AMD SEV实现

SEV使用流程

启动虚拟机参考流程

迁移参考流程

libvirt SEV相关代码分析

struct _virDomainObj {
    ...
    virDomainDefPtr def; /* The current definition */
    ...
}

struct _virDomainDef {
   ...
    virDomainSEVDefPtr sev;
    ...
}

struct _virDomainSEVDef {
    int sectype; /* enum virDomainLaunchSecurity */
    char *dh_cert;
    char *session;
    unsigned int policy;
    bool haveCbitpos;
    unsigned int cbitpos;
    bool haveReducedPhysBits;
    unsigned int reduced_phys_bits;
};
typedef struct _virDomainSEVDef virDomainSEVDef;
typedef virDomainSEVDef *virDomainSEVDefPtr;

typedef enum {
    VIR_DOMAIN_LAUNCH_SECURITY_NONE,
    VIR_DOMAIN_LAUNCH_SECURITY_SEV,
    VIR_DOMAIN_LAUNCH_SECURITY_LAST,
} virDomainLaunchSecurity;

struct _virQEMUCaps {
    ...
    virSEVCapability *sevCapabilities;
    ...
};

typedef struct _virSEVCapability virSEVCapability;
typedef virSEVCapability *virSEVCapabilityPtr;
struct _virSEVCapability {
    char *pdh;
    char *cert_chain;
    unsigned int cbitpos;
    unsigned int reduced_phys_bits;
};

/**
 *
 * SEV Parameters
 */
/**
 * VIR_NODE_SEV_PDH:
 *
 * Macro represents the Platform Diffie-Hellman key, as VIR_TYPED_PARAMS_STRING.
 */
# define VIR_NODE_SEV_PDH "pdh"
/**
 * VIR_NODE_SEV_CERT_CHAIN:
 *
 * Macro represents the platform certificate chain that includes the platform
 * endorsement key (PEK), owner certificate authority (OCD) and chip
 * endorsement key (CEK), as VIR_TYPED_PARAMS_STRING.
 */
# define VIR_NODE_SEV_CERT_CHAIN "cert-chain"

virDomainSEVDefParseXML函数通过解析虚拟机xml来填充struct virDomainSEVDef。

qemuProcessLaunch

    ->qemuDomainBuildNamespace

        ->qemuDomainSetupLaunchSecurity # 里面将/dev/sev添加到paths中。

qemuProcessLaunch

    ->qemuBuildCommandLine

        ->qemuBuildSEVCommandLine # 添加-object sev-guest,id=sev0,cbitpos=<cbitpos>,reduced-phys-bits=<reduced_phys_bits>,policy=0x<policy>,dh-cert-file=<priv->libDir>/dh_cert.base64,session-file=<priv->libDir>/session.base64。

        ->qemuBuildMachineCommandLine # 为-machine参数添加memory-encryption：-machine ...,memory-encryption=sev0

DH算法是用来进行密钥交换的算法。在使用SEV虚拟机的场景下，DH算法用于交换guest owner（用户）与SEV固件的主密钥（master secret key），该主密钥用于guest owner与SEV固件进行加密通信。

首次调用virsh domcapabilities流程如下(libvirt-6.9，/var/cache/libvirt/qemu/capabilities/没有之前缓存的情况下)：

virConnectGetDomainCapabilities

    ->qemuConnectGetDomainCapabilities

        ->virQEMUCapsCacheLookupDefault

            ->virQEMUCapsCacheLookup

                ->virFileCacheLookup

                    ->virFileCacheValidate

                        ->virFileCacheNewData

                            ->virQEMUCapsNewData

                                ->virQEMUCapsNewForBinaryInternal

                                    ->virQEMUCapsInitQMP

                                        ->virQEMUCapsInitQMPSingle

                                            ->virQEMUCapsInitQMPMonitor