Bug 2030435

The aforementioned patches were pushed upstream as of: 

commit 719bb0bf23709bcbd007a65a9304dadd7e6bbeba
Author: Daniel P. Berrangé <berrange>
Date:   Wed Dec 8 08:28:48 2021 -0500

    tools: add 'nodesevinfo' virsh command
    
    While some SEV info is reported in the domain capabilities,
    for reasons of size, this excludes the certificates. The
    nodesevinfo command provides the full set of information.
    
    Reviewed-by: Peter Krempa <pkrempa>
    Signed-off-by: Daniel P. Berrangé <berrange>

commit ac79e9ff5cb362cd7e801647ac17ef80f8055b2c
Author: Daniel P. Berrangé <berrange>
Date:   Wed Dec 8 07:53:00 2021 -0500

    tools: add 'domlaunchsecinfo' virsh command
    
    This command reports the launch security parameters for
    a guest, allowing an external tool to perform a launch
    attestation.
    
    Reviewed-by: Peter Krempa <pkrempa>
    Signed-off-by: Daniel P. Berrangé <berrange>

commit 8c071180cfcdff690bff40c15aca5386598c45ad
Author: Daniel P. Berrangé <berrange>
Date:   Wed Dec 8 07:52:33 2021 -0500

    qemu: report new launch security parameters
    
    Report extra info about the SEV setup, returning those fields
    that are required to calculate the expected launch measurement
    
     HMAC(0x04 || API_MAJOR || API_MINOR || BUILD ||
          GCTX.POLICY || GCTX.LD || MNONCE; GCTX.TIK)
    
    specified in section 6.5.1 of AMD Secure Encrypted
    Virtualization API.
    
    Reviewed-by: Peter Krempa <pkrempa>
    Signed-off-by: Daniel P. Berrangé <berrange>

commit cc9679ef1452596e2509c0923d5d398fb25c176c
Author: Daniel P. Berrangé <berrange>
Date:   Wed Dec 8 07:05:44 2021 -0500

    qemu: add monitor APIs for query-sev
    
    We're only returning the set of fields needed to perform an
    attestation, per the SEV API docs.
    
    Reviewed-by: Peter Krempa <pkrempa>
    Signed-off-by: Daniel P. Berrangé <berrange>

commit 5842163910e8b8d320a896d9485b321d553bad3f
Author: Daniel P. Berrangé <berrange>
Date:   Wed Dec 8 07:51:43 2021 -0500

    qemu: report error querying launch params for inactive guest
    
    Querying launch params on a inactive guest currently triggers
    a warning about the monitor being NULL.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=2030437
    
    Reviewed-by: Peter Krempa <pkrempa>
    Signed-off-by: Daniel P. Berrangé <berrange>

commit 36fa504dd75ba2e3c675e7c9257ca99a6b28d998
Author: Daniel P. Berrangé <berrange>
Date:   Wed Dec 8 07:50:24 2021 -0500

    include: add new launch security parameters
    
    Three more parameters are required in order that clients can
    perform a launch attestation on the SEV guest.
    
    Reviewed-by: Peter Krempa <pkrempa>
    Signed-off-by: Daniel P. Berrangé <berrange>

v7.10.0-303-g719bb0bf23

Verify this bug with libvirt-daemon-8.0.0-1.module+el8.6.0+13888+55157bfb.x86_64:

S1: test nodesevinfo command

1. check help document

# virsh nodesevinfo --help
  NAME
    nodesevinfo - node SEV information

  SYNOPSIS
    nodesevinfo

  DESCRIPTION
    Returns basic SEV information about the node.

2. check virsh man:

   nodesevinfo
       Syntax:

          nodesevinfo

       Reports information about the AMD SEV launch security features for the node, if any. Some of this information is also reported in the domain  capa‐
       bilities XML document.

3. test readonly mode:

# virsh -r nodesevinfo
error: Unable to get host SEV information
error: operation forbidden: read only access prevents virNodeGetSEVInfo

4. install sev-tool and create pdh.cert and cert_chain.cert

5. verify the output data of nodesevinfo

# virsh nodesevinfo
pdh               : AQAA....AAA=
cert-chain        : AQAAA...AAAA
cbitpos           : 51
reduced-phys-bits : 1
max-guests        : 508
max-es-guests     : 1

# base64 sev_certs/pdh.cert
AQAA....AAA=   <=== match pdh in nodesevinfo

# base64 sev_certs/cert_chain.cert
AQAAA...AAAA   <=== match cert-chain in ndoesevinfo

# dmesg |grep SEV
[ 1896.000535] SEV supported: 508 ASIDs    <=== match max-guests
[ 1896.004122] SEV-ES supported: 1 ASIDs   <=== match max-es-guests


S2: test domlaunchsecinfo command

1. check help document
# virsh domlaunchsecinfo --help
  NAME
    domlaunchsecinfo - Get domain launch security info

  SYNOPSIS
    domlaunchsecinfo <domain>

  DESCRIPTION
    Get the launch security parameters for a guest domain

  OPTIONS
    [--domain] <string>  domain name, id or uuid

2. check virsh man:

   domlaunchsecinfo
       Syntax:

          domlaunchsecinfo domain

       Returns information about the launch security parameters associated with a running domain.

       The set of parameters reported will vary depending on which type of launch security protection is active. If none is active, no parameters will  be
       reported.

3. test readonly mode:


# virsh -r domlaunchsecinfo vm1
error: Unable to get launch security parameters
error: operation forbidden: read only access prevents virDomainGetLaunchSecurityInfo

4. install sev-tool

5. verify the output data of domlaunchsecinfo

# virsh domlaunchsecinfo vm1
sev-measurement: fTeI90mv0mxkTO0pmlW2aRJ06r+76SvMDz7ljFWg4bkzvWcPuS4aGehuDFGO9F/m
sev-api-major  : 1
sev-api-minor  : 42
sev-build-id   : 42
sev-policy     : 7

# virsh qemu-monitor-command vm1 '{"execute": "query-sev-launch-measure"}' --pretty
{
  "return": {
    "data": "fTeI90mv0mxkTO0pmlW2aRJ06r+76SvMDz7ljFWg4bkzvWcPuS4aGehuDFGO9F/m"  <== match sev-measurement in domlaunchsecinfo
  },
  "id": "libvirt-410"
}

# ./src/sevtool --platform_status
api_major:	1    <== match sev-api-major in domlaunchsecinfo
api_minor:	42   <== match sev-api-minor in domlaunchsecinfo
platform_state:	2
owner:		0
config:		1
build:		42   <== match sev-build-id in domlaunchsecinfo
guest_count:	1

# virsh dumpxml vm1

  <launchSecurity type='sev'>
    <cbitpos>51</cbitpos>
    <reducedPhysBits>1</reducedPhysBits>
    <policy>0x0007</policy>   <== match sev-policy in domlaunchsecinfo
  </launchSecurity>


S3: use domlaunchsecinfo get an inactive guest sev info

# virsh  domlaunchsecinfo vm1
error: Unable to get launch security parameters
error: Requested operation is not valid: domain is not running

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:1759