mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities

Browse Source 
Add a new field 'cpu0-id' to the response of query-sev-capabilities QMP
command.  The value of the field is the base64-encoded unique ID of CPU0
(socket 0), which can be used to retrieve the signed CEK of the CPU from
AMD's Key Distribution Service (KDS).

Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20220228093014.882288-1-dovmurik@linux.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Dov Murik 2022-02-28 09:30:14 +00:00 committed by Paolo Bonzini
parent f53faa70bb
commit 811b4ec7f8
2 changed files with 45 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
qapi/misc-target.json
View File

@ -144,6 +144,8 @@
# #
# @cert-chain: PDH certificate chain (base64 encoded) # @cert-chain: PDH certificate chain (base64 encoded)
# #
# @cpu0-id: Unique ID of CPU0 (base64 encoded) (since 7.0)
#
# @cbitpos: C-bit location in page table entry # @cbitpos: C-bit location in page table entry
# #
# @reduced-phys-bits: Number of physical Address bit reduction when SEV is # @reduced-phys-bits: Number of physical Address bit reduction when SEV is
@ -154,6 +156,7 @@
{ 'struct': 'SevCapability', { 'struct': 'SevCapability',
'data': { 'pdh': 'str', 'data': { 'pdh': 'str',
'cert-chain': 'str', 'cert-chain': 'str',
'cpu0-id': 'str',
'cbitpos': 'int', 'cbitpos': 'int',
'reduced-phys-bits': 'int'}, 'reduced-phys-bits': 'int'},
'if': 'TARGET_I386' } 'if': 'TARGET_I386' }
@ -172,6 +175,7 @@
# #
# -> { "execute": "query-sev-capabilities" } # -> { "execute": "query-sev-capabilities" }
# <- { "return": { "pdh": "8CCDD8DDD", "cert-chain": "888CCCDDDEE", # <- { "return": { "pdh": "8CCDD8DDD", "cert-chain": "888CCCDDDEE",
# "cpu0-id": "2lvmGwo+...61iEinw==",
# "cbitpos": 47, "reduced-phys-bits": 5}} # "cbitpos": 47, "reduced-phys-bits": 5}}
# #
## ##

42
target/i386/sev.c
View File

@ -531,12 +531,46 @@ e_free:
return 1; return 1;
} }
static int sev_get_cpu0_id(int fd, guchar **id, size_t *id_len, Error **errp)
{
guchar *id_data;
struct sev_user_data_get_id2 get_id2 = {};
int err, r;
/* query the ID length */
r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err);
if (r < 0 && err != SEV_RET_INVALID_LEN) {
error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)",
r, err, fw_error_to_str(err));
return 1;
}
id_data = g_new(guchar, get_id2.length);
get_id2.address = (unsigned long)id_data;
r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err);
if (r < 0) {
error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)",
r, err, fw_error_to_str(err));
goto err;
}
*id = id_data;
*id_len = get_id2.length;
return 0;
err:
g_free(id_data);
return 1;
}
static SevCapability *sev_get_capabilities(Error **errp) static SevCapability *sev_get_capabilities(Error **errp)
{ {
SevCapability *cap = NULL; SevCapability *cap = NULL;
guchar *pdh_data = NULL; guchar *pdh_data = NULL;
guchar *cert_chain_data = NULL; guchar *cert_chain_data = NULL;
size_t pdh_len = 0, cert_chain_len = 0; guchar *cpu0_id_data = NULL;
size_t pdh_len = 0, cert_chain_len = 0, cpu0_id_len = 0;
uint32_t ebx; uint32_t ebx;
int fd; int fd;
@ -561,9 +595,14 @@ static SevCapability *sev_get_capabilities(Error **errp)
goto out; goto out;
} }
if (sev_get_cpu0_id(fd, &cpu0_id_data, &cpu0_id_len, errp)) {
goto out;
}
cap = g_new0(SevCapability, 1); cap = g_new0(SevCapability, 1);
cap->pdh = g_base64_encode(pdh_data, pdh_len); cap->pdh = g_base64_encode(pdh_data, pdh_len);
cap->cert_chain = g_base64_encode(cert_chain_data, cert_chain_len); cap->cert_chain = g_base64_encode(cert_chain_data, cert_chain_len);
cap->cpu0_id = g_base64_encode(cpu0_id_data, cpu0_id_len);
host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL); host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL);
cap->cbitpos = ebx & 0x3f; cap->cbitpos = ebx & 0x3f;
@ -575,6 +614,7 @@ static SevCapability *sev_get_capabilities(Error **errp)
cap->reduced_phys_bits = 1; cap->reduced_phys_bits = 1;
out: out:
g_free(cpu0_id_data);
g_free(pdh_data); g_free(pdh_data);
g_free(cert_chain_data); g_free(cert_chain_data);
close(fd); close(fd);