Re: [PATCH v2 1/6] qapi/qom,target/i386: sev-guest: Introduce kernel-hashes=on|off option

[Dov Murik <dovmurik@linux.ibm.com>]

On 08/11/2021 17:51, Markus Armbruster wrote:
> Dov Murik <dovmurik@linux.ibm.com> writes:
> 
>> Introduce new boolean 'kernel-hashes' option on the sev-guest object.
>> It will be used to to decide whether to add the hashes of
>> kernel/initrd/cmdline to SEV guest memory when booting with -kernel.
>> The default value is 'off'.
>>
>> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
>> ---
>>  qapi/qom.json     |  7 ++++++-
>>  target/i386/sev.c | 20 ++++++++++++++++++++
>>  qemu-options.hx   |  6 +++++-
>>  3 files changed, 31 insertions(+), 2 deletions(-)
>>
>> diff --git a/qapi/qom.json b/qapi/qom.json
>> index ccd1167808..4fd5d1716b 100644
>> --- a/qapi/qom.json
>> +++ b/qapi/qom.json
>> @@ -769,6 +769,10 @@
>>  # @reduced-phys-bits: number of bits in physical addresses that become
>>  #                     unavailable when SEV is enabled
>>  #
>> +# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a
>> +#                 designated guest firmware page for measured boot
>> +#                 with -kernel (default: false)
> 
> Missing: (since 7.0)
> 

I agree the "since" clause is missing, but I think this series (at least
patches 1-4) should be considered a bug fix (because booting with
-kernel will break in 6.2 for older OVMF which doesn't have guest
firmware area for hashes).

I think it should be added for 6.2.

Paolo?


If agreed, the hunk should be:



--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -769,6 +769,10 @@
 # @reduced-phys-bits: number of bits in physical addresses that become
 #                     unavailable when SEV is enabled
 #
+# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a
+#                 designated guest firmware page for measured boot
+#                 with -kernel (default: false) (since 6.2)
+#
 # Since: 2.12
 ##
 { 'struct': 'SevGuestProperties',




-Dov


>> +#
>>  # Since: 2.12
>>  ##
>>  { 'struct': 'SevGuestProperties',
>> @@ -778,7 +782,8 @@
>>              '*policy': 'uint32',
>>              '*handle': 'uint32',
>>              '*cbitpos': 'uint32',
>> -            'reduced-phys-bits': 'uint32' } }
>> +            'reduced-phys-bits': 'uint32',
>> +            '*kernel-hashes': 'bool' } }
>>  
>>  ##
>>  # @ObjectType:
> 
> [...]
>