Re: [PATCH v2 1/6] qapi/qom,target/i386: sev-guest: Introduce kernel-hashes=on|off option

[Daniel P . Berrangé]

On Mon, Nov 08, 2021 at 08:20:48PM +0200, Dov Murik wrote:
> 
> 
> On 08/11/2021 17:51, Markus Armbruster wrote:
> > Dov Murik <dovmurik@linux.ibm.com> writes:
> > 
> >> Introduce new boolean 'kernel-hashes' option on the sev-guest object.
> >> It will be used to to decide whether to add the hashes of
> >> kernel/initrd/cmdline to SEV guest memory when booting with -kernel.
> >> The default value is 'off'.
> >>
> >> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
> >> ---
> >>  qapi/qom.json     |  7 ++++++-
> >>  target/i386/sev.c | 20 ++++++++++++++++++++
> >>  qemu-options.hx   |  6 +++++-
> >>  3 files changed, 31 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/qapi/qom.json b/qapi/qom.json
> >> index ccd1167808..4fd5d1716b 100644
> >> --- a/qapi/qom.json
> >> +++ b/qapi/qom.json
> >> @@ -769,6 +769,10 @@
> >>  # @reduced-phys-bits: number of bits in physical addresses that become
> >>  #                     unavailable when SEV is enabled
> >>  #
> >> +# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a
> >> +#                 designated guest firmware page for measured boot
> >> +#                 with -kernel (default: false)
> > 
> > Missing: (since 7.0)
> > 
> 
> I agree the "since" clause is missing, but I think this series (at least
> patches 1-4) should be considered a bug fix (because booting with
> -kernel will break in 6.2 for older OVMF which doesn't have guest
> firmware area for hashes).
> 
> I think it should be added for 6.2.
> 
> Paolo?
> 
> 
> If agreed, the hunk should be:

Yes, the kernel hashes feature was introduced in this 6.2 dev
cycle, and this patch is fixing a significant behavioural
problem with it. We need this included in the 6.2 release


Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|