diff mbox series

[v3,43/49] qapi, i386: Move kernel-hashes to SevCommonProperties

Message ID 20240320083945.991426-44-michael.roth@amd.com (mailing list archive)
State New, archived
Headers show
Series Add AMD Secure Nested Paging (SEV-SNP) support | expand

Commit Message

Michael Roth March 20, 2024, 8:39 a.m. UTC 
From: Dov Murik <dovmurik@linux.ibm.com>

In order to enable kernel-hashes for SNP, pull it from
SevGuestProperties to its parent SevCommonProperties so
it will be available for both SEV and SNP.

Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
Signed-off-by: Michael Roth <michael.roth@amd.com>
---
 qapi/qom.json     | 14 +++++++-------
 target/i386/sev.c | 44 ++++++++++++++++++--------------------------
 2 files changed, 25 insertions(+), 33 deletions(-)

Comments

Daniel P. Berrangé March 20, 2024, 12:20 p.m. UTC | #1 
On Wed, Mar 20, 2024 at 03:39:39AM -0500, Michael Roth wrote:
> From: Dov Murik <dovmurik@linux.ibm.com>
> 
> In order to enable kernel-hashes for SNP, pull it from
> SevGuestProperties to its parent SevCommonProperties so
> it will be available for both SEV and SNP.
> 
> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
> Signed-off-by: Michael Roth <michael.roth@amd.com>
> ---
>  qapi/qom.json     | 14 +++++++-------
>  target/i386/sev.c | 44 ++++++++++++++++++--------------------------
>  2 files changed, 25 insertions(+), 33 deletions(-)

This change ought to be squashed into the earlier patch
that introduce sev-guest-common.

