnonce input"); 695 return NULL; 696 } 697 698 /* verify the input mnonce length */ 699 if (len != sizeof(input.mnonce)) { 700 error_setg(errp, "SEV: mnonce must be %zu bytes (got %" G_GSIZE_FORMAT ")", 701 sizeof(input.mnonce), len); 702 return NULL; 703 } 704 705 sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); 706 707 /* Query the report length */ 708 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT, 709 &input, &err); 710 if (ret < 0) { 711 if (err != SEV_RET_INVALID_LEN) { 712 error_setg(errp, "SEV: Failed to query the attestation report" 713 " length ret=%d fw_err=%d (%s)", 714 ret, err, fw_error_to_str(err)); 715 return NULL; 716 } 717 } 718 719 data = g_malloc(input.len); 720 input.uaddr = (unsigned long)data; 721 memcpy(input.mnonce, buf, sizeof(input.mnonce)); 722 723 /* Query the report */ 724 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT, 725 &input, &err); 726 if (ret) { 727 error_setg_errno(errp, errno, "SEV: Failed to get attestation report" 728 " ret=%d fw_err=%d (%s)", ret, err, fw_error_to_str(err)); 729 return NULL; 730 } 731 732 report = g_new0(SevAttestationReport, 1); 733 report->data = g_base64_encode(data, input.len); 734 735 trace_kvm_sev_attestation_report(mnonce, report->data); 736 737 return report; 738 } 739 740 SevAttestationReport *qmp_query_sev_attestation_report(const char *mnonce, 741 Error **errp) 742 { 743 return sev_get_attestation_report(mnonce, errp); 744 } 745 746 static int 747 sev_read_file_base64(const char *filename, guchar **data, gsize *len) 748 { 749 gsize sz; 750 g_autofree gchar *base64 = NULL; 751 GError *error = NULL; 752 753 if (!g_file_get_contents(filename, &base64, &sz, &error)) { 754 error_report("SEV: Failed to read '%s' (%s)", filename, error->message); 755 g_error_free(error); 756 return -1; 757 } 758 759 *data = g_base64_decode(base64, len); 760 return 0; 761 } 762 763 static int 764 sev_snp_launch_start(SevCommonState *sev_common) 765 { 766 int fw_error, rc; 767 SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(sev_common); 768 struct kvm_sev_snp_launch_start *start = &sev_snp_guest->kvm_start_conf; 769 770 trace_kvm_sev_snp_launch_start(start->policy, 771 sev_snp_guest->guest_visible_workarounds); 772 773 if (!kvm_enable_hypercall(BIT_ULL(KVM_HC_MAP_GPA_RANGE))) { 774 return 1; 775 } 776 777 rc = sev_ioctl(sev_common->sev_fd, KVM_SEV_SNP_LAUNCH_START, 778 start, &fw_error); 779 if (rc < 0) { 780 error_report("%s: SNP_LAUNCH_START ret=%d fw_error=%d '%s'", 781 __func__, rc, fw_error, fw_error_to_str(fw_error)); 782 return 1; 783 } 784 785 QTAILQ_INIT(&launch_update); 786 787 sev_set_guest_state(sev_common, SEV_STATE_LAUNCH_UPDATE); 788 789 return 0; 790 } 791 792 static int 793 sev_launch_start(SevCommonState *sev_common) 794 { 795 gsize sz; 796 int ret = 1; 797 int fw_error, rc; 798 SevGuestState *sev_guest = SEV_GUEST(sev_common); 799 struct kvm_sev_launch_start start = { 800 .handle = sev_guest->handle, .policy = sev_guest->policy 801 }; 802 guchar *session = NULL, *dh_cert = NULL; 803 804 if (sev_guest->session_file) { 805 if (sev_read_file_base64(sev_guest->session_file, &session, &sz) < 0) { 806 goto out; 807 } 808 start.session_uaddr = (unsigned long)session; 809 start.session_len = sz; 810 } 811 812 if (sev_guest->dh_cert_file) { 813 if (sev_read_file_base64(sev_guest->dh_cert_file, &dh_cert, &sz) < 0) { 814 goto out; 815 } 816 start.dh_uaddr = (unsigned long)dh_cert; 817 start.dh_len = sz; 818 } 819 820 trace_kvm_sev_launch_start(start.policy, session, dh_cert); 821 rc = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_START, &start, &fw_error); 822 if (rc < 0) { 823 error_report("%s: LAUNCH_START ret=%d fw_error=%d '%s'", 824 __func__, ret, fw_error, fw_error_to_str(fw_error)); 825 goto out; 826 } 827 828 sev_set_guest_state(sev_common, SEV_STATE_LAUNCH_UPDATE); 829 sev_guest->handle = start.handle; 830 ret = 0; 831 832 out: 833 g_free(session); 834 g_free(dh_cert); 835 return ret; 836 } 837 838 static void 839 sev_snp_cpuid_report_mismatches(SnpCpuidInfo *old, 840 SnpCpuidInfo *new) 841 { 842 size_t i; 843 844 if (old->count != new->count) { 845 error_report("SEV-SNP: CPUID validation failed due to count mismatch, " 846 "provided: %d, expected: %d", old->count, new->count); 847 return; 848 } 849 850 for (i = 0; i < old->count; i++) { 851 SnpCpuidFunc *old_func, *new_func; 852 853 old_func = &old->entries[i]; 854 new_func = &new->entries[i]; 855 856 if (memcmp(old_func, new_func, sizeof(SnpCpuidFunc))) { 857 error_report("SEV-SNP: CPUID validation failed for function 0x%x, index: 0x%x, " 858 "provided: eax:0x%08x, ebx: 0x%08x, ecx: 0x%08x, edx: 0x%08x, " 859 "expected: eax:0x%08x, ebx: 0x%08x, ecx: 0x%08x, edx: 0x%08x", 860 old_func->eax_in, old_func->ecx_in, 861 old_func->eax, old_func->ebx, old_func->ecx, old_func->edx, 862 new_func->eax, new_func->ebx, new_func->ecx, new_func->edx); 863 } 864 } 865 } 866 867 static const char * 868 snp_page_type_to_str(int type) 869 { 870 switch (type) { 871 case KVM_SEV_SNP_PAGE_TYPE_NORMAL: return "Normal"; 872 case KVM_SEV_SNP_PAGE_TYPE_ZERO: return "Zero"; 873 case KVM_SEV_SNP_PAGE_TYPE_UNMEASURED: return "Unmeasured"; 874 case KVM_SEV_SNP_PAGE_TYPE_SECRETS: return "Secrets"; 875 case KVM_SEV_SNP_PAGE_TYPE_CPUID: return "Cpuid"; 876 default: return "unknown"; 877 } 878 } 879 880 static int 881 sev_snp_launch_update(SevSnpGuestState *sev_snp_guest, 882 SevLaunchUpdateData *data) 883 { 884 int ret, fw_error; 885 SnpCpuidInfo snp_cpuid_info; 886 struct kvm_sev_snp_launch_update update = {0}; 887 888 if (!data->hva || !data->len) { 889 error_report("SNP_LAUNCH_UPDATE called with invalid address" 890 "/ length: %p / %zx", 891 data->hva, data->len); 892 return 1; 893 } 894 895 if (data->type == KVM_SEV_SNP_PAGE_TYPE_CPUID) { 896 /* Save a copy for comparison in case the LAUNCH_UPDATE fails */ 897 memcpy(&snp_cpuid_info, data->hva, sizeof(snp_cpuid_info)); 898 } 899 900 update.uaddr = (__u64)(unsigned long)data->hva; 901 update.gfn_start = data->gpa >> TARGET_PAGE_BITS; 902 update.len = data->len; 903 update.type = data->type; 904 905 /* 906 * KVM_SEV_SNP_LAUNCH_UPDATE requires that GPA ranges have the private 907 * memory attribute set in advance. 