When the KVM VM file descriptor changes as a part of the confidential guest reset mechanism, it necessary to create a new confidential guest context and re-encrypt the VM memeory. This happens for SEV-ES and SEV-SNP virtual machines as a part of SEV_LAUNCH_FINISH, SEV_SNP_LAUNCH_FINISH operations.
A new resettable interface for SEV module has been added. A new reset callback for the reset 'exit' state has been implemented to perform the above operations when the VM file descriptor has changed during VM reset. Tracepoints has been added also for tracing purpose. Signed-off-by: Ani Sinha <[email protected]> --- target/i386/sev.c | 52 ++++++++++++++++++++++++++++++++++++++++ target/i386/trace-events | 1 + 2 files changed, 53 insertions(+) diff --git a/target/i386/sev.c b/target/i386/sev.c index d7425dde96..d45356843c 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -30,8 +30,10 @@ #include "system/kvm.h" #include "kvm/kvm_i386.h" #include "sev.h" +#include "system/cpus.h" #include "system/system.h" #include "system/runstate.h" +#include "system/reset.h" #include "trace.h" #include "migration/blocker.h" #include "qom/object.h" @@ -85,6 +87,10 @@ typedef struct QEMU_PACKED PaddedSevHashTable { uint8_t padding[ROUND_UP(sizeof(SevHashTable), 16) - sizeof(SevHashTable)]; } PaddedSevHashTable; +static void sev_handle_reset(Object *obj, ResetType type); + +SevKernelLoaderContext sev_load_ctx = {}; + QEMU_BUILD_BUG_ON(sizeof(PaddedSevHashTable) % 16 != 0); #define SEV_INFO_BLOCK_GUID "00f771de-1a7e-4fcb-890e-68c77e2fb44e" @@ -128,6 +134,7 @@ struct SevCommonState { uint8_t build_id; int sev_fd; SevState state; + ResettableState reset_state; QTAILQ_HEAD(, SevLaunchVmsa) launch_vmsa; }; @@ -1984,6 +1991,38 @@ static int sev_snp_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) return 0; } +/* + * handle sev vm reset + */ +static void sev_handle_reset(Object *obj, ResetType type) +{ + SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs); + SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(sev_common); + + if (!sev_common) { + return; + } + + if (!runstate_is_running()) { + return; + } + + sev_add_kernel_loader_hashes(&sev_load_ctx, &error_fatal); + if (!sev_check_state(sev_common, SEV_STATE_RUNNING)) { + /* this calls sev_snp_launch_finish() etc */ + klass->launch_finish(sev_common); + } + + trace_sev_handle_reset(); + return; +} + +static ResettableState *sev_reset_state(Object *obj) +{ + SevCommonState *sev_common = SEV_COMMON(obj); + return &sev_common->reset_state; +} + int sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp) { @@ -2462,6 +2501,8 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp) return false; } + /* save the context here so that it can be re-used when vm is reset */ + memcpy(&sev_load_ctx, ctx, sizeof(*ctx)); return klass->build_kernel_loader_hashes(sev_common, area, ctx, errp); } @@ -2722,8 +2763,16 @@ static void sev_common_class_init(ObjectClass *oc, const void *data) { ConfidentialGuestSupportClass *klass = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc); + ResettableClass *rc = RESETTABLE_CLASS(oc); klass->kvm_init = sev_common_kvm_init; + /* + * the exit phase makes sure sev handles reset after all legacy resets + * have taken place (in the hold phase) and IGVM has also properly + * set up the boot state. + */ + rc->phases.exit = sev_handle_reset; + rc->get_state = sev_reset_state; object_class_property_add_str(oc, "sev-device", sev_common_get_sev_device, @@ -2758,6 +2807,8 @@ sev_common_instance_init(Object *obj) cgs->get_mem_map_entry = cgs_get_mem_map_entry; cgs->set_guest_policy = cgs_set_guest_policy; + qemu_register_resettable(OBJECT(sev_common)); + QTAILQ_INIT(&sev_common->launch_vmsa); /* add migration blocker */ @@ -2779,6 +2830,7 @@ static const TypeInfo sev_common_info = { .abstract = true, .interfaces = (const InterfaceInfo[]) { { TYPE_USER_CREATABLE }, + { TYPE_RESETTABLE_INTERFACE }, { } } }; diff --git a/target/i386/trace-events b/target/i386/trace-events index 51301673f0..b320f655ee 100644 --- a/target/i386/trace-events +++ b/target/i386/trace-events @@ -14,3 +14,4 @@ kvm_sev_attestation_report(const char *mnonce, const char *data) "mnonce %s data kvm_sev_snp_launch_start(uint64_t policy, char *gosvw) "policy 0x%" PRIx64 " gosvw %s" kvm_sev_snp_launch_update(uint64_t src, uint64_t gpa, uint64_t len, const char *type) "src 0x%" PRIx64 " gpa 0x%" PRIx64 " len 0x%" PRIx64 " (%s page)" kvm_sev_snp_launch_finish(char *id_block, char *id_auth, char *host_data) "id_block %s id_auth %s host_data %s" +sev_handle_reset(void) "" -- 2.42.0
