2040652 – RFE: support a way to acquire/extract/construct the initial VMSA content for AMD SEV vCPUs

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 2040652 - RFE: support a way to acquire/extract/construct the initial VMSA content for AMD SEV vCPUs

Summary: RFE: support a way to acquire/extract/construct the initial VMSA content for ...

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 9
Classification:	Red Hat
Component:	sevctl
Sub Component:
Version:	9.1
Hardware:	x86_64
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	rc
Target Release:	9.1
Assignee:	Tyler Fanelli
QA Contact:	zixchen
Docs Contact:
URL:
Whiteboard:
Depends On:	2085085
Blocks:
TreeView+	depends on / blocked

Reported:	2022-01-14 11:13 UTC by Daniel Berrangé
Modified:	2022-11-15 11:38 UTC (History)
CC List:	7 users (show)
Fixed In Version:	sevctl-0.3.0-4.el9
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2022-11-15 10:31:18 UTC
Type:	Feature Request
Target Upstream Version:
Embargoed:
Dependent Products:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Issue Tracker	RHELPLAN-108174	0	None	None	None	2022-01-14 11:16:18 UTC
Red Hat Product Errata	RHBA-2022:8171	0	None	None	None	2022-11-15 10:31:37 UTC

Description Daniel Berrangé 2022-01-14 11:13:20 UTC

Description of problem:
In order to validate the measurement of a guest configured with AMD SEV-ES, the guest owner needs to know the expected VMSA content for the boot CPU and non-boot CPUs.

There is no supported way to extract this content today. Users have hacked this in the past either

 - Patching the kernel to hexdump into dmesg
    https://lists.gnu.org/archive/html/qemu-devel/2021-12/msg02830.html

 - Hooking into the kerenl with systemtap
    https://lists.gnu.org/archive/html/qemu-devel/2022-01/msg01362.html

Neither of these are viable for RHEL customers and so we need to figure out a better option. There are various approaches

 - Red Hat publish the VMSA content as blobs for each RHEL update
 - Provide documentation on how to construct the VMSA content based on AMD CPU  specifications and OVMF impl
 - Provide a reference implementation tool based on the documentation for constructing the VMSA content
 - Provide a supported mechanism in the kernel for dumping the VMSA content
 - Provide a supported mechanism in QEMU for dumping the VMSA content (unclear it if it technically possible - possibly SEV 'debug' policy bit would allow it)


This bug is reported against QEMU, but depending on which of the above approaches is most viable, it can move to another component. QEMU is just picked as an initial placeholder

Comment 2 John Ferlan 2022-01-14 12:52:33 UTC

This has been discussed in the context of the ConfVirt project, see https://issues.redhat.com/browse/KVMUSRSPC-80

Didn't create a RHEL bug partially because we were lacking details and of course the resource that had the most knowledge left Red Hat.

I'll move to sevctl for now and assign to Tyler.

Comment 3 Tyler Fanelli 2022-01-14 15:41:30 UTC

These 3 options seems to be the most viable and preferred:

 - Provide a reference implementation tool based on the documentation for constructing the VMSA content
 - Provide a supported mechanism in the kernel for dumping the VMSA content
 - Provide a supported mechanism in QEMU for dumping the VMSA content (unclear it if it technically possible - possibly SEV 'debug' policy bit would allow it)

If a sevctl command were to be created for this, I imagine there would still be some support needed (an API?) in qemu or kvm for extracting this that sevctl would use. Is this a correct assumption?

Comment 4 John Ferlan 2022-05-12 20:52:31 UTC

upstream code posted: https://github.com/virtee/sevctl/pull/18

AIUI, having a sevctl vmsa dump command will eventually be resolved as part of rebase to new sevctl release

Comment 5 John Ferlan 2022-06-17 13:03:25 UTC

Changes have been merged upstream (reverse time order):

https://github.com/virtee/sevctl/commit/b98141e2bb85a1459b952a9e2a8e78cda3cf838b  (import vmsa from sev crate)
https://github.com/virtee/sev/commit/8e032283b404ff919701794622611800061a4a60     (move vmsa extractions into sev crate)
https://github.com/virtee/sevctl/commit/b08c571b888a4437860ca3316f4991a052220d04  (vmsa update command) 
https://github.com/virtee/sevctl/commit/379230bea58c88837a1deb11a34d77d4165a77b7  (vmsa build command)

Moving this bug to POST and awaiting the sevctl rebase

Comment 6 zixchen 2022-07-04 09:48:43 UTC

Test with sevctl-0.3.0-4.el9, sevctl vmsa passed.

Version:
sevctl-0.3.0-4.el9
kernel-5.14.0-121.el9.x86_64

# cat /proc/cpuinfo|grep -i stepping|head -n 1
stepping	: 1
# cat /proc/cpuinfo|grep -i mode|head -n 1
model		: 1
# cat /proc/cpuinfo|grep -i family|head -n 1
cpu family	: 25
# sevctl vmsa build NEW-VMSA0.bin --userspace qemu --family 25 --stepping 1 --model 1 --firmware /usr/share/edk2/ovmf/OVMF.amdsev.fd --cpu 0
# echo $?
0
# sevctl vmsa show NEW-VMSA0.bin
{
  "es": {
    "selector": 0,
    "attrib": 147,
    "limit": 65535,
    "base": 0
  },
  "cs": {
    "selector": 61440,
    "attrib": 155,
    "limit": 65535,
    "base": 4294901760
  },
  "ss": {
    "selector": 0,
    "attrib": 147,
    "limit": 65535,
    "base": 0
  },
  "ds": {
    "selector": 0,
    "attrib": 147,
    "limit": 65535,
    "base": 0
  },
  "fs": {
    "selector": 0,
    "attrib": 147,
    "limit": 65535,
    "base": 0
  },
  "gs": {
    "selector": 0,
    "attrib": 147,
    "limit": 65535,
    "base": 0
  },
  "gdtr": {
    "selector": 0,
    "attrib": 0,
    "limit": 65535,
    "base": 0
  },
  "ldtr": {
    "selector": 0,
    "attrib": 130,
    "limit": 65535,
    "base": 0
  },
  "idtr": {
    "selector": 0,
    "attrib": 0,
    "limit": 65535,
    "base": 0
  },
  "tr": {
    "selector": 0,
    "attrib": 139,
    "limit": 65535,
    "base": 0
  },
  "reserved_1": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "cpl": 0,
  "reserved_2": [
    0,
    0,
    0,
    0
  ],
  "efer": 4096,
  "reserved_3": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "xss": 0,
  "cr4": 64,
  "cr3": 0,
  "cr0": 16,
  "dr7": 1024,
  "dr6": 4294905840,
  "rflags": 2,
  "rip": 65520,
  "reserved_4": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "rsp": 0,
  "reserved_5": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "rax": 0,
  "star": 0,
  "lstar": 0,
  "cstar": 0,
  "sfmask": 0,
  "kernel_gs_base": 0,
  "sysenter_cs": 0,
  "sysenter_esp": 0,
  "sysenter_eip": 0,
  "cr2": 0,
  "reserved_6": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "g_pat": 1974748653749254,
  "dbgctl": 0,
  "br_from": 0,
  "br_to": 0,
  "last_excp_from": 0,
  "last_excp_to": 0,
  "reserved_7": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "spec_ctrl": 0,
  "reserved_7b": [
    0,
    0,
    0,
    0
  ],
  "pkru": 0,
  "reserved_7a": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "reserved_8": 0,
  "rcx": 0,
  "rdx": 10489617,
  "rbx": 0,
  "reserved_9": 0,
  "rbp": 0,
  "rsi": 0,
  "rdi": 0,
  "r8": 0,
  "r9": 0,
  "r10": 0,
  "r11": 0,
  "r12": 0,
  "r13": 0,
  "r14": 0,
  "r15": 0,
  "reserved_10": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "sw_exit_code": 0,
  "sw_exit_info_1": 0,
  "sw_exit_info_2": 0,
  "sw_scratch": 0,
  "reserved_11": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "xcr0": 1,
  "valid_bitmap": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "x87_state_gpa": 0
}
[# echo $?
0
# sevctl vmsa update NEW-VMSA0.bin --userspace qemu --family 25 --stepping 1 --model 1 --firmware /usr/share/edk2/ovmf/OVMF.amdsev.fd --cpu 1
# echo $?
0
# sevctl vmsa show NEW-VMSA0.bin
{
  "es": {
    "selector": 0,
    "attrib": 147,
    "limit": 65535,
    "base": 0
  },
  "cs": {
    "selector": 61440,
    "attrib": 155,
    "limit": 65535,
    "base": 8388608
  },
  "ss": {
    "selector": 0,
    "attrib": 147,
    "limit": 65535,
    "base": 0
  },
  "ds": {
    "selector": 0,
    "attrib": 147,
    "limit": 65535,
    "base": 0
  },
  "fs": {
    "selector": 0,
    "attrib": 147,
    "limit": 65535,
    "base": 0
  },
  "gs": {
    "selector": 0,
    "attrib": 147,
    "limit": 65535,
    "base": 0
  },
  "gdtr": {
    "selector": 0,
    "attrib": 0,
    "limit": 65535,
    "base": 0
  },
  "ldtr": {
    "selector": 0,
    "attrib": 130,
    "limit": 65535,
    "base": 0
  },
  "idtr": {
    "selector": 0,
    "attrib": 0,
    "limit": 65535,
    "base": 0
  },
  "tr": {
    "selector": 0,
    "attrib": 139,
    "limit": 65535,
    "base": 0
  },
  "reserved_1": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "cpl": 0,
  "reserved_2": [
    0,
    0,
    0,
    0
  ],
  "efer": 4096,
  "reserved_3": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "xss": 0,
  "cr4": 64,
  "cr3": 0,
  "cr0": 16,
  "dr7": 1024,
  "dr6": 4294905840,
  "rflags": 2,
  "rip": 45060,
  "reserved_4": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "rsp": 0,
  "reserved_5": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "rax": 0,
  "star": 0,
  "lstar": 0,
  "cstar": 0,
  "sfmask": 0,
  "kernel_gs_base": 0,
  "sysenter_cs": 0,
  "sysenter_esp": 0,
  "sysenter_eip": 0,
  "cr2": 0,
  "reserved_6": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "g_pat": 1974748653749254,
  "dbgctl": 0,
  "br_from": 0,
  "br_to": 0,
  "last_excp_from": 0,
  "last_excp_to": 0,
  "reserved_7": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "spec_ctrl": 0,
  "reserved_7b": [
    0,
    0,
    0,
    0
  ],
  "pkru": 0,
  "reserved_7a": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "reserved_8": 0,
  "rcx": 0,
  "rdx": 10489617,
  "rbx": 0,
  "reserved_9": 0,
  "rbp": 0,
  "rsi": 0,
  "rdi": 0,
  "r8": 0,
  "r9": 0,
  "r10": 0,
  "r11": 0,
  "r12": 0,
  "r13": 0,
  "r14": 0,
  "r15": 0,
  "reserved_10": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "sw_exit_code": 0,
  "sw_exit_info_1": 0,
  "sw_exit_info_2": 0,
  "sw_scratch": 0,
  "reserved_11": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "xcr0": 1,
  "valid_bitmap": [
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0
  ],
  "x87_state_gpa": 0
}
# echo $?
0

Comment 10 zixchen 2022-07-05 09:58:02 UTC

Since sevctl-0.3.0-4.el9 is already tested, move this to VERIFIED

Comment 12 errata-xmlrpc 2022-11-15 10:31:18 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sevctl bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:8171

Note You need to log in before you can comment on or make changes to this bug.