[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [RFC PATCH v1 04/10] KVM: SVM: Add support for KVM_SEV_RECE
From: |
Singh, Brijesh |
Subject: |
[Qemu-devel] [RFC PATCH v1 04/10] KVM: SVM: Add support for KVM_SEV_RECEIVE_START command |
Date: |
Wed, 24 Apr 2019 16:10:03 +0000 |
The command is used to create encryption context for the incoming
SEV guest. The encryption context can be later unused by the hypervisor
to import the incoming data into the SEV guest memory space.
Cc: Thomas Gleixner <address@hidden>
Cc: Ingo Molnar <address@hidden>
Cc: "H. Peter Anvin" <address@hidden>
Cc: Paolo Bonzini <address@hidden>
Cc: "Radim Krčmář" <address@hidden>
Cc: Joerg Roedel <address@hidden>
Cc: Borislav Petkov <address@hidden>
Cc: Tom Lendacky <address@hidden>
Cc: address@hidden
Cc: address@hidden
Cc: address@hidden
Signed-off-by: Brijesh Singh <address@hidden>
---
.../virtual/kvm/amd-memory-encryption.rst | 29 +++++++
arch/x86/kvm/svm.c | 80 +++++++++++++++++++
include/uapi/linux/kvm.h | 9 +++
3 files changed, 118 insertions(+)
diff --git a/Documentation/virtual/kvm/amd-memory-encryption.rst
b/Documentation/virtual/kvm/amd-memory-encryption.rst
index 006832256ae3..acdff2454649 100644
--- a/Documentation/virtual/kvm/amd-memory-encryption.rst
+++ b/Documentation/virtual/kvm/amd-memory-encryption.rst
@@ -293,6 +293,35 @@ issued by the hypervisor to delete the encryption context.
Returns: 0 on success, -negative on error
+13. KVM_SEV_RECEIVE_START
+------------------------
+
+The KVM_SEV_RECEIVE_START command is used for creating the memory encryption
+context for an incoming SEV guest. To create the encryption context, user must
+provide a guest policy, the platform public Diffie-Hellman (PDH) key and
session
+information.
+
+Parameters: struct kvm_sev_receive_start (in/out)
+
+Returns: 0 on success, -negative on error
+
+::
+
+ struct kvm_sev_receive_start {
+ __u32 handle; /* if zero then firmware creates a new
handle */
+ __u32 policy; /* guest's policy */
+
+ __u64 pdh_uaddr; /* userspace address pointing to the
PDH key */
+ __u32 dh_len;
+
+ __u64 session_addr; /* userspace address which points to
the guest session information */
+ __u32 session_len;
+ };
+
+On success, the 'handle' field contains a new handle and on error, a negative
value.
+
+For more details, see SEV spec Section 6.12.
+
References
==========
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 263f3c7deae7..a7dcf19baefb 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -7192,6 +7192,83 @@ static int sev_send_finish(struct kvm *kvm, struct
kvm_sev_cmd *argp)
return ret;
}
+static int sev_receive_start(struct kvm *kvm, struct kvm_sev_cmd *argp)
+{
+ struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
+ struct sev_data_receive_start *start;
+ struct kvm_sev_receive_start params;
+ int *error = &argp->error;
+ void *session_data = NULL;
+ void *pdh_data = NULL;
+ int ret;
+
+ if (!sev_guest(kvm))
+ return -ENOTTY;
+
+ /* Get parameter from the user */
+ if (copy_from_user(¶ms, (void __user *)(uintptr_t)argp->data,
+ sizeof(struct kvm_sev_receive_start)))
+ return -EFAULT;
+
+ if (!params.pdh_uaddr || !params.pdh_len ||
+ !params.session_uaddr || !params.session_len)
+ return -EINVAL;
+
+ start = kzalloc(sizeof(*start), GFP_KERNEL);
+ if (!start)
+ return -ENOMEM;
+
+ start->handle = params.handle;
+ start->policy = params.policy;
+
+ pdh_data = psp_copy_user_blob(params.pdh_uaddr, params.pdh_len);
+ if (IS_ERR(pdh_data)) {
+ ret = PTR_ERR(pdh_data);
+ goto e_free;
+ }
+
+ start->pdh_cert_address = __psp_pa(pdh_data);
+ start->pdh_cert_len = params.pdh_len;
