[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v3 43/49] qapi, i386: Move kernel-hashes to SevCommonProperties
From: |
Michael Roth |
Subject: |
[PATCH v3 43/49] qapi, i386: Move kernel-hashes to SevCommonProperties |
Date: |
Wed, 20 Mar 2024 03:39:39 -0500 |
From: Dov Murik <dovmurik@linux.ibm.com>
In order to enable kernel-hashes for SNP, pull it from
SevGuestProperties to its parent SevCommonProperties so
it will be available for both SEV and SNP.
Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
Signed-off-by: Michael Roth <michael.roth@amd.com>
---
qapi/qom.json | 14 +++++++-------
target/i386/sev.c | 44 ++++++++++++++++++--------------------------
2 files changed, 25 insertions(+), 33 deletions(-)
diff --git a/qapi/qom.json b/qapi/qom.json
index 7ba778af91..ea8832a8c3 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -886,12 +886,17 @@
# @reduced-phys-bits: number of bits in physical addresses that become
# unavailable when SEV is enabled
#
+# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a
+# designated guest firmware page for measured boot with -kernel
+# (default: false) (since 6.2)
+#
# Since: 2.12
##
{ 'struct': 'SevCommonProperties',
'data': { '*sev-device': 'str',
'*cbitpos': 'uint32',
- 'reduced-phys-bits': 'uint32' } }
+ 'reduced-phys-bits': 'uint32',
+ '*kernel-hashes': 'bool' } }
##
# @SevGuestProperties:
@@ -906,10 +911,6 @@
#
# @handle: SEV firmware handle (default: 0)
#
-# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a
-# designated guest firmware page for measured boot with -kernel
-# (default: false) (since 6.2)
-#
# Since: 2.12
##
{ 'struct': 'SevGuestProperties',
@@ -917,8 +918,7 @@
'data': { '*dh-cert-file': 'str',
'*session-file': 'str',
'*policy': 'uint32',
- '*handle': 'uint32',
- '*kernel-hashes': 'bool' } }
+ '*handle': 'uint32' } }
##
# @SevSnpGuestProperties:
diff --git a/target/i386/sev.c b/target/i386/sev.c
index db888afb53..3187b3dee8 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -54,6 +54,7 @@ struct SevCommonState {
char *sev_device;
uint32_t cbitpos;
uint32_t reduced_phys_bits;
+ bool kernel_hashes;
/* runtime state */
uint8_t api_major;
@@ -86,7 +87,6 @@ struct SevGuestState {
uint32_t policy;
char *dh_cert_file;
char *session_file;
- bool kernel_hashes;
};
struct SevSnpGuestState {
@@ -1696,16 +1696,12 @@ bool
sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
MemTxAttrs attrs = { 0 };
bool ret = true;
SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
- SevGuestState *sev_guest =
- (SevGuestState *)object_dynamic_cast(OBJECT(sev_common),
- TYPE_SEV_GUEST);
/*
* Only add the kernel hashes if the sev-guest configuration explicitly
- * stated kernel-hashes=on. Currently only enabled for SEV/SEV-ES guests,
- * so check for TYPE_SEV_GUEST as well.
+ * stated kernel-hashes=on.
*/
- if (sev_guest && !sev_guest->kernel_hashes) {
+ if (!sev_common->kernel_hashes) {
return false;
}
@@ -2037,6 +2033,16 @@ sev_common_set_sev_device(Object *obj, const char
*value, Error **errp)
SEV_COMMON(obj)->sev_device = g_strdup(value);
}
+static bool sev_common_get_kernel_hashes(Object *obj, Error **errp)
+{
+ return SEV_COMMON(obj)->kernel_hashes;
+}
+
+static void sev_common_set_kernel_hashes(Object *obj, bool value, Error **errp)
+{
+ SEV_COMMON(obj)->kernel_hashes = value;
+}
+
static void
sev_common_class_init(ObjectClass *oc, void *data)
{
@@ -2051,6 +2057,11 @@ sev_common_class_init(ObjectClass *oc, void *data)
sev_common_set_sev_device);
object_class_property_set_description(oc, "sev-device",
"SEV device to use");
+ object_class_property_add_bool(oc, "kernel-hashes",
+ sev_common_get_kernel_hashes,
+ sev_common_set_kernel_hashes);
+ object_class_property_set_description(oc, "kernel-hashes",
+ "add kernel hashes to guest firmware for measured Linux boot");
}
static void
@@ -2109,20 +2120,6 @@ sev_guest_set_session_file(Object *obj, const char
*value, Error **errp)
SEV_GUEST(obj)->session_file = g_strdup(value);
}
-static bool sev_guest_get_kernel_hashes(Object *obj, Error **errp)
-{
- SevGuestState *sev_guest = SEV_GUEST(obj);
-
- return sev_guest->kernel_hashes;
-}
-
-static void sev_guest_set_kernel_hashes(Object *obj, bool value, Error **errp)
-{
- SevGuestState *sev = SEV_GUEST(obj);
-
- sev->kernel_hashes = value;
-}
-
static void
sev_guest_class_init(ObjectClass *oc, void *data)
{
@@ -2136,11 +2133,6 @@ sev_guest_class_init(ObjectClass *oc, void *data)
sev_guest_set_session_file);
object_class_property_set_description(oc, "session-file",
"guest owners session parameters (encoded with base64)");
- object_class_property_add_bool(oc, "kernel-hashes",
- sev_guest_get_kernel_hashes,
- sev_guest_set_kernel_hashes);
- object_class_property_set_description(oc, "kernel-hashes",
- "add kernel hashes to guest firmware for measured Linux boot");
}
static void
--
2.25.1
- Re: [PATCH v3 37/49] i386/sev: Add the SNP launch start context, (continued)
- [PATCH v3 38/49] i386/sev: Add handling to encrypt/finalize guest launch data, Michael Roth, 2024/03/20
- [PATCH v3 39/49] i386/sev: Set CPU state to protected once SNP guest payload is finalized, Michael Roth, 2024/03/20
- [PATCH v3 40/49] hw/i386/sev: Add function to get SEV metadata from OVMF header, Michael Roth, 2024/03/20
- [PATCH v3 03/49] scripts/update-linux-headers: Add bits.h to file imports, Michael Roth, 2024/03/20
- [PATCH v3 41/49] i386/sev: Add support for populating OVMF metadata pages, Michael Roth, 2024/03/20
- [PATCH v3 42/49] i386/sev: Add support for SNP CPUID validation, Michael Roth, 2024/03/20
- [PATCH v3 43/49] qapi, i386: Move kernel-hashes to SevCommonProperties,
Michael Roth <=
- [PATCH v3 44/49] i386/sev: Extract build_kernel_loader_hashes, Michael Roth, 2024/03/20
- [PATCH v3 45/49] i386/sev: Reorder struct declarations, Michael Roth, 2024/03/20
- [PATCH v3 46/49] i386/sev: Allow measured direct kernel boot on SNP, Michael Roth, 2024/03/20
- [PATCH v3 47/49] hw/i386/sev: Add support to encrypt BIOS when SEV-SNP is enabled, Michael Roth, 2024/03/20
- [PATCH v3 48/49] hw/i386/sev: Use guest_memfd for legacy ROMs, Michael Roth, 2024/03/20