From patchwork Thu Jun 20 18:03:20 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brijesh Singh X-Patchwork-Id: 11007717 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 335F2112C for ; Thu, 20 Jun 2019 18:39:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 226CA2834A for ; Thu, 20 Jun 2019 18:39:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 11F1828857; Thu, 20 Jun 2019 18:39:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=2.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=unavailable version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 9D28F2834A for ; Thu, 20 Jun 2019 18:39:42 +0000 (UTC) Received: from localhost ([::1]:52128 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1he1yG-00086P-9B for patchwork-qemu-devel@patchwork.kernel.org; Thu, 20 Jun 2019 14:39:40 -0400 Received: from eggs.gnu.org ([209.51.188.92]:43004) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1he1cY-0004zk-9N for qemu-devel@nongnu.org; Thu, 20 Jun 2019 14:17:17 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1he1PB-0003vy-Il for qemu-devel@nongnu.org; Thu, 20 Jun 2019 14:03:47 -0400 Received: from mail-eopbgr720059.outbound.protection.outlook.com ([40.107.72.59]:35920 helo=NAM05-CO1-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1he1PB-0003qK-Be for qemu-devel@nongnu.org; Thu, 20 Jun 2019 14:03:25 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector1-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KSi7hQglvoZVySPEEvFwVR+JzBOSqhwpat13WRAjbqo=; b=w5iLOfHQhQN/cWq57iegrRbYKeO6hu10K+A5JgPrbb+zlVeOIPMQpYkhERqImiPH9J8v14MVLfqexiDJk5n/syqkubDdGdq7y19QSoJq9Ls0SAbVW657Lpp8yVdSz/q1jkYsymND3lTW/dsL4uPtReIynLHs2j6AwwUbgpj7RLc= Received: from DM6PR12MB2682.namprd12.prod.outlook.com (20.176.116.31) by DM6PR12MB3260.namprd12.prod.outlook.com (20.179.105.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1987.15; Thu, 20 Jun 2019 18:03:21 +0000 Received: from DM6PR12MB2682.namprd12.prod.outlook.com ([fe80::b9c1:b235:fff3:dba2]) by DM6PR12MB2682.namprd12.prod.outlook.com ([fe80::b9c1:b235:fff3:dba2%6]) with mapi id 15.20.1987.014; Thu, 20 Jun 2019 18:03:21 +0000 From: "Singh, Brijesh" To: "qemu-devel@nongnu.org" Thread-Topic: [RFC PATCH v1 08/12] target.json: add migrate-set-sev-info command Thread-Index: AQHVJ5JxxSpSr3fdPkCv1Ymp5YKU2g== Date: Thu, 20 Jun 2019 18:03:20 +0000 Message-ID: <20190620180247.8825-9-brijesh.singh@amd.com> References: <20190620180247.8825-1-brijesh.singh@amd.com> In-Reply-To: <20190620180247.8825-1-brijesh.singh@amd.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: DM5PR16CA0025.namprd16.prod.outlook.com (2603:10b6:4:15::11) To DM6PR12MB2682.namprd12.prod.outlook.com (2603:10b6:5:4a::31) authentication-results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; x-ms-exchange-messagesentrepresentingtype: 1 x-mailer: git-send-email 2.17.1 x-originating-ip: [165.204.77.1] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: c04821ad-32fd-4621-6f03-08d6f5a99341 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:DM6PR12MB3260; x-ms-traffictypediagnostic: DM6PR12MB3260: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:1332; x-forefront-prvs: 0074BBE012 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(396003)(376002)(136003)(39860400002)(346002)(199004)(189003)(2351001)(53936002)(486006)(2616005)(11346002)(81156014)(8676002)(14444005)(6436002)(446003)(5640700003)(50226002)(6512007)(476003)(102836004)(6916009)(99286004)(2501003)(6486002)(76176011)(8936002)(52116002)(81166006)(316002)(186003)(6506007)(26005)(478600001)(256004)(3846002)(2906002)(386003)(66066001)(14454004)(54906003)(6116002)(305945005)(25786009)(1076003)(66946007)(66556008)(73956011)(64756008)(66446008)(71190400001)(71200400001)(68736007)(36756003)(66476007)(5660300002)(7736002)(86362001)(4326008); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR12MB3260; H:DM6PR12MB2682.namprd12.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: amd.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Xw22ZYDTj6WDpjgEaHv39+zWiCzpHrZyeGHmRz58YQhzQHQS1Hjgp7llwgT3W7LTQfRSr/qUP54g82Kh+xstNMnyAMWtz89Rf/8ET8dUAz//9x/ppGmd2pdIRZn6iMvX3FnOeLYIyqP50QGVLcF51DfYYj7iN8J5/3q8/B7RKUgwM0MmtOEZXSPTf5/+mRkOmYCrceMKrpgJK5N5j6mLY1ri3ajyVyYbtJhBW8i9Kga7HzT7024NafFmBLPKajHH7GsNfZJW6KFMO3LGp++ZpCnDxfQGM12SLGisVbYDAgcBhxjRSYG8+OnJ57g5tSTHgK2r9+tac1vTE+4NN2IUUtU0YNnLeII/469PAXnrwkG3FcXrtzfInd49fmYijUcbWOr40qrJv1YEfnCCiP9SbPOvg8ybzjiuEbVGrT/K2Lk= MIME-Version: 1.0 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: c04821ad-32fd-4621-6f03-08d6f5a99341 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jun 2019 18:03:20.4132 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: sbrijesh@amd.