lkml.org 
[lkml]   [2021]   [Dec]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v8 27/40] x86/boot: Add Confidential Computing type to setup_data
    Date
    While launching the encrypted guests, the hypervisor may need to provide
    some additional information during the guest boot. When booting under the
    EFI based BIOS, the EFI configuration table contains an entry for the
    confidential computing blob that contains the required information.

    To support booting encrypted guests on non-EFI VM, the hypervisor needs to
    pass this additional information to the kernel with a different method.

    For this purpose, introduce SETUP_CC_BLOB type in setup_data to hold the
    physical address of the confidential computing blob location. The boot
    loader or hypervisor may choose to use this method instead of EFI
    configuration table. The CC blob location scanning should give preference
    to setup_data data over the EFI configuration table.

    In AMD SEV-SNP, the CC blob contains the address of the secrets and CPUID
    pages. The secrets page includes information such as a VM to PSP
    communication key and CPUID page contains PSP filtered CPUID values.
    Define the AMD SEV confidential computing blob structure.

    While at it, define the EFI GUID for the confidential computing blob.

    Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
    ---
    arch/x86/include/asm/sev.h | 12 ++++++++++++
    arch/x86/include/uapi/asm/bootparam.h | 1 +
    include/linux/efi.h | 1 +
    3 files changed, 14 insertions(+)

    diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h
    index f7cbd5164136..f42fbe3c332f 100644
    --- a/arch/x86/include/asm/sev.h
    +++ b/arch/x86/include/asm/sev.h
    @@ -44,6 +44,18 @@ struct es_em_ctxt {

    void do_vc_no_ghcb(struct pt_regs *regs, unsigned long exit_code);

    +/* AMD SEV Confidential computing blob structure */
    +#define CC_BLOB_SEV_HDR_MAGIC 0x45444d41
    +struct cc_blob_sev_info {
    + u32 magic;
    + u16 version;
    + u16 reserved;
    + u64 secrets_phys;
    + u32 secrets_len;
    + u64 cpuid_phys;
    + u32 cpuid_len;
    +};
    +
    static inline u64 lower_bits(u64 val, unsigned int bits)
    {
    u64 mask = (1ULL << bits) - 1;
    diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
    index b25d3f82c2f3..1ac5acca72ce 100644
    --- a/arch/x86/include/uapi/asm/bootparam.h
    +++ b/arch/x86/include/uapi/asm/bootparam.h
    @@ -10,6 +10,7 @@
    #define SETUP_EFI 4
    #define SETUP_APPLE_PROPERTIES 5
    #define SETUP_JAILHOUSE 6
    +#define SETUP_CC_BLOB 7

    #define SETUP_INDIRECT (1<<31)

    diff --git a/include/linux/efi.h b/include/linux/efi.h
    index dbd39b20e034..a022aed7adb3 100644
    --- a/include/linux/efi.h
    +++ b/include/linux/efi.h
    @@ -344,6 +344,7 @@ void efi_native_runtime_setup(void);
    #define EFI_CERT_SHA256_GUID EFI_GUID(0xc1c41626, 0x504c, 0x4092, 0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28)
    #define EFI_CERT_X509_GUID EFI_GUID(0xa5c059a1, 0x94e4, 0x4aa7, 0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72)
    #define EFI_CERT_X509_SHA256_GUID EFI_GUID(0x3bd2a492, 0x96c0, 0x4079, 0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed)
    +#define EFI_CC_BLOB_GUID EFI_GUID(0x067b1f5f, 0xcf26, 0x44c5, 0x85, 0x54, 0x93, 0xd7, 0x77, 0x91, 0x2d, 0x42)

    /*
    * This GUID is used to pass to the kernel proper the struct screen_info
    --
    2.25.1
    \
     
     \ /
      Last update: 2021-12-10 16:46    [W:2.954 / U:0.144 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site