> 
> diff --git a/qapi/qom.json b/qapi/qom.json
> index 7ba778af91..ea8832a8c3 100644
> --- a/qapi/qom.json
> +++ b/qapi/qom.json
> @@ -886,12 +886,17 @@
>  # @reduced-phys-bits: number of bits in physical addresses that become
>  #     unavailable when SEV is enabled
>  #
> +# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a
> +#     designated guest firmware page for measured boot with -kernel
> +#     (default: false) (since 6.2)
> +#
>  # Since: 2.12
>  ##
>  { 'struct': 'SevCommonProperties',
>    'data': { '*sev-device': 'str',
>              '*cbitpos': 'uint32',
> -            'reduced-phys-bits': 'uint32' } }
> +            'reduced-phys-bits': 'uint32',
> +            '*kernel-hashes': 'bool' } }
>  
>  ##
>  # @SevGuestProperties:
> @@ -906,10 +911,6 @@
>  #
>  # @handle: SEV firmware handle (default: 0)
>  #
> -# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a
> -#     designated guest firmware page for measured boot with -kernel
> -#     (default: false) (since 6.2)
> -#
>  # Since: 2.12
>  ##
>  { 'struct': 'SevGuestProperties',
> @@ -917,8 +918,7 @@
>    'data': { '*dh-cert-file': 'str',
>              '*session-file': 'str',
>              '*policy': 'uint32',
> -            '*handle': 'uint32',
> -            '*kernel-hashes': 'bool' } }
> +            '*handle': 'uint32' } }
>  
>  ##
>  # @SevSnpGuestProperties:
> diff --git a/target/i386/sev.c b/target/i386/sev.c
> index db888afb53..3187b3dee8 100644
> --- a/target/i386/sev.c
> +++ b/target/i386/sev.c
> @@ -54,6 +54,7 @@ struct SevCommonState {
>      char *sev_device;
>      uint32_t cbitpos;
>      uint32_t reduced_phys_bits;
> +    bool kernel_hashes;
>  
>      /* runtime state */
>      uint8_t api_major;
> @@ -86,7 +87,6 @@ struct SevGuestState {
>      uint32_t policy;
>      char *dh_cert_file;
>      char *session_file;
> -    bool kernel_hashes;
>  };
>  
>  struct SevSnpGuestState {
> @@ -1696,16 +1696,12 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
>      MemTxAttrs attrs = { 0 };
>      bool ret = true;
>      SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
> -    SevGuestState *sev_guest =
> -        (SevGuestState *)object_dynamic_cast(OBJECT(sev_common),
> -                                             TYPE_SEV_GUEST);
>  
>      /*
>       * Only add the kernel hashes if the sev-guest configuration explicitly
> -     * stated kernel-hashes=on. Currently only enabled for SEV/SEV-ES guests,
> -     * so check for TYPE_SEV_GUEST as well.
> +     * stated kernel-hashes=on.
>       */
> -    if (sev_guest && !sev_guest->kernel_hashes) {
> +    if (!sev_common->kernel_hashes) {
>          return false;
>      }
>  
> @@ -2037,6 +2033,16 @@ sev_common_set_sev_device(Object *obj, const char *value, Error **errp)
>      SEV_COMMON(obj)->sev_device = g_strdup(value);
>  }
>  
> +static bool sev_common_get_kernel_hashes(Object *obj, Error **errp)
> +{
> +    return SEV_COMMON(obj)->kernel_hashes;
> +}
> +
> +static void sev_common_set_kernel_hashes(Object *obj, bool value, Error **errp)
> +{
> +    SEV_COMMON(obj)->kernel_hashes = value;
> +}
> +
>  static void
>  sev_common_class_init(ObjectClass *oc, void *data)
>  {
> @@ -2051,6 +2057,11 @@ sev_common_class_init(ObjectClass *oc, void *data)
>                                    sev_common_set_sev_device);
>      object_class_property_set_description(oc, "sev-device",
>              "SEV device to use");
> +    object_class_property_add_bool(oc, "kernel-hashes",
> +                                   sev_common_get_kernel_hashes,
> +                                   sev_common_set_kernel_hashes);
> +    object_class_property_set_description(oc, "kernel-hashes",
> +            "add kernel hashes to guest firmware for measured Linux boot");
>  }
>  
>  static void
> @@ -2109,20 +2120,6 @@ sev_guest_set_session_file(Object *obj, const char *value, Error **errp)
>      SEV_GUEST(obj)->session_file = g_strdup(value);
>  }
>  
> -static bool sev_guest_get_kernel_hashes(Object *obj, Error **errp)
> -{
> -    SevGuestState *sev_guest = SEV_GUEST(obj);
> -
> -    return sev_guest->kernel_hashes;
> -}
> -
> -static void sev_guest_set_kernel_hashes(Object *obj, bool value, Error **errp)
> -{
> -    SevGuestState *sev = SEV_GUEST(obj);
> -
> -    sev->kernel_hashes = value;
> -}
> -
>  static void
>  sev_guest_class_init(ObjectClass *oc, void *data)
>  {
> @@ -2136,11 +2133,6 @@ sev_guest_class_init(ObjectClass *oc, void *data)
>                                    sev_guest_set_session_file);
>      object_class_property_set_description(oc, "session-file",
>              "guest owners session parameters (encoded with base64)");
> -    object_class_property_add_bool(oc, "kernel-hashes",
> -                                   sev_guest_get_kernel_hashes,
> -                                   sev_guest_set_kernel_hashes);
> -    object_class_property_set_description(oc, "kernel-hashes",
> -            "add kernel hashes to guest firmware for measured Linux boot");
>  }
>  
>  static void
> -- 
> 2.25.1
> 

With regards,
Daniel
Markus Armbruster April 22, 2024, 3:03 p.m. UTC | #2 
Daniel P. Berrangé <berrange@redhat.com> writes:

> On Wed, Mar 20, 2024 at 03:39:39AM -0500, Michael Roth wrote:
>> From: Dov Murik <dovmurik@linux.ibm.com>
>> 
>> In order to enable kernel-hashes for SNP, pull it from
>> SevGuestProperties to its parent SevCommonProperties so
>> it will be available for both SEV and SNP.
>> 
>> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
>> Signed-off-by: Michael Roth <michael.roth@amd.com>
>> ---
>>  qapi/qom.json     | 14 +++++++-------
>>  target/i386/sev.c | 44 ++++++++++++++++++--------------------------
>>  2 files changed, 25 insertions(+), 33 deletions(-)
>
> This change ought to be squashed into the earlier patch
> that introduce sev-guest-common.

Concur.

[...]
diff mbox series

Patch

diff --git a/qapi/qom.json b/qapi/qom.json
index 7ba778af91..ea8832a8c3 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -886,12 +886,17 @@ 
 # @reduced-phys-bits: number of bits in physical addresses that become
 #     unavailable when SEV is enabled
 #
+# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a
+#     designated guest firmware page for measured boot with -kernel
+#     (default: false) (since 6.2)
+#
 # Since: 2.12
 ##
 { 'struct': 'SevCommonProperties',
   'data': { '*sev-device': 'str',
             '*cbitpos': 'uint32',
-            'reduced-phys-bits': 'uint32' } }
+            'reduced-phys-bits': 'uint32',
+            '*kernel-hashes': 'bool' } }
 
 ##
 # @SevGuestProperties:
@@ -906,10 +911,6 @@ 
 #
 # @handle: SEV firmware handle (default: 0)
 #
-# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a
-#     designated guest firmware page for measured boot with -kernel
-#     (default: false) (since 6.2)
-#
 # Since: 2.12
 ##
 { 'struct': 'SevGuestProperties',
@@ -917,8 +918,7 @@ 
   'data': { '*dh-cert-file': 'str',
             '*session-file': 'str',
             '*policy': 'uint32',
-            '*handle': 'uint32',
-            '*kernel-hashes': 'bool' } }
+            '*handle': 'uint32' } }
 
 ##
 # @SevSnpGuestProperties:
diff --git a/target/i386/sev.c b/target/i386/sev.c
index db888afb53..3187b3dee8 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -54,6 +54,7 @@  struct SevCommonState {
     char *sev_device;
     uint32_t cbitpos;
     uint32_t reduced_phys_bits;
+    bool kernel_hashes;
 
     /* runtime state */
     uint8_t api_major;
@@ -86,7 +87,6 @@  struct SevGuestState {
     uint32_t policy;
     char *dh_cert_file;
     char *session_file;
-    bool kernel_hashes;
 };
 
 struct SevSnpGuestState {
@@ -1696,16 +1696,12 @@  bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
     MemTxAttrs attrs = { 0 };
     bool ret = true;
     SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
-    SevGuestState *sev_guest =
-        (SevGuestState *)object_dynamic_cast(OBJECT(sev_common),
-                                             TYPE_SEV_GUEST);
 
     /*
      * Only add the kernel hashes if the sev-guest configuration explicitly
-     * stated kernel-hashes=on. Currently only enabled for SEV/SEV-ES guests,
-     * so check for TYPE_SEV_GUEST as well.
+     * stated kernel-hashes=on.
      */
-    if (sev_guest && !sev_guest->kernel_hashes) {
+    if (!sev_common->kernel_hashes) {
         return false;
     }
 
@@ -2037,6 +2033,16 @@  sev_common_set_sev_device(Object *obj, const char *value, Error **errp)
     SEV_COMMON(obj)->sev_device = g_strdup(value);
 }
 
+static bool sev_common_get_kernel_hashes(Object *obj, Error **errp)
+{
+    return SEV_COMMON(obj)->kernel_hashes;
+}
+
+static void sev_common_set_kernel_hashes(Object *obj, bool value, Error **errp)
+{
+    SEV_COMMON(obj)->kernel_hashes = value;
+}
+
 static void
 sev_common_class_init(ObjectClass *oc, void *data)
 {
@@ -2051,6 +2057,11 @@  sev_common_class_init(ObjectClass *oc, void *data)
                                   sev_common_set_sev_device);
     object_class_property_set_description(oc, "sev-device",
             "SEV device to use");
+    object_class_property_add_bool(oc, "kernel-hashes",
+                                   sev_common_get_kernel_hashes,
+                                   sev_common_set_kernel_hashes);
+    object_class_property_set_description(oc, "kernel-hashes",
+            "add kernel hashes to guest firmware for measured Linux boot");
 }
 
 static void
@@ -2109,20 +2120,6 @@  sev_guest_set_session_file(Object *obj, const char *value, Error **errp)
     SEV_GUEST(obj)->session_file = g_strdup(value);
 }
 
-static bool sev_guest_get_kernel_hashes(Object *obj, Error **errp)
-{
-    SevGuestState *sev_guest = SEV_GUEST(obj);
-
-    return sev_guest->kernel_hashes;
-}
-
-static void sev_guest_set_kernel_hashes(Object *obj, bool value, Error **errp)
-{
-    SevGuestState *sev = SEV_GUEST(obj);
-
-    sev->kernel_hashes = value;
-}
-
 static void
 sev_guest_class_init(ObjectClass *oc, void *data)
 {
@@ -2136,11 +2133,6 @@  sev_guest_class_init(ObjectClass *oc, void *data)
                                   sev_guest_set_session_file);
     object_class_property_set_description(oc, "session-file",
             "guest owners session parameters (encoded with base64)");
-    object_class_property_add_bool(oc, "kernel-hashes",
-                                   sev_guest_get_kernel_hashes,
-                                   sev_guest_set_kernel_hashes);
-    object_class_property_set_description(oc, "kernel-hashes",
-            "add kernel hashes to guest firmware for measured Linux boot");
 }
 
 static void