target/i386/sev.c

   1 /*
   2  * QEMU SEV support
   3  *
   4  * Copyright Advanced Micro Devices 2016-2018
   5  *
   6  * Author:
   7  *      Brijesh Singh <brijesh.singh@amd.com>
   8  *
   9  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  10  * See the COPYING file in the top-level directory.
  11  *
  12  */
  13
  14 #include "qemu/osdep.h"
  15
  16 #include <linux/kvm.h>
  17 #include <linux/psp-sev.h>
  18
  19 #include <sys/ioctl.h>
  20
  21 #include "qapi/error.h"
  22 #include "qom/object_interfaces.h"
  23 #include "qemu/base64.h"
  24 #include "qemu/module.h"
  25 #include "qemu/uuid.h"
  26 #include "crypto/hash.h"
  27 #include "sysemu/kvm.h"
  28 #include "sev_i386.h"
  29 #include "sysemu/sysemu.h"
  30 #include "sysemu/runstate.h"
  31 #include "trace.h"
  32 #include "migration/blocker.h"
  33 #include "qom/object.h"
  34 #include "monitor/monitor.h"
  35 #include "exec/confidential-guest-support.h"
  36 #include "hw/i386/pc.h"
  37
  38 #define TYPE_SEV_GUEST "sev-guest"
  39 OBJECT_DECLARE_SIMPLE_TYPE(SevGuestState, SEV_GUEST)
  40
  41
  42 /**
  43  * SevGuestState:
  44  *
  45  * The SevGuestState object is used for creating and managing a SEV
  46  * guest.
  47  *
  48  * # $QEMU \
  49  *         -object sev-guest,id=sev0 \
  50  *         -machine ...,memory-encryption=sev0
  51  */
  52 struct SevGuestState {
  53     ConfidentialGuestSupport parent_obj;
  54
  55     /* configuration parameters */
  56     char *sev_device;
  57     uint32_t policy;
  58     char *dh_cert_file;
  59     char *session_file;
  60     uint32_t cbitpos;
  61     uint32_t reduced_phys_bits;
  62
  63     /* runtime state */
  64     uint32_t handle;
  65     uint8_t api_major;
  66     uint8_t api_minor;
  67     uint8_t build_id;
  68     uint64_t me_mask;
  69     int sev_fd;
  70     SevState state;
  71     gchar *measurement;
  72
  73     uint32_t reset_cs;
  74     uint32_t reset_ip;
  75     bool reset_data_valid;
  76 };
  77
  78 #define DEFAULT_GUEST_POLICY    0x1 /* disable debug */
  79 #define DEFAULT_SEV_DEVICE      "/dev/sev"
  80
  81 #define SEV_INFO_BLOCK_GUID     "00f771de-1a7e-4fcb-890e-68c77e2fb44e"
  82 typedef struct __attribute__((__packed__)) SevInfoBlock {
  83     /* SEV-ES Reset Vector Address */
  84     uint32_t reset_addr;
  85 } SevInfoBlock;
  86
  87 #define SEV_HASH_TABLE_RV_GUID  "7255371f-3a3b-4b04-927b-1da6efa8d454"
  88 typedef struct QEMU_PACKED SevHashTableDescriptor {
  89     /* SEV hash table area guest address */
  90     uint32_t base;
  91     /* SEV hash table area size (in bytes) */
  92     uint32_t size;
  93 } SevHashTableDescriptor;
  94
  95 /* hard code sha256 digest size */
  96 #define HASH_SIZE 32
  97
  98 typedef struct QEMU_PACKED SevHashTableEntry {
  99     QemuUUID guid;
 100     uint16_t len;
 101     uint8_t hash[HASH_SIZE];
 102 } SevHashTableEntry;
 103
 104 typedef struct QEMU_PACKED SevHashTable {
 105     QemuUUID guid;
 106     uint16_t len;
 107     SevHashTableEntry cmdline;
 108     SevHashTableEntry initrd;
 109     SevHashTableEntry kernel;
 110     uint8_t padding[];
 111 } SevHashTable;
 112
 113 static SevGuestState *sev_guest;
 114 static Error *sev_mig_blocker;
 115
 116 static const char *const sev_fw_errlist[] = {
 117     [SEV_RET_SUCCESS]                = "",
 118     [SEV_RET_INVALID_PLATFORM_STATE] = "Platform state is invalid",
 119     [SEV_RET_INVALID_GUEST_STATE]    = "Guest state is invalid",
 120     [SEV_RET_INAVLID_CONFIG]         = "Platform configuration is invalid",
 121     [SEV_RET_INVALID_LEN]            = "Buffer too small",
 122     [SEV_RET_ALREADY_OWNED]          = "Platform is already owned",
 123     [SEV_RET_INVALID_CERTIFICATE]    = "Certificate is invalid",
 124     [SEV_RET_POLICY_FAILURE]         = "Policy is not allowed",
 125     [SEV_RET_INACTIVE]               = "Guest is not active",
 126     [SEV_RET_INVALID_ADDRESS]        = "Invalid address",
 127     [SEV_RET_BAD_SIGNATURE]          = "Bad signature",
