github/acrn-hypervisor
1
0
Fork 0
mirror of https://github.com/projectacrn/acrn-hypervisor.git synced 2025-09-24 02:08:04 +00:00
Code Issues Projects Releases Wiki Activity

hv: keylocker: Support keylocker backup MSRs for Guest VM

Browse Source 
The logical processor scoped IWKey can be copied to or from a
platform-scope storage copy called IWKeyBackup. Copying IWKey to
IWKeyBackup is called ‘backing up IWKey’ and copying from IWKeyBackup to
IWKey is called ‘restoring IWKey’.

IWKeyBackup and the path between it and IWKey are protected against
software and simple hardware attacks. This means that IWKeyBackup can be
used to distribute an IWKey within the logical processors in a platform
in a protected manner.

Linux keylocker implementation uses this feature, so they are
introduced by this patch.

Tracked-On: #5695
Signed-off-by: Shuo A Liu <shuo.a.liu@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
This commit is contained in:
Shuo A Liu
2020-08-24 20:16:11 +08:00
committed by wenlingz
parent 38cd5b481d
commit d4aaf99d86
6 changed files with 95 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
hypervisor/include/arch/x86/guest/vcpu.h
View File

@@ -171,7 +171,7 @@ enum reset_mode;
#define SECURE_WORLD 1
#define NUM_WORLD_MSRS 2U
#define NUM_COMMON_MSRS 17U
#define NUM_COMMON_MSRS 21U
#define NUM_GUEST_MSRS (NUM_WORLD_MSRS + NUM_COMMON_MSRS)
#define EOI_EXIT_BITMAP_SIZE 256U
@@ -270,6 +270,12 @@ struct acrn_vcpu_arch {
/* Keylocker */
struct iwkey IWKey;
bool cr4_kl_enabled;
/*
* Keylocker spec 4.4:
* Bit 0 - Status of most recent copy to or from IWKeyBackup.
* Bit 63:1 - Reserved.
*/
uint64_t iwkey_copy_status;
} __aligned(PAGE_SIZE);
struct acrn_vm;

12
hypervisor/include/arch/x86/guest/vm.h
View File

@@ -116,6 +116,18 @@ struct vm_arch {
#endif
enum vm_vlapic_mode vlapic_mode; /* Represents vLAPIC mode across vCPUs*/
/*
* Keylocker spec 4.5:
* Bit 0 - Backup/restore valid.
* Bit 1 - Reserved.
* Bit 2 - Backup key storage read/write error.
* Bit 3 - IWKeyBackup consumed.
* Bit 63:4 - Reserved.
*/
uint64_t iwkey_backup_status;
spinlock_t iwkey_backup_lock; /* Spin-lock used to protect internal key backup/restore */
struct iwkey iwkey_backup;
/* reference to virtual platform to come here (as needed) */
} __aligned(PAGE_SIZE);