From: Christoffer Dall <christoffer.dall@arm.com>
Add the command line option to specify the algorithm that will be used
to create the cryptographic measurement of the realm. Valid options are
"sha256" and "sha512". The final measurement will be a hash using the
selected algorithm
Signed-off-by: Christoffer Dall <christoffer.dall@arm.com>
Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
---
arm/aarch64/include/kvm/kvm-config-arch.h | 5 ++++-
arm/aarch64/kvm.c | 17 ++++++++++++++++-
arm/include/arm-common/kvm-arch.h | 1 +
arm/include/arm-common/kvm-config-arch.h | 1 +
4 files changed, 22 insertions(+), 2 deletions(-)
@@ -23,7 +23,10 @@ int vcpu_affinity_parser(const struct option *opt, const char *arg, int unset);
OPT_BOOLEAN('\0', "disable-sve", &(cfg)->disable_sve, \
"Disable SVE"), \
OPT_BOOLEAN('\0', "realm", &(cfg)->is_realm, \
- "Create VM running in a realm using Arm RME"),
+ "Create VM running in a realm using Arm RME"), \
+ OPT_STRING('\0', "measurement-algo", &(cfg)->measurement_algo, \
+ "sha256, sha512", \
+ "Realm Measurement algorithm, default: sha256"),
#include "arm-common/kvm-config-arch.h"
@@ -53,12 +53,27 @@ static void validate_mem_cfg(struct kvm *kvm)
static void validate_realm_cfg(struct kvm *kvm)
{
- if (!kvm->cfg.arch.is_realm)
+ if (!kvm->cfg.arch.is_realm) {
+ if (kvm->cfg.arch.measurement_algo)
+ die("--measurement-algo valid only with --realm");
return;
+ }
if (kvm->cfg.arch.aarch32_guest)
die("Realms supported only for 64bit guests");
+ if (kvm->cfg.arch.measurement_algo) {
+ if (strcmp(kvm->cfg.arch.measurement_algo, "sha256") == 0)
+ kvm->arch.measurement_algo = KVM_CAP_ARM_RME_MEASUREMENT_ALGO_SHA256;
+ else if (strcmp(kvm->cfg.arch.measurement_algo, "sha512") == 0)
+ kvm->arch.measurement_algo = KVM_CAP_ARM_RME_MEASUREMENT_ALGO_SHA512;
+ else
+ die("unknown realm measurement algorithm");
+ } else {
+ pr_debug("Realm Hash algorithm: Using default SHA256\n");
+ kvm->arch.measurement_algo = KVM_CAP_ARM_RME_MEASUREMENT_ALGO_SHA256;
+ }
+
die("Realms not supported");
}
@@ -113,6 +113,7 @@ struct kvm_arch {
u64 dtb_guest_start;
cpu_set_t *vcpu_affinity_cpuset;
+ u64 measurement_algo;
};
#endif /* ARM_COMMON__KVM_ARCH_H */
@@ -6,6 +6,7 @@
struct kvm_config_arch {
const char *dump_dtb_filename;
const char *vcpu_affinity;
+ const char *measurement_algo;
unsigned int force_cntfrq;
bool virtio_trans_pci;
bool aarch32_guest;