From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.3 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MSGID_FROM_MTA_HEADER,NICE_REPLY_A,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54062C433E2 for ; Wed, 16 Sep 2020 20:34:00 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 7C0342087D for ; Wed, 16 Sep 2020 20:33:59 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=amdcloud.onmicrosoft.com header.i=@amdcloud.onmicrosoft.com header.b="jAciQwC7" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7C0342087D Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=amd.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:38256 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kIe7p-0004zb-2f for qemu-devel@archiver.kernel.org; Wed, 16 Sep 2020 16:33:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:59960) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kIe5r-00047m-MN for qemu-devel@nongnu.org; Wed, 16 Sep 2020 16:31:55 -0400 Received: from mail-bn8nam12on2070.outbound.protection.outlook.com ([40.107.237.70]:54177 helo=NAM12-BN8-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kIe5p-00020N-8Q for qemu-devel@nongnu.org; Wed, 16 Sep 2020 16:31:55 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jXwSQxWcfHqd+eL/+qNS05AGj1vOt3BzNEAgUQk1CNCrjKuQRoASa8lpW5Z9STwi8Cy+Qbj1fIbEewYv8WPIXG/sLof2Q4u4Pj/XrDKCQ0e6hzXZ0eRe5IBLWVo5nu4qU9tPI66xb8T3pnzEQNqTgAzidKx7i66JVF1yFwGPfjkuN88CwGSFZ66D8ZS7q5yDS6CJlMowiYio5Rn/pLlZY4W1Q9uZimy7Mp16OGQP7fRX+Lj9VlCQUQGo7JCM0iHVCuSQjy2mis+p1od1Gyh/LuYw7Qd6uh08bOk7gu8vWoEEOGQocYN5pXQr+Nq6fDy9G733JtgMzuJydIPovHCqvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RNqLKZyYmJvrHzKqYEaiGA2zy1EJmgLgDjoTMjp6rdY=; b=ZYpBdzKG3aELlHVT2NBNdd5JJxW5t5MuSoCqD5viHZM/xuaYMqfMx5ARfXCLYuAmavMBlNDXgDfr6iNKMGuAniVFH2bZsq8fttXvQC9d0Wguk7f0XEPxhJM584MHsAs7Nk6m7FVa+MhytfdWKi81muZtvxkTNoqk7RWeVxdSHDmQbcI4FIMtiGf9U8+wlSrhnJEGLJevJsCacRzsgc2TTZAFAVp/XrkTMjzMisIe2fqRfxVMGm6X1eDGd2dPFKLg76YqSTcG4cWdN/0nBJ+hhQRlk7IHMKsFSat1snqisPmTYsh1q2NNNPHkN3mJa7lW4e6/0DjKJjOyCVpJCJkGJA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector2-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RNqLKZyYmJvrHzKqYEaiGA2zy1EJmgLgDjoTMjp6rdY=; b=jAciQwC7tutkXo1GJlK7Hk80tifeZnBUPt6lJIZoHQ25MibOAxCX0IozA2XRv5tbFOKBeCLzveTUK1HSgQSSQnOuJz/3XTih3GM52Nu70FXLk9biThjkjzLJ3EPG9fSqiYh0IbFnhCXz+VH8bacz2Bn0NM5CoHbKx8t2zPjmHQo= Authentication-Results: twiddle.net; dkim=none (message not signed) header.d=none;twiddle.net; dmarc=none action=none header.from=amd.com; Received: from DM5PR12MB1355.namprd12.prod.outlook.com (2603:10b6:3:6e::7) by DM6PR12MB4484.namprd12.prod.outlook.com (2603:10b6:5:28f::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3370.17; Wed, 16 Sep 2020 20:31:47 +0000 Received: from DM5PR12MB1355.namprd12.prod.outlook.com ([fe80::299a:8ed2:23fc:6346]) by DM5PR12MB1355.namprd12.prod.outlook.com ([fe80::299a:8ed2:23fc:6346%3]) with mapi id 15.20.3391.011; Wed, 16 Sep 2020 20:31:47 +0000 Subject: Re: [PATCH v3 3/5] sev/i386: Allow AP booting under SEV-ES To: Laszlo Ersek , qemu-devel@nongnu.org, kvm@vger.kernel.org References: <9d964b7575471f45c522eea9ea3a7d84ed4d7d2b.1600205384.git.thomas.lendacky@amd.com> <24db1bf6-fbb6-c1c7-3018-54cc114c9a96@redhat.com> From: Tom Lendacky Message-ID: Date: Wed, 16 Sep 2020 15:31:44 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 In-Reply-To: <24db1bf6-fbb6-c1c7-3018-54cc114c9a96@redhat.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-ClientProxiedBy: SN4PR0201CA0001.namprd02.prod.outlook.com (2603:10b6:803:2b::11) To DM5PR12MB1355.namprd12.prod.outlook.com (2603:10b6:3:6e::7) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from [10.236.30.118] (165.204.77.1) by SN4PR0201CA0001.namprd02.prod.outlook.com (2603:10b6:803:2b::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3391.13 via Frontend Transport; Wed, 16 Sep 2020 20:31:46 +0000 X-Originating-IP: [165.204.77.1] X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 7561cd0e-f33d-4530-f178-08d85a7f889c X-MS-TrafficTypeDiagnostic: DM6PR12MB4484: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:374; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: kTXv5PBqbOSf2rYug4GrZXkVde0kPZVIxpLKcPt8IE0s4MOkX2vADqvYcYtiLfGnjUezF9UJq2MYNM/mY7gNXw+7Espzs2POVGGs/L+kxlFkS3vi36ZBHXdCcmhFnfYEl/bBq9BNaokwoRaIN+q5zR7YhvMWPuC3jXg4jJ3iSwxR1cz2JTKoXiss5bl/n0JKR1aAaG9cuVoW/kkAy2D054MhM/2zCNIwRKFijqM/8x7KqTU7jV8K6fOOQLwERTzeQmhP4q26Jxrm2L7OOjm9HmToSqwATRHfMIhMNfZXFaerrli5FjJ3A8XsAL0wKBkc01VzLC7jDzKe2EMMDPg0zLGqm/P/Jt2tz7RbqSu0+x6wWG1Kz78HeJjCNQIxe4QK X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM5PR12MB1355.namprd12.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(39850400004)(346002)(366004)(136003)(376002)(66946007)(31686004)(31696002)(66476007)(36756003)(54906003)(7416002)(4326008)(66556008)(52116002)(478600001)(316002)(53546011)(956004)(8676002)(8936002)(16576012)(83380400001)(26005)(186003)(2616005)(5660300002)(2906002)(6486002)(16526019)(86362001)(43740500002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData: HTynLf5Oz+UBAKU2ByejBzur1SMBfPIb5siE1+nO7nqp6yp7CFyCt9MSNwM2AIj94LYTaWiEmDtdShAc83Cim0BOBKzqNdsm75JDU63+0VqLeyeJ2dzds9Sh1+I5H2+vpwmblOUC/BP93eYTZoFg9xNEvux/sGROpsVlhlRCcJUiTgNy4B5GXY4Xp818lqaB9FvtaHDz+YhH9UMOfi3OKTCNTazSMADM44ErGWBdnFNKcFaiaZQvt7w9Z0DbH4csIUNb2IqvP29FSAQpLH1eI1kR/oKySGXMeNGnjVL0DiW8JcYZl+SMee1Tt9hJJUJ7XD04N8ZGYWAc0GksVvUadMKjCEUG8EY8QNrfusQFmH3BNEqDz60FZy/u7uslYqodlJ5VxZtb0IwiVUFYHLWJE4a5CXtqpwiIHgTy2oj2Pv+cfNQAHSc956NuVOcTQNz0pKieZxkE6qXA0AxOdcpno2klQ943g3nkiIHo9eYXPG1TowCO668GAyOVf2ui5onQ+LxXb4+1iO+uuZU4IZ2m8ahXsz3p1NGDRQ91yjh8mxh+F2pTOtdZIfIWSvxWgX/AGbp8cn41nJ7TySH2JTPvTI6W/TsnSVqUKiQljD5F/oLsVrRWDtIwx8VBFYdojs/19qFbm2gZ+2+A9iF23tuCUQ== X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7561cd0e-f33d-4530-f178-08d85a7f889c X-MS-Exchange-CrossTenant-AuthSource: DM5PR12MB1355.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Sep 2020 20:31:47.4617 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: W83BxrYpURMIHqbS7LLop6p5W6WGtV6upXPrh5InEtMwXWxbr93M2HuC4NJeMhgpyq6PXcawCkS5AFKVa+zvKg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB4484 Received-SPF: none client-ip=40.107.237.70; envelope-from=Thomas.Lendacky@amd.com; helo=NAM12-BN8-obe.outbound.protection.outlook.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/09/16 16:31:49 X-ACL-Warn: Detected OS = Windows NT kernel [generic] [fuzzy] X-Spam_score_int: -9 X-Spam_score: -1.0 X-Spam_bar: - X-Spam_report: (-1.