From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1kdNnV-0001RL-UW for mharc-grub-devel@gnu.org; Thu, 12 Nov 2020 20:22:41 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:44992) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kdNnU-0001RE-9I for grub-devel@gnu.org; Thu, 12 Nov 2020 20:22:40 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:65370 helo=mx0a-001b2d01.pphosted.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kdNnS-000441-3z for grub-devel@gnu.org; Thu, 12 Nov 2020 20:22:40 -0500 Received: from pps.filterd (m0098414.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 0AD127Pr102902; Thu, 12 Nov 2020 20:22:33 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : mime-version : content-transfer-encoding; s=pp1; bh=JU4G0AZtC/0P93uE5W6I9LC7bKNy4r3bC9pk0w8W3kc=; b=EQygS37HbbVuLmTbgjgr6Ov7XghozXHL8XduCSlqu5950QFBSaCmqO7jKhQkhj6TC1Fe D22GWz+4etZudpN7p+T6KWYj5kWlEBKy3Utos208JyNTnIGHD1Ik0fvdBF37vHosGpZ/ eyZwnyJLM2L0tyjHEV4Ya8Fhrc3SuzNkJPHkdUPA7K0sGDBmL+DN1lPVXLkhBDPsFVkG ZjKGo3H4q9TVSsJ3757x2TC09SKvxtAAeoK+hMFP8/eCttNFGxJw5xGZXpslYiN+0JK5 7hE6k6LjUGz3eUyPIllbZkUBv9TK/sZDpFMi6I7T7rc0zBdEBFyslQM/sVovvFN7T3rN 3w== Received: from pps.reinject (localhost [127.0.0.1]) by mx0b-001b2d01.pphosted.com with ESMTP id 34sdd0vfrr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 12 Nov 2020 20:22:33 -0500 Received: from m0098414.ppops.net (m0098414.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 0AD1EwGd149536; Thu, 12 Nov 2020 20:22:33 -0500 Received: from ppma05wdc.us.ibm.com (1b.90.2fa9.ip4.static.sl-reverse.com [169.47.144.27]) by mx0b-001b2d01.pphosted.com with ESMTP id 34sdd0vfrk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 12 Nov 2020 20:22:33 -0500 Received: from pps.filterd (ppma05wdc.us.ibm.com [127.0.0.1]) by ppma05wdc.us.ibm.com (8.16.0.42/8.16.0.42) with SMTP id 0AD1H0Jh011690; Fri, 13 Nov 2020 01:22:32 GMT Received: from b03cxnp07028.gho.boulder.ibm.com (b03cxnp07028.gho.boulder.ibm.com [9.17.130.15]) by ppma05wdc.us.ibm.com with ESMTP id 34nk79q3yp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 13 Nov 2020 01:22:32 +0000 Received: from b03ledav004.gho.boulder.ibm.com (b03ledav004.gho.boulder.ibm.com [9.17.130.235]) by b03cxnp07028.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 0AD1MTne9962094 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 13 Nov 2020 01:22:29 GMT Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2620E7805C; Fri, 13 Nov 2020 01:22:29 +0000 (GMT) Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E44C278060; Fri, 13 Nov 2020 01:22:26 +0000 (GMT) Received: from jarvis.int.hansenpartnership.com (unknown [9.85.145.64]) by b03ledav004.gho.boulder.ibm.com (Postfix) with ESMTP; Fri, 13 Nov 2020 01:22:26 +0000 (GMT) From: James Bottomley To: grub-devel@gnu.org Cc: dovmurik@linux.vnet.ibm.com, Dov.Murik1@il.ibm.com, ashish.kalra@amd.com, brijesh.singh@amd.com, tobin@ibm.com, david.kaplan@amd.com, jon.grimm@amd.com, thomas.lendacky@amd.com, jejb@linux.ibm.com, frankeh@us.ibm.com, "Dr . David Alan Gilbert" Subject: [PATCH 0/3] Add ability to use SEV provisioned secrets for disk decryption Date: Thu, 12 Nov 2020 17:22:03 -0800 Message-Id: <20201113012206.24246-1-jejb@linux.ibm.com> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.312, 18.0.737 definitions=2020-11-12_16:2020-11-12, 2020-11-12 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 clxscore=1011 malwarescore=0 impostorscore=0 phishscore=0 adultscore=0 lowpriorityscore=0 mlxscore=0 bulkscore=0 priorityscore=1501 spamscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000 definitions=main-2011130001 Received-SPF: pass client-ip=148.163.158.5; envelope-from=jejb@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/11/12 20:22:35 X-ACL-Warn: Detected OS = Linux 3.x [generic] X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Nov 2020 01:22:40 -0000 To achieve encrypted disk images in the AMD SEV encrypted virtual machine, we need to add the ability for grub to retrieve the disk passphrase from the SEV launch secret. To do this, we've modified OVMF to set aside an area for the injected secret and pass up a configuration table for it: https://edk2.groups.io/g/devel/topic/78198617#67339 The patches in this series modify grub to look for the disk passphrase in the secret configuration table and use it to decrypt any disks in the system if they are found. This is so an encrypted image with a properly injected password will boot without any user intervention. The three patches firstly modify the cryptodisk consumers to allow arbitrary password getters instead of the current console based one. The next patch adds a '-s' option to cryptodisk to allow it to use a saved password and the final one adds a sevsecret command to check for the secrets configuration table and provision the disk passphrase from it if an entry is found. With all this in place, the sequence to boot an encrypted volume without user intervention is: sevsecret cryptomount -s source (crypto0)/boot/grub.cfg Assuming there's a standard Linux root partition. James --- James Bottomley (3): cryptodisk: make the password getter and additional argument to recover_key cryptodisk: add OS provided secret support efi: Add API for retrieving the AMD SEV injected secret for cryptodisk grub-core/Makefile.core.def | 8 +++ grub-core/disk/cryptodisk.c | 60 +++++++++++++++-- grub-core/disk/efi/sevsecret.c | 118 +++++++++++++++++++++++++++++++++ grub-core/disk/geli.c | 5 +- grub-core/disk/luks.c | 12 ++-- grub-core/disk/luks2.c | 12 ++-- include/grub/cryptodisk.h | 8 ++- include/grub/efi/api.h | 15 +++++ 8 files changed, 221 insertions(+), 17 deletions(-) create mode 100644 grub-core/disk/efi/sevsecret.c -- 2.26.2