Re: [PATCH v2 1/9] qemu: provide support to query the SEV capability

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Mar 08, 2018 at 11:12:00AM -0600, Brijesh Singh wrote:
> QEMU version >= 2.12 provides support for launching an encrypted VMs on
> AMD x86 platform using Secure Encrypted Virtualization (SEV) feature.
> This patch adds support to query the SEV capability from the qemu.
> 
> Signed-off-by: Brijesh Singh <brijesh.singh@xxxxxxx>
> ---
>  src/conf/domain_capabilities.h | 13 ++++++++
>  src/qemu/qemu_capabilities.c   | 43 +++++++++++++++++++++++++
>  src/qemu/qemu_capabilities.h   |  1 +
>  src/qemu/qemu_capspriv.h       |  4 +++
>  src/qemu/qemu_monitor.c        |  9 ++++++
>  src/qemu/qemu_monitor.h        |  3 ++
>  src/qemu/qemu_monitor_json.c   | 73 ++++++++++++++++++++++++++++++++++++++++++
>  src/qemu/qemu_monitor_json.h   |  3 ++
>  8 files changed, 149 insertions(+)
> 
> diff --git a/src/conf/domain_capabilities.h b/src/conf/domain_capabilities.h
> index fa4c1e442f57..83d04d4c8506 100644
> --- a/src/conf/domain_capabilities.h
> +++ b/src/conf/domain_capabilities.h
> @@ -137,6 +137,19 @@ struct _virDomainCapsCPU {
>      virDomainCapsCPUModelsPtr custom;
>  };
>  
> +/*
> + * SEV capabilities
> + */
> +typedef struct _virSEVCapability virSEVCapability;
> +typedef virSEVCapability *virSEVCapabilityPtr;
> +struct _virSEVCapability {
> +    char *pdh;
> +    char *cert_chain;
> +    int cbitpos;
> +    int reduced_phys_bits;

If you have any reason to re-spin this patch series, lets make these
two be unsigned int, since IIUC -ve values are not possible.

> +};
> +
> +
>  struct _virDomainCaps {
>      virObjectLockable parent;
>  
> diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
> index b5eb8cf46a52..68e3622a3963 100644
> --- a/src/qemu/qemu_capabilities.c
> +++ b/src/qemu/qemu_capabilities.c
> @@ -459,6 +459,7 @@ VIR_ENUM_IMPL(virQEMUCaps, QEMU_CAPS_LAST,
>                "pl011",
>                "machine.pseries.max-cpu-compat",
>                "dump-completed",
> +              "sev",
>      );
>  
>  
> @@ -525,6 +526,8 @@ struct _virQEMUCaps {
>      size_t ngicCapabilities;
>      virGICCapability *gicCapabilities;
>  
> +    virSEVCapability *sevCapabilities;
> +
>      virQEMUCapsHostCPUData kvmCPU;
>      virQEMUCapsHostCPUData tcgCPU;
>  };
> @@ -2811,6 +2814,21 @@ virQEMUCapsSetGICCapabilities(virQEMUCapsPtr qemuCaps,
>      qemuCaps->ngicCapabilities = ncapabilities;
>  }
>  
> +void
> +virQEMUCapsSetSEVCapabilities(virQEMUCapsPtr qemuCaps,
> +                              virSEVCapability *capabilities)
> +{
> +    virSEVCapability *cap = qemuCaps->sevCapabilities;
> +
> +    if (cap) {
> +        VIR_FREE(cap->pdh);
> +        VIR_FREE(cap->cert_chain);
> +    }
> +
> +    VIR_FREE(qemuCaps->sevCapabilities);
> +
> +    qemuCaps->sevCapabilities = capabilities;
> +}
>  
>  static int
>  virQEMUCapsProbeQMPCommands(virQEMUCapsPtr qemuCaps,
> @@ -3318,6 +3336,19 @@ virQEMUCapsProbeQMPGICCapabilities(virQEMUCapsPtr qemuCaps,
>      return 0;
>  }
>  
> +static int
> +virQEMUCapsProbeQMPSEVCapabilities(virQEMUCapsPtr qemuCaps,
> +                                   qemuMonitorPtr mon)
> +{
> +    virSEVCapability *caps = NULL;
> +
> +    if (qemuMonitorGetSEVCapabilities(mon, &caps) < 0)
> +        return -1;
> +
> +    virQEMUCapsSetSEVCapabilities(qemuCaps, caps);
> +
> +    return 0;
> +}
>  
>  bool
>  virQEMUCapsCPUFilterFeatures(const char *name,
> @@ -4896,6 +4927,12 @@ virQEMUCapsInitQMPMonitor(virQEMUCapsPtr qemuCaps,
>          virQEMUCapsSet(qemuCaps, QEMU_CAPS_MACHINE_PSERIES_MAX_CPU_COMPAT);
>      }
>  
> +    /* no way to query -object sev-guest */
> +    if (ARCH_IS_X86(qemuCaps->arch) &&
> +        qemuCaps->version >= 2012000) {
> +        virQEMUCapsSet(qemuCaps, QEMU_CAPS_SEV);
> +    }

