From 60145485232cf1c4f3e9314ddb8a99d0473d785a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 11:19:49 +0200 Subject: [PATCH 01/40] MAINTAINERS: Add myself as reviewer of the 'Memory API' MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Having developed interest with the Memory API, volunteer to review the patches. Signed-off-by: Philippe Mathieu-Daudé Acked-by: David Hildenbrand Message-Id: <20211007091949.319404-1-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 50435b8d2f..32b668e92f 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -2502,6 +2502,7 @@ Memory API M: Paolo Bonzini M: Peter Xu M: David Hildenbrand +R: Philippe Mathieu-Daudé S: Supported F: include/exec/ioport.h F: include/exec/memop.h From 8009806ec81ff2caa711c99e87ca394f9ba50565 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Wed, 6 Oct 2021 04:33:15 -0400 Subject: [PATCH 02/40] tests: add missing dependency for check-block qemu-iotests run qemu-storage-daemon, make sure it is up to date. Signed-off-by: Paolo Bonzini --- tests/Makefile.include | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/Makefile.include b/tests/Makefile.include index 7bb8961515..cc1e4f2c07 100644 --- a/tests/Makefile.include +++ b/tests/Makefile.include @@ -151,6 +151,7 @@ ifeq ($(CONFIG_TOOLS)$(CONFIG_POSIX),yy) check: check-block export PYTHON check-block: $(SRC_PATH)/tests/check-block.sh qemu-img$(EXESUF) \ + storage-daemon/qemu-storage-daemon$(EXESUF) \ qemu-io$(EXESUF) qemu-nbd$(EXESUF) $(QEMU_IOTESTS_HELPERS-y) \ $(filter qemu-system-%, $(ninja-targets)) @$< From 097a5f19a357b6bc699a05ccd119bfa89ea409cc Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Wed, 6 Oct 2021 04:18:27 -0400 Subject: [PATCH 03/40] build: fix "make check" without earlier "make" "make check", if not preceded by "make", will not build the tools needed by qemu-iotests. This happens because qemu-iotests, aka "make check-block", is not yet part of meson.build. While at it, remove the reference to the now-dead QEMU_IOTESTS_HELPERS-y variable. Signed-off-by: Paolo Bonzini --- tests/Makefile.include | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/tests/Makefile.include b/tests/Makefile.include index cc1e4f2c07..8434a33fe6 100644 --- a/tests/Makefile.include +++ b/tests/Makefile.include @@ -150,14 +150,21 @@ check: ifeq ($(CONFIG_TOOLS)$(CONFIG_POSIX),yy) check: check-block export PYTHON -check-block: $(SRC_PATH)/tests/check-block.sh qemu-img$(EXESUF) \ - storage-daemon/qemu-storage-daemon$(EXESUF) \ - qemu-io$(EXESUF) qemu-nbd$(EXESUF) $(QEMU_IOTESTS_HELPERS-y) \ - $(filter qemu-system-%, $(ninja-targets)) + +ifneq ($(filter check check-block check-build, $(MAKECMDGOALS)),) +ninja-cmd-goals += \ + qemu-img$(EXESUF) \ + qemu-io$(EXESUF) \ + qemu-nbd$(EXESUF) \ + storage-daemon/qemu-storage-daemon$(EXESUF) \ + $(filter qemu-system-%, $(ninja-targets)) +endif + +check-block: $(SRC_PATH)/tests/check-block.sh run-ninja @$< endif -check-build: $(QEMU_IOTESTS_HELPERS-y) +check-build: run-ninja check-clean: rm -rf $(TESTS_VENV_DIR) $(TESTS_RESULTS_DIR) From ecc00666a020368ec2c3712c40386dc7ea75a8a9 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Wed, 6 Oct 2021 11:24:22 +0200 Subject: [PATCH 04/40] qemu-iotests: flush after every test This makes it possible to see what is happening, even if the output of "make check-block" is not sent to a tty (for example if it is sent to grep or tee). Reviewed-by: Richard Henderson Signed-off-by: Paolo Bonzini --- tests/qemu-iotests/testrunner.py | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/qemu-iotests/testrunner.py b/tests/qemu-iotests/testrunner.py index a56b6da396..0e29c2fddd 100644 --- a/tests/qemu-iotests/testrunner.py +++ b/tests/qemu-iotests/testrunner.py @@ -341,6 +341,7 @@ class TestRunner(ContextManager['TestRunner']): elif res.status == 'not run': notrun.append(name) + sys.stdout.flush() if res.interrupted: break From 6bd17dccb63e152266cf7a7399931c9fe11bc8cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20S=C5=82omi=C5=84ski?= Date: Sun, 5 Sep 2021 03:16:22 +0200 Subject: [PATCH 05/40] util/compatfd.c: use libc signalfd wrapper instead of raw syscall MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This allows the use of native signalfd instead of the sigtimedwait based emulation on systems other than Linux. Signed-off-by: Kacper Słomiński Message-Id: <20210905011621.200785-1-kacper.slominski72@gmail.com> Signed-off-by: Paolo Bonzini --- meson.build | 7 +++---- util/compatfd.c | 5 ++--- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/meson.build b/meson.build index 99a0a3e689..2d373a61a6 100644 --- a/meson.build +++ b/meson.build @@ -1420,10 +1420,9 @@ config_host_data.set('CONFIG_POSIX_MADVISE', cc.links(gnu_source_prefix + ''' #include int main(void) { return posix_madvise(NULL, 0, POSIX_MADV_DONTNEED); }''')) config_host_data.set('CONFIG_SIGNALFD', cc.links(gnu_source_prefix + ''' - #include - #include - #include - int main(void) { return syscall(SYS_signalfd, -1, NULL, _NSIG / 8); }''')) + #include + #include + int main(void) { return signalfd(-1, NULL, SFD_CLOEXEC); }''')) config_host_data.set('CONFIG_SPLICE', cc.links(gnu_source_prefix + ''' #include #include diff --git a/util/compatfd.c b/util/compatfd.c index a8ec525c6c..ab810c42a9 100644 --- a/util/compatfd.c +++ b/util/compatfd.c @@ -17,7 +17,7 @@ #include "qemu/thread.h" #if defined(CONFIG_SIGNALFD) -#include +#include #endif struct sigfd_compat_info { @@ -96,9 +96,8 @@ int qemu_signalfd(const sigset_t *mask) #if defined(CONFIG_SIGNALFD) int ret; - ret = syscall(SYS_signalfd, -1, mask, _NSIG / 8); + ret = signalfd(-1, mask, SFD_CLOEXEC); if (ret != -1) { - qemu_set_cloexec(ret); return ret; } #endif From b50f6dc174cf391d725fca895d74c441b23e2e47 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:16:54 +0200 Subject: [PATCH 06/40] qapi/misc-target: Wrap long 'SEV Attestation Report' long lines MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Wrap long lines before 70 characters for legibility. Suggested-by: Markus Armbruster Reviewed-by: Markus Armbruster Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-2-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- qapi/misc-target.json | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/qapi/misc-target.json b/qapi/misc-target.json index 594fbd1577..ae5577e039 100644 --- a/qapi/misc-target.json +++ b/qapi/misc-target.json @@ -300,8 +300,8 @@ ## # @SevAttestationReport: # -# The struct describes attestation report for a Secure Encrypted Virtualization -# feature. +# The struct describes attestation report for a Secure Encrypted +# Virtualization feature. # # @data: guest attestation report (base64 encoded) # @@ -315,10 +315,11 @@ ## # @query-sev-attestation-report: # -# This command is used to get the SEV attestation report, and is supported on AMD -# X86 platforms only. +# This command is used to get the SEV attestation report, and is +# supported on AMD X86 platforms only. # -# @mnonce: a random 16 bytes value encoded in base64 (it will be included in report) +# @mnonce: a random 16 bytes value encoded in base64 (it will be +# included in report) # # Returns: SevAttestationReport objects. # @@ -326,11 +327,13 @@ # # Example: # -# -> { "execute" : "query-sev-attestation-report", "arguments": { "mnonce": "aaaaaaa" } } +# -> { "execute" : "query-sev-attestation-report", +# "arguments": { "mnonce": "aaaaaaa" } } # <- { "return" : { "data": "aaaaaaaabbbddddd"} } # ## -{ 'command': 'query-sev-attestation-report', 'data': { 'mnonce': 'str' }, +{ 'command': 'query-sev-attestation-report', + 'data': { 'mnonce': 'str' }, 'returns': 'SevAttestationReport', 'if': 'TARGET_I386' } From 993e26058d10756f5e206742c20b0cd03a9cb973 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:16:55 +0200 Subject: [PATCH 07/40] qapi/misc-target: Group SEV QAPI definitions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There is already a section with various SEV commands / types, so move the SEV guest attestation together. Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-3-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- qapi/misc-target.json | 80 +++++++++++++++++++++---------------------- 1 file changed, 40 insertions(+), 40 deletions(-) diff --git a/qapi/misc-target.json b/qapi/misc-target.json index ae5577e039..5aa2b95b7d 100644 --- a/qapi/misc-target.json +++ b/qapi/misc-target.json @@ -229,6 +229,46 @@ 'data': { 'packet-header': 'str', 'secret': 'str', '*gpa': 'uint64' }, 'if': 'TARGET_I386' } +## +# @SevAttestationReport: +# +# The struct describes attestation report for a Secure Encrypted +# Virtualization feature. +# +# @data: guest attestation report (base64 encoded) +# +# +# Since: 6.1 +## +{ 'struct': 'SevAttestationReport', + 'data': { 'data': 'str'}, + 'if': 'TARGET_I386' } + +## +# @query-sev-attestation-report: +# +# This command is used to get the SEV attestation report, and is +# supported on AMD X86 platforms only. +# +# @mnonce: a random 16 bytes value encoded in base64 (it will be +# included in report) +# +# Returns: SevAttestationReport objects. +# +# Since: 6.1 +# +# Example: +# +# -> { "execute" : "query-sev-attestation-report", +# "arguments": { "mnonce": "aaaaaaa" } } +# <- { "return" : { "data": "aaaaaaaabbbddddd"} } +# +## +{ 'command': 'query-sev-attestation-report', + 'data': { 'mnonce': 'str' }, + 'returns': 'SevAttestationReport', + 'if': 'TARGET_I386' } + ## # @dump-skeys: # @@ -297,46 +337,6 @@ 'if': 'TARGET_ARM' } -## -# @SevAttestationReport: -# -# The struct describes attestation report for a Secure Encrypted -# Virtualization feature. -# -# @data: guest attestation report (base64 encoded) -# -# -# Since: 6.1 -## -{ 'struct': 'SevAttestationReport', - 'data': { 'data': 'str'}, - 'if': 'TARGET_I386' } - -## -# @query-sev-attestation-report: -# -# This command is used to get the SEV attestation report, and is -# supported on AMD X86 platforms only. -# -# @mnonce: a random 16 bytes value encoded in base64 (it will be -# included in report) -# -# Returns: SevAttestationReport objects. -# -# Since: 6.1 -# -# Example: -# -# -> { "execute" : "query-sev-attestation-report", -# "arguments": { "mnonce": "aaaaaaa" } } -# <- { "return" : { "data": "aaaaaaaabbbddddd"} } -# -## -{ 'command': 'query-sev-attestation-report', - 'data': { 'mnonce': 'str' }, - 'returns': 'SevAttestationReport', - 'if': 'TARGET_I386' } - ## # @SGXInfo: # From 02310f3a91470575a103857222d3a6e8acea338e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:16:56 +0200 Subject: [PATCH 08/40] target/i386/kvm: Introduce i386_softmmu_kvm Meson source set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Introduce the i386_softmmu_kvm Meson source set to be able to add features dependent on CONFIG_KVM. Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-4-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/kvm/meson.build | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/target/i386/kvm/meson.build b/target/i386/kvm/meson.build index 0a533411ca..b1c76957c7 100644 --- a/target/i386/kvm/meson.build +++ b/target/i386/kvm/meson.build @@ -1,8 +1,12 @@ i386_ss.add(when: 'CONFIG_KVM', if_false: files('kvm-stub.c')) -i386_softmmu_ss.add(when: 'CONFIG_KVM', if_true: files( +i386_softmmu_kvm_ss = ss.source_set() + +i386_softmmu_kvm_ss.add(files( 'kvm.c', 'kvm-cpu.c', )) i386_softmmu_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'), if_false: files('hyperv-stub.c')) + +i386_softmmu_ss.add_all(when: 'CONFIG_KVM', if_true: i386_softmmu_kvm_ss) From 773ab6cb16b34272dc7eb8171824924c38dbeb90 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:16:57 +0200 Subject: [PATCH 09/40] target/i386/kvm: Restrict SEV stubs to x86 architecture MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SEV is x86-specific, no need to add its stub to other architectures. Move the stub file to target/i386/kvm/. Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-5-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- accel/kvm/meson.build | 1 - target/i386/kvm/meson.build | 2 ++ {accel => target/i386}/kvm/sev-stub.c | 0 3 files changed, 2 insertions(+), 1 deletion(-) rename {accel => target/i386}/kvm/sev-stub.c (100%) diff --git a/accel/kvm/meson.build b/accel/kvm/meson.build index 8d219bea50..397a1fe1fd 100644 --- a/accel/kvm/meson.build +++ b/accel/kvm/meson.build @@ -3,6 +3,5 @@ kvm_ss.add(files( 'kvm-all.c', 'kvm-accel-ops.c', )) -kvm_ss.add(when: 'CONFIG_SEV', if_false: files('sev-stub.c')) specific_ss.add_all(when: 'CONFIG_KVM', if_true: kvm_ss) diff --git a/target/i386/kvm/meson.build b/target/i386/kvm/meson.build index b1c76957c7..736df8b72e 100644 --- a/target/i386/kvm/meson.build +++ b/target/i386/kvm/meson.build @@ -7,6 +7,8 @@ i386_softmmu_kvm_ss.add(files( 'kvm-cpu.c', )) +i386_softmmu_kvm_ss.add(when: 'CONFIG_SEV', if_false: files('sev-stub.c')) + i386_softmmu_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'), if_false: files('hyperv-stub.c')) i386_softmmu_ss.add_all(when: 'CONFIG_KVM', if_true: i386_softmmu_kvm_ss) diff --git a/accel/kvm/sev-stub.c b/target/i386/kvm/sev-stub.c similarity index 100% rename from accel/kvm/sev-stub.c rename to target/i386/kvm/sev-stub.c From 2c7233eb103adbf567778270b69950dd7a776c72 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:16:58 +0200 Subject: [PATCH 10/40] target/i386/sev: Prefix QMP errors with 'SEV' MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Multiple errors might be reported to the monitor, better to prefix the SEV ones so we can distinct them. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Dr. David Alan Gilbert Message-Id: <20211007161716.453984-6-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/monitor.c | 2 +- target/i386/sev.c | 20 +++++++++++--------- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/target/i386/monitor.c b/target/i386/monitor.c index 196c1c9e77..eabbeb9be9 100644 --- a/target/i386/monitor.c +++ b/target/i386/monitor.c @@ -717,7 +717,7 @@ SevLaunchMeasureInfo *qmp_query_sev_launch_measure(Error **errp) data = sev_get_launch_measurement(); if (!data) { - error_setg(errp, "Measurement is not available"); + error_setg(errp, "SEV launch measurement is not available"); return NULL; } diff --git a/target/i386/sev.c b/target/i386/sev.c index bcd9260fa4..4f1952cd32 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -440,7 +440,8 @@ sev_get_pdh_info(int fd, guchar **pdh, size_t *pdh_len, guchar **cert_chain, r = sev_platform_ioctl(fd, SEV_PDH_CERT_EXPORT, &export, &err); if (r < 0) { if (err != SEV_RET_INVALID_LEN) { - error_setg(errp, "failed to export PDH cert ret=%d fw_err=%d (%s)", + error_setg(errp, "SEV: Failed to export PDH cert" + " ret=%d fw_err=%d (%s)", r, err, fw_error_to_str(err)); return 1; } @@ -453,7 +454,7 @@ sev_get_pdh_info(int fd, guchar **pdh, size_t *pdh_len, guchar **cert_chain, r = sev_platform_ioctl(fd, SEV_PDH_CERT_EXPORT, &export, &err); if (r < 0) { - error_setg(errp, "failed to export PDH cert ret=%d fw_err=%d (%s)", + error_setg(errp, "SEV: Failed to export PDH cert ret=%d fw_err=%d (%s)", r, err, fw_error_to_str(err)); goto e_free; } @@ -491,7 +492,7 @@ sev_get_capabilities(Error **errp) fd = open(DEFAULT_SEV_DEVICE, O_RDWR); if (fd < 0) { - error_setg_errno(errp, errno, "Failed to open %s", + error_setg_errno(errp, errno, "SEV: Failed to open %s", DEFAULT_SEV_DEVICE); return NULL; } @@ -557,8 +558,9 @@ sev_get_attestation_report(const char *mnonce, Error **errp) &input, &err); if (ret < 0) { if (err != SEV_RET_INVALID_LEN) { - error_setg(errp, "failed to query the attestation report length " - "ret=%d fw_err=%d (%s)", ret, err, fw_error_to_str(err)); + error_setg(errp, "SEV: Failed to query the attestation report" + " length ret=%d fw_err=%d (%s)", + ret, err, fw_error_to_str(err)); g_free(buf); return NULL; } @@ -572,7 +574,7 @@ sev_get_attestation_report(const char *mnonce, Error **errp) ret = sev_ioctl(sev->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT, &input, &err); if (ret) { - error_setg_errno(errp, errno, "Failed to get attestation report" + error_setg_errno(errp, errno, "SEV: Failed to get attestation report" " ret=%d fw_err=%d (%s)", ret, err, fw_error_to_str(err)); goto e_free_data; } @@ -596,7 +598,7 @@ sev_read_file_base64(const char *filename, guchar **data, gsize *len) GError *error = NULL; if (!g_file_get_contents(filename, &base64, &sz, &error)) { - error_report("failed to read '%s' (%s)", filename, error->message); + error_report("SEV: Failed to read '%s' (%s)", filename, error->message); g_error_free(error); return -1; } @@ -911,7 +913,7 @@ sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp) if (sev_check_state(sev_guest, SEV_STATE_LAUNCH_UPDATE)) { int ret = sev_launch_update_data(sev_guest, ptr, len); if (ret < 0) { - error_setg(errp, "failed to encrypt pflash rom"); + error_setg(errp, "SEV: Failed to encrypt pflash rom"); return ret; } } @@ -930,7 +932,7 @@ int sev_inject_launch_secret(const char *packet_hdr, const char *secret, MemoryRegion *mr = NULL; if (!sev_guest) { - error_setg(errp, "SEV: SEV not enabled."); + error_setg(errp, "SEV not enabled for guest"); return 1; } From 9f885cac701325ebcbf7e4393aa9b21b32ec3c12 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:16:59 +0200 Subject: [PATCH 11/40] target/i386/monitor: Return QMP error when SEV is not enabled for guest MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If the management layer tries to inject a secret, it gets an empty response in case the guest doesn't have SEV enabled, or the binary is built without SEV: { "execute": "sev-inject-launch-secret", "arguments": { "packet-header": "mypkt", "secret": "mypass", "gpa": 4294959104 } } { "return": { } } Make it clearer by returning an error: { "execute": "sev-inject-launch-secret", "arguments": { "packet-header": "mypkt", "secret": "mypass", "gpa": 4294959104 } } { "error": { "class": "GenericError", "desc": "SEV not enabled for guest" } } Note: we will remove the sev_inject_launch_secret() stub in few commits, so we don't bother to add error_setg() there. Reviewed-by: Dr. David Alan Gilbert Reviewed-by: Connor Kuehl Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-7-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/monitor.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/target/i386/monitor.c b/target/i386/monitor.c index eabbeb9be9..ea836678f5 100644 --- a/target/i386/monitor.c +++ b/target/i386/monitor.c @@ -28,6 +28,7 @@ #include "monitor/hmp-target.h" #include "monitor/hmp.h" #include "qapi/qmp/qdict.h" +#include "qapi/qmp/qerror.h" #include "sysemu/kvm.h" #include "sysemu/sev.h" #include "qapi/error.h" @@ -743,6 +744,10 @@ void qmp_sev_inject_launch_secret(const char *packet_hdr, bool has_gpa, uint64_t gpa, Error **errp) { + if (!sev_enabled()) { + error_setg(errp, "SEV not enabled for guest"); + return; + } if (!has_gpa) { uint8_t *data; struct sev_secret_area *area; From f83aeeaeba1cf3e25d6292d9cc12064bfe2e78ab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:00 +0200 Subject: [PATCH 12/40] target/i386/cpu: Add missing 'qapi/error.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Commit 00b81053244 ("target-i386: Remove assert_no_error usage") forgot to add the "qapi/error.h" for &error_abort, add it now. Reviewed-by: Dr. David Alan Gilbert Reviewed-by: Connor Kuehl Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-8-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/cpu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/target/i386/cpu.c b/target/i386/cpu.c index a7b1b6aa93..b54b98551e 100644 --- a/target/i386/cpu.c +++ b/target/i386/cpu.c @@ -27,6 +27,7 @@ #include "sysemu/hvf.h" #include "kvm/kvm_i386.h" #include "sev_i386.h" +#include "qapi/error.h" #include "qapi/qapi-visit-machine.h" #include "qapi/qmp/qerror.h" #include "qapi/qapi-commands-machine-target.h" From 40cbafe05bb8f463d9dc096985ceff5d2535dc56 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:01 +0200 Subject: [PATCH 13/40] target/i386/sev_i386.h: Remove unused headers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Declarations don't require these headers, remove them. Reviewed-by: Connor Kuehl Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-9-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/sev-stub.c | 1 + target/i386/sev_i386.h | 4 ---- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/target/i386/sev-stub.c b/target/i386/sev-stub.c index d8e6583171..408441768d 100644 --- a/target/i386/sev-stub.c +++ b/target/i386/sev-stub.c @@ -12,6 +12,7 @@ */ #include "qemu/osdep.h" +#include "qapi/error.h" #include "sev_i386.h" SevInfo *sev_get_info(void) diff --git a/target/i386/sev_i386.h b/target/i386/sev_i386.h index 2afe108069..9bf6cd1878 100644 --- a/target/i386/sev_i386.h +++ b/target/i386/sev_i386.h @@ -14,11 +14,7 @@ #ifndef QEMU_SEV_I386_H #define QEMU_SEV_I386_H -#include "qom/object.h" -#include "qapi/error.h" -#include "sysemu/kvm.h" #include "sysemu/sev.h" -#include "qemu/error-report.h" #include "qapi/qapi-types-misc-target.h" #define SEV_POLICY_NODBG 0x1 From 4e7189e112966ac3a7bc884273a8b07291c3012e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:02 +0200 Subject: [PATCH 14/40] target/i386/sev: Remove sev_get_me_mask() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Unused dead code makes review harder, so remove it. Reviewed-by: Dr. David Alan Gilbert Reviewed-by: Connor Kuehl Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-10-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/sev-stub.c | 5 ----- target/i386/sev.c | 9 --------- target/i386/sev_i386.h | 1 - 3 files changed, 15 deletions(-) diff --git a/target/i386/sev-stub.c b/target/i386/sev-stub.c index 408441768d..20b1e18ec1 100644 --- a/target/i386/sev-stub.c +++ b/target/i386/sev-stub.c @@ -25,11 +25,6 @@ bool sev_enabled(void) return false; } -uint64_t sev_get_me_mask(void) -{ - return ~0; -} - uint32_t sev_get_cbit_position(void) { return 0; diff --git a/target/i386/sev.c b/target/i386/sev.c index 4f1952cd32..9e3f2ec8dd 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -65,7 +65,6 @@ struct SevGuestState { uint8_t api_major; uint8_t api_minor; uint8_t build_id; - uint64_t me_mask; int sev_fd; SevState state; gchar *measurement; @@ -389,12 +388,6 @@ sev_es_enabled(void) return sev_enabled() && (sev_guest->policy & SEV_POLICY_ES); } -uint64_t -sev_get_me_mask(void) -{ - return sev_guest ? sev_guest->me_mask : ~0; -} - uint32_t sev_get_cbit_position(void) { @@ -833,8 +826,6 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) goto err; } - sev->me_mask = ~(1UL << sev->cbitpos); - devname = object_property_get_str(OBJECT(sev), "sev-device", NULL); sev->sev_fd = open(devname, O_RDWR); if (sev->sev_fd < 0) { diff --git a/target/i386/sev_i386.h b/target/i386/sev_i386.h index 9bf6cd1878..d83428fa26 100644 --- a/target/i386/sev_i386.h +++ b/target/i386/sev_i386.h @@ -36,7 +36,6 @@ typedef struct SevKernelLoaderContext { } SevKernelLoaderContext; extern bool sev_es_enabled(void); -extern uint64_t sev_get_me_mask(void); extern SevInfo *sev_get_info(void); extern uint32_t sev_get_cbit_position(void); extern uint32_t sev_get_reduced_phys_bits(void); From d58d9f55a78a69730b4f1641f1c969d8585b970b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:03 +0200 Subject: [PATCH 15/40] target/i386/sev: Mark unreachable code with g_assert_not_reached() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The unique sev_encrypt_flash() invocation (in pc_system_flash_map) is protected by the "if (sev_enabled())" check, so is not reacheable. Replace the abort() call in sev_es_save_reset_vector() by g_assert_not_reached() which meaning is clearer. Reviewed-by: Connor Kuehl Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-11-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/sev-stub.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/target/i386/sev-stub.c b/target/i386/sev-stub.c index 20b1e18ec1..55f1ec7419 100644 --- a/target/i386/sev-stub.c +++ b/target/i386/sev-stub.c @@ -54,7 +54,7 @@ int sev_inject_launch_secret(const char *hdr, const char *secret, int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp) { - return 0; + g_assert_not_reached(); } bool sev_es_enabled(void) @@ -68,7 +68,7 @@ void sev_es_set_reset_vector(CPUState *cpu) int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size) { - abort(); + g_assert_not_reached(); } SevAttestationReport * From ed84ae720d0b28c50906412a903e598f75ee1d7c Mon Sep 17 00:00:00 2001 From: "Dr. David Alan Gilbert" Date: Thu, 7 Oct 2021 18:17:04 +0200 Subject: [PATCH 16/40] target/i386/sev: sev_get_attestation_report use g_autofree MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Removes a whole bunch of g_free's and a goto. Signed-off-by: Dr. David Alan Gilbert Reviewed-by: Connor Kuehl Reviewed-by: Brijesh Singh Message-Id: <20210603113017.34922-1-dgilbert@redhat.com> Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-12-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/sev.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index 9e3f2ec8dd..3a30ba6d94 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -521,8 +521,8 @@ sev_get_attestation_report(const char *mnonce, Error **errp) struct kvm_sev_attestation_report input = {}; SevAttestationReport *report = NULL; SevGuestState *sev = sev_guest; - guchar *data; - guchar *buf; + g_autofree guchar *data = NULL; + g_autofree guchar *buf = NULL; gsize len; int err = 0, ret; @@ -542,7 +542,6 @@ sev_get_attestation_report(const char *mnonce, Error **errp) if (len != sizeof(input.mnonce)) { error_setg(errp, "SEV: mnonce must be %zu bytes (got %" G_GSIZE_FORMAT ")", sizeof(input.mnonce), len); - g_free(buf); return NULL; } @@ -554,7 +553,6 @@ sev_get_attestation_report(const char *mnonce, Error **errp) error_setg(errp, "SEV: Failed to query the attestation report" " length ret=%d fw_err=%d (%s)", ret, err, fw_error_to_str(err)); - g_free(buf); return NULL; } } @@ -569,7 +567,7 @@ sev_get_attestation_report(const char *mnonce, Error **errp) if (ret) { error_setg_errno(errp, errno, "SEV: Failed to get attestation report" " ret=%d fw_err=%d (%s)", ret, err, fw_error_to_str(err)); - goto e_free_data; + return NULL; } report = g_new0(SevAttestationReport, 1); @@ -577,9 +575,6 @@ sev_get_attestation_report(const char *mnonce, Error **errp) trace_kvm_sev_attestation_report(mnonce, report->data); -e_free_data: - g_free(data); - g_free(buf); return report; } From 2f573c415e8c84ec79aa6deb1d04fa9fccdebca7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:05 +0200 Subject: [PATCH 17/40] target/i386/sev: Use g_autofree in sev_launch_get_measure() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use g_autofree to remove a pair of g_free/goto. Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-13-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/sev.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index 3a30ba6d94..5cbbcf0bb9 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -685,8 +685,8 @@ sev_launch_get_measure(Notifier *notifier, void *unused) { SevGuestState *sev = sev_guest; int ret, error; - guchar *data; - struct kvm_sev_launch_measure *measurement; + g_autofree guchar *data = NULL; + g_autofree struct kvm_sev_launch_measure *measurement = NULL; if (!sev_check_state(sev, SEV_STATE_LAUNCH_UPDATE)) { return; @@ -708,7 +708,7 @@ sev_launch_get_measure(Notifier *notifier, void *unused) if (!measurement->len) { error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'", __func__, ret, error, fw_error_to_str(errno)); - goto free_measurement; + return; } data = g_new0(guchar, measurement->len); @@ -720,7 +720,7 @@ sev_launch_get_measure(Notifier *notifier, void *unused) if (ret) { error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'", __func__, ret, error, fw_error_to_str(errno)); - goto free_data; + return; } sev_set_guest_state(sev, SEV_STATE_LAUNCH_SECRET); @@ -728,11 +728,6 @@ sev_launch_get_measure(Notifier *notifier, void *unused) /* encode the measurement value and emit the event */ sev->measurement = g_base64_encode(data, measurement->len); trace_kvm_sev_launch_measurement(sev->measurement); - -free_data: - g_free(data); -free_measurement: - g_free(measurement); } char * From e24b3332042b7372f4817694aec48650dcfa68a0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:06 +0200 Subject: [PATCH 18/40] target/i386/sev: Restrict SEV to system emulation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SEV is irrelevant on user emulation, so restrict it to sysemu. Some stubs are still required because used in cpu.c by x86_register_cpudef_types(), so move the sysemu specific stubs to sev-sysemu-stub.c instead. This will allow us to simplify monitor.c (which is not available in user emulation) in the next commit. Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-14-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/meson.build | 4 ++- target/i386/sev-stub.c | 43 ------------------------- target/i386/sev-sysemu-stub.c | 60 +++++++++++++++++++++++++++++++++++ 3 files changed, 63 insertions(+), 44 deletions(-) create mode 100644 target/i386/sev-sysemu-stub.c diff --git a/target/i386/meson.build b/target/i386/meson.build index dac19ec00d..a4f45c3ec1 100644 --- a/target/i386/meson.build +++ b/target/i386/meson.build @@ -6,7 +6,7 @@ i386_ss.add(files( 'xsave_helper.c', 'cpu-dump.c', )) -i386_ss.add(when: 'CONFIG_SEV', if_true: files('host-cpu.c', 'sev.c'), if_false: files('sev-stub.c')) +i386_ss.add(when: 'CONFIG_SEV', if_true: files('host-cpu.c'), if_false: files('sev-stub.c')) # x86 cpu type i386_ss.add(when: 'CONFIG_KVM', if_true: files('host-cpu.c')) @@ -20,6 +20,8 @@ i386_softmmu_ss.add(files( 'monitor.c', 'cpu-sysemu.c', )) +i386_softmmu_ss.add(when: 'CONFIG_SEV', if_true: files('sev.c'), if_false: files('sev-sysemu-stub.c')) + i386_user_ss = ss.source_set() subdir('kvm') diff --git a/target/i386/sev-stub.c b/target/i386/sev-stub.c index 55f1ec7419..170e9f50fe 100644 --- a/target/i386/sev-stub.c +++ b/target/i386/sev-stub.c @@ -15,11 +15,6 @@ #include "qapi/error.h" #include "sev_i386.h" -SevInfo *sev_get_info(void) -{ - return NULL; -} - bool sev_enabled(void) { return false; @@ -35,49 +30,11 @@ uint32_t sev_get_reduced_phys_bits(void) return 0; } -char *sev_get_launch_measurement(void) -{ - return NULL; -} - -SevCapability *sev_get_capabilities(Error **errp) -{ - error_setg(errp, "SEV is not available in this QEMU"); - return NULL; -} - -int sev_inject_launch_secret(const char *hdr, const char *secret, - uint64_t gpa, Error **errp) -{ - return 1; -} - -int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp) -{ - g_assert_not_reached(); -} - bool sev_es_enabled(void) { return false; } -void sev_es_set_reset_vector(CPUState *cpu) -{ -} - -int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size) -{ - g_assert_not_reached(); -} - -SevAttestationReport * -sev_get_attestation_report(const char *mnonce, Error **errp) -{ - error_setg(errp, "SEV is not available in this QEMU"); - return NULL; -} - bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp) { g_assert_not_reached(); diff --git a/target/i386/sev-sysemu-stub.c b/target/i386/sev-sysemu-stub.c new file mode 100644 index 0000000000..d556b4f091 --- /dev/null +++ b/target/i386/sev-sysemu-stub.c @@ -0,0 +1,60 @@ +/* + * QEMU SEV system stub + * + * Copyright Advanced Micro Devices 2018 + * + * Authors: + * Brijesh Singh + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + */ + +#include "qemu/osdep.h" +#include "qapi/qapi-commands-misc-target.h" +#include "qapi/error.h" +#include "sev_i386.h" + +SevInfo *sev_get_info(void) +{ + return NULL; +} + +char *sev_get_launch_measurement(void) +{ + return NULL; +} + +SevCapability *sev_get_capabilities(Error **errp) +{ + error_setg(errp, "SEV is not available in this QEMU"); + return NULL; +} + +int sev_inject_launch_secret(const char *hdr, const char *secret, + uint64_t gpa, Error **errp) +{ + return 1; +} + +int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp) +{ + g_assert_not_reached(); +} + +void sev_es_set_reset_vector(CPUState *cpu) +{ +} + +int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size) +{ + g_assert_not_reached(); +} + +SevAttestationReport *sev_get_attestation_report(const char *mnonce, + Error **errp) +{ + error_setg(errp, "SEV is not available in this QEMU"); + return NULL; +} From 93777de3650e7db4b0434d63dd461505b85519f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:07 +0200 Subject: [PATCH 19/40] target/i386/sev: Rename sev_i386.h -> sev.h MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SEV is a x86 specific feature, and the "sev_i386.h" header is already in target/i386/. Rename it as "sev.h" to simplify. Patch created mechanically using: $ git mv target/i386/sev_i386.h target/i386/sev.h $ sed -i s/sev_i386.h/sev.h/ $(git grep -l sev_i386.h) Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Dr. David Alan Gilbert Message-Id: <20211007161716.453984-15-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- hw/i386/x86.c | 2 +- target/i386/cpu.c | 2 +- target/i386/kvm/kvm.c | 2 +- target/i386/monitor.c | 2 +- target/i386/sev-stub.c | 2 +- target/i386/sev-sysemu-stub.c | 2 +- target/i386/sev.c | 2 +- target/i386/{sev_i386.h => sev.h} | 0 8 files changed, 7 insertions(+), 7 deletions(-) rename target/i386/{sev_i386.h => sev.h} (100%) diff --git a/hw/i386/x86.c b/hw/i386/x86.c index 0c7c054e3a..76de7e2265 100644 --- a/hw/i386/x86.c +++ b/hw/i386/x86.c @@ -47,7 +47,7 @@ #include "hw/i386/fw_cfg.h" #include "hw/intc/i8259.h" #include "hw/rtc/mc146818rtc.h" -#include "target/i386/sev_i386.h" +#include "target/i386/sev.h" #include "hw/acpi/cpu_hotplug.h" #include "hw/irq.h" diff --git a/target/i386/cpu.c b/target/i386/cpu.c index b54b98551e..8289dc87bd 100644 --- a/target/i386/cpu.c +++ b/target/i386/cpu.c @@ -26,7 +26,7 @@ #include "sysemu/reset.h" #include "sysemu/hvf.h" #include "kvm/kvm_i386.h" -#include "sev_i386.h" +#include "sev.h" #include "qapi/error.h" #include "qapi/qapi-visit-machine.h" #include "qapi/qmp/qerror.h" diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c index f25837f63f..a5f6ff63c8 100644 --- a/target/i386/kvm/kvm.c +++ b/target/i386/kvm/kvm.c @@ -28,7 +28,7 @@ #include "sysemu/kvm_int.h" #include "sysemu/runstate.h" #include "kvm_i386.h" -#include "sev_i386.h" +#include "sev.h" #include "hyperv.h" #include "hyperv-proto.h" diff --git a/target/i386/monitor.c b/target/i386/monitor.c index ea836678f5..109e4e61c0 100644 --- a/target/i386/monitor.c +++ b/target/i386/monitor.c @@ -32,7 +32,7 @@ #include "sysemu/kvm.h" #include "sysemu/sev.h" #include "qapi/error.h" -#include "sev_i386.h" +#include "sev.h" #include "qapi/qapi-commands-misc-target.h" #include "qapi/qapi-commands-misc.h" #include "hw/i386/pc.h" diff --git a/target/i386/sev-stub.c b/target/i386/sev-stub.c index 170e9f50fe..7e8b6f9a25 100644 --- a/target/i386/sev-stub.c +++ b/target/i386/sev-stub.c @@ -13,7 +13,7 @@ #include "qemu/osdep.h" #include "qapi/error.h" -#include "sev_i386.h" +#include "sev.h" bool sev_enabled(void) { diff --git a/target/i386/sev-sysemu-stub.c b/target/i386/sev-sysemu-stub.c index d556b4f091..8082781feb 100644 --- a/target/i386/sev-sysemu-stub.c +++ b/target/i386/sev-sysemu-stub.c @@ -14,7 +14,7 @@ #include "qemu/osdep.h" #include "qapi/qapi-commands-misc-target.h" #include "qapi/error.h" -#include "sev_i386.h" +#include "sev.h" SevInfo *sev_get_info(void) { diff --git a/target/i386/sev.c b/target/i386/sev.c index 5cbbcf0bb9..e43bbf3a17 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -25,7 +25,7 @@ #include "qemu/uuid.h" #include "crypto/hash.h" #include "sysemu/kvm.h" -#include "sev_i386.h" +#include "sev.h" #include "sysemu/sysemu.h" #include "sysemu/runstate.h" #include "trace.h" diff --git a/target/i386/sev_i386.h b/target/i386/sev.h similarity index 100% rename from target/i386/sev_i386.h rename to target/i386/sev.h From deae846f944a330e69109af8c807d6f2e66c95e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:08 +0200 Subject: [PATCH 20/40] target/i386/sev: Declare system-specific functions in 'sev.h' MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "sysemu/sev.h" is only used from x86-specific files. Let's move it to include/hw/i386, and merge it with target/i386/sev.h. Suggested-by: Paolo Bonzini Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-16-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- hw/i386/pc_sysfw.c | 2 +- include/sysemu/sev.h | 28 ---------------------------- target/i386/kvm/kvm.c | 1 - target/i386/kvm/sev-stub.c | 2 +- target/i386/monitor.c | 1 - target/i386/sev.h | 12 +++++++++++- 6 files changed, 13 insertions(+), 33 deletions(-) delete mode 100644 include/sysemu/sev.h diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c index 68d6b1f783..c8b17af953 100644 --- a/hw/i386/pc_sysfw.c +++ b/hw/i386/pc_sysfw.c @@ -37,7 +37,7 @@ #include "hw/qdev-properties.h" #include "hw/block/flash.h" #include "sysemu/kvm.h" -#include "sysemu/sev.h" +#include "sev.h" #define FLASH_SECTOR_SIZE 4096 diff --git a/include/sysemu/sev.h b/include/sysemu/sev.h deleted file mode 100644 index 94d821d737..0000000000 --- a/include/sysemu/sev.h +++ /dev/null @@ -1,28 +0,0 @@ -/* - * QEMU Secure Encrypted Virutualization (SEV) support - * - * Copyright: Advanced Micro Devices, 2016-2018 - * - * Authors: - * Brijesh Singh - * - * This work is licensed under the terms of the GNU GPL, version 2 or later. - * See the COPYING file in the top-level directory. - * - */ - -#ifndef QEMU_SEV_H -#define QEMU_SEV_H - -#include "sysemu/kvm.h" - -bool sev_enabled(void); -int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp); -int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp); -int sev_inject_launch_secret(const char *hdr, const char *secret, - uint64_t gpa, Error **errp); - -int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size); -void sev_es_set_reset_vector(CPUState *cpu); - -#endif diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c index a5f6ff63c8..0eb7a0340c 100644 --- a/target/i386/kvm/kvm.c +++ b/target/i386/kvm/kvm.c @@ -44,7 +44,6 @@ #include "hw/i386/intel_iommu.h" #include "hw/i386/x86-iommu.h" #include "hw/i386/e820_memory_layout.h" -#include "sysemu/sev.h" #include "hw/pci/pci.h" #include "hw/pci/msi.h" diff --git a/target/i386/kvm/sev-stub.c b/target/i386/kvm/sev-stub.c index 9587d1b2a3..6080c007a2 100644 --- a/target/i386/kvm/sev-stub.c +++ b/target/i386/kvm/sev-stub.c @@ -13,7 +13,7 @@ #include "qemu/osdep.h" #include "qemu-common.h" -#include "sysemu/sev.h" +#include "sev.h" int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) { diff --git a/target/i386/monitor.c b/target/i386/monitor.c index 109e4e61c0..935a8ee8ca 100644 --- a/target/i386/monitor.c +++ b/target/i386/monitor.c @@ -30,7 +30,6 @@ #include "qapi/qmp/qdict.h" #include "qapi/qmp/qerror.h" #include "sysemu/kvm.h" -#include "sysemu/sev.h" #include "qapi/error.h" #include "sev.h" #include "qapi/qapi-commands-misc-target.h" diff --git a/target/i386/sev.h b/target/i386/sev.h index d83428fa26..c96072bf78 100644 --- a/target/i386/sev.h +++ b/target/i386/sev.h @@ -14,7 +14,7 @@ #ifndef QEMU_SEV_I386_H #define QEMU_SEV_I386_H -#include "sysemu/sev.h" +#include "exec/confidential-guest-support.h" #include "qapi/qapi-types-misc-target.h" #define SEV_POLICY_NODBG 0x1 @@ -35,6 +35,7 @@ typedef struct SevKernelLoaderContext { size_t cmdline_size; } SevKernelLoaderContext; +bool sev_enabled(void); extern bool sev_es_enabled(void); extern SevInfo *sev_get_info(void); extern uint32_t sev_get_cbit_position(void); @@ -45,4 +46,13 @@ extern SevAttestationReport * sev_get_attestation_report(const char *mnonce, Error **errp); extern bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp); +int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp); +int sev_inject_launch_secret(const char *hdr, const char *secret, + uint64_t gpa, Error **errp); + +int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size); +void sev_es_set_reset_vector(CPUState *cpu); + +int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp); + #endif From 02eacf31374152e6fb44554a4632f477d82dd9fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:09 +0200 Subject: [PATCH 21/40] target/i386/sev: Remove stubs by using code elision MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Only declare sev_enabled() and sev_es_enabled() when CONFIG_SEV is set, to allow the compiler to elide unused code. Remove unnecessary stubs. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Eric Blake Message-Id: <20211007161716.453984-17-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/cpu.c | 13 +++++++------ target/i386/meson.build | 2 +- target/i386/sev-stub.c | 41 ----------------------------------------- target/i386/sev.h | 12 +++++++++++- 4 files changed, 19 insertions(+), 49 deletions(-) delete mode 100644 target/i386/sev-stub.c diff --git a/target/i386/cpu.c b/target/i386/cpu.c index 8289dc87bd..fc3ed80ef1 100644 --- a/target/i386/cpu.c +++ b/target/i386/cpu.c @@ -5764,12 +5764,13 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count, *edx = 0; break; case 0x8000001F: - *eax = sev_enabled() ? 0x2 : 0; - *eax |= sev_es_enabled() ? 0x8 : 0; - *ebx = sev_get_cbit_position(); - *ebx |= sev_get_reduced_phys_bits() << 6; - *ecx = 0; - *edx = 0; + *eax = *ebx = *ecx = *edx = 0; + if (sev_enabled()) { + *eax = 0x2; + *eax |= sev_es_enabled() ? 0x8 : 0; + *ebx = sev_get_cbit_position(); + *ebx |= sev_get_reduced_phys_bits() << 6; + } break; default: /* reserved values: zero */ diff --git a/target/i386/meson.build b/target/i386/meson.build index a4f45c3ec1..ae38dc9563 100644 --- a/target/i386/meson.build +++ b/target/i386/meson.build @@ -6,7 +6,7 @@ i386_ss.add(files( 'xsave_helper.c', 'cpu-dump.c', )) -i386_ss.add(when: 'CONFIG_SEV', if_true: files('host-cpu.c'), if_false: files('sev-stub.c')) +i386_ss.add(when: 'CONFIG_SEV', if_true: files('host-cpu.c')) # x86 cpu type i386_ss.add(when: 'CONFIG_KVM', if_true: files('host-cpu.c')) diff --git a/target/i386/sev-stub.c b/target/i386/sev-stub.c deleted file mode 100644 index 7e8b6f9a25..0000000000 --- a/target/i386/sev-stub.c +++ /dev/null @@ -1,41 +0,0 @@ -/* - * QEMU SEV stub - * - * Copyright Advanced Micro Devices 2018 - * - * Authors: - * Brijesh Singh - * - * This work is licensed under the terms of the GNU GPL, version 2 or later. - * See the COPYING file in the top-level directory. - * - */ - -#include "qemu/osdep.h" -#include "qapi/error.h" -#include "sev.h" - -bool sev_enabled(void) -{ - return false; -} - -uint32_t sev_get_cbit_position(void) -{ - return 0; -} - -uint32_t sev_get_reduced_phys_bits(void) -{ - return 0; -} - -bool sev_es_enabled(void) -{ - return false; -} - -bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp) -{ - g_assert_not_reached(); -} diff --git a/target/i386/sev.h b/target/i386/sev.h index c96072bf78..b6289234b0 100644 --- a/target/i386/sev.h +++ b/target/i386/sev.h @@ -14,6 +14,10 @@ #ifndef QEMU_SEV_I386_H #define QEMU_SEV_I386_H +#ifndef CONFIG_USER_ONLY +#include CONFIG_DEVICES /* CONFIG_SEV */ +#endif + #include "exec/confidential-guest-support.h" #include "qapi/qapi-types-misc-target.h" @@ -35,8 +39,14 @@ typedef struct SevKernelLoaderContext { size_t cmdline_size; } SevKernelLoaderContext; +#ifdef CONFIG_SEV bool sev_enabled(void); -extern bool sev_es_enabled(void); +bool sev_es_enabled(void); +#else +#define sev_enabled() 0 +#define sev_es_enabled() 0 +#endif + extern SevInfo *sev_get_info(void); extern uint32_t sev_get_cbit_position(void); extern uint32_t sev_get_reduced_phys_bits(void); From 3208de1cd23937254a456b95ef16658b68821a13 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:10 +0200 Subject: [PATCH 22/40] target/i386/sev: Move qmp_query_sev_attestation_report() to sev.c MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Move qmp_query_sev_attestation_report() from monitor.c to sev.c and make sev_get_attestation_report() static. We don't need the stub anymore, remove it. Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-18-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/monitor.c | 6 ------ target/i386/sev-sysemu-stub.c | 5 +++-- target/i386/sev.c | 12 ++++++++++-- target/i386/sev.h | 2 -- 4 files changed, 13 insertions(+), 12 deletions(-) diff --git a/target/i386/monitor.c b/target/i386/monitor.c index 935a8ee8ca..cf4a8a61a0 100644 --- a/target/i386/monitor.c +++ b/target/i386/monitor.c @@ -763,12 +763,6 @@ void qmp_sev_inject_launch_secret(const char *packet_hdr, sev_inject_launch_secret(packet_hdr, secret, gpa, errp); } -SevAttestationReport * -qmp_query_sev_attestation_report(const char *mnonce, Error **errp) -{ - return sev_get_attestation_report(mnonce, errp); -} - SGXInfo *qmp_query_sgx(Error **errp) { return sgx_get_info(errp); diff --git a/target/i386/sev-sysemu-stub.c b/target/i386/sev-sysemu-stub.c index 8082781feb..d5ec6b32e0 100644 --- a/target/i386/sev-sysemu-stub.c +++ b/target/i386/sev-sysemu-stub.c @@ -13,6 +13,7 @@ #include "qemu/osdep.h" #include "qapi/qapi-commands-misc-target.h" +#include "qapi/qmp/qerror.h" #include "qapi/error.h" #include "sev.h" @@ -52,8 +53,8 @@ int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size) g_assert_not_reached(); } -SevAttestationReport *sev_get_attestation_report(const char *mnonce, - Error **errp) +SevAttestationReport *qmp_query_sev_attestation_report(const char *mnonce, + Error **errp) { error_setg(errp, "SEV is not available in this QEMU"); return NULL; diff --git a/target/i386/sev.c b/target/i386/sev.c index e43bbf3a17..038fa56058 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -32,6 +32,8 @@ #include "migration/blocker.h" #include "qom/object.h" #include "monitor/monitor.h" +#include "qapi/qapi-commands-misc-target.h" +#include "qapi/qmp/qerror.h" #include "exec/confidential-guest-support.h" #include "hw/i386/pc.h" @@ -515,8 +517,8 @@ out: return cap; } -SevAttestationReport * -sev_get_attestation_report(const char *mnonce, Error **errp) +static SevAttestationReport *sev_get_attestation_report(const char *mnonce, + Error **errp) { struct kvm_sev_attestation_report input = {}; SevAttestationReport *report = NULL; @@ -578,6 +580,12 @@ sev_get_attestation_report(const char *mnonce, Error **errp) return report; } +SevAttestationReport *qmp_query_sev_attestation_report(const char *mnonce, + Error **errp) +{ + return sev_get_attestation_report(mnonce, errp); +} + static int sev_read_file_base64(const char *filename, guchar **data, gsize *len) { diff --git a/target/i386/sev.h b/target/i386/sev.h index b6289234b0..529a54acb8 100644 --- a/target/i386/sev.h +++ b/target/i386/sev.h @@ -52,8 +52,6 @@ extern uint32_t sev_get_cbit_position(void); extern uint32_t sev_get_reduced_phys_bits(void); extern char *sev_get_launch_measurement(void); extern SevCapability *sev_get_capabilities(Error **errp); -extern SevAttestationReport * -sev_get_attestation_report(const char *mnonce, Error **errp); extern bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp); int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp); From 11a6ed0e77e8dd37ccea07575791b70c0410efea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:11 +0200 Subject: [PATCH 23/40] target/i386/sev: Move qmp_sev_inject_launch_secret() to sev.c MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Move qmp_sev_inject_launch_secret() from monitor.c to sev.c and make sev_inject_launch_secret() static. We don't need the stub anymore, remove it. Previously with binaries built without SEV, management