[openEuler-24.03-LTS]Hygon: use confidential computing provisioned secrets for disk decryption · Pull Request !468 · src-openEuler/grub2

use confidential computing provisioned secrets for disk decryption

issue:
https://gitee.com/src-openeuler/grub2/issues/IB40VQ

This patchset is cherry-picked from
  https://mail.gnu.org/archive/html/grub-devel/2022-02/msg00064.html
  https://mail.gnu.org/archive/html/grub-devel/2022-02/msg00065.html
  https://mail.gnu.org/archive/html/grub-devel/2022-02/msg00066.html

Since this functionality is still in devel, we change the code in above
linkage to support full-disk-encryption for Hygon CSV guest.

The description for this functionality is shown as following:
  To achieve encrypted disk images in the AMD SEV and other confidential
  computing encrypted virtual machines, we need to add the ability for
  grub to retrieve the disk passphrase from an OVMF provisioned
  configuration table.

The first patch adds a '-s module [id]' option to cryptodisk to allow
  it to use plugin provided passwords and the second one adds a efisecret
  command to check for the secrets configuration table and provision the
  disk passphrase from it if an entry is found.  With all this in place,
  the sequence to boot an encrypted volume without user intervention is:
    cryptomount -s efisecret
    source (crypto0)/boot/grub.cfg
  Assuming there's a standard Linux root partition.

src-openEuler/grub2 .gitee-modal { width: 500px !important; }

搜索帮助

src-openEuler/grub2