summary refs log tree commit diff stats
path: root/gitlab/issues_text/target_missing/host_missing/accel_missing/1142
diff options
context:
space:
mode:
authorChristian Krinitsin <mail@krinitsin.com>2025-06-01 21:35:14 +0200
committerChristian Krinitsin <mail@krinitsin.com>2025-06-01 21:35:14 +0200
commit3e4c5a6261770bced301b5e74233e7866166ea5b (patch)
tree9379fddaba693ef8a045da06efee8529baa5f6f4 /gitlab/issues_text/target_missing/host_missing/accel_missing/1142
parente5634e2806195bee44407853c4bf8776f7abfa4f (diff)
downloadqemu-analysis-3e4c5a6261770bced301b5e74233e7866166ea5b.tar.gz
qemu-analysis-3e4c5a6261770bced301b5e74233e7866166ea5b.zip
clean up repository
Diffstat (limited to 'gitlab/issues_text/target_missing/host_missing/accel_missing/1142')
-rw-r--r--gitlab/issues_text/target_missing/host_missing/accel_missing/114246
1 files changed, 0 insertions, 46 deletions
diff --git a/gitlab/issues_text/target_missing/host_missing/accel_missing/1142 b/gitlab/issues_text/target_missing/host_missing/accel_missing/1142
deleted file mode 100644
index a4b690029..000000000
--- a/gitlab/issues_text/target_missing/host_missing/accel_missing/1142
+++ /dev/null
@@ -1,46 +0,0 @@
-Measurements fail with direct kernel boot for AMD SEV confidential virtualization with 7.1 machine type
-Description of problem:
-When booting the QEMU with the 'kernel-hashes:true' property set for 'sev-guest' confidential virtualization, the contents of the `-kernel` file are measured by the firmware.
-
-A remote tenant can then validate the measurement against its expected contents to see if the boot was trustworthy.
-
-With the pc-q35-7.1 machine type the measurement always fails to validate against expected state.
-
-Making the following code change 
-
-```
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 7280c02ce3..3a4bf5cba3 100644
---- a/hw/i386/pc.c
-+++ b/hw/i386/pc.c
-@@ -1899,6 +1899,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
-     pcmc->rsdp_in_ram = true;
-     pcmc->smbios_defaults = true;
-     pcmc->smbios_uuid_encoded = true;
-+    pcmc->legacy_no_rng_seed = true;
-+
-     pcmc->gigabyte_align = true;
-     pcmc->has_reserved_memory = true;
-     pcmc->kvmclock_enabled = true;
-```
-
-results in successfully validating the measurement.
-
-THis is not surprising, the RNG seed patch introduced in 
-
-```
-commit 67f7e426e53833a5db75b0d813e8d537b8a75bd2
-Author: Jason A. Donenfeld <Jason@zx2c4.com>
-Date:   Thu Jul 21 14:56:36 2022 +0200
-
-    hw/i386: pass RNG seed via setup_data entry
-```
-
-intentionally modifies the contents of the kernel image before passing it to the firmware, to inject a random seed. This will ensure the boot measuremnts are different every time.
-
-This RNG seed functionality must NOT be used when AMD SEV is active.
-Steps to reproduce:
-1. Create an AMD SEV guest with kernel-hashes=true and pc-q35-7.1 machine type
-2. Attempt to validate the boot measurement
-Additional information:
-