add igvmfile read/write to vmgstool #2566
Conversation
|
This PR modifies files containing For more on why we check whole files, instead of just diffs, check out the Rustonomicon |
There was a problem hiding this comment.
Pull request overview
This PR adds functionality to vmgstool for reading IGVM firmware files from Windows DLLs and writing them to VMGS file ID 8 (GUEST_FIRMWARE). The implementation uses Windows API calls to extract resources from DLLs and supports multiple resource codes (nonconfidential, snp, snp_no_hcl, tdx, tdx_no_hcl) for different VM configurations.
Key changes:
- New
copy-igvmfilecommand that extracts IGVM files from DLLs using Windows resource APIs - Support for encrypted and unencrypted VMGS files when writing IGVM data
- Platform-specific implementation for Windows x86_64 only
Reviewed changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated 7 comments.
| File | Description |
|---|---|
| vm/vmgs/vmgstool/src/main.rs | Implements the copy-igvmfile command with Windows API resource loading, adds error handling, command-line parsing, and test cases |
| vm/vmgs/vmgstool/build.rs | Adds rustc-check-cfg directive for guest_arch configuration |
| vm/vmgs/vmgstool/Cargo.toml | Adds winapi dependency with required Windows API features |
| Guide/src/dev_guide/dev_tools/vmgstool.md | Documents the new copy-igvmfile command usage |
| // SAFETY: We are loading a DLL and reading its resources as a datafile or image resource, | ||
| // which means we will not be executing any of its potentially unsafe functions. We are also | ||
| // taking precautions to ensure safety by validating all pointers and handling errors appropriately. | ||
| unsafe { |
There was a problem hiding this comment.
Instead of using LoadLibrary (which requires unsafe) could we instead just parse the dll using object? See the hvlite_pcat_locator crate for an example.
2 participants
Add tool to VmgsTool to read the IGVMfile from a DLL (passed in as a data file) and write it to VMGS FileId 8 (GUEST_FIRMWARE). To do this pass one of three resource codes (nonconfidential, snp, tdx) into the cmdline tool:
vmgstool.exe copy-igvmfile --filepath --keypath --datapath --resource-code