|
 |
b971b8 |
From 962f3c23ce6f477cfb24f5fa66a9f296ce953759 Mon Sep 17 00:00:00 2001
|
|
|
b971b8 |
Message-Id: <962f3c23ce6f477cfb24f5fa66a9f296ce953759@dist-git>
|
|
|
b971b8 |
From: Boris Fiuczynski <fiuczy@linux.ibm.com>
|
|
|
b971b8 |
Date: Wed, 24 Jun 2020 13:16:21 +0200
|
|
|
b971b8 |
Subject: [PATCH] tools: Secure guest check for AMD in virt-host-validate
|
|
|
b971b8 |
MIME-Version: 1.0
|
|
|
b971b8 |
Content-Type: text/plain; charset=UTF-8
|
|
|
b971b8 |
Content-Transfer-Encoding: 8bit
|
|
|
b971b8 |
|
|
|
b971b8 |
Add checking in virt-host-validate for secure guest support
|
|
|
b971b8 |
on x86 for AMD Secure Encrypted Virtualization.
|
|
|
b971b8 |
|
|
|
b971b8 |
Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
|
|
|
b971b8 |
Reviewed-by: Paulo de Rezende Pinatti <ppinatti@linux.ibm.com>
|
|
|
b971b8 |
Reviewed-by: Bjoern Walk <bwalk@linux.ibm.com>
|
|
|
b971b8 |
Reviewed-by: Erik Skultety <eskultet@redhat.com>
|
|
|
b971b8 |
(cherry picked from commit 4b561d49ad5d6cc45766714253adb798bb99b6e8)
|
|
|
b971b8 |
|
|
|
b971b8 |
https://bugzilla.redhat.com/show_bug.cgi?id=1848997
|
|
|
b971b8 |
https://bugzilla.redhat.com/show_bug.cgi?id=1850351
|
|
|
b971b8 |
|
|
|
b971b8 |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
b971b8 |
Message-Id: <638121e5c2692557b1b2d716371d324d61273282.1592996194.git.jdenemar@redhat.com>
|
|
|
b971b8 |
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
|
|
b971b8 |
---
|
|
|
b971b8 |
tools/virt-host-validate-common.c | 30 +++++++++++++++++++++++++++++-
|
|
|
b971b8 |
tools/virt-host-validate-common.h | 1 +
|
|
|
b971b8 |
2 files changed, 30 insertions(+), 1 deletion(-)
|
|
|
b971b8 |
|
|
|
b971b8 |
diff --git a/tools/virt-host-validate-common.c b/tools/virt-host-validate-common.c
|
|
|
b971b8 |
index e59469a49b..82e6092c01 100644
|
|
|
b971b8 |
--- a/tools/virt-host-validate-common.c
|
|
|
b971b8 |
+++ b/tools/virt-host-validate-common.c
|
|
|
b971b8 |
@@ -40,7 +40,8 @@ VIR_ENUM_IMPL(virHostValidateCPUFlag,
|
|
|
b971b8 |
"vmx",
|
|
|
b971b8 |
"svm",
|
|
|
b971b8 |
"sie",
|
|
|
b971b8 |
- "158");
|
|
|
b971b8 |
+ "158",
|
|
|
b971b8 |
+ "sev");
|
|
|
b971b8 |
|
|
|
b971b8 |
static bool quiet;
|
|
|
b971b8 |
|
|
|
b971b8 |
@@ -420,14 +421,18 @@ int virHostValidateSecureGuests(const char *hvname,
|
|
|
b971b8 |
{
|
|
|
b971b8 |
virBitmapPtr flags;
|
|
|
b971b8 |
bool hasFac158 = false;
|
|
|
b971b8 |
+ bool hasAMDSev = false;
|
|
|
b971b8 |
virArch arch = virArchFromHost();
|
|
|
b971b8 |
g_autofree char *cmdline = NULL;
|
|
|
b971b8 |
