riscv
/
qemu
mirror of https://gitea.goldendeliverer.com/riscv/qemu.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

qapi: make SEV commands unconditionally available 

This removes the TARGET_I386 condition from the SEV confidential
virtualization commands, moving them to the recently introduced
misc-i386.json QAPI file, given they are inherantly i386 specific
commands.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250522190542.588267-4-pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
pull/285/head
Daniel P. Berrangé 10 months ago
committed by Markus Armbruster
parent
9215d072d2
commit
7373759583
6 changed files with 316 additions and 324 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 278
      qapi/misc-i386.json
  2. 291
      qapi/misc-target.json
  3. 1
      stubs/meson.build
  4. 36
      stubs/monitor-i386-sev.c
  5. 32
      target/i386/sev-system-stub.c
  6. 2
      target/i386/sev.c

278
qapi/misc-i386.json
View File

@ -22,3 +22,281 @@
# <- { "return": {} }
##
{ 'command': 'rtc-reset-reinjection' }
##
# @SevState:
#
# An enumeration of SEV state information used during @query-sev.
#
# @uninit: The guest is uninitialized.
#
# @launch-update: The guest is currently being launched; plaintext
# data and register state is being imported.
#
# @launch-secret: The guest is currently being launched; ciphertext
# data is being imported.
#
# @running: The guest is fully launched or migrated in.
#
# @send-update: The guest is currently being migrated out to another
# machine.
#
# @receive-update: The guest is currently being migrated from another
# machine.
#
# Since: 2.12
##
{ 'enum': 'SevState',
'data': ['uninit', 'launch-update', 'launch-secret', 'running',
'send-update', 'receive-update' ] }
##
# @SevGuestType:
#
# An enumeration indicating the type of SEV guest being run.
#
# @sev: The guest is a legacy SEV or SEV-ES guest.
#
# @sev-snp: The guest is an SEV-SNP guest.
#
# Since: 6.2
##
{ 'enum': 'SevGuestType',
'data': [ 'sev', 'sev-snp' ] }
##
# @SevGuestInfo:
#
# Information specific to legacy SEV/SEV-ES guests.
#
# @policy: SEV policy value
#
# @handle: SEV firmware handle
#
# Since: 2.12
##
{ 'struct': 'SevGuestInfo',
'data': { 'policy': 'uint32',
'handle': 'uint32' } }
##
# @SevSnpGuestInfo:
#
# Information specific to SEV-SNP guests.
#
# @snp-policy: SEV-SNP policy value
#
# Since: 9.1
##
{ 'struct': 'SevSnpGuestInfo',
'data': { 'snp-policy': 'uint64' } }
##
# @SevInfo:
#
# Information about Secure Encrypted Virtualization (SEV) support
#
# @enabled: true if SEV is active
#
# @api-major: SEV API major version
#
# @api-minor: SEV API minor version
#
# @build-id: SEV FW build id
#
# @state: SEV guest state
#
# @sev-type: Type of SEV guest being run
#
# Since: 2.12
##
{ 'union': 'SevInfo',
'base': { 'enabled': 'bool',
'api-major': 'uint8',
'api-minor' : 'uint8',
'build-id' : 'uint8',
'state' : 'SevState',
'sev-type' : 'SevGuestType' },
'discriminator': 'sev-type',
'data': {
'sev': 'SevGuestInfo',
'sev-snp': 'SevSnpGuestInfo' } }
##
# @query-sev:
#
# Returns information about SEV/SEV-ES/SEV-SNP.
#
# If unavailable due to an incompatible configuration the returned
# @enabled field is set to 'false' and the state of all other fields
# is unspecified.
#
# Returns: @SevInfo
#
# Since: 2.12
#
# .. qmp-example::
#
# -> { "execute": "query-sev" }
# <- { "return": { "enabled": true, "api-major" : 0, "api-minor" : 0,
# "build-id" : 0, "policy" : 0, "state" : "running",
# "handle" : 1 } }
##
{ 'command': 'query-sev', 'returns': 'SevInfo' }
##
# @SevLaunchMeasureInfo:
#
# SEV Guest Launch measurement information
#
# @data: the measurement value encoded in base64
#
# Since: 2.12
##
{ 'struct': 'SevLaunchMeasureInfo', 'data': {'data': 'str'} }
