1. Patchew
  2. EDK2
  3. [edk2-devel] [PATCH v7 0/6] SEV Live Migration support for OVMF.
  4. View patch

[edk2-devel] [PATCH v7 5/6] OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall

Ashish Kalra via groups.io posted 6 patches 4 years, 5 months ago
There is a newer version of this series
[edk2-devel] [PATCH v7 5/6] OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall
Posted by Ashish Kalra via groups.io 4 years, 5 months ago 
From: Ashish Kalra <ashish.kalra@amd.com>

Mark the SEC GHCB page (that is mapped as unencrypted in
ResetVector code) in the hypervisor's guest page encryption
state tracking.

Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
---
 OvmfPkg/PlatformPei/AmdSev.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c
index a8bf610022..1d38056ec0 100644
--- a/OvmfPkg/PlatformPei/AmdSev.c
+++ b/OvmfPkg/PlatformPei/AmdSev.c
@@ -52,6 +52,17 @@ AmdSevEsInitialize (
   PcdStatus = PcdSetBoolS (PcdSevEsIsEnabled, TRUE);
   ASSERT_RETURN_ERROR (PcdStatus);
 
+  //
+  // The SEC Ghcb setup during reset-vector needs to be marked as
+  // decrypted in the hypervisor's guest page encryption state
+  // tracking.
+  //
+  SetMemoryEncDecHypercall3 (
+    FixedPcdGet32 (PcdOvmfSecGhcbBase),
+    EFI_SIZE_TO_PAGES(FixedPcdGet32 (PcdOvmfSecGhcbSize)),
+    FALSE
+    );
+
   //
   // Allocate GHCB and per-CPU variable pages.
   //   Since the pages must survive across the UEFI to OS transition
-- 
2.17.1



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#79578): https://edk2.groups.io/g/devel/message/79578
Mute This Topic: https://groups.io/mt/84997535/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v7 5/6] OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall
Posted by Nikunj A. Dadhania via groups.io 3 years, 8 months ago 
Hi Ashish,

On 8/19/2021 7:36 PM, Ashish Kalra via groups.io wrote:
> From: Ashish Kalra <ashish.kalra@amd.com>
> 
> Mark the SEC GHCB page (that is mapped as unencrypted in
> ResetVector code) in the hypervisor's guest page encryption
> state tracking.
> 
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
> Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
> ---
>  OvmfPkg/PlatformPei/AmdSev.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c
> index a8bf610022..1d38056ec0 100644
> --- a/OvmfPkg/PlatformPei/AmdSev.c
> +++ b/OvmfPkg/PlatformPei/AmdSev.c
> @@ -52,6 +52,17 @@ AmdSevEsInitialize (
>    PcdStatus = PcdSetBoolS (PcdSevEsIsEnabled, TRUE);
>    ASSERT_RETURN_ERROR (PcdStatus);
>  
> +  //
> +  // The SEC Ghcb setup during reset-vector needs to be marked as
> +  // decrypted in the hypervisor's guest page encryption state
> +  // tracking.
> +  //
> +  SetMemoryEncDecHypercall3 (
> +    FixedPcdGet32 (PcdOvmfSecGhcbBase),
> +    EFI_SIZE_TO_PAGES(FixedPcdGet32 (PcdOvmfSecGhcbSize)),
> +    FALSE
> +    );

PcdOvmfSecGhcbSize is set to 2 pages (8192 bytes). AFAIU, only first page 
needs to be change to shared, second page should be kept private.

>    //
>    // Allocate GHCB and per-CPU variable pages.
>    //   Since the pages must survive across the UEFI to OS transition
> 

Regards
Nikunj


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#90110): https://edk2.groups.io/g/devel/message/90110
Mute This Topic: https://groups.io/mt/84997535/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v7 5/6] OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall
Posted by Ashish Kalra via groups.io 3 years, 8 months ago 
[AMD Official Use Only - General]

Hello Nikunj,

That is true, but there is no SEV live migration happening before GHCB pages are re-setup and the hypercalls are invoked again for GHCB pages from
the guest kernel after it checks the live migration runtime environment flag setup by OVMF.

Thanks,
Ashish

-----Original Message-----
From: Dadhania, Nikunj <NikunjAmritlal.Dadhania@amd.com> 
Sent: Tuesday, May 31, 2022 10:14 AM
To: devel@edk2.groups.io; Kalra, Ashish <Ashish.Kalra@amd.com>
Cc: dovmurik@linux.vnet.ibm.com; brijesh.singh@amd.com; tobin@ibm.com; Lendacky, Thomas <Thomas.Lendacky@amd.com>; jejb@linux.ibm.com; erdemaktas@google.com; jiewen.yao@intel.com; min.m.xu@intel.com; jordan.l.justen@intel.com; ard.biesheuvel@arm.com
Subject: Re: [edk2-devel] [PATCH v7 5/6] OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall

Hi Ashish,

On 8/19/2021 7:36 PM, Ashish Kalra via groups.io wrote:
> From: Ashish Kalra <ashish.kalra@amd.com>
> 
> Mark the SEC GHCB page (that is mapped as unencrypted in ResetVector 
> code) in the hypervisor's guest page encryption state tracking.
> 
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
> Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
> ---
>  OvmfPkg/PlatformPei/AmdSev.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/OvmfPkg/PlatformPei/AmdSev.c 
> b/OvmfPkg/PlatformPei/AmdSev.c index a8bf610022..1d38056ec0 100644
> --- a/OvmfPkg/PlatformPei/AmdSev.c
> +++ b/OvmfPkg/PlatformPei/AmdSev.c
> @@ -52,6 +52,17 @@ AmdSevEsInitialize (
>    PcdStatus = PcdSetBoolS (PcdSevEsIsEnabled, TRUE);
>    ASSERT_RETURN_ERROR (PcdStatus);
>  
> +  //
> +  // The SEC Ghcb setup during reset-vector needs to be marked as  // 
> + decrypted in the hypervisor's guest page encryption state  // 
> + tracking.
> +  //
> +  SetMemoryEncDecHypercall3 (
> +    FixedPcdGet32 (PcdOvmfSecGhcbBase),
> +    EFI_SIZE_TO_PAGES(FixedPcdGet32 (PcdOvmfSecGhcbSize)),
> +    FALSE
> +    );

PcdOvmfSecGhcbSize is set to 2 pages (8192 bytes). AFAIU, only first page needs to be change to shared, second page should be kept private.

>    //
>    // Allocate GHCB and per-CPU variable pages.
>    //   Since the pages must survive across the UEFI to OS transition
> 

Regards
Nikunj


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#90113): https://edk2.groups.io/g/devel/message/90113
Mute This Topic: https://groups.io/mt/84997535/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v7 5/6] OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall
Posted by Ashish Kalra via groups.io 3 years, 8 months ago 
[AMD Official Use Only - General]

Hello Nikunj,

But, yes this needs to be fixed.

Thanks,
Ashish

-----Original Message-----
From: Kalra, Ashish 
Sent: Tuesday, May 31, 2022 12:51 PM
To: Dadhania, Nikunj <NikunjAmritlal.Dadhania@amd.com>; devel@edk2.groups.io
Cc: dovmurik@linux.vnet.ibm.com; brijesh.singh@amd.com; tobin@ibm.com; Lendacky, Thomas <Thomas.Lendacky@amd.com>; jejb@linux.ibm.com; erdemaktas@google.com; jiewen.yao@intel.com; min.m.xu@intel.com; jordan.l.justen@intel.com; ard.biesheuvel@arm.com
Subject: RE: [edk2-devel] [PATCH v7 5/6] OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall

[AMD Official Use Only - General]

Hello Nikunj,

That is true, but there is no SEV live migration happening before GHCB pages are re-setup and the hypercalls are invoked again for GHCB pages from the guest kernel after it checks the live migration runtime environment flag setup by OVMF.

Thanks,
Ashish

-----Original Message-----
From: Dadhania, Nikunj <NikunjAmritlal.Dadhania@amd.com>
Sent: Tuesday, May 31, 2022 10:14 AM
To: devel@edk2.groups.io; Kalra, Ashish <Ashish.Kalra@amd.com>
Cc: dovmurik@linux.vnet.ibm.com; brijesh.singh@amd.com; tobin@ibm.com; Lendacky, Thomas <Thomas.Lendacky@amd.com>; jejb@linux.ibm.com; erdemaktas@google.com; jiewen.yao@intel.com; min.m.xu@intel.com; jordan.l.justen@intel.com; ard.biesheuvel@arm.com
Subject: Re: [edk2-devel] [PATCH v7 5/6] OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall

Hi Ashish,

On 8/19/2021 7:36 PM, Ashish Kalra via groups.io wrote:
> From: Ashish Kalra <ashish.kalra@amd.com>
> 
> Mark the SEC GHCB page (that is mapped as unencrypted in ResetVector
> code) in the hypervisor's guest page encryption state tracking.
> 
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
> Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
> ---
>  OvmfPkg/PlatformPei/AmdSev.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/OvmfPkg/PlatformPei/AmdSev.c 
> b/OvmfPkg/PlatformPei/AmdSev.c index a8bf610022..1d38056ec0 100644
> --- a/OvmfPkg/PlatformPei/AmdSev.c
> +++ b/OvmfPkg/PlatformPei/AmdSev.c
> @@ -52,6 +52,17 @@ AmdSevEsInitialize (
>    PcdStatus = PcdSetBoolS (PcdSevEsIsEnabled, TRUE);
>    ASSERT_RETURN_ERROR (PcdStatus);
>  
> +  //
> +  // The SEC Ghcb setup during reset-vector needs to be marked as  // 
> + decrypted in the hypervisor's guest page encryption state  // 
> + tracking.
> +  //
> +  SetMemoryEncDecHypercall3 (
> +    FixedPcdGet32 (PcdOvmfSecGhcbBase),
> +    EFI_SIZE_TO_PAGES(FixedPcdGet32 (PcdOvmfSecGhcbSize)),
> +    FALSE
> +    );

PcdOvmfSecGhcbSize is set to 2 pages (8192 bytes). AFAIU, only first page needs to be change to shared, second page should be kept private.

>    //
>    // Allocate GHCB and per-CPU variable pages.
>    //   Since the pages must survive across the UEFI to OS transition
> 

Regards
Nikunj


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#90114): https://edk2.groups.io/g/devel/message/90114
Mute This Topic: https://groups.io/mt/84997535/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-

Patchew 2.1-devel-b67e4c2

© 2016 - 2026 Red Hat, Inc.