[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v3 2/6] target/i386/sev: Add kernel hashes only if sev-guest.kern
From: |
Dov Murik |
Subject: |
[PATCH v3 2/6] target/i386/sev: Add kernel hashes only if sev-guest.kernel-hashes=on |
Date: |
Thu, 11 Nov 2021 10:00:44 +0000 |
Commit cff03145ed3c ("sev/i386: Introduce sev_add_kernel_loader_hashes
for measured linux boot", 2021-09-30) introduced measured direct boot
with -kernel, using an OVMF-designated hashes table which QEMU fills.
However, if OVMF doesn't designate such an area, QEMU would completely
abort the VM launch. This breaks launching with -kernel using older
OVMF images which don't publish the SEV_HASH_TABLE_RV_GUID.
Fix that so QEMU will only look for the hashes table if the sev-guest
kernel-hashes option is set to on. Otherwise, QEMU won't look for the
designated area in OVMF and won't fill that area.
To enable addition of kernel hashes, launch the guest with:
-object sev-guest,...,kernel-hashes=on
Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
Reported-by: Tom Lendacky <thomas.lendacky@amd.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Brijesh Singh <brijesh.singh@amd.com>
---
target/i386/sev.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/target/i386/sev.c b/target/i386/sev.c
index cad32812f5..e3abbeef68 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -1223,6 +1223,14 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext
*ctx, Error **errp)
size_t hash_len = HASH_SIZE;
int aligned_len;
+ /*
+ * Only add the kernel hashes if the sev-guest configuration explicitly
+ * stated kernel-hashes=on.
+ */
+ if (!sev_guest->kernel_hashes) {
+ return false;
+ }
+
if (!pc_system_ovmf_table_find(SEV_HASH_TABLE_RV_GUID, &data, NULL)) {
error_setg(errp, "SEV: kernel specified but OVMF has no hash table
guid");
return false;
--
2.25.1
- [PATCH v3 0/6] SEV: add kernel-hashes=on for measured -kernel launch, Dov Murik, 2021/11/11
- [PATCH v3 3/6] target/i386/sev: Rephrase error message when no hashes table in guest firmware, Dov Murik, 2021/11/11
- [PATCH v3 6/6] target/i386/sev: Replace qemu_map_ram_ptr with address_space_map, Dov Murik, 2021/11/11
- [PATCH v3 5/6] target/i386/sev: Perform padding calculations at compile-time, Dov Murik, 2021/11/11
- [PATCH v3 2/6] target/i386/sev: Add kernel hashes only if sev-guest.kernel-hashes=on,
Dov Murik <=
- [PATCH v3 1/6] qapi/qom, target/i386: sev-guest: Introduce kernel-hashes=on|off option, Dov Murik, 2021/11/11
- [PATCH v3 4/6] target/i386/sev: Fail when invalid hashes table area detected, Dov Murik, 2021/11/11
- Re: [PATCH v3 0/6] SEV: add kernel-hashes=on for measured -kernel launch, Dov Murik, 2021/11/14