Re: [edk2-devel] [PATCH v3 6/6] OvmfPkg/AmdSev: Expose the Sev Secret area using a configuration table

["Yao, Jiewen" <jiewen.yao@intel.com>]

> To be clear: grub is just using it to get the disk password.  I do
> anticipate we'll also use it for provisioning keys directly into the
> linux kernel as well, so multiple consumers were anticipated.

Would you please share more information about the GUIDed key usage, except disk password?

What is the usage of the provisioning key for kernel?

Thank you
Yao Jiewen



> -----Original Message-----
> From: James Bottomley <jejb@linux.ibm.com>
> Sent: Thursday, December 10, 2020 12:39 AM
> To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> Cc: dovmurik@linux.vnet.ibm.com; Dov.Murik1@il.ibm.com;
> ashish.kalra@amd.com; brijesh.singh@amd.com; tobin@ibm.com;
> david.kaplan@amd.com; jon.grimm@amd.com; thomas.lendacky@amd.com;
> frankeh@us.ibm.com; Dr . David Alan Gilbert <dgilbert@redhat.com>; Laszlo
> Ersek <lersek@redhat.com>; Justen, Jordan L <jordan.l.justen@intel.com>;
> Ard Biesheuvel <ard.biesheuvel@arm.com>
> Subject: Re: [edk2-devel] [PATCH v3 6/6] OvmfPkg/AmdSev: Expose the Sev
> Secret area using a configuration table
> 
> On Wed, 2020-12-09 at 16:33 +0000, Yao, Jiewen wrote:
> > Thanks. ConfidentialComputing seems a better name.
> >
> > I agree with you that OVMF might not need understand the data
> > structure. But I am not sure if the grub is the only boot loader we
> > want to support.
> 
> To be clear: grub is just using it to get the disk password.  I do
> anticipate we'll also use it for provisioning keys directly into the
> linux kernel as well, so multiple consumers were anticipated.
> 
> > I think it might be a better idea to define the data structure
> > clearly in OVMF. As such, any boot loader can parse the data
> > structure to decrypt the disk. They don’t need refer to grub.
> 
> I'll defer to what OVMF people want, but defining a table inside OVMF
> that it doesn't actually use at all seems to be doing it at the wrong
> layer.
> 
> James
>