908 */ 909 ret = kvm_set_memory_attributes_private(data->gpa, data->len); 910 if (ret) { 911 error_report("SEV-SNP: failed to configure initial" 912 "private guest memory"); 913 goto out; 914 } 915 916 while (update.len || ret == -EAGAIN) { 917 trace_kvm_sev_snp_launch_update(update.uaddr, update.gfn_start << 918 TARGET_PAGE_BITS, update.len, 919 snp_page_type_to_str(update.type)); 920 921 ret = sev_ioctl(SEV_COMMON(sev_snp_guest)->sev_fd, 922 KVM_SEV_SNP_LAUNCH_UPDATE, 923 &update, &fw_error); 924 if (ret && ret != -EAGAIN) { 925 error_report("SNP_LAUNCH_UPDATE ret=%d fw_error=%d '%s'", 926 ret, fw_error, fw_error_to_str(fw_error)); 927 928 if (data->type == KVM_SEV_SNP_PAGE_TYPE_CPUID) { 929 sev_snp_cpuid_report_mismatches(&snp_cpuid_info, data->hva); 930 error_report("SEV-SNP: failed update CPUID page"); 931 } 932 break; 933 } 934 } 935 936 out: 937 if (!ret && update.gfn_start << TARGET_PAGE_BITS != data->gpa + data->len) { 938 error_report("SEV-SNP: expected update of GPA range %" 939 HWADDR_PRIx "-%" HWADDR_PRIx "," 940 "got GPA range %" HWADDR_PRIx "-%llx", 941 data->gpa, data->gpa + data->len, data->gpa, 942 update.gfn_start << TARGET_PAGE_BITS); 943 ret = -EIO; 944 } 945 946 return ret; 947 } 948 949 static uint32_t 950 sev_snp_mask_cpuid_features(X86ConfidentialGuest *cg, uint32_t feature, uint32_t index, 951 int reg, uint32_t value) 952 { 953 switch (feature) { 954 case 1: 955 if (reg == R_ECX) { 956 return value & ~CPUID_EXT_TSC_DEADLINE_TIMER; 957 } 958 break; 959 case 7: 960 if (index == 0 && reg == R_EBX) { 961 return value & ~CPUID_7_0_EBX_TSC_ADJUST; 962 } 963 if (index == 0 && reg == R_EDX) { 964 return value & ~(CPUID_7_0_EDX_SPEC_CTRL | 965 CPUID_7_0_EDX_STIBP | 966 CPUID_7_0_EDX_FLUSH_L1D | 967 CPUID_7_0_EDX_ARCH_CAPABILITIES | 968 CPUID_7_0_EDX_CORE_CAPABILITY | 969 CPUID_7_0_EDX_SPEC_CTRL_SSBD); 970 } 971 break; 972 case 0x80000008: 973 if (reg == R_EBX) { 974 return value & ~CPUID_8000_0008_EBX_VIRT_SSBD; 975 } 976 break; 977 } 978 return value; 979 } 980 981 static int 982 sev_launch_update_data(SevCommonState *sev_common, hwaddr gpa, 983 uint8_t *addr, size_t len) 984 { 985 int ret, fw_error; 986 struct kvm_sev_launch_update_data update; 987 988 if (!addr || !len) { 989 return 1; 990 } 991 992 update.uaddr = (uintptr_t)addr; 993 update.len = len; 994 trace_kvm_sev_launch_update_data(addr, len); 995 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA, 996 &update, &fw_error); 997 if (ret) { 998 error_report("%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'", 999 __func__, ret, fw_error, fw_error_to_str(fw_error)); 1000 } 1001 1002 return ret; 1003 } 1004 1005 static int 1006 sev_launch_update_vmsa(SevGuestState *sev_guest) 1007 { 1008 int ret, fw_error; 1009 1010 ret = sev_ioctl(SEV_COMMON(sev_guest)->sev_fd, KVM_SEV_LAUNCH_UPDATE_VMSA, 1011 NULL, &fw_error); 1012 if (ret) { 1013 error_report("%s: LAUNCH_UPDATE_VMSA ret=%d fw_error=%d '%s'", 1014 __func__, ret, fw_error, fw_error_to_str(fw_error)); 1015 } 1016 1017 return ret; 1018 } 1019 1020 static void 1021 sev_launch_get_measure(Notifier *notifier, void *unused) 1022 { 1023 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); 1024 SevGuestState *sev_guest = SEV_GUEST(sev_common); 1025 int ret, error; 1026 g_autofree guchar *data = NULL; 1027 struct kvm_sev_launch_measure measurement = {}; 1028 1029 if (!sev_check_state(sev_common, SEV_STATE_LAUNCH_UPDATE)) { 1030 return; 1031 } 1032 1033 if (sev_es_enabled()) { 1034 /* measure all the VM save areas before getting launch_measure */ 1035 ret = sev_launch_update_vmsa(sev_guest); 1036 if (ret) { 1037 exit(1); 1038 } 1039 kvm_mark_guest_state_protected(); 1040 } 1041 1042 /* query the measurement blob length */ 1043 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_MEASURE, 1044 &measurement, &error); 1045 if (!measurement.len) { 1046 error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'", 1047 __func__, ret, error, fw_error_to_str(errno)); 1048 return; 1049 } 1050 1051 data = g_new0(guchar, measurement.len); 1052 measurement.uaddr = (unsigned long)data; 1053 1054 /* get the measurement blob */ 1055 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_MEASURE, 1056 &measurement, &error); 1057 if (ret) { 1058 error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'", 1059 __func__, ret, error, fw_error_to_str(errno)); 1060 return; 1061 } 1062 1063 sev_set_guest_state(sev_common, SEV_STATE_LAUNCH_SECRET); 1064 1065 /* encode the measurement value and emit the event */ 1066 sev_guest->measurement = g_base64_encode(data, measurement.len); 1067 trace_kvm_sev_launch_measurement(sev_guest->measurement); 1068 } 1069 1070 static char *sev_get_launch_measurement(void) 1071 { 1072 ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs; 1073 SevGuestState *sev_guest = 1074 (SevGuestState *)object_dynamic_cast(OBJECT(cgs), TYPE_SEV_GUEST); 1075 1076 if (sev_guest && 1077 SEV_COMMON(sev_guest)->state >= SEV_STATE_LAUNCH_SECRET) { 1078 return g_strdup(sev_guest->measurement); 1079 } 1080 1081 return NULL; 1082 } 1083 1084 SevLaunchMeasureInfo *qmp_query_sev_launch_measure(Error **errp) 1085 { 1086 char *data; 1087 SevLaunchMeasureInfo *info; 1088 1089 data = sev_get_launch_measurement(); 1090 if (!data) { 1091 error_setg(errp, "SEV launch measurement is not available"); 1092 return NULL; 1093 } 1094 1095 info = g_malloc0(sizeof(*info)); 1096 info->data = data; 1097 1098 return info; 1099 } 1100 1101 static Notifier sev_machine_done_notify = { 1102 .notify = sev_launch_get_measure, 1103 }; 1104 1105 static void 1106 sev_launch_finish(SevCommonState *sev_common) 1107 { 1108 int ret, error; 1109 1110 trace_kvm_sev_launch_finish(); 1111 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_FINISH, 0, 1112 &error); 1113 if (ret) { 1114 error_report("%s: LAUNCH_FINISH ret=%d fw_error=%d '%s'", 1115 __func__, ret, error, fw_error_to_str(error)); 1116 exit(1); 1117 } 1118 1119 sev_set_guest_state(sev_common, SEV_STATE_RUNNING); 1120 1121 /* add migration blocker */ 1122 error_setg(&sev_mig_blocker, 1123 "SEV: Migration is not implemented"); 1124 migrate_add_blocker(&sev_mig_blocker, &error_fatal); 1125 } 1126 1127 static int 1128 snp_launch_update_data(uint64_t gpa, void *hva, size_t len, int type) 1129 { 1130 SevLaunchUpdateData *data; 1131 1132 data = g_new0(SevLaunchUpdateData, 1); 1133 data->gpa = gpa; 1134 data->hva = hva; 1135 data->len = len; 1136 data->type = type; 1137 1138 QTAILQ_INSERT_TAIL(&launch_update, data, next); 1139 1140 return 0; 1141 } 1142 1143 static int 1144 sev_snp_launch_update_data(SevCommonState *sev_common, hwaddr gpa, 1145 uint8_t *ptr, size_t len) 1146 { 1147 int ret = snp_launch_update_data(gpa, ptr, len, 1148 KVM_SEV_SNP_PAGE_TYPE_NORMAL); 1149 return ret; 1150 } 1151 1152 static int 1153 sev_snp_cpuid_info_fill(SnpCpuidInfo *snp_cpuid_info, 1154 const KvmCpuidInfo *kvm_cpuid_info) 1155 { 1156 size_t i; 1157 1158 if (kvm_cpuid_info->cpuid.nent > SNP_CPUID_FUNCTION_MAXCOUNT) { 1159 error_report("SEV-SNP: CPUID entry count (%d) exceeds max (%d)", 1160 kvm_cpuid_info->cpuid.nent, SNP_CPUID_FUNCTION_MAXCOUNT); 1161 return -1; 1162 } 1163 1164 memset(snp_cpuid_info, 0, sizeof(*snp_cpuid_info)); 1165 1166 for (i = 0; i < kvm_cpuid_info->cpuid.nent; i++) { 1167 const struct kvm_cpuid_entry2 *kvm_cpuid_entry; 1168 SnpCpuidFunc *snp_cpuid_entry; 1169 1170 kvm_cpuid_entry = &kvm_cpuid_info->entries[i]; 1171 snp_cpuid_entry = &snp_cpuid_info->entries[i]; 1172 1173 snp_cpuid_entry->eax_in = kvm_cpuid_entry->function; 1174 if (kvm_cpuid_entry->flags == KVM_CPUID_FLAG_SIGNIFCANT_INDEX) { 1175 snp_cpuid_entry->ecx_in = kvm_cpuid_entry->index; 1176 } 1177 snp_cpuid_entry->eax = kvm_cpuid_entry->eax; 1178 snp_cpuid_entry->ebx = kvm_cpuid_entry->ebx; 1179 snp_cpuid_entry->ecx = kvm_cpuid_entry->ecx; 1180 snp_cpuid_entry->edx = kvm_cpuid_entry->edx; 1181 1182 /* 1183 * Guest kernels will calculate EBX themselves using the 0xD 1184 * subfunctions corresponding to the individual XSAVE areas, so only 1185 * encode the base XSAVE size in the initial leaves, corresponding 1186 * to the initial XCR0=1 state. 