From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by mx.groups.io with SMTP id smtpd.web08.5732.1621920687167947633 for ; Mon, 24 May 2021 22:31:27 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@ibm.com header.s=pp1 header.b=K5NjPgin; spf=pass (domain: linux.ibm.com, ip: 148.163.156.1, mailfrom: dovmurik@linux.ibm.com) Received: from pps.filterd (m0098410.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 14P54T4X002675; Tue, 25 May 2021 01:31:25 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : mime-version : content-transfer-encoding; s=pp1; bh=b84EeJ4lcK8/l2IWn7hyOWNMuwXQf3B8FVuo8ZKB8+A=; b=K5NjPgin3/V9b4p6zBSHTv2CSeCbSU3ZPbI7pSEFi2IIydtAYNkbCLTqc5E+odt7VwlF upxZStJ4HwPdHbHosVbVNhgqkO7QVS7s3C0SZD0tW2YQxi4AnRQuq99ki6TJePPPvdXp gS/m+F9CbbTyntLl2kfgnvnIlFl+heY8aCI9RG38EGKjSfR9v5VI9rMjn+ZKd2YRj7Kv EbH5RqaSu+GOpYf0Zpn3q1dNQF4uSk0adPUEI+l5xStR4mGAWBbDqlGVGaGQR7xT5y9m Mm06o3Holb14M0QLXxHmh7RIB1CvGUVSxe6sDztvOu8KXW/KUuSqKpuV7h/QL5ENuRB4 dw== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 38rt751k5r-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 25 May 2021 01:31:25 -0400 Received: from m0098410.ppops.net (m0098410.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 14P55RFw012274; Tue, 25 May 2021 01:31:25 -0400 Received: from ppma04dal.us.ibm.com (7a.29.35a9.ip4.static.sl-reverse.com [169.53.41.122]) by mx0a-001b2d01.pphosted.com with ESMTP id 38rt751k4r-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 25 May 2021 01:31:24 -0400 Received: from pps.filterd (ppma04dal.us.ibm.com [127.0.0.1]) by ppma04dal.us.ibm.com (8.16.0.43/8.16.0.43) with SMTP id 14P5R67n015365; Tue, 25 May 2021 05:31:24 GMT Received: from b01cxnp23034.gho.pok.ibm.com (b01cxnp23034.gho.pok.ibm.com [9.57.198.29]) by ppma04dal.us.ibm.com with ESMTP id 38psk91gcm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 25 May 2021 05:31:23 +0000 Received: from b01ledav001.gho.pok.ibm.com (b01ledav001.gho.pok.ibm.com [9.57.199.106]) by b01cxnp23034.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 14P5VMTS23462378 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 25 May 2021 05:31:22 GMT Received: from b01ledav001.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C5D1828059; Tue, 25 May 2021 05:31:22 +0000 (GMT) Received: from b01ledav001.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7F70A2805A; Tue, 25 May 2021 05:31:22 +0000 (GMT) Received: from localhost.localdomain (unknown [9.2.130.16]) by b01ledav001.gho.pok.ibm.com (Postfix) with ESMTP; Tue, 25 May 2021 05:31:22 +0000 (GMT) From: Dov Murik To: devel@edk2.groups.io Cc: Dov Murik , Tobin Feldman-Fitzthum , Tobin Feldman-Fitzthum , Jim Cadden , James Bottomley , Hubertus Franke , Laszlo Ersek , Ard Biesheuvel , Jordan Justen , Ashish Kalra , Brijesh Singh , Erdem Aktas , Jiewen Yao , Min Xu , Tom Lendacky Subject: [PATCH v1 0/8] Measured SEV boot with kernel/initrd/cmdline Date: Tue, 25 May 2021 05:31:08 +0000 Message-Id: <20210525053116.1533673-1-dovmurik@linux.ibm.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: -5DEDAZX7ZL_x09nYdvncYx1Knu4WWIc X-Proofpoint-ORIG-GUID: 7T1PBRNbDomIPefKBEe7s7rP06oYRmM9 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391,18.0.761 definitions=2021-05-25_02:2021-05-24,2021-05-25 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 adultscore=0 mlxlogscore=999 spamscore=0 impostorscore=0 clxscore=1011 mlxscore=0 lowpriorityscore=0 phishscore=0 suspectscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2105250034 Content-Transfer-Encoding: 8bit Booting with SEV prevented the loading of kernel, initrd, and kernel command-line via QEMU fw_cfg interface because they arrive from the VMM which is untrusted in SEV. However, in some cases the kernel, initrd, and cmdline are not secret but should not be modified by the host. In such a case, we want to verify inside the trusted VM that the kernel, initrd, and cmdline are indeed the ones expected by the Guest Owner, and