public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
* [RFC PATCH 00/28] SEV-ES guest support
@ 2019-08-19 21:35 thomas.lendacky
  2019-08-19 21:35 ` [RFC PATCH 01/28] OvmfPkg/Sec: Enable cache early to speed up booting Lendacky, Thomas
                   ` (28 more replies)
  0 siblings, 29 replies; 46+ messages in thread
From: thomas.lendacky @ 2019-08-19 21:35 UTC (permalink / raw)
  To: devel@edk2.groups.io
  Cc: Jordan Justen, Laszlo Ersek, Ard Biesheuvel, Michael D Kinney,
	Liming Gao, Eric Dong, Ray Ni, Singh, Brijesh

From: Tom Lendacky <thomas.lendacky@amd.com>

This patch series provides support for running EDK2/OVMF under SEV-ES.

Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on the
SEV support to protect the guest register state from the hypervisor. See
"AMD64 Architecture Programmer's Manual Volume 2: System Programming",
section "15.35 Encrypted State (SEV-ES)" [1].

In order to allow a hypervisor to perform functions on behalf of a guest,
there is architectural support for notifying a guest's operating system
when certain types of VMEXITs are about to occur. This allows the guest to
selectively share information with the hypervisor to satisfy the requested
function. The notification is performed using a new exception, the VMM
Communication exception (#VC). The information is shared through the
Guest-Hypervisor Communication Block (GHCB) using the VMGEXIT instruction.
The GHCB format and the protocol for using it is documented in "SEV-ES
Guest-Hypervisor Communication Block Standardization" [2].

The main areas of the EDK2 code that are updated to support SEV-ES are
around the exception handling support and the AP boot support.

Exception support is required starting in Sec, continuing through Pei
and into Dxe in order to handle #VC exceptions that are generated.  Each
AP requires it's own GHCB page as well as a page to hold values specific
to that AP.

AP booting poses some interesting challenges. The INIT-SIPI-SIPI sequence
is typically used to boot the APs. However, the hypervisor is not allowed
to update the guest registers. The GHCB document [2] talks about how SMP
booting under SEV-ES is performed.

Since the GHCB page must be a shared (unencrypted) page, the processor
must be running in long mode in order for the guest and hypervisor to
communicate with each other. As a result, SEV-ES is only supported under
the X64 architecture.

[1] https://www.amd.com/system/files/TechDocs/24593.pdf
[2] https://developer.amd.com/wp-content/resources/56421.pdf
[3] https://github.com/AMDESE/ovmf/tree/sev-es-v6

Tom Lendacky (28):
  OvmfPkg/Sec: Enable cache early to speed up booting
  OvmfPkg/ResetVector: Add support for a 32-bit SEV check
  OvmfPkg/MemEncryptSevLib: Add an SEV-ES guest indicator function
  OvmfPkg: Create a GHCB page for use during Sec phase
  OvmfPkg: Create GHCB pages for use during Pei and Dxe phase
  OvmfPkg: A per-CPU variable area for #VC usage
  OvmfPkg/PlatformPei: Move early GDT into ram when SEV-ES is enabled
  MdePkg/BaseLib: Implement the VMGEXIT support
  UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC exception
  UefiCpuPkg/CpuExceptionHandler: Add base #VC exception handling
    support for Sec phase
  UefiCpuPkg/CpuExceptionHandler: Add support for IOIO_PROT NAE events
  UefiCpuPkg/CpuExceptionHandler: Support string IO for IOIO_PROT NAE
    events
  UefiCpuPkg/CpuExceptionHandler: Add support for CPUID NAE events
  UefiCpuPkg/CpuExceptionHandler: Add support for MSR_PROT NAE events
  UefiCpuPkg/CpuExceptionHandler: Add support for NPF NAE events (MMIO)
  UefiCpuPkg/CpuExceptionHandler: Add support for WBINVD NAE events
  UefiCpuPkg/CpuExceptionHandler: Add support for RDTSC NAE events
  UefiCpuPkg/CpuExceptionHandler: Add support for RDPMC NAE events
  UefiCpuPkg/CpuExceptionHandler: Add support for INVD NAE events
  UefiCpuPkg/CpuExceptionHandler: Add support for VMMCALL NAE events
  UefiCpuPkg/CpuExceptionHandler: Add support for RDTSCP NAE events
  UefiCpuPkg/CpuExceptionHandler: Add support for MONITOR/MONITORX NAE
    events
  UefiCpuPkg/CpuExceptionHandler: Add support for MWAIT/MWAITX NAE
    events
  UefiCpuPkg/CpuExceptionHandler: Add support for DR7 Read/Write NAE
    events
  UefiCpuPkg/CpuExceptionHandler: Add base #VC exception handling
    support for Pei/Dxe phases
  UefiCpuPkg/MpInitLib: Update CPU MP data with a flag to indicate if
    SEV-ES is active
  UefiCpuPkg/MpInitLib: Allow AP booting under SEV-ES
  UefiCpuPkg/MpInitLib: Introduce an MP finalization routine to support
    SEV-ES