##
# @query-sev-launch-measure:
#
# Query the SEV/SEV-ES guest launch information.
#
# This is only valid on x86 machines configured with KVM and the
# 'sev-guest' confidential virtualization object. The launch
# measurement for SEV-SNP guests is only available within the guest.
#
# Returns: The @SevLaunchMeasureInfo for the guest
#
# Errors:
# - If the launch measurement is unavailable, either due to an
# invalid guest configuration or if the guest has not reached
# the required SEV state, GenericError
#
# Since: 2.12
#
# .. qmp-example::
#
# -> { "execute": "query-sev-launch-measure" }
# <- { "return": { "data": "4l8LXeNlSPUDlXPJG5966/8%YZ" } }
##
{ 'command': 'query-sev-launch-measure', 'returns': 'SevLaunchMeasureInfo' }
##
# @SevCapability:
#
# The struct describes capability for a Secure Encrypted
# Virtualization feature.
#
# @pdh: Platform Diffie-Hellman key (base64 encoded)
#
# @cert-chain: PDH certificate chain (base64 encoded)
#
# @cpu0-id: Unique ID of CPU0 (base64 encoded) (since 7.1)
#
# @cbitpos: C-bit location in page table entry
#
# @reduced-phys-bits: Number of physical Address bit reduction when
# SEV is enabled
#
# Since: 2.12
##
{ 'struct': 'SevCapability',
'data': { 'pdh': 'str',
'cert-chain': 'str',
'cpu0-id': 'str',
'cbitpos': 'int',
'reduced-phys-bits': 'int'} }
##
# @query-sev-capabilities:
#
# Get SEV capabilities.
#
# This is only supported on AMD X86 platforms with KVM enabled.
#
# Returns: SevCapability objects.
#
# Errors:
# - If SEV is not available on the platform, GenericError
#
# Since: 2.12
#
# .. qmp-example::
#
# -> { "execute": "query-sev-capabilities" }
# <- { "return": { "pdh": "8CCDD8DDD", "cert-chain": "888CCCDDDEE",
# "cpu0-id": "2lvmGwo+...61iEinw==",
# "cbitpos": 47, "reduced-phys-bits": 1}}
##
{ 'command': 'query-sev-capabilities', 'returns': 'SevCapability' }
##
# @sev-inject-launch-secret:
#
# This command injects a secret blob into memory of a SEV/SEV-ES
# guest.
#
# This is only valid on x86 machines configured with KVM and the
# 'sev-guest' confidential virtualization object. SEV-SNP guests do
# not support launch secret injection.
#
# @packet-header: the launch secret packet header encoded in base64
#
# @secret: the launch secret data to be injected encoded in base64
#
# @gpa: the guest physical address where secret will be injected.
#
# Errors:
# - If launch secret injection is not possible, either due to
# an invalid guest configuration, or if the guest has not
# reached the required SEV state, GenericError
#
# Since: 6.0
##
{ 'command': 'sev-inject-launch-secret',
'data': { 'packet-header': 'str', 'secret': 'str', '*gpa': 'uint64' } }
##
# @SevAttestationReport:
#
# The struct describes attestation report for a Secure Encrypted
# Virtualization feature.
#
# @data: guest attestation report (base64 encoded)
#
# Since: 6.1
##
{ 'struct': 'SevAttestationReport',
'data': { 'data': 'str'} }
##
# @query-sev-attestation-report:
#
# This command is used to get the SEV attestation report.
#
# This is only valid on x86 machines configured with KVM and the
# 'sev-guest' confidential virtualization object. The attestation
# report for SEV-SNP guests is only available within the guest.
#
# @mnonce: a random 16 bytes value encoded in base64 (it will be
# included in report)
#
# Returns: SevAttestationReport objects.
#
# Errors:
# - This will return an error if the attestation report is
# unavailable, either due to an invalid guest configuration
# or if the guest has not reached the required SEV state,
# GenericError
#
# Since: 6.1
#
# .. qmp-example::
#
# -> { "execute" : "query-sev-attestation-report",
# "arguments": { "mnonce": "aaaaaaa" } }
# <- { "return" : { "data": "aaaaaaaabbbddddd"} }
##
{ 'command': 'query-sev-attestation-report',
'data': { 'mnonce': 'str' },
'returns': 'SevAttestationReport' }

