From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM12-DM6-obe.outbound.protection.outlook.com (NAM12-DM6-obe.outbound.protection.outlook.com [40.107.243.88]) by mx.groups.io with SMTP id smtpd.web12.16488.1597156829681304529 for ; Tue, 11 Aug 2020 07:40:29 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="body hash did not verify" header.i=@amdcloud.onmicrosoft.com header.s=selector2-amdcloud-onmicrosoft-com header.b=nCxGOjKc; spf=none, err=SPF record not found (domain: amd.com, ip: 40.107.243.88, mailfrom: thomas.lendacky@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=FFrvN/322XT9n73oWOJ3iRvDQVDtl3MeX/PIlRSZ9BVkEKf8EYlr5pGFZ/L105OeO9OZFHDXZGjcryy86XvFM3eJ/469v+Z4Bd08lTb3kcd8vAn34R9/yeFiKSz5hk1lNewbhu9cEkRRtjrWV4XxdbGwthixpvs7LBpOpR+mh24JkBLTPlS38Zfs86AFXhc0Kqj48zKgIZagBWNrcIRsQl+k3zthANEMhhFnI4GrZxMWBbdHa61is9w/Ae40VjGczcY7SBv5eQpuFYpDuD0fSytXHFlFEXNyfc6F6038ALuB0S+3KkJkLWkxgvB9vBdFWVne/Qs7oqkzqIkhwCFKyQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MV3TmCl8wvWhvl6I7maKgPe7qQvW2AirP+DByxiuaUI=; b=MUZ+1ciMzWpTlOUdVg2gfNtvWrTO/G9+rR9OUCQg0z9+enPdB6uXWSu3RHE/TDUWGIg9xguVBcna/xxLaVTOZewDGNGU/Xmh3VVvvOcYWWnYEy/Yhu0IjAiXO6XF7hFL8q0iZbi27RfhLk4+EyTy4hD47vK06pEIg4q3iIfjOyAVSqs8vox/t0KWw9fibro64TWxsfyQ7Wf+HqegMhnT3mpUmHv8kAhmpDzXmCG0sJB1JSCjPuBO++qtObYARVvq8vhYI1xL8KsVK0QZ79zEO2HHL8eo68OqTCVGNZh1s3N/CaefIrj9SYng/9rIFJTDukJSb82R9obKJcJ57VPKDQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector2-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MV3TmCl8wvWhvl6I7maKgPe7qQvW2AirP+DByxiuaUI=; b=nCxGOjKcODLJU+0SB1/jWrDiPN1BPwa0J2UzePXmfdx39Gu3W4iMXH7CW85vFwLn46hUN3mRYJqIXGztU96lYE21l22JSXA80J0AE/Si7TSMRUo94z02Ewzmost2CUymY3gRDF8U5ndnFhvQvlFTibo27m9CVovTAEu7Kex6wtU= Authentication-Results: intel.com; dkim=none (message not signed) header.d=none;intel.com; dmarc=none action=none header.from=amd.com; Received: from DM5PR12MB1355.namprd12.prod.outlook.com (2603:10b6:3:6e::7) by DM6PR12MB3963.namprd12.prod.outlook.com (2603:10b6:5:1cd::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3261.22; Tue, 11 Aug 2020 14:40:27 +0000 Received: from DM5PR12MB1355.namprd12.prod.outlook.com ([fe80::25ec:e6ba:197c:4eb0]) by DM5PR12MB1355.namprd12.prod.outlook.com ([fe80::25ec:e6ba:197c:4eb0%8]) with mapi id 15.20.3261.024; Tue, 11 Aug 2020 14:40:27 +0000 Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support To: "Gao, Liming" , Laszlo Ersek , "devel@edk2.groups.io" CC: Brijesh Singh , Ard Biesheuvel , "Dong, Eric" , "Justen, Jordan L" , "Kinney, Michael D" , "Ni, Ray" , Andrew Fish , Anthony Perard , "You, Benjamin" , "Bi, Dandan" , "Dong, Guo" , "Wu, Hao A" , "Wang, Jian J" , Julien Grall , Leif Lindholm , "Ma, Maurice" References: <4fa19934-008b-f8e5-6db8-0c39fe9875de@redhat.com> From: "Lendacky, Thomas" Message-ID: <01de805d-1f39-4f1c-1699-601dc702ffba@amd.com> Date: Tue, 11 Aug 2020 09:40:25 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 In-Reply-To: X-ClientProxiedBy: DM3PR12CA0085.namprd12.prod.outlook.com (2603:10b6:0:57::29) To DM5PR12MB1355.namprd12.prod.outlook.com (2603:10b6:3:6e::7) Return-Path: thomas.lendacky@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from [10.236.30.118] (165.204.77.1) by DM3PR12CA0085.namprd12.prod.outlook.com (2603:10b6:0:57::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3261.19 via Frontend Transport; Tue, 11 Aug 2020 14:40:26 +0000 X-Originating-IP: [165.204.77.1] X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: bf883ee5-28fa-4c25-fd21-08d83e047d2b X-MS-TrafficTypeDiagnostic: DM6PR12MB3963: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:41; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: QSASDLDH/GGhKs8F/zcxEoEolQxK7nTuA5VaMW6U8u+FyJ1s7gRjCzer6KJEowNAcfGyj/CiwK2jtS31CkeE+JbuZEdt1xxMkmmfuOq/txLhPozSVvxZKpBwAZwiSu5DuCAz8LHrEiGaCNEBU6jT/Quq3mxaTGZ7jTd3bqlkg+ai/mJpT/e1pnqCzKdf50BTxBjhhBcurDPG08xA4Z22feYuEs3c1MdJMSXAdA61Ei05t6pb3ZWYLvkr6nRc47Zi45+hFZgw6zUkxKO0dJuCWAigAPms2Thp0Ig6dZO8Cd9jo669Inh55PLfQacJFOhxa0AE45e1mhM5TI29Q/HdOtRwM9CVldcbBeBzCm+eXc4K59bdEtDTieFngH0R+6ueGeJyJt79cNacmsk9ViIrwARjJvAJOU22KOxSFD5sMZ09OLole/Hd4bnE5NCv4xvKcmqTsPyfM5QjNJQsKDuGkQ== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DM5PR12MB1355.