1. Patchew
  2. QEMU
  3. [PULL for-7.1 00/53] Misc pull request for QEMU 7.1
  4. View patch

[PULL 01/53] qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities

Paolo Bonzini posted 53 patches 3 years, 8 months ago
Maintainers: Cameron Esfahani <dirty@apple.com>, Roman Bolshakov <r.bolshakov@yadro.com>, Paolo Bonzini <pbonzini@redhat.com>, Richard Henderson <richard.henderson@linaro.org>, Gerd Hoffmann <kraxel@redhat.com>, "Marc-André Lureau" <marcandre.lureau@redhat.com>, David Hildenbrand <david@redhat.com>, Igor Mammedov <imammedo@redhat.com>, Stefan Berger <stefanb@linux.vnet.ibm.com>, Kevin Wolf <kwolf@redhat.com>, Hanna Reitz <hreitz@redhat.com>, Stefan Hajnoczi <stefanha@redhat.com>, Fam Zheng <fam@euphon.net>, Aarushi Mehta <mehta.aaru20@gmail.com>, Julia Suvorova <jusual@redhat.com>, Stefano Garzarella <sgarzare@redhat.com>, Ronnie Sahlberg <ronniesahlberg@gmail.com>, Peter Lieven <pl@kamp.de>, "Philippe Mathieu-Daudé" <f4bug@amsat.org>, "Denis V. Lunev" <den@openvz.org>, Vladimir Sementsov-Ogievskiy <v.sementsov-og@mail.ru>, Markus Armbruster <armbru@redhat.com>, Warner Losh <imp@bsdimp.com>, Kyle Evans <kevans@freebsd.org>, Laurent Vivier <laurent@vivier.eu>, "Michael S. Tsirkin" <mst@redhat.com>, Eduardo Habkost <eduardo@habkost.net>, Marcel Apfelbaum <marcel.apfelbaum@gmail.com>, Yanan Wang <wangyanan55@huawei.com>, "Daniel P. Berrangé" <berrange@redhat.com>, Greg Kurz <groug@kaod.org>, Christian Schoenebeck <qemu_oss@crudebyte.com>, "Alex Bennée" <alex.bennee@linaro.org>, Peter Maydell <peter.maydell@linaro.org>, Michael Rolnik <mrolnik@gmail.com>, Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>, Alistair Francis <alistair@alistair23.me>, "Edgar E. Iglesias" <edgar.iglesias@gmail.com>, Helge Deller <deller@gmx.de>, Cornelia Huck <cohuck@redhat.com>, Thomas Huth <thuth@redhat.com>, Halil Pasic <pasic@linux.ibm.com>, Christian Borntraeger <borntraeger@linux.ibm.com>, "Cédric Le Goater" <clg@kaod.org>, Daniel Henrique Barboza <danielhb413@gmail.com>, David Gibson <david@gibson.dropbear.id.au>, Huacai Chen <chenhuacai@kernel.org>, Jiaxun Yang <jiaxun.yang@flygoat.com>, Aurelien Jarno <aurelien@aurel32.net>, "Hervé Poussineau" <hpoussin@reactos.org>, Aleksandar Rikalo <aleksandar.rikalo@syrmia.com>, Pavel Pisa <pisa@cmp.felk.cvut.cz>, Vikram Garhwal <fnu.vikram@xilinx.com>, Jason Wang <jasowang@redhat.com>, Subbaraya Sundeep <sundeep.lkml@gmail.com>, Havard Skinnemoen <hskinnemoen@google.com>, Tyrone Ting <kfting@nuvoton.com>, Dmitry Fleytman <dmitry.fleytman@gmail.com>, Chris Wulff <crwulff@gmail.com>, Marek Vasut <marex@denx.de>, BALATON Zoltan <balaton@eik.bme.hu>, Elena Ufimtseva <elena.ufimtseva@oracle.com>, Jagannathan Raman <jag.raman@oracle.com>, John G Johnson <john.g.johnson@oracle.com>, Alexey Kardashevskiy <aik@ozlabs.ru>, Yuval Shaia <yuval.shaia.ml@gmail.com>, Palmer Dabbelt <palmer@dabbelt.com>, Bin Meng <bin.meng@windriver.com>, Yoshinori Sato <ysato@users.sourceforge.jp>, Eric Farman <farman@linux.ibm.com>, Fabien Chouteau <chouteau@adacore.com>, Frederic Konrad <konrad.frederic@yahoo.fr>, Artyom Tarasenko <atar4qemu@gmail.com>, Alex Williamson <alex.williamson@redhat.com>, Eric Auger <eric.auger@redhat.com>, Max Filippov <jcmvbkbc@gmail.com>, Peter Xu <peterx@redhat.com>, Stefan Weil <sw@weilnetz.de>, Taylor Simpson <tsimpson@quicinc.com>, Juan Quintela <quintela@redhat.com>, "Dr. David Alan Gilbert" <dgilbert@redhat.com>, Zhang Chen <chen.zhang@intel.com>, Li Zhijian <lizhijian@fujitsu.com>, Eric Blake <eblake@redhat.com>, Michael Roth <michael.roth@amd.com>, Konstantin Kostiuk <kkostiuk@redhat.com>, Alexander Graf <agraf@csgraf.de>, Wenchao Wang <wenchao.wang@intel.com>, Colin Xu <colin.xu@intel.com>, Marcelo Tosatti <mtosatti@redhat.com>, Kamil Rytarowski <kamil@netbsd.org>, Reinoud Zandijk <reinoud@netbsd.org>, Sunil Muthuswamy <sunilmut@microsoft.com>, Stafford Horne <shorne@gmail.com>, Bastian Koppelmann <kbastian@mail.uni-paderborn.de>, Ani Sinha <ani@anisinha.ca>, John Snow <jsnow@redhat.com>, Andrew Jeffery <andrew@aj.id.au>, Joel Stanley <joel@jms.id.au>, Alexander Bulekov <alxndr@bu.edu>, Bandan Das <bsd@redhat.com>, Darren Kenny <darren.kenny@oracle.com>, Qiuhao Li <Qiuhao.Li@outlook.com>, Corey Minyard <minyard@acm.org>, Coiby Xu <Coiby.Xu@gmail.com>
[PULL 01/53] qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities
Posted by Paolo Bonzini 3 years, 8 months ago 
From: Dov Murik <dovmurik@linux.ibm.com>

