Re: [PATCH v3 13/15] backends/igvm: Handle policy for SEV guests

["Daniel P. Berrangé" <berrange@redhat.com>]

On Fri, Jun 21, 2024 at 03:29:16PM +0100, Roy Hopkins wrote:
> Adds a handler for the guest policy initialization IGVM section and
> builds an SEV policy based on this information and the ID block
> directive if present. The policy is applied using by calling
> 'set_guest_policy()' on the ConfidentialGuestSupport object.
> 
> Signed-off-by: Roy Hopkins <roy.hopkins@suse.com>
> ---
>  backends/igvm.c | 136 ++++++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 136 insertions(+)
> 
> diff --git a/backends/igvm.c b/backends/igvm.c
> index b6b7d30a3f..bb8038f9e9 100644
> --- a/backends/igvm.c
> +++ b/backends/igvm.c
> @@ -28,6 +28,33 @@ typedef struct IgvmParameterData {
>      uint32_t index;
>  } IgvmParameterData;
>  
> +/*
> + * Some directives are specific to particular confidential computing platforms.
> + * Define required types for each of those platforms here.
> + */
> +
> +/* SEV/SEV-ES/SEV-SNP */
> +struct QEMU_PACKED sev_id_block {
> +    uint8_t ld[48];
> +    uint8_t family_id[16];
> +    uint8_t image_id[16];
> +    uint32_t version;
> +    uint32_t guest_svn;
> +    uint64_t policy;
> +};
> +
> +struct QEMU_PACKED sev_id_authentication {
> +    uint32_t id_key_alg;
> +    uint32_t auth_key_algo;
> +    uint8_t reserved[56];
> +    uint8_t id_block_sig[512];
> +    uint8_t id_key[1028];
> +    uint8_t reserved2[60];
> +    uint8_t id_key_sig[512];
> +    uint8_t author_key[1028];
> +    uint8_t reserved3[892];
> +};
> +
>  /*
>   * QemuIgvm contains the information required during processing
>   * of a single IGVM file.
> @@ -39,6 +66,17 @@ typedef struct QemuIgvm {
>      uint32_t compatibility_mask;
>      unsigned current_header_index;
>      QTAILQ_HEAD(, IgvmParameterData) parameter_data;
> +    IgvmPlatformType platform_type;
> +
> +    /*
> +     * SEV-SNP platforms can contain an ID block and authentication
> +     * that should be verified by the guest.
> +     */
> +    struct sev_id_block *id_block;
> +    struct sev_id_authentication *id_auth;
> +
> +    /* Define the guest policy for SEV guests */
> +    uint64_t sev_policy;
>  
>      /* These variables keep track of contiguous page regions */
>      IGVM_VHS_PAGE_DATA region_prev_page_data;
> @@ -64,6 +102,11 @@ static int directive_environment_info(QemuIgvm *ctx, const uint8_t *header_data,
>                                        Error **errp);
>  static int directive_required_memory(QemuIgvm *ctx, const uint8_t *header_data,
>                                       Error **errp);
> +static int directive_snp_id_block(QemuIgvm *ctx, const uint8_t *header_data,
> +                                  Error **errp);
> +static int initialization_guest_policy(QemuIgvm *ctx,
> +                                       const uint8_t *header_data,
> +                                       Error **errp);
>  
>  struct IGVMHandler {
>      uint32_t type;
> @@ -87,6 +130,10 @@ static struct IGVMHandler handlers[] = {
>        directive_environment_info },
>      { IGVM_VHT_REQUIRED_MEMORY, IGVM_HEADER_SECTION_DIRECTIVE,
>        directive_required_memory },
> +    { IGVM_VHT_SNP_ID_BLOCK, IGVM_HEADER_SECTION_DIRECTIVE,
> +      directive_snp_id_block },
> +    { IGVM_VHT_GUEST_POLICY, IGVM_HEADER_SECTION_INITIALIZATION,
> +      initialization_guest_policy },
>  };
>  
>  static int handler(QemuIgvm *ctx, uint32_t type, Error **errp)
> @@ -619,6 +666,68 @@ static int directive_required_memory(QemuIgvm *ctx, const uint8_t *header_data,
>      return 0;
>  }
>  
> +static int directive_snp_id_block(QemuIgvm *ctx, const uint8_t *header_data,
> +                                  Error **errp)
> +{
> +    const IGVM_VHS_SNP_ID_BLOCK *igvm_id =
> +        (const IGVM_VHS_SNP_ID_BLOCK *)header_data;
> +
> +    if (ctx->compatibility_mask & igvm_id->compatibility_mask) {
> +        if (ctx->id_block) {
> +            error_setg(errp, "IGVM: Multiple ID blocks encountered "
> +                             "in IGVM file.");
> +            return -1;
> +        }
> +        ctx->id_block = g_malloc0(sizeof(struct sev_id_block));
> +        ctx->id_auth = g_malloc0(sizeof(struct sev_id_authentication));

QEMU has a preference for

  g_new0(struct sev_id_block, 1);
  g_new0(struct sev_id_authentication, 1);

> +
> +        memcpy(ctx->id_block->family_id, igvm_id->family_id,
> +               sizeof(ctx->id_block->family_id));
> +        memcpy(ctx->id_block->image_id, igvm_id->image_id,
> +               sizeof(ctx->id_block->image_id));
> +        ctx->id_block->guest_svn = igvm_id->guest_svn;
> +        ctx->id_block->version = 1;
> +        memcpy(ctx->id_block->ld, igvm_id->ld, sizeof(ctx->id_block->ld));
> +
> +        ctx->id_auth->id_key_alg = igvm_id->id_key_algorithm;
> +        memcpy(ctx->id_auth->id_block_sig, &igvm_id->id_key_signature,
> +               sizeof(igvm_id->id_key_signature));
> +
> +        ctx->id_auth->auth_key_algo = igvm_id->author_key_algorithm;
> +        memcpy(ctx->id_auth->id_key_sig, &igvm_id->author_key_signature,
> +               sizeof(igvm_id->author_key_signature));
> +
> +        /*
> +         * SEV and IGVM public key structure population are slightly different.
> +         * See SEV Secure Nested Paging Firmware ABI Specification, Chapter 10.
> +         */
> +        *((uint32_t *)ctx->id_auth->id_key) = igvm_id->id_public_key.curve;
> +        memcpy(&ctx->id_auth->id_key[4], &igvm_id->id_public_key.qx, 72);
> +        memcpy(&ctx->id_auth->id_key[76], &igvm_id->id_public_key.qy, 72);
> +
> +        *((uint32_t *)ctx->id_auth->author_key) =
> +            igvm_id->author_public_key.curve;
> +        memcpy(&ctx->id_auth->author_key[4], &igvm_id->author_public_key.qx,
> +               72);
> +        memcpy(&ctx->id_auth->author_key[76], &igvm_id->author_public_key.qy,
> +               72);
> +    }
> +
> +    return 0;
> +}

With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|