AMD SEV: detect EFI CC Blob in loader - #616
Conversation
mkroening
left a comment
mkroening
left a comment
There was a problem hiding this comment.
Thanks! This is generally fine as is; I just have a few tiny suggestions and a question. :)
| pub fn cc_blob(mut self, cc_blob: u64) -> FdtWriterResult<Self> { | ||
| let cc_blob_node = self | ||
| .writer | ||
| .begin_node(&format!("hermit,cc_blob@{cc_blob:x}"))?; |
There was a problem hiding this comment.
Based on the authoritative source that calls this “EFI SNP Confidential Computing Blob”, we were considering efi_sev_snp_cc_blob in the FDT node as well as the functions and variables.
| .begin_node(&format!("hermit,cc_blob@{cc_blob:x}"))?; | |
| .begin_node(&format!("hermit,efi_sev_snp_cc_blob@{efi_sev_snp_cc_blob:x}"))?; |
On the other hand, Linux calls the GUID EFI_CC_BLOB_GUID. There's also cc_blob and SETU_CC_BLOB.
I am not sure; I just want to double-check before committing to a name. What do you think? :)
There was a problem hiding this comment.
I think we should check if TDX also has a cc blob, in which case we should probably go for cc_blob in the FDT, which could be reused for a future TDX implementation
There was a problem hiding this comment.
Ok apparently there is no such thing in TDX world, so we can commit to your new naming
51fd51f to
2602a14
Compare
2602a14 to
b7ac713
Compare
2 participants
In AMD SEV-SNP, a special page is allocated by the hypervisor to hold secret keys that can be used by the guest to communicate securely with the hardware. The hypervisor puts the address of this page in an area of the EFI Firmware, so we need to read it and forward it to Hermit so that it can use it.
Thanks @sarahspberrypi for the original implementation.