From nobody Thu May 2 22:35:13 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1527110374150616.5777592483967; Wed, 23 May 2018 14:19:34 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 570FBABB20; Wed, 23 May 2018 21:19:26 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 1F1D010694C0; Wed, 23 May 2018 21:19:26 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id C9A3E4CA83; Wed, 23 May 2018 21:19:25 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id w4NLJAeT028743 for ; Wed, 23 May 2018 17:19:10 -0400 Received: by smtp.corp.redhat.com (Postfix) id B5BD11062241; Wed, 23 May 2018 21:19:10 +0000 (UTC) Received: from mx1.redhat.com (ext-mx10.extmail.prod.ext.phx2.redhat.com [10.5.110.39]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 716F4106223E; Wed, 23 May 2018 21:19:08 +0000 (UTC) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0058.outbound.protection.outlook.com [104.47.32.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 4D11113A526; Wed, 23 May 2018 21:19:06 +0000 (UTC) Received: from wsp141597wss.amd.com (165.204.78.1) by BL0PR12MB2449.namprd12.prod.outlook.com (2603:10b6:207:4d::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.797.11; Wed, 23 May 2018 21:18:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector1-amd-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SjpTiH1mLEw/nvA5TKvjTOL2DaU/iu2CKrG1N/AfMAg=; b=s5gaUXBmqDZOyQd+ds2XJ0cS/YK5j0Wb6fLrI6nW4r151Kt/pSvwEHQ5TqgHdSnA+t779pr4e7zKHc3hep9svkWj80J1eJHu7h23A6EWqGod0+i/V+YIGz+GHeIH48LWNtC6zmv3v15m/2t4eR5IxcSQMZzANGN7AJlD84/o/6E= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: libvir-list@redhat.com Date: Wed, 23 May 2018 16:18:26 -0500 Message-Id: <20180523211834.15817-2-brijesh.singh@amd.com> In-Reply-To: <20180523211834.15817-1-brijesh.singh@amd.com> References: <20180523211834.15817-1-brijesh.singh@amd.com> MIME-Version: 1.0 X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: SN2PR01CA0050.prod.exchangelabs.com (2603:10b6:800::18) To BL0PR12MB2449.namprd12.prod.outlook.com (2603:10b6:207:4d::31) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:BL0PR12MB2449; X-Microsoft-Exchange-Diagnostics: 1; BL0PR12MB2449; 3:50aax/bc2swWGOIORim8GjbLC7JLiMBPlyJPRzEKlxYKufxZiE8wuI3c4mabg2HAGwJxJy5IXKCPjIaLCqHaF04nNyim8WRJZflOoiuwXbliYEyGSpGpgiUBsZ2vfjxocd5gY0Pj4ChqBitEHNYHw9agSXdL+AXKFPvt/QD/Vs/f7iOcQH6M5eWUTf213mYceE7JSPLknP3dSYCttTOoTjRhM0YrPi/S4rkmpv1NPrWsYHpRX27WHc0PwhvcSxVy; 25:wHlmkuEzVj6wR/SaRyFNVHeO5v7G7907RgZFIlyVxCfH8L5F9CklIG4Ow+G1QyA2/L9CWpmsggRiMyJPQeCVGy1EeEmIBOkkWINTKbFOJyQxjD6Pkr3oWT6njOQykoZn4VGwqMsIhKrZEMUrWz/twsr4tokiV3pzv5Vg1LxZAo5FEBj3Ww5y+zSasIKDz+CfD8DAzNA/ROYNGfeeiRMXZWH0FE9QHAFquvKqfrHuoVqnlOM8xmI8e2UUMWSqKVhYUEJMTFtVwGNduhhAStPs6dNBdnDmii4aKKiTlZHLfUnSgJ32FHkxxw5EinnpAt+5goIUuj/hUl1hQ0aztuRWOQ==; 31:mAKuvg4IByNZx7npvcacYcbWFPlsgqilg06gg9CZYdIWOlKwhJ38ZoAOLh+ixEsMWIE/MYuHnpvqgtxMRNyJGc3W1JgSu+P8vtmlZNSg4pVHW2ZiKxEY3zOaRpder2CQQjWuKcvW0gxDuGrbxUuB/MKdg0K2KLPeeyzj4Z5fxFJfMq0bcyThhZ5jrcPj1wCxBvgj6sfnlNTkxhdtXl082cth12xf5CjCYdt/l39W3pM= X-MS-TrafficTypeDiagnostic: BL0PR12MB2449: X-Microsoft-Exchange-Diagnostics: 1; BL0PR12MB2449; 20:prBkO/IhOjObMWLpdkWEsHryY4K/JtSTdkn7jF/sPJ60nUVO4liYB3UL7E5hC9FEYopPk4nyfCxEM84It/+oraybyIaquvWQfH8gVl7XgJjEuO9ybEstgtSDlJWbtQS6/Ym3LD3B9po5QBTRC/LwpcJ/13DMdBdk8urvU3ytHpPytnJCcaTsvvxjreC0gSA8slb1o6dCjwh7rwlClhLNyyp/XoH9SEkU85aqRczrcFHzNLhgeSPnU3mgfaKykF7hWJQmeX4lz/ATdWYuGuS/r/u9KQbLfFIsGnPMuGrQJOFG2E8J6JN4SdD5onHFxLk49qJcYWAAoEGwIVyBL6EUO2p9wzotlnBWJqBlYmCqQM96RLoKrpX1H6pgnAnlR0mcIaPpKA9CJ2D3aX9lOv1rFDjTl8zeKgFFxAc8q4HAtLyoRTfyRJ9CIg5ei1PtP0JKXAxiqOMZw68BfPU+h+ckgXuiW87yU3c7FmQ7dvNuC9YDkKkuaUoXvcz7fPgCwX9Y; 4:GZXq1a7r2McqLk5koYwhMosn64JP07qE0J48DRpa9Wqi6fB5D6jzL9RHGVQitqZGDQXNATN0NnuliGrm5k8wEQ07gk29pRUSbwl8o0NZ6Ye1W/fa9XxZfU1KCxRBP8i14+XBNL4aBHjamqoZbZxeyQs0/Yf1QSse+3UhoKL3rO9uvUNcReM47td7S4DPrUI8rX413yE+Cuu1ZifjUycg6D4IBJ+R9ehe2wN8Km5SNrtOBSvqLFlhZRe3F3Srx2XVDANQVBSpJ/ua1p+SahXudxbpMpW+/g7FP9Bq4Pz9iQE4z8HbI5tkNJuFS/HD4AmE X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(767451399110); X-MS-Exchange-SenderADCheck: 1 X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(10201501046)(93006095)(93001095)(3002001)(3231254)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123560045)(20161123558120)(6072148)(201708071742011)(7699016); SRVR:BL0PR12MB2449; BCL:0; PCL:0; RULEID:; SRVR:BL0PR12MB2449; X-Forefront-PRVS: 06818431B9 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(346002)(376002)(396003)(366004)(39380400002)(39860400002)(199004)(189003)(956004)(6116002)(53936002)(1076002)(3846002)(4326008)(2616005)(36756003)(446003)(97736004)(11346002)(5660300001)(66066001)(16526019)(47776003)(186003)(6916009)(6666003)(44832011)(6486002)(86362001)(575784001)(16586007)(2351001)(26005)(478600001)(59450400001)(2906002)(76176011)(2361001)(51416003)(68736007)(50466002)(25786009)(476003)(52116002)(7696005)(54906003)(48376002)(7736002)(305945005)(106356001)(386003)(316002)(53416004)(486006)(81166006)(81156014)(8676002)(105586002)(50226002)(8936002); DIR:OUT; SFP:1101; SCL:1; SRVR:BL0PR12MB2449; H:wsp141597wss.amd.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BL0PR12MB2449; 23:Z9wCwlP6Lxn89x/YT3WpYSzqFS+4nr7DZtSay+6ms?= =?us-ascii?Q?gm8XG3zqPHZmm4+kq4EvBsQ+I3xthzIPsUR1+zPtyVzGwUZisvL2T/FOuVAQ?= =?us-ascii?Q?PBv7Jb8n8dlRo5NusETDUz6tHb+1rmlEUnX8s370jPEVd9EwzYKFQ3WZZfuV?= =?us-ascii?Q?Pn37fHI18ZNnRRAx3a/C7TblR+qLaAE9dUbRpfL9DsrS8Pq6W3WRf9AwQgxo?= =?us-ascii?Q?uebkQHPaWxHUY7pMM65VYUR7st3NKWJJZ3n6OVKRIppYFNWpRbBQwR8uPuew?= =?us-ascii?Q?twJWAchguXRoozBCppBFkkQbnzMIlI+aI9aU2/a0XvL+YfkTFRSs27gNdGYk?= =?us-ascii?Q?GX9mtYMMCSr4R7RvmbfKJQGmiJYteeEpJSW65rKC454r3ad3wnUBnbZ5M6Rs?= =?us-ascii?Q?dpvav0mu4DaTGCiAIBZGAMkMHb9TnscHLIoj+/UKHRVf/un8HkW/nzulrcQ1?= =?us-ascii?Q?k6lWPms6U0ZbQOfkiTWQEzXEWUwtudMx2HAatXdn+ygHz3N0mKDLgKl3PWmF?= =?us-ascii?Q?zbFIkEEDfWeNrE95/0xN4Di7QChrsi4Ip9sT1FMSEdMAwHpj+1Axweu+1x2S?= =?us-ascii?Q?RYtxWbgZRFXgek24pIlScT71KTvUVyg3KM6oMGuGtSlGBUZiiCpDYbsj6R6T?= =?us-ascii?Q?w9X/iBOT/WONOx4Bcwbd/u/3D9NPwbmF8/7ZS32w6W0TErZPOWl+Zti/BHjk?= =?us-ascii?Q?gqHPwakc1DugoFZQEuoEHSgpMYIoeDqAB8/DBHYcuYqhxTMbXjt6lVNyxKux?= =?us-ascii?Q?jtxxtXEFA7z9/WLgktu/bQxFiqruRmVhwXHXIN2/ykJyoxVa02P8dhvhVCSR?= =?us-ascii?Q?ORhQ7bJot1f1IifedWiNU4bG+6854geDiVq3+ey5ALOK1NwMEYhl462pdc5I?