qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: Michael Roth <michael.roth@amd.com>
To: <qemu-devel@nongnu.org>
Cc: kvm@vger.kernel.org, "Tom Lendacky" <thomas.lendacky@amd.com>,
	"Paolo Bonzini" <pbonzini@redhat.com>,
	"Daniel P . Berrangé" <berrange@redhat.com>,
	"Markus Armbruster" <armbru@redhat.com>,
	"Pankaj Gupta" <pankaj.gupta@amd.com>,
	"Xiaoyao Li" <xiaoyao.li@intel.com>,
	"Isaku Yamahata" <isaku.yamahata@linux.intel.com>,
	"Dov Murik" <dovmurik@linux.ibm.com>
Subject: [PATCH v3 43/49] qapi, i386: Move kernel-hashes to SevCommonProperties
Date: Wed, 20 Mar 2024 03:39:39 -0500	[thread overview]
Message-ID: <20240320083945.991426-44-michael.roth@amd.com> (raw)
In-Reply-To: <20240320083945.991426-1-michael.roth@amd.com>

From: Dov Murik <dovmurik@linux.ibm.com>

In order to enable kernel-hashes for SNP, pull it from
SevGuestProperties to its parent SevCommonProperties so
it will be available for both SEV and SNP.

Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
Signed-off-by: Michael Roth <michael.roth@amd.com>
---
 qapi/qom.json     | 14 +++++++-------
 target/i386/sev.c | 44 ++++++++++++++++++--------------------------
 2 files changed, 25 insertions(+), 33 deletions(-)

diff --git a/qapi/qom.json b/qapi/qom.json
index 7ba778af91..ea8832a8c3 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -886,12 +886,17 @@
 # @reduced-phys-bits: number of bits in physical addresses that become
 #     unavailable when SEV is enabled
 #
+# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a
+#     designated guest firmware page for measured boot with -kernel
+#     (default: false) (since 6.2)
+#
 # Since: 2.12
 ##
 { 'struct': 'SevCommonProperties',
   'data': { '*sev-device': 'str',
             '*cbitpos': 'uint32',
-            'reduced-phys-bits': 'uint32' } }
+            'reduced-phys-bits': 'uint32',
+            '*kernel-hashes': 'bool' } }
 
 ##
 # @SevGuestProperties:
@@ -906,10 +911,6 @@
 #
 # @handle: SEV firmware handle (default: 0)
 #
-# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a
-#     designated guest firmware page for measured boot with -kernel
-#     (default: false) (since 6.2)
-#
 # Since: 2.12
 ##
 { 'struct': 'SevGuestProperties',
@@ -917,8 +918,7 @@
   'data': { '*dh-cert-file': 'str',
             '*session-file': 'str',
             '*policy': 'uint32',
-            '*handle': 'uint32',
-            '*kernel-hashes': 'bool' } }
+            '*handle': 'uint32' } }
 
 ##
 # @SevSnpGuestProperties:
diff --git a/target/i386/sev.c b/target/i386/sev.c
index db888afb53..3187b3dee8 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -54,6 +54,7 @@ struct SevCommonState {
     char *sev_device;
     uint32_t cbitpos;
     uint32_t reduced_phys_bits;
+    bool kernel_hashes;
 
     /* runtime state */
     uint8_t api_major;
@@ -86,7 +87,6 @@ struct SevGuestState {
     uint32_t policy;
     char *dh_cert_file;
     char *session_file;
-    bool kernel_hashes;
 };
 
 struct SevSnpGuestState {
@@ -1696,16 +1696,12 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
     MemTxAttrs attrs = { 0 };
     bool ret = true;
     SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
-    SevGuestState *sev_guest =
-        (SevGuestState *)object_dynamic_cast(OBJECT(sev_common),
-                                             TYPE_SEV_GUEST);
 
     /*
      * Only add the kernel hashes if the sev-guest configuration explicitly
-     * stated kernel-hashes=on. Currently only enabled for SEV/SEV-ES guests,
-     * so check for TYPE_SEV_GUEST as well.
+     * stated kernel-hashes=on.
      */
-    if (sev_guest && !sev_guest->kernel_hashes) {
+    if (!sev_common->kernel_hashes) {
         return false;
     }
 
@@ -2037,6 +2033,16 @@ sev_common_set_sev_device(Object *obj, const char *value, Error **errp)
     SEV_COMMON(obj)->sev_device = g_strdup(value);
 }
 
