From nobody Mon Apr 29 11:04:59 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=fail(p=quarantine dis=quarantine) header.from=suse.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 1638316347152618.9028916651504; Tue, 30 Nov 2021 15:52:27 -0800 (PST) Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-498-3Ik1L3lTPoafssVCyiVp3Q-1; Tue, 30 Nov 2021 18:52:24 -0500 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 80AE281CCB4; Tue, 30 Nov 2021 23:52:19 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 351B45D740; Tue, 30 Nov 2021 23:52:19 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 02BDD1809CB9; Tue, 30 Nov 2021 23:52:19 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 1AUNqGre013362 for ; Tue, 30 Nov 2021 18:52:16 -0500 Received: by smtp.corp.redhat.com (Postfix) id 3C84451E2; Tue, 30 Nov 2021 23:52:16 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast02.extmail.prod.ext.rdu2.redhat.com [10.11.55.18]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 352E451E1 for ; Tue, 30 Nov 2021 23:52:11 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 87CD1801212 for ; Tue, 30 Nov 2021 23:52:11 +0000 (UTC) Received: from de-smtp-delivery-102.mimecast.com (de-smtp-delivery-102.mimecast.com [194.104.111.102]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-448-WOr3EO1CPfWdFMMIv_l7rQ-1; Tue, 30 Nov 2021 18:52:09 -0500 Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-am5eur02lp2054.outbound.protection.outlook.com [104.47.4.54]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id de-mta-36-8yxi0jOtOGWUE0J0fEw9zA-1; Wed, 01 Dec 2021 00:52:07 +0100 Received: from AM0PR04MB4899.eurprd04.prod.outlook.com (2603:10a6:208:c5::16) by AM0PR04MB6275.eurprd04.prod.outlook.com (2603:10a6:208:147::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.23; Tue, 30 Nov 2021 23:52:06 +0000 Received: from AM0PR04MB4899.eurprd04.prod.outlook.com ([fe80::c58b:de4e:3ba7:9ef6]) by AM0PR04MB4899.eurprd04.prod.outlook.com ([fe80::c58b:de4e:3ba7:9ef6%4]) with mapi id 15.20.4734.027; Tue, 30 Nov 2021 23:52:06 +0000 Received: from localhost (75.169.35.15) by AM6P191CA0088.EURP191.PROD.OUTLOOK.COM (2603:10a6:209:8a::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.22 via Frontend Transport; Tue, 30 Nov 2021 23:52:06 +0000 X-MC-Unique: 3Ik1L3lTPoafssVCyiVp3Q-1 X-MC-Unique: WOr3EO1CPfWdFMMIv_l7rQ-1 X-MC-Unique: 8yxi0jOtOGWUE0J0fEw9zA-1 From: Jim Fehlig To: libvir-list@redhat.com Subject: [PATCH 1/3] libvirt: Introduce virDomainSetLaunchSecurityState public API Date: Tue, 30 Nov 2021 16:51:58 -0700 Message-ID: <20211130235200.11686-2-jfehlig@suse.com> In-Reply-To: <20211130235200.11686-1-jfehlig@suse.com> References: <20211130235200.11686-1-jfehlig@suse.com> X-ClientProxiedBy: AM6P191CA0088.EURP191.PROD.OUTLOOK.COM (2603:10a6:209:8a::29) To AM0PR04MB4899.eurprd04.prod.outlook.com (2603:10a6:208:c5::16) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 11f631f8-2ea6-4230-1514-08d9b45c6a69 X-MS-TrafficTypeDiagnostic: AM0PR04MB6275: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0 X-Microsoft-Antispam-Message-Info: ZoCDEIJo+NZ7FxYetvjyGzZa4J+NO516zeIfhe3b+8wlGKfx80GNiV4+Ww2XCg73fo3W2bs4YcVp8d4tcPBsMizkcKhuXmWrGsVizpIs3ccqFxMVgZod5pBBswYfVwi44wkmFYUVWtX5Q4cUeA71TB8UH2oDDgmINsv/DXO9wlInw9gPV27GtI22RR6QFsYRwJfARyw6WsrNys54HVw3t5QiThiCA2YUgTFYUK/EQI/IL33IEW9vZZK9sX5Wh0BQrbFrFU76cqIPuAjg2WWLejuulth/Khdjg7vMMHLuO0kv60DzAe+tSB1/BdU7hkPoxGVtKc1EfIR1W4ZM87ALa8u3vBGWA5EYpFVJaKugDGZ91l+5NS0zcrKHGhB1r4pYqxfbzSYlaLCxv/wdtFuE/jgkb5LZmHRjP9cAXvOObDeryvZ7WYcKxqHcCoJj8TRV5GhRcDQ1M4jdvwxjgwrt2WwLsgM5CRpCKULdTyipPQ92IlkOHzLMcT7G0dKSz2BdRMHryGMZoXVo+8PGekTfVCR6v0BmSVFBKwJLb/CYyR1aNncK7Y3otKeJ+ULLWAAUBAryPdsu8GZf5R6SAdWloKbZX/1Ta0KXwlGts5YHatp91//1X0rW+sGA9SRWlVlkYvnh4ByV0DDOjSKkOVOCirIcRBgQtM1BGkB1c4DrilZHabs82mSYO+tKM1epYhzbTvfFAdo2ICf1w1nteKkQsouvQ5KI0u2qeAUHZQogXQVtV18w0zyql73fMUvf1DMw61Yj1Abpw8NOdcqBoiyBfE2laA3TT0Bf4zYxZs4x/PsAT3+vqRsgGMxdDFmdxfWM X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR04MB4899.eurprd04.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(956004)(8936002)(6916009)(1076003)(8676002)(36756003)(316002)(508600001)(83380400001)(2906002)(6486002)(5660300002)(6666004)(66556008)(966005)(6496006)(2616005)(38100700002)(66476007)(186003)(26005)(66946007)(86362001)(145543001)(213903007); DIR:OUT; SFP:1101 X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?PHZZ4uO8EqTdtCQixOhh/rMgk+UgZUx+P9PWCiLWbFClw6PmTn+/97YWt6+1?= =?us-ascii?Q?j0hqLHy12xSrAt642KQb9MATRDBevSBsKZ+FkV24v5v1eS/bFdeG3/3xurYR?