Re: [PATCH v3 0/6] SEV: add kernel-hashes=on for measured -kernel launch

[Dov Murik]

Paolo,

Can you please add this series (already reviewed) to the fixes in 6.2?

Thanks,
-Dov


On 11/11/2021 12:00, Dov Murik wrote:
> Tom Lendacky and Brijesh Singh reported two issues with launching SEV
> guests with the -kernel QEMU option when an old [1] or wrongly configured [2]
> OVMF images are used.
> 
> To fix these issues, these series "hides" the whole kernel hashes
> additions behind a kernel-hashes=on option (with default value of
> "off").  This allows existing scenarios to work without change, and
> explicitly forces kernel hashes additions for guests that require that.
> 
> Patch 1 introduces a new boolean option "kernel-hashes" on the sev-guest
> object, and patch 2 causes QEMU to add kernel hashes only if its
> explicitly set to "on".  This will mitigate both experienced issues
> because the default of the new setting is off, and therefore is backward
> compatible with older OVMF images (which don't have a designated hashes
> table area) or with guests that don't wish to measure the kernel/initrd.
> 
> Patch 3 fixes the wording on the error message displayed when no hashes
> table is found in the guest firmware.
> 
> Patch 4 detects incorrect address and length of the guest firmware
> hashes table area and fails the boot.
> 
> Patch 5 is a refactoring of parts of the same function
> sev_add_kernel_loader_hashes() to calculate all padding sizes at
> compile-time.  Patch 6 also changes the same function and replaces the
> call to qemu_map_ram_ptr() with address_space_map() to allow for error
> detection.  Patches 5-6 are not required to fix the issues above, but
> are suggested as an improvement (no functional change intended).
> 
> To enable addition of kernel/initrd/cmdline hashes into the SEV guest at
> launch time, specify:
> 
>     qemu-system-x86_64 ... -object sev-guest,...,kernel-hashes=on
> 
> 
> [1] 
> https://lore.kernel.org/qemu-devel/3b9d10d9-5d9c-da52-f18c-cd93c1931706@amd.com/
> [2] 
> https://lore.kernel.org/qemu-devel/001dd81a-282d-c307-a657-e228480d4af3@amd.com/
> 
> 
> Changes in v3:
>  - Patch 1/6: Add "(since 6.2)" in the documentation of the
>    kernel-hashes option (thanks Markus)
>  - Patch 3/6: Change error string use "kernel" instead of "-kernel"
>    (thanks Daniel)
> 
> v2: 
> 20211108134840.2757206-1-dovmurik@linux.ibm.com/">https://lore.kernel.org/qemu-devel/20211108134840.2757206-1-dovmurik@linux.ibm.com/
> Changes in v2:
>  - Instead of trying to figure out whether to add hashes or not,
>    explicity declare an option (kernel-hashes=on) for that.  When that
>    option is turned on, fail if the hashes cannot be added.
>  - Rephrase error message when no hashes table GUID is found.
>  - Replace qemu_map_ram_ptr with address_space_map
> 
> v1: 
> 20211101102136.1706421-1-dovmurik@linux.ibm.com/">https://lore.kernel.org/qemu-devel/20211101102136.1706421-1-dovmurik@linux.ibm.com/
> 
> 
> Dov Murik (6):
>   qapi/qom,target/i386: sev-guest: Introduce kernel-hashes=on|off option
>   target/i386/sev: Add kernel hashes only if sev-guest.kernel-hashes=on
>   target/i386/sev: Rephrase error message when no hashes table in guest
>     firmware
>   target/i386/sev: Fail when invalid hashes table area detected
>   target/i386/sev: Perform padding calculations at compile-time
>   target/i386/sev: Replace qemu_map_ram_ptr with address_space_map
> 
>  qapi/qom.json     |  7 ++++-
>  target/i386/sev.c | 77 +++++++++++++++++++++++++++++++++++++++--------
>  qemu-options.hx   |  6 +++-
>  3 files changed, 75 insertions(+), 15 deletions(-)
> 
> 
> base-commit: af531756d25541a1b3b3d9a14e72e7fedd941a2e
>