From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80077+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80077+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513057825808.6797800786101; Wed, 1 Sep 2021 09:17:37 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id 3M68YY1788612xPZ6wkmsYYG; Wed, 01 Sep 2021 09:17:37 -0700 X-Received: from NAM02-SN1-obe.outbound.protection.outlook.com (NAM02-SN1-obe.outbound.protection.outlook.com [40.107.96.82]) by mx.groups.io with SMTP id smtpd.web09.151.1630513055289667530 for ; Wed, 01 Sep 2021 09:17:36 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=m2AtZ3oeELp7JkjJ0cucPTsBWhHgd5NZYm0eKK4quchizwazPokFkPinRzi9oelbao2oqvrV4hPEzZI8JRP8yy4z1kUHgcZX+MCglQrMvkTJS81LIE7fZEzlMnljAPifyYmOVdL2EF/ncxzQyuKHKgcaGKgN0WxiFnQQRY/iMTICiYHDWqTCMMeNS/AZcHtj4c7jhkbMlbbqiqdZyE59FYX2xmGTrB54zoolwNDR4Urbb/s9Jjw1tTlFQYLe0JWkmx7EbEx0J3RjWd530S7X90AiOS6vhP7r2AG6mDhjFE6opT5xt8JhL5wNMwxzaD+vaEWVRR0wtEW7zJmr5SYxHw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=EC5azXKMRfzEI215/YLeNa7CA9RVQ8LpIaE+hWletp8=; b=DjNJgE67Hyrrtv9dwPxiD+Ad0nuGLkpFHulI8GpAKa391/zyQCbSWR+YBdMzVCc38ShKytfvP7GCwuds9uBzLec2aDdkCMoyUgJlR8QVkuEzkSOggcuTve+7oT/gQqz9nKU8sbdWgyvTB4yXT/xTK2zVJVjJMDQKKFnVznZsCeaDUPee0TdYvPsN5ZrQdLl+pBAPtmcoRqEljFPQvd40lrm+UR5AsjoJ3RXbgZhxwRGSK6oxqEM3Dl/VLtU5lDpUHntO85VtkizSmd7YAjKZVwNqBNUERCefYf8w1Xty/EFTimvJyrkHSKV6PCp/g3qEgc7/gzbWUjOxk2bvDD4+Uw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4525.namprd12.prod.outlook.com (2603:10b6:806:92::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.19; Wed, 1 Sep 2021 16:17:34 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:34 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 01/29] OvmfPkg: reserve SNP secrets page Date: Wed, 1 Sep 2021 11:16:18 -0500 Message-ID: <20210901161646.24763-2-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:33 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: ec375d3d-172c-4018-4b81-08d96d64019f X-MS-TrafficTypeDiagnostic: SA0PR12MB4525: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6790; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: dVjf4QV5mFLAiLLLStWaOvudFbiVDDZHl16Wi1pFxKnKH2OV6tFrHS7csdPI/PAg4CvxB3s9f1kmfPkiapNFAoNSuw0BwVFEoKS5XnQdXICY4I1vG7SE+Ou/8h1eQ1NCfJdD3XlTiMzWuY3orwVXnUQemcD/Jw/R4VD/HAcC1CkzYwjwKjZckXz5BnNDfdt6DRYYcpxEk9awud0RhdeyVt8jcF8QZlIJ/Hav+xJUe10/Uyo8p7dDVKFevnkv8vRodYkm3LMzoCd/60QsXBtuH0paqOgxbSfI6R+4dtuGjTo3yoQHrJZ3PnNxDlBTWsbFj0PUanoaEtAi+d63fKcUCcXbaikAXd4hBXoK/MbQjcE6Ms9m6Bd8QKx8DDlnxbtCZbDKsIX/x8WogQe9kNoEtApX1jFzyRpYLw1lfj53N4vOfg1qXfdQuIn2FS0FjnxMYSETqF4bUQYfIZ4yXep639dH2DyL7FI2Jck+vZ2nG/lHmVnpJ2MSkr0OwcbiSqO7L9nZ+qA73RAQhjxzEehqPFFz0N3HGOI2TTp+3Eike2LqOJi0Vm8CKENjc/aJYSQWkz2c3+WxGxTGMV1D96JgbFmSsacyuirqm6prxfT6V60mN4PHrMplNv+A0OEZ9Hq3zyAEVy+PFiagn8b2omPPgq8kpQ0rmv8mepeg9yHHC1Dupz4NhDJQOsilVx905e1auExQlKJ6aZoGZZsmzd+EHq07yKL/nqoiDwGOMMmmRlA7BN44Xm3Bubih7yEnC4/Drld8l6rZFS/H14vMMe6HtS5cNLHU5Kfdn3AvNmVzSYQ= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?vg7lmaw7yXWLNCZ7g04IEilxm9szZh6PH8ON5957RieDXbr0crQgpMLElINf?= =?us-ascii?Q?RtNV4iiuSmqpHz34ix32BymswNb7S5tap907F1Yu8w4L2tBmNeLmwehiiaBY?= =?us-ascii?Q?HREisvqpB8+Z8fiig7kLCp/jsdaVEXaqGGiQu/BlZlSQN4eVBZYlMwiQJvb1?= =?us-ascii?Q?Hzy4uwLrW3OqjQcEZVXP/iSspmSvZf+jAtyaauHLr+/tQY3sRg5mBGIjQJrN?= =?us-ascii?Q?plES3bN7CAjWyvRsMvx9nzBfObl84tbe8NiSJb0FDj+u+66/1eelcErX07NV?= =?us-ascii?Q?j72X3Sse7AYkcLWb4204ZLUKy+/UMc94arujV8EvRtK51Vi+wGbdHQ+d8puE?= =?us-ascii?Q?TFXo+E4Z+WLVcIjaXqJLRDS7JUZ2Cj+f2z22uXzzkuHPTCMAmbcjxbCdy04T?= =?us-ascii?Q?geLGdjDtsyUY5+GQriscrAFzsvE8Fjr4ShN0Rm1MUeo4ClQ/SVw8etcTkIgD?= =?us-ascii?Q?j91V5ay/pKAFNN7hV4Oc6b/PoXm3uKtlTvLPt75jfD7Ihwb4l9qSw+8eMv4D?= =?us-ascii?Q?/D9tyMPX21UYk5h9Tp6Ml9lfCOT/O4I3yYKyllhwl03ZlyiqMWOMOK8Tiqkb?= =?us-ascii?Q?mJUWDlMmsInYbm4QEYZKSIjfqOYgu3UXtjV2+B+ImjOZfBgp37CEulOYE88+?= =?us-ascii?Q?qnnOFeG8B44H5RTKuPCrzGYNbqUoD72oUAP+sL9joiL1bnOATogJmandyi3G?= =?us-ascii?Q?KC0Q8h57qYBb9z6ON5sFd0u7FzDeCGMRF1HEdESZAilUoENSoHdzNbFnHmtt?= =?us-ascii?Q?LuG1WdPQdPO90hkAiMS9Hsx6cCSJ9WrBZjhENTxa6wAqlN2UZ5e+Yya7p0Xs?= =?us-ascii?Q?lTgbZC2Zwl+UtoPL9vn3PUfbKZmxGFjJsexKsfTXRJD2N3f5/kL7aeQzKtrs?= =?us-ascii?Q?6UCpFVtqwqe5OndW4NlbhVbQoSFBVdM2VZANmEIavfb34hqyIV2vw8rOtqb6?= =?us-ascii?Q?1oxbs/dzgTJmPOdfHn/10YOM6Jn7qP1f8WY3xC31WsPOulP9LYv8gB3D4ntF?= =?us-ascii?Q?dp1epjc6Vis7jiKRM4DDl1RMSUqL2K5UcFE1u4SpGSgRrpWQB9AJag/BFmH5?= =?us-ascii?Q?qDXMwf5MQzn8oA564rMPayUFBehaOkINZ/LUa4ggdJPyLQPEQ+DnUCTPt1Eb?= =?us-ascii?Q?68PNXS8T0hA3Okvj+Fs/NswGBwr3bnN6AJH4cIiVrFPAF0us4b8qQpwJrmxS?= =?us-ascii?Q?ne4wldDPYZZ8i9IQtK7pPiVGHkdygIu5T1olR7uENadgJSO1ByMM+jjDPpO4?= =?us-ascii?Q?vPi3eFPIqLSf2v/D4Dbub8jWtTF2+xuVCTq9s2JTYy/v8B/kpIoX5ufK+XWb?= =?us-ascii?Q?+eVaejQT7GQwb6fU+fKS4Olk?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: ec375d3d-172c-4018-4b81-08d96d64019f X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:34.3078 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: p+QLIHWDIn1iBQishyq3A63awMMjVJHYX3MhnuMcq07ZVYnE9Q954Oaf9ju5hJvPH2Ks8giF0UmcZhCvzNafcw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4525 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: Sy1ViSZmdKgT4Gt60RFqChXax1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513057; bh=39X6DXWFCzAGr3MRvClWiJyFwG34UZo/BhXW0RH16sM=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=dkNikDLe4yiXiWleKUobn+z/CsgN3KS+0Mi3uNkswU77LRc0sBNpYC7sI1L6f2rCvFc CHkFTN0hnqNDl5e8ylukAclupjgaOhxjuUCuNqX03BeN3hUGpO7VSGbqWT6cmNj5lDYwI rTmcObAZL6o+z2GsWV6Y/d7t1vDMRuLLFbA= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513059817100006 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 During the SNP guest launch sequence, a special secrets page needs to be inserted by the VMM. The PSP will populate the page; it will contain the VM Platform Communication Key (VMPCKs) used by the guest to send and receive secure messages to the PSP. The purpose of the secrets page in the SEV-SNP is different from the one used in SEV guests. In SEV, the secrets page contains the guest owner's private data after the remote attestation. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/OvmfPkg.dec | 6 ++++++ OvmfPkg/OvmfPkgX64.fdf | 3 +++ 2 files changed, 9 insertions(+) diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index c37dafad49bb..6266fdef6054 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -340,6 +340,12 @@ [PcdsFixedAtBuild] # header definition. gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader|0|= UINT32|0x51 =20 + ## The base address and size of the SEV-SNP Secrets Area that contains + # the VM platform communication key used to send and recieve the + # messages to the PSP. If this is set in the .fdf, the platform + # is responsible to reserve this area from DXE phase overwrites. + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase|0|UINT32|0x52 + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize|0|UINT32|0x53 =20 [PcdsDynamic, PcdsDynamicEx] gUefiOvmfPkgTokenSpaceGuid.PcdEmuVariableEvent|0|UINT64|2 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf index 23936242e74a..5b871db20ab2 100644 --- a/OvmfPkg/OvmfPkgX64.fdf +++ b/OvmfPkg/OvmfPkgX64.fdf @@ -88,6 +88,9 @@ [FD.MEMFD] 0x00C000|0x001000 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupBase|gUefiOvmfPkgTokenSpace= Guid.PcdOvmfSecGhcbBackupSize =20 +0x00D000|0x001000 +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase|gUefiOvmfPkgTokenSpaceGui= d.PcdOvmfSnpSecretsSize + 0x010000|0x010000 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase|gUefiOvmfPkgTokenSpace= Guid.PcdOvmfSecPeiTempRamSize =20 --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80077): https://edk2.groups.io/g/devel/message/80077 Mute This Topic: https://groups.io/mt/85306654/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80078+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80078+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513060184368.3313626463406; Wed, 1 Sep 2021 09:17:40 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id dtZCYY1788612xbWdExxSc3r; Wed, 01 Sep 2021 09:17:39 -0700 X-Received: from NAM02-SN1-obe.outbound.protection.outlook.com (NAM02-SN1-obe.outbound.protection.outlook.com [40.107.96.79]) by mx.groups.io with SMTP id smtpd.web08.180.1630513058900363660 for ; Wed, 01 Sep 2021 09:17:39 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=J5Ije9Mhpd0ScJSse8lcIM8OXGvb2rac2ehppxzTPv2PVLzFH6T2u6GVIPyYAzez8Ix7wMIx6XWAaxoD9z+D8UiZ/k9C9d+BohulUPRB2rWX5PbFsa0CgclnXTVfcM6zvFlzsw2NgkeGNxMgPO2ruMS/OnOwSnz8ubEAQtp1tzCGq4jp1xRI2/OPb8zlUSa5XeazqLa98GklzDT+yI/PU9mqXeuUTOAmSNswsmjSg2X/CULsf/EgMJeeMIl8T8t2GCp17zMob4J/FkjxU7zuwJZi5nEjMXGND5hyvwGsG3tk3zG95Bot55r7gCnVgDZKl6etlsf86OTcNErXJ7dfmQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=8OkTZWmcVby8DkIdYFjiJEiowUuxxivA6vO0ABgKU2g=; b=UsUWWudK8yHPotnPLOEB7/xdNc/QBxfB1ctzPB9gutVKMH4RKYBKV9L4l526RrEvUBVtdzRZ8bF0V0vHFqAeYe9IVpGfE4Tv1Nt8fWviSJzE/HCKHJRVkKZh1nQHYKkLXBe8qKrUt2tTmiEOckDVyCk99O+Gh9Nos1aXcn5aQ/i8pxs+wEfE1u8ErQq2lkQC4v6hYllvkR76LqzU6ddlJSd0AkGieBvBMeTMJi7cFpewXBrcilRfZqNztRmvQZQgjcdwG/mcvC+TDU/sYbiQVTvIAKCiQNKkZzkfdSxBv9GRfSgGOzoSmoL3hjk7r+PzBDK1LakCTwyDEj88ogXmXA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4525.namprd12.prod.outlook.com (2603:10b6:806:92::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.19; Wed, 1 Sep 2021 16:17:35 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:35 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 02/29] OvmfPkg: reserve CPUID page for SEV-SNP Date: Wed, 1 Sep 2021 11:16:19 -0500 Message-ID: <20210901161646.24763-3-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:35 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: d8e6e6ad-d4da-46df-93ea-08d96d64026a X-MS-TrafficTypeDiagnostic: SA0PR12MB4525: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7219; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: F+5WghNtlto9cS3Lhls//vAmuo1ULomss+MyX/E6/I7Il7qW54vyvd0Qk1Go+4c8SmxJ58sP3gPG9021WVBL5Vo05S1v9H5wepZ8m2LQHRAMGVsEgDyULQqFb0zp0u6y3Ol3l/eSZTizJMDJ5cOOMfQNlmerIjxvwWD/+esluBtP4/942RHrV+Yh2NO1QxQQ4f/KoOeHV4rG0ozcO6g2JsOvtl5MnPUhlx7KSI6nzmk4tmi81imX5H6YGkC2EC8QYLNQuTofdqs5E+y/AT05IENmkOaO9QIdTPljxCK2lXRCQ0qu1KB9grqBDMPJEWdPdKTLcgDfMMqcg/HeNv9J89Rgjc3E7waaRsKCXnUNhV7/e5App5eDJuxlm3xgc4DiXcvT8vMtvrBb/NFZ85B8qTE0LUQ2SG/i8YR9yVX7Z+rr4meBcUhmE/in7RbX7YFveZ05IotuaP9M4n+7DbVI6V+6ObxZRUEgC636S/FxJHeuv6jj/ZbvqwhKIpRUIIgjxqCULf7K9DIi5jOLeEaA6CTF7ykTPi13R0VEjzH5CMESoFnTKCoY3jnlvdJwcX26g7GfeIQ76PtwwA0a/1B//JG7sSO9pFtpGwecewo5fTCmMMRIU+D08H5wZPEAJq8ETURGxz87KccU0OYODZzOpFWroEYDh6iyzSeyaOWUuXddBaVYXy7vvYbG7YGJITDkbIoo6a9OFX1hgNviIwl6kFI1ZOO5l04ToSlI1o7iPzfmpEJ4NGZGGfKsmFwWMVf9r3kXGdfyuV2fCX80SKkD0Cn9dRHDrRHww8IJTA2GySo= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?U+xJUH8Z14w/2YCtr4GME4ZsJ4niJyImGUFKUhxMlhhZpUulcWdhiFjPGzzd?= =?us-ascii?Q?4SA5rWkCjJgyRh5CanOnp+c9TL44VpI0GEOLrSKmFHvKYIDy8MMp7UrHtiXM?= =?us-ascii?Q?8hqVESvR8BBtR8ojUEd5MuA38jdmgLGwXnCrliuTbotFYJm/mRZMO/M3SgrN?= =?us-ascii?Q?4l+WkQDeg5TlB9rQKGVN6OxutaLaj6jccYC38WOvgfYABaJA3lBhjRxEqf6B?= =?us-ascii?Q?3IbFB4qF6F1Gy5D8WeVv+gRQNr4EMjzxww9Y3soqoCzwHWqAuOoA6wH6MAiG?= =?us-ascii?Q?N91RBHgAn39POXY9a3bOWbfL3gGCZB9TneE7BYXTIB1yjoj0MQoZ4LT0tI42?= =?us-ascii?Q?bzf7s6w+vmKvD3Pv86uiMLlGWQmOmd3MaLmKE/LFwLJB2WewGZ2q6yTi4cCJ?= =?us-ascii?Q?JnII9jilyYX2Pp1V6jF8d0DX8UMC4+LTf0beTo3S+6NQY7GFZZD7gTg7MmGt?= =?us-ascii?Q?NHTFbKtzMHrYtpqt/iZmHYnHYwU4qLzX/yJIsq9K6lfK3Ebn3G03glwq9mxg?= =?us-ascii?Q?9uc8ganswBFMW8EFFW7C/XtC0aoOFQ/L1xcfq7sqT4lXsT8YGmyJVJETWRG7?= =?us-ascii?Q?zqqI5DJFAHgxu3eLAnSEpFaST18dLxqspVJhwqGeGsUIDhHFv3dngQlMu9oC?= =?us-ascii?Q?H2wJ2IGpMG0jG1aw4rggLvVvWG9tQ7//AEESgY6mhpUR+L8zpTvfziQ7aPS9?= =?us-ascii?Q?JnJk2mVELvi2+hrejqt8YRJEFUQGNqDIrqmNqjTibca4f6Fj2uBwtO1VeB5f?= =?us-ascii?Q?0H7YuhdxGL6VGWq3D+Z2dmWla7Whouko9s90rq5DnXzZKfO04IyJZhsvzIQR?= =?us-ascii?Q?S44eHrkEul2Wtwkl+UpsOcCUhaq74sF8dT3w9/cFhIEn/KAB1niBAnJzfvbq?= =?us-ascii?Q?ZoLFyr0ce6yQdNJGyrtWVYphXF6hZzB2yEgKEjFW40mslgU1r1KnKvBbH33s?= =?us-ascii?Q?XTN3c4/WD3INrBvr8z28DKrAxmaKQ6kOyioiwa2hOQ8vyIn/qLFLo35udRO8?= =?us-ascii?Q?zI6nREHx4LUprCERngC8YarxnQ9MJ5eBfQ5QgYMIlNJuvrnWTocf6L+icfCJ?= =?us-ascii?Q?aBdvdp1gDBueBjp94pRxypn1Z3Z5hwOkGA5T2B3pmg1kX5J0LcnWG5l35wng?= =?us-ascii?Q?bLpyXt0fitYgT1/KVWcJTYW3+xba7FNV+0JePqf7ydOBYA5aZadmPBSmFJA1?= =?us-ascii?Q?n9BVROqm3xvfbyD/ik/JF2gqlN/HYBC7LfXqvBk52so4QIWlsm54cd2xMeHu?= =?us-ascii?Q?XtS4uSKj5zl/mFokCxDhehMZpS5IwlyWf1s1Mma4kQv/LHsYaEHylCGm5Hrh?= =?us-ascii?Q?crRLjMlLg65kBXPo24tsLWSB?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: d8e6e6ad-d4da-46df-93ea-08d96d64026a X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:35.6410 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Hfax/wV2MBh1sW/DERhkvGIZKOWYABlDKTmqcxK1Y7EQ4oMtlAQX6BcPZEravTBel9cBUJOzdbuvW9yQLOo/Cg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4525 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: b0G4qsbj228eXV2Vx75zOjsxx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513059; bh=QgJN1sFV+7Ipd4/uF/ylGQcwZ/C6o5mEDBn/LiIyIKs=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=dYdGGyl5tCsjW+QCm4XQfcIEoN9dsWorAK5yDaDY13O5sSqTdhLQ5fRSjqKRgKZ1JRg 9xL9MZcTBH0myIxCoB1T3nJYzdB7zBIMuinW4qQWmNV6ggpJdU7cZGaD5uLTdo7hcP7RR Lj6PGAi7CsY/kj6WvMTpFzik1egHhaSmUw8= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513062023100009 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 Platform features and capabilities are traditionally discovered via the CPUID instruction. Hypervisors typically trap and emulate the CPUID instruction for a variety of reasons. There are some cases where incorrect CPUID information can potentially lead to a security issue. The SEV-SNP firmware provides a feature to filter the CPUID results through the PSP. The filtered CPUID values are saved on a special page for the guest to consume. Reserve a page in MEMFD that will contain the results of filtered CPUID values. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/OvmfPkg.dec | 6 ++++++ OvmfPkg/OvmfPkgX64.fdf | 3 +++ 2 files changed, 9 insertions(+) diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index 6266fdef6054..afe9b7135560 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -347,6 +347,12 @@ [PcdsFixedAtBuild] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase|0|UINT32|0x52 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize|0|UINT32|0x53 =20 + ## The base address and size of the SEV-SNP CPUID Area that contains + # the PSP filtered CPUID results. If this is set in the .fdf, the + # platform is responsible to reserve this area from DXE phase overwrite= s. + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase|0|UINT32|0x54 + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize|0|UINT32|0x55 + [PcdsDynamic, PcdsDynamicEx] gUefiOvmfPkgTokenSpaceGuid.PcdEmuVariableEvent|0|UINT64|2 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFlashVariablesEnable|FALSE|BOOLEAN|0x10 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf index 5b871db20ab2..1e292d11ace3 100644 --- a/OvmfPkg/OvmfPkgX64.fdf +++ b/OvmfPkg/OvmfPkgX64.fdf @@ -91,6 +91,9 @@ [FD.MEMFD] 0x00D000|0x001000 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase|gUefiOvmfPkgTokenSpaceGui= d.PcdOvmfSnpSecretsSize =20 +0x00E000|0x001000 +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase|gUefiOvmfPkgTokenSpaceGuid.= PcdOvmfSnpCpuidSize + 0x010000|0x010000 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase|gUefiOvmfPkgTokenSpace= Guid.PcdOvmfSecPeiTempRamSize =20 --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80078): https://edk2.groups.io/g/devel/message/80078 Mute This Topic: https://groups.io/mt/85306655/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80079+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80079+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513060792927.3838538372526; Wed, 1 Sep 2021 09:17:40 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id BPItYY1788612xRxpXCL8pLM; Wed, 01 Sep 2021 09:17:40 -0700 X-Received: from NAM02-SN1-obe.outbound.protection.outlook.com (NAM02-SN1-obe.outbound.protection.outlook.com [40.107.96.79]) by mx.groups.io with SMTP id smtpd.web08.180.1630513058900363660 for ; Wed, 01 Sep 2021 09:17:39 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=i4KMjUauVeonBFaQIvNKWC1hc9YFVYXW1kxeDmz+yti/XpyLHgNO8FRYZ2mpvUy7apOCUr1eIqTBKezrI4DRlgjCMMtgfz99DffF4pVlbb5BqkclVHsSx9QgXZqbEb6FJevROUwmiEIeUWV4unFz0fBmlLe2xFmEj+YdqpXTFuQJTxafIbbjtrpFWuBzPlmlpQnRZkIZKy1ubaR48dPzPK8u4CB0ArL9bHuz7X4z+1iVP45wSm13Vf20nT1js9l1yfc6Bt85iCtqFzNZNzzd2cXxPxsglzCNmhIQoqHunQ2s4KVrvCBS9xd+O9nWQjgjV9bt9qO0X/yoMEi7+aqsVg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Ox7HDwxe3Sq/LSNdk9PE5eDiVOJB1ad2DW9PV3FQGmQ=; b=Y8MEDfL2a3MaXwHWTgz7p2INWMP/yaetaPFkXl1sbpspozrCxe9McOD7/2Ie1NJkr1wGGVlKwPVvNtBn5a1CGnnvL9CZyTjzCupY+p+eyT1FAf1tMxS7cB+e+U6aNKiwS8r3/sz6MWEJ0Mna8XP/PG4V/i+FPMIE4WqiPw09J+QK23MzoBifS0BukBuCfcTwkaMmw59fhYtCPwwaTXW5nb0k/Bs/BTsVFAx4qDZTijlh1dvfyj87mCvaQpHyrx4O59RC0rs3xtrsreY/y5fq7UDMLKRwuUmOfD0junsCpL6gkB8emuq5U6AnQpzvfn56YctJLnW+n/fg96z3mzO6Hg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4525.namprd12.prod.outlook.com (2603:10b6:806:92::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.19; Wed, 1 Sep 2021 16:17:37 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:36 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 03/29] OvmfPkg/ResetVector: introduce SEV-SNP boot block GUID Date: Wed, 1 Sep 2021 11:16:20 -0500 Message-ID: <20210901161646.24763-4-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:35 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: c2a02224-390d-4333-7688-08d96d6402d7 X-MS-TrafficTypeDiagnostic: SA0PR12MB4525: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:626; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: n06CfxrFmYYcGqGXvKON658t0+llid3vRKuPJJVIeRCpyidq5FGjnWi9JYND6dTxI6QTBOKSoxxL7PZsWLznvhy0es9nbTi8o8SCAPgTnSrIC+7gOTHWKelB01vQrx8fRbydqqUWd17j3+hRRmrKYZkx1q/mV0d8TmWdpt1VTiYtCGvDXliT0v3no8eqvT5lKWNQyfA/3hjnDK50U9tzCztn2wok/uRt2peEYlFRNDDVcCfFJ//W7okwegSGrTDP37djQnBov90tWb/V7pn/rwtY8CJAZDKnXjGP2Kz3awDhympkwa80LNdYg68RLmLoVZdWQ939JpLDUMHFSMjfJqPRM0r00zo2rXx+3A8+OOsbk3HHTo7/+x+2mYoOo8IlWxfrg1yyvZXzHD/LH8JjBMjdmlSXAdh1r9m+NDpqQ89+lfjXnMsRpIs4L3b6lUZIMA/Y73j0OAa2eNC1F/kioWFeLT345do45F3DPy9VBqwOuykO+8Urm1Qt7MHL0AmBeMixvd0BUHhLbAS1z+XvMCyvvslDGkZ/8om713JyRzfTXsMx1SXfLGgT9pd+GeCC5vJBRHMwBtWKJ0vWnlxivvjJkkd5+jzXl1ieoGRTJR2RtQHC64P5yAatbsmTPjTpm2iNPoFvwAx/DorwDeeShtwzBEgCyDCOuHL6paAxf0Ko9klg+zpnfPpQfYEffL7LqstBTzMyyMoaM7j6mmDh4SQbvbPBs2hrKEmmZiQMLKddgBx7TCs9PhGO3mAUCjJSkvj9OyZsAkXS0izPCcEJ0LcGHcO1Z+iKU4+jhnyFyjE= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?qIPXeSL5NNkiMaXFc15tLf3BvzwowLDnV25VpIfwZnsUTahuH1xpnHl1fFE1?= =?us-ascii?Q?o41OBFVxX7WV3Oe+C6z5xgDY2Wq/94TkO1WUEYwk66SovUSu2M7JinXaMzb0?= =?us-ascii?Q?Qc4JbQrbWkUmec92KkO4IJ3LOe1gS02cgEJ2Gl6PR8mf/0CmGbS/KxxIkrDZ?= =?us-ascii?Q?NWQziedN1rlR/sN/G95Rd4chufzU5YvJYbke9DlDepIJ44asNFdYcyRDNjcP?= =?us-ascii?Q?RVaJ7dKQ4NEJmFYCBUjYlgxUolfCZDxZnLdFDv6b5DQdzfzw8NdSBkn7Jja5?= =?us-ascii?Q?D67cmvsu5PHlv8AwX9Vb+36UxHP5CpKbh71r40Aqv8Wm/LK7/P+ORZmVCE4O?= =?us-ascii?Q?0RkNNGWxLuxaEUsdLUjZ1VqA1/MXEUf9lFiebwqRbC/6589Jp7HVjGIro4PD?= =?us-ascii?Q?HQ73Lk2bbSFk6H0U3xbF0etwLGEqx0NYFOg2cQm2LPy49EGL88BCgRDUQUoX?= =?us-ascii?Q?cnslXMpPYBCf7GhlrqRWZOS7c9mTdg2z81iTD6zuCyXS1FZ7A+OGp8sHfa1z?= =?us-ascii?Q?WudKIqKjR0B1FqyD2BK+166qAkvJJJ45VLX+qRfQGKwQGCwR0XXnQu/wKRn8?= =?us-ascii?Q?XoXfos/G9R10c+Prt1R6R/bZ8Qxb9FqpRa9QcMZoKxxH4LIXj9N4rfO4Zpl1?= =?us-ascii?Q?zpajvyg2sp0MnrMkuP224HsO16StL3Ex5gHIWe+Ogvtt0KrSg7QdBXC+IYq4?= =?us-ascii?Q?yFYAsFybQajUZd+k/6Ft0Lt7D63mRfnKLCRA1Ylhpl3Z//W59XNzMKoWI971?= =?us-ascii?Q?z/Ebnr53LDX56jCbRFOSx83gsGf6kb+qb2cC84ArUgZiMFFGxjJiafDn/2UO?= =?us-ascii?Q?ERvpy/qQRRix0IKccNNX759tfuT4ntuAtXE72YZzy0j2wQxix6N3XbhCaQ7P?= =?us-ascii?Q?e17IF2LqW6iiyDBKNmzGSIep8uYVB5USG4WMBHqLIwpZXwW3RLBKwsub0jKn?= =?us-ascii?Q?xn7rPyZM69z61O3J3c6ZJWrKszSvtR845RhhSrGymbNihJRZMUx4m0Of2g1T?= =?us-ascii?Q?Wg3xs8dKlRNnBf4mHCZIHokMElRQNDV5qjGKlbHh/pUyKg+iuaxDHlr4XEOu?= =?us-ascii?Q?p+qgG4W16euWlcXKUDQw0NQ+3Zle//vvxH/fH3f3cTQygQPhqmbpNdfCicjh?= =?us-ascii?Q?R7DBjzoaMeSKeqeKCYA5WjK63wQ3K5Tzf95eGJsNEK2CQ3LPWkYRFHkJoJxy?= =?us-ascii?Q?DkWvpphztzvHV9yGPZ3fW7739gpq/+JJq1O0VP25iV+ZbwSUcjhinxX1iGjY?= =?us-ascii?Q?Yxoj5oZ27zNHMiyYq+7Pl3WmYhLZl9NhxN3uYHSosTwOM6JyOpgwaLmb5/lI?= =?us-ascii?Q?X/U/FOsgIJISROL/KbllxLsC?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: c2a02224-390d-4333-7688-08d96d6402d7 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:36.2937 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: MiCWsJK3tYNt839J3dLHBvCeXq1waCMvdkS3K7QOBmO9hqeqEEIGDYQ9b4nsuNKHPSUNj01Z7wn0w6fWGVquxg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4525 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: Rrlj7IzyZOYHMS4YPzZ0uF2nx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513060; bh=WEr5SATqZoyEJIFIongZT4Ayh3WQ4FCacO5rtGgmsHs=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=usFa+IMMp7Ktkuxvmua2Aim/eQkRHLF5SjfFEQvSCHEAe+QPhdsDsS1VcIiphJtwh/G Lg87WERpHvdJk/Zi86XUux9tlQLuNU7NsA6TTXMfxrFtpJMVBy7Avp7rJ/ahLBwQD9XK0 /FgCLxmVLW8bLu8Th3ohXcHCRdz0Nnito2o= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513062190100011 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 Introduce a new SEV-SNP boot-specific GUID block. The block is used to communicate the secrets and cpuid memory area reserved by the guest BIOS. When SEV-SNP is enabled, the hypervisor will locate the SEV-SNP boot block to get the location of the Secrets and CPUID page and call the PSP firmware command to populate those memory areas. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/ResetVector/ResetVector.inf | 4 ++++ OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 23 ++++++++++++++++++++ OvmfPkg/ResetVector/ResetVector.nasmb | 4 ++++ 3 files changed, 31 insertions(+) diff --git a/OvmfPkg/ResetVector/ResetVector.inf b/OvmfPkg/ResetVector/Rese= tVector.inf index a2520dde5508..34d843de62c4 100644 --- a/OvmfPkg/ResetVector/ResetVector.inf +++ b/OvmfPkg/ResetVector/ResetVector.inf @@ -50,3 +50,7 @@ [FixedPcd] gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretSize gUefiOvmfPkgTokenSpaceGuid.PcdQemuHashTableBase gUefiOvmfPkgTokenSpaceGuid.PcdQemuHashTableSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize diff --git a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm b/OvmfPkg/ResetVe= ctor/Ia16/ResetVectorVtf0.asm index 7ec3c6e980c3..71e1484cf4e4 100644 --- a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm +++ b/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm @@ -47,6 +47,29 @@ TIMES (15 - ((guidedStructureEnd - guidedStructureStart = + 15) % 16)) DB 0 ; guidedStructureStart: =20 +%ifdef ARCH_X64 +; SEV-SNP boot support +; +; sevSnpBlock: +; For the initial boot of SEV-SNP guest, a CPUID and Secrets page must +; be reserved by the BIOS at a RAM area defined by SNP_CPUID_BASE and +; SNP_SECRETS_BASE. A hypervisor will locate this information using the +; SEV-SNP boot block GUID and provide the GPA to the PSP to populate +; the memory area with the required information.. +; +; GUID (SEV-SNP boot block): bd39c0c2-2f8e-4243-83e8-1b74cebcb7d9 +; +sevSnpBootBlockStart: + DD SNP_SECRETS_BASE + DD SNP_SECRETS_SIZE + DD SNP_CPUID_BASE + DD SNP_CPUID_SIZE + DW sevSnpBootBlockEnd - sevSnpBootBlockStart + DB 0xC2, 0xC0, 0x39, 0xBD, 0x8e, 0x2F, 0x43, 0x42 + DB 0x83, 0xE8, 0x1B, 0x74, 0xCE, 0xBC, 0xB7, 0xD9 +sevSnpBootBlockEnd: +%endif + ; SEV Hash Table Block ; ; This describes the guest ram area where the hypervisor should diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb b/OvmfPkg/ResetVector/Re= setVector.nasmb index d1d800c56745..9be963206989 100644 --- a/OvmfPkg/ResetVector/ResetVector.nasmb +++ b/OvmfPkg/ResetVector/ResetVector.nasmb @@ -77,6 +77,10 @@ %define SEV_ES_WORK_AREA_RDRAND (FixedPcdGet32 (PcdSevEsWorkAreaBase) + = 8) %define SEV_ES_WORK_AREA_ENC_MASK (FixedPcdGet32 (PcdSevEsWorkAreaBase) = + 16) %define SEV_ES_VC_TOP_OF_STACK (FixedPcdGet32 (PcdOvmfSecPeiTempRamBase)= + FixedPcdGet32 (PcdOvmfSecPeiTempRamSize)) + %define SNP_CPUID_BASE FixedPcdGet32 (PcdOvmfSnpCpuidBase) + %define SNP_CPUID_SIZE FixedPcdGet32 (PcdOvmfSnpCpuidSize) + %define SNP_SECRETS_BASE FixedPcdGet32 (PcdOvmfSnpSecretsBase) + %define SNP_SECRETS_SIZE FixedPcdGet32 (PcdOvmfSnpSecretsSize) %include "Ia32/Flat32ToFlat64.asm" %include "Ia32/AmdSev.asm" %include "Ia32/PageTables64.asm" --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80079): https://edk2.groups.io/g/devel/message/80079 Mute This Topic: https://groups.io/mt/85306656/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80081+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80081+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513063726701.0659741571418; Wed, 1 Sep 2021 09:17:43 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id qotPYY1788612x142Qx7aIPU; Wed, 01 Sep 2021 09:17:43 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:42 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=NdjIewHCh370xvp3xc5Uvg5OR6hzeaY1+Le4izlcSb+LVPBiNuo0/I95SiaAvqjoOThe6D8gNL9pYniJH2x0s9azTsPXLhrgR5wQ7zF5ziscc7HlhjtF95jtYbJRCwuTuRp+BnyUR6B8ofg7CnscR6lv9oJyIEi//+5xOTdsvyHTAFKxmGxMNWmIjIcVeetjZGq3iTmeFVNzJTHEeDx5djGI87Qk93yR3vbClxI1PnGeMJIeLvT/IOvE9jN3KiofYSlJAEWdn5eRQ8Zjw00KE19n6+bt0s4owNUk6czx8PqRpjp8Qmd/hMuBmuljT0hUcZax+4PLftW8vWtzdUmX0g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=9UR5HfUUEtckMO2C6o31IQ+Zsog97V8y4w4heB5bNB8=; b=SszaQwGWJfkyX6C+cqWCCVShzVNm9PLL4WnGOZq9YEyf6see6AqM5K4bFDMT5D2GdMMmmEBU9tSsGC31SJ5e9+xRYwjY0piCPVOk/P0aQUnOGMABipzPAf1zIPivgZ2rSOToAe6m+VhP9eKsj4wME02HnqEEr/Ym4j5hoozbzgfoazydh/7410BMJV7d6RH7FvdHMrJ0yyB9qlXI9l9ynLo8CnMOO3RAMGbfH+rIZlZ/XaiHBid//BV2Om6brW5rZpVXxCNi06oJ3FR4Dl9eJISxomvm0PpKV35jvw1pu/Aat4sh8HMSJ4Us3t1HLqLT/s3YuMRbpIXNW7/bEu92Og== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:37 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:37 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 04/29] OvmfPkg/ResetVector: invalidate the GHCB page Date: Wed, 1 Sep 2021 11:16:21 -0500 Message-ID: <20210901161646.24763-5-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:36 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 7205944d-12ca-4349-0f8d-08d96d640342 X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4303; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: wyo99FRQG9owwvLjljr5DtosDhxjFs68xIqp+gR/ljf7mgvHkIuCFLIo3+Md6rSQhbZyH0coDRtS1LpqYGk1fZ5JSRD/TgSUeidwl8z15LqyshlVGub7kJVv2ocUw85VjXXiwrTVWSrxH3jlS7CUi1kXlcPBsymR8q7qxAazFbSl2rg85kyfESK+MIySqwyBxI+TP+f0p4ok4zvHlpybGRQ1WuHVrwJwLZTNIwcyT/Kes3cil+LwObNd/6hunVqCQMlJgmDXu1PIAPTDcfzBGFa/s14++OqgIMl4S4opVSm7HgBS1AlDGTL2kk2fnLn16CEzXOIVg5uovkWyETFrrJscrSb1ScI5DVdv1eLFR0mI3UfTfx6ORmaxd894+WHUs18l/B92jQY7T3gnFX9ej2ERZH+tEv7B0UfLpuRNVLMPUuWZa3K5HarGhrSMxEUxDYeNDatH9Wz3mIqd43z3JQnNJnQlVlZ+Ktim+/EWvzoCFoeFuDX83qCAXdXT1rVRNWGBC95RljlfFzUMq9pIjfHReA+wYwnVloyzcCGmL/AJqXmn9nJBzr3Bz+84HLDB9ZuFRqMgBvW2UUS47SCZLbn75rz4JcogijMjXZNQyf/rFmMo39pmZu9tp5Ia9xKd+Pk/eR6vUTVGn+WvXiLTxHWjgiSCNE0kBMxXRbben0259ICZ/q+DzwyyEoR/NOA6iQQ/UEBHXZ4GSX2xPX+V92eMyfRrqVCPqwK6cr8deCgOaz1dzfGKBCtE6NYv/dP9QC3ZgceQYFE4FvXo+gZ+lTludLnSwoYb879DUQAhnas= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?vieAVMR9mDNhHhnIB7XaKHqdMC8uG17Ehw0lazhIcZCtZexAdCGX+aG/Z14R?= =?us-ascii?Q?w3lnxqEsrC06My2M6tUoU/IlrLZQzquhWGOyQtFcpELLbhfx3V68HKPdqf/0?= =?us-ascii?Q?f866kBa+FfRhQKHscWYTecJia0RE5bJL9s/1o3NCO8pdv96VYCSsOcCQeSl7?= =?us-ascii?Q?GEhbyhQvyD7Opgd0Touv9HhYXbLRVX1g9CoU69vKVSvEpYLms4P8rbzK6xR4?= =?us-ascii?Q?73ZnQgBVimtTByKJ8qPxjGAArTVO6SGSNh9kbEej+dBx0z/YVf2FZM3/DS8U?= =?us-ascii?Q?Fewe6GH632H9tbnbeBIoGAykNyQBSQkanL/qDz6/1tVC8TB0YRUSg0YMiLVZ?= =?us-ascii?Q?t9rHkBu+tSkV3WnEZ4vmlbIOpN2sdL+YBmVtQa+oI/LBfAZprpj5Wipq3Hjy?= =?us-ascii?Q?OtKWemL3D8IBnBftgLMpQiwrJTOhOaM8urokdUK2D+5j2HlYUi1CZBoy9/g9?= =?us-ascii?Q?MLnBh7ZSUtNPGREIZYlisDMS8xd7QLya4qSqhjhLR7hjPUyBtK3wyfttKQ02?= =?us-ascii?Q?P30LcmIMvg0KpWLBM86f5UGvY+MFQ7ZaODKPD6A7gFgNfWwPrhFRPmj7OmmZ?= =?us-ascii?Q?qXke2wBbt/ywYHOZ3rBk89palM19bODkFtaAJQTSprdh+ltnrk9CXMvLCeIS?= =?us-ascii?Q?h3KYEyE0e+yPot3q/s6/5RU9iUcq8iEB1xXCLGiNcknr7ohTVBx0uua6khj6?= =?us-ascii?Q?hTK2FgDuzXGXLeriyvyteWX3HWX40juTbdXAQtPt/WFKMzyGl0e0YwLn0oKj?= =?us-ascii?Q?13UDeIXJJoZ5fdRTqtKcHoA87NF8riuE10m9ZcTkaCLwfHOeCVTGAL/hMdVu?= =?us-ascii?Q?8L98R4YlMt6t5PtWpPks1wXOsXtW7vh9REMomAajcGfZG1UlHL8Q8Sm60BV+?= =?us-ascii?Q?+2Qw9BCOi6sSBHkkCbc03oqpP8Akh9deVZ5sz25gVgmA+tsL5S5f4DwufIU2?= =?us-ascii?Q?1WhBDDtJE7urnNsRUXi9Cn/6jFIINKdzRdUt/gDHoqWsBh4uH/PigPd3jXcE?= =?us-ascii?Q?Bpm5upcdjZTRdBNn3TCdRmWfffalfEJfKcDeltXIshZk03gKbtLOaJSy81Dj?= =?us-ascii?Q?NT5mGu+c08TqjEw2C89nug0BE2tyBkAQIqqPz1CORrupihkS5kcn1FIXt+Zx?= =?us-ascii?Q?rmBLkAhbWCUrYerMNyqgOxVxcYi/4lOgcShL2UvFnjYbhC3H4VwTeQjp/amm?= =?us-ascii?Q?8LRQ8mY/acbhHJdGzOkitVmucvDUZVLhzDrxjxVKG4GztYTl38zY3/Ct1yIA?= =?us-ascii?Q?GUTcinWV8mhOeEpxBoJ72pCjwuko2fXRPuVQAPhiYQlv10pUbH+QdciYksTC?= =?us-ascii?Q?jLJg7QvFjD0LbftH34FzVJw5?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7205944d-12ca-4349-0f8d-08d96d640342 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:36.9793 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: DfGzOcLScMr4k0RjG+EzZlFtYfr+McO3NHA4uWrIV5CJ8p9N9lFDygwoDptCAl9fU5gSz2lUy4Z2rMEhuIZlOw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: OCyhLTLU8Tjr8RRCZ6hfCUkWx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513063; bh=wXJyznqIDgeqs1n1S5SLeT6xUzj1k4WlVV+rGS4gAr4=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=ifgFwANiRvmejKM9y0cEJYVd7bXP+MqaXCMa4z7R9+RPaSPLJeGIfvhm2xySX26P5Sy u5HDlQ+skrNqzXg+eIfstaFogk/Yl2kQv4r13BQeRgToNQKjRGTSnScgLvT8SsBuRrBHL 3ylwDnXrUUBNW0ACK+RJqvSiskFI2WsGHbA= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513064560100021 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 The GHCB page is part of a pre-validated memory range specified through the SnpBootBlock GUID. When SEV-SNP is active, the GHCB page is pre-validated by the hyperivosr during the SNP guest creation. On boot, the reset vector maps the GHCB page as un-encrypted in the initial page table. Just clearing the encryption attribute from the page table is not enough. To maintain the security guarantees, the page must be invalidated. The page invalidation consists of two steps: 1. Use the PVALIDATE instruction to clear Validated Bit from the RMP table. 2. Use the Page State Change VMGEXIT to ask hypervisor to change the page state to shared in the RMP table. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/ResetVector/Ia32/AmdSev.asm | 137 ++++++++++++++++++++++++++++ 1 file changed, 137 insertions(+) diff --git a/OvmfPkg/ResetVector/Ia32/AmdSev.asm b/OvmfPkg/ResetVector/Ia32= /AmdSev.asm index 250ac8d8b180..0ac78c73c370 100644 --- a/OvmfPkg/ResetVector/Ia32/AmdSev.asm +++ b/OvmfPkg/ResetVector/Ia32/AmdSev.asm @@ -7,6 +7,8 @@ ; ;-------------------------------------------------------------------------= ----- =20 +%include "Nasm.inc" + BITS 32 =20 ; @@ -65,6 +67,25 @@ BITS 32 PAGE_READ_WRITE + \ PAGE_PRESENT) =20 +; SNP page state change failure +%define TERM_PAGE_STATE_CHANAGE 3 + +; Hypervisor does not support SEV-SNP feature +%define TERM_HV_UNSUPPORTED_FEATURE 4 + +; GHCB SEV Information MSR protocol +%define GHCB_SEV_INFORMATION_REQUEST 2 +%define GHCB_SEV_INFORMATION_RESPONSE 1 + +; GHCB Page Invalidate request and response protocol values +; +%define GHCB_PAGE_STATE_CHANGE_REQUEST 20 +%define GHCB_PAGE_STATE_CHANGE_RESPONSE 21 +%define GHCB_PAGE_STATE_SHARED 2 + +; GHCB Hypervisor features MSR protocol +%define GHCB_HYPERVISOR_FEATURES_REQUEST 128 +%define GHCB_HYPERVISOR_FEATURES_RESPONSE 129 =20 ; Macro is used to issue the MSR protocol based VMGEXIT. The caller is ; responsible to populate values in the EDX:EAX registers. After the vmmca= ll @@ -183,6 +204,19 @@ clearGhcbMemoryLoop: mov dword[ecx * 4 + GHCB_BASE - 4], eax loop clearGhcbMemoryLoop =20 + ; + ; The page table built above cleared the memory encryption mask from t= he + ; GHCB_BASE (aka made it shared). When SEV-SNP is enabled, to maintain + ; the security guarantees, the page state transition from private to + ; shared must go through the page invalidation steps. Invalidate the + ; memory range before loading the page table below. + ; + ; NOTE: the invalidation must happen after zeroing the GHCB memory. Th= is + ; is because, in the 32-bit mode all the access are considered p= rivate. + ; The invalidation before the zero'ing will cause a #VC. + ; + OneTimeCall InvalidateGHCBPage + SevClearPageEncMaskForGhcbPageExit: OneTimeCallRet SevClearPageEncMaskForGhcbPage =20 @@ -334,6 +368,109 @@ SevExit: =20 OneTimeCallRet CheckSevFeatures =20 +; The version 2 of GHCB specification added the support to query the hyper= visor +; features. If the GHCB version is >=3D2 then read the hypervisor features= and +; verify that SEV-SNP feature is supported. +; +CheckSnpHypervisorFeatures: + ; Get the SEV Information + xor eax, eax + xor edx, edx + + VmgExit GHCB_SEV_INFORMATION_REQUEST, GHCB_SEV_INFORMATION_RESPONSE + + ; + ; SEV Information Response GHCB MSR + ; GHCB_MSR[63:48] =3D Maximum protocol version + ; GHCB_MSR[47:32] =3D Minimum protocol version + ; + shr edx, 16 + cmp edx, 2 + jl SevSnpUnsupportedFeature + + ; Get the hypervisor features + xor eax, eax + xor edx, edx + + VmgExit GHCB_HYPERVISOR_FEATURES_REQUEST, GHCB_HYPERVISOR_FEATURES_RES= PONSE + + ; + ; Hypervisor features reponse + ; GHCB_MSR[63:12] =3D Features bitmap + ; BIT0 =3D SEV-SNP Supported + ; + shr eax, 12 + bt eax, 0 + jnc SevSnpUnsupportedFeature + +CheckSnpHypervisorFeaturesDone: + OneTimeCallRet CheckSnpHypervisorFeatures + +; If its an SEV-SNP guest then use the page state change VMGEXIT to invali= date +; the GHCB page. +; +; Modified: EAX, EBX, ECX, EDX +; +InvalidateGHCBPage: + ; Check if SEV-SNP is enabled + ; MSR_0xC0010131 - Bit 2 (SEV-SNP enabled) + mov ecx, SEV_STATUS_MSR + rdmsr + bt eax, 2 + jnc InvalidateGHCBPageDone + + ; Verify that SEV-SNP feature is supported by the hypervisor. + OneTimeCall CheckSnpHypervisorFeatures + + ; Use PVALIDATE instruction to invalidate the page + mov eax, GHCB_BASE + mov ecx, 0 + mov edx, 0 + PVALIDATE + + ; Save the carry flag to be use later. + setc dl + + ; If PVALIDATE fail then abort the launch. + cmp eax, 0 + jne SevSnpPageStateFailureTerminate + + ; Check the carry flag to determine if RMP entry was updated. + cmp dl, 0 + jne SevSnpPageStateFailureTerminate + + ; Ask hypervisor to change the page state to shared using the + ; Page State Change VMGEXIT. + ; + ; Setup GHCB MSR + ; GHCB_MSR[55:52] =3D Page Operation + ; GHCB_MSR[51:12] =3D Guest Physical Frame Number + ; + mov eax, (GHCB_BASE >> 12) + shl eax, 12 + mov edx, (GHCB_PAGE_STATE_SHARED << 20) + + VmgExit GHCB_PAGE_STATE_CHANGE_REQUEST, GHCB_PAGE_STATE_CHANGE_RESPON= SE + + ; + ; Response GHCB MSR + ; GHCB_MSR[63:12] =3D Error code + ; + cmp edx, 0 + jnz SevSnpPageStateFailureTerminate + +InvalidateGHCBPageDone: + OneTimeCallRet InvalidateGHCBPage + +; Terminate the SEV-SNP guest due to the page state change failure +SevSnpPageStateFailureTerminate: + TerminateVmgExit TERM_PAGE_STATE_CHANAGE + +; Terminate the SEV-SNP guest because hypervisor does not support +; the SEV-SNP feature +SevSnpUnsupportedFeature: + TerminateVmgExit TERM_HV_UNSUPPORTED_FEATURE + ; Start of #VC exception handling routines ; =20 --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80081): https://edk2.groups.io/g/devel/message/80081 Mute This Topic: https://groups.io/mt/85306659/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80080+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80080+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513063215680.4015274816451; Wed, 1 Sep 2021 09:17:43 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id oISeYY1788612xDZLRXHqTVP; Wed, 01 Sep 2021 09:17:42 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:42 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dfINlF7X0vEjTDB5ygPOLuTpK89rKZdj2fPZCF3AhJj+HYfrxj6ihhSmdKybtaOy37nUtYHVJWgSMhM3e0q9pDnAIeWIXjGRcSdXFsGhb6LbJC7o1RiBhMg5zXjOvg9RnBMO8qb6Ia2K/NqeOhtuOFsIkoCQYiX9kj2aRD7OzX3/wHRd5d62RLsisSmW1q3t3WR7RnQIcP8ktBj8BBqnvzyafm4Fzdpdb9dxJj8d2KfEiHubGQYySe/gEMSIZ3VC+of8Z+9X2jf3bXUwe/G6SUWjrxP1exXAp6cCxn5xs4eO70/md9GYlG3V21CBaveDh7N0IrKU1/ZvCJCwCaAGPg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=vhd6JnEFli9Rx+3hlidDyEJOyC2cK1IzmNdbAescQz0=; b=m+bFf3hU+YGUBHGYSHW+XvsUuLf+mP8kKGCuWwYCjtV8TwDAE+TiQU68cEnPV1CVseGmPHNJKe1xdaoNeGYGJqz3eTYg9wFCn0TpACJ87cl9gewl2lJy54mjG/MzjPjOBvKzIyZW+qNmCBMwKpKiHcN50M0MyNb0XrDRH85w7r6UyrzbvNvuhUJ7teqqKQAVoj+tY+smerH1D8x7za34G8CfnrLzRo4vWUk1Shyt7YiuIZMhkAaT37g7d13izufXEXMUrkjfihEtpJIYrpeGoeRx2USMfHARaitqzMjwz7usBR99WQmHWE590LiLaiNmfFXWEtZP7r9ZX/GW5fthZQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:37 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:37 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 05/29] OvmfPkg/ResetVector: check the vmpl level Date: Wed, 1 Sep 2021 11:16:22 -0500 Message-ID: <20210901161646.24763-6-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:37 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 1bffdcd7-a4cf-4bcf-222a-08d96d6403ab X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8882; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: IO7r2a0I2NRz9erqaAP6RZLpSqmJbB4tZa7LmqBb81RFLun4rvwLpFhTSko2ZExGbX4YrGVzFf9nPJFwXaBvEjRN6TK73GhiZ3mW2luiP1HJu0htr8CyBsskq4JR6s4ONRthLlN87l37DYiD0IzszFLEcSHovjZIEZ/rRjU9yhfyVDz1Mqtlau9rM6HR+r9xRIqIMQLio6iP4IRp6bo4GdIn+C82iAyqT1xubnJJ+mCbXaVaHSjfKLDDQKic1XCXs5ThcOs+NpDioR14NK6Jr6B+2ZZONVeui4uM6DzNY/b1YB20bbdt/QPOf3zrdF/FD1m6IrOHsxuiKMPfP/SE6c8ZJybDHqlirK3QN9BVgbkmAyDdVXfbcb+UkEqZgDyYCFab3EYZ1zC7LnjQEWr7U/FJJxuWeyY+yc9hkfV5YPWuSx3j4+C47jkY97/J6ca1PPQZHnO+dO8SwWg1KPM8GQzsyj1CxwSzcWQyeR/38D49xXyVUzk4w7j9yVdQtMWCrWIe/+uVDZ6xofTTb72BRNA3QS+3eHryxgv3Kvh8YZCkriu0tf25eEGds8OW4O6xjZlR3tGNuw/R5rV1wWX3Wix6+iI2RFu3l0D/2I2I7k6eqBi09mrf/bIEfaw+Xq4pkYEuRsIfQKesGp6bfjxlPhbqUWLCdG9gZJoOofgDeLAkB5NTwKBViYs12l5GA71Z4CQlttAcj11tANgjAb7jIeQ6FCwMFpN7BkUq87x66H886PGKKl6CkLOu5Yp2/0r3VZYAfOq/cL0vaOQMoK+hSA1eCdZ68CLJcbqJqx699ws= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?mIQ9VzWee4VcqWGPnk92jDzbJW8n2nFOMDNMSSnirzWZk0F3PyBJLUkCz5Tp?= =?us-ascii?Q?CJTUVnfAYTZWlskTjwx96wkq/HqaHmuNeEu0mTYIbjQOe88XESyjx0EUYx6X?= =?us-ascii?Q?N0JcbkvSty8CpNu/4svipXOls4fP0rQFbQAMazUg8LaUBjRmMC81XYKhwQCk?= =?us-ascii?Q?2PVIIii7RF9N7zp0tr/bnRAVsmT2dxYDk9lfsGIfFH3Lr5elJN18H3Qpi7FG?= =?us-ascii?Q?lNm6M8ffszMNaPni71aRJw6mMz1SDw6FCgjFAub8jRFbQruGH9oJE6X41k1w?= =?us-ascii?Q?uvhyAgT0aDjhlYh8JDrraH/g3bINeLLozC4Ie2fpR7xDwAH9ne0NLHQ7YE3P?= =?us-ascii?Q?3mopPBkRkyH+/CAW8m1c/3cD1T9g8oI6OfGoBfAc+KJa/7wvi3iZ9s+B7uPx?= =?us-ascii?Q?w59qPqikhHysNjuSEgaEwBqgVc2yCgCgmAlkLYBx+H/2gZ0+FOEuENgpoBat?