From patchwork Wed Dec 6 20:03:32 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brijesh Singh X-Patchwork-Id: 10097031 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 1FE4B60210 for ; Wed, 6 Dec 2017 20:04:44 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 106CA28A07 for ; Wed, 6 Dec 2017 20:04:44 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 04B8029E42; Wed, 6 Dec 2017 20:04:44 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 95EE328A07 for ; Wed, 6 Dec 2017 20:04:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752427AbdLFUEl (ORCPT ); Wed, 6 Dec 2017 15:04:41 -0500 Received: from mail-sn1nam01on0070.outbound.protection.outlook.com ([104.47.32.70]:10704 "EHLO NAM01-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752335AbdLFUEe (ORCPT ); Wed, 6 Dec 2017 15:04:34 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector1-amd-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=unkDPa+rStOHxrexQXR267xFawfL6ru/VkXF1v33oTc=; b=I2jvfUbTDmO/D65HWzYEKtpnKFl/VvesZfF10Mly7fJJGBT3pq3QNdl2bNwHcDpdCanoCTJbZWh11vgrIU8yxutPTWbCL/E/6DF+Xf4e7EjH0UhMxz2Ef+VE+LNkQnMsnyVwUsnKHks5efnyU81DBpVHbc6TaFp+pI//8PydLaQ= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; Received: from wsp141597wss.amd.com (165.204.78.1) by SN1PR12MB0158.namprd12.prod.outlook.com (10.162.3.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.282.5; Wed, 6 Dec 2017 20:04:28 +0000 From: Brijesh Singh To: qemu-devel@nongnu.org Cc: Alistair Francis , Christian Borntraeger , Cornelia Huck , "Daniel P . Berrange" , "Dr. David Alan Gilbert" , "Edgar E . Iglesias " , Eduardo Habkost , Eric Blake , kvm@vger.kernel.org, Marcel Apfelbaum , Markus Armbruster , "Michael S. Tsirkin" , Paolo Bonzini , Peter Crosthwaite , Peter Maydell , Richard Henderson , Richard Henderson , Stefan Hajnoczi , Thomas Lendacky , Borislav Petkov , Brijesh Singh Subject: [PATCH v5 09/23] accel: add Secure Encrypted Virtulization (SEV) object Date: Wed, 6 Dec 2017 14:03:32 -0600 Message-Id: <20171206200346.116537-10-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20171206200346.116537-1-brijesh.singh@amd.com> References: <20171206200346.116537-1-brijesh.singh@amd.com> MIME-Version: 1.0 X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: BN6PR14CA0035.namprd14.prod.outlook.com (10.171.172.149) To SN1PR12MB0158.namprd12.prod.outlook.com (10.162.3.145) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: f18df670-21d1-44d3-8d36-08d53ce48f78 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(48565401081)(5600026)(4604075)(2017052603286); SRVR:SN1PR12MB0158; X-Microsoft-Exchange-Diagnostics: 1; SN1PR12MB0158; 3:jsKf16S023De14eVka2slWNx1hqEV/VwACHwGT+HVn3wIIn+2ultWRsIlafNqjG3cSGlYDv4jWjiT5Bns2kS5APVMpY/Kk35zLNDbbe++wWIchE3m4kGbD/gQU7oXMWhueJYw/X3+b5ZY1N5VF7kbMfbVMX+e6Bs/NgCbjWVb+Z9xa8s1AaAHLJfNxksDjtpkHoav/1fsy07jGSxNESyqaqHxMqnpvVl7NqsVG6XycuWd1R9Opa5EOdQ24RaUnJp; 