From nobody Fri Apr 19 01:42:29 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+74639+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+74639+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one); dmarc=fail(p=none dis=none) header.from=amd.com Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1619783553640365.6375092538859; Fri, 30 Apr 2021 04:52:33 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id Px1EYY1788612xU5b1wy2tZ0; Fri, 30 Apr 2021 04:52:33 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com []) by mx.groups.io with SMTP id smtpd.web08.10381.1619783543755812561 for ; Fri, 30 Apr 2021 04:52:25 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=k0Pj/EWo/Y7c28xkU5bq0mpMW6ZNPjeWVEDf2zu+xqLr+cGskR0a2Z3cQMlSOFwW3GZQM2hzuPiZxV0Mnobsx6N9TULU09/Hb4//1I1wrP6/ERQ2jLqvk7XLyJPVcQzREvI+VsQjU6sunVLVlwpR1aguSaAWxRxwN0Wp9q/87qd9bj+NG4uxCda7lURbZnNcoZ8uCuX6QfXE8sq+vJsQicjxy+XABsvR2vIbrpWJqexFPwhMHR73JS0X3aosfy6yv7JfvRA6GNRxWACMCiCrufdSzPXsjdTGr1JZJcz0Bp2xpThykWzml3K8Pw8NB+BfZ8unU7zr/boXvruvU8+6pw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8lba/8wuuSoPhOgXb54ZbVEYSWp+ZpMag1F9XZ1VmpY=; b=k3KakuW80g65A+40BoJ53IrhBZvgKE349SGE9900G0nsA1ybd7VwjUVYn9OTFQrXcdQy1fe+wexbdviRd3Fsb2XqbSpQqkZ5XD5QcqAxGtCiMIAYSQPOLktncp2j/TkLcxPtcUCu7HPiEDrSxaeLLx9nykUPUBOz3K81/A8uPf7SwNlW/ybGguMSzRD0RjQttPoWvizK1z8ym2a1iMi58v1B6D3W9xOnV3ReE4IK2lWz0nzTv07R5kY2sPS21q8R8asV21L8PPejoqQQuAVYZ9WQgnNfxS0fVUyOVmnO0YJDH3Dkv7oZ3z6UdSjlD6X0mXNOHxKGdq5uO0KcEns5XA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4349.namprd12.prod.outlook.com (2603:10b6:806:98::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4065.23; Fri, 30 Apr 2021 11:52:23 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::9898:5b48:a062:db94]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::9898:5b48:a062:db94%6]) with mapi id 15.20.4065.027; Fri, 30 Apr 2021 11:52:23 +0000 From: "Brijesh Singh" To: devel@edk2.groups.io Cc: Brijesh Singh , James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Laszlo Ersek , Erdem Aktas Subject: [edk2-devel] [PATCH RFC v2 12/28] OvmfPkg: Reserve CPUID page for the SEV-SNP guest Date: Fri, 30 Apr 2021 06:51:32 -0500 Message-Id: <20210430115148.22267-13-brijesh.singh@amd.com> In-Reply-To: <20210430115148.22267-1-brijesh.singh@amd.com> References: <20210430115148.22267-1-brijesh.singh@amd.com> X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: SA0PR12CA0006.namprd12.prod.outlook.com (2603:10b6:806:6f::11) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SA0PR12CA0006.namprd12.prod.outlook.com (2603:10b6:806:6f::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4087.27 via Frontend Transport; Fri, 30 Apr 2021 11:52:22 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 2e29af18-9caa-49e6-ce96-08d90bce6aae X-MS-TrafficTypeDiagnostic: SA0PR12MB4349: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info: bnegS2FW5yhIIlJUU4C9XDuMVUOXUFDIw/gT2jlbP80DlYoTu7PiMkNKUI/+cRD0a4OKLpg9TcngqSKAvaqrU/ZOH1Di222Reh706QH51JpiHu0gh2sdSktvli7Sji8P0GVRWz2fD+oWF69oJy9W+a1HyV/1V0kbByJr9M0Uz3KjO3XQVp7UskjgBycLfJkQqNZkFD7uuw4uMRLCuHyAQLVmUSe6VpAK+0v7CsNz8q0ZgmJE0h/8wlxQw0gDX0CLIxQ8no5hBUMzrSr5d/zKEDsD+xA2WohNzfe1oSf0HVCKKsTYI56sirEvOKhUYjO74Uc2VTPyC8ZaFKFPjEDlpTlQXLWKeB7HrVilu83jhpVHMjdVOn8nFYHl8W15OcH5kgmm6z8xEQUD8YkDW/QovI4my/MYoBJ1zXYFlEe8yw5g50RkfL8uznuDs+c2BvdsGvI63EoZsuE6T95hpLX/NfmVYC7EVzE+znxXT0JaPvj+HBgVM7NaTNxzqTQTW9xnpGFJL0owtL6hGrwXIHUC//1nZwZalIQawW3jYxn90PETKkxQLHME2XV1yEZoiAMjsrDa/QBERLr3S5ywUVUZkVE5DvPJfybCFRNksh1okO3ifjcyXHikJ4RbncukG7KZO+wFdITQ/UaiEPJnNx5LScrwlPRbwXpHXKTuAHtP6VVHindPZR/yCXj/xH3U7zYljmQbC79izI4WiTkzEOvL8YCK2XNej6E3JR3dPy1KAM8= X-MS-Exchange-AntiSpam-MessageData: =?us-ascii?Q?mE7V3MHZ0JvOWSVJV7stDryxzLIxkmXIHGq1qloUMppUyRnRh3Ql0YOYke+W?= =?us-ascii?Q?D4o6acU4AuT7Cvm2MTqiDFZYJl93+a8q1OpR4fAkYjbGVqBzIFcR0ltYLhaD?= =?us-ascii?Q?7SDjdkKNcL8uMzcMG/F+wdENCzZLHY1F2M92DFH4hBOqgb8UKBbMMBd3bmIp?= =?us-ascii?Q?JOPIWYqkSVW9UdDiMiSm3NePaHTDUX9cjwwhq3AsbrsCgOyXEverqNtE3Xhb?= =?us-ascii?Q?eoC/Gz7vG4QRtfWVNbMB31U3jW1AQh32Ob60FZsY42K9Ywkrj10fSiwFtokB?= =?us-ascii?Q?l59+sHx5r3QLrZjAoE9Hj6dpxICX0RiRo7WdwglUMH3Ctc/SD6V2s2btdJhk?= =?us-ascii?Q?eMmwpHaUbz7Gf8IK3hKTJohiaMrozjM2oi3qtpE063MOg7H5G7O+PS6+2ihU?= =?us-ascii?Q?m9tAo9/XcdU7K/Gtj/pWsHLg7BEsfs+dM6wahtJ+57yYURc7dVjF/UvSaZwL?= =?us-ascii?Q?zbxus5Lc9+dI2nryTqNfGZ75Hz0za7v4Wln7XT+qZhjcN77ikVRm1I5gVVsf?= =?us-ascii?Q?LKip4vAMtVJupBY7pZc+Scr0QTDmHO1BVywLsLfWHcM77YfJ+oXV1eod8hsT?= =?us-ascii?Q?l6AzkUe+G672rz0P/sLHNSGPou01uf4xP4y1JJjP4+SZSstFt7FaAnDbslX0?= =?us-ascii?Q?qSG8YICJXy6tIsMBviCX64gdotU61t9u8Dc+ejlpOC9cA0LBfY4BTPC3Zlvs?= =?us-ascii?Q?aPllgiHLLoEOgD4tYZMrJ1BVFqUGCChTJ1AcDTpoK0hlNj1heLyue+k2RQJ3?= =?us-ascii?Q?00lBjwt38mUxGuv9Fv5Psii7Pq8ITiC/VMgJf6ji49GbH9MVHDRtvmhQUHxE?= =?us-ascii?Q?s0KwX1ccfmMZcILV1bnhY0LXGyExAnF7WWA5uO/EI/pVGHWv5VqDJU9i8pAc?= =?us-ascii?Q?+FdGBjH0ftUM/Vip/DloP2MPgd/+1gf0HVLKerUOk66nf10XHpKU8ZAJIoy9?= =?us-ascii?Q?9YUTRbNuRUJBCEWr1T4qCjlKdsa0lCikhhk42NQEhNXDa2LLJN9kAlMtxskT?= =?us-ascii?Q?aVtZmpn/FN+0ebL2wwrlmGDI2vRItb8HtZcIawYu8VfG1Em7kkDSfo/RFoLi?= =?us-ascii?Q?tI9NDdxhqtJXCA2jiEZvrGh2hdiR8o2MJdy5LGj6N59NoYZK7DRkRJLdbGHJ?= =?us-ascii?Q?J4rliU3LMXV3G8qpk0whbSHsjRfQsN7dqaBjxcSb1NgayWkjOAuLn1Wl6wrD?= =?us-ascii?Q?I7sSo628NW6HVk5OoCsraKnIlAz10DD0YMtyeLcAWEMeP/Zn7itp4qwUyuvL?= =?us-ascii?Q?+UW/NvR32ngCmojMI8+QkTP+FO3UUMY0zW+LA+a2tvk3KjHzm1oGeIw8TGN2?= =?us-ascii?Q?pP/S0wSFarGHHVAVdmJFB0yE?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2e29af18-9caa-49e6-ce96-08d90bce6aae X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Apr 2021 11:52:23.6292 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 2Pu6d1xCnKiFYPBOYbhGm6C1Q6EMoW/2odBi6Y20UPNwVlHdmGtpN7irtvIi9YXjodeRSU5yHLmSzkJvs/SW7A== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4349 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: wpDqcpEYmQXYdqPnDXJqqMbKx1787277AA= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1619783553; bh=pxMlOJwL1YYKMz4ho0Afe3FvDditpuc2l9PVW7RJz8g=; h=Cc:Content-Type:Date:From:Reply-To:Subject:To; b=HvRbNnpFhMIZ/nc8lxviWESx5ac8+9lXRigHnSoZk/CISVCwdmzJe6CoGG2awK9fKvV plZEQyO9U7QfK4xj6S7C4WASCc9RHBZxJZhfirdnkq9zLqyZj+JJ4bHlDztcdQjB8dR0c RoSIdRdlfhBQX0fVk+PXJkjxwD1P60uIY7w= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 During the SEV-SNP guest launch sequence, two special pages need to be inserted, the secrets and CPUID. The secrets page, contain the VM platform communication keys. The guest BIOS and/or OS can use this key to communicate with the SEV firmware to get the attestation report. The CPUID page, contain the CPUIDs entries filtered through the AMD-SEV firmware. OvmfPkg already reserves the memory for the Secrets Page in the MEMFD. Extend the MEMFD to reserve the memory for the CPUID page. See SEV-SNP spec for more information on the content layout of the secrets and CPUID page, and how it can be used by the SEV-SNP guest VM. Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Laszlo Ersek Cc: Erdem Aktas Signed-off-by: Brijesh Singh --- OvmfPkg/OvmfPkg.dec | 6 ++++++ OvmfPkg/OvmfPkgX64.fdf | 3 +++ OvmfPkg/PlatformPei/MemDetect.c | 13 +++++++++++++ OvmfPkg/PlatformPei/PlatformPei.inf | 2 ++ OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 18 ++++++++++++++++++ OvmfPkg/ResetVector/ResetVector.inf | 2 ++ OvmfPkg/ResetVector/ResetVector.nasmb | 2 ++ 7 files changed, 46 insertions(+) diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index 9629707020..dac5fb1653 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -317,6 +317,12 @@ gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretBase|0x0|UINT32|0x42 gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretSize|0x0|UINT32|0x43 =20 + ## The base address and size of the SEV-SNP CPUID Area provisioned by the + # SEV-SNP firmware. If this is set in the .fdf, the platform + # is responsible for protecting the area from DXE phase overwrites. + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase|0x0|UINT32|0x47 + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize|0x0|UINT32|0x48 + [PcdsDynamic, PcdsDynamicEx] gUefiOvmfPkgTokenSpaceGuid.PcdEmuVariableEvent|0|UINT64|2 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFlashVariablesEnable|FALSE|BOOLEAN|0x10 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf index b04175f77c..5cc1da425e 100644 --- a/OvmfPkg/OvmfPkgX64.fdf +++ b/OvmfPkg/OvmfPkgX64.fdf @@ -91,6 +91,9 @@ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupBase|gUefi= OvmfPkgTokenSpaceGuid.P 0x00D000|0x001000 gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretBase|gUefiOvmfPkgTokenSpaceGu= id.PcdSevLaunchSecretSize =20 +0x00E000|0x001000 +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase|gUefiOvmfPkgTokenSpaceGuid.= PcdOvmfSnpCpuidSize + 0x010000|0x010000 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase|gUefiOvmfPkgTokenSpace= Guid.PcdOvmfSecPeiTempRamSize =20 diff --git a/OvmfPkg/PlatformPei/MemDetect.c b/OvmfPkg/PlatformPei/MemDetec= t.c index c08aa2e45a..02584123c1 100644 --- a/OvmfPkg/PlatformPei/MemDetect.c +++ b/OvmfPkg/PlatformPei/MemDetect.c @@ -894,6 +894,19 @@ InitializeRamRegions ( EfiACPIMemoryNVS ); } + + if (MemEncryptSevSnpIsEnabled ()) { + // + // If SEV-SNP is enabled, reserve the CPUID page. The memory range s= hould + // not be treated as a RAM and must be mapped encrypted by the guest= OS, so, + // reserve it as ACPI NVS. + // + BuildMemoryAllocationHob ( + (EFI_PHYSICAL_ADDRESS)(UINTN) PcdGet32 (PcdOvmfSnpCpuidBase), + (UINT64)(UINTN) PcdGet32 (PcdOvmfSnpCpuidSize), + EfiACPIMemoryNVS + ); + } #endif } =20 diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/Plat= formPei.inf index 6ef77ba7bb..6d18b0be9f 100644 --- a/OvmfPkg/PlatformPei/PlatformPei.inf +++ b/OvmfPkg/PlatformPei/PlatformPei.inf @@ -118,6 +118,8 @@ gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiReservedMemoryType gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesCode gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesData + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupSize gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase diff --git a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm b/OvmfPkg/ResetVe= ctor/Ia16/ResetVectorVtf0.asm index 9c0b5853a4..05c7e32f46 100644 --- a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm +++ b/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm @@ -47,6 +47,24 @@ TIMES (15 - ((guidedStructureEnd - guidedStructureStart = + 15) % 16)) DB 0 ; guidedStructureStart: =20 +; +; SEV-SNP boot support +; +; sevSnpBlock: +; For the initial boot of SEV-SNP guest, a CPUID page must be reserved by +; the BIOS at a RAM area defined by SEV_SNP_CPUID_BASE. A hypervisor will +; locate this information using the SEV-SNP boot block GUID. +; +; GUID (SEV-SNP boot block): bd39c0c2-2f8e-4243-83e8-1b74cebcb7d9 +; +sevSnpBootBlockStart: + DD SNP_CPUID_BASE + DD SNP_CPUID_SIZE + DW sevSnpBootBlockEnd - sevSnpBootBlockStart + DB 0xC2, 0xC0, 0x39, 0xBD, 0x8e, 0x2F, 0x43, 0x42 + DB 0x83, 0xE8, 0x1B, 0x74, 0xCE, 0xBC, 0xB7, 0xD9 +sevSnpBootBlockEnd: + ; ; SEV Secret block ; diff --git a/OvmfPkg/ResetVector/ResetVector.inf b/OvmfPkg/ResetVector/Rese= tVector.inf index dc38f68919..8e52265602 100644 --- a/OvmfPkg/ResetVector/ResetVector.inf +++ b/OvmfPkg/ResetVector/ResetVector.inf @@ -45,5 +45,7 @@ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamSize =20 [FixedPcd] + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretBase gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretSize diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb b/OvmfPkg/ResetVector/Re= setVector.nasmb index 5fbacaed5f..57f01aa7c7 100644 --- a/OvmfPkg/ResetVector/ResetVector.nasmb +++ b/OvmfPkg/ResetVector/ResetVector.nasmb @@ -88,5 +88,7 @@ %define SEV_ES_AP_RESET_IP FixedPcdGet32 (PcdSevEsWorkAreaBase) %define SEV_LAUNCH_SECRET_BASE FixedPcdGet32 (PcdSevLaunchSecretBase) %define SEV_LAUNCH_SECRET_SIZE FixedPcdGet32 (PcdSevLaunchSecretSize) + %define SNP_CPUID_BASE FixedPcdGet32 (PcdOvmfSnpCpuidBase) + %define SNP_CPUID_SIZE FixedPcdGet32 (PcdOvmfSnpCpuidSize) %include "Ia16/ResetVectorVtf0.asm" =20 --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#74639): https://edk2.groups.io/g/devel/message/74639 Mute This Topic: https://groups.io/mt/82479059/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-