Re: [PATCH v3 0/2] OvmfPkg: Enable measured direct boot on AMD SEV-SNP

["Gerd Hoffmann" <kraxel@redhat.com>]

On Thu, Mar 02, 2023 at 09:15:30AM +0000, Dov Murik wrote:
> AMD SEV and SEV-ES support measured direct boot with
> kernel/initrd/cmdline hashes injected by QEMU and verified by OVMF
> during boot.
> 
> To enable the same approach for AMD SEV-SNP, we declare the kernel
> hashes page in the SNP metadata list as a new region type.  When QEMU
> encounters that region in the list, it will insert the hashes of
> kernel/initrd/cmdline and encrypt the page (or, if the user turned off
> kernel hashes, it will validate the page as a zero page).
> 
> The first patch rearranges the pages in AmdSevX64's MEMFD so they are in
> the same order both as in the main target (OvmfPkgX64), with the
> exception of the SEV Launch Secret page which isn't defined in
> OvmfPkgX64.
> 
> The second patch modifies the SNP metadata structure such that on
> AmdSev target the SEV Launch Secret page is explicitly defined in SNP
> metadata list, and therefore it is not included in the ranges that are
> pre-validated (zero pages) by the VMM; instead the VMM will insert
> content into this page (the hashes table), or mark it explicitly as a
> zero page if no hashes are added.
> 
> This series is available at:
> https://github.com/confidential-containers-demo/edk2/tree/snp-kernel-hashes-v3
> 
> A corresponding QEMU RFC series will be published soon in qemu-devel, or
> use this tree:
> https://github.com/confidential-containers-demo/qemu/tree/snp-kernel-hashes-v3

For the series:
Acked-by: Gerd Hoffmann <kraxel@redhat.com>