KVM SEV-SNP kernel hashes and ID block support - #8123
Merged
Merged
Conversation
rhakobyan
force-pushed
the
sev-snp-kernel-hashes
branch
2 times, most recently
from
May 1, 2026 03:32
80c3d6f to
6974ccd
Compare
rhakobyan
marked this pull request as ready for review
May 1, 2026 07:59
rhakobyan
force-pushed
the
sev-snp-kernel-hashes
branch
3 times, most recently
from
May 1, 2026 15:14
1096def to
5063720
Compare
For KVM SEV-SNP guests, the VMM should not modify the kernel boot header before sending it via fw_cfg. The guest firmware is expected to set fields like type_of_loader itself. For upcoming measured boot logic for SEV-SNP, modifying `type_of_loader` causes the kernel hash computed by the VMM to diverge from the hash that `sev-snp-measure` (and the guest firmware) compute, resulting in a launch measurement mismatch. This matches QEMU's behavior, which skips kernel header modifications for confidential guests so the data sent via fw_cfg matches the original kernel file provided by the user. Signed-off-by: Ruben Hakobyan <[email protected]>
This introduces the kernel hashes measured boot table into cloud hypervisor if a cmdline and kernel is passed into an SEV-SNP CVM, incorporating a kernel/cmdline/optional initrd into a memory page that is measured into the launch digest of a SEV-SNP CVM. If both --kernel and --cmdline are not provided, we do not insert this data page Signed-off-by: Kevin Hui <[email protected]>
rhakobyan
force-pushed
the
sev-snp-kernel-hashes
branch
from
May 1, 2026 16:33
5063720 to
eec17a2
Compare
Verify the SEV hash table layout, GUID placement, kernel/initrd/cmdline digest values, and the setup_sects > boot_params size branch. These guard against silent regressions in the launch digest computation. Signed-off-by: Kevin Hui <[email protected]>
Introduce the KVM_SNP_PAGE_TYPE_ZERO page type for ZERO pages. AMD SEV SNP can accept ZERO pages as a page in which the page memory is functionally just zeroes Signed-off-by: Kevin Hui <[email protected]>
rhakobyan
force-pushed
the
sev-snp-kernel-hashes
branch
from
May 1, 2026 16:36
eec17a2 to
46de765
Compare
Preserve the original IGVM import order for KVM SNP launch updates. The launch digest is order-sensitive, so only coalesce adjacent pages that already share the same page type and size. MSHV continues to sort by GPA for hypercall batching. Signed-off-by: Kevin Hui <[email protected]>
Extract the SNP guest policy from IGVM initialization headers when available, falling back to the default policy. This matches QEMU's behaviour where only a non-zero IGVM policy overrides the default. Signed-off-by: Ruben Hakobyan <[email protected]>
Add KvmSevSnpIdBlock and KvmSevSnpIdAuth structs matching the AMD SEV-SNP Firmware ABI Spec (Rev 1.58), and build them from the IGVM SNP ID block directive during launch finish. This properly populates id_block_uaddr/id_auth_uaddr in KVM_SEV_SNP_LAUNCH_FINISH and derives auth_key_en from the assembled author key, matching QEMU's behavior. Thread the guest policy from sev_snp_init to launch_finish via an atomic on KvmVm so the ID block gets the correct policy value. Also track has_snp_id_block in IgvmLoadedInfo to enable the ID block based on whether the IGVM file actually contains one, rather than hardcoding it for KVM. Signed-off-by: Ruben Hakobyan <[email protected]>
rhakobyan
force-pushed
the
sev-snp-kernel-hashes
branch
from
May 1, 2026 16:39
46de765 to
5c6642d
Compare
rbradford
approved these changes
May 1, 2026
Merged
via the queue into
cloud-hypervisor:main
with commit May 1, 2026
c97d635
77 of 79 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds measured boot support for AMD SEV-SNP confidential VMs launched via Cloud Hypervisor with IGVM, bringing parity with QEMU's SEV-SNP launch flow.
The core goal is to ensure the guest's launch measurement accurately reflects the kernel, command line, and initrd provided by the VMM — and to pass a signed SNP ID block so the guest (or a remote attestor) can verify the launch against a known identity.
The kernel hashes patches are taken from #8084, and cleaned up. The ID Block patches largely follow the same principles in QEMU.
Testing
Step 1: Build Stage0 Firmware
Stage0 is built from the Project Oak
stage0_bin.Step 2: Create a Signed SNP ID Block
2a. Compute the launch measurement
--vcpu-sig: CPU signature from CPUID leaf 1 EAX--ovmf: the rawstage0_bin--append: must exactly match--cmdlinepassed to cloud-hypervisor later2b. Generate keys (example):
2c. Generate the ID block
--idkey/--authorkey: ECDSA P-384 private key PEM files--policymust match the guest policyStep 3: Build the IGVM File
Step 4: Launch Cloud-Hypervisor
4a. Build
cargo build --release --no-default-features --features "kvm,igvm,sev_snp,fw_cfg"4b. Run
sudo ./target/release/cloud-hypervisor -vv \ --platform sev_snp=on \ --igvm stage0.igvm \ --kernel vmlinuz \ --cpus boot=4 \ --memory size=2G,shared=on \ --disk path=guest.qcow2,image_type=qcow2 \ --cmdline "console=ttyS0 root=/dev/vda1 rw" \ --serial tty \ --console off4c. Verify attestation (from inside the guest)
# Get attestation report from AMD PSP snpguest report /tmp/report.bin /tmp/request.bin --random snpguest display report /tmp/report.bin Attestation Report (1184 bytes): Version: 5 Guest SVN: 0 Guest Policy (0x230000): ABI Major: 0 ABI Minor: 0 SMT Allowed: 1 Migrate MA: 0 Debug Allowed: 0 Single Socket: 0 ... Measurement: 53 c4 f9 7b 9e 99 4a c6 a9 31 76 ac a0 b8 e8 50 17 ba e9 81 27 6d 63 6d ff 71 29 83 4c cf cf ac 4b 33 83 e9 ec dd 90 b3 8e bf 47 1e bb 4c 6f b7Measurement matches 2a.