static const char *kIBMValues[] = {"y", "Y", "on", "ON", "oN", "On", "1"};
|
|
|
b971b8 |
+ g_autofree char *mod_value = NULL;
|
|
|
b971b8 |
|
|
|
b971b8 |
flags = virHostValidateGetCPUFlags();
|
|
|
b971b8 |
|
|
|
b971b8 |
if (flags && virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_FACILITY_158))
|
|
|
b971b8 |
hasFac158 = true;
|
|
|
b971b8 |
+ else if (flags && virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_SEV))
|
|
|
b971b8 |
+ hasAMDSev = true;
|
|
|
b971b8 |
|
|
|
b971b8 |
virBitmapFree(flags);
|
|
|
b971b8 |
|
|
|
b971b8 |
@@ -463,6 +468,29 @@ int virHostValidateSecureGuests(const char *hvname,
|
|
|
b971b8 |
virHostMsgFail(level, "Hardware or firmware does not provide "
|
|
|
b971b8 |
"support for IBM Secure Execution");
|
|
|
b971b8 |
}
|
|
|
b971b8 |
+ } else if (hasAMDSev) {
|
|
|
b971b8 |
+ if (virFileReadValueString(&mod_value, "/sys/module/kvm_amd/parameters/sev") < 0) {
|
|
|
b971b8 |
+ virHostMsgFail(level, "AMD Secure Encrypted Virtualization not "
|
|
|
b971b8 |
+ "supported by the currently used kernel");
|
|
|
b971b8 |
+ return 0;
|
|
|
b971b8 |
+ }
|
|
|
b971b8 |
+
|
|
|
b971b8 |
+ if (mod_value[0] != '1') {
|
|
|
b971b8 |
+ virHostMsgFail(level,
|
|
|
b971b8 |
+ "AMD Secure Encrypted Virtualization appears to be "
|
|
|
b971b8 |
+ "disabled in kernel. Add kvm_amd.sev=1 "
|
|
|
b971b8 |
+ "to the kernel cmdline arguments");
|
|
|
b971b8 |
+ return 0;
|
|
|
b971b8 |
+ }
|
|
|
b971b8 |
+
|
|
|
b971b8 |
+ if (virFileExists("/dev/sev")) {
|
|
|
b971b8 |
+ virHostMsgPass();
|
|
|
b971b8 |
+ return 1;
|
|
|
b971b8 |
+ } else {
|
|
|
b971b8 |
+ virHostMsgFail(level,
|
|
|
b971b8 |
+ "AMD Secure Encrypted Virtualization appears to be "
|
|
|
b971b8 |
+ "disabled in firemare.");
|
|
|
b971b8 |
+ }
|
|
|
b971b8 |
} else {
|
|
|
b971b8 |
virHostMsgFail(level,
|
|
|
b971b8 |
"Unknown if this platform has Secure Guest support");
|
|
|
b971b8 |
diff --git a/tools/virt-host-validate-common.h b/tools/virt-host-validate-common.h
|
|
|
b971b8 |
index 1653c9c95b..014331c0e0 100644
|
|
|
b971b8 |
--- a/tools/virt-host-validate-common.h
|
|
|
b971b8 |
+++ b/tools/virt-host-validate-common.h
|
|
|
b971b8 |
@@ -39,6 +39,7 @@ typedef enum {
|
|
|
b971b8 |
VIR_HOST_VALIDATE_CPU_FLAG_SVM,
|
|
|
b971b8 |
VIR_HOST_VALIDATE_CPU_FLAG_SIE,
|
|
|
b971b8 |
VIR_HOST_VALIDATE_CPU_FLAG_FACILITY_158,
|
|
|
b971b8 |
+ VIR_HOST_VALIDATE_CPU_FLAG_SEV,
|
|
|
b971b8 |
|
|
|
b971b8 |
VIR_HOST_VALIDATE_CPU_FLAG_LAST,
|
|
|
b971b8 |
} virHostValidateCPUFlag;
|
|
|
b971b8 |
--
|
|
|
b971b8 |
2.27.0
|
|
|
b971b8 |
|