+static bool sev_common_get_kernel_hashes(Object *obj, Error **errp)
+{
+    return SEV_COMMON(obj)->kernel_hashes;
+}
+
+static void sev_common_set_kernel_hashes(Object *obj, bool value, Error **errp)
+{
+    SEV_COMMON(obj)->kernel_hashes = value;
+}
+
 static void
 sev_common_class_init(ObjectClass *oc, void *data)
 {
@@ -2051,6 +2057,11 @@ sev_common_class_init(ObjectClass *oc, void *data)
                                   sev_common_set_sev_device);
     object_class_property_set_description(oc, "sev-device",
             "SEV device to use");
+    object_class_property_add_bool(oc, "kernel-hashes",
+                                   sev_common_get_kernel_hashes,
+                                   sev_common_set_kernel_hashes);
+    object_class_property_set_description(oc, "kernel-hashes",
+            "add kernel hashes to guest firmware for measured Linux boot");
 }
 
 static void
@@ -2109,20 +2120,6 @@ sev_guest_set_session_file(Object *obj, const char *value, Error **errp)
     SEV_GUEST(obj)->session_file = g_strdup(value);
 }
 
-static bool sev_guest_get_kernel_hashes(Object *obj, Error **errp)
-{
-    SevGuestState *sev_guest = SEV_GUEST(obj);
-
-    return sev_guest->kernel_hashes;
-}
-
-static void sev_guest_set_kernel_hashes(Object *obj, bool value, Error **errp)
-{
-    SevGuestState *sev = SEV_GUEST(obj);
-
-    sev->kernel_hashes = value;
-}
-
 static void
 sev_guest_class_init(ObjectClass *oc, void *data)
 {
@@ -2136,11 +2133,6 @@ sev_guest_class_init(ObjectClass *oc, void *data)
                                   sev_guest_set_session_file);
     object_class_property_set_description(oc, "session-file",
             "guest owners session parameters (encoded with base64)");
-    object_class_property_add_bool(oc, "kernel-hashes",
-                                   sev_guest_get_kernel_hashes,
-                                   sev_guest_set_kernel_hashes);
-    object_class_property_set_description(oc, "kernel-hashes",
-            "add kernel hashes to guest firmware for measured Linux boot");
 }
 
 static void
-- 
2.25.1



  parent reply	other threads:[~2024-03-20  8:54 UTC|newest]

