| 1 | # -*- Mode: Python -*- |
| 2 | # vim: filetype=python |
| 3 | # |
| 4 | # SPDX-License-Identifier: GPL-2.0-or-later |
| 5 | |
| 6 | ## |
| 7 | # @rtc-reset-reinjection: |
| 8 | # |
| 9 | # Reset the RTC interrupt reinjection backlog. Can be used if another |
| 10 | # mechanism to synchronize guest time is in effect, for example QEMU |
| 11 | # guest agent's `guest-set-time` command. |
| 12 | # |
| 13 | # Use of this command is only applicable for x86 machines with an RTC, |
| 14 | # and on other machines will silently return without performing any |
| 15 | # action. |
| 16 | # |
| 17 | # Since: 2.1 |
| 18 | # |
| 19 | # .. qmp-example:: |
| 20 | # |
| 21 | # -> { "execute": "rtc-reset-reinjection" } |
| 22 | # <- { "return": {} } |
| 23 | ## |
| 24 | { 'command': 'rtc-reset-reinjection' } |
| 25 | |
| 26 | ## |
| 27 | # @SevState: |
| 28 | # |
| 29 | # An enumeration of SEV state information used during `query-sev`. |
| 30 | # |
| 31 | # @uninit: The guest is uninitialized. |
| 32 | # |
| 33 | # @launch-update: The guest is currently being launched; plaintext |
| 34 | # data and register state is being imported. |
| 35 | # |
| 36 | # @launch-secret: The guest is currently being launched; ciphertext |
| 37 | # data is being imported. |
| 38 | # |
| 39 | # @running: The guest is fully launched or migrated in. |
| 40 | # |
| 41 | # @send-update: The guest is currently being migrated out to another |
| 42 | # machine. |
| 43 | # |
| 44 | # @receive-update: The guest is currently being migrated from another |
| 45 | # machine. |
| 46 | # |
| 47 | # Since: 2.12 |
| 48 | ## |
| 49 | { 'enum': 'SevState', |
| 50 | 'data': ['uninit', 'launch-update', 'launch-secret', 'running', |
| 51 | 'send-update', 'receive-update' ] } |
| 52 | |
| 53 | ## |
| 54 | # @SevGuestType: |
| 55 | # |
| 56 | # An enumeration indicating the type of SEV guest being run. |
| 57 | # |
| 58 | # @sev: The guest is a legacy SEV or SEV-ES guest. |
| 59 | # |
| 60 | # @sev-snp: The guest is an SEV-SNP guest. |
| 61 | # |
| 62 | # Since: 6.2 |
| 63 | ## |
| 64 | { 'enum': 'SevGuestType', |
| 65 | 'data': [ 'sev', 'sev-snp' ] } |
| 66 | |
| 67 | ## |
| 68 | # @SevGuestInfo: |
| 69 | # |
| 70 | # Information specific to legacy SEV/SEV-ES guests. |
| 71 | # |
| 72 | # @policy: SEV policy value |
| 73 | # |
| 74 | # @handle: SEV firmware handle |
| 75 | # |
| 76 | # Since: 2.12 |
| 77 | ## |
| 78 | { 'struct': 'SevGuestInfo', |
| 79 | 'data': { 'policy': 'uint32', |
| 80 | 'handle': 'uint32' } } |
| 81 | |
| 82 | ## |
| 83 | # @SevSnpGuestInfo: |
| 84 | # |
| 85 | # Information specific to SEV-SNP guests. |
| 86 | # |
| 87 | # @snp-policy: SEV-SNP policy value |
| 88 | # |
| 89 | # Since: 9.1 |
| 90 | ## |
| 91 | { 'struct': 'SevSnpGuestInfo', |
| 92 | 'data': { 'snp-policy': 'uint64' } } |
| 93 | |
| 94 | ## |
| 95 | # @SevInfo: |
| 96 | # |
| 97 | # Information about Secure Encrypted Virtualization (SEV) support |
| 98 | # |
| 99 | # @enabled: true if SEV is active |
| 100 | # |
| 101 | # @api-major: SEV API major version |
| 102 | # |
| 103 | # @api-minor: SEV API minor version |
| 104 | # |
| 105 | # @build-id: SEV FW build id |
| 106 | # |
| 107 | # @state: SEV guest state |
| 108 | # |
| 109 | # @sev-type: Type of SEV guest being run |
| 110 | # |
| 111 | # Since: 2.12 |
| 112 | ## |
| 113 | { 'union': 'SevInfo', |
| 114 | 'base': { 'enabled': 'bool', |
| 115 | 'api-major': 'uint8', |
| 116 | 'api-minor' : 'uint8', |
| 117 | 'build-id' : 'uint8', |
| 118 | 'state' : 'SevState', |
| 119 | 'sev-type' : 'SevGuestType' }, |
| 120 | 'discriminator': 'sev-type', |
| 121 | 'data': { |
| 122 | 'sev': 'SevGuestInfo', |
| 123 | 'sev-snp': 'SevSnpGuestInfo' } } |
| 124 | |
| 125 | ## |
| 126 | # @query-sev: |
| 127 | # |
| 128 | # Return information about SEV/SEV-ES/SEV-SNP. |
| 129 | # |
| 130 | # If unavailable due to an incompatible configuration the returned |
| 131 | # @enabled field is set to 'false' and the state of all other fields |
| 132 | # is unspecified. |
| 133 | # |
| 134 | # Since: 2.12 |
| 135 | # |
| 136 | # .. qmp-example:: |
| 137 | # |
| 138 | # -> { "execute": "query-sev" } |
| 139 | # <- { "return": { "enabled": true, "api-major" : 0, "api-minor" : 0, |
| 140 | # "build-id" : 0, "policy" : 0, "state" : "running", |
| 141 | # "handle" : 1 } } |
| 142 | ## |
| 143 | { 'command': 'query-sev', 'returns': 'SevInfo' } |
| 144 | |
| 145 | ## |
| 146 | # @SevLaunchMeasureInfo: |
| 147 | # |
| 148 | # SEV Guest Launch measurement information |
| 149 | # |
| 150 | # @data: the measurement value encoded in base64 |
| 151 | # |
| 152 | # Since: 2.12 |
| 153 | ## |
| 154 | { 'struct': 'SevLaunchMeasureInfo', 'data': {'data': 'str'} } |
| 155 | |
| 156 | ## |
| 157 | # @query-sev-launch-measure: |
| 158 | # |
| 159 | # Query the SEV/SEV-ES guest launch information. |
| 160 | # |
| 161 | # This is only valid on x86 machines configured with KVM and the |
| 162 | # 'sev-guest' confidential virtualization object. The launch |
| 163 | # measurement for SEV-SNP guests is only available within the guest. |
| 164 | # |
| 165 | # Returns: The guest's SEV guest launch measurement info |
| 166 | # |
| 167 | # Errors: |
| 168 | # - If the launch measurement is unavailable, either due to an |
| 169 | # invalid guest configuration or if the guest has not reached |
| 170 | # the required SEV state, GenericError |
| 171 | # |
| 172 | # Since: 2.12 |
| 173 | # |
| 174 | # .. qmp-example:: |
| 175 | # |
| 176 | # -> { "execute": "query-sev-launch-measure" } |
| 177 | # <- { "return": { "data": "4l8LXeNlSPUDlXPJG5966/8%YZ" } } |
| 178 | ## |
| 179 | { 'command': 'query-sev-launch-measure', 'returns': 'SevLaunchMeasureInfo' } |
| 180 | |
| 181 | ## |
| 182 | # @SevCapability: |
| 183 | # |
| 184 | # The struct describes capability for a Secure Encrypted |
| 185 | # Virtualization feature. |
| 186 | # |
| 187 | # @pdh: Platform Diffie-Hellman key (base64 encoded) |
| 188 | # |
| 189 | # @cert-chain: PDH certificate chain (base64 encoded) |
| 190 | # |
| 191 | # @cpu0-id: Unique ID of CPU0 (base64 encoded) (since 7.1) |
| 192 | # |
| 193 | # @cbitpos: C-bit location in page table entry |
| 194 | # |
| 195 | # @reduced-phys-bits: Number of physical address bit reduction when |
| 196 | # SEV is enabled |
| 197 | # |
| 198 | # Since: 2.12 |
| 199 | ## |
| 200 | { 'struct': 'SevCapability', |
| 201 | 'data': { 'pdh': 'str', |
| 202 | 'cert-chain': 'str', |
| 203 | 'cpu0-id': 'str', |
| 204 | 'cbitpos': 'int', |
| 205 | 'reduced-phys-bits': 'int'} } |
| 206 | |
| 207 | ## |
| 208 | # @query-sev-capabilities: |
| 209 | # |
| 210 | # Get SEV capabilities. |
| 211 | # |
| 212 | # This is only supported on AMD X86 platforms with KVM enabled. |
| 213 | # |
| 214 | # Errors: |
| 215 | # - If SEV is not available on the platform, GenericError |
| 216 | # |
| 217 | # Since: 2.12 |
| 218 | # |
| 219 | # .. qmp-example:: |
| 220 | # |
| 221 | # -> { "execute": "query-sev-capabilities" } |
| 222 | # <- { "return": { "pdh": "8CCDD8DDD", "cert-chain": "888CCCDDDEE", |
| 223 | # "cpu0-id": "2lvmGwo+...61iEinw==", |
| 224 | # "cbitpos": 47, "reduced-phys-bits": 1}} |
| 225 | ## |
| 226 | { 'command': 'query-sev-capabilities', 'returns': 'SevCapability' } |
| 227 | |
| 228 | ## |
| 229 | # @sev-inject-launch-secret: |
| 230 | # |
| 231 | # Inject a secret blob into a SEV/SEV-ES guest's memory. |
| 232 | # |
| 233 | # This is only valid on x86 machines configured with KVM and the |
| 234 | # 'sev-guest' confidential virtualization object. SEV-SNP guests do |
| 235 | # not support launch secret injection. |
| 236 | # |
| 237 | # @packet-header: the launch secret packet header encoded in base64 |
| 238 | # |
| 239 | # @secret: the launch secret data to be injected encoded in base64 |
| 240 | # |
| 241 | # @gpa: the guest physical address where secret will be injected. |
| 242 | # |
| 243 | # Errors: |
| 244 | # - If launch secret injection is not possible, either due to |
| 245 | # an invalid guest configuration, or if the guest has not |
| 246 | # reached the required SEV state, GenericError |
| 247 | # |
| 248 | # Since: 6.0 |
| 249 | ## |
| 250 | { 'command': 'sev-inject-launch-secret', |
| 251 | 'data': { 'packet-header': 'str', 'secret': 'str', '*gpa': 'uint64' } } |
| 252 | |
| 253 | ## |
| 254 | # @SevAttestationReport: |
| 255 | # |
| 256 | # The struct describes attestation report for a Secure Encrypted |
| 257 | # Virtualization feature. |
| 258 | # |
| 259 | # @data: guest attestation report (base64 encoded) |
| 260 | # |
| 261 | # Since: 6.1 |
| 262 | ## |
| 263 | { 'struct': 'SevAttestationReport', |
| 264 | 'data': { 'data': 'str'} } |
| 265 | |
| 266 | ## |
| 267 | # @query-sev-attestation-report: |
| 268 | # |
| 269 | # Get the SEV attestation report. |
| 270 | # |
| 271 | # This is only valid on x86 machines configured with KVM and the |
| 272 | # 'sev-guest' confidential virtualization object. The attestation |
| 273 | # report for SEV-SNP guests is only available within the guest. |
| 274 | # |
| 275 | # @mnonce: a random 16 bytes value encoded in base64 (it will be |
| 276 | # included in report) |
| 277 | # |
| 278 | # Errors: |
| 279 | # - If the attestation report is unavailable, either due to an |
| 280 | # invalid guest configuration or because the guest has not |
| 281 | # reached the required SEV state, GenericError |
| 282 | # |
| 283 | # Since: 6.1 |
| 284 | # |
| 285 | # .. qmp-example:: |
| 286 | # |
| 287 | # -> { "execute" : "query-sev-attestation-report", |
| 288 | # "arguments": { "mnonce": "aaaaaaa" } } |
| 289 | # <- { "return" : { "data": "aaaaaaaabbbddddd"} } |
| 290 | ## |
| 291 | { 'command': 'query-sev-attestation-report', |
| 292 | 'data': { 'mnonce': 'str' }, |
| 293 | 'returns': 'SevAttestationReport' } |
| 294 | |
| 295 | ## |
| 296 | # @SgxEpcSection: |
| 297 | # |
| 298 | # Information about intel SGX EPC section |
| 299 | # |
| 300 | # @node: the numa node |
| 301 | # |
| 302 | # @size: the size of EPC section |
| 303 | # |
| 304 | # Since: 7.0 |
| 305 | ## |
| 306 | { 'struct': 'SgxEpcSection', |
| 307 | 'data': { 'node': 'int', |
| 308 | 'size': 'uint64'}} |
| 309 | |
| 310 | ## |
| 311 | # @SgxInfo: |
| 312 | # |
| 313 | # Information about intel Safe Guard eXtension (SGX) support |
| 314 | # |
| 315 | # @sgx: true if SGX is supported |
| 316 | # |
| 317 | # @sgx1: true if SGX1 is supported |
| 318 | # |
| 319 | # @sgx2: true if SGX2 is supported |
| 320 | # |
| 321 | # @flc: true if FLC is supported |
| 322 | # |
| 323 | # @sections: The EPC sections information (Since: 7.0) |
| 324 | # |
| 325 | # Since: 6.2 |
| 326 | ## |
| 327 | { 'struct': 'SgxInfo', |
| 328 | 'data': { 'sgx': 'bool', |
| 329 | 'sgx1': 'bool', |
| 330 | 'sgx2': 'bool', |
| 331 | 'flc': 'bool', |
| 332 | 'sections': ['SgxEpcSection']} } |
| 333 | |
| 334 | ## |
| 335 | # @query-sgx: |
| 336 | # |
| 337 | # Return information about configured SGX capabilities of guest |
| 338 | # |
| 339 | # Since: 6.2 |
| 340 | # |
| 341 | # .. qmp-example:: |
| 342 | # |
| 343 | # -> { "execute": "query-sgx" } |
| 344 | # <- { "return": { "sgx": true, "sgx1" : true, "sgx2" : true, |
| 345 | # "flc": true, |
| 346 | # "sections": [{"node": 0, "size": 67108864}, |
| 347 | # {"node": 1, "size": 29360128}]} } |
| 348 | ## |
| 349 | { 'command': 'query-sgx', 'returns': 'SgxInfo' } |
| 350 | |
| 351 | ## |
| 352 | # @query-sgx-capabilities: |
| 353 | # |
| 354 | # Return information about SGX capabilities of host |
| 355 | # |
| 356 | # Since: 6.2 |
| 357 | # |
| 358 | # .. qmp-example:: |
| 359 | # |
| 360 | # -> { "execute": "query-sgx-capabilities" } |
| 361 | # <- { "return": { "sgx": true, "sgx1" : true, "sgx2" : true, |
| 362 | # "flc": true, |
| 363 | # "section" : [{"node": 0, "size": 67108864}, |
| 364 | # {"node": 1, "size": 29360128}]} } |
| 365 | ## |
| 366 | { 'command': 'query-sgx-capabilities', 'returns': 'SgxInfo' } |
| 367 | |
| 368 | ## |
| 369 | # @EvtchnPortType: |
| 370 | # |
| 371 | # An enumeration of Xen event channel port types. |
| 372 | # |
| 373 | # @closed: The port is unused. |
| 374 | # |
| 375 | # @unbound: The port is allocated and ready to be bound. |
| 376 | # |
| 377 | # @interdomain: The port is connected as an interdomain interrupt. |
| 378 | # |
| 379 | # @pirq: The port is bound to a physical IRQ (PIRQ). |
| 380 | # |
| 381 | # @virq: The port is bound to a virtual IRQ (VIRQ). |
| 382 | # |
| 383 | # @ipi: The post is an inter-processor interrupt (IPI). |
| 384 | # |
| 385 | # Since: 8.0 |
| 386 | ## |
| 387 | { 'enum': 'EvtchnPortType', |
| 388 | 'data': ['closed', 'unbound', 'interdomain', 'pirq', 'virq', 'ipi'] } |
| 389 | |
| 390 | ## |
| 391 | # @EvtchnInfo: |
| 392 | # |
| 393 | # Information about a Xen event channel port |
| 394 | # |
| 395 | # @port: the port number |
| 396 | # |
| 397 | # @vcpu: target vCPU for this port |
| 398 | # |
| 399 | # @type: the port type |
| 400 | # |
| 401 | # @remote-domain: remote domain for interdomain ports |
| 402 | # |
| 403 | # @target: remote port ID, or virq/pirq number |
| 404 | # |
| 405 | # @pending: port is currently active pending delivery |
| 406 | # |
| 407 | # @masked: port is masked |
| 408 | # |
| 409 | # Since: 8.0 |
| 410 | ## |
| 411 | { 'struct': 'EvtchnInfo', |
| 412 | 'data': {'port': 'uint16', |
| 413 | 'vcpu': 'uint32', |
| 414 | 'type': 'EvtchnPortType', |
| 415 | 'remote-domain': 'str', |
| 416 | 'target': 'uint16', |
| 417 | 'pending': 'bool', |
| 418 | 'masked': 'bool'} } |
| 419 | |
| 420 | ## |
| 421 | # @xen-event-list: |
| 422 | # |
| 423 | # Query the Xen event channels opened by the guest. |
| 424 | # |
| 425 | # Returns: list of open event channel ports. |
| 426 | # |
| 427 | # Since: 8.0 |
| 428 | # |
| 429 | # .. qmp-example:: |
| 430 | # |
| 431 | # -> { "execute": "xen-event-list" } |
| 432 | # <- { "return": [ |
| 433 | # { |
| 434 | # "pending": false, |
| 435 | # "port": 1, |
| 436 | # "vcpu": 1, |
| 437 | # "remote-domain": "qemu", |
| 438 | # "masked": false, |
| 439 | # "type": "interdomain", |
| 440 | # "target": 1 |
| 441 | # }, |
| 442 | # { |
| 443 | # "pending": false, |
| 444 | # "port": 2, |
| 445 | # "vcpu": 0, |
| 446 | # "remote-domain": "", |
| 447 | # "masked": false, |
| 448 | # "type": "virq", |
| 449 | # "target": 0 |
| 450 | # } |
| 451 | # ] |
| 452 | # } |
| 453 | ## |
| 454 | { 'command': 'xen-event-list', |
| 455 | 'returns': ['EvtchnInfo'] } |
| 456 | |
| 457 | ## |
| 458 | # @xen-event-inject: |
| 459 | # |
| 460 | # Inject a Xen event channel port (interrupt) to the guest. |
| 461 | # |
| 462 | # @port: The port number |
| 463 | # |
| 464 | # Since: 8.0 |
| 465 | # |
| 466 | # .. qmp-example:: |
| 467 | # |
| 468 | # -> { "execute": "xen-event-inject", "arguments": { "port": 1 } } |
| 469 | # <- { "return": { } } |
| 470 | ## |
| 471 | { 'command': 'xen-event-inject', |
| 472 | 'data': { 'port': 'uint32' } } |