On 7/20/21 3:04 AM, Dov Murik wrote: > In the AmdSevX64 build, use BlobVerifierLibSevHashes to enforce > verification of hashes of the kernel/initrd/cmdline blobs fetched from > firmware config. > > This allows for secure (measured) boot of SEV guests with QEMU's > -kernel/-initrd/-append switches (with the corresponding QEMU support > for injecting the hashes table into initial measured guest memory). > > Cc: Ard Biesheuvel <[email protected]> > Cc: Jordan Justen <[email protected]> > Cc: Ashish Kalra <[email protected]> > Cc: Brijesh Singh <[email protected]> > Cc: Erdem Aktas <[email protected]> > Cc: James Bottomley <[email protected]> > Cc: Jiewen Yao <[email protected]> > Cc: Min Xu <[email protected]> > Cc: Tom Lendacky <[email protected]> > Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457 > Signed-off-by: Dov Murik <[email protected]>
Reviewed-by: Tom Lendacky <[email protected]> > --- > OvmfPkg/AmdSev/AmdSevX64.dsc | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#77980): https://edk2.groups.io/g/devel/message/77980 Mute This Topic: https://groups.io/mt/84328242/21656 Group Owner: [email protected] Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
