From nobody Fri May 17 03:12:45 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+88436+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1649179860877732.6333716474354; Tue, 5 Apr 2022 10:31:00 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id 8W6dYY1788612xLEFsmy3zVA; Tue, 05 Apr 2022 10:31:00 -0700 X-Received: from NAM02-DM3-obe.outbound.protection.outlook.com (NAM02-DM3-obe.outbound.protection.outlook.com [40.107.95.80]) by mx.groups.io with SMTP id smtpd.web11.81.1649179859544653270 for ; Tue, 05 Apr 2022 10:30:59 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=gZLYK/2Qn0C18vj2zq/dnelpxNjN8ByCgaXGsHbIeGEHSX29rn/9k0bsE20MnTfVGdQw2Ipz23OR7wJe4LBDxDVxfk3slmKU+E8bdHj+l0F2dam8vYyeYcu2TL4dAcAB/f+vRqync58EW0tkbzUau5qLbFXLjvWn7C96cr40qwW8FQqGiqpPhmT/oTA10FIX9s8psv0W67BbJMbIL2u+FCOFteoDgXUWTybvE1UTlqfGp35hiN59cQjUI7xFaVw+YJwj5wyPk9pSX/YbrqWKjRbF+Lw8BuHYP9VK80Tbd2GnMmHkGnn8t2gMeHNEZsKaulpd3UhfFWF12rn7tyeshw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=LGe5GDInGdNpXdBL76Y/ywgZVcMmTw46OvTTZEhWjaA=; b=QszfyZsxd+GeGuuQAC2/OR1PqZnsGcmvsDkAVffjhtx0EnYpE/Vn+DJ1coimW+zumqVaKIzxkEtUuMiKLw013x/gocr2XqfhPWiNH+MyPP+8E40e0Rb2fhhFABfi+/5hebJJwZbqbvzpGQd2rb9xGLR6ssSmoOe3udNdzSNZtFZ1W7KLvNhK+Gfduyi674bjwZ0uyxNQ7mqkIeBkw9n6XAeXHPrMda8w+QcZVEBkaxdVHPzQ5vql9FmE2fbS7ksgOqYqbUoknVaV0y8qk769o2tyevYnhE4IFHwzQe127t4QwD0iu90Z1f9ycU2h+S7ETKnEo4qnzShVPNQ6669KXA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none X-Received: from BN9PR03CA0203.namprd03.prod.outlook.com (2603:10b6:408:f9::28) by DM6PR12MB2732.namprd12.prod.outlook.com (2603:10b6:5:4a::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.31; Tue, 5 Apr 2022 17:30:57 +0000 X-Received: from BN8NAM11FT066.eop-nam11.prod.protection.outlook.com (2603:10b6:408:f9:cafe::d9) by BN9PR03CA0203.outlook.office365.com (2603:10b6:408:f9::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.31 via Frontend Transport; Tue, 5 Apr 2022 17:30:57 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+88436+1787277+3901457@groups.io; helo=mail02.groups.io; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; X-Received: from SATLEXMB04.amd.com (165.204.84.17) by BN8NAM11FT066.mail.protection.outlook.com (10.13.177.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.5123.19 via Frontend Transport; Tue, 5 Apr 2022 17:30:56 +0000 X-Received: from ashkalraubuntuserver.amd.com (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 5 Apr 2022 12:30:55 -0500 From: "Ashish Kalra via groups.io" To: CC: , , , , , , , , Subject: [edk2-devel] [PATCH v8 1/6] OvmfPkg/BaseMemEncryptLib: Detect SEV live migration feature. Date: Tue, 5 Apr 2022 17:30:45 +0000 Message-ID: <76bd51fdab5cdb0a69374979b8638380e2879714.1649178155.git.ashish.kalra@amd.com> In-Reply-To: References: MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 0bb2d43f-da05-47df-3581-08da172a0b0e X-MS-TrafficTypeDiagnostic: DM6PR12MB2732:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: rT2+NgbnPkrSCuP0wk9XTyZ9FrvisJwx4tQheIMzZGBx/aaEj382WnfgcOq7wqyJBSwUmO7QR6VJn4Djw5qpXGGeCEdlhScNPYu6ev2y2enCHqBBgElZYKGlpJ8UmAKlvbSvn2yARaCXVcWfpjgOA3dv5zfZXITKBBe2EJZlw86LcQF8Hjy1Hw8zOXFdmPAelvNJM/+B7ko59ChOT8BhFEOrI77PYr7fRSH//Bf9PYOmz8op1gE2Rlck4LJ6KgV/Lw0nVfrFX4QUgUxOlQx9lTGfKLVIfvv11d8X56R00FqUPztMqore8RF3RrjXDtI0PkXH2TC03KvpLANT7SatnhrWloM/aBe8TkboyxFDc3x9Cop3qFRbaHfvMFxujIVflfdzM9hXJjh565imMYo5gxwRxX2xxBEn3dT0C8wg/pUVynbcGQcarvlP2y6QtFWF5mgq0GoEj44B8etvEszBXiRVXKlFcC9l/IZIx6n2uSCtcBOvLlGVjxWNUfgs5AjQDd3KML+KVDzAnSfQNkAMdnqITEd3w6gIhV1DDcxefpMjmvsEvVxVixCZDD6Lofk1eMOHLx4ZyFIfyE/TDFHNzcButziIlF2EjonCH1TDr82U23t0haUSKS1NUXYiIDlCNIy2ll54D3CM6qquPXy1yUIUtZJ8/g149F8ZNvi6oppJ1Rqxp0PvcuOplufkwPnvdh1aX7kdr7SD6g4cl2QrCQ== X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Apr 2022 17:30:56.7267 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 0bb2d43f-da05-47df-3581-08da172a0b0e X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT066.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB2732 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,ashish.kalra@amd.com X-Gm-Message-State: oX95iNF6R4woId4AiF2SmHVwx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1649179860; bh=D+yx0R6ML+8dPrD9dEn5WqFGqPsZttTw0N+ijsO1lJc=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=GFfIXDX+lZiqWfC5VE+rkmKbAC67cOC5FAaH3BvQqKrG1j38QNwGJzNPjW19iu8LN1+ 3/90XuvT5cyYZkvRaKZVT08ABGjbqnyzUNkfcS6XJapUUbkhQpWPCzJGxxwUChtixK5q9 tkNymHfuWN2nm605pmO7VxUvf3n5RMEjR1s= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1649179862204100001 Content-Type: text/plain; charset="utf-8" From: Ashish Kalra Add support to check if we are running inside KVM HVM and KVM HVM supports SEV Live Migration feature. Cc: Jordan Justen Cc: Ard Biesheuvel Signed-off-by: Ashish Kalra --- OvmfPkg/Include/Library/MemEncryptSevLib.h | 12 ++++ .../DxeMemEncryptSevLibInternal.c | 49 ++++++++++++++-- .../PeiDxeMemEncryptSevLibInternal.c | 58 +++++++++++++++++++ .../PeiDxeMemEncryptSevLibInternal.h | 31 ++++++++++ .../PeiMemEncryptSevLibInternal.c | 42 ++++++++++++++ .../SecMemEncryptSevLibInternal.c | 18 ++++++ 6 files changed, 206 insertions(+), 4 deletions(-) create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSe= vLibInternal.h diff --git a/OvmfPkg/Include/Library/MemEncryptSevLib.h b/OvmfPkg/Include/L= ibrary/MemEncryptSevLib.h index 4fa9c0d700..babec60df4 100644 --- a/OvmfPkg/Include/Library/MemEncryptSevLib.h +++ b/OvmfPkg/Include/Library/MemEncryptSevLib.h @@ -83,6 +83,18 @@ MemEncryptSevIsEnabled ( VOID ); =20 +/** + Returns a boolean to indicate whether SEV live migration is enabled. + + @retval TRUE SEV live migration is enabled + @retval FALSE SEV live migration is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevLiveMigrationIsEnabled ( + VOID + ); + /** This function clears memory encryption bit for the memory region specifi= ed by BaseAddress and NumPages from the current page table context. diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c index 4aba0075b9..d80ebe2fac 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLibInternal.c @@ -18,10 +18,14 @@ #include #include =20 -STATIC UINT64 mCurrentAttr =3D 0; -STATIC BOOLEAN mCurrentAttrRead =3D FALSE; -STATIC UINT64 mSevEncryptionMask =3D 0; -STATIC BOOLEAN mSevEncryptionMaskSaved =3D FALSE; +#include "PeiDxeMemEncryptSevLibInternal.h" + +STATIC UINT64 mCurrentAttr =3D 0; +STATIC BOOLEAN mCurrentAttrRead =3D FALSE; +STATIC UINT64 mSevEncryptionMask =3D 0; +STATIC BOOLEAN mSevEncryptionMaskSaved =3D FALSE; +STATIC BOOLEAN mSevLiveMigrationStatus =3D FALSE; +STATIC BOOLEAN mSevLiveMigrationStatusChecked =3D FALSE; =20 /** The function check if the specified Attr is set. @@ -111,6 +115,24 @@ MemEncryptSevSnpIsEnabled ( return ConfidentialComputingGuestHas (CCAttrAmdSevSnp); } =20 +/** + Figures out if we are running inside KVM HVM and + KVM HVM supports SEV Live Migration feature. +**/ +STATIC +VOID +EFIAPI +InternalDetectSevLiveMigrationFeature ( + VOID + ) +{ + if (KvmDetectSevLiveMigrationFeature ()) { + mSevLiveMigrationStatus =3D TRUE; + } + + mSevLiveMigrationStatusChecked =3D TRUE; +} + /** Returns a boolean to indicate whether SEV-ES is enabled. =20 @@ -141,6 +163,25 @@ MemEncryptSevIsEnabled ( return ConfidentialComputingGuestHas (CCAttrAmdSev); } =20 +/** + Returns a boolean to indicate whether SEV live migration is enabled. + + @retval TRUE SEV live migration is enabled + @retval FALSE SEV live migration is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevLiveMigrationIsEnabled ( + VOID + ) +{ + if (!mSevLiveMigrationStatusChecked) { + InternalDetectSevLiveMigrationFeature (); + } + + return mSevLiveMigrationStatus; +} + /** Returns the SEV encryption mask. =20 diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSevLibInt= ernal.c b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSevLibIntern= al.c index 78ea16ae06..868392f7e2 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSevLibInternal.c @@ -16,6 +16,8 @@ #include #include =20 +#include "PeiDxeMemEncryptSevLibInternal.h" + /** Locate the page range that covers the initial (pre-SMBASE-relocation) SM= RAM Save State Map. @@ -61,3 +63,59 @@ MemEncryptSevLocateInitialSmramSaveStateMapPages ( =20 return RETURN_SUCCESS; } + +/** + Figures out if we are running inside KVM HVM and + KVM HVM supports SEV Live Migration feature. + + @retval TRUE SEV live migration is supported. + @retval FALSE SEV live migration is not supported. +**/ +BOOLEAN +EFIAPI +KvmDetectSevLiveMigrationFeature ( + VOID + ) +{ + CHAR8 Signature[13]; + UINT32 mKvmLeaf; + UINT32 RegEax; + UINT32 RegEbx; + UINT32 RegEcx; + UINT32 RegEdx; + + Signature[12] =3D '\0'; + for (mKvmLeaf =3D 0x40000000; mKvmLeaf < 0x40010000; mKvmLeaf +=3D 0x100= ) { + AsmCpuid ( + mKvmLeaf, + NULL, + (UINT32 *)&Signature[0], + (UINT32 *)&Signature[4], + (UINT32 *)&Signature[8] + ); + + if (AsciiStrCmp (Signature, "KVMKVMKVM") =3D=3D 0) { + DEBUG (( + DEBUG_INFO, + "%a: KVM Detected, signature =3D %a\n", + __FUNCTION__, + Signature + )); + + RegEax =3D mKvmLeaf + 1; + RegEcx =3D 0; + AsmCpuid (mKvmLeaf + 1, &RegEax, &RegEbx, &RegEcx, &RegEdx); + if ((RegEax & KVM_FEATURE_MIGRATION_CONTROL) !=3D 0) { + DEBUG (( + DEBUG_INFO, + "%a: SEV Live Migration feature supported\n", + __FUNCTION__ + )); + + return TRUE; + } + } + } + + return FALSE; +} diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSevLibInt= ernal.h b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSevLibIntern= al.h new file mode 100644 index 0000000000..b0ef053cd9 --- /dev/null +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiDxeMemEncryptSevLibInternal.h @@ -0,0 +1,31 @@ +/** @file + + Secure Encrypted Virtualization (SEV) library helper function + + Copyright (c) 2021, AMD Incorporated. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef PEI_DXE_MEM_ENCRYPT_SEV_LIB_INTERNAL_H_ +#define PEI_DXE_MEM_ENCRYPT_SEV_LIB_INTERNAL_H_ + +#include + +#define KVM_FEATURE_MIGRATION_CONTROL BIT17 + +/** + Figures out if we are running inside KVM HVM and + KVM HVM supports SEV Live Migration feature. + + @retval TRUE SEV live migration is supported. + @retval FALSE SEV live migration is not supported. +**/ +BOOLEAN +EFIAPI +KvmDetectSevLiveMigrationFeature ( + VOID + ); + +#endif // PEI_DXE_MEM_ENCRYPT_SEV_LIB_INTERNAL_H_ diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c index 3f8f91a5da..72bd6e98f8 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLibInternal.c @@ -17,6 +17,11 @@ #include #include =20 +#include "PeiDxeMemEncryptSevLibInternal.h" + +STATIC BOOLEAN mSevLiveMigrationStatus =3D FALSE; +STATIC BOOLEAN mSevLiveMigrationStatusChecked =3D FALSE; + /** Read the workarea to determine whether SEV is enabled. If enabled, then return the SevEsWorkArea pointer. @@ -83,6 +88,24 @@ MemEncryptSevSnpIsEnabled ( return Msr.Bits.SevSnpBit ? TRUE : FALSE; } =20 +/** + Figures out if we are running inside KVM HVM and + KVM HVM supports SEV Live Migration feature. +**/ +STATIC +VOID +EFIAPI +InternalDetectSevLiveMigrationFeature ( + VOID + ) +{ + if (KvmDetectSevLiveMigrationFeature ()) { + mSevLiveMigrationStatus =3D TRUE; + } + + mSevLiveMigrationStatusChecked =3D TRUE; +} + /** Returns a boolean to indicate whether SEV-ES is enabled. =20 @@ -121,6 +144,25 @@ MemEncryptSevIsEnabled ( return Msr.Bits.SevBit ? TRUE : FALSE; } =20 +/** + Returns a boolean to indicate whether SEV live migration is enabled. + + @retval TRUE SEV live migration is enabled + @retval FALSE SEV live migration is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevLiveMigrationIsEnabled ( + VOID + ) +{ + if (!mSevLiveMigrationStatusChecked) { + InternalDetectSevLiveMigrationFeature (); + } + + return mSevLiveMigrationStatus; +} + /** Returns the SEV encryption mask. =20 diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c index 80aceba01b..b05dbec02e 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c @@ -121,6 +121,24 @@ MemEncryptSevIsEnabled ( return Msr.Bits.SevBit ? TRUE : FALSE; } =20 +/** + Returns a boolean to indicate whether SEV live migration is enabled. + + @retval TRUE SEV live migration is enabled + @retval FALSE SEV live migration is not enabled +**/ +BOOLEAN +EFIAPI +MemEncryptSevLiveMigrationIsEnabled ( + VOID + ) +{ + // + // Not used in SEC phase. + // + return FALSE; +} + /** Returns the SEV encryption mask. =20 --=20 2.25.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#88436): https://edk2.groups.io/g/devel/message/88436 Mute This Topic: https://groups.io/mt/90271200/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 03:12:45 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+88437+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1649179918012439.57837291394685; Tue, 5 Apr 2022 10:31:58 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id C9ZiYY1788612x5qgzyUZ9AW; Tue, 05 Apr 2022 10:31:57 -0700 X-Received: from NAM11-BN8-obe.outbound.protection.outlook.com (NAM11-BN8-obe.outbound.protection.outlook.com [40.107.236.49]) by mx.groups.io with SMTP id smtpd.web11.90.1649179916631465599 for ; Tue, 05 Apr 2022 10:31:57 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=G0Vqzmx34Sxkx5byJfTWgp+Drf1WD6fl1R+0NNyc97LT5Tt5UUUz1QeCQwZUSSa09eFaUED1ZgOvgNj7+G4OI56NS+Lt25R+LK7H9JpbQwVJ2zRZSU7n6p6a29StcpAemyrI2rrpjFQnTY0aaHAIcs7wtWVlPbfxs9AstkE+ng+iIZHgPezeJQC5DMyxmeZc3WSsS+YLINwmsESML71tKr13tYd6XeyI998oLlO3GuobEmsmQcvs+2m6nos3zm8/nfHQmiBAvAGSUM9FFsqNuiynz2OehWlC6hkadSvSOMwRWS3TCuQ/br/COpJgKvWWs+8TxkLPJfrzH7/bVt08nA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5+2FSP+GNskLnDp4nr/+3dIiXYiPBey73eIOjyKGMQU=; b=VzkDmtEqlObtjuNyDJDM/se3/aLmhe/hG9fM3BgWwnbtKh0qR6DrVnnbnJusaa1qGOTHwO+hpKyNYlTcUWf3M7afdx2xytIIafrNSho953VQ4cB7oJmFjYaG3vIKt2XZm82KphAGwu26MoToMXPP7BAS2AEOq/JD6mRnzdjrp8nNv+Yc6w+/xyi3ESlcKyw6oz1FtlT40EmwgiB0odRB+8bQuP1oYjheyB8zgiHFaDJ7PZ1ACUcvOv+bTEWNZDBjxizawvhxg8Dx+Te28nz50BoGTwTbEbwCWT6+UbxejK/IuH9h19GBTKa1sXI4cMRs2z6ntdlsxFoKck2r4MD6Rw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none