From: "Michael S. Tsirkin" <mst@redhat.com>
To: Dorjoy Chowdhury <dorjoychy111@gmail.com>
Cc: graf@amazon.com, qemu-devel@nongnu.org, agraf@csgraf.de,
stefanha@redhat.com, pbonzini@redhat.com, slp@redhat.com,
richard.henderson@linaro.org, eduardo@habkost.net,
marcel.apfelbaum@gmail.com, berrange@redhat.com,
philmd@linaro.org
Subject: Re: [PATCH v5 5/8] device/virtio-nsm: Support for Nitro Secure Module device
Date: Tue, 3 Sep 2024 16:32:00 -0400 [thread overview]
Message-ID: <20240903162013-mutt-send-email-mst@kernel.org> (raw)
In-Reply-To: <CAFfO_h66g138yVwufKY_C22Aiu8XctzyyjqsBYM4wdYN77JLuQ@mail.gmail.com>
On Wed, Sep 04, 2024 at 01:58:15AM +0600, Dorjoy Chowdhury wrote:
> On Thu, Aug 29, 2024 at 1:11 AM Michael S. Tsirkin <mst@redhat.com> wrote:
> >
> > On Thu, Aug 29, 2024 at 01:04:05AM +0600, Dorjoy Chowdhury wrote:
> > > On Thu, Aug 29, 2024 at 12:28 AM Michael S. Tsirkin <mst@redhat.com> wrote:
> > > >
> > > > On Thu, Aug 22, 2024 at 09:08:46PM +0600, Dorjoy Chowdhury wrote:
> > > > > Nitro Secure Module (NSM)[1] device is used in AWS Nitro Enclaves[2]
> > > > > for stripped down TPM functionality like cryptographic attestation.
> > > > > The requests to and responses from NSM device are CBOR[3] encoded.
> > > > >
> > > > > This commit adds support for NSM device in QEMU. Although related to
> > > > > AWS Nitro Enclaves, the virito-nsm device is independent and can be
> > > > > used in other machine types as well. The libcbor[4] library has been
> > > > > used for the CBOR encoding and decoding functionalities.
> > > > >
> > > > > [1] https://lists.oasis-open.org/archives/virtio-comment/202310/msg00387.html
> > > > > [2] https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html
> > > > > [3] http://cbor.io/
> > > > > [4] https://libcbor.readthedocs.io/en/latest/
> > > > >
> > > > > Signed-off-by: Dorjoy Chowdhury <dorjoychy111@gmail.com>
> > > > > ---
> > > > > MAINTAINERS | 10 +
> > > > > hw/virtio/Kconfig | 5 +
> > > > > hw/virtio/cbor-helpers.c | 326 ++++++
> > > > > hw/virtio/meson.build | 6 +
> > > > > hw/virtio/virtio-nsm-pci.c | 73 ++
> > > > > hw/virtio/virtio-nsm.c | 1638 ++++++++++++++++++++++++++++++
> > > > > include/hw/virtio/cbor-helpers.h | 46 +
> > > > > include/hw/virtio/virtio-nsm.h | 59 ++
> > > > > meson.build | 2 +
> > > > > 9 files changed, 2165 insertions(+)
> > >
> > > [...]
> > >
> > > > > +static void handle_input(VirtIODevice *vdev, VirtQueue *vq)
> > > > > +{
> > > > > + g_autofree VirtQueueElement *out_elem = NULL;
> > > > > + g_autofree VirtQueueElement *in_elem = NULL;
> > > > > + VirtIONSM *vnsm = VIRTIO_NSM(vdev);
> > > > > + Error *err = NULL;
> > > > > +
> > > > > + out_elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
> > > > > + if (!out_elem) {
> > > > > + /* nothing in virtqueue */
> > > > > + return;
> > > > > + }
> > > > > +
> > > > > + if (out_elem->out_num != 1) {
> > > > > + virtio_error(vdev, "Expected one request buffer first in virtqueue");
> > > > > + goto cleanup;
> > > > > + }
> > > >
> > > > Seems to assume request in a single s/g element?
> > > > We generally avoid this kind of thing.
> > > >
> > > > Applies equally elsewheree.
> > > >
> > >
> > > Thank you for reviewing. I think I did it this way (first virqueue_pop
> > > gives out_elem with out_num == 1 and the next virtqueue_pop gives
> > > in_elem with in_num == 1) after seeing what the virqueue contains
> > > (using printfs) when running in a VM and sending some NSM requests and
> > > I noticed the above. Can you give me a bit more details about what
> > > this should be like? Is there any existing virtio device code I can
> > > look at for example?
> > > Thanks!
> >
> >
> > Use iov_to_buf / iov_from_buf
> >
> > there are many examples in the tree, I'd look for some recent ones.
> >
>
> I am a bit stuck at this and I would appreciate some help. I looked at
> other "iov_to_buf" and "iov_from_buf" examples in QEMU and in those I
> see there are known request and response "structs" associated with it.
> But in the case of NSM, the request and responses can be arbitrary
> CBOR objects i.e., no specific structs or lengths associated.
take whatever you want to access, move it to a buffer with iov_to_buf
then access the buffer.
reverse is even easier. put in a buffer, copy with iov_from_buf.
> So I am
> not sure using "iov_to_buf" / "iov_from_buf" makes sense here.
> And about the request response being in a single s/g element, I think
> it's because of how the NSM driver is in drivers/misc/nsm.c (see
> nsm_sendrecv_msg_locked function)in the linux kernel tree.
yes but driver is free to change this.
Isn't there a spec for this device to consult?
Sending that to virtio tc will be needed before we add this to qemu.
> I am not sure what changes are needed in the current code if any. Do
> you have any suggestions on this?
>
> Regards,
> Dorjoy
next prev parent reply other threads:[~2024-09-03 20:32 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-08-22 15:08 [PATCH v5 0/8] AWS Nitro Enclave emulation support Dorjoy Chowdhury
2024-08-22 15:08 ` [PATCH v5 1/8] crypto: Define macros for hash algorithm digest lengths Dorjoy Chowdhury
2024-08-28 15:33 ` Daniel P. Berrangé
2024-08-22 15:08 ` [PATCH v5 2/8] crypto: Support SHA384 hash when using glib Dorjoy Chowdhury
2024-08-22 15:08 ` [PATCH v5 3/8] crypto: Introduce x509 utils Dorjoy Chowdhury
2024-08-22 15:08 ` [PATCH v5 4/8] tests/lcitool: Update libvirt-ci and add libcbor dependency Dorjoy Chowdhury
2024-08-28 15:34 ` Daniel P. Berrangé
2024-08-22 15:08 ` [PATCH v5 5/8] device/virtio-nsm: Support for Nitro Secure Module device Dorjoy Chowdhury
2024-08-28 18:28 ` Michael S. Tsirkin
2024-08-28 19:04 ` Dorjoy Chowdhury
2024-08-28 19:11 ` Michael S. Tsirkin
2024-09-03 19:58 ` Dorjoy Chowdhury
2024-09-03 20:32 ` Michael S. Tsirkin [this message]
2024-09-03 20:47 ` Dorjoy Chowdhury
2024-09-04 18:30 ` Dorjoy Chowdhury
2024-09-04 20:27 ` Michael S. Tsirkin
2024-09-04 20:45 ` Dorjoy Chowdhury
2024-08-22 15:08 ` [PATCH v5 6/8] hw/core: Add Enclave Image Format (EIF) related helpers Dorjoy Chowdhury
2024-08-28 15:42 ` Daniel P. Berrangé
2024-08-22 15:08 ` [PATCH v5 7/8] machine/nitro-enclave: New machine type for AWS Nitro Enclaves Dorjoy Chowdhury
2024-08-28 15:39 ` Daniel P. Berrangé
2024-08-28 15:50 ` Dorjoy Chowdhury
2024-08-29 8:14 ` Daniel P. Berrangé
2024-09-05 20:00 ` Dorjoy Chowdhury
2024-08-22 15:08 ` [PATCH v5 8/8] docs/nitro-enclave: Documentation for nitro-enclave machine type Dorjoy Chowdhury
2024-09-05 20:03 ` [PATCH v5 0/8] AWS Nitro Enclave emulation support Dorjoy Chowdhury
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240903162013-mutt-send-email-mst@kernel.org \
--to=mst@redhat.com \
--cc=agraf@csgraf.de \
--cc=berrange@redhat.com \
--cc=dorjoychy111@gmail.com \
--cc=eduardo@habkost.net \
--cc=graf@amazon.com \
--cc=marcel.apfelbaum@gmail.com \
--cc=pbonzini@redhat.com \
--cc=philmd@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=richard.henderson@linaro.org \
--cc=slp@redhat.com \
--cc=stefanha@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).