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB3260 X-detected-operating-system: by eggs.gnu.org: Windows 7 or 8 [fuzzy] X-Received-From: 40.107.72.59 Subject: [Qemu-devel] [RFC PATCH v1 08/12] target.json: add migrate-set-sev-info command X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "Lendacky, Thomas" , "Singh, Brijesh" , "kvm@vger.kernel.org" Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP The command can be used by the hypervisor to specify the target Platform Diffie-Hellman key (PDH) and certificate chain before starting the SEV guest migration. The values passed through the command will be used while creating the outgoing encryption context. Signed-off-by: Brijesh Singh --- qapi/target.json | 18 ++++++++++++++++++ target/i386/monitor.c | 10 ++++++++++ target/i386/sev-stub.c | 5 +++++ target/i386/sev.c | 11 +++++++++++ target/i386/sev_i386.h | 9 ++++++++- 5 files changed, 52 insertions(+), 1 deletion(-) diff --git a/qapi/target.json b/qapi/target.json index 1d4d54b600..4109772298 100644 --- a/qapi/target.json +++ b/qapi/target.json @@ -512,3 +512,21 @@ ## { 'command': 'query-cpu-definitions', 'returns': ['CpuDefinitionInfo'], 'if': 'defined(TARGET_PPC) || defined(TARGET_ARM) || defined(TARGET_I386) || defined(TARGET_S390X) || defined(TARGET_MIPS)' } + +## +# @migrate-set-sev-info: +# +# The command is used to provide the target host information used during the +# SEV guest. +# +# @pdh the target host platform diffie-hellman key encoded in base64 +# +# @plat-cert the target host platform certificate chain encoded in base64 +# +# @amd-cert AMD certificate chain which include ASK and OCA encoded in base64 +# +# Since 4.3 +# +## +{ 'command': 'migrate-set-sev-info', + 'data': { 'pdh': 'str', 'plat-cert': 'str', 'amd-cert' : 'str' }} diff --git a/target/i386/monitor.c b/target/i386/monitor.c index 56e2dbece7..68e2e2b8ec 100644 --- a/target/i386/monitor.c +++ b/target/i386/monitor.c @@ -736,3 +736,13 @@ SevCapability *qmp_query_sev_capabilities(Error **errp) return data; } + +void qmp_migrate_set_sev_info(const char *pdh, const char *plat_cert, + const char *amd_cert, Error **errp) +{ + if (sev_enabled()) { + sev_set_migrate_info(pdh, plat_cert, amd_cert); + } else { + error_setg(errp, "SEV is not enabled"); + } +} diff --git a/target/i386/sev-stub.c b/target/i386/sev-stub.c index e5ee13309c..173bfa6374 100644 --- a/target/i386/sev-stub.c +++ b/target/i386/sev-stub.c @@ -48,3 +48,8 @@ SevCapability *sev_get_capabilities(void) { return NULL; } + +void sev_set_migrate_info(const char *pdh, const char *plat_cert, + const char *amd_cert) +{ +} diff --git a/target/i386/sev.c b/target/i386/sev.c index 1b05fcf9a9..2c7c496593 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -852,6 +852,17 @@ int sev_sync_page_enc_bitmap(void *handle, uint8_t *host, uint64_t size, return 0; } +void sev_set_migrate_info(const char *pdh, const char *plat_cert, + const char *amd_cert) +{ + SEVState *s = sev_state; + + s->remote_pdh = g_base64_decode(pdh, &s->remote_pdh_len); + s->remote_plat_cert = g_base64_decode(plat_cert, + &s->remote_plat_cert_len); + s->amd_cert = g_base64_decode(amd_cert, &s->amd_cert_len); +} + static void sev_register_types(void) { diff --git a/target/i386/sev_i386.h b/target/i386/sev_i386.h index c0f9373beb..258047ab2c 100644 --- a/target/i386/sev_i386.h +++ b/target/i386/sev_i386.h @@ -39,7 +39,8 @@ extern uint32_t sev_get_cbit_position(void); extern uint32_t sev_get_reduced_phys_bits(void); extern char *sev_get_launch_measurement(void); extern SevCapability *sev_get_capabilities(void); - +extern void sev_set_migrate_info(const char *pdh, const char *plat_cert, + const char *amd_cert); typedef struct QSevGuestInfo QSevGuestInfo; typedef struct QSevGuestInfoClass QSevGuestInfoClass; @@ -81,6 +82,12 @@ struct SEVState { int sev_fd; SevState state; gchar *measurement; + guchar *remote_pdh; + size_t remote_pdh_len; + guchar *remote_plat_cert; + size_t remote_plat_cert_len; + guchar *amd_cert; + size_t amd_cert_len; }; typedef struct SEVState SEVState;