From nobody Thu Apr 24 19:09:54 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+101245+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1678917524681425.1362881511375; Wed, 15 Mar 2023 14:58:44 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id DTJRYY1788612xjv88dxIDya; Wed, 15 Mar 2023 14:58:44 -0700 X-Received: from NAM10-DM6-obe.outbound.protection.outlook.com (NAM10-DM6-obe.outbound.protection.outlook.com [40.107.93.65]) by mx.groups.io with SMTP id smtpd.web11.6797.1678917521753894092 for ; Wed, 15 Mar 2023 14:58:43 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=eKfd5E7d3Zk32AUbL/8XZxzyqosicohmT8+cXdHJ0MY9BgFPR4LERua0tZ6589pur17aWALDyYoR3BAgm/OXURFPduXLIHx9YkYmbhB6IJ3n4/BdB1fB8dwdsSLoRNv0KEg8zsOeZKp5tAjVYysTGcTGSlKxc5h3JclquaI6P3Vdvb9fjitjf2G/AEgXj4n0hUSWiKy+pYG12+GzD+BSB52u2m14WNxp+uERQPoC3GlPUFLPybj4HYR30XY9liiBj+p8JKQwckzZfSRpZgA6oTmhJgqcp8eFUxN1HqcgLBMgCPqMwZbzZT8w3cUji+X2P02qyxE5O0iK91TQLAk0DA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=lXpXRHPP2Vv0U7HTJSDpeJspE9Rt9XcHPqpqyb7aFqE=; b=QEyuJhebOGw5+Lavgp9xA5i3k5rviAOO9ArGz7tM/9Z9UAthW1CB3EVVkVO2svTWktx0tjK0wzzUof9DLwMwnKbnDSrHSdEaTPq+pDDo4engFyvr1cLUYalkfWepu3nbB3XbSwEUiR5eSYYfudrWGWXAIBaXdQldT3uQ2kkrBOIZpPSz6jEoo/0Dr5EyPHVSZK3S+NDlwkJVaLfbnU8//cBQL97bGG18UgthYPvJJrzzGUwvTM358qcfLdwRvUQARYGqwP1cwbDR+DrSKChGUUDPqVtyr0AnJyIv98MqApKeFyVgFnSz9ILqtLzx1vDJoEHQSX6LP2TzAYJSVuMnXw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none X-Received: from MW4PR04CA0071.namprd04.prod.outlook.com (2603:10b6:303:6b::16) by DS0PR12MB7678.namprd12.prod.outlook.com (2603:10b6:8:135::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6178.24; Wed, 15 Mar 2023 21:58:39 +0000 X-Received: from CO1NAM11FT081.eop-nam11.prod.protection.outlook.com (2603:10b6:303:6b:cafe::53) by MW4PR04CA0071.outlook.office365.com (2603:10b6:303:6b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6178.29 via Frontend Transport; Wed, 15 Mar 2023 21:58:39 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+101245+1787277+3901457@groups.io; helo=mail02.groups.io; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C X-Received: from SATLEXMB04.amd.com (165.204.84.17) by CO1NAM11FT081.mail.protection.outlook.com (10.13.174.80) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.6199.16 via Frontend Transport; Wed, 15 Mar 2023 21:58:39 +0000 X-Received: from localhost (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.34; Wed, 15 Mar 2023 16:58:38 -0500 From: "Roth, Michael via groups.io" To: CC: Tom Lendacky , Jiewen Yao , , Gerd Hoffmann , Erdem Aktas , James Bottomley , Min Xu , Dov Murik Subject: [edk2-devel] [PATCH RESEND 1/4] OvmfPkg/AmdSevDxe: Allocate SEV-SNP CC blob as EfiACPIReclaimMemory