Qemu SEV-ES guest support
v2 cover Qemu SEV-ES guest support
From: Tom Lendacky <[email protected]>
This patch series provides support for launching an SEV-ES guest.
Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on the SEV support to protect the guest register state from the hypervisor. See "AMD64 Architecture Programmer's Manual Volume 2: System Programming", section "15.35 Encrypted State (SEV-ES)" [1].
In order to allow a hypervisor to perform functions on behalf of a guest, there is architectural support for notifying a guest's operating system when certain types of VMEXITs are about to occur. This allows the guest to selectively share information with the hypervisor to satisfy the requested function. The notification is performed using a new exception, the VMM Communication exception (#VC). The information is shared through the Guest-Hypervisor Communication Block (GHCB) using the VMGEXIT instruction. The GHCB format and the protocol for using it is documented in "SEV-ES Guest-Hypervisor Communication Block Standardization" [2].
The main areas of the Qemu code that are updated to support SEV-ES are around the SEV guest launch process and AP booting in order to support booting multiple vCPUs.
There are no new command line switches required. Instead, the desire for SEV-ES is presented using the SEV policy object. Bit 2 of the SEV policy object indicates that SEV-ES is required.
The SEV launch process is updated in two ways. The first is that a the KVM_SEV_ES_INIT ioctl is used to initialize the guest instead of the standard KVM_SEV_INIT ioctl. The second is that before the SEV launch measurement is calculated, the LAUNCH_UPDATE_VMSA SEV API is invoked for each vCPU that Qemu has created. Once the LAUNCH_UPDATE_VMSA API has been invoked, no direct changes to the guest register state can be made.
AP booting poses some interesting challenges. The INIT-SIPI-SIPI sequence is typically used to boot the APs. However, the hypervisor is not allowed to update the guest registers. For the APs, the reset vector must be known in advance. An OVMF method to provide a known reset vector address exists by providing an SEV information block, identified by UUID, near the end of the firmware [3]. OVMF will program the jump to the actual reset vector in this area of memory. Since the memory location is known in advance, an AP can be created with the known reset vector address as its starting CS:IP. The GHCB document [2] talks about how SMP booting under SEV-ES is performed.
[1] https://www.amd.com/system/files/TechDocs/24593.pdf
[2] https://developer.amd.com/wp-content/resources/56421.pdf
[3] 30937f2f98c4 ("OvmfPkg: Use the SEV-ES work area for the SEV-ES AP reset vector")
https://github.com/tianocore/edk2/commit/30937f2f98c42496f2f143fe8374ae7f7e684847
---
These patches are based on commit:d0ed6a69d3 ("Update version for v5.1.0 release")
(I tried basing on the latest Qemu commit, but I was having build issues that level)
A version of the tree can be found at:
https://github.com/AMDESE/qemu/tree/sev-es-v10
Changes since v1:
- Fixed checkpatch.pl errors/warnings
Tom Lendacky (4):
sev/i386: Add initial support for SEV-ES sev/i386: Allow AP booting under SEV-ES sev/i386: Don't allow a system reset under an SEV-ES guest sev/i386: Enable an SEV-ES guest based on SEV policy
accel/kvm/kvm-all.c | 73 +++++++++++++++++++++++++++++ accel/stubs/kvm-stub.c | 5 ++ hw/i386/pc_sysfw.c | 10 +++- include/sysemu/cpus.h | 2 + include/sysemu/hw_accel.h | 5 ++ include/sysemu/kvm.h | 18 +++++++ include/sysemu/sev.h | 3 ++ softmmu/cpus.c | 5 ++ softmmu/vl.c | 5 +- target/i386/cpu.c | 1 + target/i386/kvm.c | 2 + target/i386/sev-stub.c | 5 ++ target/i386/sev.c | 99 ++++++++++++++++++++++++++++++++++++++- target/i386/sev_i386.h | 1 + 14 files changed, 230 insertions(+), 4 deletions(-)
Signature · 1 line
2.28.0
PATCH v2 1/4 sev/i386: Add initial support for SEV-ES
From: Tom Lendacky <[email protected]>
Provide initial support for SEV-ES. This includes creating a function to indicate the guest is an SEV-ES guest (which will return false until all support is in place), performing the proper SEV initialization and ensuring that the guest CPU state is measured as part of the launch.
