OvmfPkg/OvmfPkg.dec | 4 + OvmfPkg/AmdSev/AmdSevX64.dsc | 1 + OvmfPkg/OvmfPkgIa32.dsc | 1 + OvmfPkg/OvmfPkgIa32X64.dsc | 1 + OvmfPkg/OvmfPkgX64.dsc | 1 + OvmfPkg/AmdSev/AmdSevX64.fdf | 1 + OvmfPkg/OvmfPkgIa32.fdf | 1 + OvmfPkg/OvmfPkgIa32X64.fdf | 1 + OvmfPkg/OvmfPkgX64.fdf | 1 + OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf | 2 +- OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf | 40 +++++++ OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 120 +++++++++++++++++++- OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPeim.c | 87 ++++++++++++++ 13 files changed, 258 insertions(+), 3 deletions(-) create mode 100644 OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf create mode 100644 OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPeim.c
This patch series provides fixes for using TPM support with an SEV-ES guest. The fixes include: - Decode ModRM byte for MOVZX and MOVSX opcodes. - Add MMIO support for MOV opcodes 0xA0-0xA3. - Create a new TPM MMIO ready PPI guid, gOvmfTpmMmioAccessiblePpiGuid - Mark TPM MMIO range as un-encrypted during PEI phase for an SEV-ES guest and install the TPM MMIO ready PPI guid. - Update the Tcg2Config Depex to ensure the new PEIM runs before the Tcg2Config PEIM BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3345 --- These patches are based on commit: ab957f036f67 ("BaseTools/Source/Python: New Target/ToolChain/Arch in DSC [BuildOptions]") Changes since: v2: - Update the TPM PEIM to only perform the mapping change when SEV-ES is active (with a comment in the code to explain why). - Update the TPM PEIM file header comment. - Updates to the INF file (INF_VERSION, Packages, LibraryClasses, etc.). - Updates to PEIM file order in DSC and FDF files. - Split out Tcg2Config Depex change to a separate patch. v1: - Create a TPM PEIM that will map the TPM address range as unencrypted and install a new PPI to indicate the mapping change is complete. Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Brijesh Singh <brijesh.singh@amd.com> Cc: Erdem Aktas <erdemaktas@google.com> Cc: James Bottomley <jejb@linux.ibm.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Min Xu <min.m.xu@intel.com> Cc: Marc-André Lureau <marcandre.lureau@redhat.com> Cc: Stefan Berger <stefanb@linux.ibm.com> Tom Lendacky (5): OvfmPkg/VmgExitLib: Properly decode MMIO MOVZX and MOVSX opcodes OvmfPkg/VmgExitLib: Add support for new MMIO MOV opcodes OvmfPkg: Define a new PPI GUID to signal TPM MMIO accessability OvmfPkg/Tcg2ConfigPei: Mark TPM MMIO range as unencrypted for SEV-ES OvmfPkg/Tcg2ConfigPei: Update Depex for IA32 and X64 OvmfPkg/OvmfPkg.dec | 4 + OvmfPkg/AmdSev/AmdSevX64.dsc | 1 + OvmfPkg/OvmfPkgIa32.dsc | 1 + OvmfPkg/OvmfPkgIa32X64.dsc | 1 + OvmfPkg/OvmfPkgX64.dsc | 1 + OvmfPkg/AmdSev/AmdSevX64.fdf | 1 + OvmfPkg/OvmfPkgIa32.fdf | 1 + OvmfPkg/OvmfPkgIa32X64.fdf | 1 + OvmfPkg/OvmfPkgX64.fdf | 1 + OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf | 2 +- OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf | 40 +++++++ OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 120 +++++++++++++++++++- OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPeim.c | 87 ++++++++++++++ 13 files changed, 258 insertions(+), 3 deletions(-) create mode 100644 OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf create mode 100644 OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPeim.c -- 2.31.0 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#74608): https://edk2.groups.io/g/devel/message/74608 Mute This Topic: https://groups.io/mt/82461176/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
On 04/29/21 19:12, Lendacky, Thomas wrote: > This patch series provides fixes for using TPM support with an SEV-ES > guest. > > The fixes include: > > - Decode ModRM byte for MOVZX and MOVSX opcodes. > - Add MMIO support for MOV opcodes 0xA0-0xA3. > - Create a new TPM MMIO ready PPI guid, gOvmfTpmMmioAccessiblePpiGuid > - Mark TPM MMIO range as un-encrypted during PEI phase for an SEV-ES > guest and install the TPM MMIO ready PPI guid. > - Update the Tcg2Config Depex to ensure the new PEIM runs before the > Tcg2Config PEIM > > BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3345 > > --- > > These patches are based on commit: > ab957f036f67 ("BaseTools/Source/Python: New Target/ToolChain/Arch in DSC [BuildOptions]") Merged in commit range ab957f036f67..1e6b0394d6c0, via <https://github.com/tianocore/edk2/pull/1620>. Thanks, Laszlo > > Changes since: > > v2: > - Update the TPM PEIM to only perform the mapping change when SEV-ES is > active (with a comment in the code to explain why). > - Update the TPM PEIM file header comment. > - Updates to the INF file (INF_VERSION, Packages, LibraryClasses, etc.). > - Updates to PEIM file order in DSC and FDF files. > - Split out Tcg2Config Depex change to a separate patch. > > v1: > - Create a TPM PEIM that will map the TPM address range as unencrypted and > install a new PPI to indicate the mapping change is complete. > > Cc: Laszlo Ersek <lersek@redhat.com> > Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> > Cc: Jordan Justen <jordan.l.justen@intel.com> > Cc: Brijesh Singh <brijesh.singh@amd.com> > Cc: Erdem Aktas <erdemaktas@google.com> > Cc: James Bottomley <jejb@linux.ibm.com> > Cc: Jiewen Yao <jiewen.yao@intel.com> > Cc: Min Xu <min.m.xu@intel.com> > Cc: Marc-André Lureau <marcandre.lureau@redhat.com> > Cc: Stefan Berger <stefanb@linux.ibm.com> > > Tom Lendacky (5): > OvfmPkg/VmgExitLib: Properly decode MMIO MOVZX and MOVSX opcodes > OvmfPkg/VmgExitLib: Add support for new MMIO MOV opcodes > OvmfPkg: Define a new PPI GUID to signal TPM MMIO accessability > OvmfPkg/Tcg2ConfigPei: Mark TPM MMIO range as unencrypted for SEV-ES > OvmfPkg/Tcg2ConfigPei: Update Depex for IA32 and X64 > > OvmfPkg/OvmfPkg.dec | 4 + > OvmfPkg/AmdSev/AmdSevX64.dsc | 1 + > OvmfPkg/OvmfPkgIa32.dsc | 1 + > OvmfPkg/OvmfPkgIa32X64.dsc | 1 + > OvmfPkg/OvmfPkgX64.dsc | 1 + > OvmfPkg/AmdSev/AmdSevX64.fdf | 1 + > OvmfPkg/OvmfPkgIa32.fdf | 1 + > OvmfPkg/OvmfPkgIa32X64.fdf | 1 + > OvmfPkg/OvmfPkgX64.fdf | 1 + > OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf | 2 +- > OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf | 40 +++++++ > OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 120 +++++++++++++++++++- > OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPeim.c | 87 ++++++++++++++ > 13 files changed, 258 insertions(+), 3 deletions(-) > create mode 100644 OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf > create mode 100644 OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPeim.c > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#74675): https://edk2.groups.io/g/devel/message/74675 Mute This Topic: https://groups.io/mt/82461176/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