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFTY:;SFS:(4636009)(39860400002)(346002)(376002)(136003)(396003)(366004)(45080400002)(478600001)(53546011)(83380400001)(30864003)(26005)(31686004)(2906002)(186003)(19627235002)(16526019)(86362001)(52116002)(5660300002)(2616005)(31696002)(956004)(36756003)(8676002)(966005)(110136005)(316002)(54906003)(16576012)(4326008)(66946007)(66556008)(7416002)(6486002)(8936002)(66476007)(43740500002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: XAX9yfm/IvYPcVIcL2CQmnSYqrmEHvRXBzisOizzDETX5njftA/KXhz6c7hUKalU+LKnC92n+yOMRkLdHAP4sQJUTS76ybLvmDtuhaDjAUEhiiMZuSxxKd2uoIdN1AdJy5PuEt+lRKPzfU+ehjhHNyeGkVZkwx6GGrWBPh58SA9R/2hDCpAEAEI+ZyHs4oQ2a3b/d6VI5oKt+KQ+eZVDUQAKShXvGWVnBrbrni07YLqlOU1/Cyw8MfeuCYfG+R2pjQhEmGNGg+AfJS+e3DIKF2zQla8s1YtGrkIamHD8s1anEi+ZgGqwp2LthlpuwyOUPQhsSw/xH7rld5y9408rRas7Y25rmn8Zj4HuXClVAZMYE3s6LbwS5Qt1wPJrPPDr09W4o7WP08w1bbd4aLe9+hvJZN6k54OYxprO++X9+Rl+xWgppbZy192lgU7q/R/TfKgndWIClhkE1Ey75hqONYHxgJWwt2+cz8Y2LyoDJRsaHOWt8/1qJFXfka4T1avoKVaXBZtyUp6p1S7AyHMMF7xCxslPSst1ove0RI1w3CFF7kqUHd0IgZHg54QkDQsCTrvrDkDTQdfWwbreuVpQea2CuuBhVv2WVEznmY3n7lvWTMW1qlwLtbMGp046LlQyFeyORYakHC82fIu20SoCEw== X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: bf883ee5-28fa-4c25-fd21-08d83e047d2b X-MS-Exchange-CrossTenant-AuthSource: DM5PR12MB1355.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Aug 2020 14:40:27.7409 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: keAbpfhN4SX6sy9RCNRWWJVJZqjvoO3eu95cCUgHxu/O4PN9BiqXumNdxtMhI963d4jMAVL0Jbf5jl2w8EDRyQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB3963 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 8/10/20 8:12 PM, Gao, Liming wrote: > Tom: > I run ECC plugin (https://nam11.safelinks.protection.outlook.com/?url= =3Dhttps%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F63271&data=3D02= %7C01%7Cthomas.lendacky%40amd.com%7Ce7a200ac9bfb47bff77e08d83d93abe6%7C3dd8= 961fe4884e608e11a82d994e183d%7C0%7C0%7C637327052903689176&sdata=3DSMb6I= dJWNnk2NGIMatXRUO1RB7AhdB%2B%2BMJryMiEoL78%3D&reserved=3D0) in my local= machine. It reports below issues. Can you help update the patches to fix t= hem? > I use the standalone EccCheck from https://nam11.safelinks.protection.o= utlook.com/?url=3Dhttps%3A%2F%2Fgithub.com%2Fshenglei10%2Fedk2%2Ftree%2Fecc= _script&data=3D02%7C01%7Cthomas.lendacky%40amd.com%7Ce7a200ac9bfb47bff7= 7e08d83d93abe6%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637327052903689= 176&sdata=3DB1yImgWXGeXG3fs2mo1j3Oe34hhcgXUjRCkvyew1HVw%3D&reserved= =3D0.=20 >=20 > EFI coding style error > *Error code: 8005 > *Variable name does not follow the rules: 1. First character should be = upper case 2. Must contain lower case characters 3. No white space characte= rs 4. Global variable name must start with a 'g' > *file: D:\AllPkg\edk2\OvmfPkg\Sec\SecMain.c > *Line number: 867 > *The variable name [*Ds] does not follow the rules So line 867 of SecMain.c has: UINT8 *Src, *Dst; which appears correct to me, so I believe that is an issue with the tool? > EFI coding style error > *Error code: 9003 > *The first line of text in a comment block should be a brief descriptio= n of the element being documented and the brief description must end with a= period. > *file: D:\AllPkg\edk2\OvmfPkg\Library\BaseMemEncryptSevLib\MemEncryptSe= vLibInternal.c > *Line number: 72 > *Comment description should end with period '.'