= =?us-ascii?Q?cjeFLCUS4Naz/dBONmGotRTqL0OF1Fai1+7NQ6PWn5R88wefzhGBqOPs9vOv?= =?us-ascii?Q?AEE35RXHrNf7O78W1+BzZZHcte7DANM5PRgz9EkjPNafWaSft0ue6vkM2w7I?= =?us-ascii?Q?8sXDXxMFThDFm/NdwHCXMIKe406G5V1JzfLXhaFNON1/2BYltp65b9uqQQOI?= =?us-ascii?Q?C847nrbX0H+M0G4j7KMSKbDZKhkiH7NRcvS7sTci18lHl1eHshkTwCDOMhxc?= =?us-ascii?Q?vRj8gn86S9uf18t0ZZxSEpLWL9ErWNljvUnEQFwUOnY5R5hn65+joUwFzssm?= =?us-ascii?Q?EDWgEYSZnodcGVSR1q7lA/RCgHeH/3RtCSFZWGsomvYsdoSJxLYn0Lgyash1?= =?us-ascii?Q?Qy0e/m0/Pykz3dvRryetmm3qf1t/fWzZGmfbMLskRDQ50BkXSr4EMT0CVFr0?= =?us-ascii?Q?MyCYUBQ1La10YKRjXxtc/pl7DWJGcS7dlaJQYE7QThG?= X-Microsoft-Antispam-Message-Info: 3u5rH2f53lNeIyOc1+2wGWrIbXWjWb0LNoMLOqrNev71+zSBP3F16oRsmckTcuvXB+JJj4LIeKIKwtKYMx72I8Q+VpD1C6zULI5GByF0wePH7CfXYcyoPV0eDxEQ2QybKJ9v+7UQJHVflkAtNQ5P726LZOSQBfJFTaCmFL+Cr+RfJRl84Cc/4z0CvmUObfB+ X-Microsoft-Exchange-Diagnostics: 1; BL0PR12MB2449; 6:0HB3stz3K888AYguQ+S9wFfPEaxVgBZifcKi3VspwwOZtzh4COpUvZonpViZ3JC52mXYvao//JNx4Ooi9/rJbUaK2xxo5Xeyb61bv5hYx2eP8anvR8+8/hbV7QXKZNH+99dbLE6zdUJswkpiNl0Zcqe8dH4sEZa0JJFnajvbBS0SSoWQ+MLZpZVTEcQ4IB7cVPeyX3MRtHmt2RVro+Dn34nukiT17tL/zRNxCBZG1/bnHNzW2fORUX5tN2285W1ZjAo5wBQfr7xnfIoZconHo8vzlPPYtStaZ+imIYBbqOI3xMZGYYPtsjuZ+IxcDs/WlQ+5MuKaEG/PWHOXDv0oB8cBf+9FffE6Ab//5kvfsul5spCQ+i9GHLxcIBZejCWHOmte6Ix6sWkq0ayw5IChawfH3U3thIIFLVcwv7uDfcwvJVXC/GU1gVVLQtPVGWIE1J2WOU0hcf8msQDKkqiUbQ==; 5:4LRUH1+vczkZke5FvQLSx9+6YAY9EBsTnG0MgSXU/2TfCidV9CZ2UR3r5pW+iCmyhqd13rWi0LV2WHaEauJoYGE9VrKHCb9CNbLSZFklfjGg1+fNngY6BMx6YCm6yhMY72s2Lir9Mo3WoNEJca3H5TofvXE6bulA4jTrW88L2DA=; 24:QkJGcVmJV5ypt4ErPRm0qzrVYBaankHZdVvsLyJ9QTv3DxF1Iys9YJ+aq6aYv7Ddo1k1zC+EYB7IJlDF+Rfv+LLNZ/I4hVXdxVfKqTNfWhY= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; BL0PR12MB2449; 7:gdTEQ1OJdCMY/MNUBAOAQO0W+pSA4G2PGA5+oLDronTR3/S4VLesUvsVpsiciysXMIueBhqNLTO5hxwiwqNnp4tuy+wsArEoI4UgGG413NOUDg2Uqm8oRH2VKNi+JDPsR7QZ1QLW+Fb9XSJM3xEXoxnwiq53MZ5EOiylmRpu8aXd5oI1NQjc0hewLkpUuy0a/o3Byw9PQRDwY1Jppm81HIfnD/g/Vy/+HdCvL4AcP0iKyrlp7I90hXnyd0hvxF/E; 20:mFExJjdZG2G6ilU8XIWJ0yHc4ZhHcEHStqz4JIuH6XDiQQ48O5s/1xSG9ZadqYOcmr9dIWYP1YUQEBOfwTS1DX2kSxIoI5pfm3Ytq3qNCuYj10KLFqyeMYORuVN3R+ijfMHF/R6jNFopuCMFHhENsib2fumwu20tOQpUwOks1fdM8cpwD+PGd5DDPS6IOnoeXXCfM0IEWADoFzNdKXdeDJIZwvk84flBT/6VFVC1pV5P2SaoXJAUr+T+sXQ3lZc6 X-MS-Office365-Filtering-Correlation-Id: 913b1ee5-039b-46fe-566a-08d5c0f2cb42 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 May 2018 21:18:56.0669 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 913b1ee5-039b-46fe-566a-08d5c0f2cb42 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR12MB2449 X-Greylist: Sender passed SPF test, Sender IP whitelisted by DNSRBL, ACL 207 matched, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Wed, 23 May 2018 21:19:06 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Wed, 23 May 2018 21:19:06 +0000 (UTC) for IP:'104.47.32.58' DOMAIN:'mail-sn1nam01on0058.outbound.protection.outlook.com' HELO:'NAM01-SN1-obe.outbound.protection.outlook.com' FROM:'brijesh.singh@amd.com' RCPT:'' X-RedHat-Spam-Score: -0.021 (DKIM_SIGNED, DKIM_VALID, RCVD_IN_DNSWL_NONE, SPF_HELO_PASS, T_DKIMWL_WL_MED) 104.47.32.58 mail-sn1nam01on0058.outbound.protection.outlook.com 104.47.32.58 mail-sn1nam01on0058.outbound.protection.outlook.com X-Scanned-By: MIMEDefang 2.78 on 10.5.110.39 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-loop: libvir-list@redhat.com Cc: Tom Lendacky , Peter Krempa , Erik Skultety , Jon Grimm , Andrea Bolognani , Brijesh Singh , Borislav Petkov Subject: [libvirt] [PATCH v6 1/9] qemu: provide support to query the SEV capability X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Wed, 23 May 2018 21:19:33 +0000 (UTC) X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" QEMU version >=3D 2.12 provides support for launching an encrypted VMs on AMD x86 platform using Secure Encrypted Virtualization (SEV) feature. This patch adds support to query the SEV capability from the qemu. Signed-off-by: Brijesh Singh --- src/conf/domain_capabilities.h | 13 ++++ src/qemu/qemu_capabilities.c | 47 ++++++++++++++ src/qemu/qemu_capabilities.h | 4 ++ src/qemu/qemu_capspriv.h | 4 ++ src/qemu/qemu_monitor.c | 9 +++ src/qemu/qemu_monitor.h | 3 + src/qemu/qemu_monitor_json.c | 74 ++++++++++++++++++= ++++ src/qemu/qemu_monitor_json.h | 3 + .../caps_2.12.0.x86_64.replies | 10 +++ tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml | 3 +- 10 files changed, 169 insertions(+), 1 deletion(-) diff --git a/src/conf/domain_capabilities.h b/src/conf/domain_capabilities.h index 9b852e8649bf..c1093234ceb8 100644 --- a/src/conf/domain_capabilities.h +++ b/src/conf/domain_capabilities.h @@ -137,6 +137,19 @@ struct _virDomainCapsCPU { virDomainCapsCPUModelsPtr custom; }; =20 +/* + * SEV capabilities + */ +typedef struct _virSEVCapability virSEVCapability; +typedef virSEVCapability *virSEVCapabilityPtr; +struct _virSEVCapability { + char *pdh; + char *cert_chain; + unsigned int cbitpos; + unsigned int reduced_phys_bits; +}; + + struct _virDomainCaps { virObjectLockable parent; =20 diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 8a63db5f4f33..49b74f7e12c1 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -489,6 +489,7 @@ VIR_ENUM_IMPL(virQEMUCaps, QEMU_CAPS_LAST, "screendump_device", "hda-output", "blockdev-del", + "sev-guest", ); =20 =20 @@ -555,6 +556,8 @@ struct _virQEMUCaps { size_t ngicCapabilities; virGICCapability *gicCapabilities; =20 + virSEVCapability *sevCapabilities; + virQEMUCapsHostCPUData kvmCPU; virQEMUCapsHostCPUData tcgCPU; }; @@ -1121,6 +1124,7 @@ struct virQEMUCapsStringFlags virQEMUCapsObjectTypes[= ] =3D { { "virtual-css-bridge", QEMU_CAPS_CCW }, { "vfio-ccw", QEMU_CAPS_DEVICE_VFIO_CCW }, { "hda-output", QEMU_CAPS_HDA_OUTPUT }, + { "sev-guest", QEMU_CAPS_SEV_GUEST }, }; =20 static struct virQEMUCapsStringFlags virQEMUCapsDevicePropsVirtioBalloon[]= =3D { @@ -2050,6 +2054,28 @@ virQEMUCapsSetGICCapabilities(virQEMUCapsPtr qemuCap= s, } =20 =20 +void +virQEMUSevCapabilitiesFree(virSEVCapability *cap) +{ + if (!cap) + return; + + VIR_FREE(cap->pdh); + VIR_FREE(cap->cert_chain); + VIR_FREE(cap); +} + + +void +virQEMUCapsSetSEVCapabilities(virQEMUCapsPtr qemuCaps, + virSEVCapability *capabilities) +{ + virQEMUSevCapabilitiesFree(qemuCaps->sevCapabilities); + + qemuCaps->sevCapabilities =3D capabilities; +} + + static int virQEMUCapsProbeQMPCommands(virQEMUCapsPtr qemuCaps, qemuMonitorPtr mon) @@ -2580,6 +2606,21 @@ virQEMUCapsProbeQMPGICCapabilities(virQEMUCapsPtr qe= muCaps, } =20 =20 +static int +virQEMUCapsProbeQMPSEVCapabilities(virQEMUCapsPtr qemuCaps, + qemuMonitorPtr mon) +{ + virSEVCapability *caps =3D NULL; + + if (qemuMonitorGetSEVCapabilities(mon, &caps) < 0) + return -1; + + virQEMUCapsSetSEVCapabilities(qemuCaps, caps); + + return 0; +} + + bool virQEMUCapsCPUFilterFeatures(const char *name, void *opaque) @@ -3965,6 +4006,12 @@ virQEMUCapsInitQMPMonitor(virQEMUCapsPtr qemuCaps, virQEMUCapsClear(qemuCaps, QEMU_CAPS_DEVICE_VFIO_CCW); } =20 + /* Probe for SEV capabilities */ + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_GUEST)) { + if (virQEMUCapsProbeQMPSEVCapabilities(qemuCaps, mon) < 0) + virQEMUCapsClear(qemuCaps, QEMU_CAPS_SEV_GUEST); + } + ret =3D 0; cleanup: return ret; diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 3e120e64c0b4..8b7eef4359b7 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -473,6 +473,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for = syntax-check */ QEMU_CAPS_SCREENDUMP_DEVICE, /* screendump command accepts device & he= ad */ QEMU_CAPS_HDA_OUTPUT, /* -device hda-output */ QEMU_CAPS_BLOCKDEV_DEL, /* blockdev-del is supported */ + QEMU_CAPS_SEV_GUEST, /* -object sev-guest,... */ =20 QEMU_CAPS_LAST /* this must always be the last item */ } virQEMUCapsFlags; @@ -599,4 +600,7 @@ bool virQEMUCapsGuestIsNative(virArch host, bool virQEMUCapsCPUFilterFeatures(const char *name, void *opaque); =20 +void +virQEMUSevCapabilitiesFree(virSEVCapability *capabilities); + #endif /* __QEMU_CAPABILITIES_H__*/ diff --git a/src/qemu/qemu_capspriv.h b/src/qemu/qemu_capspriv.h index 0199501c931b..20b03876d470 100644 --- a/src/qemu/qemu_capspriv.h +++ b/src/qemu/qemu_capspriv.h @@ -85,6 +85,10 @@ virQEMUCapsSetGICCapabilities(virQEMUCapsPtr qemuCaps, virGICCapability *capabilities, size_t ncapabilities); =20 +void +virQEMUCapsSetSEVCapabilities(virQEMUCapsPtr qemuCaps, + virSEVCapability *capabilities); + int virQEMUCapsProbeQMPCPUDefinitions(virQEMUCapsPtr qemuCaps, qemuMonitorPtr mon, diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 43f1d2f81671..3b034930408c 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -3778,6 +3778,15 @@ qemuMonitorGetGICCapabilities(qemuMonitorPtr mon, return qemuMonitorJSONGetGICCapabilities(mon, capabilities); } =20 +int +qemuMonitorGetSEVCapabilities(qemuMonitorPtr mon, + virSEVCapability **capabilities) +{ + QEMU_CHECK_MONITOR(mon); + + return qemuMonitorJSONGetSEVCapabilities(mon, capabilities); +} + =20 int qemuMonitorNBDServerStart(qemuMonitorPtr mon, diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index c28db1a52b8b..b1b7ef09c929 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -710,6 +710,9 @@ int qemuMonitorSetMigrationCapabilities(qemuMonitorPtr = mon, int qemuMonitorGetGICCapabilities(qemuMonitorPtr mon, virGICCapability **capabilities); =20 +int qemuMonitorGetSEVCapabilities(qemuMonitorPtr mon, + virSEVCapability **capabilities); + typedef enum { QEMU_MONITOR_MIGRATE_BACKGROUND =3D 1 << 0, QEMU_MONITOR_MIGRATE_NON_SHARED_DISK =3D 1 << 1, /* migration with non-= shared storage with full disk copy */ diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 9f5c35879587..24d3a2ff412f 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -6436,6 +6436,80 @@ qemuMonitorJSONGetGICCapabilities(qemuMonitorPtr mon, return ret; } =20 +int +qemuMonitorJSONGetSEVCapabilities(qemuMonitorPtr mon, + virSEVCapability **capabilities) +{ + int ret =3D -1; + virJSONValuePtr cmd; + virJSONValuePtr reply =3D NULL; + virJSONValuePtr caps; + virSEVCapability *capability =3D NULL; + const char *pdh =3D NULL, *cert_chain =3D NULL; + int cbitpos, reduced_phys_bits; + + *capabilities =3D NULL; + + if (!(cmd =3D qemuMonitorJSONMakeCommand("query-sev-capabilities", + NULL))) + return -1; + + if (qemuMonitorJSONCommand(mon, cmd, &reply) < 0) + goto cleanup; + + + if (qemuMonitorJSONCheckError(cmd, reply) < 0) + goto cleanup; + + caps =3D virJSONValueObjectGetObject(reply, "return"); + + if (virJSONValueObjectGetNumberInt(caps, "cbitpos", &cbitpos) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("'cbitpos' field is missing")); + goto cleanup; + } + + if (virJSONValueObjectGetNumberInt(caps, "reduced-phys-bits", + &reduced_phys_bits) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("'reduced-phys-bits' field is missing")); + goto cleanup; + } + + if (!(pdh =3D virJSONValueObjectGetString(caps, "pdh"))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("'pdh' field is missing")); + goto cleanup; + } + + if (!(cert_chain =3D virJSONValueObjectGetString(caps, "cert-chain")))= { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("'cert-chain' field is missing")); + goto cleanup; + } + + if (VIR_ALLOC(capability) < 0) + goto cleanup; + + if (VIR_STRDUP(capability->pdh, pdh) < 0) + goto cleanup; + + if (VIR_STRDUP(capability->cert_chain, cert_chain) < 0) + goto cleanup; + + capability->cbitpos =3D cbitpos; + capability->reduced_phys_bits =3D reduced_phys_bits; + VIR_STEAL_PTR(*capabilities, capability); + ret =3D 0; + + cleanup: + virQEMUSevCapabilitiesFree(capability); + virJSONValueFree(cmd); + virJSONValueFree(reply); + + return ret; +} + static virJSONValuePtr qemuMonitorJSONBuildInetSocketAddress(const char *host, const char *port) diff --git a/src/qemu/qemu_monitor_json.h b/src/qemu/qemu_monitor_json.h index f4ac8319ac8a..129aab22bf98 100644 --- a/src/qemu/qemu_monitor_json.h +++ b/src/qemu/qemu_monitor_json.h @@ -152,6 +152,9 @@ int qemuMonitorJSONSetMigrationCapabilities(qemuMonitor= Ptr mon, int qemuMonitorJSONGetGICCapabilities(qemuMonitorPtr mon, virGICCapability **capabilities); =20 +int qemuMonitorJSONGetSEVCapabilities(qemuMonitorPtr mon, + virSEVCapability **capabilities); + int qemuMonitorJSONMigrate(qemuMonitorPtr mon, unsigned int flags, const char *uri); diff --git a/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.replies b/tests/= qemucapabilitiesdata/caps_2.12.0.x86_64.replies index c40046beef6b..ace35374ef96 100644 --- a/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.replies +++ b/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.replies @@ -18995,6 +18995,16 @@ "id": "libvirt-51" } =20 +{ + "return" : { + "reduced-phys-bits": 1, + "cbitpos": 47, + "cert-chain": "AQAAAAAOAAAAQAAAAAOAAAAQAAAAAOAAAAQAAAAAOAAAAQAAAAAOAAA", + "pdh": "AQAAAAAOAAAAQAAAAAOAAAAQAAAAAOAAAAQAAAAAOAAAAQAAAAAOAAAAQAAAAAO= AAA" + }, + "id": "libvirt-52" +} + { "return": { }, diff --git a/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml b/tests/qemu= capabilitiesdata/caps_2.12.0.x86_64.xml index 3c7dadffcd8a..58a1bf835a73 100644 --- a/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml @@ -204,9 +204,10 @@ + 2011090 0 - 390813 + 391059 v2.12.0-rc0 x86_64 --=20 2.14.3 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list From nobody Thu May 2 22:35:13 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1527110381568972.6828756879453; Wed, 23 May 2018 14:19:41 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx12.intmail.prod.int.phx2.redhat.com [10.5.11.27]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 8421530AA385; Wed, 23 May 2018 21:19:32 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 51CFF959CA; Wed, 23 May 2018 21:19:31 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id DC7FD18033F0; Wed, 23 May 2018 21:19:29 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx12.intmail.prod.int.phx2.redhat.com [10.5.11.27]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id w4NLJBWr028748 for ; Wed, 23 May 2018 17:19:11 -0400 Received: by smtp.corp.redhat.com (Postfix) id 0F3AA959C4; Wed, 23 May 2018 21:19:11 +0000 (UTC) Received: from mx1.redhat.com (ext-mx16.extmail.prod.ext.phx2.redhat.com [10.5.110.45]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 86F53959C0; Wed, 23 May 2018 21:19:07 +0000 (UTC) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0040.outbound.protection.outlook.com [104.47.36.40]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id F112730DCC20; Wed, 23 May 2018 21:19:05 +0000 (UTC) Received: from wsp141597wss.amd.com (165.204.78.1) by BL0PR12MB2449.namprd12.prod.outlook.com (2603:10b6:207:4d::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.797.11; Wed, 23 May 2018 21:18:57 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector1-amd-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=0ARNRrlpHq9GS6oRZnuSEOHztOwXgXzWOxENbJkl/9k=; b=GkJdpbXXsTnpO9DZ4mq7/UWSkDbQjcUKEc+9eYIR+zhzdfUALrr+VDgsI+oG6FOJmVbiehRbA35jb7aCbioYIesefy459E4Gb6b2FVyUtkLOsWUxslj27SoO1bk1Fin0JTJqI474K6V0IuvXuaOMY2RytXOEQryvMb/vCNlW7O8= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: libvir-list@redhat.com Date: Wed, 23 May 2018 16:18:27 -0500 Message-Id: <20180523211834.15817-3-brijesh.singh@amd.com> In-Reply-To: <20180523211834.15817-1-brijesh.singh@amd.com> References: <20180523211834.15817-1-brijesh.singh@amd.com> MIME-Version: 1.0 X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: SN2PR01CA0050.prod.exchangelabs.com (2603:10b6:800::18) To BL0PR12MB2449.namprd12.prod.outlook.com (2603:10b6:207:4d::31) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:BL0PR12MB2449; X-Microsoft-Exchange-Diagnostics: 1; BL0PR12MB2449; 3:9punBNHMtE6HW+TyccH9wlJ78+3TFtSP1+THcYERfuDLqkDSq4Ia5IUET1dVrcKt5I+1Cju2ys/Ot3Ou0BJITDBvyYisQ8cphtIp70kNryWNJdfSbXIYuKNMI0wUL1bgNNDW1FxTzya7NKxT/pV7oltLCh1iPWSaDwNxfDdvFXyFTBDN14MaoPf/cyuWWhb80SkDpbm9Up+WnAclP37KemZqcnFtSSflArMJFNWQgpL6CNtlRCgye7sK6iu6+Kyz; 25:REEFE35yoUoxx7+I4THFwg5hvGPAOZaRqGwF7bP6ZafvNOjww9wpow/mT7rIOZGe/bXwXCYG9VXlkG2OYfJ5ID68Hb7BM4Qj9lMBKtZ+QN6eCTDQHdVbf54CyE10qAqPz0AuLnJXBQ6x/9yjY+HPz3OJWIVSPRCAEnAJg9W9ON0dqRemGC3wEXKkdFI4E9Y0ERyiB0rx9N5I/iwdAOUDseBELWQgreSvYdW9dyH96A6cXKyXLNwWS9QyhK/wiZZW+s8CBbD+NOdkk66gQTGk8qOdIWeAtPnzipSUStNRCJRXv8edPV7PfDHOA6nKpYm/A+B0n67M2c15Vel47FSdeA==; 31:R0vbhPVy6AJx4R5MOajb1agSZ75qS/dlA88tkyQvs3mlIBosIT9QrRMQLlXaIsdt49wY20rZ/apo3oYNLjENLoT4BKjfaKKbJpPWGx8QVU7a2FrorZ2tluWTBo4lwJ/xxwATJXtVxOadTEIIWkhmX4ZbE8H0m9WKl08jYrlue+0H6ExR0udje4goSD6JesOsDYs0Xy6qx68F2tx47nWJDFrIXvfTiCSagmOnAwbqvLo= X-MS-TrafficTypeDiagnostic: BL0PR12MB2449: X-Microsoft-Exchange-Diagnostics: 1; BL0PR12MB2449; 20:q6KUDl8P9WHKA7+f7UUx9EgUz8q9stmU0EnNuytpIb5QHYwvG2cgOKeDN+vChtAqH52NuRucsw1T1JyoIu1X1VrBzplJZLEn1YCKqgbEJVhcLNWhyDJ/K+B6RcWSlQbShmn3a/3GtMzUx8bYNUigj1KWhUYYHbImLc0TM9GrUTaPFcJdHdcyLWaiOugzfnoRyygUpyf6Gx3Jr6vo0uxrSAkNuxrahCKhXON3Q2MLXWq0sKfXvTp0t5r3vodKbgwPHAOwszPBslydodcjyinXiwW/lTACicq1vgTqck4Q+MVCTfJCyq6W91CLft4OMHVsIZSSYezW/KT8N278mih93AbNzWBHpI2qK31klKcquWNX799IgxjLEMZYs5Fi7EeHSnVBekqzwBuY3+wMyqbg7pg6JXffbW8p4kHanTM/Dn+05YOy8zp2tYHqdQTYZwbHwqJ+UqSrJmqH0Sda+7ViBIEFJp00j7xJBLdXn5pbo3v9V9HqVsU/pmkN6IyMP6Tq; 4:ZNRWhJyposbQvGcg64hytSBQAZ66kdGXFqGMlbrX+LggrdMATTf7QctESsj5xrvZWXLZlJ5UPQ38WaLEawZXprSLLgLSZ5tZYPwymsu4ITHo14CIauXUSwy3Ous2ZUuINxeFwboOx8DsW1INcHnnZKJ77EAituFiEnauMnz3o4uGlmq4f1pbAQogdOumCC+LFcE+7NFrxE/F3NIiMMtYRZ9V4rY81puVuEyutdU1QGUathLNhzlAR/J+vhY7QXOOw3GXvRPuecXrbS55OsJzX4dTsto4QeDGJ27/BKf1EN9s/pCKqvGW08xpNhbHsCPweHPd4MFUNG/VCsR82si53A== X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(20558992708506)(767451399110); X-MS-Exchange-SenderADCheck: 1 X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(10201501046)(93006095)(93001095)(3002001)(3231254)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123560045)(20161123558120)(6072148)(201708071742011)(7699016); SRVR:BL0PR12MB2449; BCL:0; PCL:0; RULEID:; SRVR:BL0PR12MB2449; X-Forefront-PRVS: 06818431B9 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(346002)(376002)(396003)(366004)(39380400002)(39860400002)(199004)(189003)(956004)(6116002)(53936002)(1076002)(3846002)(4326008)(2616005)(6306002)(236005)(36756003)(446003)(97736004)(11346002)(5660300001)(66066001)(16526019)(47776003)(186003)(6916009)(6666003)(44832011)(6486002)(86362001)(575784001)(16586007)(2351001)(26005)(478600001)(298455003)(59450400001)(2906002)(76176011)(2361001)(51416003)(68736007)(50466002)(606006)(25786009)(476003)(52116002)(7696005)(54906003)(48376002)(7736002)(106356001)(386003)(316002)(53416004)(486006)(81166006)(81156014)(8676002)(105586002)(50226002)(8936002); DIR:OUT; SFP:1101; SCL:1; SRVR:BL0PR12MB2449; H:wsp141597wss.amd.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BL0PR12MB2449; 23:3wClUijBX7u8xwukybdCat3WtLczeuS1SLTAlZD8Q?