Add a new field 'cpu0-id' to the response of query-sev-capabilities QMP
command.  The value of the field is the base64-encoded unique ID of CPU0
(socket 0), which can be used to retrieve the signed CEK of the CPU from
AMD's Key Distribution Service (KDS).

Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20220228093014.882288-1-dovmurik@linux.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 qapi/misc-target.json |  4 ++++
 target/i386/sev.c     | 42 +++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/qapi/misc-target.json b/qapi/misc-target.json
index 036c5e4a91..bc9355b595 100644
--- a/qapi/misc-target.json
+++ b/qapi/misc-target.json
@@ -144,6 +144,8 @@
 #
 # @cert-chain:  PDH certificate chain (base64 encoded)
 #
+# @cpu0-id: Unique ID of CPU0 (base64 encoded) (since 7.0)
+#
 # @cbitpos: C-bit location in page table entry
 #
 # @reduced-phys-bits: Number of physical Address bit reduction when SEV is
@@ -154,6 +156,7 @@
 { 'struct': 'SevCapability',
   'data': { 'pdh': 'str',
             'cert-chain': 'str',
+            'cpu0-id': 'str',
             'cbitpos': 'int',
             'reduced-phys-bits': 'int'},
   'if': 'TARGET_I386' }
@@ -172,6 +175,7 @@
 #
 # -> { "execute": "query-sev-capabilities" }
 # <- { "return": { "pdh": "8CCDD8DDD", "cert-chain": "888CCCDDDEE",
+#                  "cpu0-id": "2lvmGwo+...61iEinw==",
 #                  "cbitpos": 47, "reduced-phys-bits": 5}}
 #
 ##
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 025ff7a6f8..32f7dbac4e 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -531,12 +531,46 @@ e_free:
     return 1;
 }
 
+static int sev_get_cpu0_id(int fd, guchar **id, size_t *id_len, Error **errp)
+{
+    guchar *id_data;
+    struct sev_user_data_get_id2 get_id2 = {};
+    int err, r;
+
+    /* query the ID length */
+    r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err);
+    if (r < 0 && err != SEV_RET_INVALID_LEN) {
+        error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)",
+                   r, err, fw_error_to_str(err));
+        return 1;
+    }
+
+    id_data = g_new(guchar, get_id2.length);
+    get_id2.address = (unsigned long)id_data;
+
+    r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err);
+    if (r < 0) {
+        error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)",
+                   r, err, fw_error_to_str(err));
+        goto err;
+    }
+
+    *id = id_data;
+    *id_len = get_id2.length;
+    return 0;
+
+err:
+    g_free(id_data);
+    return 1;
+}
+
 static SevCapability *sev_get_capabilities(Error **errp)
 {
     SevCapability *cap = NULL;
     guchar *pdh_data = NULL;
     guchar *cert_chain_data = NULL;
-    size_t pdh_len = 0, cert_chain_len = 0;
+    guchar *cpu0_id_data = NULL;
+    size_t pdh_len = 0, cert_chain_len = 0, cpu0_id_len = 0;
     uint32_t ebx;
     int fd;
 
@@ -561,9 +595,14 @@ static SevCapability *sev_get_capabilities(Error **errp)
         goto out;
     }
 
+    if (sev_get_cpu0_id(fd, &cpu0_id_data, &cpu0_id_len, errp)) {
+        goto out;
+    }
+
     cap = g_new0(SevCapability, 1);
     cap->pdh = g_base64_encode(pdh_data, pdh_len);
     cap->cert_chain = g_base64_encode(cert_chain_data, cert_chain_len);
+    cap->cpu0_id = g_base64_encode(cpu0_id_data, cpu0_id_len);
 
     host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL);
     cap->cbitpos = ebx & 0x3f;
@@ -575,6 +614,7 @@ static SevCapability *sev_get_capabilities(Error **errp)
     cap->reduced_phys_bits = 1;
 
 out:
+    g_free(cpu0_id_data);
     g_free(pdh_data);
     g_free(cert_chain_data);
     close(fd);
-- 
2.35.1
Re: [PULL 01/53] qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities
Posted by Dov Murik 3 years, 8 months ago 
Thanks Paolo.

On 19/04/2022 8:50, Paolo Bonzini wrote:
> From: Dov Murik <dovmurik@linux.ibm.com>
> 
> Add a new field 'cpu0-id' to the response of query-sev-capabilities QMP
> command.  The value of the field is the base64-encoded unique ID of CPU0
> (socket 0), which can be used to retrieve the signed CEK of the CPU from
> AMD's Key Distribution Service (KDS).
> 
> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
> 
> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
> Message-Id: <20220228093014.882288-1-dovmurik@linux.ibm.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  qapi/misc-target.json |  4 ++++
>  target/i386/sev.c     | 42 +++++++++++++++++++++++++++++++++++++++++-
>  2 files changed, 45 insertions(+), 1 deletion(-)
> 
> diff --git a/qapi/misc-target.json b/qapi/misc-target.json
> index 036c5e4a91..bc9355b595 100644
> --- a/qapi/misc-target.json
> +++ b/qapi/misc-target.json
> @@ -144,6 +144,8 @@
>  #
>  # @cert-chain:  PDH certificate chain (base64 encoded)
>  #
> +# @cpu0-id: Unique ID of CPU0 (base64 encoded) (since 7.0)
> +#

Should this be changed to "since 7.1" ?

Paolo, can you modify the patch in your tree, or should I submit a new
version?

-Dov

>  # @cbitpos: C-bit location in page table entry
>  #
>  # @reduced-phys-bits: Number of physical Address bit reduction when SEV is
> @@ -154,6 +156,7 @@
>  { 'struct': 'SevCapability',
>    'data': { 'pdh': 'str',
>              'cert-chain': 'str',
> +            'cpu0-id': 'str',
>              'cbitpos': 'int',
>              'reduced-phys-bits': 'int'},
>    'if': 'TARGET_I386' }
> @@ -172,6 +175,7 @@
>  #
>  # -> { "execute": "query-sev-capabilities" }
>  # <- { "return": { "pdh": "8CCDD8DDD", "cert-chain": "888CCCDDDEE",
> +#                  "cpu0-id": "2lvmGwo+...61iEinw==",
>  #                  "cbitpos": 47, "reduced-phys-bits": 5}}
>  #
>  ##
> diff --git a/target/i386/sev.c b/target/i386/sev.c
> index 025ff7a6f8..32f7dbac4e 100644
> --- a/target/i386/sev.c
> +++ b/target/i386/sev.c
> @@ -531,12 +531,46 @@ e_free:
>      return 1;
>  }
>  
> +static int sev_get_cpu0_id(int fd, guchar **id, size_t *id_len, Error **errp)
> +{
> +    guchar *id_data;
> +    struct sev_user_data_get_id2 get_id2 = {};
> +    int err, r;
> +
> +    /* query the ID length */
> +    r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err);
> +    if (r < 0 && err != SEV_RET_INVALID_LEN) {
> +        error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)",
> +                   r, err, fw_error_to_str(err));
> +        return 1;
> +    }
> +
> +    id_data = g_new(guchar, get_id2.length);
> +    get_id2.address = (unsigned long)id_data;
> +
> +    r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err);
> +    if (r < 0) {
> +        error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)",
> +                   r, err, fw_error_to_str(err));
> +        goto err;
> +    }
> +
> +    *id = id_data;
> +    *id_len = get_id2.length;
> +    return 0;
> +
> +err:
> +    g_free(id_data);
> +    return 1;
> +}
> +
>  static SevCapability *sev_get_capabilities(Error **errp)
>  {
>      SevCapability *cap = NULL;
>      guchar *pdh_data = NULL;
>      guchar *cert_chain_data = NULL;
> -    size_t pdh_len = 0, cert_chain_len = 0;
> +    guchar *cpu0_id_data = NULL;
> +    size_t pdh_len = 0, cert_chain_len = 0, cpu0_id_len = 0;
>      uint32_t ebx;
>      int fd;
>  
> @@ -561,9 +595,14 @@ static SevCapability *sev_get_capabilities(Error **errp)
>          goto out;
>      }
>  
> +    if (sev_get_cpu0_id(fd, &cpu0_id_data, &cpu0_id_len, errp)) {
> +        goto out;
> +    }
> +
>      cap = g_new0(SevCapability, 1);
>      cap->pdh = g_base64_encode(pdh_data, pdh_len);
>      cap->cert_chain = g_base64_encode(cert_chain_data, cert_chain_len);
> +    cap->cpu0_id = g_base64_encode(cpu0_id_data, cpu0_id_len);
>  
>      host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL);
>      cap->cbitpos = ebx & 0x3f;
> @@ -575,6 +614,7 @@ static SevCapability *sev_get_capabilities(Error **errp)
>      cap->reduced_phys_bits = 1;
>  
>  out:
> +    g_free(cpu0_id_data);
>      g_free(pdh_data);
>      g_free(cert_chain_data);
>      close(fd);
Re: [PULL 01/53] qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities
Posted by Dov Murik 3 years, 8 months ago 

On 19/04/2022 10:16, Dov Murik wrote:
> Thanks Paolo.
> 
> On 19/04/2022 8:50, Paolo Bonzini wrote:
>> From: Dov Murik <dovmurik@linux.ibm.com>
>>
>> Add a new field 'cpu0-id' to the response of query-sev-capabilities QMP
>> command.  The value of the field is the base64-encoded unique ID of CPU0
>> (socket 0), which can be used to retrieve the signed CEK of the CPU from
>> AMD's Key Distribution Service (KDS).
>>
>> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
>>
>> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
>> Message-Id: <20220228093014.882288-1-dovmurik@linux.ibm.com>
>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>> ---
>>  qapi/misc-target.json |  4 ++++
>>  target/i386/sev.c     | 42 +++++++++++++++++++++++++++++++++++++++++-
>>  2 files changed, 45 insertions(+), 1 deletion(-)
>>
>> diff --git a/qapi/misc-target.json b/qapi/misc-target.json
>> index 036c5e4a91..bc9355b595 100644
>> --- a/qapi/misc-target.json
>> +++ b/qapi/misc-target.json
>> @@ -144,6 +144,8 @@
>>  #
>>  # @cert-chain:  PDH certificate chain (base64 encoded)
>>  #
>> +# @cpu0-id: Unique ID of CPU0 (base64 encoded) (since 7.0)
>> +#
> 
> Should this be changed to "since 7.1" ?
> 
> Paolo, can you modify the patch in your tree, or should I submit a new
> version?


I see the original is already merged to master, so I sent another fix-up patch:

Subject: [PATCH] qapi: Fix version of cpu0-id field
Message-ID: 20220420190129.3532623-1-dovmurik@linux.ibm.com

-Dov


> 
> -Dov
> 
>>  # @cbitpos: C-bit location in page table entry
>>  #
>>  # @reduced-phys-bits: Number of physical Address bit reduction when SEV is
>> @@ -154,6 +156,7 @@
>>  { 'struct': 'SevCapability',
>>    'data': { 'pdh': 'str',
>>              'cert-chain': 'str',
>> +            'cpu0-id': 'str',
>>              'cbitpos': 'int',
>>              'reduced-phys-bits': 'int'},
>>    'if': 'TARGET_I386' }
>> @@ -172,6 +175,7 @@
>>  #
>>  # -> { "execute": "query-sev-capabilities" }
>>  # <- { "return": { "pdh": "8CCDD8DDD", "cert-chain": "888CCCDDDEE",
>> +#                  "cpu0-id": "2lvmGwo+...61iEinw==",
>>  #                  "cbitpos": 47, "reduced-phys-bits": 5}}
>>  #
>>  ##
>> diff --git a/target/i386/sev.c b/target/i386/sev.c
>> index 025ff7a6f8..32f7dbac4e 100644
>> --- a/target/i386/sev.c
>> +++ b/target/i386/sev.c
>> @@ -531,12 +531,46 @@ e_free:
>>      return 1;
>>  }
>>  
>> +static int sev_get_cpu0_id(int fd, guchar **id, size_t *id_len, Error **errp)
>> +{
>> +    guchar *id_data;
>> +    struct sev_user_data_get_id2 get_id2 = {};
>> +    int err, r;
>> +
>> +    /* query the ID length */
>> +    r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err);
>> +    if (r < 0 && err != SEV_RET_INVALID_LEN) {
>> +        error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)",
>> +                   r, err, fw_error_to_str(err));
>> +        return 1;
>> +    }
>> +
>> +    id_data = g_new(guchar, get_id2.length);
>> +    get_id2.address = (unsigned long)id_data;
>> +
>> +    r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err);
>> +    if (r < 0) {
>> +        error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)",
>> +                   r, err, fw_error_to_str(err));
>> +        goto err;
>> +    }
>> +
>> +    *id = id_data;
>> +    *id_len = get_id2.length;
>> +    return 0;
>> +
>> +err:
>> +    g_free(id_data);
>> +    return 1;
>> +}
>> +
>>  static SevCapability *sev_get_capabilities(Error **errp)
>>  {
>>      SevCapability *cap = NULL;
>>      guchar *pdh_data = NULL;
>>      guchar *cert_chain_data = NULL;
>> -    size_t pdh_len = 0, cert_chain_len = 0;
>> +    guchar *cpu0_id_data = NULL;
>> +    size_t pdh_len = 0, cert_chain_len = 0, cpu0_id_len = 0;
>>      uint32_t ebx;
>>      int fd;
>>  
>> @@ -561,9 +595,14 @@ static SevCapability *sev_get_capabilities(Error **errp)
>>          goto out;
>>      }
>>  
>> +    if (sev_get_cpu0_id(fd, &cpu0_id_data, &cpu0_id_len, errp)) {
>> +        goto out;
>> +    }
>> +
>>      cap = g_new0(SevCapability, 1);
>>      cap->pdh = g_base64_encode(pdh_data, pdh_len);
>>      cap->cert_chain = g_base64_encode(cert_chain_data, cert_chain_len);
>> +    cap->cpu0_id = g_base64_encode(cpu0_id_data, cpu0_id_len);
>>  
>>      host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL);
>>      cap->cbitpos = ebx & 0x3f;
>> @@ -575,6 +614,7 @@ static SevCapability *sev_get_capabilities(Error **errp)
>>      cap->reduced_phys_bits = 1;
>>  
>>  out:
>> +    g_free(cpu0_id_data);
>>      g_free(pdh_data);
>>      g_free(cert_chain_data);
>>      close(fd);

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.