diff mbox series

[v4,23/31] i386/sev: Allow measured direct kernel boot on SNP

Message ID 20240530111643.1091816-24-pankaj.gupta@amd.com
State New
Headers show
Series Add AMD Secure Nested Paging (SEV-SNP) support | expand

Commit Message

Gupta, Pankaj May 30, 2024, 11:16 a.m. UTC 
From: Dov Murik <dovmurik@linux.ibm.com>

In SNP, the hashes page designated with a specific metadata entry
published in AmdSev OVMF.

Therefore, if the user enabled kernel hashes (for measured direct boot),
QEMU should prepare the content of hashes table, and during the
processing of the metadata entry it copy the content into the designated
page and encrypt it.

Note that in SNP (unlike SEV and SEV-ES) the measurements is done in
whole 4KB pages.  Therefore QEMU zeros the whole page that includes the
hashes table, and fills in the kernel hashes area in that page, and then
encrypts the whole page.  The rest of the page is reserved for SEV
launch secrets which are not usable anyway on SNP.

If the user disabled kernel hashes, QEMU pre-validates the kernel hashes
page as a zero page.

Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
Signed-off-by: Michael Roth <michael.roth@amd.com>
Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
---
 include/hw/i386/pc.h |  2 ++
 target/i386/sev.c    | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

Comments

Paolo Bonzini May 31, 2024, 11:14 a.m. UTC | #1 
On Thu, May 30, 2024 at 1:17 PM Pankaj Gupta <pankaj.gupta@amd.com> wrote:
>
> From: Dov Murik <dovmurik@linux.ibm.com>
>
> In SNP, the hashes page designated with a specific metadata entry
> published in AmdSev OVMF.
>
> Therefore, if the user enabled kernel hashes (for measured direct boot),
> QEMU should prepare the content of hashes table, and during the
> processing of the metadata entry it copy the content into the designated
> page and encrypt it.
>
> Note that in SNP (unlike SEV and SEV-ES) the measurements is done in
> whole 4KB pages.  Therefore QEMU zeros the whole page that includes the
> hashes table, and fills in the kernel hashes area in that page, and then
> encrypts the whole page.  The rest of the page is reserved for SEV
> launch secrets which are not usable anyway on SNP.
>
> If the user disabled kernel hashes, QEMU pre-validates the kernel hashes
> page as a zero page.
>
> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
> Signed-off-by: Michael Roth <michael.roth@amd.com>
> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
> ---
>  include/hw/i386/pc.h |  2 ++
>  target/i386/sev.c    | 35 +++++++++++++++++++++++++++++++++++
>  2 files changed, 37 insertions(+)
>
> diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
> index c653b8eeb2..ca7904ac2c 100644
> --- a/include/hw/i386/pc.h
> +++ b/include/hw/i386/pc.h
> @@ -172,6 +172,8 @@ typedef enum {
>      SEV_DESC_TYPE_SNP_SECRETS,
>      /* The section contains address that can be used as a CPUID page */
>      SEV_DESC_TYPE_CPUID,
> +    /* The section contains the region for kernel hashes for measured direct boot */
> +    SEV_DESC_TYPE_SNP_KERNEL_HASHES = 0x10,
>
>  } ovmf_sev_metadata_desc_type;
>
> diff --git a/target/i386/sev.c b/target/i386/sev.c
> index 1b29fdbc9a..1a78e98751 100644
> --- a/target/i386/sev.c
> +++ b/target/i386/sev.c
> @@ -145,6 +145,9 @@ struct SevSnpGuestState {
>
>      struct kvm_sev_snp_launch_start kvm_start_conf;
>      struct kvm_sev_snp_launch_finish kvm_finish_conf;
> +
> +    uint32_t kernel_hashes_offset;
> +    PaddedSevHashTable *kernel_hashes_data;
>  };
>
>  struct SevSnpGuestStateClass {
> @@ -1187,6 +1190,23 @@ snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva, uint32_t cpuid_len)
>                                    KVM_SEV_SNP_PAGE_TYPE_CPUID);
>  }
>
> +static int
> +snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp, uint32_t addr,
> +                                void *hva, uint32_t len)
> +{
> +    int type = KVM_SEV_SNP_PAGE_TYPE_ZERO;
> +    if (sev_snp->parent_obj.kernel_hashes) {
> +        assert(sev_snp->kernel_hashes_data);
> +        assert((sev_snp->kernel_hashes_offset +
> +                sizeof(*sev_snp->kernel_hashes_data)) <= len);
> +        memset(hva, 0, len);
> +        memcpy(hva + sev_snp->kernel_hashes_offset, sev_snp->kernel_hashes_data,
> +               sizeof(*sev_snp->kernel_hashes_data));
> +        type = KVM_SEV_SNP_PAGE_TYPE_NORMAL;
> +    }
> +    return snp_launch_update_data(addr, hva, len, type);
> +}
> +
>  static int
>  snp_metadata_desc_to_page_type(int desc_type)
>  {
> @@ -1223,6 +1243,9 @@ snp_populate_metadata_pages(SevSnpGuestState *sev_snp,
>
>          if (type == KVM_SEV_SNP_PAGE_TYPE_CPUID) {
>              ret = snp_launch_update_cpuid(desc->base, hva, desc->len);
> +        } else if (desc->type == SEV_DESC_TYPE_SNP_KERNEL_HASHES) {
> +            ret = snp_launch_update_kernel_hashes(sev_snp, desc->base, hva,
> +                                                  desc->len);
>          } else {
>              ret = snp_launch_update_data(desc->base, hva, desc->len, type);
>          }
> @@ -1855,6 +1878,18 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
>          return false;
>      }
>
> +    if (sev_snp_enabled()) {
> +        /*
> +         * SNP: Populate the hashes table in an area that later in
> +         * snp_launch_update_kernel_hashes() will be copied to the guest memory
> +         * and encrypted.
> +         */
> +        SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(sev_common);
> +        sev_snp_guest->kernel_hashes_offset = area->base & ~TARGET_PAGE_MASK;
> +        sev_snp_guest->kernel_hashes_data = g_new0(PaddedSevHashTable, 1);
> +        return build_kernel_loader_hashes(sev_snp_guest->kernel_hashes_data, ctx, errp);
> +    }

