[edk2-devel] [PATCH v3 0/6] SEV Encrypted Boot for Ovmf
Laszlo Ersek
lersek at redhat.com
Mon Dec 14 19:57:35 UTC 2020
Hi James,
On 12/04/20 03:01, Laszlo Ersek wrote:
> On 12/04/20 02:55, Laszlo Ersek wrote:
>
>> I will send a short patch series to add the exceptions, and once
>> that's upstream, we *will* merge this (v3) series.
>
> BTW the tweaks I added on top of your v3, in
> <https://github.com/tianocore/edk2/pull/1175>, are as follows (git
> range-diff output):
>
>> 1: 4020c20b2342 ! 1: b96494ad75db OvmfPkg/ResetVector: convert SEV-ES Reset Block structure to be GUIDed
>> @@ -8,8 +8,9 @@
>>
>> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3077
>> Signed-off-by: James Bottomley <jejb at linux.ibm.com>
>> -
>> Message-Id: <20201130202819.3910-2-jejb at linux.ibm.com>
>> + Acked-by: Ard Biesheuvel <ard.biesheuvel at arm.com>
>> + Reviewed-by: Laszlo Ersek <lersek at redhat.com>
>>
>> diff --git a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm b/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm
>> --- a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm
>> 2: 488fbdbe7689 ! 2: acc8cb13da8d OvmfPkg/Amdsev: Base commit to build encrypted boot specific OVMF
>> @@ -11,8 +11,9 @@
>>
>> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3077
>> Signed-off-by: James Bottomley <jejb at linux.ibm.com>
>> -
>> Message-Id: <20201130202819.3910-3-jejb at linux.ibm.com>
>> + Acked-by: Ard Biesheuvel <ard.biesheuvel at arm.com>
>> + Reviewed-by: Laszlo Ersek <lersek at redhat.com>
>>
>> diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
>> new file mode 100644
>> 3: 796ec96e3414 ! 3: b80ce0838781 OvmfPkg/AmdSev: add Grub Firmware Volume Package
>> @@ -19,8 +19,10 @@
>>
>> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3077
>> Signed-off-by: James Bottomley <jejb at linux.ibm.com>
>> -
>> Message-Id: <20201130202819.3910-4-jejb at linux.ibm.com>
>> + Acked-by: Ard Biesheuvel <ard.biesheuvel at arm.com>
>> + [lersek at redhat.com: replace local variable initialization with assignment]
>> + Reviewed-by: Laszlo Ersek <lersek at redhat.com>
>>
>> diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec
>> --- a/OvmfPkg/OvmfPkg.dec
>> @@ -779,7 +781,9 @@
>> +{
>> + EFI_HANDLE Handle;
>> + EFI_STATUS Status;
>> -+ UINT16 FrontPageTimeout = 0;
>> ++ UINT16 FrontPageTimeout;
>> ++
>> ++ FrontPageTimeout = 0;
>> +
>> + DEBUG ((DEBUG_INFO, "PlatformBootManagerBeforeConsole\n"));
>> + InstallDevicePathCallback ();
>> 4: d954947f8d14 ! 4: f3cda3cadde4 OvmfPkg: create a SEV secret area in the AmdSev memfd
>> @@ -10,8 +10,9 @@
>> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3077
>> Signed-off-by: James Bottomley <jejb at linux.ibm.com>
>> Reviewed-by: Laszlo Ersek <lersek at redhat.com>
>> -
>> Message-Id: <20201130202819.3910-5-jejb at linux.ibm.com>
>> + Acked-by: Ard Biesheuvel <ard.biesheuvel at arm.com>
>> + [lersek at redhat.com: fix typo in "ResetVectorVtf0.asm" comments]
>>
>> diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec
>> --- a/OvmfPkg/OvmfPkg.dec
>> @@ -52,7 +53,7 @@
>> +;
>> +; SEV Secret block
>> +;
>> -+; This describes the guest ram area where the hypervisor may should
>> ++; This describes the guest ram area where the hypervisor should
>> +; inject the secret. The data format is:
>> +;
>> +; base physical address (32 bit word)
>> 5: 1a18c4921cdf ! 5: c38b3caf22ad OvmfPkg/AmdSev: assign and protect the Sev Secret area
>> @@ -1,14 +1,17 @@
>> Author: James Bottomley <jejb at linux.ibm.com>
>>
>> - OvmfPkg/AmdSev: assign and protect the Sev Secret area
>> + OvmfPkg/AmdSev: assign and reserve the Sev Secret area
>>
>> - Create a one page secret area in the MEMFD and protect the area with a
>> + Create a one page secret area in the MEMFD and reserve the area with a
>> boot time HOB.