On 4/30/21 1:44 PM, Laszlo Ersek wrote: > On 04/29/21 19:12, Lendacky, Thomas wrote: >> This patch series provides fixes for using TPM support with an SEV-ES >> guest. >> >> The fixes include: >> >> - Decode ModRM byte for MOVZX and MOVSX opcodes. >> - Add MMIO support for MOV opcodes 0xA0-0xA3. >> - Create a new TPM MMIO ready PPI guid, gOvmfTpmMmioAccessiblePpiGuid >> - Mark TPM MMIO range as un-encrypted during PEI phase for an SEV-ES >> guest and install the TPM MMIO ready PPI guid. >> - Update the Tcg2Config Depex to ensure the new PEIM runs before the >> Tcg2Config PEIM >> >> BZ: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D3345&data=04%7C01%7Cthomas.lendacky%40amd.com%7C66427d33196c49e1cb3608d90c07f4a2%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637554050583398276%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=WdFDHBTgxDnvD%2BbNu1CisWXW7W8t3WhqEqWa4G14tLA%3D&reserved=0 >> >> --- >> >> These patches are based on commit: >> ab957f036f67 ("BaseTools/Source/Python: New Target/ToolChain/Arch in DSC [BuildOptions]") > > Merged in commit range ab957f036f67..1e6b0394d6c0, via > <https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftianocore%2Fedk2%2Fpull%2F1620&data=04%7C01%7Cthomas.lendacky%40amd.com%7C66427d33196c49e1cb3608d90c07f4a2%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637554050583398276%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=SZ52q4eTMIJ8PIcYBmlk1NXA7STO3xaphIS6oMWfjcI%3D&reserved=0>. Thanks for all your help getting this fixed, Laszlo! Tom > > Thanks, > Laszlo > >> >> Changes since: >> >> v2: >> - Update the TPM PEIM to only perform the mapping change when SEV-ES is >> active (with a comment in the code to explain why). >> - Update the TPM PEIM file header comment. >> - Updates to the INF file (INF_VERSION, Packages, LibraryClasses, etc.). >> - Updates to PEIM file order in DSC and FDF files. >> - Split out Tcg2Config Depex change to a separate patch. >> >> v1: >> - Create a TPM PEIM that will map the TPM address range as unencrypted and >> install a new PPI to indicate the mapping change is complete. >> >> Cc: Laszlo Ersek <lersek@redhat.com> >> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> >> Cc: Jordan Justen <jordan.l.justen@intel.com> >> Cc: Brijesh Singh <brijesh.singh@amd.com> >> Cc: Erdem Aktas <erdemaktas@google.com> >> Cc: James Bottomley <jejb@linux.ibm.com> >> Cc: Jiewen Yao <jiewen.yao@intel.com> >> Cc: Min Xu <min.m.xu@intel.com> >> Cc: Marc-André Lureau <marcandre.lureau@redhat.com> >> Cc: Stefan Berger <stefanb@linux.ibm.com> >> >> Tom Lendacky (5): >> OvfmPkg/VmgExitLib: Properly decode MMIO MOVZX and MOVSX opcodes >> OvmfPkg/VmgExitLib: Add support for new MMIO MOV opcodes >> OvmfPkg: Define a new PPI GUID to signal TPM MMIO accessability >> OvmfPkg/Tcg2ConfigPei: Mark TPM MMIO range as unencrypted for SEV-ES >> OvmfPkg/Tcg2ConfigPei: Update Depex for IA32 and X64 >> >> OvmfPkg/OvmfPkg.dec | 4 + >> OvmfPkg/AmdSev/AmdSevX64.dsc | 1 + >> OvmfPkg/OvmfPkgIa32.dsc | 1 + >> OvmfPkg/OvmfPkgIa32X64.dsc | 1 + >> OvmfPkg/OvmfPkgX64.dsc | 1 + >> OvmfPkg/AmdSev/AmdSevX64.fdf | 1 + >> OvmfPkg/OvmfPkgIa32.fdf | 1 + >> OvmfPkg/OvmfPkgIa32X64.fdf | 1 + >> OvmfPkg/OvmfPkgX64.fdf | 1 + >> OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf | 2 +- >> OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf | 40 +++++++ >> OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 120 +++++++++++++++++++- >> OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPeim.c | 87 ++++++++++++++ >> 13 files changed, 258 insertions(+), 3 deletions(-) >> create mode 100644 OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf >> create mode 100644 OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPeim.c >> > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#74677): https://edk2.groups.io/g/devel/message/74677 Mute This Topic: https://groups.io/mt/82461176/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
© 2016 - 2024 Red Hat, Inc.