layer was getting an empty response: { "execute": "sev-inject-launch-secret", "arguments": { "packet-header": "mypkt", "secret": "mypass", "gpa": 4294959104 } } { "return": { } } Now the response is explicit, mentioning the feature is disabled: { "execute": "sev-inject-launch-secret", "arguments": { "packet-header": "mypkt", "secret": "mypass", "gpa": 4294959104 } } { "error": { "class": "GenericError", "desc": "this feature or command is not currently supported" } } Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-19-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/monitor.c | 31 ------------------------------- target/i386/sev-sysemu-stub.c | 6 +++--- target/i386/sev.c | 31 +++++++++++++++++++++++++++++++ 3 files changed, 34 insertions(+), 34 deletions(-) diff --git a/target/i386/monitor.c b/target/i386/monitor.c index cf4a8a61a0..22883ef2eb 100644 --- a/target/i386/monitor.c +++ b/target/i386/monitor.c @@ -732,37 +732,6 @@ SevCapability *qmp_query_sev_capabilities(Error **errp) return sev_get_capabilities(errp); } -#define SEV_SECRET_GUID "4c2eb361-7d9b-4cc3-8081-127c90d3d294" -struct sev_secret_area { - uint32_t base; - uint32_t size; -}; - -void qmp_sev_inject_launch_secret(const char *packet_hdr, - const char *secret, - bool has_gpa, uint64_t gpa, - Error **errp) -{ - if (!sev_enabled()) { - error_setg(errp, "SEV not enabled for guest"); - return; - } - if (!has_gpa) { - uint8_t *data; - struct sev_secret_area *area; - - if (!pc_system_ovmf_table_find(SEV_SECRET_GUID, &data, NULL)) { - error_setg(errp, "SEV: no secret area found in OVMF," - " gpa must be specified."); - return; - } - area = (struct sev_secret_area *)data; - gpa = area->base; - } - - sev_inject_launch_secret(packet_hdr, secret, gpa, errp); -} - SGXInfo *qmp_query_sgx(Error **errp) { return sgx_get_info(errp); diff --git a/target/i386/sev-sysemu-stub.c b/target/i386/sev-sysemu-stub.c index d5ec6b32e0..82c5ebb92f 100644 --- a/target/i386/sev-sysemu-stub.c +++ b/target/i386/sev-sysemu-stub.c @@ -33,10 +33,10 @@ SevCapability *sev_get_capabilities(Error **errp) return NULL; } -int sev_inject_launch_secret(const char *hdr, const char *secret, - uint64_t gpa, Error **errp) +void qmp_sev_inject_launch_secret(const char *packet_header, const char *secret, + bool has_gpa, uint64_t gpa, Error **errp) { - return 1; + error_setg(errp, "SEV is not available in this QEMU"); } int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp) diff --git a/target/i386/sev.c b/target/i386/sev.c index 038fa56058..072bb6f0fd 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -973,6 +973,37 @@ int sev_inject_launch_secret(const char *packet_hdr, const char *secret, return 0; } +#define SEV_SECRET_GUID "4c2eb361-7d9b-4cc3-8081-127c90d3d294" +struct sev_secret_area { + uint32_t base; + uint32_t size; +}; + +void qmp_sev_inject_launch_secret(const char *packet_hdr, + const char *secret, + bool has_gpa, uint64_t gpa, + Error **errp) +{ + if (!sev_enabled()) { + error_setg(errp, "SEV not enabled for guest"); + return; + } + if (!has_gpa) { + uint8_t *data; + struct sev_secret_area *area; + + if (!pc_system_ovmf_table_find(SEV_SECRET_GUID, &data, NULL)) { + error_setg(errp, "SEV: no secret area found in OVMF," + " gpa must be specified."); + return; + } + area = (struct sev_secret_area *)data; + gpa = area->base; + } + + sev_inject_launch_secret(packet_hdr, secret, gpa, errp); +} + static int sev_es_parse_reset_block(SevInfoBlock *info, uint32_t *addr) { From 8371df29021241b43a7a9df6369fc70f649551a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:12 +0200 Subject: [PATCH 24/40] target/i386/sev: Move qmp_query_sev_capabilities() to sev.c MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Move qmp_query_sev_capabilities() from monitor.c to sev.c and make sev_get_capabilities() static. We don't need the stub anymore, remove it. Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-20-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/monitor.c | 5 ----- target/i386/sev-sysemu-stub.c | 2 +- target/i386/sev.c | 8 ++++++-- target/i386/sev.h | 1 - 4 files changed, 7 insertions(+), 9 deletions(-) diff --git a/target/i386/monitor.c b/target/i386/monitor.c index 22883ef2eb..4c017b59b3 100644 --- a/target/i386/monitor.c +++ b/target/i386/monitor.c @@ -727,11 +727,6 @@ SevLaunchMeasureInfo *qmp_query_sev_launch_measure(Error **errp) return info; } -SevCapability *qmp_query_sev_capabilities(Error **errp) -{ - return sev_get_capabilities(errp); -} - SGXInfo *qmp_query_sgx(Error **errp) { return sgx_get_info(errp); diff --git a/target/i386/sev-sysemu-stub.c b/target/i386/sev-sysemu-stub.c index 82c5ebb92f..3e8cab4c14 100644 --- a/target/i386/sev-sysemu-stub.c +++ b/target/i386/sev-sysemu-stub.c @@ -27,7 +27,7 @@ char *sev_get_launch_measurement(void) return NULL; } -SevCapability *sev_get_capabilities(Error **errp) +SevCapability *qmp_query_sev_capabilities(Error **errp) { error_setg(errp, "SEV is not available in this QEMU"); return NULL; diff --git a/target/i386/sev.c b/target/i386/sev.c index 072bb6f0fd..56e9e03acc 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -466,8 +466,7 @@ e_free: return 1; } -SevCapability * -sev_get_capabilities(Error **errp) +static SevCapability *sev_get_capabilities(Error **errp) { SevCapability *cap = NULL; guchar *pdh_data = NULL; @@ -517,6 +516,11 @@ out: return cap; } +SevCapability *qmp_query_sev_capabilities(Error **errp) +{ + return sev_get_capabilities(errp); +} + static SevAttestationReport *sev_get_attestation_report(const char *mnonce, Error **errp) { diff --git a/target/i386/sev.h b/target/i386/sev.h index 529a54acb8..35e702e57b 100644 --- a/target/i386/sev.h +++ b/target/i386/sev.h @@ -51,7 +51,6 @@ extern SevInfo *sev_get_info(void); extern uint32_t sev_get_cbit_position(void); extern uint32_t sev_get_reduced_phys_bits(void); extern char *sev_get_launch_measurement(void); -extern SevCapability *sev_get_capabilities(Error **errp); extern bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp); int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp); From 0875a7038b8de0d79479a7d4662f0a9cdfa61940 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:13 +0200 Subject: [PATCH 25/40] target/i386/sev: Move qmp_query_sev_launch_measure() to sev.c MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Move qmp_query_sev_launch_measure() from monitor.c to sev.c and make sev_get_launch_measurement() static. We don't need the stub anymore, remove it. Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-21-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/monitor.c | 17 ----------------- target/i386/sev-sysemu-stub.c | 3 ++- target/i386/sev.c | 20 ++++++++++++++++++-- target/i386/sev.h | 1 - 4 files changed, 20 insertions(+), 21 deletions(-) diff --git a/target/i386/monitor.c b/target/i386/monitor.c index 4c017b59b3..bd24d0d473 100644 --- a/target/i386/monitor.c +++ b/target/i386/monitor.c @@ -710,23 +710,6 @@ void hmp_info_sev(Monitor *mon, const QDict *qdict) qapi_free_SevInfo(info); } -SevLaunchMeasureInfo *qmp_query_sev_launch_measure(Error **errp) -{ - char *data; - SevLaunchMeasureInfo *info; - - data = sev_get_launch_measurement(); - if (!data) { - error_setg(errp, "SEV launch measurement is not available"); - return NULL; - } - - info = g_malloc0(sizeof(*info)); - info->data = data; - - return info; -} - SGXInfo *qmp_query_sgx(Error **errp) { return sgx_get_info(errp); diff --git a/target/i386/sev-sysemu-stub.c b/target/i386/sev-sysemu-stub.c index 3e8cab4c14..8d97d7c7e1 100644 --- a/target/i386/sev-sysemu-stub.c +++ b/target/i386/sev-sysemu-stub.c @@ -22,8 +22,9 @@ SevInfo *sev_get_info(void) return NULL; } -char *sev_get_launch_measurement(void) +SevLaunchMeasureInfo *qmp_query_sev_launch_measure(Error **errp) { + error_setg(errp, "SEV is not available in this QEMU"); return NULL; } diff --git a/target/i386/sev.c b/target/i386/sev.c index 56e9e03acc..ec874b3df8 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -742,8 +742,7 @@ sev_launch_get_measure(Notifier *notifier, void *unused) trace_kvm_sev_launch_measurement(sev->measurement); } -char * -sev_get_launch_measurement(void) +static char *sev_get_launch_measurement(void) { if (sev_guest && sev_guest->state >= SEV_STATE_LAUNCH_SECRET) { @@ -753,6 +752,23 @@ sev_get_launch_measurement(void) return NULL; } +SevLaunchMeasureInfo *qmp_query_sev_launch_measure(Error **errp) +{ + char *data; + SevLaunchMeasureInfo *info; + + data = sev_get_launch_measurement(); + if (!data) { + error_setg(errp, "SEV launch measurement is not available"); + return NULL; + } + + info = g_malloc0(sizeof(*info)); + info->data = data; + + return info; +} + static Notifier sev_machine_done_notify = { .notify = sev_launch_get_measure, }; diff --git a/target/i386/sev.h b/target/i386/sev.h index 35e702e57b..9ee1429395 100644 --- a/target/i386/sev.h +++ b/target/i386/sev.h @@ -50,7 +50,6 @@ bool sev_es_enabled(void); extern SevInfo *sev_get_info(void); extern uint32_t sev_get_cbit_position(void); extern uint32_t sev_get_reduced_phys_bits(void); -extern char *sev_get_launch_measurement(void); extern bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp); int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp); From aa3950182f902a48f60d7040069b092eb5aaae21 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:14 +0200 Subject: [PATCH 26/40] target/i386/sev: Move qmp_query_sev() & hmp_info_sev() to sev.c MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Move qmp_query_sev() & hmp_info_sev()() from monitor.c to sev.c and make sev_get_info() static. We don't need the stub anymore, remove it. Add a stub for hmp_info_sev(). Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-22-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- target/i386/monitor.c | 35 -------------------------------- target/i386/sev-sysemu-stub.c | 10 ++++++++- target/i386/sev.c | 38 +++++++++++++++++++++++++++++++++-- target/i386/sev.h | 2 -- 4 files changed, 45 insertions(+), 40 deletions(-) diff --git a/target/i386/monitor.c b/target/i386/monitor.c index bd24d0d473..680d282591 100644 --- a/target/i386/monitor.c +++ b/target/i386/monitor.c @@ -31,7 +31,6 @@ #include "qapi/qmp/qerror.h" #include "sysemu/kvm.h" #include "qapi/error.h" -#include "sev.h" #include "qapi/qapi-commands-misc-target.h" #include "qapi/qapi-commands-misc.h" #include "hw/i386/pc.h" @@ -676,40 +675,6 @@ void hmp_info_io_apic(Monitor *mon, const QDict *qdict) "removed soon. Please use 'info pic' instead.\n"); } -SevInfo *qmp_query_sev(Error **errp) -{ - SevInfo *info; - - info = sev_get_info(); - if (!info) { - error_setg(errp, "SEV feature is not available"); - return NULL; - } - - return info; -} - -void hmp_info_sev(Monitor *mon, const QDict *qdict) -{ - SevInfo *info = sev_get_info(); - - if (info && info->enabled) { - monitor_printf(mon, "handle: %d\n", info->handle); - monitor_printf(mon, "state: %s\n", SevState_str(info->state)); - monitor_printf(mon, "build: %d\n", info->build_id); - monitor_printf(mon, "api version: %d.