Date: Wed, 15 Mar 2023 16:57:44 -0500 Message-ID: <20230315215747.1543837-2-michael.roth@amd.com> In-Reply-To: <20230315215747.1543837-1-michael.roth@amd.com> References: <20230315215747.1543837-1-michael.roth@amd.com> MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CO1NAM11FT081:EE_|DS0PR12MB7678:EE_ X-MS-Office365-Filtering-Correlation-Id: 538bccc0-3588-46ec-94ec-08db25a06f4a X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: NKLoHXe3t4KufgjlASSRTvGAj9IpVBt/KUDPHqAJklsk1Dahn1IsYYxQB+y4/wLkkRwZWW7rBBZvwzdE/EIV41rRA39xlI6DcjxYnlTZJltpMUdD1ioRQ+vmOWoMWSNPlA3qZvPMqJwxmIF9+MDKmG3edhAtypzey4QXto6vWyaOlOsafAmRGbd9wTE8/ayxKSYC8E3FvZgp5+NBiXEQ1lRdd4KhC66t8VYcPMgzq/sJXukZFec1wxCaK1Ec/1hCa25AuLZKknrQX8zj8JK18L4D/4rBC3rdaFz9vwl4GhWuHXBq29BVWSFwcVdfpZAK38/WBqoIRDmnW0Oz9SJ11RgxHD+gv7+R/eFPlpnUWRzuYxwiMgGDAFeilwGLtD4HjCdijmW9FGJL1I0BvbCzPy/qIcjSSyPno31ciZKGxClZ4pO/HYF/qqJeh/ft0EObYcHcWbn5tPyh/3rwRyojlCDIpFq91V8nPGHXoTwsylO342jyfCHiwb0dYLwEbrKIEX5K/2fhwGVPRjMDqSUglo2ViQ7rUY/pqdJ4pfJy63MwnaZUSzMC3luReHNoWdn6iXmBkKj97+wQB4RsOVZ6bB6o0/4L6HJTxYoywV0/ouE5wCLJlpO49we/jNDMy3s7Law65sdb4b81jx/PM6ASKKKLOG3gYi2fOCX9Zm4FTW13sZQM7WE0b9X+w7G9OdPch6SumvAJUxAlMoOl3HtJo0BWKzrYqcTyH9EtcAMv3cJrLJEZOyQQB4e0rN0dQvZ4efzHillPXwXKTlaO1qZ0og== X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Mar 2023 21:58:39.2242 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 538bccc0-3588-46ec-94ec-08db25a06f4a X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT081.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB7678 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,Michael.Roth@amd.com X-Gm-Message-State: Kuk19KGn2eZtxML0AAtVfMNCx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1678917524; bh=RdgA7/rhcl97J/4eoXalZg8Hpc6lLQfZGl/qqLx3KIk=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=hJQLuWezcauCCe+3DPYTRUuHVVE7r1ObxIlkoCJ3Ljk36bx+Kr1Z6b2GOpU60hCaoH8 dDwHoGM0KvdTYpsoGO3FRZhZKiijVpFUwNOc98REG6TwTgmcb61F0dqkxaK2NyaiWgFr7 u0zFGBIdq7llATot07e1EZlz3COMresl2oI= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1678917525862100001 Content-Type: text/plain; charset="utf-8" The SEV-SNP Confidential Computing blob contains metadata that should remain accessible for the life of the guest. Allocate it as EfiACPIReclaimMemory to ensure the memory isn't overwritten by the guest operating system later. Reported-by: Dov Murik Suggested-by: Dov Murik Reviewed-by: Dov Murik Reviewed-by: Tom Lendacky Signed-off-by: Michael Roth Acked-by: Gerd Hoffmann --- OvmfPkg/AmdSevDxe/AmdSevDxe.c | 62 +++++++++++++++++++++++++++-------- 1 file changed, 48 insertions(+), 14 deletions(-) diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.c b/OvmfPkg/AmdSevDxe/AmdSevDxe.c index