291
qapi/misc-target.json
View File

@ -2,297 +2,6 @@
# vim: filetype=python
#
##
# @SevState:
#
# An enumeration of SEV state information used during @query-sev.
#
# @uninit: The guest is uninitialized.
#
# @launch-update: The guest is currently being launched; plaintext
# data and register state is being imported.
#
# @launch-secret: The guest is currently being launched; ciphertext
# data is being imported.
#
# @running: The guest is fully launched or migrated in.
#
# @send-update: The guest is currently being migrated out to another
# machine.
#
# @receive-update: The guest is currently being migrated from another
# machine.
#
# Since: 2.12
##
{ 'enum': 'SevState',
'data': ['uninit', 'launch-update', 'launch-secret', 'running',
'send-update', 'receive-update' ],
'if': 'TARGET_I386' }
##
# @SevGuestType:
#
# An enumeration indicating the type of SEV guest being run.
#
# @sev: The guest is a legacy SEV or SEV-ES guest.
#
# @sev-snp: The guest is an SEV-SNP guest.
#
# Since: 6.2
##
{ 'enum': 'SevGuestType',
'data': [ 'sev', 'sev-snp' ],
'if': 'TARGET_I386' }
##
# @SevGuestInfo:
#
# Information specific to legacy SEV/SEV-ES guests.
#
# @policy: SEV policy value
#
# @handle: SEV firmware handle
#
# Since: 2.12
##
{ 'struct': 'SevGuestInfo',
'data': { 'policy': 'uint32',
'handle': 'uint32' },
'if': 'TARGET_I386' }
##
# @SevSnpGuestInfo:
#
# Information specific to SEV-SNP guests.
#
# @snp-policy: SEV-SNP policy value
#
# Since: 9.1
##
{ 'struct': 'SevSnpGuestInfo',
'data': { 'snp-policy': 'uint64' },
'if': 'TARGET_I386' }
##
# @SevInfo:
#
# Information about Secure Encrypted Virtualization (SEV) support
#
# @enabled: true if SEV is active
#
# @api-major: SEV API major version
#
# @api-minor: SEV API minor version
#
# @build-id: SEV FW build id
#
# @state: SEV guest state
#
# @sev-type: Type of SEV guest being run
#
# Since: 2.12
##
{ 'union': 'SevInfo',
'base': { 'enabled': 'bool',
'api-major': 'uint8',
'api-minor' : 'uint8',
'build-id' : 'uint8',
'state' : 'SevState',
'sev-type' : 'SevGuestType' },
'discriminator': 'sev-type',
'data': {
'sev': 'SevGuestInfo',
'sev-snp': 'SevSnpGuestInfo' },
'if': 'TARGET_I386' }
##
# @query-sev:
#
# Returns information about SEV/SEV-ES/SEV-SNP.
#
# If unavailable due to an incompatible configuration the returned
# @enabled field is set to 'false' and the state of all other fields
# is unspecified.
#
# Returns: @SevInfo
#
# Since: 2.12
#
# .. qmp-example::
#
# -> { "execute": "query-sev" }
# <- { "return": { "enabled": true, "api-major" : 0, "api-minor" : 0,
# "build-id" : 0, "policy" : 0, "state" : "running",
# "handle" : 1 } }
##
{ 'command': 'query-sev', 'returns': 'SevInfo',
'if': 'TARGET_I386' }
##
# @SevLaunchMeasureInfo:
#
# SEV Guest Launch measurement information
#
# @data: the measurement value encoded in base64
#
# Since: 2.12
##
{ 'struct': 'SevLaunchMeasureInfo', 'data': {'data': 'str'},
'if': 'TARGET_I386' }
##
# @query-sev-launch-measure:
#
# Query the SEV/SEV-ES guest launch information.
#
# This is only valid on x86 machines configured with KVM and the
# 'sev-guest' confidential virtualization object. The launch
# measurement for SEV-SNP guests is only available within the guest.
#
# Returns: The @SevLaunchMeasureInfo for the guest
#
# Errors:
# - If the launch measurement is unavailable, either due to an
# invalid guest configuration or if the guest has not reached
# the required SEV state, GenericError
#
# Since: 2.12
#
# .. qmp-example::
#
# -> { "execute": "query-sev-launch-measure" }
# <- { "return": { "data": "4l8LXeNlSPUDlXPJG5966/8%YZ" } }
##
{ 'command': 'query-sev-launch-measure', 'returns': 'SevLaunchMeasureInfo',