= =?us-ascii?Q?a59L6nMmwpDo1vOz9gKMVhNo3dbiCbneG3s1+LGsh5Sdds+EuiHwSNSPlWsU?= =?us-ascii?Q?GlfyqbwRIOe0BqDlczWg+AQlMUxjulhgW1QZwokGZ4nvvNlrch6abcYsGY5K?= =?us-ascii?Q?4fEEMX9JJW6ub7KLgw80hAeX0p1FajibfK+cjxCnhWW/TwpcTiFytNMzzWcf?= =?us-ascii?Q?VoOzC/pEuMV/I1dXUkZnMPryRodhjqTu/ojT0WHSRXmk4IcHEIm3LWZoU9z/?= =?us-ascii?Q?XDsVJIzYf82UN9gWrIYNF3LIBOpc1KGjFvCu5MTGWIXk7JrrIiK4/sH7QAnc?= =?us-ascii?Q?JcuXXBpeCECCQtUIeUOUVomH6G6Uzjpi8xX5QLbB4YlzdlZjsuUDYyJgqhXm?= =?us-ascii?Q?/9NaSTR1pMDpOJoiD3b2bmeCH387ayAprGDb2QaZ0bWgV/RHpUqtxSIm8Ldw?= =?us-ascii?Q?st7CF3Jo9buwNKnDwBdG4eC7YeMtnQgdr+N6f4FkqbqQ7+oO42VjYVKhYKdy?= =?us-ascii?Q?9pDcBH2g49Al4vpTPIWeAxKKrS1udTeAEnhBQgqttnCB/k/aBMh+HHNH2WkJ?= =?us-ascii?Q?/F+DImX+8b/XDJjsUa8jlSbQnSyvrVAmu6ra/Ll/NkVKL4FS3Y7LFh1HRImX?= =?us-ascii?Q?lpF/8iLxIHCrQGHtazJZBmk6noS70tJEGkgic3tOTd/zLcyaWxrCKAHsFxCB?= =?us-ascii?Q?orHS16X6+kV/E7SLgjw1xaZmLaVsDsjJiz90yeFmD2JoUU6c/PnPlv3sQgKS?= =?us-ascii?Q?RtFU0vtEoOkYkscCMy/oghPvccBmogZoIRZdub4aAObax6Bs8M9ZRhPlEibw?= =?us-ascii?Q?/P3Emrbe2k6uAtw0fk4mumWNYnYaj7I0TTG2IfX4D06rdD0pn9dfvaiZK4FD?= =?us-ascii?Q?RqZq8+HRna2I4/L9/IVsrXpGLglWMEtmDQf4R0SOtU8l23QthIT4HcGQyIDK?= =?us-ascii?Q?TnvSvnKgmOQiZ2NcPwFmaLHMoIt3QYLdvipTiqs1crzSUfUCjEOw25KO6uUc?= =?us-ascii?Q?Ceq7/ess8YjOmIYRzuD3aLvMOBYt29zFkRC1JT/Okws07YZzBLhETyHW2Vxn?= =?us-ascii?Q?V/+fkNoiBXUzDD8to0rP1f9ALUjJFtzRJT0fKVN4r0otBFcHAjasPtxeuMc5?= =?us-ascii?Q?lztubO1HvCNweBrNn6oBUYWOoI3+ObSu1EINTh8/2i4exaSWGEDr/F9MHUt9?= =?us-ascii?Q?hjOcoIpmCT3Vo+6jhtj27oot+FKL0wr/RyNJK7Eou4UIRSCSZ5GPWKJaTMjg?= =?us-ascii?Q?eTDDh5Ugk9JCvx/z9vghoebRCShQE9yNQCi8yFU+fYHIdQX5VFogmt6VIKEd?= =?us-ascii?Q?BAsLSFCnyymbx1DHUTtcLEqEaFKswVVUnRGnSrgXIYVjQZpvTZ5e+26qKpJo?= =?us-ascii?Q?U5y6vuQal6eNmtUQtfiLH8wcgm1IQCz9HVwO034Cf4bF7Jb/Ci/z3Zlu5G58?= =?us-ascii?Q?Ao2lbSSjJ3ikcsE4refzkXb8bl+dc9ZoVlOHZ/TOJpmJBiS/n2q10uCJiFtD?= =?us-ascii?Q?TyycNP8EXGr9kCiC8Y+ukVv8NNnLP1iNJGCPw3TKnpHV2VjXD/psTyJBdBIH?= =?us-ascii?Q?KSqJX2QXmd80V8JuRMAt9A8=3D?= X-OriginatorOrg: suse.com X-MS-Exchange-CrossTenant-Network-Message-Id: 11f631f8-2ea6-4230-1514-08d9b45c6a69 X-MS-Exchange-CrossTenant-AuthSource: AM0PR04MB4899.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Nov 2021 23:52:06.7386 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: EbeenZRI7uUfy95k9hsjrepoPckZQ1/Obba/BJbLU38nstKPU76MlVE4F8nIMMKEqgp0LWk/vcuzyr0q0j+YZA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR04MB6275 X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-MIME-Autoconverted: from quoted-printable to 8bit by lists01.pubmisc.prod.ext.phx2.redhat.com id 1AUNqGre013362 X-loop: libvir-list@redhat.com X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZM-MESSAGEID: 1638316348488100003 Content-Type: text/plain; charset="utf-8" This API allows setting a launch secret within a guests's memory. The launch secret is created by the guest owner after retrieving and verifying the launch measurement with virDomainGetLaunchSecurityInfo. The API uses virTypedParameter for input, allowing it to be expanded to support other confidential computing technologies. In the case of SEV, a basic guest launch workflow is described in the SEV API spec in section "1.3.1 Launch" https://www.amd.com/system/files/TechDocs/55766_SEV-KM_API_Specification.pdf Signed-off-by: Jim Fehlig --- include/libvirt/libvirt-domain.h | 35 +++++++++++++++++++++ src/driver-hypervisor.h | 7 +++++ src/libvirt-domain.c | 52 ++++++++++++++++++++++++++++++++ src/libvirt_public.syms | 5 +++ 4 files changed, 99 insertions(+) diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-dom= ain.h index 2f017c5b68..7af634cfb2 100644 --- a/include/libvirt/libvirt-domain.h +++ b/include/libvirt/libvirt-domain.h @@ -5086,11 +5086,46 @@ int virDomainSetLifecycleAction(virDomainPtr domain, */ # define VIR_DOMAIN_LAUNCH_SECURITY_SEV_MEASUREMENT "sev-measurement" =20 +/** + * VIR_DOMAIN_LAUNCH_SECURITY_SEV_SECRET_HEADER: + * + * A macro used to represent the SEV launch secret header. The secret head= er + * is a base64-encoded VIR_TYPED_PARAM_STRING containing artifacts needed = by + * the SEV firmware to recover the plain text of the launch secret. See + * section "6.6 LAUNCH_SECRET" in the SEV API specification for a detailed + * description of the secret header. + */ +# define VIR_DOMAIN_LAUNCH_SECURITY_SEV_SECRET_HEADER "sev-secret-header" + +/** + * VIR_DOMAIN_LAUNCH_SECURITY_SEV_SECRET: + * + * A macro used to represent the SEV launch secret. The secret is a + * base64-encoded VIR_TYPED_PARAM_STRING containing an encrypted launch + * secret. The secret is created by the domain owner