File 4b561d49-amd-host-validate-check.patch of Package libvirt.29527

Overview Repositories Revisions Requests Users Attributes Meta

File 4b561d49-amd-host-validate-check.patch of Package libvirt.29527

commit 4b561d49ad5d6cc45766714253adb798bb99b6e8
Author: Boris Fiuczynski <fiuczy@linux.ibm.com>
Date:   Mon Jun 15 10:28:10 2020 +0200

tools: Secure guest check for AMD in virt-host-validate
    
    Add checking in virt-host-validate for secure guest support
    on x86 for AMD Secure Encrypted Virtualization.
    
    Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
    Reviewed-by: Paulo de Rezende Pinatti <ppinatti@linux.ibm.com>
    Reviewed-by: Bjoern Walk <bwalk@linux.ibm.com>
    Reviewed-by: Erik Skultety <eskultet@redhat.com>

Index: libvirt-6.0.0/tools/virt-host-validate-common.c
===================================================================
--- libvirt-6.0.0.orig/tools/virt-host-validate-common.c
+++ libvirt-6.0.0/tools/virt-host-validate-common.c
@@ -40,7 +40,8 @@ VIR_ENUM_IMPL(virHostValidateCPUFlag,
               "vmx",
               "svm",
               "sie",
-              "158");
+              "158",
+              "sev");
 
 static bool quiet;
 
@@ -420,14 +421,18 @@ int virHostValidateSecureGuests(const ch
 {
     virBitmapPtr flags;
     bool hasFac158 = false;
+    bool hasAMDSev = false;
     virArch arch = virArchFromHost();
     g_autofree char *cmdline = NULL;
     static const char *kIBMValues[] = {"y", "Y", "on", "ON", "oN", "On", "1"};
+    g_autofree char *mod_value = NULL;
 
     flags = virHostValidateGetCPUFlags();
 
     if (flags && virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_FACILITY_158))
         hasFac158 = true;
+    else if (flags && virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_SEV))
+        hasAMDSev = true;
 
     virBitmapFree(flags);
 
@@ -463,6 +468,29 @@ int virHostValidateSecureGuests(const ch
             virHostMsgFail(level, "Hardware or firmware does not provide "
                                   "support for IBM Secure Execution");
         }
+    } else if (hasAMDSev) {
+        if (virFileReadValueString(&mod_value, "/sys/module/kvm_amd/parameters/sev") < 0) {
+            virHostMsgFail(level, "AMD Secure Encrypted Virtualization not "
+                                  "supported by the currently used kernel");
+            return 0;
+        }
+
+        if (mod_value[0] != '1') {
+            virHostMsgFail(level,
+                           "AMD Secure Encrypted Virtualization appears to be "
+                           "disabled in kernel. Add kvm_amd.sev=1 "
+                           "to the kernel cmdline arguments");
+            return 0;
+        }
+
+        if (virFileExists("/dev/sev")) {
+            virHostMsgPass();
+            return 1;
+        } else {
+            virHostMsgFail(level,
+                           "AMD Secure Encrypted Virtualization appears to be "
+                           "disabled in firemare.");
+        }
     } else {
         virHostMsgFail(level,
                        "Unknown if this platform has Secure Guest support");
Index: libvirt-6.0.0/tools/virt-host-validate-common.h
===================================================================
--- libvirt-6.0.0.orig/tools/virt-host-validate-common.h
+++ libvirt-6.0.0/tools/virt-host-validate-common.h
@@ -39,6 +39,7 @@ typedef enum {
     VIR_HOST_VALIDATE_CPU_FLAG_SVM,
     VIR_HOST_VALIDATE_CPU_FLAG_SIE,
     VIR_HOST_VALIDATE_CPU_FLAG_FACILITY_158,
+    VIR_HOST_VALIDATE_CPU_FLAG_SEV,
 
     VIR_HOST_VALIDATE_CPU_FLAG_LAST,
 } virHostValidateCPUFlag;

Places

File 4b561d49-amd-host-validate-check.patch of Package libvirt.29527

Places