25:pw7NRukMdQVPMLYuOkLKr+HwPg8ECotRDCuBj40WoP6mDaMgZZAb6rdqfQZVJ69q1C9vR7+dlYClkM8X4JcEXzKlApDLKmPGo1SL5uJW749HTVdF4d6vhyNHzzmkNfxUJ4jhFdJ/R6+D8fMpIdvK5hZyfohL8Cu0tYFpYEUzj8ex1jbKLIVaWPyoWbtkO9zK0KwRU/M445Cfj3MIq4MjsiKJdskpAdP7h35qWmWyedux6U1QszTBsjzB/HZ21ugbGK2esCiPsCNWA1b7KtIX3X7ts3I211AJGirzgOmgLCwbnjCVXiKwE6/44kCoX93MbUnhQk0lRaW31xyaGnVb6A==; 31:drEwI3gwLSzuRM0JqODfkr+J01f7OjHt98TVc7bRaU6w2NvQysQzDDzi1DNIKDcXlfIcIu9zTYSzEoaE9JfywE5vTCx/u2zFeDqpoaesrFoDviTtNtEQwmL7rAv0RP7TPutvf4qpSX/Z3Um2LU2/Bxz3Lb5s8iuWm4/XEO9GN7T+0sio57w04rSMerhUxzzN7fBpqTYF4tlk/GBad0kLqlC3skbpeQgIpnvWH/1dhzM= X-MS-TrafficTypeDiagnostic: SN1PR12MB0158: X-Microsoft-Exchange-Diagnostics: 1; SN1PR12MB0158; 20:0f3Nrfu25dOmbOpqcebI+lDmHdKZi1WuywNevpN2LFg6OC9hW9dTUD6Qw2nk8ZSZir8Zfg/00dqKFRpL4yNMnoWwqGnca2k+TViUHPsCcfe5MpjI8xM640py5AqyanijS1UMN6EfAENSHMbQq4BvMo/4dzhoVR1T5vBPm916p89Kx5eYegyXIiRa1FF5NT4vQkeIuPXs0IPbVMFjejtCBNZFp4MJAKlkgbjqLL0+5NIPggBPSn6n2mXeoTi5ErdT1P0iBaF+Jkpi1YjDzzqeNu/I0fhWTOFEhCHy8PniVlNPKJ78JG/RpI9gESoz7jWnzPSTcVeKDtnmN09y0uMNhCZR7dlpaiMw8SLYZjNgclwblnyL2FnMZYtZayFvUScwukTgNvGBOXOxdJkf5ncx/BkfDCYodV1ptVl4AO3nv7tNkyGuUEPgSNAj82vo4ibsfS8AqtebgKXuTRH2iPVTiojDAERGMEqi0r6es2+c+liK3rqfTgh6wRV8sCBejWNP; 4:LheBpCrAIoprIc63h3XAtgh5vumcCcXsegJlyPUepG/Vk2co4BGrFGWqC1w1+qWkee09I1XajoacZcHGnLmOqVQDD1wRyjTuY1sAqxzY6r+OeL9qL6eXv9WEZtr0Z4kO+nXu9UEJEhOC31uApuC3iPPW/2fTfnI3wxqgWQ2FNZrAavKna55mGctAKGCHAAbpzY3pDUqOoF8DNhJ+NL7jJSJajIzkO1ySB0DpsBl6XPNwLl9o/vy6uEPqkzmv+HXDQrboe+YoBwSk7NlP35o9JOFxQwPXcXp9jjoSVzcMFAPzZQilLg8wp3YY68qyO7YgizyeuA9cEi3+A87ypmUy+g== X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(767451399110)(17755550239193); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040450)(2401047)(8121501046)(5005006)(93006095)(93001095)(10201501046)(3002001)(3231022)(6055026)(6041248)(20161123555025)(20161123558100)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123562025)(20161123564025)(6072148)(201708071742011); SRVR:SN1PR12MB0158; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:SN1PR12MB0158; X-Forefront-PRVS: 05134F8B4F X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(376002)(39860400002)(346002)(366004)(199004)(189003)(16526018)(16586007)(33646002)(53416004)(105586002)(39060400002)(4326008)(305945005)(2351001)(106356001)(2361001)(7736002)(7696005)(86362001)(52116002)(8936002)(316002)(53936002)(97736004)(76176011)(51416003)(36756003)(66066001)(1076002)(3846002)(25786009)(6116002)(47776003)(50226002)(68736007)(54906003)(6916009)(2950100002)(478600001)(6666003)(8666007)(5660300001)(8656006)(8676002)(101416001)(81156014)(81166006)(2906002)(7416002)(48376002)(6486002)(50466002); DIR:OUT; SFP:1101; SCL:1; SRVR:SN1PR12MB0158; H:wsp141597wss.amd.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; SN1PR12MB0158; 23:7zMdrti0FX48tW+V1PUd9KPNqfhOYDnjg/b3o1KdX?= =?us-ascii?Q?LZmKcdoizUoCBX0m1M66XUyAXFc1IGqg90sk0/hnmprXObxLwCZqbF0gsox5?= =?us-ascii?Q?VJdTMzLQ4JPyU3kLuucHcxjPCazd5dedTW/xiXK7C8rjf7NCe90QTQ3r0xtR?= =?us-ascii?Q?xzB5qcAHGeOucQ/wev3jbYpVKJN6EOIIDU6WIQ7pHbCEOEKieYUXoNU3hlK+?= =?us-ascii?Q?WG+EfAsyht1NnZmq2t+Qn/AAaBw4MLQ0KsNILgZMLS1i8d08Zkr2UX8LeZMU?= =?us-ascii?Q?HnyN4cwxXy+TD1jt3eUaqeiR1j8zPri3pdbhAh4IZldEBLoq6E1Hh0mYQSyo?= =?us-ascii?Q?zfIldRYfU9qQLlfjW/kzHEXXvV6YbvFFu9MOeD4ETXB63Ka4hs5wPaugtNsP?= =?us-ascii?Q?QB5nFvFpUo9mqg6XDS34cdc8R0lFNOyrt6zPFXQIKGgyEFoXukfPg2KxdME8?= =?us-ascii?Q?hFBLCEelCpUOypztcIFgO6f1aCRTHza67DWQrYeB2axWRbO/6zraHtCiQAuv?= =?us-ascii?Q?DpzUbydRn1k8Oi2qawFEg7182hR1H4nUOAAUVcMIFbZU14di3g8WGvyhL/Nf?= =?us-ascii?Q?ZDWZcialqmXugFTaelA2x1NZwR8Ka49P+v+z4sYHELuDgIn1MTds7MDIE+mz?= =?us-ascii?Q?rn41Cqgfy7IwMYGxQ7aHZtzwsN9EH9OcrMR6vW4ykN+Y2CI3FEubPgapFxkG?= =?us-ascii?Q?cWpCyVKSr1zWCbbGhkSgAJkl5fL/Ocktq/IAoFkIS4wN1CAFfZrWDxoQyMRq?= =?us-ascii?Q?reFLlfQaarG7cOhzK/89ShUg/uCAeUvTvDPM0FWDG50AaJNGJkRnyJwAu0hy?= =?us-ascii?Q?bxHBFMusYm1GJyt73i+02anOga91HLsw/wkuBBg9v09Wn0zDGxmJ6/tdAFZh?= =?us-ascii?Q?GGdt4MD6MDUUsx0GWKJ+xrCrIAkwBZCd+st930CM85to37IkmrifFVYzvZAS?= =?us-ascii?Q?NObr+YRggpTeGxJCD2269bh0PwqBYLdtxglGrncK94zQibCHfDZU3a5rZ49W?= =?us-ascii?Q?QIIXKSfYtVc84lMdasx9z6gV3frqDwglSsMtEwPzPfaMG4MyLSAdw17DYt8U?= =?us-ascii?Q?17HBabjGY94nRIQjmNtZU3xBSJ3UtRsKZdQB6fDFLUjuvLmfLdkyCq2Jt194?= =?us-ascii?Q?B30V/nEWouot4nLnuADO0RpEh0K0gCQQKluxph3GMetjaJBFt4yTj1mfR1sU?= =?us-ascii?Q?awEDSyqMsuPFCxxDEsvN+jPGxqVQ2OZMmmodx6hj4zf7eMBuMZ3Q7ZUXA=3D?= =?us-ascii?Q?=3D?= X-Microsoft-Exchange-Diagnostics: 1; SN1PR12MB0158; 6:hu8TPZzdHPhcOQFuGxSxjGw0LdbtYPvR6qdEbLX4YnfbLJJ0K8alhenvM/Ipq6wqQ3QXjT6NqFvGYN7X2EHDuLEb5K4zXMGiaRC089z+wBrqkhl8H05R0oT+4DNaDhlAEB3JvN31ZScc2R9ZLPtjFjfdYuGLeNQ/5NvCDX0m0INlSi+isGkXJijZ8P4p4CYesNDpyqvEofLJwx4A89AO/Wdx5kzYU5y9wA9LvXjR//Aa3W7DEo3rgC174naWPsVhRzjYw1l9BQdzmEAQ184MShC/1BePo++5xKEp/BAT3r0t79CdyxYEtbAfyBioUinrydNxgD9x9v2OHT0+V6wO+4tj70j94OnOdukuud79Ikw=; 5:CCGxs2NrtNcayLaqQYEe2t1J4Iao2K8vth6Ap2nTYOpnGlrBFbxJD3w8aa3skC0Gpx7NUaKGHDzqAZEEQShPjo9LOdeuc3dYRiHIMJkKO25xWBSTMZAx12d+ykcQ9y+RPLbXK19bnvsUzQxbDyU1oXCYj8mqFFGgd/JirftDKnw=; 24:j8b1Yq90FLt6wBRFF7KD03NCGtIzxyA/RzWVm9OxPcoOT3/irMowCe05SnOgdq7NAKngJEAlT2DYnwDZ525eYSw0yWU6blxolH44Nih7ex8=; 7:yGEDnqWHD6/Q+hzo4ppsASBDbqd8y3nLipckv19jKZ+kESXkwCNs1GHtR9WQaWJSeYFfzdYkx/7OUxzhxh0yzEvwLH+k7nNy6RMqrE8+fpYurvFb9ByeK9nT/3q9+cZ8q03RjdyxjWUwZdQG0lk07LEV54vmRwIBebXA3dzDIkEFNuR7TMNiqa9zdxevtmPzrfDjnJXHetRTCaHMA8a11rlT/hfvH7oxuLV49p3WVGwxCLQRBlBMbHr/rE4Z0WkD SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; SN1PR12MB0158; 20:IEQg++TQwOZ7lbwrqzTlKqXRBPkweGOoMuQpbt5G/+WETESZZGlCLxmotciNjjfQwGzVZ/s+agEOcAGlpZkxOiv8SFiwrpZxJXGJeYW/i/Awzy08r67LZZ5chNS4kZAPbbMubp2a9S82hyTzbm2JWp0j5nswCcpWEwYPGQS2k/nUGWz5R9CgGRhBDIJJfjl/N4e49Wrl42m2urpxDff8mlvW94+2Ls+uUwQhFyiSLQal/eRG0nQy6MJOuP80EWeK