From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by mx.groups.io with SMTP id smtpd.web10.6842.1623932228782479224 for ; Thu, 17 Jun 2021 05:17:09 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@ibm.com header.s=pp1 header.b=QP3U2XQx; spf=pass (domain: linux.ibm.com, ip: 148.163.158.5, mailfrom: dovmurik@linux.ibm.com) Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 15HC4b9t065520; Thu, 17 Jun 2021 08:17:08 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : content-transfer-encoding : mime-version; s=pp1; bh=Qcj3a8EcsaS7qrvOAWynd08INDOunwtvd/W7jNHMl88=; b=QP3U2XQxVCdN3vmiYWDUdx6ISJ3P0kKVbflUD/NeeCmK/pftzdrwsZdzuWV55fwq4z4z Xf0lbKJ59Oqfp09k1EFZyh9E5gEscroVHnac1kNVcgtdHhqRm87kRN5lI9GOOsWD55+s uapzmQHRbfB/Uc9L2WHWKXgoIpl6w/C7znjQPR5FPSWTzG1Zwetwgal8xLHZaWhDFo1c Dpz/Te4/4Picd0gt1iq87YX6sd9Uv2n7a5Ccqg7dXPTq06JbHv9lObooakHfFWd3uRYT Y/tlo0B2CyATrDp6relQMuJdtFrkcNLcg71Oauxnu3lI+jQgTQ/Z2shz9XOsvx3GPQQr Nw== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 3985br9v94-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 17 Jun 2021 08:17:07 -0400 Received: from m0098417.ppops.net (m0098417.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 15HC4kgK066366; Thu, 17 Jun 2021 08:17:07 -0400 Received: from ppma02wdc.us.ibm.com (aa.5b.37a9.ip4.static.sl-reverse.com [169.55.91.170]) by mx0a-001b2d01.pphosted.com with ESMTP id 3985br9v8t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 17 Jun 2021 08:17:07 -0400 Received: from pps.filterd (ppma02wdc.us.ibm.com [127.0.0.1]) by ppma02wdc.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 15HCCCC3013642; Thu, 17 Jun 2021 12:17:06 GMT Received: from b03cxnp08025.gho.boulder.ibm.com (b03cxnp08025.gho.boulder.ibm.com [9.17.130.17]) by ppma02wdc.us.ibm.com with ESMTP id 394mja8kct-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 17 Jun 2021 12:17:06 +0000 Received: from b03ledav006.gho.boulder.ibm.com (b03ledav006.gho.boulder.ibm.com [9.17.130.237]) by b03cxnp08025.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 15HCH5qP28770728 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 17 Jun 2021 12:17:05 GMT Received: from b03ledav006.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 81724C6062; Thu, 17 Jun 2021 12:17:05 +0000 (GMT) Received: from b03ledav006.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 197FCC605A; Thu, 17 Jun 2021 12:17:05 +0000 (GMT) Received: from localhost.localdomain (unknown [9.2.130.16]) by b03ledav006.gho.boulder.ibm.com (Postfix) with ESMTP; Thu, 17 Jun 2021 12:17:04 +0000 (GMT) From: "Dov Murik" To: devel@edk2.groups.io Cc: Dov Murik , Laszlo Ersek , Ard Biesheuvel , Jordan Justen , James Bottomley , Tobin Feldman-Fitzthum Subject: [RESEND] [PATCH v2 0/3] OvmfPkg: Use QemuKernelLoaderFs to read cmdline/initrd Date: Thu, 17 Jun 2021 12:16:57 +0000 Message-Id: <20210617121700.2883073-1-dovmurik@linux.ibm.com> X-Mailer: git-send-email 2.25.1 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: OELJbWJHVRV7ILNVp-5byr-nOR2vJMWw X-Proofpoint-ORIG-GUID: RKHub2YQKWvgGRbdtShb9l16VcCdXQxN X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391,18.0.790 definitions=2021-06-17_05:2021-06-15,2021-06-17 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 adultscore=0 lowpriorityscore=0 suspectscore=0 phishscore=0 mlxlogscore=999 mlxscore=0 bulkscore=0 priorityscore=1501 clxscore=1015 impostorscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2106170079 Content-Transfer-Encoding: 8bit [resending due to missing recipients] BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3457 In order to support measured SEV boot with kernel/initrd/cmdline, we'd like to have one place that reads those blobs; in the future we'll add the measurement and verification in that place. We already have a synthetic filesystem (QemuKernelLoaderFs) which holds three files: "kernel", "initrd", and "cmdline". The kernel is indeed read from this filesystem in LoadImage; but the cmdline (and the length of initrd) are read from QemuFwCfgLib items. This patch series modifies GenericQemuLoadImageLib to read cmdline (and the initrd size) from the QemuKernelLoaderFs synthetic filesystem, thus removing the dependency on QemuFwCfgLib. Note that X86QemuLoadImageLib is not modified, because it contains a QemuLoadLegacyImage() which reads other items of the QemuFwCfg which are not available in QemuKernelLoaderFs. Since we don't want to support the legacy boot path in the future measured SEV boot, we leave X86QemuLoadImageLib as-is (except for a comment addition in patch 3) and will force use for GenericQemuLoadImageLib in the measured SEV boot implementation. Relevant discussion threads start in: https://edk2.groups.io/g/devel/message/76069 To test this on x86_64, I forced the use of GenericQemuLoadImageLib using the following local patch: diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index 0a237a905866..46442b543bcf 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -404,7 +404,7 @@ [LibraryClasses.common.DXE_DRIVER] PciLib|OvmfPkg/Library/DxePciLibI440FxQ35/DxePciLibI440FxQ35.inf MpInitLib|UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf QemuFwCfgS3Lib|OvmfPkg/Library/QemuFwCfgS3Lib/DxeQemuFwCfgS3LibFwCfg.inf - QemuLoadImageLib|OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf + QemuLoadImageLib|OvmfPkg/Library/GenericQemuLoadImageLib/GenericQemuLoadImageLib.inf # XXX don't commit this or someone will be mad !if $(TPM_ENABLE) == TRUE Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibTcg/Tpm12DeviceLibTcg.inf Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibTcg2/Tpm2DeviceLibTcg2.inf I tested boot with QEMU and OVMF with the following QEMU arguments: -kernel a -kernel a -initrd b -kernel a -cmdline c -kernel a -initrd b -cmdline c (and also without -kernel) Code is at https://github.com/confidential-containers-demo/edk2/tree/use-synthetic-fs-for-cmdline-v2 v2 changes: - Add comment to header of X86QemuLoadImageLib.inf - Clearer function names in GenericQemuLoadImageLib.c - Fix coding style issues v1: https://edk2.groups.io/g/devel/message/76265 Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Jordan Justen Cc: James Bottomley Cc: Tobin Feldman-Fitzthum Dov Murik (3): Revert "OvmfPkg/QemuKernelLoaderFsDxe: don't expose kernel command line" OvmfPkg/GenericQemuLoadImageLib: Read cmdline from QemuKernelLoaderFs OvmfPkg/X86QemuLoadImageLib: State fw_cfg dependency in file header OvmfPkg/Library/GenericQemuLoadImageLib/GenericQemuLoadImageLib.inf | 2 +- OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf | 3 + OvmfPkg/Library/GenericQemuLoadImageLib/GenericQemuLoadImageLib.c | 145 ++++++++++++++++++-- OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c | 3 + OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c | 11 +- 5 files changed, 147 insertions(+), 17 deletions(-) -- 2.25.1