From nobody Mon Feb 9 14:17:12 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=amd.com); dmarc=pass(p=quarantine dis=none) header.from=amd.com ARC-Seal: i=2; a=rsa-sha256; t=1628078379; cv=pass; d=zohomail.com; s=zohoarc; b=Trww4OQ6yprp3mevvuaSiJznnHQ9JgYyguDzEOBFLYMkVr9qUD+XSScQUplDIYt+2f/ua7lttcVncD5Q8IaufZps9LEnOwnrrYY6HZ12l/vCB6PLHtbWiZk689DwzZpCPoK91O/jnWHG/nU/S+h3abVqqG8RJe77Nfd5zX9+xYs= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1628078379; h=Content-Type:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=aWzb+h5UrK/mMQI+JkYKO0hDHrK6UaYweN+VHSPu6u8=; b=WIKfhtrm9aSYur2Qu8jDcnxszS5Mo1yHx0enjAXmGhg9Lcxah6wXqn2PJUZ7CXj88agCrQnfkSfDU7kbPfohD1dCSYrgbXdloJrGbK7YOWiRS5QV0Ksm/0pdiSGMt2//+F9Ye09Ax5nC2MfgEfFB8uAoBviJNq3O35G3VhgtfCY= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=amd.com); dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1628078379511471.96393217157356; Wed, 4 Aug 2021 04:59:39 -0700 (PDT) Received: from localhost ([::1]:52082 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1mBFYg-0004l6-E3 for importer@patchew.org; Wed, 04 Aug 2021 07:59:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:57192) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mBFVQ-0005Ub-TH for qemu-devel@nongnu.org; Wed, 04 Aug 2021 07:56:16 -0400 Received: from mail-bn7nam10on2086.outbound.protection.outlook.com ([40.107.92.86]:58849 helo=NAM10-BN7-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mBFVP-0002Vc-0a for qemu-devel@nongnu.org; Wed, 04 Aug 2021 07:56:16 -0400 Received: from SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) by SA0PR12MB4413.namprd12.prod.outlook.com (2603:10b6:806:9e::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.21; Wed, 4 Aug 2021 11:56:13 +0000 Received: from SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::491e:2642:bae2:8b73]) by SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::491e:2642:bae2:8b73%7]) with mapi id 15.20.4373.026; Wed, 4 Aug 2021 11:56:13 +0000 Received: from ashkalra_ubuntu_server.amd.com (165.204.77.1) by SN7P222CA0023.NAMP222.PROD.OUTLOOK.COM (2603:10b6:806:124::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4394.17 via Frontend Transport; Wed, 4 Aug 2021 11:56:12 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=MrAP20NS6GdYQ59klwzu5YEbpdZN2bqDRgZ8LMBAKhC9VwbwvH4lj4kyo7QiCwyR8yDXjQDBGCCYO2qzEvpT/TglVLvOqkki+kH+c+3cc9g1TYZRqCT6rZXJtSiKRM4WLi9MIClLo/vTRNzNnKKN0xXhTGj2Mfyn8LCpMSKuQNDZSIYzcXpAPzx6FeVf8qCxj3WS8c5B7Fm7/7pMBoPxFL9RIVt8UIgwivy6PnqzytXx08ma8RZbFH3Og3gEGwmiOi/q8U++3eUEGMvPNoSI30lJkMAy2TGxHA9fsjGfPcI6356uRyf3mS/4HQNcYqlMr2NqTh62/tExxyDZ5IiJ3Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aWzb+h5UrK/mMQI+JkYKO0hDHrK6UaYweN+VHSPu6u8=; b=MRlmSzzDsHPvHSOjR3PXau55t77qmrGUofwm4l1TLorSDCZRJVuqrC+/nEklyZ8PstqDU+pQEpsnx0A3y+vbkDZRxvxXGfCoz8isMNf0+p/pKWVf6FkSXNi+5BihHNsrl53HTzpiWUQUVU7mX4pLJlvod4vL39fwf4wlp0nIbdrhopjhBnbWsy4IWMbSz0hDkinPOmBZMhp7XsUQ1udlcTrSNJvk2XCjEjDT0OfcbNRp26GmRZpwQtNFy3+4MMVCH8agcsvMCBZ7twPt2gcLJ/kDnUsRIpENcZgt50BZYnCqU38kNtj8VTLjiHXfol9jerTCd/UhXMyy9kYkJbk+pA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aWzb+h5UrK/mMQI+JkYKO0hDHrK6UaYweN+VHSPu6u8=; b=1Hll1O4WbKlh2lLfxtUV563nsfDf4oGZfHVc951rO3o81NVLLhyEsKpvN8iwRfaDI0BOF2LQnhe/wiP795tE3RMyFLLovUFnFQgRNx58D8H9mm5oeFqWr4rPGqGBDyF+h/CG8DfOyvQS0pAWpJyh620MFw8kZryTw+Suf3V66oc= Authentication-Results: nongnu.org; dkim=none (message not signed) header.d=none;nongnu.org; dmarc=none action=none header.from=amd.com; From: Ashish Kalra To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, Thomas.Lendacky@amd.com, brijesh.singh@amd.com, dgilbert@redhat.com, ehabkost@redhat.com, dovmurik@linux.vnet.ibm.com, tobin@ibm.com, jejb@linux.ibm.com Subject: [PATCH v4 05/14] target/i386: sev: provide callback to setup outgoing context Date: Wed, 4 Aug 2021 11:56:01 +0000 Message-Id: <7521883afc073960728f6f0837dac9be1641dcb6.1628076205.git.ashish.kalra@amd.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: References: X-ClientProxiedBy: SN7P222CA0023.NAMP222.PROD.OUTLOOK.COM (2603:10b6:806:124::31) To SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 0eca93c4-4cc9-4558-b932-08d9573edb1c X-MS-TrafficTypeDiagnostic: SA0PR12MB4413: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:250; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: Ge0QT1JSKGqb1O+Pk50wxjYlc2l0LAE+y39PgYW+qbYfNRxthZZPMOiasdMG5dudTdNnSDqybkarSsCBVdWcmWYOMvBFG21bnvtSGgizSmHEi8Oc7CLcfCHlUzCLS2TEic/bp8EWR4peBPFyT10InPBGk5qC9W4NylxmcDVs/xeSL4vBOgjepy3BS9euswePc+JGdZuSgYMEm+dTogSzLJYwc4RkMsi6nHiSvlfFcJJ998X+BGOwauVqE50upsVb0elr029WycgtIWQ6wuQopu3zuQaS+3AheJANEd/znG76fUM7ncGKG9ONx26LUXG86SaQFqJI1rqaiSQNQlFntzqrxupLvFBYLIt8qp80e5c9QrGCPAH6tUjbFMiTIC6o7oyv46zWCTsA9QwaHikzJ6Bt+GqKCfyXDnWayUU4+ed/VjGERT5wQdxmMQg4Z1STJg5Q7zvfYlvGpJrggtMgWhdA5JDWptk2S62l0N4GR/38kSFXvuLiWrMqKivrFiBpf+G8pTj3jAAUOUonePeGFjc6xvIo9kY1+7rxx/ec83PdmErJEvXPDrVN5MBwqC9Iniu3Xlq60UMWWBqvxuTgC8Nq+BysWpHdZCEh15z1AA+H8gip195BLZ3hIXshzp/Ga0p8WjcezQHDF/7DeVBvfriYRmMLdsNtvQRDZgvJRhguF/U7kC1tIZPa5WmXKP8nQlyWOwFQ8P7o6WXAT73f8w== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SN6PR12MB2767.namprd12.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(376002)(366004)(39860400002)(346002)(136003)(36756003)(38350700002)(2906002)(6486002)(8676002)(38100700002)(86362001)(5660300002)(478600001)(52116002)(7696005)(316002)(66946007)(2616005)(4326008)(186003)(6666004)(6916009)(26005)(66476007)(8936002)(66556008)(956004); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?pGiOl/7pb8ySIAvpLVaK5F/y0X54KQjX2kQgi7+UgmwkcxlFnCZw8L2cW8X5?= =?us-ascii?Q?C2iTZ4wHN2NMWfMM1vn7qp6srTaUVddHYLmB3rceNvIEtqPJK69NEzDzTNa0?= =?us-ascii?Q?lh2fuXL5jEPMDh8Av5ScBlzEKh/UcEgE6kOcmm6WwEswYpsr1HOe9Ef3FNGW?= =?us-ascii?Q?VUXr3RMNp6irYbF7F31Qe6eHEu5VZTG8kRcIqWEbzrAI6V0ukRecCkpuQbXL?= =?us-ascii?Q?iWL51iIlxHK1UMj1f1Gu1HQqvTLM123E1MhZ1YLrBWWtmOYLmkLesXz2TlPg?