On Fri, Feb 05, 2021 at 12:45:18PM +0100, Paolo Bonzini wrote: > On 05/02/21 12:37, Daniel P. Berrangé wrote: > > On Fri, Feb 05, 2021 at 11:58:26AM +0100, Paolo Bonzini wrote: > > > On 05/02/21 10:51, Daniel P. Berrangé wrote: > > > > > + if (!pc_system_ovmf_table_find(SEV_SECRET_GUID, &data, > > > > > NULL)) { > > > > > + error_setg(errp, "SEV: no secret area found in OVMF," > > > > > + " gpa must be specified."); > > > > > + return; > > > > > + } > > > > IIUC, historically QEMU has gone out of its way to avoid creating a > > > > direct dependancy on specific firmware implementation details such > > > > as this, so this whole approach makes me feel really uneasy. > > > > > > The problem here is that this secret must be measured and therefore cannot > > > be extracted by the guest out of fw_cfg. Note that there's no reason why > > > other firmware than OVMF could not adopt the same interface. > > > > I didn't mean to store the secret in fw_cfg. Rather to use fw_cfg as a > > way for OVMF to tell QEMU where to store it > > I may be misunderstanding, but I think QEMU has to store it before OVMF > runs, because the measurement is "sealed" when the VM starts.
Oh, right, I see what you mean Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|