 OvmfPkg/OvmfPkg.dec                           |    5 +
 UefiCpuPkg/UefiCpuPkg.dec                     |    7 +
 OvmfPkg/OvmfPkgIa32.dsc                       |    1 +
 OvmfPkg/OvmfPkgIa32X64.dsc                    |    1 +
 OvmfPkg/OvmfPkgX64.dsc                        |    6 +
 OvmfPkg/OvmfPkgX64.fdf                        |    9 +-
 MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf       |    3 +
 MdePkg/Library/BaseLib/BaseLib.inf            |    2 +
 OvmfPkg/PlatformPei/PlatformPei.inf           |    5 +
 OvmfPkg/ResetVector/ResetVector.inf           |    4 +
 OvmfPkg/Sec/SecMain.inf                       |    1 +
 .../DxeCpuExceptionHandlerLib.inf             |    4 +
 .../PeiCpuExceptionHandlerLib.inf             |    4 +
 .../SecPeiCpuExceptionHandlerLib.inf          |    4 +
 UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf |    4 +-
 UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf |    2 +
 .../Core/DxeIplPeim/X64/VirtualMemory.h       |   12 +-
 MdePkg/Include/Library/BaseLib.h              |   30 +
 MdePkg/Include/Protocol/Cpu.h                 |    6 +
 OvmfPkg/Include/Library/MemEncryptSevLib.h    |   12 +
 UefiCpuPkg/CpuDxe/CpuDxe.h                    |   14 +
 UefiCpuPkg/CpuDxe/CpuGdt.h                    |    2 +-
 UefiCpuPkg/Include/Library/MpInitLib.h        |   17 +
 UefiCpuPkg/Include/Register/Amd/Fam17Msr.h    |   28 +
 UefiCpuPkg/Include/Register/Amd/Ghcb.h        |  197 +++
 .../CpuExceptionHandlerLib/AMDSevVcCommon.h   |   19 +
 .../CpuExceptionCommon.h                      |    2 +
 UefiCpuPkg/Library/MpInitLib/MpLib.h          |   73 +-
 MdeModulePkg/Core/Dxe/DxeMain/DxeMain.c       |    5 +
 .../Core/DxeIplPeim/Ia32/DxeLoadFunc.c        |    6 +-
 .../Core/DxeIplPeim/X64/DxeLoadFunc.c         |   11 +-
 .../Core/DxeIplPeim/X64/VirtualMemory.c       |   49 +-
 MdePkg/Library/BaseLib/Ia32/GccInline.c       |   17 +
 MdePkg/Library/BaseLib/X64/GccInline.c        |   45 +
 .../MemEncryptSevLibInternal.c                |   78 +-
 .../BaseMemEncryptSevLib/X64/VirtualMemory.c  |   33 +-
 OvmfPkg/PlatformPei/AmdSev.c                  |   83 ++
 OvmfPkg/Sec/SecMain.c                         |   34 +-
 UefiCpuPkg/CpuDxe/CpuDxe.c                    |   10 +
 UefiCpuPkg/CpuDxe/CpuGdt.c                    |   10 +-
 .../CpuExceptionCommon.c                      |    2 +-
 .../Ia32/AMDSevVcCommon.c                     |   13 +
 .../PeiDxeAMDSevVcHandler.c                   |   22 +
 .../PeiDxeSmmCpuException.c                   |   16 +
 .../SecAMDSevVcHandler.c                      |   45 +
 .../SecPeiCpuException.c                      |   16 +
 .../X64/AMDSevVcCommon.c                      | 1192 +++++++++++++++++
 UefiCpuPkg/Library/MpInitLib/DxeMpLib.c       |  124 +-
 UefiCpuPkg/Library/MpInitLib/MpLib.c          |  255 +++-
 UefiCpuPkg/Library/MpInitLib/PeiMpLib.c       |   16 +
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c  |    2 +-
 MdePkg/Library/BaseLib/X64/VmgExit.nasm       |   38 +
 MdePkg/Library/BaseLib/X64/XGetBv.nasm        |   39 +
 OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm  |   85 ++
 OvmfPkg/ResetVector/Ia32/PageTables64.asm     |  210 ++-
 OvmfPkg/ResetVector/ResetVector.nasmb         |    3 +-
 .../X64/ExceptionHandlerAsm.nasm              |   15 +
 UefiCpuPkg/Library/MpInitLib/Ia32/MpEqu.inc   |    4 +-
 .../Library/MpInitLib/Ia32/MpFuncs.nasm       |   15 +
 UefiCpuPkg/Library/MpInitLib/X64/MpEqu.inc    |    4 +-
 UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm |  367 ++++-
 .../ResetVector/Vtf0/Ia16/Real16ToFlat32.asm  |    9 +
 62 files changed, 3239 insertions(+), 108 deletions(-)
 create mode 100644 UefiCpuPkg/Include/Register/Amd/Ghcb.h
 create mode 100644 UefiCpuPkg/Library/CpuExceptionHandlerLib/AMDSevVcCommon.h
 create mode 100644 UefiCpuPkg/Library/CpuExceptionHandlerLib/Ia32/AMDSevVcCommon.c
 create mode 100644 UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiDxeAMDSevVcHandler.c
 create mode 100644 UefiCpuPkg/Library/CpuExceptionHandlerLib/SecAMDSevVcHandler.c
 create mode 100644 UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/AMDSevVcCommon.c
 create mode 100644 MdePkg/Library/BaseLib/X64/VmgExit.nasm
 create mode 100644 MdePkg/Library/BaseLib/X64/XGetBv.nasm
 create mode 100644 OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm

-- 
2.17.1


^ permalink raw reply	[flat|nested] 46+ messages in thread

end of thread, other threads:[~2019-08-23 13:32 UTC | newest]

Thread overview: 46+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-08-19 21:35 [RFC PATCH 00/28] SEV-ES guest support thomas.lendacky
2019-08-19 21:35 ` [RFC PATCH 01/28] OvmfPkg/Sec: Enable cache early to speed up booting Lendacky, Thomas
2019-08-21 14:21   ` [edk2-devel] " Laszlo Ersek
2019-08-21 21:25     ` Lendacky, Thomas
2019-08-21 21:51     ` Jordan Justen
2019-08-22 13:46       ` Laszlo Ersek
2019-08-22 20:44         ` Jordan Justen
2019-08-23 13:32           ` Laszlo Ersek
2019-08-19 21:35 ` [RFC PATCH 02/28] OvmfPkg/ResetVector: Add support for a 32-bit SEV check Lendacky, Thomas
2019-08-19 21:35 ` [RFC PATCH 03/28] OvmfPkg/MemEncryptSevLib: Add an SEV-ES guest indicator function Lendacky, Thomas
2019-08-19 21:35 ` [RFC PATCH 04/28] OvmfPkg: Create a GHCB page for use during Sec phase Lendacky, Thomas
2019-08-21 14:25   ` [edk2-devel] " Laszlo Ersek
2019-08-21 21:29     ` Lendacky, Thomas
2019-08-19 21:35 ` [RFC PATCH 05/28] OvmfPkg: Create GHCB pages for use during Pei and Dxe phase Lendacky, Thomas
2019-08-21 14:31   ` [edk2-devel] " Laszlo Ersek
2019-08-21 21:42     ` Lendacky, Thomas
2019-08-22 14:12       ` Laszlo Ersek
2019-08-22 15:24         ` Lendacky, Thomas
2019-08-23 13:26           ` Laszlo Ersek
2019-08-19 21:35 ` [RFC PATCH 06/28] OvmfPkg: A per-CPU variable area for #VC usage Lendacky, Thomas
2019-08-19 21:35 ` [RFC PATCH 07/28] OvmfPkg/PlatformPei: Move early GDT into ram when SEV-ES is enabled Lendacky, Thomas
2019-08-21 15:44   ` [edk2-devel] " Laszlo Ersek
2019-08-19 21:35 ` [RFC PATCH 08/28] MdePkg/BaseLib: Implement the VMGEXIT support Lendacky, Thomas
2019-08-19 21:47   ` Ni, Ray
2019-08-19 22:25     ` Lendacky, Thomas
2019-08-19 21:35 ` [RFC PATCH 09/28] UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC exception Lendacky, Thomas
2019-08-19 21:35 ` [RFC PATCH 10/28] UefiCpuPkg/CpuExceptionHandler: Add base #VC exception handling support for Sec phase Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 11/28] UefiCpuPkg/CpuExceptionHandler: Add support for IOIO_PROT NAE events Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 12/28] UefiCpuPkg/CpuExceptionHandler: Support string IO " Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 13/28] UefiCpuPkg/CpuExceptionHandler: Add support for CPUID " Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 14/28] UefiCpuPkg/CpuExceptionHandler: Add support for MSR_PROT " Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 15/28] UefiCpuPkg/CpuExceptionHandler: Add support for NPF NAE events (MMIO) Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 16/28] UefiCpuPkg/CpuExceptionHandler: Add support for WBINVD NAE events Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 17/28] UefiCpuPkg/CpuExceptionHandler: Add support for RDTSC " Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 18/28] UefiCpuPkg/CpuExceptionHandler: Add support for RDPMC " Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 19/28] UefiCpuPkg/CpuExceptionHandler: Add support for INVD " Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 20/28] UefiCpuPkg/CpuExceptionHandler: Add support for VMMCALL " Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 21/28] UefiCpuPkg/CpuExceptionHandler: Add support for RDTSCP " Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 22/28] UefiCpuPkg/CpuExceptionHandler: Add support for MONITOR/MONITORX " Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 23/28] UefiCpuPkg/CpuExceptionHandler: Add support for MWAIT/MWAITX " Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 24/28] UefiCpuPkg/CpuExceptionHandler: Add support for DR7 Read/Write " Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 25/28] UefiCpuPkg/CpuExceptionHandler: Add base #VC exception handling support for Pei/Dxe phases Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 26/28] UefiCpuPkg/MpInitLib: Update CPU MP data with a flag to indicate if SEV-ES is active Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 27/28] UefiCpuPkg/MpInitLib: Allow AP booting under SEV-ES Lendacky, Thomas
2019-08-19 21:36 ` [RFC PATCH 28/28] UefiCpuPkg/MpInitLib: Introduce an MP finalization routine to support SEV-ES Lendacky, Thomas
2019-08-21 14:17 ` [edk2-devel] [RFC PATCH 00/28] SEV-ES guest support Laszlo Ersek

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox