[Qemu-devel] [RFC PATCH v4 13/20] sev: add LAUNCH_UPDATE_DATA command

[Brijesh Singh]

The command is used to encrypt a guest memory region using the VM Encryption
Key (VEK) created by LAUNCH_START command. The firmware will also update
the measurement with the contents of the memory region for attestation.

Signed-off-by: Brijesh Singh <brijesh.si...@amd.com>
---
 include/sysemu/sev.h |    2 +-
 kvm-all.c            |    1 +
 sev.c                |   44 +++++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/include/sysemu/sev.h b/include/sysemu/sev.h
index 88cbea5..c614cc0 100644
--- a/include/sysemu/sev.h
+++ b/include/sysemu/sev.h
@@ -96,6 +96,6 @@ bool sev_enabled(void);
 void *sev_guest_init(const char *keyid);
 void sev_set_debug_ops(void *handle, MemoryRegion *mr);
 int sev_create_launch_context(void *handle);
-
+int sev_encrypt_launch_buffer(void *handle, uint8_t *ptr, uint64_t len);
 #endif
 
diff --git a/kvm-all.c b/kvm-all.c
index a13d62f..5e98534 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1827,6 +1827,7 @@ static int kvm_init(MachineState *ms)
             }
             kvm_state->memcrypt_debug_ops = sev_set_debug_ops;
             kvm_state->create_launch_context = sev_create_launch_context;
+            kvm_state->encrypt_launch_data = sev_encrypt_launch_buffer;
             g_free(id);
         }
     }
diff --git a/sev.c b/sev.c
index c13bbfd..b391012 100644
--- a/sev.c
+++ b/sev.c
@@ -225,9 +225,45 @@ err:
 }
 
 static int
+sev_launch_update_data(SEVState *s, uint8_t *addr, uint64_t len)
+{
+    int ret, error;
+    struct kvm_sev_launch_update_data *update;
+
+    if (!s) {
+        return 1;
+    }
+
+    update = g_malloc0(sizeof(*update));
+    if (!update) {
+        return 1;
+    }
+
+    update->address = (__u64)addr;
+    update->length = len;
+    ret = sev_ioctl(KVM_SEV_LAUNCH_UPDATE_DATA, update, &error);
+    if (ret) {
+        fprintf(stderr, "failed LAUNCH_UPDATE_DATA %d (%#x)\n", ret, error);
+        goto err;
+    }
+
+    DPRINTF("SEV: LAUNCH_UPDATE_DATA %#lx+%#lx\n", (unsigned long)addr, len);
+err:
+    g_free(update);
+    return ret;
+}
+
+static int
 sev_mem_write(uint8_t *dst, const uint8_t *src, uint32_t len, MemTxAttrs attrs)
 {
-    return 0;
+    SEVState *s = kvm_memcrypt_get_handle();
+
+    if (sev_get_current_state(s) == SEV_STATE_LAUNCHING) {
+        memcpy(dst, src, len);
+        return sev_launch_update_data(s, dst, len);
+    }
+
+    return 1;
 }
 
 static int
@@ -292,6 +328,12 @@ sev_set_debug_ops(void *handle, MemoryRegion *mr)
     memory_region_set_ram_debug_ops(mr, &sev_ops);
 }
 
+int
+sev_encrypt_launch_buffer(void *handle, uint8_t *ptr, uint64_t len)
+{
+    return sev_launch_update_data((SEVState *)handle, ptr, len);
+}
+
 bool
 sev_enabled(void)
 {