From c7f7e6970d3b74c1454cafea4918187e06c473eb Mon Sep 17 00:00:00 2001 From: Tobin Feldman-Fitzthum Date: Tue, 27 Oct 2020 13:03:03 -0400 Subject: sev: add sev-inject-launch-secret AMD SEV allows a guest owner to inject a secret blob into the memory of a virtual machine. The secret is encrypted with the SEV Transport Encryption Key and integrity is guaranteed with the Transport Integrity Key. Although QEMU facilitates the injection of the launch secret, it cannot access the secret. Signed-off-by: Tobin Feldman-Fitzthum Signed-off-by: Eduardo Habkost Reviewed-by: Daniel P. Berrangé Reviewed-by: Brijesh Singh Message-Id: <20201027170303.47550-1-tobin@linux.ibm.com> Signed-off-by: Eduardo Habkost --- qapi/misc-target.json | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'qapi') diff --git a/qapi/misc-target.json b/qapi/misc-target.json index cbe5135264..06ef8757f0 100644 --- a/qapi/misc-target.json +++ b/qapi/misc-target.json @@ -201,6 +201,24 @@ { 'command': 'query-sev-capabilities', 'returns': 'SevCapability', 'if': 'defined(TARGET_I386)' } +## +# @sev-inject-launch-secret: +# +# This command injects a secret blob into memory of SEV guest. +# +# @packet-header: the launch secret packet header encoded in base64 +# +# @secret: the launch secret data to be injected encoded in base64 +# +# @gpa: the guest physical address where secret will be injected. +# +# Since: 6.0 +# +## +{ 'command': 'sev-inject-launch-secret', + 'data': { 'packet-header': 'str', 'secret': 'str', 'gpa': 'uint64' }, + 'if': 'defined(TARGET_I386)' } + ## # @dump-skeys: # -- cgit v1.2.3-55-g7522