| Message ID | 20240125032328.2522472-30-xiaoyao.li@intel.com |
|---|---|
| State | New |
| Headers | show |
| Series | QEMU Guest memfd + QEMU TDX support | expand |
Xiaoyao Li <xiaoyao.li@intel.com> writes: > From: Isaku Yamahata <isaku.yamahata@intel.com> > > Three sha384 hash values, mrconfigid, mrowner and mrownerconfig, of a TD > can be provided for TDX attestation. Detailed meaning of them can be > found: https://lore.kernel.org/qemu-devel/31d6dbc1-f453-4cef-ab08-4813f4e0ff92@intel.com/ > > Allow user to specify those values via property mrconfigid, mrowner and > mrownerconfig. They are all in base64 format. > > example > -object tdx-guest, \ > mrconfigid=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v,\ > mrowner=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v,\ > mrownerconfig=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v > > Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com> > Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com> > Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> > > --- > Changes in v4: > - describe more of there fields in qom.json > - free the old value before set new value to avoid memory leak in > _setter(); (Daniel) > > Changes in v3: > - use base64 encoding instread of hex-string; > --- > qapi/qom.json | 14 ++++++- > target/i386/kvm/tdx.c | 87 +++++++++++++++++++++++++++++++++++++++++++ > target/i386/kvm/tdx.h | 3 ++ > 3 files changed, 103 insertions(+), 1 deletion(-) > > diff --git a/qapi/qom.json b/qapi/qom.json > index 2177f3101382..15445f9e41fc 100644 > --- a/qapi/qom.json > +++ b/qapi/qom.json > @@ -905,10 +905,22 @@ > # pages. Some guest OS (e.g., Linux TD guest) may require this to > # be set, otherwise they refuse to boot. > # > +# @mrconfigid: ID for non-owner-defined configuration of the guest TD, > +# e.g., run-time or OS configuration. base64 encoded SHA384 digest. "base64 encoded SHA384" is not a sentence. Double-checking: the data being hashed here is the "non-owner-defined configuration of the guest TD", and the resulting hash is the "ID"? > +# > +# @mrowner: ID for the guest TD’s owner. base64 encoded SHA384 digest. Likewise. > +# > +# @mrownerconfig: ID for owner-defined configuration of the guest TD, > +# e.g., specific to the workload rather than the run-time or OS. > +# base64 encoded SHA384 digest. Likewise. > +# > # Since: 9.0 > ## > { 'struct': 'TdxGuestProperties', > - 'data': { '*sept-ve-disable': 'bool' } } > + 'data': { '*sept-ve-disable': 'bool', > + '*mrconfigid': 'str', > + '*mrowner': 'str', > + '*mrownerconfig': 'str' } } The new members are optional, but their description in the doc comment doesn't explain behavior when present vs. behavior when absent. > > ## > # @ThreadContextProperties: [...]
On 2/19/2024 8:48 PM, Markus Armbruster wrote: > Xiaoyao Li <xiaoyao.li@intel.com> writes: > >> From: Isaku Yamahata <isaku.yamahata@intel.com> >> >> Three sha384 hash values, mrconfigid, mrowner and mrownerconfig, of a TD >> can be provided for TDX attestation. Detailed meaning of them can be >> found: https://lore.kernel.org/qemu-devel/31d6dbc1-f453-4cef-ab08-4813f4e0ff92@intel.com/ >> >> Allow user to specify those values via property mrconfigid, mrowner and >> mrownerconfig. They are all in base64 format. >> >> example >> -object tdx-guest, \ >> mrconfigid=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v,\ >> mrowner=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v,\ >> mrownerconfig=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v >> >> Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com> >> Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com> >> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> >> >> --- >> Changes in v4: >> - describe more of there fields in qom.json >> - free the old value before set new value to avoid memory leak in >> _setter(); (Daniel) >> >> Changes in v3: >> - use base64 encoding instread of hex-string; >> --- >> qapi/qom.json | 14 ++++++- >> target/i386/kvm/tdx.c | 87 +++++++++++++++++++++++++++++++++++++++++++ >> target/i386/kvm/tdx.h | 3 ++ >> 3 files changed, 103 insertions(+), 1 deletion(-) >> >> diff --git a/qapi/qom.json b/qapi/qom.json >> index 2177f3101382..15445f9e41fc 100644 >> --- a/qapi/qom.json >> +++ b/qapi/qom.json >> @@ -905,10 +905,22 @@ >> # pages. Some guest OS (e.g., Linux TD guest) may require this to >> # be set, otherwise they refuse to boot. >> # >> +# @mrconfigid: ID for non-owner-defined configuration of the guest TD, >> +# e.g., run-time or OS configuration. base64 encoded SHA384 digest. > > "base64 encoded SHA384" is not a sentence. > > Double-checking: the data being hashed here is the "non-owner-defined > configuration of the guest TD", and the resulting hash is the "ID"? yes. The "ID" here means the resulting hash. The reason to use "ID" here because in the TDX spec, it's description is Software-defined ID for non-owner-defined configuration of the guest TD - e.g., run-time or OS configuration. If ID is confusing, how about SHA384 hash of non-owner-defined configuration of the guest TD, e.g., run-time of OS configuration. It's base64 encoded. >> +# >> +# @mrowner: ID for the guest TD’s owner. base64 encoded SHA384 digest. > > Likewise. > >> +# >> +# @mrownerconfig: ID for owner-defined configuration of the guest TD, >> +# e.g., specific to the workload rather than the run-time or OS. >> +# base64 encoded SHA384 digest. > > Likewise. > >> +# >> # Since: 9.0 >> ## >> { 'struct': 'TdxGuestProperties', >> - 'data': { '*sept-ve-disable': 'bool' } } >> + 'data': { '*sept-ve-disable': 'bool', >> + '*mrconfigid': 'str', >> + '*mrowner': 'str', >> + '*mrownerconfig': 'str' } } > > The new members are optional, but their description in the doc comment > doesn't explain behavior when present vs. behavior when absent. > >> >> ## >> # @ThreadContextProperties: > > [...] > >
Xiaoyao Li <xiaoyao.li@intel.com> writes: > On 2/19/2024 8:48 PM, Markus Armbruster wrote: >> Xiaoyao Li <xiaoyao.li@intel.com> writes: >> >>> From: Isaku Yamahata <isaku.yamahata@intel.com> >>> >>> Three sha384 hash values, mrconfigid, mrowner and mrownerconfig, of a TD >>> can be provided for TDX attestation. Detailed meaning of them can be >>> found: https://lore.kernel.org/qemu-devel/31d6dbc1-f453-4cef-ab08-4813f4e0ff92@intel.com/ >>> >>> Allow user to specify those values via property mrconfigid, mrowner and >>> mrownerconfig. They are all in base64 format. >>> >>> example >>> -object tdx-guest, \ >>> mrconfigid=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v,\ >>> mrowner=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v,\ >>> mrownerconfig=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v >>> >>> Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com> >>> Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com> >>> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> >>> >>> --- >>> Changes in v4: >>> - describe more of there fields in qom.json >>> - free the old value before set new value to avoid memory leak in >>> _setter(); (Daniel) >>> >>> Changes in v3: >>> - use base64 encoding instread of hex-string; >>> --- >>> qapi/qom.json | 14 ++++++- >>> target/i386/kvm/tdx.c | 87 +++++++++++++++++++++++++++++++++++++++++++ >>> target/i386/kvm/tdx.h | 3 ++ >>> 3 files