From nobody Sun Feb 8 19:59:55 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+68093+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+68093+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1606768316; cv=none; d=zohomail.com; s=zohoarc; b=MiqatCjnAo3jew+PRRfSrdf3TDJ5YCA6DOE2IdwNGxRGKPAhN6HICsBY2EU1QXGOxLVA2Aso3DaDl9tPwpjSGYOZhL7Qu54lq74kJlx0cQrYxWogfA5RSu96bNy0XQXrgl8Bm+GwsKH5tSGowuTIxT1NnAuhbli3QluvI2CDT/Y= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1606768316; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Id:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=hQVF0o4DlNVllzDbjmnTLyMmwlCSDFdHgXKbL3RlJi8=; b=nx0H9Jz/DeQpz/FsnlK4JJ6/PflEjhks/9SjFHIfbJXq6XfRPhnVou5NNJSIY2h2TdoU6CVlIDok3ox/e6HCco2ghcuCupJKA4eYYRpiGirEfxTAhmHx6yvRHqEDBauG+ut07RTrxCWDte0+48a6TLpgvpyRfR8+UJGo/M1TUd4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+68093+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1606768316829268.98654068870087; Mon, 30 Nov 2020 12:31:56 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id APTdYY1788612xBx0DCRkh1Q; Mon, 30 Nov 2020 12:31:55 -0800 X-Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by mx.groups.io with SMTP id smtpd.web11.2970.1606768312290946201 for ; Mon, 30 Nov 2020 12:31:52 -0800 X-Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 0AUK38uR143637; Mon, 30 Nov 2020 15:31:48 -0500 X-Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 35551sddan-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 30 Nov 2020 15:31:48 -0500 X-Received: from m0098417.ppops.net (m0098417.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 0AUKPFPx043784; Mon, 30 Nov 2020 15:31:47 -0500 X-Received: from ppma04dal.us.ibm.com (7a.29.35a9.ip4.static.sl-reverse.com [169.53.41.122]) by mx0a-001b2d01.pphosted.com with ESMTP id 35551sdda5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 30 Nov 2020 15:31:47 -0500 X-Received: from pps.filterd (ppma04dal.us.ibm.com [127.0.0.1]) by ppma04dal.us.ibm.com (8.16.0.42/8.16.0.42) with SMTP id 0AUKMbfU007885; Mon, 30 Nov 2020 20:31:47 GMT X-Received: from b01cxnp22033.gho.pok.ibm.com (b01cxnp22033.gho.pok.ibm.com [9.57.198.23]) by ppma04dal.us.ibm.com with ESMTP id 353e68y4n5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 30 Nov 2020 20:31:46 +0000 X-Received: from b01ledav002.gho.pok.ibm.com (b01ledav002.gho.pok.ibm.com [9.57.199.107]) by b01cxnp22033.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 0AUKViH836241912 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 30 Nov 2020 20:31:44 GMT X-Received: from b01ledav002.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DD0C3124052; Mon, 30 Nov 2020 20:31:43 +0000 (GMT) X-Received: from b01ledav002.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id F3F4F124054; Mon, 30 Nov 2020 20:31:41 +0000 (GMT) X-Received: from jarvis.int.hansenpartnership.com (unknown [9.80.201.242]) by b01ledav002.gho.pok.ibm.com (Postfix) with ESMTP; Mon, 30 Nov 2020 20:31:41 +0000 (GMT) From: "James Bottomley" To: devel@edk2.groups.io Cc: dovmurik@linux.vnet.ibm.com, Dov.Murik1@il.ibm.com, ashish.kalra@amd.com, brijesh.singh@amd.com, tobin@ibm.com, david.kaplan@amd.com, jon.grimm@amd.com, thomas.lendacky@amd.com, jejb@linux.ibm.com, frankeh@us.ibm.com, "Dr . David Alan Gilbert" , Laszlo Ersek , Jordan Justen , Ard Biesheuvel Subject: [edk2-devel] [PATCH v3 6/6] OvmfPkg/AmdSev: Expose the Sev Secret area using a configuration table Date: Mon, 30 Nov 2020 12:28:19 -0800 Message-Id: <20201130202819.3910-7-jejb@linux.ibm.com> In-Reply-To: <20201130202819.3910-1-jejb@linux.ibm.com> References: <20201130202819.3910-1-jejb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,jejb@linux.ibm.com X-Gm-Message-State: LHQmu9pudW9WdAAZbbnGthIGx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1606768315; bh=Nl2F0fg8v3E/cdI5N23G603KguPmPvHoNa9zqqY33A0=; h=Cc:Date:From:Reply-To:Subject:To; b=RwuSM348UWzn+nCqbp32X+0c9qROWUZL7gXh1FUYeRZ/GucMiF/RkSOytLH+OF5x6WT 5SHKpUS7Xb65sVKjngT+B+vRYCG/Map/t6WdoQEfkaDM2aro6WMID06gTX35DwtPag1R9 iMs+0FydzcbAbW+/vO3IJh4dweYVGf+DG4g= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Type: text/plain; charset="utf-8" Now that the secret area is protected by a boot time HOB, extract its location details into a configuration table referenced by gSevLaunchSecretGuid so the boot loader or OS can locate it before a call to ExitBootServices(). Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3077 Signed-off-by: James Bottomley Reviewed-by: Laszlo Ersek --- OvmfPkg/OvmfPkg.dec | 1 + OvmfPkg/AmdSev/AmdSevX64.dsc | 1 + OvmfPkg/AmdSev/AmdSevX64.fdf | 1 + OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf | 37 ++++++++++++++++++++++++++ OvmfPkg/Include/Guid/SevLaunchSecret.h | 28 +++++++++++++++++++ OvmfPkg/AmdSev/SecretDxe/SecretDxe.c | 26 ++++++++++++++++++ 6 files changed, 94 insertions(+) create mode 100644 OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf create mode 100644 OvmfPkg/Include/Guid/SevLaunchSecret.h create mode 100644 OvmfPkg/AmdSev/SecretDxe/SecretDxe.c diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index 7d27f8e16040..8a294116efaa 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -117,6 +117,7 @@ [Guids] gLinuxEfiInitrdMediaGuid =3D {0x5568e427, 0x68fc, 0x4f3d, {= 0xac, 0x74, 0xca, 0x55, 0x52, 0x31, 0xcc, 0x68}} gQemuKernelLoaderFsMediaGuid =3D {0x1428f772, 0xb64a, 0x441e, {= 0xb8, 0xc3, 0x9e, 0xbd, 0xd7, 0xf8, 0x93, 0xc7}} gGrubFileGuid =3D {0xb5ae312c, 0xbc8a, 0x43b1, {= 0x9c, 0x62, 0xeb, 0xb8, 0x26, 0xdd, 0x5d, 0x07}} + gSevLaunchSecretGuid =3D {0xadf956ad, 0xe98c, 0x484c, {= 0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47}} =20 [Ppis] # PPI whose presence in the PPI database signals that the TPM base addre= ss diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc index e9c522bedad9..bb7697eb324b 100644 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc @@ -778,6 +778,7 @@ [Components] gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE } !endif + OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf OvmfPkg/AmdSev/Grub/Grub.inf !if $(BUILD_SHELL) =3D=3D TRUE ShellPkg/Application/Shell/Shell.inf { diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf index b2656a1cf6fc..e8fd4b8c7b89 100644 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf @@ -269,6 +269,7 @@ [FV.DXEFV] !if $(TOOL_CHAIN_TAG) !=3D "XCODE5" && $(BUILD_SHELL) =3D=3D TRUE INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand= .inf !endif +INF OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf INF OvmfPkg/AmdSev/Grub/Grub.inf !if $(BUILD_SHELL) =3D=3D TRUE INF ShellPkg/Application/Shell/Shell.inf diff --git a/OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf b/OvmfPkg/AmdSev/Secret= Dxe/SecretDxe.inf new file mode 100644 index 000000000000..62ab00a3d382 --- /dev/null +++ b/OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf @@ -0,0 +1,37 @@ +## @file +# Sev Secret configuration Table installer +# +# Copyright (C) 2020 James Bottomley, IBM Corporation. +# +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +## + +[Defines] + INF_VERSION =3D 0x00010005 + BASE_NAME =3D SecretDxe + FILE_GUID =3D 6e2b9619-8810-4e9d-a177-d432bb9abeda + MODULE_TYPE =3D DXE_DRIVER + VERSION_STRING =3D 1.0 + ENTRY_POINT =3D InitializeSecretDxe + +[Sources] + SecretDxe.c + +[Packages] + OvmfPkg/OvmfPkg.dec + MdePkg/MdePkg.dec + +[LibraryClasses] + UefiBootServicesTableLib + UefiDriverEntryPoint + +[Guids] + gSevLaunchSecretGuid + +[FixedPcd] + gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretBase + gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretSize + +[Depex] + TRUE diff --git a/OvmfPkg/Include/Guid/SevLaunchSecret.h b/OvmfPkg/Include/Guid/= SevLaunchSecret.h new file mode 100644 index 000000000000..fa5f3830bc2b --- /dev/null +++ b/OvmfPkg/Include/Guid/SevLaunchSecret.h @@ -0,0 +1,28 @@ + /** @file + UEFI Configuration Table for exposing the SEV Launch Secret location to= UEFI + applications (boot loaders). + + Copyright (C) 2020 James Bottomley, IBM Corporation. + SPDX-License-Identifier: BSD-2-Clause-Patent + **/ + +#ifndef SEV_LAUNCH_SECRET_H_ +#define SEV_LAUNCH_SECRET_H_ + +#include + +#define SEV_LAUNCH_SECRET_GUID \ + { 0xadf956ad, \ + 0xe98c, \ + 0x484c, \ + { 0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47 }, \ + } + +typedef struct { + UINT32 Base; + UINT32 Size; +} SEV_LAUNCH_SECRET_LOCATION; + +extern EFI_GUID gSevLaunchSecretGuid; + +#endif // SEV_LAUNCH_SECRET_H_ diff --git a/OvmfPkg/AmdSev/SecretDxe/SecretDxe.c b/OvmfPkg/AmdSev/SecretDx= e/SecretDxe.c new file mode 100644 index 000000000000..d8cc9b00946a --- /dev/null +++ b/OvmfPkg/AmdSev/SecretDxe/SecretDxe.c @@ -0,0 +1,26 @@ +/** @file + SEV Secret configuration table constructor + + Copyright (C) 2020 James Bottomley, IBM Corporation. + SPDX-License-Identifier: BSD-2-Clause-Patent +**/ +#include +#include +#include + +STATIC SEV_LAUNCH_SECRET_LOCATION mSecretDxeTable =3D { + FixedPcdGet32 (PcdSevLaunchSecretBase), + FixedPcdGet32 (PcdSevLaunchSecretSize), +}; + +EFI_STATUS +EFIAPI +InitializeSecretDxe( + IN EFI_HANDLE ImageHandle, + IN EFI_SYSTEM_TABLE *SystemTable + ) +{ + return gBS->InstallConfigurationTable (&gSevLaunchSecretGuid, + &mSecretDxeTable + ); +} --=20 2.26.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#68093): https://edk2.groups.io/g/devel/message/68093 Mute This Topic: https://groups.io/mt/78617882/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-