after the SEV launch + * measurement is retrieved and verified. + */ +# define VIR_DOMAIN_LAUNCH_SECURITY_SEV_SECRET "sev-secret" + +/** + * VIR_DOMAIN_LAUNCH_SECURITY_SEV_SECRET_SET_ADDRESS: + * + * A macro used to represent the physical address within the guest's memory + * where the secret will be set, as VIR_TYPED_PARAM_LLONG. If not specifie= d, + * the address will be determined by the hypervisor. + */ +# define VIR_DOMAIN_LAUNCH_SECURITY_SEV_SECRET_SET_ADDRESS "sev-secret-set= -address" + int virDomainGetLaunchSecurityInfo(virDomainPtr domain, virTypedParameterPtr *params, int *nparams, unsigned int flags); =20 +int virDomainSetLaunchSecurityState(virDomainPtr domain, + virTypedParameterPtr params, + int nparams, + unsigned int flags); + typedef enum { VIR_DOMAIN_GUEST_INFO_USERS =3D (1 << 0), /* return active users */ VIR_DOMAIN_GUEST_INFO_OS =3D (1 << 1), /* return OS information */ diff --git a/src/driver-hypervisor.h b/src/driver-hypervisor.h index d642af8a37..c83fb648a2 100644 --- a/src/driver-hypervisor.h +++ b/src/driver-hypervisor.h @@ -1333,6 +1333,12 @@ typedef int int *nparams, unsigned int flags); =20 +typedef int +(*virDrvDomainSetLaunchSecurityState)(virDomainPtr domain, + virTypedParameterPtr params, + int nparams, + unsigned int flags); + typedef virDomainCheckpointPtr (*virDrvDomainCheckpointCreateXML)(virDomainPtr domain, const char *xmlDesc, @@ -1661,6 +1667,7 @@ struct _virHypervisorDriver { virDrvConnectBaselineHypervisorCPU connectBaselineHypervisorCPU; virDrvNodeGetSEVInfo nodeGetSEVInfo; virDrvDomainGetLaunchSecurityInfo domainGetLaunchSecurityInfo; + virDrvDomainSetLaunchSecurityState domainSetLaunchSecurityState; virDrvDomainCheckpointCreateXML domainCheckpointCreateXML; virDrvDomainCheckpointGetXMLDesc domainCheckpointGetXMLDesc; virDrvDomainListAllCheckpoints domainListAllCheckpoints; diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c index ce7cafde36..e62f0efa1a 100644 --- a/src/libvirt-domain.c +++ b/src/libvirt-domain.c @@ -12818,6 +12818,58 @@ int virDomainGetLaunchSecurityInfo(virDomainPtr do= main, } =20 =20 +/** + * virDomainSetLaunchSecurityState: + * @domain: a domain object + * @params: pointer to launch security parameter objects + * @nparams: number of launch security parameters + * @flags: currently used, set to 0. + * + * Set a launch security secret in the guests's memory. The secret is crea= ted + * by the guest owner after retrieving and verifying the launch measurement + * with virDomainGetLaunchSecurityInfo. + * + * See VIR_DOMAIN_LAUNCH_SECURITY_* for a detailed description of accepted + * launch security parameters. + * + * Returns -1 in case of failure, 0 in case of success. + */ +int virDomainSetLaunchSecurityState(virDomainPtr domain, + virTypedParameterPtr params, + int nparams, + unsigned int flags) +{ + virConnectPtr conn =3D domain->conn; + + VIR_DOMAIN_DEBUG(domain, "params=3D%p, nparams=3D%d flags=3D0x%x", + params, nparams, flags); + VIR_TYPED_PARAMS_DEBUG(params, nparams); + + virResetLastError(); + + virCheckDomainReturn(domain, -1); + virCheckNonNullArgGoto(params, error); + virCheckPositiveArgGoto(nparams, error); + + if (virTypedParameterValidateSet(conn, params, nparams) < 0) + goto error; + + if (conn->driver->domainSetLaunchSecurityState) { + int ret; + ret =3D conn->driver->domainSetLaunchSecurityState(domain, params, + nparams, flags); + if (ret < 0) + goto error; + return ret; + } + virReportUnsupportedError(); + + error: + virDispatchError(domain->conn); + return -1; +} + + /** * virDomainAgentSetResponseTimeout: * @domain: a domain object diff --git a/src/libvirt_public.syms b/src/libvirt_public.syms index 788a967df7..f93692c427 100644 --- a/src/libvirt_public.syms +++ b/src/libvirt_public.syms @@ -911,4 +911,9 @@ LIBVIRT_7.8.0 { virNetworkCreateXMLFlags; } LIBVIRT_7.7.0; =20 +LIBVIRT_8.0.0 { + global: + virDomainSetLaunchSecurityState; +} LIBVIRT_7.8.0; + # .... define new API here using predicted next version number .... --=20 2.33.0 From nobody Mon Apr 29 11:04:59 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) client-ip=170.10.129.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=fail(p=quarantine dis=quarantine) header.from=suse.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.zohomail.com with SMTPS id 1638316347134402.1213483225704; Tue, 30 Nov 2021 15:52:27 -0800 (PST) Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-199-Y0ilKLa8MkOiORcMkcGi4w-1; Tue, 30 Nov 2021 18:52:23 -0500 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id B35E110066FE; Tue, 30 Nov 2021 23:52:18 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id CC66C10023B8; Tue, 30 Nov 2021 23:52:17 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 3AB541809CB7; Tue, 30 Nov 2021 23:52:17 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 1AUNqEUl013357 for ; Tue, 30 Nov 2021 18:52:15 -0500 Received: by smtp.corp.redhat.com (Postfix) id D0C0D492C3B; Tue, 30 Nov 2021 23:52:14 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast01.extmail.prod.ext.rdu2.redhat.com [10.11.55.17]) by smtp.corp.redhat.com (Postfix) with ESMTPS id CB1E0492C38 for ; Tue, 30 Nov 2021 23:52:14 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [207.211.31.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id ABF1685A5AA for ; Tue, 30 Nov 2021 23:52:14 +0000 (UTC) Received: from de-smtp-delivery-102.mimecast.com (de-smtp-delivery-102.mimecast.com [194.104.111.102]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-587-elRgjeS9OzGHPOddx9S8Tw-1; Tue, 30 Nov 2021 18:52:12 -0500 Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-am5eur02lp2056.outbound.protection.outlook.com [104.47.4.56]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id de-mta-38-JJWZP8HxM8Khi-m254IWnA-1; Wed, 01 Dec 2021 00:52:10 +0100 Received: from AM0PR04MB4899.eurprd04.prod.outlook.com (2603:10a6:208:c5::16) by AM0PR04MB6275.eurprd04.prod.outlook.com (2603:10a6:208:147::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.23; Tue, 30 Nov 2021 23:52:10 +0000 Received: from AM0PR04MB4899.eurprd04.prod.outlook.com ([fe80::c58b:de4e:3ba7:9ef6]) by AM0PR04MB4899.eurprd04.prod.outlook.com ([fe80::c58b:de4e:3ba7:9ef6%4]) with mapi id 15.20.4734.027; Tue, 30 Nov 2021 23:52:10 +0000 Received: from localhost (75.169.35.15) by AM6P191CA0092.EURP191.PROD.OUTLOOK.COM (2603:10a6:209:8a::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.20 via Frontend Transport; Tue, 30 Nov 2021 23:52:09 +0000 X-MC-Unique: Y0ilKLa8MkOiORcMkcGi4w-1 X-MC-Unique: elRgjeS9OzGHPOddx9S8Tw-1 X-MC-Unique: JJWZP8HxM8Khi-m254IWnA-1 From: Jim Fehlig To: libvir-list@redhat.com Subject: [PATCH 2/3] remote: Add RPC support for the virDomainSetLaunchSecurityState API Date: Tue, 30 Nov 2021 16:51:59 -0700 Message-ID: <20211130235200.11686-3-jfehlig@suse.com> In-Reply-To: <20211130235200.11686-1-jfehlig@suse.com> References: <20211130235200.11686-1-jfehlig@suse.com> X-ClientProxiedBy: AM6P191CA0092.EURP191.PROD.OUTLOOK.COM (2603:10a6:209:8a::33) To AM0PR04MB4899.eurprd04.prod.outlook.com (2603:10a6:208:c5::16) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 93090418-d6cc-4fe6-ff70-08d9b45c6c8e X-MS-TrafficTypeDiagnostic: AM0PR04MB6275: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:116 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0 X-Microsoft-Antispam-Message-Info: MI7clsg5WtaozsarswAWgEPj6L35PrRrhZn0CBP+bstP7hpcoxmNeYS6DsH5TDr2k/XpjeN35xUcV4xA3VHEnVSHtfRUkq8CzXKliuodM+XvZvu0JDgsj0YDs+Z7WGDK1RFppt0Ntc6XzUAC66932k2QoxOfX0V0bBI9YHnuhQGUiStHSbXb1AL51HjNvbOt3KMcD9zh0O9V+fj1rouwEyXgoLWu84rohoNg1n2ewZoQYRn0tvPpaj7w96ujStFHejPxLfpCxdJ5pNss9IR9omHC6qp7nuM+HV6k+s47BH1ZoWy8bqy+e5REN62nGm0sQhM5rQeCVUIZRHTF3/C/HdAmX1H/O+UFQSGQnF7UYRFK1fDJ2hLbLEHIs1JMnxqal4ceEzdaXdHcEJgzLnN6DFOBaw5IdgZtoGUdvTEgMpQsE5FUf1Q9fQFHEq23oSb4nrZbkxULuBfcienmhqGW1ExZqbj8DH0yAuijKjgW2A5Mi0rNI0ebwXSKnYwUVrfKby1efUPeo211WdbMTx7X6uNsY3Y+ZwGsLiToqgAX/LBq5t8zd5PClEX7Ty+e6RAxOX3noInse3WeF3EojE56SQ/v2a7xzcX/M542lWG8iMVOCeCLwapotHWuNmUmSy/VGk+LiJPCQUgnRZNqbcSzQTPmdv8tl/JJJbUcwiW6CLey8/LlmolQ87Qc4thsB68UYMz/jMeFdzMFg8g0TJCMHCtpVBPXQu6cDRgh7bn8aC4= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR04MB4899.eurprd04.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(956004)(8936002)(6916009)(1076003)(8676002)(36756003)(316002)(508600001)(83380400001)(2906002)(6486002)(5660300002)(6666004)(66556008)(6496006)(2616005)(38100700002)(66476007)(186003)(26005)(66946007)(86362001)(145543001)(213903007); DIR:OUT; SFP:1101 X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?sJwUx3mF/oNS2mrhvKSMel4ANyTV9zpHW5SndzD1pSKWQ6DNKVbZoh3mXSLK?= =?us-ascii?Q?IrkWa87ladts9c+tiaG0+XGrQAb1js207eyq2WtdNUlrZrISxplol3ic52cx?= =?us-ascii?Q?XTxl2kZ4XzNHm19zqjr7xtJ4DQO9Eh6KoVpryBx3fB/kfpciCXmAVJDVmxF3?= =?us-ascii?Q?PSEOb/yfOXEP+3HRGXfpDKkJW0S2Q1P4yNfj68GrgLAocDQWfg6NvXR0fkES?= =?us-ascii?Q?/ip1kQcalRbsbkCUN4HL0EzIpCuINHPuU4gTOKwxqGMgd7fHskHplWP/WFv4?= =?us-ascii?Q?slWAuwzbRO36uceh9rs4kdzS2ReuME87Jx8w2bjDihvtCkgeEA2jUaZWzTaD?= =?us-ascii?Q?5/QgyVcttjBTkgMGDrWPbDSO6bT26g2CtWRgSi8MfJA+q0fsNqgOMOLVtXOf?= =?us-ascii?Q?