[PATCH v3 0/7] Add Security Guest doc and check for capabilities cache validation

Paulo de Rezende Pinatti posted 7 patches 3 years, 9 months ago
Failed in applying to current master (apply log)
Test syntax-check failed
docs/kbase.html.in                 |   3 +
docs/kbase/launch_security_sev.rst |   9 +-
docs/kbase/s390_protected_virt.rst | 189 +++++++++++++++++++++++++++++
src/libvirt_private.syms           |   2 +
src/qemu/qemu_capabilities.c       |  76 ++++++++++++
src/util/virutil.c                 | 188 ++++++++++++++++++++++++++++
src/util/virutil.h                 |  17 +++
tests/utiltest.c                   | 144 ++++++++++++++++++++++
tools/virt-host-validate-common.c  |  88 +++++++++++++-
tools/virt-host-validate-common.h  |   5 +
tools/virt-host-validate-qemu.c    |   4 +
11 files changed, 720 insertions(+), 5 deletions(-)
create mode 100644 docs/kbase/s390_protected_virt.rst
[PATCH v3 0/7] Add Security Guest doc and check for capabilities cache validation
Posted by Paulo de Rezende Pinatti 3 years, 9 months ago
This series introduces the concept of a 'Secure Guest' feature
which covers on s390 IBM Secure Execution and on x86 AMD Secure
Encrypted Virtualization.

Besides adding documentation for IBM Secure Execution it also adds
checks during validation of the qemu capabilities cache.
These checks per architecture can be performed for IBM Secure
Execution on s390 and AMD Secure Encrypted Virtualization on AMD x86
CPUs (both checks implemented in this series).

For s390 the verification consists of:
- checking if /sys/firmware/uv is available: meaning the HW
facility is available and the host OS supports it;
- checking if the kernel cmdline contains 'prot_virt=1': meaning
the host OS wants to use the feature.

For AMD Secure Encrypted Virtualization the verification consists of:
- checking if /sys/module/kvm_amd/parameters/sev contains the
value '1': meaning SEV is enabled in the host kernel;
- checking if /dev/sev exists

Whenever the availability of the feature does not match the secure
guest flag in the cache then libvirt will re-build it in order to
pick up the new set of capabilities available.

Additionally, this series adds the same aforementioned checks to the
virt-host-validate tool to facilitate the manual verification
process for users.

Changes in v3:

[Patch 1]
  Reworked auxiliary functions to eliminate unnecessary wrappers
  Moved arg normalization to MatchParam function
  Replaced macro VIR_CMDLINE_STR_CMP by the simpler function virKernelCmdlineStrCmp
  Renamed function SkipDbQuote to SkipQuote
  Renamed flag SEARCH_STICKY to SEARCH_FIRST
  Reworked some input values in unit test for better test coverage
[Patches 4, 5]
  Added empty lines between if statements

link to v2: https://www.redhat.com/archives/libvir-list/2020-May/msg01175.html

Boris Fiuczynski (3):
  tools: secure guest check on s390 in virt-host-validate
  tools: secure guest check for AMD in virt-host-validate
  docs: update AMD launch secure description

Paulo de Rezende Pinatti (3):
  util: introduce a parser for kernel cmdline arguments
  qemu: check if s390 secure guest support is enabled
  qemu: check if AMD secure guest support is enabled

Viktor Mihajlovski (1):
  docs: Describe protected virtualization guest setup

 docs/kbase.html.in                 |   3 +
 docs/kbase/launch_security_sev.rst |   9 +-
 docs/kbase/s390_protected_virt.rst | 189 +++++++++++++++++++++++++++++
 src/libvirt_private.syms           |   2 +
 src/qemu/qemu_capabilities.c       |  76 ++++++++++++
 src/util/virutil.c                 | 188 ++++++++++++++++++++++++++++
 src/util/virutil.h                 |  17 +++
 tests/utiltest.c                   | 144 ++++++++++++++++++++++
 tools/virt-host-validate-common.c  |  88 +++++++++++++-
 tools/virt-host-validate-common.h  |   5 +
 tools/virt-host-validate-qemu.c    |   4 +
 11 files changed, 720 insertions(+), 5 deletions(-)
 create mode 100644 docs/kbase/s390_protected_virt.rst

-- 
2.26.2

Re: [PATCH v3 0/7] Add Security Guest doc and check for capabilities cache validation
Posted by Erik Skultety 3 years, 9 months ago
On Mon, Jun 15, 2020 at 10:28:05AM +0200, Paulo de Rezende Pinatti wrote:
> This series introduces the concept of a 'Secure Guest' feature
> which covers on s390 IBM Secure Execution and on x86 AMD Secure
> Encrypted Virtualization.
>
> Besides adding documentation for IBM Secure Execution it also adds
> checks during validation of the qemu capabilities cache.
> These checks per architecture can be performed for IBM Secure
> Execution on s390 and AMD Secure Encrypted Virtualization on AMD x86
> CPUs (both checks implemented in this series).
>
> For s390 the verification consists of:
> - checking if /sys/firmware/uv is available: meaning the HW
> facility is available and the host OS supports it;
> - checking if the kernel cmdline contains 'prot_virt=1': meaning
> the host OS wants to use the feature.
>
> For AMD Secure Encrypted Virtualization the verification consists of:
> - checking if /sys/module/kvm_amd/parameters/sev contains the
> value '1': meaning SEV is enabled in the host kernel;
> - checking if /dev/sev exists
>
> Whenever the availability of the feature does not match the secure
> guest flag in the cache then libvirt will re-build it in order to
> pick up the new set of capabilities available.
>
> Additionally, this series adds the same aforementioned checks to the
> virt-host-validate tool to facilitate the manual verification
> process for users.

ACK to the series, let me know whether you agree with the micro fixups I
attached to the individual patch review and I'll squash them before pushing.

Thanks for bearing with me,
Erik