--- target/i386/cpu.c | 1 + target/i386/sev-stub.c | 5 +++++ target/i386/sev.c | 46 ++++++++++++++++++++++++++++++++++++++++-- target/i386/sev_i386.h | 1 + 4 files changed, 51 insertions(+), 2 deletions(-)
target/i386/cpu.c +1 -0
@@ -5969,6 +5969,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,break ;case 0x8000001F : *eax =sev_enabled () ?0x2 :0 ; + *eax |=sev_es_enabled () ?0x8 :0 ; *ebx =sev_get_cbit_position (); *ebx |=sev_get_reduced_phys_bits () <<6 ; *ecx =0 ;
target/i386/sev-stub.c +5 -0
@@ -49,3 +49,8 @@ SevCapability *sev_get_capabilities(Error **errp)error_setg (errp,"SEV is not available in this QEMU" );return NULL ; } + +bool sev_es_enabled (void ) +{ +return false; +}
target/i386/sev.c +44 -2
77 lines not on this page · raw message
target/i386/sev_i386.h +1 -0
@@ -29,6 +29,7 @@#define SEV_POLICY_SEV 0x20extern bool sev_enabled (void ); +extern bool sev_es_enabled (void );extern uint64_t sev_get_me_mask (void );extern SevInfo *sev_get_info (void );extern uint32_t sev_get_cbit_position (void );
Signature · 1 line
2.28.0
PATCH v2 2/4 sev/i386: Allow AP booting under SEV-ES
In reply to Tom LendackyFrom: Tom Lendacky <[email protected]>
When SEV-ES is enabled, it is not possible modify the guests register state after it has been initially created, encrypted and measured.
Normally, an INIT-SIPI-SIPI request is used to boot the AP. However, the hypervisor cannot emulate this because it cannot update the AP register state. For the very first boot by an AP, the reset vector CS segment value and the EIP value must be programmed before the register has been encrypted and measured.
--- accel/kvm/kvm-all.c | 64 ++++++++++++++++++++++++++++++++++++++++++ accel/stubs/kvm-stub.c | 5 ++++ hw/i386/pc_sysfw.c | 10 ++++++- include/sysemu/kvm.h | 16 +++++++++++ include/sysemu/sev.h | 3 ++ target/i386/kvm.c | 2 ++ target/i386/sev.c | 51 +++++++++++++++++++++++++++++++++ 7 files changed, 150 insertions(+), 1 deletion(-)
accel/kvm/kvm-all.c +64 -0
@@ -39,6 +39,7 @@#include "qemu/main-loop.h" #include "trace.h" #include "hw/irq.h" +#include "sysemu/kvm.h" #include "sysemu/sev.h" #include "qapi/visitor.h" #include "qapi/qapi-types-common.h"
@@ -120,6 +121,12 @@ struct KVMState/* memory encryption */ void *memcrypt_handle;int (*memcrypt_encrypt_data)(void *handle,uint8_t *ptr,uint64_t len); +int (*memcrypt_save_reset_vector)(void *handle,void *flash_ptr, +uint64_t flash_size,uint32_t *addr); + +unsigned int reset_cs; +unsigned int reset_ip; +bool reset_valid;/* For "info mtree -f" to tell if an MR is registered in KVM */ int nr_as;
@@ -239,6 +246,62 @@ int kvm_memcrypt_encrypt_data(uint8_t *ptr, uint64_t len)return 1 ; } +void kvm_memcrypt_set_reset_vector (CPUState *cpu) +{ +X86CPU *x86; +CPUX86State *env; + +/* Only update if we have valid reset information */ +if (!kvm_state->reset_valid) { +return ; + } + +/* Do not update the BSP reset state */ +if (cpu->cpu_index ==0 ) { +return ; + } + + x86 =X86_CPU (cpu); + env = &x86->env; + +cpu_x86_load_seg_cache (env,R_CS ,0xf000 , kvm_state->reset_cs,0xffff , +DESC_P_MASK |DESC_S_MASK |DESC_CS_MASK | +DESC_R_MASK |DESC_A_MASK ); + + env->eip = kvm_state->reset_ip; +} + +int kvm_memcrypt_save_reset_vector (void *flash_ptr,uint64_t flash_size) +{ +CPUState *cpu; +uint32_t addr; +int ret; + +if (kvm_memcrypt_enabled () && + kvm_state->memcrypt_save_reset_vector) { + + addr =0 ; + ret = kvm_state->memcrypt_save_reset_vector (kvm_state->memcrypt_handle, + flash_ptr, flash_size, + &addr); +if (ret) { +return ret; + } + +if (addr) { + kvm_state->reset_cs = addr &0xffff0000 ; + kvm_state->reset_ip = addr &0x0000ffff ; + kvm_state->reset_valid = true; + +CPU_FOREACH (cpu) { +kvm_memcrypt_set_reset_vector (cpu); + } + } + } + +return 0 ; +} +/* Called with KVMMemoryListener.slots_lock held */ static KVMSlot *kvm_get_free_slot (KVMMemoryListener *kml) {