 128     [SEV_RET_BAD_MEASUREMENT]        = "Bad measurement",
 129     [SEV_RET_ASID_OWNED]             = "ASID is already owned",
 130     [SEV_RET_INVALID_ASID]           = "Invalid ASID",
 131     [SEV_RET_WBINVD_REQUIRED]        = "WBINVD is required",
 132     [SEV_RET_DFFLUSH_REQUIRED]       = "DF_FLUSH is required",
 133     [SEV_RET_INVALID_GUEST]          = "Guest handle is invalid",
 134     [SEV_RET_INVALID_COMMAND]        = "Invalid command",
 135     [SEV_RET_ACTIVE]                 = "Guest is active",
 136     [SEV_RET_HWSEV_RET_PLATFORM]     = "Hardware error",
 137     [SEV_RET_HWSEV_RET_UNSAFE]       = "Hardware unsafe",
 138     [SEV_RET_UNSUPPORTED]            = "Feature not supported",
 139     [SEV_RET_INVALID_PARAM]          = "Invalid parameter",
 140     [SEV_RET_RESOURCE_LIMIT]         = "Required firmware resource depleted",
 141     [SEV_RET_SECURE_DATA_INVALID]    = "Part-specific integrity check failure",
 142 };
 143
 144 #define SEV_FW_MAX_ERROR      ARRAY_SIZE(sev_fw_errlist)
 145
 146 static int
 147 sev_ioctl(int fd, int cmd, void *data, int *error)
 148 {
 149     int r;
 150     struct kvm_sev_cmd input;
 151
 152     memset(&input, 0x0, sizeof(input));
 153
 154     input.id = cmd;
 155     input.sev_fd = fd;
 156     input.data = (__u64)(unsigned long)data;
 157
 158     r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_OP, &input);
 159
 160     if (error) {
 161         *error = input.error;
 162     }
 163
 164     return r;
 165 }
 166
 167 static int
 168 sev_platform_ioctl(int fd, int cmd, void *data, int *error)
 169 {
 170     int r;
 171     struct sev_issue_cmd arg;
 172
 173     arg.cmd = cmd;
 174     arg.data = (unsigned long)data;
 175     r = ioctl(fd, SEV_ISSUE_CMD, &arg);
 176     if (error) {
 177         *error = arg.error;
 178     }
 179
 180     return r;
 181 }
 182
 183 static const char *
 184 fw_error_to_str(int code)
 185 {
 186     if (code < 0 || code >= SEV_FW_MAX_ERROR) {
 187         return "unknown error";
 188     }
 189
 190     return sev_fw_errlist[code];
 191 }
 192
 193 static bool
 194 sev_check_state(const SevGuestState *sev, SevState state)
 195 {
 196     assert(sev);
 197     return sev->state == state ? true : false;
 198 }
 199
 200 static void
 201 sev_set_guest_state(SevGuestState *sev, SevState new_state)
 202 {
 203     assert(new_state < SEV_STATE__MAX);
 204     assert(sev);
 205
 206     trace_kvm_sev_change_state(SevState_str(sev->state),
 207                                SevState_str(new_state));
 208     sev->state = new_state;
 209 }
 210
 211 static void
 212 sev_ram_block_added(RAMBlockNotifier *n, void *host, size_t size,
 213                     size_t max_size)
 214 {
 215     int r;
 216     struct kvm_enc_region range;
 217     ram_addr_t offset;
 218     MemoryRegion *mr;
 219
 220     /*
 221      * The RAM device presents a memory region that should be treated
 222      * as IO region and should not be pinned.
 223      */
 224     mr = memory_region_from_host(host, &offset);
 225     if (mr && memory_region_is_ram_device(mr)) {
 226         return;
 227     }
 228
 229     range.addr = (__u64)(unsigned long)host;
 230     range.size = max_size;
 231
 232     trace_kvm_memcrypt_register_region(host, max_size);
 233     r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_REG_REGION, &range);
 234     if (r) {
 235         error_report("%s: failed to register region (%p+%#zx) error '%s'",
 236                      __func__, host, max_size, strerror(errno));
 237         exit(1);
 238     }
 239 }
 240
 241 static void
 242 sev_ram_block_removed(RAMBlockNotifier *n, void *host, size_t size,
 243                       size_t max_size)
 244 {
 245     int r;
 246     struct kvm_enc_region range;
 247     ram_addr_t offset;
 248     MemoryRegion *mr;
 249
 250     /*
 251      * The RAM device presents a memory region that should be treated
 252      * as IO region and should not have been pinned.
