[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v6 18/23] sev: emit the SEV_MEASUREMENT event
From: |
Brijesh Singh |
Subject: |
[Qemu-devel] [PATCH v6 18/23] sev: emit the SEV_MEASUREMENT event |
Date: |
Mon, 29 Jan 2018 11:41:27 -0600 |
During machine creation we encrypted the guest bios image, the
LAUNCH_MEASURE command can be used to retrieve the measurement of
the encrypted memory region. Emit the SEV_MEASUREMENT event so that
libvirt can grab the measurement value as soon as we are done with
creating the encrypted machine.
Cc: Daniel P. Berrange <address@hidden>
Cc: Paolo Bonzini <address@hidden>
Cc: address@hidden
Signed-off-by: Brijesh Singh <address@hidden>
---
accel/kvm/sev.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++
accel/kvm/trace-events | 1 +
include/sysemu/sev.h | 1 +
3 files changed, 60 insertions(+)
diff --git a/accel/kvm/sev.c b/accel/kvm/sev.c
index 1f757df725df..b78cf3144b1d 100644
--- a/accel/kvm/sev.c
+++ b/accel/kvm/sev.c
@@ -19,11 +19,13 @@
#include "sysemu/sev.h"
#include "sysemu/sysemu.h"
#include "trace.h"
+#include "qapi-event.h"
#define DEFAULT_GUEST_POLICY 0x1 /* disable debug */
#define DEFAULT_SEV_DEVICE "/dev/sev"
static int sev_fd;
+static SEVState *sev_state;
#define SEV_FW_MAX_ERROR 0x17
@@ -418,6 +420,59 @@ err:
return ret;
}
+static void
+sev_launch_get_measure(Notifier *notifier, void *unused)
+{
+ int ret, error;
+ guchar *data;
+ SEVState *s = sev_state;
+ struct kvm_sev_launch_measure *measurement;
+
+ measurement = g_malloc0(sizeof(*measurement));
+ if (!measurement) {
+ return;
+ }
+
+ /* query the measurement blob length */
+ ret = sev_ioctl(KVM_SEV_LAUNCH_MEASURE, measurement, &error);
+ if (!measurement->len) {
+ error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'",
+ __func__, ret, error, fw_error_to_str(errno));
+ goto free_measurement;
+ }
+
+ data = g_malloc(measurement->len);
+ if (s->measurement) {
+ goto free_data;
+ }
+
+ measurement->uaddr = (unsigned long)data;
+
+ /* get the measurement blob */
+ ret = sev_ioctl(KVM_SEV_LAUNCH_MEASURE, measurement, &error);
+ if (ret) {
+ error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'",
+ __func__, ret, error, fw_error_to_str(errno));
+ goto free_data;
+ }
+
+ sev_set_guest_state(SEV_STATE_SECRET);
+
+ /* encode the measurement value and emit the event */
+ s->measurement = g_base64_encode(data, measurement->len);
+ trace_kvm_sev_launch_measurement(s->measurement);
+ qapi_event_send_sev_measurement(s->measurement, &error_abort);
+
+free_data:
+ g_free(data);
+free_measurement:
+ g_free(measurement);
+}
+
+static Notifier sev_machine_done_notify = {
+ .notify = sev_launch_get_measure,
+};
+
void *
sev_guest_init(const char *id)
{
@@ -461,6 +516,9 @@ sev_guest_init(const char *id)
}
ram_block_notifier_add(&sev_ram_notifier);
+ qemu_add_machine_init_done_notifier(&sev_machine_done_notify);
+
+ sev_state = s;
return s;
err:
diff --git a/accel/kvm/trace-events b/accel/kvm/trace-events
index c55546f36a25..51df5113ad07 100644
--- a/accel/kvm/trace-events
+++ b/accel/kvm/trace-events
@@ -20,3 +20,4 @@ kvm_memcrypt_unregister_region(void *addr, size_t len) "addr
%p len 0x%lu"
kvm_sev_change_state(char *old, char *new) "%s -> %s"
kvm_sev_launch_start(int policy, void *session, void *pdh) "policy 0x%x
session %p pdh %p"
kvm_sev_launch_update_data(void *addr, uint64_t len) "addr %p len 0x%" PRIu64
+kvm_sev_launch_measurement(const char *value) "data %s"
diff --git a/include/sysemu/sev.h b/include/sysemu/sev.h
index 839800efdbbf..572120c865ea 100644
--- a/include/sysemu/sev.h
+++ b/include/sysemu/sev.h
@@ -63,6 +63,7 @@ typedef enum {
struct SEVState {
QSevGuestInfo *sev_info;
+ gchar *measurement;
};
typedef struct SEVState SEVState;
--
2.9.5
- Re: [Qemu-devel] [PATCH v6 05/23] target/i386: add memory encryption feature cpuid support, (continued)
- [Qemu-devel] [PATCH v6 09/23] accel: add Secure Encrypted Virtulization (SEV) object, Brijesh Singh, 2018/01/29
- [Qemu-devel] [PATCH v6 07/23] kvm: update kvm.h to include memory encryption ioctls, Brijesh Singh, 2018/01/29
- [Qemu-devel] [PATCH v6 11/23] sev: register the guest memory range which may contain encrypted data, Brijesh Singh, 2018/01/29
- [Qemu-devel] [PATCH v6 13/23] hmp: display memory encryption support in 'info kvm', Brijesh Singh, 2018/01/29
- [Qemu-devel] [PATCH v6 12/23] kvm: introduce memory encryption APIs, Brijesh Singh, 2018/01/29
- [Qemu-devel] [PATCH v6 15/23] sev: add command to encrypt guest memory region, Brijesh Singh, 2018/01/29
- [Qemu-devel] [PATCH v6 14/23] sev: add command to create launch memory encryption context, Brijesh Singh, 2018/01/29
- [Qemu-devel] [PATCH v6 10/23] sev: add command to initialize the memory encryption context, Brijesh Singh, 2018/01/29
- [Qemu-devel] [PATCH v6 18/23] sev: emit the SEV_MEASUREMENT event,
Brijesh Singh <=
- [Qemu-devel] [PATCH v6 17/23] qapi: add SEV_MEASUREMENT event, Brijesh Singh, 2018/01/29
- [Qemu-devel] [PATCH v6 16/23] target/i386: encrypt bios rom, Brijesh Singh, 2018/01/29
- [Qemu-devel] [PATCH v6 20/23] hw: i386: set ram_debug_ops when memory encryption is enabled, Brijesh Singh, 2018/01/29
- [Qemu-devel] [PATCH v6 19/23] sev: Finalize the SEV guest launch flow, Brijesh Singh, 2018/01/29
- [Qemu-devel] [PATCH v6 21/23] sev: add debug encrypt and decrypt commands, Brijesh Singh, 2018/01/29
- [Qemu-devel] [PATCH v6 23/23] sev: add migration blocker, Brijesh Singh, 2018/01/29
- [Qemu-devel] [PATCH v6 22/23] target/i386: clear C-bit when walking SEV guest page table, Brijesh Singh, 2018/01/29