%d\n", - info->api_major, info->api_minor); - monitor_printf(mon, "debug: %s\n", - info->policy & SEV_POLICY_NODBG ? "off" : "on"); - monitor_printf(mon, "key-sharing: %s\n", - info->policy & SEV_POLICY_NOKS ? "off" : "on"); - } else { - monitor_printf(mon, "SEV is not enabled\n"); - } - - qapi_free_SevInfo(info); -} - SGXInfo *qmp_query_sgx(Error **errp) { return sgx_get_info(errp); diff --git a/target/i386/sev-sysemu-stub.c b/target/i386/sev-sysemu-stub.c index 8d97d7c7e1..68518fd3f9 100644 --- a/target/i386/sev-sysemu-stub.c +++ b/target/i386/sev-sysemu-stub.c @@ -12,13 +12,16 @@ */ #include "qemu/osdep.h" +#include "monitor/monitor.h" +#include "monitor/hmp.h" #include "qapi/qapi-commands-misc-target.h" #include "qapi/qmp/qerror.h" #include "qapi/error.h" #include "sev.h" -SevInfo *sev_get_info(void) +SevInfo *qmp_query_sev(Error **errp) { + error_setg(errp, "SEV is not available in this QEMU"); return NULL; } @@ -60,3 +63,8 @@ SevAttestationReport *qmp_query_sev_attestation_report(const char *mnonce, error_setg(errp, "SEV is not available in this QEMU"); return NULL; } + +void hmp_info_sev(Monitor *mon, const QDict *qdict) +{ + monitor_printf(mon, "SEV is not available in this QEMU\n"); +} diff --git a/target/i386/sev.c b/target/i386/sev.c index ec874b3df8..19504796fb 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -32,6 +32,7 @@ #include "migration/blocker.h" #include "qom/object.h" #include "monitor/monitor.h" +#include "monitor/hmp.h" #include "qapi/qapi-commands-misc-target.h" #include "qapi/qmp/qerror.h" #include "exec/confidential-guest-support.h" @@ -402,8 +403,7 @@ sev_get_reduced_phys_bits(void) return sev_guest ? sev_guest->reduced_phys_bits : 0; } -SevInfo * -sev_get_info(void) +static SevInfo *sev_get_info(void) { SevInfo *info; @@ -422,6 +422,40 @@ sev_get_info(void) return info; } +SevInfo *qmp_query_sev(Error **errp) +{ + SevInfo *info; + + info = sev_get_info(); + if (!info) { + error_setg(errp, "SEV feature is not available"); + return NULL; + } + + return info; +} + +void hmp_info_sev(Monitor *mon, const QDict *qdict) +{ + SevInfo *info = sev_get_info(); + + if (info && info->enabled) { + monitor_printf(mon, "handle: %d\n", info->handle); + monitor_printf(mon, "state: %s\n", SevState_str(info->state)); + monitor_printf(mon, "build: %d\n", info->build_id); + monitor_printf(mon, "api version: %d.%d\n", + info->api_major, info->api_minor); + monitor_printf(mon, "debug: %s\n", + info->policy & SEV_POLICY_NODBG ? "off" : "on"); + monitor_printf(mon, "key-sharing: %s\n", + info->policy & SEV_POLICY_NOKS ? "off" : "on"); + } else { + monitor_printf(mon, "SEV is not enabled\n"); + } + + qapi_free_SevInfo(info); +} + static int sev_get_pdh_info(int fd, guchar **pdh, size_t *pdh_len, guchar **cert_chain, size_t *cert_chain_len, Error **errp) diff --git a/target/i386/sev.h b/target/i386/sev.h index 9ee1429395..83e82aa42c 100644 --- a/target/i386/sev.h +++ b/target/i386/sev.h @@ -19,7 +19,6 @@ #endif #include "exec/confidential-guest-support.h" -#include "qapi/qapi-types-misc-target.h" #define SEV_POLICY_NODBG 0x1 #define SEV_POLICY_NOKS 0x2 @@ -47,7 +46,6 @@ bool sev_es_enabled(void); #define sev_es_enabled() 0 #endif -extern SevInfo *sev_get_info(void); extern uint32_t sev_get_cbit_position(void); extern uint32_t sev_get_reduced_phys_bits(void); extern bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp); From cd35beb488c655a86da60d85949c026387187171 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:15 +0200 Subject: [PATCH 27/40] monitor: Reduce hmp_info_sev() declaration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit While being conditionally used for TARGET_I386 in hmp-commands-info.hx, hmp_info_sev() is declared for all targets. Reduce its declaration to target including "monitor/hmp-target.h". This is a minor cleanup. Reviewed-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-23-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- include/monitor/hmp-target.h | 1 + include/monitor/hmp.h | 1 - target/i386/sev-sysemu-stub.c | 2 +- target/i386/sev.c | 2 +- 4 files changed, 3 insertions(+), 3 deletions(-) diff --git a/include/monitor/hmp-target.h b/include/monitor/hmp-target.h index dc53add7ee..96956d0fc4 100644 --- a/include/monitor/hmp-target.h +++ b/include/monitor/hmp-target.h @@ -49,6 +49,7 @@ void hmp_info_tlb(Monitor *mon, const QDict *qdict); void hmp_mce(Monitor *mon, const QDict *qdict); void hmp_info_local_apic(Monitor *mon, const QDict *qdict); void hmp_info_io_apic(Monitor *mon, const QDict *qdict); +void hmp_info_sev(Monitor *mon, const QDict *qdict); void hmp_info_sgx(Monitor *mon, const QDict *qdict); #endif /* MONITOR_HMP_TARGET_H */ diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h index 3baa1058e2..6bc27639e0 100644 --- a/include/monitor/hmp.h +++ b/include/monitor/hmp.h @@ -124,7 +124,6 @@ void hmp_info_ramblock(Monitor *mon, const QDict *qdict); void hmp_hotpluggable_cpus(Monitor *mon, const QDict *qdict); void hmp_info_vm_generation_id(Monitor *mon, const QDict *qdict); void hmp_info_memory_size_summary(Monitor *mon, const QDict *qdict); -void hmp_info_sev(Monitor *mon, const QDict *qdict); void hmp_info_replay(Monitor *mon, const QDict *qdict); void hmp_replay_break(Monitor *mon, const QDict *qdict); void hmp_replay_delete_break(Monitor *mon, const QDict *qdict); diff --git a/target/i386/sev-sysemu-stub.c b/target/i386/sev-sysemu-stub.c index 68518fd3f9..7a29295d1e 100644 --- a/target/i386/sev-sysemu-stub.c +++ b/target/i386/sev-sysemu-stub.c @@ -13,7 +13,7 @@ #include "qemu/osdep.h" #include "monitor/monitor.h" -#include "monitor/hmp.h" +#include "monitor/hmp-target.h" #include "qapi/qapi-commands-misc-target.h" #include "qapi/qmp/qerror.h" #include "qapi/error.h" diff --git a/target/i386/sev.c b/target/i386/sev.c index 19504796fb..4c64c68244 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -32,7 +32,7 @@ #include "migration/blocker.h" #include "qom/object.h" #include "monitor/monitor.h" -#include "monitor/hmp.h" +#include "monitor/hmp-target.h" #include "qapi/qapi-commands-misc-target.h" #include "qapi/qmp/qerror.h" #include "exec/confidential-guest-support.h" From 8c9e7f8c8a6de68be1e31a645f7d76855fc219ba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 18:17:16 +0200 Subject: [PATCH 28/40] MAINTAINERS: Cover SEV-related files with X86/KVM section MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Complete the x86/KVM section with SEV-related files. Suggested-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007161716.453984-24-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- MAINTAINERS | 2 ++ 1 file changed, 2 insertions(+) diff --git a/MAINTAINERS b/MAINTAINERS index 32b668e92f..e31c190b47 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -417,7 +417,9 @@ M: Paolo Bonzini M: Marcelo Tosatti L: kvm@vger.kernel.org S: Supported +F: docs/amd-memory-encryption.txt F: target/i386/kvm/ +F: target/i386/sev* F: scripts/kvm/vmxcap Guest CPU Cores (other accelerators) From f1279fc15bf4315fb8e103e6eabaee014ce1f914 Mon Sep 17 00:00:00 2001 From: Thomas Huth Date: Tue, 28 Sep 2021 18:02:32 +0200 Subject: [PATCH 29/40] qapi: Make some ObjectTypes depend on the build settings Some of the ObjectType entries already depend on CONFIG_* switches. Some others also only make sense with certain configurations, but are currently always listed in the ObjectType enum. Let's make them depend on the correpsonding CONFIG_* switches, too, so that upper layers (like libvirt) have a better way to determine which features are available in QEMU. Signed-off-by: Thomas Huth Reviewed-by: Markus Armbruster Message-Id: <20210928160232.432980-1-thuth@redhat.com> [Do the same for MemoryBackendEpcProperties. - Paolo] Signed-off-by: Paolo Bonzini --- qapi/qom.json | 36 ++++++++++++++++++++++++------------ 1 file changed, 24 insertions(+), 12 deletions(-) diff --git a/qapi/qom.json b/qapi/qom.json index 0222bb4506..7231ac3f34 100644 --- a/qapi/qom.json +++ b/qapi/qom.json @@ -794,7 +794,8 @@ 'authz-pam', 'authz-simple', 'can-bus', - 'can-host-socketcan', + { 'name': 'can-host-socketcan', + 'if': 'CONFIG_LINUX' }, 'colo-compare', 'cryptodev-backend', 'cryptodev-backend-builtin', @@ -808,21 +809,26 @@ 'filter-replay', 'filter-rewriter', 'input-barrier', - 'input-linux', + { 'name': 'input-linux', + 'if': 'CONFIG_LINUX' }, 'iothread', + { 'name': 'memory-backend-epc', + 'if': 'CONFIG_LINUX' }, 'memory-backend-file', { 'name': 'memory-backend-memfd', 'if': 'CONFIG_LINUX' }, 'memory-backend-ram', - 'memory-backend-epc', 'pef-guest', - 'pr-manager-helper', + { 'name': 'pr-manager-helper', + 'if': 'CONFIG_LINUX' }, 'qtest', 'rng-builtin', 'rng-egd', - 'rng-random', + { 'name': 'rng-random', + 'if': 'CONFIG_POSIX' }, 'secret', - 'secret_keyring', + { 'name': 'secret_keyring', + 'if': 'CONFIG_SECRET_KEYRING' }, 'sev-guest', 's390-pv-guest', 'throttle-group', @@ -853,7 +859,8 @@ 'authz-listfile': 'AuthZListFileProperties', 'authz-pam': 'AuthZPAMProperties', 'authz-simple': 'AuthZSimpleProperties', - 'can-host-socketcan': 'CanHostSocketcanProperties', + 'can-host-socketcan': { 'type': 'CanHostSocketcanProperties', + 'if': 'CONFIG_LINUX' }, 'colo-compare': 'ColoCompareProperties', 'cryptodev-backend': 'CryptodevBackendProperties', 'cryptodev-backend-builtin': 'CryptodevBackendProperties', @@ -867,20 +874,25 @@ 'filter-replay': 'NetfilterProperties', 'filter-rewriter': 'FilterRewriterProperties', 'input-barrier': 'InputBarrierProperties', - 'input-linux': 'InputLinuxProperties', + 'input-linux': { 'type': 'InputLinuxProperties', + 'if': 'CONFIG_LINUX' }, 'iothread': 'IothreadProperties', + 'memory-backend-epc': { 'type': 'MemoryBackendEpcProperties', + 'if': 'CONFIG_LINUX' }, 'memory-backend-file': 'MemoryBackendFileProperties', 'memory-backend-memfd': { 'type': 'MemoryBackendMemfdProperties', 'if': 'CONFIG_LINUX' }, 'memory-backend-ram': 'MemoryBackendProperties', - 'memory-backend-epc': 'MemoryBackendEpcProperties', - 'pr-manager-helper': 'PrManagerHelperProperties', + 'pr-manager-helper': { 'type': 'PrManagerHelperProperties', + 'if': 'CONFIG_LINUX' }, 'qtest': 'QtestProperties', 'rng-builtin': 'RngProperties', 'rng-egd': 'RngEgdProperties', - 'rng-random': 'RngRandomProperties', + 'rng-random': { 'type': 'RngRandomProperties', + 'if': 'CONFIG_POSIX' }, 'secret': 'SecretProperties', - 'secret_keyring': 'SecretKeyringProperties', + 'secret_keyring': { 'type': 'SecretKeyringProperties', + 'if': 'CONFIG_SECRET_KEYRING' }, 'sev-guest': 'SevGuestProperties', 'throttle-group': 'ThrottleGroupProperties', 'tls-creds-anon': 'TlsCredsAnonProperties', From 8e751e9c38e324737fd3d3aa0562f886313bba3c Mon Sep 17 00:00:00 2001 From: Cole Robinson Date: Fri, 8 Oct 2021 12:21:01 -0400 Subject: [PATCH 30/40] tests: tcg: Fix PVH test with binutils 2.36+ binutils started adding a .note.gnu.property ELF section which makes the PVH test fail: TEST hello on x86_64 qemu-system-x86_64: Error loading uncompressed kernel without PVH ELF Note Discard .note.gnu* while keeping the PVH .note bits intact. This also strips the build-id note, so drop the related comment. Signed-off-by: Cole Robinson Message-Id: <5ab2a54c262c61f64c22dbb49ade3e2db8a740bb.1633708346.git.crobinso@redhat.com> Signed-off-by: Paolo Bonzini --- tests/tcg/x86_64/system/kernel.ld | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/tcg/x86_64/system/kernel.ld b/tests/tcg/x86_64/system/kernel.ld index 49c12b04ae..ca5d6bd850 100644 --- a/tests/tcg/x86_64/system/kernel.ld +++ b/tests/tcg/x86_64/system/kernel.ld @@ -16,7 +16,10 @@ SECTIONS { *(.rodata) } :text - /* Keep build ID and PVH notes in same section */ + /DISCARD/ : { + *(.note.gnu*) + } + .notes : { *(.note.