>>
>> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3077
>> Signed-off-by: James Bottomley <jejb at linux.ibm.com>
>> Reviewed-by: Laszlo Ersek <lersek at redhat.com>
>> Message-Id: <20201130202819.3910-6-jejb at linux.ibm.com>
>> + Acked-by: Ard Biesheuvel <ard.biesheuvel at arm.com>
>> + [lersek at redhat.com: s/protect/reserve/g in the commit message, at Ard's
>> + and James's suggestion]
>>
>> diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
>> --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
>> 6: 6970b9413c93 ! 6: ea823d078162 OvmfPkg/AmdSev: Expose the Sev Secret area using a configuration table
>> @@ -11,6 +11,8 @@
>> Signed-off-by: James Bottomley <jejb at linux.ibm.com>
>> Reviewed-by: Laszlo Ersek <lersek at redhat.com>
>> Message-Id: <20201130202819.3910-7-jejb at linux.ibm.com>
>> + Acked-by: Ard Biesheuvel <ard.biesheuvel at arm.com>
>> + [lersek at redhat.com: fix indentation of InstallConfigurationTable() args]
>>
>> diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec
>> --- a/OvmfPkg/OvmfPkg.dec
>> @@ -152,7 +154,8 @@
>> + IN EFI_SYSTEM_TABLE *SystemTable
>> + )
>> +{
>> -+ return gBS->InstallConfigurationTable (&gSevLaunchSecretGuid,
>> -+ &mSecretDxeTable
>> -+ );
>> ++ return gBS->InstallConfigurationTable (
>> ++ &gSevLaunchSecretGuid,
>> ++ &mSecretDxeTable
>> ++ );
>> +}
>
> I meant to include this range-diff in the email where I'd confirm the
> merge and the commit range; too bad I got distracted with this ECC mess.
Additional updates (expressed incrementally), per prior discussion:
> 1: b96494ad75db = 1: 11f014f9a5a5 OvmfPkg/ResetVector: convert SEV-ES Reset Block structure to be GUIDed
> 2: acc8cb13da8d = 2: ac3e7f9e93ab OvmfPkg/Amdsev: Base commit to build encrypted boot specific OVMF
> 3: b80ce0838781 ! 3: da5e1715a902 OvmfPkg/AmdSev: add Grub Firmware Volume Package
> @@ -23,6 +23,10 @@
> Acked-by: Ard Biesheuvel <ard.biesheuvel at arm.com>
> [lersek at redhat.com: replace local variable initialization with assignment]
> Reviewed-by: Laszlo Ersek <lersek at redhat.com>
> + [lersek at redhat.com: squash 'OvmfPkg: add "gGrubFileGuid=Grub" to
> + GuidCheck.IgnoreDuplicates', reviewed stand-alone by Phil (msgid
> + <e6eae551-8563-ccfb-5547-7a97da6d46e5 at redhat.com>) and Ard (msgid
> + <10aeda37-def6-d9a4-6e02-4c66c1492f57 at arm.com>)]
>
> diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec
> --- a/OvmfPkg/OvmfPkg.dec
> @@ -2327,3 +2331,16 @@
> +
> +remove_efi=0
> +echo "grub.efi generated in ${basedir}"
> +
> +diff --git a/OvmfPkg/OvmfPkg.ci.yaml b/OvmfPkg/OvmfPkg.ci.yaml
> +--- a/OvmfPkg/OvmfPkg.ci.yaml
> ++++ b/OvmfPkg/OvmfPkg.ci.yaml
> +@@
> + "IgnoreGuidName": ["ResetVector", "XenResetVector"], # Expected duplication for gEfiFirmwareVolumeTopFileGuid
> + "IgnoreGuidValue": [],
> + "IgnoreFoldersAndFiles": [],
> +- "IgnoreDuplicates": [],
> ++ "IgnoreDuplicates": ["gGrubFileGuid=Grub"],
> + },
> +
> + ## options defined .pytool/Plugin/LibraryClassCheck
> 4: f3cda3cadde4 = 4: 9caed44db39b OvmfPkg: create a SEV secret area in the AmdSev memfd
> 5: c38b3caf22ad = 5: dbba0abc831f OvmfPkg/AmdSev: assign and reserve the Sev Secret area
> 6: ea823d078162 = 6: 0612c2ecdc77 OvmfPkg/AmdSev: Expose the Sev Secret area using a configuration table
Merged as commit range ef3e73c6a0c0..01726b6d23d4, via the same PR:
<https://github.com/tianocore/edk2/pull/1175>.
Please proceed with addressing Jiewen's feedback, with further patches.
Thanks!
Laszlo
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#68810): https://edk2.groups.io/g/devel/message/68810
Mute This Topic: https://groups.io/mt/78617825/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list