1187 */ 1188 if (snp_cpuid_entry->eax_in == 0xD && 1189 (snp_cpuid_entry->ecx_in == 0x0 || snp_cpuid_entry->ecx_in == 0x1)) { 1190 snp_cpuid_entry->ebx = 0x240; 1191 snp_cpuid_entry->xcr0_in = 1; 1192 snp_cpuid_entry->xss_in = 0; 1193 } 1194 } 1195 1196 snp_cpuid_info->count = i; 1197 1198 return 0; 1199 } 1200 1201 static int 1202 snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva, size_t cpuid_len) 1203 { 1204 KvmCpuidInfo kvm_cpuid_info = {0}; 1205 SnpCpuidInfo snp_cpuid_info; 1206 CPUState *cs = first_cpu; 1207 int ret; 1208 uint32_t i = 0; 1209 1210 assert(sizeof(snp_cpuid_info) <= cpuid_len); 1211 1212 /* get the cpuid list from KVM */ 1213 do { 1214 kvm_cpuid_info.cpuid.nent = ++i; 1215 ret = kvm_vcpu_ioctl(cs, KVM_GET_CPUID2, &kvm_cpuid_info); 1216 } while (ret == -E2BIG); 1217 1218 if (ret) { 1219 error_report("SEV-SNP: unable to query CPUID values for CPU: '%s'", 1220 strerror(-ret)); 1221 return 1; 1222 } 1223 1224 ret = sev_snp_cpuid_info_fill(&snp_cpuid_info, &kvm_cpuid_info); 1225 if (ret) { 1226 error_report("SEV-SNP: failed to generate CPUID table information"); 1227 return 1; 1228 } 1229 1230 memcpy(hva, &snp_cpuid_info, sizeof(snp_cpuid_info)); 1231 1232 return snp_launch_update_data(cpuid_addr, hva, cpuid_len, 1233 KVM_SEV_SNP_PAGE_TYPE_CPUID); 1234 } 1235 1236 static int 1237 snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp, uint32_t addr, 1238 void *hva, uint32_t len) 1239 { 1240 int type = KVM_SEV_SNP_PAGE_TYPE_ZERO; 1241 if (sev_snp->parent_obj.kernel_hashes) { 1242 assert(sev_snp->kernel_hashes_data); 1243 assert((sev_snp->kernel_hashes_offset + 1244 sizeof(*sev_snp->kernel_hashes_data)) <= len); 1245 memset(hva, 0, len); 1246 memcpy(hva + sev_snp->kernel_hashes_offset, sev_snp->kernel_hashes_data, 1247 sizeof(*sev_snp->kernel_hashes_data)); 1248 type = KVM_SEV_SNP_PAGE_TYPE_NORMAL; 1249 } 1250 return snp_launch_update_data(addr, hva, len, type); 1251 } 1252 1253 static int 1254 snp_metadata_desc_to_page_type(int desc_type) 1255 { 1256 switch (desc_type) { 1257 /* Add the umeasured prevalidated pages as a zero page */ 1258 case SEV_DESC_TYPE_SNP_SEC_MEM: return KVM_SEV_SNP_PAGE_TYPE_ZERO; 1259 case SEV_DESC_TYPE_SNP_SECRETS: return KVM_SEV_SNP_PAGE_TYPE_SECRETS; 1260 case SEV_DESC_TYPE_CPUID: return KVM_SEV_SNP_PAGE_TYPE_CPUID; 1261 default: 1262 return KVM_SEV_SNP_PAGE_TYPE_ZERO; 1263 } 1264 } 1265 1266 static void 1267 snp_populate_metadata_pages(SevSnpGuestState *sev_snp, 1268 OvmfSevMetadata *metadata) 1269 { 1270 OvmfSevMetadataDesc *desc; 1271 int type, ret, i; 1272 void *hva; 1273 MemoryRegion *mr = NULL; 1274 1275 for (i = 0; i < metadata->num_desc; i++) { 1276 desc = &metadata->descs[i]; 1277 1278 type = snp_metadata_desc_to_page_type(desc->type); 1279 1280 hva = gpa2hva(&mr, desc->base, desc->len, NULL); 1281 if (!hva) { 1282 error_report("%s: Failed to get HVA for GPA 0x%x sz 0x%x", 1283 __func__, desc->base, desc->len); 1284 exit(1); 1285 } 1286 1287 if (type == KVM_SEV_SNP_PAGE_TYPE_CPUID) { 1288 ret = snp_launch_update_cpuid(desc->base, hva, desc->len); 1289 } else if (desc->type == SEV_DESC_TYPE_SNP_KERNEL_HASHES) { 1290 ret = snp_launch_update_kernel_hashes(sev_snp, desc->base, hva, 1291 desc->len); 1292 } else { 1293 ret = snp_launch_update_data(desc->base, hva, desc->len, type); 1294 } 1295 1296 if (ret) { 1297 error_report("%s: Failed to add metadata page gpa 0x%x+%x type %d", 1298 __func__, desc->base, desc->len, desc->type); 1299 exit(1); 1300 } 1301 } 1302 } 1303 1304 static void 1305 sev_snp_launch_finish(SevCommonState *sev_common) 1306 { 1307 int ret, error; 1308 Error *local_err = NULL; 1309 OvmfSevMetadata *metadata; 1310 SevLaunchUpdateData *data; 1311 SevSnpGuestState *sev_snp = SEV_SNP_GUEST(sev_common); 1312 struct kvm_sev_snp_launch_finish *finish = &sev_snp->kvm_finish_conf; 1313 1314 /* 1315 * To boot the SNP guest, the hypervisor is required to populate the CPUID 1316 * and Secrets page before finalizing the launch flow. The location of 1317 * the secrets and CPUID page is available through the OVMF metadata GUID. 1318 */ 1319 metadata = pc_system_get_ovmf_sev_metadata_ptr(); 1320 if (metadata == NULL) { 1321 error_report("%s: Failed to locate SEV metadata header", __func__); 1322 exit(1); 1323 } 1324 1325 /* Populate all the metadata pages */ 1326 snp_populate_metadata_pages(sev_snp, metadata); 1327 1328 QTAILQ_FOREACH(data, &launch_update, next) { 1329 ret = sev_snp_launch_update(sev_snp, data); 1330 if (ret) { 1331 exit(1); 1332 } 1333 } 1334 1335 trace_kvm_sev_snp_launch_finish(sev_snp->id_block_base64, sev_snp->id_auth_base64, 1336 sev_snp->host_data); 1337 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_SNP_LAUNCH_FINISH, 1338 finish, &error); 1339 if (ret) { 1340 error_report("SNP_LAUNCH_FINISH ret=%d fw_error=%d '%s'", 1341 ret, error, fw_error_to_str(error)); 1342 exit(1); 1343 } 1344 1345 kvm_mark_guest_state_protected(); 1346 sev_set_guest_state(sev_common, SEV_STATE_RUNNING); 1347 1348 /* add migration blocker */ 1349 error_setg(&sev_mig_blocker, 1350 "SEV-SNP: Migration is not implemented"); 1351 ret = migrate_add_blocker(&sev_mig_blocker, &local_err); 1352 if (local_err) { 1353 error_report_err(local_err); 1354 error_free(sev_mig_blocker); 1355 exit(1); 1356 } 1357 } 1358 1359 1360 static void 1361 sev_vm_state_change(void *opaque, bool running, RunState state) 1362 { 1363 SevCommonState *sev_common = opaque; 1364 SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(opaque); 1365 1366 if (running) { 1367 if (!sev_check_state(sev_common, SEV_STATE_RUNNING)) { 1368 klass->launch_finish(sev_common); 1369 } 1370 } 1371 } 1372 1373 /* 1374 * This helper is to examine sev-guest properties and determine if any options 1375 * have been set which rely on the newer KVM_SEV_INIT2 interface and associated 1376 * KVM VM types. 