motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-08 18:23:57 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

sev/i386: add support to LAUNCH_MEASURE command

Browse source 
During machine creation we encrypted the guest bios image, the
LAUNCH_MEASURE command can be used to retrieve the measurement of
the encrypted memory region. This measurement is a signature of
the memory contents that can be sent to the guest owner as an
attestation that the memory was encrypted correctly by the firmware.
VM management tools like libvirt can query the measurement using
query-sev-launch-measure QMP command.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Brijesh Singh 2018-03-08 06:48:51 -06:00 • committed by Paolo Bonzini
parent 952e0668c4
commit c6c89c976d
4 changed files with 71 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

63
target/i386/sev.c
View file

@ -516,6 +516,68 @@ sev_launch_update_data(uint8_t *addr, uint64_t len)
return ret;
}
static void
sev_launch_get_measure(Notifier *notifier, void *unused)
{
int ret, error;
guchar *data;
SEVState *s = sev_state;
struct kvm_sev_launch_measure *measurement;
if (!sev_check_state(SEV_STATE_LAUNCH_UPDATE)) {
return;
}
measurement = g_new0(struct kvm_sev_launch_measure, 1);
/* query the measurement blob length */
ret = sev_ioctl(sev_state->sev_fd, KVM_SEV_LAUNCH_MEASURE,
measurement, &error);
if (!measurement->len) {
error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'",
__func__, ret, error, fw_error_to_str(errno));
goto free_measurement;
}
data = g_new0(guchar, measurement->len);
measurement->uaddr = (unsigned long)data;
/* get the measurement blob */
ret = sev_ioctl(sev_state->sev_fd, KVM_SEV_LAUNCH_MEASURE,
measurement, &error);
if (ret) {
error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'",
__func__, ret, error, fw_error_to_str(errno));
goto free_data;
}
sev_set_guest_state(SEV_STATE_LAUNCH_SECRET);
/* encode the measurement value and emit the event */
s->measurement = g_base64_encode(data, measurement->len);
trace_kvm_sev_launch_measurement(s->measurement);
free_data:
g_free(data);
free_measurement:
g_free(measurement);
}
char *
sev_get_launch_measurement(void)
{
if (sev_state &&
sev_state->state >= SEV_STATE_LAUNCH_SECRET) {
return g_strdup(sev_state->measurement);
}
return NULL;
}
static Notifier sev_machine_done_notify = {
.notify = sev_launch_get_measure,
};
void *
sev_guest_init(const char *id)
{
@ -593,6 +655,7 @@ sev_guest_init(const char *id)
}
ram_block_notifier_add(&sev_ram_notifier);
qemu_add_machine_init_done_notifier(&sev_machine_done_notify);
return s;
err: