On Thu, May 30, 2024 at 1:17 PM Pankaj Gupta <pankaj.gupta@xxxxxxx> wrote:
>
> From: Dov Murik <dovmurik@xxxxxxxxxxxxx>
>
> In SNP, the hashes page designated with a specific metadata entry
> published in AmdSev OVMF.
>
> Therefore, if the user enabled kernel hashes (for measured direct boot),
> QEMU should prepare the content of hashes table, and during the
> processing of the metadata entry it copy the content into the designated
> page and encrypt it.
>
> Note that in SNP (unlike SEV and SEV-ES) the measurements is done in
> whole 4KB pages. Therefore QEMU zeros the whole page that includes the
> hashes table, and fills in the kernel hashes area in that page, and then
> encrypts the whole page. The rest of the page is reserved for SEV
> launch secrets which are not usable anyway on SNP.
>
> If the user disabled kernel hashes, QEMU pre-validates the kernel hashes
> page as a zero page.
>
> Signed-off-by: Dov Murik <dovmurik@xxxxxxxxxxxxx>
> Signed-off-by: Michael Roth <michael.roth@xxxxxxx>
> Signed-off-by: Pankaj Gupta <pankaj.gupta@xxxxxxx>
> ---
> include/hw/i386/pc.h | 2 ++
> target/i386/sev.c | 35 +++++++++++++++++++++++++++++++++++
> 2 files changed, 37 insertions(+)
>
> diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
> index c653b8eeb2..ca7904ac2c 100644
> --- a/include/hw/i386/pc.h
> +++ b/include/hw/i386/pc.h
> @@ -172,6 +172,8 @@ typedef enum {
> SEV_DESC_TYPE_SNP_SECRETS,
> /* The section contains address that can be used as a CPUID page */
> SEV_DESC_TYPE_CPUID,
> + /* The section contains the region for kernel hashes for measured direct boot */
> + SEV_DESC_TYPE_SNP_KERNEL_HASHES = 0x10,
>
> } ovmf_sev_metadata_desc_type;
>
> diff --git a/target/i386/sev.c b/target/i386/sev.c
> index 1b29fdbc9a..1a78e98751 100644
> --- a/target/i386/sev.c
> +++ b/target/i386/sev.c
> @@ -145,6 +145,9 @@ struct SevSnpGuestState {
>
> struct kvm_sev_snp_launch_start kvm_start_conf;
> struct kvm_sev_snp_launch_finish kvm_finish_conf;
> +
> + uint32_t kernel_hashes_offset;
> + PaddedSevHashTable *kernel_hashes_data;
> };
>
> struct SevSnpGuestStateClass {
> @@ -1187,6 +1190,23 @@ snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva, uint32_t cpuid_len)
> KVM_SEV_SNP_PAGE_TYPE_CPUID);
> }
>
> +static int
> +snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp, uint32_t addr,
> + void *hva, uint32_t len)
> +{
> + int type = KVM_SEV_SNP_PAGE_TYPE_ZERO;
> + if (sev_snp->parent_obj.kernel_hashes) {
> + assert(sev_snp->kernel_hashes_data);
> + assert((sev_snp->kernel_hashes_offset +
> + sizeof(*sev_snp->kernel_hashes_data)) <= len);
> + memset(hva, 0, len);
> + memcpy(hva + sev_snp->kernel_hashes_offset, sev_snp->kernel_hashes_data,
> + sizeof(*sev_snp->kernel_hashes_data));
> + type = KVM_SEV_SNP_PAGE_TYPE_NORMAL;
> + }
> + return snp_launch_update_data(addr, hva, len, type);
> +}
> +
> static int
> snp_metadata_desc_to_page_type(int desc_type)
> {
> @@ -1223,6 +1243,9 @@ snp_populate_metadata_pages(SevSnpGuestState *sev_snp,
>
> if (type == KVM_SEV_SNP_PAGE_TYPE_CPUID) {
> ret = snp_launch_update_cpuid(desc->base, hva, desc->len);
> + } else if (desc->type == SEV_DESC_TYPE_SNP_KERNEL_HASHES) {
> + ret = snp_launch_update_kernel_hashes(sev_snp, desc->base, hva,
> + desc->len);
> } else {
> ret = snp_launch_update_data(desc->base, hva, desc->len, type);
> }
> @@ -1855,6 +1878,18 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
> return false;
> }
>
> + if (sev_snp_enabled()) {
> + /*
> + * SNP: Populate the hashes table in an area that later in
> + * snp_launch_update_kernel_hashes() will be copied to the guest memory
> + * and encrypted.
> + */
> + SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(sev_common);
> + sev_snp_guest->kernel_hashes_offset = area->base & ~TARGET_PAGE_MASK;
> + sev_snp_guest->kernel_hashes_data = g_new0(PaddedSevHashTable, 1);
> + return build_kernel_loader_hashes(sev_snp_guest->kernel_hashes_data, ctx, errp);
> + }
This is effectively a new method:
bool (*build_kernel_loader_hashes)(SevCommonState *sev_common,
SevHashTableDescriptor *area,
SevKernelLoaderContext *ctx,
Error **errp);
where the four lines above are the implementation for SNP and the code
below is the implementation for sev-guest.
Paolo
> /*
> * Populate the hashes table in the guest's memory at the OVMF-designated
> * area for the SEV hashes table
> --
> 2.34.1
>