1377 */ 1378 static bool sev_init2_required(SevGuestState *sev_guest) 1379 { 1380 /* Currently no KVM_SEV_INIT2-specific options are exposed via QEMU */ 1381 return false; 1382 } 1383 1384 static int sev_kvm_type(X86ConfidentialGuest *cg) 1385 { 1386 SevCommonState *sev_common = SEV_COMMON(cg); 1387 SevGuestState *sev_guest = SEV_GUEST(sev_common); 1388 int kvm_type; 1389 1390 if (sev_common->kvm_type != -1) { 1391 goto out; 1392 } 1393 1394 /* These are the only cases where legacy VM types can be used. */ 1395 if (sev_guest->legacy_vm_type == ON_OFF_AUTO_ON || 1396 (sev_guest->legacy_vm_type == ON_OFF_AUTO_AUTO && 1397 !sev_init2_required(sev_guest))) { 1398 sev_common->kvm_type = KVM_X86_DEFAULT_VM; 1399 goto out; 1400 } 1401 1402 /* 1403 * Newer VM types are required, either explicitly via legacy-vm-type=on, or 1404 * implicitly via legacy-vm-type=auto along with additional sev-guest 1405 * properties that require the newer VM types. 1406 */ 1407 kvm_type = (sev_guest->policy & SEV_POLICY_ES) ? 1408 KVM_X86_SEV_ES_VM : KVM_X86_SEV_VM; 1409 if (!kvm_is_vm_type_supported(kvm_type)) { 1410 if (sev_guest->legacy_vm_type == ON_OFF_AUTO_AUTO) { 1411 error_report("SEV: host kernel does not support requested %s VM type, which is required " 1412 "for the set of options specified. To allow use of the legacy " 1413 "KVM_X86_DEFAULT_VM VM type, please disable any options that are not " 1414 "compatible with the legacy VM type, or upgrade your kernel.", 1415 kvm_type == KVM_X86_SEV_VM ? "KVM_X86_SEV_VM" : "KVM_X86_SEV_ES_VM"); 1416 } else { 1417 error_report("SEV: host kernel does not support requested %s VM type. To allow use of " 1418 "the legacy KVM_X86_DEFAULT_VM VM type, the 'legacy-vm-type' argument " 1419 "must be set to 'on' or 'auto' for the sev-guest object.", 1420 kvm_type == KVM_X86_SEV_VM ? "KVM_X86_SEV_VM" : "KVM_X86_SEV_ES_VM"); 1421 } 1422 1423 return -1; 1424 } 1425 1426 sev_common->kvm_type = kvm_type; 1427 out: 1428 return sev_common->kvm_type; 1429 } 1430 1431 static int sev_snp_kvm_type(X86ConfidentialGuest *cg) 1432 { 1433 return KVM_X86_SNP_VM; 1434 } 1435 1436 static int sev_common_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) 1437 { 1438 char *devname; 1439 int ret, fw_error, cmd; 1440 uint32_t ebx; 1441 uint32_t host_cbitpos; 1442 struct sev_user_data_status status = {}; 1443 SevCommonState *sev_common = SEV_COMMON(cgs); 1444 SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(cgs); 1445 X86ConfidentialGuestClass *x86_klass = 1446 X86_CONFIDENTIAL_GUEST_GET_CLASS(cgs); 1447 1448 sev_common->state = SEV_STATE_UNINIT; 1449 1450 host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL); 1451 host_cbitpos = ebx & 0x3f; 1452 1453 /* 1454 * The cbitpos value will be placed in bit positions 5:0 of the EBX 1455 * register of CPUID 0x8000001F. No need to verify the range as the 1456 * comparison against the host value accomplishes that. 1457 */ 1458 if (host_cbitpos != sev_common->cbitpos) { 1459 error_setg(errp, "%s: cbitpos check failed, host '%d' requested '%d'", 1460 __func__, host_cbitpos, sev_common->cbitpos); 1461 return -1; 1462 } 1463 1464 /* 1465 * The reduced-phys-bits value will be placed in bit positions 11:6 of 1466 * the EBX register of CPUID 0x8000001F, so verify the supplied value 1467 * is in the range of 1 to 63. 1468 */ 1469 if (sev_common->reduced_phys_bits < 1 || 1470 sev_common->reduced_phys_bits > 63) { 1471 error_setg(errp, "%s: reduced_phys_bits check failed," 1472 " it should be in the range of 1 to 63, requested '%d'", 1473 __func__, sev_common->reduced_phys_bits); 1474 return -1; 1475 } 1476 1477 devname = object_property_get_str(OBJECT(sev_common), "sev-device", NULL); 1478 sev_common->sev_fd = open(devname, O_RDWR); 1479 if (sev_common->sev_fd < 0) { 1480 error_setg(errp, "%s: Failed to open %s '%s'", __func__, 1481 devname, strerror(errno)); 1482 g_free(devname); 1483 return -1; 1484 } 1485 g_free(devname); 1486 1487 ret = sev_platform_ioctl(sev_common->sev_fd, SEV_PLATFORM_STATUS, &status, 1488 &fw_error); 1489 if (ret) { 1490 error_setg(errp, "%s: failed to get platform status ret=%d " 1491 "fw_error='%d: %s'", __func__, ret, fw_error, 1492 fw_error_to_str(fw_error)); 1493 return -1; 1494 } 1495 sev_common->build_id = status.build; 1496 sev_common->api_major = status.api_major; 1497 sev_common->api_minor = status.api_minor; 1498 1499 if (sev_es_enabled()) { 1500 if (!kvm_kernel_irqchip_allowed()) { 1501 error_setg(errp, "%s: SEV-ES guests require in-kernel irqchip" 1502 "support", __func__); 1503 return -1; 1504 } 1505 } 1506 1507 if (sev_es_enabled() && !sev_snp_enabled()) { 1508 if (!(status.flags & SEV_STATUS_FLAGS_CONFIG_ES)) { 1509 error_setg(errp, "%s: guest policy requires SEV-ES, but " 1510 "host SEV-ES support unavailable", 1511 __func__); 1512 return -1; 1513 } 1514 } 1515 1516 trace_kvm_sev_init(); 1517 switch (x86_klass->kvm_type(X86_CONFIDENTIAL_GUEST(sev_common))) { 1518 case KVM_X86_DEFAULT_VM: 1519 cmd = sev_es_enabled() ? KVM_SEV_ES_INIT : KVM_SEV_INIT; 1520 1521 ret = sev_ioctl(sev_common->sev_fd, cmd, NULL, &fw_error); 1522 break; 1523 case KVM_X86_SEV_VM: 1524 case KVM_X86_SEV_ES_VM: 1525 case KVM_X86_SNP_VM: { 1526 struct kvm_sev_init args = { 0 }; 1527 1528 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_INIT2, &args, &fw_error); 1529 break; 1530 } 1531 default: 1532 error_setg(errp, "%s: host kernel does not support the requested SEV configuration.", 1533 __func__); 1534 return -1; 1535 } 1536 1537 if (ret) { 1538 error_setg(errp, "%s: failed to initialize ret=%d fw_error=%d '%s'", 1539 __func__, ret, fw_error, fw_error_to_str(fw_error)); 1540 return -1; 1541 } 1542 1543 ret = klass->launch_start(sev_common); 1544 1545 if (ret) { 1546 error_setg(errp, "%s: failed to create encryption context", __func__); 1547 return -1; 1548 } 1549 1550 if (klass->kvm_init && klass->kvm_init(cgs, errp)) { 1551 return -1; 1552 } 1553 1554 qemu_add_vm_change_state_handler(sev_vm_state_change, sev_common); 1555 1556 cgs->ready = true; 1557 1558 return 0; 1559 } 1560 1561 static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) 1562 { 1563 int ret; 1564 1565 /* 1566 * SEV/SEV-ES rely on pinned memory to back guest RAM so discarding 1567 * isn't actually possible. With SNP, only guest_memfd pages are used 1568 * for private guest memory, so discarding of shared memory is still 1569 * possible.. 1570 */ 1571 ret = ram_block_discard_disable(true); 1572 if (ret) { 1573 error_setg(errp, "%s: cannot disable RAM discard", __func__); 1574 return -1; 1575 } 1576 1577 /* 1578 * SEV uses these notifiers to register/pin pages prior to guest use, 1579 * but SNP relies on guest_memfd for private pages, which has its 1580 * own internal mechanisms for registering/pinning private memory. 1581 */ 1582 ram_block_notifier_add(&sev_ram_notifier); 1583 1584 /* 1585 * The machine done notify event is used for SEV guests to get the 1586 * measurement of the encrypted images. When SEV-SNP is enabled, the 1587 * measurement is part of the guest attestation process where it can 1588 * be collected without any reliance on the VMM. So skip registering 1589 * the notifier for SNP in favor of using guest attestation instead. 1590 */ 1591 qemu_add_machine_init_done_notifier(&sev_machine_done_notify); 1592 1593 return 0; 1594 } 1595 1596 static int sev_snp_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) 1597 { 1598 MachineState *ms = MACHINE(qdev_get_machine()); 1599 X86MachineState *x86ms = X86_MACHINE(ms); 1600 1601 if (x86ms->smm == ON_OFF_AUTO_AUTO) { 1602 x86ms->smm = ON_OFF_AUTO_OFF; 1603 } else if (x86ms->smm == ON_OFF_AUTO_ON) { 1604 error_setg(errp, "SEV-SNP does not support SMM."); 1605 return -1; 1606 } 1607 1608 return 0; 1609 } 1610 1611 int 1612 sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp) 1613 { 1614 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); 1615 SevCommonStateClass *klass; 1616 1617 if (!sev_common) { 1618 return 0; 1619 } 1620 klass = SEV_COMMON_GET_CLASS(sev_common); 1621 1622 /* if SEV is in update state then encrypt the data else do nothing */ 1623 if (sev_check_state(sev_common, SEV_STATE_LAUNCH_UPDATE)) { 1624 int ret; 1625 1626 ret = klass->launch_update_data(sev_common, gpa, ptr, len); 1627 if (ret < 0) { 1628 error_setg(errp, "SEV: Failed to encrypt pflash rom"); 1629 return ret; 1630 } 1631 } 1632 1633 return 0; 1634 } 1635 1636 int sev_inject_launch_secret(const char *packet_hdr, const char *secret, 1637 uint64_t gpa, Error **errp) 1638 { 1639 ERRP_GUARD(); 1640 struct kvm_sev_launch_secret input; 1641 g_autofree guchar *data = NULL, *hdr = NULL; 1642 int error, ret = 1; 1643 void *hva; 1644 gsize hdr_sz = 0, data_sz = 0; 1645 MemoryRegion *mr = NULL; 1646 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); 1647 1648 if (!sev_common) { 1649 error_setg(errp, "SEV not enabled for guest"); 1650 return 1; 1651 } 1652 1653 /* secret can be injected only in this state */ 1654 if (!sev_check_state(sev_common, SEV_STATE_LAUNCH_SECRET)) { 1655 error_setg(errp, "SEV: Not in correct state. (LSECRET) %x", 1656 sev_common->state); 1657 return 1; 1658 } 1659 1660 hdr = g_base64_decode(packet_hdr, &hdr_sz); 1661 if (!hdr || !hdr_sz) { 1662 error_setg(errp, "SEV: Failed to decode sequence header"); 1663 return 1; 1664 } 1665 1666 data = g_base64_decode(secret, &data_sz); 1667 if (!data || !data_sz) { 1668 error_setg(errp, "SEV: Failed to decode data"); 1669 return 1; 1670 } 1671 1672 hva = gpa2hva(&mr, gpa, data_sz, errp); 1673 if (!hva) { 1674 error_prepend(errp, "SEV: Failed to calculate guest address: "); 1675 return 1; 1676 } 1677 1678 input.hdr_uaddr = (uint64_t)(unsigned long)hdr; 1679 input.hdr_len = hdr_sz; 1680 1681 input.trans_uaddr = (uint64_t)(unsigned long)data; 1682 input.trans_len = data_sz; 1683 1684 input.guest_uaddr = (uint64_t)(unsigned long)hva; 1685 input.guest_len = data_sz; 1686 1687 trace_kvm_sev_launch_secret(gpa, input.guest_uaddr, 1688 input.trans_uaddr, input.trans_len); 1689 1690 ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_SECRET, 1691 &input, &error); 1692 if (ret) { 1693 error_setg(errp, "SEV: failed to inject secret ret=%d fw_error=%d '%s'", 1694 ret, error, fw_error_to_str(error)); 1695 return ret; 1696 } 1697 1698 return 0; 1699 } 1700 1701 #define SEV_SECRET_GUID "4c2eb361-7d9b-4cc3-8081-127c90d3d294" 1702 struct sev_secret_area { 1703 uint32_t base; 1704 uint32_t size; 1705 }; 1706 1707 void qmp_sev_inject_launch_secret(const char *packet_hdr, 1708 const char *secret, 1709 bool has_gpa, uint64_t gpa, 1710 Error **errp) 1711 { 1712 if (!sev_enabled()) { 1713 error_setg(errp, "SEV not enabled for guest"); 1714 return; 1715 } 1716 if (!has_gpa) { 1717 uint8_t *data; 1718 struct sev_secret_area *area; 1719 1720 if (!pc_system_ovmf_table_find(SEV_SECRET_GUID, &data, NULL)) { 1721 error_setg(errp, "SEV: no secret area found in OVMF," 1722 " gpa must be specified."); 1723 return; 1724 } 1725 area = (struct sev_secret_area *)data; 1726 gpa = area->base; 1727 } 1728 1729 sev_inject_launch_secret(packet_hdr, secret, gpa, errp); 1730 } 1731 1732 static int 1733 sev_es_parse_reset_block(SevInfoBlock *info, uint32_t *addr) 1734 { 1735 if (!info->reset_addr) { 1736 error_report("SEV-ES reset address is zero"); 1737 return 1; 1738 } 1739 1740 *addr = info->reset_addr; 1741 1742 return 0; 1743 } 1744 1745 static int 1746 sev_es_find_reset_vector(void *flash_ptr, uint64_t flash_size, 1747 uint32_t *addr) 1748 { 1749 QemuUUID info_guid, *guid; 1750 SevInfoBlock *info; 1751 uint8_t *data; 1752 uint16_t *len; 1753 1754 /* 1755 * Initialize the address to zero. An address of zero with a successful 1756 * return code indicates that SEV-ES is not active. 1757 */ 1758 *addr = 0; 1759 1760 /* 1761 * Extract the AP reset vector for SEV-ES guests by locating the SEV GUID. 1762 * The SEV GUID is located on its own (original implementation) or within 1763 * the Firmware GUID Table (new implementation), either of which are 1764 * located 32 bytes from the end of the flash. 1765 * 1766 * Check the Firmware GUID Table first. 1767 */ 1768 if (pc_system_ovmf_table_find(SEV_INFO_BLOCK_GUID, &data, NULL)) { 1769 return sev_es_parse_reset_block((SevInfoBlock *)data, addr); 1770 } 1771 1772 /* 1773 * SEV info block not found in the Firmware GUID Table (or there isn't 1774 * a Firmware GUID Table), fall back to the original implementation. 1775 */ 1776 data = flash_ptr + flash_size - 0x20; 1777 1778 qemu_uuid_parse(SEV_INFO_BLOCK_GUID, &info_guid); 1779 info_guid = qemu_uuid_bswap(info_guid); /* GUIDs are LE */ 1780 1781 guid = (QemuUUID *)(data - sizeof(info_guid)); 1782 if (!qemu_uuid_is_equal(guid, &info_guid)) { 1783 error_report("SEV information block/Firmware GUID Table block not found in pflash rom"); 1784 return 1; 1785 } 1786 1787 len = (uint16_t *)((uint8_t *)guid - sizeof(*len)); 1788 info = (SevInfoBlock *)(data - le16_to_cpu(*len)); 1789 1790 return sev_es_parse_reset_block(info, addr); 1791 } 1792 1793 void sev_es_set_reset_vector(CPUState *cpu) 1794 { 1795 X86CPU *x86; 1796 CPUX86State *env; 1797 ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs; 1798 SevCommonState *sev_common = SEV_COMMON( 1799 object_dynamic_cast(OBJECT(cgs), TYPE_SEV_COMMON)); 1800 1801 /* Only update if we have valid reset information */ 1802 if (!sev_common || !sev_common->reset_data_valid) { 1803 return; 1804 } 1805 1806 /* Do not update the BSP reset state */ 1807 if (cpu->cpu_index == 0) { 1808 return; 1809 } 1810 1811 x86 = X86_CPU(cpu); 1812 env = &x86->env; 1813 1814 cpu_x86_load_seg_cache(env, R_CS, 0xf000, sev_common->reset_cs, 0xffff, 1815 DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK | 1816 DESC_R_MASK | DESC_A_MASK); 1817 1818 env->eip = sev_common->reset_ip; 1819 } 1820 1821 int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size) 1822 { 1823 CPUState *cpu; 1824 uint32_t addr; 1825 int ret; 1826 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); 1827 1828 if (!sev_es_enabled()) { 1829 return 0; 1830 } 1831 1832 addr = 0; 1833 ret = sev_es_find_reset_vector(flash_ptr, flash_size, 1834 &addr); 1835 if (ret) { 1836 return ret; 1837 } 1838 1839 if (addr) { 1840 sev_common->reset_cs = addr & 0xffff0000; 1841 sev_common->reset_ip = addr & 0x0000ffff; 1842 sev_common->reset_data_valid = true; 1843 1844 CPU_FOREACH(cpu) { 1845 sev_es_set_reset_vector(cpu); 1846 } 1847 } 1848 1849 return 0; 1850 } 1851 1852 static const QemuUUID sev_hash_table_header_guid = { 1853 .data = UUID_LE(0x9438d606, 0x4f22, 0x4cc9, 0xb4, 0x79, 0xa7, 0x93, 1854 0xd4, 0x11, 0xfd, 0x21) 1855 }; 1856 1857 static const QemuUUID sev_kernel_entry_guid = { 1858 .data = UUID_LE(0x4de79437, 0xabd2, 0x427f, 0xb8, 0x35, 0xd5, 0xb1, 1859 0x72, 0xd2, 0x04, 0x5b) 1860 }; 1861 static const QemuUUID sev_initrd_entry_guid = { 1862 .data = UUID_LE(0x44baf731, 0x3a2f, 0x4bd7, 0x9a, 0xf1, 0x41, 0xe2, 1863 0x91, 0x69, 0x78, 0x1d) 1864 }; 1865 static const QemuUUID sev_cmdline_entry_guid = { 1866 .data = UUID_LE(0x97d02dd8, 0xbd20, 0x4c94, 0xaa, 0x78, 0xe7, 0x71, 1867 0x4d, 0x36, 0xab, 0x2a) 1868 }; 1869 1870 static bool build_kernel_loader_hashes(PaddedSevHashTable *padded_ht, 1871 SevKernelLoaderContext *ctx, 1872 Error **errp) 1873 { 1874 SevHashTable *ht; 1875 uint8_t cmdline_hash[HASH_SIZE]; 1876 uint8_t initrd_hash[HASH_SIZE]; 1877 uint8_t kernel_hash[HASH_SIZE]; 1878 uint8_t *hashp; 1879 size_t hash_len = HASH_SIZE; 1880 1881 /* 1882 * Calculate hash of kernel command-line with the terminating null byte. If 1883 * the user doesn't supply a command-line via -append, the 1-byte "\0" will 1884 * be used. 1885 */ 1886 hashp = cmdline_hash; 1887 if (qcrypto_hash_bytes(QCRYPTO_HASH_ALGO_SHA256, ctx->cmdline_data, 1888 ctx->cmdline_size, &hashp, &hash_len, errp) < 0) { 1889 return false; 1890 } 1891 assert(hash_len == HASH_SIZE); 1892 1893 /* 1894 * Calculate hash of initrd. If the user doesn't supply an initrd via 1895 * -initrd, an empty buffer will be used (ctx->initrd_size == 0). 1896 */ 1897 hashp = initrd_hash; 1898 if (qcrypto_hash_bytes(QCRYPTO_HASH_ALGO_SHA256, ctx->initrd_data, 1899 ctx->initrd_size, &hashp, &hash_len, errp) < 0) { 1900 return false; 1901 } 1902 assert(hash_len == HASH_SIZE); 1903 1904 /* Calculate hash of the kernel */ 1905 hashp = kernel_hash; 1906 struct iovec iov[2] = { 1907 { .iov_base = ctx->setup_data, .iov_len = ctx->setup_size }, 1908 { .iov_base = ctx->kernel_data, .iov_len = ctx->kernel_size } 1909 }; 1910 if (qcrypto_hash_bytesv(QCRYPTO_HASH_ALGO_SHA256, iov, ARRAY_SIZE(iov), 1911 &hashp, &hash_len, errp) < 0) { 1912 return false; 1913 } 1914 assert(hash_len == HASH_SIZE); 1915 1916 ht = &padded_ht->ht; 1917 1918 ht->guid = sev_hash_table_header_guid; 1919 ht->len = sizeof(*ht); 1920 1921 ht->cmdline.guid = sev_cmdline_entry_guid; 1922 ht->cmdline.len = sizeof(ht->cmdline); 1923 memcpy(ht->cmdline.hash, cmdline_hash, sizeof(ht->cmdline.hash)); 1924 1925 ht->initrd.guid = sev_initrd_entry_guid; 1926 ht->initrd.len = sizeof(ht->initrd); 1927 memcpy(ht->initrd.hash, initrd_hash, sizeof(ht->initrd.hash)); 1928 1929 ht->kernel.guid = sev_kernel_entry_guid; 1930 ht->kernel.len = sizeof(ht->kernel); 1931 memcpy(ht->kernel.hash, kernel_hash, sizeof(ht->kernel.hash)); 1932 1933 /* zero the excess data so the measurement can be reliably calculated */ 1934 memset(padded_ht->padding, 0, sizeof(padded_ht->padding)); 1935 1936 return true; 1937 } 1938 1939 static bool sev_snp_build_kernel_loader_hashes(SevCommonState *sev_common, 1940 SevHashTableDescriptor *area, 1941 SevKernelLoaderContext *ctx, 1942 Error **errp) 1943 { 1944 /* 1945 * SNP: Populate the hashes table in an area that later in 1946 * snp_launch_update_kernel_hashes() will be copied to the guest memory 1947 * and encrypted. 1948 */ 1949 SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(sev_common); 1950 sev_snp_guest->kernel_hashes_offset = area->base & ~TARGET_PAGE_MASK; 1951 sev_snp_guest->kernel_hashes_data = g_new0(PaddedSevHashTable, 1); 1952 return build_kernel_loader_hashes(sev_snp_guest->kernel_hashes_data, ctx, errp); 1953 } 1954 1955 static bool sev_build_kernel_loader_hashes(SevCommonState *sev_common, 1956 SevHashTableDescriptor *area, 1957 SevKernelLoaderContext *ctx, 1958 Error **errp) 1959 { 1960 PaddedSevHashTable *padded_ht; 1961 hwaddr mapped_len = sizeof(*padded_ht); 1962 MemTxAttrs attrs = { 0 }; 1963 bool ret = true; 1964 1965 /* 1966 * Populate the hashes table in the guest's memory at the OVMF-designated 1967 * area for the SEV hashes table 1968 */ 1969 padded_ht = address_space_map(&address_space_memory, area->base, 1970 &mapped_len, true, attrs); 1971 if (!padded_ht || mapped_len != sizeof(*padded_ht)) { 1972 error_setg(errp, "SEV: cannot map hashes table guest memory area"); 1973 return false; 1974 } 1975 1976 if (build_kernel_loader_hashes(padded_ht, ctx, errp)) { 1977 if (sev_encrypt_flash(area->base, (uint8_t *)padded_ht, 1978 sizeof(*padded_ht), errp) < 0) { 1979 ret = false; 1980 } 1981 } else { 1982 ret = false; 1983 } 1984 1985 address_space_unmap(&address_space_memory, padded_ht, 1986 mapped_len, true, mapped_len); 1987 1988 return ret; 1989 } 1990 1991 /* 1992 * Add the hashes of the linux kernel/initrd/cmdline to an encrypted guest page 1993 * which is included in SEV's initial memory measurement. 1994 */ 1995 bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp) 1996 { 1997 uint8_t *data; 1998 SevHashTableDescriptor *area; 1999 SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); 2000 SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(sev_common); 2001 2002 /* 2003 * Only add the kernel hashes if the sev-guest configuration explicitly 2004 * stated kernel-hashes=on. 2005 */ 2006 if (!sev_common->kernel_hashes) { 2007 return false; 2008 } 2009 2010 if (!pc_system_ovmf_table_find(SEV_HASH_TABLE_RV_GUID, &data, NULL)) { 2011 error_setg(errp, "SEV: kernel specified but guest firmware " 2012 "has no hashes table GUID"); 2013 return false; 2014 } 2015 2016 area = (SevHashTableDescriptor *)data; 2017 if (!area->base || area->size < sizeof(PaddedSevHashTable)) { 2018 error_setg(errp, "SEV: guest firmware hashes table area is invalid " 2019 "(base=0x%x size=0x%x)", area->base, area->size); 2020 return false; 2021 } 2022 2023 return klass->build_kernel_loader_hashes(sev_common, area, ctx, errp); 2024 } 2025 2026 static char * 2027 sev_common_get_sev_device(Object *obj, Error **errp) 2028 { 2029 return g_strdup(SEV_COMMON(obj)->sev_device); 2030 } 2031 2032 static void 2033 sev_common_set_sev_device(Object *obj, const char *value, Error **errp) 2034 { 2035 SEV_COMMON(obj)->sev_device = g_strdup(value); 2036 } 2037 2038 static bool sev_common_get_kernel_hashes(Object *obj, Error **errp) 2039 { 2040 return SEV_COMMON(obj)->kernel_hashes; 2041 } 2042 2043 static void sev_common_set_kernel_hashes(Object *obj, bool value, Error **errp) 2044 { 2045 SEV_COMMON(obj)->kernel_hashes = value; 2046 } 2047 2048 static void 2049 sev_common_class_init(ObjectClass *oc, const void *data) 2050 { 2051 ConfidentialGuestSupportClass *klass = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc); 2052 2053 klass->kvm_init = sev_common_kvm_init; 2054 2055 object_class_property_add_str(oc, "sev-device", 2056 sev_common_get_sev_device, 2057 sev_common_set_sev_device); 2058 object_class_property_set_description(oc, "sev-device", 2059 "SEV device to use"); 2060 object_class_property_add_bool(oc, "kernel-hashes", 2061 sev_common_get_kernel_hashes, 2062 sev_common_set_kernel_hashes); 2063 object_class_property_set_description(oc, "kernel-hashes", 2064 "add kernel hashes to guest firmware for measured Linux boot"); 2065 } 2066 2067 static void 2068 sev_common_instance_init(Object *obj) 2069 { 2070 SevCommonState *sev_common = SEV_COMMON(obj); 2071 2072 sev_common->kvm_type = -1; 2073 2074 sev_common->sev_device = g_strdup(DEFAULT_SEV_DEVICE); 2075 2076 object_property_add_uint32_ptr(obj, "cbitpos", &sev_common->cbitpos, 2077 OBJ_PROP_FLAG_READWRITE); 2078 object_property_add_uint32_ptr(obj, "reduced-phys-bits", 2079 &sev_common->reduced_phys_bits, 2080 OBJ_PROP_FLAG_READWRITE); 2081 } 2082 2083 /* sev guest info common to sev/sev-es/sev-snp */ 2084 static const TypeInfo sev_common_info = { 2085 .parent = TYPE_X86_CONFIDENTIAL_GUEST, 2086 .name = TYPE_SEV_COMMON, 2087 .instance_size = sizeof(SevCommonState), 2088 .instance_init = sev_common_instance_init, 2089 .class_size = sizeof(SevCommonStateClass), 2090 .class_init = sev_common_class_init, 2091 .abstract = true, 2092 .interfaces = (const InterfaceInfo[]) { 2093 { TYPE_USER_CREATABLE }, 2094 { } 2095 } 2096 }; 2097 2098 static char * 2099 sev_guest_get_dh_cert_file(Object *obj, Error **errp) 2100 { 2101 return g_strdup(SEV_GUEST(obj)->dh_cert_file); 2102 } 2103 2104 static void 2105 sev_guest_set_dh_cert_file(Object *obj, const char *value, Error **errp) 2106 { 2107 SEV_GUEST(obj)->dh_cert_file = g_strdup(value); 2108 } 2109 2110 static char * 2111 sev_guest_get_session_file(Object *obj, Error **errp) 2112 { 2113 SevGuestState *sev_guest = SEV_GUEST(obj); 2114 2115 return sev_guest->session_file ? g_strdup(sev_guest->session_file) : NULL; 2116 } 2117 2118 static void 2119 sev_guest_set_session_file(Object *obj, const char *value, Error **errp) 2120 { 2121 SEV_GUEST(obj)->session_file = g_strdup(value); 2122 } 2123 2124 static void sev_guest_get_legacy_vm_type(Object *obj, Visitor *v, 2125 const char *name, void *opaque, 2126 Error **errp) 2127 { 2128 SevGuestState *sev_guest = SEV_GUEST(obj); 2129 OnOffAuto legacy_vm_type = sev_guest->legacy_vm_type; 2130 2131 visit_type_OnOffAuto(v, name, &legacy_vm_type, errp); 2132 } 2133 2134 static void sev_guest_set_legacy_vm_type(Object *obj, Visitor *v, 2135 const char *name, void *opaque, 2136 Error **errp) 2137 { 2138 SevGuestState *sev_guest = SEV_GUEST(obj); 2139 2140 visit_type_OnOffAuto(v, name, &sev_guest->legacy_vm_type, errp); 2141 } 2142 2143 static void 2144 sev_guest_class_init(ObjectClass *oc, const void *data) 2145 { 2146 SevCommonStateClass *klass = SEV_COMMON_CLASS(oc); 2147 X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc); 2148 2149 klass->build_kernel_loader_hashes = sev_build_kernel_loader_hashes; 2150 klass->launch_start = sev_launch_start; 2151 klass->launch_finish = sev_launch_finish; 2152 klass->launch_update_data = sev_launch_update_data; 2153 klass->kvm_init = sev_kvm_init; 2154 x86_klass->kvm_type = sev_kvm_type; 2155 2156 object_class_property_add_str(oc, "dh-cert-file", 2157 sev_guest_get_dh_cert_file, 2158 sev_guest_set_dh_cert_file); 2159 object_class_property_set_description(oc, "dh-cert-file", 2160 "guest owners DH certificate (encoded with base64)"); 2161 object_class_property_add_str(oc, "session-file", 2162 sev_guest_get_session_file, 2163 sev_guest_set_session_file); 2164 object_class_property_set_description(oc, "session-file", 2165 "guest owners session parameters (encoded with base64)"); 2166 object_class_property_add(oc, "legacy-vm-type", "OnOffAuto", 2167 sev_guest_get_legacy_vm_type, 2168 sev_guest_set_legacy_vm_type, NULL, NULL); 2169 object_class_property_set_description(oc, "legacy-vm-type", 2170 "use legacy VM type to maintain measurement compatibility with older QEMU or kernel versions."); 2171 } 2172 2173 static void 2174 sev_guest_instance_init(Object *obj) 2175 { 2176 SevGuestState *sev_guest = SEV_GUEST(obj); 2177 2178 sev_guest->policy = DEFAULT_GUEST_POLICY; 2179 object_property_add_uint32_ptr(obj, "handle", &sev_guest->handle, 2180 OBJ_PROP_FLAG_READWRITE); 2181 object_property_add_uint32_ptr(obj, "policy", &sev_guest->policy, 2182 OBJ_PROP_FLAG_READWRITE); 2183 object_apply_compat_props(obj); 2184 2185 sev_guest->legacy_vm_type = ON_OFF_AUTO_AUTO; 2186 } 2187 2188 /* guest info specific sev/sev-es */ 2189 static const TypeInfo sev_guest_info = { 2190 .parent = TYPE_SEV_COMMON, 2191 .name = TYPE_SEV_GUEST, 2192 .instance_size = sizeof(SevGuestState), 2193 .instance_init = sev_guest_instance_init, 2194 .class_init = sev_guest_class_init, 2195 }; 2196 2197 static void 2198 sev_snp_guest_get_policy(Object *obj, Visitor *v, const char *name, 2199 void *opaque, Error **errp) 2200 { 2201 visit_type_uint64(v, name, 2202 (uint64_t *)&SEV_SNP_GUEST(obj)->kvm_start_conf.policy, 2203 errp); 2204 } 2205 2206 static void 2207 sev_snp_guest_set_policy(Object *obj, Visitor *v, const char *name, 2208 void *opaque, Error **errp) 2209 { 2210 visit_type_uint64(v, name, 2211 (uint64_t *)&SEV_SNP_GUEST(obj)->kvm_start_conf.policy, 2212 errp); 2213 } 2214 2215 static char * 2216 sev_snp_guest_get_guest_visible_workarounds(Object *obj, Error **errp) 2217 { 2218 return g_strdup(SEV_SNP_GUEST(obj)->guest_visible_workarounds); 2219 } 2220 2221 static void 2222 sev_snp_guest_set_guest_visible_workarounds(Object *obj, const char *value, 2223 Error **errp) 2224 { 2225 SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj); 2226 struct kvm_sev_snp_launch_start *start = &sev_snp_guest->kvm_start_conf; 2227 g_autofree guchar *blob; 2228 gsize len; 2229 2230 g_free(sev_snp_guest->guest_visible_workarounds); 2231 2232 /* store the base64 str so we don't need to re-encode in getter */ 2233 sev_snp_guest->guest_visible_workarounds = g_strdup(value); 2234 2235 blob = qbase64_decode(sev_snp_guest->guest_visible_workarounds, 2236 -1, &len, errp); 2237 if (!blob) { 2238 return; 2239 } 2240 2241 if (len != sizeof(start->gosvw)) { 2242 error_setg(errp, "parameter length of %" G_GSIZE_FORMAT 2243 " exceeds max of %zu", 2244 len, sizeof(start->gosvw)); 2245 return; 2246 } 2247 2248 memcpy(start->gosvw, blob, len); 2249 } 2250 2251 static char * 2252 