Ping for reviews.
On 29/05/20 12:10, Paulo de Rezende Pinatti wrote:
> This series introduces the concept of a 'Secure Guest' feature
> which covers on s390 IBM Secure Execution and on x86 AMD Secure
> Encrypted Virtualization.
>
> Besides adding documentation for IBM Secure Execution it also adds
> checks during validation of the qemu capabilities cache.
> These checks per architecture can be performed for IBM Secure
> Execution on s390 and AMD Secure Encrypted Virtualization on AMD x86
> CPUs (both checks implemented in this series).
>
> For s390 the verification consists of:
> - checking if /sys/firmware/uv is available: meaning the HW
> facility is available and the host OS supports it;
> - checking if the kernel cmdline contains 'prot_virt=1': meaning
> the host OS wants to use the feature.
>
> For AMD Secure Encrypted Virtualization the verification consists of:
> - checking if /sys/module/kvm_amd/parameters/sev contains the
> value '1': meaning SEV is enabled in the host kernel;
> - checking if /dev/sev exists
>
> Whenever the availability of the feature does not match the secure
> guest flag in the cache then libvirt will re-build it in order to
> pick up the new set of capabilities available.
>
> Additionally, this series adds the same aforementioned checks to the
> virt-host-validate tool to facilitate the manual verification
> process for users.
>
> Changes in v2:
>
> [Patch 1]
> Reworked kernel cmdline parser into a parameter based processing.
> [Patch 2]
> Added missing value "on" to kvalue list
> [Patch 3]
> Changed AMD SEV support check to module parameter is set and /dev/sev exists.
> Moved doc changes to a new standalone patch 6.
> [Patch 4]
> Added missing value "on" to kvalue list
> [Patch 5]
> Changed AMD SEV support check to align with patch 3.
> Moved doc changes to a new standalone patch 6.
> [Patch 6]
> Summarized AMD SEV doc changes from patches 3 and 5.
> Adjusted libvirt version number
> [Patch 7 (v1: Patch 6)]
> Adjusted libvirt version number
>
> link to v1: https://www.redhat.com/archives/libvir-list/2020-May/msg00416.html
>
> Boris Fiuczynski (3):
> tools: secure guest check on s390 in virt-host-validate
> tools: secure guest check for AMD in virt-host-validate
> docs: update AMD launch secure description
>
> Paulo de Rezende Pinatti (3):
> util: introduce a parser for kernel cmdline arguments
> qemu: check if s390 secure guest support is enabled
> qemu: check if AMD secure guest support is enabled
>
> Viktor Mihajlovski (1):
> docs: Describe protected virtualization guest setup
>
> docs/kbase.html.in | 3 +
> docs/kbase/launch_security_sev.rst | 9 +-
> docs/kbase/s390_protected_virt.rst | 189 +++++++++++++++++++++++++++++
> src/libvirt_private.syms | 2 +
> src/qemu/qemu_capabilities.c | 76 ++++++++++++
> src/util/virutil.c | 169 ++++++++++++++++++++++++++
> src/util/virutil.h | 17 +++
> tests/utiltest.c | 141 +++++++++++++++++++++
> tools/virt-host-validate-common.c | 83 ++++++++++++-
> tools/virt-host-validate-common.h | 5 +
> tools/virt-host-validate-qemu.c | 4 +
> 11 files changed, 693 insertions(+), 5 deletions(-)
> create mode 100644 docs/kbase/s390_protected_virt.rst
>
--
Best regards,
Paulo de Rezende Pinatti