On Tue, Sep 06, 2022 at 12:46:32PM +0200, Jason A. Donenfeld wrote: > On Tue, Sep 06, 2022 at 06:45:34AM -0400, Michael S. Tsirkin wrote: > > On Tue, Sep 06, 2022 at 12:43:55PM +0200, Jason A. Donenfeld wrote: > > > On Tue, Sep 6, 2022 at 12:40 PM Michael S. Tsirkin <m...@redhat.com> > > > wrote: > > > > > > > > On Tue, Sep 06, 2022 at 12:36:56PM +0200, Jason A. Donenfeld wrote: > > > > > It's only safe to modify the setup_data pointer on newer kernels where > > > > > the EFI stub loader will ignore it. So condition setting that offset > > > > > on > > > > > the newer boot protocol version. While we're at it, gate this on SEV > > > > > too. > > > > > This depends on the kernel commit linked below going upstream. > > > > > > > > > > Cc: Gerd Hoffmann <kra...@redhat.com> > > > > > Cc: Laurent Vivier <laur...@vivier.eu> > > > > > Cc: Michael S. Tsirkin <m...@redhat.com> > > > > > Cc: Paolo Bonzini <pbonz...@redhat.com> > > > > > Cc: Peter Maydell <peter.mayd...@linaro.org> > > > > > Cc: Philippe Mathieu-Daudé <f4...@amsat.org> > > > > > Cc: Richard Henderson <richard.hender...@linaro.org> > > > > > Cc: Ard Biesheuvel <a...@kernel.org> > > > > > Link: > > > > > https://lore.kernel.org/linux-efi/20220904165321.1140894-1-ja...@zx2c4.com/ > > > > > Signed-off-by: Jason A. Donenfeld <ja...@zx2c4.com> > > > > > > > > BTW what does it have to do with SEV? > > > > Is this because SEV is not going to trust the data to be random anyway? > > > > > > Daniel (now CC'd) pointed out in one of the previous threads that this > > > breaks SEV, because the image hash changes. > > > > > > Jason > > > > Oh I see. I'd add a comment maybe and definitely mention this > > in the commit log. > > Sure, will do.
Actually, I'm wrong. This is already done implicitly below with a huge comment: /* * If we're starting an encrypted VM, it will be OVMF based, which uses the * efi stub for booting and doesn't require any values to be placed in the * kernel header. We therefore don't update the header so the hash of the * kernel on the other side of the fw_cfg interface matches the hash of the * file the user passed in. */ if (!sev_enabled()) { memcpy(setup, header, MIN(sizeof(header), setup_size)); } So I'll remove the SEV bit from this commit. Whoops. Glad you asked about it. Jason