From: Kevin Wolf <kwolf@redhat.com>
To: Connor Kuehl <ckuehl@redhat.com>
Cc: jejb@linux.ibm.com, npmccallum@redhat.com, qemu-devel@nongnu.org,
dgilbert@redhat.com
Subject: Re: Interactive launch over QMP socket?
Date: Mon, 22 Feb 2021 12:40:07 +0100 [thread overview]
Message-ID: <20210222114007.GB6866@merkur.fritz.box> (raw)
In-Reply-To: <47b15088-514a-8174-029d-8d9c4571960a@redhat.com>
Am 10.02.2021 um 19:01 hat Connor Kuehl geschrieben:
> Hello,
>
> Does QEMU have an internal API which would allow VM construction to wait at
> a *very specific point* until specific data/QMP message(s) are supplied via
> the QMP socket?
>
> For some additional context: QEMU supports launching AMD SEV-protected
> guests; in short: encrypted virtual machines. Guest owners may participate
> in attestation to cryptographically verify their assumptions about the
> guest's initial state, the host's platform, and the host platform owner's
> identity. If the guest owner is satisfied with the attestation process, a
> secret can be safely injected into the guest's address space over a secure
> channel.
>
> Attestation is an unavoidably interactive process.
>
> It appears that QEMU already exposes most of the API required to perform
> this attestation remotely with a guest owner over QMP, with only one
> exception: starting the attestation session. It looks like the session
> components (policy, session-file, and dh-cert-file) are supplied via command
> line arguments to QEMU and don't have a message type in the QMP spec:
>
> -object sev-guest,id=sev0,cbitpos=47,reduced-phys-bits=1,policy=0x1,session-file=blah.session,dh-cert-file=guest_owner.cert
>
> I would like to add a message type to QMP which allows guest owners to
> supply this data over a socket and _not_ require these components a priori
> via command line arguments.
I don't think you need a new QMP command for this. If you would use
-object on the command line, you can use QMP object-add at runtime.
Kevin
next prev parent reply other threads:[~2021-02-22 11:42 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-10 18:01 Interactive launch over QMP socket? Connor Kuehl
2021-02-10 18:14 ` James Bottomley
2021-02-10 18:46 ` Connor Kuehl
2021-02-10 19:06 ` James Bottomley
2021-02-10 20:39 ` Connor Kuehl
2021-02-11 9:11 ` Dr. David Alan Gilbert
2021-02-22 11:40 ` Kevin Wolf [this message]
2021-02-22 15:39 ` Daniel P. Berrangé
2021-02-22 16:23 ` Kevin Wolf
2021-02-22 12:18 ` Daniel P. Berrangé
2021-02-22 15:00 ` Connor Kuehl
2021-02-22 15:36 ` Daniel P. Berrangé
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210222114007.GB6866@merkur.fritz.box \
--to=kwolf@redhat.com \
--cc=ckuehl@redhat.com \
--cc=dgilbert@redhat.com \
--cc=jejb@linux.ibm.com \
--cc=npmccallum@redhat.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).