[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory
From: |
Ard Biesheuvel |
Subject: |
Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory |
Date: |
Thu, 4 Aug 2022 14:16:25 +0200 |
On Thu, 4 Aug 2022 at 14:11, Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> On Thu, Aug 04, 2022 at 02:03:29PM +0200, Jason A. Donenfeld wrote:
> > Hi Daniel,
> >
> > On Thu, Aug 04, 2022 at 10:25:36AM +0100, Daniel P. Berrangé wrote:
> > > Yep, and ultimately the inability to distinguish UEFI vs other firmware
> > > is arguably correct by design, as the QEMU <-> firmware interface is
> > > supposed to be arbitrarily pluggable for any firmware implementation
> > > not limited to merely UEFI + seabios.
> >
> > Indeed, I agree with this.
> >
> > >
> > > > For now I suggest either reverting the original patch, or at least not
> > > > enabling the knob by default for any machine types. In particular, when
> > > > using MicroVM, the user must leave the knob disabled when direct booting
> > > > a kernel on OVMF, and the user may or may not enable the knob when
> > > > direct booting a kernel on SeaBIOS.
> > >
> > > Having it opt-in via a knob would defeat Jason's goal of having the seed
> > > available automatically.
> >
> > Yes, adding a knob is absolutely out of the question.
> >
> > It also doesn't actually solve the problem: this triggers when QEMU
> > passes a DTB too. It's not just for the new RNG seed thing. This bug
> > isn't new.
>
> In the other thread I also mentioned that this RNG Seed addition has
> caused a bug with AMD SEV too, making boot measurement attestation
> fail because the kernel blob passed to the firmware no longer matches
> what the tenant expects, due to the injected seed.
>
I was actually expecting this to be an issue in the
signing/attestation department as well, and you just confirmed my
suspicion.
But does this mean that populating the setup_data pointer is out of
the question altogether? Or only that putting the setup_data linked
list nodes inside the image is a problem?
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, (continued)
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Daniel P . Berrangé, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Ard Biesheuvel, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Laszlo Ersek, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Jason A. Donenfeld, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Jason A. Donenfeld, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Laszlo Ersek, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Jason A. Donenfeld, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Laszlo Ersek, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Jason A. Donenfeld, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Daniel P . Berrangé, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory,
Ard Biesheuvel <=
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Jason A. Donenfeld, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Jason A. Donenfeld, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Laszlo Ersek, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Jason A. Donenfeld, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Laszlo Ersek, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Daniel P . Berrangé, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Laszlo Ersek, 2022/08/04
- Re: [PATCH v2] hw/i386: place setup_data at fixed place in memory, Jason A. Donenfeld, 2022/08/04
- [PATCH v3] hw/i386: place setup_data at fixed place in memory, Jason A. Donenfeld, 2022/08/04
- Re: [PATCH v3] hw/i386: place setup_data at fixed place in memory, Paolo Bonzini, 2022/08/05