github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-09-08 04:09:07 +00:00
Code Issues Projects Releases Wiki Activity

runtime: make SNP IDBlock configurable

Browse Source 
For a use case, we want to set the SNP IDBlock, which allows
configuring the AMD ASP to enforce parameters like expected launch
digest at launch. The struct with the config that should be enforced
(IDBlock) is signed. The public key is placed in the auth block and
the signature is verified by the ASP before launch. The digest of the
public key is also part of the attestation report (ID_KEY_DIGESTS).

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
This commit is contained in:
Paul Meyer
2025-02-11 15:21:01 +01:00
parent 810a6dafad
commit a994f142d0
6 changed files with 79 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/runtime/virtcontainers/hypervisor.go
View File

@@ -461,6 +461,14 @@ type HypervisorConfig struct {
// The user maps to the uid.
User string
// SnpIdBlock is the 96-byte, base64-encoded blob to provide the ‘ID Block’ structure
// for the SNP_LAUNCH_FINISH command defined in the SEV-SNP firmware ABI (default: all-zero)
SnpIdBlock string
// SnpIdAuth is the 4096-byte, base64-encoded blob to provide the ‘ID Authentication Information Structure’
// for the SNP_LAUNCH_FINISH command defined in the SEV-SNP firmware ABI (default: all-zero)
SnpIdAuth string
// KernelParams are additional guest kernel parameters.
KernelParams []Param

42
src/runtime/virtcontainers/qemu_amd64.go
View File

@@ -13,6 +13,7 @@ import (
"time"
"github.com/kata-containers/kata-containers/src/runtime/virtcontainers/types"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"github.com/intel-go/cpuid"
@@ -33,6 +34,10 @@ type qemuAmd64 struct {
sgxEPCSize int64
qgsPort uint32
snpIdBlock string
snpIdAuth string
}
const (
@@ -125,9 +130,11 @@ func newQemuArch(config HypervisorConfig) (qemuArch, error) {
protection: noneProtection,
legacySerial: config.LegacySerial,
},
vmFactory: factory,
snpGuest: config.SevSnpGuest,
qgsPort: config.QgsPort,
vmFactory: factory,
snpGuest: config.SevSnpGuest,
qgsPort: config.QgsPort,
snpIdBlock: config.SnpIdBlock,
snpIdAuth: config.SnpIdAuth,
}
if config.ConfidentialGuest {
@@ -233,7 +240,8 @@ func (q *qemuAmd64) enableProtection() error {
"machine": q.qemuMachine,
"kernel-params-debug": q.kernelParamsDebug,
"kernel-params-non-debug": q.kernelParamsNonDebug,
"kernel-params": q.kernelParams})
"kernel-params": q.kernelParams,
})
switch q.protection {
case tdxProtection:
@@ -303,15 +311,23 @@ func (q *qemuAmd64) appendProtectionDevice(devices []govmmQemu.Device, firmware,
ReducedPhysBits: 1,
}), "", nil
case snpProtection:
return append(devices,
govmmQemu.Object{
Type: govmmQemu.SNPGuest,
ID: "snp",
Debug: false,
File: firmware,
CBitPos: cpuid.AMDMemEncrypt.CBitPosition,
ReducedPhysBits: 1,
}), "", nil
obj := govmmQemu.Object{
Type: govmmQemu.SNPGuest,
ID: "snp",
Debug: false,
File: firmware,
CBitPos: cpuid.AMDMemEncrypt.CBitPosition,
ReducedPhysBits: 1,
}
if q.snpIdBlock != "" && q.snpIdAuth != "" {
obj.SnpIdBlock = q.snpIdBlock
obj.SnpIdAuth = q.snpIdAuth
} else if q.snpIdBlock != "" {
return nil, "", errors.New("specifying SNP IDBlock without SNP IDAuth is not allowed")
} else if q.snpIdAuth != "" {
return nil, "", errors.New("specifying SNP IDAuth without SNP IDBlock is not allowed")
}
return append(devices, obj), "", nil
case noneProtection:
return devices, firmware, nil