Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 59414c98 authored by Brijesh Singh's avatar Brijesh Singh
Browse files

KVM: SVM: Add support for KVM_SEV_LAUNCH_START command 



The KVM_SEV_LAUNCH_START command is used to create a memory encryption
context within the SEV firmware. In order to do so, the guest owner
should provide the guest's policy, its public Diffie-Hellman (PDH) key
and session information. The command implements the LAUNCH_START flow
defined in SEV spec Section 6.2.

Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: "Radim Krčmář" <rkrcmar@redhat.com>
Cc: Joerg Roedel <joro@8bytes.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: x86@kernel.org
Cc: kvm@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Improvements-by: default avatarBorislav Petkov <bp@suse.de>
Signed-off-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
parent 70cd94e6

arch/x86/include/asm/kvm_host.h

+2 −0
Original line number Diff line number Diff line
@@ -750,6 +750,8 @@ enum kvm_irqchip_mode { 
struct kvm_sev_info {

	bool active;		/* SEV enabled guest */

	unsigned int asid;	/* ASID used for this guest */

	unsigned int handle;	/* SEV firmware handle */

	int fd;			/* SEV device fd */

};



struct kvm_arch {

arch/x86/kvm/svm.c

+153 −0
Original line number Diff line number Diff line
@@ -1538,11 +1538,45 @@ static void sev_asid_free(struct kvm *kvm) 
	__sev_asid_free(sev->asid);

}



static void sev_unbind_asid(struct kvm *kvm, unsigned int handle)

{

	struct sev_data_decommission *decommission;

	struct sev_data_deactivate *data;



	if (!handle)

		return;



	data = kzalloc(sizeof(*data), GFP_KERNEL);

	if (!data)

		return;



	/* deactivate handle */

	data->handle = handle;

	sev_guest_deactivate(data, NULL);



	wbinvd_on_all_cpus();

	sev_guest_df_flush(NULL);

	kfree(data);



	decommission = kzalloc(sizeof(*decommission), GFP_KERNEL);

	if (!decommission)

		return;



	/* decommission handle */

	decommission->handle = handle;

	sev_guest_decommission(decommission, NULL);



	kfree(decommission);

}



static void sev_vm_destroy(struct kvm *kvm)

{

	struct kvm_sev_info *sev = &kvm->arch.sev_info;



	if (!sev_guest(kvm))

		return;



	sev_unbind_asid(kvm, sev->handle);

	sev_asid_free(kvm);

}
@@ -5708,6 +5742,122 @@ static int sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp) 
	return ret;

}



static int sev_bind_asid(struct kvm *kvm, unsigned int handle, int *error)

{

	struct sev_data_activate *data;

	int asid = sev_get_asid(kvm);

	int ret;



	wbinvd_on_all_cpus();



	ret = sev_guest_df_flush(error);

	if (ret)

		return ret;



	data = kzalloc(sizeof(*data), GFP_KERNEL);

	if (!data)

		return -ENOMEM;



	/* activate ASID on the given handle */

	data->handle = handle;

	data->asid   = asid;

	ret = sev_guest_activate(data, error);

	kfree(data);



	return ret;

}



static int sev_issue_cmd(int fd, int id, void *data, int *error)

{

	struct fd f;

	int ret;



	f = fdget(fd);

	if (!f.file)

		return -EBADF;



	ret = sev_issue_cmd_external_user(f.file, id, data, error);



	fdput(f);

	return ret;

}



static int sev_launch_start(struct kvm *kvm, struct kvm_sev_cmd *argp)

{

	struct kvm_sev_info *sev = &kvm->arch.sev_info;

	struct sev_data_launch_start *start;

	struct kvm_sev_launch_start params;

	void *dh_blob, *session_blob;

	int *error = &argp->error;

	int ret;



	if (!sev_guest(kvm))

		return -ENOTTY;



	if (copy_from_user(&params, (void __user *)(uintptr_t)argp->data, sizeof(params)))

		return -EFAULT;



	start = kzalloc(sizeof(*start), GFP_KERNEL);

	if (!start)

		return -ENOMEM;



	dh_blob = NULL;

	if (params.dh_uaddr) {

		dh_blob = psp_copy_user_blob(params.dh_uaddr, params.dh_len);

		if (IS_ERR(dh_blob)) {

			ret = PTR_ERR(dh_blob);

			goto e_free;

		}



		start->dh_cert_address = __sme_set(__pa(dh_blob));

		start->dh_cert_len = params.dh_len;

	}



	session_blob = NULL;

	if (params.session_uaddr) {

		session_blob = psp_copy_user_blob(params.session_uaddr, params.session_len);

		if (IS_ERR(session_blob)) {

			ret = PTR_ERR(session_blob);

			goto e_free_dh;

		}



		start->session_address = __sme_set(__pa(session_blob));

		start->session_len = params.session_len;

	}



	start->handle = params.handle;

	start->policy = params.policy;



	/* create memory encryption context */

	ret = sev_issue_cmd(argp->sev_fd, SEV_CMD_LAUNCH_START, start, error);

	if (ret)

		goto e_free_session;



	/* Bind ASID to this guest */

	ret = sev_bind_asid(kvm, start->handle, error);

	if (ret)

		goto e_free_session;



	/* return handle to userspace */

	params.handle = start->handle;

	if (copy_to_user((void __user *)(uintptr_t)argp->data, &params, sizeof(params))) {

		sev_unbind_asid(kvm, start->handle);

		ret = -EFAULT;

		goto e_free_session;

	}



	sev->handle = start->handle;

	sev->fd = argp->sev_fd;



e_free_session:

	kfree(session_blob);

e_free_dh:

	kfree(dh_blob);

e_free:

	kfree(start);

	return ret;

}



static int svm_mem_enc_op(struct kvm *kvm, void __user *argp)

{

	struct kvm_sev_cmd sev_cmd;
@@ -5725,6 +5875,9 @@ static int svm_mem_enc_op(struct kvm *kvm, void __user *argp) 
	case KVM_SEV_INIT:

		r = sev_guest_init(kvm, &sev_cmd);

		break;

	case KVM_SEV_LAUNCH_START:

		r = sev_launch_start(kvm, &sev_cmd);

		break;

	default:

		r = -EINVAL;

		goto out;