*) } :note From dec490db8b5c98d60814d07c23ddf70708a56d6e Mon Sep 17 00:00:00 2001 From: Alexander Graf Date: Fri, 8 Oct 2021 07:46:16 +0200 Subject: [PATCH 31/40] hvf: Determine slot count from struct layout We can handle up to a static amount of memory slots, capped by the size of an internal array. Let's make sure that array size is the only source of truth for the number of elements in that array. Signed-off-by: Alexander Graf Reviewed-by: Richard Henderson Message-Id: <20211008054616.43828-1-agraf@csgraf.de> Signed-off-by: Paolo Bonzini --- accel/hvf/hvf-accel-ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c index 6cbd2c3f97..2b2c411076 100644 --- a/accel/hvf/hvf-accel-ops.c +++ b/accel/hvf/hvf-accel-ops.c @@ -321,7 +321,7 @@ static int hvf_accel_init(MachineState *ms) s = g_new0(HVFState, 1); - s->num_slots = 32; + s->num_slots = ARRAY_SIZE(s->slots); for (x = 0; x < s->num_slots; ++x) { s->slots[x].size = 0; s->slots[x].slot_id = x; From a821186ec02ecf5ac4949ed42410bf2095bcea66 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 19:56:09 +0200 Subject: [PATCH 32/40] MAINTAINERS: Cover SGX documentation file with X86/KVM section MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Yang Zhong Cc: Paolo Bonzini Cc: Marcelo Tosatti Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007175612.496366-2-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index e31c190b47..cfefe386ea 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -418,6 +418,7 @@ M: Marcelo Tosatti L: kvm@vger.kernel.org S: Supported F: docs/amd-memory-encryption.txt +F: docs/system/i386/sgx.rst F: target/i386/kvm/ F: target/i386/sev* F: scripts/kvm/vmxcap From 05fc8db720a2effad2fe523ab45c1ce5f8f32379 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 19:56:10 +0200 Subject: [PATCH 33/40] hw/i386/sgx: Have sgx_epc_get_section() return a boolean MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007175612.496366-3-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- hw/i386/sgx-stub.c | 2 +- hw/i386/sgx.c | 6 +++--- include/hw/i386/sgx-epc.h | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/hw/i386/sgx-stub.c b/hw/i386/sgx-stub.c index 3be9f5ca32..45c473119e 100644 --- a/hw/i386/sgx-stub.c +++ b/hw/i386/sgx-stub.c @@ -20,7 +20,7 @@ void pc_machine_init_sgx_epc(PCMachineState *pcms) memset(&pcms->sgx_epc, 0, sizeof(SGXEPCState)); } -int sgx_epc_get_section(int section_nr, uint64_t *addr, uint64_t *size) +bool sgx_epc_get_section(int section_nr, uint64_t *addr, uint64_t *size) { g_assert_not_reached(); } diff --git a/hw/i386/sgx.c b/hw/i386/sgx.c index e481e9358f..29724ff8f0 100644 --- a/hw/i386/sgx.c +++ b/hw/i386/sgx.c @@ -115,13 +115,13 @@ SGXInfo *sgx_get_info(Error **errp) return info; } -int sgx_epc_get_section(int section_nr, uint64_t *addr, uint64_t *size) +bool sgx_epc_get_section(int section_nr, uint64_t *addr, uint64_t *size) { PCMachineState *pcms = PC_MACHINE(qdev_get_machine()); SGXEPCDevice *epc; if (pcms->sgx_epc.size == 0 || pcms->sgx_epc.nr_sections <= section_nr) { - return 1; + return true; } epc = pcms->sgx_epc.sections[section_nr]; @@ -129,7 +129,7 @@ int sgx_epc_get_section(int section_nr, uint64_t *addr, uint64_t *size) *addr = epc->addr; *size = memory_device_get_region_size(MEMORY_DEVICE(epc), &error_fatal); - return 0; + return false; } void pc_machine_init_sgx_epc(PCMachineState *pcms) diff --git a/include/hw/i386/sgx-epc.h b/include/hw/i386/sgx-epc.h index 65a68ca753..a6a65be854 100644 --- a/include/hw/i386/sgx-epc.h +++ b/include/hw/i386/sgx-epc.h @@ -55,7 +55,7 @@ typedef struct SGXEPCState { int nr_sections; } SGXEPCState; -int sgx_epc_get_section(int section_nr, uint64_t *addr, uint64_t *size); +bool sgx_epc_get_section(int section_nr, uint64_t *addr, uint64_t *size); static inline uint64_t sgx_epc_above_4g_end(SGXEPCState *sgx_epc) { From 021658566b71e138db46434849f0556bab3fc30b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 19:56:11 +0200 Subject: [PATCH 34/40] hw/i386/sgx: Move qmp_query_sgx_capabilities() to hw/i386/sgx.c MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Move qmp_query_sgx_capabilities() from target/i386/monitor.c to hw/i386/sgx.c, removing the sgx_get_capabilities() indirection. Suggested-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007175612.496366-4-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- hw/i386/sgx-stub.c | 4 +++- hw/i386/sgx.c | 3 ++- include/hw/i386/sgx.h | 1 - target/i386/monitor.c | 5 ----- 4 files changed, 5 insertions(+), 8 deletions(-) diff --git a/hw/i386/sgx-stub.c b/hw/i386/sgx-stub.c index 45c473119e..3749656db1 100644 --- a/hw/i386/sgx-stub.c +++ b/hw/i386/sgx-stub.c @@ -2,6 +2,8 @@ #include "hw/i386/pc.h" #include "hw/i386/sgx-epc.h" #include "hw/i386/sgx.h" +#include "qapi/error.h" +#include "qapi/qapi-commands-misc-target.h" SGXInfo *sgx_get_info(Error **errp) { @@ -9,7 +11,7 @@ SGXInfo *sgx_get_info(Error **errp) return NULL; } -SGXInfo *sgx_get_capabilities(Error **errp) +SGXInfo *qmp_query_sgx_capabilities(Error **errp) { error_setg(errp, "SGX support is not compiled in"); return NULL; diff --git a/hw/i386/sgx.c b/hw/i386/sgx.c index 29724ff8f0..713f136343 100644 --- a/hw/i386/sgx.c +++ b/hw/i386/sgx.c @@ -16,6 +16,7 @@ #include "hw/mem/memory-device.h" #include "monitor/qdev.h" #include "qapi/error.h" +#include "qapi/qapi-commands-misc-target.h" #include "exec/address-spaces.h" #include "hw/i386/sgx.h" #include "sysemu/hw_accel.h" @@ -57,7 +58,7 @@ static uint64_t sgx_calc_host_epc_section_size(void) return size; } -SGXInfo *sgx_get_capabilities(Error **errp) +SGXInfo *qmp_query_sgx_capabilities(Error **errp) { SGXInfo *info = NULL; uint32_t eax, ebx, ecx, edx; diff --git a/include/hw/i386/sgx.h b/include/hw/i386/sgx.h index 16fc25725c..2bf90b3f4f 100644 --- a/include/hw/i386/sgx.h +++ b/include/hw/i386/sgx.h @@ -7,6 +7,5 @@ #include "qapi/qapi-types-misc-target.h" SGXInfo *sgx_get_info(Error **errp); -SGXInfo *sgx_get_capabilities(Error **errp); #endif diff --git a/target/i386/monitor.c b/target/i386/monitor.c index 680d282591..84fba47f19 100644 --- a/target/i386/monitor.c +++ b/target/i386/monitor.c @@ -700,8 +700,3 @@ void hmp_info_sgx(Monitor *mon, const QDict *qdict) monitor_printf(mon, "size: %" PRIu64 "\n", info->section_size); } - -SGXInfo *qmp_query_sgx_capabilities(Error **errp) -{ - return sgx_get_capabilities(errp); -} From 6e81733e27a250af7507c3dd5ae945c473ab0d6b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 7 Oct 2021 19:56:12 +0200 Subject: [PATCH 35/40] hw/i386/sgx: Move qmp_query_sgx() and hmp_info_sgx() to hw/i386/sgx.c MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Move qmp_query_sgx() and hmp_info_sgx() from target/i386/monitor.c to hw/i386/sgx.c, removing the sgx_get_info() indirection and the "hw/i386/sgx.h" header. Suggested-by: Paolo Bonzini Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20211007175612.496366-5-philmd@redhat.com> Signed-off-by: Paolo Bonzini --- hw/i386/sgx-stub.c | 10 ++++++++-- hw/i386/sgx.c | 26 ++++++++++++++++++++++++-- include/hw/i386/sgx.h | 11 ----------- target/i386/monitor.c | 27 --------------------------- 4 files changed, 32 insertions(+), 42 deletions(-) delete mode 100644 include/hw/i386/sgx.h diff --git a/hw/i386/sgx-stub.c b/hw/i386/sgx-stub.c index 3749656db1..c9b379e665 100644 --- a/hw/i386/sgx-stub.c +++ b/hw/i386/sgx-stub.c @@ -1,11 +1,12 @@ #include "qemu/osdep.h" +#include "monitor/monitor.h" +#include "monitor/hmp-target.h" #include "hw/i386/pc.h" #include "hw/i386/sgx-epc.h" -#include "hw/i386/sgx.h" #include "qapi/error.h" #include "qapi/qapi-commands-misc-target.h" -SGXInfo *sgx_get_info(Error **errp) +SGXInfo *qmp_query_sgx(Error **errp) { error_setg(errp, "SGX support is not compiled in"); return NULL; @@ -17,6 +18,11 @@ SGXInfo *qmp_query_sgx_capabilities(Error **errp) return NULL; } +void hmp_info_sgx(Monitor *mon, const QDict *qdict) +{ + monitor_printf(mon, "SGX is not available in this QEMU\n"); +} + void pc_machine_init_sgx_epc(PCMachineState *pcms) { memset(&pcms->sgx_epc, 0, sizeof(SGXEPCState)); diff --git a/hw/i386/sgx.c b/hw/i386/sgx.c index 713f136343..11607568b6 100644 --- a/hw/i386/sgx.c +++ b/hw/i386/sgx.c @@ -15,10 +15,11 @@ #include "hw/i386/sgx-epc.h" #include "hw/mem/memory-device.h" #include "monitor/qdev.h" +#include "monitor/monitor.h" +#include "monitor/hmp-target.h" #include "qapi/error.h" #include "qapi/qapi-commands-misc-target.h" #include "exec/address-spaces.h" -#include "hw/i386/sgx.h" #include "sysemu/hw_accel.h" #define SGX_MAX_EPC_SECTIONS 8 @@ -86,7 +87,7 @@ SGXInfo *qmp_query_sgx_capabilities(Error **errp) return info; } -SGXInfo *sgx_get_info(Error **errp) +SGXInfo *qmp_query_sgx(Error **errp) { SGXInfo *info = NULL; X86MachineState *x86ms; @@ -116,6 +117,27 @@ SGXInfo *sgx_get_info(Error **errp) return info; } +void hmp_info_sgx(Monitor *mon, const QDict *qdict) +{ + Error *err = NULL; + g_autoptr(SGXInfo) info = qmp_query_sgx(&err); + + if (err) { + error_report_err(err); + return; + } + monitor_printf(mon, "SGX support: %s\n", + info->sgx ? "enabled" : "disabled"); + monitor_printf(mon, "SGX1 support: %s\n", + info->sgx1 ? "enabled" : "disabled"); + monitor_printf(mon, "SGX2 support: %s\n", + info->sgx2 ? "enabled" : "disabled"); + monitor_printf(mon, "FLC support: %s\n", + info->flc ? "enabled" : "disabled"); + monitor_printf(mon, "size: %" PRIu64 "\n", + info->section_size); +} + bool sgx_epc_get_section(int section_nr, uint64_t *addr, uint64_t *size) { PCMachineState *pcms = PC_MACHINE(qdev_get_machine()); diff --git a/include/hw/i386/sgx.h b/include/hw/i386/sgx.h deleted file mode 100644 index 2bf90b3f4f..0000000000 --- a/include/hw/i386/sgx.h +++ /dev/null @@ -1,11 +0,0 @@ -#ifndef QEMU_SGX_H -#define QEMU_SGX_H - -#include "qom/object.h" -#include "qapi/error.h" -#include "qemu/error-report.h" -#include "qapi/qapi-types-misc-target.h" - -SGXInfo *sgx_get_info(Error **errp); - -#endif diff --git a/target/i386/monitor.c b/target/i386/monitor.c index 84fba47f19..8166e17693 100644 --- a/target/i386/monitor.c +++ b/target/i386/monitor.c @@ -34,7 +34,6 @@ #include "qapi/qapi-commands-misc-target.h" #include "qapi/qapi-commands-misc.h" #include "hw/i386/pc.h" -#include "hw/i386/sgx.h" /* Perform linear address sign extension */ static hwaddr addr_canonical(CPUArchState *env, hwaddr addr) @@ -674,29 +673,3 @@ void hmp_info_io_apic(Monitor *mon, const QDict *qdict) monitor_printf(mon, "This command is obsolete and will be " "removed soon. Please use 'info pic' instead.\n"); } - -SGXInfo *qmp_query_sgx(Error **errp) -{ - return sgx_get_info(errp); -} - -void hmp_info_sgx(Monitor *mon, const QDict *qdict) -{ - Error *err = NULL; - g_autoptr(SGXInfo) info = qmp_query_sgx(&err); - - if (err) { - error_report_err(err); - return; - } - monitor_printf(mon, "SGX support: %s\n", - info->sgx ? "enabled" : "disabled"); - monitor_printf(mon, "SGX1 support: %s\n", - info->sgx1 ? "enabled" : "disabled"); - monitor_printf(mon, "SGX2 support: %s\n", - info->sgx2 ? "enabled" : "disabled"); - monitor_printf(mon, "FLC support: %s\n", - info->flc ? "enabled" : "disabled"); - monitor_printf(mon, "size: %" PRIu64 "\n", - info->section_size); -} From b71803a74612cc73eee82681f942a083038642ba Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Fri, 8 Oct 2021 20:55:01 +0200 Subject: [PATCH 36/40] Revert "hw/misc: applesmc: use host osk as default on macs" This reverts commit 93ddefbc3c909bb6c3b76086f1dfc8ad98dd3725. The commit included code under the APSL 2.0, which is incompatible with the GPL v2. Signed-off-by: Paolo Bonzini --- hw/misc/applesmc.c | 192 +-------------------------------------------- 1 file changed, 1 insertion(+), 191 deletions(-) diff --git a/hw/misc/applesmc.c b/hw/misc/applesmc.c index cec247b5ee..1b9acaf1d3 100644 --- a/hw/misc/applesmc.c +++ b/hw/misc/applesmc.c @@ -38,171 +38,6 @@ #include "qemu/timer.h" #include "qom/object.h" -#if defined(__APPLE__) && defined(__MACH__) -#include - -enum { - kSMCSuccess = 0x00, - kSMCKeyNotFound = 0x84 -}; - -enum { - kSMCUserClientOpen = 0x00, - kSMCUserClientClose = 0x01, - kSMCHandleYPCEvent = 0x02, - kSMCReadKey = 0x05, - kSMCGetKeyInfo = 0x09 -}; - -typedef struct SMCVersion { - uint8_t major; - uint8_t minor; - uint8_t build; - uint8_t reserved; - uint16_t release; -} SMCVersion; - -typedef struct SMCPLimitData { - uint16_t version; - uint16_t length; - uint32_t cpuPLimit; - uint32_t gpuPLimit; - uint32_t memPLimit; -} SMCPLimitData; - -typedef struct SMCKeyInfoData { - IOByteCount dataSize; - uint32_t dataType; - uint8_t dataAttributes; -} SMCKeyInfoData; - -typedef struct { - uint32_t key; - SMCVersion vers; - SMCPLimitData pLimitData; - SMCKeyInfoData keyInfo; - uint8_t result; - uint8_t status; - uint8_t data8; - uint32_t data32; - uint8_t bytes[32]; -} SMCParamStruct; - -static IOReturn smc_call_struct_method(uint32_t