X-Received: from BN9PR03CA0533.namprd03.prod.outlook.com (2603:10b6:408:131::28) by CY4PR1201MB0184.namprd12.prod.outlook.com (2603:10b6:910:1d::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.31; Tue, 5 Apr 2022 17:31:53 +0000 X-Received: from BN8NAM11FT035.eop-nam11.prod.protection.outlook.com (2603:10b6:408:131:cafe::f4) by BN9PR03CA0533.outlook.office365.com (2603:10b6:408:131::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.31 via Frontend Transport; Tue, 5 Apr 2022 17:31:53 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+88437+1787277+3901457@groups.io; helo=mail02.groups.io; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; X-Received: from SATLEXMB04.amd.com (165.204.84.17) by BN8NAM11FT035.mail.protection.outlook.com (10.13.177.116) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.5123.19 via Frontend Transport; Tue, 5 Apr 2022 17:31:53 +0000 X-Received: from ashkalraubuntuserver.amd.com (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 5 Apr 2022 12:31:52 -0500 From: "Ashish Kalra via groups.io" To: CC: , , , , , , , , Subject: [edk2-devel] [PATCH v8 2/6] OvmfPkg/BaseMemEncryptLib: Hypercall API for page encryption state change Date: Tue, 5 Apr 2022 17:31:36 +0000 Message-ID: <15a91fa87f2dde8ce557000159b9183979b123bc.1649178155.git.ashish.kalra@amd.com> In-Reply-To: References: MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 7895d152-bb3f-4dc3-4ee0-08da172a2cbc X-MS-TrafficTypeDiagnostic: CY4PR1201MB0184:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: fDDN7LE7FilPwoqcTljG19klv9ybS9XDSlhOkfEs+C5kjPeAOg0XU8AEDVkMi7vR1/NyXY4ycVdUJ9DwDl/E3eJXq+sHBZvtfJ6mnkofzHJbFMM7zmt69/ZVmu1XwUaCoNls1XYylYLBH4WDHPh70OWANzP/mCi+bXiATSNDSQ0t73e8JPj7e2If7pRX5AWHzTE+voJqy4A4gaczxSey5TaPz7yICQlt4V3lcoqbJRg6yoMr+rPuy1W3hRpHefWOUUX3jwhkqkpJZfJXlmf4xQYQWRoHUb3XOv5V2lk/OzG6kSt7nehJc4YF699sTCozpzqtyFedKxDrJhvWmp3KmahdUxIMyYreXtUpAnFpc9tW1ZRfQmkHTKsQinyMX6L9gV/DiUPr+eurLOXSHxc5DKsA2oqK3mPKFrq5J/HOGSUKkjkarsCLvvrIScG3GUM4LsUFMzEJQY2t+eDWPYeWoXG0xbZJ+QcGvZNwIptgPBa6n4rDbF1oXYMbTVssQ9jHRrSZQn+AmG02rtDs5ufWM6Du8HD1ktYHCq9Sr7ITitOoVPYI9p2G77kHsN4NAQKl0bsJGfXBsooDLYVgxwlsvK5KP+5og9h5zupPYLFBHx5cAV42AsFoWAd2RrmnoWhfWcpJex8Ai3PuAx2LZUQvk4jzjelPv4hAhzTp3kvCOvwJ8TM87OwGMqX7mqsA4+qi0gn1ypjjsNYX6FY1TFNV1Q== X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Apr 2022 17:31:53.2169 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 7895d152-bb3f-4dc3-4ee0-08da172a2cbc X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT035.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1201MB0184 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,ashish.kalra@amd.com X-Gm-Message-State: a46B1qhsjd2vs9xdtinsHckGx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1649179917; bh=At6JSXYtAtwOq/VvedaVZw8eXoE4MCTl0f+FMt5x4jo=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=wTyCYhB+TFVZ3gWpuWzpt0s5eZVwwT+BXkiA5nygwFkou/KNaF9lYgh/AU+iIuLeMjU GkAL/Co3vrVXOwKzGyKmT3HMt3U8t9UVGYe8g+5cHQEuCEerP++6OvrEsZhFPM1dKxeBC HreKtdRJSvShJzC/2HfTtfBr0WAZSxt/dg4= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1649179918624100001 Content-Type: text/plain; charset="utf-8" From: Ashish Kalra Add API to issue hypercall on page encryption state change. By default all the SEV guest memory regions are considered encrypted, if a guest changes the encryption attribute of the page (e.g mark a page as decrypted) then notify hypervisor. Hypervisor will need to track the unencrypted pages. The information will be used during guest live migration, guest page migration and guest debugging. This hypercall is used to notify hypervisor when the page's encryption state changes. Cc: Jordan Justen Cc: Ard Biesheuvel Signed-off-by: Brijesh Singh Signed-off-by: Ashish Kalra --- OvmfPkg/Include/Library/MemEncryptSevLib.h | 52 +++++++++++++++ .../DxeMemEncryptSevLib.inf | 1 + .../Ia32/MemEncryptSevLib.c | 27 ++++++++ .../PeiMemEncryptSevLib.inf | 1 + .../SecMemEncryptSevLibInternal.c | 20 ++++++ .../X64/AsmHelperStub.nasm | 33 ++++++++++ .../X64/MemEncryptSevLib.c | 66 +++++++++++++++++++ 7 files changed, 200 insertions(+) create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/AsmHelperStub.= nasm diff --git a/OvmfPkg/Include/Library/MemEncryptSevLib.h b/OvmfPkg/Include/L= ibrary/MemEncryptSevLib.h index babec60df4..b60496c26f 100644 --- a/OvmfPkg/Include/Library/MemEncryptSevLib.h +++ b/OvmfPkg/Include/Library/MemEncryptSevLib.h @@ -240,4 +240,56 @@ MemEncryptSevSnpPreValidateSystemRam ( IN UINTN NumPages ); =20 +/** + This hypercall is used to notify hypervisor when the page's encryption + state changes. + + @param[in] PhysicalAddress The physical address that is the start= address + of a memory region. + @param[in] Pages Number of pages in memory region. + @param[in] IsEncrypted Encrypted or Decrypted. + + @retval RETURN_SUCCESS Hypercall returned success. + @retval RETURN_UNSUPPORTED Hypercall not supported. + @retval RETURN_NO_MAPPING Hypercall returned error. +**/ +RETURN_STATUS +EFIAPI +SetMemoryEncDecHypercall3 ( + IN UINTN PhysicalAddress, + IN UINTN Pages, + IN BOOLEAN IsEncrypted + ); + +#define KVM_HC_MAP_GPA_RANGE 12 +#define KVM_MAP_GPA_RANGE_PAGE_SZ_4K 0 +#define KVM_MAP_GPA_RANGE_PAGE_SZ_2M BIT0 +#define KVM_MAP_GPA_RANGE_PAGE_SZ_1G BIT1 +#define KVM_MAP_GPA_RANGE_ENC_STATE(n) ((n) << 4) +#define KVM_MAP_GPA_RANGE_ENCRYPTED KVM_MAP_GPA_RANGE_ENC_STATE(1) +#define KVM_MAP_GPA_RANGE_DECRYPTED KVM_MAP_GPA_RANGE_ENC_STATE(0) + +/** + Interface exposed by the ASM implementation of the core hypercall + + @param[in] HypercallNum KVM_HC_MAP_GPA_RANGE hypercall. + @param[in] PhysicalAddress The physical address that is the start= address + of a memory region. + @param[in] Pages Number of pages in memory region. + @param[in] Attributes Bits 3:0 - preferred page size encodin= g, + 0 =3D 4kb, 1 =3D 2mb, 2 =3D 1gb, etc... + Bit 4 - plaintext =3D 0, encrypted = =3D 1 + Bits 63:5 - reserved (must be zero) + + @retval Hypercall returned status. +**/ +UINTN +EFIAPI +SetMemoryEncDecHypercall3AsmStub ( + IN UINTN HypercallNum, + IN UINTN PhysicalAddress, + IN UINTN Pages, + IN UINTN Attributes + ); + #endif // _MEM_ENCRYPT_SEV_LIB_H_ diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf index 35b7d519d9..af7d2059a2 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf @@ -40,6 +40,7 @@ X64/SnpPageStateChangeInternal.c X64/VirtualMemory.c X64/VirtualMemory.h + X64/AsmHelperStub.nasm =20 [Sources.IA32] Ia32/MemEncryptSevLib.c diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c b= /OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c index f92299fc77..c1c10a61c4 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c @@ -153,3 +153,30 @@ MemEncryptSevSnpPreValidateSystemRam ( { ASSERT (FALSE); } + +/** + This hyercall is used to notify hypervisor when the page's encryption + state changes. + + @param[in] PhysicalAddress The physical address that is the start= address + of a memory region. + @param[in] Pages Number of Pages in the memory region. + @param[in] IsEncrypted Encrypted or Decrypted. + + @retval RETURN_SUCCESS Hypercall returned success. + @retval RETURN_UNSUPPORTED Hypercall not supported. + @retval RETURN_NO_MAPPING Hypercall returned error. +**/ +RETURN_STATUS +EFIAPI +SetMemoryEncDecHypercall3 ( + IN UINTN PhysicalAddress, + IN UINTN Pages, + IN BOOLEAN IsEncrypted + ) +{ + // + // Memory encryption bit is not accessible in 32-bit mode + // + return RETURN_UNSUPPORTED; +} diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf index 714da33237..e28008d26b 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf @@ -40,6 +40,7 @@ X64/SnpPageStateChangeInternal.c X64/VirtualMemory.c X64/VirtualMemory.h + X64/AsmHelperStub.nasm =20 [Sources.IA32] Ia32/MemEncryptSevLib.c diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibIntern= al.c b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c index b05dbec02e..d7504ea9e7 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLibInternal.c @@ -139,6 +139,26 @@ MemEncryptSevLiveMigrationIsEnabled ( return FALSE; } =20 +/** + Interface exposed by the ASM implementation of the core hypercall + + @retval Hypercall returned status. +**/ +UINTN +EFIAPI +SetMemoryEncDecHypercall3AsmStub ( + IN UINTN HypercallNum, + IN UINTN PhysicalAddress, + IN UINTN Pages, + IN UINTN Attributes + ) +{ + // + // Not used in SEC phase. + // + return RETURN_UNSUPPORTED; +} + /** Returns the SEV encryption mask. =20 diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/AsmHelperStub.nasm b/= OvmfPkg/Library/BaseMemEncryptSevLib/X64/AsmHelperStub.nasm new file mode 100644 index 0000000000..0ec35dd9b6 --- /dev/null +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/AsmHelperStub.nasm @@ -0,0 +1,33 @@ +/** @file + + ASM helper stub to invoke hypercall + + Copyright (c) 2021, AMD Incorporated. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +DEFAULT REL +SECTION .text + +; UINTN +; EFIAPI +; SetMemoryEncDecHypercall3AsmStub ( +; IN UINTN HypercallNum, +; IN UINTN Arg1, +; IN UINTN Arg2, +; IN UINTN Arg3 +; ); +global ASM_PFX(SetMemoryEncDecHypercall3AsmStub) +ASM_PFX(SetMemoryEncDecHypercall3AsmStub): + ; UEFI calling conventions require RBX to + ; be nonvolatile/callee-saved. + push rbx + mov rax, rcx ; Copy HypercallNumber to rax + mov rbx, rdx ; Copy Arg1 to the register expected by KVM + mov rcx, r8 ; Copy Arg2 to register expected by KVM + mov rdx, r9 ; Copy Arg3 to register expected by KVM + vmmcall ; Call VMMCALL + pop rbx + ret diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/MemEncryptSevLib.c b/= OvmfPkg/Library/BaseMemEncryptSevLib/X64/MemEncryptSevLib.c index e7c703bb9a..a64ff2a5e6 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/MemEncryptSevLib.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/MemEncryptSevLib.c @@ -142,3 +142,69 @@ MemEncryptSevClearMmioPageEncMask ( EFI_PAGES_TO_SIZE (NumPages) ); } + +/** + This hyercall is used to notify hypervisor when the page's encryption + state changes. + + @param[in] PhysicalAddress The physical address that is the start= address + of a memory region. + @param[in] Pages Number of Pages in the memory region. + @param[in] IsEncrypted Encrypted or Decrypted. + + @retval RETURN_SUCCESS Hypercall returned success. + @retval RETURN_UNSUPPORTED Hypercall not supported. + @retval RETURN_NO_MAPPING Hypercall returned error. +**/ +RETURN_STATUS +EFIAPI +SetMemoryEncDecHypercall3 ( + IN UINTN PhysicalAddress, + IN UINTN Pages, + IN BOOLEAN IsEncrypted + ) +{ + RETURN_STATUS Ret; + UINTN Error; + UINTN EncryptState; + + Ret =3D RETURN_UNSUPPORTED; + + if (MemEncryptSevLiveMigrationIsEnabled ()) { + Ret =3D RETURN_SUCCESS; + // + // The encryption bit is set/clear on the smallest page size, hence + // use the 4k page size in MAP_GPA_RANGE hypercall below. + // + // Also, when the GCD map is being walked and the c-bit being cleared + // from MMIO and NonExistent memory spaces, the physical address + // range being passed may not be page-aligned and adding an assert + // here prevents booting. Hence, rounding it down when calling + // SetMemoryEncDecHypercall3AsmStub below. + // + + EncryptState =3D IsEncrypted ? KVM_MAP_GPA_RANGE_ENCRYPTED : + KVM_MAP_GPA_RANGE_DECRYPTED; + + Error =3D SetMemoryEncDecHypercall3AsmStub ( + KVM_HC_MAP_GPA_RANGE, + PhysicalAddress & ~EFI_PAGE_MASK, + Pages, + KVM_MAP_GPA_RANGE_PAGE_SZ_4K | EncryptState + ); + + if (Error !=3D 0) { + DEBUG (( + DEBUG_ERROR, + "SetMemoryEncDecHypercall3 failed, Phys =3D %x, Pages =3D %d, Err = =3D %Ld\n", + PhysicalAddress, + Pages, + (INT64)Error + )); + + Ret =3D RETURN_NO_MAPPING; + } + } + + return Ret; +} --=20 2.25.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#88437): https://edk2.groups.io/g/devel/message/88437 Mute This Topic: https://groups.io/mt/90271217/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 03:12:45 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+88438+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1649179936237160.4638922766169; Tue, 5 Apr 2022 10:32:16 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id rgUpYY1788612xIRSNbsadT9; Tue, 05 Apr 2022 10:32:15 -0700 X-Received: from NAM02-BN1-obe.outbound.protection.outlook.com (NAM02-BN1-obe.outbound.protection.outlook.com [40.107.212.56]) by mx.groups.io with SMTP id smtpd.web11.97.1649179934774971270 for ; Tue, 05 Apr 2022 10:32:15 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=lnZUsk+U0A5KQIZnp7CFErDNQtofNCsbPBWl7FfIsIucohdFM2iOTqDNX1r2kiZT66wyIBJKeA8/ia9LYT5S0WnD3aVDD2akWMBqoyS/5DNh0JSnD0uNIxncj5+0sgu0Ogvp7qiYgf6EZafxU4KeYsNuGdHM58yzJAh8OBWp/E5IU1T5Q77eHiMJFVcrvlPHmdi33fxE4ts9NSIcp5Pr98DopbyMskYW22ScCvJ6DoCerfP+SjZHe76gJEBtwjeizY3yHsdJYdY/Bs1w7YFcZquKfrhd9tYc4G3qgq3Vx1Dm50X9XPkFl7St+kljjwVH1uwKu4RRu2UBXEiwJtNqhw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GwhI5Eaz1v/k4EQCDbaOlrODxu1AaEBeodGdSTE0cRk=; b=S0yivmNsEptWL0MYI/uD10GBxtTc6waVRoIaIHxbVyZ6Ge5qyMU1pln+F8xAb704zmUbV2nUZ7aZEaU6jkrb9/9uvA0YbNaEj2Z82+WG/4aZE8lcCazuN3tWDkUwLIFX2D6qMG0fSPhxhxvqv1pv49K6zQfEX6wt0G5Xi3ytfH3gINqt69Pi5KRYZPEw34uPcd6UQiUhDlayDiHueoF+pvtfeG5nNVev+6DzFI4qBSV9dQ5RWbdPBXkIdig8LN/7e+M/eUkTDdj8s8qR2iLVPdEyeBW4Ez22FQfyBiTF+0a98mcz2wxs5qDkYMn0R4ftpnEcB0ZtfAsPZBrwHKRR0Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none X-Received: from BN6PR16CA0014.namprd16.prod.outlook.com (2603:10b6:404:f5::24) by MN2PR12MB4141.namprd12.prod.outlook.com (2603:10b6:208:1d5::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.31; Tue, 5 Apr 2022 17:32:12 +0000 X-Received: from BN8NAM11FT067.eop-nam11.prod.protection.outlook.com (2603:10b6:404:f5:cafe::80) by BN6PR16CA0014.outlook.office365.com (2603:10b6:404:f5::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.31 via Frontend Transport; Tue, 5 Apr 2022 17:32:12 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+88438+1787277+3901457@groups.io; helo=mail02.groups.io; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; X-Received: from SATLEXMB04.amd.com (165.204.84.17) by BN8NAM11FT067.mail.protection.outlook.com (10.13.177.159) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.5144.20 via Frontend Transport; Tue, 5 Apr 2022 17:32:12 +0000 X-Received: from ashkalraubuntuserver.amd.com (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 5 Apr 2022 12:32:10 -0500 From: "Ashish Kalra via groups.io" To: CC: , , , , , , , , Subject: [edk2-devel] [PATCH v8 3/6] OvmfPkg/BaseMemEncryptLib: Invoke page encryption state change hypercall Date: Tue, 5 Apr 2022 17:32:01 +0000 Message-ID: In-Reply-To: References: MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: af0b4b37-f79d-425c-5bc4-08da172a37f4 X-MS-TrafficTypeDiagnostic: MN2PR12MB4141:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: Ikeu5s2IQWFFl+/er9zr05fTZrU8AxPivJO9lG/aZ6XsBKMUpFACUZW+TCOQ0ydqgz5imc3Z5GFXJ8hLLu1ds7mydaNWMNGKCJqJ5tAQ0rtck1O+0qLtUYVWZBVF60p3W8OKBnpWZ5vqc8zFbxStX8kvedde+R9NwzWaX+SBPlGXDPbKooUOlEzlzVRvM8UF4YvazY34FwStC8jMkUn3pe6zje8Vw5vj7ti9yj8WZIvPC8wiWejREKig6sB1sf3XUssKWLeM7Es2w6XRufyjpAN7b8SdqaYWBzD5LfzvWBSonUaVjboZhYlTI0tHqQwYo4B2MOMGun/wkbRvyuYeYylu1VKlE4PJLD8LefbZzaJhx8KyOo256i2kwG0kFRr2tavFPh7KSXZOzAxQq22USZyjvzVRoL50j1W89wtTXxNTAHFGCkzXCW97Vvtz8fXPogbGQvavNI9r027fi1PMcmzE+fpLB10vcKyaCkbe1AJcWGQR+TMfqmvz3SDrViVEDsw6KiT/OZPq+cjFhzjrsVfyoAye8S0LDMWIG4Xra7uCUKkd8oFxJXpqnYwEcl91E+oPn3bLC6TqMi79G8QBXtghkmhxFdZUazb8LlfwH6EsvjxjZQb4aqOrnXQN0JcnhNa3NaLPHBQXOoLrMtsJtSWNmWPVgD+DYL8oSbUzQYDB7zdmu/6tpgwywri5rsRf6Mus+1W2Vne17We8fBmLlg== X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Apr 2022 17:32:12.0391 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: af0b4b37-f79d-425c-5bc4-08da172a37f4 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT067.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR12MB4141 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,ashish.kalra@amd.com X-Gm-Message-State: nxNfwR6B59gta4LxNPJnIEe6x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1649179935; bh=uqz8SPYmEOzax96T/UbGbc5ESODKG9rIt4ar277Phq4=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=RxX285MvsaDxKFRzduas0aiNg/vJ4bA7WDcdpaYvge9IwANb4lI8LyhNC4iW+eY1BtZ RbPbTpk7TnZ0XMmvcXp+8CydvEboPCgjlVCSWApXU5tvs1pRlZHfWx4dAecHtVoOnlRgG 8aa59wZWyo+uYkxwx2J3IcPBJN1/dmsiVQc= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1649179936816100001 Content-Type: text/plain; charset="utf-8" From: Ashish Kalra Invoke the hypercall API to notify hypervisor when the page's encryption state changes. Cc: Jordan Justen Cc: Ard Biesheuvel Signed-off-by: Brijesh Singh Signed-off-by: Ashish Kalra --- .../X64/PeiDxeVirtualMemory.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c= b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c index b9c0a5b25a..b8478dd948 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c @@ -701,6 +701,7 @@ SetMemoryEncDec ( UINT64 PgTableMask; UINT64 AddressEncMask; BOOLEAN IsWpEnabled; + BOOLEAN CBitChanged; UINTN OrigLength; RETURN_STATUS Status; =20 @@ -769,6 +770,7 @@ SetMemoryEncDec ( // Save the specified length and physical address (we need it later). // OrigLength =3D Length; + CBitChanged =3D FALSE; OrigPhysicalAddress =3D PhysicalAddress; =20 while (Length !=3D 0) { @@ -829,6 +831,7 @@ SetMemoryEncDec ( )); PhysicalAddress +=3D BIT30; Length -=3D BIT30; + CBitChanged =3D TRUE; } else { // // We must split the page @@ -884,6 +887,7 @@ SetMemoryEncDec ( SetOrClearCBit (&PageDirectory2MEntry->Uint64, Mode); PhysicalAddress +=3D BIT21; Length -=3D BIT21; + CBitChanged =3D TRUE; } else { // // We must split up this page into 4K pages @@ -927,6 +931,7 @@ SetMemoryEncDec ( SetOrClearCBit (&PageTableEntry->Uint64, Mode); PhysicalAddress +=3D EFI_PAGE_SIZE; Length -=3D EFI_PAGE_SIZE; + CBitChanged =3D TRUE; } } } @@ -959,6 +964,17 @@ SetMemoryEncDec ( ); } =20 + // + // Notify Hypervisor on C-bit status + // + if (CBitChanged) { + Status =3D SetMemoryEncDecHypercall3 ( + OrigPhysicalAddress, + EFI_SIZE_TO_PAGES (OrigLength), + (Mode =3D=3D SetCBit) ? TRUE : FALSE + ); + } + Done: // // Restore page table write protection, if any. --=20 2.25.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#88438): https://edk2.groups.io/g/devel/message/88438 Mute This Topic: https://groups.io/mt/90271222/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 03:12:45 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+88439+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1649179963709464.3133617606055; Tue, 5 Apr 2022 10:32:43 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id YJbCYY1788612xIqN95qWvZN; Tue, 05 Apr 2022 10:32:43 -0700 X-Received: from NAM11-BN8-obe.outbound.protection.outlook.com (NAM11-BN8-obe.outbound.protection.outlook.com [40.107.236.49]) by mx.groups.io with SMTP id smtpd.web11.102.1649179962453761436 for ; Tue, 05 Apr 2022 10:32:42 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=T5jMhAK/vu9/rIPAKe8c9T4SdNQygud1SVdx1xWtcVbvgqSTGFdA5TS/cZU/srGTPlLKkgsh3suVhP/OxCbBnfABk0RtI0s2CoKFpqZ3PxBxk7b5FZzD0stfmnEq+akI/Kt2qesZEGWLnIh3BRb521oTcvRIP9XAUfHjIzYbXUunp8BpGhGV+QdIYkmgFIPRIcwipWJj06l0COHwBMD6BReoNwdFuIGZGHTuRMGT2lys9/lNjgDp7C1MZVb3DQle2Fr5xj+7k+DEQPbyKJTy38OgLaHbCsgDUR01bD4H1Wb9dw4+aR6+8+85kR0jBxRuHbXEOBLkI0tSC5jjnGofSQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=XRi3UVsdNHvhHvRzWUIIZROzFaaaBlJzv3tWoB0DICU=; b=BAQNrpT1bI47PjQa7yDhfxbb4LYFIEhFsU5pLRzZTKK6OE/B+OH8zPE/noeORCp4dU3g642DlR6LrvQtfVtkv95ikRIu04qwk03q/xL8MBXk0+/BqUh79faXV758bvI5BpCC5i+eRnc3BEDkFQW+TxQdZaa1mfrSVYPOqUaU0IiDvKnlHzIERQ/lJutTRA3A4Ygfx1nChCwNPdyGFf7Mx+NMebZ5oGjrgBgSjB2CDQo+ZFTpKt+9X5gDrwka3CLOQDA+vtWOdxklpMLUiY6cX3AxpEMGpTs3DlVVMqGc7I9ajdsDZTzUilSkJk/4to7VW2T8CiENx8TAnL0S9w8U/g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none X-Received: from BN6PR1401CA0001.namprd14.prod.outlook.com (2603:10b6:405:4b::11) by DM5PR1201MB0043.namprd12.prod.outlook.com (2603:10b6:4:57::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.31; Tue, 5 Apr 2022 17:32:40 +0000 X-Received: from BN8NAM11FT036.eop-nam11.prod.protection.outlook.com (2603:10b6:405:4b:cafe::98) by BN6PR1401CA0001.outlook.office365.com (2603:10b6:405:4b::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.31 via Frontend Transport; Tue, 5 Apr 2022 17:32:40 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+88439+1787277+3901457@groups.io; helo=mail02.groups.io; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; X-Received: from SATLEXMB04.amd.com (165.204.84.17) by BN8NAM11FT036.mail.protection.outlook.com (10.13.177.168) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.5123.19 via Frontend Transport; Tue, 5 Apr 2022 17:32:40 +0000 X-Received: from ashkalraubuntuserver.amd.com (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 5 Apr 2022 12:32:38 -0500 From: "Ashish Kalra via groups.io" To: CC: , , , , , , , , Subject: [edk2-devel] [PATCH v8 4/6] OvmfPkg/VmgExitLib: Encryption state change hypercall support in VC handler Date: Tue, 5 Apr 2022 17:32:27 +0000 Message-ID: In-Reply-To: References: MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 83436486-65a4-4bf9-0802-08da172a48c1 X-MS-TrafficTypeDiagnostic: DM5PR1201MB0043:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: 5GkaY+irdRUUhMgcx7eKkIiQK5Mro5ZgCVAzqTZKQfd10QZoIaENiuKyCrdgGnnM4lCtL5vzozQVBIA0uxoCxmc7qH8Q2ukojYpMPBVwFaqfJuyXj32skk/Zf/yDFHOG/Mjw9NsgGRLR0iuDFcPDbgve4wnfid09rY1ecgVe0auk5wHKaPCSmQzFOE9jNHc3ZJQG3XyzaqlewWFT1vpkUyA9GeeFou4b+y2afGaZik7gJWVSrObOOhCh+OjbLuMp4DQPlZLOfEpw/QWSNfl31Zr41TIt/RRkDzRRN7fBeHojXx/Lwf3WJmdcGoZeenOA0l0u5gv1vXEl6r8Hk8kUlqW/J6NuqCjI9/cjN7f4PmDAHEmL6Tj+12x4FwvxnC3oGF0dQC6cjo2O9Xt7ytLPN7vPxOGIo03zVrcbwA/ZJODhfH3NXTr0+uYIUDSI6KihKqnM/l/b80I9nMmKKqwBJtIeedRKFCVSQN3n5u9LJxu0a/dxgtU0SFW3zT6z8L8OjQdOwNH83UQpyFjk5CYJ7M1DWOaR5q6uRf960wgPuSp5xK68DQDLxOESh79PB4o3O8SSX2rdjHOrSFtjqrc1Yp7oNXdrE3bH4whVk0/aFgBbUhGDj7+/k0elvSx2Vm2+HeWAvOAgjgCfJgWRnC1tsonOAYQ3EhXXC+Y5jDdFa+T63QTY8Snt7onQzOQWtHQ1iTp7V1k+pR9kg7tuwakvGQ== X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Apr 2022 17:32:40.2241 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 83436486-65a4-4bf9-0802-08da172a48c1 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT036.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR1201MB0043 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,ashish.kalra@amd.com X-Gm-Message-State: DZvCutcMMCW4xjQjFbrLVfULx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1649179963; bh=MNsLN4TauhD2KS9TZn5BVdkTx6m1KWZf0srRgknum60=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=BUx+NZFIoG43/h7xLIKvnuN92+eOVxLcjdD+rfKOiNjp5mkjK94A+IUtMFf7eREpj6Y ufXgDeFihZt8TsR5SUtoJpseCZ2l9dnOzl5e8e4R3ol97IGgbfenv3KJPIYGXkJNZGF33 YOTAmZKiUFryhJF+bMN4qcwTKAhQwbzC5WY= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1649179965150100001 Content-Type: text/plain; charset="utf-8" From: Ashish Kalra Make the #VC handler aware of the page encryption state change hypercall by adding support to check KVM_HC_MAP_GPA_RANGE hypercall and add the additional register values used by hypercall in the GHCB. Cc: Jordan Justen Cc: Ard Biesheuvel Signed-off-by: Ashish Kalra --- OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c b/OvmfPkg/Librar= y/VmgExitLib/VmgExitVcHandler.c index a4393dffbd..ee213ae2cb 100644 --- a/OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c +++ b/OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c @@ -1211,6 +1211,19 @@ VmmCallExit ( Ghcb->SaveArea.Cpl =3D (UINT8)(Regs->Cs & 0x3); VmgSetOffsetValid (Ghcb, GhcbCpl); =20 + if (Regs->Rax =3D=3D KVM_HC_MAP_GPA_RANGE) { + // + // KVM_HC_MAP_GPA_RANGE hypercall requires these + // extra registers. + // + Ghcb->SaveArea.Rbx =3D Regs->Rbx; + VmgSetOffsetValid (Ghcb, GhcbRbx); + Ghcb->SaveArea.Rcx =3D Regs->Rcx; + VmgSetOffsetValid (Ghcb, GhcbRcx); + Ghcb->SaveArea.Rdx =3D Regs->Rdx; + VmgSetOffsetValid (Ghcb, GhcbRdx); + } + Status =3D VmgExit (Ghcb, SVM_EXIT_VMMCALL, 0, 0); if (Status !=3D 0) { return Status; --=20 2.25.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#88439): https://edk2.groups.io/g/devel/message/88439 Mute This Topic: https://groups.io/mt/90271234/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 03:12:45 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+88440+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1649179981040497.36290049635966; Tue, 5 Apr 2022 10:33:01 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id iFcHYY1788612xh2T30hEtpg; Tue, 05 Apr 2022 10:33:00 -0700 X-Received: from NAM12-MW2-obe.outbound.protection.outlook.com (NAM12-MW2-obe.outbound.protection.outlook.com [40.107.244.57]) by mx.groups.io with SMTP id smtpd.web08.119.1649179979410138693 for ; Tue, 05 Apr 2022 10:32:59 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Mm/zcJbKJLPdKjv2qtlkh/LD5UUonUQPDyB918YhXSpIxLI4nT+FuOyWT9oPqCVIAO3JDhuE2rSEUim4ujUJCK+4tWuGRk3iGDmkWHu2t8XGnYlR8TaM+mvP0zhyEgVibnZCfaBufpm6pNu3z1yvBiObewQm2Sc9OGvFYV/+46gI7IdDTD1eT9ugWXIbjBsNzH3SovBcEu1sB1hctfyrQaGSJefgdxf/rKZKZ011piLgwnvsM49COHM8PPYLcrwfMCnceVz8bLFfKX/y2SWRaTdR9gH8vpeQdxSHN/79cRnJtKuCpmeD0lPzbaIyhIATwF61d8uyimpK360CW5ZYKA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=CU3+GEe99feGPclKoByxGzoSNLj6a11DxI9T1A0rYcs=; b=ngNOhhG9wNGpWyai/oetQ80aOhNoxw9tqfpdrIag0owQUr22OkZ96qqfsi8HRw0USeAItGQ5Fnx86nEocLU3qqvjS/ghCFEbgIs6IqWrCAJ3qtvrBjWtWZM23b2ptR6rzV1Z3iJNoZ6cXHOKZggfCTReXKUONEez+QPblR0Pgw0sE89qT0nx3hHNkwiqZPJ/4caIQme2n0dl2gCUKEaqXfANMvR9MLhoJIi5h8LU3O7oPl7lDUvdqi+2oro267SGvgWaEDbAiw7QBGAY7xjwf2WsI4Y9DrlkAFdkPUVfweZUuebd3yFic61iMAByI6EV5YcXxMgmOEt1UgY/gRVjqQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none X-Received: from BN9PR03CA0607.namprd03.prod.outlook.com (2603:10b6:408:106::12) by MN2PR12MB3021.namprd12.prod.outlook.com (2603:10b6:208:c2::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.31; Tue, 5 Apr 2022 17:32:56 +0000 X-Received: from BN8NAM11FT032.eop-nam11.prod.protection.outlook.com (2603:10b6:408:106:cafe::d) by BN9PR03CA0607.outlook.office365.com (2603:10b6:408:106::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.31 via Frontend Transport; Tue, 5 Apr 2022 17:32:56 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+88440+1787277+3901457@groups.io; helo=mail02.groups.io; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; X-Received: from SATLEXMB04.amd.com (165.204.84.17) by BN8NAM11FT032.mail.protection.outlook.com (10.13.177.88) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.5144.20 via Frontend Transport; Tue, 5 Apr 2022 17:32:56 +0000 X-Received: from ashkalraubuntuserver.amd.com (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 5 Apr 2022 12:32:54 -0500 From: "Ashish Kalra via groups.io" To: CC: , , , , , , , , Subject: [edk2-devel] [PATCH v8 5/6] OvmfPkg/PlatformPei: Mark SEC GHCB page as unencrypted via hypercall Date: Tue, 5 Apr 2022 17:32:45 +0000 Message-ID: <8e98ccac7867d922f0f4c76ccc17fadef738623e.1649178155.git.ashish.kalra@amd.com> In-Reply-To: References: MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 4161e02b-3fb2-4a00-7b19-08da172a5260 X-MS-TrafficTypeDiagnostic: MN2PR12MB3021:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: seTZVXczUUEDNpz+sYC0I2TY5fb0nJsFaDiUEXpmdkDau5hVlH6MkO9wjq/gvAevFRmBNnQFE2LFdDooiRn27k/CbZcZ8g/yWQ0jct7F6JDD/WG0vlZZlsLXLwfLAk1wpX7ADLdT6GnVKtxZq+XF22XaXOK2bxoSqbuQlyKM9szPq0uINnrGMz+SNQGk92Flnc7BWB0+EiyPnfayJZHvWM0jxZUi0jlNgxD5dINO/Nsv2IxEg+nc+SOwVRZWitjGJb+qqPE90SGnI9QK4fu+uPbMM7/OL4X/pnvhNu0qq6Foiycq76rcBGjr1jUysiF3wsYQeD23uxvG+9Scb+YLnV5sysKnSPXjryujtzeyYwyrl3nctlmxRZnYfsb4eGbLv8N0lkSa23B9HdbniE0YLKpXCY6c//JcivdFvm7s8YCRps49KupAltLVjmSJjkl9HpFETmHHzpaND59y8CVyaELV56V208BFTHSgsmn0Ynx+b3VZ0qGEq9nkbKUBZJNwF4QDmkdSierrOQ+sdg77Q55Thx/Yghx+VQWApH02JHSeJ01PM+G+6uAb3SB3N36hjDZapfQxUKt7HjatZdkC6jRoSRr8RO9/dzYsiqQa7/EDQK7echoxECHS42leZ7kaEZxxNdTY/YfHeM0qdy2iiVHpQES+h9jZFaKrwekEMoEswkiGwyVzQIFObBB8vunQRj1bOCiF7jvxV/nyCnzhzQ== X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Apr 2022 17:32:56.3841 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 4161e02b-3fb2-4a00-7b19-08da172a5260 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT032.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR12MB3021 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,ashish.kalra@amd.com X-Gm-Message-State: uXuPzj2YwgcEQPPCwkRFW4sIx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1649179980; bh=Ur8kVIohQvYgmvLf1uk/j51f/v3WdBYBeUeJ13timFk=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=wImpXVkF7L8cZ2sXDpoDrkRPK/3wsK0F2U578Er9oRekV5bGLjdvYWfzfNOskKOdOqW NOTlavcxW7uMJP7GyoC1INnsxBsFl6WqblU/khWIcBqnaebrc/p2eB3wFiKOyDle0/Dqp b5+JeLuABiJXIoDGPGBydJ1ZdSYOmqb7hV8= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1649179983015100003 Content-Type: text/plain; charset="utf-8" From: Ashish Kalra Mark the SEC GHCB page (that is mapped as unencrypted in ResetVector code) in the hypervisor's guest page encryption state tracking. Cc: Jordan Justen Cc: Ard Biesheuvel Signed-off-by: Ashish Kalra --- OvmfPkg/PlatformPei/AmdSev.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c index 385562b44c..cd96fc23bd 100644 --- a/OvmfPkg/PlatformPei/AmdSev.c +++ b/OvmfPkg/PlatformPei/AmdSev.c @@ -223,6 +223,17 @@ AmdSevEsInitialize ( PcdStatus =3D PcdSetBoolS (PcdSevEsIsEnabled, TRUE); ASSERT_RETURN_ERROR (PcdStatus); =20 + // + // The SEC Ghcb setup during reset-vector needs to be marked as + // decrypted in the hypervisor's guest page encryption state + // tracking. + // + SetMemoryEncDecHypercall3 ( + FixedPcdGet32 (PcdOvmfSecGhcbBase), + EFI_SIZE_TO_PAGES (FixedPcdGet32 (PcdOvmfSecGhcbSize)), + FALSE + ); + // // Allocate GHCB and per-CPU variable pages. // Since the pages must survive across the UEFI to OS transition --=20 2.25.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#88440): https://edk2.groups.io/g/devel/message/88440 Mute This Topic: https://groups.io/mt/90271239/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 03:12:45 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+88441+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1649179997644648.5068862197708; Tue, 5 Apr 2022 10:33:17 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id s9KpYY1788612xRjxEjxn3hD; Tue, 05 Apr 2022 10:33:17 -0700 X-Received: from NAM10-MW2-obe.outbound.protection.outlook.com (NAM10-MW2-obe.outbound.protection.outlook.com [40.107.94.73]) by mx.groups.io with SMTP id smtpd.web11.109.1649179996430414145 for ; Tue, 05 Apr 2022 10:33:16 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=YbRfCTQR5oxMjERLtY7ign2Np/Fh/sgOn9DkXBpYQ580XYfmX03fMWAyn0CSvwhuTQWxBwQbqm5TTUClR/pQO7ttWlcgdEKc+H4H7nFLnUw41xs1KbvbNaop00B290t0sP+BG+lk9BVIF3vXKgt2u+ZciPIumiVD7ekbxFnFXdotUQ/J222gjZzhfr9K+Zza4YIxHFBJIhQGBcd18CYL9D5vbZyChymTtIHRmHzF0OkuN8Prl6Q9U16sZ8LzM3fS5c5X7liJSJcoffMvvpavDvXaupoHZneFtAo2vOjN9lH8S/+8aOmUSVn8KAMJ7YDmLk21hB5eeuMWlMfEeZhdWQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Xhhdohhx02B4MoP7YOlLSQaujslzZPGS3ZFI5mABxQM=; b=JmG1mVRLopIbUPY1aHHtUf5Fct2CUqhtBT0nmvHgoPZNi90UwwNH9VD6AfjDq/HpQLrwzTsAkXaUw33YI5mvZ8GCkY8vGvm2nWgnw+zyFzBQOU9DorFPrvZdW52uuuVjK6k7Yb68CAZ2vEeUyOYp3T/FRtY9lx1jvw+xccajL+81b0dj85JVyDff8nCegDcwiTkIRff6va4Aq//lH06iq7CVlC5T7iFTyq8GDukUdjHiHyd0E5GxZN0sMiSsTYqOqPVyH6mEF7XoQrhXKsrPhnnJEbdA5+wOg+kBi11J/M433Dhbhp+OGfJHrOysIrJlji2sAoXOzskfGeHoVdAq9Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none X-Received: from BN8PR07CA0011.namprd07.prod.outlook.com (2603:10b6:408:ac::24) by DM5PR1201MB2475.namprd12.prod.outlook.com (2603:10b6:3:e6::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.31; Tue, 5 Apr 2022 17:33:14 +0000 X-Received: from BN8NAM11FT065.eop-nam11.prod.protection.outlook.com (2603:10b6:408:ac:cafe::d5) by BN8PR07CA0011.outlook.office365.com (2603:10b6:408:ac::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.31 via Frontend Transport; Tue, 5 Apr 2022 17:33:14 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+88441+1787277+3901457@groups.io; helo=mail02.groups.io; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; X-Received: from SATLEXMB04.amd.com (165.204.84.17) by BN8NAM11FT065.mail.protection.outlook.com (10.13.177.63) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.5123.19 via Frontend Transport; Tue, 5 Apr 2022 17:33:13 +0000 X-Received: from ashkalraubuntuserver.amd.com (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 5 Apr 2022 12:33:12 -0500 From: "Ashish Kalra via groups.io" To: CC: , , , , , , , , Subject: [edk2-devel] [PATCH v8 6/6] OvmfPkg/AmdSevDxe: Add support for SEV live migration. Date: Tue, 5 Apr 2022 17:33:03 +0000 Message-ID: In-Reply-To: References: MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 60b109e7-bae9-4311-c802-08da172a5cba X-MS-TrafficTypeDiagnostic: DM5PR1201MB2475:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: /pC3oZ1FoDrOAiYwT65Uvh7MXn92BHxwg/gRydqRMr4n2dosieE7ZaeHsk+06qlxlEy0IjEkrFW1OOrqtTB84T60RplEj2NMCXSIlIlV75g8gJu4Ud6Zc/3ng94NwwXoaaQP+bcHGcrTFZRCmTYe5SQQKZet5iLcCwnv8NbT1t20fqBn1jYE2F/dj45eGOEpbHN/OAGcTYFvfknjocUm3sDU27Xt49XZpbBZv1y9LpgTbPJvCPG5c703JmqVG2HCdqtWTnwayH0vobg+c+Znj53v0xzNJM5nwftESymsjMMHS0tMOaNUZqZwYQIwgtQVgFKFH1YfDNH3O+ROx6R4xZ0gHHiBplzSoG/YarBdes+OK3Su0vFe71Dw7pgHtabedk3xeHZKXYUJP6tTVKgxMWqPvRVRiwYtvBTi5tYgUvooGI49jTZq4BhJR/iwo0a3I4I9i+/4ajOZMibzOtmuD8/g/r/MrYg0Vrsdwa6T0RLedo7Ld1TkiCs7od2+wGrB2rd51mH9mbOLfqK9pUJFzjf80zb7omzp8udCxNYYm9fKPXtBhQ/jFa4UG106H7rOh+f7F9dVQgNT1AEtGkoe+NLdil4gh2nEi3EYZzW0fwHl4GxGKxUjxmLMbf5qRTO9EwRn7vUQIUuf/sfYjqiQP/vBc7K3TQH82voVbOk/VI7QWrMXQjvy4gSOghL1gwJtQfvQp81WXUyP7ZbpUtvYpg== X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Apr 2022 17:33:13.7375 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 60b109e7-bae9-4311-c802-08da172a5cba X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT065.