From mboxrd@z Thu Jan  1 00:00:00 1970
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Subject: Re: [PATCH v7 17/26] target/i386: encrypt bios rom
Date: Fri, 9 Feb 2018 18:28:20 +0000
Message-ID: <20180209182819.GH2428@work-vm>
References: <20180207160638.98872-17-brijesh.singh@amd.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: qemu-devel@nongnu.org,
        Alistair Francis <alistair.francis@xilinx.com>,
        Christian Borntraeger <borntraeger@de.ibm.com>,
        Cornelia Huck <cornelia.huck@de.ibm.com>,
        "Daniel P . Berrange" <berrange@redhat.com>,
        "Michael S. Tsirkin" <mst@redhat.com>,
        "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>,
        Eduardo Habkost <ehabkost@redhat.com>,
        Eric Blake <eblake@redhat.com>, kvm@vger.kernel.org,
        Marcel Apfelbaum <marcel@redhat.com>,
        Markus Armbruster <armbru@redhat.com>,
        Paolo Bonzini <pbonzini@redhat.com>,
        Peter Crosthwaite <crosthwaite.peter@gmail.com>,
        Peter Maydell <peter.maydell@linaro.org>,
        Richard Henderson <richard.henderson@linaro.org>,
        Stefan Hajnoczi <stefanha@gmail.com>,
        Thomas Lendacky <Thomas.Lendacky@amd.com>,
        Borislav Petkov <bp@suse.de>,
To: Brijesh Singh <brijesh.singh@amd.com>
Return-path: <kvm-owner@vger.kernel.org>
Received: from mx3-rdu2.redhat.com ([66.187.233.73]:41686 "EHLO mx1.redhat.com"
        rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP
        id S1750942AbeBIS2a (ORCPT <rfc822;kvm@vger.kernel.org>);
        Fri, 9 Feb 2018 13:28:30 -0500
Content-Disposition: inline
In-Reply-To: <20180207160638.98872-17-brijesh.singh@amd.com>
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

* Brijesh Singh (brijesh.singh@amd.com) wrote:
> SEV requires that guest bios must be encrypted before booting the guest.

I'm curious; is it just the main BIOS that needs encryption - what about
things like device/PXE rom images?

Dave

> 
> Cc: "Michael S. Tsirkin" <mst@redhat.com>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: Richard Henderson <rth@twiddle.net>
> Cc: Eduardo Habkost <ehabkost@redhat.com>
> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
> ---
>  hw/i386/pc_sysfw.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
> index 6b183747fcea..8ddbbf74d330 100644
> --- a/hw/i386/pc_sysfw.c
> +++ b/hw/i386/pc_sysfw.c
> @@ -112,6 +112,8 @@ static void pc_system_flash_init(MemoryRegion *rom_memory)
>      pflash_t *system_flash;
>      MemoryRegion *flash_mem;
>      char name[64];
> +    void *flash_ptr;
> +    int ret, flash_size;
>  
>      sector_bits = 12;
>      sector_size = 1 << sector_bits;
> @@ -168,6 +170,17 @@ static void pc_system_flash_init(MemoryRegion *rom_memory)
>          if (unit == 0) {
>              flash_mem = pflash_cfi01_get_memory(system_flash);
>              pc_isa_bios_init(rom_memory, flash_mem, size);
> +
> +            /* Encrypt the pflash boot ROM */
> +            if (kvm_memcrypt_enabled()) {
> +                flash_ptr = memory_region_get_ram_ptr(flash_mem);
> +                flash_size = memory_region_size(flash_mem);
> +                ret = kvm_memcrypt_encrypt_data(flash_ptr, flash_size);
> +                if (ret) {
> +                    error_report("failed to encrypt pflash rom");
> +                    exit(1);
> +                }
> +            }
>          }
>      }
>  }
> -- 
> 2.14.3
> 
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK