On Wed, Mar 20, 2024 at 03:39:39AM -0500, Michael Roth wrote:
> From: Dov Murik <dovmurik@xxxxxxxxxxxxx>
>
> In order to enable kernel-hashes for SNP, pull it from
> SevGuestProperties to its parent SevCommonProperties so
> it will be available for both SEV and SNP.
>
> Signed-off-by: Dov Murik <dovmurik@xxxxxxxxxxxxx>
> Signed-off-by: Michael Roth <michael.roth@xxxxxxx>
> ---
> qapi/qom.json | 14 +++++++-------
> target/i386/sev.c | 44 ++++++++++++++++++--------------------------
> 2 files changed, 25 insertions(+), 33 deletions(-)
This change ought to be squashed into the earlier patch
that introduce sev-guest-common.
>
> diff --git a/qapi/qom.json b/qapi/qom.json
> index 7ba778af91..ea8832a8c3 100644
> --- a/qapi/qom.json
> +++ b/qapi/qom.json
> @@ -886,12 +886,17 @@
> # @reduced-phys-bits: number of bits in physical addresses that become
> # unavailable when SEV is enabled
> #
> +# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a
> +# designated guest firmware page for measured boot with -kernel
> +# (default: false) (since 6.2)
> +#
> # Since: 2.12
> ##
> { 'struct': 'SevCommonProperties',
> 'data': { '*sev-device': 'str',
> '*cbitpos': 'uint32',
> - 'reduced-phys-bits': 'uint32' } }
> + 'reduced-phys-bits': 'uint32',
> + '*kernel-hashes': 'bool' } }
>
> ##
> # @SevGuestProperties:
> @@ -906,10 +911,6 @@
> #
> # @handle: SEV firmware handle (default: 0)
> #
> -# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a
> -# designated guest firmware page for measured boot with -kernel
> -# (default: false) (since 6.2)
> -#
> # Since: 2.12
> ##
> { 'struct': 'SevGuestProperties',
> @@ -917,8 +918,7 @@
> 'data': { '*dh-cert-file': 'str',
> '*session-file': 'str',
> '*policy': 'uint32',
> - '*handle': 'uint32',
> - '*kernel-hashes': 'bool' } }
> + '*handle': 'uint32' } }
>
> ##
> # @SevSnpGuestProperties:
> diff --git a/target/i386/sev.c b/target/i386/sev.c
> index db888afb53..3187b3dee8 100644
> --- a/target/i386/sev.c
> +++ b/target/i386/sev.c
> @@ -54,6 +54,7 @@ struct SevCommonState {
> char *sev_device;
> uint32_t cbitpos;
> uint32_t reduced_phys_bits;
> + bool kernel_hashes;
>
> /* runtime state */
> uint8_t api_major;
> @@ -86,7 +87,6 @@ struct SevGuestState {
> uint32_t policy;
> char *dh_cert_file;
> char *session_file;
> - bool kernel_hashes;
> };
>
> struct SevSnpGuestState {
> @@ -1696,16 +1696,12 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
> MemTxAttrs attrs = { 0 };
> bool ret = true;
> SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
> - SevGuestState *sev_guest =
> - (SevGuestState *)object_dynamic_cast(OBJECT(sev_common),
> - TYPE_SEV_GUEST);
>
> /*
> * Only add the kernel hashes if the sev-guest configuration explicitly
> - * stated kernel-hashes=on. Currently only enabled for SEV/SEV-ES guests,
> - * so check for TYPE_SEV_GUEST as well.
> + * stated kernel-hashes=on.
> */
> - if (sev_guest && !sev_guest->kernel_hashes) {
> + if (!sev_common->kernel_hashes) {
> return false;
> }
>
> @@ -2037,6 +2033,16 @@ sev_common_set_sev_device(Object *obj, const char *value, Error **errp)
> SEV_COMMON(obj)->sev_device = g_strdup(value);
> }
>
> +static bool sev_common_get_kernel_hashes(Object *obj, Error **errp)
> +{
> + return SEV_COMMON(obj)->kernel_hashes;
> +}
> +
> +static void sev_common_set_kernel_hashes(Object *obj, bool value, Error **errp)
> +{
> + SEV_COMMON(obj)->kernel_hashes = value;
> +}
> +
> static void
> sev_common_class_init(ObjectClass *oc, void *data)
> {
> @@ -2051,6 +2057,11 @@ sev_common_class_init(ObjectClass *oc, void *data)
> sev_common_set_sev_device);
> object_class_property_set_description(oc, "sev-device",
> "SEV device to use");
> + object_class_property_add_bool(oc, "kernel-hashes",
> + sev_common_get_kernel_hashes,
> + sev_common_set_kernel_hashes);
> + object_class_property_set_description(oc, "kernel-hashes",
> + "add kernel hashes to guest firmware for measured Linux boot");
> }
>
> static void
> @@ -2109,20 +2120,6 @@ sev_guest_set_session_file(Object *obj, const char *value, Error **errp)
> SEV_GUEST(obj)->session_file = g_strdup(value);
> }
>
> -static bool sev_guest_get_kernel_hashes(Object *obj, Error **errp)
> -{
> - SevGuestState *sev_guest = SEV_GUEST(obj);
> -
> - return sev_guest->kernel_hashes;
> -}
> -
> -static void sev_guest_set_kernel_hashes(Object *obj, bool value, Error **errp)
> -{
> - SevGuestState *sev = SEV_GUEST(obj);
> -
> - sev->kernel_hashes = value;
> -}
> -
> static void
> sev_guest_class_init(ObjectClass *oc, void *data)
> {
> @@ -2136,11 +2133,6 @@ sev_guest_class_init(ObjectClass *oc, void *data)
> sev_guest_set_session_file);
> object_class_property_set_description(oc, "session-file",
> "guest owners session parameters (encoded with base64)");
> - object_class_property_add_bool(oc, "kernel-hashes",
> - sev_guest_get_kernel_hashes,
> - sev_guest_set_kernel_hashes);
> - object_class_property_set_description(oc, "kernel-hashes",
> - "add kernel hashes to guest firmware for measured Linux boot");
> }
>
> static void
> --
> 2.25.1
>
With regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