'if': 'TARGET_I386' }
##
# @SevCapability:
#
# The struct describes capability for a Secure Encrypted
# Virtualization feature.
#
# @pdh: Platform Diffie-Hellman key (base64 encoded)
#
# @cert-chain: PDH certificate chain (base64 encoded)
#
# @cpu0-id: Unique ID of CPU0 (base64 encoded) (since 7.1)
#
# @cbitpos: C-bit location in page table entry
#
# @reduced-phys-bits: Number of physical Address bit reduction when
# SEV is enabled
#
# Since: 2.12
##
{ 'struct': 'SevCapability',
'data': { 'pdh': 'str',
'cert-chain': 'str',
'cpu0-id': 'str',
'cbitpos': 'int',
'reduced-phys-bits': 'int'},
'if': 'TARGET_I386' }
##
# @query-sev-capabilities:
#
# Get SEV capabilities.
#
# This is only supported on AMD X86 platforms with KVM enabled.
#
# Returns: SevCapability objects.
#
# Errors:
# - If SEV is not available on the platform, GenericError
#
# Since: 2.12
#
# .. qmp-example::
#
# -> { "execute": "query-sev-capabilities" }
# <- { "return": { "pdh": "8CCDD8DDD", "cert-chain": "888CCCDDDEE",
# "cpu0-id": "2lvmGwo+...61iEinw==",
# "cbitpos": 47, "reduced-phys-bits": 1}}
##
{ 'command': 'query-sev-capabilities', 'returns': 'SevCapability',
'if': 'TARGET_I386' }
##
# @sev-inject-launch-secret:
#
# This command injects a secret blob into memory of a SEV/SEV-ES
# guest.
#
# This is only valid on x86 machines configured with KVM and the
# 'sev-guest' confidential virtualization object. SEV-SNP guests do
# not support launch secret injection.
#
# @packet-header: the launch secret packet header encoded in base64
#
# @secret: the launch secret data to be injected encoded in base64
#
# @gpa: the guest physical address where secret will be injected.
#
# Errors:
# - If launch secret injection is not possible, either due to
# an invalid guest configuration, or if the guest has not
# reached the required SEV state, GenericError
#
# Since: 6.0
##
{ 'command': 'sev-inject-launch-secret',
'data': { 'packet-header': 'str', 'secret': 'str', '*gpa': 'uint64' },
'if': 'TARGET_I386' }
##
# @SevAttestationReport:
#
# The struct describes attestation report for a Secure Encrypted
# Virtualization feature.
#
# @data: guest attestation report (base64 encoded)
#
# Since: 6.1
##
{ 'struct': 'SevAttestationReport',
'data': { 'data': 'str'},
'if': 'TARGET_I386' }
##
# @query-sev-attestation-report:
#
# This command is used to get the SEV attestation report.
#
# This is only valid on x86 machines configured with KVM and the
# 'sev-guest' confidential virtualization object. The attestation
# report for SEV-SNP guests is only available within the guest.
#
# @mnonce: a random 16 bytes value encoded in base64 (it will be
# included in report)
#
# Returns: SevAttestationReport objects.
#
# Errors:
# - This will return an error if the attestation report is
# unavailable, either due to an invalid guest configuration
# or if the guest has not reached the required SEV state,
# GenericError
#
# Since: 6.1
#
# .. qmp-example::
#
# -> { "execute" : "query-sev-attestation-report",
# "arguments": { "mnonce": "aaaaaaa" } }
# <- { "return" : { "data": "aaaaaaaabbbddddd"} }
##
{ 'command': 'query-sev-attestation-report',
'data': { 'mnonce': 'str' },
'returns': 'SevAttestationReport',
'if': 'TARGET_I386' }
##
# @GICCapability:
#