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR1201MB2475 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,ashish.kalra@amd.com X-Gm-Message-State: 2YTF7yhflJvlSYNxsjjPs2KLx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1649179997; bh=C8nV5F/+wgOoqDtiI1l/Io74cCVcS60BR11sKDj4dyA=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=mCUaC1qxiWNCguHodAOSFP1zxWbSN0+J6r6mAWyf/CUqzit/qoge4MGx8EjmaeQg3aq aIagqKLcXSqSUd+7TGhqRoS2HMLxP+CD5yVIfkSVYOftojX6tmfVN4aSsvgTJoA4s7nCM 9KM2+Mx08tTW/DttkICPvyKBl9hQc1ii2vU= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1649179999125100001 Content-Type: text/plain; charset="utf-8" From: Ashish Kalra Check for SEV live migration feature support, if detected setup a new UEFI enviroment variable to indicate OVMF support for SEV live migration. This environment variable is created by UEFI but consumed by the (guest) linux kernel. This is actually part of a 3-way negotiation of the live migration feature between hypervisor, guest OVMF and guest kernel. Host indicates support for live migration, which is detected by OVMF and correspondingly OVMF sets this SetLiveMigrationEnabled UEFI variable, which is read by the guest kernel and it indicates to the guest kernel that both host and OVMF support and have enabled the live migration feature. The new runtime UEFI environment variable is set via the notification function registered for the EFI_END_OF_DXE_EVENT_GROUP_GUID event in AmdSevDxe driver. AmdSevDxe module is an apriori driver so it gets loaded between PEI and DXE phases and the SetVariable call will fail at the driver's entry point as the Variable DXE module is still not loaded yet. So we need to wait for an event notification which is signaled after the Variable DXE module is loaded, hence, using the EndOfDxe event notification to make this call. Signed-off-by: Ashish Kalra --- OvmfPkg/AmdSevDxe/AmdSevDxe.c | 67 ++++++++++++++++++++++ OvmfPkg/AmdSevDxe/AmdSevDxe.inf | 4 ++ OvmfPkg/Include/Guid/AmdSevMemEncryptLib.h | 20 +++++++ OvmfPkg/OvmfPkg.dec | 1 + 4 files changed, 92 insertions(+) create mode 100644 OvmfPkg/Include/Guid/AmdSevMemEncryptLib.h diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.c b/OvmfPkg/AmdSevDxe/AmdSevDxe.c index 662d3c4ccb..1453d68d81 100644 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.c +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.c @@ -15,10 +15,13 @@ #include #include #include +#include #include #include #include #include +#include +#include #include =20 STATIC CONFIDENTIAL_COMPUTING_SNP_BLOB_LOCATION mSnpBootDxeTable =3D { @@ -31,6 +34,39 @@ STATIC CONFIDENTIAL_COMPUTING_SNP_BLOB_LOCATION mSnpBoo= tDxeTable =3D { FixedPcdGet32 (PcdOvmfCpuidSize), }; =20 +STATIC +VOID +EFIAPI +AmdSevDxeOnEndOfDxe ( + IN EFI_EVENT Event, + IN VOID *EventToSignal + ) +{ + EFI_STATUS Status; + BOOLEAN SevLiveMigrationEnabled; + + SevLiveMigrationEnabled =3D MemEncryptSevLiveMigrationIsEnabled (); + + if (SevLiveMigrationEnabled) { + Status =3D gRT->SetVariable ( + L"SevLiveMigrationEnabled", + &gAmdSevMemEncryptGuid, + EFI_VARIABLE_NON_VOLATILE | + EFI_VARIABLE_BOOTSERVICE_ACCESS | + EFI_VARIABLE_RUNTIME_ACCESS, + sizeof SevLiveMigrationEnabled, + &SevLiveMigrationEnabled + ); + + DEBUG (( + DEBUG_INFO, + "%a: Setting SevLiveMigrationEnabled variable, status =3D %lx\n", + __FUNCTION__, + Status + )); + } +} + EFI_STATUS EFIAPI AmdSevDxeEntryPoint ( @@ -42,6 +78,7 @@ AmdSevDxeEntryPoint ( EFI_GCD_MEMORY_SPACE_DESCRIPTOR *AllDescMap; UINTN NumEntries; UINTN Index; + EFI_EVENT Event; =20 // // Do nothing when SEV is not enabled @@ -158,5 +195,35 @@ AmdSevDxeEntryPoint ( ); } =20 + // + // AmdSevDxe module is an apriori driver so it gets loaded between PEI + // and DXE phases and the SetVariable call will fail at the driver's + // entry point as the Variable DXE module is still not loaded yet. + // So we need to wait for an event notification which is signaled + // after the Variable DXE module is loaded, hence, using the + // EndOfDxe event notification to make this call. + // + // Register EFI_END_OF_DXE_EVENT_GROUP_GUID event. + // The notification function sets the runtime variable indicating OVMF + // support for SEV live migration. + // + Status =3D gBS->CreateEventEx ( + EVT_NOTIFY_SIGNAL, + TPL_CALLBACK, + AmdSevDxeOnEndOfDxe, + NULL, + &gEfiEndOfDxeEventGroupGuid, + &Event + ); + + if (EFI_ERROR (Status)) { + DEBUG (( + DEBUG_ERROR, + "%a: CreateEventEx(): %r\n", + __FUNCTION__, + Status + )); + } + return EFI_SUCCESS; } diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf b/OvmfPkg/AmdSevDxe/AmdSevDxe.= inf index 9acf860cf2..42f8af0d0d 100644 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.inf @@ -52,3 +52,7 @@ =20 [Pcd] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfHostBridgePciDevId + +[Guids] + gAmdSevMemEncryptGuid + gEfiEndOfDxeEventGroupGuid ## CONSUMES ## Event diff --git a/OvmfPkg/Include/Guid/AmdSevMemEncryptLib.h b/OvmfPkg/Include/G= uid/AmdSevMemEncryptLib.h new file mode 100644 index 0000000000..62d22e79a9 --- /dev/null +++ b/OvmfPkg/Include/Guid/AmdSevMemEncryptLib.h @@ -0,0 +1,20 @@ +/** @file + + AMD Memory Encryption GUID, define a new GUID for defining + new UEFI environment variables assocaiated with SEV Memory Encryption. + + Copyright (c) 2021, AMD Inc. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef __AMD_SEV_MEMENCRYPT_LIB_H__ +#define __AMD_SEV_MEMENCRYPT_LIB_H__ + +#define AMD_SEV_MEMENCRYPT_GUID \ +{0x0cf29b71, 0x9e51, 0x433a, {0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8, 0x= 75}} + +extern EFI_GUID gAmdSevMemEncryptGuid; + +#endif diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index b9ca441202..0f415f24db 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -142,6 +142,7 @@ gConfidentialComputingSecretGuid =3D {0xadf956ad, 0xe98c, 0x484c, {= 0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47}} gConfidentialComputingSevSnpBlobGuid =3D {0x067b1f5f, 0xcf26, 0x44c5, {= 0x85, 0x54, 0x93, 0xd7, 0x77, 0x91, 0x2d, 0x42}} gUefiOvmfPkgPlatformInfoGuid =3D {0xdec9b486, 0x1f16, 0x47c7, {= 0x8f, 0x68, 0xdf, 0x1a, 0x41, 0x88, 0x8b, 0xa5}} + gAmdSevMemEncryptGuid =3D {0x0cf29b71, 0x9e51, 0x433a, {= 0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8, 0x75}} =20 [Ppis] # PPI whose presence in the PPI database signals that the TPM base addre= ss --=20 2.25.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#88441): https://edk2.groups.io/g/devel/message/88441 Mute This Topic: https://groups.io/mt/90271245/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-