From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
To: James Bottomley <jejb@linux.ibm.com>
Cc: thomas.lendacky@amd.com, ashish.kalra@amd.com,
brijesh.singh@amd.com, david.kaplan@amd.com, berrange@redhat.com,
jon.grimm@amd.com, tobin@ibm.com, qemu-devel@nongnu.org,
frankeh@us.ibm.com, Dov.Murik1@il.ibm.com, pbonzini@redhat.com,
dovmurik@linux.vnet.ibm.com
Subject: Re: [PATCH v2 2/2] sev: update sev-inject-launch-secret to make gpa optional
Date: Tue, 26 Jan 2021 12:32:01 +0000 [thread overview]
Message-ID: <20210126123201.GB4221@work-vm> (raw)
In-Reply-To: <20201214154429.11023-3-jejb@linux.ibm.com>
* James Bottomley (jejb@linux.ibm.com) wrote:
> If the gpa isn't specified, it's value is extracted from the OVMF
> properties table located below the reset vector (and if this doesn't
> exist, an error is returned). OVMF has defined the GUID for the SEV
> secret area as 4c2eb361-7d9b-4cc3-8081-127c90d3d294 and the format of
> the <data> is: <base>|<size> where both are uint32_t. We extract
> <base> and use it as the gpa for the injection.
>
> Note: it is expected that the injected secret will also be GUID
> described but since qemu can't interpret it, the format is left
> undefined here.
>
> Signed-off-by: James Bottomley <jejb@linux.ibm.com>
>
> ---
>
> v2: fix line length warning, add more comments about sev area
> ---
> qapi/misc-target.json | 2 +-
> target/i386/monitor.c | 27 ++++++++++++++++++++++++++-
> 2 files changed, 27 insertions(+), 2 deletions(-)
>
> diff --git a/qapi/misc-target.json b/qapi/misc-target.json
> index 06ef8757f0..0c7491cd82 100644
> --- a/qapi/misc-target.json
> +++ b/qapi/misc-target.json
> @@ -216,7 +216,7 @@
> #
> ##
> { 'command': 'sev-inject-launch-secret',
> - 'data': { 'packet-header': 'str', 'secret': 'str', 'gpa': 'uint64' },
> + 'data': { 'packet-header': 'str', 'secret': 'str', '*gpa': 'uint64' },
> 'if': 'defined(TARGET_I386)' }
>
> ##
> diff --git a/target/i386/monitor.c b/target/i386/monitor.c
> index 1bc91442b1..11bdb04155 100644
> --- a/target/i386/monitor.c
> +++ b/target/i386/monitor.c
> @@ -34,6 +34,7 @@
> #include "sev_i386.h"
> #include "qapi/qapi-commands-misc-target.h"
> #include "qapi/qapi-commands-misc.h"
> +#include "hw/i386/pc.h"
>
> /* Perform linear address sign extension */
> static hwaddr addr_canonical(CPUArchState *env, hwaddr addr)
> @@ -730,9 +731,33 @@ SevCapability *qmp_query_sev_capabilities(Error **errp)
> return sev_get_capabilities(errp);
> }
>
> +#define SEV_SECRET_GUID "4c2eb361-7d9b-4cc3-8081-127c90d3d294"
> +struct sev_secret_area {
> + uint32_t base;
> + uint32_t size;
> +};
> +
> void qmp_sev_inject_launch_secret(const char *packet_hdr,
> - const char *secret, uint64_t gpa,
> + const char *secret,
> + bool has_gpa, uint64_t gpa,
> Error **errp)
> {
> + if (!has_gpa) {
> + uint8_t *data;
> + struct sev_secret_area *area;
> +
> + /*
> + * not checking length means that this area can't be versioned
> + * by length and would have to be replaced if updated
> + */
Can you just explain that a bit more?
> + if (!pc_system_ovmf_table_find(SEV_SECRET_GUID, &data, NULL)) {
> + error_setg(errp, "SEV: no secret area found in OVMF,"
> + " gpa must be specified.");
> + return;
> + }
> + area = (struct sev_secret_area *)data;
> + gpa = area->base;
> + }
> +
> sev_inject_launch_secret(packet_hdr, secret, gpa, errp);
Other than me not understanding that comment, I think we're fine:
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
> }
> --
> 2.26.2
>
>
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
next prev parent reply other threads:[~2021-01-26 12:33 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-14 15:44 [PATCH v2 0/2] sev: enable secret injection to a self described area in OVMF James Bottomley
2020-12-14 15:44 ` [PATCH v2 1/2] pc: add parser for OVMF reset block James Bottomley
2021-01-26 12:22 ` Dr. David Alan Gilbert
2021-02-02 23:30 ` James Bottomley
2021-02-03 9:14 ` Dr. David Alan Gilbert
2020-12-14 15:44 ` [PATCH v2 2/2] sev: update sev-inject-launch-secret to make gpa optional James Bottomley
2021-01-26 12:32 ` Dr. David Alan Gilbert [this message]
2021-02-02 23:35 ` James Bottomley
2021-02-03 9:06 ` Dr. David Alan Gilbert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210126123201.GB4221@work-vm \
--to=dgilbert@redhat.com \
--cc=Dov.Murik1@il.ibm.com \
--cc=ashish.kalra@amd.com \
--cc=berrange@redhat.com \
--cc=brijesh.singh@amd.com \
--cc=david.kaplan@amd.com \
--cc=dovmurik@linux.vnet.ibm.com \
--cc=frankeh@us.ibm.com \
--cc=jejb@linux.ibm.com \
--cc=jon.grimm@amd.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=thomas.lendacky@amd.com \
--cc=tobin@ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).