Sigh, we really need to fix introspection of -object types one day...

> +
>      if (virQEMUCapsProbeQMPCommands(qemuCaps, mon) < 0)
>          goto cleanup;
>  
> @@ -4951,6 +4988,12 @@ virQEMUCapsInitQMPMonitor(virQEMUCapsPtr qemuCaps,
>          virQEMUCapsGet(qemuCaps, QEMU_CAPS_QUERY_CPU_MODEL_EXPANSION))
>          virQEMUCapsSet(qemuCaps, QEMU_CAPS_CPU_CACHE);
>  
> +    /* Probe for SEV capabilities */
> +    if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV)) {
> +        if (virQEMUCapsProbeQMPSEVCapabilities(qemuCaps, mon) < 0)
> +            virQEMUCapsClear(qemuCaps, QEMU_CAPS_SEV);
> +    }
> +
>      ret = 0;
>   cleanup:
>      return ret;
> diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
> index c2ec2be19311..02acae491ab5 100644
> --- a/src/qemu/qemu_capabilities.h
> +++ b/src/qemu/qemu_capabilities.h
> @@ -444,6 +444,7 @@ typedef enum {
>      QEMU_CAPS_DEVICE_PL011, /* -device pl011 (not user-instantiable) */
>      QEMU_CAPS_MACHINE_PSERIES_MAX_CPU_COMPAT, /* -machine pseries,max-cpu-compat= */
>      QEMU_CAPS_DUMP_COMPLETED, /* DUMP_COMPLETED event */
> +    QEMU_CAPS_SEV, /* -object sev-guest,... */
>  
>      QEMU_CAPS_LAST /* this must always be the last item */
>  } virQEMUCapsFlags;
> diff --git a/src/qemu/qemu_capspriv.h b/src/qemu/qemu_capspriv.h
> index 222f3368e3b6..1fa85cc14f07 100644
> --- a/src/qemu/qemu_capspriv.h
> +++ b/src/qemu/qemu_capspriv.h
> @@ -86,6 +86,10 @@ virQEMUCapsSetGICCapabilities(virQEMUCapsPtr qemuCaps,
>                                virGICCapability *capabilities,
>                                size_t ncapabilities);
>  
> +void
> +virQEMUCapsSetSEVCapabilities(virQEMUCapsPtr qemuCaps,
> +                              virSEVCapability *capabilities);
> +
>  int
>  virQEMUCapsParseHelpStr(const char *qemu,
>                          const char *str,
> diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c
> index ad5c572aeefb..195248c88ae1 100644
> --- a/src/qemu/qemu_monitor.c
> +++ b/src/qemu/qemu_monitor.c
> @@ -4007,6 +4007,15 @@ qemuMonitorGetGICCapabilities(qemuMonitorPtr mon,
>      return qemuMonitorJSONGetGICCapabilities(mon, capabilities);
>  }
>  
> +int
> +qemuMonitorGetSEVCapabilities(qemuMonitorPtr mon,
> +                              virSEVCapability **capabilities)
> +{
> +    QEMU_CHECK_MONITOR_JSON(mon);
> +
> +    return qemuMonitorJSONGetSEVCapabilities(mon, capabilities);
> +}
> +
>  
>  int
>  qemuMonitorNBDServerStart(qemuMonitorPtr mon,
> diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h
> index 954ae88e4f64..1b2513650c58 100644
> --- a/src/qemu/qemu_monitor.h
> +++ b/src/qemu/qemu_monitor.h
> @@ -755,6 +755,9 @@ int qemuMonitorSetMigrationCapability(qemuMonitorPtr mon,
>  int qemuMonitorGetGICCapabilities(qemuMonitorPtr mon,
>                                    virGICCapability **capabilities);
>  
> +int qemuMonitorGetSEVCapabilities(qemuMonitorPtr mon,
> +                                  virSEVCapability **capabilities);
> +
>  typedef enum {
>    QEMU_MONITOR_MIGRATE_BACKGROUND       = 1 << 0,
>    QEMU_MONITOR_MIGRATE_NON_SHARED_DISK  = 1 << 1, /* migration with non-shared storage with full disk copy */
> diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
> index a09e93e464b3..94a1af1d3f75 100644
> --- a/src/qemu/qemu_monitor_json.c
> +++ b/src/qemu/qemu_monitor_json.c
> @@ -6362,6 +6362,79 @@ qemuMonitorJSONGetGICCapabilities(qemuMonitorPtr mon,
