Re: [PATCH v2 16/31] qapi/qom: Add ObjectOptions for confidential-guest-support

[Eric Blake]

On 2/24/21 7:52 AM, Kevin Wolf wrote:
> This adds a QAPI schema for the properties of the objects implementing
> the confidential-guest-support interface.
> 
> pef-guest and s390x-pv-guest don't have any properties, so they only
> need to be added to the ObjectType enum without adding a new branch to
> ObjectOptions.
> 
> Signed-off-by: Kevin Wolf 
> ---
>  qapi/qom.json | 37 +
>  1 file changed, 37 insertions(+)
> 
> diff --git a/qapi/qom.json b/qapi/qom.json
> index e7184122e9..d5f68b5c89 100644
> --- a/qapi/qom.json
> +++ b/qapi/qom.json
> @@ -633,6 +633,38 @@
>'base': 'RngProperties',
>'data': { '*filename': 'str' } }
>  
> +##
> +# @SevGuestProperties:
> +#
> +# Properties for sev-guest objects.
> +#
> +# @sev-device: SEV device to use (default: "/dev/sev")
> +#
> +# @dh-cert-file: guest owners DH certificate (encoded with base64)
> +#
> +# @session-file: guest owners session parameters (encoded with base64)

Matches target/i386/sev.c:sev_guest_class_init()...

> +#
> +# @policy: SEV policy value (default: 0x1)
> +#
> +# @handle: SEV firmware handle (default: 0)
> +#
> +# @cbitpos: C-bit location in page table entry (default: 0)
> +#
> +# @reduced-phys-bits: number of bits in physical addresses that become
> +# unavailable when SEV is enabled

...and sev_guest_instance_init().

> +#
> +# Since: 2.12
> +##
> +{ 'struct': 'SevGuestProperties',
> +  'data': { '*sev-device': 'str',
> +'*dh-cert-file': 'str',
> +'*session-file': 'str',
> +'*policy': 'uint32',
> +'*handle': 'uint32',
> +'*cbitpos': 'uint32',
> +'reduced-phys-bits': 'uint32' },
> +  'if': 'defined(CONFIG_SEV)' }
> +
>  ##
>  # @ObjectType:
>  #
> @@ -661,12 +693,15 @@
>  'memory-backend-file',
>  'memory-backend-memfd',
>  'memory-backend-ram',
> +{'name': 'pef-guest', 'if': 'defined(CONFIG_PSERIES)' },
>  'pr-manager-helper',
>  'rng-builtin',
>  'rng-egd',
>  'rng-random',
>  'secret',
>  'secret_keyring',
> +{'name': 'sev-guest', 'if': 'defined(CONFIG_SEV)' },
> +'s390-pv-guest',
>  'throttle-group',
>  'tls-creds-anon',
>  'tls-creds-psk',
> @@ -716,6 +751,8 @@
>'rng-random': 'RngRandomProperties',
>'secret': 'SecretProperties',
>'secret_keyring': 'SecretKeyringProperties',
> +  'sev-guest':  { 'type': 'SevGuestProperties',
> +  'if': 'defined(CONFIG_SEV)' },
>'throttle-group': 'ThrottleGroupProperties',
>'tls-creds-anon': 'TlsCredsAnonProperties',
>'tls-creds-psk':  'TlsCredsPskProperties',
> 

Reviewed-by: Eric Blake 

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.   +1-919-301-3226
Virtualization:  qemu.org | libvirt.org

Re: [PATCH v2 16/31] qapi/qom: Add ObjectOptions for confidential-guest-support

[Kevin Wolf]

