From nobody Wed Oct 8 18:32:52 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1520514017302444.7674847296819; Thu, 8 Mar 2018 05:00:17 -0800 (PST) Received: from localhost ([::1]:38512 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1etv9c-0005yh-Fv for importer@patchew.org; Thu, 08 Mar 2018 08:00:16 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59020) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1etuzy-0005WR-8r for qemu-devel@nongnu.org; Thu, 08 Mar 2018 07:50:21 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1etuzu-0004BQ-8e for qemu-devel@nongnu.org; Thu, 08 Mar 2018 07:50:18 -0500 Received: from mail-cys01nam02on0055.outbound.protection.outlook.com ([104.47.37.55]:40580 helo=NAM02-CY1-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1etuzt-0004As-W4 for qemu-devel@nongnu.org; Thu, 08 Mar 2018 07:50:14 -0500 Received: from wsp141597wss.amd.com (165.204.78.1) by DM2PR12MB0156.namprd12.prod.outlook.com (2a01:111:e400:50ce::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.548.13; Thu, 8 Mar 2018 12:50:08 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector1-amd-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=lnH+Gle5N5Fx+/VlWZnyw+Y9zqcT6b49jP+NiMBJEIQ=; b=yugkhwQUKBctWsD5kaBWfCYhId6NB1SGM/pbsXvhu3VbRDFNznhABeMLh1SbX4hqHjmnxKE262c2VxjYqRezxHR9hlDA3iD1h25hU94uAGLKD5IC1RDvu7v9nKaTj3OAsLNGRqUxwFCg/s4xXBd7t+bWpuxzNmJfKsYQ6p/hNS0= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: qemu-devel@nongnu.org Date: Thu, 8 Mar 2018 06:48:51 -0600 Message-Id: <20180308124901.83533-19-brijesh.singh@amd.com> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20180308124901.83533-1-brijesh.singh@amd.com> References: <20180308124901.83533-1-brijesh.singh@amd.com> MIME-Version: 1.0 X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: BN6PR14CA0031.namprd14.prod.outlook.com (2603:10b6:404:13f::17) To DM2PR12MB0156.namprd12.prod.outlook.com (2a01:111:e400:50ce::19) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: ce8d7535-baf1-4848-3519-08d584f3208f X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(48565401081)(5600026)(4604075)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:DM2PR12MB0156; X-Microsoft-Exchange-Diagnostics: 1; DM2PR12MB0156; 3:kwSz9NUwoeBgDKHKZTDWlYU4g524PnUjeWfM+tBWBwvDjjQqKQcf0BAbnWG9NYW1AVUufPcOuLsvLjv0lZ846U2301mgs55xRqyXVamfmwbIzR6Ua6J9rVlP3OXw/09zo94c2hq3BA6kh/KqAUmQdMeAQQKgDZVHm+y1zf1zsUOBTaHf+gFO7hK83Qac4WqdyLIeNc6d0ROw+vWKz6wutdnkaF8To8VF1iDt8Mc15mZZZPTtkQgCXsCxU7wDRWu+; 25:IlogoP466B7I1z6wW25TSd0XJ0bkK5jGSoz5zsaGSllwxfqBmtpzlJ42e61P9IEBO1Wj3Y2WFLysgafjiJA6ZVVCdUF43IDGDhQLv0LGZ1+JszextzNJExnF8Xv5Qqs2NSwnuGOYhVxQS2GIhUDaNiauv7mdyZX6klnQjopk3e1MxlClt5tjstucDK2zOZBuV+S1cVcrDaRSAH0GhBk9YsareygosXz9mC2vYJL2aWMEH0u7RrNpwWiNLqLTEtrGrUWCXmCligM+icxKxEd1EbFQ6SULL0UFQW4Tcl/kS45ufkjl2gmEHMCEK20tdxQ2d/M7NDUGcOr56JUKBY/6ug==; 