Thread overview: 110+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-03-20  8:38 [PATCH RFC v3 00/49] Add AMD Secure Nested Paging (SEV-SNP) support Michael Roth
2024-03-20  8:38 ` [PATCH v3 01/49] Revert "linux-headers hack" from sevinit2 base tree Michael Roth
2024-03-20  8:38 ` [PATCH v3 02/49] scripts/update-linux-headers: Add setup_data.h to import list Michael Roth
2024-03-20  9:19   ` Paolo Bonzini
2024-03-20  8:38 ` [PATCH v3 03/49] scripts/update-linux-headers: Add bits.h to file imports Michael Roth
2024-03-20  8:39 ` [PATCH v3 04/49] [HACK] linux-headers: Update headers for 6.8 + kvm-coco-queue + SNP Michael Roth
2024-03-20  8:39 ` [PATCH v3 05/49] [TEMP] hw/i386: Remove redeclaration of struct setup_data Michael Roth
2024-03-20  8:39 ` [PATCH v3 06/49] RAMBlock: Add support of KVM private guest memfd Michael Roth
2024-03-20 16:38   ` Paolo Bonzini
2024-03-20  8:39 ` [PATCH v3 07/49] HostMem: Add mechanism to opt in kvm guest memfd via MachineState Michael Roth
2025-01-21 17:39   ` Peter Xu
2025-01-21 18:24     ` David Hildenbrand
2025-01-21 20:21       ` Peter Xu
2025-01-21 20:41         ` David Hildenbrand
2025-01-21 20:59           ` Peter Xu
2025-01-21 21:00             ` David Hildenbrand
2024-03-20  8:39 ` [PATCH v3 08/49] trace/kvm: Split address space and slot id in trace_kvm_set_user_memory() Michael Roth
2024-03-20  8:39 ` [PATCH v3 09/49] kvm: Enable KVM_SET_USER_MEMORY_REGION2 for memslot Michael Roth
2024-03-20 15:56   ` Paolo Bonzini
2024-03-20  8:39 ` [PATCH v3 10/49] kvm: Introduce support for memory_attributes Michael Roth
2024-03-20 16:00   ` Paolo Bonzini
2024-03-20  8:39 ` [PATCH v3 11/49] physmem: Introduce ram_block_discard_guest_memfd_range() Michael Roth
2024-03-20  9:37   ` David Hildenbrand
2024-03-20 12:43     ` Xiaoyao Li
2024-03-20 12:58       ` David Hildenbrand
2024-03-20 17:38     ` Michael Roth
2024-03-20 20:04       ` David Hildenbrand
2024-03-21 20:24         ` Michael Roth
2024-03-20  8:39 ` [PATCH v3 12/49] kvm: handle KVM_EXIT_MEMORY_FAULT Michael Roth
2024-03-20  8:39 ` [PATCH v3 13/49] [FIXUP] "kvm: handle KVM_EXIT_MEMORY_FAULT": drop qemu_host_page_size Michael Roth
2024-03-20 12:46   ` Xiaoyao Li
2024-03-20  8:39 ` [PATCH v3 14/49] trace/kvm: Add trace for page convertion between shared and private Michael Roth
2024-03-20  8:39 ` [PATCH v3 15/49] kvm/memory: Make memory type private by default if it has guest memfd backend Michael Roth
2024-03-20  8:39 ` [PATCH v3 16/49] memory: Introduce memory_region_init_ram_guest_memfd() Michael Roth
2024-03-20  8:39 ` [PATCH v3 17/49] pci-host/q35: Move PAM initialization above SMRAM initialization Michael Roth
2024-03-20  8:39 ` [PATCH v3 18/49] q35: Introduce smm_ranges property for q35-pci-host Michael Roth
2024-03-20  8:39 ` [PATCH v3 19/49] kvm: Make kvm_convert_memory() obey ram_block_discard_is_enabled() Michael Roth
2024-03-20 16:26   ` Paolo Bonzini
2024-03-20 19:47     ` Michael Roth
2024-03-20  8:39 ` [PATCH v3 20/49] trace/kvm: Add trace for KVM_EXIT_MEMORY_FAULT Michael Roth
2024-03-20  8:39 ` [PATCH v3 21/49] i386/sev: Introduce "sev-common" type to encapsulate common SEV state Michael Roth
2024-03-20 11:44   ` Daniel P. Berrangé
2024-03-20 21:36     ` Michael Roth via
2024-03-27 15:22     ` Markus Armbruster
2024-03-20 11:47   ` Daniel P. Berrangé
2024-03-20 21:45     ` Michael Roth via
2024-04-22 13:06   ` Markus Armbruster
2024-03-20  8:39 ` [PATCH v3 22/49] i386/sev: Introduce 'sev-snp-guest' object Michael Roth
2024-03-20 11:58   ` Daniel P. Berrangé
2024-03-20 22:09     ` Michael Roth via
2024-04-22 13:52   ` Markus Armbruster
2024-03-20  8:39 ` [PATCH v3 23/49] i386/sev: Add a sev_snp_enabled() helper Michael Roth
2024-03-20 12:35   ` Daniel P. Berrangé
2024-03-20 22:11     ` Michael Roth via
2024-03-20  8:39 ` [PATCH v3 24/49] target/i386: Add handling for KVM_X86_SNP_VM VM type Michael Roth
2024-03-20  9:33   ` Paolo Bonzini
2024-03-20  8:39 ` [PATCH v3 25/49] i386/sev: Skip RAMBlock notifiers for SNP Michael Roth
2024-03-20  9:46   ` Paolo Bonzini