1
stubs/meson.build
View File

@ -78,6 +78,7 @@ if have_system
stub_ss.add(files('win32-kbd-hook.c'))
stub_ss.add(files('xen-hw-stub.c'))
stub_ss.add(files('monitor-i386-rtc.c'))
stub_ss.add(files('monitor-i386-sev.c'))
endif
if have_system or have_user

36
stubs/monitor-i386-sev.c
View File

@ -0,0 +1,36 @@
/* SPDX-License-Identifier: GPL-2.0-or-later */
#include "qemu/osdep.h"
#include "qapi/error.h"
#include "qapi/qapi-commands-misc-i386.h"
SevInfo *qmp_query_sev(Error **errp)
{
error_setg(errp, "SEV is not available in this QEMU");
return NULL;
}
SevLaunchMeasureInfo *qmp_query_sev_launch_measure(Error **errp)
{
error_setg(errp, "SEV is not available in this QEMU");
return NULL;
}
SevCapability *qmp_query_sev_capabilities(Error **errp)
{
error_setg(errp, "SEV is not available in this QEMU");
return NULL;
}
void qmp_sev_inject_launch_secret(const char *packet_header, const char *secret,
bool has_gpa, uint64_t gpa, Error **errp)
{
error_setg(errp, "SEV is not available in this QEMU");
}
SevAttestationReport *qmp_query_sev_attestation_report(const char *mnonce,
Error **errp)
{
error_setg(errp, "SEV is not available in this QEMU");
return NULL;
}

32
target/i386/sev-system-stub.c
View File

@ -14,34 +14,9 @@
#include "qemu/osdep.h"
#include "monitor/monitor.h"
#include "monitor/hmp-target.h"
#include "qapi/qapi-commands-misc-target.h"
#include "qapi/error.h"
#include "sev.h"
SevInfo *qmp_query_sev(Error **errp)
{
error_setg(errp, "SEV is not available in this QEMU");
return NULL;
}
SevLaunchMeasureInfo *qmp_query_sev_launch_measure(Error **errp)
{
error_setg(errp, "SEV is not available in this QEMU");
return NULL;
}
SevCapability *qmp_query_sev_capabilities(Error **errp)
{
error_setg(errp, "SEV is not available in this QEMU");
return NULL;
}
void qmp_sev_inject_launch_secret(const char *packet_header, const char *secret,
bool has_gpa, uint64_t gpa, Error **errp)
{
error_setg(errp, "SEV is not available in this QEMU");
}
int sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp)
{
g_assert_not_reached();
@ -56,13 +31,6 @@ int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size)
g_assert_not_reached();
}
SevAttestationReport *qmp_query_sev_attestation_report(const char *mnonce,
Error **errp)
{
error_setg(errp, "SEV is not available in this QEMU");
return NULL;
}
void hmp_info_sev(Monitor *mon, const QDict *qdict)
{
monitor_printf(mon, "SEV is not available in this QEMU\n");

2
target/i386/sev.c
View File

@ -37,7 +37,7 @@
#include "qom/object.h"
#include "monitor/monitor.h"
#include "monitor/hmp-target.h"
#include "qapi/qapi-commands-misc-target.h"
#include "qapi/qapi-commands-misc-i386.h"
#include "confidential-guest.h"
#include "hw/i386/pc.h"
#include "system/address-spaces.h"

Write Preview
Loading…
Cancel
Save