+Kt/FZ1W4pyXYQY43CzpYrxq8QyNweU1K9shHbYzh0913Ph3/YUyfX08DDoG?= =?us-ascii?Q?9GGSO0s5tgQXsrCm7OvEQjSPTOy6KsZ7Yn/9uRptXKCpXFKzHrH41FbHOmAk?= =?us-ascii?Q?eC7rG0aunu7ne3sEwlhrcLXcQbgTvwy5TxfVvcPO/Om8B5/iYU2Z0e+i/qOr?= =?us-ascii?Q?1xXWpSr5oBOl3xhH7rYBC88j6sLZb/zB9k6zAWEJ9Bp2NAzWPW+MmcM75RZQ?= =?us-ascii?Q?dIeymr5E2JOn7D3UAjonJ+vsrxnVFPVa/ROOI81vCO+a+f5c5DIdecK/vw0g?= =?us-ascii?Q?fI+cR9+68gIE9UU3t6D/paw8f6uos1O+APfjn3/168qTn2dVadiYcELCLix0?= =?us-ascii?Q?YiU2pkJ9qcyeqQVkX/meu0aUoPPV0LJelMhy9eLQmwiSy/bII0ZSsqgorTEn?= =?us-ascii?Q?FhjsXyuRUPhR8OXPYp9fIOGg/mzD5Y4twHMBiO3SrtRvXMFP0n3DpNwCP46W?= =?us-ascii?Q?3n9nbgLSl8L+cH+i3/3ZlFDpphtQrQZRxB6B9uKIZumJ5rNKDhcmfAN35L/o?= =?us-ascii?Q?8KPvAWjQvJwrA6TWxaX9VUdon2FIcLaDbRC7iY5yoAV/vEQYS8BHQxZDukZH?= =?us-ascii?Q?Y5cGGcdUbbfs7F9Wp0khOkc0vjvtRNhpWILr8Ysaf8tiSnB/XTHiJi+4tvDo?= =?us-ascii?Q?x9CKM2OVIeCvoY516Z33JjaKmmHSfxcCKfOtLtAnAAWzMPL3ib3PP2w4vBBg?= =?us-ascii?Q?4O9X9ZpUC/MuF/+qdTSNT4ayEiII3cSJ/t+qVkhTJz1p1LhaKU3J83G4G50u?= =?us-ascii?Q?wWswV1DUvTxvltLmT+1d9mLTu4oCYcIF3Ckcr7doEEstT/AAU8I4ZlFvCjba?= =?us-ascii?Q?/nLpds4hSZ84NvE62x7fon70sN3SXM53w4gX42d4QiNxGhRKjT54M4YJDQfK?= =?us-ascii?Q?5bosfiyl5fDir17TuGqsXhdQqLjf01/C8A9ND9qngfpndEjsn8aZhTD8XV4W?= =?us-ascii?Q?i9taoTYp3W471qXUZhdEFTPF53e407RjRNFaKEqUJl226Vl7Rgp0bs3KlV0Y?= =?us-ascii?Q?yByLz128orxmb2JTabIf1uLtmB5PNwvof18RdDHmkJJIKavWaMgajy5CSayD?= =?us-ascii?Q?9RIMEWzWDNOjjivgijyv33v2ZON38NplfP5GXkYuPEotbwf87RpJwn4Dtfv8?= =?us-ascii?Q?p2bjZeFaaekCNaAG2Z8bHv0V5Sv42eXg1MutOH6WZh5rELMTisboSRto199o?= =?us-ascii?Q?J64//jNIyml7rKLaP/JTmV4=3D?= X-OriginatorOrg: suse.com X-MS-Exchange-CrossTenant-Network-Message-Id: 93090418-d6cc-4fe6-ff70-08d9b45c6c8e X-MS-Exchange-CrossTenant-AuthSource: AM0PR04MB4899.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Nov 2021 23:52:10.1807 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ReBuMq7gCY2V0CGU7mCdYlQx4v4f5p6pZw7YBq2wUGUDJhTl8eRL4q3C14oMPBXOXG+NMocE/cMDLhlxBSEucQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR04MB6275 X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.85 on 10.11.54.9 X-MIME-Autoconverted: from quoted-printable to 8bit by lists01.pubmisc.prod.ext.phx2.redhat.com id 1AUNqEUl013357 X-loop: libvir-list@redhat.com X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZM-MESSAGEID: 1638316348474100002 Content-Type: text/plain; charset="utf-8" Signed-off-by: Jim Fehlig Reviewed-by: Daniel P. Berrang=C3=A9 --- src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 17 ++++++++++++++++- src/remote_protocol-structs | 9 +++++++++ 3 files changed, 26 insertions(+), 1 deletion(-) diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 235c406a5a..604239951c 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -8574,6 +8574,7 @@ static virHypervisorDriver hypervisor_driver =3D { .domainAuthorizedSSHKeysSet =3D remoteDomainAuthorizedSSHKeysSet, /* 6= .10.0 */ .domainGetMessages =3D remoteDomainGetMessages, /* 7.1.0 */ .domainStartDirtyRateCalc =3D remoteDomainStartDirtyRateCalc, /* 7.2.0= */ + .domainSetLaunchSecurityState =3D remoteDomainSetLaunchSecurityState, = /* 8.0.0 */ }; =20 static virNetworkDriver network_driver =3D { diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index 60010778ca..4f13cef662 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -272,6 +272,9 @@ const REMOTE_NODE_SEV_INFO_MAX =3D 64; /* Upper limit on number of launch security information entries */ const REMOTE_DOMAIN_LAUNCH_SECURITY_INFO_PARAMS_MAX =3D 64; =20 +/* Upper limit on number of launch security state entries */ +const REMOTE_DOMAIN_LAUNCH_SECURITY_STATE_PARAMS_MAX =3D 64; + /* Upper limit on number of parameters describing a guest */ const REMOTE_DOMAIN_GUEST_INFO_PARAMS_MAX =3D 2048; =20 @@ -3642,6 +3645,12 @@ struct remote_domain_get_launch_security_info_ret { remote_typed_param params; }; =20 +struct remote_domain_set_launch_security_state_args { + remote_nonnull_domain dom; + remote_typed_param params; + unsigned int flags; +}; + /* nwfilter binding */ =20 struct remote_nwfilter_binding_lookup_by_port_dev_args { @@ -6905,5 +6914,11 @@ enum remote_procedure { * @generate: both * @acl: none */ - REMOTE_PROC_DOMAIN_EVENT_MEMORY_DEVICE_SIZE_CHANGE =3D 438 + REMOTE_PROC_DOMAIN_EVENT_MEMORY_DEVICE_SIZE_CHANGE =3D 438, + + /** + * @generate: both + * @acl: domain:write + */ + REMOTE_PROC_DOMAIN_SET_LAUNCH_SECURITY_STATE =3D 439 }; diff --git a/src/remote_protocol-structs b/src/remote_protocol-structs index dbef4ace79..d88176781d 100644 --- a/src/remote_protocol-structs +++ b/src/remote_protocol-structs @@ -3005,6 +3005,14 @@ struct remote_domain_get_launch_security_info_ret { remote_typed_param * params_val; } params; }; +struct remote_domain_set_launch_security_state_args { + remote_nonnull_domain dom; + struct { + u_int params_len; + remote_typed_param * params_val; + } params; + u_int flags; +}; struct remote_nwfilter_binding_lookup_by_port_dev_args { remote_nonnull_string name; }; @@ -3680,4 +3688,5 @@ enum remote_procedure { REMOTE_PROC_NODE_DEVICE_IS_ACTIVE =3D 436, REMOTE_PROC_NETWORK_CREATE_XML_FLAGS =3D 437, REMOTE_PROC_DOMAIN_EVENT_MEMORY_DEVICE_SIZE_CHANGE =3D 438, + REMOTE_PROC_DOMAIN_SET_LAUNCH_SECURITY_STATE =3D 439, }; --=20 2.33.0 From nobody Mon Apr 29 11:04:59 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=fail(p=quarantine dis=quarantine) header.from=suse.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 163831636624192.98675144644221; Tue, 30 Nov 2021 15:52:46 -0800 (PST) Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-352-bg1NqlEwNF2xk3M6O1-PuA-1; Tue, 30 Nov 2021 18:52:41 -0500 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id D4D2F81CCB7; Tue, 30 Nov 2021 23:52:36 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id B4F075DAA5; Tue, 30 Nov 2021 23:52:36 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 88C281802E24; Tue, 30 Nov 2021 23:52:36 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 1AUNqJN4013375 for ; Tue, 30 Nov 2021 18:52:19 -0500 Received: by smtp.corp.redhat.com (Postfix) id AFB3C40D1B9E; Tue, 30 Nov 2021 23:52:19 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast04.extmail.prod.ext.rdu2.redhat.com [10.11.55.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id AA7DA40D1B98 for ; Tue, 30 Nov 2021 23:52:19 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 5C5F11066558 for ; Tue, 30 Nov 2021 23:52:19 +0000 (UTC) Received: from de-smtp-delivery-102.mimecast.com (de-smtp-delivery-102.mimecast.com [194.104.109.102]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-290-ZFjeKVIPMja-Ulq54FAZgg-1; Tue, 30 Nov 2021 18:52:17 -0500 Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-am5eur02lp2056.outbound.protection.outlook.com [104.47.4.56]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id de-mta-33-8-t2-UMJMmqkEiORt8M6mQ-1; Wed, 01 Dec 2021 00:52:14 +0100 Received: from AM0PR04MB4899.eurprd04.prod.outlook.com (2603:10a6:208:c5::16) by AM0PR04MB6275.eurprd04.prod.outlook.com (2603:10a6:208:147::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.23; Tue, 30 Nov 2021 23:52:13 +0000 Received: from AM0PR04MB4899.eurprd04.prod.outlook.com ([fe80::c58b:de4e:3ba7:9ef6]) by AM0PR04MB4899.eurprd04.prod.outlook.com ([fe80::c58b:de4e:3ba7:9ef6%4]) with mapi id 15.20.4734.027; Tue, 30 Nov 2021 23:52:13 +0000 Received: from localhost (75.169.35.15) by AM6P191CA0100.EURP191.PROD.OUTLOOK.COM (2603:10a6:209:8a::41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.21 via Frontend Transport; Tue, 30 Nov 2021 23:52:12 +0000 X-MC-Unique: bg1NqlEwNF2xk3M6O1-PuA-1 X-MC-Unique: ZFjeKVIPMja-Ulq54FAZgg-1 X-MC-Unique: 8-t2-UMJMmqkEiORt8M6mQ-1 From: Jim Fehlig To: libvir-list@redhat.com Subject: [PATCH 3/3] qemu: Implement the virDomainSetLaunchSecurityState API Date: Tue, 30 Nov 2021 16:52:00 -0700 Message-ID: <20211130235200.11686-4-jfehlig@suse.com> In-Reply-To: <20211130235200.11686-1-jfehlig@suse.com> References: <20211130235200.11686-1-jfehlig@suse.com> X-ClientProxiedBy: AM6P191CA0100.EURP191.PROD.OUTLOOK.COM (2603:10a6:209:8a::41) To AM0PR04MB4899.eurprd04.prod.outlook.com (2603:10a6:208:c5::16) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: af2b09f6-a616-47d1-0c0b-08d9b45c6e7a X-MS-TrafficTypeDiagnostic: AM0PR04MB6275: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:33 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0 X-Microsoft-Antispam-Message-Info: sONdATxla2i0OU4NhCwNSdtkgmIHOIc7PHSCVsSAOCnWMXHlmzfnBM/ptYZY4srCJ0h6M0QXMP14eU9KQJeu0Qe1Bx4wH3Oi3K6Z6YA76xIVWpxkToTjkvlXgWGOgIlx9n3HZUKxqZmln26Ux/oepSpNHDqhNXO0mkDuO1N0+4Ub9QXBQ4+JGB/yfr7wUQCO3SzcOOLODhIUS8u7Z7B/zSK5WQZpCjau6sJ2uZtRM3q2c9yauYO6OneVqzuv0ZYqnnIznM3kQTl/vicLXRh8CZ7Ds/L7ansyRNbJHP9pKTMUewuiHMTcq1OYkt8n4NoyhPXGZqwMt2UMttigmd9nQq0Tmtph8T37vxzNPweVEk7WLPN1szQ7nLp/4EnLf5h0Z5BSFY0jX7HEL4HIYN/y5zwuxcXrX0055EfGakJR2lMz7pr91BATs/esPIXhG1ZOGj1g0Z6nl2u/gk/B1Gbtv987iJb2f85WxNoo6p/dQYDmuepCaEQc1PSuhHIvzoN1CtErGYO7LMav9zfyx5zhj9Cem9V+AXcI9EG0qvzIIuKRQZAkzwgt6wBGOrmbPsYGTlTjDu2ARN7+BCtPkVywL9O6dgxCJVK0VHhtBz/7cicOlB3so08FWSsSy1Y2xGNnjFCuPK+iRPDG5cwYnrRAOG02tbhx5NGhEeirXIuKPAclU0SO0W6iyznlvkUmBOVZB/bWXLWgktQ7EIReL5CYb14sS0fToti0qJE3to6Nv+I= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR04MB4899.eurprd04.