= =?us-ascii?Q?YTILr6Vj2W62AZ6RmK23qo9eSg/N1Pmo7ocxMc9YWo8nUu2EoBp6TySu8Srz?= =?us-ascii?Q?fYP75JZDn133EXIFxVaI59y16rfr90ae2Vt80R/aD+UTmjvjA0s/u9e8JAj2?= =?us-ascii?Q?n5zQGxogg3diEWe+oWBRXiiKRBfe+FQXfl4EYqV4xy8WLTk3dlgiO5c8ScPm?= =?us-ascii?Q?SpjZPQ0n6bscK+n/z+Cmf5yxpRPpW38zk+scmFcyjEXQ/KQ0RA5j8w+wp/Bb?= =?us-ascii?Q?AtglalnPBSM5H+YkrJgFDtdVOXLXo9wYrL/mlhuyUUBTjlm4fZ5et5rY8fWe?= =?us-ascii?Q?ioAD2OFTB+F28o0Y0D03B34MMRQc7FR9G1FqspzngqXi1pNl83FCcDDmNgGE?= =?us-ascii?Q?Pr0aFEOFCxHmtbV78jdEzxjFi4lDMljdP9WNObF6oz49CnZ5y+E/14VGQkaL?= =?us-ascii?Q?nh81IYueevHtTpmygQGCHM56yufKr+NlXqfRtCkdDwjmPUQ3kfMFnoj+IvT2?= =?us-ascii?Q?xxwoJ2jNova86MfniP3dT3xYxGG5Ja0Flnu5p23ckuXJvmYRbEuhzzUwBJp6?= =?us-ascii?Q?6i9Q1CeIP5i6RPOTfdANKV1KjvcAS3zfjIOgP85ZXyVwBi+TfEc2h6ZHUcA+?= =?us-ascii?Q?6PPAi34pJxRgy938yWyhEdvPSo1/jAHUpKWLgjoD5gJkjBwpcsdZmMaL3R82?= =?us-ascii?Q?eEFYZK4743nodLUC4ns7bbFfNw86huY5posyRS2hYX18mgkAdWmZisnZ8c/X?= =?us-ascii?Q?8HN4InH0mjhMez+Y1gZHvhDHoattw6Rt7TDTA7Z7gtLailnHAsb6pyCjgVFh?= =?us-ascii?Q?sSJzgD81LSWjEV2Vzo8MdhPtt7+wu8maTCRhk1Ke8G+S1oEPjKvtJVBr1JkT?= =?us-ascii?Q?BxDI4ToEdZJHF9aVWTIu4giX?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1bffdcd7-a4cf-4bcf-222a-08d96d6403ab X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:37.7678 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: bZ3prS6XRY+Hv+lwv30X42WIPoUxZw4U85MxMNhJI+GwJPSowrXtfSvvbM9oBW3KF1tghJ+fgCWbP35b345TyQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: H6RDxftyKvYUCGnJhMoJaKmox1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513062; bh=arPoetK2wmToJ6RiSWyiaw/nlrCfajVR5oAAruZfDls=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=EWPpGETDc1I23Y0Txfq34V+P9MQlzUDYr4ObGhl8Z8ZsZcKaI8tpeXxk/Rmv8I3Mq25 uB0WUIIIylElfS7RFne5x9aYzPsEt6KyET4oMGadxRfE3jOh0+66ciH3fIVMaFa3gJvjv 1KSD5un1/zKPMdE1PgM/aOu+f8cybOW2pfA= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513064176100017 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 Virtual Machine Privilege Level (VMPL) is an optional feature in the SEV-SNP architecture, which allows a guest VM to divide its address space into four levels. The level can be used to provide the hardware isolated abstraction layers with a VM. The VMPL0 is the highest privilege, and VMPL3 is the least privilege. Certain operations must be done by the VMPL0 software, such as: * Validate or invalidate memory range (PVALIDATE instruction) * Allocate VMSA page (RMPADJUST instruction when VMSA=3D1) The initial SEV-SNP support assumes that it's running on VMPL0. Let's add a check to make sure that we are running at VMPL0 before continuing the boot. There is no easy method to query the current VMPL level. One simple approach is to call PVALIDATE instruction and if the instruction causes a #GP then its SEV-SNP guest is not booted under VMPL0. See the AMD APL volume 3 (PVALIDATE) for additional information on the PVALIDATE. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/ResetVector/Ia32/AmdSev.asm | 90 ++++++++++++++++++++++++++++- 1 file changed, 88 insertions(+), 2 deletions(-) diff --git a/OvmfPkg/ResetVector/Ia32/AmdSev.asm b/OvmfPkg/ResetVector/Ia32= /AmdSev.asm index 0ac78c73c370..2386b15c0ce0 100644 --- a/OvmfPkg/ResetVector/Ia32/AmdSev.asm +++ b/OvmfPkg/ResetVector/Ia32/AmdSev.asm @@ -73,6 +73,12 @@ BITS 32 ; Hypervisor does not support SEV-SNP feature %define TERM_HV_UNSUPPORTED_FEATURE 4 =20 +; SEV-SNP guest is not launched at VMPL-0 +%define TERM_SNP_NOT_VMPL0 5 + +; The #VC is not for PVALIDATE +%define TERM_VC_NOT_PVALIDATE 6 + ; GHCB SEV Information MSR protocol %define GHCB_SEV_INFORMATION_REQUEST 2 %define GHCB_SEV_INFORMATION_RESPONSE 1 @@ -236,6 +242,25 @@ GetSevCBitMaskAbove31: GetSevCBitMaskAbove31Exit: OneTimeCallRet GetSevCBitMaskAbove31 =20 +; Check whether we're booted under the VMPL-0. +; +; There is no straightforward way to query the current VMPL level. The sim= plest +; method is to use the PVALIDATE instruction to change the page state. If = its +; not a VMPL-0 guest then PVALIDATE will cause #GP. +; +CheckSnpVmpl0: + ; This routine is part of the ROM, and should have been validated by t= he SNP + ; guest launch sequence. So its safe to re-validate the page containing + ; this routine. + mov eax, ADDR_OF(CheckSnpVmpl0) + mov ecx, 0 + mov edx, 1 + PVALIDATE + + ; We will reach here only if we are running at VMPL-0. + + OneTimeCallRet CheckSnpVmpl0 + ; Check if Secure Encrypted Virtualization (SEV) features are enabled. ; ; Register usage is tight in this routine, so multiple calls for the @@ -293,6 +318,17 @@ CheckSevFeatures: ; Set the work area header to indicate that the SEV is enabled mov byte[WORK_AREA_GUEST_TYPE], 1 =20 + ; Check if we're SEV-SNP guest and booted under VMPL-0. + ; + ; This check should happen here because the PVALIDATE instruction + ; used in the check will cause an exception. The IDT is active + ; during the CheckSevFeatures only. + ; + bt eax, 2 + jnc SkipCheckSnpVmpl0 + OneTimeCall CheckSnpVmpl0 + +SkipCheckSnpVmpl0: ; Check for SEV-ES memory encryption feature: ; CPUID Fn8000_001F[EAX] - Bit 3 ; CPUID raises a #VC exception if running as an SEV-ES guest @@ -471,6 +507,37 @@ SevSnpPageStateFailureTerminate: SevSnpUnsupportedFeature: TerminateVmgExit TERM_HV_UNSUPPORTED_FEATURE =20 + +; Start handling of #GP exception handling routines +; +SevEsIdtNotPvalidate: + TerminateVmgExit TERM_VC_NOT_PVALIDATE + iret + +SevSnpGpException: + ; + ; If we're here, then its an SEV-SNP guest and it was due to + ; PVALIDATE instruction. + ; + ; Verify that its an PVALIDATE instruction + ; The exception stack looks like this: + ; +---------+ + ; | .... | + ; | eip | + ; | err code| + ; +---------+ + pop ebx + pop ebx + mov ecx, [ebx] + cmp ecx, 0xff010ff2 ; Compare EIP with PVALIDATE menomics + jne SevEsIdtNotPvalidate + + ; The #GP was triggered by the PVALIDATE instruction, this will happen + ; only when we're not running at VMPL-0 + ; + TerminateVmgExit TERM_SNP_NOT_VMPL0 + iret + ; Start of #VC exception handling routines ; =20 @@ -600,15 +667,34 @@ ALIGN 16 ; IDT_BASE: ; -; Vectors 0 - 28 (No handlers) +; Vectors 0 - 12 (No handlers) ; -%rep 29 +%rep 13 dw 0 ; Offset low bits 15..0 dw 0x10 ; Selector db 0 ; Reserved db 0x8E ; Gate Type (IA32_IDT_GAT= E_TYPE_INTERRUPT_32) dw 0 ; Offset high bits 31..16 %endrep +; +; Vector 13 (GP Exception) +; + dw (ADDR_OF(SevSnpGpException) & 0xffff) ; Offset low bits 15..0 + dw 0x10 ; Selector + db 0 ; Reserved + db 0x8E ; Gate Type (IA32_IDT_GAT= E_TYPE_INTERRUPT_32) + dw (ADDR_OF(SevSnpGpException) >> 16) ; Offset high bits 31..16 +; +; Vectors 14 - 28 (No handlers) +; +%rep 15 + dw 0 ; Offset low bits 15..0 + dw 0x10 ; Selector + db 0 ; Reserved + db 0x8E ; Gate Type (IA32_IDT_GAT= E_TYPE_INTERRUPT_32) + dw 0 ; Offset high bits 31..16 +%endrep + ; ; Vector 29 (VMM Communication Exception) ; --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80080): https://edk2.groups.io/g/devel/message/80080 Mute This Topic: https://groups.io/mt/85306658/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80082+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80082+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 163051306442574.6930714046049; Wed, 1 Sep 2021 09:17:44 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id jcjzYY1788612xYZrnofVtIm; Wed, 01 Sep 2021 09:17:44 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:43 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ifNfKsNNQeRARjHBG6BVIUGsS9UQ0S3DVuJT7IAzTQw0NWTtjj3WCJxE59qaT+/PcOoe0nAtln/rVjmDJ910E1EB87FX2nQzzaOcGy54qqCa09WbYcbrpqwAKRGyx7ZT8LG6pMJtsSidnTzj0dqLvt2LhgmFHpyOr3Ipwge2hMuK2KOwQlYq4qKpafK2BIWOhXCRIMpMuXRKjoQ16PzdY7R1BhDHI2bYxyrNZcax1iLgX/ssjaeP3aSiXn6xyz4d3kw9lQWmVkk+bEewjQGGQb/5SSNcFGmnt/dfbO3pU0hev4TyDueK99nIqG2EOfCjSHf0l6M8QI8Fpb883CqN+g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=tqFjpv3EqIiYgb9HAQgo0BiNmLi2aqPfAG/4VqlPhgo=; b=ajdu3RHraZHchP/AytH27yH7kN8m5lNHn2ftsjaIU4CCLt3vDzxqcnHRZue/DerJJstPkKE1PlNpgQMEPhQtvPkZjeY0AAYpta7yHLYLF7s+lf3htyDhpx+VByuwFXd7E4ckDjoIfNQamoneVVhag3oCWU3m9tIGBriUmjugE6DJygJMAhifHK8lJqkpS0v+vGLA/ExizYD5Aitf1ppnFekqr01j/+8/TTvUUJGwIaUIWgNhNhz7tubyTfmYc4dsu1KuPlwzwrVqLrAK0LoONC07xg21j5LJuednZ1PEs4asNpb1BR8yABJ2MaYvZ6+Ac7mRMlg5ir/A4l50v0GZgQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:38 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:38 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 06/29] OvmfPkg/ResetVector: pre-validate the data pages used in SEC phase Date: Wed, 1 Sep 2021 11:16:23 -0500 Message-ID: <20210901161646.24763-7-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:37 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 7ca59fb6-95f4-4a3a-1e65-08d96d64041e X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8882; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: 96bez8MegT4CDUgkWkOR/Jc0ZKV5b0956T0FG/bqGigIAPfWCXkGKVUcdi+5+hbR0sCIi+BKkDb9a2qIscT+ksybjbpyGYuN1zAQB8DSXqbfhCYO6nR/XNzb1dw8rH1udBaKCXgfAD/V0B5cEZme/G8nkgxZ++puvrJv/Q22lp2IFeyv9W8UTgvSEd74SBQyYkl8KAcbxfWJ+n9SDwrafUpe1cIJbv2MRRtA1Wj5c/aACOV4pzGCdTQ4drGRmKmZOv1b6oQjBzI5rONX4L1PexH7GBWDtZdts168FUwkCSONuTw2WpS3tuWaXh2MmES47O8JEIGvICGIgs5u+yoYtiyCqGQEzBqvOMrJcwdiHyJWsuYPRNgY/+HRDhCDNZ2SOyOcJ7ODTC66nNxA/a4xWCM8IvrWiNZGLjJ6E1Zh57DTbTUzKfx/ojARhSTjd1JS/zhDN2dcZBM1ITWmKXi9bHTH7x7D4/l2lHjs6a2WF4M3qmGR7gzaqt/31UaBrc8L5J7Ut8iZhlCugio70wm0VRlsDkTi3xK+L3lcVZA5xA4ar/6UFis1KjQ5nTqzTitR+/t6OOJkym3U1OmjXUOMTNm8VVA0KocdPGzbSbYMahh2ykN+n73CYd21mkTRqR47mWFI4+NyEzAdKOT6dd5fHhaogLYkwFPuIvOK76QsBges4jg5EfeJEiaJ/h2NvlCRvhpPlHX6Rd2jd36ci8EZlYBlQAVMY1aJtgW/cJ3Y8LwRaAjGZ6N2lKRODrWOq7E3/5mJEnN5exUh34dGR4Svz61FtqqaRJwvPoCzcL4hKoA= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?eJS95wqFH1Y6wkJG3O8Gb7xL13L8/IJKPOr8ieDrHgmqLDcR60Ev7H7LIadl?= =?us-ascii?Q?xf/wS55WaBtb2mHrDOmawPHHRb0Upnf9MZXQi9Ri1Zgso22vR12zFEa5rPrs?= =?us-ascii?Q?8oNT8l6ryPkatVgj5Owm2ecxmWVx7mexWqQKGOrnSN7QKWClD90IbJ6EO6Jz?= =?us-ascii?Q?DQvPCGxwuszNaaVsqdenDefYlI6+hcW+UqIgT6/ktisTJmWpHQEGZMcE3CUh?= =?us-ascii?Q?o/WUC80DC//szXA+ELXR852aUKBmqKvaMCLXKb2d37mT9aoS14JdADjiXcLF?= =?us-ascii?Q?nxmOswXTfhJ8JUC6rU+cYbYDRTdsDm1V933wPQ0dyaYhP6Pbrm7Eyqk60DYy?= =?us-ascii?Q?OEMOipA6O77udKd+ufoiBzBOnR2fmdvvlYiesldEwuIIRX4TZ+JLjFUk3OLC?= =?us-ascii?Q?4ltM7xtk4QdENuHB55ruKClGqQQIhoM3nXsx2SDlTUSRngjmzP5unskbliop?= =?us-ascii?Q?L4SwCNOokvwVhJnLbIwX0GJDImeyfxSSNThYIQiMUI4/QRqA2UD+hw/xzWQJ?= =?us-ascii?Q?qSahGDL9U237dJRoc7EoG1Qm3w1KPirYceqMF/ymguvnTgDKm71lUjWOIslt?= =?us-ascii?Q?xC7JFIk85QzDtvE1O+gz6h4+usGs9B6CP79JDXxMpleHkvPsZVNRGn5AAbYn?= =?us-ascii?Q?vqmEzffbge9FpzLGifbRKyrJulr787TxrqX+OhaTQgLD7T1P/wY5VchiTzfe?= =?us-ascii?Q?INCkngC+Mns55CIiGVZKsAK1M4D1yI09yzG6cdECUJqI4MATMltIlcKAbygX?= =?us-ascii?Q?3fhBC00ryUVKLUvIZ9uEllkWxhCcK9edAxKN1QAHgeSf4uZT4cC+Ja/jzIP+?= =?us-ascii?Q?9Ux3Tsz5x9f3nXw6So/WJ4YfhQqvkbsFEg2phombtQKNDSarAP1nOAcppOGM?= =?us-ascii?Q?C1i7BlHRKxxioH3+QQ57EgQeRu1yJpo47ZIpdMaAk+DRVMaahdzEeXlLlRat?= =?us-ascii?Q?zs7EBzL2lxosnZ/rmkIUisrarj70BR5Bm/MDSQ/hQXb9BciaIwXm2zkAt1Po?= =?us-ascii?Q?vq09IIJNC2Kl9FAFCzexLhUkJU0AnG3ws42EyC/KNM1tiRZc0WMn0UuL/2b3?= =?us-ascii?Q?AHBb67MVH2jRhDa2Y3T3NT3Kfgxtbg0Ph+BthXf/ZiIbSX/w5MWIaca2b32h?= =?us-ascii?Q?iEcp2PlYhi0/AE1FAvhSF3e6d0XQ3HvekedEZgsfc8QVgkbsFPYsJ+1bETNb?= =?us-ascii?Q?9Bm33MabUUdHnzhnYtJAX3IBCqP0qVcepYKDkVNZN5gGFeB3WhKXqxOHsM+O?= =?us-ascii?Q?lu3JTiJxRegB0Ybzg8veRwLU//lDP1PnEvGImbtsmjDzfJ7ooGqcSksre90j?= =?us-ascii?Q?mliZgnR6m7r5ZtCOgtWUTU7I?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7ca59fb6-95f4-4a3a-1e65-08d96d64041e X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:38.4095 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: FKUZWTGCJ1v00XFSYocYBg04b8l6X3/qFTDXChm6yM4qSRuyP+RABEpnPSyW+PYuW/0xgY+pzmnrSwWZEzJX8Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: 3e5mMN3NZEBuH0WiPPNg7n56x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513064; bh=peuGgKonRqGAK35yMORUdncrJIM9ibIHPNuZhteZyB8=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=XzJKHJNIsWjMo6mMjemJlrGaEYW8K1EBdnqQwAt8N4lw6kkKny4Yu8rNchEkj8F9wsf 1r0ae539HulMGD1nB9qbS6CDybZDa1NBxhthdDxb2tjmMnlhRBcI/bxZ7+8BWokN9a57/ AxdG7+afd6tlyNPcv6F7rQVIdT2Wz+hhojk= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513065180100025 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 An SEV-SNP guest requires that private memory (aka pages mapped encrypted) must be validated before being accessed. The validation process consist of the following sequence: 1) Set the memory encryption attribute in the page table (aka C-bit). Note: If the processor is in non-PAE mode, then all the memory accesses are considered private. 2) Add the memory range as private in the RMP table. This can be performed using the Page State Change VMGEXIT defined in the GHCB specification. 3) Use the PVALIDATE instruction to set the Validated Bit in the RMP table. During the guest creation time, the VMM encrypts the OVMF_CODE.fd using the SEV-SNP firmware provided LAUNCH_UPDATE_DATA command. In addition to encrypting the content, the command also validates the memory region. This allows us to execute the code without going through the validation sequence. During execution, the reset vector need to access some data pages (such as page tables, SevESWorkarea, Sec stack). The data pages are accessed as private memory. The data pages are not part of the OVMF_CODE.fd, so they were not validated during the guest creation. There are two approaches we can take to validate the data pages before the access: a) Enhance the OVMF reset vector code to validate the pages as described above (go through step 2 - 3). OR b) Validate the pages during the guest creation time. The SEV firmware provides a command which can be used by the VMM to validate the pages without affecting the measurement of the launch. Approach #b seems much simpler; it does not require any changes to the OVMF reset vector code. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/OvmfPkg.dec | 5 +++++ OvmfPkg/OvmfPkgX64.fdf | 6 ++++-- OvmfPkg/ResetVector/ResetVector.inf | 2 ++ OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 5 +++++ OvmfPkg/ResetVector/ResetVector.nasmb | 2 ++ 5 files changed, 18 insertions(+), 2 deletions(-) diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index afe9b7135560..41fffd6d3bd9 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -353,6 +353,11 @@ [PcdsFixedAtBuild] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase|0|UINT32|0x54 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize|0|UINT32|0x55 =20 + ## The start and end of pre-validated memory region by the hypervisor + # through the SEV-SNP firmware. + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpHypervisorPreValidatedStart|0x0|UIN= T32|0x56 + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpHypervisorPreValidatedEnd|0x0|UINT3= 2|0x57 + [PcdsDynamic, PcdsDynamicEx] gUefiOvmfPkgTokenSpaceGuid.PcdEmuVariableEvent|0|UINT64|2 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFlashVariablesEnable|FALSE|BOOLEAN|0x10 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf index 1e292d11ace3..10e8ba758a29 100644 --- a/OvmfPkg/OvmfPkgX64.fdf +++ b/OvmfPkg/OvmfPkgX64.fdf @@ -110,9 +110,11 @@ [FD.MEMFD] # SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase =3D $(MEMFD_BASE_ADDRES= S) + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase + gUefiOvmfPkgTokenSpa= ceGuid.PcdOvmfConfidentialComputingWorkAreaHeader SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize =3D gUefiOvmfPkgTokenSp= aceGuid.PcdOvmfWorkAreaSize - gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentia= lComputingWorkAreaHeader -##########################################################################= ################ =20 -##########################################################################= ###### +# The range of the pages pre-validated through the SEV-SNP firmware. +SET gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpHypervisorPreValidatedStart =3D $= (MEMFD_BASE_ADDRESS) + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesBase +SET gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpHypervisorPreValidatedEnd =3D $(M= EMFD_BASE_ADDRESS) + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfPeiMemFvBase +##########################################################################= ################ =20 [FV.SECFV] FvNameGuid =3D 763BED0D-DE9F-48F5-81F1-3E90E1B1A015 diff --git a/OvmfPkg/ResetVector/ResetVector.inf b/OvmfPkg/ResetVector/Rese= tVector.inf index 34d843de62c4..307699d8bf22 100644 --- a/OvmfPkg/ResetVector/ResetVector.inf +++ b/OvmfPkg/ResetVector/ResetVector.inf @@ -54,3 +54,5 @@ [FixedPcd] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpHypervisorPreValidatedStart + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpHypervisorPreValidatedEnd diff --git a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm b/OvmfPkg/ResetVe= ctor/Ia16/ResetVectorVtf0.asm index 71e1484cf4e4..a45e828a04a5 100644 --- a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm +++ b/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm @@ -57,9 +57,14 @@ guidedStructureStart: ; SEV-SNP boot block GUID and provide the GPA to the PSP to populate ; the memory area with the required information.. ; +; In order to boot the SEV-SNP guest the hypervisor must pre-validated t= he +; memory range from SNP_HV_VALIDATED_START to SNP_HV_VALIDATED_END. +; ; GUID (SEV-SNP boot block): bd39c0c2-2f8e-4243-83e8-1b74cebcb7d9 ; sevSnpBootBlockStart: + DD SNP_HV_VALIDATED_START + DD SNP_HV_VALIDATED_END DD SNP_SECRETS_BASE DD SNP_SECRETS_SIZE DD SNP_CPUID_BASE diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb b/OvmfPkg/ResetVector/Re= setVector.nasmb index 9be963206989..75a38697d5d8 100644 --- a/OvmfPkg/ResetVector/ResetVector.nasmb +++ b/OvmfPkg/ResetVector/ResetVector.nasmb @@ -81,6 +81,8 @@ %define SNP_CPUID_SIZE FixedPcdGet32 (PcdOvmfSnpCpuidSize) %define SNP_SECRETS_BASE FixedPcdGet32 (PcdOvmfSnpSecretsBase) %define SNP_SECRETS_SIZE FixedPcdGet32 (PcdOvmfSnpSecretsSize) + %define SNP_HV_VALIDATED_START FixedPcdGet32 (PcdOvmfSnpHypervisorPreVal= idatedStart) + %define SNP_HV_VALIDATED_END FixedPcdGet32 (PcdOvmfSnpHypervisorPreValid= atedEnd) %include "Ia32/Flat32ToFlat64.asm" %include "Ia32/AmdSev.asm" %include "Ia32/PageTables64.asm" --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80082): https://edk2.groups.io/g/devel/message/80082 Mute This Topic: https://groups.io/mt/85306660/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80083+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80083+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513065090178.63240873305836; Wed, 1 Sep 2021 09:17:45 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id LimbYY1788612x2e5SXgBGvk; Wed, 01 Sep 2021 09:17:44 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:44 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Y56X39VvhxAAzUBxHHFnZ1b7qOfto6Dy0RGfX7Kf7a9Y1Abco7KH3Lj2MKYA3Nj+NFxteqdBLNyX7ZWHw4iFiZys/Yn9vIHcy+utEYEg5ZeG53OdqAPlZfyjkSZEL0m8oj4qqSvne6W6UeHZ9QtlgVPLsGYbLTmTwOOXSE6/2+BVN2lahDFX0ifk1F4XX+yuuaGSBPVl2TWrJtLeVKm4BPBYNbzaMTl3ZlCjeSkTaq9Mj1vCTMq9QDTbtCWOZfUy0pxunFTR6+Z8/mawQuzyeWNwj+9XBWYP6yU+9LU5B35fLc8p9vGZKKCGKy9TxSdOa+HYgsAbCCDHecZUHhug1Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=VJZtrWB22b4iHqD1ncGiHcpz+F+S7AyU63XkbfoSoeM=; b=TcebmpwFEqhqva13d3lxWHoCKnH2OXY+1K90ODoeE4mqSUF5h2Vvg1GjiJMPisVvD42dpko59mWSX3MPYPLqXN1i/YyS5UAhLruc+1BpL1wL77TBtWq660cte2N3b4EHXCT7xBAtNlqlb1ldcHAUhhCym/AjgwBbP/CQ8XkXmM5T6OgskVpqw5QJxe+0u7T57AUpd+Ie5U9MoZMAMtfEChpJ+gg/bUO2FVxCu3vO4hFJ8fOKEdjmum/5k2iAQ/7mV1tpBpQGfiuWduMg+7cJ/sght2l8zCLrzT4i43HsC6shTYQakyUfhTsImm2/dHQg56qjW86DIm2kwnk0uboTvg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:39 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:39 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Michael Roth , Brijesh Singh Subject: [edk2-devel] [PATCH v6 07/29] OvmfPkg/ResetVector: use SEV-SNP-validated CPUID values Date: Wed, 1 Sep 2021 11:16:24 -0500 Message-ID: <20210901161646.24763-8-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:38 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: bdc5a41d-5716-4cef-af17-08d96d640483 X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8273; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: IZZ8tZscf0b9ZJcBSvDH4AIZG/P166vx2RdXIothoINjOIwBzjZOKiXCR5WvQDZxevAGpuviviHs33WwK7h0oaf1Xo5zp//zyFHESMZqVPfl6FVGMWPaJeOScje9P/egovw9yHZp3FL6PYXKbnSpLJnSq2hh+f2h6bewn31kLugwvtfLFpbzZJaHESYbGOIxgFcsgZ2wpbc4AnEZIPRJz2sWSKjuazSeIpbPdufOepkJHmya8swgmZ0zg4m6WFjXtBMf4PO8LdWqDKiW6XLFTS+4qo9ciP7lOmyVWfYvJv8vKErhglz5GG34hnKZboS+QJwiV0FWevmbWd1GrLDDpT55yeasddne5pB7LitL8n4JcOiyUF5beErMdJrzEU3oIESIuR1JY81HjwtuWMIqcC+98khj1owfdox3LfMIHPBmbF6u8a+tNo2NrlSKdRw4KWkRLQgVj+v/rC/Q9WTKBkHt31g+Kt06ety3c+FheH7pRne9RGyPbTRwo+RnXUPBnIbAc0/oiXzuJZXNBZmFfA4RyDDkVieiyQ/04ccERqBeDmeliC1ZZ+ljrQha/bxIfLFjegoVWQQjnXjcJhVqJok4woIqEhe7lbGxCe5AANIV5QwcI9PpjeSHgARQxd8hevtRDMDUBzZfziV6MWWwP0x/mKrmAAfoTZOliLanIYPJU8JIadxmgs7T1bw3PtsPLjG7APeLQfnJm6LsEr3JCw== X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Xgx50OarUWeD+o5ra8Ef56ZVN43Rf8IITEhMDIvZBUiUiGCkfMLUuiKLYHqs?= =?us-ascii?Q?BdyhMwl9rJcUnwjsbwDEY/FqWX7IRrnrrMgXFmE76NwkXI6mcOHulKTEPV9Y?= =?us-ascii?Q?5FWs11ShPxi6K2mXRSnfQv/gfzxcA7O0Z33W57i/mm5Aj3YqaKjG46rrkeVA?= =?us-ascii?Q?yx3zx6RdNUafPwXF1Ab9NhbBzCXaREKnd06QumwyRsnfSURKMi53FQ3Rhg9g?= =?us-ascii?Q?accjm+qKulx1enXCCqwGh6jdfK0aY+cGMBIZK1Nsy8Ckso/m1eXeyGcBRsFE?= =?us-ascii?Q?G809HOGhnDOBnz4rJbaXEIrG1g2uvdd0rOIqpFYtIicfssAZodt8eIFRAi06?= =?us-ascii?Q?SXHJBUMZgruMMw6yjNo+y5/jry+RHwM0l7dHKpTJT2Htfx632X2SZ6NWaw8N?= =?us-ascii?Q?Uu1eNjwJOqIHvzCJ+4HopGKRNdwRNvMMLIK4reXZWDWF7BUZJ2ImqcEKudP5?= =?us-ascii?Q?HHeYjTLkWmZNaW88ei+nx5d90pBTtt8wGBqypsPnM6D82pLuI5jmwLHEA8cV?= =?us-ascii?Q?0gbi9lNDS1GvELZuo+S7vXx4Re2Ze85rmK8CXhaiqLWc9J9rCShEL1ayzZr3?= =?us-ascii?Q?rAzM2SMRh3djGw/XhkRixAi0DfM+KDGyICcvbZAmC39x4Zs2MmoFrtPUOmiW?= =?us-ascii?Q?CX5xYE/E6TS6Y1Emv86KRYBmwKmwDf43HTrJmcofiQXwU4IHJKQ/CEKCPvs+?= =?us-ascii?Q?zohdlNyJLZEfvDUtd1X2jKGPWkhmirgfkl+3o4fVmHy56qI7E59U+9l/FJFa?= =?us-ascii?Q?K4CNZp/m9Kfk7W2sELSrk6TFhWOUCQLDwSbYTOEuKLNtnrIJVOOXCWTqgnH8?= =?us-ascii?Q?8e/QrI4AaUjOFvBruJyYJ4zwrRmOsPZfwcUeDAxf561rFklkxelVHbDU++m2?= =?us-ascii?Q?5ljtWCvD0o4pPIX+Zh95arVz75r/xJrjuhn94CiLrEEm49/yyJJnubryBOTT?= =?us-ascii?Q?VZahwscGGJVwGfIdIAS83kv2261Siql7hqUJgINK3UKNCZNl2/Hy/inWHM25?= =?us-ascii?Q?1d9dqPWYSGW4TxtI+DRBFW1Pinr4U7523pJqW0jPdOj0oYL1S+wtHYwMqZ3i?= =?us-ascii?Q?A2RaSgf76sevPrH+mRLaKILKQObWEzyN7ESDe6IsSMpC5ZJw59qS91aGf2L1?= =?us-ascii?Q?YOh6n7BxGvJMeJBryd48bu4w7+XJgsjG5GgFQuduxYxB/k370axfz/OGj1ib?= =?us-ascii?Q?IvwOnv2NeJbQWZzEuLVrAfCdwWloFnjknW8Be6l/GpFQnhHnI6h3aAgceIsv?= =?us-ascii?Q?E22RJ3XOrX9nlTqXOxe5CszsqIx/btmeGKe8ygcwh3fBalvy056zInRriOyo?= =?us-ascii?Q?V6nbKNefzwdJLC0dSSxLLRBT?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: bdc5a41d-5716-4cef-af17-08d96d640483 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:39.1440 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Rtl3pIxwWwZkgugPt3mQh6wl/6I5FCWOivAZT6Le4JPSj0njbQCp58ODF/klDnYGMxxbA2wrNeUXxQel1xGKLg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: 1qKbGr0R5JiwfdGbNPRwz5q0x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513064; bh=FlbPoKz8N8MUx0pHprtLOuYCKHV4wyB/SLfcF1E+X/M=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=NWJ9IthmhsXp+sR9DUJG6oi58inzQo4Fnmq9LBq/+IuwK21bsm4okYtIjo6XYdCdqmx Gvzo4uwLwGoqaeJWNz6H0vMvWr51bkZeruI43e3IScSO+oP8jCtxrZTmMzuzEKIOGdz9A XW0uV9DnCZz1QQGp3UypGrsXZwhx9Oe7lac= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513065827100029 Content-Type: text/plain; charset="utf-8" From: Michael Roth CPUID instructions are issued during early boot to do things like probe for SEV support. Currently these are handled by a minimal #VC handler that uses the MSR-based GHCB protocol to fetch the CPUID values from the hypervisor. When SEV-SNP is enabled, use the firmware-validated CPUID values from the CPUID page instead [1]. [1]: SEV SNP Firmware ABI Specification, Rev. 0.8, 8.13.2.6 Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Michael Roth Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/ResetVector/Ia32/AmdSev.asm | 80 +++++++++++++++++++++++++++-- 1 file changed, 75 insertions(+), 5 deletions(-) diff --git a/OvmfPkg/ResetVector/Ia32/AmdSev.asm b/OvmfPkg/ResetVector/Ia32= /AmdSev.asm index 2386b15c0ce0..3ce3dd2785cb 100644 --- a/OvmfPkg/ResetVector/Ia32/AmdSev.asm +++ b/OvmfPkg/ResetVector/Ia32/AmdSev.asm @@ -36,6 +36,18 @@ BITS 32 %define GHCB_CPUID_REGISTER_SHIFT 30 %define CPUID_INSN_LEN 2 =20 +; #VC handler offsets/sizes for accessing SNP CPUID page +; +%define SNP_CPUID_ENTRY_SZ 48 +%define SNP_CPUID_COUNT 0 +%define SNP_CPUID_ENTRY 16 +%define SNP_CPUID_ENTRY_EAX_IN 0 +%define SNP_CPUID_ENTRY_ECX_IN 4 +%define SNP_CPUID_ENTRY_EAX 24 +%define SNP_CPUID_ENTRY_EBX 28 +%define SNP_CPUID_ENTRY_ECX 32 +%define SNP_CPUID_ENTRY_EDX 36 + =20 %define SEV_GHCB_MSR 0xc0010130 %define SEV_STATUS_MSR 0xc0010131 @@ -545,11 +557,61 @@ SevEsIdtNotCpuid: TerminateVmgExit TERM_VC_NOT_CPUID iret =20 - ; - ; Total stack usage for the #VC handler is 44 bytes: - ; - 12 bytes for the exception IRET (after popping error code) - ; - 32 bytes for the local variables. - ; +; Use the SNP CPUID page to handle the cpuid lookup +; +; Modified: EAX, EBX, ECX, EDX +; +; Relies on the stack setup/usage in #VC handler: +; +; On entry, +; [esp + VC_CPUID_FUNCTION] contains EAX input to cpuid instruction +; +; On return, stores corresponding results of CPUID lookup in: +; [esp + VC_CPUID_RESULT_EAX] +; [esp + VC_CPUID_RESULT_EBX] +; [esp + VC_CPUID_RESULT_ECX] +; [esp + VC_CPUID_RESULT_EDX] +; +SnpCpuidLookup: + mov eax, [esp + VC_CPUID_FUNCTION] + mov ebx, [SNP_CPUID_BASE + SNP_CPUID_COUNT] + mov ecx, SNP_CPUID_BASE + SNP_CPUID_ENTRY + ; Zero these out now so we can simply return if lookup fails + mov dword[esp + VC_CPUID_RESULT_EAX], 0 + mov dword[esp + VC_CPUID_RESULT_EBX], 0 + mov dword[esp + VC_CPUID_RESULT_ECX], 0 + mov dword[esp + VC_CPUID_RESULT_EDX], 0 + +SnpCpuidCheckEntry: + cmp ebx, 0 + je VmmDoneSnpCpuid + cmp dword[ecx + SNP_CPUID_ENTRY_EAX_IN], eax + jne SnpCpuidCheckEntryNext + ; As with SEV-ES handler we assume requested CPUID sub-leaf/index is 0 + cmp dword[ecx + SNP_CPUID_ENTRY_ECX_IN], 0 + je SnpCpuidEntryFound + +SnpCpuidCheckEntryNext: + dec ebx + add ecx, SNP_CPUID_ENTRY_SZ + jmp SnpCpuidCheckEntry + +SnpCpuidEntryFound: + mov eax, [ecx + SNP_CPUID_ENTRY_EAX] + mov [esp + VC_CPUID_RESULT_EAX], eax + mov eax, [ecx + SNP_CPUID_ENTRY_EBX] + mov [esp + VC_CPUID_RESULT_EBX], eax + mov eax, [ecx + SNP_CPUID_ENTRY_EDX] + mov [esp + VC_CPUID_RESULT_ECX], eax + mov eax, [ecx + SNP_CPUID_ENTRY_ECX] + mov [esp + VC_CPUID_RESULT_EDX], eax + jmp VmmDoneSnpCpuid + +; +; Total stack usage for the #VC handler is 44 bytes: +; - 12 bytes for the exception IRET (after popping error code) +; - 32 bytes for the local variables. +; SevEsIdtVmmComm: ; ; If we're here, then we are an SEV-ES guest and this @@ -577,6 +639,13 @@ SevEsIdtVmmComm: ; Save the CPUID function being requested mov [esp + VC_CPUID_FUNCTION], eax =20 + ; If SEV-SNP is enabled, use the CPUID page to handle the CPUID + ; instruction. + mov ecx, SEV_STATUS_MSR + rdmsr + bt eax, 2 + jc SnpCpuidLookup + ; The GHCB CPUID protocol uses the following mapping to request ; a specific register: ; 0 =3D> EAX, 1 =3D> EBX, 2 =3D> ECX, 3 =3D> EDX @@ -634,6 +703,7 @@ VmmDone: mov ecx, SEV_GHCB_MSR wrmsr =20 +VmmDoneSnpCpuid: mov eax, [esp + VC_CPUID_RESULT_EAX] mov ebx, [esp + VC_CPUID_RESULT_EBX] mov ecx, [esp + VC_CPUID_RESULT_ECX] --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80083): https://edk2.groups.io/g/devel/message/80083 Mute This Topic: https://groups.io/mt/85306661/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80084+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80084+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513065611800.6657158684254; Wed, 1 Sep 2021 09:17:45 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id vSgYYY1788612x1O1k5oXxT7; Wed, 01 Sep 2021 09:17:45 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:44 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=nO805k6JggaHyVLwTZqG8vY05QtsjaVRUiHx2A1sQtc1jfpchRIwhZHc2Bh3H+Srz8miSQ2ZB0Nzp/ertUc47gK4G94HSNd21dR2whCKoM15cBj4pGPguNJ95BWPxUWJZKCOcj+J0HjqIpmlb3wiiIbU0cvuS4nnFE2AB68dfv18FRzrV6bBrexVbyKerW1kCMeyS4Ca92RKF9Iaf39RDq6XkIajh9sTZuir7ZwBT9D58zIJ/W4apeIbhtBjLXRKuBAJeIzGjXz4GtzqgTmbdbGOGHq6L2IJvXe7hS3ER7vDBw5JJf1h/r+T700bPqHXAMi5stpQLeHTfkFisF4r8g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=lKIY/ZENN4btwppjuQdsPHtE42ZTfYv3CTY8kA/e/sQ=; b=HM+VNG3FyD9ieRsxfMh286Z1Zc1XCesUYX7mr5quiFUeWHJupOoCJqJrSTu9Z3Sh+PWDVPrQnV19/UVDvuhBrtSC1k9AJNhNOZ5VAj6bgsyrQ535yF2AvktTFxKm/KVmgkL4nODTyuO0sIZD7f5aY7oWyDE+M1xykCTxQGmarDYk4rDrxSvD+qMJ85DM5AxXDBGQyjpTJKKkImOmuqtbepZ1C2a+k0ZD8TRrf38v9eQzJmdATme7WDsdvRxfF7CCkn+T7fRHnOy0e3918pxv2RgWavh6smrOwBfsNYZ36EDIzWAGDeCtf2rSjZdOKrDhCmi5gxxzsU27Ul8BMR4OKQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:40 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:40 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth , Ray Ni , Rahul Kumar , Eric Dong Subject: [edk2-devel] [PATCH v6 08/29] UefiCpuPkg: Define the SEV-SNP specific dynamic PCDs Date: Wed, 1 Sep 2021 11:16:25 -0500 Message-ID: <20210901161646.24763-9-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:39 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 5d0df092-f110-48fe-4b4d-08d96d6404fe X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4303; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: HpaYr6ish65xPoxQQ1Pt6qrjZXqqbB86cfS8ew7lwoZaF1EOrnOmmL/iTt1miYHophJoEnfuvihODePqMHiQT/lPUYyHlpwH9RgW/qY/CZnvVBaI9PFg9x6wLw/q/s5KJfoRRjXCVbiMtZveCft7nNvWsFCZbqAJj1uMsGjvhpuESP0qLZe1IpppSjfl0fitko1bJ8e2FWP4daEcAWwSxU9YUNBA/O89Rr1MTYQYQ4dV9NrL3lXs6qqSRDZqZJZ+HXA5z+JeluwRnhQERuJWdl8BiUlgGJ7N2G84Mj2wffZhXkwSKNpGOP+Uex2wlRrFhb1KejQVC/+nkFAI49VDFuSySLro4/KJmeRSIy2BZ+zlagwglp0o+Nz7kP6EJknsUTbJ8IdgOWrTmeQCyzYs0M48vGmwHCiTWt/vUwCXj1OLs69cwH65Ik+9Nd9+fVS+7IJwL9av9jeihowT4f2rmeOD/GU5f+HXm8lVI+kFgGeDeSuul8/Qk3xKlXcjR9ekoAAIOa4u/Jr971eDN02e67QZyB4fhOJPTR9vuvE3SsP0Dz7JnhSNC0jZhOcFrPPzT8qhNm0LsiU87Vg1JXfQr8xWz5+s8y5HYIUv1X3gfj/hG6QU33hcmOWyWq/5ctG6MTpWpzWEcmaNIDCwOWo4lnl5Fyt7NpWL2/gOLNvG1IbmFRMPlvgP8oIx8kz/oa0ABiTs1oFhv4bi2VJnk/+oGS9mK6X7SGglvu1RHNaGDVP8esqDBuJExb8rzqlS0CFapB55T07Vmjp/PoCD1xgpWwuG3zqnlnk6JQmf4E/H16M= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?PHO+bA8rloiFWKreZMwAQNCDqFiSDNkh2y+pUjUox4vdODv5pa2K+dlAvZH5?= =?us-ascii?Q?1O20kf8ksyRcb+pyAGz3HZj9Z1GADPZJkxPFl171EO56Dl1HM4tKyXoYGdm2?= =?us-ascii?Q?NAgriHZJnp4T3dkr/XV4Kk8Y1WKWCcjzCgABP+CGNlz8bykHwFfSNocNfae8?= =?us-ascii?Q?WePoJbLbS7FADucho35D1qHUcNJ4qWgUHTVmZ/6Z8uxNIX2ToA4DW0lhLxqU?= =?us-ascii?Q?Q+amUQbVU5RkeQC63ChIpKBywxTv7S5hmU1Dx30scQtPaNVQjj1Fh6mqfCro?= =?us-ascii?Q?MKKmbRIcpK/ABy9LzcWv5xrkS+00rNMhPI75eSOQ837moLbBIjF6cLhhZ7mK?= =?us-ascii?Q?PbzPzyKJcjaOylgtwz92tkOaUZuj9dUat/SinpOM/q//vB05q2JxXmulj3pk?= =?us-ascii?Q?+iNVahVrQRmU+WaZYwFtjZArj7cVJ4B//cP+Du8zq1DDYBOm3BUWeyPl9iiB?= =?us-ascii?Q?vY+z76J6MnR2Z2JslvaruNFn0Z4ZXqRW0+11QypIoz9y5XWmB5iWD7H7xTm0?= =?us-ascii?Q?HCg5XzAHq94D/wTRhKQ7FB7xYmnbE9gbn3xmZIFaNQ1oTYDW7SOkidVefmJG?= =?us-ascii?Q?DMPKxpERsj2O0LXx7FZ9hBXPPs1XsnzcfIua6WLRqA9vR1qF/r43TLPsUc7N?= =?us-ascii?Q?ZUEo1DKZzeWS7zY4ZC/91TdsnKPOSTlrHY0ylKfa+7vXH6p9rIB5pI2PZKAC?= =?us-ascii?Q?9jUHTeIFyWewB9GXcAgiEcakKmStwbrOg9SBrM7rG3pVnCd1qaV6GIbKWefK?= =?us-ascii?Q?O9AM47ehaQLtdzJBYFeQIcTHQuMxTQEWeQjBmkFWRYNG2N/PJ35S63CInBGv?= =?us-ascii?Q?7uVxp461ilzct9dJzJV9wGyczxmKI1flTMnPGLZ2WqjuJ236nGsiMMyKX8Zl?= =?us-ascii?Q?glGEnn/EiUoTwQeIpAFabHMzqe+wbifnuJWeqzXXoOMY8+MdYcXMTE8i9ODy?= =?us-ascii?Q?2Te1eXmHqrFIsSah7nlTbVzGd2MeWwl9HLnxGJrvR9jx8rQTNJLyTVRRNY8L?= =?us-ascii?Q?LmeloMoVX2ldH9LEUpAJdEUD84IrAEMUToFFYWPnXgJMXtXVjROL3w2gMY0e?= =?us-ascii?Q?xe9pVDQaHgvfzUJGbkW+o83iXt5MHjlVbXDH57slym9Gqq2IAP/Mqz9xdJJ7?= =?us-ascii?Q?XncW+JlygluS3oZLvFNupJkuEFU3NqJUoZHsfZH/Y1zMwdDKq/hhQ2ij2anG?= =?us-ascii?Q?jebn7wzcfvOGBit1C6UHWmiksJmtlleFrlC64TomEa00jwljJ75vVcZTm5iP?= =?us-ascii?Q?JBb761cAy3PZ9HacwTfPD3qOTeRuLoR6kQQATHZUfl7zxfToVKEfMSpH2Giz?= =?us-ascii?Q?NrCNaPN+BvC/2j73bc01x3vQ?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5d0df092-f110-48fe-4b4d-08d96d6404fe X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:39.9666 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: E3KhFheTBQAfsdVaCsOCifbZu9m/JqdwX3JTropjrJyRph5kiJcK3/xDYrCLv7YCAN2w19pchAbF04/GiF2nPA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: 9ZslkscsFjlvWwTQdC48Vwjox1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513065; bh=usgMaCbLhY7vZbn6X5/lFRXe6oq7pk8fRD5GMA99okI=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=Bv8eAwGAlij6Fjm7t4+1kWf0RvuFEG5B8QRd1u8aIYj5S2Llsz+Jb4HLxYavhNGBkkD OojWmlazn2iLWeKoYcfbKxRfjm1uReK2pm0yhb09el6WWbbdGVblm4r6vDjd5n6trkzvc tGwYnplCl20AlqX2sRHNjh/D407haSU6YWU= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513066095100033 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 Define the PCDs used by the MpInitLib while creating the AP when SEV-SNP is active in the guest VM. Cc: Michael Roth Cc: Ray Ni Cc: Rahul Kumar Cc: Eric Dong Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- UefiCpuPkg/UefiCpuPkg.dec | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/UefiCpuPkg/UefiCpuPkg.dec b/UefiCpuPkg/UefiCpuPkg.dec index 62acb291f309..0ec25871a50f 100644 --- a/UefiCpuPkg/UefiCpuPkg.dec +++ b/UefiCpuPkg/UefiCpuPkg.dec @@ -396,5 +396,16 @@ [PcdsDynamic, PcdsDynamicEx] # @Prompt SEV-ES Status gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled|FALSE|BOOLEAN|0x60000016 =20 + ## This dynamic PCD indicates whether SEV-SNP is enabled + # TRUE - SEV-SNP is enabled + # FALSE - SEV-SNP is not enabled + # @Prompt SEV-SNP Status + gUefiCpuPkgTokenSpaceGuid.PcdSevSnpIsEnabled|FALSE|BOOLEAN|0x60000017 + + ## This dynamic PCD contains the hypervisor features value obtained thro= ugh the GHCB HYPERVISOR + # features VMGEXIT defined in the version 2 of GHCB spec. + # @Prompt GHCB Hypervisor Features + gUefiCpuPkgTokenSpaceGuid.PcdGhcbHypervisorFeatures|0x0|UINT64|0x60000018 + [UserExtensions.TianoCore."ExtraFiles"] UefiCpuPkgExtra.uni --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80084): https://edk2.groups.io/g/devel/message/80084 Mute This Topic: https://groups.io/mt/85306663/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80085+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80085+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513066343643.5403021256807; Wed, 1 Sep 2021 09:17:46 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id Uf2fYY1788612xMOf7ybFwxI; Wed, 01 Sep 2021 09:17:46 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:45 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Qv1GaR+4CCa1KSzXkXZsq06fII59WiTrFIEpZCFlc6tzyOdqb8eICsnjj5ndZt149Hfp27MXiPx+OpsqjSI/0g/6i5jXifrDk09epaxaRnBIMXdY0kYj5vH7o07u7G5ybO7EdzQ2tKgtx4yeN5RoKlrHAYyN64yUbYWkNm87F0RHgM84jvegfDZenGalkBW35luGfZ81MbW/8o0JV9EbVmTq9jaNmSViwCdl8BsGth4cvgYnXrGPVY0WLG2k0fIKFf1Lb6hn9TESL5rYotuStFoUSPsDZwTA+nJkKrNHH9DMtl/Jw6x/vo3MxFWVEmOorgJbYnZVDVee+bACwaFwBA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=5OUcog9UVozK+ADgLz8vv0rYUnIBv0rJBeB6x+qPiHY=; b=XSpM9ziZg/dmRe2C9WV77Fl3A9DuwjdNfYZf5Kol7+iV4WgAPB0+3p4WgQwqZXEN4sz2mMeuWjaSJoP/vp/UV1jgq47HSS+sVnuGUbIKscTt3x3LAFo4k7+o4mlDCJCz2CvRX2EoSr5ehnCenw8HKyQ24ro0r9tzDVIE36zXvPTXmE1q2GEFKpHrWnLRH94RqZmpP/r0PFwSGyhyYzTnJdgf6ZsEUOi8jWfr2Egp+wypQDyhW+T3m4apqxlpx+nAdsMxOu5zVjb4zXItBIXhypA8QGIzU529Gvn+lGGGSiHDhOck4fQr/u/gjhYarkp8p/qEH7N65olEJg4c2Wi5aQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:41 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:41 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 09/29] OvmfPkg/MemEncryptSevLib: add MemEncryptSevSnpEnabled() Date: Wed, 1 Sep 2021 11:16:26 -0500 Message-ID: <20210901161646.24763-10-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:40 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 9bfece3d-5d02-41e3-6fd7-08d96d64059c X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:196; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: MicuvOkBf6svYha5oQpfXsYQxzrGWaMbS3n0R2cVdGMN+ihcOq9dYYIgbm8q4L0mVfvacdZi7wvVmfGShxpY9NqVtHAGaq0aJjsK/NToRyPmVBKM3AHhLg8l5B+LPQ5hPLSfq/2fORAInYfF0/qJyMOelCLDpJ0kr/gBKrO6H33oSt7AENrFO/OT5KC0wTLD4Qa4SiDD1um+Wrtd9p2svI4nODMLgbpJ2LPMUzUiromEr/XbVj1S81dPwK5k5ZPu5IGwK0UNfIqEiR0gUOsVGTn+/uHp+jfd/gyw7TFLOW79cWITF7rJr3VclB7q4aMQSrIBQhOj/XDargFcw114igsv3aXbyCl4k0aj1uiDLEkFolbRAdCGA1stNF9aSUM+akD/OcAEau6G63B7Vi25YliYCBYbzEPBX4dOfnV595CVN15Q0TOK+OOdJicYKafPvU2wu+TQz4DIUpRgMNuJGYutV5ugYrhUwY8i1+RGvbW6SdG7I3XhIwUpClzBHLIMzBpkrEE9C4Bu0dwGd3yvrKtroWmoFueu0M6dm5kJZ8mXQNuRHzv0A/o5mT8axXqZdQHsKcmYYSrTDVBpRZKjo+EOv5aru+0ZdLjNG6lr5x5y+GxV0XxX6VMOV/tMN3tqeyHyFOSU3LOOpJsKIZyBp1uGq15Q4VkDQJy4v2e4fbhW9sEP1UAoW/yVgPazxhwNfFKVdbVRxS5qTkg3KAsKv6V3xFh0EAx/SOOip7hJocU91XTwOtKBBvFVjZ9TpoQzmc52QvteYgy1CVa+xqI3CRgw8HWfsbu9CXTj7yoPeoY0Ed+RyEPfFUfxzbo7+e+N X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Ug/WPi6U+x72/ykq7D0GWezbJZoYLjtAUYTrIB01HjHyh2AFGe4ipqA0DhNI?= =?us-ascii?Q?NfpZxv7RWkxlH3yebi9GNDTA8BcqiqsI9Cuh4af2ZrRXmUE94UilY3UryGUk?= =?us-ascii?Q?f0ENc3NJ+x4K58eVVN9De3V0C3Na7hoh+tjR4c7J72jXhlTRznFJFIx2l9Ri?= =?us-ascii?Q?bfa7LiiTOub7g6dsEgHkPl5ggf2zmituOX4Eihr6eVBVOJyeUH7OMAcbMK8v?= =?us-ascii?Q?SKkn9D+BHRKgU/Y3lo1b86odyixxGbnz0TZrPvcvP0cJ4jgvhydby31At+7Y?= =?us-ascii?Q?efXuHNzJMXmSXthijd+W95o/dDoKxIS23cDlTBb0a+pTxYRlu2PZtVi8ZPDl?= =?us-ascii?Q?QEZEuNstg0fTaQTLZhgm65blgi800cOhAv4peqHISSQknHFkqlTgJtPBeuJU?= =?us-ascii?Q?6NmsTXIepkNtmXTIPWFRIzERIHJAoSpIcDf+PsBP4SfTjqPf0JOWHJBok8hZ?= =?us-ascii?Q?iZVsVc9RmZnMAE3jOPnm48zVoFDC/oTU++/AJbL5b3C1cDk3pFixfvrLA42I?= =?us-ascii?Q?2sz5Lzz6qONWYBqkJfjXs4iv0w8k5oJQDC7p55NaefKKGvkJLjXRzhZ8vwrg?= =?us-ascii?Q?6CePcl7ybcm0n30qrxxLCZBmAlYYb9WQgj4+LomHoQPLdmBVhzjZXJul5xgg?= =?us-ascii?Q?pmXitHqcmWG+yk17TJ0f15x4H7iXz9UW0AaNVYHu6hx2F5STDzikXeSQpw9W?= =?us-ascii?Q?VsNA17c2IU11RNO9/CZpBfPnxl1yv/cNelgqky5rZetiGtt+xNZTf6i/H+BG?= =?us-ascii?Q?4ZwQirB3Os1p5S5X8XKf64KkvEOYtE6Wf9EQldUzwk25UkoPvu/d52Fkfov7?= =?us-ascii?Q?oAFl1HvAvlLqsKzayBm4+BOspMPrkSwDaFMdwfDscp5ZHmX+CvYYURGV3rVb?= =?us-ascii?Q?bv8AqUNEiKQo5s/dqtomd/AWUGHtJ+Zg7tLQB9MIgRBvnbC5u9bwUUoBqIZd?= =?us-ascii?Q?uNr/it/zA5iBevcY8NI948XIS6RYDIJK52Jz/Z7bFZHkcfC5o099JQlYJEkt?= =?us-ascii?Q?zGSpWw1N4Hp4qPsupwdoHL0/XVsJPegKXz4VwkwjD2GXbwrot6DwoIz8YuB7?= =?us-ascii?Q?ke9WETnyOZJba28IofEkVR8t/K2bLLbfdoEGKFsgFbp6t4BLF2HIhmsPguoP?= =?us-ascii?Q?4xD5LwEs8lCaox+YMTX6M0MhOoS+Ofxshi5UUpnA82JDlnKDjBWh0cfTBFwE?= =?us-ascii?Q?7vCakOzaOWygPbGM3uTPh39mgJsWBpiwPA2uyoVg6/Fp+EWnOWTRTS7u5ozU?= =?us-ascii?Q?Nt1BPA9jfUnXu6xLbNjThe+JalQ3tBosOQrOhwC+1Q4u8cDxCR18yAJ4GL/O?