only if that is the case go on and boot them up (removing the need for grub inside OVMF in that mode). This patch series declares a new page in MEMFD which will contain the hashes of these three blobs (kernel, initrd, cmdline), each under its own GUID entry. This tables of hashes is populated by QEMU before launch, and encrypted as part of the initial VM memory; this makes sure theses hashes are part of the SEV measurement (which has to be approved by the Guest Owner for secret injection, for example). Note that this requires a new QEMU patch which will be submitted soon. OVMF parses the table of hashes populated by QEMU (patch 5), and as it reads the fw_cfg blobs from QEMU, it will verify each one against the expected hash (kernel and initrd verifiers are introduced in patch 6, and command-line verifier is introduced in patches 7+8). This is all done inside the trusted VM context. If all the hashes are correct, boot of the kernel is allowed to continue. Any attempt by QEMU to modify the kernel, initrd, cmdline (including dropping one of them), or to modify the OVMF code that verifies those hashes, will cause the initial SEV measurement to change and therefore will be detectable by the Guest Owner during launch before secret injection. Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Jordan Justen Cc: Ashish Kalra Cc: Brijesh Singh Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Min Xu Cc: Tom Lendacky James Bottomley (8): OvmfPkg/AmdSev/SecretDxe: fix header comment to generic naming OvmfPkg: PlatformBootManagerLibGrub: Allow executing kernel via fw_cfg OvmfPkg/AmdSev: add a page to the MEMFD for firmware config hashes OvmfPkg/QemuKernelLoaderFsDxe: Add ability to verify loaded items OvmfPkg/AmdSev: Add library to find encrypted hashes for the FwCfg device OvmfPkg/AmdSev: Add firmware file plugin to verifier OvmfPkg: GenericQemuLoadImageLib: Allow verifying fw_cfg command line OvmfPkg/AmdSev: add SevQemuLoadImageLib OvmfPkg/OvmfPkg.dec | 10 ++ OvmfPkg/AmdSev/AmdSevX64.dsc | 9 +- OvmfPkg/AmdSev/AmdSevX64.fdf | 3 + OvmfPkg/AmdSev/Library/SevFwCfgVerifier/SevFwCfgVerifier.inf | 30 +++++ OvmfPkg/AmdSev/Library/SevHashFinderLib/SevHashFinderLib.inf | 34 ++++++ OvmfPkg/AmdSev/Library/SevQemuLoadImageLib/SevQemuLoadImageLib.inf | 30 +++++ OvmfPkg/Library/PlatformBootManagerLibGrub/PlatformBootManagerLibGrub.inf | 2 + OvmfPkg/ResetVector/ResetVector.inf | 2 + OvmfPkg/AmdSev/Include/Library/SevHashFinderLib.h | 47 ++++++++ OvmfPkg/Include/Library/QemuFwCfgLib.h | 35 ++++++ OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.h | 11 ++ OvmfPkg/AmdSev/Library/SevFwCfgVerifier/SevFwCfgVerifier.c | 60 ++++++++++ OvmfPkg/AmdSev/Library/SevHashFinderLib/SevHashFinderLib.c | 126 ++++++++++++++++++++ OvmfPkg/AmdSev/Library/SevQemuLoadImageLib/SevQemuLoadImageLib.c | 52 ++++++++ OvmfPkg/AmdSev/SecretDxe/SecretDxe.c | 2 +- OvmfPkg/Library/GenericQemuLoadImageLib/GenericQemuLoadImageLib.c | 29 +++++ OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c | 5 + OvmfPkg/Library/PlatformBootManagerLibGrub/QemuKernel.c | 50 ++++++++ OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c | 31 +++++ OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 20 ++++ OvmfPkg/ResetVector/ResetVector.nasmb | 2 + 21 files changed, 587 insertions(+), 3 deletions(-) create mode 100644 OvmfPkg/AmdSev/Library/SevFwCfgVerifier/SevFwCfgVerifier.inf create mode 100644 OvmfPkg/AmdSev/Library/SevHashFinderLib/SevHashFinderLib.inf create mode 100644 OvmfPkg/AmdSev/Library/SevQemuLoadImageLib/SevQemuLoadImageLib.inf create mode 100644 OvmfPkg/AmdSev/Include/Library/SevHashFinderLib.h create mode 100644 OvmfPkg/AmdSev/Library/SevFwCfgVerifier/SevFwCfgVerifier.c create mode 100644 OvmfPkg/AmdSev/Library/SevHashFinderLib/SevHashFinderLib.c create mode 100644 OvmfPkg/AmdSev/Library/SevQemuLoadImageLib/SevQemuLoadImageLib.c create mode 100644 OvmfPkg/Library/PlatformBootManagerLibGrub/QemuKernel.c -- 2.25.1