On Tue, May 25, 2021 at 06:59:31AM +0000, Dov Murik wrote: > From: James Bottomley <j...@linux.ibm.com> > > If the VM is using memory encryption and also specifies a kernel/initrd > or appended command line, calculate the hashes and add them to the > encrypted data. For this to work, OVMF must support an encrypted area > to place the data which is advertised via a special GUID in the OVMF > reset table (if the GUID doesn't exist, the user isn't allowed to pass > in the kernel/initrd/cmdline via the fw_cfg interface). > > The hashes of each of the files is calculated (or the string in the case > of the cmdline with trailing '\0' included). Each entry in the hashes > table is GUID identified and since they're passed through the memcrypt > interface, the hash of the encrypted data will be accumulated by the > PSP. > > Signed-off-by: James Bottomley <j...@linux.ibm.com> > Signed-off-by: Dov Murik <dovmu...@linux.ibm.com> > [dovmu...@linux.ibm.com: use machine->cgs, remove parsing of GUID > strings, remove GCC pragma, fix checkpatch errors] > --- > > OVMF support for handling the table of hashes (verifying that the > kernel/initrd/cmdline passed via the fw_cfg interface indeed correspond > to the measured hashes in the table) will be posted soon to edk2-devel. > > --- > hw/i386/x86.c | 120 +++++++++++++++++++++++++++++++++++++++++++++++++- > 1 file changed, 119 insertions(+), 1 deletion(-) >
This is not an objection to the patch itself, but: can we do something to move all sev-related code to sev.c? It would make the process of assigning a maintainer and reviewing/merging future patches much simpler. I am not familiar with SEV internals, so my only question is about configurations where SEV is disabled: [...] > diff --git a/hw/i386/x86.c b/hw/i386/x86.c > @@ -778,6 +818,11 @@ void x86_load_linux(X86MachineState *x86ms, > const char *initrd_filename = machine->initrd_filename; > const char *dtb_filename = machine->dtb; > const char *kernel_cmdline = machine->kernel_cmdline; > + uint8_t buf[HASH_SIZE]; > + uint8_t *hash = buf; > + size_t hash_len = sizeof(buf); > + struct sev_hash_table *sev_ht = NULL; > + int sev_ht_index = 0; > > /* Align to 16 bytes as a paranoia measure */ > cmdline_size = (strlen(kernel_cmdline) + 16) & ~15; > @@ -799,6 +844,22 @@ void x86_load_linux(X86MachineState *x86ms, > exit(1); > } > > + if (machine->cgs && machine->cgs->ready) { machine->cgs doesn't seem to be a SEV-specific field. What if machine->cgs->ready is set but SEV is disabled? > + uint8_t *data; > + struct sev_hash_table_descriptor *area; > + > + if (!pc_system_ovmf_table_find(SEV_HASH_TABLE_RV_GUID, &data, NULL)) > { > + fprintf(stderr, "qemu: kernel command line specified but OVMF > has " > + "no hash table guid\n"); > + exit(1); > + } > + area = (struct sev_hash_table_descriptor *)data; > + > + sev_ht = qemu_map_ram_ptr(NULL, area->base); > + memcpy(sev_ht->guid, sev_hash_table_header_guid, > sizeof(sev_ht->guid)); > + sev_ht->len = sizeof(*sev_ht); > + } > + > /* kernel protocol version */ > if (ldl_p(header + 0x202) == 0x53726448) { > protocol = lduw_p(header + 0x206); [...] -- Eduardo