linux-kernel - Re: [PATCH v2 07/13] KVM: selftests: add library for creating/interacting with SEV guests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <496b5209-6b1c-1205-ed0e-733af6386f8d@redhat.com>
Date:   Wed, 22 Dec 2021 15:52:49 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Michael Roth <michael.roth@....com>,
        Peter Gonda <pgonda@...gle.com>
Cc:     linux-kselftest@...r.kernel.org, kvm list <kvm@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        the arch/x86 maintainers <x86@...nel.org>,
        Nathan Tempelman <natet@...gle.com>,
        Marc Orr <marcorr@...gle.com>,
        Steve Rutherford <srutherford@...gle.com>,
        Sean Christopherson <seanjc@...gle.com>,
        Mingwei Zhang <mizhang@...gle.com>,
        Brijesh Singh <brijesh.singh@....com>,
        Tom Lendacky <thomas.lendacky@....com>,
        Varad Gautam <varad.gautam@...e.com>,
        Shuah Khan <shuah@...nel.org>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        David Woodhouse <dwmw@...zon.co.uk>,
        Ricardo Koller <ricarkol@...gle.com>,
        Jim Mattson <jmattson@...gle.com>,
        Joerg Roedel <joro@...tes.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        "H . Peter Anvin" <hpa@...or.com>,
        Krish Sadhukhan <krish.sadhukhan@...cle.com>
Subject: Re: [PATCH v2 07/13] KVM: selftests: add library for
 creating/interacting with SEV guests

On 12/17/21 17:17, Michael Roth wrote:
>>> +void kvm_sev_ioctl(struct sev_vm *sev, int cmd, void *data)
>>> +{
>>> +       struct kvm_sev_cmd arg = {0};
>>> +       int ret;
>>> +
>>> +       arg.id = cmd;
>>> +       arg.sev_fd = sev->fd;
>>> +       arg.data = (__u64)data;
>>> +
>>> +       ret = ioctl(vm_get_fd(sev->vm), KVM_MEMORY_ENCRYPT_OP, &arg);
>> If the helper vm_get_fd() exists why not add another which takes a
>> struct sev_vm. So you can do __vm_get_fd(sev) here?
> I can add it as a local helper for now, maybe sev_get_kvm_fd(), to
> distinguish from the SEV_PATH fd? I'm not sure it's worth exporting it
> as part of the library though since vm_get_fd(sev_get_vm(sev)) would be
> more familiar to callers that are already used to the kvm_util library.
> 

I also prefer the one that you suggest.

>> Can you dedup this from  sev_ioctl() in sev_migrate_tests.c? That
>> function already correctly asserts the fw_error.
> 
> This is a little bit awkward since sev_ioctl() in sev_migrate_tests opens
> SEV_PATH on demand whereas this one pulls it out of struct sev_vm. I
> could make kvm_sev_ioctl() expect the KVM fd as a parameter but that
> means external callers need another call to pull it out of struct
> sev_vm.

Yeah, it's a bit weird because sev_migrate_tests do not use struct 
sev_vm.  Unless you port them first, you could have both 
kvm_vm_sev_ioctl that takes a struct kvm_vm, and sev_vm_ioctl that takes 
a struct sev_vm.  Then you only need to change the argument of 
verify_mirror_allowed_cmds to struct kvm_vm.

Paolo