On 25/05/2021 9:59, Dov Murik wrote:
> From: James Bottomley <j...@linux.ibm.com>
>
> If the VM is using memory encryption and also specifies a kernel/initrd
> or appended command line, calculate the hashes and add them to the
> encrypted data. For this to work, OVMF must support an encrypted area
> to place the data which is advertised via a special GUID in the OVMF
> reset table (if the GUID doesn't exist, the user isn't allowed to pass
> in the kernel/initrd/cmdline via the fw_cfg interface).
>
> The hashes of each of the files is calculated (or the string in the case
> of the cmdline with trailing '\0' included). Each entry in the hashes
> table is GUID identified and since they're passed through the memcrypt
> interface, the hash of the encrypted data will be accumulated by the
> PSP.
>
> Signed-off-by: James Bottomley <j...@linux.ibm.com>
> Signed-off-by: Dov Murik <dovmu...@linux.ibm.com>
> [dovmu...@linux.ibm.com: use machine->cgs, remove parsing of GUID
> strings, remove GCC pragma, fix checkpatch errors]
> ---
>
> OVMF support for handling the table of hashes (verifying that the
> kernel/initrd/cmdline passed via the fw_cfg interface indeed correspond
> to the measured hashes in the table) will be posted soon to edk2-devel.
>
OVMF support was submitted to edk2-devel (patch series "Measured SEV
boot with kernel/initrd/cmdline"), which starts here:
https://edk2.groups.io/g/devel/topic/patch_v1_0_8_measured_sev/83074450
-Dov
