diff options
| author | Brijesh Singh <brijesh.singh@amd.com> | 2018-03-08 06:48:49 -0600 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2018-03-13 17:36:00 +0100 |
| commit | b738d6300d84000319d06366d06e1795196c756d (patch) | |
| tree | 469ba8b1dcd112603f0111a6e7de9df54f748f05 | |
| parent | 620fd55c242fb0ada42421b2d252bc5ae5b783cc (diff) | |
sev/i386: add command to encrypt guest memory region
The KVM_SEV_LAUNCH_UPDATE_DATA command is used to encrypt a guest memory
region using the VM Encryption Key created using LAUNCH_START.
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| -rw-r--r-- | target/i386/sev.c | 43 | ||||
| -rw-r--r-- | target/i386/trace-events | 1 |
2 files changed, 44 insertions, 0 deletions
diff --git a/target/i386/sev.c b/target/i386/sev.c index 26f888edf8..2d14879166 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -105,6 +105,13 @@ fw_error_to_str(int code) return sev_fw_errlist[code]; } +static bool +sev_check_state(SevState state) +{ + assert(sev_state); + return sev_state->state == state ? true : false; +} + static void sev_set_guest_state(SevState new_state) { @@ -486,6 +493,29 @@ sev_launch_start(SEVState *s) return 0; } +static int +sev_launch_update_data(uint8_t *addr, uint64_t len) +{ + int ret, fw_error; + struct kvm_sev_launch_update_data update; + + if (!addr || !len) { + return 1; + } + + update.uaddr = (__u64)(unsigned long)addr; + update.len = len; + trace_kvm_sev_launch_update_data(addr, len); + ret = sev_ioctl(sev_state->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA, + &update, &fw_error); + if (ret) { + error_report("%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'", + __func__, ret, fw_error, fw_error_to_str(fw_error)); + } + + return ret; +} + void * sev_guest_init(const char *id) { @@ -571,6 +601,19 @@ err: return NULL; } +int +sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len) +{ + assert(handle); + + /* if SEV is in update state then encrypt the data else do nothing */ + if (sev_check_state(SEV_STATE_LAUNCH_UPDATE)) { + return sev_launch_update_data(ptr, len); + } + + return 0; +} + static void sev_register_types(void) { diff --git a/target/i386/trace-events b/target/i386/trace-events index 3f29c85f32..4aa87ef3ee 100644 --- a/target/i386/trace-events +++ b/target/i386/trace-events @@ -12,3 +12,4 @@ kvm_memcrypt_register_region(void *addr, size_t len) "addr %p len 0x%zu" kvm_memcrypt_unregister_region(void *addr, size_t len) "addr %p len 0x%zu" kvm_sev_change_state(const char *old, const char *new) "%s -> %s" kvm_sev_launch_start(int policy, void *session, void *pdh) "policy 0x%x session %p pdh %p" +kvm_sev_launch_update_data(void *addr, uint64_t len) "addr %p len 0x%" PRIu64 |