From: Markus Frank <m.frank@proxmox.com>
To: Philipp Giersfeld <philipp.giersfeld@canarybit.eu>,
pve-devel@lists.proxmox.com
Subject: Re: [pve-devel] [PATCH edk2-firmware v4 1/4] Add OVMF targets for AMD SEV-ES and SEV-SNP
Date: Tue, 18 Mar 2025 10:40:53 +0100 [thread overview]
Message-ID: <d0596f8e-6d03-499c-9bda-dcd1bb0dcf0d@proxmox.com> (raw)
In-Reply-To: <20250311150456.4071232-2-philipp.giersfeld@canarybit.eu>
On 2025-03-11 16:04, Philipp Giersfeld wrote:
> AMD SEV-SNP boots with a single volatile firmware image OVMF.fd via the
> -bios option.
>
> This requires building the `OvmfPkg/OvmfPkgX64.dsc` target.
> Also, SEV-ES and SEV-SNP do not support SMM [1,2].
>
> Therefore, introduce a new target build-ovmf-cvm that builds OVMF
> firmware suitable for AMD SEV.
>
> [1] https://www.qemu.org/docs/master/system/i386/amd-memory-encryption.
> [2] https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/56421.pdf
>
> Signed-off-by: Philipp Giersfeld <philipp.giersfeld@canarybit.eu>
> Tested-by: Markus Frank <m.frank@proxmox.com>
I have not tested this version before (there have been some changes since v3/v2).
But now I have. So the "Tested-by" can stay there.
> ---
>
> changes since v3: https://lists.proxmox.com/pipermail/pve-devel/2025-February/068578.html
> * Build SEV targets with secure boot support since edk2 has been
> updated
>
> debian/pve-edk2-firmware-ovmf.install | 3 +++
> debian/rules | 28 +++++++++++++++++++++++++--
> 2 files changed, 29 insertions(+), 2 deletions(-)
>
> diff --git a/debian/pve-edk2-firmware-ovmf.install b/debian/pve-edk2-firmware-ovmf.install
> index f4c0602..a51846e 100644
> --- a/debian/pve-edk2-firmware-ovmf.install
> +++ b/debian/pve-edk2-firmware-ovmf.install
> @@ -1,5 +1,8 @@
> debian/ovmf-install/OVMF_CODE*.fd /usr/share/pve-edk2-firmware
> debian/ovmf-install/OVMF_VARS*.fd /usr/share/pve-edk2-firmware
> +debian/ovmf-cvm-install/OVMF_CVM_CODE*.fd /usr/share/pve-edk2-firmware
> +debian/ovmf-cvm-install/OVMF_CVM_VARS*.fd /usr/share/pve-edk2-firmware
> +debian/ovmf-cvm-install/OVMF_CVM_4M.fd /usr/share/pve-edk2-firmware
> debian/ovmf32-install/OVMF32_CODE*.fd /usr/share/pve-edk2-firmware
> debian/ovmf32-install/OVMF32_VARS*.fd /usr/share/pve-edk2-firmware
> debian/PkKek-1-snakeoil.* /usr/share/pve-edk2-firmware
> diff --git a/debian/rules b/debian/rules
> index 2e9365b..c52d4fb 100755
> --- a/debian/rules
> +++ b/debian/rules
> @@ -37,6 +37,7 @@ OVMF_4M_FLAGS = $(OVMF_COMMON_FLAGS) -DFD_SIZE_4MB
> OVMF_4M_SMM_FLAGS = $(OVMF_4M_FLAGS) -DSMM_REQUIRE=TRUE
> OVMF32_4M_FLAGS = $(OVMF_COMMON_FLAGS) -DFD_SIZE_4MB
> OVMF32_4M_SMM_FLAGS = $(OVMF32_4M_FLAGS) -DSMM_REQUIRE=TRUE
> +OVMF_CVM_4M_FLAGS = $(OVMF_4M_FLAGS)
>
> AAVMF_FLAGS = $(COMMON_FLAGS)
> AAVMF_FLAGS += -DTPM2_ENABLE=TRUE
> @@ -56,7 +57,7 @@ undefine CONF_PATH
> %:
> dh $@
>
> -override_dh_auto_build: build-qemu-efi-aarch64 build-ovmf build-ovmf32 build-qemu-efi-riscv64
> +override_dh_auto_build: build-qemu-efi-aarch64 build-ovmf build-ovmf32 build-ovmf-cvm build-qemu-efi-riscv64
>
> debian/setup-build-stamp:
> cp -a debian/Logo.bmp MdeModulePkg/Logo/Logo.bmp
> @@ -79,6 +80,12 @@ OVMF32_SHELL = $(OVMF32_BUILD_DIR)/IA32/Shell.efi
> OVMF32_BINARIES = $(OVMF32_SHELL)
> OVMF32_IMAGES := $(addprefix $(OVMF32_INSTALL_DIR)/,OVMF32_CODE_4M.secboot.fd OVMF32_VARS_4M.fd)
>
> +OVMF_CVM_INSTALL_DIR = debian/ovmf-cvm-install
> +OVMF_CVM_BUILD_DIR = Build/OvmfX64/$(BUILD_TYPE)_$(EDK2_TOOLCHAIN)
> +OVMF_CVM_SHELL = $(OVMF_CVM_BUILD_DIR)/X64/Shell.efi
> +OVMF_CVM_BINARIES = $(OVMF_CVM_SHELL)
> +OVMF_CVM_IMAGES := $(addprefix $(OVMF_CVM_INSTALL_DIR)/,OVMF_CVM_CODE_4M.fd OVMF_CVM_VARS_4M.fd)
> +
> QEMU_EFI_BUILD_DIR = Build/ArmVirtQemu-$(EDK2_HOST_ARCH)/$(BUILD_TYPE)_$(EDK2_TOOLCHAIN)
> AAVMF_BUILD_DIR = Build/ArmVirtQemu-AARCH64/$(BUILD_TYPE)_$(EDK2_TOOLCHAIN)
> AAVMF_ENROLL = $(AAVMF_BUILD_DIR)/AARCH64/EnrollDefaultKeys.efi
> @@ -106,6 +113,23 @@ $(OVMF32_BINARIES) $(OVMF32_IMAGES): debian/setup-build-stamp
> cp $(OVMF32_BUILD_DIR)/FV/OVMF_VARS.fd \
> $(OVMF32_INSTALL_DIR)/OVMF32_VARS_4M.fd
>
> +build-ovmf-cvm: $(OVMF_CVM_BINARIES) $(OVMF_CVM_IMAGES)
> +$(OVMF_CVM_BINARIES) $(OVMF_CVM_IMAGES): debian/setup-build-stamp
> + rm -rf $(OVMF_CVM_INSTALL_DIR)
> + mkdir $(OVMF_CVM_INSTALL_DIR)
> + set -e; . ./edksetup.sh; \
> + build -a X64 \
> + -t $(EDK2_TOOLCHAIN) \
> + -p OvmfPkg/OvmfPkgX64.dsc \
> + $(OVMF_CVM_4M_FLAGS) -b $(BUILD_TYPE)
> + #-b $(BUILD_TYPE)
> + cp $(OVMF_CVM_BUILD_DIR)/FV/OVMF_CODE.fd \
> + $(OVMF_CVM_INSTALL_DIR)/OVMF_CVM_CODE_4M.fd
> + cp $(OVMF_CVM_BUILD_DIR)/FV/OVMF_VARS.fd \
> + $(OVMF_CVM_INSTALL_DIR)/OVMF_CVM_VARS_4M.fd
> + cp $(OVMF_CVM_BUILD_DIR)/FV/OVMF.fd \
> + $(OVMF_CVM_INSTALL_DIR)/OVMF_CVM_4M.fd
> +
> build-ovmf: $(OVMF_BINARIES) $(OVMF_IMAGES) $(OVMF_PREENROLLED_VARS)
> $(OVMF_BINARIES) $(OVMF_IMAGES): debian/setup-build-stamp
> rm -rf $(OVMF_INSTALL_DIR)
> @@ -250,4 +274,4 @@ get-orig-source:
> edk2-$(DEB_VERSION_UPSTREAM)
> rm -rf edk2.tmp edk2-$(DEB_VERSION_UPSTREAM)
>
> -.PHONY: build-ovmf build-ovmf32 build-qemu-efi build-qemu-efi-aarch64 build-qemu-efi-riscv64
> +.PHONY: build-ovmf build-ovmf32 build-ovmf-cvm build-qemu-efi build-qemu-efi-aarch64 build-qemu-efi-riscv64
> \ No newline at end of file
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
next prev parent reply other threads:[~2025-03-18 9:41 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-11 15:04 [pve-devel] [PATCH edk2-firmware/qemu-server/manager v3 0/4] AMD SEV-SNP Philipp Giersfeld
2025-03-11 15:04 ` [pve-devel] [PATCH edk2-firmware v4 1/4] Add OVMF targets for AMD SEV-ES and SEV-SNP Philipp Giersfeld
2025-03-18 9:40 ` Markus Frank [this message]
2025-03-11 15:04 ` [pve-devel] [PATCH qemu-server v4 2/4] Convert policy calculation Philipp Giersfeld
2025-03-11 15:04 ` [pve-devel] [PATCH qemu-server v4 3/4] config: add AMD SEV-SNP support Philipp Giersfeld
2025-03-18 9:41 ` Markus Frank
2025-03-11 15:04 ` [pve-devel] [PATCH pve-manager v4 4/4] Add configuration options for AMD SEV-SNP Philipp Giersfeld
2025-03-17 10:13 ` Markus Frank
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d0596f8e-6d03-499c-9bda-dcd1bb0dcf0d@proxmox.com \
--to=m.frank@proxmox.com \
--cc=philipp.giersfeld@canarybit.eu \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal