From 962f3c23ce6f477cfb24f5fa66a9f296ce953759 Mon Sep 17 00:00:00 2001 Message-Id: <962f3c23ce6f477cfb24f5fa66a9f296ce953759@dist-git> From: Boris Fiuczynski Date: Wed, 24 Jun 2020 13:16:21 +0200 Subject: [PATCH] tools: Secure guest check for AMD in virt-host-validate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add checking in virt-host-validate for secure guest support on x86 for AMD Secure Encrypted Virtualization. Signed-off-by: Boris Fiuczynski Reviewed-by: Paulo de Rezende Pinatti Reviewed-by: Bjoern Walk Reviewed-by: Erik Skultety (cherry picked from commit 4b561d49ad5d6cc45766714253adb798bb99b6e8) https://bugzilla.redhat.com/show_bug.cgi?id=1848997 https://bugzilla.redhat.com/show_bug.cgi?id=1850351 Signed-off-by: Jiri Denemark Message-Id: <638121e5c2692557b1b2d716371d324d61273282.1592996194.git.jdenemar@redhat.com> Reviewed-by: Ján Tomko --- tools/virt-host-validate-common.c | 30 +++++++++++++++++++++++++++++- tools/virt-host-validate-common.h | 1 + 2 files changed, 30 insertions(+), 1 deletion(-) diff --git a/tools/virt-host-validate-common.c b/tools/virt-host-validate-common.c index e59469a49b..82e6092c01 100644 --- a/tools/virt-host-validate-common.c +++ b/tools/virt-host-validate-common.c @@ -40,7 +40,8 @@ VIR_ENUM_IMPL(virHostValidateCPUFlag, "vmx", "svm", "sie", - "158"); + "158", + "sev"); static bool quiet; @@ -420,14 +421,18 @@ int virHostValidateSecureGuests(const char *hvname, { virBitmapPtr flags; bool hasFac158 = false; + bool hasAMDSev = false; virArch arch = virArchFromHost(); g_autofree char *cmdline = NULL; static const char *kIBMValues[] = {"y", "Y", "on", "ON", "oN", "On", "1"}; + g_autofree char *mod_value = NULL; flags = virHostValidateGetCPUFlags(); if (flags && virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_FACILITY_158)) hasFac158 = true; + else if (flags && virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_SEV)) + hasAMDSev = true; virBitmapFree(flags); @@ -463,6 +468,29 @@ int virHostValidateSecureGuests(const char *hvname, virHostMsgFail(level, "Hardware or firmware does not provide " "support for IBM Secure Execution"); } + } else if (hasAMDSev) { + if (virFileReadValueString(&mod_value, "/sys/module/kvm_amd/parameters/sev") < 0) { + virHostMsgFail(level, "AMD Secure Encrypted Virtualization not " + "supported by the currently used kernel"); + return 0; + } + + if (mod_value[0] != '1') { + virHostMsgFail(level, + "AMD Secure Encrypted Virtualization appears to be " + "disabled in kernel. Add kvm_amd.sev=1 " + "to the kernel cmdline arguments"); + return 0; + } + + if (virFileExists("/dev/sev")) { + virHostMsgPass(); + return 1; + } else { + virHostMsgFail(level, + "AMD Secure Encrypted Virtualization appears to be " + "disabled in firemare."); + } } else { virHostMsgFail(level, "Unknown if this platform has Secure Guest support"); diff --git a/tools/virt-host-validate-common.h b/tools/virt-host-validate-common.h index 1653c9c95b..014331c0e0 100644 --- a/tools/virt-host-validate-common.h +++ b/tools/virt-host-validate-common.h @@ -39,6 +39,7 @@ typedef enum { VIR_HOST_VALIDATE_CPU_FLAG_SVM, VIR_HOST_VALIDATE_CPU_FLAG_SIE, VIR_HOST_VALIDATE_CPU_FLAG_FACILITY_158, + VIR_HOST_VALIDATE_CPU_FLAG_SEV, VIR_HOST_VALIDATE_CPU_FLAG_LAST, } virHostValidateCPUFlag; -- 2.27.0