selector, - SMCParamStruct *inputStruct, - SMCParamStruct *outputStruct) -{ - IOReturn ret; - - size_t inputStructCnt = sizeof(SMCParamStruct); - size_t outputStructCnt = sizeof(SMCParamStruct); - - io_service_t smcService = IO_OBJECT_NULL; - io_connect_t smcConnect = IO_OBJECT_NULL; - - smcService = IOServiceGetMatchingService(kIOMasterPortDefault, - IOServiceMatching("AppleSMC")); - if (smcService == IO_OBJECT_NULL) { - ret = kIOReturnNotFound; - goto exit; - } - - ret = IOServiceOpen(smcService, mach_task_self(), 1, &smcConnect); - if (ret != kIOReturnSuccess) { - smcConnect = IO_OBJECT_NULL; - goto exit; - } - if (smcConnect == IO_OBJECT_NULL) { - ret = kIOReturnError; - goto exit; - } - - ret = IOConnectCallMethod(smcConnect, kSMCUserClientOpen, - NULL, 0, NULL, 0, - NULL, NULL, NULL, NULL); - if (ret != kIOReturnSuccess) { - goto exit; - } - - ret = IOConnectCallStructMethod(smcConnect, selector, - inputStruct, inputStructCnt, - outputStruct, &outputStructCnt); - -exit: - if (smcConnect != IO_OBJECT_NULL) { - IOConnectCallMethod(smcConnect, kSMCUserClientClose, - NULL, 0, NULL, 0, NULL, - NULL, NULL, NULL); - IOServiceClose(smcConnect); - } - - return ret; -} - -static IOReturn smc_read_key(uint32_t key, - uint8_t *bytes, - IOByteCount *dataSize) -{ - IOReturn ret; - - SMCParamStruct inputStruct; - SMCParamStruct outputStruct; - - if (key == 0 || bytes == NULL) { - ret = kIOReturnCannotWire; - goto exit; - } - - /* determine key's data size */ - memset(&inputStruct, 0, sizeof(SMCParamStruct)); - inputStruct.data8 = kSMCGetKeyInfo; - inputStruct.key = key; - - memset(&outputStruct, 0, sizeof(SMCParamStruct)); - ret = smc_call_struct_method(kSMCHandleYPCEvent, &inputStruct, &outputStruct); - if (ret != kIOReturnSuccess) { - goto exit; - } - if (outputStruct.result == kSMCKeyNotFound) { - ret = kIOReturnNotFound; - goto exit; - } - if (outputStruct.result != kSMCSuccess) { - ret = kIOReturnInternalError; - goto exit; - } - - /* get key value */ - memset(&inputStruct, 0, sizeof(SMCParamStruct)); - inputStruct.data8 = kSMCReadKey; - inputStruct.key = key; - inputStruct.keyInfo.dataSize = outputStruct.keyInfo.dataSize; - - memset(&outputStruct, 0, sizeof(SMCParamStruct)); - ret = smc_call_struct_method(kSMCHandleYPCEvent, &inputStruct, &outputStruct); - if (ret != kIOReturnSuccess) { - goto exit; - } - if (outputStruct.result == kSMCKeyNotFound) { - ret = kIOReturnNotFound; - goto exit; - } - if (outputStruct.result != kSMCSuccess) { - ret = kIOReturnInternalError; - goto exit; - } - - memset(bytes, 0, *dataSize); - if (*dataSize > inputStruct.keyInfo.dataSize) { - *dataSize = inputStruct.keyInfo.dataSize; - } - memcpy(bytes, outputStruct.bytes, *dataSize); - -exit: - return ret; -} -#endif - /* #define DEBUG_SMC */ #define APPLESMC_DEFAULT_IOBASE 0x300 @@ -480,7 +315,6 @@ static const MemoryRegionOps applesmc_err_io_ops = { static void applesmc_isa_realize(DeviceState *dev, Error **errp) { AppleSMCState *s = APPLE_SMC(dev); - bool valid_key = false; memory_region_init_io(&s->io_data, OBJECT(s), &applesmc_data_io_ops, s, "applesmc-data", 1); @@ -497,31 +331,7 @@ static void applesmc_isa_realize(DeviceState *dev, Error **errp) isa_register_ioport(&s->parent_obj, &s->io_err, s->iobase + APPLESMC_ERR_PORT); - if (s->osk) { - valid_key = strlen(s->osk) == 64; - } else { -#if defined(__APPLE__) && defined(__MACH__) - IOReturn ret; - IOByteCount size = 32; - - ret = smc_read_key('OSK0', (uint8_t *) default_osk, &size); - if (ret != kIOReturnSuccess) { - goto failure; - } - - ret = smc_read_key('OSK1', (uint8_t *) default_osk + size, &size); - if (ret != kIOReturnSuccess) { - goto failure; - } - - warn_report("Using AppleSMC with host key"); - valid_key = true; - s->osk = default_osk; -failure:; -#endif - } - - if (!valid_key) { + if (!s->osk || (strlen(s->osk) != 64)) { warn_report("Using AppleSMC with invalid key"); s->osk = default_osk; } From 69520261204b9a1769134ed24b92cc0fa8445951 Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Thu, 16 Sep 2021 13:17:07 +0200 Subject: [PATCH 37/40] monitor: Tidy up find_device_state() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Commit 6287d827d4 "monitor: allow device_del to accept QOM paths" extended find_device_state() to accept QOM paths in addition to qdev IDs. This added a checked conversion to TYPE_DEVICE at the end, which duplicates the check done for the qdev ID case earlier, except it sets a *different* error: GenericError "ID is not a hotpluggable device" when passed a QOM path, and DeviceNotFound "Device 'ID' not found" when passed a qdev ID. Fortunately, the latter won't happen as long as we add only devices to /machine/peripheral/. Earlier, commit b6cc36abb2 "qdev: device_del: Search for to be unplugged device in 'peripheral' container" rewrote the lookup by qdev ID to use QOM instead of qdev_find_recursive(), so it can handle buss-less devices. It does so by constructing an absolute QOM path. Works, but object_resolve_path_component() is easier. Switching to it also gets rid of the unclean duplication described above. While there, avoid converting to TYPE_DEVICE twice, first to check whether it's possible, and then for real. Signed-off-by: Markus Armbruster Reviewed-by: Damien Hedde Reviewed-by: Daniel P. Berrangé Message-Id: <20210916111707.84999-1-armbru@redhat.com> Signed-off-by: Paolo Bonzini --- softmmu/qdev-monitor.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c index 0705f00846..3df99ce9fc 100644 --- a/softmmu/qdev-monitor.c +++ b/softmmu/qdev-monitor.c @@ -836,16 +836,12 @@ void qmp_device_add(QDict *qdict, QObject **ret_data, Error **errp) static DeviceState *find_device_state(const char *id, Error **errp) { Object *obj; + DeviceState *dev; if (id[0] == '/') { obj = object_resolve_path(id, NULL); } else { - char *root_path = object_get_canonical_path(qdev_get_peripheral()); - char *path = g_strdup_printf("%s/%s", root_path, id); - - g_free(root_path); - obj = object_resolve_path_type(path, TYPE_DEVICE, NULL); - g_free(path); + obj = object_resolve_path_component(qdev_get_peripheral(), id); } if (!obj) { @@ -854,12 +850,13 @@ static DeviceState *find_device_state(const char *id, Error **errp) return NULL; } - if (!object_dynamic_cast(obj, TYPE_DEVICE)) { + dev = (DeviceState *)object_dynamic_cast(obj, TYPE_DEVICE); + if (!dev) { error_setg(errp, "%s is not a hotpluggable device", id); return NULL; } - return DEVICE(obj); + return dev; } void qdev_unplug(DeviceState *dev, Error **errp) From eb8257a261325988873e047872975b5eda03efb4 Mon Sep 17 00:00:00 2001 From: Dov Murik Date: Mon, 11 Oct 2021 17:30:25 +0000 Subject: [PATCH 38/40] target/i386/sev: Use local variable for kvm_sev_launch_start The struct kvm_sev_launch_start has a constant and small size, and therefore we can use a regular local variable for it instead of allocating and freeing heap memory for it. Signed-off-by: Dov Murik Reviewed-by: Dr. David Alan Gilbert Message-Id: <20211011173026.2454294-2-dovmurik@linux.ibm.com> Signed-off-by: Paolo Bonzini --- target/i386/sev.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index 4c64c68244..0062566c71 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -647,31 +647,29 @@ sev_launch_start(SevGuestState *sev) gsize sz; int ret = 1; int fw_error, rc; - struct kvm_sev_launch_start *start; + struct kvm_sev_launch_start start = { + .handle = sev->handle, .policy = sev->policy + }; guchar *session = NULL, *dh_cert = NULL; - start = g_new0(struct kvm_sev_launch_start, 1); - - start->handle = sev->handle; - start->policy = sev->policy; if (sev->session_file) { if (sev_read_file_base64(sev->session_file, &session, &sz) < 0) { goto out; } - start->session_uaddr = (unsigned long)session; - start->session_len = sz; + start.session_uaddr = (unsigned long)session; + start.session_len = sz; } if (sev->dh_cert_file) { if (sev_read_file_base64(sev->dh_cert_file, &dh_cert, &sz) < 0) { goto out; } - start->dh_uaddr = (unsigned long)dh_cert; - start->dh_len = sz; + start.dh_uaddr = (unsigned long)dh_cert; + start.dh_len = sz; } - trace_kvm_sev_launch_start(start->policy, session, dh_cert); - rc = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_START, start, &fw_error); + trace_kvm_sev_launch_start(start.policy, session, dh_cert); + rc = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_START, &start, &fw_error); if (rc < 0) { error_report("%s: LAUNCH_START ret=%d fw_error=%d '%s'", __func__, ret, fw_error, fw_error_to_str(fw_error)); @@ -679,11 +677,10 @@ sev_launch_start(SevGuestState *sev) } sev_set_guest_state(sev, SEV_STATE_LAUNCH_UPDATE); - sev->handle = start->handle; + sev->handle = start.handle; ret = 0; out: - g_free(start); g_free(session); g_free(dh_cert); return ret; From 59e42d88b6851b238927cbe48505b1cef547ce3b Mon Sep 17 00:00:00 2001 From: Dov Murik Date: Mon, 11 Oct 2021 17:30:26 +0000 Subject: [PATCH 39/40] target/i386/sev: Use local variable for kvm_sev_launch_measure The struct kvm_sev_launch_measure has a constant and small size, and therefore we can use a regular local variable for it instead of allocating and freeing heap memory for it. Signed-off-by: Dov Murik Reviewed-by: Dr. David Alan Gilbert Message-Id: <20211011173026.2454294-3-dovmurik@linux.ibm.com> Signed-off-by: Paolo Bonzini --- target/i386/sev.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index 0062566c71..eede07f11d 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -729,7 +729,7 @@ sev_launch_get_measure(Notifier *notifier, void *unused) SevGuestState *sev = sev_guest; int ret, error; g_autofree guchar *data = NULL; - g_autofree struct kvm_sev_launch_measure *measurement = NULL; + struct kvm_sev_launch_measure measurement = {}; if (!sev_check_state(sev, SEV_STATE_LAUNCH_UPDATE)) { return; @@ -743,23 +743,21 @@ sev_launch_get_measure(Notifier *notifier, void *unused) } } - measurement = g_new0(struct kvm_sev_launch_measure, 1); - /* query the measurement blob length */ ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_MEASURE, - measurement, &error); - if (!measurement->len) { + &measurement, &error); + if (!measurement.len) { error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'", __func__, ret, error, fw_error_to_str(errno)); return; } - data = g_new0(guchar, measurement->len); - measurement->uaddr = (unsigned long)data; + data = g_new0(guchar, measurement.len); + measurement.uaddr = (unsigned long)data; /* get the measurement blob */ ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_MEASURE, - measurement, &error); + &measurement, &error); if (ret) { error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'", __func__, ret, error, fw_error_to_str(errno)); @@ -769,7 +767,7 @@ sev_launch_get_measure(Notifier *notifier, void *unused) sev_set_guest_state(sev, SEV_STATE_LAUNCH_SECRET); /* encode the measurement value and emit the event */ - sev->measurement = g_base64_encode(data, measurement->len); + sev->measurement = g_base64_encode(data, measurement.len); trace_kvm_sev_launch_measurement(sev->measurement); } From eeecc2ede44b2a5f2551dfcebd561a3945d4c132 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Tue, 7 Sep 2021 12:45:12 +0200 Subject: [PATCH 40/40] ebpf: really include it only in system emulators MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit eBPF libraries are being included in user emulators, which is useless and also breaks --static compilation if a shared library for libbpf is present in the system. Reported-by: Alex Bennée Signed-off-by: Paolo Bonzini --- meson.build | 2 -- 1 file changed, 2 deletions(-) diff --git a/meson.build b/meson.build index 2d373a61a6..c1314baace 100644 --- a/meson.build +++ b/meson.build @@ -2300,8 +2300,6 @@ subdir('bsd-user') subdir('linux-user') subdir('ebpf') -common_ss.add(libbpf) - bsd_user_ss.add(files('gdbstub.c')) specific_ss.add_all(when: 'CONFIG_BSD_USER', if_true: bsd_user_ss)