= =?us-ascii?Q?+KsZrjwEtUK1iJJcy+YE+giM?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9bfece3d-5d02-41e3-6fd7-08d96d64059c X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:40.9950 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: HFxOqe8cieviF0BvGWMbe/DqgaZr7ualFiePPXLVJBB8J+R1C5NqYDjOLOiPfOqawnPk7Oj6C9uZvcXylrVEvg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: Wm9NB8fWlFANrMPnpYSmXVqxx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513066; bh=P3UKosJe1gpTGszxH46Kc5r3LPd5v3FkS8e5PjEIYEc=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=WfVhYMZApiOVhmMP9039OM741Vrz5eGXdXfejPuJK5G33kmmZN0sjGpRWQx1YGcxFJE ux2AOB/u4MGDhPx+x+5cARb1iKbDCDR8nAykyzL+jeyE6CrY+xR3UNTg7pZfak2QTdHXy dFu5KrIFgnTi3nACvlbS83DytUEo/hcwKk4= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513068294100001 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 Create a function that can be used to determine if VM is running as an SEV-SNP guest. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/Include/Library/MemEncryptSevLib.h | 12 +++++++++ .../DxeMemEncryptSevLibInternal.c | 27 +++++++++++++++++++ .../PeiMemEncryptSevLibInternal.c | 27 +++++++++++++++++++ .../SecMemEncryptSevLibInternal.c | 19 +++++++++++++ 4 files changed, 85 insertions(+) diff --git a/OvmfPkg/Include/Library/MemEncryptSevLib.h b/OvmfPkg/Include/L= ibrary/MemEncryptSevLib.h index adc490e466ec..796de62ec2f8 100644 --- a/OvmfPkg/Include/Library/MemEncryptSevLib.h +++ b/OvmfPkg/Include/Library/MemEncryptSevLib.h @@ -47,6 +47,18 @@ typedef enum { MemEncryptSevAddressRangeError, } MEM_ENCRYPT_SEV_ADDRESS_RANGE_STATE; =20 +/** + Returns a boolean to indicate whether SEV-SNP is enabled + + @retval TRUE SEV-SNP is enabled + @retval FALSE SEV-SNP is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevSnpIsEnabled ( + VOID + ); + /** Returns a boolean to indicate whether SEV-ES is enabled. =20 diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c index 2816f859a0c4..057129723824 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c @@ -19,6 +19,7 @@ =20 STATIC BOOLEAN mSevStatus =3D FALSE; STATIC BOOLEAN mSevEsStatus =3D FALSE; +STATIC BOOLEAN mSevSnpStatus =3D FALSE; STATIC BOOLEAN mSevStatusChecked =3D FALSE; =20 STATIC UINT64 mSevEncryptionMask =3D 0; @@ -82,11 +83,37 @@ InternalMemEncryptSevStatus ( if (Msr.Bits.SevEsBit) { mSevEsStatus =3D TRUE; } + + // + // Check MSR_0xC0010131 Bit 2 (Sev-Snp Enabled) + // + if (Msr.Bits.SevSnpBit) { + mSevSnpStatus =3D TRUE; + } } =20 mSevStatusChecked =3D TRUE; } =20 +/** + Returns a boolean to indicate whether SEV-SNP is enabled. + + @retval TRUE SEV-SNP is enabled + @retval FALSE SEV-SNP is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevSnpIsEnabled ( + VOID + ) +{ + if (!mSevStatusChecked) { + InternalMemEncryptSevStatus (); + } + + return mSevSnpStatus; +} + /** Returns a boolean to indicate whether SEV-ES is enabled. =20 diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c index e2fd109d120f..b561f211f577 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c @@ -19,6 +19,7 @@ =20 STATIC BOOLEAN mSevStatus =3D FALSE; STATIC BOOLEAN mSevEsStatus =3D FALSE; +STATIC BOOLEAN mSevSnpStatus =3D FALSE; STATIC BOOLEAN mSevStatusChecked =3D FALSE; =20 STATIC UINT64 mSevEncryptionMask =3D 0; @@ -82,11 +83,37 @@ InternalMemEncryptSevStatus ( if (Msr.Bits.SevEsBit) { mSevEsStatus =3D TRUE; } + + // + // Check MSR_0xC0010131 Bit 2 (Sev-Snp Enabled) + // + if (Msr.Bits.SevSnpBit) { + mSevSnpStatus =3D TRUE; + } } =20 mSevStatusChecked =3D TRUE; } =20 +/** + Returns a boolean to indicate whether SEV-SNP is enabled. + + @retval TRUE SEV-SNP is enabled + @retval FALSE SEV-SNP is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevSnpIsEnabled ( + VOID + ) +{ + if (!mSevStatusChecked) { + InternalMemEncryptSevStatus (); + } + + return mSevSnpStatus; +} + /** Returns a boolean to indicate whether SEV-ES is enabled. =20 diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c index 56d8f3f3183f..69852779e2ff 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c @@ -62,6 +62,25 @@ InternalMemEncryptSevStatus ( return ReadSevMsr ? AsmReadMsr32 (MSR_SEV_STATUS) : 0; } =20 +/** + Returns a boolean to indicate whether SEV-SNP is enabled. + + @retval TRUE SEV-SNP is enabled + @retval FALSE SEV-SNP is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevSnpIsEnabled ( + VOID + ) +{ + MSR_SEV_STATUS_REGISTER Msr; + + Msr.Uint32 =3D InternalMemEncryptSevStatus (); + + return Msr.Bits.SevSnpBit ? TRUE : FALSE; +} + /** Returns a boolean to indicate whether SEV-ES is enabled. =20 --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80085): https://edk2.groups.io/g/devel/message/80085 Mute This Topic: https://groups.io/mt/85306665/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80086+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80086+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513068890321.07689042605773; Wed, 1 Sep 2021 09:17:48 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id 5XgWYY1788612xoXWMlIfQk3; Wed, 01 Sep 2021 09:17:48 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:48 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=oIY7539wzW9D2qZQ6XQqkNe4naLcY5U65rLpMiAVPgYTyGdVVWE3ndBD0BJC/XC98rzaZakDkwwCeV+g8Gp3ec4gMJdk/GPsXNkOsonOIJMu5XBlDfvys7yd53IY0I6ZWJ88hAdSI0Qi9H6oj/D28O3/hk8xmyXgxmI2OvPnCNMuU7qb1TuTBw5+yhQ+v35X2DhWkKR4Tbr2IW503xyvNtCsLDk9DMPSEQIEU20rKG5yqzO9+aA3M+RINuH8xff7yN4wG1010jScZ+MwM5KLlCmO1z+u5wRGaeux8BOZMLM1CWYAGdZ2fD7Q7gDcX8YYKzyKyFSjRPRlotueq2+ynw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=wCim04ndJu7Qv4KJVDck4xFAE/p4o0SlKUoHFJfoIKk=; b=Bla5AbrZnbSn0f1aDoUGtEUNAlUrVnq36LoeA8g1RwjbgnDPj10FEE9qRbYOEHBkQQsnsLdpmcd4AL5QPqOG0okqAafSflKB7mjfzfgRTsFG6NgjuxrBam0ZbCTHdQwOJ17+1XU19dNmWqKx4rNFj1nqil++tFzzuMS7pw0VTXc3aDzV5vUKLJYxagis4H8x6e16QrBjRRVg4MJgLHknxBJLIwyuV30VO1U5qaSnR4vsbfkKxjtEOqYSYJL2bpFe5nKMdW5az2T+MA3Ba7dAjMJTu8upgeVnXqLPFS/oTknnFXWOlfU1yQxjjCKHw8Yy0m3EJWVCT4ycm3ugQ+GJVA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:42 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:41 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 10/29] OvmfPkg/SecMain: move SEV specific routines in AmdSev.c Date: Wed, 1 Sep 2021 11:16:27 -0500 Message-ID: <20210901161646.24763-11-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:41 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 0834c785-c05d-49ee-dcb5-08d96d640611 X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: sNXFj6cn3A+FrutWtXjAvGZLaoLcHYtoxAsbn1qCoo6MpkL170O/8BtwuyzSSNx5pYeLADJ1chGW+RbHGY7D9aD2bxJybeFMoxbSn/rDnCU/U/GEKfS0OZLVaJljGy7hLi2sT8LsXPeO+XgNXjA7jwIrXho7d68kxBCCW3bVhsKEU4EQWg7yj7sdtsacwZisqEl/KR3Q8eWbhMDswNJ2Xgneo+/ZifOuMjIDGAbOhihk86NYNJvWbBhMytI4bsAM19BG2SKHsZb74TDUKnWpPGXFu0Oju9259302DZfnZ2+0mbTMiSq6pmLdaUAW55V01iEooLAG6jzDV3EfkzWXf0IWworxGI8Plo9fCPsUd/rwEE1pGWoO9lkCewmLadPgIAQbEpLaAT6nSOJggCTk5h/NIyXuWZON3I2tmC3JHDtK7leZcRWEc5OFfPkTOo0cUYtHlC/8je0kQ4eK1Upu9aj2GgvvZo6RF893Ix90ongQAzkfc/qOVikAzDyMf0rpHVUnJpnq88BEbdO1rjShetBAXSRwHg1Z1owsadZgVituV8kP29uOt9XZW+AwQYfy/UG6p699GGitya/KPIyvCJqaDjjQBPmb901bC1IzOX7jvlOg1j1p8LplQJtN5BWggD5n20DMnEC/d/F0ro5/KRChTl9nAkBsmNnLf/ZpQwyIGhSdjkm0aeBCxvo+u0WX/gE1sN+6JQPQDiKh95uw9g== X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?wGoCR+NOsrEsB5T4ZWhXIb6Y1clkwyy4zfZTQL5+Edw77xi22+VFESSxFMo5?= =?us-ascii?Q?BXcmVHKNlVhVz7InuZ/fJMHdh5J6tm5RIbRjdSOG0QfTtBjvUCWbPx+ujCgE?= =?us-ascii?Q?xHZWG2Zu3DcZ74tugOIwflZtqi8Nh/uu/yVbBK2IXW03y/h48E4itxDXXiNE?= =?us-ascii?Q?4c7WUz1WSEG1Ml0loLtGjZNQSAaZGp7j/pYqlabEAXrRbxR2HZz72BGBEwQ9?= =?us-ascii?Q?ddf6HU4eOKQw5gKUPd0ZiaRJufBXrxawnk8LM2uXrZoqP93yLrYHBZchcv7o?= =?us-ascii?Q?PW+YvjrZspRAdEV0E9BqW3F/KXH3CJ7qpkjQVAQL5eEQxQ1CUDbEPCaf1xZX?= =?us-ascii?Q?ViZHURrNnZpxXe5ScJYLkwuTYeWvdGhm0Q4dQ+Cz5SucMzvtsWHj4KlnOfjf?= =?us-ascii?Q?OHPT09GSJievKtqdoxQyRiLTDrUO17p9z6Z35uZEfW56E8IemEvVzImiEGaP?= =?us-ascii?Q?L/uvD5hI1liImbhHhe0jRtiN691dLth/NzHUxGudrsNswS8Qyz4K+ppjXAhq?= =?us-ascii?Q?81/kndd4R9mSpfe8vyL8PRcDxzjQn4othkT7J4r9LpCC4ZkP6U0zeNGiMVDO?= =?us-ascii?Q?IzQ5bzuE2PO6koRZLIf1EyaGmit1dGpszeM/yhXyiigFhKp4xWgsjn7iRl9U?= =?us-ascii?Q?tpLbalEX/ibIPL5XaLmq+qQ5P12SuYuVO4vwK8cNOOWQoVZuxjkr343XkAEI?= =?us-ascii?Q?GGzWGfdIJuIpBOdtct3jWodSbY0lqVbcke3xd61lWm2SiO2UWNKskZMh+fG1?= =?us-ascii?Q?wEZXvaYApw/+5NToAN5SjwHePenGcwTbnHbE6TJhTZmXL3AF++K+vNmjGSpm?= =?us-ascii?Q?XqddD+UMjER/6aDri9Wc71Eyvhw1uo9lUIa29+fapuNw0vWQdeInRPEvmtAu?= =?us-ascii?Q?Zq023BCBm3YDSbHO8sP79P4I3Kjh2YzslT/xr4n2S9FRyhEJSjC4xtVAY4qZ?= =?us-ascii?Q?PkTD0EJZ+68Oigo4EQnvAEes/FfvIADjTrzHF2g+tjWtGwlWyBJn6t6WbvuK?= =?us-ascii?Q?VCfqtlpokbTLWMoUwT38ORyqnVxv1UwMzQjAurKa3ZCMMckNfyPFfmB2D7GL?= =?us-ascii?Q?F02KzWv9zORRdBQbxxm8NGQyo2CY+F+EWrNhCmpoo2bWqgQBFX5ebjQcv1BZ?= =?us-ascii?Q?/NuJJhWx87kjKRMSpXANnvLkFL/Z1GiFsYg7+vQeB6bciCCg3StXf6t+arAP?= =?us-ascii?Q?TdZ9hSFir/y9F5dWY1TeWmyPWFJs1idMDjHhoau8vwPFaSFfNU3A6zV/X/Rd?= =?us-ascii?Q?BcU59ikHpeXnZB5KVfSy17EKqyseeaz3WJtcqCC6zRMUBEUmohqpEleU3L/W?= =?us-ascii?Q?ZcJ4Vln/IoHwzstPd7xijBUY?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0834c785-c05d-49ee-dcb5-08d96d640611 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:41.8375 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: +ijusLyzb1+BO5oMxX+bo6O4EFamShhDSntn7y3g6mJyqlEjrZIAPkYZWnR+PQwkexljcaoPoU6t4LB+S6V/ng== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: Tz6UjDGJ8qH1oKLSsjV4iZqOx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513068; bh=iGZXLSumGbonvyRMRfH5PeaWxgxWKzEwf9L+PmsQ/Cs=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=Psqxl2t2EUB83LeOce4qEwpDTxPaCoKVaRJd4VdP2TCXvOCbiWCwiv67jjMMdcfUYvV WWwZYjBHrCbZdsUKJN0FYsqYc6NeCTBvzg+i3SMpSUyshXAkaO2ilR0mH423IS1HwzmZ7 vVSBmQxDYSUt3+OzFp3fnLtHOubZN2UbwrA= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513070624100001 Content-Type: text/plain; charset="utf-8" Move all the SEV specific function in AmdSev.c. No functional change intended. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/Sec/SecMain.inf | 1 + OvmfPkg/Sec/AmdSev.h | 72 ++++++++++++++++++ OvmfPkg/Sec/AmdSev.c | 161 ++++++++++++++++++++++++++++++++++++++++ OvmfPkg/Sec/SecMain.c | 153 +------------------------------------- 4 files changed, 236 insertions(+), 151 deletions(-) create mode 100644 OvmfPkg/Sec/AmdSev.h create mode 100644 OvmfPkg/Sec/AmdSev.c diff --git a/OvmfPkg/Sec/SecMain.inf b/OvmfPkg/Sec/SecMain.inf index ea4b9611f52d..9523a8ea6c8f 100644 --- a/OvmfPkg/Sec/SecMain.inf +++ b/OvmfPkg/Sec/SecMain.inf @@ -23,6 +23,7 @@ [Defines] =20 [Sources] SecMain.c + AmdSev.c =20 [Sources.IA32] Ia32/SecEntry.nasm diff --git a/OvmfPkg/Sec/AmdSev.h b/OvmfPkg/Sec/AmdSev.h new file mode 100644 index 000000000000..adad96d23189 --- /dev/null +++ b/OvmfPkg/Sec/AmdSev.h @@ -0,0 +1,72 @@ +/** @file + File defines the Sec routines for the AMD SEV + + Copyright (c) 2021, Advanced Micro Devices, Inc. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef _AMD_SEV_SEC_INTERNAL_H__ +#define _AMD_SEV_SEC_INTERNAL_H__ + +/** + Handle an SEV-ES/GHCB protocol check failure. + + Notify the hypervisor using the VMGEXIT instruction that the SEV-ES guest + wishes to be terminated. + + @param[in] ReasonCode Reason code to provide to the hypervisor for the + termination request. + +**/ +VOID +SevEsProtocolFailure ( + IN UINT8 ReasonCode + ); + + +/** + Validate the SEV-ES/GHCB protocol level. + + Verify that the level of SEV-ES/GHCB protocol supported by the hypervisor + and the guest intersect. If they don't intersect, request termination. + +**/ +VOID +SevEsProtocolCheck ( + VOID + ); + +/** + Determine if the SEV is active. + + During the early booting, GuestType is set in the work area. Verify that = it + is an SEV guest. + + @retval TRUE SEV is enabled + @retval FALSE SEV is not enabled + +**/ +BOOLEAN +IsSevGuest ( + VOID + ); + +/** + Determine if SEV-ES is active. + + During early booting, SEV-ES support code will set a flag to indicate th= at + SEV-ES is enabled. Return the value of this flag as an indicator that SE= V-ES + is enabled. + + @retval TRUE SEV-ES is enabled + @retval FALSE SEV-ES is not enabled + +**/ +BOOLEAN +SevEsIsEnabled ( + VOID + ); + +#endif diff --git a/OvmfPkg/Sec/AmdSev.c b/OvmfPkg/Sec/AmdSev.c new file mode 100644 index 000000000000..3b4adaae32c7 --- /dev/null +++ b/OvmfPkg/Sec/AmdSev.c @@ -0,0 +1,161 @@ +/** @file + File defines the Sec routines for the AMD SEV + + Copyright (c) 2021, Advanced Micro Devices, Inc. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include +#include +#include +#include +#include +#include + +#include "AmdSev.h" + +/** + Handle an SEV-ES/GHCB protocol check failure. + + Notify the hypervisor using the VMGEXIT instruction that the SEV-ES guest + wishes to be terminated. + + @param[in] ReasonCode Reason code to provide to the hypervisor for the + termination request. + +**/ +VOID +SevEsProtocolFailure ( + IN UINT8 ReasonCode + ) +{ + MSR_SEV_ES_GHCB_REGISTER Msr; + + // + // Use the GHCB MSR Protocol to request termination by the hypervisor + // + Msr.GhcbPhysicalAddress =3D 0; + Msr.GhcbTerminate.Function =3D GHCB_INFO_TERMINATE_REQUEST; + Msr.GhcbTerminate.ReasonCodeSet =3D GHCB_TERMINATE_GHCB; + Msr.GhcbTerminate.ReasonCode =3D ReasonCode; + AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress); + + AsmVmgExit (); + + ASSERT (FALSE); + CpuDeadLoop (); +} + +/** + Validate the SEV-ES/GHCB protocol level. + + Verify that the level of SEV-ES/GHCB protocol supported by the hypervisor + and the guest intersect. If they don't intersect, request termination. + +**/ +VOID +SevEsProtocolCheck ( + VOID + ) +{ + MSR_SEV_ES_GHCB_REGISTER Msr; + GHCB *Ghcb; + + // + // Use the GHCB MSR Protocol to obtain the GHCB SEV-ES Information for + // protocol checking + // + Msr.GhcbPhysicalAddress =3D 0; + Msr.GhcbInfo.Function =3D GHCB_INFO_SEV_INFO_GET; + AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress); + + AsmVmgExit (); + + Msr.GhcbPhysicalAddress =3D AsmReadMsr64 (MSR_SEV_ES_GHCB); + + if (Msr.GhcbInfo.Function !=3D GHCB_INFO_SEV_INFO) { + SevEsProtocolFailure (GHCB_TERMINATE_GHCB_GENERAL); + } + + if (Msr.GhcbProtocol.SevEsProtocolMin > Msr.GhcbProtocol.SevEsProtocolMa= x) { + SevEsProtocolFailure (GHCB_TERMINATE_GHCB_PROTOCOL); + } + + if ((Msr.GhcbProtocol.SevEsProtocolMin > GHCB_VERSION_MAX) || + (Msr.GhcbProtocol.SevEsProtocolMax < GHCB_VERSION_MIN)) { + SevEsProtocolFailure (GHCB_TERMINATE_GHCB_PROTOCOL); + } + + // + // SEV-ES protocol checking succeeded, set the initial GHCB address + // + Msr.GhcbPhysicalAddress =3D FixedPcdGet32 (PcdOvmfSecGhcbBase); + AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress); + + Ghcb =3D Msr.Ghcb; + SetMem (Ghcb, sizeof (*Ghcb), 0); + + // + // Set the version to the maximum that can be supported + // + Ghcb->ProtocolVersion =3D MIN (Msr.GhcbProtocol.SevEsProtocolMax, GHCB_V= ERSION_MAX); + Ghcb->GhcbUsage =3D GHCB_STANDARD_USAGE; +} + +/** + Determine if the SEV is active. + + During the early booting, GuestType is set in the work area. Verify that = it + is an SEV guest. + + @retval TRUE SEV is enabled + @retval FALSE SEV is not enabled + +**/ +BOOLEAN +IsSevGuest ( + VOID + ) +{ + OVMF_WORK_AREA *WorkArea; + + // + // Ensure that the size of the Confidential Computing work area header + // is same as what is provided through a fixed PCD. + // + ASSERT ((UINTN) FixedPcdGet32 (PcdOvmfConfidentialComputingWorkAreaHeade= r) =3D=3D + sizeof(CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER)); + + WorkArea =3D (OVMF_WORK_AREA *) FixedPcdGet32 (PcdOvmfWorkAreaBase); + + return ((WorkArea !=3D NULL) && (WorkArea->Header.GuestType =3D=3D GUEST= _TYPE_AMD_SEV)); +} + +/** + Determine if SEV-ES is active. + + During early booting, SEV-ES support code will set a flag to indicate th= at + SEV-ES is enabled. Return the value of this flag as an indicator that SE= V-ES + is enabled. + + @retval TRUE SEV-ES is enabled + @retval FALSE SEV-ES is not enabled + +**/ +BOOLEAN +SevEsIsEnabled ( + VOID + ) +{ + SEC_SEV_ES_WORK_AREA *SevEsWorkArea; + + if (!IsSevGuest()) { + return FALSE; + } + + SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *) FixedPcdGet32 (PcdSevEsWorkAr= eaBase); + + return (SevEsWorkArea->SevEsEnabled !=3D 0); +} diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c index 707b0d4bbff4..406e3a25d0cd 100644 --- a/OvmfPkg/Sec/SecMain.c +++ b/OvmfPkg/Sec/SecMain.c @@ -26,12 +26,11 @@ #include #include #include -#include -#include -#include =20 #include =20 +#include "AmdSev.h" + #define SEC_IDT_ENTRY_COUNT 34 =20 typedef struct _SEC_IDT_TABLE { @@ -717,154 +716,6 @@ FindAndReportEntryPoints ( return; } =20 -/** - Handle an SEV-ES/GHCB protocol check failure. - - Notify the hypervisor using the VMGEXIT instruction that the SEV-ES guest - wishes to be terminated. - - @param[in] ReasonCode Reason code to provide to the hypervisor for the - termination request. - -**/ -STATIC -VOID -SevEsProtocolFailure ( - IN UINT8 ReasonCode - ) -{ - MSR_SEV_ES_GHCB_REGISTER Msr; - - // - // Use the GHCB MSR Protocol to request termination by the hypervisor - // - Msr.GhcbPhysicalAddress =3D 0; - Msr.GhcbTerminate.Function =3D GHCB_INFO_TERMINATE_REQUEST; - Msr.GhcbTerminate.ReasonCodeSet =3D GHCB_TERMINATE_GHCB; - Msr.GhcbTerminate.ReasonCode =3D ReasonCode; - AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress); - - AsmVmgExit (); - - ASSERT (FALSE); - CpuDeadLoop (); -} - -/** - Validate the SEV-ES/GHCB protocol level. - - Verify that the level of SEV-ES/GHCB protocol supported by the hypervisor - and the guest intersect. If they don't intersect, request termination. - -**/ -STATIC -VOID -SevEsProtocolCheck ( - VOID - ) -{ - MSR_SEV_ES_GHCB_REGISTER Msr; - GHCB *Ghcb; - - // - // Use the GHCB MSR Protocol to obtain the GHCB SEV-ES Information for - // protocol checking - // - Msr.GhcbPhysicalAddress =3D 0; - Msr.GhcbInfo.Function =3D GHCB_INFO_SEV_INFO_GET; - AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress); - - AsmVmgExit (); - - Msr.GhcbPhysicalAddress =3D AsmReadMsr64 (MSR_SEV_ES_GHCB); - - if (Msr.GhcbInfo.Function !=3D GHCB_INFO_SEV_INFO) { - SevEsProtocolFailure (GHCB_TERMINATE_GHCB_GENERAL); - } - - if (Msr.GhcbProtocol.SevEsProtocolMin > Msr.GhcbProtocol.SevEsProtocolMa= x) { - SevEsProtocolFailure (GHCB_TERMINATE_GHCB_PROTOCOL); - } - - if ((Msr.GhcbProtocol.SevEsProtocolMin > GHCB_VERSION_MAX) || - (Msr.GhcbProtocol.SevEsProtocolMax < GHCB_VERSION_MIN)) { - SevEsProtocolFailure (GHCB_TERMINATE_GHCB_PROTOCOL); - } - - // - // SEV-ES protocol checking succeeded, set the initial GHCB address - // - Msr.GhcbPhysicalAddress =3D FixedPcdGet32 (PcdOvmfSecGhcbBase); - AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress); - - Ghcb =3D Msr.Ghcb; - SetMem (Ghcb, sizeof (*Ghcb), 0); - - // - // Set the version to the maximum that can be supported - // - Ghcb->ProtocolVersion =3D MIN (Msr.GhcbProtocol.SevEsProtocolMax, GHCB_V= ERSION_MAX); - Ghcb->GhcbUsage =3D GHCB_STANDARD_USAGE; -} - -/** - Determine if the SEV is active. - - During the early booting, GuestType is set in the work area. Verify that = it - is an SEV guest. - - @retval TRUE SEV is enabled - @retval FALSE SEV is not enabled - -**/ -STATIC -BOOLEAN -IsSevGuest ( - VOID - ) -{ - OVMF_WORK_AREA *WorkArea; - - // - // Ensure that the size of the Confidential Computing work area header - // is same as what is provided through a fixed PCD. - // - ASSERT ((UINTN) FixedPcdGet32 (PcdOvmfConfidentialComputingWorkAreaHeade= r) =3D=3D - sizeof(CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER)); - - WorkArea =3D (OVMF_WORK_AREA *) FixedPcdGet32 (PcdOvmfWorkAreaBase); - - return ((WorkArea !=3D NULL) && (WorkArea->Header.GuestType =3D=3D GUEST= _TYPE_AMD_SEV)); -} - -/** - Determine if SEV-ES is active. - - During early booting, SEV-ES support code will set a flag to indicate th= at - SEV-ES is enabled. Return the value of this flag as an indicator that SE= V-ES - is enabled. - - @retval TRUE SEV-ES is enabled - @retval FALSE SEV-ES is not enabled - -**/ -STATIC -BOOLEAN -SevEsIsEnabled ( - VOID - ) -{ - SEC_SEV_ES_WORK_AREA *SevEsWorkArea; - - if (!IsSevGuest()) { - return FALSE; - } - - SevEsWorkArea =3D (SEC_SEV_ES_WORK_AREA *) FixedPcdGet32 (PcdSevEsWorkAr= eaBase); - - return (SevEsWorkArea->SevEsEnabled !=3D 0); -} - VOID EFIAPI SecCoreStartupWithStack ( --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80086): https://edk2.groups.io/g/devel/message/80086 Mute This Topic: https://groups.io/mt/85306666/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80087+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80087+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513069678625.1062634927688; Wed, 1 Sep 2021 09:17:49 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id dDdDYY1788612x1Lp44DTXZX; Wed, 01 Sep 2021 09:17:49 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:48 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=PqZuotBfCqghDLc+QtWci/2OHfZrfLZyer9WJzCC5kBp3i1yx+x0Epes/J0/0aNAAy2JDx4ssoKyuu15qUc/njRrhvD6IfRnC5u1jU7m0lQ+te+yd3Fshe4Wc+W0cXf99zfQbi4r1HiKGt64jRDrBhAzsWj1dHxjJxmQb+ziYcbkNEWE6sC+UhLJcnxvPnbQDqU0ip1n4n28FAuMxvWM4jl/giU5qvrbgCt5xPn0/MGqRzr8of0DGzTH68YJISTVtOC0t1J6kDP7mw8qLGbQ2WmbhlS1DRtfZaHJMZYsGcGxlmt9D6lnY8jrE3zigGxL8+P5MqL4Kwh2WrFr2QRxeA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=WPvt287+uBijKTQV9IOneZeVURnXj6LsXUCPBmBTZ0U=; b=M5FOdxSxvpfCvKvIbJAFsqfpf4/0ZfwIXNa6DS6FzmeMPlMUMyT3pFgv/uW2rorxTxwRnebwMuCG+H4B5RFmFF/fK7CuLEHgENVAGq2NkVxnVGpsp1a76m1Z7zGsrosXI/rnpWr0NvtjKFpZWPWLsKe0DHfxl+my6HWnP6YKQnp2JI3j/aTR6QXj9jWFMir8r77ZGjsKD6FaETZGz2g/AI3ULtEFvmGBjRr46Z1ZNoJJKL+i37K00I+kVrL8UYrQE20O1KI19+nseIyKdrxDldGuh9y4KKYwOznLAIa1rzyfEn0+/Q3hCLRLIA1/NsTaO15R8imbmlWxWnugiUgGAw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:42 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:42 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 11/29] OvmfPkg/SecMain: register GHCB gpa for the SEV-SNP guest Date: Wed, 1 Sep 2021 11:16:28 -0500 Message-ID: <20210901161646.24763-12-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:42 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: d80aebdf-27a9-4126-e70f-08d96d6406b2 X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: /RWnkVmXFbSuO99+i2dRm1LAgwT0YN60Jc+j784I5cYAVbWPHGJuix2T1i08tno8iZU97CTKs5bt+Mg/Grx1t32+mTejVzIcY8JXvNsoDuji7SbY4VI+RXYZlpsHtVXwG/XYNHrqsM5k05rBnalmZ0fUIDY9dfwh8szoTd7+S0FXVnUK7pSJV8cJvdOzJ17Hv1LX3Q3mFmUfBfzfhh28ap+GDD/NR286VaLkTE18+rxaUpWkdnoi7ICHxyqfUUgSXhVo05+YGB+WbYg89CgWUU12K2eyYuEgNAcZ7Ht7VPsMo08+spFOQ5vs+RxqFoHjXr1NJfEJL9+eZ8aoJl1hVMsXZSLUtAKFlQjIP3P50UbrK920JqwhAi3FDoAid2ZuVN8ye8tGp0TMnSsOXKd19cz62BqISWx3Hm8S/Vw0ywCRWBN07eQrfHGhiBNFUU5mHsVzfYei37MbSKsrgqxzRTYQrUMjy7BpnCEYQP+ijmtwvq28x/sDPK58BN40jWhufv5iAm8n0EpJlVcPHQ8T+4vDnlNvPedhFBY3Cj+1c2y5VUgFEW60kkdDFQCy4FKKQKAsH1Zme/MpCuYi4ad9Ey9v97j/CssunrjXWVq1lhohgk1GK/ITpsIgsc1urx9P+VhaWMvv2V3FBbp44rB/c1DhTKTMTVU0E2IW2Xn6WbWz1NIa62dES8bGYs0xSfkZ3ec9WW9BmM3xKGysVBLsTyvE9FETFnIHuGsUVho7JYc8/VEBWkndgCicWdkyrDowdPtSdPrbsZrmI6v3nIRusDbx1ouhyji4mtL4exCcY74= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?bGet4rpd4zbGSCMR37ZzCj84Xqbj16BEI+pVKnuv5aEB5iYudzxFgLosk9Os?= =?us-ascii?Q?L2qRZ/Dn6hTbAQBgRx5Vq8FnB7mpL4rruEsgAJEe4nyOkDyDjZl5lAWGZKbx?= =?us-ascii?Q?/Op23xDVWJtACD+s4tFbs9rEMN/wxAyXQQ+kV0aeOTFw1HvyIQ1pfAKIGavK?= =?us-ascii?Q?fqFzG5dCdld/Ht8pSCbyhWjApnA6/ac4i70filLhSUXUDf5Em1L5EaEf0onR?= =?us-ascii?Q?am1sYy51u5+gdFqzU2h6gCnB04mfaT7JO1erZsvR2ZQwVMIYO/qkxVDc/4Ux?= =?us-ascii?Q?mX1JpXYD/Zu1Bm+TLDUPhues+17EYCHkQmBhQ2z8shiiCKk325gW46Rf95oA?= =?us-ascii?Q?Y1UhPGJMQ85oQPU7+r4/kshiz/CEaNuUMsYun0QTk1tqOGTEUkMc0+Qe10BC?= =?us-ascii?Q?rvvFNmxrA86y84Ufzg0KNMwQrJ0VnxPTyuqgnAWmvLYXfshWnuS3AaGiURWv?= =?us-ascii?Q?fhddFCozytckvBuHOHH7Lw9e4S5r/jxWufAFJVwtuDyhBAt5+P4nMDb2IbkU?= =?us-ascii?Q?ZbG83R1CoIykXpTNaNcpAelIf9aikDqtYpYYu8dYRMaOp2xnBSwteMvIaAUX?= =?us-ascii?Q?6pp7j3ktFRNWtDHpx8Uhql9tAIIY+hzGiFY7p61bpWh4FwnG69pThFsaZ+ZN?= =?us-ascii?Q?nl9vI0DyHocVzGzvYdByb5mGUiXwNnmSCiFL+U/1LKxD5qZQRO1yk9yUKmTD?= =?us-ascii?Q?uhpgjLwV/SX/BsMLsx0HKzu24W10imXAg/YT5RrRP7XqRJGofnNB+K4/fhJY?= =?us-ascii?Q?1L6S0MIp9MuDUMg3ehNdNLa9CDNWyHlRw6CpAMbyNPOqX3ig0mLN4+B9oX4C?= =?us-ascii?Q?9Hg7lM5tIPEjxxePjylnZcSlipi5vm8k+byKP/A2JBvyBIHz6CfFGpTGkZgT?= =?us-ascii?Q?DBvz7AZV363zsnUKtlOs56bLj16Xp/p29oifORq+W1cngMwDZ7Y8dyYBh408?= =?us-ascii?Q?Ou+zFlEKSl3CogntGoACMLdBY1m6YY6PwIYyqTLwfG8AmOQ7qClkSGw+8A9h?= =?us-ascii?Q?ft5G9ugA0YjwSf17fSQyA6GhbJlHKfnKL4Li8TaT2QAswWLs4HU7H5LfC+nv?= =?us-ascii?Q?hix0mhrX6Q/XR7cIczN2HZoLNwfopB3/io1J0B1T2voq0/nUK9L7j1u/C7YP?= =?us-ascii?Q?dxuR1UpyEYJQKWq8JRF4VRd+NXm4ovSnYvziKDaUfQQQHuG9AZo/AzwuN2ME?= =?us-ascii?Q?ob5oGkyGH1In45WQ82X06OaRMLnhKRcSmcj4kV3ZsQZfVcuBsh6cLwiP24I/?= =?us-ascii?Q?6tueJuAeOhFWOVeHMwbJp69kk7Ri4bQaeDnfQ3/ZJ4qZofGy8oyZAWX9HxGG?= =?us-ascii?Q?gPTyDBViYPKWWvqgAufsiLis?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: d80aebdf-27a9-4126-e70f-08d96d6406b2 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:42.7969 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: cnfd0LYm4tdE26wsBqTqCYFIkIkdL6xIBiASIWkUHVtO8eX+vAiCWKsS37Sa3vdlgcFCOJ28jLFKp/Ffe0FnTQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: 7YRVAUhlTQ0oyVlWAWWDErnrx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513069; bh=scGh0AUACaIsz3VW9mCrkugQ4LmcHah/B9xvKF9pgvw=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=JTGWijizjxZJ52PQkPm1dAZ7S8Qs3sf2qkCrR30URsbrSFz3jXTLpausFEriYB8fWdy c3nQdnVp/6J8jyagqZp7qScgGrXJCkhrCAlfG/SmtWDjyF10PC1abqe1YCk4Igr8Em133 HKcw+vUMnbvGu0WplrR5Hw/OkgRBBYYPA4I= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513070784100004 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 The SEV-SNP guest requires that GHCB GPA must be registered before using. See the GHCB specification section 2.3.2 for more details. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/Sec/AmdSev.c | 88 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) diff --git a/OvmfPkg/Sec/AmdSev.c b/OvmfPkg/Sec/AmdSev.c index 3b4adaae32c7..054f19216f1e 100644 --- a/OvmfPkg/Sec/AmdSev.c +++ b/OvmfPkg/Sec/AmdSev.c @@ -48,6 +48,83 @@ SevEsProtocolFailure ( CpuDeadLoop (); } =20 +/** + Determine if SEV-SNP is active. + + @retval TRUE SEV-SNP is enabled + @retval FALSE SEV-SNP is not enabled + +**/ +STATIC +BOOLEAN +SevSnpIsEnabled ( + VOID + ) +{ + MSR_SEV_STATUS_REGISTER Msr; + + // + // Read the SEV_STATUS MSR to determine whether SEV-SNP is active. + // + Msr.Uint32 =3D AsmReadMsr32 (MSR_SEV_STATUS); + + // + // Check MSR_0xC0010131 Bit 2 (Sev-Snp Enabled) + // + if (Msr.Bits.SevSnpBit) { + return TRUE; + } + + return FALSE; +} + +/** + Register the GHCB GPA + +*/ +STATIC +VOID +SevSnpGhcbRegister ( + UINTN Address + ) +{ + MSR_SEV_ES_GHCB_REGISTER Msr; + MSR_SEV_ES_GHCB_REGISTER CurrentMsr; + EFI_PHYSICAL_ADDRESS GuestFrameNumber; + + GuestFrameNumber =3D Address >> EFI_PAGE_SHIFT; + + // + // Save the current MSR Value + // + CurrentMsr.GhcbPhysicalAddress =3D AsmReadMsr64 (MSR_SEV_ES_GHCB); + + // + // Use the GHCB MSR Protocol to request to register the GPA. + // + Msr.GhcbPhysicalAddress =3D 0; + Msr.GhcbGpaRegister.Function =3D GHCB_INFO_GHCB_GPA_REGISTER_REQUEST; + Msr.GhcbGpaRegister.GuestFrameNumber =3D GuestFrameNumber; + AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress); + + AsmVmgExit (); + + Msr.GhcbPhysicalAddress =3D AsmReadMsr64 (MSR_SEV_ES_GHCB); + + // + // If hypervisor responded with a different GPA than requested then fail. + // + if ((Msr.GhcbGpaRegister.Function !=3D GHCB_INFO_GHCB_GPA_REGISTER_RESPO= NSE) || + (Msr.GhcbGpaRegister.GuestFrameNumber !=3D GuestFrameNumber)) { + SevEsProtocolFailure (GHCB_TERMINATE_GHCB_GENERAL); + } + + // + // Restore the MSR + // + AsmWriteMsr64 (MSR_SEV_ES_GHCB, CurrentMsr.GhcbPhysicalAddress); +} + /** Validate the SEV-ES/GHCB protocol level. =20 @@ -88,6 +165,17 @@ SevEsProtocolCheck ( SevEsProtocolFailure (GHCB_TERMINATE_GHCB_PROTOCOL); } =20 + // + // We cannot use the MemEncryptSevSnpIsEnabled () because the + // ProcessLibraryConstructorList () is not called yet. + // + if (SevSnpIsEnabled ()) { + // + // SEV-SNP guest requires that GHCB GPA must be registered before usin= g it. + // + SevSnpGhcbRegister (FixedPcdGet32 (PcdOvmfSecGhcbBase)); + } + // // SEV-ES protocol checking succeeded, set the initial GHCB address // --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80087): https://edk2.groups.io/g/devel/message/80087 Mute This Topic: https://groups.io/mt/85306668/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80088+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80088+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513070144783.810112059862; Wed, 1 Sep 2021 09:17:50 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id rfn2YY1788612xZotrbJRv6U; Wed, 01 Sep 2021 09:17:49 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:49 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ena4vDW0eW6rRfTWR/DQgpWr/+uEzx4k1Pnb/voF1wsRfpGb1ZAkl+tQUOODspxN0jkzH0rhp0UHZQacwXZHeS7l/KJMQSW6M5NtDOYLxS3GWQAi/O5iH2Dm0e3v3qLWKAChlynhgJHH79+fsohGF19FfkYT5+nFfIP5Umt6eIE4XhBUZYz448flpOX00WE4mvceoZOCPKq2k9OTpfBAwWvPlmV+nHkUeNkUGk0VxXeC5BebiyzSPns13fq+/TtC3DuXAM0CzLaNV4ybkX1WyPYYJF5o8oP1AxWRoadhyuQKaVdGU/ZimHWvPpcShOikeJIPkYN1PALRY17CXBY+Ng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=6tCBSQMLnYm1zCEMvmD4N0dhdvKZmvy63/5bznKIKYw=; b=ngqOUWhf5AacYggO0T8i/BUHuPKXKGW7fhtnyd8gsqdOpl1QGOMViGcb3CF9uKzdL6S2oiU1RS48htgHCm23+rhh5CAG0+fMQIC33YHKNri15rvCojZWs0LoPKh4tvzF8FLSMIhVhStmG9aK7Obp7OW8BdaKboELVRmAsSatn6QC2vb66MQWO4DhWfQayvnQfUlJuqrnSx8vYu4XD+jE2ALCJfx6amPQ49Af5joMo9CGNFiA0HK5PQeT88Bn2a2JffpBIpZyF/LLRx9w6Mlm1HDCT+ijtvPeTTBrgamo8W7tXlQEnJxyLdkXFj9tqFpuhevMmg27JgIVmhMaqvlD9A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:43 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:43 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Michael Roth , Brijesh Singh Subject: [edk2-devel] [PATCH v6 12/29] OvmfPkg/VmgExitLib: use SEV-SNP-validated CPUID values Date: Wed, 1 Sep 2021 11:16:29 -0500 Message-ID: <20210901161646.24763-13-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:43 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: c302f9b2-94d9-4f7e-40b7-08d96d640742 X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: +PFfbBdslRtiJRlDY2QhoHlFBhcl0PAR4Neh5t6Fvxp+oLNRgOutAk3wh4tpbr2L+ImzhREuygEC6T+wj4Hq8zAKq+xvPTWf97nSXOeUNHZzFyfIR+Q3bb5CyS1ZngBgf2l+lYcXUQh6sDIOoTNVaphLb0Au/JFTDYf64cz9lrub2JZ/A1xR1xtJs+zR2BSaU3prLKYU9ZhdpYw5XZ1avH03saF4KFE0nBvrQadG9fpt+AdbLT4uD8LDIHDUJoLWzjvidpqiXsqGQGPJNc6DpOhycXXA0W3o0EpA1kEZzIYF0+sNDLo0GcyVOvy5+ROJ3rGX9xlow5UzmPeGEJ0gUlqR6oL6RdT9ANib/i96F8sM+2xXH5Y1KW6MBkXrJrsnKzNX3CQkTOg82e+Pm+5bbuO4tM5ejYoGzcxEj4htLxu6TtrEreR6DP69fxNQxkJVdDIzc/EV+vmgnf8u6zYUulhkvkYGCynX7A13rFteRy1ngSUDre8No0IwvurCnaSsTcDRonl4DB5gp5V605DujvVp2zjay2nhuOlxOpkprCx1TKiIrDmktE/hHLtNSQpxZ4GUvyF638+Xxa0Kbca8iwyyit4WAVlXqA78hMiri5sfVLjMWYyYNB0OnhmYU4iBLLSXI6oT9J3eHRP164lISkm4UBlsabFvqCONUDn6njWaJzEg8/iHFhf2rxq0LFzPFlM7kdTaCRKp5wp98csY/ewMzLiSdHwHCA1z9j4Rzkk= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?R0iuIjVC+gVTv8pLgYz8YlmpCpUv9gcnPuc3xCRLJ0X8ZDe0GChI+2m3KPXQ?= =?us-ascii?Q?0dnri0wPBclINvZLLSipvO2BvjrUWd9v7VLgXVXZz9JNNeFVCZAiG1rnXD0o?= =?us-ascii?Q?MQFb5VrB0dybY4CMyPjt6mdFi4y8Z870wqu9usuhbaaBV5deBoPpAGPt1dSS?= =?us-ascii?Q?nTCWK5zOt5vSJ93bPX8VBen8p9Q3bwTwIIP4KtL6POP7d5ngzd2/nqtRJEmU?= =?us-ascii?Q?KrfMdZleKnpLALcxtv+q0ozegRazVqhTz8LhU8H19HMIANhpEGnaIRJ9kgqV?= =?us-ascii?Q?Pz1C+qXnHQroNUn8WSGH5hArB1xXpuHWkQMON+vXkn1o0Mb9WSCH1gmHpTmW?= =?us-ascii?Q?xNx1ARTVUa70z61l1ckG1yPxvoFuExdAUi/bw/h9ByZbOfkJONgcjgYNyGbk?= =?us-ascii?Q?OF+YX+rFmEbTZlH3vVU6Ylwpzfe8EsfAtzJUKmctoy43JDG7yvM3+Y0IbGL7?= =?us-ascii?Q?iLd3dfdcrPMWfDzM2WGgHel8V+7Dw9MfaVh3BVDfum9UUckVuX+6XfoSi39e?= =?us-ascii?Q?Pot0wwteAI054tJDiDHaw7TQxyol10HzZJTLBn63cBxAyhcHtMR7rhm/ef+G?= =?us-ascii?Q?MS5GFuMxtGUQplbudlQls8WJ8xJdNwn4vli9b5VRXiSw6LskfjjWncL/Dvid?= =?us-ascii?Q?TntabZnHmXWWYeJ9C1SZRH2fvuT9latnEN68jlwdRLhcibOdSt8aekAVEFFx?= =?us-ascii?Q?8TroWulWJ8AdKsophESA6Xd9ohrlnR2AvTAxhOTLqk2yxkKucAcMEFsN2+pB?= =?us-ascii?Q?Wo9qIpPKwj+pUyd6tBHtGXN/4yv5rag8DtxjSuNys+j2Uz4X3HiDgutXnQ2p?= =?us-ascii?Q?dRFYvxeBmUuG+j0Rylwf+mlB681hTNsMSJ7Zx2wtY+M7335Tl4oWZORCHKKp?= =?us-ascii?Q?b6n5l4clEGt13JX3PkAJOolCutt5eA87nzF5mapKErBLqbF5mDMvN/wvm95l?= =?us-ascii?Q?IfqrQmq8/i0ClRg8rjfFiM8+oTyHUvcXPOkus6SsVhqqXo83aOGCvLiWLX6w?= =?us-ascii?Q?U7apb2e/pxJOVxRva7LbnHrXjxlMAchaheSIECGsi82dIKK1K2MKtdJRqvYB?= =?us-ascii?Q?gyobhcYyKZ2fWtuRsE2HQNl1sIDdkOgWVZjNRhItz0nhKj4RBlelljJ87cYH?= =?us-ascii?Q?NfThD0LdZ9L1e2jSXRMBOTNNCLxGdXnB9PEzO38FvJjv5uLWJ1HF+mVLLzbD?= =?us-ascii?Q?9/h4T99GU4Z0KXjE+bcXDmWl6NriBwySnt2F5VwbTplDbRqWFl8vwL6TGKhz?= =?us-ascii?Q?P/ztE/jYZlYf5vJrteAQ1x2uvlose+J+/7Q6CLiUxqStZGaB2P6+31CxLc29?= =?us-ascii?Q?np9eyvykH103nNC//5JP4vbC?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: c302f9b2-94d9-4f7e-40b7-08d96d640742 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:43.7254 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: dbvzlJefxjNM/bS26IdUNFjdEHNKnxhFo1pFFBPG0pc5fOFFB2CBE/vGrTo90AhbT2vf3BBHV3zMaKx75C7QqQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: skrOMkmuVGzcNx6tq5DZFlHVx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513069; bh=94/bjhjlFcp+sDky8w8a/PZhwwlCPHgYMMK8ue5gSPI=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=Nl+aGqXqCayOk0jFtoE+16MJ9Qp4U+yYq8WPUFA6jOX3UzDP1PogNt0f56mw3oWeEtk +Y7UvhrUDTMK9M61ztYvMyM4Gz0F7Mn/nu7uN+pruxnQ+YN1spwvuvTVN97P74iJq9CiY GVTagxyvujkLs0RQs5xyE6DdpsnYz3jtRn4= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513070884100007 Content-Type: text/plain; charset="utf-8" From: Michael Roth SEV-SNP firmware allows a special guest page to be populated with guest CPUID values so that they can be validated against supported host features before being loaded into encrypted guest memory to be used instead of hypervisor-provided values [1]. Add handling for this in the CPUID #VC handler and use it whenever SEV-SNP is enabled. To do so, existing CPUID handling via VmgExit is moved to a helper, GetCpuidHyp(), and a new helper that uses the CPUID page to do the lookup, GetCpuidFw(), is used instead when SNP is enabled. For cases where SNP CPUID lookups still rely on fetching specific CPUID fields from hypervisor, GetCpuidHyp() is used there as well. [1]: SEV SNP Firmware ABI Specification, Rev. 0.8, 8.13.2.6 Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Michael Roth Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/Library/VmgExitLib/SecVmgExitLib.inf | 2 + OvmfPkg/Library/VmgExitLib/VmgExitLib.inf | 3 + OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 444 ++++++++++++++++-- 3 files changed, 419 insertions(+), 30 deletions(-) diff --git a/OvmfPkg/Library/VmgExitLib/SecVmgExitLib.inf b/OvmfPkg/Library= /VmgExitLib/SecVmgExitLib.inf index e6f6ea7972fd..67cbe15afafe 100644 --- a/OvmfPkg/Library/VmgExitLib/SecVmgExitLib.inf +++ b/OvmfPkg/Library/VmgExitLib/SecVmgExitLib.inf @@ -42,4 +42,6 @@ [LibraryClasses] [FixedPcd] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize =20 diff --git a/OvmfPkg/Library/VmgExitLib/VmgExitLib.inf b/OvmfPkg/Library/Vm= gExitLib/VmgExitLib.inf index c66c68726cdb..a81fb034ad2d 100644 --- a/OvmfPkg/Library/VmgExitLib/VmgExitLib.inf +++ b/OvmfPkg/Library/VmgExitLib/VmgExitLib.inf @@ -38,3 +38,6 @@ [LibraryClasses] LocalApicLib MemEncryptSevLib =20 +[Pcd] + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize diff --git a/OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c b/OvmfPkg/Librar= y/VmgExitLib/VmgExitVcHandler.c index 41b0c8cc5312..152d38c42cbe 100644 --- a/OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c +++ b/OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c @@ -17,6 +17,7 @@ #include =20 #include "VmgExitVcHandler.h" +//#include =20 // // Instruction execution mode definition @@ -130,6 +131,32 @@ UINT64 SEV_ES_INSTRUCTION_DATA *InstructionData ); =20 +// +// SEV-SNP Cpuid table entry/function +// +typedef PACKED struct { + UINT32 EaxIn; + UINT32 EcxIn; + UINT64 Unused; + UINT64 Unused2; + UINT32 Eax; + UINT32 Ebx; + UINT32 Ecx; + UINT32 Edx; + UINT64 Reserved; +} SEV_SNP_CPUID_FUNCTION; + +// +// SEV-SNP Cpuid page format +// +typedef PACKED struct { + UINT32 Count; + UINT32 Reserved1; + UINT64 Reserved2; + SEV_SNP_CPUID_FUNCTION function[0]; +} SEV_SNP_CPUID_INFO; + + /** Return a pointer to the contents of the specified register. =20 @@ -1496,58 +1523,415 @@ InvdExit ( } =20 /** - Handle a CPUID event. + Fetch CPUID leaf/function via hypervisor/VMGEXIT. =20 - Use the VMGEXIT instruction to handle a CPUID event. + @param[in, out] Ghcb Pointer to the Guest-Hypervisor Communicati= on + Block + @param[in] EaxIn EAX input for cpuid instruction + @param[in] EcxIn ECX input for cpuid instruction + @param[in] Xcr0In XCR0 at time of cpuid instruction + @param[in, out] Eax Pointer to store leaf's EAX value + @param[in, out] Ebx Pointer to store leaf's EBX value + @param[in, out] Ecx Pointer to store leaf's ECX value + @param[in, out] Edx Pointer to store leaf's EDX value + @param[in, out] Status Pointer to store status from VMGEXIT (alway= s 0 + unless return value indicates failure) + @param[in, out] Unsupported Pointer to store indication of unsupported + VMGEXIT (always false unless return value + indicates failure) =20 - @param[in, out] Ghcb Pointer to the Guest-Hypervisor Communi= cation - Block - @param[in, out] Regs x64 processor context - @param[in] InstructionData Instruction parsing context - - @retval 0 Event handled successfully - @return New exception value to propagate + @retval TRUE CPUID leaf fetch successfully. + @retval FALSE Error occurred while fetching CPUID leaf. C= allers + should Status and Unsupported and handle + accordingly if they indicate a more precise + error condition. =20 **/ STATIC -UINT64 -CpuidExit ( +BOOLEAN +GetCpuidHyp ( IN OUT GHCB *Ghcb, - IN OUT EFI_SYSTEM_CONTEXT_X64 *Regs, - IN SEV_ES_INSTRUCTION_DATA *InstructionData + IN UINT32 EaxIn, + IN UINT32 EcxIn, + IN UINT64 XCr0, + IN OUT UINT32 *Eax, + IN OUT UINT32 *Ebx, + IN OUT UINT32 *Ecx, + IN OUT UINT32 *Edx, + IN OUT UINT64 *Status, + IN OUT BOOLEAN *UnsupportedExit ) { - UINT64 Status; - - Ghcb->SaveArea.Rax =3D Regs->Rax; + *UnsupportedExit =3D FALSE; + Ghcb->SaveArea.Rax =3D EaxIn; VmgSetOffsetValid (Ghcb, GhcbRax); - Ghcb->SaveArea.Rcx =3D Regs->Rcx; + Ghcb->SaveArea.Rcx =3D EcxIn; VmgSetOffsetValid (Ghcb, GhcbRcx); - if (Regs->Rax =3D=3D CPUID_EXTENDED_STATE) { - IA32_CR4 Cr4; - - Cr4.UintN =3D AsmReadCr4 (); - Ghcb->SaveArea.XCr0 =3D (Cr4.Bits.OSXSAVE =3D=3D 1) ? AsmXGetBv (0) : = 1; + if (EaxIn =3D=3D CPUID_EXTENDED_STATE) { + Ghcb->SaveArea.XCr0 =3D XCr0; VmgSetOffsetValid (Ghcb, GhcbXCr0); } =20 - Status =3D VmgExit (Ghcb, SVM_EXIT_CPUID, 0, 0); - if (Status !=3D 0) { - return Status; + *Status =3D VmgExit (Ghcb, SVM_EXIT_CPUID, 0, 0); + if (*Status !=3D 0) { + return FALSE; } =20 if (!VmgIsOffsetValid (Ghcb, GhcbRax) || !VmgIsOffsetValid (Ghcb, GhcbRbx) || !VmgIsOffsetValid (Ghcb, GhcbRcx) || !VmgIsOffsetValid (Ghcb, GhcbRdx)) { - return UnsupportedExit (Ghcb, Regs, InstructionData); + *UnsupportedExit =3D TRUE; + return FALSE; } - Regs->Rax =3D Ghcb->SaveArea.Rax; - Regs->Rbx =3D Ghcb->SaveArea.Rbx; - Regs->Rcx =3D Ghcb->SaveArea.Rcx; - Regs->Rdx =3D Ghcb->SaveArea.Rdx; + + if (Eax) { + *Eax =3D Ghcb->SaveArea.Rax; + } + if (Ebx) { + *Ebx =3D Ghcb->SaveArea.Rbx; + } + if (Ecx) { + *Ecx =3D Ghcb->SaveArea.Rcx; + } + if (Edx) { + *Edx =3D Ghcb->SaveArea.Rdx; + } + + return TRUE; +} + +/** + Check if SEV-SNP enabled. + + @retval TRUE SEV-SNP is enabled. + @retval FALSE SEV-SNP is disabled. + +**/ +STATIC +BOOLEAN +SnpEnabled (VOID) +{ + MSR_SEV_STATUS_REGISTER Msr; + + Msr.Uint32 =3D AsmReadMsr32(MSR_SEV_STATUS); + + return !!Msr.Bits.SevSnpBit; +} + +/** + Calculate the total XSAVE area size for enabled XSAVE areas + + @param[in] XFeaturesEnabled Bit-mask of enabled XSAVE features/are= as as + indicated by XCR0/MSR_IA32_XSS bits + @param[in] XSaveBaseSize Base/legacy XSAVE area size (e.g. when + XCR0 is 1) + @param[in, out] XSaveSize Pointer to storage for calculated XSAV= E area + size + @param[in] Compacted Whether or not the calculation is for = the + normal XSAVE area size (leaf 0xD,0x0,E= BX) or + compacted XSAVE area size (leaf 0xD,0x= 1,EBX) + + + @retval TRUE XSAVE size calculation was successful. + @retval FALSE XSAVE size calculation was unsuccessfu= l. +**/ +STATIC +BOOLEAN +GetCpuidXSaveSize ( + IN UINT64 XFeaturesEnabled, + IN UINT32 XSaveBaseSize, + IN OUT UINT32 *XSaveSize, + IN BOOLEAN Compacted + ) +{ + SEV_SNP_CPUID_INFO *CpuidInfo; + UINT64 XFeaturesFound =3D 0; + UINT32 Idx; + + *XSaveSize =3D XSaveBaseSize; + CpuidInfo =3D (SEV_SNP_CPUID_INFO *)(UINT64)PcdGet32(PcdOvmfSnpCpuidBase= ); + + for (Idx =3D 0; Idx < CpuidInfo->Count; Idx++) { + SEV_SNP_CPUID_FUNCTION *CpuidFn =3D &CpuidInfo->function[Idx]; + + if (!(CpuidFn->EaxIn =3D=3D 0xD && + (CpuidFn->EcxIn =3D=3D 0 || CpuidFn->EcxIn =3D=3D 1))) { + continue; + } + + if (XFeaturesFound & (1UL << CpuidFn->EcxIn) || + !(XFeaturesEnabled & (1UL << CpuidFn->EcxIn))) { + continue; + } + + XFeaturesFound |=3D (1UL << CpuidFn->EcxIn); + if (Compacted) { + *XSaveSize +=3D CpuidFn->Eax; + } else { + *XSaveSize =3D MAX(*XSaveSize, CpuidFn->Eax + CpuidFn->Ebx); + } + } + + /* + * Either the guest set unsupported XCR0/XSS bits, or the corresponding + * entries in the CPUID table were not present. This is an invalid state. + */ + if (XFeaturesFound !=3D (XFeaturesEnabled & ~3UL)) { + return FALSE; + } + + return TRUE; +} + +/** + Check if a CPUID leaf/function is indexed via ECX sub-leaf/sub-function + + @param[in] EaxIn EAX input for cpuid instruction + + @retval FALSE cpuid leaf/function is not indexed by ECX i= nput + @retval TRUE cpuid leaf/function is indexed by ECX input + +**/ +STATIC +BOOLEAN +IsFunctionIndexed ( + IN UINT32 EaxIn + ) +{ + switch (EaxIn) { + case CPUID_CACHE_PARAMS: + case CPUID_STRUCTURED_EXTENDED_FEATURE_FLAGS: + case CPUID_EXTENDED_TOPOLOGY: + case CPUID_EXTENDED_STATE: + case CPUID_INTEL_RDT_MONITORING: + case CPUID_INTEL_RDT_ALLOCATION: + case CPUID_INTEL_SGX: + case CPUID_INTEL_PROCESSOR_TRACE: + case CPUID_DETERMINISTIC_ADDRESS_TRANSLATION_PARAMETERS: + case CPUID_V2_EXTENDED_TOPOLOGY: + case 0x8000001D: /* Cache Topology Information */ + return TRUE; + } + return FALSE; +} + +/** + Fetch CPUID leaf/function via SEV-SNP CPUID table. + + @param[in, out] Ghcb Pointer to the Guest-Hypervisor Communicati= on + Block + @param[in] EaxIn EAX input for cpuid instruction + @param[in] EcxIn ECX input for cpuid instruction + @param[in] Xcr0In XCR0 at time of cpuid instruction + @param[in, out] Eax Pointer to store leaf's EAX value + @param[in, out] Ebx Pointer to store leaf's EBX value + @param[in, out] Ecx Pointer to store leaf's ECX value + @param[in, out] Edx Pointer to store leaf's EDX value + @param[in, out] Status Pointer to store status from VMGEXIT (alway= s 0 + unless return value indicates failure) + @param[in, out] Unsupported Pointer to store indication of unsupported + VMGEXIT (always false unless return value + indicates failure) + + @retval TRUE CPUID leaf fetch successfully. + @retval FALSE Error occurred while fetching CPUID leaf. C= allers + should Status and Unsupported and handle + accordingly if they indicate a more precise + error condition. + +**/ +STATIC +BOOLEAN +GetCpuidFw ( + IN OUT GHCB *Ghcb, + IN UINT32 EaxIn, + IN UINT32 EcxIn, + IN UINT64 XCr0, + IN OUT UINT32 *Eax, + IN OUT UINT32 *Ebx, + IN OUT UINT32 *Ecx, + IN OUT UINT32 *Edx, + IN OUT UINT64 *Status, + IN OUT BOOLEAN *Unsupported + ) +{ + SEV_SNP_CPUID_INFO *CpuidInfo; + BOOLEAN Found; + UINT32 Idx; + + CpuidInfo =3D (SEV_SNP_CPUID_INFO *)(UINT64)PcdGet32(PcdOvmfSnpCpuidBase= ); + Found =3D FALSE; + + for (Idx =3D 0; Idx < CpuidInfo->Count; Idx++) { + SEV_SNP_CPUID_FUNCTION *CpuidFn =3D &CpuidInfo->function[Idx]; + + if (CpuidFn->EaxIn !=3D EaxIn) { + continue; + } + + if (IsFunctionIndexed(CpuidFn->EaxIn) && CpuidFn->EcxIn !=3D EcxIn) { + continue; + } + + *Eax =3D CpuidFn->Eax; + *Ebx =3D CpuidFn->Ebx; + *Ecx =3D CpuidFn->Ecx; + *Edx =3D CpuidFn->Edx; + + Found =3D TRUE; + break; + } + + if (!Found) { + *Eax =3D *Ebx =3D *Ecx =3D *Edx =3D 0; + goto Out; + } + + if (EaxIn =3D=3D CPUID_VERSION_INFO) { + IA32_CR4 Cr4; + UINT32 Ebx2; + UINT32 Edx2; + + if (!GetCpuidHyp (Ghcb, EaxIn, EcxIn, XCr0, NULL, &Ebx2, NULL, &Edx2, + Status, Unsupported)) { + return FALSE; + } + + /* initial APIC ID */ + *Ebx =3D (*Ebx & 0x00FFFFFF) | (Ebx2 & 0xFF000000); + /* APIC enabled bit */ + *Edx =3D (*Edx & ~BIT9) | (Edx2 & BIT9); + /* OSXSAVE enabled bit */ + Cr4.UintN =3D AsmReadCr4 (); + *Ecx =3D (Cr4.Bits.OSXSAVE) ? (*Ecx & ~BIT27) | (*Ecx & BIT27) + : (*Ecx & ~BIT27); + } else if (EaxIn =3D=3D CPUID_STRUCTURED_EXTENDED_FEATURE_FLAGS) { + IA32_CR4 Cr4; + + Cr4.UintN =3D AsmReadCr4 (); + /* OSPKE enabled bit */ + *Ecx =3D (Cr4.Bits.PKE) ? (*Ecx | BIT4) : (*Ecx & ~BIT4); + } else if (EaxIn =3D=3D CPUID_EXTENDED_TOPOLOGY) { + if (!GetCpuidHyp (Ghcb, EaxIn, EcxIn, XCr0, NULL, NULL, NULL, Edx, + Status, Unsupported)) { + return FALSE; + } + } else if (EaxIn =3D=3D CPUID_EXTENDED_STATE && (EcxIn =3D=3D 0 || EcxIn= =3D=3D 1)) { + MSR_IA32_XSS_REGISTER XssMsr; + BOOLEAN Compacted; + UINT32 XSaveSize; + + XssMsr.Uint64 =3D 0; + if (EcxIn =3D=3D 1) { + /* + * The PPR and APM aren't clear on what size should be encoded in + * 0xD:0x1:EBX when compaction is not enabled by either XSAVEC or + * XSAVES, as these are generally fixed to 1 on real CPUs. Report + * this undefined case as an error. + */ + if (!(*Eax & (BIT3 | BIT1))) { /* (XSAVES | XSAVEC) */ + return FALSE; + } + + Compacted =3D TRUE; + XssMsr.Uint64 =3D AsmReadMsr64 (MSR_IA32_XSS); + } + + if (!GetCpuidXSaveSize (XCr0 | XssMsr.Uint64, *Ebx, &XSaveSize, + Compacted)) { + return FALSE; + } + + *Ebx =3D XSaveSize; + } else if (EaxIn =3D=3D 0x8000001E) { + UINT32 Ebx2; + UINT32 Ecx2; + + /* extended APIC ID */ + if (!GetCpuidHyp (Ghcb, EaxIn, EcxIn, XCr0, Eax, &Ebx2, &Ecx2, NULL, + Status, Unsupported)) { + return FALSE; + } + /* compute ID */ + *Ebx =3D (*Ebx & 0xFFFFFF00) | (Ebx2 & 0x000000FF); + /* node ID */ + *Ecx =3D (*Ecx & 0xFFFFFF00) | (Ecx2 & 0x000000FF); + } + +Out: + *Status =3D 0; + *Unsupported =3D FALSE; + return TRUE; +} + +/** + Handle a CPUID event. + + Use VMGEXIT instruction or CPUID table to handle a CPUID event. + + @param[in, out] Ghcb Pointer to the Guest-Hypervisor Communi= cation + Block + @param[in, out] Regs x64 processor context + @param[in] InstructionData Instruction parsing context + + @retval 0 Event handled successfully + @return New exception value to propagate + +**/ +STATIC +UINT64 +CpuidExit ( + IN OUT GHCB *Ghcb, + IN OUT EFI_SYSTEM_CONTEXT_X64 *Regs, + IN SEV_ES_INSTRUCTION_DATA *InstructionData + ) +{ + BOOLEAN Unsupported; + UINT64 Status; + UINT32 EaxIn; + UINT32 EcxIn; + UINT64 XCr0; + UINT32 Eax; + UINT32 Ebx; + UINT32 Ecx; + UINT32 Edx; + + EaxIn =3D Regs->Rax; + EcxIn =3D Regs->Rcx; + + if (EaxIn =3D=3D CPUID_EXTENDED_STATE) { + IA32_CR4 Cr4; + + Cr4.UintN =3D AsmReadCr4 (); + XCr0 =3D (Cr4.Bits.OSXSAVE =3D=3D 1) ? AsmXGetBv (0) : 1; + } + + if (SnpEnabled ()) { + if (!GetCpuidFw (Ghcb, EaxIn, EcxIn, XCr0, &Eax, &Ebx, &Ecx, &Edx, + &Status, &Unsupported)) { + goto CpuidFail; + } + } else { + if (!GetCpuidHyp (Ghcb, EaxIn, EcxIn, XCr0, &Eax, &Ebx, &Ecx, &Edx, + &Status, &Unsupported)) { + goto CpuidFail; + } + } + + Regs->Rax =3D Eax; + Regs->Rbx =3D Ebx; + Regs->Rcx =3D Ecx; + Regs->Rdx =3D Edx; =20 return 0; + +CpuidFail: + if (Unsupported) { + return UnsupportedExit (Ghcb, Regs, InstructionData); + } + + return Status; } =20 /** --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80088): https://edk2.groups.io/g/devel/message/80088 Mute This Topic: https://groups.io/mt/85306669/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80089+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80089+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513070987932.8123346986843; Wed, 1 Sep 2021 09:17:50 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id APLrYY1788612x9LZXxdi2IP; Wed, 01 Sep 2021 09:17:50 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:50 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=b38Qp7Uvy0QlvvZUERAj20KL/3PnztczE9wSC035FRTar9mHq5uOsuoyIy/9FjYTyWDE7eYIWBypQPZ9TiHDErwIlln6r9ZDVw/YwLGFNdTjSS5uK31nB/UH25bLVt5Y3qADn4Qf3ILzImiDH/lwhoKpM7KPme7tWkfh7IeSq2HlnNj94eoVSakAl5whwwdxNzKz4XxAlc6NkMuQiWVrzpFb5Y4V8JpO3sbYk/YIsOGGi0O8gyAohXa8mP4yr9HUy2DZ0X5iPzu7Rb8CkitG4yyQt9qpCjnkZUjngb4LUXPXCq/ZTaPlETLsf10wPeYR0XGbh7Rye6GUQdgZ8u3gBQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=VP5cvLMmaWE4UfhsfQLIakbLAemleNRF2jPTdqSM2MM=; b=UCvrGOSHUAjcFdJE9IEhXIkkXIEFoDcGrw6mfztE/E0swl1a1P4RSycXsHuCTmWD23zzrByv/fYpnlfpLGbEPvqbCuORVz/vAEnOMKCRB4pIMk5Fzl1NKPe1eDc6tBKTLXx6kNVf03ow8YN6jbyfQfzCelbs8GaUyOOXoyh103TWq7pdmwc8hcKOIfv8kcI1UsZFtCORlYXTfgdz5/zmE8nNEauUG7a9Nh+VjKYwKO454zUCqIfuL4v/4TtTo2pbi1fTrdVwdUJ0yy6rTUqzsRG1H01vTO8lCQJnA29hmAZR/5VZtzp1Ce84Hw52dLWD5GDhRPTmd51wJKF3Y1JFmg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:44 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:44 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 13/29] OvmfPkg/PlatformPei: register GHCB gpa for the SEV-SNP guest Date: Wed, 1 Sep 2021 11:16:30 -0500 Message-ID: <20210901161646.24763-14-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:44 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 5029d713-2d9d-4ed5-bd93-08d96d6407ca X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: HUKF1JJoF824OOJCfxM/v9AyQaJl7Ji6LgNAd95cZyEKT3v8al5TBsdnjSKUVQ4m/zNzEeCuPc9WkSCJjJdEnpCp76E9iVf4k68lbJtkRU1MJmSPwnDen5DzhkJFjcN3L9qFI8KNR9hn7nKVi71p2xv1uFF5/Xr6ZXwLsMwIANADFy6ykoZRebV8ZwBKUTQo3PEbbxRmVcwO7pmyC6Ab51HpeCsd/AvtAuUjxFdVx/JOBNZv4wyUoWqR2uBh4CXVndBL5Ho08YMWBA9tgeWgDgCfgeRDM0qVbnXzkd4uZojBFhf7G3O3IqB3cew1A0LUCVm3jia4oBqGG1kQnCAwg1Tr/ZgDSpQIbcsPwr2tVrpnDTq7AwERmZHfpScmAmbX6u5eDXclBTjIKzZ3vCnBYTgw6aKQ0UM5lbx9cKDsLP38uX3Yo+C7GYEc3m+9wSV8MU9h2LvMNp7nB/3NgAsARfVKmAkAQkw3CVXbwLs6I9NeMZtlvurjOPPDc5TzT5IQJ4jw9/1GF92blg6EzKUjTyULbS6Zr4W+idmR41T5T4kUrMdrbUeQ8IsWV3XhVi4KKoEiFGPeaQq3VHI177aI8pSuiz+5DPPFQeNMwf0vjT57jBX04Omfg/5z7SKvpJMZMpQRJOaGrV7KBp6ULq65kxl/p1mRajMRMVrI0dUbUZq0kqJaP3ZhlF+fj8VyHK9oNWEjCSYTGxFJ+qcbvFcUT20xJQu8nSFfsK4cWuaa68uTn0Kmzvfp6ngHdX/iQZjO/0xreI5kHwxOIcYrwQphMmb5rQrimTQsppguMUu/pKA= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?TXq2DzVegvE3ZboyPT52JIRfeMgg2nRgXdlupew2oKk1+IuruOxJ9GJGN8ZL?= =?us-ascii?Q?04FYv6QPS/RM5NulCMSWKSvKCzDpT3K07uJl13ANcASDpECf74chdMufLtzY?= =?us-ascii?Q?+6198Bx/OsVYMltJHUiPOfIfQ1t26zIfP7DZ9CQKovNTJFbZKfA4QmZP23iq?= =?us-ascii?Q?3rX22yZnOqVS5ypmc/ZLsr6VaCgOkgPH8kKFLGAQ+bF7dYXlD4oeQ0p0O+Rf?= =?us-ascii?Q?4X1ydjeHrGqQPpwfMBxfWDNqn4txr7VSHlC53h4A1z5YR3dWBvJ47usQSLvL?= =?us-ascii?Q?rW25a5RtLHyDD/hD1wxoR9DZKsfvOgJDpu+T8BsESV8MfeEwEflcvy0MzX+R?= =?us-ascii?Q?5hxfTtAna5iQU5qWqRhwmPyggdoZev7k9lTg5Ww3XMfqhKdJ9xAk0M2ri9iy?= =?us-ascii?Q?dyvZMSmBEkRVPWegU3+HCEmln244CdWGdqLB+fWYmBLnkPrIAo5ImwU6fdhH?= =?us-ascii?Q?zESPpgiD8XzqaEAgsPUDb+S0T3NtuQFJZ0CI8evORP/4I9m0a1x2YRogYVCU?= =?us-ascii?Q?kYLevmm77FvdrbbdTSDhlQiJbwjYk1szTf0Xi7kA0p/ggrECGnrA4MpPosn3?= =?us-ascii?Q?IzBAXlKUpw7WWFZv7UDvL+LZj3KexX7T28QG+Ad0T3AK8hqdGm8YtJrvo3BO?= =?us-ascii?Q?c5eHpbb2hhdhE12BEnpllBMXn8BwLPHiLHiDwIwg8AIT+4M6eYRVo3YPpqzJ?= =?us-ascii?Q?gKi2K8PBX5/FDHeKf3lugQ2TjAmCxJmk/qG1lbe2+d7D0wbPaaFotIvvtEF5?= =?us-ascii?Q?bXDk4DkTO30O9b/SQITtb/8B3UsSeVcqp+OAblDXIuNSWT9uh1lMLHI2D+4h?= =?us-ascii?Q?qCWtLjQwOUofOFAxxgNXc/E1NsZ+ISvKnrrkWRa7ao1YEk7SliFn8tzl08LB?= =?us-ascii?Q?zVPzl24/ZOeU0B2oWmKi5353Y7JdiQF27yQO5xbaoVDzWtTU22VgcTqWQ+75?= =?us-ascii?Q?x3F1S76w19VCjhN38/5lVtCiJLOgZWMvCsIDp45YX94QwliJIil7VuEE5sQj?= =?us-ascii?Q?bM00X9Dt/b/KzCvblLE3e+DN71hqQIg26fY74g3WOjSiZUbajN/nT77QCs0D?= =?us-ascii?Q?aFKpqD0lYMf4JwvFjxPt54IuKs0FZpL4XB5y5vF63EG9+0dzLPKl9SjdDeLv?= =?us-ascii?Q?uLZdumH7xIhoWQi47zR3DMugHKe+lOFKNE4mwcdnC5db0xhRd3/C0y6K1Fmy?= =?us-ascii?Q?2DKz9UoRQzoxeU7+0rhIB5OA9o40GqAhw1nBRZLfbeaeYi38bzh6MnlztlaT?= =?us-ascii?Q?6fGfPusUpkXTHV8YzPOunNE4A5LL8rA3CUQlKAqw1tkGLb+iVdojbjrlCwwP?= =?us-ascii?Q?HsWXi1gu8QR6Zwkj4dXovOxb?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5029d713-2d9d-4ed5-bd93-08d96d6407ca X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:44.6039 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: tT81gh5eU6aoBBUyWdzYntGLDGj7CdA+h8Ym43s1tPciKZuuyG6xaVlO49hKdLsexxh0JT9NKBePShmEMER+Uw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: ajvLAMd46Slr3MdnRUpCLvoax1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513070; bh=DfovQFc0kCA+H3oTWwnSf+lp94q87iPS7LTVcTcPkvc=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=M6E+UXRkDXL06zbgQwQSqfe8+/1CtM4w7Ai3mWjanMv08w0mpSSShM63w5oPI1+pMQS DyNAbClFWSt16bSiFFPER2174bNmfKilKsymZ6FEGBu0UOjKSfFj3h4YMFiHuOgJiXu20 iuIZGf13B4p70MhRDgHa0b8ZGis1VXP9zsw= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513072928100014 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 The SEV-SNP guest requires that GHCB GPA must be registered before using. See the GHCB specification section 2.3.2 for more details. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/PlatformPei/AmdSev.c | 91 ++++++++++++++++++++++++++++++++++++ 1 file changed, 91 insertions(+) diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c index a8bf610022ba..de876fdb478e 100644 --- a/OvmfPkg/PlatformPei/AmdSev.c +++ b/OvmfPkg/PlatformPei/AmdSev.c @@ -19,9 +19,93 @@ #include #include #include +#include =20 #include "Platform.h" =20 +/** + Handle an SEV-SNP/GHCB protocol check failure. + + Notify the hypervisor using the VMGEXIT instruction that the SEV-SNP gue= st + wishes to be terminated. + + @param[in] ReasonCode Reason code to provide to the hypervisor for the + termination request. + +**/ +STATIC +VOID +SevEsProtocolFailure ( + IN UINT8 ReasonCode + ) +{ + MSR_SEV_ES_GHCB_REGISTER Msr; + + // + // Use the GHCB MSR Protocol to request termination by the hypervisor + // + Msr.GhcbPhysicalAddress =3D 0; + Msr.GhcbTerminate.Function =3D GHCB_INFO_TERMINATE_REQUEST; + Msr.GhcbTerminate.ReasonCodeSet =3D GHCB_TERMINATE_GHCB; + Msr.GhcbTerminate.ReasonCode =3D ReasonCode; + AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress); + + AsmVmgExit (); + + ASSERT (FALSE); + CpuDeadLoop (); +} + +/** + + This function can be used to register the GHCB GPA. + + @param[in] Address The physical address to be registered. + +**/ +STATIC +VOID +GhcbRegister ( + IN EFI_PHYSICAL_ADDRESS Address + ) +{ + MSR_SEV_ES_GHCB_REGISTER Msr; + MSR_SEV_ES_GHCB_REGISTER CurrentMsr; + EFI_PHYSICAL_ADDRESS GuestFrameNumber; + + GuestFrameNumber =3D Address >> EFI_PAGE_SHIFT; + + // + // Save the current MSR Value + // + CurrentMsr.GhcbPhysicalAddress =3D AsmReadMsr64 (MSR_SEV_ES_GHCB); + + // + // Use the GHCB MSR Protocol to request to register the GPA. + // + Msr.GhcbPhysicalAddress =3D 0; + Msr.GhcbGpaRegister.Function =3D GHCB_INFO_GHCB_GPA_REGISTER_REQUEST; + Msr.GhcbGpaRegister.GuestFrameNumber =3D GuestFrameNumber; + AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress); + + AsmVmgExit (); + + Msr.GhcbPhysicalAddress =3D AsmReadMsr64 (MSR_SEV_ES_GHCB); + + // + // If hypervisor responded with a different GPA than requested then fail. + // + if ((Msr.GhcbGpaRegister.Function !=3D GHCB_INFO_GHCB_GPA_REGISTER_RESPO= NSE) || + (Msr.GhcbGpaRegister.GuestFrameNumber !=3D GuestFrameNumber)) { + SevEsProtocolFailure (GHCB_TERMINATE_GHCB_GENERAL); + } + + // + // Restore the MSR + // + AsmWriteMsr64 (MSR_SEV_ES_GHCB, CurrentMsr.GhcbPhysicalAddress); +} + /** =20 Initialize SEV-ES support if running as an SEV-ES guest. @@ -109,6 +193,13 @@ AmdSevEsInitialize ( "SEV-ES is enabled, %lu GHCB backup pages allocated starting at 0x%p\n= ", (UINT64)GhcbBackupPageCount, GhcbBackupBase)); =20 + // + // SEV-SNP guest requires that GHCB GPA must be registered before using = it. + // + if (MemEncryptSevSnpIsEnabled ()) { + GhcbRegister (GhcbBasePa); + } + AsmWriteMsr64 (MSR_SEV_ES_GHCB, GhcbBasePa); =20 // --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80089): https://edk2.groups.io/g/devel/message/80089 Mute This Topic: https://groups.io/mt/85306670/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80090+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80090+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513071493632.352720784608; Wed, 1 Sep 2021 09:17:51 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id gLwqYY1788612xhwYfhDTpJt; Wed, 01 Sep 2021 09:17:51 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:50 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZoiluRxs3TJKpCNQhk8VujrwHdMuYqRTuGff6YngRaRiecqxyTiq3T0s7WYdBCvM2KDmmkiiO/U3ZcI6be5wqoTYNpzxFAmZnoNTw+592ie+r7txnG/eqVwcJFG0HMCIyf1Kgw82PJQT8zq7AR/oTzT+iXhMGB+ofQqof0+9s7Zp3SIvhhT5gAGJ7M/h9Wnd36MV3NROLqn6HzugG+wzunH0doarwStZv7fLB0OvbWaRXhJ6537iOv4HBZz2KKK95PI4uf7Jftwvujp4iA8BOiSAmMlQsHgpGWmGkHWPLwDsOrSFbPIHKCw2/6bjTAF/YMWC9xomCrhiYXyrbJkxCw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=uNNQ1zdLZAZq7eRXHcLHUI0iXyIX3VjYX3n8lV1RdbU=; b=jpCigKg8OHOaKBi6KJ6eP1BNflyYMvvlcLNgYOHtkEQl/VMVqdyRhFSGvXzfx5JDuiS1YrNsHMMEfq1pONQKGGO77LI+N3pK87w3AqHEsdxEIcVcTyjhPH5yij/J1as4mUYm1Cxbj5eHfz3HAwclDD+5IDtrHQEKgrHZrU3i919wKlFmjsG3Uz4neqtMPA8IHG6mGgSHyvBaHtF4oijwPvkzxbh5XrmbAu66dyGLpKkqJe24/65LJEGu7yNf9JcNlgGP/DR6SXuacrwnkCG9MUPk0NRqzVd4t0TO96Fu2AFhOd7fExW/0X3b/RZQBl7zvP4iSUdltx+ksaBUAXH0Ug== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:45 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:45 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 14/29] OvmfPkg/AmdSevDxe: do not use extended PCI config space Date: Wed, 1 Sep 2021 11:16:31 -0500 Message-ID: <20210901161646.24763-15-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:44 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: c539649d-cddb-4b01-7741-08d96d640852 X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:773; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: 029ahu1AIx6IOv6lf6XMrxu/6leTFXUBHEyBXYqdW1Qxb9u6e/pYUjuJz7ktXEBfwKhX+0Hf2Luu3LrbxXJjAASVNJK+sgtA6VoPYU3ib6GrA8fqBDeL0KOePf23uZ830lSh2bDmoztu+zOi2rFP9d9Mn6YaQveBwvzePjpA7wZHjsdXwXOIoP3Q1wHnFUAR7sruFrV7ace56AX4cHarOixvyLnXIkxb2z5x8AJ8WjnfMtUgg2ilrg1bvayDE80JhME9PPP6LVhLI4JxsOPHbmmN7E4KVb30JwVXQIy7gQB9FAO8Hmc9W8Jw4RXpZifODJVTKfzjhk/Y916MwbRf+dODjW98cDiOno3Bc+ifSoR8IxZGlqtTYHU1nUTuLECtrQbbKday9m1bst+FI1Tl8T+ZiZNenDUuvlzyGeHAM7+diDbvBU/nIfT4VnyFNZrVxt7wH+VqnHqjKSYv141yGoEsDucolAYrGdwG11vbIpcDiPzr43e+RBCuyVq1w6Pb842D8LQQWgORxxz0l4Dmiu9F7pIDl46UcPgjqYK0h+1iElnD1gxLyur9jGq3zs1Pq0Hjd9jY6DbSIcXSPTleQNEYEOoryD4WbHP40NDtdqwpa0fsQ9evadglLs/oObDU1ZV3ZcN58TSDOC5eubb+JdriTQpXWzP8omiByJG5t/UkbED37AfWnBr8LHMzHHOSunOdKCRwHGj19xshgu82ue/fGvTrV8z72komHkceRvG7zJ3tc/gNqfIGPEpUqWyEz14gz2y/uvrYY6SdqYtAu5LQW6tqAdg37UBCnPr/5mk= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?ErMdZviD9BfSzbGHZFIW7DDKh31Gf1OLIa9QeFbXs40LH3VGrXly3yqggMYQ?= =?us-ascii?Q?Y1tQPc93JciW0+7frXINDbqYTWsLu+Iv2EU2AtlITlAuE3Unl5Kw6k43xkH0?= =?us-ascii?Q?cElyGuwdGY+wuf0w1HJXGYwRW+ZVs4GFAtZwLx7vhGpN0AanPZBqeBnrQUuZ?= =?us-ascii?Q?sVGmnAE9iNplsWLWa5dZnKjZDrXOJmExmCn1tKC/MkgyZUpgtjdTKOceD7nH?= =?us-ascii?Q?nuSxqhdgNxve9AHXbpOboGuJEQQHuOtVHJQ5oppbHSXW9csTeo1zTieR7Rkp?= =?us-ascii?Q?D8L+aI+nnA9P68moazH1WZZGCXpZJViPpiKv6U+FxJF1d85ogSXZh8hoE7nS?= =?us-ascii?Q?Hp1ImbTwdjCwejqTthWV/h3gyW6rV2i7WieA/0OOLo5r7Cye57hMgbBVKhT7?= =?us-ascii?Q?B256Ak4g1PudYTz+sgLQyc/zpzdeJwTDqNl/0DA7lfKugwigos2JVgs3FbUC?= =?us-ascii?Q?2rpO+aWGFt6yHE1kPjz6xGTzJon6OaHVuIxaRA0wLIHHzGZGL9pvA4B/nd8q?= =?us-ascii?Q?4NqLxKON48e7nGxriXYErYXPgqzlrCNj8denBacQzLP16mWyc6Mxw2lWX9S2?= =?us-ascii?Q?Lpabpr8SbUwFx6FV+cjKTO9ETbQ0AOYk+3ZAnhxbcvx39cx2rStYeefOGAIU?= =?us-ascii?Q?WfpZiiOrwNSqIzNJHu8v+yQQP60cmR0lRcyRfdckPYgKeGAYArFGqMWXY5oa?= =?us-ascii?Q?YDT7D6zlA9S98Ave2pegOp3+Byf5MLap5qlPytTPer01/sltlA0pveDLhFVr?= =?us-ascii?Q?UkdIerdgiXUTr9tOuz6iwsIPWT7A062fG3HDyqT+HweBa2S2wjoWzSSVKrOF?= =?us-ascii?Q?hzavyTLNJEHNvMIDjBjZDIhDedUfdsmRYBULVvclebDxsUCRpGJMrVppYSWa?= =?us-ascii?Q?SQpLwczZrOhrIq3cJpL3bAlCpYZPvUHy/UiO0V3TBZQTUk/rjIFAoRebj0fS?= =?us-ascii?Q?Nq9f6Lu0kJtv0reRD4HzdZCQAWq9mxPjS3ft19+TghM9UBzNAj7B8CisqcMp?= =?us-ascii?Q?bT7atshkfsPpm+QN3L2cpwbwJwRM11vzwm2vdd2itz2ydWdaHze9ix710czQ?= =?us-ascii?Q?pbv+6Yi9mhFID6Ll/pXyG1G03A5c68mdFBgkLrYuC2C/Qtuf4K/n5GwwBQUv?= =?us-ascii?Q?RJ2ptSuajuEfnLjwyhMsw6tvF33pQ97Z0Fz4JZBcGxon4Q4Q9cAHzn9Yc48i?= =?us-ascii?Q?MvW7SGk+9dqfRuKe8C6ykHOBk9CGQfqjGtqGCwKSlle+MA8jEL0JEaOMTkwI?= =?us-ascii?Q?qr4Rkg95SogVX3GOOxIj1TtKkGL9ubrQC4hu9tw0+ZXLAfUoAk9GtBa/aE0E?= =?us-ascii?Q?dMClXGoMA5v3V5cjNYc7zU1k?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: c539649d-cddb-4b01-7741-08d96d640852 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:45.4904 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: gliWi+QwdOcNDVGnNf2kqgF0OmnmiDvagpSLOWhUwumXlWrErbL3vdOyogeE34LUV+uCiPTerj9PSgApU3rcoA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: fEamAzk5DNfyCF34u5b0JWv2x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513071; bh=dw5Wv2Uadyyuw0X98O2g7rdgTtMDfVlYwg6ZPtkfjDk=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=fqYWAjd38FdP4uBckelAItuioGcjf35LDXQX+Pb25YI0CxHj6kCeLdjj7CSvP2VJgGV d5EZ3kw5rbEVMSPO341eCudDngbRk3uR9zCjmJg7bsyWfiunTVOCrFkClWM66gHSOTZht cQltuGRpdc0BS5uPM291kWj5PAGiG7tP/bY= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513073052100016 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 Commit 85b8eac59b8c5bd9c7eb9afdb64357ce1aa2e803 added support to ensure that MMIO is only performed against the un-encrypted memory. If MMIO is performed against encrypted memory, a #GP is raised. The AmdSevDxe uses the functions provided by the MemEncryptSevLib to clear the memory encryption mask from the page table. If the MemEncryptSevLib is extended to include VmgExitLib then depedency chain will look like this: OvmfPkg/AmdSevDxe/AmdSevDxe.inf Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao Suggested-by: Laszlo Ersek -----> MemEncryptSevLib class -----> "OvmfPkg/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf" instance -----> VmgExitLib class -----> "OvmfPkg/VmgExitLib" instance -----> LocalApicLib class -----> "UefiCpuPkg/BaseXApicX2ApicLib/BaseXApicX2ApicLib.inf" instance -----> TimerLib class -----> "OvmfPkg/AcpiTimerLib/DxeAcpiTimerLib.inf" instance -----> PciLib class -----> "OvmfPkg/DxePciLibI440FxQ35/DxePciLibI440FxQ35.inf" instance -----> PciExpressLib class -----> "MdePkg/BasePciExpressLib/BasePciExpressLib.inf" instance The LocalApicLib provides a constructor that gets called before the AmdSevDxe can clear the memory encryption mask from the MMIO regions. When running under the Q35 machine type, the call chain looks like this: AcpiTimerLibConstructor () [AcpiTimerLib] PciRead32 () [DxePciLibI440FxQ35] PciExpressRead32 () [PciExpressLib] The PciExpressRead32 () reads the MMIO region. The MMIO regions are not yet mapped un-encrypted, so the check introduced in the commit 85b8eac59b8c5bd9c7eb9afdb64357ce1aa2e803 raises a #GP. The AmdSevDxe driver does not require the access to the extended PCI config space. Accessing a normal PCI config space, via IO port should be sufficent. Use the module-scope override to make the AmdSevDxe use the BasePciLib instead of BasePciExpressLib so that PciRead32 () uses the IO ports instead of the extended config space. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Suggested-by: Laszlo Ersek Signed-off-by: Brijesh Singh --- OvmfPkg/AmdSev/AmdSevX64.dsc | 5 ++++- OvmfPkg/Bhyve/BhyveX64.dsc | 5 ++++- OvmfPkg/OvmfPkgIa32X64.dsc | 5 ++++- OvmfPkg/OvmfPkgX64.dsc | 5 ++++- OvmfPkg/OvmfXen.dsc | 5 ++++- 5 files changed, 20 insertions(+), 5 deletions(-) diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc index e6cd10b75922..a8ea08a10a99 100644 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc @@ -812,7 +812,10 @@ [Components] !endif =20 OvmfPkg/PlatformDxe/Platform.inf - OvmfPkg/AmdSevDxe/AmdSevDxe.inf + OvmfPkg/AmdSevDxe/AmdSevDxe.inf { + + PciLib|MdePkg/Library/BasePciLibCf8/BasePciLibCf8.inf + } OvmfPkg/IoMmuDxe/IoMmuDxe.inf =20 # diff --git a/OvmfPkg/Bhyve/BhyveX64.dsc b/OvmfPkg/Bhyve/BhyveX64.dsc index d8fe607d1cf7..f45634996247 100644 --- a/OvmfPkg/Bhyve/BhyveX64.dsc +++ b/OvmfPkg/Bhyve/BhyveX64.dsc @@ -790,7 +790,10 @@ [Components] !endif =20 OvmfPkg/PlatformDxe/Platform.inf - OvmfPkg/AmdSevDxe/AmdSevDxe.inf + OvmfPkg/AmdSevDxe/AmdSevDxe.inf { + + PciLib|MdePkg/Library/BasePciLibCf8/BasePciLibCf8.inf + } OvmfPkg/IoMmuDxe/IoMmuDxe.inf =20 =20 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index a467ab7090fb..f42abc041c0c 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -965,7 +965,10 @@ [Components.X64] !endif =20 OvmfPkg/PlatformDxe/Platform.inf - OvmfPkg/AmdSevDxe/AmdSevDxe.inf + OvmfPkg/AmdSevDxe/AmdSevDxe.inf { + + PciLib|MdePkg/Library/BasePciLibCf8/BasePciLibCf8.inf + } OvmfPkg/IoMmuDxe/IoMmuDxe.inf =20 !if $(SMM_REQUIRE) =3D=3D TRUE diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index e56b83d95e09..19cc5d4122e2 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -963,7 +963,10 @@ [Components] !endif =20 OvmfPkg/PlatformDxe/Platform.inf - OvmfPkg/AmdSevDxe/AmdSevDxe.inf + OvmfPkg/AmdSevDxe/AmdSevDxe.inf { + + PciLib|MdePkg/Library/BasePciLibCf8/BasePciLibCf8.inf + } OvmfPkg/IoMmuDxe/IoMmuDxe.inf =20 !if $(SMM_REQUIRE) =3D=3D TRUE diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc index 1a9c06c164a8..5ac12a36b981 100644 --- a/OvmfPkg/OvmfXen.dsc +++ b/OvmfPkg/OvmfXen.dsc @@ -726,7 +726,10 @@ [Components] } =20 OvmfPkg/PlatformDxe/Platform.inf - OvmfPkg/AmdSevDxe/AmdSevDxe.inf + OvmfPkg/AmdSevDxe/AmdSevDxe.inf { + + PciLib|MdePkg/Library/BasePciLibCf8/BasePciLibCf8.inf + } OvmfPkg/IoMmuDxe/IoMmuDxe.inf =20 # --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80090): https://edk2.groups.io/g/devel/message/80090 Mute This Topic: https://groups.io/mt/85306671/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80094+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80094+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 163051307382426.264046897920025; Wed, 1 Sep 2021 09:17:53 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id kSLCYY1788612xWP3OKr3DyX; Wed, 01 Sep 2021 09:17:53 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:51 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=c5Jt34MhH9v4XIoGhs1bDYh8jJ6DeMnRgz/Tc/2tRe0rmCOzjfmjeE1KGJD2xCx0fwoHNdVz/VOiYZqReYRasd7lLYH+U6WDn3qzWVXIlIEPzFT/tRLqdjhnzG7YmUzdNCun8jXqm78sTX2jUGwBgpqdNKZSM5c3LDV17FmevCrUJFCnb7MUC3AoM++OH4ftF6m9MGPsfyX2eRm4nmgJoahUtSkQuFyuKdPgsjrwlH6snN9LswxogH4qf60O44bvx0Tef/jp8S5h9fU+i0SJgSyRbUxiusn0waflaRCCz8BmKNS+fnusENbnKaiYGMFANNYvLBjyuMQB6TQvQlBSnQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=lDuYDFBgdXrBUYlMv4GsngpEqnZwo8MaJKFG+IAcNeU=; b=VrKofZ8HlIbgh9F0+Q6ql36ajWwng7rkqZcqkIpmKUng+j+GzxLTL/QyfTMDbhY4n5dNgyqbgbP4/PAgqtcQhTma9O5dPkSDFkFFLlIk+1U5jLF6xuUIDbiUuUthWlRMSgnexkDSiu9fNr4sp8IXK7qA+yJOLzTYKcfszpwO1DD2mBTh7kVK9W39BNwAY+iGPktpBfjfgZZst0daIM9jtn68rQwEfO7pkhPdBHVmMxctL/tT8Wt7MGOOQQX+DbkK2KZqMXfAKD8+DrSncuLkbZKHr7RWo3CJGy7+GN4oRxldsBBkib3pPOl6b02MoB4ujt7WiLjPil4jbV1iZjO5Ug== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:47 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:46 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 15/29] OvmfPkg/MemEncryptSevLib: add support to validate system RAM Date: Wed, 1 Sep 2021 11:16:32 -0500 Message-ID: <20210901161646.24763-16-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:45 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: cd73158a-7141-4cc9-a37a-08d96d6408c1 X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8273; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: OOHkjDnko32nh7GA16ZLOnqStGoxvnF1+gz1Ac0ZybfotJqqq7kQDLfG2vNY2hWkRwb7BhQBO/mT4ad9ueqcWy8ChStN6wtQDuc9E8cEpir2dRprxQ8UOG9UL01Hm5vVnyCvuYbziHrD5i54+fMhEMQ2BOwOiL8w9mn5dySoMVzo3iUCgoHcvmXyw3TJvMnemcZfEqF2rSTX+CbjUgInlOhL055FHtNYfIjly6EtbvhIs7Km7X1flt52hEfJy+NzhKO+4rhvU8LvGofRD9TU4JgFFKh9K5k1DWPFxnUMjdG/sC8BYytFWRA2NWewqohRt1MC1iU7TBb2km1i5deAMhMrhMQoP7nzADo5nhXLbjrPKOv8pU7AtiKwmO81HMNrD84fXjNBTsdvDPB39Z0G/sUUuEPtnubpBvfYS8J+OvAZB9mmB0eZSsDQXgkW/oZatNSBMMh7IdI0l7hVCgN5OBii2GuNZDs4rSJJHILpjDQf7k/urS9u5WfL1T9H2WE5QaSqTjYLqJ2Ccsit27aEKTFI3Zd4nWqdIrQgjGW8WlYgdFNVF0ogEW8KCO1QYIDjFWPUPZJEIEBdy6JFvy9uPu5eDcNc1//5vG4Vw/zcUY5jaNSBSSZAKmwHBrzH8vj4qjLwMzEFsEGCLj8MRu/jo+Y0owXKhuRVnbSXzDErTR5/VlX2d5Ho5mYNeMJbP1g6yH54Ckd2bJ23RP39DV5grV8KJyHct5NfLFv2vgaSYmFy3A87PsXe/x0Zz4jhDw5UOOl+OgkrIQTOFMZq/DT6prUdWQXMOyIS3+3+ytXJyvQ= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?0fUhRzp4Q5VnQRApEqR44I8G95G8N7JUzJDrtwd7GLbX9pKndpNwvDE7dXVC?= =?us-ascii?Q?lWRu7sPIyvny2bOMpF5YCwDzzWnPI0VeAvQVZhZGaDCNi3zZPJJ4uElZxZxz?= =?us-ascii?Q?5HgDjt/LFrzBmNEaLyafWltCz9SRgmwbiDRaV6FK87r7fZly6ZC+D1bNNbx+?= =?us-ascii?Q?Vvrkys9hlbQoGaGcNxOhs8kk2UVzXete8WE+FsN8jJ7bOc9bCbSlSRDGoDo1?= =?us-ascii?Q?H7VdoYOaIRJRn86pqX893WP1YNzLFwHmvGsAqhb55ChYwg5qhxeK7p2FWvLm?= =?us-ascii?Q?lCAUOAakujkgBQghSlzGXVljM3PhvLJmv8Uth68LA8uGcnVa4qy0z95pG8I7?= =?us-ascii?Q?XZIoi/qAdp7++znnSGOXCMeuYUa+lLjOFmrzRwQ7QOsV0WNFOlBJw022m/So?= =?us-ascii?Q?r/MeBmYcxGpRHj5O2Y0Z5TCGcTG9d7vLHGIiKYnWNxL1ZFFfSurO8PJ0WTDr?= =?us-ascii?Q?IzmdDGJcxXvCw/LnIKJvTqXN5ng57gG9i/MAssor0IkAEdPLhUwzpxHlrdKD?= =?us-ascii?Q?/nb4tisiJqachWFfdidRn8smDv30RadYSzIGC+BZ1b96CLZVp9KM1AQg4WVt?= =?us-ascii?Q?BcbaLR0js/YiXebh18mR9eFUc8hHkCsh3cVhyfdc2wXip69XJWpCnNdjB7nM?= =?us-ascii?Q?K69Y8SxxN7Hjwh92ACNd8em/H+udIWEPXQnkMF/B7W70/OdriaV07sxsnEF0?= =?us-ascii?Q?msKVyfhwqLHBZR2fERQQD5J7fXu81BM8jYci9tdNvgMUNbcOD8xO4OC6fr//?= =?us-ascii?Q?IlPUI59o3HYUHSVCmr5TWJauO7ieg4sAbP8vz70chnuBDwtcyMT7cgGoeLB5?= =?us-ascii?Q?B6FWYIZXTcUp7nqxGd+KQ/laSkoKi6fsaJFIKKoxplij/iduT0GdPgVy/V75?= =?us-ascii?Q?shJGVlE3LN+tBhsYrzxiRnf+IO3Jv+f3bSHrG0zHxVUsIE4bBrm1TchWdhDm?= =?us-ascii?Q?dInycxxqCaw+Fu/FJxhCGnbVwbym7f84Fh2WwDyZImv8cI7vy3bYfuw/o/oZ?= =?us-ascii?Q?r12siZFR/YkzTag0OJ02ddMg48shRB7Zf/2OMiA4GEQ9gdqx8M99B2RCKgno?= =?us-ascii?Q?a4MuNHV8kI6sEpGtuoKAFUbEh6qRh42NXfZY362zeDTUyHr01yOSKI/TqaWs?= =?us-ascii?Q?SRdgdFpsmDu7AFr9L2B5/EzCKZJhw2QAnI7LS+ZTf7yrfjw0gnfiBMDI6ur7?= =?us-ascii?Q?KvOQ0zsnrfO6TYCPeiT8mJaZnQF46uRIOHvC4IuoHJyuE09p6rgr/vcaBcpq?= =?us-ascii?Q?cZ1gHHFCVaGG4DDTqgKrPYoZgWeLpeZKRI7oTkVbZ+IDzaBBG2D6OiuNtm8i?= =?us-ascii?Q?3pV043fl4eE4bjtNBLf6qej+?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: cd73158a-7141-4cc9-a37a-08d96d6408c1 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:46.3089 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: z9t2R/5IxlW+aLvteZQSKmsSCQDEyfOUxwezXcB41inhqVol2zG0Rs5fYrCvX+l0Ghp77R3GftkEWUbkWWWroA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: 20O5MVKj3jSiLeCqowoHn4vcx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513073; bh=mg/6XKnNtCVeT6F0KkVQBT08XWU9iNcsehNgoIlkeIE=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=qBDv1+ae/sZefpfrvMdN/2Yr3an2BOcKTOGEb1GsQn8yqw8zPeLCGqV52Bv2WlMg/Cb XsLzZ19VxIUSiq5bOufRCm+b5QA4l0Xn8WbtIFaJfE+7eptb+hU/XNRTLgIvw8P1UU/zR gvmnqos59xwdKTZZNkPEDKR4ypXprR++KFo= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513074807100033 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 Many of the integrity guarantees of SEV-SNP are enforced through the Reverse Map Table (RMP). Each RMP entry contains the GPA at which a particular page of DRAM should be mapped. The guest can request the hypervisor to add pages in the RMP table via the Page State Change VMGEXIT defined in the GHCB specification section 2.5.1 and 4.1.6. Inside each RMP entry is a Validated flag; this flag is automatically cleared to 0 by the CPU hardware when a new RMP entry is created for a guest. Each VM page can be either validated or invalidated, as indicated by the Validated flag in the RMP entry. Memory access to a private page that is not validated generates a #VC. A VM can use the PVALIDATE instruction to validate the private page before using it. During the guest creation, the boot ROM memory is pre-validated by the AMD-SEV firmware. The MemEncryptSevSnpValidateSystemRam() can be called during the SEC and PEI phase to validate the detected system RAM. One of the fields in the Page State Change NAE is the RMP page size. The page size input parameter indicates that either a 4KB or 2MB page should be used while adding the RMP entry. During the validation, when possible, the MemEncryptSevSnpValidateSystemRam() will use the 2MB entry. A hypervisor backing the memory may choose to use the different page size in the RMP entry. In those cases, the PVALIDATE instruction should return SIZEMISMATCH. If a SIZEMISMATCH is detected, then validate all 512-pages constituting a 2MB region. Upon completion, the PVALIDATE instruction sets the rFLAGS.CF to 0 if instruction changed the RMP entry and to 1 if the instruction did not change the RMP entry. The rFlags.CF will be 1 only when a memory region is already validated. We should not double validate a memory as it could lead to a security compromise. If double validation is detected, terminate the boot. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/OvmfPkgIa32.dsc | 1 + OvmfPkg/OvmfPkgIa32X64.dsc | 1 + .../DxeMemEncryptSevLib.inf | 3 + .../PeiMemEncryptSevLib.inf | 3 + .../SecMemEncryptSevLib.inf | 3 + OvmfPkg/Include/Library/MemEncryptSevLib.h | 14 + .../X64/SnpPageStateChange.h | 31 ++ .../Ia32/MemEncryptSevLib.c | 17 + .../X64/DxeSnpSystemRamValidate.c | 40 +++ .../X64/PeiSnpSystemRamValidate.c | 36 +++ .../X64/SecSnpSystemRamValidate.c | 36 +++ .../X64/SnpPageStateChangeInternal.c | 295 ++++++++++++++++++ 12 files changed, 480 insertions(+) create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateCh= ange.h create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemRa= mValidate.c create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRa= mValidate.c create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRa= mValidate.c create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateCh= angeInternal.c diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index d1d92c97bae3..626dbc15786a 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -266,6 +266,7 @@ [LibraryClasses.common.SEC] !else CpuExceptionHandlerLib|UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiC= puExceptionHandlerLib.inf !endif + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLi= b.inf =20 [LibraryClasses.common.PEI_CORE] HobLib|MdePkg/Library/PeiHobLib/PeiHobLib.inf diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index f42abc041c0c..58be97eb0605 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -270,6 +270,7 @@ [LibraryClasses.common.SEC] !else CpuExceptionHandlerLib|UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiC= puExceptionHandlerLib.inf !endif + MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLi= b.inf =20 [LibraryClasses.common.PEI_CORE] HobLib|MdePkg/Library/PeiHobLib/PeiHobLib.inf diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf index f2e162d68076..f613bb314f5f 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf @@ -34,8 +34,10 @@ [Sources] PeiDxeMemEncryptSevLibInternal.c =20 [Sources.X64] + X64/DxeSnpSystemRamValidate.c X64/MemEncryptSevLib.c X64/PeiDxeVirtualMemory.c + X64/SnpPageStateChangeInternal.c X64/VirtualMemory.c X64/VirtualMemory.h =20 @@ -49,6 +51,7 @@ [LibraryClasses] DebugLib MemoryAllocationLib PcdLib + VmgExitLib =20 [FeaturePcd] gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf index 03a78c32df28..0402e49a1028 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf @@ -36,6 +36,8 @@ [Sources] [Sources.X64] X64/MemEncryptSevLib.c X64/PeiDxeVirtualMemory.c + X64/PeiSnpSystemRamValidate.c + X64/SnpPageStateChangeInternal.c X64/VirtualMemory.c X64/VirtualMemory.h =20 @@ -49,6 +51,7 @@ [LibraryClasses] DebugLib MemoryAllocationLib PcdLib + VmgExitLib =20 [FeaturePcd] gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf index 279c38bfbc2c..939af0a91ea4 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf @@ -35,6 +35,8 @@ [Sources] [Sources.X64] X64/MemEncryptSevLib.c X64/SecVirtualMemory.c + X64/SecSnpSystemRamValidate.c + X64/SnpPageStateChangeInternal.c X64/VirtualMemory.c X64/VirtualMemory.h =20 @@ -46,6 +48,7 @@ [LibraryClasses] CpuLib DebugLib PcdLib + VmgExitLib =20 [FixedPcd] gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase diff --git a/OvmfPkg/Include/Library/MemEncryptSevLib.h b/OvmfPkg/Include/L= ibrary/MemEncryptSevLib.h index 796de62ec2f8..f708a0cdaa72 100644 --- a/OvmfPkg/Include/Library/MemEncryptSevLib.h +++ b/OvmfPkg/Include/Library/MemEncryptSevLib.h @@ -215,4 +215,18 @@ MemEncryptSevClearMmioPageEncMask ( IN UINTN NumPages ); =20 +/** + Pre-validate the system RAM when SEV-SNP is enabled in the guest VM. + + @param[in] BaseAddress Base address + @param[in] NumPages Number of pages starting from the ba= se address + +**/ +VOID +EFIAPI +MemEncryptSevSnpPreValidateSystemRam ( + IN PHYSICAL_ADDRESS BaseAddress, + IN UINTN NumPages + ); + #endif // _MEM_ENCRYPT_SEV_LIB_H_ diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChange.h = b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChange.h new file mode 100644 index 000000000000..8bbdf06468b9 --- /dev/null +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChange.h @@ -0,0 +1,31 @@ +/** @file + + SEV-SNP Page Validation functions. + + Copyright (c) 2021 AMD Incorporated. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef SNP_PAGE_STATE_INTERNAL_H_ +#define SNP_PAGE_STATE_INTERNAL_H_ + +// +// SEV-SNP Page states +// +typedef enum { + SevSnpPagePrivate, + SevSnpPageShared, + +} SEV_SNP_PAGE_STATE; + +VOID +InternalSetPageState ( + IN EFI_PHYSICAL_ADDRESS BaseAddress, + IN UINTN NumPages, + IN SEV_SNP_PAGE_STATE State, + IN BOOLEAN UseLargeEntry + ); + +#endif diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c b= /OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c index be260e0d1014..df5e4d61513d 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c @@ -136,3 +136,20 @@ MemEncryptSevClearMmioPageEncMask ( // return RETURN_UNSUPPORTED; } + +/** + Pre-validate the system RAM when SEV-SNP is enabled in the guest VM. + + @param[in] BaseAddress Base address + @param[in] NumPages Number of pages starting from the ba= se address + +**/ +VOID +EFIAPI +MemEncryptSevSnpPreValidateSystemRam ( + IN PHYSICAL_ADDRESS BaseAddress, + IN UINTN NumPages + ) +{ + ASSERT (FALSE); +} diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemRamValida= te.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemRamValidate.c new file mode 100644 index 000000000000..ad8d8b388dc8 --- /dev/null +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemRamValidate.c @@ -0,0 +1,40 @@ +/** @file + + SEV-SNP Page Validation functions. + + Copyright (c) 2021 AMD Incorporated. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include +#include +#include +#include + +#include "SnpPageStateChange.h" + +/** + Pre-validate the system RAM when SEV-SNP is enabled in the guest VM. + + @param[in] BaseAddress Base address + @param[in] NumPages Number of pages starting from the ba= se address + +**/ +VOID +EFIAPI +MemEncryptSevSnpPreValidateSystemRam ( + IN PHYSICAL_ADDRESS BaseAddress, + IN UINTN NumPages + ) +{ + if (!MemEncryptSevSnpIsEnabled ()) { + return; + } + + // + // All the pre-validation must be completed in the PEI phase. + // + ASSERT (FALSE); +} diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValida= te.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c new file mode 100644 index 000000000000..64aab7f45b6d --- /dev/null +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c @@ -0,0 +1,36 @@ +/** @file + + SEV-SNP Page Validation functions. + + Copyright (c) 2021 AMD Incorporated. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include +#include +#include + +#include "SnpPageStateChange.h" + +/** + Pre-validate the system RAM when SEV-SNP is enabled in the guest VM. + + @param[in] BaseAddress Base address + @param[in] NumPages Number of pages starting from the ba= se address + +**/ +VOID +EFIAPI +MemEncryptSevSnpPreValidateSystemRam ( + IN PHYSICAL_ADDRESS BaseAddress, + IN UINTN NumPages + ) +{ + if (!MemEncryptSevSnpIsEnabled ()) { + return; + } + + InternalSetPageState (BaseAddress, NumPages, SevSnpPagePrivate, TRUE); +} diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValida= te.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c new file mode 100644 index 000000000000..64aab7f45b6d --- /dev/null +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c @@ -0,0 +1,36 @@ +/** @file + + SEV-SNP Page Validation functions. + + Copyright (c) 2021 AMD Incorporated. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include +#include +#include + +#include "SnpPageStateChange.h" + +/** + Pre-validate the system RAM when SEV-SNP is enabled in the guest VM. + + @param[in] BaseAddress Base address + @param[in] NumPages Number of pages starting from the ba= se address + +**/ +VOID +EFIAPI +MemEncryptSevSnpPreValidateSystemRam ( + IN PHYSICAL_ADDRESS BaseAddress, + IN UINTN NumPages + ) +{ + if (!MemEncryptSevSnpIsEnabled ()) { + return; + } + + InternalSetPageState (BaseAddress, NumPages, SevSnpPagePrivate, TRUE); +} diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInt= ernal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeIntern= al.c new file mode 100644 index 000000000000..506df12d4e51 --- /dev/null +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c @@ -0,0 +1,295 @@ +/** @file + + SEV-SNP Page Validation functions. + + Copyright (c) 2021 AMD Incorporated. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include +#include +#include +#include +#include +#include + +#include +#include + +#include "SnpPageStateChange.h" + +#define IS_ALIGNED(x, y) ((((x) & (y - 1)) =3D=3D 0)) +#define PAGES_PER_LARGE_ENTRY 512 + +STATIC +UINTN +MemoryStateToGhcbOp ( + IN SEV_SNP_PAGE_STATE State + ) +{ + UINTN Cmd; + + switch (State) { + case SevSnpPageShared: Cmd =3D SNP_PAGE_STATE_SHARED; break; + case SevSnpPagePrivate: Cmd =3D SNP_PAGE_STATE_PRIVATE; break; + default: ASSERT(0); + } + + return Cmd; +} + +STATIC +VOID +SnpPageStateFailureTerminate ( + VOID + ) +{ + MSR_SEV_ES_GHCB_REGISTER Msr; + + // + // Use the GHCB MSR Protocol to request termination by the hypervisor + // + Msr.GhcbPhysicalAddress =3D 0; + Msr.GhcbTerminate.Function =3D GHCB_INFO_TERMINATE_REQUEST; + Msr.GhcbTerminate.ReasonCodeSet =3D GHCB_TERMINATE_GHCB; + Msr.GhcbTerminate.ReasonCode =3D GHCB_TERMINATE_GHCB_GENERAL; + AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress); + + AsmVmgExit (); + + ASSERT (FALSE); + CpuDeadLoop (); +} + +/** + This function issues the PVALIDATE instruction to validate or invalidate = the memory + range specified. If PVALIDATE returns size mismatch then it retry validat= ing with + smaller page size. + + */ +STATIC +VOID +PvalidateRange ( + IN SNP_PAGE_STATE_CHANGE_INFO *Info, + IN UINTN StartIndex, + IN UINTN EndIndex, + IN BOOLEAN Validate + ) +{ + UINTN Address, RmpPageSize, Ret, i; + + for (; StartIndex <=3D EndIndex; StartIndex++) { + // + // Get the address and the page size from the Info. + // + Address =3D Info->Entry[StartIndex].GuestFrameNumber << EFI_PAGE_SHIFT; + RmpPageSize =3D Info->Entry[StartIndex].PageSize; + + Ret =3D AsmPvalidate (RmpPageSize, Validate, Address); + + // + // If we fail to validate due to size mismatch then try with the + // smaller page size. This senario will occur if the backing page in + // the RMP entry is 4K and we are validating it as a 2MB. + // + if ((Ret =3D=3D PVALIDATE_RET_SIZE_MISMATCH) && (RmpPageSize =3D=3D Pv= alidatePageSize2MB)) { + for (i =3D 0; i < PAGES_PER_LARGE_ENTRY; i++) { + Ret =3D AsmPvalidate (PvalidatePageSize4K, Validate, Address); + if (Ret) { + break; + } + + Address =3D Address + EFI_PAGE_SIZE; + } + } + + // + // If validation failed then do not continue. + // + if (Ret) { + DEBUG (( + DEBUG_ERROR, "%a:%a: Failed to %a address 0x%Lx Error code %d\n", + gEfiCallerBaseName, + __FUNCTION__, + Validate ? "Validate" : "Invalidate", + Address, + Ret + )); + SnpPageStateFailureTerminate (); + } + } +} + +STATIC +EFI_PHYSICAL_ADDRESS +BuildPageStateBuffer ( + IN EFI_PHYSICAL_ADDRESS BaseAddress, + IN EFI_PHYSICAL_ADDRESS EndAddress, + IN SEV_SNP_PAGE_STATE State, + IN BOOLEAN UseLargeEntry, + IN SNP_PAGE_STATE_CHANGE_INFO *Info + ) +{ + EFI_PHYSICAL_ADDRESS NextAddress; + UINTN i, RmpPageSize; + + // Clear the page state structure + SetMem (Info, sizeof (*Info), 0); + + i =3D 0; + NextAddress =3D EndAddress; + + // + // Populate the page state entry structure + // + while ((BaseAddress < EndAddress) && (i < SNP_PAGE_STATE_MAX_ENTRY)) { + // + // Is this a 2MB aligned page? Check if we can use the Large RMP entry. + // + if (UseLargeEntry && IS_ALIGNED (BaseAddress, SIZE_2MB) && + ((EndAddress - BaseAddress) >=3D SIZE_2MB)) { + RmpPageSize =3D PvalidatePageSize2MB; + NextAddress =3D BaseAddress + SIZE_2MB; + } else { + RmpPageSize =3D PvalidatePageSize4K; + NextAddress =3D BaseAddress + EFI_PAGE_SIZE; + } + + Info->Entry[i].GuestFrameNumber =3D BaseAddress >> EFI_PAGE_SHIFT; + Info->Entry[i].PageSize =3D RmpPageSize; + Info->Entry[i].Operation =3D MemoryStateToGhcbOp (State); + Info->Entry[i].CurrentPage =3D 0; + Info->Header.EndEntry =3D i; + + BaseAddress =3D NextAddress; + i++; + } + + return NextAddress; +} + +STATIC +VOID +PageStateChangeVmgExit ( + IN GHCB *Ghcb, + IN SNP_PAGE_STATE_CHANGE_INFO *Info + ) +{ + EFI_STATUS Status; + + // + // As per the GHCB specification, the hypervisor can resume the guest be= fore + // processing all the entries. Checks whether all the entries are proces= sed. + // + // The stragtegy here is to wait for the hypervisor to change the page + // state in the RMP table before guest access the memory pages. If the + // page state was not successful, then later memory access will result + // in the crash. + // + while (Info->Header.CurrentEntry <=3D Info->Header.EndEntry) { + Ghcb->SaveArea.SwScratch =3D (UINT64) Ghcb->SharedBuffer; + VmgSetOffsetValid (Ghcb, GhcbSwScratch); + + Status =3D VmgExit (Ghcb, SVM_EXIT_SNP_PAGE_STATE_CHANGE, 0, 0); + + // + // The Page State Change VMGEXIT can pass the failure through the + // ExitInfo2. Lets check both the return value as well as ExitInfo2. + // + if ((Status !=3D 0) || (Ghcb->SaveArea.SwExitInfo2)) { + SnpPageStateFailureTerminate (); + } + } +} + +/** + The function is used to set the page state when SEV-SNP is active. The pa= ge state + transition consist of changing the page ownership in the RMP table, and u= sing the + PVALIDATE instruction to update the Validated bit in RMP table. + + When the UseLargeEntry is set to TRUE, then function will try to use the = large RMP + entry (whevever possible). + */ +VOID +InternalSetPageState ( + IN EFI_PHYSICAL_ADDRESS BaseAddress, + IN UINTN NumPages, + IN SEV_SNP_PAGE_STATE State, + IN BOOLEAN UseLargeEntry + ) +{ + GHCB *Ghcb; + EFI_PHYSICAL_ADDRESS NextAddress, EndAddress; + MSR_SEV_ES_GHCB_REGISTER Msr; + BOOLEAN InterruptState; + SNP_PAGE_STATE_CHANGE_INFO *Info; + + Msr.GhcbPhysicalAddress =3D AsmReadMsr64 (MSR_SEV_ES_GHCB); + Ghcb =3D Msr.Ghcb; + + EndAddress =3D BaseAddress + EFI_PAGES_TO_SIZE (NumPages); + + DEBUG (( + DEBUG_VERBOSE, "%a:%a Address 0x%Lx - 0x%Lx State =3D %a LargeEntry = =3D %d\n", + gEfiCallerBaseName, + __FUNCTION__, + BaseAddress, + EndAddress, + State =3D=3D SevSnpPageShared ? "Shared" : "Private", + UseLargeEntry + )); + + while (BaseAddress < EndAddress) { + UINTN CurrentEntry, EndEntry; + + // + // Initialize the GHCB + // + VmgInit (Ghcb, &InterruptState); + + // + // Build the page state structure + // + Info =3D (SNP_PAGE_STATE_CHANGE_INFO *) Ghcb->SharedBuffer; + NextAddress =3D BuildPageStateBuffer (BaseAddress, + EndAddress, + State, + UseLargeEntry, + Info + ); + + // + // Save the current and end entry from the page state structure. We ne= ed + // it later. + // + CurrentEntry =3D Info->Header.CurrentEntry; + EndEntry =3D Info->Header.EndEntry; + + // + // If the caller requested to change the page state to shared then + // invalidate the pages before making the page shared in the RMP table. + // + if (State =3D=3D SevSnpPageShared) { + PvalidateRange (Info, CurrentEntry, EndEntry, FALSE); + } + + // + // Invoke the page state change VMGEXIT. + // + PageStateChangeVmgExit (Ghcb, Info); + + // + // If the caller requested to change the page state to private then + // validate the pages after it has been added in the RMP table. + // + if (State =3D=3D SevSnpPagePrivate) { + PvalidateRange (Info, CurrentEntry, EndEntry, TRUE); + } + + VmgDone (Ghcb, InterruptState); + + BaseAddress =3D NextAddress; + } +} --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80094): https://edk2.groups.io/g/devel/message/80094 Mute This Topic: https://groups.io/mt/85306676/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80092+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80092+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 16305130721861019.5783151030636; Wed, 1 Sep 2021 09:17:52 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id QPbeYY1788612xb3WIQvNWVY; Wed, 01 Sep 2021 09:17:51 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:51 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=m7/gjBJx6BoTwRxvy0foeV7CADhvMLKclf7cJO/TCuRhbyGP6g57bTBtOP0TbECDOaz01wCpX73AsYbskdDkKR0TKXOG1HVXUU/mGqSsiRisFqTwuMaVL1yzajsH5Tg89z7xnxePWKGnCtMK/c5kTIxYQBDJezwLHXs/Cms+CNlG/7Ap4zNzZa+suIEWxIkuqir9v14DcCF9zFi0jF2YRuiC+QIYWWzrbLyyRmtL3+O6/idl88PoJjH3nwjje0QhWp0Esssga6/qwVz6DOAYKwHxOiMNqPVwAftMoJK+mfbKFt2kVGwFp3fATg7JBLyDT6pg6NtqLLSQVCqEIkXFCw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=7zIWo9GeGewtJfUP1bc76si9U9TM5Jl11fzPq+3jcMA=; b=Gbp8B2Mie975GOTa7OHD3kbyy8OyhxUBleNXFQHbZWpkAWSIWs64/Q+dZyN9CZ791k7U1pFS5/5yUjEJhqdlVwiY3uoE3V2I5DJKusiw+uLlU1jAvhnqe57203a/JK060a+s/kqxZIzie0Vgt7o5/KJ2MYdkTkFzCqWhVVb3mpzA3hYmDIs9RxY4Z5R6CZCgJQNDCqkF17sKu2M6PayfFdBtSA56l0MNfukQprDGgR9LJf6HRukd+JtkbWw9G58d53exc3+HROjmgBG7p1uehMC/yxw2u1ySwIP50Ibh4HdYwJdCmZaFVjDMqj2xoh0bjkfQu0T0G5FzB0nBeV/EXw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:48 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:48 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 16/29] OvmfPkg/BaseMemEncryptSevLib: skip the pre-validated system RAM Date: Wed, 1 Sep 2021 11:16:33 -0500 Message-ID: <20210901161646.24763-17-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:46 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: adc3540c-0358-4cbf-c615-08d96d64093d X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7691; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: uB9dqvOrH8fCgvqMvpX8OlqrNaDq13PK1yKiDYZXbIHmd0inKznyqXJX/JqNwBBvZ+bdF3rv0Z3CwDowLJGSWzjamEEqHxKjxtYnSaWW/RukS3v2HpvB+xM4ugA2KrxmEsWzn+l8JaZsQyKCBFWQb17OLr6jvv1cC8DzT2XeX/29xBI6a101b3szdxY3RWB/ZgMeXJPiegfz3pL/fqIqh6sozoKmh0GcxloYCvQ2NmlavlPCSB6idaxJbA6AuKorYCxfgTJl74qjIj7+Rb5DrFXraKn8YgN+tsxQy1la91wGpt1RGwVpGKD1L0bQ+s9k5+OouiesN6XuoFBFjwZ1LXOduUaADpuSYmN8Dqw25YqthOqk0diUksuA7+tnCChhufjYDLhZGamNcHC0Z2yHLQdfR/y9fN5HVhlLmDSrwGfEPt0RbDjjRMY+tTgFnQJjS4tgkxChrmH+iiOZiImI+rRGyAMA/18MlFsidbKeaMdGPuhXJ7Ly3tw3VVUiMprqT4Ef2DjoaphXTh4R9e+bpGMm2D1r5XiS3uieWAkiZLIPqdgA3lu0FZOYlnmH65V33XWMZK7ljQ8hAYYUYS2+7G8UtdQEvChEFH+yy3kG9lJmeGV4jIe5hqEAnQVl/UkR0rqLy1E2YXJ2/97uMkNxeTAYA3lownKWNuMwI9hz5i74c9ycnrJho801Mhn+s+heEEg5d7JXCb7bc7ZAmN/62KmF/Qrz2BiU8VasEVx3ceSahwz2K5tVt1YtkDgDiQ4/yWsFK4Iz7HMinDUozmuXYiAi43CbMdTLhQvzZ3AG5AU+un3GaJU6R4j2ER+TSiT+ X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?buM02A6Ip4y7tbE3aDX7kUJYEf73NqEBAtRdjcHphbs8GyPwjEuUhKGIsvj4?= =?us-ascii?Q?HaQqGDJQ7LEvo+uLXWZ/oMh8e4jlImF1O/ONA9eSwlL8VfAuQa8b0RmRqBGE?= =?us-ascii?Q?+FcYStAGzIXmiZbEO6U2yhsJ0Hvuavla2nmcGTs4ilafMgNqrwZgttKGW2bD?= =?us-ascii?Q?hz+FvWygaYpBa/KZOyj1FcD2sM1os84UU154NYZgCC47VUGEUrQZkvbYnYqT?= =?us-ascii?Q?hjvKaBhgSwXARhQv89/7lSdeLTHR9LcqxjCPDyITfovUeF88zqFkpl1xhGJk?= =?us-ascii?Q?v0xQt7pPbW9KEWC36J9YMco63klNuXZPlouWgpgssECyjj/wSMUHC5TiclOi?= =?us-ascii?Q?RxNPIRiAtREIozwg1eWUoh5V2HGRF9rx0qArs9pME2ZQmCnBfYGTB08S355+?= =?us-ascii?Q?qqir09jB1WFh2qJxGuLteud5988awSxzJzhNUq+ErZm7Er4V6uV+fG9e8oOL?= =?us-ascii?Q?Fcan5yZnMRXjdIUA1OKt8NKRxiqGbbSsduLd/Bsd2Sox/9wrbas1Ik1O2syS?= =?us-ascii?Q?zN0DBxJMkgrysFeBZzxh1sZrjAdLgfg5YFvPW73iRrUoi3glqhCO91TIVaSb?= =?us-ascii?Q?ipmh2vdHjdaS+hQCO3oLQwO+mlqA7G2YLzSCRzkSm4bZQPQbFgiD09myA5uG?= =?us-ascii?Q?IhZdVeVUShk+zps+282mGG1PPgmUwjm6yj3oR+k+rs/qAm5W8b6xmQs73qXI?= =?us-ascii?Q?O4U+Gq2VL1BjmJJQUrFWkh6ZwsjGnO/TGAHaiVum9eOq/ah4xtLY8hgt6hkj?= =?us-ascii?Q?Cy/QsRQL8p9jHioNd9TIra6rOHFlpAgLCNRjzrJ/qb5Xn8K0HYdSzFJ+dUc+?= =?us-ascii?Q?6notPC9BPhzuwESIku+WdkhG55Qlifgd0g6lvq+O3ygYQxCfiUU4qXTxaM+j?= =?us-ascii?Q?6hAy2cgmP3JBdpctqwR5LhVX37TEgPohe7TMMRjV2e+7gaiUnoGNIl2Q6qzN?= =?us-ascii?Q?TPWE3qrTxXvqhRK4qGryxcykPzmJs6HNSDko8IClVRfCVew0abpyKNKYgrPQ?= =?us-ascii?Q?mM6W1vQMO5w8DbuJc0oKPaIVmGkiU/XOtHdU3CMQ5R8CDC5bYm0VGxfVISBO?= =?us-ascii?Q?fSYVlHBvsg/nDP7P+Y0rEKpXwFQUZQ0fZNMsjz7GeSqKzIKfr0Ej+IFmi0+V?= =?us-ascii?Q?h8kHK7kSy8Hsyi+wRRb5WolEciB3JKMaL8IX3DqoFqqCtl4GKLSizCSkuQR1?= =?us-ascii?Q?TI9z84dZIFvp6Mv10Na3U9Jmk1OiagHe19ZkOoeFoqEoO2P4HHR7iSEgNS4M?= =?us-ascii?Q?8gvM0cTo48XFY2BlW38/buZNCFuPXSoSQ81aqWjwOakFqhqTbbdYgk7nrGAI?= =?us-ascii?Q?zvPNSMspRtBvGqLTnd8ZRH2p?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: adc3540c-0358-4cbf-c615-08d96d64093d X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:47.0375 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: KwInSMcSW7RBtaKeGdmi+80UMHwHL9zIdgah3PYTBaHInb0zQg+BuryTmEjvd9yzefpjmkSJk0iBp+A5aSGa6A== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: X1uaKCTN6tLchHw88DrM7I9ax1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513071; bh=Eg7Uu9keeYPF4VScvxnrU7Jk//BJsaoEwTpuHfoboRk=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=HNdCtUCMjsRkshdvooQ9olMiTTnulvCtRW0fxP81dikCIr6ydianLIp3LmQM5oLut4I sfE9wFZZ3hA0Vou0pu18dzGa0QlUr/oztT/GdQprO2o584taXNuXT2dZY5c0NuFho68Sq 2lEk2CwcdBdpxHDHdn9L4lN4JPg90udYW7A= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513073092100020 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 The MemEncryptSevSnpPreValidateSystemRam() is used for pre-validating the system RAM. As the boot progress, each phase validates a fixed region of the RAM. In the PEI phase, the PlatformPei detects all the available RAM and calls to pre-validate the detected system RAM. While validating the system RAM in PEI phase, we must skip previously validated system RAM to avoid the double validation. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- .../PeiMemEncryptSevLib.inf | 2 + .../X64/PeiSnpSystemRamValidate.c | 65 ++++++++++++++++++- 2 files changed, 66 insertions(+), 1 deletion(-) diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf index 0402e49a1028..f4058911e7b6 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf @@ -58,3 +58,5 @@ [FeaturePcd] =20 [FixedPcd] gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpHypervisorPreValidatedEnd + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpHypervisorPreValidatedStart diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValida= te.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c index 64aab7f45b6d..3e692a3b869d 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c @@ -14,6 +14,44 @@ =20 #include "SnpPageStateChange.h" =20 +typedef struct { + UINT64 StartAddress; + UINT64 EndAddress; +} SNP_PRE_VALIDATED_RANGE; + +STATIC SNP_PRE_VALIDATED_RANGE mPreValidatedRange[] =3D { + // This range is pre-validated by the Hypervisor. + { + FixedPcdGet32 (PcdOvmfSnpHypervisorPreValidatedStart), + FixedPcdGet32 (PcdOvmfSnpHypervisorPreValidatedEnd) + } +}; + +STATIC +BOOLEAN +DetectPreValidatedOverLap ( + IN PHYSICAL_ADDRESS StartAddress, + IN PHYSICAL_ADDRESS EndAddress, + OUT SNP_PRE_VALIDATED_RANGE *OverlapRange + ) +{ + UINTN i; + + // + // Check if the specified address range exist in pre-validated array. + // + for (i =3D 0; i < ARRAY_SIZE (mPreValidatedRange); i++) { + if ((mPreValidatedRange[i].StartAddress < EndAddress) && + (StartAddress < mPreValidatedRange[i].EndAddress)) { + OverlapRange->StartAddress =3D mPreValidatedRange[i].StartAddress; + OverlapRange->EndAddress =3D mPreValidatedRange[i].EndAddress; + return TRUE; + } + } + + return FALSE; +} + /** Pre-validate the system RAM when SEV-SNP is enabled in the guest VM. =20 @@ -28,9 +66,34 @@ MemEncryptSevSnpPreValidateSystemRam ( IN UINTN NumPages ) { + PHYSICAL_ADDRESS EndAddress; + SNP_PRE_VALIDATED_RANGE OverlapRange; + if (!MemEncryptSevSnpIsEnabled ()) { return; } =20 - InternalSetPageState (BaseAddress, NumPages, SevSnpPagePrivate, TRUE); + EndAddress =3D BaseAddress + EFI_PAGES_TO_SIZE (NumPages); + + while (BaseAddress < EndAddress) { + // + // Check if the range overlaps with the pre-validated ranges. + // + if (DetectPreValidatedOverLap (BaseAddress, EndAddress, &OverlapRange)= ) { + // Validate the non-overlap regions. + if (BaseAddress < OverlapRange.StartAddress) { + NumPages =3D EFI_SIZE_TO_PAGES (OverlapRange.StartAddress - BaseAd= dress); + + InternalSetPageState (BaseAddress, NumPages, SevSnpPagePrivate, TR= UE); + } + + BaseAddress =3D OverlapRange.EndAddress; + continue; + } + + // Validate the remaining pages. + NumPages =3D EFI_SIZE_TO_PAGES (EndAddress - BaseAddress); + InternalSetPageState (BaseAddress, NumPages, SevSnpPagePrivate, TRUE); + BaseAddress =3D EndAddress; + } } --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80092): https://edk2.groups.io/g/devel/message/80092 Mute This Topic: https://groups.io/mt/85306673/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80096+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80096+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513074771602.9288363179915; Wed, 1 Sep 2021 09:17:54 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id Ds2SYY1788612xw6cI7GiM1V; Wed, 01 Sep 2021 09:17:54 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:52 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=GgvTzRojvuPcNImc0VDM3vmh6HaWAorOnxlNRTdn8sxy0Qbn4yH/BIo2gNDv3PQPYhRBaGaivLWQenZd3e9+SZnOFFnHA8uLA47IqvEOQ+W32ftUrfHxvWGrzUuxc5lY2QygMcW8YgXeKoyf3VKDrvVLofCEIvXdj82B1MOzK9Cv8d9BUlSeLOyW4uBPZ/vpHY+7iwnjCWLGGL12E8NMuGwAoz+Jz2QlJjANjBCR+O1AyiP02pt7N3AYLHoWmCGZvksxgnZsP9ZqarDGETf2BHjU92VHllH+UztPhgfZXLkCs8H4jqZ2HoPW8Ycsb81RNzy+dUrir3UGh57nnWLqYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=7qSr61F6YUelKg7brd2dKyMRmi5D59retwtmW9NAx8Q=; b=FDcX68dx6UIa8GuHKrEGftnyZR4EXRt9WKgcjEBc8NNt+wTmUWmYO5P9d5whbWK2JGDyw2VZIX3Gm4HJdJneJGN43jkJlMV2a1sTT2QoVxKCFTXHROFlmZ8nMcBkIHnXboHScQnMbP0DWWDqLnRT3pjhdvncDb51VBg5kGShxnFtJ0lOlOdCIGk3/s6oBRxYs4iGbOVltel6tIoNvxfUEd3jj7Kw252qNkDEX/azdXT7ZzrYhQFs8bH98RIODNJV2Jk1PnB+W8BTQ5bitathcKaB1CsOz28l9RAi1lcTljnjY1y/DRbjvqVUHcRzUswnc/m3AVXUU4IQ9g2/Gk49Cg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:48 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:48 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 17/29] OvmfPkg/MemEncryptSevLib: add support to validate > 4GB memory in PEI phase Date: Wed, 1 Sep 2021 11:16:34 -0500 Message-ID: <20210901161646.24763-18-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:47 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 5c9b667e-f036-4037-3beb-08d96d6409af X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8273; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: YMzWhhVzmnRGhDXcp+d36Ko1hU/Oxq8jKfLfrQal+Nnlo8BPC7C3NQMwn5ASn6AKLbLV5Q+7WRoStnQhEV63fcGPjvboi9oZ8fhONv3TZkpPZlt+tBXWBkwPjyTahan72hl2KW6EzHEMdnb4APO55OZQlOwSB5GBsgSKGmwV1zkoNbMLlbr264gE6hCMCKfuLBpc1sJNdl7CuVuYxZC8SwaevK3NmzG4E2NCiVgwpnWFRaCeoYuvXL5TYFxGF+smvON28mXLvft/Lw7ULxQhmMUmyVwzLTKRHjfDR4ooflyn+ZFW+ghrt8JRDqbfleOMcTt99lVUX1J6Yi2q+MHtNuclc9y9OOWs/wSPGOekWq1jmUb71vZFZL0+5rxv+0QNvrKgdF9pntxruesBT9FmD8j1D7m+s2E2c5gH9gZK1Ms79iauB4EaVjFpo/Jrv1dNqd4zO9GvarUwOlyZViMSNVXd+axxLZGH4kM0UVY+Ui3JSZXpzFI5+KCVQz354MPCbDXp3RhcbusmNXNTUdQp5UB7ZfBO4h7rPfKU7K4CQi016tpDvmdaIrTFArYX+rZIvqQQ3PNwviGpKStVlaGrMnZT0YUyZ5bTDXUUarItzI2zQubef2yyezRXGvvGFu5AO48aKhxVhpaVE7EblKX5I3W+iEjydsvrXiNp2fUagze7zlsLcega9p1+aRItYbYlhpEPKTh3wkhBie1uhNyLwGBp6WElIh2PQkzWzWOKfI//lqOtWk1596fj734NMZQpe8HRBrK3wkJGhwII08haoA== X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?oQgp5eK1zsOLeWP8djvlkWbLghSJdsVV6I/4N7fZeHf2flYyBgsyOBopq9pu?= =?us-ascii?Q?gTwukOp/YBeutaAu+l4b71nV607fv/4yNOINT7GVkG/C0RRobljZW8pPLhzz?= =?us-ascii?Q?wkR3rNXxtxpbF/pJdGidQFrBuv/lAzofj1jgPtKl4GXCtBHU6D2C7Iz5Vs27?= =?us-ascii?Q?cDi3tvsLcWpwacf8I7BWupa2iWsrL3/WuDAuwhA0jYBquXrd1yxdEq6Ukaib?= =?us-ascii?Q?eTvtF1i4iDN/SgLPdsBL3zIxU5hRE2AlgcFSrcqqd2+06VGbUB/LCcoAsZ31?= =?us-ascii?Q?QkkmAB40PGGnzp92L8cZOfZJdkCQWs0E/rML0+5sB+WMWnQs3hfrkGkJ5Et+?= =?us-ascii?Q?aI48npJAXWF827cOeLAK2Ke8oVLqLLjVRkFJD6aJCROndW8raOogn15pEz/V?= =?us-ascii?Q?9nxdbvGl4ZfQU8M50RHCzWDW9Pfb16wLfhHZyPhlppdBpgS6tIM8ZIkvT4KN?= =?us-ascii?Q?GC6vS2BJaV5R0QAQ1/Rtt3XDw5XpvTZ0RBZ3JxJ5YT3OX/lnx3P8aU9wQVY0?= =?us-ascii?Q?12Madjq0YF8Jk5Y5T3JSgrlg2QkmjTGNf8oPflR20yIIiJopHH4CIYoYQwbJ?= =?us-ascii?Q?csN9r9mXE+UzQfYNF3XL+abFi5id5jdT/oyKgs9dP8S8mjiWWPiUonnFcHqz?= =?us-ascii?Q?Ilc/mVoljUzZviL3XDezOA7/E22psiFqcKxnSrMBzGoKrH1ZmwITzM6gDN42?= =?us-ascii?Q?AR1F6GvByUxMPqq17yQCh1/fkEtByWV565HliWNEGQPjKQ7ER2IFSUrQltcn?= =?us-ascii?Q?bXq/QTAu7cHQBMWz9CrNvfYMXQUoID0RJssSHtT4+mqzbMX8NRGnyeschWAQ?= =?us-ascii?Q?Fro7Cow9mXgAS8AapChtI23wGFRiQZ5pCC0sAB0iOflzqfh4Z53V+PHZZy+D?= =?us-ascii?Q?jDiXhdMRGQIlRM3+EdXceXOnL+qltsmuw6J876mLyt3aGXerk7J4RdxE/OTT?= =?us-ascii?Q?uqvCwsof3O+KsYyJmu1v0BmgY/jiEZnxzHOTglICcBetUxwTIjzH4Xg5wGKB?= =?us-ascii?Q?rFb3B8N+N8iBW8rx4fIUPmGFkur3zIYAB5kzBSZNtMQjieOPbHfJaJ5SHLIJ?= =?us-ascii?Q?QMEJi1K3qRcdyYYfICnuBzWVAay/uv0nSuREwBWr7v6h+31GEnVFBRf2yJ/C?= =?us-ascii?Q?rCzeScZhiZZG4Nvqg7JdTo6r1WG1Htox99iT/Xn3gSBm+61P2U4RgBle8Wy5?= =?us-ascii?Q?E2WGXCpbm+4SLaU63CTrrn/GbADJnVfisWg4syi+cnr/6UTSvY3b+uvkaCJo?= =?us-ascii?Q?OYcXA7dzPjHR19sVXPJMh9SB7WeTpV43Q2xj0WhaEC+Mh8R4uOtbQBTSJXlT?= =?us-ascii?Q?BW/OsXwKm3ijhbX2ipl9+BKV?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5c9b667e-f036-4037-3beb-08d96d6409af X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:47.7461 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: jEHxOfrwEqcPr+f6aIrxR2F8iSrrqknqfv3CHQry98k8hIEgj1WKc4GadKGKWWvAxl5U/u0qhrmySzTbbFtULA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: J8B08oyGn6VGTkvd14Ujyfc6x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513074; bh=iB5crRN8dtDoLEyd/xUUlp5YFjd6rV8ZU6mvhdgdHzA=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=XgR590Minpn2gsR51WqntrJfRFVI7ePq+fs0i5M2R0Kzr0FarVn2eYx6LWGFXeDobWb RHhNnBb9CSQGAgfbEucec7DuP5ZTdAOYd3khixYd2qf2A0M3BQ0rEGNT5opGRfDfcAz85 V5lZNZ6VWLwkYI88xnLp9SOaYRAIlM+Ya6w= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513077068100041 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 The initial page built during the SEC phase is used by the MemEncryptSevSnpValidateSystemRam() for the system RAM validation. The page validation process requires using the PVALIDATE instruction; the instruction accepts a virtual address of the memory region that needs to be validated. If hardware encounters a page table walk failure (due to page-not-present) then it raises #GP. The initial page table built in SEC phase address up to 4GB. Add an internal function to extend the page table to cover > 4GB. The function builds 1GB entries in the page table for access > 4GB. This will provide the support to call PVALIDATE instruction for the virtual address > 4GB in PEI phase. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- .../BaseMemEncryptSevLib/X64/VirtualMemory.h | 19 +++ .../X64/PeiDxeVirtualMemory.c | 115 ++++++++++++++++++ .../X64/PeiSnpSystemRamValidate.c | 22 ++++ 3 files changed, 156 insertions(+) diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.h b/Ovm= fPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.h index 21bbbd1c4f9c..aefef68c30c0 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.h +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.h @@ -143,4 +143,23 @@ InternalMemEncryptSevClearMmioPageEncMask ( IN PHYSICAL_ADDRESS PhysicalAddress, IN UINTN Length ); + +/** + Create 1GB identity mapping for the specified virtual address range. + + @param[in] Cr3BaseAddress Cr3 Base Address (if zero then use + current CR3) + @param[in] VirtualAddress Virtual address + @param[in] Length Length of virtual address range + + @retval RETURN_INVALID_PARAMETER Number of pages is zero. + +**/ +RETURN_STATUS +EFIAPI +InternalMemEncryptSevCreateIdentityMap1G ( + IN PHYSICAL_ADDRESS Cr3BaseAddress, + IN PHYSICAL_ADDRESS PhysicalAddress, + IN UINTN Length + ); #endif diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c= b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c index c696745f9d26..f146f6d61cc5 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c @@ -536,6 +536,121 @@ EnableReadOnlyPageWriteProtect ( AsmWriteCr0 (AsmReadCr0() | BIT16); } =20 +RETURN_STATUS +EFIAPI +InternalMemEncryptSevCreateIdentityMap1G ( + IN PHYSICAL_ADDRESS Cr3BaseAddress, + IN PHYSICAL_ADDRESS PhysicalAddress, + IN UINTN Length + ) +{ + PAGE_MAP_AND_DIRECTORY_POINTER *PageMapLevel4Entry; + PAGE_TABLE_1G_ENTRY *PageDirectory1GEntry; + UINT64 PgTableMask; + UINT64 AddressEncMask; + BOOLEAN IsWpEnabled; + RETURN_STATUS Status; + + // + // Set PageMapLevel4Entry to suppress incorrect compiler/analyzer warnin= gs. + // + PageMapLevel4Entry =3D NULL; + + DEBUG (( + DEBUG_VERBOSE, + "%a:%a: Cr3Base=3D0x%Lx Physical=3D0x%Lx Length=3D0x%Lx\n", + gEfiCallerBaseName, + __FUNCTION__, + Cr3BaseAddress, + PhysicalAddress, + (UINT64)Length + )); + + if (Length =3D=3D 0) { + return RETURN_INVALID_PARAMETER; + } + + // + // Check if we have a valid memory encryption mask + // + AddressEncMask =3D InternalGetMemEncryptionAddressMask (); + if (!AddressEncMask) { + return RETURN_ACCESS_DENIED; + } + + PgTableMask =3D AddressEncMask | EFI_PAGE_MASK; + + + // + // Make sure that the page table is changeable. + // + IsWpEnabled =3D IsReadOnlyPageWriteProtected (); + if (IsWpEnabled) { + DisableReadOnlyPageWriteProtect (); + } + + Status =3D EFI_SUCCESS; + + while (Length) + { + // + // If Cr3BaseAddress is not specified then read the current CR3 + // + if (Cr3BaseAddress =3D=3D 0) { + Cr3BaseAddress =3D AsmReadCr3(); + } + + PageMapLevel4Entry =3D (VOID*) (Cr3BaseAddress & ~PgTableMask); + PageMapLevel4Entry +=3D PML4_OFFSET(PhysicalAddress); + if (!PageMapLevel4Entry->Bits.Present) { + DEBUG (( + DEBUG_ERROR, + "%a:%a: bad PML4 for Physical=3D0x%Lx\n", + gEfiCallerBaseName, + __FUNCTION__, + PhysicalAddress + )); + Status =3D RETURN_NO_MAPPING; + goto Done; + } + + PageDirectory1GEntry =3D (VOID *)( + (PageMapLevel4Entry->Bits.PageTableBaseAddres= s << + 12) & ~PgTableMask + ); + PageDirectory1GEntry +=3D PDP_OFFSET(PhysicalAddress); + if (!PageDirectory1GEntry->Bits.Present) { + PageDirectory1GEntry->Bits.Present =3D 1; + PageDirectory1GEntry->Bits.MustBe1 =3D 1; + PageDirectory1GEntry->Bits.MustBeZero =3D 0; + PageDirectory1GEntry->Bits.ReadWrite =3D 1; + PageDirectory1GEntry->Uint64 |=3D (UINT64)PhysicalAddress | AddressE= ncMask; + } + + if (Length <=3D BIT30) { + Length =3D 0; + } else { + Length -=3D BIT30; + } + + PhysicalAddress +=3D BIT30; + } + + // + // Flush TLB + // + CpuFlushTlb(); + +Done: + // + // Restore page table write protection, if any. + // + if (IsWpEnabled) { + EnableReadOnlyPageWriteProtect (); + } + + return Status; +} =20 /** This function either sets or clears memory encryption bit for the memory diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValida= te.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c index 3e692a3b869d..69ffb79633c4 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c @@ -10,9 +10,12 @@ =20 #include #include +#include +#include #include =20 #include "SnpPageStateChange.h" +#include "VirtualMemory.h" =20 typedef struct { UINT64 StartAddress; @@ -68,6 +71,7 @@ MemEncryptSevSnpPreValidateSystemRam ( { PHYSICAL_ADDRESS EndAddress; SNP_PRE_VALIDATED_RANGE OverlapRange; + EFI_STATUS Status; =20 if (!MemEncryptSevSnpIsEnabled ()) { return; @@ -75,6 +79,24 @@ MemEncryptSevSnpPreValidateSystemRam ( =20 EndAddress =3D BaseAddress + EFI_PAGES_TO_SIZE (NumPages); =20 + // + // The page table used in PEI can address up to 4GB memory. If we are as= ked to + // validate a range above the 4GB, then create an identity mapping so th= at the + // PVALIDATE instruction can execute correctly. If the page table entry = is not + // present then PVALIDATE will #GP. + // + if (BaseAddress >=3D SIZE_4GB) { + Status =3D InternalMemEncryptSevCreateIdentityMap1G ( + 0, + BaseAddress, + EFI_PAGES_TO_SIZE (NumPages) + ); + if (EFI_ERROR (Status)) { + ASSERT (FALSE); + CpuDeadLoop (); + } + } + while (BaseAddress < EndAddress) { // // Check if the range overlaps with the pre-validated ranges. --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80096): https://edk2.groups.io/g/devel/message/80096 Mute This Topic: https://groups.io/mt/85306678/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80098+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80098+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513075683969.8749333880215; Wed, 1 Sep 2021 09:17:55 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id 8q3WYY1788612xS5GMIZTuZi; Wed, 01 Sep 2021 09:17:55 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web10.176.1630513061970038126 for ; Wed, 01 Sep 2021 09:17:53 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=N8UiaGvRP7OKkjDJQzRwddnZ8hSKVagmS7ijHrrMu5ZnSk972aokrdhgS+yI+JthJG3biffrXiQhoPJ8NwRkwAWi9arxvQAnYb4KT48Ie5sIQYohjI39S2z5xVpNjFy+VIXvEIGfYwZBDDyW2JPsRsbx+KkGsyX1YLzr+DaPpueV/Fzugd50rvu1m/P1/nhSsTF7VoO1NrCmF2f/j7QpwUAX0N5PsZSexyUeyQYaWy63UBGqM0Z1HjAM7yhv/7Ktoj1RN4LppZPzcbFkzgn4WpJ2sUiiaCZG22FHQsGRlk4FkTPNp0O3sZ+GbLR5q5Y3ae//bK1PnpsWp0xCkJssnw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=4hEDK3VjTE6q1JzkyEE38bqSPnojbcYZiH9bRXoXNDg=; b=AtIFqIshfJ4F/kykQSucZ8MEtcWaAb+nT9GObcMsxZeayvcIH2tJLubWrs1iY8dg77oYQX2BjN0tvTxdTKHaryFuL4twdINZYFNDTBh/QRdwwaoZyfX9NYf4pL/tYJ7vC1w/biULLe5sC0JFcksfAJa36WVwKSeiQ2YyyNgAkm3BXkIQxAqLNo1m1l1S7bOjdcDgPiLSWO2LYOyyHF7112L2fjgeQ7z7LjHVD0FqLd1Hs55McV9YEaBADtCgw++8BZ7BgI2M2rkAISnCGyMvJ317AkF/gS9ugSNb34vv8evsmZQLOgOet6MA3ClbyO+7O3A9Wjbx7iECZZN+2o1pcg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4415.namprd12.prod.outlook.com (2603:10b6:806:70::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:48 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:48 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 18/29] OvmfPkg/SecMain: pre-validate the memory used for decompressing Fv Date: Wed, 1 Sep 2021 11:16:35 -0500 Message-ID: <20210901161646.24763-19-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:47 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b6615fdf-9be6-447c-0966-08d96d640a14 X-MS-TrafficTypeDiagnostic: SA0PR12MB4415: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7691; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: tngsW1yojwg2re5TR2mCBIgZpN/J1smi775/Xi2PGxB+3S/nmFGBEMboS0AzJMyrSu+cDkbAKf25hdY5zt5dAXeRsFLBhOB1LfiAonlbvEBYY/zTjgAcSZ4x8wisDXEiyLGkHWlkHaCflNtFa8JFlKc5VAKk0FU68Qv2rDciUVJHrzQNrd0/yS5arKFnJLlcUMVJ5dJefyCLYkWB+ncfCrASm76ukuPG3vLqJ31MAhLDEBF6T+AlvDXNa7np1S3oRY4p0ogoiVn/Tgai3i3f7qev54yMpfPGCHoNlnjS4Nzz0/z6HcKsHrgSRT/6j4djPou7FRxwnfQOcGFPNuj1Ojtkr2X0POnFZUJDex5dA+rpXTOEZQTD4GpsjCnQIN7L2QIg86k5+UmlZGh7JcVKj9QbCH5Olld+DQMilffVq2BcbIO479xnv4BPnhSU/r7b1zDtfrVg4HdfomlNh8ti/WbAkNyB1+J+WtFRBGj9hZ6BuuMp3po8Bw4Jjrp1ZlrU6cf5ALnpfk3arP62wDeMPKFJQo+dTObaT4VMgz3iI6DqoK0V5wMUNw/0j6jtrFYNPzKyIAM40++9TosTTMJI+4wRopiHInAIpO3x+uCh9uGM9akEVzBCiD4DJP5laYNTKVSZhr8zCLFsmStzv45zqfZ/Hg8h2IZBQ2hnT3M0OwY7owkyGeOZTSE1FS9MRUgiu3STa34TVimlUWAqjCkJbxM8Bt1CJr/rEuEh1C7P3dUwkt+xVEguFzR+tlRK3ChirhR+lfsrdrbTQuRUZLrlzBDUrTjGzMTO2/j6lT2gPGU= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?MBsWRmvZMzVepZbNEPmcyM/hKcbNanENd53TkFjvAhCJqdppTu5qB8KcKxQC?= =?us-ascii?Q?DuIE/Jveuvu36Hs6HhfrMNhB8iUBmf17gRAyn4OU/oZC0SS0uP3/vj73pFLj?= =?us-ascii?Q?x5crExCARJtm0uPXoYddXVuouvY+5usXW77P6d1ueZ27OL8o7wZl+sYuI6jE?= =?us-ascii?Q?UG3axA2PnFUbNroXOCbWm+Mltdl30olJJ6Vf1RyPS+Jju0G8KQFhAYzgl9Pq?= =?us-ascii?Q?NWIg2Zh/6zXhn+OUWjEC6osBakoUAy5+nES7Qct2GKSw16mlMAGSFI2jkb2p?= =?us-ascii?Q?Ip63iv7j6jkfNT0NC7nx7g/mwQiArcYT0nOzX2DvKE7c4ZXWRad+ph4tYqqP?= =?us-ascii?Q?1wFj2VNyFrJZliXUJrTyjjwTdObKa5rjNs0fTXGbmbF4JQuACb+rbk7XmlPT?= =?us-ascii?Q?FtVZgl1uRwd8nWshPQYQ4O8ZZUunq5Yj+klipy+XKeOZq7swZ80ez4dinK8F?= =?us-ascii?Q?/IuAv9rR/+woR4SZ/hZp9pCgrtXoIysAb7K89D16bNbtxM3qXFC/iS8cG7aC?= =?us-ascii?Q?tCkeYx4uaW/Ft00pHnkhRgfBjReuE0FN23C/h7RImvshMQkz/GP2grQ3HkuA?= =?us-ascii?Q?HLGW7kV6cmYPDe/J4re4Ev1Oap8R+/nkot1VjFHohjN3KTJTDiGVVa2ZRNZx?= =?us-ascii?Q?bo5IdSqTZR0hHFDwQ3LdUOHqiaVCamgI8kmgeNGP6DmQc9MV7o5rQ9+QGxfJ?= =?us-ascii?Q?EE5IeehYpJpBdHhitbNoj1MtZYV3/1Imh9Qcw42yzAZsh4S3+mX8wZZMLBpw?= =?us-ascii?Q?sQD5KoLdLI64z1EBMLGpF9EXI+djNk4OALQN74m69oZjEsdDe7P3VSrosI4K?= =?us-ascii?Q?3K3NSkBePL9xGZMNduIoot6IEcCb4VeeOTsxEObXav6OK22tiGIAYKJuqKkd?= =?us-ascii?Q?KHtniZ5msV8+cVDXX5CBBsBLCfF8u/1e93AV5T4xgI+NB6QJ2M5VNgEyZ9VN?= =?us-ascii?Q?/oiD//+4mrCGPyhDM8tYYXC4ZvaZXh2TzGzd0Y+GRU0rcArEGpVadt5hRTIY?= =?us-ascii?Q?GF6sBIlS27XpeyLcpQTNsrdokDnO6KvG3ED6iVrvj/r1a8FZZ9HOYIDnFWcT?= =?us-ascii?Q?Ob89Ewl8yPxkspPoL0yDS0Oy1obYc2k3XIM4dG1ucfVEc27dsyxu0urY/i7u?= =?us-ascii?Q?fFkW02gs/CZGpO/pLXnFcat84zY1iwS1fDqfVN82HvBPop+wAVGx1NtPIDc+?= =?us-ascii?Q?Dm03A88y20fbhBmtSLC7bIAfraz1RGDXT8QT+w2w4QVmVzkZxYrKvxK+ScUg?= =?us-ascii?Q?Xt8fSQ0mHeIEwsBKnvQHh/EGxaPQJS+QK0XCTz0EY1jk0Yd4AtTNsv7Y8ExW?= =?us-ascii?Q?pw30M2dqdb3co4fBXJEr9Anz?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: b6615fdf-9be6-447c-0966-08d96d640a14 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:48.4787 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ZJOWGQu6L42GyKAhAlU8szq1wRumC3Ou/RsjCvPE56gqKHB3TI2aTSrmgdud5ed7+LO3fuMLlXtbWv0L5YlElQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4415 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: TprUZDy95XlwRn2enofMa6Zux1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513075; bh=izy4NgeS1tyntXp34ZfM2unfgY8NQ1yK5dh6bZmx46o=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=KDAkFaFYLgYIk8QQVMnj4BplZPbSBFMx1h76Ikn66+OzZuu8bjBhMZwJmPAEyJ1JuEn irMEx8DNL9JN9hEGVKJX1uhhM6wnQBFv9J2J04gzKruxdmbougfac10EmqvvFUPSrKUwz IGKffgJgQDCuU4KKFmk1XC0suSDBhNmD/Z8= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513077186100046 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 The VMM launch sequence should have pre-validated all the data pages used in the Reset vector. The range does not cover the data pages used during the SEC phase (mainly PEI and DXE firmware volume decompression memory). When SEV-SNP is active, the memory must be pre-validated before the access. Add support to pre-validate the memory range from SnpSecPreValidatedStart to SnpSecPreValidatedEnd. This should be sufficent to enter into the PEI phase. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/OvmfPkg.dec | 5 ++++ .../PeiMemEncryptSevLib.inf | 2 ++ OvmfPkg/Sec/SecMain.inf | 3 +++ OvmfPkg/Sec/AmdSev.h | 23 +++++++++++++++++++ .../X64/PeiSnpSystemRamValidate.c | 5 ++++ OvmfPkg/Sec/AmdSev.c | 20 +++++++++++++++- OvmfPkg/Sec/SecMain.c | 7 ++++++ OvmfPkg/FvmainCompactScratchEnd.fdf.inc | 5 ++++ 8 files changed, 69 insertions(+), 1 deletion(-) diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index 41fffd6d3bd9..d040ee02b94f 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -358,6 +358,11 @@ [PcdsFixedAtBuild] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpHypervisorPreValidatedStart|0x0|UIN= T32|0x56 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpHypervisorPreValidatedEnd|0x0|UINT3= 2|0x57 =20 + ## The range of memory that need to be pre-validated in the SEC phase + # when SEV-SNP is active in the guest VM. + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedStart|0|UINT32|0x58 + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedEnd|0|UINT32|0x59 + [PcdsDynamic, PcdsDynamicEx] gUefiOvmfPkgTokenSpaceGuid.PcdEmuVariableEvent|0|UINT64|2 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFlashVariablesEnable|FALSE|BOOLEAN|0x10 diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf index f4058911e7b6..2b60920f4b25 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf @@ -58,5 +58,7 @@ [FeaturePcd] =20 [FixedPcd] gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedEnd + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedStart gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpHypervisorPreValidatedEnd gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpHypervisorPreValidatedStart diff --git a/OvmfPkg/Sec/SecMain.inf b/OvmfPkg/Sec/SecMain.inf index 9523a8ea6c8f..7e2668ff2f66 100644 --- a/OvmfPkg/Sec/SecMain.inf +++ b/OvmfPkg/Sec/SecMain.inf @@ -51,6 +51,7 @@ [LibraryClasses] PeCoffExtraActionLib ExtractGuidedSectionLib LocalApicLib + MemEncryptSevLib CpuExceptionHandlerLib =20 [Ppis] @@ -73,6 +74,8 @@ [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdInitValueInTempStack gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedStart + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedEnd =20 [FeaturePcd] gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire diff --git a/OvmfPkg/Sec/AmdSev.h b/OvmfPkg/Sec/AmdSev.h index adad96d23189..33af32b9925b 100644 --- a/OvmfPkg/Sec/AmdSev.h +++ b/OvmfPkg/Sec/AmdSev.h @@ -69,4 +69,27 @@ SevEsIsEnabled ( VOID ); =20 +/** + Pre-validate System RAM used for decompressing the PEI and DXE firmware v= olumes + when SEV-SNP is active. The PCDs SecPreValidatedStart and SecPreValidated= End are + set in OvmfPkg/FvmainCompactScratchEnd.fdf.inc. + +**/ +VOID +SevSnpSecPreValidateSystemRam ( + VOID + ); + +/** + Determine if SEV-SNP is active. + + @retval TRUE SEV-SNP is enabled + @retval FALSE SEV-SNP is not enabled + +**/ +BOOLEAN +SevSnpIsEnabled ( + VOID + ); + #endif diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValida= te.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c index 69ffb79633c4..253d42073907 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c @@ -27,6 +27,11 @@ STATIC SNP_PRE_VALIDATED_RANGE mPreValidatedRange[] =3D { { FixedPcdGet32 (PcdOvmfSnpHypervisorPreValidatedStart), FixedPcdGet32 (PcdOvmfSnpHypervisorPreValidatedEnd) + }, + // This range is pre-validated by the Sec/SecMain.c + { + FixedPcdGet32 (PcdOvmfSnpSecPreValidatedStart), + FixedPcdGet32 (PcdOvmfSnpSecPreValidatedEnd) } }; =20 diff --git a/OvmfPkg/Sec/AmdSev.c b/OvmfPkg/Sec/AmdSev.c index 054f19216f1e..a626dc3943fe 100644 --- a/OvmfPkg/Sec/AmdSev.c +++ b/OvmfPkg/Sec/AmdSev.c @@ -55,7 +55,6 @@ SevEsProtocolFailure ( @retval FALSE SEV-SNP is not enabled =20 **/ -STATIC BOOLEAN SevSnpIsEnabled ( VOID @@ -247,3 +246,22 @@ SevEsIsEnabled ( =20 return (SevEsWorkArea->SevEsEnabled !=3D 0); } + +/** + Pre-validate System RAM used for decompressing the PEI and DXE firmware v= olumes + when SEV-SNP is active. The PCDs SecPreValidatedStart and SecPreValidated= End are + set in OvmfPkg/FvmainCompactScratchEnd.fdf.inc. + +**/ +VOID +SevSnpSecPreValidateSystemRam ( + VOID + ) +{ + PHYSICAL_ADDRESS Start, End; + + Start =3D (EFI_PHYSICAL_ADDRESS) PcdGet32 (PcdOvmfSnpSecPreValidatedStar= t); + End =3D (EFI_PHYSICAL_ADDRESS) PcdGet32 (PcdOvmfSnpSecPreValidatedEnd); + + MemEncryptSevSnpPreValidateSystemRam (Start, EFI_SIZE_TO_PAGES (End - St= art)); +} diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c index 406e3a25d0cd..0d80494b062c 100644 --- a/OvmfPkg/Sec/SecMain.c +++ b/OvmfPkg/Sec/SecMain.c @@ -847,6 +847,13 @@ SecCoreStartupWithStack ( SecCoreData.BootFirmwareVolumeBase =3D BootFv; SecCoreData.BootFirmwareVolumeSize =3D (UINTN) BootFv->FvLength; =20 + if (SevSnpIsEnabled ()) { + // + // Pre-validate the System RAM used in the SEC Phase + // + SevSnpSecPreValidateSystemRam (); + } + // // Make sure the 8259 is masked before initializing the Debug Agent and = the debug timer is enabled // diff --git a/OvmfPkg/FvmainCompactScratchEnd.fdf.inc b/OvmfPkg/FvmainCompac= tScratchEnd.fdf.inc index 46f52583297c..b560fb0b8e4f 100644 --- a/OvmfPkg/FvmainCompactScratchEnd.fdf.inc +++ b/OvmfPkg/FvmainCompactScratchEnd.fdf.inc @@ -63,3 +63,8 @@ DEFINE DECOMP_SCRATCH_BASE =3D (($(DECOMP_SCRATCH_BASE_UNALIGNED= ) + $(DECOMP_SCRATCH_BASE_ALIGNMENT)) & $(DECOMP_SCRATCH_BASE_MASK)) =20 SET gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDecompressionScratchEnd =3D $(DECOMP= _SCRATCH_BASE) + $(DECOMP_SCRATCH_SIZE) + +# +# The range of pages that should be pre-validated during the SEC phase whe= n SEV-SNP is active in the guest VM. +SET gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedStart =3D $(MEMFD_= BASE_ADDRESS) + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfPeiMemFvBase +SET gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedEnd =3D $(DECOMP_S= CRATCH_BASE) + $(DECOMP_SCRATCH_SIZE) --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80098): https://edk2.groups.io/g/devel/message/80098 Mute This Topic: https://groups.io/mt/85306680/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80091+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80091+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513071999793.7019323633624; Wed, 1 Sep 2021 09:17:51 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id TLo9YY1788612xWTJUVuq2w7; Wed, 01 Sep 2021 09:17:51 -0700 X-Received: from NAM10-BN7-obe.outbound.protection.outlook.com (NAM10-BN7-obe.outbound.protection.outlook.com [40.107.92.47]) by mx.groups.io with SMTP id smtpd.web09.156.1630513070864767401 for ; Wed, 01 Sep 2021 09:17:51 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ObrlQW4ZD+ENC3okIkgYT0S1n9OC9ulNF/yXT4MbOfhHoDejD/TCMcuLrm/h1NTk3+K1vBrXRaH0xa0eeNUQZLUeaBfXi2fmJd4jVeZH3uGsRAQy+ssjWMIploDxnPRrkQ20gKlsTog6KtZF+n9Hnbt3iqqs406L1MKLO/5B6A1UfBd95UpesLTvHvi1b0VIGojTBuHD9pqtR8+mC1QbrR7moqRJr8YxGg7XczO4teMTF0RwX6MBTuXaKQcV/vgQ+OxKLg2ryURHBYzDoFjSshgwHUAh6x4PnQl6bV71MRngfg6DGRBuy2zJOf7HJvxwkrsxiBUxAOZr60VY7HyxdQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=DsiqL6lXqdDzE5DdKVAH5kfSLlSq2pUpnC479AE1x6o=; b=SCnbekEBmUh0jc7QrZ8r30BiEa1P2AMmzSN3HpJw0Lud8a4ndiQRrJFvW5nZ7vicNtJ15fpvd1r2HD86c5JM67VkLC0c8JHWOPnlLmuPLgoU4dgd10kPYJ2i+iG0sfBvL/af0Zyy1Lm/LUAisbnbG9I/hh11o/kOoiXqJr5l5+QTynCPC5EH4VvFS1caQ21LStu8l/inHCB+mVKKNbruUSrGNAhz+NafOc2MD7CqI9ods5sSDcoe9ld0pD1kdB5TOaiAoV31OgqqDGRow3oKZQt19esW3XhVAp4vOibIpgSeTPuo7Yqs5mJ+cP8Nl1iqFPEKzrJGzZByckBfApbgfg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4512.namprd12.prod.outlook.com (2603:10b6:806:71::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:49 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:49 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 19/29] OvmfPkg/PlatformPei: validate the system RAM when SNP is active Date: Wed, 1 Sep 2021 11:16:36 -0500 Message-ID: <20210901161646.24763-20-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:48 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 41835aa5-06bf-4f4f-df34-08d96d640a7d X-MS-TrafficTypeDiagnostic: SA0PR12MB4512: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: 1B10rzsvhG+wdDd7R6XhvZYx+a3ZvmHjhC+ewdhwGF6RVwL3qHVWHOQS3JPToDNs7gP3YEgFltXq/uPt6Tg652XaOxbTpLb5cUgc4nI0l1bQfeyG0TRFozSW91iLJwoICTeyF3ks2bMQhztUBULo8d7lJ4uehLlozXYl4FQgTWSm39J2pJAeXK59+J2meds3FUc6RvgRtLcUzOyG9C0j5UwSv/dzZEEyXQizTqmvOWcWR0ySbp1jLuyzx0sK/IsGVKf/mA7+WeT5VtDH3ARbbBwDMvmYIgCG3DO1UsHo91ywdQfzcG951biCEsA9aRP1Pttrwvg6VUHS+WYC6tHChLoIhLOuCgJ3eMfCby/P/H1VNo+SP0xNJnLXcW3kLvS0nmR+0BGa9X1pacesD30vtfmkZ/VSS2rc6cEw3RkEGH1GNX87ZwaccAm+1lIjmmfQmdKn0K6poOkFSTFB7F2aEaUGxJTwBcmcbPDkaOjb6elrXWQod6oQjYs/RspLwnoJ8gOxNXG4XIMv0NZPkCAgqYNxUV5eE+qIRIVxyFOmG7kDhdPBzZEyO6VpMfOJpwmkqnR/O2UrGqefpZmTNjh9rMjKDG35001AAeQzl6e54JUx+bb7zlzPGICfmZ/tnr2Y1fAAgqXpCg08GPPpRgoivjpc3CNKpXgpSZIvH+CbxVoN120iE4xTwKRhbeLt7DItwW0GmS+NjfxhSR834UxpL11dortdipEjkX09QDHSsWLo5Ws44hnYDdfJNFKXX6S/Lu9/buthaTiDiS3gvqMnlg== X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?VfXuvEt5WxBB0lsB6RVuORRgKXCizALg+Xkp3vo8i9xT73p+0/wB4nIL0A5L?= =?us-ascii?Q?4j8mvX2Dq9NFGzFuZ2GhQra5Xu8PeoOsmUGUslONYPY+SNbQ+WceTTTQlSnd?= =?us-ascii?Q?j9fpHzUos54Ah+nGSUNIog9ZVlIdMSrfmZb+IX5ptehLMZEt2Qaga62e6ChA?= =?us-ascii?Q?7tw9P7LzfzQ3IzvIihDHDQWSz0idbeIzhVrWJbZmfKm7lrok6+W/iqx9c29O?= =?us-ascii?Q?fcZe7zEaDrW0C67L0gBvkq9kNidYD7HLJkof/fhBBbef8xRFIDMZJ7LF7aPt?= =?us-ascii?Q?QCt5PLeZbsHX7/9ynRMVCWjEBxGlRdndQrpRRdYyykROCm9aFH5nOW2syIxd?= =?us-ascii?Q?gzcWSQSaqHpHG+F+iFnZSf459CUyHeiRpnho6TRpkHAB1ngA1Ucuoh3ND2bw?= =?us-ascii?Q?QX0Wvi2re96cJ845CXmb/V1OyVIsHy8d/2F3O9z9lGWwwAp4N+v9lYq/G6tO?= =?us-ascii?Q?ndO7/22kGhwD511+GKULS3Rfp+fgWRf1X4xuqfcDGxhQAK8/TCf9YGpjd225?= =?us-ascii?Q?kIwkOnqzz7O1xcTARJF2BQzEYucVuLXNUODRKhqgrbzCNNJSZYcvv6uGuks2?= =?us-ascii?Q?D4MFZfC/igg6jOoDu8O+aYem37DAmIXYiFgDOMa9+JXaIvtZtbIHk1RxTtLh?= =?us-ascii?Q?GRmP/omHzkAG5jop7CUsGPtpCkqLOjp9NS2gEgTSQrzi3mazVOprsBB0FmFo?= =?us-ascii?Q?DQd0E3W/Jrq1f6NOFjfpqxD1BKzpOBxMycl0b5bNyVWmXn6CI31yJlCeS7iA?= =?us-ascii?Q?OYHosKlits6toqNBuAdtuXLPJUUS/jm5tBJoVoZHEk2e4bJe5qWNemjNFLDL?= =?us-ascii?Q?9LFUbFtSL2hBlc04yDlfrWOE010BhU6ffx9VeGRPQxbgztSBV27w6FX+B0tG?= =?us-ascii?Q?Vtt+Pw0RIosAsedx8Cih653Ql6aBrY0jqOjm5rgoVUu5eISNF8uaR4QGcKUc?= =?us-ascii?Q?jZZQJGszTrugapi+f9rrmXsbyYHI8Builvj+/HVOvxnWXpyvjlTkd20gz0wq?= =?us-ascii?Q?K2fYK9pRqZj1bZduF869tMTh+Y/mD2LlfciHsnhqFnbGm5G1JsP1auU/Oyxe?= =?us-ascii?Q?BNxEt1DvTJvXNw9UutVQMa8e/AciIr77OR6ykg6bG3G01sCwVNjpvuPDr18K?= =?us-ascii?Q?V+MxaOS5EGQB10lVRFQkvWgfgMJNkN6Ck2ZqmFS7FpXrdJCacEeBbhwpdPih?= =?us-ascii?Q?3DkM3TyttR5A0UF28VMav2QgIhSNWgizHnWP/umW9/w1kkPEiWenk6rCiFCf?= =?us-ascii?Q?olfa61MHKFl8vsfIEdvVRHuzjR7XXf9lSkv7Oz/CJE7jc8QZX5PfgBwQXe6z?= =?us-ascii?Q?cetMPKamRqik92HgjV5hWCmX?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 41835aa5-06bf-4f4f-df34-08d96d640a7d X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:49.1093 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: NDaaw7igC/Ty2InqERP2KqM1Igwg8ZajASv2OGLRV7LXT+UZpmwgfKm45ZZ0EUW2uI/5NRLgFntz48UZD2/i0g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4512 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: GuVoHknNc0L7xyFePbwSNZdvx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513071; bh=XSUrXXKoT5sJTNCyZGX9iLbRXx0N7G1L12YIYeh8lTI=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=WOifjywDodHnxXgucNxPTC9yUXDy/PWiTsGwEIKJ8/I3TAOYgJkeqxD9Zy9ZgirUPB6 YaVFlmF5JhYL2yUN0Jo0YRL0pIAUYuRUtDP1Fwrk10ap9tqyZFmaa2e21Hwg2GTGoDfjl D7yPQu2yWVOn7WuCfHykDx8GRGL03McnKco= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513073069100019 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 When SEV-SNP is active, a memory region mapped encrypted in the page table must be validated before access. There are two approaches that can be taken to validate the system RAM detected during the PEI phase: 1) Validate on-demand OR 2) Validate before access On-demand =3D=3D=3D=3D=3D=3D=3D=3D=3D If memory is not validated before access, it will cause a #VC exception with the page-not-validated error code. The VC exception handler can perform the validation steps. The pages that have been validated will need to be tracked to avoid the double validation scenarios. The range of memory that has not been validated will need to be communicated to the OS through the recently introduced unaccepted memory type https://github.com/microsoft/mu_basecore/pull/66, so that OS can validate those ranges before using them. Validate before access =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Since the PEI phase detects all the available system RAM, use the MemEncryptSevSnpValidateSystemRam() function to pre-validate the system RAM in the PEI phase. For now, choose option 2 due to the dependency and the complexity of the on-demand validation. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/PlatformPei/AmdSev.c | 42 ++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c index de876fdb478e..391e7bbb7dbd 100644 --- a/OvmfPkg/PlatformPei/AmdSev.c +++ b/OvmfPkg/PlatformPei/AmdSev.c @@ -23,6 +23,40 @@ =20 #include "Platform.h" =20 +/** + Initialize SEV-SNP support if running as an SEV-SNP guest. + +**/ +STATIC +VOID +AmdSevSnpInitialize ( + VOID + ) +{ + EFI_PEI_HOB_POINTERS Hob; + EFI_HOB_RESOURCE_DESCRIPTOR *ResourceHob; + + if (!MemEncryptSevSnpIsEnabled ()) { + return; + } + + // + // Iterate through the system RAM and validate it. + // + for (Hob.Raw =3D GetHobList (); !END_OF_HOB_LIST (Hob); Hob.Raw =3D GET_= NEXT_HOB (Hob)) { + if (Hob.Raw !=3D NULL && GET_HOB_TYPE (Hob) =3D=3D EFI_HOB_TYPE_RESOUR= CE_DESCRIPTOR) { + ResourceHob =3D Hob.ResourceDescriptor; + + if (ResourceHob->ResourceType =3D=3D EFI_RESOURCE_SYSTEM_MEMORY) { + MemEncryptSevSnpPreValidateSystemRam ( + ResourceHob->PhysicalStart, + EFI_SIZE_TO_PAGES ((UINTN) ResourceHob->ResourceLength) + ); + } + } + } +} + /** Handle an SEV-SNP/GHCB protocol check failure. =20 @@ -240,6 +274,14 @@ AmdSevInitialize ( return; } =20 + // + // Check and perform SEV-SNP initialization if required. This need to be + // done before the GHCB page is made shared in the AmdSevEsInitialize().= This + // is because the system RAM must be validated before it is made shared. + // The AmdSevSnpInitialize() validates the system RAM. + // + AmdSevSnpInitialize (); + // // Set Memory Encryption Mask PCD // --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80091): https://edk2.groups.io/g/devel/message/80091 Mute This Topic: https://groups.io/mt/85306672/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80093+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80093+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513072986747.3516284275713; Wed, 1 Sep 2021 09:17:52 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id T5dwYY1788612xUGvdfr8s39; Wed, 01 Sep 2021 09:17:52 -0700 X-Received: from NAM10-BN7-obe.outbound.protection.outlook.com (NAM10-BN7-obe.outbound.protection.outlook.com [40.107.92.47]) by mx.groups.io with SMTP id smtpd.web09.156.1630513070864767401 for ; Wed, 01 Sep 2021 09:17:51 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kOWsE7UAnjYLRNOvwHbjyWYV8j37JzwaGDwXprmusWOnrfv2W93Y08B8WHE10UsC8geO4R6Q3BbIQnLIUSNK4v8sIfLQ5CWZGG+bE7+qGrUlPDYFe6wVWIILIPJ+i4Ssnob3MhkOVEKUXykN5qD5GIEvqKV+m5ZUV4HkC1RAO0Lw1G8TC4HRNcV523qT3QZICjd3k/HD48hfQ2TFNVgpNO9T5vQE7bUDZxkCZJHg1SIS//cQMD8XfSXP0oRrkQEWgdL8nPA6UN030CPWa6DTpIfJ+ei1NlrHFWVKDh45YJaapXS/i51fNCEEIazk7pf3hZ6SDBkYELxcZWWmuXnQmw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=jbglhkrZMH1ZVWNCh6Kk83BlMnocdUoPvNUvfVoyczY=; b=IA7nGWD/gsF9kAkfdKzxMESDMfLMJZ3Tofr/bvgOyfqTPKGKCJPmbi+HVZO/ov6s/E6oRJct8nGtavd9/fLRFialRKqipAIGro0YIY1BwJhewPIJ8Q/ErF50VPL7u81HCwrB90arQbKCT2QX5GdiIGDSlzb0t2lTKielcb4JvPeDAYjh+wKxk/TEKw2m6H6jr15SIj4c6Vai1epJh/q1fiIdRtU4wxUmmu/sp28mSz0lnv8cH9XQkzD+mvkAvZz7kp1pOvo/p6BYRken81KrF1q8nTI2bM0hXyrzi/+viV6uDqbJS1S3XaknTSI9O9kXOB3b99Ez2btWzn5l7+KkMA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4512.namprd12.prod.outlook.com (2603:10b6:806:71::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:49 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:49 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 20/29] OvmfPkg/PlatformPei: set the SEV-SNP enabled PCD Date: Wed, 1 Sep 2021 11:16:37 -0500 Message-ID: <20210901161646.24763-21-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:49 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 09679de5-0555-4ca9-d327-08d96d640aeb X-MS-TrafficTypeDiagnostic: SA0PR12MB4512: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:2000; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: Q9MfPZEQypPQ9URCUZg51GdotACJ2gf4IES6hIwlXqk9vKJjhsMLM4Sv9JndRsXG/0SWlwW/WeQApE45yg1SKDx+avnqsL/N2EkYpD2p3M8vX0/3l/2M0YytMNIIOjeaqocAsjDcH2iFmrBmuFxnVQPX92Uw4o2RZfLR3a9Aw9AV8c0I+J1Di35c5sHx4CXpX0uX9z/zNy0Hl5NQvtf0L9u+7A93epWC3p2eIaVgHGoBpPe1sLmVgIpOEY27zLLZeMpTOko5AV9g5JU9PzvwIsRLXPPheN4FzNBX0ww2eVsPH/v71ca5U+YrW8DPjEfp9RjRvRwdoiB8K2yudDp1E4ZkrPKvcuPAU5OEgBHM2l5N+6wzjD8xEuhoAXSIB1dK3ws8zqhN65YJ/9oY2+5gmBI4Mpy09h12cTn+c/SdYdHDLrYBRaCQpuyOtK7rRFBbrznIOBVtSvyyFkbJ67ZnqAGC+Q5B0MSKweEFPwdy0MV0RdQW/n3k1E4Uw0xMKWe25cw+bUChSjY75hvQZreUD50RphQr36RM0ihc+64934YwaIfxL0N/dG/We604RRiJGDNg/Aq+9h08pZKA+YEgcITcFgHscPUHUndAx933ilpWJwIMoQcGFoiEHm4h/Ma7RcGFeU/U0jvm4EWLbbUjxcJmcVKeKslWbVpHCn7HQ2gr3lTiddZAv3RH3GJtDMIkqm146rl4mu/0ItPj1c757JN1CrWc/6geC08hok9Mu+9mrtk8fWWxvzRrO1iNVUKXOAKcNugdgDxBX0xruTM6fiTIUL0EcCSd/MCZ6aq734s= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?+qjjoMRoKetEfwwGVN0uE1X3OLFoNNibdg4KJ+0dda8zNT6II0+o1jJe6Tf1?= =?us-ascii?Q?+vt5kbcFPtnJ2ARRsEipUxOlg7D2ccWoz5iVO9zX5hcycRJZqo3jehaCY99U?= =?us-ascii?Q?sOFLPoKJ2IEFcpBZkL6FsZTDyRHHT3o7LyK06o8XpvPBDCJrYfIyNOGfJZ52?= =?us-ascii?Q?+Wbp0qosok5VBFO0S283oicNptuJsXt6ng6XtsQgZebgPUeV8JIklN32iyMR?= =?us-ascii?Q?R+eCEbcfecrJBjWmAWRMihVXM7e74YfbwLnrBfQqboHWJqvAez98SQoerVkl?= =?us-ascii?Q?qt0ICACpuCi1f6EMJDUdbdvoMUPiOFej8lCJsuJRKCmMm4+A1CKViyDDD/s+?= =?us-ascii?Q?oTP/RHiXcQxegtrneMBxxxu2I4wy8C1A6fNTA0AWqaZFZYUD0wu3wf4iRoq6?= =?us-ascii?Q?iLeUA6oVsgCb7vatDQjRE/oano8+u6EUIzLR9+iqdDnSlxDHWrnk+FaXf3dT?= =?us-ascii?Q?dB/T0vePk0+l8w5/gOPWODLjHbT9Pux3vex2XzMwTtguTqFh6ETehCbHQNGB?= =?us-ascii?Q?dNZ7iqKzYwvse4Hn94NJw0TTsOPkdKLBKeLHY3b19vyEl88vKUDjTDiB0eTL?= =?us-ascii?Q?1IVl98jPA4dPHfr+XwNxL0gIvnlmJwkuwOdj8cEfOMAoUDQ11jQY52UjHOpy?= =?us-ascii?Q?+8fqpl6OwJxCYeexzp9ULpmAul/He6BTxyWfvbkStHxfLDutvcUPYPj1HbQC?= =?us-ascii?Q?pAihyhZ58Wa+5YzNa/WOdBlGMAOsQd55+4xM2ZbCEVDoGEepmOJva4InIHHk?= =?us-ascii?Q?JXASPkKadvoq7Pp+jkuqiIf3F4mmGTcRlFGWAHAgiJAFa3cFS2k6PuUJ4gGL?= =?us-ascii?Q?qQ2fDX6Spn1G/o0xGUZd88VeMfTdwTYe78TvTuXajlJW76tMmrJ0DrYqnvrs?= =?us-ascii?Q?rU53XO5KKoC7TanaYtrYvBdJ9G+2i2vdRXAco4ud3WBhBGGGYVrSOdDIZePp?= =?us-ascii?Q?72bV6dC5PxTGqv9yuXQpCkkEPSfAOP/GJBUy+05n0CTqfT1ZaicnZOTyp+f8?= =?us-ascii?Q?rVRLuHQpPxk1byYsbj5m4VxluH7XLuNludr+d4VYyYyLrXfdvdcn1ASQbmr5?= =?us-ascii?Q?PrRuKR3yGdZ7n9TS1H/BrS5zVDgFObjBssejGzBzwK5Gy0H56No+/EFGnSW6?= =?us-ascii?Q?ApWeeqIleIkxiowbIXsVEfHjKi18vwLWDG6onK/O/YI+O823XXAUgcjWQx2l?= =?us-ascii?Q?/SCV19ORUmXN/M73XOjo29X4uhEcFvyyAeJhpxedsKEQIAmcojsyuUi0xYe5?= =?us-ascii?Q?08UaWENRWxjeeMwPG2JykUr6wSa+TJaC+R/RTuTUlvYI0s4fq45zWak/0ESx?= =?us-ascii?Q?nnqmtpBXnnPnCUWID7Qv2rcJ?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 09679de5-0555-4ca9-d327-08d96d640aeb X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:49.8539 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: AAadJBbxMOg1qxbYku0S2M6ZqGWyocyRno+tYbi84ku7Ap2NA3DNH/5QhCIwdwpPa8ZTr8oRs3Iv5BLAlDWasw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4512 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: 5xhS5Z24nHhWRFRDBBYMoynRx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513072; bh=LI6uaWKbGWGFYhvJPnkjOG6d52D/heE1fZ6kiJxUO8s=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=sBd8WKIpA0xA1GbXS/WU4PZULe/hSuPjBIO2Dm/w4Jat+YeBprTnMTa5oqfPiTakXGs GOtV2pOfdUSpHH5b9Aml6YzqvC2zkqEnEOcj6Rz3E50ftNyQb6tdlzJJlvLIqnp9kKHRP cyTmiMRbUoqK61aFlwXdlV73i5H/8N65540= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513074206100030 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 The MpInitLib uses the PcdSevSnpIsEnabled to determine whether the SEV-SNP is active. If the SEV-SNP is active, then set the PCD to TRUE. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/PlatformPei/PlatformPei.inf | 1 + OvmfPkg/PlatformPei/AmdSev.c | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/Plat= formPei.inf index 67eb7aa7166b..c8c89ab648d0 100644 --- a/OvmfPkg/PlatformPei/PlatformPei.inf +++ b/OvmfPkg/PlatformPei/PlatformPei.inf @@ -106,6 +106,7 @@ [Pcd] gUefiCpuPkgTokenSpaceGuid.PcdCpuBootLogicalProcessorNumber gUefiCpuPkgTokenSpaceGuid.PcdCpuApStackSize gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled + gUefiCpuPkgTokenSpaceGuid.PcdSevSnpIsEnabled =20 [FixedPcd] gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c index 391e7bbb7dbd..ec577ef3efcc 100644 --- a/OvmfPkg/PlatformPei/AmdSev.c +++ b/OvmfPkg/PlatformPei/AmdSev.c @@ -33,6 +33,7 @@ AmdSevSnpInitialize ( VOID ) { + RETURN_STATUS PcdStatus; EFI_PEI_HOB_POINTERS Hob; EFI_HOB_RESOURCE_DESCRIPTOR *ResourceHob; =20 @@ -40,6 +41,9 @@ AmdSevSnpInitialize ( return; } =20 + PcdStatus =3D PcdSetBoolS (PcdSevSnpIsEnabled, TRUE); + ASSERT_RETURN_ERROR (PcdStatus); + // // Iterate through the system RAM and validate it. // --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80093): https://edk2.groups.io/g/devel/message/80093 Mute This Topic: https://groups.io/mt/85306675/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80095+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80095+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513074346343.8330159976442; Wed, 1 Sep 2021 09:17:54 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id DNFpYY1788612x80jeF8nH00; Wed, 01 Sep 2021 09:17:54 -0700 X-Received: from NAM10-BN7-obe.outbound.protection.outlook.com (NAM10-BN7-obe.outbound.protection.outlook.com [40.107.92.47]) by mx.groups.io with SMTP id smtpd.web09.156.1630513070864767401 for ; Wed, 01 Sep 2021 09:17:52 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HZSCF9JHYojYCRRZo+l3+IBr6eb8VW6Ptnt5nmVW/Kw7E3zPlqDgHeiG3P9ZlfcQ3wt9YW3O7rQH10rPJN3t91VCWP8YAySEesLpoT3qAoM6HcoKNPSiwKwtHvmEqTafWxG0tHUnPhDJzAUAeJsdD7NLq0XgvdgLNLemyjEVImhVn5gwByvTLXNUWAjOXndM3axbqVgMOFuYe0y5Fmvrbv3DXhkmc+d6d2CJpOtdBuVS80ie4gGc/ba0uE70+M4+dy8DduqW1KbIi0/P8+xYn9drGIKbFsANwv8Y1CmCwlrqxgrzUO7IwpV1VvEgKHlrmonGtho4jo5IHqSZPSSctg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=9OrGPvTZvfeDqIruWJry2xwW7hUkqVnvvrCbg9Y4xE8=; b=L1zmDDlkxwdDLq60ap6VvtJ5/weLpDr6ujI7ep1lddSV76K99u7ujoUtp5yi8VcLtgkIib+3Cj0rJ8aWBQr6EnfFPBVX8F8jTlLX9g6hWD7fnFxhRpp8+bSLdUv69GVbIAEoRjFjo/Ey9/V0zGf19w6VpogbmlC/5XwlpLWHG//ZIEw7fjp7It4EM7+wEa+QNlc/FkjQ6oi4jDv4BI8waIIEMcvI1SNAcfRuc95cAL9w5cQc/hdCC6RJIlo56PvoB4Z8RA8JL/xAEB6DzgY55xZvyWiFxnp6xtGhYrieaWL8SzMSHdu1PKbQ96Sox/3brpUITkf1sjbYfToXXFIMDg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4512.namprd12.prod.outlook.com (2603:10b6:806:71::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:50 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:50 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 21/29] OvmfPkg/PlatformPei: set the Hypervisor Features PCD Date: Wed, 1 Sep 2021 11:16:38 -0500 Message-ID: <20210901161646.24763-22-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:50 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 4e21b71f-6f8e-4f15-5658-08d96d640b57 X-MS-TrafficTypeDiagnostic: SA0PR12MB4512: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:3276; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: eCooubiJUDyQAwVNPcdfzrHJU76pYoQq5i+V/JVIq0TjkGtS7zPDGhrl9wZ1Ilpkuvw+pxwE7ablExzpKqlv+tGBt2vSE8OAKZ6V2/91/GdhZgG75lx1dQ0UOZ0WowHVb2q7wIskgBNaiwceaMbzhGWq0L0CEVYgKkAgYPzxk/BXo5HgQFxzZpxPNGDiHop99QyycWT23xZdepmgM66yXch+PMfWgEnk/LNLeGEBabtnwIZ0MFi51qUoQ2SCzVN5R1wvMd5qCf+BwZdkx1h8WhxrH+772ZTZNKKbMvsL7nqIESGN3aILb+OtOyxeKU9k/4SujkEyJduRK7X+/lenc+ddyavql19s9ulik9ivE5fimWuFPIQZVS0eoVkFwJLFZwQh18DkANA7lPUuRgWhrd4iSbIkxvu9gsBRsJwZiWQ4TF4Wrws0fXsChCSLFT4FJNYQ5VSVQsS6kYYzip2LYwaZrfqg8LEwCXeZ36JJ4AknBBYLhdkbAph6UfAmKpdRNKaxlWWWrpYE8ZmIAGy+WAlHZC82kNn70J4m14pQlg5EEi45FrT0k/JYzaWU2MUNws3NSNcc36qiNk3n2KgGXek8durZrtCsyGeMoLF1h5D+qiBeuUQYTBQlvuWrzI25CzqcP3YpghRog+xaeYLzlDdxMoGmCTVbscB1sHCzEV008SdqgpYK5VPG+iH7josUg/oPjxY7LJgVkh/hIS/5plL0yX2IR1e1HIkm8KJZLLuAGU6oxrOeNaMmNAAeRoVe8zaRg2RWBqEl+eY0I5aS7V2zwXO1BB60OY3Q3dqERY4= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?sLVy9ANZIxOKahQkGrUBX0m5CjaSPJld7BwJ19abNzt6C2PzwXolp/ONRRQn?= =?us-ascii?Q?Sk2TtS/pCN2orzNMwXzJcBj2HGB7Z5C2U1xUkimwQvxPycmOHE9Hp/LNpp+3?= =?us-ascii?Q?INsAMMAZn/ot58iijwXMFXNaE75yRTN59cmdxNpqSvIhVj/FpTZa2bvHcxeI?= =?us-ascii?Q?2nV2ibkB7VxiyPhw7x7JOqmKQ8+kslkR12uU/NbYWRo3qbr0OlZjGYtQ7ez1?= =?us-ascii?Q?cRvlHNJCdFovcmcrchtS3wJ6rrSgYEkHLiKNNXj2N0/Yd/HaGQ6sXl1j37tS?= =?us-ascii?Q?afBGKly/cFY/H9LU4a22nwu+N7ttEeIeYX7dwhDgtF9Pj8KVfWDiPog5V6Yy?= =?us-ascii?Q?SJhKNoq3gHlP7L+7lyF+esTPAIUMZGY0c0B8CbLqHM5Ioiwot6mTjBV3x0sp?= =?us-ascii?Q?ghrQRQJyASMNZsME+VWaHaK9tHvHIUmXY4AR/AUsHBsLo/giE7+bhESsTFfU?= =?us-ascii?Q?NjTagfkUqcY0wJ/JVFNFYxvl3jSQWG7y1pvAEwHPl78Q6yyKRkVc2aTh+ONW?= =?us-ascii?Q?F4dFvEZk+qSB2Qyf72UfgMYxa+NixVBG/IPJgueYwdklNW5XtJrtY5SnzJdp?= =?us-ascii?Q?+schPiCj8mQAXk+6+FIKU+ApJSalnpGEBZiorKatDw3xhylpZCFbffp4Oljb?= =?us-ascii?Q?eZoQG8c4p+WR3rQ204E4acdNg2aMzBvm2TgK9gWlMDiwKL0gFiYWkRBWT9o/?= =?us-ascii?Q?3VYI6e7VBGhGG6F8LbKNOHDirpErQYZTEn2WqfLzsceMiRXeWmrMjw0R0PcI?= =?us-ascii?Q?Q2Cl8Ymk4UnOsxDQo2l3p7aoFMpnHTKCgWTaBMpJAXI4YhMHwL0Ob++3WW7w?= =?us-ascii?Q?iqOzZlDB0t/xjKZYV5ahvNeQctm6mKyQwoRO8ReXIgbEUupANZogzwQ/VANA?= =?us-ascii?Q?6LsZOFjwtVWoAp2LTt+eju0i0SEqW2emdCM0vpRKhYnbfc+XL4o4txSLcPGW?= =?us-ascii?Q?C0BgYd8R01FmV1IhCbmUj7PN05tyXY8HL/cbp67TdrNTVWw/8YfmBBNPD+OM?= =?us-ascii?Q?qlC6D8dx+E9vBJO3zAK8fxan4/oTTXW/8fc4UBN+gI3SEDCm/XGHIBeq1OW1?= =?us-ascii?Q?czb5H3JGWEVefwayfyRGR/b95GXWjkVIu4mf5xU1F9MkmsQpuea/FmkfRe4J?= =?us-ascii?Q?BHvyw96YOkjZIIeeX+g1/HZjkIxs2swzDRm5/V3XjXosFSvJZJdSIVazM1H0?= =?us-ascii?Q?MpNhw/ihOOGS8dqrxQqZWBTYza2/YJqzq6kL7LurEUfWT5m9dDEQgehe70UR?= =?us-ascii?Q?YvNvr8OwPCOg8jNDfQwPDz9hx779xBPYUjcKvur3ZFyuuUkTjRfkBz+HYNtY?= =?us-ascii?Q?UCwAw/i1bP9QX2qHWV6rO88Q?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4e21b71f-6f8e-4f15-5658-08d96d640b57 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:50.5225 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: U9zNXRv8a7N3K0EXZIkGQ+t1IvvzT2JDles3pSyo4Yp4ugHaXr8VoBBcX5nJStJhdy1nns+XuCpn0YLvxX5Svw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4512 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: zklLbnaKdW3fXKvzMZi9Nsz0x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513074; bh=oJveG7glDWf1dKKpa5z8//FOzaUzwlGXbpeTAOFExtA=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=JBKVWREOVbOEInbdSo6BH/961LS1WEjMeYKn5L0Jw2RvEcOTJB6ic0WbkAgQoHbV3W7 dAIg4aIbOc1KftPN6PcK5dijfjO1ZNKBkFr3c8Wnj0FpjfCB2vTnlsgd9pw2jvGfjgW0g EItq47cWtospqdQ+uFxsQE8PnlvGpeOR40A= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513075005100035 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 Version 2 of the GHCB specification added the support to query the hypervisor feature bitmap. The feature bitmap provide information such as whether to use the AP create VmgExit or use the AP jump table approach to create the APs. The MpInitLib will use the PcdGhcbHypervisorFeatures to determine which method to use for creating the AP. Query the hypervisor feature and set the PCD accordingly. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/PlatformPei/PlatformPei.inf | 3 ++ OvmfPkg/PlatformPei/AmdSev.c | 55 +++++++++++++++++++++++++++++ 2 files changed, 58 insertions(+) diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/Plat= formPei.inf index c8c89ab648d0..8c9795095a10 100644 --- a/OvmfPkg/PlatformPei/PlatformPei.inf +++ b/OvmfPkg/PlatformPei/PlatformPei.inf @@ -62,6 +62,7 @@ [LibraryClasses] MtrrLib MemEncryptSevLib PcdLib + VmgExitLib =20 [Pcd] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfPeiMemFvBase @@ -107,6 +108,8 @@ [Pcd] gUefiCpuPkgTokenSpaceGuid.PcdCpuApStackSize gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled gUefiCpuPkgTokenSpaceGuid.PcdSevSnpIsEnabled + gUefiCpuPkgTokenSpaceGuid.PcdGhcbHypervisorFeatures + =20 [FixedPcd] gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c index ec577ef3efcc..b488cd5aed9b 100644 --- a/OvmfPkg/PlatformPei/AmdSev.c +++ b/OvmfPkg/PlatformPei/AmdSev.c @@ -23,6 +23,12 @@ =20 #include "Platform.h" =20 +STATIC +UINT64 +GetHypervisorFeature ( + VOID + ); + /** Initialize SEV-SNP support if running as an SEV-SNP guest. =20 @@ -36,6 +42,7 @@ AmdSevSnpInitialize ( RETURN_STATUS PcdStatus; EFI_PEI_HOB_POINTERS Hob; EFI_HOB_RESOURCE_DESCRIPTOR *ResourceHob; + UINT64 HvFeatures; =20 if (!MemEncryptSevSnpIsEnabled ()) { return; @@ -44,6 +51,15 @@ AmdSevSnpInitialize ( PcdStatus =3D PcdSetBoolS (PcdSevSnpIsEnabled, TRUE); ASSERT_RETURN_ERROR (PcdStatus); =20 + // + // Query the hypervisor feature using the VmgExit and set the value in t= he + // hypervisor features PCD. + // + HvFeatures =3D GetHypervisorFeature (); + PcdStatus =3D PcdSet64S (PcdGhcbHypervisorFeatures, HvFeatures); + ASSERT_RETURN_ERROR (PcdStatus); + + // // Iterate through the system RAM and validate it. // @@ -94,6 +110,45 @@ SevEsProtocolFailure ( CpuDeadLoop (); } =20 +/** + Get the hypervisor features bitmap + +**/ +STATIC +UINT64 +GetHypervisorFeature ( + VOID + ) +{ + RETURN_STATUS Status; + GHCB *Ghcb; + MSR_SEV_ES_GHCB_REGISTER Msr; + BOOLEAN InterruptState; + UINT64 Features; + + Msr.GhcbPhysicalAddress =3D AsmReadMsr64 (MSR_SEV_ES_GHCB); + Ghcb =3D Msr.Ghcb; + + // + // Initialize the GHCB + // + VmgInit (Ghcb, &InterruptState); + + // + // Query the Hypervisor Features. + // + Status =3D VmgExit (Ghcb, SVM_EXIT_HYPERVISOR_FEATURES, 0, 0); + if ((Status !=3D 0)) { + SevEsProtocolFailure (GHCB_TERMINATE_GHCB_GENERAL); + } + + Features =3D Ghcb->SaveArea.SwExitInfo2; + + VmgDone (Ghcb, InterruptState); + + return Features; +} + /** =20 This function can be used to register the GHCB GPA. --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80095): https://edk2.groups.io/g/devel/message/80095 Mute This Topic: https://groups.io/mt/85306677/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80097+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80097+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513075456490.0424152394023; Wed, 1 Sep 2021 09:17:55 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id QzttYY1788612xqPMDBxFBZ9; Wed, 01 Sep 2021 09:17:55 -0700 X-Received: from NAM10-BN7-obe.outbound.protection.outlook.com (NAM10-BN7-obe.outbound.protection.outlook.com [40.107.92.47]) by mx.groups.io with SMTP id smtpd.web09.156.1630513070864767401 for ; Wed, 01 Sep 2021 09:17:52 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=l8TgrXKJM4SIRU9Z2TfsdmO0mb5mEgUqmNQRXAyIBDsEMSRqrqjM96OAwRItAJBgIAUShrETRDJQCXt8d5X6ZBFYd1pwUdTh731L1OXUGMf/yt8LJPDu7tDQ25NfpH/mReLKTjZyGcqxYgB27/LZ4igqs82bSa6OUr1RCdvxpFsGdIam/M/4VRe7deDyI7Y42GEITHiNHNK6zaC2Te3mX47RXDaSuPxSiOwIXUr6SnHYpcUXB5sQDZzToZCEFQFRGY2tri8KWwaUfR+/pAyHeHFXTTkExiBJSEFjWolKCuHFVFYcaOgAZBJoh9xIvtsq9kBLgjvDF0d6c9T/LKeYKg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=ge9/2T+eqm4MzGFJ9gvSGI7FuSyRG97OpJG8opzsp+8=; b=AfOHQUG/3J3k1SgiL8znDt/6SNKOZ2niKpvMHfxKFNPbaQh9xxmPOV/MrPMScQvsC4Q+zUxBsUCHVPxDyGmceFJmCr0T7Lfl6Ohr4k1SQlMBj3lWgVq2VKs8E3e1yclkQPePqarGg9g4+2YvJJAu/MCDB9MwQVKEQm0Z28QBa6gXvRIJi0Q1IBiu1u2QzFrJQJkRLHLIVjVyWzZqjQdUXUmjdi6uvwoXOfQy5gGbH6j3Mp5O5GhybbsktLK6wRYeUWi87bC0a1qTjjgnxAZ25tqYIM5dmNLa483v8iJsGG7Hvn2LatkA/wgcLMONimPAG7K8+mkcq/OZT+FcutIzOQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4512.namprd12.prod.outlook.com (2603:10b6:806:71::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:51 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:51 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth , Ray Ni , Rahul Kumar , Eric Dong Subject: [edk2-devel] [PATCH v6 22/29] MdePkg/GHCB: increase the GHCB protocol max version Date: Wed, 1 Sep 2021 11:16:39 -0500 Message-ID: <20210901161646.24763-23-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:50 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 37c4f8bc-3eef-435f-4ebd-08d96d640bc3 X-MS-TrafficTypeDiagnostic: SA0PR12MB4512: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:1060; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: i2UPgCep6UWpTKJmEfyoVOT/M7q1mWO9MPkqnFQdONlApRJGagp5gh1xorTodvFvyzgepJ4YO8Dioku4M+xoIObGedGLG7FVGzXVn4t+qlAnwg3t/clT7tNO392y4TDWr2NuZKDXZkLpBI62FGvS+Z2RAxdQ++l6ppH2iler4XPD80aecn0sqNXkI0tApFSGaVJg9JWJ1l1UQ7XGCiqzT2nbct2EpHzPeJri/JPFxVP2eeIYzypEZDfNuY6cr+xlthWifbbg6G8DPIgf0DH9KDAWawIrGSvgOqLC30JGbZXZoADqx/UgoTuGNFcrkdDHYp36lFqakkTqonizYQUTn9ba27gkjbZVsv4smMkoRVD1lSIhxcDHJqWkkn2S7dQLuCa4rQOeLXzeiDBJu74R+98kDRAUf7UmMj4dF4Npaw2NPPP6eNtBc7FQIyP5leg0eGSofPEDx4fOu7Zv0vYcQN/7n6kTeQQOSL7a5uy8BWprFuf0u5hwTE/bt6d/XF01SOZt4jBrpE84RYXYf9KSDzgyyhRJppl/otJv+IxdHo9PFkmzwpl3zqatQ6hdsOhVGLEZDhFswJGwRW3VNeexUVjED+uL0xz8bBN2F/U0nujWi+iw8xg4w37av9NjjiDtO0QjGMJ2i3NjMH4dw0oFKGwussoSSuzirQplGj0EJ4U0G/0jrac+vWmU2IkSLi3rwibvp0/btROv4oVCsZfX1hrt5vHPX9tef6AaCdybRWrQooboRPjFsan0LkGCctGJwNsT8sOC+CfPZkxj4q7tghu3yQsRRFvH1YDZ9633HYM= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?j0sm3TTzcI2wbrTJWNo7cmXHZ+4Tu8pFnFtPpP7S7MbPqZ/6VZH2Rs8E740w?= =?us-ascii?Q?srAkj6Xgp4eC9jAsGhHbe9fpmEUNabFNSBY4XMEo31/qKSgSZlKTryMKzg7U?= =?us-ascii?Q?joOwn9UVqWierJ7WI8c19B0td7YbAGiE0jMSYCRZ13P85+J/s2nwRunodOIT?= =?us-ascii?Q?DrfZWgSHXJUHZvRdxoTwvA3eVd56pkR6rYaIwgKqx4b6GlAaiPDpUphU0TeD?= =?us-ascii?Q?zdJnwRJQQEL9rMYBUr0X/gNmwvvIKtgxamz02Zgrg4tkmr8Y7RBiZL+czP0I?= =?us-ascii?Q?FfrMWDXmDEDMhXiKZKAXVAJ7dDQOgeidT+Apbue6z3be4m4DPm4y051Tr87S?= =?us-ascii?Q?hCbrf18MMfzNkkHSDexnz6arzhcg8870nZavX/RXRzjXfkC0Iszhss3oksal?= =?us-ascii?Q?GyTMYsg6ZfXvWxFefPlMmLDCNatJxyG8IKN7w1JPCa/uwM94joFsxGvY4paz?= =?us-ascii?Q?bD3oU4YV1cvtgvGcTFkg/Ph11ON669+UqcTPDGbFOuwdIJhxxgBsT+Jvapik?= =?us-ascii?Q?B9xwPhdgygYV9sG2hnk6XZ04KVfw4gsGQahrBO/PqPw6tF3ESOjy7E9SEozn?= =?us-ascii?Q?nKgWjhe8HMD27G5e59O5QXm++z/PkPYZ3yaJBq6A7SlkSQEB9+qfTutFrkUo?= =?us-ascii?Q?Kk0m1QjQAON7rGnnQeLKTQhGaSLaILrCSiEauTned0drvsTL22h7Yfkcowt/?= =?us-ascii?Q?MHi8/1d/mQ19xoP9XJPDtkZquOJHTqVXr10/0Cm79itXoDWPhhGe0p5IAmc+?= =?us-ascii?Q?XuAwbDnw88kVtW0JMY0+3Nmnsl2QhVARfx03IhWL5TmDuU+mBLCrceHhV6Vs?= =?us-ascii?Q?7nZcUOkx4RyAOiXysFjbuXHAtb7D4zQu2npuUTM3k0XlVsJfomgNNcuW6RVr?= =?us-ascii?Q?DOw14Fxd3/N9ZULXw1DcP62AE3/d3d1n5+08aVl2ODPm2z4ovKFmZbi13Lcg?= =?us-ascii?Q?VN05nsBqdqHmCx+hJwsWy7XF/HXuaZ232LhHeBzkqo/LDJl6LZq5YZhPDg/r?= =?us-ascii?Q?j0R+TDhX7yBkfVb1EAo6GVKOWismSs/s1nIjaWuvPGnKwiSwmZ6NSWTsWpcf?= =?us-ascii?Q?veJyEc4XL9dNu6tvHoXmxG55yjte356zIlpsTSEMS4zoSFLC01+kKvY9uHwR?= =?us-ascii?Q?9sm1yvfWxVxjR8ytyw7+aozq7Kx0SRIEE05HxJeBAOqW7BHmr4OQtm+nOukC?= =?us-ascii?Q?w6Jn7RwE8noI6svgdFfJz59TOUL6xNh6k0XOcodDxhKpdU14fwAlADTyHwIW?= =?us-ascii?Q?z47nF6dMoO/wFacVrHLSRwWC+4cSngWqTZ0QKaJxTN/yYd3IN6RPh+iPjPpe?= =?us-ascii?Q?x2hJzOIA5gYwNH/8sbTY43GX?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 37c4f8bc-3eef-435f-4ebd-08d96d640bc3 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:51.2431 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: uiY43w27wiCRXdLyuvz0dHvMBSNSmAUW5eqAr4UIR+IQ80OOmyRlVzDN1xtvK3O7GxjmwnP7UX6b6EJPS9iONg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4512 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: oFUEPQ681KNtNSo0ztmm0G3nx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513075; bh=oFMBE45bqUzhwYOF6M/mf6832lTPJnORYu+91ecaQqk=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=PlDa4xx2x7n5KkkU+X1J9h4uBpu7SlQTm3uI+PgD1wNeco4L1I4NcXb+xmpKx+A++Tj 7avC7pojma12r9dO76X/9lsd3O6cNUEZ12Go77LPLCtOvDUyFxEJMzg8Qt2alIuqwC6et VkBe4CaBY1ihWTbfSgKcn4mZcpLxabSK/rw= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513077130100042 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 Now that OvmfPkg supports version 2 of the GHCB specification, bump the protocol version. Cc: Michael Roth Cc: Ray Ni Cc: Rahul Kumar Cc: Eric Dong Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- MdePkg/Include/Register/Amd/Ghcb.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MdePkg/Include/Register/Amd/Ghcb.h b/MdePkg/Include/Register/A= md/Ghcb.h index 8c5f46e4bb53..071aae0c9e09 100644 --- a/MdePkg/Include/Register/Amd/Ghcb.h +++ b/MdePkg/Include/Register/Amd/Ghcb.h @@ -24,7 +24,7 @@ #define VC_EXCEPTION 29 =20 #define GHCB_VERSION_MIN 1 -#define GHCB_VERSION_MAX 1 +#define GHCB_VERSION_MAX 2 =20 #define GHCB_STANDARD_USAGE 0 =20 --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80097): https://edk2.groups.io/g/devel/message/80097 Mute This Topic: https://groups.io/mt/85306679/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80099+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80099+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513076274566.5086713144631; Wed, 1 Sep 2021 09:17:56 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id AW9oYY1788612x3COwse1IOr; Wed, 01 Sep 2021 09:17:55 -0700 X-Received: from NAM10-BN7-obe.outbound.protection.outlook.com (NAM10-BN7-obe.outbound.protection.outlook.com [40.107.92.47]) by mx.groups.io with SMTP id smtpd.web09.156.1630513070864767401 for ; Wed, 01 Sep 2021 09:17:53 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=fOQjrHzPVpZ5HUSbMab5XkylSpAn/xs+CBph2bLPrT3nSgASUwQ/A0buVv21hAJjO0/ixhfujN3zDSwt01lvcYVW2CZ8inXaL2zOjIuFmUeyFii6UOr+Yz6CGMoFrfSxH5baRdtcNPhw4CCgRCD26saJLPRMbFU29CKurNvVoWEQ3HxzKj8iU14Z6RiD+wCrE6GiKWJgvH6XIiDqxla/6mX22y9KxS8ZLDuXFlFD5VH4e8B2ZE1xiiTazf7Gv8J9IBD9T4Qn+A+nU3D34/S+8J8OUDyOiOaPlh8n35MrM3jcdVAZOLiapo3CBi8AoSL0fNvUbyzZBF44e+FGX/JT/Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=6HQooJuv4ElGFgC8Gfz8SnPFi+exp0cxln3WUcoIru8=; b=H0yFXiQPoZfKABzpXH/Uls2aXbw1a76jJ+cLPiy4q7B6nZAAR03zus8MN/bOPuKQwPAEDNuqqKw9YJuVeNj/bkGWV09502CEyrPtUm2H/9SrCICf3gfl24P7GdvMTmutxjM1Sfkz9byUZ94t2/MCvvphSA1Qk2KIkdRvRzZujM6xmXpDsEI2dC7W49jhc9weZs9Yt0EjNx/ZBNacDLL9Oo0AjzuSg2QGALl3fe24dKm7r4LqP2JrXp1AZSTAeH4wZTVCrzLujLOrz7/al8lloxqX54tegYUICVTMBkDU3BYTrLZUOCq+dHmSAZ4Y3F9AuXT4p0ALMjubhxZLFbJCVQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4512.namprd12.prod.outlook.com (2603:10b6:806:71::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:52 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:52 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth , Eric Dong , Ray Ni , Rahul Kumar Subject: [edk2-devel] [PATCH v6 23/29] UefiCpuPkg/MpLib: add support to register GHCB GPA when SEV-SNP is enabled Date: Wed, 1 Sep 2021 11:16:40 -0500 Message-ID: <20210901161646.24763-24-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:51 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: ac54d332-579a-4e10-87c1-08d96d640c35 X-MS-TrafficTypeDiagnostic: SA0PR12MB4512: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: FAlpwvirQUkzizRA5dhhydJtsz97ehY1Wz5j5w5ZgArwb/YJdOCgw+wtiaLkuhmQecSG2vpVYMTokq4qEgqVzFlUKrYmd62rWCAeT9NK8DH7aA3cUnbxjnMZrvC200AOSwl/tZjuEyxl171WDtqEHI9cLXueuqLQfhS9yLoR7v9pIr5AdT+GZlKl5iZ4CYZuEAROOOu7qrcFGZ3PixcFg9BECr6oaEI4nMkvY/LNYAAIRAJW0i9k5mB92naCkVS44R2IQ3qASzWI2a8bQpd8oVQ5rWMmsXI/2d69/24dIxtojd2REYfwKPyW9AiOTiWEhW32usKxPJoPD3AtS9Egoh9cj1/8vcQocxxMSRFENOu7erSU3ilMVqwtoApj9M1RkTSIkNUxrhj5c/n70agzJXj8lfFMXjc/dPr272h4esggXqi/knV5EKx/hdV7N5tfmbY4eDdxnsecnrHmmADwvaCi0motj60y4vZF3jwWOaYdIsoYvSrpJ+tpR13nzj+voh8GMV2g2venGV8s4Ba8iKwPBiBh9E/E19ArV2/DxorJaQnJfckmCQk9QsUA3DvLZqb59bn+Q3SURwBSmSa9Z3TRvxFJo5DIr4k5b4cOiqwzpHGyL2lmjW9BG7GOysrNZKQj3N6mZf5JwjQjUI/UE7XYnAn4BKhpHZPNv1TnAfpfztKw2WleA3gnTZs8W+5wrt/W0V1YRqppTQjJMTEeSvU35IXsAWOGY/GFQb30ZcRk1wVoD4h5vadzeqYGOlREPLpGhzjVqF7SSObLaJu0FGHJTLr55q/bKEHBg/e2y3M= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?q2M1xHrKMxoQpxlYS4vszLUFe0g0E6KPWjU8bAVWhLng1uRxA8xfZ2OOk1ty?= =?us-ascii?Q?ad8fSkLOqfMi0hHmJdaGin7PkfRh10P6d7cEoRZOTpMgczVVH9hXn97bmS9e?