Am 24.02.2021 um 16:21 hat Dr. David Alan Gilbert geschrieben:
> * Kevin Wolf (kw...@redhat.com) wrote:
> > This adds a QAPI schema for the properties of the objects implementing
> > the confidential-guest-support interface.
> > 
> > pef-guest and s390x-pv-guest don't have any properties, so they only
> > need to be added to the ObjectType enum without adding a new branch to
> > ObjectOptions.
> > 
> > Signed-off-by: Kevin Wolf 
> > ---
> >  qapi/qom.json | 37 +
> >  1 file changed, 37 insertions(+)
> > 
> > diff --git a/qapi/qom.json b/qapi/qom.json
> > index e7184122e9..d5f68b5c89 100644
> > --- a/qapi/qom.json
> > +++ b/qapi/qom.json
> > @@ -633,6 +633,38 @@
> >'base': 'RngProperties',
> >'data': { '*filename': 'str' } }
> >  
> > +##
> > +# @SevGuestProperties:
> > +#
> > +# Properties for sev-guest objects.
> > +#
> > +# @sev-device: SEV device to use (default: "/dev/sev")
> > +#
> > +# @dh-cert-file: guest owners DH certificate (encoded with base64)
> > +#
> > +# @session-file: guest owners session parameters (encoded with base64)
> > +#
> > +# @policy: SEV policy value (default: 0x1)
> > +#
> > +# @handle: SEV firmware handle (default: 0)
> > +#
> > +# @cbitpos: C-bit location in page table entry (default: 0)
> > +#
> > +# @reduced-phys-bits: number of bits in physical addresses that become
> > +# unavailable when SEV is enabled
> > +#
> > +# Since: 2.12
> > +##
> > +{ 'struct': 'SevGuestProperties',
> > +  'data': { '*sev-device': 'str',
> > +'*dh-cert-file': 'str',
> > +'*session-file': 'str',
> > +'*policy': 'uint32',
> > +'*handle': 'uint32',
> > +'*cbitpos': 'uint32',
> > +'reduced-phys-bits': 'uint32' },
> > +  'if': 'defined(CONFIG_SEV)' }
> > +
> >  ##
> >  # @ObjectType:
> >  #
> > @@ -661,12 +693,15 @@
> >  'memory-backend-file',
> >  'memory-backend-memfd',
> >  'memory-backend-ram',
> > +{'name': 'pef-guest', 'if': 'defined(CONFIG_PSERIES)' },
> >  'pr-manager-helper',
> >  'rng-builtin',
> >  'rng-egd',
> >  'rng-random',
> >  'secret',
> >  'secret_keyring',
> > +{'name': 'sev-guest', 'if': 'defined(CONFIG_SEV)' },
> > +'s390-pv-guest',
> 
> If pef-guest is conditional on PSERIES< shouldn't this be dependent on
> s390?

The difference is that s390-pv-guest is compiled unconditionally if the
s390x target is built, whereas CONFIG_PSERIES is a separate thing from
building a ppc target.

I actually tried making it conditional on TARGET_S390X at first, but the
code generated from this schema is supposed to be target independent, so
it rightly failed to build because TARGET_* are marked as poisoned in
most of the codebase.

Kevin

Re: [PATCH v2 16/31] qapi/qom: Add ObjectOptions for confidential-guest-support

[Dr. David Alan Gilbert]

* Kevin Wolf (kw...@redhat.com) wrote:
> This adds a QAPI schema for the properties of the objects implementing
> the confidential-guest-support interface.
> 
> pef-guest and s390x-pv-guest don't have any properties, so they only
> need to be added to the ObjectType enum without adding a new branch to
> ObjectOptions.
> 
> Signed-off-by: Kevin Wolf 
> ---
>  qapi/qom.json | 37 +
>  1 file changed, 37 insertions(+)
> 
> diff --git a/qapi/qom.json b/qapi/qom.json
> index e7184122e9..d5f68b5c89 100644
> --- a/qapi/qom.json
> +++ b/qapi/qom.json
> @@ -633,6 +633,38 @@
>'base': 'RngProperties',
>'data': { '*filename': 'str' } }
>  
> +##
> +# @SevGuestProperties:
> +#
> +# Properties for sev-guest objects.
> +#
> +# @sev-device: SEV device to use (default: "/dev/sev")
> +#
> +# @dh-cert-file: guest owners DH certificate (encoded with base64)
> +#
> +# @session-file: guest owners session parameters (encoded with base64)
> +#
> +# @policy: SEV policy value (default: 0x1)
> +#
> +# @handle: SEV firmware handle (default: 0)
> +#
> +# @cbitpos: C-bit location in page table entry (default: 0)
> +#
> +# @reduced-phys-bits: number of bits in physical addresses that become
> +# unavailable when SEV is enabled
> +#
> +# Since: 2.12
> +##
> +{ 'struct': 'SevGuestProperties',
> +  'data': { '*sev-device': 'str',
> +'*dh-cert-file': 'str',
> +'*session-file': 'str',
> +'*policy': 'uint32',
> +'*handle': 'uint32',
> +'*cbitpos': 'uint32',
> +'reduced-phys-bits': 'uint32' },
> +  'if': 'defined(CONFIG_SEV)' }
> +
>  ##
>  # @ObjectType:
>  #
> @@ -661,12 +693,15 @@
>  'memory-backend-file',
>  'memory-backend-memfd',
>  'memory-backend-ram',
> +{'name': 'pef-guest', 'if': 'defined(CONFIG_PSERIES)' },
>  'pr-manager-helper',
>  'rng-builtin',
>  'rng-egd',
>  'rng-random',
>  'secret',
>  'secret_keyring',
> +{'name': 'sev-guest', 'if': 'defined(CONFIG_SEV)' },
> +'s390-pv-guest',