sev_snp_guest_get_id_block(Object *obj, Error **errp) 2253 { 2254 SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj); 2255 2256 return g_strdup(sev_snp_guest->id_block_base64); 2257 } 2258 2259 static void 2260 sev_snp_guest_set_id_block(Object *obj, const char *value, Error **errp) 2261 { 2262 SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj); 2263 struct kvm_sev_snp_launch_finish *finish = &sev_snp_guest->kvm_finish_conf; 2264 gsize len; 2265 2266 finish->id_block_en = 0; 2267 g_free(sev_snp_guest->id_block); 2268 g_free(sev_snp_guest->id_block_base64); 2269 2270 /* store the base64 str so we don't need to re-encode in getter */ 2271 sev_snp_guest->id_block_base64 = g_strdup(value); 2272 sev_snp_guest->id_block = 2273 qbase64_decode(sev_snp_guest->id_block_base64, -1, &len, errp); 2274 2275 if (!sev_snp_guest->id_block) { 2276 return; 2277 } 2278 2279 if (len != KVM_SEV_SNP_ID_BLOCK_SIZE) { 2280 error_setg(errp, "parameter length of %" G_GSIZE_FORMAT 2281 " not equal to %u", 2282 len, KVM_SEV_SNP_ID_BLOCK_SIZE); 2283 return; 2284 } 2285 2286 finish->id_block_en = 1; 2287 finish->id_block_uaddr = (uintptr_t)sev_snp_guest->id_block; 2288 } 2289 2290 static char * 2291 sev_snp_guest_get_id_auth(Object *obj, Error **errp) 2292 { 2293 SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj); 2294 2295 return g_strdup(sev_snp_guest->id_auth_base64); 2296 } 2297 2298 static void 2299 sev_snp_guest_set_id_auth(Object *obj, const char *value, Error **errp) 2300 { 2301 SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj); 2302 struct kvm_sev_snp_launch_finish *finish = &sev_snp_guest->kvm_finish_conf; 2303 gsize len; 2304 2305 finish->id_auth_uaddr = 0; 2306 g_free(sev_snp_guest->id_auth); 2307 g_free(sev_snp_guest->id_auth_base64); 2308 2309 /* store the base64 str so we don't need to re-encode in getter */ 2310 sev_snp_guest->id_auth_base64 = g_strdup(value); 2311 sev_snp_guest->id_auth = 2312 qbase64_decode(sev_snp_guest->id_auth_base64, -1, &len, errp); 2313 2314 if (!sev_snp_guest->id_auth) { 2315 return; 2316 } 2317 2318 if (len > KVM_SEV_SNP_ID_AUTH_SIZE) { 2319 error_setg(errp, "parameter length:ID_AUTH %" G_GSIZE_FORMAT 2320 " exceeds max of %u", 2321 len, KVM_SEV_SNP_ID_AUTH_SIZE); 2322 return; 2323 } 2324 2325 finish->id_auth_uaddr = (uintptr_t)sev_snp_guest->id_auth; 2326 } 2327 2328 static bool 2329 sev_snp_guest_get_author_key_enabled(Object *obj, Error **errp) 2330 { 2331 SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj); 2332 2333 return !!sev_snp_guest->kvm_finish_conf.auth_key_en; 2334 } 2335 2336 static void 2337 sev_snp_guest_set_author_key_enabled(Object *obj, bool value, Error **errp) 2338 { 2339 SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj); 2340 2341 sev_snp_guest->kvm_finish_conf.auth_key_en = value; 2342 } 2343 2344 static bool 2345 sev_snp_guest_get_vcek_disabled(Object *obj, Error **errp) 2346 { 2347 SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj); 2348 2349 return !!sev_snp_guest->kvm_finish_conf.vcek_disabled; 2350 } 2351 2352 static void 2353 sev_snp_guest_set_vcek_disabled(Object *obj, bool value, Error **errp) 2354 { 2355 SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj); 2356 2357 sev_snp_guest->kvm_finish_conf.vcek_disabled = value; 2358 } 2359 2360 static char * 2361 sev_snp_guest_get_host_data(Object *obj, Error **errp) 2362 { 2363 SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj); 2364 2365 return g_strdup(sev_snp_guest->host_data); 2366 } 2367 2368 static void 2369 sev_snp_guest_set_host_data(Object *obj, const char *value, Error **errp) 2370 { 2371 SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj); 2372 struct kvm_sev_snp_launch_finish *finish = &sev_snp_guest->kvm_finish_conf; 2373 g_autofree guchar *blob; 2374 gsize len; 2375 2376 g_free(sev_snp_guest->host_data); 2377 2378 /* store the base64 str so we don't need to re-encode in getter */ 2379 sev_snp_guest->host_data = g_strdup(value); 2380 2381 blob = qbase64_decode(sev_snp_guest->host_data, -1, &len, errp); 2382 2383 if (!blob) { 2384 return; 2385 } 2386 2387 if (len != sizeof(finish->host_data)) { 2388 error_setg(errp, "parameter length of %" G_GSIZE_FORMAT 2389 " not equal to %zu", 2390 len, sizeof(finish->host_data)); 2391 return; 2392 } 2393 2394 memcpy(finish->host_data, blob, len); 2395 } 2396 2397 static void 2398 sev_snp_guest_class_init(ObjectClass *oc, const void *data) 2399 { 2400 SevCommonStateClass *klass = SEV_COMMON_CLASS(oc); 2401 X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc); 2402 2403 klass->build_kernel_loader_hashes = sev_snp_build_kernel_loader_hashes; 2404 klass->launch_start = sev_snp_launch_start; 2405 klass->launch_finish = sev_snp_launch_finish; 2406 klass->launch_update_data = sev_snp_launch_update_data; 2407 klass->kvm_init = sev_snp_kvm_init; 2408 x86_klass->mask_cpuid_features = sev_snp_mask_cpuid_features; 2409 x86_klass->kvm_type = sev_snp_kvm_type; 2410 2411 object_class_property_add(oc, "policy", "uint64", 2412 sev_snp_guest_get_policy, 2413 sev_snp_guest_set_policy, NULL, NULL); 2414 object_class_property_add_str(oc, "guest-visible-workarounds", 2415 sev_snp_guest_get_guest_visible_workarounds, 2416 sev_snp_guest_set_guest_visible_workarounds); 2417 object_class_property_add_str(oc, "id-block", 2418 sev_snp_guest_get_id_block, 2419 sev_snp_guest_set_id_block); 2420 object_class_property_add_str(oc, "id-auth", 2421 sev_snp_guest_get_id_auth, 2422 sev_snp_guest_set_id_auth); 2423 object_class_property_add_bool(oc, "author-key-enabled", 2424 sev_snp_guest_get_author_key_enabled, 2425 sev_snp_guest_set_author_key_enabled); 2426 object_class_property_add_bool(oc, "vcek-disabled", 2427 sev_snp_guest_get_vcek_disabled, 2428 sev_snp_guest_set_vcek_disabled); 2429 object_class_property_add_str(oc, "host-data", 2430 sev_snp_guest_get_host_data, 2431 sev_snp_guest_set_host_data); 2432 } 2433 2434 static void 2435 sev_snp_guest_instance_init(Object *obj) 2436 { 2437 ConfidentialGuestSupport *cgs = CONFIDENTIAL_GUEST_SUPPORT(obj); 2438 SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj); 2439 2440 cgs->require_guest_memfd = true; 2441 2442 /* default init/start/finish params for kvm */ 2443 sev_snp_guest->kvm_start_conf.policy = DEFAULT_SEV_SNP_POLICY; 2444 } 2445 2446 /* guest info specific to sev-snp */ 2447 static const TypeInfo sev_snp_guest_info = { 2448 .parent = TYPE_SEV_COMMON, 2449 .name = TYPE_SEV_SNP_GUEST, 2450 .instance_size = sizeof(SevSnpGuestState), 2451 .class_init = sev_snp_guest_class_init, 2452 .instance_init = sev_snp_guest_instance_init, 2453 }; 2454 2455 static void 2456 sev_register_types(void) 2457 { 2458 type_register_static(&sev_common_info); 2459 type_register_static(&sev_guest_info); 2460 type_register_static(&sev_snp_guest_info); 2461 } 2462 2463 type_init(sev_register_types); 2464