X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Dec 2017 20:04:28.2858 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f18df670-21d1-44d3-8d36-08d53ce48f78 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB0158 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Add a new memory encryption object 'sev-guest'. The object will be used to create enrypted VMs on AMD EPYC CPU. The object provides the properties to pass guest owner's public Diffie-hellman key, guest policy and session information required to create the memory encryption context within the SEV firmware. e.g to launch SEV guest # $QEMU \ -object sev-guest,id=sev0 \ -machine ....,memory-encryption=sev0 Cc: Paolo Bonzini Signed-off-by: Brijesh Singh --- accel/kvm/Makefile.objs | 2 +- accel/kvm/sev.c | 179 +++++++++++++++++++++++++++++++++++++++++ docs/amd-memory-encryption.txt | 17 ++++ include/sysemu/sev.h | 53 ++++++++++++ qemu-options.hx | 34 ++++++++ 5 files changed, 284 insertions(+), 1 deletion(-) create mode 100644 accel/kvm/sev.c create mode 100644 include/sysemu/sev.h diff --git a/accel/kvm/Makefile.objs b/accel/kvm/Makefile.objs index 85351e7de7e8..666ceef3dae3 100644 --- a/accel/kvm/Makefile.objs +++ b/accel/kvm/Makefile.objs @@ -1 +1 @@ -obj-$(CONFIG_KVM) += kvm-all.o +obj-$(CONFIG_KVM) += kvm-all.o sev.o diff --git a/accel/kvm/sev.c b/accel/kvm/sev.c new file mode 100644 index 000000000000..a9b9a63c2da0 --- /dev/null +++ b/accel/kvm/sev.c @@ -0,0 +1,179 @@ +/* + * QEMU SEV support + * + * Copyright Advanced Micro Devices 2016-2017 + * + * Author: + * Brijesh Singh + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + */ + +#include "qemu/osdep.h" +#include "qapi/error.h" +#include "qom/object_interfaces.h" +#include "qemu/base64.h" +#include "sysemu/kvm.h" +#include "sysemu/sev.h" +#include "sysemu/sysemu.h" + +#define DEFAULT_GUEST_POLICY 0x1 /* disable debug */ +#define DEFAULT_SEV_DEVICE "/dev/sev" + +static void +qsev_guest_finalize(Object *obj) +{ +} + +static char * +qsev_guest_get_session_file(Object *obj, Error **errp) +{ + QSevGuestInfo *s = QSEV_GUEST_INFO(obj); + + return s->session_file ? g_strdup(s->session_file) : NULL; +} + +static void +qsev_guest_set_session_file(Object *obj, const char *value, Error **errp) +{ + QSevGuestInfo *s = QSEV_GUEST_INFO(obj); + + s->session_file = g_strdup(value); +} + +static char * +qsev_guest_get_dh_cert_file(Object *obj, Error **errp) +{ + QSevGuestInfo *s = QSEV_GUEST_INFO(obj); + + return g_strdup(s->dh_cert_file); +} + +static void +qsev_guest_set_dh_cert_file(Object *obj, const char *value, Error **errp) +{ + QSevGuestInfo *s = QSEV_GUEST_INFO(obj); + + s->dh_cert_file = g_strdup(value); +} + +static char * +qsev_guest_get_sev_device(Object *obj, Error **errp) +{ + QSevGuestInfo *sev = QSEV_GUEST_INFO(obj); + + return g_strdup(sev->sev_device); +} + +static void +qsev_guest_set_sev_device(Object *obj, const char *value, Error **errp) +{ + QSevGuestInfo *sev = QSEV_GUEST_INFO(obj); + + sev->sev_device = g_strdup(value); +} + +static void +qsev_guest_class_init(ObjectClass *oc, void *data) +{ + object_class_property_add_str(oc, "sev-device", + qsev_guest_get_sev_device, + qsev_guest_set_sev_device, + NULL); + object_class_property_set_description(oc, "sev-device", + "SEV device to use", NULL); + object_class_property_add_str(oc, "dh-cert-file", + qsev_guest_get_dh_cert_file, + qsev_guest_set_dh_cert_file, + NULL); + object_class_property_set_description(oc, "dh-cert-file", + "guest owners DH certificate (encoded with base64)", NULL); + object_class_property_add_str(oc, "session-file", + qsev_guest_get_session_file, + qsev_guest_set_session_file, + NULL); + object_class_property_set_description(oc, "session-file", + "guest owners session parameters (encoded with base64)", NULL); +} + +static void +qsev_guest_set_handle(Object *obj, Visitor *v, const char *name, + void *opaque, Error **errp) +{ + QSevGuestInfo *sev = QSEV_GUEST_INFO(obj); + uint32_t value; + + visit_type_uint32(v, name, &value, errp); + sev->handle = value; +} + +static void +qsev_guest_set_policy(Object *obj, Visitor *v, const char *name, + void *opaque, Error **errp) +{ + QSevGuestInfo *sev = QSEV_GUEST_INFO(obj); + uint32_t value; + + visit_type_uint32(v, name, &value, errp); + sev->policy = value; +} + +static void +qsev_guest_get_policy(Object *obj, Visitor *v, const char *name, + void *opaque, Error **errp) +{ + uint32_t value; + QSevGuestInfo *sev = QSEV_GUEST_INFO(obj); + + value = sev->policy; + visit_type_uint32(v, name, &value, errp); +} + +static void +qsev_guest_get_handle(Object *obj, Visitor *v, const char *name, + void *opaque, Error **errp) +{ + uint32_t value; + QSevGuestInfo *sev = QSEV_GUEST_INFO(obj); + + value = sev->handle; + visit_type_uint32(v, name, &value, errp); +} + +static void +qsev_guest_init(Object *obj) +{ + QSevGuestInfo *sev = QSEV_GUEST_INFO(obj); + + sev->sev_device = g_strdup(DEFAULT_SEV_DEVICE); + sev->policy = DEFAULT_GUEST_POLICY; + object_property_add(obj, "policy", "uint32", qsev_guest_get_policy, + qsev_guest_set_policy, NULL, NULL, NULL); + object_property_add(obj, "handle", "uint32", qsev_guest_get_handle, + qsev_guest_set_handle, NULL, NULL, NULL); +} + +/* sev guest info */ +static const TypeInfo qsev_guest_info = { + .parent = TYPE_OBJECT, + .name = TYPE_QSEV_GUEST_INFO, + .instance_size = sizeof(QSevGuestInfo), + .instance_finalize = qsev_guest_finalize, + .class_size = sizeof(QSevGuestInfoClass), + .class_init = qsev_guest_class_init, + .instance_init = qsev_guest_init, + .interfaces = (InterfaceInfo[]) { + { TYPE_USER_CREATABLE }, + { } + } +}; + +static void +sev_register_types(void) +{ + type_register_static(&qsev_guest_info); +} + +type_init(sev_register_types); diff --git a/docs/amd-memory-encryption.txt b/docs/amd-memory-encryption.txt index 72a92b6c6353..1527f603ea2a 100644 --- a/docs/amd-memory-encryption.txt +++ b/docs/amd-memory-encryption.txt @@ -35,10 +35,21 @@ in bad measurement). The guest policy is a 4-byte data structure containing several flags that restricts what can be done on running SEV guest. See KM Spec section 3 and 6.2 for more details. +The guest policy can be provided via the 'policy' property (see below) + +# ${QEMU} \ + sev-guest,id=sev0,policy=0x1...\ + Guest owners provided DH certificate and session parameters will be used to establish a cryptographic session with the guest owner to negotiate keys used for the attestation. +The DH certificate and session blob can be provided via 'dh-cert-file' and +'session-file' property (see below + +# ${QEMU} \ + sev-guest,id=sev0,dh-cert-file=,session-file= + LAUNCH_UPDATE_DATA encrypts the memory region using the cryptographic context created via LAUNCH_START command. If required, this command can be called multiple times to encrypt different memory regions. The command also calculates @@ -59,6 +70,12 @@ context. See SEV KM API Spec [1] 'Launching a guest' usage flow (Appendix A) for the complete flow chart. +To launch a SEV guest + +# ${QEMU} \ + -machine ...,memory-encryption=sev0 \ + -object sev-guest,id=sev0 + Debugging ----------- Since memory contents of SEV guest is encrypted hence hypervisor access to the diff --git a/include/sysemu/sev.h b/include/sysemu/sev.h new file mode 100644 index 000000000000..e00794ec1805 --- /dev/null +++ b/include/sysemu/sev.h @@ -0,0 +1,53 @@ +/* + * QEMU Secure Encrypted Virutualization (SEV) support + * + * Copyright: Advanced Micro Devices, 2016-2017 + * + * Authors: + * Brijesh Singh + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + */ + +#ifndef QEMU_SEV_H +#define QEMU_SEV_H + +#include "qom/object.h" +#include "qapi/error.h" +#include "sysemu/kvm.h" +#include "qemu/error-report.h" + +#define TYPE_QSEV_GUEST_INFO "sev-guest" +#define QSEV_GUEST_INFO(obj) \ + OBJECT_CHECK(QSevGuestInfo, (obj), TYPE_QSEV_GUEST_INFO) + +typedef struct QSevGuestInfo QSevGuestInfo; +typedef struct QSevGuestInfoClass QSevGuestInfoClass; + +/** + * QSevGuestInfo: + * + * The QSevGuestInfo object is used for creating a SEV guest. + * + * # $QEMU \ + * -object sev-guest,id=sev0 \ + * -machine ...,memory-encryption=sev0 + */ +struct QSevGuestInfo { + Object parent_obj; + + char *sev_device; + uint32_t policy; + uint32_t handle; + char *dh_cert_file; + char *session_file; +}; + +struct QSevGuestInfoClass { + ObjectClass parent_class; +}; + +#endif + diff --git a/qemu-options.hx b/qemu-options.hx index 5385832707e0..4611db3c1d51 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -4470,6 +4470,40 @@ contents of @code{iv.b64} to the second secret data=$SECRET,iv=$(