bc419a1cc5
SPDM enables authentication, attestation and key exchange to assist in providing infrastructure security enablement. It's a standard published by the DMTF [1]. SPDM supports multiple transports, including PCIe DOE and MCTP. This patch adds support to QEMU to connect to an external SPDM instance. SPDM support can be added to any QEMU device by exposing a TCP socket to a SPDM server. The server can then implement the SPDM decoding/encoding support, generally using libspdm [2]. This is similar to how the current TPM implementation works and means that the heavy lifting of setting up certificate chains, capabilities, measurements and complex crypto can be done outside QEMU by a well supported and tested library. 1: https://www.dmtf.org/standards/SPDM 2: https://github.com/DMTF/libspdm Signed-off-by: Huai-Cheng Kuo <hchkuo@avery-design.com.tw> Signed-off-by: Chris Browy <cbrowy@avery-design.com> Co-developed-by: Jonathan Cameron <Jonathan.cameron@huawei.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> [ Changes by WM - Bug fixes from testing ] Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> [ Changes by AF: - Convert to be more QEMU-ified - Move to backends as it isn't PCIe specific ] Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20240703092027.644758-3-alistair.francis@wdc.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
75 lines
2.8 KiB
C
75 lines
2.8 KiB
C
/*
|
|
* QEMU SPDM socket support
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
* of this software and associated documentation files (the "Software"), to deal
|
|
* in the Software without restriction, including without limitation the rights
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
* copies of the Software, and to permit persons to whom the Software is
|
|
* furnished to do so, subject to the following conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be included in
|
|
* all copies or substantial portions of the Software.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
|
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
* THE SOFTWARE.
|
|
*/
|
|
|
|
#ifndef SPDM_REQUESTER_H
|
|
#define SPDM_REQUESTER_H
|
|
|
|
/**
|
|
* spdm_socket_connect: connect to an external SPDM socket
|
|
* @port: port to connect to
|
|
* @errp: error object handle
|
|
*
|
|
* This will connect to an external SPDM socket server. On error
|
|
* it will return -1 and errp will be set. On success this function
|
|
* will return the socket number.
|
|
*/
|
|
int spdm_socket_connect(uint16_t port, Error **errp);
|
|
|
|
/**
|
|
* spdm_socket_rsp: send and receive a message to a SPDM server
|
|
* @socket: socket returned from spdm_socket_connect()
|
|
* @transport_type: SPDM_SOCKET_TRANSPORT_TYPE_* macro
|
|
* @req: request buffer
|
|
* @req_len: request buffer length
|
|
* @rsp: response buffer
|
|
* @rsp_len: response buffer length
|
|
*
|
|
* Send platform data to a SPDM server on socket and then receive
|
|
* a response.
|
|
*/
|
|
uint32_t spdm_socket_rsp(const int socket, uint32_t transport_type,
|
|
void *req, uint32_t req_len,
|
|
void *rsp, uint32_t rsp_len);
|
|
|
|
/**
|
|
* spdm_socket_close: send a shutdown command to the server
|
|
* @socket: socket returned from spdm_socket_connect()
|
|
* @transport_type: SPDM_SOCKET_TRANSPORT_TYPE_* macro
|
|
*
|
|
* This will issue a shutdown command to the server.
|
|
*/
|
|
void spdm_socket_close(const int socket, uint32_t transport_type);
|
|
|
|
#define SPDM_SOCKET_COMMAND_NORMAL 0x0001
|
|
#define SPDM_SOCKET_COMMAND_OOB_ENCAP_KEY_UPDATE 0x8001
|
|
#define SPDM_SOCKET_COMMAND_CONTINUE 0xFFFD
|
|
#define SPDM_SOCKET_COMMAND_SHUTDOWN 0xFFFE
|
|
#define SPDM_SOCKET_COMMAND_UNKOWN 0xFFFF
|
|
#define SPDM_SOCKET_COMMAND_TEST 0xDEAD
|
|
|
|
#define SPDM_SOCKET_TRANSPORT_TYPE_MCTP 0x01
|
|
#define SPDM_SOCKET_TRANSPORT_TYPE_PCI_DOE 0x02
|
|
|
|
#define SPDM_SOCKET_MAX_MESSAGE_BUFFER_SIZE 0x1200
|
|
|
|
#endif
|