6 # @rtc-reset-reinjection:
8 # This command will reset the RTC interrupt reinjection backlog.
9 # Can be used if another mechanism to synchronize guest time
10 # is in effect, for example QEMU guest agent's guest-set-time
17 # -> { "execute": "rtc-reset-reinjection" }
21 { 'command': 'rtc-reset-reinjection',
27 # An enumeration of SEV state information used during @query-sev.
29 # @uninit: The guest is uninitialized.
31 # @launch-update: The guest is currently being launched; plaintext data and
32 # register state is being imported.
34 # @launch-secret: The guest is currently being launched; ciphertext data
37 # @running: The guest is fully launched or migrated in.
39 # @send-update: The guest is currently being migrated out to another machine.
41 # @receive-update: The guest is currently being migrated from another machine.
46 'data': ['uninit', 'launch-update', 'launch-secret', 'running',
47 'send-update', 'receive-update' ],
53 # Information about Secure Encrypted Virtualization (SEV) support
55 # @enabled: true if SEV is active
57 # @api-major: SEV API major version
59 # @api-minor: SEV API minor version
61 # @build-id: SEV FW build id
63 # @policy: SEV policy value
65 # @state: SEV guest state
67 # @handle: SEV firmware handle
71 { 'struct': 'SevInfo',
72 'data': { 'enabled': 'bool',
74 'api-minor' : 'uint8',
86 # Returns information about SEV
94 # -> { "execute": "query-sev" }
95 # <- { "return": { "enabled": true, "api-major" : 0, "api-minor" : 0,
96 # "build-id" : 0, "policy" : 0, "state" : "running",
100 { 'command': 'query-sev', 'returns': 'SevInfo',
101 'if': 'TARGET_I386' }
104 # @SevLaunchMeasureInfo:
106 # SEV Guest Launch measurement information
108 # @data: the measurement value encoded in base64
112 { 'struct': 'SevLaunchMeasureInfo', 'data': {'data': 'str'},
113 'if': 'TARGET_I386' }
116 # @query-sev-launch-measure:
118 # Query the SEV guest launch information.
120 # Returns: The @SevLaunchMeasureInfo for the guest
126 # -> { "execute": "query-sev-launch-measure" }
127 # <- { "return": { "data": "4l8LXeNlSPUDlXPJG5966/8%YZ" } }
130 { 'command': 'query-sev-launch-measure', 'returns': 'SevLaunchMeasureInfo',
131 'if': 'TARGET_I386' }
136 # The struct describes capability for a Secure Encrypted Virtualization
139 # @pdh: Platform Diffie-Hellman key (base64 encoded)
141 # @cert-chain: PDH certificate chain (base64 encoded)
143 # @cpu0-id: Unique ID of CPU0 (base64 encoded) (since 7.1)
145 # @cbitpos: C-bit location in page table entry
147 # @reduced-phys-bits: Number of physical Address bit reduction when SEV is
152 { 'struct': 'SevCapability',
153 'data': { 'pdh': 'str',
157 'reduced-phys-bits': 'int'},
158 'if': 'TARGET_I386' }
161 # @query-sev-capabilities:
163 # This command is used to get the SEV capabilities, and is supported on AMD
164 # X86 platforms only.
166 # Returns: SevCapability objects.
172 # -> { "execute": "query-sev-capabilities" }
173 # <- { "return": { "pdh": "8CCDD8DDD", "cert-chain": "888CCCDDDEE",
174 # "cpu0-id": "2lvmGwo+...61iEinw==",
175 # "cbitpos": 47, "reduced-phys-bits": 5}}
178 { 'command': 'query-sev-capabilities', 'returns': 'SevCapability',
179 'if': 'TARGET_I386' }
182 # @sev-inject-launch-secret:
184 # This command injects a secret blob into memory of SEV guest.
186 # @packet-header: the launch secret packet header encoded in base64
188 # @secret: the launch secret data to be injected encoded in base64
190 # @gpa: the guest physical address where secret will be injected.
194 { 'command': 'sev-inject-launch-secret',
195 'data': { 'packet-header': 'str', 'secret': 'str', '*gpa': 'uint64' },
196 'if': 'TARGET_I386' }
199 # @SevAttestationReport:
201 # The struct describes attestation report for a Secure Encrypted
202 # Virtualization feature.
204 # @data: guest attestation report (base64 encoded)
208 { 'struct': 'SevAttestationReport',
209 'data': { 'data': 'str'},
210 'if': 'TARGET_I386' }
213 # @query-sev-attestation-report:
215 # This command is used to get the SEV attestation report, and is
216 # supported on AMD X86 platforms only.
218 # @mnonce: a random 16 bytes value encoded in base64 (it will be
219 # included in report)
221 # Returns: SevAttestationReport objects.
227 # -> { "execute" : "query-sev-attestation-report",
228 # "arguments": { "mnonce": "aaaaaaa" } }
229 # <- { "return" : { "data": "aaaaaaaabbbddddd"} }
232 { 'command': 'query-sev-attestation-report',
233 'data': { 'mnonce': 'str' },
234 'returns': 'SevAttestationReport',
235 'if': 'TARGET_I386' }
240 # Dump guest's storage keys
242 # @filename: the path to the file to dump to
244 # This command is only supported on s390 architecture.
250 # -> { "execute": "dump-skeys",
251 # "arguments": { "filename": "/tmp/skeys" } }
252 # <- { "return": {} }
255 { 'command': 'dump-skeys',
256 'data': { 'filename': 'str' },
257 'if': 'TARGET_S390X' }
262 # The struct describes capability for a specific GIC (Generic
263 # Interrupt Controller) version. These bits are not only decided by
264 # QEMU/KVM software version, but also decided by the hardware that
265 # the program is running upon.
267 # @version: version of GIC to be described. Currently, only 2 and 3
270 # @emulated: whether current QEMU/hardware supports emulated GIC
271 # device in user space.
273 # @kernel: whether current QEMU/hardware supports hardware
274 # accelerated GIC device in kernel.
278 { 'struct': 'GICCapability',
279 'data': { 'version': 'int',
285 # @query-gic-capabilities:
287 # This command is ARM-only. It will return a list of GICCapability
288 # objects that describe its capability bits.
290 # Returns: a list of GICCapability objects.
296 # -> { "execute": "query-gic-capabilities" }
297 # <- { "return": [{ "version": 2, "emulated": true, "kernel": false },
298 # { "version": 3, "emulated": false, "kernel": true } ] }
301 { 'command': 'query-gic-capabilities', 'returns': ['GICCapability'],
307 # Information about intel SGX EPC section info
309 # @node: the numa node
311 # @size: the size of EPC section
315 { 'struct': 'SGXEPCSection',
316 'data': { 'node': 'int',
322 # Information about intel Safe Guard eXtension (SGX) support
324 # @sgx: true if SGX is supported
326 # @sgx1: true if SGX1 is supported
328 # @sgx2: true if SGX2 is supported
330 # @flc: true if FLC is supported
332 # @section-size: The EPC section size for guest
333 # Redundant with @sections. Just for backward compatibility.
335 # @sections: The EPC sections info for guest (Since: 7.0)
338 # @deprecated: Member @section-size is deprecated. Use @sections instead.
342 { 'struct': 'SGXInfo',
343 'data': { 'sgx': 'bool',
347 'section-size': { 'type': 'uint64',
348 'features': [ 'deprecated' ] },
349 'sections': ['SGXEPCSection']},
350 'if': 'TARGET_I386' }
355 # Returns information about SGX
363 # -> { "execute": "query-sgx" }
364 # <- { "return": { "sgx": true, "sgx1" : true, "sgx2" : true,
365 # "flc": true, "section-size" : 96468992,
366 # "sections": [{"node": 0, "size": 67108864},
367 # {"node": 1, "size": 29360128}]} }
370 { 'command': 'query-sgx', 'returns': 'SGXInfo', 'if': 'TARGET_I386' }
373 # @query-sgx-capabilities:
375 # Returns information from host SGX capabilities
383 # -> { "execute": "query-sgx-capabilities" }
384 # <- { "return": { "sgx": true, "sgx1" : true, "sgx2" : true,
385 # "flc": true, "section-size" : 96468992,
386 # "section" : [{"node": 0, "size": 67108864},
387 # {"node": 1, "size": 29360128}]} }
390 { 'command': 'query-sgx-capabilities', 'returns': 'SGXInfo', 'if': 'TARGET_I386' }