31:vLceHw6rrFvnXRR1GNX2f1NnOaG8IxN97TNMOSlQNtGekOJwXpg0hvX2RuVCmB3ChZ5Picj/rpUfWBlE+P2k0fjs5hU2FaVkHfhI1y30LkgfLER15m4h1S8AYa8emH//nmPggR5rwasGfOsblgvCHIsr3VLMzk+L+h9na/wuMjdYLiDVLIaX5pizT+UvIro0gSeJWvw9K+swEWmfVM06Hjk+wdS48OuYjDmpwiDsRfw= X-MS-TrafficTypeDiagnostic: DM2PR12MB0156: X-Microsoft-Exchange-Diagnostics: 1; DM2PR12MB0156; 20:LLQvKDS81NT8gemGOIB7V3JP/0eZuP3cgT8FdYiQMO30uwGCITn2MuwqxIaKTOZ9/aE5lszD8gXoLy1TiWj+u8/WHLBPRBUq+1wAdreyxbTzi7irVhDa4ZiA73mD2Y8Ys5Anw7y5lvUTLdxzJ73v7bPEHZLGvcoNxfhHzM3RE+fHkST/lhaES3qKklh8An/Sq/k8v5U85RCrxSnPruNfmu+YVloSvUnAU8a4irVWAF+TNHXb7ds3WDntg1BinDfLNYRRdyt/ho0Cd7noQwgt1yMnJwB1NAiQgWoQ+poUuRYKxfl95z0w9ojGDfHBHhFC3wQVKeY3FBHCa3OO6OZ1UQIUNItheLxNAseo6USiExo4lc7QfZ05NplgxAg97WqZKvGWpY+DzM/7ZM3sh/9HVP9VPtWD1s/ZmI/10v9WtNsvm7pPtEJj4UNPlTbF2J1WjGPlXhXGFZsLCZPvSn7qLH0khU8Bpn0AtLas5tgl9/iIkeW8m9o9xEgsn1VAy7l6; 4:qy4RYpTeokxg/DyT+pOMY0wCS0rpHEMRfeGcSmJRCYkZzhNmjNYgk9oDOBME2Ukg8NX3XEFOmhIl8sCtsindCIcuiYZ7ncHlPmuKUoK4yN0ZHNXsL97G5DCpgkk9u+p44CwjzwqGjDhXeTGR0/CnbZXFZvWiGJ5OaKWfgyz33AIOC+h7a4lkmYqZvrQWo81lX47uw5+a+xGjYpDf/8NkozrqM06xIBdvwdpL68tkDcs77vMyFpeA4tu3P5vn6rB+1DZBXXsulwKW+buKFDztzaycLCN9c1VBnE5iY2sdCJmg78Ddsz2keKIZ0QfmSdK5 X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(767451399110); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(6040501)(2401047)(5005006)(8121501046)(93006095)(93001095)(10201501046)(3231220)(944501244)(52105095)(3002001)(6055026)(6041288)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123560045)(20161123558120)(20161123562045)(6072148)(201708071742011); SRVR:DM2PR12MB0156; BCL:0; PCL:0; RULEID:; SRVR:DM2PR12MB0156; X-Forefront-PRVS: 060503E79B X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(1496009)(39380400002)(39860400002)(376002)(396003)(346002)(366004)(199004)(189003)(50226002)(53936002)(2950100002)(6916009)(2906002)(2361001)(6666003)(2351001)(106356001)(81156014)(53416004)(8676002)(81166006)(7736002)(36756003)(305945005)(8936002)(105586002)(48376002)(50466002)(68736007)(97736004)(47776003)(66066001)(25786009)(4326008)(39060400002)(6486002)(7416002)(5660300001)(3846002)(478600001)(76176011)(51416003)(7696005)(52116002)(6116002)(16586007)(16526019)(186003)(26005)(1076002)(8656006)(386003)(54906003)(86362001)(575784001)(316002)(59450400001)(8666007); DIR:OUT; SFP:1101; SCL:1; SRVR:DM2PR12MB0156; H:wsp141597wss.amd.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; DM2PR12MB0156; 23:JuRlCVL3xRX1WjGKLux7DlPRCCioJ7V/SXLL5ZQIX?= =?us-ascii?Q?J8OYEpb32pOPR0esocmcBFiLEYxsw+onH2Wj7qQ5h6uah2YYHwsCdukY2tVc?= =?us-ascii?Q?mljyUOHfN7/tHZ5QSUJUT3xDseMDZqXJkxlUrQvKx90ZIPEe1VgfGRT4u5AE?