On Mon, Nov 08, 2021 at 08:20:48PM +0200, Dov Murik wrote: > > > On 08/11/2021 17:51, Markus Armbruster wrote: > > Dov Murik <dovmu...@linux.ibm.com> writes: > > > >> Introduce new boolean 'kernel-hashes' option on the sev-guest object. > >> It will be used to to decide whether to add the hashes of > >> kernel/initrd/cmdline to SEV guest memory when booting with -kernel. > >> The default value is 'off'. > >> > >> Signed-off-by: Dov Murik <dovmu...@linux.ibm.com> > >> --- > >> qapi/qom.json | 7 ++++++- > >> target/i386/sev.c | 20 ++++++++++++++++++++ > >> qemu-options.hx | 6 +++++- > >> 3 files changed, 31 insertions(+), 2 deletions(-) > >> > >> diff --git a/qapi/qom.json b/qapi/qom.json > >> index ccd1167808..4fd5d1716b 100644 > >> --- a/qapi/qom.json > >> +++ b/qapi/qom.json > >> @@ -769,6 +769,10 @@ > >> # @reduced-phys-bits: number of bits in physical addresses that become > >> # unavailable when SEV is enabled > >> # > >> +# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a > >> +# designated guest firmware page for measured boot > >> +# with -kernel (default: false) > > > > Missing: (since 7.0) > > > > I agree the "since" clause is missing, but I think this series (at least > patches 1-4) should be considered a bug fix (because booting with > -kernel will break in 6.2 for older OVMF which doesn't have guest > firmware area for hashes). > > I think it should be added for 6.2. > > Paolo? > > > If agreed, the hunk should be:
Yes, the kernel hashes feature was introduced in this 6.2 dev cycle, and this patch is fixing a significant behavioural problem with it. We need this included in the 6.2 release Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
