Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SNP Direct DM-Verity Boot #1952

Merged
merged 24 commits into from Dec 28, 2023
Merged

SNP Direct DM-Verity Boot #1952

merged 24 commits into from Dec 28, 2023

Conversation

darracott
Copy link
Contributor

@darracott darracott commented Oct 30, 2023 •
edited

NOTE: CI is failing on all branches with the same error, including main, see the latest run on main here.

The effect of this PR is to reduce SNP mode boot time from ~20 seconds to ~4 seconds.
This PR also adds linux kernel 6.1 support (the changes to pkg/amdsevsnp/report.go ripped from PR1886) which supersedes PR-1886.

I'm happy to talk through these changes if it would be useful.

Summary:

  • Overall moving SNP mode from booting an initramfs (initrd) in memory, to booting only the kernel + kernel commandline (e.g. the .vmgs file) followed by the kernel directly mounting a DM-Verity protected rootfilesystem on disk rather than in memory. Because the PSP now only needs to measure and attest to the smaller vmgs file, this reduces boot time from ~20 seconds to ~4 seconds.
  • Adds optional debug builds to the Makefile.
  • Adds annotations for dmverity boot options and an annotation to add debug ports on debug builds.
  • Adds PR-1886 linux 6.1 report fetching.

To help reviewers, here's a more detailed summary of the changes :

  • The new boot directory contains the SNP mode startup script (startup.sh) and two debugging startup scripts for the debug builds.
  • blob2vhd.go is a tool to convert devices to VHDs.
  • debuginit.c is an debug init used in the debug builds.
  • changes to both annotations.go and uvm.go are about plumbing new annotations through.
  • In create_lcow.go:
    • in SNP/DM-Verity mode we add two scsi devices, the dmverity protected rootfs and another device containing the dm-verity merkle tree (hashes of all the data in the rootfs).
    • The rest of the changes to create_lcow.go are plumbing annotations through.
  • Changes to report.go are independent, see PR-1886 Testing this PR required those changes so they are here. (If preferred to keep a cleaner history, reviewers can merge that PR quickly now and then those changes don't need to be present here.)

KenGordon and others added 12 commits October 30, 2023 12:48
@KenGordon @darracott
Working DM-Verity boot using 5..15 kernel
da7d569 
Signed-off-by: Ken Gordon <Ken.Gordon@microsoft.com>
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@KenGordon @darracott
Working to boot 6.1 or 5.15 kernels with vhd supplied userland and me…
7160e47 
…rkle tree.

Signed-off-by: Ken Gordon <Ken.Gordon@microsoft.com>
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@KenGordon @darracott
PR microsoft#1886 changes which are required or gcs cannot start on 6.1
e12464a 
Signed-off-by: Ken Gordon <Ken.Gordon@microsoft.com>
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@KenGordon @darracott
Use "modern" igvm tooling from github repo.
0a109c0 
Signed-off-by: Ken Gordon <Ken.Gordon@microsoft.com>
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
Clean up Makefile
c1a26e9 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
Add boot doc
b9293a1 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
Remove startup_2 as it is now redundant
dc5369f 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
Tidying
fb460c7 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
Merge branch 'main' into jp1/dmverityboot
f2e781e
@darracott
print opts
64cdfbe 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
debug
26fe829 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
debug
af397fa 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
Remove extra err
2ba2c53 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
Rm fmt
4eff666 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
Clean up startups
21ca6cc 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
Kick CI
0bc232a 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
Add HvSock port annotation
41ee454 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott darracott changed the title WIP: Jp1/dmverityboot Jp1/dmverityboot Nov 2, 2023
@darracott darracott marked this pull request as ready for review November 2, 2023 15:19
@darracott darracott requested a review from a team as a code owner November 2, 2023 15:19
@helsaawy helsaawy self-assigned this Nov 3, 2023
helsaawy
helsaawy reviewed Nov 13, 2023
View reviewed changes
cmd/blob2vhd/blob2vhd.go Outdated Show resolved Hide resolved
debuginit/debuginit.c Outdated Show resolved Hide resolved
internal/uvm/create_lcow.go Outdated Show resolved Hide resolved
Makefile Outdated Show resolved Hide resolved
boot/bootstrap.md Outdated Show resolved Hide resolved
@kevpar
Copy link
Member

kevpar commented Nov 13, 2023

Can you please update the PR title to a short description of the changes?

We should also either rebase the commits into a logical set, or ensure we squash commits when merging.

anmaxvl
anmaxvl reviewed Nov 14, 2023
View reviewed changes
Makefile Outdated Show resolved Hide resolved
pkg/annotations/annotations.go Outdated Show resolved Hide resolved
internal/uvm/create_lcow.go Outdated Show resolved Hide resolved
internal/uvm/create_lcow.go Outdated Show resolved Hide resolved
@anmaxvl
Copy link
Contributor

anmaxvl commented Nov 15, 2023

also seems like some of the changes are from the PR that has been merged. Can you rebase instead?

@darracott
Merge branch 'main' into jp1/dmverityboot
c135517 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
Clean up merge
5c65ad3 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
Mark ups pre-rebasing
04a595b 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
gofmt
5a820e4 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott
More concise Makefile snp target
1c57243 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@darracott darracott changed the title Jp1/dmverityboot SNP Direct DM-Verity Boot Nov 24, 2023
helsaawy
helsaawy approved these changes Dec 11, 2023
View reviewed changes
Copy link
Contributor

@helsaawy helsaawy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor nits, overall LGTM

Makefile Outdated Show resolved Hide resolved
cmd/tar2ext4/tar2ext4.go Outdated Show resolved Hide resolved
internal/oci/annotations.go Show resolved Hide resolved
@darracott
Apply nits
4e1ace6 
Signed-off-by: Joe Powell <joepowell@microsoft.com>
@helsaawy helsaawy merged commit 4fd5f02 into microsoft:main Dec 28, 2023
18 of 19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kevpar kevpar kevpar left review comments

@anmaxvl anmaxvl anmaxvl left review comments

@helsaawy helsaawy helsaawy approved these changes

Assignees

@anmaxvl anmaxvl

@helsaawy helsaawy

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@darracott @kevpar @anmaxvl @helsaawy @KenGordon