>      return ret;
>  }
>  
> +int
> +qemuMonitorJSONGetSEVCapabilities(qemuMonitorPtr mon,
> +                                  virSEVCapability **capabilities)
> +{
> +    int ret = -1;
> +    virJSONValuePtr cmd;
> +    virJSONValuePtr reply = NULL;
> +    virJSONValuePtr caps;
> +    virSEVCapability *capability = NULL;
> +    const char *pdh = NULL, *cert_chain = NULL;
> +    int cbitpos, reduced_phys_bits;
> +
> +    *capabilities = NULL;
> +
> +    if (!(cmd = qemuMonitorJSONMakeCommand("query-sev-capabilities",
> +                                           NULL)))
> +        return -1;
> +
> +    if (qemuMonitorJSONCommand(mon, cmd, &reply) < 0)
> +        goto cleanup;
> +
> +
> +    if (qemuMonitorJSONCheckError(cmd, reply) < 0)
> +        goto cleanup;
> +
> +    caps = virJSONValueObjectGetObject(reply, "return");
> +
> +    if (virJSONValueObjectGetNumberInt(caps, "cbitpos", &cbitpos) < 0) {
> +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
> +                       _("'cbitpos' field is missing"));
> +        goto cleanup;
> +    }
> +
> +    if (virJSONValueObjectGetNumberInt(caps, "reduced-phys-bits",
> +                                       &reduced_phys_bits) < 0) {
> +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
> +                       _("'reduced-phys-bits' field is missing"));
> +        goto cleanup;
> +    }
> +
> +    if (!(pdh = virJSONValueObjectGetString(caps, "pdh"))) {
> +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
> +                       _("'pdh' field is missing"));
> +        goto cleanup;
> +    }
> +
> +    if (!(cert_chain = virJSONValueObjectGetString(caps, "cert-chain"))) {
> +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
> +                       _("'cert-chain' field is missing"));
> +        goto cleanup;
> +    }
> +
> +    if (VIR_ALLOC(capability) < 0)
> +        goto cleanup;
> +
> +    if (VIR_STRDUP(capability->pdh, pdh) < 0)
> +        goto cleanup;
> +
> +    if (VIR_STRDUP(capability->cert_chain, cert_chain) < 0)
> +        goto cleanup;
> +
> +    capability->cbitpos = cbitpos;
> +    capability->reduced_phys_bits = reduced_phys_bits;
> +    *capabilities = capability;
> +    ret = 0;
> +
> + cleanup:
> +    virJSONValueFree(cmd);
> +    virJSONValueFree(reply);
> +
> +    return ret;
> +}
> +
>  static virJSONValuePtr
>  qemuMonitorJSONBuildInetSocketAddress(const char *host,
>                                        const char *port)
> diff --git a/src/qemu/qemu_monitor_json.h b/src/qemu/qemu_monitor_json.h
> index ec243becc4ae..305f789902e9 100644
> --- a/src/qemu/qemu_monitor_json.h
> +++ b/src/qemu/qemu_monitor_json.h
> @@ -152,6 +152,9 @@ int qemuMonitorJSONSetMigrationCapability(qemuMonitorPtr mon,
>  int qemuMonitorJSONGetGICCapabilities(qemuMonitorPtr mon,
>                                        virGICCapability **capabilities);
>  
> +int qemuMonitorJSONGetSEVCapabilities(qemuMonitorPtr mon,
> +                                      virSEVCapability **capabilities);
> +
>  int qemuMonitorJSONMigrate(qemuMonitorPtr mon,
>                             unsigned int flags,
>                             const char *uri);

Reviewed-by: Daniel P. Berrangé <berrange@xxxxxxxxxx>

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list




[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]

  Powered by Linux