=20 I'll fix this. > EFI coding style error > *Error code: 3002 > *Non-Boolean comparisons should use a compare operator (=3D=3D, !=3D, >= , < >=3D, <=3D) > *file: D:\AllPkg\edk2\OvmfPkg\Library\VmgExitLib\VmgExitVcHandler.c > *Line number: 1280 > *Predicate Expression: OpCount=20 I'll fix this. > EFI coding style error > *Error code: 5007 > *There should be no initialization of a variable as part of its declara= tion > *file: D:\AllPkg\edk2\OvmfPkg\Library\VmgExitLib\VmgExitVcHandler.c > *Line number: 845 > *Variable Name: Data=20 I'll fix this. > EFI coding style error > *Error code: 5007 > *There should be no initialization of a variable as part of its declara= tion > *file: D:\AllPkg\edk2\OvmfPkg\Library\VmgExitLib\VmgExitVcHandler.c > *Line number: 849 > *Variable Name: Data I'll fix this. I'm trying to run this tool on my Ubuntu installs (both 18.04 and 20.04) and it consistently fails trying to execute a git command: $ python3 BaseTools/Scripts/EccCheck.py=20 usage: git [--version] [--help] [-C ] [-c =3D] [--exec-path[=3D]] [--html-path] [--man-path] [--i= nfo-path] [-p | --paginate | -P | --no-pager] [--no-replace-object= s] [--bare] [--git-dir=3D] [--work-tree=3D] [--namespace= =3D] [] These are common Git commands used in various situations: start a working area (see also: git help tutorial) clone Clone a repository into a new directory init Create an empty Git repository or reinitialize= an existing one work on the current change (see also: git help everyday) add Add file contents to the index=20 mv Move or rename a file, a directory, or a symli= nk restore Restore working tree files=20 rm Remove files from the working tree and from th= e index=20 sparse-checkout Initialize and modify the sparse-checkout examine the history and state (see also: git help revisions) bisect Use binary search to find the commit that intr= oduced a bug=20 diff Show changes between commits, commit and worki= ng tree, etc grep Print lines matching a pattern log Show commit logs show Show various types of objects status Show the working tree status grow, mark and tweak your common history branch List, create, or delete branches commit Record changes to the repository merge Join two or more development histories togethe= r rebase Reapply commits on top of another base tip reset Reset current HEAD to the specified state=20 switch Switch branches tag Create, list, delete or verify a tag object si= gned with GPG collaborate (see also: git help workflows) fetch Download objects and refs from another reposit= ory pull Fetch from and integrate with another reposito= ry or a local branch push Update remote refs along with associated objec= ts 'git help -a' and 'git help -g' list available subcommands and some concept guides. See 'git help ' or 'git help ' to read about a specific subcommand or concept. See 'git help git' for an overview of the system. Fail to run GIT ECC tool detect error I've also tried specifying -1, a commit id, etc., but the same thing happen= s. Has this been run/tested on Ubuntu? Is there something specific that needs to be done in order to run this tool? Thanks, Tom >=20 > Thanks > Liming > -----Original Message----- > From: Laszlo Ersek =20 > Sent: 2020=E5=B9=B48=E6=9C=8811=E6=97=A5 3:36 > To: devel@edk2.groups.io; thomas.lendacky@amd.com > Cc: Brijesh Singh ; Ard Biesheuvel ; Dong, Eric ; Justen, Jordan L ; Gao, Liming ; Kinney, Michael D ; Ni, Ray ; Andrew Fish ; Anthony Perard ; You, Benjamin ; Bi, Dandan ; Dong, Guo ; Wu, Hao A ; Wang, Jian J ; Julien Grall ; Leif Lindholm ; Ma, M= aurice > Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support >=20 > On 08/07/20 21:38, Lendacky, Thomas wrote: >> From: Tom Lendacky >> >> This patch series provides support for running EDK2/OVMF under SEV-ES. >> >> Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on=20 >> the SEV support to protect the guest register state from the=20 >> hypervisor. See >> "AMD64 Architecture Programmer's Manual Volume 2: System Programming",=20 >> section "15.35 Encrypted State (SEV-ES)" [1]. >> >> In order to allow a hypervisor to perform functions on behalf of a=20 >> guest, there is architectural support for notifying a guest's=20 >> operating system when certain types of VMEXITs are about to occur.=20 >> This allows the guest to selectively share information with the=20 >> hypervisor to satisfy the requested function. The notification is=20 >> performed using a new exception, the VMM Communication exception=20 >> (#VC). The information is shared through the Guest-Hypervisor Communicat= ion Block (GHCB) using the VMGEXIT instruction. >> The GHCB format and the protocol for using it is documented in "SEV-ES=20 >> Guest-Hypervisor Communication Block Standardization" [2]. >> >> The main areas of the EDK2 code that are updated to support SEV-ES are=20 >> around the exception handling support and the AP boot support. >> >> Exception support is required starting in Sec, continuing through Pei=20 >> and into Dxe in order to handle #VC exceptions that are generated. =20 >> Each AP requires it's own GHCB page as well as a page to hold values=20 >> specific to that AP. >> >> AP booting poses some interesting challenges. The INIT-SIPI-SIPI=20 >> sequence is typically used to boot the APs. However, the hypervisor is=20 >> not allowed to update the guest registers. The GHCB document [2] talks=20 >> about how SMP booting under SEV-ES is performed. >> >> Since the GHCB page must be a shared (unencrypted) page, the processor=20 >> must be running in long mode in order for the guest and hypervisor to=20 >> communicate with each other. As a result, SEV-ES is only supported=20 >> under the X64 architecture. >> >> This series adds a new library requirement for the VmgExitLib library=20 >> against the UefiCpuPkg CpuExceptionHandlerLib library and the=20 >> UefiCpuPkg MpInitLib library. The edk2-platforms repo requires=20 >> updates/patches to add the new library requirement. To accomodate=20 >> that, this series could be split between: >> >> patch number 10: >> UefiPayloadPkg: Prepare UefiPayloadPkg to use the VmgExitLib library >> >> and patch number 11: >> UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC=20 >> exception >> >> The updates to edk2-platforms can be applied at the split. >> >> [1] https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2F= www.amd.com%2Fsystem%2Ffiles%2FTechDocs%2F24593.pdf&data=3D02%7C01%7Cth= omas.lendacky%40amd.com%7Ce7a200ac9bfb47bff77e08d83d93abe6%7C3dd8961fe4884e= 608e11a82d994e183d%7C0%7C0%7C637327052903689176&sdata=3DlaSNrQUXRN7lLHN= NWKvVSRqJk7VGviYtTTJ%2F%2BqiTQKY%3D&reserved=3D0 >> [2] https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2F= developer.amd.com%2Fwp-content%2Fresources%2F56421.pdf&data=3D02%7C01%7= Cthomas.lendacky%40amd.com%7Ce7a200ac9bfb47bff77e08d83d93abe6%7C3dd8961fe48= 84e608e11a82d994e183d%7C0%7C0%7C637327052903689176&sdata=3DyCRA3fdXO3Mg= g%2BiqgQ3ERY4WUHs3OVmzPA7jL8Tq0wE%3D&reserved=3D0 >> >> --- >> >> These patches are based on