= =?us-ascii?Q?iXBstMvwZPFwc6y/qZcGIVQw/xwpvho2t9Zpl+h9OljFlcOmlL2abjeEY0tB?= =?us-ascii?Q?W6yzI9b1wXfNh3qwKQ43Rf32GgWX61Q+qphcHN4OW4m7I/zNbV0bCVaTJw+2?= =?us-ascii?Q?bntWffxovkMLRgBQg5lARKfVBhI/NAQ4tSLuW5ScwJTaICCPuwcOBl0Q8tRI?= =?us-ascii?Q?TIj/ARayTlESDwhzcYJ6HDPPwDp2k4Izb3fNu8tW3PSaLFoG8A/qsHElVnwr?= =?us-ascii?Q?0lJR4YWgxEjPKNXD67DA4E23nutTlG9wlKjKP6GjQV03I/+imnXN0qF+FlDO?= =?us-ascii?Q?8WK7aMhrR+tpxCBjtiBN73rxV6W261vbcOEOyWY1kE1lMBsC7yEdi1XsByKL?= =?us-ascii?Q?hRHnMGlZe69zBq8OXND/q0g4WUUsOos8MYKqIJRzk9mhgPhTB/3p1jBkiPGP?= =?us-ascii?Q?/Nw4iJhys9xNPf3LA4DZAaxMynEL8aE8CY/6XX7nv/KP/MLgx9iIdjIXAaC9?= =?us-ascii?Q?+5WXvtqzzy0fthFMhAahDKzkAtM7A85gk1xKkGwBoJjf+87ur447/IrEjGMP?= =?us-ascii?Q?Aw7c1/CH/gdWww1tmuN/gpd5K/O3b3V29Dw0N6mS1yNRY1+TBLLzrEoleU9F?= =?us-ascii?Q?FenvAOHzoDaygRLI9/oitGxIqSS1fNt2T5LtpaLQNJNTCNvOvGaXxMdvyPvA?= =?us-ascii?Q?MNOPM0Vg3/iBDZSB316UWmq5NxdcijXBdtl9Ue6rlL69NL+v8eNNYEyxwVzw?= =?us-ascii?Q?s7qvMgjz2pW1BTSwhcVMsKPXUxQWRnlJ90CLIs7yo/6J2E5RraJtZYeMVRCN?= =?us-ascii?Q?LFq2P/EK06+mzW4mVqisUjXHql0CIox8mIoQ7SJOHrnXLnkqyJvG3x5jwJAs?= =?us-ascii?Q?OLEBnXEthk6c5Xe0u5Y+00RbmSnbjoFpkTefXwhOyPe8UJr2yVrqChOCYQ6Y?= =?us-ascii?Q?OTPtmLGdIrpOGaN85AM0pojgIZQ6mTrWZQbf9BuZhBcyGqXckuY5Dsz3eVPg?= =?us-ascii?Q?2phQlE+SOHakltqqhs/OR1e6aNiv0mKMMQUxRVFVsOLfQtNfdj1iKtWMy9oh?= =?us-ascii?Q?LLeW79/lMXlKdHp6cP48JlSz?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0eca93c4-4cc9-4558-b932-08d9573edb1c X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2767.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Aug 2021 11:56:12.6656 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 9v5ajkZKZQDfwpwlIhGgZ12sQY6BXnLqI3bUQ68FQ+a6kbExxsUevuA1YOiJuxFriw6YZwP3Mq9dv2arZSHn4g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4413 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: softfail client-ip=40.107.92.86; envelope-from=Ashish.Kalra@amd.com; helo=NAM10-BN7-obe.outbound.protection.outlook.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @amd.com) X-ZM-MESSAGEID: 1628078380460100001 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Brijesh Singh The user provides the target machine's Platform Diffie-Hellman key (PDH) and certificate chain before starting the SEV guest migration. Cache the certificate chain as we need them while creating the outgoing context. Signed-off-by: Brijesh Singh Co-developed-by: Ashish Kalra Signed-off-by: Ashish Kalra --- include/sysemu/sev.h | 2 ++ target/i386/sev.c | 61 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 63 insertions(+) diff --git a/include/sysemu/sev.h b/include/sysemu/sev.h index 94d821d737..64fc88d3c5 100644 --- a/include/sysemu/sev.h +++ b/include/sysemu/sev.h @@ -14,11 +14,13 @@ #ifndef QEMU_SEV_H #define QEMU_SEV_H =20 +#include #include "sysemu/kvm.h" =20 bool sev_enabled(void); int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp); int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp); +int