= =?us-ascii?Q?yM4h+p2OkQYJ/LUcQOaWaJSuXuG14xmsxTmI0jnMHqDq7x3Ymdl16SA+4PUE?= =?us-ascii?Q?/aPHYjrvndW9YSnkHf2vUNkCVV/lvrrX9nqAT6iO2wdvJNzyyhqja6NXG+L4?= =?us-ascii?Q?0KBs4V3/eUKc9mx4n63KTr5BZvV41vdyjSWoM/2tIZxDx32s+FuoDhF0uUCP?= =?us-ascii?Q?jVIbKmKyIZzwDt3iE/ykmO/QlIjzSzXlPjvVxMSXKuFUtVLmJzi7xcXhpxes?= =?us-ascii?Q?A5qnOllKFiNPNQVWI91KgZ7QaSVhaewdxT36iZGVhiy2q1g2Q1QA+aoxrUSZ?= =?us-ascii?Q?TfDQA5f2oLqi3jSBkLGvwBtM7MQ/RGHXxtJUWwSPl/yr72/J89I+ETP4gCx3?= =?us-ascii?Q?izbi6eG8BIM5jHRuJVIZAjjtYj06/AbFnqLbVR2akhECg/55CF8nC6EJsufn?= =?us-ascii?Q?eOJzYusY7LIQL5dvL2by1k0cdxDSWOvSHRJuIAsKElJbhy3YqezyLxvaAjhx?= =?us-ascii?Q?Ir/6ausqiDd8x2pIO+ym89/LRl6s9Y0UeJBYvGsgxRTfemne57ug08gqmWOL?= =?us-ascii?Q?fusn5fnM0E3tiij70AUmpTKRD8QVnWOc6XvggcWR94plkyl0koLv6LcCaJ8f?= =?us-ascii?Q?EWHwrS0eqqZTuQYMg9hWioAVcltbLvRptWg5gSmkR0leQzs4sxTt97dSGAKo?= =?us-ascii?Q?jtrcpncVsmR1X4Qt9cuvPfsHL9Y0RwY8ZewQMNtkP73lDs1A/4A1lt/EobBr?= =?us-ascii?Q?zxU/rR1aYujjX/MBR/+kupD42Fi4GRk/lIrJiusajKxZnYtmKS9KgiYYQUC3?= =?us-ascii?Q?SoM6uPwVCGpArcA+NquxisexsHLcsOJFKSIfuaTzhWSPbTAk6JoTcAo3JVU6?= =?us-ascii?Q?OM+1RVuRRHWaznEe7nQ8xcAgc65kiz8Z6gJv8ufagsvm/vAn0S18rO3lEIC6?= =?us-ascii?Q?TrjLK2sGqLtyG28A1vHZ8qNrtXWgZV78qM/AIu7c2eL71sz7NOZOv1aXeta2?= =?us-ascii?Q?eyF8TKZWEVhx5L9ROJ7y8LW9IWNYeG+HMPVP0A1u8qCSiQdehhKlJOdQOCiS?= =?us-ascii?Q?WeQfkmxI6aycRaj32CWtGo4ljZhzc5xV4jH+DK31VqLs+jXHZuiaYAoDBPWw?= =?us-ascii?Q?CqXqw5RgvnOzloylLqE+kTx96jnT95Gc7aP2AloDNemDiupbSpv8vUrt2HbL?= =?us-ascii?Q?Dhulry2flETHxSLtGVvDvv2VD4f6AuG05cWkp7olei8/1J0q7wp7/2qn1BX4?= =?us-ascii?Q?0E31wGW7J5WN1cHZOzr8r6SwgPsjMsTR5sEeR0apKqtF7Pwpn4E+dR3hjWpx?= =?us-ascii?Q?mC6NIn3VUWFH2T67TmWgWHscSEOeXXfzcAUdU4o9IObFxgSnPAu24p6lzyKS?= =?us-ascii?Q?3I0cgJU3R3t0nakYmssdGYXFXg=3D?= X-Microsoft-Antispam-Message-Info: S0qn3zRKotkup5t7HE6pEqhJZ+bSVO65uV1OBld9qxG4r/ZEv33ZPcJte8Z7HI/rGaijxKpX3uKy39CnGq/LiffHFj8r0pFaAOjDpekQWUU6LXee4/JAEKjVyAfux9lF1xncshgRK60dlN2ozmTeY6RkTRvlz6fVBm9O6hOWeaf/G5L4200CRjub8jCh7QwI X-Microsoft-Exchange-Diagnostics: 1; BL0PR12MB2449; 6:twkWzUDdu0dJ+IGdM+jVpPP5CqLaw/aekU/LipgbHyOZ9USm7CAEaoHv0FjOyCgoC40ek84Zv4rFIVZNHIZcQYM9KFBsywdWEmkJWv3d4wqWYk+/rxeb9Jqf5FsPuEti/IUNl6w4zmtIsKwlD1+8EBDwEjdcLjxV/1M/rE/5+VQ5beYK6NzUGPgEmP9Zx0UX7OFDGTWYaUO/M9gVa04Wwkim2XMZQVLJF9ScviamPnaSPIRm1lgswWCfAy6QGQloUIIOlN4MTAmKueU4KDElmQGBYGjCNkBHlqoQY/jI1kLR1DE5hBds/Q5OYRUKpfxWApOnRmQnZ/uihYNQYeTPx+lZeuLwZNndbboVfmXqhuvt68Hjkzy63QvWt0iuT5Ssm9xRzp3PI3+yLzx0KuZL2eAIV5oRdd752TC1AjlM6qNeaoiZ1rn8N/wtY6YxWXC40lQ8WrZN9St02LZ9GzVIAg==; 5:kA7dmauvy4iUBY2vaa+0HAUtx1TR9evCwvHRFRLpI3Glmh5nVVhCU+cWLUMM+8L4aICHZS1qMK5dMw+pWx4KWqsbkSU2uNac5TlCBQZbIm2Z32a5uY6UDxAf9/RpwZm64ugBpmrBcnrMMxiTIdherumpLaSMIu0TsFMwQA4ii1s=; 24:VEVPgEgO3CvqqMz/DDUGzB88olyCQeH1duxr1BVC38PnW1APUaXc1c+fIfQ7eqFxoOg66m9pPDkH0Y713PIha1F4wz1YVEooIJIbIqIRL6A= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; BL0PR12MB2449; 7:bC4gg/95iBLlOfLBBw0wJ1yFesfC6+8SaZPv0LNobpq263f2HDJCeMxE3V/CwNWdcngVi1vSA/w+TXrhdAy/MX75+g92Y16VfnYVCsQJybWqpMZXv8n8QvORvpHa9+0lrNIdQIdB5mrKmigzQeM0Chf7c/DMF/wQDwXo0/1aj127ecmtqarqQIbPy0CW9c8Z/7gEiLFxMkVFwWYW+QyY5G07N3rDZ4XUIqVrl0KL4gb1LRlyredqJUSUsr6pySML; 20:xBwFstBld2wEiz/9H/kdka4DHkYKFZcHxgdDzot4m24tmQNw8zHtKi0cVM+Mg/g2kYL8wLFBnF/9AtW+8pvozl0gSTq9JhR6D4H33V6pEnd8bIq6o7DCSlbEWHer4/T+R4sAcxbw2+KbWVfwazly32Nx5r0iHw0zb8LjGgM4H7bfI1kbW3exc87JqTCHLc2zgkizfA9ajE1nHe+hRl7aEUkh4Ohp27HE7npog//PEvAIZuy9Fewas1IxBxH2eV0z X-MS-Office365-Filtering-Correlation-Id: 6f873e8f-3606-410c-d760-08d5c0f2cbd5 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 May 2018 21:18:57.0286 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 6f873e8f-3606-410c-d760-08d5c0f2cbd5 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR12MB2449 X-Greylist: Sender passed SPF test, Sender IP whitelisted by DNSRBL, ACL 207 matched, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.45]); Wed, 23 May 2018 21:19:06 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.45]); Wed, 23 May 2018 21:19:06 +0000 (UTC) for IP:'104.47.36.40' DOMAIN:'mail-sn1nam02on0040.outbound.protection.outlook.com' HELO:'NAM02-SN1-obe.outbound.protection.outlook.com' FROM:'brijesh.singh@amd.com' RCPT:'' X-RedHat-Spam-Score: -1.031 (DKIM_SIGNED, DKIM_VALID, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H5, RCVD_IN_MSPIKE_WL, SPF_HELO_PASS, T_DKIMWL_WL_MED) 104.47.36.40 mail-sn1nam02on0040.outbound.protection.outlook.com 104.47.36.40 mail-sn1nam02on0040.outbound.protection.outlook.com X-Scanned-By: MIMEDefang 2.84 on 10.5.110.45 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.27 X-loop: libvir-list@redhat.com Cc: Tom Lendacky , Peter Krempa , Erik Skultety , Jon Grimm , Andrea Bolognani , Brijesh Singh , Borislav Petkov Subject: [libvirt] [PATCH v6 2/9] qemu: introduce SEV feature in hypervisor capabilities X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.27 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.40]); Wed, 23 May 2018 21:19:40 +0000 (UTC) X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Extend hypervisor capabilities to include sev feature. When available, hypervisor supports launching an encrypted VM on AMD platform. The sev feature tag provides additional details like Platform Diffie-Hellman (PDH) key and certificate chain which can be used by the guest owner to establish a cryptographic session with the SEV firmware to negotiate keys used for attestation or to provide secret during launch. Signed-off-by: Brijesh Singh --- docs/formatdomaincaps.html.in | 40 ++++++++++++++++++++++++++++++++++++++= ++ docs/schemas/domaincaps.rng | 20 ++++++++++++++++++++ src/conf/domain_capabilities.c | 20 ++++++++++++++++++++ src/conf/domain_capabilities.h | 1 + src/qemu/qemu_capabilities.c | 2 ++ 5 files changed, 83 insertions(+) diff --git a/docs/formatdomaincaps.html.in b/docs/formatdomaincaps.html.in index b68ae4b4f1f3..f37b059ba6b1 100644 --- a/docs/formatdomaincaps.html.in +++ b/docs/formatdomaincaps.html.in @@ -434,6 +434,12 @@ </enum> </gic> <vmcoreinfo supported=3D'yes'/> + <sev> + <pdh>UWxKSlNrVlRTRk5KVGtkSVFVMUU=3D</pdh> + <cert-chain>VVd4S1NsTnJWbFJUUms1S1ZHdGtTVkZWTVVVPQ=3D=3D</c= ert-chain> + <cbitpos>47</cbitpos> + <reduced-phys-bits>1</reduced-phys-bits> + </sev> </features> </domainCapabilities> @@ -462,5 +468,39 @@ =20

Reports whether the vmcoreinfo feature can be enabled

=20 +

SEV capabilities

+ +

AMD Secure Encrypted Virtualization (SEV) capabilities are exposed = under + the sev element. + SEV is an extension to the AMD-V architecture which supports running + virtual machines (VMs) under the control of a hypervisor. When support= ed, + guest owner can create a VM whose memory contents will be transparently + encrypted with a key unique to that VM.

+ +

+ For more details on SEV feature see: + + SEV API spec and \n"); + virBufferAdjustIndent(buf, 2); + virBufferAsprintf(buf, "%d\n", sev->cbitpos); + virBufferAsprintf(buf, "%d\n", + sev->reduced_phys_bits); + virBufferEscapeString(buf, "%s\n", sev->pdh); + virBufferEscapeString(buf, "%s\n", + sev->cert_chain); + virBufferAdjustIndent(buf, -2); + virBufferAddLit(buf, "\n"); +} + =20 char * virDomainCapsFormat(virDomainCapsPtr const caps) @@ -585,6 +604,7 @@ virDomainCapsFormat(virDomainCapsPtr const caps) virDomainCapsFeatureGICFormat(&buf, &caps->gic); virBufferAsprintf(&buf, "\n", caps->vmcoreinfo ? "yes" : "no"); + virDomainCapsFeatureSEVFormat(&buf, caps->sev); =20 virBufferAdjustIndent(&buf, -2); virBufferAddLit(&buf, "\n"); diff --git a/src/conf/domain_capabilities.h b/src/conf/domain_capabilities.h index c1093234ceb8..e33bef525ef4 100644 --- a/src/conf/domain_capabilities.h +++ b/src/conf/domain_capabilities.h @@ -172,6 +172,7 @@ struct _virDomainCaps { =20 virDomainCapsFeatureGIC gic; bool vmcoreinfo; + virSEVCapabilityPtr sev; /* add new domain features here */ }; =20 diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 49b74f7e12c1..3345b09fa384 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -4998,6 +4998,8 @@ virQEMUCapsFillDomainCaps(virCapsPtr caps, virQEMUCapsFillDomainDeviceHostdevCaps(qemuCaps, hostdev) < 0 || virQEMUCapsFillDomainFeatureGICCaps(qemuCaps, domCaps) < 0) return -1; + + domCaps->sev =3D qemuCaps->sevCapabilities; return 0; } =20 --=20 2.14.3 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list From nobody Thu May 2 22:35:13 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1527110379173176.21833974579852; Wed, 23 May 2018 14:19:39 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 77CCE3003988; Wed, 23 May 2018 21:19:37 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 404EB60BEB; Wed, 23 May 2018 21:19:37 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id EB69A4CA89; Wed, 23 May 2018 21:19:36 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id w4NLJDKF028766 for ; Wed, 23 May 2018 17:19:13 -0400 Received: by smtp.corp.redhat.com (Postfix) id B8D33619FF; Wed, 23 May 2018 21:19:13 +0000 (UTC) Received: from mx1.redhat.com (ext-mx16.extmail.prod.ext.phx2.redhat.com [10.5.110.45]) by smtp.corp.redhat.com (Postfix) with ESMTPS id E768760BEB; Wed, 23 May 2018 21:19:09 +0000 (UTC) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0040.outbound.protection.outlook.com [104.47.36.40]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 9414A3082A32; Wed, 23 May 2018 21:19:07 +0000 (UTC) Received: from wsp141597wss.amd.com (165.204.78.1) by BL0PR12MB2449.namprd12.prod.outlook.com (2603:10b6:207:4d::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.797.11; Wed, 23 May 2018 21:18:58 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector1-amd-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jJOyCUB9O0HdZbHQxCOS+1TBUJ/4gDz9bfQPNLTuSjI=; b=zZbcd5EgJ5UjCFAr3Ty4no57vDFF5u/EyF6YlCtPfBwIFrhuUZNMYX2CF6SWW4oFkxFkKahm1GQ5D4QYE2gcNKTwG1iELU7Har5KUfRk7jNCtAvH0XnQdPgNEwtw6Hzn2eyTvypXMmrA/Ckup6TKdH847WRA/yJToxVS74EC7UQ= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: libvir-list@redhat.com Date: Wed, 23 May 2018 16:18:28 -0500 Message-Id: <20180523211834.15817-4-brijesh.singh@amd.com> In-Reply-To: <20180523211834.15817-1-brijesh.singh@amd.com> References: <20180523211834.15817-1-brijesh.singh@amd.com> MIME-Version: 1.0 X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: SN2PR01CA0050.prod.exchangelabs.com (2603:10b6:800::18) To BL0PR12MB2449.namprd12.prod.outlook.com (2603:10b6:207:4d::31) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:BL0PR12MB2449; X-Microsoft-Exchange-Diagnostics: 1; BL0PR12MB2449; 3:F447o+M5MCw+vLOjUjdx95au9wsL5IHgi/dK4FJh9wz2+C6zZZOwaM9n1bdSZBohvMMAkSdl7fJ27dMffDHaqcxH/1HrwWhIEfPs7HK2G2YGMSJjnU+UjHjGZmbMYvbn0Np5x2X+XC1WXAhdsceSOPlDGQAbZwHOonoqK5sEbfG09udtfglXmhkuCTL2KDrzjJlYEFQc6kuFSvpo9A5QUNh1qyJerzqW9EPWmNunUEVIbIR/YNN4CRx4dm4bMWkD; 25:U+0caRSgtNXoO+33TaYLKs1riX0DuySVBGqRfE0BTVG4xjC8ykIBV2TUfeo0wd3gOmM+fbIrSHzNSGNPjcNxGxLF6QLDXgTG6f5SaQHDpQo+32fM4mwg1earU0tmmdtBcyBqVuLIf2nQZHfgDfn54xp96M/D+8gouOCuBZKYj6IcQ1Imy43qCnmbEAR7ujilufB59cg++jPTGeRY3o0w6lOBZGT78bnWM8FIoWsHP4mJT/8bcdJ3nWNIdj1vuJUZmpkY4CEE+leWAhlVFwh/gP+EYFjFTf++zc4/bqVewg213ixX2pBhDobXO8NkZNlPZympUS0bEoOP+M0zotsytw==; 31:m4/85NjagLu17UCPWqWRmX/gf25si8YynSYgpItUX2hAbYumZHIqu5L42HEu1oD6wZVwzwLvMnIGOvguxxKzxv63p7zNC+V6om/mMG2HZ55wN0FjSR1NKWHXNVI3AyAfSk7OSGo1EJoQHCcVHEXY443Dn84M//1QhIH51FRtuJXk1IsQFk6h3rGZCduKf0C5jeugPM+kc9AWszGtgrOHk4d1P8mtFjPBFFPOw+n7oZ4= X-MS-TrafficTypeDiagnostic: BL0PR12MB2449: X-Microsoft-Exchange-Diagnostics: 1; BL0PR12MB2449; 20:AdLWzKcHMVUzSotkbrMLEHfKyWouK15S9auhTCVOmJ8uw8t7CygxYT1uHAM/O9VII4i322+5jqQWBd8vm87773VosZu/GMgr3VoVsgKMjHEa7/FYAnIwUESyBTF1YwYq6Rv5uy+7/nK77bxG2YAINwway93itTip9wwGGsBB7vMA65rMXXXHDAdr9lBGgs/khErbGA9Ve4CubbFI2MtgRjGLS9vKgmv+bTHil4nH4MnT94sF+vKWcGBo9oVyzqIvnudRcTwQCwiHUcn2G5wR8scBU1lnm91MHNPJPzHwFw2Q/TBB4U7agkCnxAqo48SfeXv9MxnOK9xi4JdTomSnQApn3m0LZjMZ9etLOJM9csUbOppOab+QkuWuP2lUbILwdAO5WVeyaxzOeTrqzawmnKdreFfXUc7GrA5CN5hud6bCobQquZzLOLQ8o2Ffo/dY/K/U5pFYMtS/nu+hIjeeaeXvIymP9Evyza1z15SN1hwZ/7fybwgWnd1426tSuhk9; 4:FAN8tK1jVeLFsDD1C7RrYC4TiDVPdsq0H1mnn7TzHiPagkr94u2ydT8kO4D1e4Vvyr383cqUyOJ42Ke66TymZZiTFfLADAQ0+RfsNN0w3f1Z2qoJg2qLVV1wPuOglWawTr58v+Rl0eVbo4M56bze3I/VrkNFKeP3tFpYc25PFODYxNjHN5XVnnvShLW+VEa7VJUNg5B7k4ANIGPtA+sCvbniatP7+oogCUXHdZyrKk5nhu7NfsrLL5U0aLOCo3B8b1F2lfNwAaPwZnIZeSafbG7qQIQbo6PolEIfXWpCsdzz3gHjBSIImgBnPHrcv0N/DOB3oBYhuenD7Gv5PJM0XA== X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705)(767451399110); X-MS-Exchange-SenderADCheck: 1 X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(10201501046)(93006095)(93001095)(3002001)(3231254)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123560045)(20161123558120)(6072148)(201708071742011)(7699016); SRVR:BL0PR12MB2449; BCL:0; PCL:0; RULEID:; SRVR:BL0PR12MB2449; X-Forefront-PRVS: 06818431B9 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(346002)(376002)(396003)(366004)(39380400002)(39860400002)(15404003)(199004)(189003)(956004)(6116002)(53936002)(1076002)(3846002)(4326008)(2616005)(6306002)(236005)(36756003)(446003)(97736004)(11346002)(5660300001)(66066001)(16526019)(15650500001)(47776003)(186003)(6916009)(6666003)(44832011)(6486002)(86362001)(575784001)(16586007)(2351001)(26005)(478600001)(59450400001)(2906002)(76176011)(2361001)(51416003)(68736007)(50466002)(966005)(606006)(25786009)(476003)(52116002)(7696005)(54906003)(48376002)(7736002)(305945005)(106356001)(386003)(316002)(53416004)(486006)(81166006)(81156014)(8676002)(105586002)(50226002)(8936002)(44824005)(19607625011); DIR:OUT; SFP:1101; SCL:1; SRVR:BL0PR12MB2449; H:wsp141597wss.amd.