= =?us-ascii?Q?pPP/KRnF3Wc8Bb7KOJpXqZgFy04UMZAWpZqJDQUEDZRyxMZUuhW7WZUcu3Ue?= =?us-ascii?Q?bsCnyK4FO0ofy4kZKrK2NjmnF6YLHxsf5MHPr4azq3FwbUdA6r2lqNSurm1Y?= =?us-ascii?Q?5KRvety7+R2OPVNRSxqQwIq7FqRdUHLj2KudPka4Yknrgx1NlT3oM60Ok1zH?= =?us-ascii?Q?WBOSFWzEH3kmWBZdgFF06VOnwgZnBZL41wxxqdwJv5nXDaqSmM33vWDfU+Gj?= =?us-ascii?Q?jp3kwMwYD9Eg/f8cmBxzkf5xy5W93C40B0gYUfvD5CZ1hUjlB6cL16V9Fmsw?= =?us-ascii?Q?IKxeTdFeYJBYXQ3DiulaM676viz7bnFAoW9AUK2BqOrBRmoompw7tmxTBP2A?= =?us-ascii?Q?QbuwpXCVMEvOArGNqnECGdYMrPLs7tyrZ747/ZAG0JGcJ1yC2xzWWn5kTVuv?= =?us-ascii?Q?IH8QMokd05gvE19X25xDoLja4o9hXUsDFInI+SaePMe6+Y1Bq7ZPYcO4x9jl?= =?us-ascii?Q?lUFEwAm7i4eJ8PimG63Hnnz9+oiZirFakRguBhYJnr8CkL/LoGjhi1wiwcxs?= =?us-ascii?Q?Do2iJEokEvyvgXTVotTRarnf8qwiNe45cKVGYFn7la8I9G84BMKgKUP32ihV?= =?us-ascii?Q?Q93efEOJxY9PrqTFkpZ7sLP7UIbzlMM+rVNpLsAigg+4pUIFKTOAn1tqKESl?= =?us-ascii?Q?MLTO2XbK5qkR58AuuHX4DMhsYU250zUagI5nhxb7ado3QtV7D4iywwfhqfTz?= =?us-ascii?Q?cRPdBVwJf9IfM1F1LTEYXj+yKiE9fHg2l8ca+CtL+fxphDOeHs1TyPI/0A5n?= =?us-ascii?Q?gUqe0zxdEQNqNsQwKyXejAvWgIDBTypdOb0pXJtvXdxZ+6trN3oybfhTTxko?= =?us-ascii?Q?ZrBaIUR2NOcefC8G8ale2mZS3Yt+LHbZCED5BjhyPzpJrgcl0mKHl1+EXbJc?= =?us-ascii?Q?83qq743kmhZPdTY5GP9msGTabbZk0KkSoFxkcm8Aijad/bps1dUiRQAUwzOR?= =?us-ascii?Q?fZBgGIy2Mbi7HEiiK21L1o58gTy2e3dghzuvveg0i5flfVj74CZRShbyFVVH?= =?us-ascii?Q?SIUjT8XTt2PlTdBg3cv1wzN8G4kAJZbCKtThMec4jB7Bus4laTBiQ6ugGFI7?= =?us-ascii?Q?poAD30XIwbEU/mSIqQrzU19bfdhl5TJi2TPW8z5qkgZCFKUvphII38kgtNA3?= =?us-ascii?Q?xCXAPhZrKerErDzocJRMMpi0sdD9R8BpJd0PsPIUAgX?= X-Microsoft-Antispam-Message-Info: hWyjsVRuaw/4q4MzKjDNzVVptGHGMxTNx5s5GcIdEAeBTdgMHVI95VIIRy7FUeFLQdhTtwALh40fHoLfQLxgVUaAp+qEIrLAYawweA++KLMkbuf1t3E87z3tcivRJTMifct58an1gisiRNcoqAW86odJVGYsEJrwqqc2V3C0yA/LO4WXogs9AHMbmxF48eaX X-Microsoft-Exchange-Diagnostics: 1; DM2PR12MB0156; 6:nzt1DiPb8Z9mwYVYFGuvHJrY8XwQLk3qrEc/3tzj5FWIOJ89ba3d680eBes2NORTSx8QKKYcJW5vbMnmMIVCf5+B9kdiliavQpiGSNzf3MJSxbIYkgy5/mRCfoAmkMyX/sYHidaMUbCx5tsSBoi/Gvsz50ENCQKdXnNFBLJD13s8Vveq3mq/ztV0syN6v6zav5cW9aZO2LfpvyWbnORz2NY42E03K1tNnwLNClTm7hCfT0HiZ6Fh6Ft5e0nmoNuiq4ksj0JjV7LIq9U6Crf34SbCNvHFKsVR6KkED8jdLWuAhsLa1S+kGnE7/NSKW6pZSp6zHifBX1cW2bKr1knbPj6FmFUIQ1KKcITzR0Gsnkc=; 5:1sVY/Jt7G63jrB+lyW79S+98huTdLVk5RlEh9DcG/5yJthgzebUHYKTKIx1cNiJPJnF+F64wdvA5F4BZ2VfC4yhdH82NyAZhi056zgwp4VH+Ia/GPNaBNb5386Zxa7LGRXLh+kBleSNW8Z9vftropmSWuh1Fr2uRu7h/5CryMkE=; 24:t7ynFMSX8Q4nhSisvmN5B8mCCQjvoF3ATQq4CSeUxkiT3KkBHYCv/xHCJND5jj8ioZSKxqOeF+lJiFWXn5AlP1h7zWAm0/4jjzt6f8cdFBc=; 7:c25ougg6+WsHIcQbEAgK69WJl2+6WIH3xShchVE4wgXzsHbmTaSOVcDc8KTqthpkNAcGJR2W31soFclti18xuC6HnDnbByDR3OdVw65XOZj8nZFOwr0kK4Vzh6YHVK6I3dJP06dWqZ26iPhA4IzvXOZFvrTFHpwdQJVOoHTwnRBQvUORAsMbTVdL/3loua/QEKDOFXMQaV5gN0Y8NiHEhUDBmmUVgjTA7jYQPxZqpaTv5+QDqdO+BNjvLRBDmei+ SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; DM2PR12MB0156; 20:ht+lYvn3SghH+E0rTvd2i1Ab6TQgt2t7hH/USqGqYcPBCnuOjDONSmIbGIOQJpiYTWfVTo39zC7CUb/Gu66bwcPjLKjQb9zjKMH6zCEd0+5IiFoVmtmFtjXk3/EGcbW7I3sQyOTJLjqlDsHJgeJbXcA7OPhb66KFIvjmOQ7UEuaJTnGBjXZ65BirLjg9ZMz34StCm3NnLhkM1YY7Wkcw0MUDTC1yy2K+p9rSlXuVrgpp59Ut+RTCby/wTbIPdr6U X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Mar 2018 12:50:08.0031 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ce8d7535-baf1-4848-3519-08d584f3208f X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR12MB0156 X-detected-operating-system: by eggs.gnu.org: Windows 7 or 8 [fuzzy] X-Received-From: 104.47.37.55 Subject: [Qemu-devel] [PATCH v12 18/28] sev/i386: add support to LAUNCH_MEASURE command X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Brijesh Singh , kvm@vger.kernel.org, "Michael S. Tsirkin" , Stefan Hajnoczi , Alexander Graf , "Edgar E. Iglesias" , Markus Armbruster , Bruce Rogers , Christian Borntraeger , Marcel Apfelbaum , Borislav Petkov , Thomas Lendacky , Eduardo Habkost , Richard Henderson , "Dr. David Alan Gilbert" , Alistair Francis , Cornelia Huck , Richard Henderson , Peter Crosthwaite , Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" During machine creation we encrypted the guest bios image, the LAUNCH_MEASURE command can be used to retrieve the measurement of the encrypted memory region. This measurement is a signature of the memory contents that can be sent to the guest owner as an attestation that the memory was encrypted correctly by the firmware. VM management tools like libvirt can query the measurement using query-sev-launch-measure QMP command. Cc: Paolo Bonzini Cc: Richard Henderson Cc: Eduardo Habkost Signed-off-by: Brijesh Singh --- target/i386/sev-stub.c | 5 ++++ target/i386/sev.c | 63 ++++++++++++++++++++++++++++++++++++++++++++= ++++ target/i386/sev_i386.h | 2 ++ target/i386/trace-events | 1 + 4 files changed, 71 insertions(+) diff --git a/target/i386/sev-stub.c b/target/i386/sev-stub.c index c86d8c139237..2f61c32ec975 100644 --- a/target/i386/sev-stub.c +++ b/target/i386/sev-stub.c @@ -39,3 +39,8 @@ uint32_t sev_get_reduced_phys_bits(void) { return 0; } + +char *sev_get_launch_measurement(void) +{ + return NULL; +} diff --git a/target/i386/sev.c b/target/i386/sev.c index cb0bf84742ed..7ad7eaf600a7 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -516,6 +516,68 @@ sev_launch_update_data(uint8_t *addr, uint64_t len) return ret; } =20 +static void +sev_launch_get_measure(Notifier *notifier, void *unused) +{ + int ret, error; + guchar *data; + SEVState *s =3D sev_state; + struct kvm_sev_launch_measure *measurement; + + if (!sev_check_state(SEV_STATE_LUPDATE)) { + return; + } + + measurement =3D g_new0(struct kvm_sev_launch_measure, 1); + + /* query the measurement blob length */ + ret =3D sev_ioctl(sev_state->sev_fd, KVM_SEV_LAUNCH_MEASURE, + measurement, &error); + if (!measurement->len) { + error_report("%s: LAUNCH_MEASURE ret=3D%d fw_error=3D%d '%s'", + __func__, ret, error, fw_error_to_str(errno)); + goto free_measurement; + } + + data =3D g_new0(guchar, measurement->len); + measurement->uaddr =3D (unsigned long)data; + + /* get the measurement blob */ + ret =3D sev_ioctl(sev_state->sev_fd, KVM_SEV_LAUNCH_MEASURE, + measurement, &error); + if (ret) { + error_report("%s: LAUNCH_MEASURE ret=3D%d fw_error=3D%d '%s'", + __func__, ret, error, fw_error_to_str(errno)); + goto free_data; + } + + sev_set_guest_state(SEV_STATE_LSECRET); + + /* encode the measurement value and emit the event */ + s->measurement =3D g_base64_encode(data, measurement->len); + trace_kvm_sev_launch_measurement(s->measurement); + +free_data: + g_free(data); +free_measurement: + g_free(measurement); +} + +char * +sev_get_launch_measurement(void) +{ + if (sev_state && + sev_state->state >=3D SEV_STATE_LSECRET) { + return g_strdup(sev_state->measurement); + } + + return NULL; +} + +static Notifier sev_machine_done_notify =3D { + .notify =3D sev_launch_get_measure, +}; + void * sev_guest_init(const char *id) { @@ -593,6 +655,7 @@ sev_guest_init(const char *id) } =20 ram_block_notifier_add(&sev_ram_notifier); + qemu_add_machine_init_done_notifier(&sev_machine_done_notify); =20 return s; err: diff --git a/target/i386/sev_i386.h b/target/i386/sev_i386.h index 924cebcab02d..6e370775770e 100644 --- a/target/i386/sev_i386.h +++ b/target/i386/sev_i386.h @@ -37,6 +37,7 @@ extern uint64_t sev_get_me_mask(void); extern SevInfo *sev_get_info(void); extern uint32_t sev_get_cbit_position(void); extern uint32_t sev_get_reduced_phys_bits(void); +extern char *sev_get_launch_measurement(void); =20 typedef struct QSevGuestInfo QSevGuestInfo; typedef struct QSevGuestInfoClass QSevGuestInfoClass; @@ -78,6 +79,7 @@ struct SEVState { uint32_t handle; int sev_fd; SevState state; + gchar *measurement; }; =20 typedef struct SEVState SEVState; diff --git a/target/i386/trace-events b/target/i386/trace-events index c0cd8e93217f..f7a1a1e6b85c 100644 --- a/target/i386/trace-events +++ b/target/i386/trace-events @@ -13,3 +13,4 @@ kvm_memcrypt_unregister_region(void *addr, size_t len) "a= ddr %p len 0x%lu" kvm_sev_change_state(const char *old, const char *new) "%s -> %s" kvm_sev_launch_start(int policy, void *session, void *pdh) "policy 0x%x se= ssion %p pdh %p" kvm_sev_launch_update_data(void *addr, uint64_t len) "addr %p len 0x%" PRI= u64 +kvm_sev_launch_measurement(const char *value) "data %s" --=20 2.14.3