3ea1a80243
The SEV FW >= 0.23 added a new command that can be used to query the attestation report containing the SHA-256 digest of the guest memory and VMSA encrypted with the LAUNCH_UPDATE and sign it with the PEK. Note, we already have a command (LAUNCH_MEASURE) that can be used to query the SHA-256 digest of the guest memory encrypted through the LAUNCH_UPDATE. The main difference between previous and this command is that the report is signed with the PEK and unlike the LAUNCH_MEASURE command the ATTESATION_REPORT command can be called while the guest is running. Add a QMP interface "query-sev-attestation-report" that can be used to get the report encoded in base64. Cc: James Bottomley <jejb@linux.ibm.com> Cc: Tom Lendacky <Thomas.Lendacky@amd.com> Cc: Eric Blake <eblake@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: kvm@vger.kernel.org Reviewed-by: James Bottomley <jejb@linux.ibm.com> Tested-by: James Bottomley <jejb@linux.ibm.com> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> Reviewed-by: Connor Kuehl <ckuehl@redhat.com> Message-Id: <20210429170728.24322-1-brijesh.singh@amd.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
42 lines
1.1 KiB
C
42 lines
1.1 KiB
C
/*
|
|
* QEMU Secure Encrypted Virutualization (SEV) support
|
|
*
|
|
* Copyright: Advanced Micro Devices, 2016-2018
|
|
*
|
|
* Authors:
|
|
* Brijesh Singh <brijesh.singh@amd.com>
|
|
*
|
|
* This work is licensed under the terms of the GNU GPL, version 2 or later.
|
|
* See the COPYING file in the top-level directory.
|
|
*
|
|
*/
|
|
|
|
#ifndef QEMU_SEV_I386_H
|
|
#define QEMU_SEV_I386_H
|
|
|
|
#include "qom/object.h"
|
|
#include "qapi/error.h"
|
|
#include "sysemu/kvm.h"
|
|
#include "sysemu/sev.h"
|
|
#include "qemu/error-report.h"
|
|
#include "qapi/qapi-types-misc-target.h"
|
|
|
|
#define SEV_POLICY_NODBG 0x1
|
|
#define SEV_POLICY_NOKS 0x2
|
|
#define SEV_POLICY_ES 0x4
|
|
#define SEV_POLICY_NOSEND 0x8
|
|
#define SEV_POLICY_DOMAIN 0x10
|
|
#define SEV_POLICY_SEV 0x20
|
|
|
|
extern bool sev_es_enabled(void);
|
|
extern uint64_t sev_get_me_mask(void);
|
|
extern SevInfo *sev_get_info(void);
|
|
extern uint32_t sev_get_cbit_position(void);
|
|
extern uint32_t sev_get_reduced_phys_bits(void);
|
|
extern char *sev_get_launch_measurement(void);
|
|
extern SevCapability *sev_get_capabilities(Error **errp);
|
|
extern SevAttestationReport *
|
|
sev_get_attestation_report(const char *mnonce, Error **errp);
|
|
|
|
#endif
|