 253      */
 254     mr = memory_region_from_host(host, &offset);
 255     if (mr && memory_region_is_ram_device(mr)) {
 256         return;
 257     }
 258
 259     range.addr = (__u64)(unsigned long)host;
 260     range.size = max_size;
 261
 262     trace_kvm_memcrypt_unregister_region(host, max_size);
 263     r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_UNREG_REGION, &range);
 264     if (r) {
 265         error_report("%s: failed to unregister region (%p+%#zx)",
 266                      __func__, host, max_size);
 267     }
 268 }
 269
 270 static struct RAMBlockNotifier sev_ram_notifier = {
 271     .ram_block_added = sev_ram_block_added,
 272     .ram_block_removed = sev_ram_block_removed,
 273 };
 274
 275 static void
 276 sev_guest_finalize(Object *obj)
 277 {
 278 }
 279
 280 static char *
 281 sev_guest_get_session_file(Object *obj, Error **errp)
 282 {
 283     SevGuestState *s = SEV_GUEST(obj);
 284
 285     return s->session_file ? g_strdup(s->session_file) : NULL;
 286 }
 287
 288 static void
 289 sev_guest_set_session_file(Object *obj, const char *value, Error **errp)
 290 {
 291     SevGuestState *s = SEV_GUEST(obj);
 292
 293     s->session_file = g_strdup(value);
 294 }
 295
 296 static char *
 297 sev_guest_get_dh_cert_file(Object *obj, Error **errp)
 298 {
 299     SevGuestState *s = SEV_GUEST(obj);
 300
 301     return g_strdup(s->dh_cert_file);
 302 }
 303
 304 static void
 305 sev_guest_set_dh_cert_file(Object *obj, const char *value, Error **errp)
 306 {
 307     SevGuestState *s = SEV_GUEST(obj);
 308
 309     s->dh_cert_file = g_strdup(value);
 310 }
 311
 312 static char *
 313 sev_guest_get_sev_device(Object *obj, Error **errp)
 314 {
 315     SevGuestState *sev = SEV_GUEST(obj);
 316
 317     return g_strdup(sev->sev_device);
 318 }
 319
 320 static void
 321 sev_guest_set_sev_device(Object *obj, const char *value, Error **errp)
 322 {
 323     SevGuestState *sev = SEV_GUEST(obj);
 324
 325     sev->sev_device = g_strdup(value);
 326 }
 327
 328 static void
 329 sev_guest_class_init(ObjectClass *oc, void *data)
 330 {
 331     object_class_property_add_str(oc, "sev-device",
 332                                   sev_guest_get_sev_device,
 333                                   sev_guest_set_sev_device);
 334     object_class_property_set_description(oc, "sev-device",
 335             "SEV device to use");
 336     object_class_property_add_str(oc, "dh-cert-file",
 337                                   sev_guest_get_dh_cert_file,
 338                                   sev_guest_set_dh_cert_file);
 339     object_class_property_set_description(oc, "dh-cert-file",
 340             "guest owners DH certificate (encoded with base64)");
 341     object_class_property_add_str(oc, "session-file",
 342                                   sev_guest_get_session_file,
 343                                   sev_guest_set_session_file);
 344     object_class_property_set_description(oc, "session-file",
 345             "guest owners session parameters (encoded with base64)");
 346 }
 347
 348 static void
 349 sev_guest_instance_init(Object *obj)
 350 {
 351     SevGuestState *sev = SEV_GUEST(obj);
 352
 353     sev->sev_device = g_strdup(DEFAULT_SEV_DEVICE);
 354     sev->policy = DEFAULT_GUEST_POLICY;
 355     object_property_add_uint32_ptr(obj, "policy", &sev->policy,
 356                                    OBJ_PROP_FLAG_READWRITE);
 357     object_property_add_uint32_ptr(obj, "handle", &sev->handle,
 358                                    OBJ_PROP_FLAG_READWRITE);
 359     object_property_add_uint32_ptr(obj, "cbitpos", &sev->cbitpos,
 360                                    OBJ_PROP_FLAG_READWRITE);
 361     object_property_add_uint32_ptr(obj, "reduced-phys-bits",
 362                                    &sev->reduced_phys_bits,
 363                                    OBJ_PROP_FLAG_READWRITE);
 364 }
 365
 366 /* sev guest info */
 367 static const TypeInfo sev_guest_info = {
 368     .parent = TYPE_CONFIDENTIAL_GUEST_SUPPORT,
 369     .name = TYPE_SEV_GUEST,
 370     .instance_size = sizeof(SevGuestState),
 371     .instance_finalize = sev_guest_finalize,
 372     .class_init = sev_guest_class_init,
 373     .instance_init = sev_guest_instance_init,
 374     .interfaces = (InterfaceInfo[]) {
 375         { TYPE_USER_CREATABLE },
 376         { }
 377     }
 378 };
 379
 380 bool
 381 sev_enabled(void)
 382 {
 383     return !!sev_guest;
 384 }
 385
 386 bool
 387 sev_es_enabled(void)
 388 {
 389     return sev_enabled() && (sev_guest->policy & SEV_POLICY_ES);
 390 }
 391
 392 uint64_t
 393 sev_get_me_mask(void)
 394 {
 395     return sev_guest ? sev_guest->me_mask : ~0;
 396 }
 397
 398 uint32_t
 399 sev_get_cbit_position(void)
 400 {
 401     return sev_guest ? sev_guest->cbitpos : 0;
 402 }
 403
 404 uint32_t
 405 sev_get_reduced_phys_bits(void)
 406 {
 407     return sev_guest ? sev_guest->reduced_phys_bits : 0;
 408 }
 409
 410 SevInfo *
 411 sev_get_info(void)
 412 {
 413     SevInfo *info;
 414
 415     info = g_new0(SevInfo, 1);
 416     info->enabled = sev_enabled();
 417
 418     if (info->enabled) {
 419         info->api_major = sev_guest->api_major;
 420         info->api_minor = sev_guest->api_minor;
 421         info->build_id = sev_guest->build_id;
 422         info->policy = sev_guest->policy;
 423         info->state = sev_guest->state;
 424         info->handle = sev_guest->handle;
 425     }
 426
 427     return info;
 428 }
 429
 430 static int
 431 sev_get_pdh_info(int fd, guchar **pdh, size_t *pdh_len, guchar **cert_chain,
 432                  size_t *cert_chain_len, Error **errp)