@@ -2193,6 +2256,7 @@ static int kvm_init(MachineState *ms) } kvm_state->memcrypt_encrypt_data = sev_encrypt_data; + kvm_state->memcrypt_save_reset_vector = sev_es_save_reset_vector; } ret =kvm_arch_init (ms, s);
accel/stubs/kvm-stub.c +5 -0
@@ -114,6 +114,11 @@ int kvm_memcrypt_encrypt_data(uint8_t *ptr, uint64_t len)return 1 ; } +int kvm_memcrypt_save_reset_vector (void *flash_ptr,uint64_t flash_size) +{ +return -ENOSYS ; +} +#ifndef CONFIG_USER_ONLY int kvm_irqchip_add_msi_route (KVMState *s,int vector,PCIDevice *dev) {
hw/i386/pc_sysfw.c +9 -1
@@ -156,7 +156,8 @@ static void pc_system_flash_map(PCMachineState *pcms,PFlashCFI01 *system_flash;MemoryRegion *flash_mem;void *flash_ptr; -int ret, flash_size; +uint64_t flash_size; +int ret;assert (PC_MACHINE_GET_CLASS (pcms)->pci_enabled);
@@ -204,6 +205,13 @@ static void pc_system_flash_map(PCMachineState *pcms,if (kvm_memcrypt_enabled ()) { flash_ptr =memory_region_get_ram_ptr (flash_mem); flash_size =memory_region_size (flash_mem); + + ret =kvm_memcrypt_save_reset_vector (flash_ptr, flash_size); +if (ret) { +error_report ("failed to locate and/or save reset vector" ); +exit (1 ); + } + ret =kvm_memcrypt_encrypt_data (flash_ptr, flash_size);if (ret) {error_report ("failed to encrypt pflash rom" );
include/sysemu/kvm.h +16 -0
@@ -247,6 +247,22 @@ bool kvm_memcrypt_enabled(void);*/ int kvm_memcrypt_encrypt_data (uint8_t *ptr,uint64_t len); +/** +* kvm_memcrypt_set_reset_vector - sets the CS/IP value for the AP if SEV-ES +* is active. +*/ +void kvm_memcrypt_set_reset_vector (CPUState *cpu); + +/** +* kvm_memcrypt_save_reset_vector - locates and saves the reset vector to be +* used as the initial CS/IP value for APs +* if SEV-ES is active. +* +* Return: 1 SEV-ES is active and failed to locate a valid reset vector +* 0 SEV-ES is not active or successfully located and saved the +* reset vector address +*/ +int kvm_memcrypt_save_reset_vector (void *flash_prt,uint64_t flash_size);#ifdef NEED_CPU_H #include "cpu.h"
include/sysemu/sev.h +3 -0
@@ -18,4 +18,7 @@void *sev_guest_init (const char *id);int sev_encrypt_data (void *handle,uint8_t *ptr,uint64_t len); +int sev_es_save_reset_vector (void *handle,void *flash_ptr, +uint64_t flash_size,uint32_t *addr); +#endif
target/i386/kvm.c +2 -0
@@ -1912,6 +1912,8 @@ void kvm_arch_reset_vcpu(X86CPU *cpu) }/* enabled by default */ env->poll_control_msr =1 ; + +kvm_memcrypt_set_reset_vector (CPU (cpu)); }void kvm_arch_do_init_vcpu (X86CPU *cpu)
target/i386/sev.c +51 -0
63 lines not on this page · raw message
Signature · 1 line
2.28.0
PATCH v2 3/4 sev/i386: Don't allow a system reset under an SEV-ES guest
In reply to Tom LendackyFrom: Tom Lendacky <[email protected]>
An SEV-ES guest does not allow register state to be altered once it has been measured. When a SEV-ES guest issues a reboot command, Qemu will reset the vCPU state and resume the guest. This will cause failures under SEV-ES, so prevent that from occurring.
--- accel/kvm/kvm-all.c | 9 +++++++++ include/sysemu/cpus.h | 2 ++ include/sysemu/hw_accel.h | 5 +++++ include/sysemu/kvm.h | 2 ++ softmmu/cpus.c | 5 +++++ softmmu/vl.c | 5 ++++- 6 files changed, 27 insertions(+), 1 deletion(-)
accel/kvm/kvm-all.c +9 -0
@@ -2388,6 +2388,15 @@ void kvm_flush_coalesced_mmio_buffer(void) s->coalesced_flush_in_progress = false; } +bool kvm_cpu_check_resettable (void ) +{ +/* +* If we have a valid reset vector override, then SEV-ES is active +* and the CPU can't be reset. +*/ +return !kvm_state->reset_valid; +} +static void do_kvm_cpu_synchronize_state (CPUState *cpu,run_on_cpu_data arg) {if (!cpu->vcpu_dirty) {
include/sysemu/cpus.h +2 -0
@@ -24,6 +24,8 @@ void dump_drift_info(void);void qemu_cpu_kick_self (void );void qemu_timer_notify_cb (void *opaque,QEMUClockType type); +bool cpu_is_resettable (void ); +void cpu_synchronize_all_states (void );void cpu_synchronize_all_post_reset (void );void cpu_synchronize_all_post_init (void );
include/sysemu/hw_accel.h +5 -0
@@ -17,6 +17,11 @@#include "sysemu/hvf.h" #include "sysemu/whpx.h" +static inline bool cpu_check_resettable (void ) +{ +return kvm_enabled () ?kvm_cpu_check_resettable () : true; +} +static inline void cpu_synchronize_state (CPUState *cpu) {if (kvm_enabled ()) {
include/sysemu/kvm.h +2 -0
@@ -494,6 +494,8 @@ int kvm_physical_memory_addr_from_host(KVMState *s, void *ram_addr,#endif /* NEED_CPU_H */ +bool kvm_cpu_check_resettable (void ); +void kvm_cpu_synchronize_state (CPUState *cpu);void kvm_cpu_synchronize_post_reset (CPUState *cpu);void kvm_cpu_synchronize_post_init (CPUState *cpu);
softmmu/cpus.c +5 -0
@@ -927,6 +927,11 @@ void hw_error(const char *fmt, ...)abort (); } +bool cpu_is_resettable (void ) +{ +return cpu_check_resettable (); +} +void cpu_synchronize_all_states (void ) {CPUState *cpu;
softmmu/vl.c +4 -1
@@ -1475,7 +1475,10 @@ void qemu_system_guest_crashloaded(GuestPanicInformation *info)void qemu_system_reset_request (ShutdownCause reason) { -if (no_reboot && reason !=SHUTDOWN_CAUSE_SUBSYSTEM_RESET ) { +if (!cpu_is_resettable ()) { +error_report ("cpus are not resettable, terminating" ); + shutdown_requested = reason; + }else if (no_reboot && reason !=SHUTDOWN_CAUSE_SUBSYSTEM_RESET ) { shutdown_requested = reason; }else { reset_requested = reason;
Signature · 1 line
2.28.0
PATCH v2 4/4 sev/i386: Enable an SEV-ES guest based on SEV policy
In reply to Tom LendackyFrom: Tom Lendacky <[email protected]>
Update the sev_es_enabled() function return value to be based on the SEV policy that has been specified. SEV-ES is enabled if SEV is enabled and the SEV-ES policy bit is set in the policy object.
--- target/i386/sev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
target/i386/sev.c +3 -1
@@ -70,6 +70,8 @@ struct SevGuestState {#define DEFAULT_GUEST_POLICY 0x1/* disable debug */ #define DEFAULT_SEV_DEVICE "/dev/sev" +#define GUEST_POLICY_SEV_ES_BIT (1 << 2) +/* SEV Information Block GUID = 00f771de-1a7e-4fcb-890e-68c77e2fb44e */ #define SEV_INFO_BLOCK_GUID \ "\xde\x71\xf7\x00\x7e\x1a\xcb\x4f\x89\x0e\x68\xc7\x7e\x2f\xb4\x4e"
@@ -375,7 +377,7 @@ sev_enabled(void)bool sev_es_enabled (void ) { -return false; +return sev_enabled () && (sev_guest->policy &GUEST_POLICY_SEV_ES_BIT ); }uint64_t
Signature · 1 line
2.28.0