changed, 103 insertions(+), 1 deletion(-) >>> >>> diff --git a/qapi/qom.json b/qapi/qom.json >>> index 2177f3101382..15445f9e41fc 100644 >>> --- a/qapi/qom.json >>> +++ b/qapi/qom.json >>> @@ -905,10 +905,22 @@ >>> # pages. Some guest OS (e.g., Linux TD guest) may require this to >>> # be set, otherwise they refuse to boot. >>> # >>> +# @mrconfigid: ID for non-owner-defined configuration of the guest TD, >>> +# e.g., run-time or OS configuration. base64 encoded SHA384 digest. >> >> "base64 encoded SHA384" is not a sentence. >> >> Double-checking: the data being hashed here is the "non-owner-defined >> configuration of the guest TD", and the resulting hash is the "ID"? > > yes. The "ID" here means the resulting hash. > > The reason to use "ID" here because in the TDX spec, it's description is > > Software-defined ID for non-owner-defined configuration of the guest > TD - e.g., run-time or OS configuration. > > If ID is confusing, how about > > SHA384 hash of non-owner-defined configuration of the guest TD, e.g., > run-time of OS configuration. It's base64 encoded. I guess staying close to the TDX spec makes sense. We still need to mention the base64 encoding. What about something like ID for non-owner-defined configuration of the guest TD, e.g., run-time or OS configuration (base64 encoded SHA384 digest) or, if we decide that the fact it's SHA384 digest is irrelevant for QMP ID for non-owner-defined configuration of the guest TD, e.g., run-time or OS configuration (base64 encoded) >>> +# >>> +# @mrowner: ID for the guest TD’s owner. base64 encoded SHA384 digest. >> >> Likewise. >> >>> +# >>> +# @mrownerconfig: ID for owner-defined configuration of the guest TD, >>> +# e.g., specific to the workload rather than the run-time or OS. >>> +# base64 encoded SHA384 digest. >> >> Likewise. >> >>> +# >>> # Since: 9.0 >>> ## >>> { 'struct': 'TdxGuestProperties', >>> - 'data': { '*sept-ve-disable': 'bool' } } >>> + 'data': { '*sept-ve-disable': 'bool', >>> + '*mrconfigid': 'str', >>> + '*mrowner': 'str', >>> + '*mrownerconfig': 'str' } } >> >> The new members are optional, but their description in the doc comment >> doesn't explain behavior when present vs. behavior when absent. >> >>> >>> ## >>> # @ThreadContextProperties: >> >> [...] >> >>
diff --git a/qapi/qom.json b/qapi/qom.json index 2177f3101382..15445f9e41fc 100644 --- a/qapi/qom.json +++ b/qapi/qom.json @@ -905,10 +905,22 @@ # pages. Some guest OS (e.g., Linux TD guest) may require this to # be set, otherwise they refuse to boot. # +# @mrconfigid: ID for non-owner-defined configuration of the guest TD, +# e.g., run-time or OS configuration. base64 encoded SHA384 digest. +# +# @mrowner: ID for the guest TD’s owner. base64 encoded SHA384 digest. +# +# @mrownerconfig: ID for owner-defined configuration of the guest TD, +# e.g., specific to the workload rather than the run-time or OS. +# base64 encoded SHA384 digest. +# # Since: 9.0 ## { 'struct': 'TdxGuestProperties', - 'data': { '*sept-ve-disable': 'bool' } } + 'data': { '*sept-ve-disable': 'bool', + '*mrconfigid': 'str', + '*mrowner': 'str', + '*mrownerconfig': 'str' } } ## # @ThreadContextProperties: diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c index 8c2bf512397e..ead19923f318 100644 --- a/target/i386/kvm/tdx.c +++ b/target/i386/kvm/tdx.c @@ -13,6 +13,7 @@ #include "qemu/osdep.h" #include "qemu/error-report.h" +#include "qemu/base64.h" #include "qapi/error.h" #include "qom/object_interfaces.h" #include "standard-headers/asm-x86/kvm_para.h" @@ -515,6 +516,7 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp) X86CPU *x86cpu = X86_CPU(cpu); CPUX86State *env = &x86cpu->env; g_autofree struct kvm_tdx_init_vm *init_vm = NULL; + size_t data_len; int r = 0; QEMU_LOCK_GUARD(&tdx_guest->lock); @@ -525,6 +527,38 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp) init_vm = g_malloc0(sizeof(struct kvm_tdx_init_vm) + sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES); +#define SHA384_DIGEST_SIZE 48 + + if (tdx_guest->mrconfigid) { + g_autofree uint8_t *data = qbase64_decode(tdx_guest->mrconfigid, + strlen(tdx_guest->mrconfigid), &data_len, errp); + if (!data || data_len != SHA384_DIGEST_SIZE) { + error_setg(errp, "TDX: failed to decode mrconfigid"); + return -1; + } + memcpy(init_vm->mrconfigid, data, data_len); + } + + if (tdx_guest->mrowner) { + g_autofree uint8_t *data = qbase64_decode(tdx_guest->mrowner, + strlen(tdx_guest->mrowner), &data_len, errp); + if (!data || data_len != SHA384_DIGEST_SIZE) { + error_setg(errp, "TDX: failed to decode mrowner"); + return -1; + } + memcpy(init_vm->mrowner, data, data_len); + } + + if (tdx_guest->mrownerconfig) { + g_autofree uint8_t *data = qbase64_decode(tdx_guest->mrownerconfig, + strlen(tdx_guest->mrownerconfig), &data_len, errp); + if (!data || data_len != SHA384_DIGEST_SIZE) { + error_setg(errp, "TDX: failed to decode mrownerconfig"); + return -1; + } + memcpy(init_vm->mrownerconfig, data, data_len); + } + r = kvm_vm_enable_cap(kvm_state, KVM_CAP_MAX_VCPUS, 0, ms->smp.cpus); if (r < 0) { error_setg(errp, "Unable to set MAX VCPUS to %d", ms->smp.cpus); @@ -571,6 +605,51 @@ static void tdx_guest_set_sept_ve_disable(Object *obj, bool value, Error **errp) } } +static char * tdx_guest_get_mrconfigid(Object *obj, Error **errp) +{ + TdxGuest *tdx = TDX_GUEST(obj); + + return g_strdup(tdx->mrconfigid); +} + +static void tdx_guest_set_mrconfigid(Object *obj, const char *value, Error **errp) +{ + TdxGuest *tdx = TDX_GUEST(obj); + + g_free(tdx->mrconfigid); + tdx->mrconfigid = g_strdup(value); +} + +static char * tdx_guest_get_mrowner(Object *obj, Error **errp) +{ + TdxGuest *tdx = TDX_GUEST(obj); + + return g_strdup(tdx->mrowner); +} + +static void tdx_guest_set_mrowner(Object *obj, const char *value, Error **errp) +{ + TdxGuest *tdx = TDX_GUEST(obj); + + g_free(tdx->mrowner); + tdx->mrowner = g_strdup(value); +} + +static char * tdx_guest_get_mrownerconfig(Object *obj, Error **errp) +{ + TdxGuest *tdx = TDX_GUEST(obj); + + return g_strdup(tdx->mrownerconfig); +} + +static void tdx_guest_set_mrownerconfig(Object *obj, const char *value, Error **errp) +{ + TdxGuest *tdx = TDX_GUEST(obj); + + g_free(tdx->mrownerconfig); + tdx->mrownerconfig = g_strdup(value); +} + /* tdx guest */ OBJECT_DEFINE_TYPE_WITH_INTERFACES(TdxGuest, tdx_guest, @@ -590,6 +669,14 @@ static void tdx_guest_init(Object *obj) object_property_add_bool(obj, "sept-ve-disable", tdx_guest_get_sept_ve_disable, tdx_guest_set_sept_ve_disable); + object_property_add_str(obj, "mrconfigid", + tdx_guest_get_mrconfigid, + tdx_guest_set_mrconfigid); + object_property_add_str(obj, "mrowner", + tdx_guest_get_mrowner, tdx_guest_set_mrowner); + object_property_add_str(obj, "mrownerconfig", + tdx_guest_get_mrownerconfig, + tdx_guest_set_mrownerconfig); } static void tdx_guest_finalize(Object *obj) diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h index 432077723ac5..6e39ef3bac13 100644 --- a/target/i386/kvm/tdx.h +++ b/target/i386/kvm/tdx.h @@ -21,6 +21,9 @@ typedef struct TdxGuest { bool initialized; uint64_t attributes; /* TD attributes */ + char *mrconfigid; /* base64 encoded sha348 digest */ + char *mrowner; /* base64 encoded sha348 digest */ + char *mrownerconfig; /* base64 encoded sha348 digest */ } TdxGuest; #ifdef CONFIG_TDX