= =?us-ascii?Q?ConCh7mzizBtV4huT/UrdC9B8Q38C6NT3hE2INRBCDI6sRSfT1ommMRQNJgr?= =?us-ascii?Q?TLb+f4QuHl8DV1sVSSWnNsxIlFsKqaVuETgOk48EnL1w9lGr24OezrT0orvT?= =?us-ascii?Q?VD9C+QcJsQe+ACHY+jG40rOUSCX0F2qiye2LA896UjsePSzQIPBNNsxIR9TV?= =?us-ascii?Q?V4qeFhkDXs1hO2imcFd8+NziadyMKRmsqFXNs1MAZxNpJGPy+vMBsaxRUN16?= =?us-ascii?Q?4Jk+dgbVwXlCKiy1B92SGvuKjmTBinqethosSYTH6cW0DQpMpU12A9DyKSwM?= =?us-ascii?Q?nQDmL3QUcQ3A7OtEHlt49DUN2hsCobk688JpjOVv4fkpWKxpsLNByfLF72dB?= =?us-ascii?Q?8qJdv4ujFcRnlICOwhkGGSr8W1fXWnXd1keKWL9mACsskXRv0sJmNqWSdSCV?= =?us-ascii?Q?VLMzdTmK6D77nkXLhQjdT2ySESTJALiFfMSq3anhd01VDt4J48mjK8SteFTS?= =?us-ascii?Q?0i0V8LQHlVoO4UdyloOu/sX5DbX/x/s6gKJ9S3i+l5noYaayI0yABbLx20Xe?= =?us-ascii?Q?N0BB7nUE5gC7INQKm2ASuGd5djUY3AghEmj8xhtg1VotAlwu8q+WEZacssYD?= =?us-ascii?Q?BSczZuSkqiK1DBVj/Mi/spc455O8AP8u6XNSbExpAIhojmonToGl20Mv7RlP?= =?us-ascii?Q?pPTxored2uM8MldTzdQrfgUrk+U/fIj+4z0giGsBous9fOahJZY1VcRKNCzh?= =?us-ascii?Q?NInHJC2mm5LmBMHjUHe4aInQRQc/d98h9a/GiPvGvtsfBZm1Z1nQ8o998Pix?= =?us-ascii?Q?HUdPZNU+XY1/I5cKTHO3zC4uvKGs67mPnEFlTre2LtQVZDF1KMxzrr/etmE1?= =?us-ascii?Q?NGbyRMsJf5GYct+fAygg6NckkkRaUJBtmThTMFBnWS6NjGB2zUoLJX0XN/Id?= =?us-ascii?Q?vbyUWbbDEn8XFpmMmLN03glo6JuplxHOIaHoaVvf4GZJxgADDku4WKZp7Dge?= =?us-ascii?Q?LU1OP7qFpq5wr+snWFgN5XwrT6wT3763Vgxk6nIyRa/RVl2QU6k93EdI24w9?= =?us-ascii?Q?hauCDiLhDcM+D+yRRZRQ9CQlPXGLhA0hQBeq9sYzbkpAZPxXhXuN8qw0nqMZ?= =?us-ascii?Q?2s4ZhuHum5+FF/LokildLJblgfcS5smr52i9Y+OUTHPGx5pjOuTOil1/mL+j?= =?us-ascii?Q?nReJLIYqaIcbz2o7icjbsL/d2DAKsppoQpJEL82Mc8sQm/NHqWZwZV2D4/W+?= =?us-ascii?Q?VatgpmkZod9y0cLZsQBc5M6Y?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: ac54d332-579a-4e10-87c1-08d96d640c35 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:52.0356 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: cK3J1gfHeHXopsN87mKajF+6VSA5H4snEEz3iWDFYN9RCZl+B019/RtCmBPJ2N+4bstfBYoqnxVcAt5rRXVHbg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4512 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: z6Q6JtGFNw1PKXIz9L1F5BcGx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513075; bh=wUQkAT79CH2aAJr9W2ikryXsmr/Yt/QHmUMImXz/WBg=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=BZ0OkYb/Gdl4H+GBZBlzFoE6Hf7g8z4UdGop1nVA9k6YgtUc+dCJl0tjdPC1ylroxKX zFxv/TTAfWtkiP168syjxX05FOAh1ur8ahmu9uN0ky8isonRg7v2+15h/qvWuDRb4DE27 RVJ4sxwGZmUxfiswpIj5O43GsN1Z4btC+2k= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513077211100047 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 An SEV-SNP guest requires that the physical address of the GHCB must be registered with the hypervisor before using it. See the GHCB specification section 2.3.2 for more details. Cc: Michael Roth Cc: Eric Dong Cc: Ray Ni Cc: Rahul Kumar Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf | 1 + UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf | 1 + UefiCpuPkg/Library/MpInitLib/MpLib.h | 2 + UefiCpuPkg/Library/MpInitLib/MpLib.c | 2 + UefiCpuPkg/Library/MpInitLib/MpEqu.inc | 1 + UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm | 51 +++++++++++++++++++ 6 files changed, 58 insertions(+) diff --git a/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf b/UefiCpuPkg/Lib= rary/MpInitLib/DxeMpInitLib.inf index d34419c2a524..48d7dfa4450f 100644 --- a/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf +++ b/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf @@ -76,3 +76,4 @@ [Pcd] gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase ## = SOMETIMES_CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard ## = CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase ## = CONSUMES + gUefiCpuPkgTokenSpaceGuid.PcdSevSnpIsEnabled ## = CONSUMES diff --git a/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf b/UefiCpuPkg/Lib= rary/MpInitLib/PeiMpInitLib.inf index 36fcb96b5852..ab8279df596f 100644 --- a/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf +++ b/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf @@ -65,6 +65,7 @@ [Pcd] gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled ## CONS= UMES gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase ## SOME= TIMES_CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase ## CONS= UMES + gUefiCpuPkgTokenSpaceGuid.PcdSevSnpIsEnabled ## CONS= UMES =20 [Ppis] gEdkiiPeiShadowMicrocodePpiGuid ## SOMETIMES_CONSUMES diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.h b/UefiCpuPkg/Library/MpIn= itLib/MpLib.h index e88a5355c983..4abaa2243d0a 100644 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.h +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.h @@ -218,6 +218,7 @@ typedef struct { // BOOLEAN Enable5LevelPaging; BOOLEAN SevEsIsEnabled; + BOOLEAN SevSnpIsEnabled; UINTN GhcbBase; } MP_CPU_EXCHANGE_INFO; =20 @@ -287,6 +288,7 @@ struct _CPU_MP_DATA { BOOLEAN WakeUpByInitSipiSipi; =20 BOOLEAN SevEsIsEnabled; + BOOLEAN SevSnpIsEnabled; UINTN SevEsAPBuffer; UINTN SevEsAPResetStackStart; CPU_MP_DATA *NewCpuMpData; diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpIn= itLib/MpLib.c index b9a06747edbf..586cff2f6813 100644 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.c +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c @@ -1040,6 +1040,7 @@ FillExchangeInfoData ( DEBUG ((DEBUG_INFO, "%a: 5-Level Paging =3D %d\n", gEfiCallerBaseName, E= xchangeInfo->Enable5LevelPaging)); =20 ExchangeInfo->SevEsIsEnabled =3D CpuMpData->SevEsIsEnabled; + ExchangeInfo->SevSnpIsEnabled =3D CpuMpData->SevSnpIsEnabled; ExchangeInfo->GhcbBase =3D (UINTN) CpuMpData->GhcbBase; =20 // @@ -2033,6 +2034,7 @@ MpInitLibInitialize ( CpuMpData->CpuInfoInHob =3D (UINT64) (UINTN) (CpuMpData->CpuData + M= axLogicalProcessorNumber); InitializeSpinLock(&CpuMpData->MpLock); CpuMpData->SevEsIsEnabled =3D PcdGetBool (PcdSevEsIsEnabled); + CpuMpData->SevSnpIsEnabled =3D PcdGetBool (PcdSevSnpIsEnabled); CpuMpData->SevEsAPBuffer =3D (UINTN) -1; CpuMpData->GhcbBase =3D PcdGet64 (PcdGhcbBase); =20 diff --git a/UefiCpuPkg/Library/MpInitLib/MpEqu.inc b/UefiCpuPkg/Library/Mp= InitLib/MpEqu.inc index 2e9368a374a4..01668638f245 100644 --- a/UefiCpuPkg/Library/MpInitLib/MpEqu.inc +++ b/UefiCpuPkg/Library/MpInitLib/MpEqu.inc @@ -92,6 +92,7 @@ struc MP_CPU_EXCHANGE_INFO .ModeHighSegment: CTYPE_UINT16 1 .Enable5LevelPaging: CTYPE_BOOLEAN 1 .SevEsIsEnabled: CTYPE_BOOLEAN 1 + .SevSnpIsEnabled CTYPE_BOOLEAN 1 .GhcbBase: CTYPE_UINTN 1 endstruc =20 diff --git a/UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm b/UefiCpuPkg/Lib= rary/MpInitLib/X64/MpFuncs.nasm index 50df802d1fca..19939c093d2e 100644 --- a/UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm +++ b/UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm @@ -194,9 +194,60 @@ LongModeStart: mov rdx, rax shr rdx, 32 mov rcx, 0xc0010130 + + ; + ; Register GHCB GPA when SEV-SNP is enabled + ; + lea edi, [esi + MP_CPU_EXCHANGE_INFO_FIELD (SevSnpIsEnabled)] + cmp byte [edi], 1 ; SevSnpIsEnabled + jne SetGhcbAddress + + ; Save the rdi and rsi to used for later comparison + push rdi + push rsi + mov edi, eax + mov esi, edx + or eax, 18 ; Ghcb registration request + wrmsr + rep vmmcall + rdmsr + mov r12, rax + and r12, 0fffh + cmp r12, 19 ; Ghcb registration response + jne GhcbGpaRegisterFailure + + ; Verify that GPA is not changed + and eax, 0fffff000h + cmp edi, eax + jne GhcbGpaRegisterFailure + cmp esi, edx + jne GhcbGpaRegisterFailure + pop rsi + pop rdi + + ; + ; Program GHCB + ; +SetGhcbAddress: wrmsr jmp CProcedureInvoke =20 + ; + ; Request the guest termination + ; +GhcbGpaRegisterFailure: + xor edx, edx + mov eax, 256 ; GHCB terminate + wrmsr + rep vmmcall + + ; We should not return from the above terminate request, but if we do + ; then enter into the hlt loop. +DoHltLoop: + cli + hlt + jmp DoHltLoop + GetApicId: lea edi, [esi + MP_CPU_EXCHANGE_INFO_FIELD (SevEsIsEnabled)] cmp byte [edi], 1 ; SevEsIsEnabled --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80099): https://edk2.groups.io/g/devel/message/80099 Mute This Topic: https://groups.io/mt/85306681/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80100+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80100+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513076715392.59318708860735; Wed, 1 Sep 2021 09:17:56 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id nEMMYY1788612xQ6EOKGUbz4; Wed, 01 Sep 2021 09:17:56 -0700 X-Received: from NAM10-BN7-obe.outbound.protection.outlook.com (NAM10-BN7-obe.outbound.protection.outlook.com [40.107.92.65]) by mx.groups.io with SMTP id smtpd.web09.158.1630513074592019784 for ; Wed, 01 Sep 2021 09:17:54 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=BwtxQqOUPOxrvFLGYYfqWeYcavp36Bmng2cYXrP+FK4rmmNTOVlcbA8Vqn8n62yNsVHSLgedVJLDc8jFo1pXX1Fq4Kq5sg7ImfWYAwLETf/Sf5Xqg4pWeIQ7A5gPUe18CiWB/G5ACFeIIO5HjZslo2nmuarCG+j5egRHh+f2jNj4ThjqqOZzXiiQRKD0/WdNtLBOIfP/3f9Lh1/Gj2MwbDr0Vfc+If02ZhfGl9E/tux1sJb2gjwOnt6GCpMSd42moETSI+CIEGEsaAUg41tFTDsR92PWXupUE+pyW5xJu5WomFddFioBoJIGZPbRAC4fYZvmWD093s+8zMKxYMnzXg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=tJ+TYvV0PPa4GZfYK5jXDQ9S83mjtlePxHvJtB0kQ9w=; b=R61oo5Z0OR+gcm97S4RmJkMjAyJh+fO07bWFideRN+CZuwCLdfoF9mZklsrla7/BS/8DLQ3GtY5eQW0cJ5UYYSZpqDwRSrGosXvlkTpj/rQNuRFKzN3lp5KI8bbKljQ7sVYRnQCbB0DzMQoiEvM7V1FzAr9bhZ9tiKku3Xz4Q9/7TjhbvbDz6rPoZEzFjnF7J0sfMrbJd6xUE5NIb9TMr2pgQKAPpyqV9L2N5MDb4n2y9wOgHIU+bkqd1CEo/q32rcM5CKpsY12JbOdrw7GEvpWe51JEWdBl8Bu3By7ZslkeZP4M75At8s4joQTGaSmRwPHyHD3L2GJZwK0YlA0UsQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4512.namprd12.prod.outlook.com (2603:10b6:806:71::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:53 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:52 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Michael Roth , Eric Dong , Ray Ni , Rahul Kumar , Brijesh Singh Subject: [edk2-devel] [PATCH v6 24/29] UefiCpuPkg/MpInitLib: use BSP to do extended topology check Date: Wed, 1 Sep 2021 11:16:41 -0500 Message-ID: <20210901161646.24763-25-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:52 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: cedc35fc-3120-46be-60c8-08d96d640caf X-MS-TrafficTypeDiagnostic: SA0PR12MB4512: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8882; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: Wprh/31kmNoQiSZjPoWq22NcVnj/SGbYkvjhUBrn62AEoUDQhopiXe/C5P9EhOlwBeJj4ICkPukwdzEDlruRcqW3o03SZWXYhDURS9J+ik+3HfR8i9tbHR9Nr3FDYzsxNgUzpui4vD0b1Adv8Du9ijPh6k3hMyL7j/OEaa4hArw0HKjJYN/H+sJEbMwhL5nFI4ECztTPfIxvXnPyZEHSPrVJai7PnnAyPcQjKCAXKmz8uvev3qZvU0sMn8+k6atJfVy5hIWjun8B4LHADBOTSQAUv+7tPoVQA7nHIUop1QHUi1yNFZnTE1AgkdXWPpLjMRFfA4kA+fyM+k71FKRz4y7RlOjtVFXihsfK/rVDnu0z12weTER8gXOk/Egk0tTMgR0it6eiycMQ8BS8uuHeSBJIBBWQ9dbHYg9g7q6S3m3Wgg81eTsO0QXwMNJXcc1H+h6pbndO+qTK8vRMdegsH7ifLnUZssKbRW0ddtQziLkYk7o1+tQRY52K+6a8Tec5OT/XizsCIWOEDh0qVIHwwJit4hyVqz4EIVxsNYDmvjOelyXobmFYWXa8c3nWaVTviQ2wlRAM71g/9CuiSrYx95FdEuu9rP7oYomzBGIML+pXf4NvKDPXqs6PFYsZPlQBRBCzVX/M3Y94bFbSYo8VtCN3ARhd6yUHpxO6dlgB0PY7hQfhSxIT6nmQvBDZ9QB0lUu64Pktyb3Afkn2sbs/PdKPfrjEzMpcwq9uQ2BEo1E= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?hu+vMiScIUmQ1F3aatM3VPpqKRxjT4dJM5xm+LfR570u+CO74pw/xJH53uh0?= =?us-ascii?Q?XsB9tYVVtk4dFnIasZooKSe5Vb1X8KJZ78QlDegn7ZBQgc9/NypezOEofjsR?= =?us-ascii?Q?/Tl8y4GiLVKgiXMr9ISVGBWAD3r65IqgzsNnarUZUaxZVZ69oOoRqSfS+OVY?= =?us-ascii?Q?AmcyB0fn4jlMi0TIojn7GAA0uhtQ9vehg4iOj1zl/9TR0fvKiZENU9w6R1M1?= =?us-ascii?Q?vL89ct4jTHqb/vvFvCeXduZb17F7rWySFyZi7Ev9zaZJs9mVTsRr02kJAz8e?= =?us-ascii?Q?xtiQqRn9meNS/HjdFGHa/ApOKBIkMUlCORGOLl5/Uoou1QjjVvzHo1Ygh7AR?= =?us-ascii?Q?G37GBZNci82WR7TvdZPzJTW6K4Ze5mAEFLg0sQzzCI5tJNanZYBO/1ytC8bM?= =?us-ascii?Q?1IeNHlrVBkmL9KWmFulNtvHpmwRztDRr2kbvv0rBGYwufuGxn+IlxHHt2P+e?= =?us-ascii?Q?Ve5ZrOJT5Xxb9BBiJmraHkL1pC5EKKF5Fu+95Clu1uuli78M909K9o1Cu8Ft?= =?us-ascii?Q?Qs7eNzHnHRQrhTKue8z1CIkPKDk0EqGMJvCR+TLAgq7vXB3Ga4GU67gavyF+?= =?us-ascii?Q?+htyxpYa9Zn9rnbQaitEXyqppT0CAZCIEgDNee5bGxkBrHIYNogy9KK9dsFU?= =?us-ascii?Q?mhrDz1UGI0T/FlzBs7LWRuOJZuSZgwWHIiq2EHqrlOj8oCxpEmjcbHovkyFX?= =?us-ascii?Q?iSQu6tmLzjoi7WN1Ey5ShXzOLtByWgYLj0fMrz6zMPzYAsPaDjmVckad6BPn?= =?us-ascii?Q?AOkGSvjP2CefcSgE5BXnQoI8ayq8H8kSLYhYJ1eP+ay8wysURjI2kVVuzTOk?= =?us-ascii?Q?Mf20H+4YUuZotBaG6U4EpkO7TuoIlF/+6pDUU5xqDmFFJ6y3Js63SAbYyqdV?= =?us-ascii?Q?ZQjoHC9/Yy+GaA/6LtC5K9PD2MKPA2/M3Hi2NMcUOQIpKHMO4cBREc+Rpgzx?= =?us-ascii?Q?It1sbDLu39PIUNhlKDIiw05Jhe3N0V/Fhpeg5/uSRv5cL5MXAqhVtLTkMwyr?= =?us-ascii?Q?ShFPuR8EHInKD2yXcE66PFokL1W64brRulOBoqY+SnnwiXFT1ZRkUyjlFt9N?= =?us-ascii?Q?zxaRdMO7ljclQvWqGWFzXUUdrnnI1nyQ7tV0uFXwx7V3KhG0V6iimuZA4FsD?= =?us-ascii?Q?pHvp+4qi5V9Lfq5O0PN7yoQ+wesfsHdwybK3N+zaLQiYzviirH6+51jdKwe8?= =?us-ascii?Q?R3icz/ziGqehlSgAe45JdzVF0yPZVofBSe1NnpsXs4TMYIdgqcxTer/aKDxM?= =?us-ascii?Q?DgCxaTzwctrO2jAUfhD0ImfzHgRPE13x4PJeMiSWaz/b5XsDliysk8AlDnYp?= =?us-ascii?Q?mQ/Gvr3iG5Z+BcNbT34r+Aeh?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: cedc35fc-3120-46be-60c8-08d96d640caf X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:52.8362 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 09QGg7CkQhNvehJU5WqCf74bVL0WCaR9mnPn7ZNVhZft971/vvX/RmSnbQagFV3JIZJ1JcULJuart6vhFjUAGw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4512 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: 6RlS9EDjr4bMVGxot8XIVaCix1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513076; bh=cyAKFRrC7JnAKE/q1zfc3VB83OrpqBcnbDsUftKXaic=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=UXT77DFPi0Td3iNY8FtuColmm8ruv6G3ojjmBrVzUqTGW97QF4J6M8CG2+kRGUh52mu IHTj+UZAyadTXrZyOtRYYH2AsKZepcKtgaVmtKyANp9Q4RHt0hjnygcxhi0f5PyhGwp6n AxnaKckJTlEE+5dmzRgvsPBxsc6w82wZP3A= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513077316100050 Content-Type: text/plain; charset="utf-8" From: Michael Roth During AP bringup, just after switching to long mode, APs will do some cpuid calls to verify that the extended topology leaf (0xB) is available so they can fetch their x2 APIC IDs from it. In the case of SEV-ES, these cpuid instructions must be handled by direct use of the GHCB MSR protocol to fetch the values from the hypervisor, since a #VC handler is not yet available due to the AP's stack not being set up yet. For SEV-SNP, rather than relying on the GHCB MSR protocol, it is expected that these values would be obtained from the SEV-SNP CPUID table instead. The actual x2 APIC ID (and 8-bit APIC IDs) would still be fetched from hypervisor using the GHCB MSR protocol however, so introducing support for the SEV-SNP CPUID table in that part of the AP bring-up code would only be to handle the checks/validation of the extended topology leaf. Rather than introducing all the added complexity needed to handle these checks via the CPUID table, instead let the BSP do the check in advance, since it can make use of the #VC handler to avoid the need to scan the SNP CPUID table directly, and add a flag in ExchangeInfo to communicate the result of this check to APs. Cc: Eric Dong Cc: Ray Ni Cc: Rahul Kumar Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Suggested-by: Brijesh Singh Signed-off-by: Michael Roth Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- UefiCpuPkg/Library/MpInitLib/MpLib.h | 1 + UefiCpuPkg/Library/MpInitLib/MpLib.c | 11 ++++++++ UefiCpuPkg/Library/MpInitLib/MpEqu.inc | 1 + UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm | 27 +++++++++++++++++++ 4 files changed, 40 insertions(+) diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.h b/UefiCpuPkg/Library/MpIn= itLib/MpLib.h index 4abaa2243d0a..19e91bf7d74e 100644 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.h +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.h @@ -220,6 +220,7 @@ typedef struct { BOOLEAN SevEsIsEnabled; BOOLEAN SevSnpIsEnabled; UINTN GhcbBase; + BOOLEAN ExtTopoAvail; } MP_CPU_EXCHANGE_INFO; =20 #pragma pack() diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpIn= itLib/MpLib.c index 586cff2f6813..c2b00a1f04ff 100644 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.c +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c @@ -1004,6 +1004,7 @@ FillExchangeInfoData ( UINTN Size; IA32_SEGMENT_DESCRIPTOR *Selector; IA32_CR4 Cr4; + UINT32 StdRangeMax; =20 ExchangeInfo =3D CpuMpData->MpCpuExchangeInfo; ExchangeInfo->StackStart =3D CpuMpData->Buffer; @@ -1043,6 +1044,16 @@ FillExchangeInfoData ( ExchangeInfo->SevSnpIsEnabled =3D CpuMpData->SevSnpIsEnabled; ExchangeInfo->GhcbBase =3D (UINTN) CpuMpData->GhcbBase; =20 + if (ExchangeInfo->SevSnpIsEnabled) { + AsmCpuid (CPUID_SIGNATURE, &StdRangeMax, NULL, NULL, NULL); + if (StdRangeMax >=3D CPUID_EXTENDED_TOPOLOGY) { + CPUID_EXTENDED_TOPOLOGY_EBX ExtTopoEbx; + + AsmCpuid (CPUID_EXTENDED_TOPOLOGY, NULL, &ExtTopoEbx.Uint32, NULL, N= ULL); + ExchangeInfo->ExtTopoAvail =3D !!ExtTopoEbx.Bits.LogicalProcessors; + } + } + // // Get the BSP's data of GDT and IDT // diff --git a/UefiCpuPkg/Library/MpInitLib/MpEqu.inc b/UefiCpuPkg/Library/Mp= InitLib/MpEqu.inc index 01668638f245..aba53f57201c 100644 --- a/UefiCpuPkg/Library/MpInitLib/MpEqu.inc +++ b/UefiCpuPkg/Library/MpInitLib/MpEqu.inc @@ -94,6 +94,7 @@ struc MP_CPU_EXCHANGE_INFO .SevEsIsEnabled: CTYPE_BOOLEAN 1 .SevSnpIsEnabled CTYPE_BOOLEAN 1 .GhcbBase: CTYPE_UINTN 1 + .ExtTopoAvail: CTYPE_BOOLEAN 1 endstruc =20 MP_CPU_EXCHANGE_INFO_OFFSET equ (SwitchToRealProcEnd - RendezvousFunnelPro= cStart) diff --git a/UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm b/UefiCpuPkg/Lib= rary/MpInitLib/X64/MpFuncs.nasm index 19939c093d2e..76d07a275c7b 100644 --- a/UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm +++ b/UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm @@ -264,6 +264,32 @@ GetApicId: or rax, rdx mov rdi, rax ; RDI now holds the original GHCB GPA =20 + ; + ; For SEV-SNP, the recommended handling for getting the x2APIC ID + ; would be to use the SNP CPUID table to fetch CPUID.00H:EAX and + ; CPUID:0BH:EBX[15:0] instead of the GHCB MSR protocol vmgexits + ; below. + ; + ; To avoid the unecessary ugliness to accomplish that here, the BSP + ; has performed these checks in advance (where #VC handler handles + ; the CPUID table lookups automatically) and cached them in a flag + ; so those checks can be skipped here. + ; + mov eax, [esi + MP_CPU_EXCHANGE_INFO_FIELD (SevSnpIsEnabled)] + cmp al, 1 + jne CheckExtTopoAvail + + ; + ; Even with SEV-SNP, the actual x2APIC ID in CPUID.0BH:EDX + ; fetched from the hypervisor the same way SEV-ES does it. + ; + mov eax, [esi + MP_CPU_EXCHANGE_INFO_FIELD (ExtTopoAvail)] + cmp al, 1 + je GetApicIdSevEs + ; The 8-bit APIC ID fallback is also the same as with SEV-ES + jmp NoX2ApicSevEs + +CheckExtTopoAvail: mov rdx, 0 ; CPUID function 0 mov rax, 0 ; RAX register requested or rax, 4 @@ -282,6 +308,7 @@ GetApicId: test edx, 0ffffh jz NoX2ApicSevEs ; CPUID.0BH:EBX[15:0] is zero =20 +GetApicIdSevEs: mov rdx, 0bh ; CPUID function 0x0b mov rax, 0c0000000h ; RDX register requested or rax, 4 --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80100): https://edk2.groups.io/g/devel/message/80100 Mute This Topic: https://groups.io/mt/85306684/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80101+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80101+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513077440973.5288420627177; Wed, 1 Sep 2021 09:17:57 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id jdSDYY1788612xcpV1prjeS5; Wed, 01 Sep 2021 09:17:57 -0700 X-Received: from NAM10-BN7-obe.outbound.protection.outlook.com (NAM10-BN7-obe.outbound.protection.outlook.com [40.107.92.65]) by mx.groups.io with SMTP id smtpd.web09.158.1630513074592019784 for ; Wed, 01 Sep 2021 09:17:55 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=CZXZzElhxYG6Kq5hRL4XOIMEiQa2wO8GT7EX+VO0iu4lGE/C4h1cwcJN4KorPP+8z50k8+cUKLOED0dIf5SzNnD54wy7YH8g67aR8xP0Ud175FSFLJ9VJ2fEVV/5kIm4ElMWuNUnZRKWVuD3gDVcT2UA2QUCHBX5LvRBPoq2v/XuaJqNy6QvpT9mWZlO/cAY6bncw3VpLGwaLHYbQ2aj+l271AJTtb+vKa9Z1krhUxpcaia74Zlk6Cr1hFY77LhH33Uapl90iphkwJRV8l6ebiqQ2N03xWiIeEs8JVvj0sE5dERu5nCmzx/lbW1WNFRgD+BYWGku/q/wzOH6vk3zrw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Q/7y5WuP4O9pc9aRZ/ATYW4r7uyRxTGbq8b0K+QMSwY=; b=PkZmROi0sy5wX74XTwxKco5Bo/nSCdDe9FHxDQ3G2QH3xqJAjUDfqtu5tFPBrf4vxkTW+2o9BmydibLxnseMyIIrfiabbhlg5hXdGPg/tQNORm2biW2r/3iu8JwgCd5aPZVi1l6sxPvIzcJrzbMIWkXvUVVvBRW4PCCMLcmO9w9G7BQuMVSW0F4uZUNaKA9APKNC2nqAVB6st+RMpUypsj5T3XuDIisqJsTBoVnd3f3VDMpJgNZk9h0SL7PIutsldSHuz6vyVDVS7SRIQeI49HLy3NYSO2hX012N5OfmlXeLz09agz/nA7wnDZegWKWfFd9Va/8z8qRlf8SiN6CTaA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4512.namprd12.prod.outlook.com (2603:10b6:806:71::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:53 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:53 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 25/29] OvmfPkg/MemEncryptSevLib: change the page state in the RMP table Date: Wed, 1 Sep 2021 11:16:42 -0500 Message-ID: <20210901161646.24763-26-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:53 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 46c404a7-298b-45f4-5bbc-08d96d640d34 X-MS-TrafficTypeDiagnostic: SA0PR12MB4512: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8273; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: xjJX07jXz4Ww7xJCZPsQUdGVqL9LGJB9rsFB0qqnlYYUjDXD8x1dO9O7a3kNkoPNQVdmV62WSio1mZDp0tT5HQoMDgrnL+dp92jBKIVE5oeam2vIP43tqgBecM3Ny2uDRPIZFuDe6DIKU0Lx7Cj+oiqAQ+wYuDNUuUoqybtwAftxwYMKyyP3vSf69dHIhtx/pSHP+WbIL/J2t6XYJ/Y32zw9MlbOktJhxIid5q208LxLa0AzBYlXw//Y/yTJBXUWNhcyh8ouL9sLp2lXyfwU4zBmZpU8nYoShcrNi3K+1+OxtaqFLHu0otrLPM7DBm8m8R/iO+vRyN1YQWERSAQjrnItDEoUJoJD6Dz+LaiGz7OMWri4fBUruP4o5VIG1dl7CsZSFZALtIqS6khuDpsZW88gQOGfGgT12lBqp2ZOW6XiNFma40d5xkmG4YOCngxZ1HGvOdzxFr4uiOAdXNukPVHiylVZ0V4qf5aVx+3Pmdog1p0Y3B0wJFo6mabOMnJoTQamG9ggGvpCDLd7N93rDQIIy5uTE/Bj/CzqlD9XnUpCd4sH8VHGAiBNMN3II5hM3Qac5UtedIRtkg0dwCf8edB1CSq138A6QnlCBo5UyPXTaCiAzQMOwb9oIuzziMMTpHC4y2Nc6GnF6rGPCuxa1jgMcp13b0wyS/TLfi5YAe/fEyM2zmghDQ5knePnh5CTaeQ3eJCP/1CeVUD1hmlFyR54+ZkPscixjgpwggQtdFF3b5tXA2T+xn0Ap5DI+y4VVNPyRAz69PLBBWl+vbZBmQ== X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?WG3IdL/pfh2RZnYuSz0xIXvr/bsX0XtSRoGMMcB+joZLuyK+iXVm+TvQ+fN9?= =?us-ascii?Q?ePP26B+Z/zmwqBbjllb8dWnP99D7xEzCUtPwe5HVvkNPl1IY2F1OSlWjbNRr?= =?us-ascii?Q?WKjwFOZLyaYnAMq6hA/dlcVEacsIONi94ddlRu7DjrLHa7+Vq8TltzzYnzGQ?= =?us-ascii?Q?gzvT5GCwTXVgtxyiWcQA+K9dMN3OW5KcK9UGN6Zmoc468oZX8CiJwWFZSDFv?= =?us-ascii?Q?TnzIRTIqixyiPR18FU0fPt+w0vBx2HSTA1f7EhTLis6luilq76tlKiYdUDGf?= =?us-ascii?Q?LXlGA7zSw5aCCwFXFUxTp9yFPmEPxlY3IhAfbBgIQat8yd8v0ygYDyxbXpAh?= =?us-ascii?Q?2wYC7fnhn7fw2WS/itcvAWt0sTEkmTI+XbH6IG7Zk49zB9bWR1NknOFpkdGC?= =?us-ascii?Q?rryeR2fkYLOV35N01lMj9fwEEB0RFMrHu4ZKpaDcW+Q6ohZbE1VdPoDWo8xn?= =?us-ascii?Q?xRc8BIno7uLZen4Ip+ruKrIiYgE1J/IMb0WO52a/7zsHRhypNGRxXZB0Uwv7?= =?us-ascii?Q?XLvijSLrgw3dhEm3Vub7OHY8273bX4BiP/duZg3slqR5RQYoCJh/R2+diIgS?= =?us-ascii?Q?hT8du/u37C13r5ILd8dkNIvok3bQmeC2otoQHAH8UHbmRkmR1gWm8zcvD8Yx?= =?us-ascii?Q?iSRNqZtgiy4P3uFVptxCu7++upgZoh5RYv8bqDb0PpA2AdWaIqYib0oysivP?= =?us-ascii?Q?SkeEPA4UdhJuUtnryZOjwl8+blchLppVE7LeHdjFvM++XwrxIjfXntdonbrp?= =?us-ascii?Q?q9iR3neHcX7Tyiqd2xSpxWsFBbBO3+cKHwzxPH5EMxn/m5B0CiLBgAB4YQ81?= =?us-ascii?Q?MIukKO3mbOa+pu2BCKoMIa8tmUpc1RCMRjrzdWYvC9WlyGamTd32Cgi03sWv?= =?us-ascii?Q?XzcghDD+gzKKrAD61Ljmw1DWSbbZSq8nLulB/sRMRRoX+Yy1IwzNWKuSJaX/?= =?us-ascii?Q?zOG6TGJ9MWnxZyI0f6aTOWMg4lhdJyUHMiTKchTXouG4sQW8Ym3uKcdUBhkh?= =?us-ascii?Q?4AyQI6gg1irzPgmnsDHbKVRin2Y10Dbn/e1qAzQAnoodwAVDOwdxb/u9pqcc?= =?us-ascii?Q?eqLTiYJ/Gb5abOessQG+NnZASvyDwr+EOzZ63U06mkYLuqK2djOFjyRSVQAa?= =?us-ascii?Q?TzYKT5SK5N0c2JPoAURyrlgbdoYR1DVWshLMnbM1G6BqqDz+0E3+eORObH1/?= =?us-ascii?Q?c9pRf5SbinrX66ITD09RFk8VupD9AQa0g9Ely40ji9rVI7QKP3r+EpSNJsmj?= =?us-ascii?Q?DKjf6ooJZFqEOZm0pwe5HfqVc9/xgNZQAOyfQUzcVJ0WuOikF0zIL1lCH+RA?= =?us-ascii?Q?vCV8AxyG1YVT00FF+lxqegPZ?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 46c404a7-298b-45f4-5bbc-08d96d640d34 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:53.6977 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: kKWUpQWMNqb8ehg9uL4MsmUfMTzlvbEr14VgZ4mOIYIozefnn2osgDtAAw6fpRNBpckeDrNs37Gmn69MuT9fWA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4512 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: L2gDc6Mc7FtybLAxHJYTBY8Tx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513077; bh=2bfFyucswFn3kM1oKMn0rf2yxP+R550h9hyHy4YjaoQ=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=G8aIpCzKXAIG74lIMWZhqUjQNwANGcqgDDRV9dw9gTrcKd1Yqan77B9ZyGAn+7NqqHG m3GMO8ICibby5joKoys/v068Jgsweq4kuUZVMFKnnSGu/VCAlZRASwd6rcZYGemCsNEPB YxiLRqeD1wGKX4l/60QhPEdTgQySQJ2mnSo= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513079377100062 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 The MemEncryptSev{Set,Clear}PageEncMask() functions are used to set or clear the memory encryption attribute in the page table. When SEV-SNP is active, we also need to change the page state in the RMP table so that it is in sync with the memory encryption attribute change. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- .../X64/PeiDxeVirtualMemory.c | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c= b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c index f146f6d61cc5..56db1e4b6ecf 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c @@ -17,6 +17,7 @@ #include =20 #include "VirtualMemory.h" +#include "SnpPageStateChange.h" =20 STATIC BOOLEAN mAddressEncMaskChecked =3D FALSE; STATIC UINT64 mAddressEncMask; @@ -695,10 +696,12 @@ SetMemoryEncDec ( PAGE_MAP_AND_DIRECTORY_POINTER *PageDirectoryPointerEntry; PAGE_TABLE_1G_ENTRY *PageDirectory1GEntry; PAGE_TABLE_ENTRY *PageDirectory2MEntry; + PHYSICAL_ADDRESS OrigPhysicalAddress; PAGE_TABLE_4K_ENTRY *PageTableEntry; UINT64 PgTableMask; UINT64 AddressEncMask; BOOLEAN IsWpEnabled; + UINTN OrigLength; RETURN_STATUS Status; =20 // @@ -751,6 +754,22 @@ SetMemoryEncDec ( =20 Status =3D EFI_SUCCESS; =20 + // + // To maintain the security gurantees we must set the page to shared in = the RMP + // table before clearing the memory encryption mask from the current pag= e table. + // + // The InternalSetPageState() is used for setting the page state in the = RMP table. + // + if ((Mode =3D=3D ClearCBit) && MemEncryptSevSnpIsEnabled ()) { + InternalSetPageState (PhysicalAddress, EFI_SIZE_TO_PAGES (Length), Sev= SnpPageShared, FALSE); + } + + // + // Save the specified length and physical address (we need it later). + // + OrigLength =3D Length; + OrigPhysicalAddress =3D PhysicalAddress; + while (Length !=3D 0) { // @@ -923,6 +942,21 @@ SetMemoryEncDec ( // CpuFlushTlb(); =20 + // + // SEV-SNP requires that all the private pages (i.e pages mapped encrypt= ed) must be + // added in the RMP table before the access. + // + // The InternalSetPageState() is used for setting the page state in the = RMP table. + // + if ((Mode =3D=3D SetCBit) && MemEncryptSevSnpIsEnabled ()) { + InternalSetPageState ( + OrigPhysicalAddress, + EFI_SIZE_TO_PAGES (OrigLength), + SevSnpPagePrivate, + FALSE + ); + } + Done: // // Restore page table write protection, if any. --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80101): https://edk2.groups.io/g/devel/message/80101 Mute This Topic: https://groups.io/mt/85306685/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80102+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80102+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513077510642.5714324049342; Wed, 1 Sep 2021 09:17:57 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id B7GtYY1788612xdZdQgLK30k; Wed, 01 Sep 2021 09:17:57 -0700 X-Received: from NAM10-BN7-obe.outbound.protection.outlook.com (NAM10-BN7-obe.outbound.protection.outlook.com [40.107.92.65]) by mx.groups.io with SMTP id smtpd.web09.158.1630513074592019784 for ; Wed, 01 Sep 2021 09:17:56 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=YOjs08ygheZD/z5YVvlmIhm4VPBsGHnB2O5CghF+9ZCHTQQHUxboAPTXn7/0nJBq948zKyMGgpEoEOfPTtWhaxpKGiAnucxlScYgaeObA823GnXKWPu6N1sJgzIxMai7uc97iFS7GG/WsJhldn8pOrmsGFB7UvIPa/nZgZSG/GzWnYVqR6MhXTAuIXNqV6vuifwayu0zpasUTgTlWWqzS48Hvs4PNMvZuzttW15JIHd7hXpCPP5zoN9QgpicqDt8RIzVT0LzaNNbEw/2CbxuGjI4dH/dqzAaqy1gKRoOG4WRITxbs8g2jO8+guyrx9vLWSNf6iKxkNyjeS6fXdFcOA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=OShJX/RhL41kbpYzPsc/6Da3+ow9z7IRLd9MET3wcDc=; b=LVcHQB/MMYVespPdkv4sXQkAPqvlsH95i22V/pXw0oW7cKrofibVdKfQeYnRQB19v+EZ3dbJPRMvnaIgJGQ/TfJDIanfoPllqHTAibASp+3k3K1pUbF0qcOKB4l7NlDf4X/cy4iGxjrz0+QPbn4dt9i8hX/W3E1tLy2b4QHu98kKlB2DxCGF01pf+935sVbft+s2BDY9H6kFFqSV6IZSNRDIn759a7Q/QIj+T4MWq2wLrOtNG4fJJ/97KtcCfBdhwCLEB4nLcm4x2KRd8XnEq/C1VzpvbTqqdWZ1tyw2HkP1Ied1egx3xnIPL/yamDRLDGweYuT/NZg4mKRn+Dh+Hg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4512.namprd12.prod.outlook.com (2603:10b6:806:71::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:54 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:54 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 26/29] OvmfPkg/MemEncryptSevLib: skip page state change for Mmio address Date: Wed, 1 Sep 2021 11:16:43 -0500 Message-ID: <20210901161646.24763-27-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:54 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 9aff71ac-50b6-4275-d234-08d96d640dd9 X-MS-TrafficTypeDiagnostic: SA0PR12MB4512: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4502; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: wJSIyvu/33VOrejflHQ3oPFKRcsPbkI3K9jVDprk9ZH+6qCEt9Vr3FlN/Ojyn2kExHwkf2G3GQiVPhR7rf7td1kRGrvu3XnQH5sVmtYgnAnQDLCff1NDEuHQnrIXIeNL7DcOr+3KSrvfgEURg80QZSQEoqEMUcRnEhDItkQPv5utmmq1cpjfVhCZ1ebaZ/9skEmm3B7Mfo0Lm5xshy5HdZFCCjqlx+pu9QikEIlQEp+6QHzdhp/zH45M3fN4njWq1JyEptwRSsxxc/ZHI155E2WyMjW4IbiFEEBR92XCqYUEvhRo7LC39ZGB/r/dsj+Tp2T0cJuyXelBfX0Ck3VyqUHpD4mdS/g8FKL+l/eCD8asMFrZFGQJw4+2uVWsj4oi7XIiN5RroJlVOMfnBkB0Y7fBCIYw9HRt+yb0OySgx0GhrwxJqF0TRAlf/Sdqij2DYhGdLVDiT/pk9OChZtUY1X+KX9O6xh1uPrVhhTh4oZ7ySWZ44eln19J/QYyiGN9FdnoFHO3VqS6IcwBmzXbk9d5dKlHd4hj8dUwoJGu9bNHKofHN3tb/XtJycvxKAuHJlArCg4S2tvbvad9jnX949ZeR0xDcWIshPE565fWSh/Vbk+MOrzvS/bL/NSVBbVPUZo4ssQxLUgYmQqjAxr311FkbUKsFIlLlp0YM1otvWmd0VeW1zVfpipDIWOSafxN894Ob6TP/r+cqcf4pKYLicQ== X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?7Gef0LdAkUTvhXvl5TKXOJBOXCgKsl5TtsohFMl/vKePMjO77jlryntBSf8/?= =?us-ascii?Q?ulrptnYcm4T8vzS0evBFEU2PHmd3ih89RZmP7qmRm5llTU/Pso/YZphcmMx5?= =?us-ascii?Q?DZfwLmAJdzZVJsFRasI13eEVz0ui1xA+yjg3txrowKpPS8QHbB6hvFoLJII1?= =?us-ascii?Q?fLBOzPHUCPqOHlV98oRtVKZ/bPWiNJOZpYMGNWo2VvgvRjeXj7qEkw18UtdZ?= =?us-ascii?Q?5DpZjRIsMNk3UmtWTdBzHnJo7gm28oo2n+UWEil99LtVNGrsAaHHGicf2D9N?= =?us-ascii?Q?HlO/WWXyhDqYrjts3JjwLoRZ+2y02/UIcgIvuYd5zBacc1x0zkXM/5Shzbeq?= =?us-ascii?Q?GLDsT+4O6ymA1EkZT0lnHPZYKv5TlEaTl6+Eg/OhNAvg8LTJKi0/c0R5oUrs?= =?us-ascii?Q?1XThw23xTx7I853ITef3+/ebAwyhKw2KnKqznKXDXtmkKpH08EnzgtPKHdIK?= =?us-ascii?Q?7lpvgg8Lx7edr9XHcWdOst8uluqOhZ9/apCdZ63jjZcrzUzQew/PI/T+NWwy?= =?us-ascii?Q?XNF/OysHsV1LijkDdUOnNv7J54jjgm7zPE8oqiJnKMdeic4fVEB5sXrftx/x?= =?us-ascii?Q?kL9JCJorqbVZ3rKqrfCIfylbwCIhV+Vf5P5JmWTZhGsC0TryXzEz5hGsHwyo?= =?us-ascii?Q?yGGkfz3tU/KggPD0M+p6lXufOJbIIbzug2gg7eB+Rm2qW1XEm+3SgyqL6Q6h?= =?us-ascii?Q?3mepz77LrifiTB8pQNEhZfnwViSXbbn6JtLKajg+rDyddhiVH6N4npDqiuyo?= =?us-ascii?Q?Lj2u0xVFcQVHmJM2aqGYh9j71D4eOSU2db1JROgfXL1J/hSLtnyqD9vWekJL?= =?us-ascii?Q?I583eU+5p5E9vugT3p3cH5vjJUGgpdsE9BwlgAF3IkQzAZKUOymbP7O61Nf9?= =?us-ascii?Q?z+rtoMvxMZpdVNxgu4FXRqUpB0BETnNEhHAgGXtXIlzwo6OOjL4fY2EuVvG+?= =?us-ascii?Q?j9cAe6EKyVEQ0aIQEMwtvLC7ShU7f30r9oPJr1eAnICY5mbNNUVjG6nbwJot?= =?us-ascii?Q?ONcN5PHQbtsGV44ZRsnWhngUNOeaHTnFaDWE11swq4XTVAsByxW9lfoyiing?= =?us-ascii?Q?gxGuuvZ2KkAnStcZcmpMbzSMYaOLbxmQCppalA5UN6q5p0L7Hg4gR3KZMnry?= =?us-ascii?Q?cxZCqeUoUarFAy0c5WjPvlEBurALR1WoGDMaZlWEYb9me9Q9lxOsPhDv7k2L?= =?us-ascii?Q?MSN7EKxn4FrRCmCpX0cgsHXxsifLAbQt6Fhsp7zKCJsO17LeLdBZR+X0eYu+?= =?us-ascii?Q?/OQ2kPGgZ3y7kgv0c4WLC3RI3v3S3xhuWroCKRBwk7G8x6ccnAmc2OrLwxm+?= =?us-ascii?Q?xmI06iYPK9akleOwJY2l1Zu+?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9aff71ac-50b6-4275-d234-08d96d640dd9 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:54.7841 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: F1107hBkEau92XehOKFyzRx0qXVlG7prRKofeT7at+xO+w5oWqVXQdRLrQDBM8M0m2rTmO+TPeIkTFPwDMTxKw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4512 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: xQ7NI34aHl0uYiuUeE4dxRePx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513077; bh=gS0Olf+Ihb9ndlOuhUQb9aaGpjdmCq7XaPLFdxrfQCA=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=ttuK92D7c08t8wI6f9+LAgajObhfQEtsaDiSsUNr2JC6G2QJ5kTDhYWUD3AwmhKynad t07ixqbXRYRpeeQOGzURlacEYeSsRB7kKBdARfdlSdMwunxXnQkgLTc/1HrOqFX4jgJ8a bonNBEe6IiYvPknOczPc0RlUbgY4xzCIcIE= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513079398100063 Content-Type: text/plain; charset="utf-8" The SetMemoryEncDec() is used by the higher level routines to set or clear the page encryption mask for system RAM and Mmio address. When SEV-SNP is active, in addition to set/clear page mask it also updates the RMP table. The RMP table updates are required for the system RAM address and not the Mmio address. Add a new parameter in SetMemoryEncDec() to tell whether the specified address is Mmio. If its Mmio then skip the page state change in the RMP table. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- .../X64/PeiDxeVirtualMemory.c | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c= b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c index 56db1e4b6ecf..0bb86d768017 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c @@ -673,6 +673,7 @@ InternalMemEncryptSevCreateIdentityMap1G ( @param[in] Mode Set or Clear mode @param[in] CacheFlush Flush the caches before applying the encryption mask + @param[in] Mmio The physical address specified is Mm= io =20 @retval RETURN_SUCCESS The attributes were cleared for the memory region. @@ -688,7 +689,8 @@ SetMemoryEncDec ( IN PHYSICAL_ADDRESS PhysicalAddress, IN UINTN Length, IN MAP_RANGE_MODE Mode, - IN BOOLEAN CacheFlush + IN BOOLEAN CacheFlush, + IN BOOLEAN Mmio ) { PAGE_MAP_AND_DIRECTORY_POINTER *PageMapLevel4Entry; @@ -711,14 +713,15 @@ SetMemoryEncDec ( =20 DEBUG (( DEBUG_VERBOSE, - "%a:%a: Cr3Base=3D0x%Lx Physical=3D0x%Lx Length=3D0x%Lx Mode=3D%a Cach= eFlush=3D%u\n", + "%a:%a: Cr3Base=3D0x%Lx Physical=3D0x%Lx Length=3D0x%Lx Mode=3D%a Cach= eFlush=3D%u Mmio=3D%u\n", gEfiCallerBaseName, __FUNCTION__, Cr3BaseAddress, PhysicalAddress, (UINT64)Length, (Mode =3D=3D SetCBit) ? "Encrypt" : "Decrypt", - (UINT32)CacheFlush + (UINT32)CacheFlush, + (UINT32)Mmio )); =20 // @@ -760,7 +763,7 @@ SetMemoryEncDec ( // // The InternalSetPageState() is used for setting the page state in the = RMP table. // - if ((Mode =3D=3D ClearCBit) && MemEncryptSevSnpIsEnabled ()) { + if (!Mmio && (Mode =3D=3D ClearCBit) && MemEncryptSevSnpIsEnabled ()) { InternalSetPageState (PhysicalAddress, EFI_SIZE_TO_PAGES (Length), Sev= SnpPageShared, FALSE); } =20 @@ -998,7 +1001,8 @@ InternalMemEncryptSevSetMemoryDecrypted ( PhysicalAddress, Length, ClearCBit, - TRUE + TRUE, + FALSE ); } =20 @@ -1031,7 +1035,8 @@ InternalMemEncryptSevSetMemoryEncrypted ( PhysicalAddress, Length, SetCBit, - TRUE + TRUE, + FALSE ); } =20 @@ -1064,6 +1069,7 @@ InternalMemEncryptSevClearMmioPageEncMask ( PhysicalAddress, Length, ClearCBit, - FALSE + FALSE, + TRUE ); } --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80102): https://edk2.groups.io/g/devel/message/80102 Mute This Topic: https://groups.io/mt/85306686/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80103+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80103+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513078515668.0735380003067; Wed, 1 Sep 2021 09:17:58 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id 39pnYY1788612xWLGoR2cBfZ; Wed, 01 Sep 2021 09:17:58 -0700 X-Received: from NAM10-BN7-obe.outbound.protection.outlook.com (NAM10-BN7-obe.outbound.protection.outlook.com [40.107.92.76]) by mx.groups.io with SMTP id smtpd.web12.165.1630513077014031814 for ; Wed, 01 Sep 2021 09:17:57 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TUcRnckaWPo2x5dHh+Pc8WCEfi9RQd9/N2xTj6zza4w4kpO8TPKvGLztOJodDrIMLtynHcGJA8d/d3uaIQu0JwFmfKe1jSDRS4zpsoP0ATW6vw8a+SpbdXV3trex/TKIEXicJ24m9rDyZl4ed+I1WS8LzzO9jInbnxAaLuyOLYdyzCfDIXUAtDvhGxVk7pBR/nnHmMv8XTU+W8wEO7KjYd4efUlB1LKcMJWO5QRgsRw2PGoF0xbg0edMRluoJoXZYUGrKozB6bR6ZG1vuUg11T1BGAan1q0cwgbcExu7nDgGIfEZbLYiwPFahnzZ/N10SHxPalLF8gA9L7nFmdmjJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=0cAck3GUVGG3XDoaGy8JYF5AgZvUawhcQTCvX8en/pE=; b=MKZOWQko0MEL73XpnSN9mQVpCUvx2unxVvTQ+TjFrkjS9V/QbRM9El4TV8wQ47uxWJ8D6T4d/37T/NoHLR2XHOmx0ZzsQqRyD/A2mbL5eJr6RKt4CCSU4BpIrW/2r64kpPonDdbxrRlFT/HPv991E0P60+Uf7V7X7nx+GpDO+TBE6ADBnuTdx7F/2YyXL8Z8rFGW+ldfppA5KjkU3YRsDPP5bAv7hQKD1mkJEtq+YPRP1mfmmvaJd3dIJJ8B5XfO4sKRF04F/f4ZW2a8rO/iNe1YWEHuAzVRcHjmrOPRjbd33EjkJ4jG4ztl3vwmwtg4MQ0xL6xGJRehc/sBKlNYyA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4512.namprd12.prod.outlook.com (2603:10b6:806:71::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:55 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:55 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 27/29] OvmfPkg/PlatformPei: mark cpuid and secrets memory reserved in EFI map Date: Wed, 1 Sep 2021 11:16:44 -0500 Message-ID: <20210901161646.24763-28-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:55 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 1cad0b5f-9344-4cf0-4434-08d96d640e44 X-MS-TrafficTypeDiagnostic: SA0PR12MB4512: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7219; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: Kmh3QkkD4zVId3lhEhtO29LFY6x+OvEI/oGAiGfHciemCsMplB9hknYdgQwGTsNOl7ipmyUYowYLdso1+5/cEBH5jJwy9Ghjo6LzR0WP+EaPxD03Zk2ISN47pzDjqssOA5D4MDlnXL5L3slOTsZatiGfmZ5b+jWW9O8Xa+ypz5XpVmLmvg83rvGV6Wqn9LWDS9lRZUd8z83OI4Sa8vlxYGGnj7P+N1r96eCLYJW8G0lrdp0E7Wkfc4Btt4F7Ge0nxsHJwDaMeL61Iyzqb/exI44ENwSJBgCZT1Ri5bQwETZR+kZtawDpqa21B91RookTd4yk9KyuC2L8FzdwhiyTLuwFljtIY1SJMmHeeT7OBLg17Ye4RqV47ptvvSfkI/VEyjMsNiFiyQv8j9pLhAiekl8PQePMzFX8fDLsFzsy2nuQ1YmMP21H4Fsnnj9xGj5cMPIr+MOZLXYVE52c/tnmQHmqGVLrB0PmgjM6IL/rNSbzvznzo+nYs0zo9gKpELGzKjdW4izfU+IzEXv9hhzQ3DNcKNS8MzytjXtuOVED3/ZvTXvJlPtEy6EgSt2t+1yfUoRPnCrvV/ojOGwf/XF8mc7TSyUGmMd8ONUaozFCjkIjYzsSnJ7vqLBbiWTh+VaV4hfp86sHa5UjEhVtadO3XmE5qr2mQ7ar3BbFjE3xnC9wEi+790FwPFBtoBiIN19PD7Uwdzja2rGTDqDKKl+SfA== X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?lbFMgvAy3n2YHQ5miAfX4zmPpABKicXTk71bHoGohoUGL4Gps3KaaB1nKRVR?= =?us-ascii?Q?JhnfvQWRkrbZ9rtf/rLYoTqCUdRXinZG++9Y40LmeXtHKCZaYcHTrANh8AGd?= =?us-ascii?Q?sHcbC1aLfD3Z2JUP7cIG17WllJYaPPgG4M4758/U/mTKL/B59QA9kSHregPS?= =?us-ascii?Q?nBwadl9qRdJlBYV/59KqR90qdLyBbaUTK5UVCzudoR+HX18sS2/+1Ad/vClO?= =?us-ascii?Q?0inp2Idh3y0JKKre7SD4TZhDLlxk0u8/xkC5hXH1guKS1t0o8LTJ43Jm4MWg?= =?us-ascii?Q?WJ5S84Dpo0lL05sJkWuYNAhrJ1qOKjJLe3x/Wr2ZCILo+eZC7RuqizbevJU3?= =?us-ascii?Q?gXmKB2mdLACYkFYZoVKMqanxquPIfJXivLeOcj3A8QhznsFCOuIqIR6/FvCZ?= =?us-ascii?Q?E1HCu3J2GaJKKe3bd5FqUP84DlMFb6xjiDcsEteVS8lzRnMR5k6mqvSCrQGm?= =?us-ascii?Q?wemt/RU7VPHYlpLJEnRmM3NFcWphc5Iq0Jm6zD7xv7GlLEJv9l14YiMyTj2J?= =?us-ascii?Q?izmY96oGuEZLTqDX6n0JKdKWbwSbswllEK9STTim3UN3I4eVdxPnyjRAmPxc?= =?us-ascii?Q?q0z9n1Axvhn2iHSQrDrHvTtJgMOjxQTKE/17I82TMOr8O6WLAvqGgRSMtPOr?= =?us-ascii?Q?JL1CwXS1NJG2/UTQf0CrIO7LDmxE9U918SbW6rCG+o9m/YiY4lz3AhdVQvSI?= =?us-ascii?Q?Q/e7tvTpMVTRrVocGgTdRZcDfKx9B+6tiWIcDM4AVOjk1jpB42m+Y6y7woWK?= =?us-ascii?Q?jAbnmECQvQLa2zzweiygsk1uP3L9gZZWkTdnbIOwRN9kiCu6c56Rv0SYftk/?= =?us-ascii?Q?o2K/6fIAtOx6vFqtGdWUTPX+L+nLPsKjyhXTpvhV2DXBmQkOykuoIgF3lKdU?= =?us-ascii?Q?HxAzn7z+McZnRk0476boChrbuyxy1DMvgcHaeD6hgvfld92CVCfVxPvBcndP?= =?us-ascii?Q?vru6ewUonORJGzdBFh1km+2V/2iFfd3wie9to2hCI6BIVGg2R+uNCZXccnx4?= =?us-ascii?Q?p8QOHy/PIFTb5mtUK8UqXj/Q8HXoC15ZDJXtlNIaLEcokk9+F0r1Lmh4dO0B?= =?us-ascii?Q?khtdZNMm1uZml5YIw2FFGC1bR+COVxBjx49EVJad8ekWQ4BmNTIQe5pBbzlZ?= =?us-ascii?Q?sfudOMR6d+fVGFX3RyFWOwSalSJG2jS6ZMOg67WlQumZY55E5DQmHGX1VZHp?= =?us-ascii?Q?Ub0k8tWr/pAcHEoim5zmjoDovRnFI9YdNpNdOEKXSYWjdRF7vLbWtu7DFRTP?= =?us-ascii?Q?ldgl4UkpRUX7pjXLT0XGf3HudEZBujk22em8FsFqX3uiaoqyiRSQWAgmZhnG?= =?us-ascii?Q?4e4OEKiAhiXGphGWT9fzOCrK?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1cad0b5f-9344-4cf0-4434-08d96d640e44 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:55.4826 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: iE/fEkTp65S/5gIdMeHk/JIMJiR/MBwmQmUw9EDbCi9oN4aI4ShWtL8NgcSmJsaVqUtHYAfy5c1iWZKGg02ebA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4512 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: 66WaIu4u1YHd2Abp2OVKnNGXx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513078; bh=L2TXykE+Ur3bxD2PLPprc/pu1lQ6EDzVchzDEwTTu30=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=hH/neX7Nr5kYgdiR9YRTJKvqmJWbehbK97vbV1wAyrse+gwDHjfRgpoauGtUCQXBpZF XYdR+fZjtEtap+B2tBNTkSJjKEVp3DkzHLbgSK0Q2PyvE0zzkcaoLQtUDjzOPnslr0GHE MjGBoHKydbBhGmKT7Z5JdAo+6KTLc5peeWM= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513079436100066 Content-Type: text/plain; charset="utf-8" When SEV-SNP is active, the CPUID and Secrets memory range contains the information that is used during the VM boot. The content need to be persist across the kexec boot. Mark the memory range as Reserved in the EFI map so that guest OS or firmware does not use the range as a system RAM. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/PlatformPei/PlatformPei.inf | 6 ++++++ OvmfPkg/PlatformPei/MemDetect.c | 21 +++++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/Plat= formPei.inf index 8c9795095a10..82a0ee721da2 100644 --- a/OvmfPkg/PlatformPei/PlatformPei.inf +++ b/OvmfPkg/PlatformPei/PlatformPei.inf @@ -122,6 +122,12 @@ [FixedPcd] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupSize gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaSize + gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase + gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize =20 [FeaturePcd] gUefiOvmfPkgTokenSpaceGuid.PcdCsmEnable diff --git a/OvmfPkg/PlatformPei/MemDetect.c b/OvmfPkg/PlatformPei/MemDetec= t.c index 2c2c4641ec8a..564c3dabc487 100644 --- a/OvmfPkg/PlatformPei/MemDetect.c +++ b/OvmfPkg/PlatformPei/MemDetect.c @@ -817,6 +817,27 @@ InitializeRamRegions ( { QemuInitializeRam (); =20 + if (MemEncryptSevSnpIsEnabled ()) { + // + // If SEV-SNP is enabled, reserve the Secrets and CPUID memory area. + // + // This memory range is given to the PSP by the hypervisor to populate + // the information used during the SNP VM boots, and it need to persist + // across the kexec boots. Mark it as EfiReservedMemoryType so that + // the guest firmware and OS does not use it as a system memory. + // + BuildMemoryAllocationHob ( + (EFI_PHYSICAL_ADDRESS)(UINTN) PcdGet32 (PcdOvmfSnpSecretsBase), + (UINT64)(UINTN) PcdGet32 (PcdOvmfSnpSecretsSize), + EfiReservedMemoryType + ); + BuildMemoryAllocationHob ( + (EFI_PHYSICAL_ADDRESS)(UINTN) PcdGet32 (PcdOvmfSnpCpuidBase), + (UINT64)(UINTN) PcdGet32 (PcdOvmfSnpCpuidSize), + EfiReservedMemoryType + ); + } + if (mS3Supported && mBootMode !=3D BOOT_ON_S3_RESUME) { // // This is the memory range that will be used for PEI on S3 resume --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80103): https://edk2.groups.io/g/devel/message/80103 Mute This Topic: https://groups.io/mt/85306688/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80104+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80104+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513079771632.1823952914159; Wed, 1 Sep 2021 09:17:59 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id jGczYY1788612x5xg1bPDzCK; Wed, 01 Sep 2021 09:17:59 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.81]) by mx.groups.io with SMTP id smtpd.web09.162.1630513078582068804 for ; Wed, 01 Sep 2021 09:17:58 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DVE2gy5+zQxEaGTkDrax5h63nzhJTm14R/jwcpFYIhGgelN2gxneb2Gk8UkW0P3ZNSXRjbI+qGlU204tPKasmiaGfPXUbEBqMVCDh3ccLwJ7nExaG64RP5UVTunZ/sJXpAFpiOxaY5YXuSCG/Pvue2a4WDN1YYaXNF4wBUj8/QP/1VD2Z98HuTSoqHPOzS49k5tZM+wpol5JEgosuQ8IqLZxmLkYjTZqiyavlBJoLPVn91HqdiO9eOVA/WnTylx2fHUImdiW/WdRKENrixJxfxTpBDi8FewevZGeHFvjZcWOl7+9IJH6RMSEWsxOa8N8Ref8jExe8ZPGw8UtSxn09A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=0qF2tIYl2bGbK/jM/39hEVTg7rjtu/4XtKkHbJToEFw=; b=VA8q8E74ZzvAoKuvdOvd5qQGIGbdsO8FKJimzjMhhPBvTndWWEIK5NeBxW3aQV9+yaAuFfxQW/w7mbTXNUT5ySvDP5o+Khtv6v8qjkpk/Hmf8cSrm1aW31EuZ5Jbmon20wRmk9zbhBdUYoJSq8S2t3XEtV9H08sP7h8bPazYtCw3uDz5XPYHjBa7SokpO2Y5DaLcKDTd4NFTjmRBWqD2eVDGaYKiI9pQHGFEXkTjfnWOYZ6gXx/doKkXejLT5VethiWtSVt/m/StDjTHMk4/TyJ1dlBW3tVlS3YuqZ20sm+9eTSizfJj0hjLaeDvysrOAZm2Mju2NTCQhYzIUb1NrQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4512.namprd12.prod.outlook.com (2603:10b6:806:71::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:56 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:56 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [edk2-devel] [PATCH v6 28/29] OvmfPkg/AmdSev: expose the SNP reserved pages through configuration table Date: Wed, 1 Sep 2021 11:16:45 -0500 Message-ID: <20210901161646.24763-29-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:55 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 0fc78444-01f1-4fbf-9bed-08d96d640eb1 X-MS-TrafficTypeDiagnostic: SA0PR12MB4512: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:5516; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: 7muMB3tPQ7vsmGaRxJVV5l1Op2NppblWruYYIr0eGQxRuCT2XZd5CAsQCgiEEIKLI8FJ4hLjFBIjGNAx73+L7oRz81OsyrsOtx3lZNAWt//8aHNPdFm2YbuwO2s0H9pTaiguIU5f6DNs7uO6rlK8u3zPm7KQiNHNCDLjUF+5UU8uIgAUcDVyewa7YdfR9y4M1qmLU9hIo08yx+ZpP3SvmoFx3+sPNDkzOz4O1oef5/Bk4HbWedysU3S58rMUJFZq8Q0T2cNU3P6e0NcymB+j0mb5lDGaqJuvZUKzYWS5OVGjGZ5IbB24wv8t96lSLrE+pH2nhqv7fmaFPhYlQU/GgOJy8SYxmBeDdwaxZi/aYcKx0GD7UnM/cXskLQr9OMuaPrV8LY4oNbKFagk6aaT1nN7kNAfbbL4+AB1B3w5C5G1DGJ51Ju6tHBKJXcSRejn6M7mI3xOtV9sLNi+tiUjzh9k0wmB+6d6Dc1pV2BiomXzZXhmPNxf52eP/bP42IJvACa339vDir5IRNx90RgmyhmyCB+m96ly5krMt7FdaumT/sZt1dQcvdbocNs0gQNKM+33u7jTLhutZofPi43YbZM5L4CQt0klRfTQsQYPuEgKLW/JVQcClNvZK+f6846/1dKVm6YeAFwRVgy/fTOPcI3KUeBNH1TXpHgSuLJHJYlwBphs6LmFNinxl5+FSvyrWwfyXxZyaikujGH4tmxhodWri9PkOnjN1g4lNLXjB4CJ7+daSFZA+16mvWG4wJ8roND6glXht4nN5ZYEThTNOCA3f2xpQHZSevjfEQuP1aHQ= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?vpjScBLbt4wYu+mn7eq7nKgYbuOY9dFfIePp135ir5lugVg2NTrTnQNZMhte?= =?us-ascii?Q?ntkIyDB6vn0D8Yh8yFxuoTmWkfoLTK50q8+uOx1ai0TwOfXsEQtNr299VlFq?= =?us-ascii?Q?R91mU9dqW2C3dXz/fI3P2K3jGbPYcMInTenJhbFIJ31L7L6NwE5cnTj0D76/?= =?us-ascii?Q?HC+YSZA3vzv6TESMVvuQ3iDoi0RhZjwHu7u5pGKTkxHqZEVCv5/pUvKOtM9n?= =?us-ascii?Q?/anITqI7fMLaJxlrTWq6kIfZuI07rOMpx6m5zQtvUh8kK3flWW1zm625qVT+?= =?us-ascii?Q?+HzKaHaLc+uuBBh58dxf90PiqtqA2k4GHo7+lm7QkAhnIpiMrjMhMQPggs/O?= =?us-ascii?Q?LKt8+6lfsiipqAWTSomzWv2sNYZHJL/2nL9gAGGD6nADYpJghxsE8jIzgKeN?= =?us-ascii?Q?PxalwcHIkpmH/5M+mQWOoUpQdcXHBHtu+QOzzo+fzVlDgN3j0RbIOHh1Whgu?= =?us-ascii?Q?f3+NIZo5NbtWmG0pjEPiakU8RWoHtIMQ/Mholo1pKCT5zt6q5PNbtiGGDDb7?= =?us-ascii?Q?mpyXGyv5p5+zhiWvvCvZeXo1x4KV4T8VprvJL51uLO6x2c1euudbS7C0bryl?= =?us-ascii?Q?Pmt77+Q9J/2knLdjNoUyf8GqVgoctBo1Wg4U9gLBf6Lxsk+oKPM4rnBbpMQg?= =?us-ascii?Q?UBjzK0UCsH3b0Co+Ffxmiq7n00lUmD0q3BMGdjuD0fSlbrAs8T8aUQEaSTbH?= =?us-ascii?Q?jW9A7IEhV9xg69PSTsLW+f9pZQQxeULHywiBTDQ6sQTcMoZN/69Sm2UkJere?= =?us-ascii?Q?V7GjtMuH/5120Lq7Fqv1+6RUzo+UrHfxh88z9YuqBx2sPSuFzOpuzBQ9vDOD?= =?us-ascii?Q?1WMV1fP4EW9ResxyL/bLL6Es+baamHi+UW290LkCZwbMd4vro8Ss+t0wSglu?= =?us-ascii?Q?pZP5BGB6x+1fRVd98TRNZsc/H8yOrCG/VrmtvtrTCGmeOPTK9AOx8AtwR4Zx?= =?us-ascii?Q?llm3rUIgsPZtqZDUTyYfDDv2dF0DMYftgiMWLJ6TItTbQQ4huXt44l4JQ20P?= =?us-ascii?Q?ZBNNbi+zJEyI01I4/hraHDOLfqoN9rL8lInCO3Eeib2b5syZ3ZXPRpFyQGmG?= =?us-ascii?Q?jEmKNjrjQpUPX9OQWEYPkBCrBPieTORsOYnj7afrHPPiiLxtbFlc13374KVn?= =?us-ascii?Q?LYLepIdb3HsGz6/wjd+BqVjMmDhmSgmiuMclrP5jjJb618xKlkmHehyzMGkB?= =?us-ascii?Q?K6coEeUkish6S7JzhjQTQDY57cqeyRXerwH5/95OTYYnv53wE/+Cv0J/qnfr?= =?us-ascii?Q?gUrLg2vzwLqPtcug9PIptuHLHlozGUXq/Sw5p8eBwbcP7J3T7N9Do6kV04+p?= =?us-ascii?Q?La+E4gm4OZ7XNyH9LAlF2F+U?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0fc78444-01f1-4fbf-9bed-08d96d640eb1 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:56.2372 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: dFyvSzfRSRi+lghXVleSfaSILuwA2ToApoRWWU4ogXDTsgOzZuvRapjCjkaoy5mGFehiBqXdj3ISbxQFfySp8g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4512 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: 1epun8ESSCeVAxYKrfwTxyxtx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513079; bh=ZXus/XjE1DxYbOLYjKyJn/2NOtUG48hC1C4qC0TPoCs=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=u5oS4eB/AJTHwdAFiQACbG/0YRBARzZlRpYGSGDpbd2bwEAJx1GLcQWjtU6QwCTxkNw 17Xxqkl7t+cxavtmWWER570+g57EL2lYNt4Bid18n2qzRJhdshamHUvWYmZutWkGn35qY erCCvMGoDLLnAWt3op09J0s3im3PmhIKBqM= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513081633100001 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 Now that both the secrets and cpuid pages are reserved in the HOB, extract the location details through fixed PCD and make it available to the guest OS through the configuration table. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- OvmfPkg/OvmfPkg.dec | 1 + OvmfPkg/AmdSevDxe/AmdSevDxe.inf | 7 ++++++ .../Guid/ConfidentialComputingSecret.h | 18 +++++++++++++++ OvmfPkg/AmdSevDxe/AmdSevDxe.c | 23 +++++++++++++++++++ 4 files changed, 49 insertions(+) diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index d040ee02b94f..f4a53ab49901 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -124,6 +124,7 @@ [Guids] gQemuKernelLoaderFsMediaGuid =3D {0x1428f772, 0xb64a, 0x441e, {= 0xb8, 0xc3, 0x9e, 0xbd, 0xd7, 0xf8, 0x93, 0xc7}} gGrubFileGuid =3D {0xb5ae312c, 0xbc8a, 0x43b1, {= 0x9c, 0x62, 0xeb, 0xb8, 0x26, 0xdd, 0x5d, 0x07}} gConfidentialComputingSecretGuid =3D {0xadf956ad, 0xe98c, 0x484c, {= 0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47}} + gConfidentialComputingSevBlobGuid =3D {0x067b1f5f, 0xcf26, 0x44c5, {= 0x85, 0x54, 0x93, 0xd7, 0x77, 0x91, 0x2d, 0x42}} =20 [Ppis] # PPI whose presence in the PPI database signals that the TPM base addre= ss diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf b/OvmfPkg/AmdSevDxe/AmdSevDxe.= inf index 0676fcc5b6a4..74a55c189a09 100644 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.inf @@ -42,6 +42,13 @@ [FeaturePcd] =20 [FixedPcd] gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize + +[Guids] + gConfidentialComputingSevBlobGuid =20 [Pcd] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfHostBridgePciDevId diff --git a/OvmfPkg/Include/Guid/ConfidentialComputingSecret.h b/OvmfPkg/I= nclude/Guid/ConfidentialComputingSecret.h index 7026fc5b089f..769f2831f3e5 100644 --- a/OvmfPkg/Include/Guid/ConfidentialComputingSecret.h +++ b/OvmfPkg/Include/Guid/ConfidentialComputingSecret.h @@ -18,11 +18,29 @@ { 0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47 }, \ } =20 +#define CONFIDENTIAL_COMPUTING_SEV_BLOB_GUID \ + { 0x067b1f5f, \ + 0xcf26, \ + 0x44c5, \ + { 0x85, 0x54, 0x93, 0xd7, 0x77, 0x91, 0x2d, 0x42 }, \ + } + typedef struct { UINT64 Base; UINT64 Size; } CONFIDENTIAL_COMPUTING_SECRET_LOCATION; =20 +typedef struct { + UINT32 Header; + UINT16 Version; + UINT16 Reserved1; + UINT64 SecretsPhysicalAddress; + UINT32 SecretsSize; + UINT64 CpuidPhysicalAddress; + UINT32 CpuidLSize; +} CONFIDENTIAL_COMPUTING_SEV_BLOB_LOCATION; + extern EFI_GUID gConfidentialComputingSecretGuid; +extern EFI_GUID gConfidentialComputingSevBlobGuid; =20 #endif // SEV_LAUNCH_SECRET_H_ diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.c b/OvmfPkg/AmdSevDxe/AmdSevDxe.c index c66c4e9b9272..3af40f4cf29b 100644 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.c +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.c @@ -17,8 +17,20 @@ #include #include #include +#include +#include #include =20 +STATIC CONFIDENTIAL_COMPUTING_SEV_BLOB_LOCATION mSnpBootDxeTable =3D { + SIGNATURE_32('A','M','D','E'), + 1, + 0, + (UINT64)(UINTN) FixedPcdGet32 (PcdOvmfSnpSecretsBase), + FixedPcdGet32 (PcdOvmfSnpSecretsSize), + (UINT64)(UINTN) FixedPcdGet32 (PcdOvmfSnpCpuidBase), + FixedPcdGet32 (PcdOvmfSnpCpuidSize), +}; + EFI_STATUS EFIAPI AmdSevDxeEntryPoint ( @@ -130,5 +142,16 @@ AmdSevDxeEntryPoint ( } } =20 + // + // If its SEV-SNP active guest then install the CONFIDENTIAL_COMPUTING_S= EV_BLOB. + // It contains the location for both the Secrets and CPUID page. + // + if (MemEncryptSevSnpIsEnabled ()) { + return gBS->InstallConfigurationTable ( + &gConfidentialComputingSevBlobGuid, + &mSnpBootDxeTable + ); + } + return EFI_SUCCESS; } --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80104): https://edk2.groups.io/g/devel/message/80104 Mute This Topic: https://groups.io/mt/85306690/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri Apr 19 09:50:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+80105+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+80105+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1630513080459206.17395015432794; Wed, 1 Sep 2021 09:18:00 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id 2FlMYY1788612xgXLu1YuHWe; Wed, 01 Sep 2021 09:18:00 -0700 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.81]) by mx.groups.io with SMTP id smtpd.web09.162.1630513078582068804 for ; Wed, 01 Sep 2021 09:17:59 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=JOqaAn2oVR+/wvBrXIDbQMEd0s6p4mumfh2tJZA0QCPNL64zmzlk6uW9efpqCgzgpGJjQg16yIHB2Lk7dGY8edtf2yREArDloJS+mtAFlNaOyExB0HsGE7Zbg651tZ+GmuybhAx3/OUJLTUuSQQ6a0uQ843dN3UVu5oxjR49oH0khKV1EMldnPL0JoBaEvxUnaZs3odGYJjdI73s0RY4eFbb08/GZA1lXuzKA5SReytAMRG8WaqBDLeLXGSd6VxZ62Cq7/7Ry4i0IMAzUR9MuZAsPoeln5EakP9pEgLpJ1cdBnxRnRyeZ2BLtgmPxZfwRsizHiUTA0XImIYFNLEGuA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=vcfJXMcGeQABWA+yNgyblRYHmC6TOOkDRKjJTckaP+c=; b=NHNCN20oIAs0WKzdSZIFQGgsDAMEfnUPmCqGsg8ATuuYTN6bz8g8rFfxqgNpDj/fiz8HCCV5Mdr11eOTitbXnOqTmSNOR6b1OuT11mgGGWrkTM44906gs9yq8A/sRr7M0jPjFuTD20inin5jmKYghB9wYRF+uMpqL+b1gtA9wKB7rWbXJG66vYztoceLs59zT5YBvJC8yR+MckzWWLac/u3InHa/hmrqM2llDPO2XuL4TUPtR0k/3Be7jcXdzCOFNAqsIpE0tuQpBhScqs6UbFetIvwkvJTU6/LqkMTYdiiLkrv1y1Oy5VLcNW/SBaTJxa0zM20Q6WqmkcdSbNTBrw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4512.namprd12.prod.outlook.com (2603:10b6:806:71::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:57 +0000 X-Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:57 +0000 From: "Brijesh Singh via groups.io" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Michael Roth , Eric Dong , Ray Ni , Rahul Kumar , Brijesh Singh Subject: [edk2-devel] [PATCH v6 29/29] UefiCpuPkg/MpInitLib: Use SEV-SNP AP Creation NAE event to launch APs Date: Wed, 1 Sep 2021 11:16:46 -0500 Message-ID: <20210901161646.24763-30-brijesh.singh@amd.com> In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:56 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: d33505b1-e72e-4ccc-21c1-08d96d640f36 X-MS-TrafficTypeDiagnostic: SA0PR12MB4512: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: RRDwjI4VP2X7lzq93gWRTl9z+3fcAxQC/5vokLKdFLnzlc8VRYt2ILg/enwLRpeY13yjaNjPHRrIcBg9xjiVKCXefqufsIZz98SKtazZMSv1rI76IEbOs8zeibHr/7j72iAHliEfZ/rzYEUhDbPMS7zM/D0hc0+3M2bRuFY0AXwvWTtao3Gg/H7fupY5ONsHYJG5DcnIoT4PznoyFKIKp2yg9e7sgZJDozCXw93lEb7mJ5QBUUzqA0FdmwAsOopjGex5UJjMCQ+kpcwDQh2mXfRramlPuzSsB0aFQoml6ZWs5XRjVhOVzhCMzgiUNg8zx9zRooUIQlcI2vO4mqIuYfcCKZJbtf6L4zmnb4EZmhKpNmuidFpxSeeC58f5CzwEKZ0011j6WY3hoU3QcWXeT9mUdzr3zdNi2xRzBfMDHKuL4eWetYzAhiOl9hu1NIwpGDoxMYH8Etwvh1aLVRFAZ/+yGmsLvB24CJ5nCVxOZLsuWFHDzMDA0hNLqRwgDLmBED34dw6SbHdMO6zARQTwiyvV1CNRdJM+XLR8XzGctiuUydvHqJGjnhHn81Gu1D1LX6p6mnCM4o0q2WnnN0d+z6nA+KstBXdDWEhbNSyyks4XXeEW9TTfAfDo3adYeqh7I1Yw+knr6t+5EF6BeUC31a53ZH9iTkNY7Wsr8Y4t78kqLqoBVdkYy+/iypnR2hTVfMys7qIEIV6WdjljQT26jgqo24LLhSq1l1ExPE/sWXtJf7Ok0XL2QH6qSQX+xwtdPzCS7MdxtpYNLmV/X5aURhj4rGmdpDaruNwe9dlt/VE= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?OkAXF0bDNG8Ue+r+kNj8+dxCJnrTWmwbxxc5uTnY5E4iezAhWxc0gh2pYHuT?= =?us-ascii?Q?xwvq118f/yRVJDX3pv2myy8kyiaang107c3c87AIrItr46mDe/PQruXoNzZG?= =?us-ascii?Q?GAzBT2BsfTQxQFsh6USrlYDsd3vRYPHCTm+e448B0mWgyQnkKVaLfEHosJoA?= =?us-ascii?Q?Mt4zc27+GE4KZiDXb9Tw0bYwkX17ljjs4bop43THpGpGnfaLvIu4iGU005/N?= =?us-ascii?Q?6BA4eHqURtkrqFBej+u/sS3a7ME5AtirlXxO8eeRA7/mpblEUTJ7yyP+S2W2?= =?us-ascii?Q?ewVyGMwdk9BMzDLy+et2sD6dSJQqItQEOoPNdW512PXrNQecW+P2SXBXYFEj?= =?us-ascii?Q?h/dFHOAeSMe3Xd8/Txe0llaCdLONwKT3DLUHBVjiOmArLoShPMSDa5XF0GDs?= =?us-ascii?Q?SA6FaOa53xbP+xsXUCXipez5ebz/k+cIWahBv4DrP/b43YaH8NQuskxrsZO4?= =?us-ascii?Q?BfHPa2rLPV+1eqJ2yXYiBTi+SayvIu6qfLNB4PwPV8tCddfwXUIFf//wwlJW?= =?us-ascii?Q?zXOit9iCSnejHPTqsonnIkxRVsjqx5W1NaS2gAQPNu04iEjaW0t1xZxOh0of?= =?us-ascii?Q?1Ya1HK0rJUzqSM8xU7knVoJZbXX1XIu6W0QWzyD4jgJmL1Mt7OG4AMUB99Ay?= =?us-ascii?Q?jdUVKryGn6vFkMo+I5FvqEppXkvctqvoxk6PdhA4w3/E93/6qANIKagiOHQ4?= =?us-ascii?Q?OHMMuPPX+mrxtOjcaVTYnAWmKEF91+0D/kZExNuJNYKTKwSvXQQ0DDAKcVtR?= =?us-ascii?Q?Aq292uZa5J91JZ5q/+GiwIIPmZJdILscmhKw8OAyF76g71g1P8i2TsarI5VI?= =?us-ascii?Q?1uK5h0erCAy3EaBhNETU6zdSxEZCJh41DqlQDr35dCy5hJ/l70k4q8O2CO4N?= =?us-ascii?Q?BlL5JtIewZQdA9wlKgLmN5p5Hbhk1MZSryABI6rzWYsloDZkrPaL5vVfjNpy?= =?us-ascii?Q?rv9nsF3/Vni44m7rPIMrj9PW/i73OeBtbYSCQeEEyMii/NdMtvCHK3sbMejg?= =?us-ascii?Q?S88nYzMahgeJ+iX2SOcyDhJPtS7phcxvN1TU5nANJbHnqZIDtDx5A4KFP57K?= =?us-ascii?Q?ObnvCVWKP7e0E6y8ECBhOzSpK5bKKHDWTqIDDShf9WkLIXYOYVsfvkgEVR6a?= =?us-ascii?Q?v5JyrfixDw3KvhLEj2aJMV13N4Kauh7SnRHS2PtoRIiCxhAv+aYtO1Zap5++?= =?us-ascii?Q?+gB9+mIehgQxmUiAt5KNjFe984VdUrSl3W64IzPLkL/S87wISbSldQBX8xUc?= =?us-ascii?Q?+hs/IYZaVinRBE15XwbZ+S7YfrkiGgHoOogAh3vfwiDMXEJZmkVOYUzZkNOR?= =?us-ascii?Q?sUQbcV0O5rsdIpm+kAdHuXa6?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: d33505b1-e72e-4ccc-21c1-08d96d640f36 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:57.0797 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: jE0h8KXYriNp3PBM8Q+IsU7+dVekGGHjo8nyyFhwdQIWjgPmYDgKBdLBOzfeLicxChy3n911ThmwL5Uny8KMXg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4512 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,brijesh.singh@amd.com X-Gm-Message-State: S04ZKQkbiulSAhhr83wwbVksx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1630513080; bh=HWus19cn2SyNSJSwnsSI8fvAjDxJOs/21yVw2ruoN6g=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=r7J7HxKKKD+EOcroURkKBj5l87Tvd8jySnt62HEksvJyKlVfEzIuig+KScfcCJId6U6 0YMVr4RI/rjOzynnPmi4DNb8REge2JEb4ULj2Vf1ZDTD8214dfLJQ4yQNZvCrckzVr44t zPREiFT8/EJYabJDR8XlpMQXQMbdsZKWWPE= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1630513081704100003 Content-Type: text/plain; charset="utf-8" From: Tom Lendacky BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 Use the SEV-SNP AP Creation NAE event to create and launch APs under SEV-SNP. This capability will be advertised in the SEV Hypervisor Feature Support PCD (PcdSevEsHypervisorFeatures). Cc: Michael Roth Cc: Eric Dong Cc: Ray Ni Cc: Rahul Kumar Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Tom Lendacky Signed-off-by: Brijesh Singh Acked-by: Jiewen Yao Reviewed-by: Jiewen Yao --- UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf | 3 + UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf | 5 +- UefiCpuPkg/Library/MpInitLib/MpLib.h | 17 ++ UefiCpuPkg/Library/MpInitLib/DxeMpLib.c | 11 +- .../MpInitLib/Ia32/SevSnpRmpAdjustInternal.c | 31 ++ UefiCpuPkg/Library/MpInitLib/MpLib.c | 275 ++++++++++++++++-- .../MpInitLib/X64/SevSnpRmpAdjustInternal.c | 44 +++ 7 files changed, 361 insertions(+), 25 deletions(-) create mode 100644 UefiCpuPkg/Library/MpInitLib/Ia32/SevSnpRmpAdjustIntern= al.c create mode 100644 UefiCpuPkg/Library/MpInitLib/X64/SevSnpRmpAdjustInterna= l.c diff --git a/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf b/UefiCpuPkg/Lib= rary/MpInitLib/DxeMpInitLib.inf index 48d7dfa4450f..b9ce05e81b54 100644 --- a/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf +++ b/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf @@ -23,9 +23,11 @@ [Defines] =20 [Sources.IA32] Ia32/MpFuncs.nasm + Ia32/SevSnpRmpAdjustInternal.c =20 [Sources.X64] X64/MpFuncs.nasm + X64/SevSnpRmpAdjustInternal.c =20 [Sources.common] MpEqu.inc @@ -72,6 +74,7 @@ [Pcd] gUefiCpuPkgTokenSpaceGuid.PcdCpuApLoopMode ## = CONSUMES gUefiCpuPkgTokenSpaceGuid.PcdCpuApTargetCstate ## = SOMETIMES_CONSUMES gUefiCpuPkgTokenSpaceGuid.PcdCpuApStatusCheckIntervalInMicroSeconds ## = CONSUMES + gUefiCpuPkgTokenSpaceGuid.PcdGhcbHypervisorFeatures ## = CONSUMES gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled ## = CONSUMES gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase ## = SOMETIMES_CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard ## = CONSUMES diff --git a/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf b/UefiCpuPkg/Lib= rary/MpInitLib/PeiMpInitLib.inf index ab8279df596f..35057ac07cbb 100644 --- a/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf +++ b/UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf @@ -23,9 +23,11 @@ [Defines] =20 [Sources.IA32] Ia32/MpFuncs.nasm + Ia32/SevSnpRmpAdjustInternal.c =20 [Sources.X64] X64/MpFuncs.nasm + X64/SevSnpRmpAdjustInternal.c =20 [Sources.common] MpEqu.inc @@ -62,10 +64,11 @@ [Pcd] gUefiCpuPkgTokenSpaceGuid.PcdCpuMicrocodePatchRegionSize ## CONS= UMES gUefiCpuPkgTokenSpaceGuid.PcdCpuApLoopMode ## CONS= UMES gUefiCpuPkgTokenSpaceGuid.PcdCpuApTargetCstate ## SOME= TIMES_CONSUMES + gUefiCpuPkgTokenSpaceGuid.PcdGhcbHypervisorFeatures ## CONS= UMES gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled ## CONS= UMES gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase ## SOME= TIMES_CONSUMES - gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase ## CONS= UMES gUefiCpuPkgTokenSpaceGuid.PcdSevSnpIsEnabled ## CONS= UMES + gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase ## CONS= UMES =20 [Ppis] gEdkiiPeiShadowMicrocodePpiGuid ## SOMETIMES_CONSUMES diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.h b/UefiCpuPkg/Library/MpIn= itLib/MpLib.h index 19e91bf7d74e..a046de8e5c68 100644 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.h +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.h @@ -15,6 +15,7 @@ =20 #include #include +#include #include #include #include @@ -146,6 +147,7 @@ typedef struct { UINT8 PlatformId; UINT64 MicrocodeEntryAddr; UINT32 MicrocodeRevision; + SEV_ES_SAVE_AREA *SevEsSaveArea; } CPU_AP_DATA; =20 // @@ -290,6 +292,7 @@ struct _CPU_MP_DATA { =20 BOOLEAN SevEsIsEnabled; BOOLEAN SevSnpIsEnabled; + BOOLEAN UseSevEsAPMethod; UINTN SevEsAPBuffer; UINTN SevEsAPResetStackStart; CPU_MP_DATA *NewCpuMpData; @@ -744,5 +747,19 @@ PlatformShadowMicrocode ( IN OUT CPU_MP_DATA *CpuMpData ); =20 +/** + Issue RMPADJUST to adjust the VMSA attribute of an SEV-SNP page. + + @param[in] PageAddress + @param[in] VmsaPage + + @return RMPADJUST return value +**/ +UINT32 +SevSnpRmpAdjust ( + IN EFI_PHYSICAL_ADDRESS PageAddress, + IN BOOLEAN VmsaPage + ); + #endif =20 diff --git a/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c b/UefiCpuPkg/Library/M= pInitLib/DxeMpLib.c index 93fc63bf93e3..15e797cd0990 100644 --- a/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c +++ b/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c @@ -93,7 +93,12 @@ GetWakeupBuffer ( EFI_PHYSICAL_ADDRESS StartAddress; EFI_MEMORY_TYPE MemoryType; =20 - if (PcdGetBool (PcdSevEsIsEnabled)) { + // + // An SEV-ES-only guest requires the memory to be reserved. SEV-SNP, whi= ch + // is also considered SEV-ES, uses a different AP startup method, though, + // which does not have the same requirement. + // + if (PcdGetBool (PcdSevEsIsEnabled) && !PcdGetBool (PcdSevSnpIsEnabled)) { MemoryType =3D EfiReservedMemoryType; } else { MemoryType =3D EfiBootServicesData; @@ -373,7 +378,7 @@ RelocateApLoop ( MpInitLibWhoAmI (&ProcessorNumber); CpuMpData =3D GetCpuMpData (); MwaitSupport =3D IsMwaitSupport (); - if (CpuMpData->SevEsIsEnabled) { + if (CpuMpData->UseSevEsAPMethod) { StackStart =3D CpuMpData->SevEsAPResetStackStart; } else { StackStart =3D mReservedTopOfApStack; @@ -422,7 +427,7 @@ MpInitChangeApLoopCallback ( CpuPause (); } =20 - if (CpuMpData->SevEsIsEnabled && (CpuMpData->WakeupBuffer !=3D (UINTN) -= 1)) { + if (CpuMpData->UseSevEsAPMethod && (CpuMpData->WakeupBuffer !=3D (UINTN)= -1)) { // // There are APs present. Re-use reserved memory area below 1MB from // WakeupBuffer as the area to be used for transitioning to 16-bit mode diff --git a/UefiCpuPkg/Library/MpInitLib/Ia32/SevSnpRmpAdjustInternal.c b/= UefiCpuPkg/Library/MpInitLib/Ia32/SevSnpRmpAdjustInternal.c new file mode 100644 index 000000000000..5c9ee08b2117 --- /dev/null +++ b/UefiCpuPkg/Library/MpInitLib/Ia32/SevSnpRmpAdjustInternal.c @@ -0,0 +1,31 @@ +/** @file + + RMPADJUST helper function. + + Copyright (c) 2021, AMD Incorporated. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include "MpLib.h" + +/** + Issue RMPADJUST to adjust the VMSA attribute of an SEV-SNP page. + + @param[in] PageAddress + @param[in] VmsaPage + + @return RMPADJUST return value +**/ +UINT32 +SevSnpRmpAdjust ( + IN EFI_PHYSICAL_ADDRESS PageAddress, + IN BOOLEAN VmsaPage + ) +{ + // + // RMPADJUST is not supported in 32-bit mode + // + return RETURN_UNSUPPORTED; +} diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpIn= itLib/MpLib.c index c2b00a1f04ff..01f11ab1d9b3 100644 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.c +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c @@ -295,10 +295,10 @@ GetApLoopMode ( ApLoopMode =3D ApInHltLoop; } =20 - if (PcdGetBool (PcdSevEsIsEnabled)) { + if (PcdGetBool (PcdSevEsIsEnabled) && !PcdGetBool (PcdSevSnpIsEnabled)= ) { // - // For SEV-ES, force AP in Hlt-loop mode in order to use the GHCB - // protocol for starting APs + // For SEV-ES (SEV-SNP is also considered SEV-ES), force AP in Hlt-l= oop + // mode in order to use the GHCB protocol for starting APs // ApLoopMode =3D ApInHltLoop; } @@ -869,7 +869,7 @@ ApWakeupFunction ( // to allow the APs to issue an AP_RESET_HOLD before the BSP possibly // performs another INIT-SIPI-SIPI sequence. // - if (!CpuMpData->SevEsIsEnabled) { + if (!CpuMpData->UseSevEsAPMethod) { InterlockedDecrement ((UINT32 *) &CpuMpData->MpCpuExchangeInfo->Nu= mApsExecuting); } } @@ -883,7 +883,7 @@ ApWakeupFunction ( // while (TRUE) { DisableInterrupts (); - if (CpuMpData->SevEsIsEnabled) { + if (CpuMpData->UseSevEsAPMethod) { MSR_SEV_ES_GHCB_REGISTER Msr; GHCB *Ghcb; UINT64 Status; @@ -1207,9 +1207,11 @@ AllocateResetVector ( ); // // The AP reset stack is only used by SEV-ES guests. Do not allocate it - // if SEV-ES is not enabled. + // if SEV-ES is not enabled. An SEV-SNP guest is also considered + // an SEV-ES guest, but uses a different method of AP startup, elimina= ting + // the need for the allocation. // - if (PcdGetBool (PcdSevEsIsEnabled)) { + if (PcdGetBool (PcdSevEsIsEnabled) && !PcdGetBool (PcdSevSnpIsEnabled)= ) { // // Stack location is based on ProcessorNumber, so use the total numb= er // of processors for calculating the total stack area. @@ -1259,7 +1261,7 @@ FreeResetVector ( // perform the restore as this will overwrite memory which has data // needed by SEV-ES. // - if (!CpuMpData->SevEsIsEnabled) { + if (!CpuMpData->UseSevEsAPMethod) { RestoreWakeupBuffer (CpuMpData); } } @@ -1276,7 +1278,7 @@ AllocateSevEsAPMemory ( { if (CpuMpData->SevEsAPBuffer =3D=3D (UINTN) -1) { CpuMpData->SevEsAPBuffer =3D - CpuMpData->SevEsIsEnabled ? GetSevEsAPMemory () : 0; + CpuMpData->UseSevEsAPMethod ? GetSevEsAPMemory () : 0; } } =20 @@ -1329,6 +1331,222 @@ SetSevEsJumpTable ( JmpFar->Segment =3D (UINT16) (SipiVector >> 4); } =20 +/** + Create an SEV-SNP AP save area (VMSA) for use in running the vCPU. + + @param[in] CpuMpData Pointer to CPU MP Data + @param[in] CpuData Pointer to CPU AP Data + @param[in] ApicId APIC ID of the vCPU +**/ +STATIC +VOID +SevSnpCreateSaveArea ( + IN CPU_MP_DATA *CpuMpData, + IN CPU_AP_DATA *CpuData, + UINT32 ApicId + ) +{ + SEV_ES_SAVE_AREA *SaveArea; + IA32_CR0 ApCr0; + IA32_CR0 ResetCr0; + IA32_CR4 ApCr4; + IA32_CR4 ResetCr4; + UINTN StartIp; + UINT8 SipiVector; + UINT32 RmpAdjustStatus; + UINT64 VmgExitStatus; + MSR_SEV_ES_GHCB_REGISTER Msr; + GHCB *Ghcb; + BOOLEAN InterruptState; + UINT64 ExitInfo1; + UINT64 ExitInfo2; + + // + // Allocate a single page for the SEV-ES Save Area and initialize it. + // + SaveArea =3D AllocateReservedPages (1); + if (!SaveArea) { + return; + } + ZeroMem (SaveArea, EFI_PAGE_SIZE); + + // + // Propogate the CR0.NW and CR0.CD setting to the AP + // + ResetCr0.UintN =3D 0x00000010; + ApCr0.UintN =3D CpuData->VolatileRegisters.Cr0; + if (ApCr0.Bits.NW) { + ResetCr0.Bits.NW =3D 1; + } + if (ApCr0.Bits.CD) { + ResetCr0.Bits.CD =3D 1; + } + + // + // Propagate the CR4.MCE setting to the AP + // + ResetCr4.UintN =3D 0; + ApCr4.UintN =3D CpuData->VolatileRegisters.Cr4; + if (ApCr4.Bits.MCE) { + ResetCr4.Bits.MCE =3D 1; + } + + // + // Convert the start IP into a SIPI Vector + // + StartIp =3D CpuMpData->MpCpuExchangeInfo->BufferStart; + SipiVector =3D (UINT8) (StartIp >> 12); + + // + // Set the CS:RIP value based on the start IP + // + SaveArea->Cs.Base =3D SipiVector << 12; + SaveArea->Cs.Selector =3D SipiVector << 8; + SaveArea->Cs.Limit =3D 0xFFFF; + SaveArea->Cs.Attributes.Bits.Present =3D 1; + SaveArea->Cs.Attributes.Bits.Sbit =3D 1; + SaveArea->Cs.Attributes.Bits.Type =3D SEV_ES_RESET_CODE_SEGMENT_TYPE; + SaveArea->Rip =3D StartIp & 0xFFF; + + // + // Set the remaining values as defined in APM for INIT + // + SaveArea->Ds.Limit =3D 0xFFFF; + SaveArea->Ds.Attributes.Bits.Present =3D 1; + SaveArea->Ds.Attributes.Bits.Sbit =3D 1; + SaveArea->Ds.Attributes.Bits.Type =3D SEV_ES_RESET_DATA_SEGMENT_TYPE; + SaveArea->Es =3D SaveArea->Ds; + SaveArea->Fs =3D SaveArea->Ds; + SaveArea->Gs =3D SaveArea->Ds; + SaveArea->Ss =3D SaveArea->Ds; + + SaveArea->Gdtr.Limit =3D 0xFFFF; + SaveArea->Ldtr.Limit =3D 0xFFFF; + SaveArea->Ldtr.Attributes.Bits.Present =3D 1; + SaveArea->Ldtr.Attributes.Bits.Type =3D SEV_ES_RESET_LDT_TYPE; + SaveArea->Idtr.Limit =3D 0xFFFF; + SaveArea->Tr.Limit =3D 0xFFFF; + SaveArea->Ldtr.Attributes.Bits.Present =3D 1; + SaveArea->Ldtr.Attributes.Bits.Type =3D SEV_ES_RESET_TSS_TYPE; + + SaveArea->Efer =3D 0x1000; + SaveArea->Cr4 =3D ResetCr4.UintN; + SaveArea->Cr0 =3D ResetCr0.UintN; + SaveArea->Dr7 =3D 0x0400; + SaveArea->Dr6 =3D 0xFFFF0FF0; + SaveArea->Rflags =3D 0x0002; + SaveArea->GPat =3D 0x0007040600070406ULL; + SaveArea->XCr0 =3D 0x0001; + SaveArea->Mxcsr =3D 0x1F80; + SaveArea->X87Ftw =3D 0x5555; + SaveArea->X87Fcw =3D 0x0040; + + // + // Set the SEV-SNP specific fields for the save area: + // VMPL - always VMPL0 + // SEV_FEATURES - equivalent to the SEV_STATUS MSR right shifted 2 bits + // + SaveArea->Vmpl =3D 0; + SaveArea->SevFeatures =3D AsmReadMsr64 (MSR_SEV_STATUS) >> 2; + + // + // To turn the page into a recognized VMSA page, issue RMPADJUST: + // Target VMPL but numerically higher than current VMPL + // Target PermissionMask is not used + // + RmpAdjustStatus =3D SevSnpRmpAdjust ( + (EFI_PHYSICAL_ADDRESS) (UINTN) SaveArea, + TRUE + ); + ASSERT (RmpAdjustStatus =3D=3D 0); + + ExitInfo1 =3D (UINT64) ApicId << 32; + ExitInfo1 |=3D SVM_VMGEXIT_SNP_AP_CREATE; + ExitInfo2 =3D (UINT64) (UINTN) SaveArea; + + Msr.GhcbPhysicalAddress =3D AsmReadMsr64 (MSR_SEV_ES_GHCB); + Ghcb =3D Msr.Ghcb; + + VmgInit (Ghcb, &InterruptState); + Ghcb->SaveArea.Rax =3D SaveArea->SevFeatures; + VmgSetOffsetValid (Ghcb, GhcbRax); + VmgExitStatus =3D VmgExit ( + Ghcb, + SVM_EXIT_SNP_AP_CREATION, + ExitInfo1, + ExitInfo2 + ); + VmgDone (Ghcb, InterruptState); + + ASSERT (VmgExitStatus =3D=3D 0); + if (VmgExitStatus !=3D 0) { + RmpAdjustStatus =3D SevSnpRmpAdjust ( + (EFI_PHYSICAL_ADDRESS) (UINTN) SaveArea, + FALSE + ); + if (RmpAdjustStatus =3D=3D 0) { + FreePages (SaveArea, 1); + } else { + DEBUG ((DEBUG_INFO, "SEV-SNP: RMPADJUST failed, leaking VMSA page\n"= )); + } + + SaveArea =3D NULL; + } + + if (CpuData->SevEsSaveArea) { + RmpAdjustStatus =3D SevSnpRmpAdjust ( + (EFI_PHYSICAL_ADDRESS) (UINTN) CpuData->SevEsSaveA= rea, + FALSE + ); + if (RmpAdjustStatus =3D=3D 0) { + FreePages (CpuData->SevEsSaveArea, 1); + } else { + DEBUG ((DEBUG_INFO, "SEV-SNP: RMPADJUST failed, leaking VMSA page\n"= )); + } + } + + CpuData->SevEsSaveArea =3D SaveArea; +} + +/** + Create SEV-SNP APs. + + @param[in] CpuMpData Pointer to CPU MP Data + @param[in] ProcessorNumber The handle number of specified processor + (-1 for all APs) +**/ +STATIC +VOID +SevSnpCreateAP ( + IN CPU_MP_DATA *CpuMpData, + IN INTN ProcessorNumber + ) +{ + CPU_INFO_IN_HOB *CpuInfoInHob; + CPU_AP_DATA *CpuData; + UINTN Index; + UINT32 ApicId; + + ASSERT (CpuMpData->MpCpuExchangeInfo->BufferStart < 0x100000); + + CpuInfoInHob =3D (CPU_INFO_IN_HOB *) (UINTN) CpuMpData->CpuInfoInHob; + + if (ProcessorNumber < 0) { + for (Index =3D 0; Index < CpuMpData->CpuCount; Index++) { + if (Index !=3D CpuMpData->BspNumber) { + CpuData =3D &CpuMpData->CpuData[Index]; + ApicId =3D CpuInfoInHob[Index].ApicId, + SevSnpCreateSaveArea (CpuMpData, CpuData, ApicId); + } + } + } else { + Index =3D (UINTN) ProcessorNumber; + CpuData =3D &CpuMpData->CpuData[Index]; + ApicId =3D CpuInfoInHob[ProcessorNumber].ApicId, + SevSnpCreateSaveArea (CpuMpData, CpuData, ApicId); + } +} + /** This function will be called by BSP to wakeup AP. =20 @@ -1360,7 +1578,7 @@ WakeUpAP ( ResetVectorRequired =3D FALSE; =20 if (CpuMpData->WakeUpByInitSipiSipi || - CpuMpData->InitFlag !=3D ApInitDone) { + CpuMpData->InitFlag !=3D ApInitDone) { ResetVectorRequired =3D TRUE; AllocateResetVector (CpuMpData); AllocateSevEsAPMemory (CpuMpData); @@ -1401,7 +1619,7 @@ WakeUpAP ( } if (ResetVectorRequired) { // - // For SEV-ES, the initial AP boot address will be defined by + // For SEV-ES and SEV-SNP, the initial AP boot address will be defin= ed by // PcdSevEsWorkAreaBase. The Segment/Rip must be the jump address // from the original INIT-SIPI-SIPI. // @@ -1411,8 +1629,14 @@ WakeUpAP ( =20 // // Wakeup all APs + // Must use the INIT-SIPI-SIPI method for initial configuration in + // order to obtain the APIC ID. // - SendInitSipiSipiAllExcludingSelf ((UINT32) ExchangeInfo->BufferStart= ); + if (CpuMpData->SevSnpIsEnabled && CpuMpData->InitFlag !=3D ApInitCon= fig) { + SevSnpCreateAP (CpuMpData, -1); + } else { + SendInitSipiSipiAllExcludingSelf ((UINT32) ExchangeInfo->BufferSta= rt); + } } if (CpuMpData->InitFlag =3D=3D ApInitConfig) { if (PcdGet32 (PcdCpuBootLogicalProcessorNumber) > 0) { @@ -1502,7 +1726,7 @@ WakeUpAP ( CpuInfoInHob =3D (CPU_INFO_IN_HOB *) (UINTN) CpuMpData->CpuInfoInHob; =20 // - // For SEV-ES, the initial AP boot address will be defined by + // For SEV-ES and SEV-SNP, the initial AP boot address will be defin= ed by // PcdSevEsWorkAreaBase. The Segment/Rip must be the jump address // from the original INIT-SIPI-SIPI. // @@ -1510,10 +1734,14 @@ WakeUpAP ( SetSevEsJumpTable (ExchangeInfo->BufferStart); } =20 - SendInitSipiSipi ( - CpuInfoInHob[ProcessorNumber].ApicId, - (UINT32) ExchangeInfo->BufferStart - ); + if (CpuMpData->SevSnpIsEnabled && CpuMpData->InitFlag !=3D ApInitCon= fig) { + SevSnpCreateAP (CpuMpData, (INTN) ProcessorNumber); + } else { + SendInitSipiSipi ( + CpuInfoInHob[ProcessorNumber].ApicId, + (UINT32) ExchangeInfo->BufferStart + ); + } } // // Wait specified AP waken up @@ -2044,10 +2272,15 @@ MpInitLibInitialize ( CpuMpData->CpuData =3D (CPU_AP_DATA *) (CpuMpData + 1); CpuMpData->CpuInfoInHob =3D (UINT64) (UINTN) (CpuMpData->CpuData + M= axLogicalProcessorNumber); InitializeSpinLock(&CpuMpData->MpLock); - CpuMpData->SevEsIsEnabled =3D PcdGetBool (PcdSevEsIsEnabled); - CpuMpData->SevSnpIsEnabled =3D PcdGetBool (PcdSevSnpIsEnabled); - CpuMpData->SevEsAPBuffer =3D (UINTN) -1; - CpuMpData->GhcbBase =3D PcdGet64 (PcdGhcbBase); + CpuMpData->SevEsIsEnabled =3D PcdGetBool (PcdSevEsIsEnabled); + CpuMpData->SevSnpIsEnabled =3D PcdGetBool (PcdSevSnpIsEnabled); + CpuMpData->SevEsAPBuffer =3D (UINTN) -1; + CpuMpData->GhcbBase =3D PcdGet64 (PcdGhcbBase); + CpuMpData->UseSevEsAPMethod =3D CpuMpData->SevEsIsEnabled && !CpuMpData-= >SevSnpIsEnabled; + + if (CpuMpData->SevSnpIsEnabled) { + ASSERT ((PcdGet64 (PcdGhcbHypervisorFeatures) & GHCB_HV_FEATURES_SNP_A= P_CREATE) =3D=3D GHCB_HV_FEATURES_SNP_AP_CREATE); + } =20 // // Make sure no memory usage outside of the allocated buffer. diff --git a/UefiCpuPkg/Library/MpInitLib/X64/SevSnpRmpAdjustInternal.c b/U= efiCpuPkg/Library/MpInitLib/X64/SevSnpRmpAdjustInternal.c new file mode 100644 index 000000000000..3048742facb5 --- /dev/null +++ b/UefiCpuPkg/Library/MpInitLib/X64/SevSnpRmpAdjustInternal.c @@ -0,0 +1,44 @@ +/** @file + + RMPADJUST helper function. + + Copyright (c) 2021, AMD Incorporated. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include "MpLib.h" + +/** + Issue RMPADJUST to adjust the VMSA attribute of an SEV-SNP page. + + @param[in] PageAddress + @param[in] VmsaPage + + @return RMPADJUST return value +**/ +UINT32 +SevSnpRmpAdjust ( + IN EFI_PHYSICAL_ADDRESS PageAddress, + IN BOOLEAN VmsaPage + ) +{ + UINT64 Rdx; + + // + // The RMPADJUST instruction is used to set or clear the VMSA bit for a + // page. The VMSA change is only made when running at VMPL0 and is ignor= ed + // otherwise. If too low a target VMPL is specified, the instruction can + // succeed without changing the VMSA bit when not running at VMPL0. Usin= g a + // target VMPL level of 1, RMPADJUST will return a FAIL_PERMISSION error= if + // not running at VMPL0, thus ensuring that the VMSA bit is set appropri= ately + // when no error is returned. + // + Rdx =3D 1; + if (VmsaPage) { + Rdx |=3D RMPADJUST_VMSA_PAGE_BIT; + } + + return AsmRmpAdjust ((UINT64) PageAddress, 0, Rdx); +} --=20 2.17.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80105): https://edk2.groups.io/g/devel/message/80105 Mute This Topic: https://groups.io/mt/85306691/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-