From e5791a0306db65073a3edec094eab9fbae728a89 Mon Sep 17 00:00:00 2001 From: Brijesh Singh Date: Fri, 8 Jun 2018 09:40:56 -0500 Subject: [PATCH] conf: Introduce launch-security element in domain The launch-security element can be used to define the security model to use when launching a domain. Currently we support 'sev'. When 'sev' is used, the VM will be launched with AMD SEV feature enabled. SEV feature supports running encrypted VM under the control of KVM. Encrypted VMs have their pages (code and data) secured such that only the guest itself has access to the unencrypted version. Each encrypted VM is associated with a unique encryption key; if its data is accessed to a different entity using a different key the encrypted guests data will be incorrectly decrypted, leading to unintelligible data. Signed-off-by: Brijesh Singh Reviewed-by: Erik Skultety --- docs/formatdomain.html.in | 115 +++++++++++++++ docs/schemas/domaincommon.rng | 37 +++++ src/conf/domain_conf.c | 133 ++++++++++++++++++ src/conf/domain_conf.h | 27 ++++ .../launch-security-sev.xml | 24 ++++ tests/genericxml2xmltest.c | 2 + 6 files changed, 338 insertions(+) create mode 100644 tests/genericxml2xmlindata/launch-security-sev.xml diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 6912762f28..77845fe5f7 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -8458,6 +8458,121 @@ qemu-kvm -net nic,model=? /dev/null

Note: DEA/TDEA is synonymous with DES/TDES.

+

Secure Encrypted Virtualization (SEV)

+ +

+ The contents of the <launch-security type='sev'> element + is used to provide the guest owners input used for creating an encrypted + VM using the AMD SEV feature. + + SEV is an extension to the AMD-V architecture which supports running + encrypted virtual machine (VMs) under the control of KVM. Encrypted + VMs have their pages (code and data) secured such that only the guest + itself has access to the unencrypted version. Each encrypted VM is + associated with a unique encryption key; if its data is accessed to a + different entity using a different key the encrypted guests data will + be incorrectly decrypted, leading to unintelligible data. + + For more information see various input parameters and its format see the SEV API spec + https://support.amd.com/TechDocs/55766_SEV-KM%20API_Specification.pdf + Since 4.4.0 +

+ 
+<domain>
+  ...
+  <launch-security type='sev'>
+    <policy> 0x0001 </policy>
+    <cbitpos> 47 </cbitpos>
+    <reduced-phys-bits> 1 </reduced-phys-bits>
+    <session> AAACCCDD=FFFCCCDSDS </session>
+    <dh-cert> RBBBSDDD=FDDCCCDDDG </dh>
+  </sev>
+  ...
+</domain>
+
+ +
+
cbitpos
+
The required cbitpos element provides the C-bit (aka encryption bit) + location in guest page table entry. The value of cbitpos is + hypervisor dependent and can be obtained through the sev element + from the domain capabilities. +
+
reduced-phys-bits
+
The required reduced-phys-bits element provides the physical + address bit reducation. Similar to cbitpos the value of + reduced-phys-bit is hypervisor dependent and can be obtained + through the sev element from the domain capabilities. +
+
policy
+
The required policy element provides the guest policy + which must be maintained by the SEV firmware. This policy is enforced by + the firmware and restricts what configuration and operational commands + can be performed on this guest by the hypervisor. The guest policy + provided during guest launch is bound to the guest and cannot be changed + throughout the lifetime of the guest. The policy is also transmitted + during snapshot and migration flows and enforced on the destination platform. + + The guest policy is a 4 unsigned byte with the fields shown in Table: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Bit(s) Description
0 Debugging of the guest is disallowed when set
1 Sharing keys with other guests is disallowed when set
2 SEV-ES is required when set
3 Sending the guest to another platform is disallowed when set
4 The guest must not be transmitted to another platform that is + not in the domain when set.
5 The guest must not be transmitted to another platform that is + not SEV capable when set.
6:15 reserved
16:32 The guest must not be transmitted to another platform with a + lower firmware version.
+ +
+
dh-cert
+
The optional dh-cert element provides the guest owners + base64 encoded Diffie-Hellman (DH) key. The key is used to negotiate a + master secret key between the SEV firmware and guest owner. This master + secret key is then used to establish a trusted channel between SEV + firmware and guest owner. +
+
session
+
The optional session element provides the guest owners + base64 encoded session blob defined in the SEV API spec. + + See SEV spec LAUNCH_START section for the session blob format. +
+
+

Example configs

diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index 550fb10159..1d06a5ea89 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -77,6 +77,9 @@ + + + @@ -436,6 +439,40 @@ + + + + sev + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +