aboutsummaryrefslogtreecommitdiff
path: root/target/i386/sev.c
diff options
context:
space:
mode:
authorDov Murik <dovmurik@linux.ibm.com>2022-02-28 09:30:14 +0000
committerPaolo Bonzini <pbonzini@redhat.com>2022-04-06 10:50:37 +0200
commit811b4ec7f8eb3fb1fe9851848ab8e3cd926b9627 (patch)
tree039a583e070a9d5f2ac3fe4559ec5373856be96a /target/i386/sev.c
parentf53faa70bb63cc0c8e2fd0752b7ad2c8a79616ba (diff)
qapi, target/i386/sev: Add cpu0-id to query-sev-capabilities
Add a new field 'cpu0-id' to the response of query-sev-capabilities QMP command. The value of the field is the base64-encoded unique ID of CPU0 (socket 0), which can be used to retrieve the signed CEK of the CPU from AMD's Key Distribution Service (KDS). Signed-off-by: Dov Murik <dovmurik@linux.ibm.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20220228093014.882288-1-dovmurik@linux.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'target/i386/sev.c')
-rw-r--r--target/i386/sev.c42
1 files changed, 41 insertions, 1 deletions
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 025ff7a6f8..32f7dbac4e 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -531,12 +531,46 @@ e_free:
return 1;
}
+static int sev_get_cpu0_id(int fd, guchar **id, size_t *id_len, Error **errp)
+{
+ guchar *id_data;
+ struct sev_user_data_get_id2 get_id2 = {};
+ int err, r;
+
+ /* query the ID length */
+ r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err);
+ if (r < 0 && err != SEV_RET_INVALID_LEN) {
+ error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)",
+ r, err, fw_error_to_str(err));
+ return 1;
+ }
+
+ id_data = g_new(guchar, get_id2.length);
+ get_id2.address = (unsigned long)id_data;
+
+ r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err);
+ if (r < 0) {
+ error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)",
+ r, err, fw_error_to_str(err));
+ goto err;
+ }
+
+ *id = id_data;
+ *id_len = get_id2.length;
+ return 0;
+
+err:
+ g_free(id_data);
+ return 1;
+}
+
static SevCapability *sev_get_capabilities(Error **errp)
{
SevCapability *cap = NULL;
guchar *pdh_data = NULL;
guchar *cert_chain_data = NULL;
- size_t pdh_len = 0, cert_chain_len = 0;
+ guchar *cpu0_id_data = NULL;
+ size_t pdh_len = 0, cert_chain_len = 0, cpu0_id_len = 0;
uint32_t ebx;
int fd;
@@ -561,9 +595,14 @@ static SevCapability *sev_get_capabilities(Error **errp)
goto out;
}
+ if (sev_get_cpu0_id(fd, &cpu0_id_data, &cpu0_id_len, errp)) {
+ goto out;
+ }
+
cap = g_new0(SevCapability, 1);
cap->pdh = g_base64_encode(pdh_data, pdh_len);
cap->cert_chain = g_base64_encode(cert_chain_data, cert_chain_len);
+ cap->cpu0_id = g_base64_encode(cpu0_id_data, cpu0_id_len);
host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL);
cap->cbitpos = ebx & 0x3f;
@@ -575,6 +614,7 @@ static SevCapability *sev_get_capabilities(Error **errp)
cap->reduced_phys_bits = 1;
out:
+ g_free(cpu0_id_data);
g_free(pdh_data);
g_free(cert_chain_data);
close(fd);