* [PATCH v3] qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities
@ 2022-02-28 9:30 Dov Murik
2022-02-28 9:31 ` Daniel P. Berrangé
2022-03-29 15:02 ` Paolo Bonzini
0 siblings, 2 replies; 7+ messages in thread
From: Dov Murik @ 2022-02-28 9:30 UTC (permalink / raw)
To: qemu-devel
Cc: Tom Lendacky, Ashish Kalra, Daniel P. Berrangé,
James Bottomley, Marcelo Tosatti, Markus Armbruster,
Dr. David Alan Gilbert, Dov Murik, Tobin Feldman-Fitzthum,
Brijesh Singh, Paolo Bonzini, Eric Blake
Add a new field 'cpu0-id' to the response of query-sev-capabilities QMP
command. The value of the field is the base64-encoded unique ID of CPU0
(socket 0), which can be used to retrieve the signed CEK of the CPU from
AMD's Key Distribution Service (KDS).
Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
---
v3:
- dynamically get the ID length from the firmware and allocate a buffer
accordingly (thanks Daniel)
v2:
- change encoding to Base64 (thanks Daniel)
- rename constant to SEV_CPU_UNIQUE_ID_LEN
---
qapi/misc-target.json | 4 ++++
target/i386/sev.c | 42 +++++++++++++++++++++++++++++++++++++++++-
2 files changed, 45 insertions(+), 1 deletion(-)
diff --git a/qapi/misc-target.json b/qapi/misc-target.json
index 4bc45d2474..a896ab907b 100644
--- a/qapi/misc-target.json
+++ b/qapi/misc-target.json
@@ -177,6 +177,8 @@
#
# @cert-chain: PDH certificate chain (base64 encoded)
#
+# @cpu0-id: Unique ID of CPU0 (base64 encoded) (since 7.0)
+#
# @cbitpos: C-bit location in page table entry
#
# @reduced-phys-bits: Number of physical Address bit reduction when SEV is
@@ -187,6 +189,7 @@
{ 'struct': 'SevCapability',
'data': { 'pdh': 'str',
'cert-chain': 'str',
+ 'cpu0-id': 'str',
'cbitpos': 'int',
'reduced-phys-bits': 'int'},
'if': 'TARGET_I386' }
@@ -205,6 +208,7 @@
#
# -> { "execute": "query-sev-capabilities" }
# <- { "return": { "pdh": "8CCDD8DDD", "cert-chain": "888CCCDDDEE",
+# "cpu0-id": "2lvmGwo+...61iEinw==",
# "cbitpos": 47, "reduced-phys-bits": 5}}
#
##
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 025ff7a6f8..32f7dbac4e 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -531,12 +531,46 @@ e_free:
return 1;
}
+static int sev_get_cpu0_id(int fd, guchar **id, size_t *id_len, Error **errp)
+{
+ guchar *id_data;
+ struct sev_user_data_get_id2 get_id2 = {};
+ int err, r;
+
+ /* query the ID length */
+ r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err);
+ if (r < 0 && err != SEV_RET_INVALID_LEN) {
+ error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)",
+ r, err, fw_error_to_str(err));
+ return 1;
+ }
+
+ id_data = g_new(guchar, get_id2.length);
+ get_id2.address = (unsigned long)id_data;
+
+ r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err);
+ if (r < 0) {
+ error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)",
+ r, err, fw_error_to_str(err));
+ goto err;
+ }
+
+ *id = id_data;
+ *id_len = get_id2.length;
+ return 0;
+
+err:
+ g_free(id_data);
+ return 1;
+}
+
static SevCapability *sev_get_capabilities(Error **errp)
{
SevCapability *cap = NULL;
guchar *pdh_data = NULL;
guchar *cert_chain_data = NULL;
- size_t pdh_len = 0, cert_chain_len = 0;
+ guchar *cpu0_id_data = NULL;
+ size_t pdh_len = 0, cert_chain_len = 0, cpu0_id_len = 0;
uint32_t ebx;
int fd;
@@ -561,9 +595,14 @@ static SevCapability *sev_get_capabilities(Error **errp)
goto out;
}
+ if (sev_get_cpu0_id(fd, &cpu0_id_data, &cpu0_id_len, errp)) {
+ goto out;
+ }
+
cap = g_new0(SevCapability, 1);
cap->pdh = g_base64_encode(pdh_data, pdh_len);
cap->cert_chain = g_base64_encode(cert_chain_data, cert_chain_len);
+ cap->cpu0_id = g_base64_encode(cpu0_id_data, cpu0_id_len);
host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL);
cap->cbitpos = ebx & 0x3f;
@@ -575,6 +614,7 @@ static SevCapability *sev_get_capabilities(Error **errp)
cap->reduced_phys_bits = 1;
out:
+ g_free(cpu0_id_data);
g_free(pdh_data);
g_free(cert_chain_data);
close(fd);
--
2.25.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH v3] qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities
2022-02-28 9:30 [PATCH v3] qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities Dov Murik
@ 2022-02-28 9:31 ` Daniel P. Berrangé
2022-02-28 9:39 ` Dov Murik
2022-03-29 15:02 ` Paolo Bonzini
1 sibling, 1 reply; 7+ messages in thread
From: Daniel P. Berrangé @ 2022-02-28 9:31 UTC (permalink / raw)
To: Dov Murik
Cc: Tom Lendacky, Ashish Kalra, Brijesh Singh, Markus Armbruster,
James Bottomley, Marcelo Tosatti, qemu-devel,
Dr. David Alan Gilbert, Tobin Feldman-Fitzthum, Paolo Bonzini,
Eric Blake
On Mon, Feb 28, 2022 at 09:30:14AM +0000, Dov Murik wrote:
> Add a new field 'cpu0-id' to the response of query-sev-capabilities QMP
> command. The value of the field is the base64-encoded unique ID of CPU0
> (socket 0), which can be used to retrieve the signed CEK of the CPU from
> AMD's Key Distribution Service (KDS).
>
> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v3] qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities
2022-02-28 9:31 ` Daniel P. Berrangé
@ 2022-02-28 9:39 ` Dov Murik
2022-04-06 17:19 ` Cole Robinson
0 siblings, 1 reply; 7+ messages in thread
From: Dov Murik @ 2022-02-28 9:39 UTC (permalink / raw)
To: Daniel P. Berrangé
Cc: Tom Lendacky, Ashish Kalra, Brijesh Singh, Markus Armbruster,
James Bottomley, Marcelo Tosatti, qemu-devel,
Dr. David Alan Gilbert, Dov Murik, Tobin Feldman-Fitzthum,
Paolo Bonzini, Eric Blake
On 28/02/2022 11:31, Daniel P. Berrangé wrote:
> On Mon, Feb 28, 2022 at 09:30:14AM +0000, Dov Murik wrote:
>> Add a new field 'cpu0-id' to the response of query-sev-capabilities QMP
>> command. The value of the field is the base64-encoded unique ID of CPU0
>> (socket 0), which can be used to retrieve the signed CEK of the CPU from
>> AMD's Key Distribution Service (KDS).
>>
>> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
>
> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
>
Thanks Daniel for reviewing.
Next: libvirt patch to add this field to response of virNodeGetSEVInfo().
-Dov
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v3] qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities
2022-02-28 9:39 ` Dov Murik
@ 2022-04-06 17:19 ` Cole Robinson
2022-04-07 5:55 ` Markus Armbruster
0 siblings, 1 reply; 7+ messages in thread
From: Cole Robinson @ 2022-04-06 17:19 UTC (permalink / raw)
To: Dov Murik, Daniel P. Berrangé
Cc: Tom Lendacky, Ashish Kalra, Brijesh Singh, James Bottomley,
Marcelo Tosatti, Markus Armbruster, qemu-devel,
Tobin Feldman-Fitzthum, Paolo Bonzini, Eric Blake,
Dr. David Alan Gilbert
On 2/28/22 4:39 AM, Dov Murik wrote:
>
>
> On 28/02/2022 11:31, Daniel P. Berrangé wrote:
>> On Mon, Feb 28, 2022 at 09:30:14AM +0000, Dov Murik wrote:
>>> Add a new field 'cpu0-id' to the response of query-sev-capabilities QMP
>>> command. The value of the field is the base64-encoded unique ID of CPU0
>>> (socket 0), which can be used to retrieve the signed CEK of the CPU from
>>> AMD's Key Distribution Service (KDS).
>>>
>>> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
>>
>> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
>>
>
> Thanks Daniel for reviewing.
>
Hmm I don't see this in qemu.git. Who should pick this up?