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FORGED_SPF_HELO=1, MSGID_FROM_MTA_HEADER=0.001, NICE_REPLY_A=-0.062, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_NONE=0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Brijesh Singh , Eduardo Habkost , "Michael S. Tsirkin" , Connor Kuehl , Marcelo Tosatti , "Dr. David Alan Gilbert" , Paolo Bonzini , Jiri Slaby , Richard Henderson Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" On 9/16/20 4:23 AM, Laszlo Ersek wrote: > Hi Tom, Hi Laszlo, > > sorry for the random feedback -- I haven't followed (and don't really > intend to follow) the QEMU side of the feature. Just one style idea: > > On 09/15/20 23:29, Tom Lendacky wrote: >> From: Tom Lendacky >> >> When SEV-ES is enabled, it is not possible modify the guests register >> state after it has been initially created, encrypted and measured. >> >> Normally, an INIT-SIPI-SIPI request is used to boot the AP. However, the >> hypervisor cannot emulate this because it cannot update the AP register >> state. For the very first boot by an AP, the reset vector CS segment >> value and the EIP value must be programmed before the register has been >> encrypted and measured. >> >> Signed-off-by: Tom Lendacky >> --- >> accel/kvm/kvm-all.c | 64 ++++++++++++++++++++++++++++++++++++++++++ >> accel/stubs/kvm-stub.c | 5 ++++ >> hw/i386/pc_sysfw.c | 10 ++++++- >> include/sysemu/kvm.h | 16 +++++++++++ >> include/sysemu/sev.h | 3 ++ >> target/i386/kvm.c | 2 ++ >> target/i386/sev.c | 51 +++++++++++++++++++++++++++++++++ >> 7 files changed, 150 insertions(+), 1 deletion(-) >> >> diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c >> index 63ef6af9a1..20725b0368 100644 >> --- a/accel/kvm/kvm-all.c >> +++ b/accel/kvm/kvm-all.c >> @@ -39,6 +39,7 @@ >> #include "qemu/main-loop.h" >> #include "trace.h" >> #include "hw/irq.h" >> +#include "sysemu/kvm.h" >> #include "sysemu/sev.h" >> #include "qapi/visitor.h" >> #include "qapi/qapi-types-common.h" >> @@ -120,6 +121,12 @@ struct KVMState >> /* memory encryption */ >> void *memcrypt_handle; >> int (*memcrypt_encrypt_data)(void *handle, uint8_t *ptr, uint64_t len); >> + int (*memcrypt_save_reset_vector)(void *handle, void *flash_ptr, >> + uint64_t flash_size, uint32_t *addr); >> + >> + unsigned int reset_cs; >> + unsigned int reset_ip; >> + bool reset_valid; >> >> /* For "info mtree -f" to tell if an MR is registered in KVM */ >> int nr_as; >> @@ -239,6 +246,62 @@ int kvm_memcrypt_encrypt_data(uint8_t *ptr, uint64_t len) >> return 1; >> } >> >> +void kvm_memcrypt_set_reset_vector(CPUState *cpu) >> +{ >> + X86CPU *x86; >> + CPUX86State *env; >> + >> + /* Only update if we have valid reset information */ >> + if (!kvm_state->reset_valid) { >> + return; >> + } >> + >> + /* Do not update the BSP reset state */ >> + if (cpu->cpu_index == 0) { >> + return; >> + } >> + >> + x86 = X86_CPU(cpu); >> + env = &x86->env; >> + >> + cpu_x86_load_seg_cache(env, R_CS, 0xf000, kvm_state->reset_cs, 0xffff, >> + DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK | >> + DESC_R_MASK | DESC_A_MASK); >> + >> + env->eip = kvm_state->reset_ip; >> +} >> + >> +int kvm_memcrypt_save_reset_vector(void *flash_ptr, uint64_t flash_size) >> +{ >> + CPUState *cpu; >> + uint32_t addr; >> + int ret; >> + >> + if (kvm_memcrypt_enabled() && >> + kvm_state->memcrypt_save_reset_vector) { >> + >> + addr = 0; >> + ret = kvm_state->memcrypt_save_reset_vector(kvm_state->memcrypt_handle, >> + flash_ptr, flash_size, >> + &addr); >> + if (ret) { >> + return ret; >> + } >> + >> + if (addr) { >> + kvm_state->reset_cs = addr & 0xffff0000; >> + kvm_state->reset_ip = addr & 0x0000ffff; >> + kvm_state->reset_valid = true; >> + >> + CPU_FOREACH(cpu) { >> + kvm_memcrypt_set_reset_vector(cpu); >> + } >> + } >> + } >> + >> + return 0; >> +} >> + >> /* Called with KVMMemoryListener.slots_lock held */ >> static KVMSlot *kvm_get_free_slot(KVMMemoryListener *kml) >> { >> @@ -2193,6 +2256,7 @@ static int kvm_init(MachineState *ms) >> } >> >> kvm_state->memcrypt_encrypt_data = sev_encrypt_data; >> + kvm_state->memcrypt_save_reset_vector = sev_es_save_reset_vector; >> } >> >> ret = kvm_arch_init(ms, s); >> diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c >> index 82f118d2df..3aece9b513 100644 >> --- a/accel/stubs/kvm-stub.c >> +++ b/accel/stubs/kvm-stub.c >> @@ -114,6 +114,11 @@ int kvm_memcrypt_encrypt_data(uint8_t *ptr, uint64_t len) >> return 1; >> } >> >> +int kvm_memcrypt_save_reset_vector(void *flash_ptr, uint64_t flash_size) >> +{ >> + return -ENOSYS; >> +} >> + >> #ifndef CONFIG_USER_ONLY >> int kvm_irqchip_add_msi_route(KVMState *s, int vector, PCIDevice *dev) >> { >> diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c >> index b6c0822fe3..321ff94261 100644 >> --- a/hw/i386/pc_sysfw.c >> +++ b/hw/i386/pc_sysfw.c >> @@ -156,7 +156,8 @@ static void pc_system_flash_map(PCMachineState *pcms, >> PFlashCFI01 *system_flash; >> MemoryRegion *flash_mem; >> void *flash_ptr; >> - int ret, flash_size; >> + uint64_t flash_size; >> + int ret; >> >> assert(PC_MACHINE_GET_CLASS(pcms)->pci_enabled); >> >> @@ -204,6 +205,13 @@ static void pc_system_flash_map(PCMachineState *pcms, >> if (kvm_memcrypt_enabled()) { >> flash_ptr = memory_region_get_ram_ptr(flash_mem); >> flash_size = memory_region_size(flash_mem); >> + >> + ret = kvm_memcrypt_save_reset_vector(flash_ptr, flash_size); >> + if (ret) { >> + error_report("failed to locate and/or save reset vector"); >> + exit(1); >> + } >> + >> ret = kvm_memcrypt_encrypt_data(flash_ptr, flash_size); >> if (ret) { >> error_report("failed to encrypt pflash rom"); >> diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h >> index b4174d941c..f74cfa85ab 100644 >> --- a/include/sysemu/kvm.h >> +++ b/include/sysemu/kvm.h >> @@ -247,6 +247,22 @@ bool kvm_memcrypt_enabled(void); >> */ >> int kvm_memcrypt_encrypt_data(uint8_t *ptr, uint64_t len); >> >> +/** >> + * kvm_memcrypt_set_reset_vector - sets the CS/IP value for the AP if SEV-ES >> + * is active. >> + */ >> +void kvm_memcrypt_set_reset_vector(CPUState *cpu); >> + >> +/** >> + * kvm_memcrypt_save_reset_vector - locates and saves the reset vector to be >> + * used as the initial CS/IP value for APs >> + * if SEV-ES is active. >> + * >> + * Return: 1 SEV-ES is active and failed to locate a valid reset vector >> + * 0 SEV-ES is not active or successfully located and saved the >> + * reset vector address >> + */ >> +int kvm_memcrypt_save_reset_vector(void *flash_prt, uint64_t flash_size); >> >> #ifdef NEED_CPU_H >> #include "cpu.h" >> diff --git a/include/sysemu/sev.h b/include/sysemu/sev.h >> index 98c1ec8d38..5198e5a621 100644 >> --- a/include/sysemu/sev.h >> +++ b/include/sysemu/sev.h >> @@ -18,4 +18,7 @@ >> >> void *sev_guest_init(const char *id); >> int sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len); >> +int sev_es_save_reset_vector(void *handle, void *flash_ptr, >> + uint64_t flash_size, uint32_t *addr); >> + >> #endif >> diff --git a/target/i386/kvm.c b/target/i386/kvm.c >> index 6f18d940a5..10eaba8943 100644 >> --- a/target/i386/kvm.c >> +++ b/target/i386/kvm.c >> @@ -1912,6 +1912,8 @@ void kvm_arch_reset_vcpu(X86CPU *cpu) >> } >> /* enabled by default */ >> env->poll_control_msr = 1; >> + >> + kvm_memcrypt_set_reset_vector(CPU(cpu)); >> } >> >> void kvm_arch_do_init_vcpu(X86CPU *cpu) >> diff --git a/target/i386/sev.c b/target/i386/sev.c >> index 5055b1fe00..6ddefc65fa 100644 >> --- a/target/i386/sev.c >> +++ b/target/i386/sev.c >> @@ -70,6 +70,19 @@ struct SevGuestState { >> #define DEFAULT_GUEST_POLICY 0x1 /* disable debug */ >> #define DEFAULT_SEV_DEVICE "/dev/sev" >> >> +/* SEV Information Block GUID = 00f771de-1a7e-4fcb-890e-68c77e2fb44e */ >> +#define SEV_INFO_BLOCK_GUID \ >> + "\xde\x71\xf7\x00\x7e\x1a\xcb\x4f\x89\x0e\x68\xc7\x7e\x2f\xb4\x4e" >> + >> +typedef struct __attribute__((__packed__)) SevInfoBlock { >> + /* SEV-ES Reset Vector Address */ >> + uint32_t reset_addr; >> + >> + /* SEV Information Block size and GUID */ >> + uint16_t size; >> + char guid[16]; >> +} SevInfoBlock; >> + >> static SevGuestState *sev_guest; >> static Error *sev_mig_blocker; >> > > Can we replace "char guid[16]" with "QemuUUID guid"? > > Also, can we replace the SEV_INFO_BLOCK_GUID macro with a static const > structure, initialized with UUID_LE()? > > Something like > > static const QemuUUID sev_info_block_guid_le = { > .data = UUID_LE(...) > }; > Can do. Thanks, Tom > Thanks > Laszlo > >> @@ -833,6 +846,44 @@ sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len) >> return 0; >> } >> >> +int >> +sev_es_save_reset_vector(void *handle, void *flash_ptr, uint64_t flash_size, >> + uint32_t *addr) >> +{ >> + SevInfoBlock *info; >> + >> + assert(handle); >> + >> + /* >> + * Initialize the address to zero. An address of zero with a successful >> + * return code indicates that SEV-ES is not active. >> + */ >> + *addr = 0; >> + if (!sev_es_enabled()) { >> + return 0; >> + } >> + >> + /* >> + * Extract the AP reset vector for SEV-ES guests by locating the SEV GUID. >> + * The SEV GUID is located 32 bytes from the end of the flash. Use this >> + * address to base the SEV information block. >> + */ >> + info = flash_ptr + flash_size - 0x20 - sizeof(*info); >> + if (memcmp(info->guid, SEV_INFO_BLOCK_GUID, 16)) { >> + error_report("SEV information block not found in pflash rom"); >> + return 1; >> + } >> + >> + if (!info->reset_addr) { >> + error_report("SEV-ES reset address is zero"); >> + return 1; >> + } >> + >> + *addr = info->reset_addr; >> + >> + return 0; >> +} >> + >> static void >> sev_register_types(void) >> { >> >