Re: [RFC PATCH 0/8] i386/sev: Use C API of Rust SEV library

[Tyler Fanelli <tfanelli@redhat.com>]

On 9/14/23 3:04 PM, Philippe Mathieu-Daudé wrote:
> Hi Tyler,
>
> On 14/9/23 19:58, Tyler Fanelli wrote:
>> These patches are submitted as an RFC mainly because I'm a relative
>> newcomer to QEMU with no knowledge of the community's views on
>> including Rust code, nor it's preference of using library APIs for
>> ioctls that were previously implemented in QEMU directly.
>>
>> Recently, the Rust sev library [0] has introduced a C API to take
>> advantage of the library outside of Rust.
>>
>> Should the inclusion of the library as a dependency be desired, it can
>> be extended further to include the firmware/platform ioctls, the
>> attestation report fetching, and more. This would result in much of
>> the AMD-SEV portion of QEMU being offloaded to the library.
>>
>> This series looks to explore the possibility of using the library and
>> show a bit of what it would look like. I'm looking for comments
>> regarding if this feature is desired.
>>
>> [0] https://github.com/virtee/sev
>>
>> Tyler Fanelli (8):
>>    Add SEV Rust library as dependency with CONFIG_SEV
>>    i386/sev: Replace INIT and ES_INIT ioctls with sev library 
>> equivalents
>>    i386/sev: Replace LAUNCH_START ioctl with sev library equivalent
>>    i386/sev: Replace UPDATE_DATA ioctl with sev library equivalent
>>    i386/sev: Replace LAUNCH_UPDATE_VMSA ioctl with sev library 
>> equivalent
>>    i386/sev: Replace LAUNCH_MEASURE ioctl with sev library equivalent
>>    i386/sev: Replace LAUNCH_SECRET ioctl with sev library equivalent
>>    i386/sev: Replace LAUNCH_FINISH ioctl with sev library equivalent
>
> There is still one ioctl use, GET_ATTESTATION_REPORT. No libsev
> equivalent for this one yet?
>
There is an equivalent, however the machine that I'm using currently 
hangs when trying to fetch an attestation report (not a libsev issue, as 
it hangs when I try with latest qemu release as well). When I can either 
update its firmware or get access to another SEV machine, I can test and 
confirm it behaves as intended with the libsev API. Once this is done, I 
can add that API to the patch series.


Tyler