From nobody Fri May 17 04:49:23 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1675759340; cv=none; d=zohomail.com; s=zohoarc; b=geYrEmqYK4KkccC7R9yldZyfLVNKNq72IQasAfn8xm2+E6KLKu8oihpjW/ZeSlj1OwEHgPijuav+l/+zWEI9ZUqi/cygJX40l+PIzYZ7plqICgCOYQDKxEBiEIBluvXN/5Ic5vZN7C5UlXaIUpchErIzdoDtPS0UOTTnwC/jMDs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1675759340; h=Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=1jYPxsby7mgt0KD38Gi2aCJ6aMWLn8Z6FZmZcEKbDMA=; b=FmkuoCPISvjo+cZlGEF0Lcmfx5BRvief++/7lqjfSxJI2JjA9O1HjiyTglZRJpCaWyk287QbMWXgX4tMFXNxJeFYYBIpNEkASsIDPCRemS4mNousf8upXVYo7fF5BOPiT7/qjMo2A86hEAlKlhaxBRU00musYoIdbnedZt64EQ8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1675759340173967.8334933420174; Tue, 7 Feb 2023 00:42:20 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pPJXr-0007PX-O4; Tue, 07 Feb 2023 03:41:43 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pPJXn-0007O4-U9 for qemu-devel@nongnu.org; Tue, 07 Feb 2023 03:41:40 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pPJXl-00036S-JL for qemu-devel@nongnu.org; Tue, 07 Feb 2023 03:41:39 -0500 Received: from pps.filterd (m0187473.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 3178MKj6033283; Tue, 7 Feb 2023 08:41:31 GMT Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3nkk2xgbvf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Feb 2023 08:41:30 +0000 Received: from m0187473.ppops.net (m0187473.ppops.net [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 3178ZgPO036400; Tue, 7 Feb 2023 08:41:30 GMT Received: from ppma01wdc.us.ibm.com (fd.55.37a9.ip4.static.sl-reverse.com [169.55.85.253]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3nkk2xgbuq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Feb 2023 08:41:30 +0000 Received: from pps.filterd (ppma01wdc.us.ibm.com [127.0.0.1]) by ppma01wdc.us.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 3178Rnn6001041; Tue, 7 Feb 2023 08:41:28 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([9.208.129.119]) by ppma01wdc.us.ibm.com (PPS) with ESMTPS id 3nhf076ytd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Feb 2023 08:41:28 +0000 Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 3178fQOO30671292 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Feb 2023 08:41:27 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A304358055; Tue, 7 Feb 2023 08:41:26 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D55DE58043; Tue, 7 Feb 2023 08:41:25 +0000 (GMT) Received: from amdrome3.watson.ibm.com (unknown [9.2.130.16]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Tue, 7 Feb 2023 08:41:25 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : content-transfer-encoding : mime-version; s=pp1; bh=1jYPxsby7mgt0KD38Gi2aCJ6aMWLn8Z6FZmZcEKbDMA=; b=eoOW5ifJpT7zn5IH80x7/lBb1wW+tw4qDs5R3Evy7p096E6gdx9H5YfvyxCWh4SyjrLV gFBf9uEYCPvCZACiTm/AfYypd8qgIjtBsewpeKniKLnu/8+R2TYnrhDzu9v9wN5pgQx/ +AHhKL2uncmNJii/cG5Ra0YadvzAQIgMcYx/bahKKgtkcuJ4rALQ4o8qm/nKcTOfZeC2 m/efx3pcdLuGMqf/wgH4fPRSe9Tv8izHp7vB2z10IE5NPjNj6eFHGNj4REat5JzvQyD3 kAK5hwhN6geX1p4+oPGhwh9ub6XO0CxdTNbs4EggkKBSkVx9q8KOaRpJQR10PH1Y5nmQ 7Q== From: Dov Murik To: qemu-devel@nongnu.org Cc: Dov Murik , Tom Lendacky , "Jason A. Donenfeld" , James Bottomley , Gerd Hoffmann , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , "H. Peter Anvin" , Paolo Bonzini , Richard Henderson , Eduardo Habkost , "Michael S. Tsirkin" , Marcel Apfelbaum , Tobin Feldman-Fitzthum Subject: [PATCH] x86: Don't add RNG seed to Linux cmdline for SEV guests Date: Tue, 7 Feb 2023 08:41:16 +0000 Message-Id: <20230207084116.285787-1-dovmurik@linux.ibm.com> X-Mailer: git-send-email 2.25.1 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: RrffsNN6QPZzDuNo5_5AByA9ugaYkdqF X-Proofpoint-ORIG-GUID: u56_dapRxGFjLFlZABxxGt6a9xm0o8fO Content-Transfer-Encoding: quoted-printable X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.930,Hydra:6.0.562,FMLib:17.11.122.1 definitions=2023-02-07_02,2023-02-06_03,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1011 lowpriorityscore=0 malwarescore=0 adultscore=0 priorityscore=1501 phishscore=0 suspectscore=0 mlxlogscore=999 bulkscore=0 mlxscore=0 spamscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2302070077 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=dovmurik@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1675759341617100003 Content-Type: text/plain; charset="utf-8" Recent feature to supply RNG seed to the guest kernel modifies the kernel command-line by adding extra data at its end; this breaks measured boot with SEV and OVMF, and possibly signed boot. Specifically SEV doesn't miss this feature because it uses UEFI/OVMF which has its own way of getting random seed (not to mention that getting the random seed from the untrusted host breaks the confidential computing trust model). Disable the RNG seed feature in SEV guests. Fixes: eac7a7791bb6 ("x86: don't let decompressed kernel image clobber setu= p_data") Reported-by: Tom Lendacky Signed-off-by: Dov Murik --- There might be a need for a wider change to the ways setup_data entries are handled in x86_load_linux(); here I just try to restore the situation for SEV guests prior to the addition of the SETUP_RNG_SEED entry. Recent discussions on other (safer?) ways to pass this setup_data entry: [1] https://lore.kernel.org/qemu-devel/da39abab9785aea2a2e7652ed6403b6268ae= b31f.camel@linux.ibm.com/ Note that in qemu 7.2.0 this is broken as well -- there the SETUP_RNG_SEED entry is appended to the Linux kernel data (and therefore modifies and breaks the measurement of the kernel in SEV measured boot). A similar fix will be needed there (but I fear this patch cannot be applied as-is). --- hw/i386/x86.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/i386/x86.c b/hw/i386/x86.c index eaff4227bd..e65a83f8df 100644 --- a/hw/i386/x86.c +++ b/hw/i386/x86.c @@ -1103,7 +1103,7 @@ void x86_load_linux(X86MachineState *x86ms, load_image_size(dtb_filename, setup_data->data, dtb_size); } =20 - if (!legacy_no_rng_seed && protocol >=3D 0x209) { + if (!legacy_no_rng_seed && protocol >=3D 0x209 && !sev_enabled()) { setup_data_offset =3D cmdline_size; cmdline_size +=3D sizeof(SetupData) + RNG_SEED_LENGTH; kernel_cmdline =3D g_realloc(kernel_cmdline, cmdline_size); base-commit: 6661b8c7fe3f8b5687d2d90f7b4f3f23d70e3e8b --=20 2.25.1