sev_save_setup(MigrationParameters *p); int sev_inject_launch_secret(const char *hdr, const char *secret, uint64_t gpa, Error **errp); =20 diff --git a/target/i386/sev.c b/target/i386/sev.c index 83df8c09f6..5e7c87764c 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -24,6 +24,7 @@ #include "qemu/module.h" #include "qemu/uuid.h" #include "sysemu/kvm.h" +#include "sysemu/sev.h" #include "sev_i386.h" #include "sysemu/sysemu.h" #include "sysemu/runstate.h" @@ -68,6 +69,12 @@ struct SevGuestState { int sev_fd; SevState state; gchar *measurement; + guchar *remote_pdh; + size_t remote_pdh_len; + guchar *remote_plat_cert; + size_t remote_plat_cert_len; + guchar *amd_cert; + size_t amd_cert_len; =20 uint32_t reset_cs; uint32_t reset_ip; @@ -116,6 +123,12 @@ static const char *const sev_fw_errlist[] =3D { =20 #define SEV_FW_MAX_ERROR ARRAY_SIZE(sev_fw_errlist) =20 +#define SEV_FW_BLOB_MAX_SIZE 0x4000 /* 16KB */ + +static struct ConfidentialGuestMemoryEncryptionOps sev_memory_encryption_o= ps =3D { + .save_setup =3D sev_save_setup, +}; + static int sev_ioctl(int fd, int cmd, void *data, int *error) { @@ -772,6 +785,50 @@ sev_vm_state_change(void *opaque, bool running, RunSta= te state) } } =20 +static inline bool check_blob_length(size_t value) +{ + if (value > SEV_FW_BLOB_MAX_SIZE) { + error_report("invalid length max=3D%d got=3D%ld", + SEV_FW_BLOB_MAX_SIZE, value); + return false; + } + + return true; +} + +int sev_save_setup(MigrationParameters *p) +{ + SevGuestState *s =3D sev_guest; + const char *pdh =3D p->sev_pdh; + const char *plat_cert =3D p->sev_plat_cert; + const char *amd_cert =3D p->sev_amd_cert; + + s->remote_pdh =3D g_base64_decode(pdh, &s->remote_pdh_len); + if (!check_blob_length(s->remote_pdh_len)) { + goto error; + } + + s->remote_plat_cert =3D g_base64_decode(plat_cert, + &s->remote_plat_cert_len); + if (!check_blob_length(s->remote_plat_cert_len)) { + goto error; + } + + s->amd_cert =3D g_base64_decode(amd_cert, &s->amd_cert_len); + if (!check_blob_length(s->amd_cert_len)) { + goto error; + } + + return 0; + +error: + g_free(s->remote_pdh); + g_free(s->remote_plat_cert); + g_free(s->amd_cert); + + return 1; +} + int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) { SevGuestState *sev @@ -781,6 +838,8 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error *= *errp) uint32_t ebx; uint32_t host_cbitpos; struct sev_user_data_status status =3D {}; + ConfidentialGuestSupportClass *cgs_class =3D + (ConfidentialGuestSupportClass *) object_get_class(OBJECT(cgs)); =20 if (!sev) { return 0; @@ -870,6 +929,8 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error *= *errp) qemu_add_machine_init_done_notifier(&sev_machine_done_notify); qemu_add_vm_change_state_handler(sev_vm_state_change, sev); =20 + cgs_class->memory_encryption_ops =3D &sev_memory_encryption_ops; + cgs->ready =3D true; =20 return 0; --=20 2.17.1