 433 {
 434     guchar *pdh_data = NULL;
 435     guchar *cert_chain_data = NULL;
 436     struct sev_user_data_pdh_cert_export export = {};
 437     int err, r;
 438
 439     /* query the certificate length */
 440     r = sev_platform_ioctl(fd, SEV_PDH_CERT_EXPORT, &export, &err);
 441     if (r < 0) {
 442         if (err != SEV_RET_INVALID_LEN) {
 443             error_setg(errp, "failed to export PDH cert ret=%d fw_err=%d (%s)",
 444                        r, err, fw_error_to_str(err));
 445             return 1;
 446         }
 447     }
 448
 449     pdh_data = g_new(guchar, export.pdh_cert_len);
 450     cert_chain_data = g_new(guchar, export.cert_chain_len);
 451     export.pdh_cert_address = (unsigned long)pdh_data;
 452     export.cert_chain_address = (unsigned long)cert_chain_data;
 453
 454     r = sev_platform_ioctl(fd, SEV_PDH_CERT_EXPORT, &export, &err);
 455     if (r < 0) {
 456         error_setg(errp, "failed to export PDH cert ret=%d fw_err=%d (%s)",
 457                    r, err, fw_error_to_str(err));
 458         goto e_free;
 459     }
 460
 461     *pdh = pdh_data;
 462     *pdh_len = export.pdh_cert_len;
 463     *cert_chain = cert_chain_data;
 464     *cert_chain_len = export.cert_chain_len;
 465     return 0;
 466
 467 e_free:
 468     g_free(pdh_data);
 469     g_free(cert_chain_data);
 470     return 1;
 471 }
 472
 473 SevCapability *
 474 sev_get_capabilities(Error **errp)
 475 {
 476     SevCapability *cap = NULL;
 477     guchar *pdh_data = NULL;
 478     guchar *cert_chain_data = NULL;
 479     size_t pdh_len = 0, cert_chain_len = 0;
 480     uint32_t ebx;
 481     int fd;
 482
 483     if (!kvm_enabled()) {
 484         error_setg(errp, "KVM not enabled");
 485         return NULL;
 486     }
 487     if (kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_OP, NULL) < 0) {
 488         error_setg(errp, "SEV is not enabled in KVM");
 489         return NULL;
 490     }
 491
 492     fd = open(DEFAULT_SEV_DEVICE, O_RDWR);
 493     if (fd < 0) {
 494         error_setg_errno(errp, errno, "Failed to open %s",
 495                          DEFAULT_SEV_DEVICE);
 496         return NULL;
 497     }
 498
 499     if (sev_get_pdh_info(fd, &pdh_data, &pdh_len,
 500                          &cert_chain_data, &cert_chain_len, errp)) {
 501         goto out;
 502     }
 503
 504     cap = g_new0(SevCapability, 1);
 505     cap->pdh = g_base64_encode(pdh_data, pdh_len);
 506     cap->cert_chain = g_base64_encode(cert_chain_data, cert_chain_len);
 507
 508     host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL);
 509     cap->cbitpos = ebx & 0x3f;
 510
 511     /*
 512      * When SEV feature is enabled, we loose one bit in guest physical
 513      * addressing.
 514      */
 515     cap->reduced_phys_bits = 1;
 516
 517 out:
 518     g_free(pdh_data);
 519     g_free(cert_chain_data);
 520     close(fd);
 521     return cap;
 522 }
 523
 524 SevAttestationReport *
 525 sev_get_attestation_report(const char *mnonce, Error **errp)
 526 {
 527     struct kvm_sev_attestation_report input = {};
 528     SevAttestationReport *report = NULL;
 529     SevGuestState *sev = sev_guest;
 530     guchar *data;
 531     guchar *buf;
 532     gsize len;
 533     int err = 0, ret;
 534
 535     if (!sev_enabled()) {
 536         error_setg(errp, "SEV is not enabled");
 537         return NULL;
 538     }
 539
 540     /* lets decode the mnonce string */
 541     buf = g_base64_decode(mnonce, &len);
 542     if (!buf) {
 543         error_setg(errp, "SEV: failed to decode mnonce input");
 544         return NULL;
 545     }
 546
 547     /* verify the input mnonce length */
 548     if (len != sizeof(input.mnonce)) {
 549         error_setg(errp, "SEV: mnonce must be %zu bytes (got %" G_GSIZE_FORMAT ")",
 550                 sizeof(input.mnonce), len);
 551         g_free(buf);
 552         return NULL;
 553     }
 554
 555     /* Query the report length */
 556     ret = sev_ioctl(sev->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT,
 557             &input, &err);
 558     if (ret < 0) {
 559         if (err != SEV_RET_INVALID_LEN) {
 560             error_setg(errp, "failed to query the attestation report length "
 561                     "ret=%d fw_err=%d (%s)", ret, err, fw_error_to_str(err));
 562             g_free(buf);
 563             return NULL;
 564         }
 565     }
 566
 567     data = g_malloc(input.len);
 568     input.uaddr = (unsigned long)data;
 569     memcpy(input.mnonce, buf, sizeof(input.mnonce));
 570
 571     /* Query the report */
 572     ret = sev_ioctl(sev->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT,
 573             &input, &err);
 574     if (ret) {
 575         error_setg_errno(errp, errno, "Failed to get attestation report"
 576                 " ret=%d fw_err=%d (%s)", ret, err, fw_error_to_str(err));
 577         goto e_free_data;
 578     }
 579
 580     report = g_new0(SevAttestationReport, 1);
 581     report->data = g_base64_encode(data, input.len);
 582
 583     trace_kvm_sev_attestation_report(mnonce, report->data);
 584
 585 e_free_data:
 586     g_free(data);
 587     g_free(buf);
 588     return report;
 589 }
 590
 591 static int
 592 sev_read_file_base64(const char *filename, guchar **data, gsize *len)
 593 {
 594     gsize sz;
 595     g_autofree gchar *base64 = NULL;
 596     GError *error = NULL;
 597
 598     if (!g_file_get_contents(filename, &base64, &sz, &error)) {
 599         error_report("failed to read '%s' (%s)", filename, error->message);
 600         g_error_free(error);
 601         return -1;
 602     }
 603
 604     *data = g_base64_decode(base64, len);
 605     return 0;
 606 }
 607
 608 static int
 609 sev_launch_start(SevGuestState *sev)
 610 {
 611     gsize sz;
 612     int ret = 1;
 613     int fw_error, rc;
 614     struct kvm_sev_launch_start *start;
 615     guchar *session = NULL, *dh_cert = NULL;
 616
 617     start = g_new0(struct kvm_sev_launch_start, 1);
 618
 619     start->handle = sev->handle;
 620     start->policy = sev->policy;
 621     if (sev->session_file) {
 622         if (sev_read_file_base64(sev->session_file, &session, &sz) < 0) {
 623             goto out;
 624         }
 625         start->session_uaddr = (unsigned long)session;
 626         start->session_len = sz;
 627     }
 628
 629     if (sev->dh_cert_file) {
 630         if (sev_read_file_base64(sev->dh_cert_file, &dh_cert, &sz) < 0) {
 631             goto out;
 632         }
 633         start->dh_uaddr = (unsigned long)dh_cert;
 634         start->dh_len = sz;
 635     }
 636
 637     trace_kvm_sev_launch_start(start->policy, session, dh_cert);
 638     rc = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_START, start, &fw_error);
 639     if (rc < 0) {
 640         error_report("%s: LAUNCH_START ret=%d fw_error=%d '%s'",
 641                 __func__, ret, fw_error, fw_error_to_str(fw_error));
 642         goto out;
 643     }
 644
 645     sev_set_guest_state(sev, SEV_STATE_LAUNCH_UPDATE);
 646     sev->handle = start->handle;
 647     ret = 0;
 648
 649 out:
 650     g_free(start);
 651     g_free(session);
 652     g_free(dh_cert);
 653     return ret;
 654 }
 655
 656 static int
 657 sev_launch_update_data(SevGuestState *sev, uint8_t *addr, uint64_t len)
 658 {
 659     int ret, fw_error;
 660     struct kvm_sev_launch_update_data update;
 661
 662     if (!addr || !len) {
 663         return 1;
 664     }
 665
 666     update.uaddr = (__u64)(unsigned long)addr;
 667     update.len = len;
 668     trace_kvm_sev_launch_update_data(addr, len);
 669     ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA,
 670                     &update, &fw_error);
 671     if (ret) {
 672         error_report("%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'",
 673                 __func__, ret, fw_error, fw_error_to_str(fw_error));
 674     }
 675
 676     return ret;
 677 }
 678
 679 static int
 680 sev_launch_update_vmsa(SevGuestState *sev)
 681 {
 682     int ret, fw_error;
 683
 684     ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_UPDATE_VMSA, NULL, &fw_error);
 685     if (ret) {
 686         error_report("%s: LAUNCH_UPDATE_VMSA ret=%d fw_error=%d '%s'",
 687                 __func__, ret, fw_error, fw_error_to_str(fw_error));
 688     }
 689
 690     return ret;
 691 }
 692
 693 static void
 694 sev_launch_get_measure(Notifier *notifier, void *unused)
 695 {
 696     SevGuestState *sev = sev_guest;
 697     int ret, error;
 698     guchar *data;
 699     struct kvm_sev_launch_measure *measurement;
 700
 701     if (!sev_check_state(sev, SEV_STATE_LAUNCH_UPDATE)) {
 702         return;
 703     }
 704
 705     if (sev_es_enabled()) {
 706         /* measure all the VM save areas before getting launch_measure */
 707         ret = sev_launch_update_vmsa(sev);
 708         if (ret) {
 709             exit(1);
 710         }
 711     }
 712
 713     measurement = g_new0(struct kvm_sev_launch_measure, 1);
 714
 715     /* query the measurement blob length */
 716     ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_MEASURE,
 717                     measurement, &error);
 718     if (!measurement->len) {
 719         error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'",
 720                      __func__, ret, error, fw_error_to_str(errno));
 721         goto free_measurement;
 722     }
 723
 724     data = g_new0(guchar, measurement->len);
 725     measurement->uaddr = (unsigned long)data;
 726
 727     /* get the measurement blob */
 728     ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_MEASURE,
 729                     measurement, &error);
 730     if (ret) {
 731         error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'",
 732                      __func__, ret, error, fw_error_to_str(errno));
 733         goto free_data;
 734     }
 735
 736     sev_set_guest_state(sev, SEV_STATE_LAUNCH_SECRET);
 737
 738     /* encode the measurement value and emit the event */
 739     sev->measurement = g_base64_encode(data, measurement->len);
 740     trace_kvm_sev_launch_measurement(sev->measurement);
 741
 742 free_data:
 743     g_free(data);
 744 free_measurement:
 745     g_free(measurement);
 746 }
 747
 748 char *
 749 sev_get_launch_measurement(void)
 750 {
 751     if (sev_guest &&
 752         sev_guest->state >= SEV_STATE_LAUNCH_SECRET) {
 753         return g_strdup(sev_guest->measurement);
 754     }
 755
 756     return NULL;
 757 }
 758
 759 static Notifier sev_machine_done_notify = {
 760     .notify = sev_launch_get_measure,
 761 };
 762
 763 static void
 764 sev_launch_finish(SevGuestState *sev)
 765 {
 766     int ret, error;
 767
 768     trace_kvm_sev_launch_finish();
 769     ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_FINISH, 0, &error);
 770     if (ret) {
 771         error_report("%s: LAUNCH_FINISH ret=%d fw_error=%d '%s'",
 772                      __func__, ret, error, fw_error_to_str(error));
 773         exit(1);
 774     }
 775
 776     sev_set_guest_state(sev, SEV_STATE_RUNNING);
 777
 778     /* add migration blocker */
 779     error_setg(&sev_mig_blocker,
 780                "SEV: Migration is not implemented");
 781     migrate_add_blocker(sev_mig_blocker, &error_fatal);
 782 }
 783
 784 static void
 785 sev_vm_state_change(void *opaque, bool running, RunState state)
 786 {
 787     SevGuestState *sev = opaque;
 788
 789     if (running) {
 790         if (!sev_check_state(sev, SEV_STATE_RUNNING)) {
 791             sev_launch_finish(sev);
 792         }
 793     }
 794 }
 795
 796 int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
 797 {
 798     SevGuestState *sev
 799         = (SevGuestState *)object_dynamic_cast(OBJECT(cgs), TYPE_SEV_GUEST);
 800     char *devname;
 801     int ret, fw_error, cmd;
 802     uint32_t ebx;
 803     uint32_t host_cbitpos;
 804     struct sev_user_data_status status = {};
 805
 806     if (!sev) {
 807         return 0;
 808     }
 809
 810     ret = ram_block_discard_disable(true);
 811     if (ret) {
 812         error_report("%s: cannot disable RAM discard", __func__);
 813         return -1;
 814     }
 815
 816     sev_guest = sev;
 817     sev->state = SEV_STATE_UNINIT;
 818
 819     host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL);
 820     host_cbitpos = ebx & 0x3f;
 821
 822     if (host_cbitpos != sev->cbitpos) {
 823         error_setg(errp, "%s: cbitpos check failed, host '%d' requested '%d'",
 824                    __func__, host_cbitpos, sev->cbitpos);
 825         goto err;
 826     }
 827
 828     if (sev->reduced_phys_bits < 1) {
 829         error_setg(errp, "%s: reduced_phys_bits check failed, it should be >=1,"
 830                    " requested '%d'", __func__, sev->reduced_phys_bits);
 831         goto err;
 832     }
 833
 834     sev->me_mask = ~(1UL << sev->cbitpos);
 835
 836     devname = object_property_get_str(OBJECT(sev), "sev-device", NULL);
 837     sev->sev_fd = open(devname, O_RDWR);
 838     if (sev->sev_fd < 0) {
 839         error_setg(errp, "%s: Failed to open %s '%s'", __func__,
 840                    devname, strerror(errno));
 841         g_free(devname);
 842         goto err;
 843     }
 844     g_free(devname);
 845
 846     ret = sev_platform_ioctl(sev->sev_fd, SEV_PLATFORM_STATUS, &status,
 847                              &fw_error);
 848     if (ret) {
 849         error_setg(errp, "%s: failed to get platform status ret=%d "
 850                    "fw_error='%d: %s'", __func__, ret, fw_error,
 851                    fw_error_to_str(fw_error));
 852         goto err;
 853     }
 854     sev->build_id = status.build;
 855     sev->api_major = status.api_major;
 856     sev->api_minor = status.api_minor;
 857
 858     if (sev_es_enabled()) {
 859         if (!kvm_kernel_irqchip_allowed()) {
 860             error_report("%s: SEV-ES guests require in-kernel irqchip support",
 861                          __func__);
 862             goto err;
 863         }
 864
 865         if (!(status.flags & SEV_STATUS_FLAGS_CONFIG_ES)) {
 866             error_report("%s: guest policy requires SEV-ES, but "
 867                          "host SEV-ES support unavailable",
 868                          __func__);
 869             goto err;
 870         }
 871         cmd = KVM_SEV_ES_INIT;
 872     } else {
 873         cmd = KVM_SEV_INIT;
 874     }
 875
 876     trace_kvm_sev_init();
 877     ret = sev_ioctl(sev->sev_fd, cmd, NULL, &fw_error);
 878     if (ret) {
 879         error_setg(errp, "%s: failed to initialize ret=%d fw_error=%d '%s'",
 880                    __func__, ret, fw_error, fw_error_to_str(fw_error));
 881         goto err;
 882     }
 883
 884     ret = sev_launch_start(sev);
 885     if (ret) {
 886         error_setg(errp, "%s: failed to create encryption context", __func__);
 887         goto err;
 888     }
 889
 890     ram_block_notifier_add(&sev_ram_notifier);
 891     qemu_add_machine_init_done_notifier(&sev_machine_done_notify);
 892     qemu_add_vm_change_state_handler(sev_vm_state_change, sev);
 893
 894     cgs->ready = true;
 895
 896     return 0;
 897 err:
 898     sev_guest = NULL;
 899     ram_block_discard_disable(false);
 900     return -1;
 901 }
 902
 903 int
 904 sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp)
 905 {
 906     if (!sev_guest) {
 907         return 0;
 908     }
 909
 910     /* if SEV is in update state then encrypt the data else do nothing */
 911     if (sev_check_state(sev_guest, SEV_STATE_LAUNCH_UPDATE)) {
 912         int ret = sev_launch_update_data(sev_guest, ptr, len);
 913         if (ret < 0) {
 914             error_setg(errp, "failed to encrypt pflash rom");
 915             return ret;
 916         }
 917     }
 918
 919     return 0;
 920 }
 921
 922 int sev_inject_launch_secret(const char *packet_hdr, const char *secret,
 923                              uint64_t gpa, Error **errp)
 924 {
 925     struct kvm_sev_launch_secret input;
 926     g_autofree guchar *data = NULL, *hdr = NULL;
 927     int error, ret = 1;
 928     void *hva;
 929     gsize hdr_sz = 0, data_sz = 0;
 930     MemoryRegion *mr = NULL;
 931
 932     if (!sev_guest) {
 933         error_setg(errp, "SEV: SEV not enabled.");
 934         return 1;
 935     }
 936
 937     /* secret can be injected only in this state */
 938     if (!sev_check_state(sev_guest, SEV_STATE_LAUNCH_SECRET)) {
 939         error_setg(errp, "SEV: Not in correct state. (LSECRET) %x",
 940                      sev_guest->state);
 941         return 1;
 942     }
 943
 944     hdr = g_base64_decode(packet_hdr, &hdr_sz);
 945     if (!hdr || !hdr_sz) {
 946         error_setg(errp, "SEV: Failed to decode sequence header");
 947         return 1;
 948     }
 949
 950     data = g_base64_decode(secret, &data_sz);
 951     if (!data || !data_sz) {
 952         error_setg(errp, "SEV: Failed to decode data");
 953         return 1;
 954     }
 955
 956     hva = gpa2hva(&mr, gpa, data_sz, errp);
 957     if (!hva) {
 958         error_prepend(errp, "SEV: Failed to calculate guest address: ");
 959         return 1;
 960     }
 961
 962     input.hdr_uaddr = (uint64_t)(unsigned long)hdr;
 963     input.hdr_len = hdr_sz;
 964
 965     input.trans_uaddr = (uint64_t)(unsigned long)data;
 966     input.trans_len = data_sz;
 967
 968     input.guest_uaddr = (uint64_t)(unsigned long)hva;
 969     input.guest_len = data_sz;
 970
 971     trace_kvm_sev_launch_secret(gpa, input.guest_uaddr,
 972                                 input.trans_uaddr, input.trans_len);
 973
 974     ret = sev_ioctl(sev_guest->sev_fd, KVM_SEV_LAUNCH_SECRET,
 975                     &input, &error);
 976     if (ret) {
 977         error_setg(errp, "SEV: failed to inject secret ret=%d fw_error=%d '%s'",
 978                      ret, error, fw_error_to_str(error));
 979         return ret;
 980     }
 981
 982     return 0;
 983 }
 984
 985 static int
 986 sev_es_parse_reset_block(SevInfoBlock *info, uint32_t *addr)
 987 {
 988     if (!info->reset_addr) {
 989         error_report("SEV-ES reset address is zero");
 990         return 1;
 991     }
 992
 993     *addr = info->reset_addr;
 994
 995     return 0;
 996 }
 997
 998 static int
 999 sev_es_find_reset_vector(void *flash_ptr, uint64_t flash_size,
1000                          uint32_t *addr)
1001 {
1002     QemuUUID info_guid, *guid;
1003     SevInfoBlock *info;
1004     uint8_t *data;
1005     uint16_t *len;
1006
1007     /*
1008      * Initialize the address to zero. An address of zero with a successful
1009      * return code indicates that SEV-ES is not active.
1010      */
1011     *addr = 0;
1012
1013     /*
1014      * Extract the AP reset vector for SEV-ES guests by locating the SEV GUID.
1015      * The SEV GUID is located on its own (original implementation) or within
1016      * the Firmware GUID Table (new implementation), either of which are
1017      * located 32 bytes from the end of the flash.
1018      *
1019      * Check the Firmware GUID Table first.
1020      */
1021     if (pc_system_ovmf_table_find(SEV_INFO_BLOCK_GUID, &data, NULL)) {
1022         return sev_es_parse_reset_block((SevInfoBlock *)data, addr);
1023     }
1024
1025     /*
1026      * SEV info block not found in the Firmware GUID Table (or there isn't
1027      * a Firmware GUID Table), fall back to the original implementation.
1028      */
1029     data = flash_ptr + flash_size - 0x20;
1030
1031     qemu_uuid_parse(SEV_INFO_BLOCK_GUID, &info_guid);
1032     info_guid = qemu_uuid_bswap(info_guid); /* GUIDs are LE */
1033
1034     guid = (QemuUUID *)(data - sizeof(info_guid));
1035     if (!qemu_uuid_is_equal(guid, &info_guid)) {
1036         error_report("SEV information block/Firmware GUID Table block not found in pflash rom");
1037         return 1;
1038     }
1039
1040     len = (uint16_t *)((uint8_t *)guid - sizeof(*len));
1041     info = (SevInfoBlock *)(data - le16_to_cpu(*len));
1042
1043     return sev_es_parse_reset_block(info, addr);
1044 }
1045
1046 void sev_es_set_reset_vector(CPUState *cpu)
1047 {
1048     X86CPU *x86;
1049     CPUX86State *env;
1050
1051     /* Only update if we have valid reset information */
1052     if (!sev_guest || !sev_guest->reset_data_valid) {
1053         return;
1054     }
1055
1056     /* Do not update the BSP reset state */
1057     if (cpu->cpu_index == 0) {
1058         return;
1059     }
1060
1061     x86 = X86_CPU(cpu);
1062     env = &x86->env;
1063
1064     cpu_x86_load_seg_cache(env, R_CS, 0xf000, sev_guest->reset_cs, 0xffff,
1065                            DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK |
1066                            DESC_R_MASK | DESC_A_MASK);
1067
1068     env->eip = sev_guest->reset_ip;
1069 }
1070
1071 int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size)
1072 {
1073     CPUState *cpu;
1074     uint32_t addr;
1075     int ret;
1076
1077     if (!sev_es_enabled()) {
1078         return 0;
1079     }
1080
1081     addr = 0;
1082     ret = sev_es_find_reset_vector(flash_ptr, flash_size,
1083                                    &addr);
1084     if (ret) {
1085         return ret;
1086     }
1087
1088     if (addr) {
1089         sev_guest->reset_cs = addr & 0xffff0000;
1090         sev_guest->reset_ip = addr & 0x0000ffff;
1091         sev_guest->reset_data_valid = true;
1092
1093         CPU_FOREACH(cpu) {
1094             sev_es_set_reset_vector(cpu);
1095         }
1096     }
1097
1098     return 0;
1099 }
1100
1101 static const QemuUUID sev_hash_table_header_guid = {
1102     .data = UUID_LE(0x9438d606, 0x4f22, 0x4cc9, 0xb4, 0x79, 0xa7, 0x93,
1103                     0xd4, 0x11, 0xfd, 0x21)
1104 };
1105
1106 static const QemuUUID sev_kernel_entry_guid = {
1107     .data = UUID_LE(0x4de79437, 0xabd2, 0x427f, 0xb8, 0x35, 0xd5, 0xb1,
1108                     0x72, 0xd2, 0x04, 0x5b)
1109 };
1110 static const QemuUUID sev_initrd_entry_guid = {
1111     .data = UUID_LE(0x44baf731, 0x3a2f, 0x4bd7, 0x9a, 0xf1, 0x41, 0xe2,
1112                     0x91, 0x69, 0x78, 0x1d)
1113 };
1114 static const QemuUUID sev_cmdline_entry_guid = {
1115     .data = UUID_LE(0x97d02dd8, 0xbd20, 0x4c94, 0xaa, 0x78, 0xe7, 0x71,
1116                     0x4d, 0x36, 0xab, 0x2a)
1117 };
1118
1119 /*
1120  * Add the hashes of the linux kernel/initrd/cmdline to an encrypted guest page
1121  * which is included in SEV's initial memory measurement.
1122  */
1123 bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
1124 {
1125     uint8_t *data;
1126     SevHashTableDescriptor *area;
1127     SevHashTable *ht;
1128     uint8_t cmdline_hash[HASH_SIZE];
1129     uint8_t initrd_hash[HASH_SIZE];
1130     uint8_t kernel_hash[HASH_SIZE];
1131     uint8_t *hashp;
1132     size_t hash_len = HASH_SIZE;
1133     int aligned_len;
1134
1135     if (!pc_system_ovmf_table_find(SEV_HASH_TABLE_RV_GUID, &data, NULL)) {
1136         error_setg(errp, "SEV: kernel specified but OVMF has no hash table guid");
1137         return false;
1138     }
1139     area = (SevHashTableDescriptor *)data;
1140
1141     /*
1142      * Calculate hash of kernel command-line with the terminating null byte. If
1143      * the user doesn't supply a command-line via -append, the 1-byte "\0" will
1144      * be used.
1145      */
1146     hashp = cmdline_hash;
1147     if (qcrypto_hash_bytes(QCRYPTO_HASH_ALG_SHA256, ctx->cmdline_data,
1148                            ctx->cmdline_size, &hashp, &hash_len, errp) < 0) {
1149         return false;
1150     }
1151     assert(hash_len == HASH_SIZE);
1152
1153     /*
1154      * Calculate hash of initrd. If the user doesn't supply an initrd via
1155      * -initrd, an empty buffer will be used (ctx->initrd_size == 0).
1156      */
1157     hashp = initrd_hash;
1158     if (qcrypto_hash_bytes(QCRYPTO_HASH_ALG_SHA256, ctx->initrd_data,
1159                            ctx->initrd_size, &hashp, &hash_len, errp) < 0) {
1160         return false;
1161     }
1162     assert(hash_len == HASH_SIZE);
1163
1164     /* Calculate hash of the kernel */
1165     hashp = kernel_hash;
1166     struct iovec iov[2] = {
1167         { .iov_base = ctx->setup_data, .iov_len = ctx->setup_size },
1168         { .iov_base = ctx->kernel_data, .iov_len = ctx->kernel_size }
1169     };
1170     if (qcrypto_hash_bytesv(QCRYPTO_HASH_ALG_SHA256, iov, ARRAY_SIZE(iov),
1171                             &hashp, &hash_len, errp) < 0) {
1172         return false;
1173     }
1174     assert(hash_len == HASH_SIZE);
1175
1176     /*
1177      * Populate the hashes table in the guest's memory at the OVMF-designated
1178      * area for the SEV hashes table
1179      */
1180     ht = qemu_map_ram_ptr(NULL, area->base);
1181
1182     ht->guid = sev_hash_table_header_guid;
1183     ht->len = sizeof(*ht);
1184
1185     ht->cmdline.guid = sev_cmdline_entry_guid;
1186     ht->cmdline.len = sizeof(ht->cmdline);
1187     memcpy(ht->cmdline.hash, cmdline_hash, sizeof(ht->cmdline.hash));
1188
1189     ht->initrd.guid = sev_initrd_entry_guid;
1190     ht->initrd.len = sizeof(ht->initrd);
1191     memcpy(ht->initrd.hash, initrd_hash, sizeof(ht->initrd.hash));
1192
1193     ht->kernel.guid = sev_kernel_entry_guid;
1194     ht->kernel.len = sizeof(ht->kernel);
1195     memcpy(ht->kernel.hash, kernel_hash, sizeof(ht->kernel.hash));
1196
1197     /* When calling sev_encrypt_flash, the length has to be 16 byte aligned */
1198     aligned_len = ROUND_UP(ht->len, 16);
1199     if (aligned_len != ht->len) {
1200         /* zero the excess data so the measurement can be reliably calculated */
1201         memset(ht->padding, 0, aligned_len - ht->len);
1202     }
1203
1204     if (sev_encrypt_flash((uint8_t *)ht, aligned_len, errp) < 0) {
1205         return false;
1206     }
1207
1208     return true;
1209 }
1210
1211 static void
1212 sev_register_types(void)
1213 {
1214     type_register_static(&sev_guest_info);
1215 }
1216
1217 type_init(sev_register_types);