From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1kdhVb-0001Ga-HU for mharc-grub-devel@gnu.org; Fri, 13 Nov 2020 17:25:31 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:42210) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kdhVZ-0001GO-7E for grub-devel@gnu.org; Fri, 13 Nov 2020 17:25:29 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:7748) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kdhVX-00055e-6b for grub-devel@gnu.org; Fri, 13 Nov 2020 17:25:28 -0500 Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 0ADM3tKx185100; Fri, 13 Nov 2020 17:25:24 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : mime-version : content-transfer-encoding; s=pp1; bh=UKDWY+4ErRlPAb9eKb0oF0N5oVplPAizzAs5JSrYK7E=; b=MQpMzCE+8g93HaRFiwxH6gBKin8fwyvV/AFAF9+NyfmNrq+D0/8sxSZlnkN0LPJbdTqW t3nUI5A5QroS6sLe0vvA7SaBuWELnFkjI0nQ5beVkOpNge+9fetEH9AWkeekin9IcozQ t2HTnUhf8kjfQEhQyJzgQ41X5gGtc2EwSahJHqfQtt9ai8pI3QzR4q6YdYv3tvoDpK7i q487f1mfIhiDpF6X/FhOk3VfxVFyw3ZhkxGgYFd0W3PvuzjGDli218B6DN0VhipNjLqT MWEATl/+92Gnc/oxvBWKpYPCvD1VUX1SHK3VUuZlQL/VTtL7EQ6umgABZY/ps39n8XFw TQ== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 34sxt4ycv2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 13 Nov 2020 17:25:24 -0500 Received: from m0098417.ppops.net (m0098417.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 0ADMPOc7051159; Fri, 13 Nov 2020 17:25:24 -0500 Received: from ppma02dal.us.ibm.com (a.bd.3ea9.ip4.static.sl-reverse.com [169.62.189.10]) by mx0a-001b2d01.pphosted.com with ESMTP id 34sxt4ycuw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 13 Nov 2020 17:25:24 -0500 Received: from pps.filterd (ppma02dal.us.ibm.com [127.0.0.1]) by ppma02dal.us.ibm.com (8.16.0.42/8.16.0.42) with SMTP id 0ADMHsvq021965; Fri, 13 Nov 2020 22:25:23 GMT Received: from b03cxnp08025.gho.boulder.ibm.com (b03cxnp08025.gho.boulder.ibm.com [9.17.130.17]) by ppma02dal.us.ibm.com with ESMTP id 34nk7aku8k-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 13 Nov 2020 22:25:23 +0000 Received: from b03ledav004.gho.boulder.ibm.com (b03ledav004.gho.boulder.ibm.com [9.17.130.235]) by b03cxnp08025.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 0ADMPDLM9568948 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 13 Nov 2020 22:25:13 GMT Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AC9EB7805F; Fri, 13 Nov 2020 22:25:19 +0000 (GMT) Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4370D7805C; Fri, 13 Nov 2020 22:25:17 +0000 (GMT) Received: from jarvis.int.hansenpartnership.com (unknown [9.85.145.64]) by b03ledav004.gho.boulder.ibm.com (Postfix) with ESMTP; Fri, 13 Nov 2020 22:25:16 +0000 (GMT) From: James Bottomley To: grub-devel@gnu.org Cc: dovmurik@linux.vnet.ibm.com, Dov.Murik1@il.ibm.com, ashish.kalra@amd.com, brijesh.singh@amd.com, tobin@ibm.com, david.kaplan@amd.com, jon.grimm@amd.com, thomas.lendacky@amd.com, jejb@linux.ibm.com, frankeh@us.ibm.com, "Dr . David Alan Gilbert" Subject: [PATCH v2 0/3] Add ability to use SEV provisioned secrets for disk decryption Date: Fri, 13 Nov 2020 14:25:07 -0800 Message-Id: <20201113222510.16958-1-jejb@linux.ibm.com> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.312, 18.0.737 definitions=2020-11-13_19:2020-11-13, 2020-11-13 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 priorityscore=1501 adultscore=0 impostorscore=0 mlxlogscore=999 clxscore=1015 suspectscore=0 mlxscore=0 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000 definitions=main-2011130141 Received-SPF: pass client-ip=148.163.158.5; envelope-from=jejb@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/11/13 16:04:08 X-ACL-Warn: Detected OS = Linux 3.x [generic] X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Nov 2020 22:25:29 -0000 v2: update geli.c to use conditional prompt and add callback for variable message printing and secret destruction To achieve encrypted disk images in the AMD SEV encrypted virtual machine, we need to add the ability for grub to retrieve the disk passphrase from the SEV launch secret. To do this, we've modified OVMF to set aside an area for the injected secret and pass up a configuration table for it: https://edk2.groups.io/g/devel/topic/78198617#67339 The patches in this series modify grub to look for the disk passphrase in the secret configuration table and use it to decrypt any disks in the system if they are found. This is so an encrypted image with a properly injected password will boot without any user intervention. The three patches firstly modify the cryptodisk consumers to allow arbitrary password getters instead of the current console based one. The next patch adds a '-s' option to cryptodisk to allow it to use a saved password and the final one adds a sevsecret command to check for the secrets configuration table and provision the disk passphrase from it if an entry is found. With all this in place, the sequence to boot an encrypted volume without user intervention is: sevsecret cryptomount -s source (crypto0)/boot/grub.cfg Assuming there's a standard Linux root partition. James --- James Bottomley (3): cryptodisk: make the password getter and additional argument to recover_key cryptodisk: add OS provided secret support efi: Add API for retrieving the AMD SEV injected secret for cryptodisk grub-core/Makefile.core.def | 8 ++ grub-core/disk/cryptodisk.c | 61 ++++++++++++++- grub-core/disk/efi/sevsecret.c | 132 +++++++++++++++++++++++++++++++++ grub-core/disk/geli.c | 12 +-- grub-core/disk/luks.c | 12 +-- grub-core/disk/luks2.c | 12 +-- include/grub/cryptodisk.h | 11 ++- include/grub/efi/api.h | 15 ++++ 8 files changed, 243 insertions(+), 20 deletions(-) create mode 100644 grub-core/disk/efi/sevsecret.c -- 2.26.2