From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.4 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83D50C43142 for ; Tue, 19 Jan 2021 18:28:31 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3DFD222DFB for ; Tue, 19 Jan 2021 18:28:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389344AbhASQre (ORCPT ); Tue, 19 Jan 2021 11:47:34 -0500 Received: from us-smtp-delivery-124.mimecast.com ([216.205.24.124]:44063 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389101AbhASQrT (ORCPT ); Tue, 19 Jan 2021 11:47:19 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1611074752; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0J++Mr9m0Mfy8jyUQHfcyaXEz43NfNlMC2385CCzrfI=; b=Xr4b6c0dkd08ryjJVdc+NeIWyMsLWLp6PuSitM5G3+QKHfzA9ktzw1AG5qAm/wmSuJ0/HN pJWcmnfJydzpAMlnq/IulGpbV2I1nDIPUu686NkzBuxH3B2N3uNz/PAHTBKKZWvx6gIYvJ HMAqT3utJY+e3azbrO5fcQUwGrhV9AI= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-547-ihAcHFwCNRCAq0kJWO6gMw-1; Tue, 19 Jan 2021 11:45:48 -0500 X-MC-Unique: ihAcHFwCNRCAq0kJWO6gMw-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 9512E835DF2; Tue, 19 Jan 2021 16:45:47 +0000 (UTC) Received: from [10.3.113.116] (ovpn-113-116.phx2.redhat.com [10.3.113.116]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 04FC06EF43; Tue, 19 Jan 2021 16:45:46 +0000 (UTC) Subject: Re: [PATCH] target/i386/sev: add the support to query the attestation report To: Brijesh Singh , qemu-devel@nongnu.org Cc: James Bottomley , Tom Lendacky , Paolo Bonzini , kvm@vger.kernel.org References: <20201204213101.14552-1-brijesh.singh@amd.com> From: Eric Blake Organization: Red Hat, Inc. Message-ID: <15a7472f-5ec2-adc1-cda6-61d9ca58a5e0@redhat.com> Date: Tue, 19 Jan 2021 10:45:46 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.6.0 MIME-Version: 1.0 In-Reply-To: <20201204213101.14552-1-brijesh.singh@amd.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org On 12/4/20 3:31 PM, Brijesh Singh wrote: > The SEV FW >= 0.23 added a new command that can be used to query the > attestation report containing the SHA-256 digest of the guest memory > and VMSA encrypted with the LAUNCH_UPDATE and sign it with the PEK. > > Note, we already have a command (LAUNCH_MEASURE) that can be used to > query the SHA-256 digest of the guest memory encrypted through the > LAUNCH_UPDATE. The main difference between previous and this command > is that the report is signed with the PEK and unlike the LAUNCH_MEASURE > command the ATTESATION_REPORT command can be called while the guest > is running. > > Add a QMP interface "query-sev-attestation-report" that can be used > to get the report encoded in base64. > > +++ b/qapi/misc-target.json > @@ -267,3 +267,41 @@ > ## > { 'command': 'query-gic-capabilities', 'returns': ['GICCapability'], > 'if': 'defined(TARGET_ARM)' } > + > + > +## > +# @SevAttestationReport: > +# > +# The struct describes attestation report for a Secure Encrypted Virtualization > +# feature. > +# > +# @data: guest attestation report (base64 encoded) > +# > +# > +# Since: 5.2 You've missed the 5.2 release; this should be since 6.0. > +## > +{ 'struct': 'SevAttestationReport', > + 'data': { 'data': 'str'}, > + 'if': 'defined(TARGET_I386)' } > + > +## > +# @query-sev-attestation-report: > +# > +# This command is used to get the SEV attestation report, and is supported on AMD > +# X86 platforms only. > +# > +# @mnonce: a random 16 bytes of data (it will be included in report) This says 16 bytes,... > +# > +# Returns: SevAttestationReport objects. > +# > +# Since: 5.2 Likewise. > +# > +# Example: > +# > +# -> { "execute" : "query-sev-attestation-report", "arguments": { "mnonce": "aaaaaaa" } } ...but this example does not use 16 bytes. That's confusing. > +# <- { "return" : { "data": "aaaaaaaabbbddddd"} } > +# > +## > +{ 'command': 'query-sev-attestation-report', 'data': { 'mnonce': 'str' }, > + 'returns': 'SevAttestationReport', > + 'if': 'defined(TARGET_I386)' } > diff --git a/target/i386/monitor.c b/target/i386/monitor.c -- Eric Blake, Principal Software Engineer Red Hat, Inc. +1-919-301-3226 Virtualization: qemu.org | libvirt.org