2024-03-20 22:14     ` Michael Roth
2024-03-20  8:39 ` [PATCH v3 26/49] i386/sev: Skip machine-init-done " Michael Roth
2024-03-20  8:39 ` [PATCH v3 27/49] i386/sev: Set ms->require_guest_memfd " Michael Roth
2024-03-20  9:48   ` Paolo Bonzini
2024-03-20  8:39 ` [PATCH v3 28/49] i386/sev: Disable SMM " Michael Roth
2024-03-20 12:32   ` Daniel P. Berrangé
2024-03-20  8:39 ` [PATCH v3 29/49] i386/sev: Don't disable block discarding " Michael Roth
2024-03-20 12:33   ` Daniel P. Berrangé
2024-03-20  8:39 ` [PATCH v3 30/49] i386/cpu: Set SEV-SNP CPUID bit when SNP enabled Michael Roth
2024-03-20  8:39 ` [PATCH v3 31/49] i386/sev: Update query-sev QAPI format to handle SEV-SNP Michael Roth
2024-03-20 12:10   ` Daniel P. Berrangé
2024-03-20 22:23     ` Michael Roth via
2024-04-22 15:01   ` Markus Armbruster
2024-03-20  8:39 ` [PATCH v3 32/49] i386/sev: Don't return launch measurements for SEV-SNP guests Michael Roth
2024-03-20 12:15   ` Daniel P. Berrangé
2024-03-20 12:27     ` Daniel P. Berrangé
2024-03-20  8:39 ` [PATCH v3 33/49] kvm: Make kvm_convert_memory() non-static Michael Roth
2024-03-20  8:39 ` [PATCH v3 34/49] i386/sev: Add KVM_EXIT_VMGEXIT handling for Page State Changes Michael Roth
2024-03-20  8:39 ` [PATCH v3 35/49] i386/sev: Add KVM_EXIT_VMGEXIT handling for Page State Changes (MSR-based) Michael Roth
2024-03-20  8:39 ` [PATCH v3 36/49] i386/sev: Add KVM_EXIT_VMGEXIT handling for Extended Guest Requests Michael Roth
2024-04-22 15:02   ` Markus Armbruster
2024-03-20  8:39 ` [PATCH v3 37/49] i386/sev: Add the SNP launch start context Michael Roth
2024-03-20  9:58   ` Paolo Bonzini
2024-03-20 22:32     ` Michael Roth
2024-03-21 11:55       ` Paolo Bonzini
2024-03-20  8:39 ` [PATCH v3 38/49] i386/sev: Add handling to encrypt/finalize guest launch data Michael Roth
2024-03-20  8:39 ` [PATCH v3 39/49] i386/sev: Set CPU state to protected once SNP guest payload is finalized Michael Roth
2024-03-20  8:39 ` [PATCH v3 40/49] hw/i386/sev: Add function to get SEV metadata from OVMF header Michael Roth
2024-03-20 17:55   ` Isaku Yamahata
2024-03-20 22:35     ` Michael Roth
2024-03-20  8:39 ` [PATCH v3 41/49] i386/sev: Add support for populating OVMF metadata pages Michael Roth
2024-03-20  8:39 ` [PATCH v3 42/49] i386/sev: Add support for SNP CPUID validation Michael Roth
2024-03-20 12:18   ` Daniel P. Berrangé
2024-03-20  8:39 ` Michael Roth [this message]
2024-03-20 12:20   ` [PATCH v3 43/49] qapi, i386: Move kernel-hashes to SevCommonProperties Daniel P. Berrangé
2024-04-22 15:03     ` Markus Armbruster
2024-03-20  8:39 ` [PATCH v3 44/49] i386/sev: Extract build_kernel_loader_hashes Michael Roth
2024-03-20  8:39 ` [PATCH v3 45/49] i386/sev: Reorder struct declarations Michael Roth
2024-03-20  8:39 ` [PATCH v3 46/49] i386/sev: Allow measured direct kernel boot on SNP Michael Roth
2024-03-20  8:39 ` [PATCH v3 47/49] hw/i386/sev: Add support to encrypt BIOS when SEV-SNP is enabled Michael Roth
2024-03-20 12:22   ` Daniel P. Berrangé
2024-03-21 13:42     ` Michael Roth via
2024-03-20  8:39 ` [PATCH v3 48/49] hw/i386/sev: Use guest_memfd for legacy ROMs Michael Roth
2024-03-20 18:12   ` Isaku Yamahata
2024-03-28  0:45     ` Xiaoyao Li
2024-04-24  0:08       ` Michael Roth
2024-03-20  8:39 ` [PATCH v3 49/49] hw/i386: Add support for loading BIOS using guest_memfd Michael Roth
2024-03-20  9:59 ` [PATCH RFC v3 00/49] Add AMD Secure Nested Paging (SEV-SNP) support Paolo Bonzini
2024-03-20 17:08   ` Paolo Bonzini
2024-03-20 20:54     ` Xiaoyao Li
2024-03-21 20:26 ` Michael Roth
2024-04-18 11:37 ` Ani Sinha

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240320083945.991426-44-michael.roth@amd.com \
    --to=michael.roth@amd.com \
    --cc=armbru@redhat.com \
    --cc=berrange@redhat.com \
    --cc=dovmurik@linux.ibm.com \
    --cc=isaku.yamahata@linux.intel.com \
    --cc=kvm@vger.kernel.org \
    --cc=pankaj.gupta@amd.com \
    --cc=pbonzini@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=thomas.lendacky@amd.com \
    --cc=xiaoyao.li@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).