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(956004)(8936002)(6916009)(1076003)(8676002)(36756003)(316002)(508600001)(83380400001)(2906002)(6486002)(5660300002)(6666004)(66556008)(6496006)(2616005)(38100700002)(66476007)(186003)(26005)(66946007)(86362001)(145543001)(213903007); DIR:OUT; SFP:1101 X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?+X+XAp9gGSoZIjW3WPQ4w0di0eY1+O3yL1YgKQ3jGUgQDi6VJ1N7ZgtxXs5Q?= =?us-ascii?Q?/yrvHhND36U4CgslrgRTaQWE1r2UCNJX8pA7DG6nDS+7EI2AEIhStMaxlR44?= =?us-ascii?Q?v4SHpwnJtXX0kDsd1WaUaKdTMAt/PwKH7UrBoLZyXoYz+A/niIbHbcr7//vM?= =?us-ascii?Q?GOBn9p31r323Ee7s4adw1584Y4pAoIm+VQQIq8Bm/YM0l7OPsvRhCbd9jaTs?= =?us-ascii?Q?dY7Kp4J2AN8J/zzqf+WxJRGD/u6FR92b7WsCiZivctG9FMuspIqHivRU204C?= =?us-ascii?Q?a+AaQMouu1BO+k3YnbhlqnFeUb8kR1/MuKnjD+nw0tOL9nMgJaKlUHyfW3Ht?= =?us-ascii?Q?9V7LVaxQX4kj87t2Ht99qyEdNFfUansGJseV01DS1yTyiLvWLn8EHHErhUWr?= =?us-ascii?Q?5rbkuNZ+z0b32A/jYgnZEZEq8T7IKt7gYekXc1HlOLrkZQb2VlweDs7D2xPu?= =?us-ascii?Q?pilXmIZVkq8v2IQPE6lld5SNF2MSSaHGfYEdvNHm3mjBiPd3kSdIM7dlQeYo?= =?us-ascii?Q?gEDUYdbYjg1NOWCDYQFTpNcNrsVm3TE46VugTaGRFWtdF6ur0ZS1q4hkhjz3?= =?us-ascii?Q?RBpfcbmBckSlrlHFWO7H7C6W/q4Eb9l77NHj5BTJ2YVNFnIO+pR4yh4qdkZX?= =?us-ascii?Q?eqR832hAssBg5SGea86ao6Fsi97kLPuZfoiueb95370IUEmUdPnVtE/kl3wy?= =?us-ascii?Q?K/SEc3tV87KxLa7L+L5AUtfVdX4Hdvpuc0JM1L2nOA09Kp3HT9DU0gV8HILJ?= =?us-ascii?Q?WsjbI95NMa2QqA9PX3GFfIJ3OxV4DuMLQYj4u3PWVJ8nlP+XxZQycpJHudv/?= =?us-ascii?Q?j6A/NhE7nVayptl6nnnuIvuWeHdwg3FxnyE/QiQ7o0LPao6qd8fYoog+9jiZ?= =?us-ascii?Q?TK4IENGCISiytJt0dSFIDfeyYqwreBZr03YpMDRt2mi8Lznnkf56emAEKW0Z?= =?us-ascii?Q?QO+H2C+k7MzgWuH0a+g6s8/nSfjE/2k4O2NH+BK3yFt8cIeZ7CCefmObHMzR?= =?us-ascii?Q?ZgVaSPsR8cx+Q34AG9FNBdHwtjORLGW4k9eXXlFe4uZx8xa5fgQN3tWkmtCh?= =?us-ascii?Q?0R+HfdAXm4nPqZ/hog6tjGjfZpLFeB1UFhMu8DAOlwBeCATriPi0K07qf+f8?= =?us-ascii?Q?TIeBtrdhmMawx9qiOx9jFHGD7AFclXRUJCiUVvlEgkzz8fD+ZqZ1kM2VeLcU?= =?us-ascii?Q?Le/mjEvctK/fXHPDfP8jpBFj62fbmHr2A1s5YSzmdohBjBbpaAfTskNi2sSH?= =?us-ascii?Q?ysrfBeH2OfXlQsCOPJLcATXxMQXFXuiWR7Ni25czlfJpvYsFsiKJDSXPd6QX?= =?us-ascii?Q?iE+7OjFWq8PPdcU2K54/2KPme/fErUeLK+2aLbzbV5k56J3BgytwnNigzEnk?= =?us-ascii?Q?GWWVQgXIAubtBMfoDXlkrD8OMQ7cUd7BGTw89kJY1M63urjkFqeDLW5qqjrI?= =?us-ascii?Q?WDw/osCLjrWnOPUL1f3B+9C4Dg0iugE11WrQTTs3WzOlQNvu3e9Tei7Yqr2L?= =?us-ascii?Q?HSP/wKl8mYSAXPpbssSb+rxjghNgshXekU6OonfLRQ0ZKLWDz5hV2WmVmm1o?= =?us-ascii?Q?tN9foulTOkEavUxaLK2Ui1ecPyyBCQs4H2Txa7+l2EK2rbzMuS0heTlVTMpq?= =?us-ascii?Q?zhG3qxEvcBc1P/2rc3seql4=3D?= X-OriginatorOrg: suse.com X-MS-Exchange-CrossTenant-Network-Message-Id: af2b09f6-a616-47d1-0c0b-08d9b45c6e7a X-MS-Exchange-CrossTenant-AuthSource: AM0PR04MB4899.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Nov 2021 23:52:13.6766 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: +1Dx0uG37BtM8/bDAUOzxs2tROO2yrhHYyOScQI/KGc0QpsoxQO048Y7YuJ8IKs7t2N8R2+HrKxP81P0+vpfsw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR04MB6275 X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.84 on 10.11.54.2 X-MIME-Autoconverted: from quoted-printable to 8bit by lists01.pubmisc.prod.ext.phx2.redhat.com id 1AUNqJN4013375 X-loop: libvir-list@redhat.com X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZM-MESSAGEID: 1638316368050100001 Content-Type: text/plain; charset="utf-8" Set a launch secret in guest memory using the sev-inject-launch-secret QMP API. Only supported for SEV-enabled guests. Signed-off-by: Jim Fehlig --- src/qemu/qemu_driver.c | 78 ++++++++++++++++++++++++++++++++++++ src/qemu/qemu_monitor.c | 12 ++++++ src/qemu/qemu_monitor.h | 6 +++ src/qemu/qemu_monitor_json.c | 34 ++++++++++++++++ src/qemu/qemu_monitor_json.h | 5 +++ 5 files changed, 135 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 4e680bc0a7..b6ee41b29e 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -20056,6 +20056,83 @@ qemuDomainGetLaunchSecurityInfo(virDomainPtr domai= n, return ret; } =20 + +static int +qemuDomainSetLaunchSecurityState(virDomainPtr domain, + virTypedParameterPtr params, + int nparams, + unsigned int flags) +{ + virQEMUDriver *driver =3D domain->conn->privateData; + virDomainObj *vm; + int ret =3D -1; + size_t i; + g_autofree char *secrethdr =3D NULL; + g_autofree char *secret =3D NULL; + long long setaddr =3D -1; + + virCheckFlags(0, -1); + if (virTypedParamsValidate(params, nparams, + VIR_DOMAIN_LAUNCH_SECURITY_SEV_SECRET_HEADE= R, + VIR_TYPED_PARAM_STRING, + VIR_DOMAIN_LAUNCH_SECURITY_SEV_SECRET, + VIR_TYPED_PARAM_STRING, + VIR_DOMAIN_LAUNCH_SECURITY_SEV_SECRET_SET_A= DDRESS, + VIR_TYPED_PARAM_LLONG, + NULL) < 0) + return -1; + + if (!(vm =3D qemuDomainObjFromDomain(domain))) + goto cleanup; + + if (virDomainSetLaunchSecurityStateEnsureACL(domain->conn, vm->def) < = 0) + goto cleanup; + + /* Currently only SEV is supported */ + if (!vm->def->sec || + vm->def->sec->sectype !=3D VIR_DOMAIN_LAUNCH_SECURITY_SEV) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("setting a launch secret is only supported in SEV= -enabled domains")); + goto cleanup; + } + + for (i =3D 0; i < nparams; i++) { + virTypedParameterPtr param =3D ¶ms[i]; + + if (STREQ(param->field, VIR_DOMAIN_LAUNCH_SECURITY_SEV_SECRET_HEAD= ER)) + secrethdr =3D g_strdup(param->value.s); + else if (STREQ(param->field, VIR_DOMAIN_LAUNCH_SECURITY_SEV_SECRET= )) + secret =3D g_strdup(param->value.s); + else if (STREQ(param->field, VIR_DOMAIN_LAUNCH_SECURITY_SEV_SECRET= _SET_ADDRESS)) + setaddr =3D param->value.l; + } + + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) + goto cleanup; + + if (virDomainObjCheckActive(vm) < 0) + goto endjob; + + qemuDomainObjEnterMonitor(driver, vm); + + if (qemuMonitorSetLaunchSecurityState(QEMU_DOMAIN_PRIVATE(vm)->mon, + secrethdr, secret, setaddr) < 0) + goto endjob; + + if (qemuDomainObjExitMonitor(driver, vm) < 0) + goto endjob; + + ret =3D 0; + + endjob: + qemuDomainObjEndJob(driver, vm); + + cleanup: + virDomainObjEndAPI(&vm); + return ret; +} + + static const unsigned int qemuDomainGetGuestInfoSupportedTypes =3D VIR_DOMAIN_GUEST_INFO_USERS | VIR_DOMAIN_GUEST_INFO_OS | @@ -20930,6 +21007,7 @@ static virHypervisorDriver qemuHypervisorDriver =3D= { .domainAuthorizedSSHKeysSet =3D qemuDomainAuthorizedSSHKeysSet, /* 6.1= 0.0 */ .domainGetMessages =3D qemuDomainGetMessages, /* 7.1.0 */ .domainStartDirtyRateCalc =3D qemuDomainStartDirtyRateCalc, /* 7.2.0 */ + .domainSetLaunchSecurityState =3D qemuDomainSetLaunchSecurityState, /*= 8.0.0 */ }; =20 =20 diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 26b59801b8..7f31a53231 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -4372,6 +4372,18 @@ qemuMonitorGetSEVMeasurement(qemuMonitor *mon) } =20 =20 +int +qemuMonitorSetLaunchSecurityState(qemuMonitor *mon, + const char *secrethdr, + const char *secret, + long long injectaddr) +{ + QEMU_CHECK_MONITOR(mon); + + return qemuMonitorJSONSetLaunchSecurityState(mon, secrethdr, secret, i= njectaddr); +} + + int qemuMonitorGetPRManagerInfo(qemuMonitor *mon, GHashTable **retinfo) diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index 99ecebc648..c485e403fd 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -1444,6 +1444,12 @@ int qemuMonitorBlockdevMediumInsert(qemuMonitor *mon, char * qemuMonitorGetSEVMeasurement(qemuMonitor *mon); =20 +int +qemuMonitorSetLaunchSecurityState(qemuMonitor *mon, + const char *secrethdr, + const char *secret, + long long injectaddr); + typedef struct _qemuMonitorPRManagerInfo qemuMonitorPRManagerInfo; struct _qemuMonitorPRManagerInfo { bool connected; diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 56f0b22b2a..35aea34b5f 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -8174,6 +8174,40 @@ qemuMonitorJSONGetSEVMeasurement(qemuMonitor *mon) } =20 =20 +/** + * The function is used to inject a launch secret in an SEV guest. + * + * Example JSON: + * + * { "execute" : "sev-inject-launch-secret", + * "data": { "packet-header": "str", "secret": "str", "gpa": "uint64" } } + */ +int +qemuMonitorJSONSetLaunchSecurityState(qemuMonitor *mon, + const char *secrethdr, + const char *secret, + long long injectaddr) +{ + g_autoptr(virJSONValue) cmd =3D NULL; + g_autoptr(virJSONValue) reply =3D NULL; + + if (!(cmd =3D qemuMonitorJSONMakeCommand("sev-inject-launch-secret", + "s:packet-header", secrethdr, + "s:secret", secret, + "U:gpa", injectaddr, + NULL))) + return -1; + + if (qemuMonitorJSONCommand(mon, cmd, &reply) < 0) + return -1; + + if (qemuMonitorJSONCheckError(cmd, reply) < 0) + return -1; + + return 0; +} + + /* * Example return data * diff --git a/src/qemu/qemu_monitor_json.h b/src/qemu/qemu_monitor_json.h index f7fb13f56c..4d2d73c661 100644 --- a/src/qemu/qemu_monitor_json.h +++ b/src/qemu/qemu_monitor_json.h @@ -368,6 +368,11 @@ int qemuMonitorJSONSystemWakeup(qemuMonitor *mon); =20 char *qemuMonitorJSONGetSEVMeasurement(qemuMonitor *mon); =20 +int qemuMonitorJSONSetLaunchSecurityState(qemuMonitor *mon, + const char *secrethdr, + const char *secret, + long long injectaddr); + int qemuMonitorJSONGetVersion(qemuMonitor *mon, int *major, int *minor, --=20 2.33.0