Re: [PATCH v2 1/6] qapi/qom,target/i386: sev-guest: Introduce kernel-hashes=on|off option

[Dov Murik <dovmurik@linux.ibm.com>]

On 11/11/2021 11:26, Daniel P. Berrangé wrote:
> On Mon, Nov 08, 2021 at 08:20:48PM +0200, Dov Murik wrote:
>>
>>
>> On 08/11/2021 17:51, Markus Armbruster wrote:
>>> Dov Murik <dovmurik@linux.ibm.com> writes:
>>>
>>>> Introduce new boolean 'kernel-hashes' option on the sev-guest object.
>>>> It will be used to to decide whether to add the hashes of
>>>> kernel/initrd/cmdline to SEV guest memory when booting with -kernel.
>>>> The default value is 'off'.
>>>>
>>>> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
>>>> ---
>>>>  qapi/qom.json     |  7 ++++++-
>>>>  target/i386/sev.c | 20 ++++++++++++++++++++
>>>>  qemu-options.hx   |  6 +++++-
>>>>  3 files changed, 31 insertions(+), 2 deletions(-)
>>>>
>>>> diff --git a/qapi/qom.json b/qapi/qom.json
>>>> index ccd1167808..4fd5d1716b 100644
>>>> --- a/qapi/qom.json
>>>> +++ b/qapi/qom.json
>>>> @@ -769,6 +769,10 @@
>>>>  # @reduced-phys-bits: number of bits in physical addresses that become
>>>>  #                     unavailable when SEV is enabled
>>>>  #
>>>> +# @kernel-hashes: if true, add hashes of kernel/initrd/cmdline to a
>>>> +#                 designated guest firmware page for measured boot
>>>> +#                 with -kernel (default: false)
>>>
>>> Missing: (since 7.0)
>>>
>>
>> I agree the "since" clause is missing, but I think this series (at least
>> patches 1-4) should be considered a bug fix (because booting with
>> -kernel will break in 6.2 for older OVMF which doesn't have guest
>> firmware area for hashes).
>>
>> I think it should be added for 6.2.
>>
>> Paolo?
>>
>>
>> If agreed, the hunk should be:
> 
> Yes, the kernel hashes feature was introduced in this 6.2 dev
> cycle, and this patch is fixing a significant behavioural
> problem with it. We need this included in the 6.2 release
> 

Thanks for reviewing.

I'll shortly send a v3 with the minor doc/string changes suggested here
(patches 1 and 3).

-Dov