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BL0PR12MB2449; 23:ddGUpQvDymWQq0G9z/5s4lFCREEvUWGuDstDJ9sbe?= =?us-ascii?Q?nPcVLJOKaf3rDorO3G1KINlfxr8RL1sqzy5VzxqFHWnxiESnTaPjYNvnwqpE?= =?us-ascii?Q?ehBJduq7hL63rkxoxzU+QHN5ODfryKT5TbGLNDiYaoSkAzWP3pR+Daf/UEWm?= =?us-ascii?Q?LuXSH/eLHGAj+0ZH6vDqz/H0qaexjBnu3Kcml749s6UHvOg4YKnqBIgVZLlV?= =?us-ascii?Q?0WGr0pY6kKSZJzcFYaou3Y2S3SUg6Zp3zG1MF9ENjGDzARCOFEB75yH77Nbq?= =?us-ascii?Q?vQK9UhtlnbOZ/9x5XIkea/sFhp/Tu+rcrkqKPxTFKN0RpKSwMXssKNixBbZx?= =?us-ascii?Q?wonSEecJ0NMG/5TQYQrwqUsD/WDAIhuWNSf9ncnLZlTMGpgzVKSMvJ5dsXGH?= =?us-ascii?Q?aWxFzgJfTb5TM5wgA1p9zWum5FNrILMxPelOxcw14mQ8mIRh03PXlh1KYZMq?= =?us-ascii?Q?f8nDZTH34JCaZysYQiD2+cQD0vBX5Z15qKFFhBDqAVLZDTNW/EenvTZ3GI5E?= =?us-ascii?Q?qj0YkWzNWxK3Ktx3qe0UGtvFuUfa+/AP0glDKjdGoE2RZs+MHSjq640XzvkY?= =?us-ascii?Q?iyvzw2hje3HznKiithntMbVI6xHQpaA4PRdk0hGUFubb6GcRNTEupB0FQhg5?= =?us-ascii?Q?AMye94B9mddnWXuOSrU/cMdmlkqgpHGUqZW+VVb1lPJU5bcf6w988YidIYSv?= =?us-ascii?Q?iYlOizshJ+9e+rGzZzWbqnNOZulAJBedbIezwMBQBMr0QUAGJDHIyZWzTPvp?= =?us-ascii?Q?CLgQoM+ihlvJysPUeNU1xCdCKbiDfoDuNsMeaHIVIRWIRB5bgZYFC0yW6UAV?= =?us-ascii?Q?IIPk3zmHRg2I5dZWdCTFwua+/7APZP7Th2FR2IuL/laEfIRSPv7R2rCtWFbR?= =?us-ascii?Q?eWZAYzVYulNt9W4OxYctPF/kaOFbWq4Pt5UPbc3gO08RWTTEr+4KQZc3ZHRb?= =?us-ascii?Q?v3fQZC4q8FVSDALNhxeSK1eLXXHjcjbW/Kv+YLUZHJghX0TxWq2PBB8w2aem?= =?us-ascii?Q?L8cxT1Dck96y1RrqAu4nVGas3vMHL/dehxvEZHOisZtKYIkGo5+pzx7PQVZz?= =?us-ascii?Q?cq0L1kxbtyyTmDJyQ08wHCr7DDj6F0kG3UpnV6+Rn7Fhwcc8z0fFS+BRNHKi?= =?us-ascii?Q?CzXJVNskJUXaPX2wePPFsyHycJ2gHcurWFuU2Lrbk5zI3zDkx3NzIdAc2UEm?= =?us-ascii?Q?PVzGHOdA14Jw3BtIl3xn+TUBfyKrFrXrz4qieF5yE1SV3KpYo3yB3AyL6IrP?= =?us-ascii?Q?r4oB1fkfSzai+xdjXwgelzn7aqXS6pKq1FRTXVLQVQPik1SfCWjmP8jVMpO6?= =?us-ascii?Q?SAehyWJB3vJ1WvsDv5xNk1wdDyS2dmhP/LTI7TaHebaCc5urrDNkCMneCnr6?= =?us-ascii?Q?wVZmU+bztigBFO9QcHHa6/XcLHvjfkW1nilgfhHdq1WmTekfJrQ98AuKeFex?= =?us-ascii?Q?A3et9ggNTQlx+thjje01jLRGCoIRglRqQ2PK2CfzkMdl2bDuJEXu8bOYPPKI?= =?us-ascii?Q?3s0EbFfx6O2mg=3D=3D?= X-Microsoft-Antispam-Message-Info: HWFQZpsksjjSO/tf7PltFt83eDRpqMLMclmFjkFcMRLNpm7Hk9xHOavyx/WAEtvC+NO2KOHt+bq1m4tMZ3F8DTGcJ2H2fKjXMT0V7fea78+GoXO0MgJvSX3aI6R5vLbq5jxdBKC6a5Q6XY7HdnsRnS7x7xHHGPGHtRBDzezwopE1h4sj8uBhYdgftuAvpmrI X-Microsoft-Exchange-Diagnostics: 1; BL0PR12MB2449; 6:KMQ3Td34hnrj4X5yOSYGiTptqVbYUOqwgvS7a1by/dPMUIpimRrGALcqCeeolplqHAGjeMag1V6q9ajidhtEiAdVycn2OjmjOUTxhYd50+7sot7hM2vNdPfbh4WP8Onq6INwGXcHkeV+1DBBRzazFumHAR8n+IKDTKpat6OCHxa6xheAzhgK6DlyhDeJsu+qhs7xXpe6fu9Tc8aWZFjgQRdZNy1MVrC396ro7+2RugQXTCpzKpeZl44LrYBir86zOeeOsTP5nH6RTL5T37pQef81ID22eQ3ERtd/tnRDYMqXD6djCu55h3xyDPFGoTjSSo2zDH1E6A003QYYbjLnl70q71L9ekal3bBAK8XtGDzsJaTY40HAv7PjmfX1yZlr1sOyUltWDhVGR5/55ZQKTCqxJ4IYKwZ+ceDfs2egcMVFwFqB1ti7A2qcCSei0g9EVYjh0olkxk/2stZ5kUQsRw==; 5:ReBjkUVy5MeG9+9Hqh2VhIeJzFO5S6sy0QkuLSQMxEdHPXRsW8TXZLZm+uXPP8zNdRfckl4EYBkwsDFZIBlPiUDM08aCXhiNDpuLmF93Fz9bbq9kduHbFftHUW5TnwL0+W5tv7XAIsevZnXP9gOdLZWy4TIH4jStWCoPWMV/He0=; 24:oqn4Hl+mtCaFsCwRmH6TayLl967wmm1r3T9sVpPeRGkDQCoEZic21ZMDMn9Wnkxh7MVKlh8FPHSArL+cB6bUuJxIqLHI3rKtbKLixGtGsqU= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; BL0PR12MB2449; 7:oEMJNZt5tUOprybzLfgne7eH7BM4DWsRi4wYF7MkbVqTB5sjwpNmiCsHdCO503BIJKwPMmcIToAhXHIzAu9v9+nAlOCqnh6/ygmkgsFROwbxcb9ZvAW3IPdXNHHnJo6yK1xC7EpGlcu8oTqmWF9Cdl3POTbIXAEdf20/7IO19hwbe7GWeZWFdecgPly3znbhrQ7pd7ZIBNEVgPajwESsrcPXDN/Ee9Q96EicHz5haVKu09HW7C1cbBUuiTsb4SPl; 20:o7po/x92rPx3Xl4+LD5Y/UJ2T1ljrDwXHAo9G9salcGkg2xzSqlAYU9GmD6eaeMzDsuL4L7o8QuEo0wTUKw/YoOeka2UjJ+qAnEnx3PSPw/O8nYK7IPUF2gypGQc5/a1SCNH8ZjX+d6N2f/X/7yh2hhYfXFtQUAn6j948EnRD29LqqbC1QOlLmkHg3JpPJkdLkBj3CT/hVmDFOwZfTk8GXQrTP1tZKFBoXxWmairwGMGEQBFl18fKbufuaffVQYe X-MS-Office365-Filtering-Correlation-Id: 83eec2e8-b42f-40ad-66ed-08d5c0f2cc80 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 May 2018 21:18:58.1574 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 83eec2e8-b42f-40ad-66ed-08d5c0f2cc80 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR12MB2449 X-Greylist: Sender passed SPF test, Sender IP whitelisted by DNSRBL, ACL 207 matched, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.45]); Wed, 23 May 2018 21:19:07 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.45]); Wed, 23 May 2018 21:19:07 +0000 (UTC) for IP:'104.47.36.40' DOMAIN:'mail-sn1nam02on0040.outbound.protection.outlook.com' HELO:'NAM02-SN1-obe.outbound.protection.outlook.com' FROM:'brijesh.singh@amd.com' RCPT:'' X-RedHat-Spam-Score: -1.031 (DKIM_SIGNED, DKIM_VALID, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H5, RCVD_IN_MSPIKE_WL, SPF_HELO_PASS, T_DKIMWL_WL_MED) 104.47.36.40 mail-sn1nam02on0040.outbound.protection.outlook.com 104.47.36.40 mail-sn1nam02on0040.outbound.protection.outlook.com X-Scanned-By: MIMEDefang 2.84 on 10.5.110.45 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-loop: libvir-list@redhat.com Cc: Tom Lendacky , Peter Krempa , Erik Skultety , Jon Grimm , Andrea Bolognani , Brijesh Singh , Borislav Petkov Subject: [libvirt] [PATCH v6 3/9] conf: introduce launch-security element in domain X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.46]); Wed, 23 May 2018 21:19:38 +0000 (UTC) X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" The launch-security element can be used to define the security model to use when launching a domain. Currently we support 'sev'. When 'sev' is used, the VM will be launched with AMD SEV feature enabled. SEV feature supports running encrypted VM under the control of KVM. Encrypted VMs have their pages (code and data) secured such that only the guest itself has access to the unencrypted version. Each encrypted VM is associated with a unique encryption key; if its data is accessed to a different entity using a different key the encrypted guests data will be incorrectly decrypted, leading to unintelligible data. Signed-off-by: Brijesh Singh --- docs/formatdomain.html.in | 115 ++++++++++++++++++ docs/schemas/domaincommon.rng | 39 ++++++ src/conf/domain_conf.c | 133 +++++++++++++++++= ++++ src/conf/domain_conf.h | 27 +++++ tests/genericxml2xmlindata/launch-security-sev.xml | 24 ++++ tests/genericxml2xmltest.c | 2 + 6 files changed, 340 insertions(+) create mode 100644 tests/genericxml2xmlindata/launch-security-sev.xml diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 665d0f25293e..cab08ea52003 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -8310,6 +8310,121 @@ qemu-kvm -net nic,model=3D? /dev/null =20