- Cole
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v3] qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities
2022-04-06 17:19 ` Cole Robinson
@ 2022-04-07 5:55 ` Markus Armbruster
2022-04-10 9:45 ` Dov Murik
0 siblings, 1 reply; 7+ messages in thread
From: Markus Armbruster @ 2022-04-07 5:55 UTC (permalink / raw)
To: Cole Robinson
Cc: Tom Lendacky, Ashish Kalra, Daniel P. Berrangé,
James Bottomley, Marcelo Tosatti, qemu-devel,
Dr. David Alan Gilbert, Dov Murik, Tobin Feldman-Fitzthum,
Paolo Bonzini, Brijesh Singh, Eric Blake
Cole Robinson <crobinso@redhat.com> writes:
> On 2/28/22 4:39 AM, Dov Murik wrote:
>>
>>
>> On 28/02/2022 11:31, Daniel P. Berrangé wrote:
>>> On Mon, Feb 28, 2022 at 09:30:14AM +0000, Dov Murik wrote:
>>>> Add a new field 'cpu0-id' to the response of query-sev-capabilities QMP
>>>> command. The value of the field is the base64-encoded unique ID of CPU0
>>>> (socket 0), which can be used to retrieve the signed CEK of the CPU from
>>>> AMD's Key Distribution Service (KDS).
>>>>
>>>> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
>>>
>>> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
>>>
>>
>> Thanks Daniel for reviewing.
>>
>
> Hmm I don't see this in qemu.git. Who should pick this up?
I'd say
$ scripts/get_maintainer.pl -f target/i386/sev.c
Paolo Bonzini <pbonzini@redhat.com> (supporter:X86 KVM CPUs)
Marcelo Tosatti <mtosatti@redhat.com> (supporter:X86 KVM CPUs)
kvm@vger.kernel.org (open list:X86 KVM CPUs)
qemu-devel@nongnu.org (open list:All patches CC here)
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v3] qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities
2022-04-07 5:55 ` Markus Armbruster
@ 2022-04-10 9:45 ` Dov Murik
0 siblings, 0 replies; 7+ messages in thread
From: Dov Murik @ 2022-04-10 9:45 UTC (permalink / raw)
To: Markus Armbruster, Cole Robinson, Paolo Bonzini
Cc: Tom Lendacky, Ashish Kalra, Daniel P. Berrangé,
James Bottomley, Marcelo Tosatti, qemu-devel,
Dr. David Alan Gilbert, Tobin Feldman-Fitzthum, Brijesh Singh,
Eric Blake
On 07/04/2022 8:55, Markus Armbruster wrote:
> Cole Robinson <crobinso@redhat.com> writes:
>
>> On 2/28/22 4:39 AM, Dov Murik wrote:
>>>
>>>
>>> On 28/02/2022 11:31, Daniel P. Berrangé wrote:
>>>> On Mon, Feb 28, 2022 at 09:30:14AM +0000, Dov Murik wrote:
>>>>> Add a new field 'cpu0-id' to the response of query-sev-capabilities QMP
>>>>> command. The value of the field is the base64-encoded unique ID of CPU0
>>>>> (socket 0), which can be used to retrieve the signed CEK of the CPU from
>>>>> AMD's Key Distribution Service (KDS).
>>>>>
>>>>> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
>>>>
>>>> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
>>>>
>>>
>>> Thanks Daniel for reviewing.
>>>
>>
>> Hmm I don't see this in qemu.git. Who should pick this up?
>
> I'd say
>
> $ scripts/get_maintainer.pl -f target/i386/sev.c
> Paolo Bonzini <pbonzini@redhat.com> (supporter:X86 KVM CPUs)
> Marcelo Tosatti <mtosatti@redhat.com> (supporter:X86 KVM CPUs)
> kvm@vger.kernel.org (open list:X86 KVM CPUs)
> qemu-devel@nongnu.org (open list:All patches CC here)
>
I see this in Paolo's tree in branch for-upstream:
https://gitlab.com/bonzini/qemu/-/commit/811b4ec7f8eb3fb1fe9851848ab8e3cd926b9627
-Dov
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v3] qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities
2022-02-28 9:30 [PATCH v3] qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities Dov Murik
2022-02-28 9:31 ` Daniel P. Berrangé
@ 2022-03-29 15:02 ` Paolo Bonzini
1 sibling, 0 replies; 7+ messages in thread
From: Paolo Bonzini @ 2022-03-29 15:02 UTC (permalink / raw)
To: Dov Murik
Cc: Tom Lendacky, Ashish Kalra, Daniel P . Berrangé,
James Bottomley, Marcelo Tosatti, qemu-devel, Markus Armbruster,
Tobin Feldman-Fitzthum, Brijesh Singh, Eric Blake,
Dr . David Alan Gilbert
Queued, thanks.
Paolo
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2022-04-10 9:47 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-02-28 9:30 [PATCH v3] qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities Dov Murik
2022-02-28 9:31 ` Daniel P. Berrangé
2022-02-28 9:39 ` Dov Murik
2022-04-06 17:19 ` Cole Robinson
2022-04-07 5:55 ` Markus Armbruster
2022-04-10 9:45 ` Dov Murik
2022-03-29 15:02 ` Paolo Bonzini
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.