Re: [PATCH v3 2/2] sev: update sev-inject-launch-secret to make gpa optional

From: "Daniel P. Berrangé" <berrange@redhat.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: thomas.lendacky@amd.com, ashish.kalra@amd.com,
	brijesh.singh@amd.com, david.kaplan@amd.com,
	James Bottomley <jejb@linux.ibm.com>,
	jon.grimm@amd.com, tobin@ibm.com, qemu-devel@nongnu.org,
	"Dr . David Alan Gilbert" <dgilbert@redhat.com>,
	frankeh@us.ibm.com, Dov.Murik1@il.ibm.com,
	dovmurik@linux.vnet.ibm.com
Subject: Re: [PATCH v3 2/2] sev: update sev-inject-launch-secret to make gpa optional
Date: Fri, 5 Feb 2021 11:51:29 +0000	[thread overview]
Message-ID: <20210205115129.GI908621@redhat.com> (raw)
In-Reply-To: <263306b6-52c5-6da8-7f58-b639eb74c40d@redhat.com>

On Fri, Feb 05, 2021 at 12:45:18PM +0100, Paolo Bonzini wrote:
> On 05/02/21 12:37, Daniel P. Berrangé wrote:
> > On Fri, Feb 05, 2021 at 11:58:26AM +0100, Paolo Bonzini wrote:
> > > On 05/02/21 10:51, Daniel P. Berrangé wrote:
> > > > > +        if (!pc_system_ovmf_table_find(SEV_SECRET_GUID, &data, NULL)) {
> > > > > +            error_setg(errp, "SEV: no secret area found in OVMF,"
> > > > > +                       " gpa must be specified.");
> > > > > +            return;
> > > > > +        }
> > > > IIUC, historically QEMU has gone out of its way to avoid creating a
> > > > direct dependancy on specific firmware implementation details such
> > > > as this, so this whole approach makes me feel really uneasy.
> > > 
> > > The problem here is that this secret must be measured and therefore cannot
> > > be extracted by the guest out of fw_cfg.  Note that there's no reason why
> > > other firmware than OVMF could not adopt the same interface.
> > 
> > I didn't mean to store the secret in fw_cfg. Rather to use fw_cfg as a
> > way for OVMF to tell QEMU where to store it
> 
> I may be misunderstanding, but I think QEMU has to store it before OVMF
> runs, because the measurement is "sealed" when the VM starts.

Oh, right, I see what you mean

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|