This patchset is also available at: https://github.com/amdese/qemu/commits/snp-certs-v3
and is based on top of qemu master (d731492832) v1: https://lore.kernel.org/qemu-devel/[email protected]/ v2: https://lore.kernel.org/qemu-devel/[email protected]/ v3: - add QEMU documentation for how to work with certificate files (Markus) - address QAPI scheme formatting issues (Markus) - partially re-use async_safe_run_on_cpu() infrastructure for handling immediate exit callbacks so that multiple vCPUs waiting to release read lock on the certificate file are each handled correctly - refactor certificate file handling to thoroughly log unexpected errors without flooding host logs - propagate all unexpected errors to guest rather than terminating QEMU - additional comments/cleanups and other fixes Overview -------- The GHCB 2.0 specification defines 2 GHCB request types to allow SNP guests to send encrypted messages/requests to firmware: SNP Guest Requests and SNP Extended Guest Requests. These encrypted messages are used for things like servicing attestation requests issued by the guest. Implementing support for these is required to be fully GHCB-compliant. For the most part, KVM only needs to handle forwarding these requests to firmware (to be issued via the SNP_GUEST_REQUEST firmware command defined in the SEV-SNP Firmware ABI), and then forwarding the encrypted response to the guest. However, in the case of SNP Extended Guest Requests, the host is also able to provide the certificate data corresponding to the endorsement key used by firmware to sign attestation report requests. This certificate data is provided by userspace because: 1) It allows for different keys/key types to be used for each particular guest with requiring any sort of KVM API to configure the certificate table in advance on a per-guest basis. 2) It provides additional flexibility with how attestation requests might be handled during live migration where the certificate data for source/dest might be different. 3) It allows all synchronization between certificates and firmware/signing key updates to be handled purely by userspace rather than requiring some in-kernel mechanism to facilitate it. [1] To support fetching certificate data from userspace, a new KVM KVM_EXIT_SNP_REQ_CERTS exit type is used to fetch the data similarly to KVM_EXIT_MMIO/etc, with an associate KVM capability to detect/enable the exits depending on whether userspace has been configured to provide certificate data. Add support for this exit in QEMU. Additionally, because some of the locking behavior relies on kvm_immediate_exit, add an some infrastructure to allow for callbacks to be registered and executed upon a kvm_immediate_exit-induced exit from KVM. See the documentation included in the patches for more details on the expected usage and kvm_immediate_exit handling: [1] https://lore.kernel.org/kvm/[email protected]/ Testing ------- For testing this, use the following host kernel: https://github.com/amdese/linux/commits/snp-certs-v3 For the guest, any 5.19 or newer kernel will do. A basic command-line invocation for an SNP guest with certificate data supplied would be: qemu-system-x86_64 -smp 32,maxcpus=255 -cpu EPYC-Milan-v2 -machine q35,confidential-guest-support=sev0,memory-backend=ram1 -object memory-backend-memfd,id=ram1,size=4G,share=true,reserve=false -object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1,id-auth=,certs-path=/home/mroth/cert.blob -bios OVMF.fd Something like the following simple example can be used to simulate an exclusive lock being held on the certificate by management tools performing an update: #include <stdlib.h> #include <stdio.h> #define __USE_GNU #include <fcntl.h> #include <unistd.h> #include <errno.h> #include <stdbool.h> #include <sys/types.h> #include <sys/stat.h> int main(int argc, void **argv) { int ret, fd, i = 0; char *path = argv[1]; struct flock fl = { .l_whence = SEEK_SET, .l_start = 0, .l_len = 0, .l_type = F_WRLCK }; fd = open(path, O_RDWR); ret = fcntl(fd, F_OFD_SETLK, &fl); if (ret) { printf("error locking file, ret %d errno %d\n", ret, errno); return ret; } while (true) { i++; printf("now holding lock (%d seconds elapsed)...\n", i); usleep(1000 * 1000); } return 0; } For requesting attestation with certificate data attached, you can use something like the following tool/workflow: https://github.com/virtee/snpguest?tab=readme-ov-file#extended-attestation-workflow The format of the certificate blob is defined in the GHCB 2.0 specification, but if it's not being parsed on the guest-side then random data will suffice for testing the KVM bits. Any feedback/review is appreciated. Thanks! -Mike ---------------------------------------------------------------- Michael Roth (3): hw/cpu: Add async_run_on_cpu_after_accel() accel/kvm: Add kvm_immediate_exit callback infrastructure i386/sev: Add KVM_EXIT_SNP_REQ_CERTS support for certificate-fetching accel/kvm/kvm-all.c | 20 ++ cpu-common.c | 66 ++++++ docs/system/i386/amd-memory-encryption.rst | 77 +++++++ hw/core/cpu-common.c | 2 + include/hw/core/cpu.h | 33 +++ include/system/kvm.h | 11 + qapi/qom.json | 23 +- target/i386/kvm/kvm.c | 10 + target/i386/sev-system-stub.c | 5 + target/i386/sev.c | 338 +++++++++++++++++++++++++++++ target/i386/sev.h | 3 +- 11 files changed, 586 insertions(+), 2 deletions(-)
