b2f73a0784
When SEV-ES is enabled, it is not possible modify the guests register state after it has been initially created, encrypted and measured. Normally, an INIT-SIPI-SIPI request is used to boot the AP. However, the hypervisor cannot emulate this because it cannot update the AP register state. For the very first boot by an AP, the reset vector CS segment value and the EIP value must be programmed before the register has been encrypted and measured. Search the guest firmware for the guest for a specific GUID that tells Qemu the value of the reset vector to use. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> Cc: Richard Henderson <richard.henderson@linaro.org> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Message-Id: <22db2bfb4d6551aed661a9ae95b4fdbef613ca21.1611682609.git.thomas.lendacky@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
29 lines
768 B
C
29 lines
768 B
C
/*
|
|
* QEMU Secure Encrypted Virutualization (SEV) support
|
|
*
|
|
* Copyright: Advanced Micro Devices, 2016-2018
|
|
*
|
|
* Authors:
|
|
* Brijesh Singh <brijesh.singh@amd.com>
|
|
*
|
|
* This work is licensed under the terms of the GNU GPL, version 2 or later.
|
|
* See the COPYING file in the top-level directory.
|
|
*
|
|
*/
|
|
|
|
#ifndef QEMU_SEV_H
|
|
#define QEMU_SEV_H
|
|
|
|
#include "sysemu/kvm.h"
|
|
|
|
bool sev_enabled(void);
|
|
int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp);
|
|
int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp);
|
|
int sev_inject_launch_secret(const char *hdr, const char *secret,
|
|
uint64_t gpa, Error **errp);
|
|
|
|
int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size);
|
|
void sev_es_set_reset_vector(CPUState *cpu);
|
|
|
|
#endif
|