a726498e27..7250cc90e5 100644 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.c +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.c @@ -28,15 +28,36 @@ // Present, initialized, tested bits defined in MdeModulePkg/Core/Dxe/DxeM= ain.h #define EFI_MEMORY_INTERNAL_MASK 0x0700000000000000ULL =20 -STATIC CONFIDENTIAL_COMPUTING_SNP_BLOB_LOCATION mSnpBootDxeTable =3D { - SIGNATURE_32 ('A', 'M', 'D', 'E'), - 1, - 0, - (UINT64)(UINTN)FixedPcdGet32 (PcdOvmfSnpSecretsBase), - FixedPcdGet32 (PcdOvmfSnpSecretsSize), - (UINT64)(UINTN)FixedPcdGet32 (PcdOvmfCpuidBase), - FixedPcdGet32 (PcdOvmfCpuidSize), -}; +STATIC +EFI_STATUS +AllocateConfidentialComputingBlob ( + OUT CONFIDENTIAL_COMPUTING_SNP_BLOB_LOCATION **CcBlobPtr + ) +{ + EFI_STATUS Status; + CONFIDENTIAL_COMPUTING_SNP_BLOB_LOCATION *CcBlob; + + Status =3D gBS->AllocatePool ( + EfiACPIReclaimMemory, + sizeof (CONFIDENTIAL_COMPUTING_SNP_BLOB_LOCATION), + (VOID **)&CcBlob + ); + if (EFI_ERROR (Status)) { + return Status; + } + + CcBlob->Header =3D SIGNATURE_32 ('A', 'M', 'D', 'E'); + CcBlob->Version =3D 1; + CcBlob->Reserved1 =3D 0; + CcBlob->SecretsPhysicalAddress =3D (UINT64)(UINTN)FixedPcdGet32 (PcdOvmf= SnpSecretsBase); + CcBlob->SecretsSize =3D FixedPcdGet32 (PcdOvmfSnpSecretsSize); + CcBlob->CpuidPhysicalAddress =3D (UINT64)(UINTN)FixedPcdGet32 (PcdOvmf= CpuidBase); + CcBlob->CpuidLSize =3D FixedPcdGet32 (PcdOvmfCpuidSize); + + *CcBlobPtr =3D CcBlob; + + return EFI_SUCCESS; +} =20 STATIC EFI_HANDLE mAmdSevDxeHandle =3D NULL; =20 @@ -177,10 +198,11 @@ AmdSevDxeEntryPoint ( IN EFI_SYSTEM_TABLE *SystemTable ) { - EFI_STATUS Status; - EFI_GCD_MEMORY_SPACE_DESCRIPTOR *AllDescMap; - UINTN NumEntries; - UINTN Index; + EFI_STATUS Status; + EFI_GCD_MEMORY_SPACE_DESCRIPTOR *AllDescMap; + UINTN NumEntries; + UINTN Index; + CONFIDENTIAL_COMPUTING_SNP_BLOB_LOCATION *SnpBootDxeTable; =20 // // Do nothing when SEV is not enabled @@ -286,6 +308,18 @@ AmdSevDxeEntryPoint ( } } =20 + Status =3D AllocateConfidentialComputingBlob (&SnpBootDxeTable); + if (EFI_ERROR (Status)) { + DEBUG (( + DEBUG_ERROR, + "%a: AllocateConfidentialComputingBlob(): %r\n", + __FUNCTION__, + Status + )); + ASSERT (FALSE); + CpuDeadLoop (); + } + if (MemEncryptSevSnpIsEnabled ()) { // // Memory acceptance began being required in SEV-SNP, so install the @@ -323,7 +357,7 @@ AmdSevDxeEntryPoint ( // return gBS->InstallConfigurationTable ( &gConfidentialComputingSevSnpBlobGuid, - &mSnpBootDxeTable + SnpBootDxeTable ); } =20 --=20 2.25.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#101245): https://edk2.groups.io/g/devel/message/101245 Mute This Topic: https://groups.io/mt/97638492/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-