commit: >> 9565ab67c209 ("ShellPkg: smbiosview - Change some type 17 field values=20 >> format") >> >> A version of the tree can be found at: >> https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgith= ub.com%2FAMDESE%2Fovmf%2Ftree%2Fsev-es-v22&data=3D02%7C01%7Cthomas.lend= acky%40amd.com%7Ce7a200ac9bfb47bff77e08d83d93abe6%7C3dd8961fe4884e608e11a82= d994e183d%7C0%7C0%7C637327052903689176&sdata=3D5AHBB1tfOdODnXo9XQqbdzzA= Xc3s38%2Bwb2ICZs1dRXg%3D&reserved=3D0 >> >> Cc: Andrew Fish >> Cc: Anthony Perard >> Cc: Ard Biesheuvel >> Cc: Benjamin You >> Cc: Dandan Bi >> Cc: Eric Dong >> Cc: Guo Dong >> Cc: Hao A Wu >> Cc: Jian J Wang >> Cc: Jordan Justen >> Cc: Julien Grall >> Cc: Laszlo Ersek >> Cc: Leif Lindholm >> Cc: Liming Gao >> Cc: Maurice Ma >> Cc: Michael D Kinney >> Cc: Ray Ni >> >> Changes since v13: >> - Fixup the AsmRelocateApLoop() call site so IA32 successfully boots APs= . >> Do this by appending the three new parameters without altering the >> original parameter passing order. >> - Minor updates to description text and help text to expand the GHCB >> acronym. >> >> Changes since v12: >> - Change IA32 VMGEXIT .nasm file to issue an int 3. Depending on the >> version of NASM, the "BITS 64" trick to get NASM to recognize the >> VMMCALL instruction (VMGEXIT is a REP VMMCALL) caused an error. Since >> SEV-ES is X64 only, VMGEXIT should never be called in IA32. >> >> Changes since v11: >> - Make the XGETBV and VMGEXIT .nasm files buildable for all environments >> and remove the updates that add these instructions to GccInline.c >> >> Changes since v10: >> - Fix conflicts around GccInline.c file after moving to latest commit >> - Fix conflicts with OVMF PCD values after moving to latest commit >> >> Changes since v9: >> - Fixed bit field declarations in the GHCB structure to use UINT32 >> and not UINT64. >> - Fixed a warning produced by VS2019 in the instruction parsing code >> by expliciting casting a bit shift to an INT64. >> - Sorted section entries in the OVMF VmgExitLib INF file. >> - Moved the new Maintainers.txt entry so entries remain sorted. >> - Documentation style fixes for return values. >> - Miscellaneous code style fixes. >> >> Changes since v8: >> - Move IOIO exit info definitions into Ghcb.h file >> - Add a macro for calculating IO instruction bytes (IOIO_DATA_BYTES) >> - Exception handler support for debug registers >> - Moved the DRx register saving changes into the UefiCpuPkg patch for >> base #VC support in CpuExceptionHandlerLib. >> - OvmfPkg VmgExitLib >> - Remove the .uni file >> - Update .inf file: >> - New file location for VmgExitVcHandler.c >> - Add additional Packages and LibraryClasses >> - Introduce a header file to hold the #VC instruction parsing related >> definitions >> - Include additional #defines for instruction decoding to replace >> hard coded values for things like instruction prefixes and escapes. >> - Replace hardcoded CPUID values with values from existing header files >> and use existing CR4 definition for accessing CR4 data. >> - Change the type used for obtaining data addresses in the instruction >> parsing >> - Switch from INTN to UINT64 and use compiler conversions and casting >> to perform the correct address calculation >> - ResetVector code: >> - Revert some inadvertant changes introduced in v7 for reserving the >> SEV-ES work area memory and for checking the status of SEV-ES. >> - AP Booting >> - Provide support for non-broadcast INIT-SIPI-SIPI AP boot (minimize >> code duplication by creating a function to set the AP jump table >> vector address). >> - Fix file/directory entry in maintainer changes. >> - Various coding style fixes >> - Commenting, if statements, etc. >> - Various documentation style fixes >> >> Changes since v7: >> - Reserve the SEV-ES workarea when S3 is enabled >> - Fix warnings issued by the Visual Studio compiler >> - Create a NULL VmgExitLib instance that is used for VMGEXIT >> related operations as well as #VC handling. Then create the full >> VmgExitLib support only in OvmfPkg - where it will be used. This >> removes a bunch of implementation code from platforms that will >> not be using the functionality. >> - Remove single use interfaces from the VmgExitLib (VmgMmioWrite >> and VmgSetApJumpTable) >> >> Changes since v6: >> - Add function comments to all functions, including local functions >> - Add function parameter direction to all functions (in/out) >> - Add support for MMIO MOVZX/MOVSX instructions >> - Ensure the per-CPU variable page remains encrypted >> - Coding-style fixes as identified by Ecc >> >> Changes since v5: >> - Remove extraneous VmgExitLib usage >> - Miscellaneous changes to address feedback (coding style, etc.) >> >> Changes since v4: >> - Move the SEV-ES protocol negotiation out of the SEC exception handler >> and into the SecMain.c file. As a result: >> - Move the SecGhcb related PCDs out of UefiCpuPkg and into OvmfPkg >> - Combine SecAMDSevVcHandler.c and PeiDxeAMDSevVcHandler.c into a >> single AMDSevVcHandler.c >> - Consolidate VmgExitLib usage into common LibraryClasses sections >> - Add documentation comments to the VmgExitLib functions >> >> Changes since v3: >> - Remove the need for the MP library finalization routine. The AP >> jump table address will be held by the hypervisor rather than >> communicated via the GHCB MSR. This removes some fragility around >> the UEFI to OS transition. >> - Rename the SEV-ES RIP reset area to SEV-ES workarea and use it to >> communicate the SEV-ES status, so that SEC CPU exception handling is >> only established for an SEV-ES guest. >> - Fix SMM build breakageAdd around QemuFlashPtrWrite(). >> - Fix SMM build breakage by adding VC exception support the SMM CPU >> exception handling. >> - Add memory fencing around the invocation of AsmVmgExit(). >> - Clarify comments around the SEV-ES AP reset RIP values and usage. >> - Move some PCD definitions from MdeModulePkg to UefiCpuPkg. >> - Remove the 16-bit code selector definition from MdeModulePkg >> >> Changes since v2: >> - Added a way to locate the SEV-ES fixed AP RIP address for starting >> AP's to avoid updating the actual flash image (build time location >> that is identified with a GUID value). >> - Create a VmgExit library to replace static inline functions. >> - Move some PCDs to the appropriate packages >> - Add support for writing to QEMU flash under SEV-ES >> - Add additional MMIO opcode support >> - Cleaned up the GHCB MSR CPUID protocol support >> >> Changes since v1: >> - Patches reworked to be more specific to the component/area being updat= ed >> and order of definition/usage >> - Created a library for VMGEXIT-related functions to replace use of inli= ne >> functions >> - Allocation method for GDT changed from AllocatePool to AllocatePages >> - Early caching only enabled for SEV-ES guests >> - Ensure AP loop mode set to halt loop mode for SEV-ES guests >> - Reserved SEC GHCB-related memory areas when S3 is enabled >> >> Tom Lendacky (46): >> MdeModulePkg: Create PCDs to be used in support of SEV-ES >> UefiCpuPkg: Create PCD to be used in support of SEV-ES >> MdePkg: Add the MSR definition for the GHCB register >> MdePkg: Add a structure definition for the GHCB >> MdeModulePkg/DxeIplPeim: Support GHCB pages when creating page tables >> MdePkg/BaseLib: Add support for the XGETBV instruction >> MdePkg/BaseLib: Add support for the VMGEXIT instruction >> UefiCpuPkg: Implement library support for VMGEXIT >> OvmfPkg: Prepare OvmfPkg to use the VmgExitLib library >> UefiPayloadPkg: Prepare UefiPayloadPkg to use the VmgExitLib library >> UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC exception >> OvmfPkg/VmgExitLib: Implement library support for VmgExitLib in OVMF >> OvmfPkg/VmgExitLib: Add support for IOIO_PROT NAE events >> OvmfPkg/VmgExitLib: Support string IO for IOIO_PROT NAE events >> OvmfPkg/VmgExitLib: Add support for CPUID NAE events >> OvmfPkg/VmgExitLib: Add support for MSR_PROT NAE events >> OvmfPkg/VmgExitLib: Add support for NPF NAE events (MMIO) >> OvmfPkg/VmgExitLib: Add support for WBINVD NAE events >> OvmfPkg/VmgExitLib: Add support for RDTSC NAE events >> OvmfPkg/VmgExitLib: Add support for RDPMC NAE events >> OvmfPkg/VmgExitLib: Add support for INVD NAE events >> OvmfPkg/VmgExitLib: Add support for VMMCALL NAE events >> OvmfPkg/VmgExitLib: Add support for RDTSCP NAE events >> OvmfPkg/VmgExitLib: Add support for MONITOR/MONITORX NAE events >> OvmfPkg/VmgExitLib: Add support for MWAIT/MWAITX NAE events >> OvmfPkg/VmgExitLib: Add support for DR7 Read/Write NAE events >> OvmfPkg/MemEncryptSevLib: Add an SEV-ES guest indicator function >> OvmfPkg: Add support to perform SEV-ES initialization >> OvmfPkg: Create a GHCB page for use during Sec phase >> OvmfPkg/PlatformPei: Reserve GHCB-related areas if S3 is supported >> OvmfPkg: Create GHCB pages for use during Pei and Dxe phase >> OvmfPkg/PlatformPei: Move early GDT into ram when SEV-ES is enabled >> UefiCpuPkg: Create an SEV-ES workarea PCD >> OvmfPkg: Reserve a page in memory for the SEV-ES usage >> OvmfPkg/PlatformPei: Reserve SEV-ES work area if S3 is supported >> OvmfPkg/ResetVector: Add support for a 32-bit SEV check >> OvmfPkg/Sec: Add #VC exception handling for Sec phase >> OvmfPkg/Sec: Enable cache early to speed up booting >> OvmfPkg/QemuFlashFvbServicesRuntimeDxe: Bypass flash detection with >> SEV-ES >> UefiCpuPkg: Add a 16-bit protected mode code segment descriptor >> UefiCpuPkg/MpInitLib: Add CPU MP data flag to indicate if SEV-ES is >> enabled >> UefiCpuPkg: Allow AP booting under SEV-ES >> OvmfPkg: Use the SEV-ES work area for the SEV-ES AP reset vector >> OvmfPkg: Move the GHCB allocations into reserved memory >> UefiCpuPkg/MpInitLib: Prepare SEV-ES guest APs for OS use >> Maintainers.txt: Add reviewers for the OvmfPkg SEV-related files >> >> MdeModulePkg/MdeModulePkg.dec | 9 + >> OvmfPkg/OvmfPkg.dec | 9 + >> UefiCpuPkg/UefiCpuPkg.dec | 17 + >> OvmfPkg/OvmfPkgIa32.dsc | 6 + >> OvmfPkg/OvmfPkgIa32X64.dsc | 6 + >> OvmfPkg/OvmfPkgX64.dsc | 6 + >> OvmfPkg/OvmfXen.dsc | 1 + >> UefiCpuPkg/UefiCpuPkg.dsc | 2 + >> UefiPayloadPkg/UefiPayloadPkgIa32.dsc | 2 + >> UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc | 2 + >> OvmfPkg/OvmfPkgX64.fdf | 9 + >> MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf | 2 + >> MdePkg/Library/BaseLib/BaseLib.inf | 4 + >> OvmfPkg/Library/VmgExitLib/VmgExitLib.inf | 36 + >> OvmfPkg/PlatformPei/PlatformPei.inf | 9 + >> .../FvbServicesRuntimeDxe.inf | 2 + >> OvmfPkg/ResetVector/ResetVector.inf | 8 + >> OvmfPkg/Sec/SecMain.inf | 4 + >> .../DxeCpuExceptionHandlerLib.inf | 1 + >> .../PeiCpuExceptionHandlerLib.inf | 1 + >> .../SecPeiCpuExceptionHandlerLib.inf | 1 + >> .../SmmCpuExceptionHandlerLib.inf | 1 + >> .../Xcode5SecPeiCpuExceptionHandlerLib.inf | 1 + >> UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf | 4 + >> UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf | 4 + >> .../Library/VmgExitLibNull/VmgExitLibNull.inf | 27 + >> .../Core/DxeIplPeim/X64/VirtualMemory.h | 12 +- >> MdePkg/Include/Library/BaseLib.h | 31 + >> MdePkg/Include/Register/Amd/Fam17Msr.h | 46 + >> MdePkg/Include/Register/Amd/Ghcb.h | 166 ++ >> .../IndustryStandard/InstructionParsing.h | 83 + >> OvmfPkg/Include/Library/MemEncryptSevLib.h | 12 + >> .../QemuFlash.h | 13 + >> UefiCpuPkg/CpuDxe/CpuGdt.h | 4 +- >> UefiCpuPkg/Include/Library/VmgExitLib.h | 103 + >> UefiCpuPkg/Library/MpInitLib/MpLib.h | 68 +- >> .../Core/DxeIplPeim/Ia32/DxeLoadFunc.c | 4 +- >> .../Core/DxeIplPeim/X64/DxeLoadFunc.c | 11 +- >> .../Core/DxeIplPeim/X64/VirtualMemory.c | 57 +- >> .../MemEncryptSevLibInternal.c | 75 +- >> OvmfPkg/Library/VmgExitLib/VmgExitLib.c | 159 ++ >> OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 1716 +++++++++++++++++ >> OvmfPkg/PlatformPei/AmdSev.c | 89 + >> OvmfPkg/PlatformPei/MemDetect.c | 43 + >> .../QemuFlash.c | 23 +- >> .../QemuFlashDxe.c | 40 + >> .../QemuFlashSmm.c | 16 + >> OvmfPkg/Sec/SecMain.c | 188 +- >> UefiCpuPkg/CpuDxe/CpuGdt.c | 8 +- >> .../CpuExceptionCommon.c | 10 +- >> .../PeiDxeSmmCpuException.c | 20 +- >> .../SecPeiCpuException.c | 19 + >> UefiCpuPkg/Library/MpInitLib/DxeMpLib.c | 120 +- >> UefiCpuPkg/Library/MpInitLib/MpLib.c | 337 +++- >> UefiCpuPkg/Library/MpInitLib/PeiMpLib.c | 19 + >> .../Library/VmgExitLibNull/VmgExitLibNull.c | 121 ++ >> UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 2 +- >> Maintainers.txt | 10 + >> MdeModulePkg/MdeModulePkg.uni | 8 + >> MdePkg/Library/BaseLib/Ia32/VmgExit.nasm | 38 + >> MdePkg/Library/BaseLib/Ia32/XGetBv.nasm | 31 + >> MdePkg/Library/BaseLib/X64/VmgExit.nasm | 32 + >> MdePkg/Library/BaseLib/X64/XGetBv.nasm | 34 + >> OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 100 + >> OvmfPkg/ResetVector/Ia32/PageTables64.asm | 351 +++- >> OvmfPkg/ResetVector/ResetVector.nasmb | 20 + >> .../X64/ExceptionHandlerAsm.nasm | 17 + >> .../X64/Xcode5ExceptionHandlerAsm.nasm | 17 + >> UefiCpuPkg/Library/MpInitLib/Ia32/MpEqu.inc | 2 +- >> .../Library/MpInitLib/Ia32/MpFuncs.nasm | 20 +- >> UefiCpuPkg/Library/MpInitLib/X64/MpEqu.inc | 4 +- >> UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm | 369 +++- >> .../Library/VmgExitLibNull/VmgExitLibNull.uni | 15 + >> .../ResetVector/Vtf0/Ia16/Real16ToFlat32.asm | 9 + >> UefiCpuPkg/UefiCpuPkg.uni | 11 + >> 75 files changed, 4777 insertions(+), 100 deletions(-) create mode=20 >> 100644 OvmfPkg/Library/VmgExitLib/VmgExitLib.inf >> create mode 100644=20 >> UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.inf >> create mode 100644 MdePkg/Include/Register/Amd/Ghcb.h >> create mode 100644=20 >> OvmfPkg/Include/IndustryStandard/InstructionParsing.h >> create mode 100644 UefiCpuPkg/Include/Library/VmgExitLib.h >> create mode 100644 OvmfPkg/Library/VmgExitLib/VmgExitLib.c >> create mode 100644 OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c >> create mode 100644 UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.c >> create mode 100644 MdePkg/Library/BaseLib/Ia32/VmgExit.nasm >> create mode 100644 MdePkg/Library/BaseLib/Ia32/XGetBv.nasm >> create mode 100644 MdePkg/Library/BaseLib/X64/VmgExit.nasm >> create mode 100644 MdePkg/Library/BaseLib/X64/XGetBv.nasm >> create mode 100644 OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm >> create mode 100644=20 >> UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.uni >> >=20 > For all patches except #10 ("UefiPayloadPkg: Prepare UefiPayloadPkg to us= e the VmgExitLib library") and #46 ("Maintainers.txt: Add reviewers for the= OvmfPkg SEV-related files"): >=20 > Regression-tested-by: Laszlo Ersek >=20 > Thanks > Laszlo >=20