lkml.org 
[lkml]   [2021]   [May]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [RFC PATCH 0/3] Allow access to confidential computing secret area
From
Date
On Fri, 2021-05-21 at 10:56 -0500, Brijesh Singh wrote:
[...]
> In case of the SEV-SNP and TDX, the guest OS participates during the
> attestation flow; the driver working on the behalf of userspace and
> does not have access to the secret, so it cannot populate the file
> with the secrets in it.

OK, so for a simple encrypted VM using root on luks, how in SNP does
the boot loader obtain the disk passphrase?

In the non SNP case, it's already upstream: OVMF finds the secret page
and converts it to an EFI config table, which is passed into grub.
It's starting to sound like we'll need a new grub module for SNP which
will do an active attestation and receive the passphrase over some
channel secure against the cloud provider. Could you give us an
example of how you think this flow will work?

Thanks,

James


\
 
 \ /
  Last update: 2021-05-21 18:04    [W:0.070 / U:2.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site