This is effectively a new method:

    bool (*build_kernel_loader_hashes)(SevCommonState *sev_common,
                                       SevHashTableDescriptor *area,
                                       SevKernelLoaderContext *ctx,
                                       Error **errp);

where the four lines above are the implementation for SNP and the code
below is the implementation for sev-guest.

Paolo


>      /*
>       * Populate the hashes table in the guest's memory at the OVMF-designated
>       * area for the SEV hashes table
> --
> 2.34.1
>
diff mbox series

Patch

diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index c653b8eeb2..ca7904ac2c 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -172,6 +172,8 @@  typedef enum {
     SEV_DESC_TYPE_SNP_SECRETS,
     /* The section contains address that can be used as a CPUID page */
     SEV_DESC_TYPE_CPUID,
+    /* The section contains the region for kernel hashes for measured direct boot */
+    SEV_DESC_TYPE_SNP_KERNEL_HASHES = 0x10,
 
 } ovmf_sev_metadata_desc_type;
 
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 1b29fdbc9a..1a78e98751 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -145,6 +145,9 @@  struct SevSnpGuestState {
 
     struct kvm_sev_snp_launch_start kvm_start_conf;
     struct kvm_sev_snp_launch_finish kvm_finish_conf;
+
+    uint32_t kernel_hashes_offset;
+    PaddedSevHashTable *kernel_hashes_data;
 };
 
 struct SevSnpGuestStateClass {
@@ -1187,6 +1190,23 @@  snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva, uint32_t cpuid_len)
                                   KVM_SEV_SNP_PAGE_TYPE_CPUID);
 }
 
+static int
+snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp, uint32_t addr,
+                                void *hva, uint32_t len)
+{
+    int type = KVM_SEV_SNP_PAGE_TYPE_ZERO;
+    if (sev_snp->parent_obj.kernel_hashes) {
+        assert(sev_snp->kernel_hashes_data);
+        assert((sev_snp->kernel_hashes_offset +
+                sizeof(*sev_snp->kernel_hashes_data)) <= len);
+        memset(hva, 0, len);
+        memcpy(hva + sev_snp->kernel_hashes_offset, sev_snp->kernel_hashes_data,
+               sizeof(*sev_snp->kernel_hashes_data));
+        type = KVM_SEV_SNP_PAGE_TYPE_NORMAL;
+    }
+    return snp_launch_update_data(addr, hva, len, type);
+}
+
 static int
 snp_metadata_desc_to_page_type(int desc_type)
 {
@@ -1223,6 +1243,9 @@  snp_populate_metadata_pages(SevSnpGuestState *sev_snp,
 
         if (type == KVM_SEV_SNP_PAGE_TYPE_CPUID) {
             ret = snp_launch_update_cpuid(desc->base, hva, desc->len);
+        } else if (desc->type == SEV_DESC_TYPE_SNP_KERNEL_HASHES) {
+            ret = snp_launch_update_kernel_hashes(sev_snp, desc->base, hva,
+                                                  desc->len);
         } else {
             ret = snp_launch_update_data(desc->base, hva, desc->len, type);
         }
@@ -1855,6 +1878,18 @@  bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
         return false;
     }
 
+    if (sev_snp_enabled()) {
+        /*
+         * SNP: Populate the hashes table in an area that later in
+         * snp_launch_update_kernel_hashes() will be copied to the guest memory
+         * and encrypted.
+         */
+        SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(sev_common);
+        sev_snp_guest->kernel_hashes_offset = area->base & ~TARGET_PAGE_MASK;
+        sev_snp_guest->kernel_hashes_data = g_new0(PaddedSevHashTable, 1);
+        return build_kernel_loader_hashes(sev_snp_guest->kernel_hashes_data, ctx, errp);
+    }
+
     /*
      * Populate the hashes table in the guest's memory at the OVMF-designated
      * area for the SEV hashes table