If pef-guest is conditional on PSERIES< shouldn't this be dependent on
s390?

Dave

>  'throttle-group',
>  'tls-creds-anon',
>  'tls-creds-psk',
> @@ -716,6 +751,8 @@
>'rng-random': 'RngRandomProperties',
>'secret': 'SecretProperties',
>'secret_keyring': 'SecretKeyringProperties',
> +  'sev-guest':  { 'type': 'SevGuestProperties',
> +  'if': 'defined(CONFIG_SEV)' },
>'throttle-group': 'ThrottleGroupProperties',
>'tls-creds-anon': 'TlsCredsAnonProperties',
>'tls-creds-psk':  'TlsCredsPskProperties',
> -- 
> 2.29.2
> 
-- 
Dr. David Alan Gilbert / dgilb...@redhat.com / Manchester, UK

[PATCH v2 16/31] qapi/qom: Add ObjectOptions for confidential-guest-support

[Kevin Wolf]

This adds a QAPI schema for the properties of the objects implementing
the confidential-guest-support interface.

pef-guest and s390x-pv-guest don't have any properties, so they only
need to be added to the ObjectType enum without adding a new branch to
ObjectOptions.

Signed-off-by: Kevin Wolf 
---
 qapi/qom.json | 37 +
 1 file changed, 37 insertions(+)

diff --git a/qapi/qom.json b/qapi/qom.json
index e7184122e9..d5f68b5c89 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -633,6 +633,38 @@
   'base': 'RngProperties',
   'data': { '*filename': 'str' } }
 
+##
+# @SevGuestProperties:
+#
+# Properties for sev-guest objects.
+#
+# @sev-device: SEV device to use (default: "/dev/sev")
+#
+# @dh-cert-file: guest owners DH certificate (encoded with base64)
+#
+# @session-file: guest owners session parameters (encoded with base64)
+#
+# @policy: SEV policy value (default: 0x1)
+#
+# @handle: SEV firmware handle (default: 0)
+#
+# @cbitpos: C-bit location in page table entry (default: 0)
+#
+# @reduced-phys-bits: number of bits in physical addresses that become
+# unavailable when SEV is enabled
+#
+# Since: 2.12
+##
+{ 'struct': 'SevGuestProperties',
+  'data': { '*sev-device': 'str',
+'*dh-cert-file': 'str',
+'*session-file': 'str',
+'*policy': 'uint32',
+'*handle': 'uint32',
+'*cbitpos': 'uint32',
+'reduced-phys-bits': 'uint32' },
+  'if': 'defined(CONFIG_SEV)' }
+
 ##
 # @ObjectType:
 #
@@ -661,12 +693,15 @@
 'memory-backend-file',
 'memory-backend-memfd',
 'memory-backend-ram',
+{'name': 'pef-guest', 'if': 'defined(CONFIG_PSERIES)' },
 'pr-manager-helper',
 'rng-builtin',
 'rng-egd',
 'rng-random',
 'secret',
 'secret_keyring',
+{'name': 'sev-guest', 'if': 'defined(CONFIG_SEV)' },
+'s390-pv-guest',
 'throttle-group',
 'tls-creds-anon',
 'tls-creds-psk',
@@ -716,6 +751,8 @@
   'rng-random': 'RngRandomProperties',
   'secret': 'SecretProperties',
   'secret_keyring': 'SecretKeyringProperties',
+  'sev-guest':  { 'type': 'SevGuestProperties',
+  'if': 'defined(CONFIG_SEV)' },
   'throttle-group': 'ThrottleGroupProperties',
   'tls-creds-anon': 'TlsCredsAnonProperties',
   'tls-creds-psk':  'TlsCredsPskProperties',
-- 
2.29.2