Note: DEA/TDEA is synonymous with DES/TDES.

=20 +

Secure Encrypted Virtualization (SEV)

+ +

+ The contents of the <launch-security type=3D'sev'> element + is used to provide the guest owners input used for creating an encr= ypted + VM using the AMD SEV feature. + + SEV is an extension to the AMD-V architecture which supports running + encrypted virtual machine (VMs) under the control of KVM. Encrypted + VMs have their pages (code and data) secured such that only the gue= st + itself has access to the unencrypted version. Each encrypted VM is + associated with a unique encryption key; if its data is accessed to= a + different entity using a different key the encrypted guests data wi= ll + be incorrectly decrypted, leading to unintelligible data. + + For more information see various input parameters and its format se= e the SEV API spec + https://support.amd.com/TechDocs/55766_SEV-KM%20API_Specifi= cation.pdf + Since 4.4.0 +

+ 
+<domain>
+  ...
+  <launch-security type=3D'sev'>
+    <policy> 0x0001 </policy>
+    <cbitpos> 47 </cbitpos>
+    <reduced-phys-bits> 1 </reduced-phys-bits>
+    <session> AAACCCDD=3DFFFCCCDSDS </session>
+    <dh-cert> RBBBSDDD=3DFDDCCCDDDG </dh>
+  </sev>
+  ...
+</domain>
+
+ +
+
cbitpos
+
The required cbitpos element provides the C-bit (ak= a encryption bit) + location in guest page table entry. The value of cbitpos is + hypervisor dependent and can be obtained through the sev element + from the domain capabilities. +
+
reduced-phys-bits
+
The required reduced-phys-bits element provides the= physical + address bit reducation. Similar to cbitpos the value of= + reduced-phys-bit is hypervisor dependent and can be obtained + through the sev element from the domain capabilities. +
+
policy
+
The required policy element provides the guest poli= cy + which must be maintained by the SEV firmware. This policy is enforce= d by + the firmware and restricts what configuration and operational comman= ds + can be performed on this guest by the hypervisor. The guest policy + provided during guest launch is bound to the guest and cannot be cha= nged + throughout the lifetime of the guest. The policy is also transmitted + during snapshot and migration flows and enforced on the destination = platform. + + The guest policy is a 4 unsigned byte with the fields shown in Table: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Bit(s) Description
0 Debugging of the guest is disallowed when set
1 Sharing keys with other guests is disallowed when set
2 SEV-ES is required when set
3 Sending the guest to another platform is disallowed when se= t
4 The guest must not be transmitted to another platform that = is + not in the domain when set.
5 The guest must not be transmitted to another platform that = is + not SEV capable when set.
15:6 reserved
16:32 The guest must not be transmitted to another platform with a + lower firmware version.
+ +
+
dh-cert
+
The optional dh-cert element provides the guest own= ers + base64 encoded Diffie-Hellman (DH) key. The key is used to negotiate= a + master secret key between the SEV firmware and guest owner. This mas= ter + secret key is then used to establish a trusted channel between SEV + firmware and guest owner. +
+
session
+
The optional session element provides the guest own= ers + base64 encoded session blob defined in the SEV API spec. + + See SEV spec LAUNCH_START section for the session blob format. +
+
+

Example configs

=20

diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index f16e157397d4..69b6c84b9540 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -77,6 +77,9 @@ + + + @@ -436,6 +439,42 @@ =20 + + + + sev + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +