Re: [edk2-devel] [PATCH v3 0/6] SEV Encrypted Boot for Ovmf

["Laszlo Ersek" <lersek@redhat.com>]

On 12/04/20 02:55, Laszlo Ersek wrote:

> I will send a short patch series to add the exceptions, and once
> that's upstream, we *will* merge this (v3) series.

BTW the tweaks I added on top of your v3, in
<https://github.com/tianocore/edk2/pull/1175>, are as follows (git
range-diff output):

> 1:  4020c20b2342 ! 1:  b96494ad75db OvmfPkg/ResetVector: convert SEV-ES Reset Block structure to be GUIDed
>     @@ -8,8 +8,9 @@
>
>          Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3077
>          Signed-off-by: James Bottomley <jejb@linux.ibm.com>
>     -
>          Message-Id: <20201130202819.3910-2-jejb@linux.ibm.com>
>     +    Acked-by: Ard Biesheuvel <ard.biesheuvel@arm.com>
>     +    Reviewed-by: Laszlo Ersek <lersek@redhat.com>
>
>      diff --git a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm b/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm
>      --- a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm
> 2:  488fbdbe7689 ! 2:  acc8cb13da8d OvmfPkg/Amdsev: Base commit to build encrypted boot specific OVMF
>     @@ -11,8 +11,9 @@
>
>          Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3077
>          Signed-off-by: James Bottomley <jejb@linux.ibm.com>
>     -
>          Message-Id: <20201130202819.3910-3-jejb@linux.ibm.com>
>     +    Acked-by: Ard Biesheuvel <ard.biesheuvel@arm.com>
>     +    Reviewed-by: Laszlo Ersek <lersek@redhat.com>
>
>      diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
>      new file mode 100644
> 3:  796ec96e3414 ! 3:  b80ce0838781 OvmfPkg/AmdSev: add Grub Firmware Volume Package
>     @@ -19,8 +19,10 @@
>
>          Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3077
>          Signed-off-by: James Bottomley <jejb@linux.ibm.com>
>     -
>          Message-Id: <20201130202819.3910-4-jejb@linux.ibm.com>
>     +    Acked-by: Ard Biesheuvel <ard.biesheuvel@arm.com>
>     +    [lersek@redhat.com: replace local variable initialization with assignment]
>     +    Reviewed-by: Laszlo Ersek <lersek@redhat.com>
>
>      diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec
>      --- a/OvmfPkg/OvmfPkg.dec
>     @@ -779,7 +781,9 @@
>      +{
>      +  EFI_HANDLE    Handle;
>      +  EFI_STATUS    Status;
>     -+  UINT16 FrontPageTimeout = 0;
>     ++  UINT16        FrontPageTimeout;
>     ++
>     ++  FrontPageTimeout = 0;
>      +
>      +  DEBUG ((DEBUG_INFO, "PlatformBootManagerBeforeConsole\n"));
>      +  InstallDevicePathCallback ();
> 4:  d954947f8d14 ! 4:  f3cda3cadde4 OvmfPkg: create a SEV secret area in the AmdSev memfd
>     @@ -10,8 +10,9 @@
>          Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3077
>          Signed-off-by: James Bottomley <jejb@linux.ibm.com>
>          Reviewed-by: Laszlo Ersek <lersek@redhat.com>
>     -
>          Message-Id: <20201130202819.3910-5-jejb@linux.ibm.com>
>     +    Acked-by: Ard Biesheuvel <ard.biesheuvel@arm.com>
>     +    [lersek@redhat.com: fix typo in "ResetVectorVtf0.asm" comments]
>
>      diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec
>      --- a/OvmfPkg/OvmfPkg.dec
>     @@ -52,7 +53,7 @@
>      +;
>      +; SEV Secret block
>      +;
>     -+; This describes the guest ram area where the hypervisor may should
>     ++; This describes the guest ram area where the hypervisor should
>      +; inject the secret.  The data format is:
>      +;
>      +; base physical address (32 bit word)
> 5:  1a18c4921cdf ! 5:  c38b3caf22ad OvmfPkg/AmdSev: assign and protect the Sev Secret area
>     @@ -1,14 +1,17 @@
>      Author: James Bottomley <jejb@linux.ibm.com>
>
>     -    OvmfPkg/AmdSev: assign and protect the Sev Secret area
>     +    OvmfPkg/AmdSev: assign and reserve the Sev Secret area
>
>     -    Create a one page secret area in the MEMFD and protect the area with a
>     +    Create a one page secret area in the MEMFD and reserve the area with a
>          boot time HOB.
>
>          Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3077
>          Signed-off-by: James Bottomley <jejb@linux.ibm.com>
>          Reviewed-by: Laszlo Ersek <lersek@redhat.com>
>          Message-Id: <20201130202819.3910-6-jejb@linux.ibm.com>
>     +    Acked-by: Ard Biesheuvel <ard.biesheuvel@arm.com>
>     +    [lersek@redhat.com: s/protect/reserve/g in the commit message, at Ard's
>     +     and James's suggestion]
>
>      diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
>      --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
> 6:  6970b9413c93 ! 6:  ea823d078162 OvmfPkg/AmdSev: Expose the Sev Secret area using a configuration table
>     @@ -11,6 +11,8 @@
>          Signed-off-by: James Bottomley <jejb@linux.ibm.com>
>          Reviewed-by: Laszlo Ersek <lersek@redhat.com>
>          Message-Id: <20201130202819.3910-7-jejb@linux.ibm.com>
>     +    Acked-by: Ard Biesheuvel <ard.biesheuvel@arm.com>
>     +    [lersek@redhat.com: fix indentation of InstallConfigurationTable() args]
>
>      diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec
>      --- a/OvmfPkg/OvmfPkg.dec
>     @@ -152,7 +154,8 @@
>      +  IN EFI_SYSTEM_TABLE     *SystemTable
>      +  )
>      +{
>     -+  return gBS->InstallConfigurationTable (&gSevLaunchSecretGuid,
>     -+                                         &mSecretDxeTable
>     -+                                         );
>     ++  return gBS->InstallConfigurationTable (
>     ++                &gSevLaunchSecretGuid,
>     ++                &mSecretDxeTable
>     ++                );
>      +}

I meant to include this range-diff in the email where I'd confirm the
merge and the commit range; too bad I got distracted with this ECC mess.

Laszlo