+
+ session_data = psp_copy_user_blob(params.session_uaddr,
params.session_len);
+ if (IS_ERR(session_data)) {
+ ret = PTR_ERR(session_data);
+ goto e_free_pdh;
+ }
+
+ start->session_address = __psp_pa(session_data);
+ start->session_len = params.session_len;
+
+ /* create memory encryption context */
+ ret = __sev_issue_cmd(argp->sev_fd, SEV_CMD_RECEIVE_START, start,
error);
+ if (ret)
+ goto e_free_session;
+
+ /* Bind ASID to this guest */
+ ret = sev_bind_asid(kvm, start->handle, error);
+ if (ret)
+ goto e_free_session;
+
+ params.handle = start->handle;
+ if (copy_to_user((void __user *)(uintptr_t)argp->data,
+ ¶ms, sizeof(struct kvm_sev_receive_start))) {
+ ret = -EFAULT;
+ sev_unbind_asid(kvm, start->handle);
+ goto e_free_session;
+ }
+
+ sev->handle = start->handle;
+ sev->fd = argp->sev_fd;
+
+e_free_session:
+ kfree(session_data);
+e_free_pdh:
+ kfree(pdh_data);
+e_free:
+ kfree(start);
+ return ret;
+}
+
static int svm_mem_enc_op(struct kvm *kvm, void __user *argp)
{
struct kvm_sev_cmd sev_cmd;
@@ -7242,6 +7319,9 @@ static int svm_mem_enc_op(struct kvm *kvm, void __user
*argp)
case KVM_SEV_SEND_FINISH:
r = sev_send_finish(kvm, &sev_cmd);
break;
+ case KVM_SEV_RECEIVE_START:
+ r = sev_receive_start(kvm, &sev_cmd);
+ break;
default:
r = -EINVAL;
goto out;
diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
index 0bee91bba329..fee75bf1fd90 100644
--- a/include/uapi/linux/kvm.h
+++ b/include/uapi/linux/kvm.h
@@ -1541,6 +1541,15 @@ struct kvm_sev_send_update_data {
__u32 trans_len;
};
+struct kvm_sev_receive_start {
+ __u32 handle;
+ __u32 policy;
+ __u64 pdh_uaddr;
+ __u32 pdh_len;
+ __u64 session_uaddr;
+ __u32 session_len;
+};
+
#define KVM_DEV_ASSIGN_ENABLE_IOMMU (1 << 0)
#define KVM_DEV_ASSIGN_PCI_2_3 (1 << 1)
#define KVM_DEV_ASSIGN_MASK_INTX (1 << 2)
--
2.17.1
- Re: [Qemu-devel] [RFC PATCH v1 01/10] KVM: SVM: Add KVM_SEV SEND_START command, (continued)
- Re: [Qemu-devel] [RFC PATCH v1 01/10] KVM: SVM: Add KVM_SEV SEND_START command, Singh, Brijesh, 2019/04/26
- Re: [Qemu-devel] [RFC PATCH v1 01/10] KVM: SVM: Add KVM_SEV SEND_START command, Borislav Petkov, 2019/04/26
- Re: [Qemu-devel] [RFC PATCH v1 01/10] KVM: SVM: Add KVM_SEV SEND_START command, Singh, Brijesh, 2019/04/29
- Re: [Qemu-devel] [RFC PATCH v1 01/10] KVM: SVM: Add KVM_SEV SEND_START command, Borislav Petkov, 2019/04/29
- Re: [Qemu-devel] [RFC PATCH v1 01/10] KVM: SVM: Add KVM_SEV SEND_START command, Singh, Brijesh, 2019/04/29
[Qemu-devel] [RFC PATCH v1 09/10] KVM: x86: Introduce KVM_GET_PAGE_ENC_BITMAP ioctl, Singh, Brijesh, 2019/04/24
[Qemu-devel] [RFC PATCH v1 10/10] mm: x86: Invoke hypercall when page encryption status is changed, Singh, Brijesh, 2019/04/24
[Qemu-devel] [RFC PATCH v1 02/10] KVM: SVM: Add KVM_SEND_UPDATE_DATA command, Singh, Brijesh, 2019/04/24
[Qemu-devel] [RFC PATCH v1 04/10] KVM: SVM: Add support for KVM_SEV_RECEIVE_START command,
Singh, Brijesh <=
[Qemu-devel] [RFC PATCH v1 06/10] KVM: SVM: Add KVM_SEV_RECEIVE_FINISH command, Singh, Brijesh, 2019/04/24
[Qemu-devel] [RFC PATCH v1 05/10] KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command, Singh, Brijesh, 2019/04/24
[Qemu-devel] [RFC PATCH v1 03/10] KVM: SVM: Add KVM_SEV_SEND_FINISH command, Singh, Brijesh, 2019/04/24
[Qemu-devel] [RFC PATCH v1 07/10] KVM: x86: Add AMD SEV specific Hypercall3, Singh, Brijesh, 2019/04/24
[Qemu-devel] [RFC PATCH v1 08/10] KVM: X86: Introduce KVM_HC_PAGE_ENC_STATUS hypercall, Singh, Brijesh, 2019/04/24
Re: [Qemu-devel] [RFC PATCH v1 00/10] Add AMD SEV guest live migration support, Steve Rutherford, 2019/04/24