From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by mx.groups.io with SMTP id smtpd.web09.15817.1605140058791359393 for ; Wed, 11 Nov 2020 16:14:18 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@ibm.com header.s=pp1 header.b=hn9KK09y; spf=pass (domain: linux.ibm.com, ip: 148.163.156.1, mailfrom: jejb@linux.ibm.com) Received: from pps.filterd (m0098393.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 0AC039iV013517; Wed, 11 Nov 2020 19:14:16 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=n3QDIHUwPMPV9riMy8tPhUTuz+Dg73Mwga0sxtWKPF0=; b=hn9KK09yXhwTEz3YEwp65a0N7Ybjmrjhm78RPw5ZzSQeQRFg7F6rSfO5J/T3aLXf/lif LFZWsmUaFgZh47u9uyFshcgdEfDoivmmK6PvYEOlbfym06r6ImNIz2k+PaQDEVXh9T/Y V5SPJujKB+m+JO9u6+jW1cYgrkBf3nwnhWF/bAy6cLPRm2Ydg1mENSRlkLum/gwlhZ+U B3R7wDR2LPMzVp/EsvDI6cCPXD+vIcgdq5skKlJX5eelKPuqrWSn6b5+qYUxPEMCj3u2 g92+ZYOapWPkQpQhb3/LWt7xceICmfVygluX7DTJ5kFo785sPmJ3LxZKSsZxBezu1FFm zw== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 34rcxf85t2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 11 Nov 2020 19:14:16 -0500 Received: from m0098393.ppops.net (m0098393.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 0AC037dx013316; Wed, 11 Nov 2020 19:14:16 -0500 Received: from ppma04dal.us.ibm.com (7a.29.35a9.ip4.static.sl-reverse.com [169.53.41.122]) by mx0a-001b2d01.pphosted.com with ESMTP id 34rcxf85sx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 11 Nov 2020 19:14:16 -0500 Received: from pps.filterd (ppma04dal.us.ibm.com [127.0.0.1]) by ppma04dal.us.ibm.com (8.16.0.42/8.16.0.42) with SMTP id 0AC087fx009841; Thu, 12 Nov 2020 00:14:15 GMT Received: from b03cxnp07028.gho.boulder.ibm.com (b03cxnp07028.gho.boulder.ibm.com [9.17.130.15]) by ppma04dal.us.ibm.com with ESMTP id 34nk7aerv1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 12 Nov 2020 00:14:15 +0000 Received: from b03ledav004.gho.boulder.ibm.com (b03ledav004.gho.boulder.ibm.com [9.17.130.235]) by b03cxnp07028.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 0AC0EBOf50069858 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 12 Nov 2020 00:14:11 GMT Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9D7F27805E; Thu, 12 Nov 2020 00:14:11 +0000 (GMT) Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 685CC7805C; Thu, 12 Nov 2020 00:14:09 +0000 (GMT) Received: from jarvis.int.hansenpartnership.com (unknown [9.85.162.106]) by b03ledav004.gho.boulder.ibm.com (Postfix) with ESMTP; Thu, 12 Nov 2020 00:14:09 +0000 (GMT) From: James Bottomley To: devel@edk2.groups.io Cc: dovmurik@linux.vnet.ibm.com, Dov.Murik1@il.ibm.com, ashish.kalra@amd.com, brijesh.singh@amd.com, tobin@ibm.com, david.kaplan@amd.com, jon.grimm@amd.com, thomas.lendacky@amd.com, jejb@linux.ibm.com, frankeh@us.ibm.com, "Dr . David Alan Gilbert" Subject: [PATCH 3/4] OvmfPkg: create a SEV secret area in the AmdSev memfd Date: Wed, 11 Nov 2020 16:13:15 -0800 Message-Id: <20201112001316.11341-4-jejb@linux.ibm.com> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20201112001316.11341-1-jejb@linux.ibm.com> References: <20201112001316.11341-1-jejb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.312,18.0.737 definitions=2020-11-11_12:2020-11-10,2020-11-11 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=1 clxscore=1015 impostorscore=0 spamscore=0 bulkscore=0 priorityscore=1501 mlxlogscore=857 lowpriorityscore=0 phishscore=0 mlxscore=0 adultscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000 definitions=main-2011110139 Content-Transfer-Encoding: quoted-printable SEV needs an area to place an injected secret where OVMF can find it and pass it up as a ConfigurationTable. This patch implements the area itself as an addition to the SEV enhanced reset vector. The reset vector scheme allows additions but not removals. If the size of the reset vector is 22, it only contains the AP reset IP, but if it is 30 (or greater) it contains the SEV secret page location and size. Signed-off-by: James Bottomley --- OvmfPkg/OvmfPkg.dec | 5 +++++ OvmfPkg/AmdSev/AmdSevX64.fdf | 3 +++ OvmfPkg/ResetVector/ResetVector.inf | 4 ++++ OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 4 ++++ OvmfPkg/ResetVector/ResetVector.nasmb | 2 ++ 5 files changed, 18 insertions(+) diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index 3fbf7a0ee1..b00f083417 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -117,6 +117,7 @@ gLinuxEfiInitrdMediaGuid =3D {0x5568e427, 0x68fc, 0x4f3d, {= 0xac, 0x74, 0xca, 0x55, 0x52, 0x31, 0xcc, 0x68}}=0D gQemuKernelLoaderFsMediaGuid =3D {0x1428f772, 0xb64a, 0x441e, {= 0xb8, 0xc3, 0x9e, 0xbd, 0xd7, 0xf8, 0x93, 0xc7}}=0D gGrubFileGuid =3D {0xb5ae312c, 0xbc8a, 0x43b1, {= 0x9c, 0x62, 0xeb, 0xb8, 0x26, 0xdd, 0x5d, 0x07}}=0D + gSevLaunchSecretGuid =3D {0xadf956ad, 0xe98c, 0x484c, {= 0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47}}=0D =0D [Ppis]=0D # PPI whose presence in the PPI database signals that the TPM base addre= ss=0D @@ -304,6 +305,10 @@ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBase|0|UINT32|0x40=0D gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbSize|0|UINT32|0x41=0D =0D + ## The base address and size of the SEV Launch Secret Area=0D + gSevLaunchSecretGuid.PcdSevLaunchSecretBase|0x0|UINT32|0=0D + gSevLaunchSecretGuid.PcdSevLaunchSecretSize|0x0|UINT32|1=0D +=0D [PcdsDynamic, PcdsDynamicEx]=0D gUefiOvmfPkgTokenSpaceGuid.PcdEmuVariableEvent|0|UINT64|2=0D gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFlashVariablesEnable|FALSE|BOOLEAN|0x1= 0=0D diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf index 689386612d..1fd38b3fe2 100644 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf @@ -59,6 +59,9 @@ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBase|gUefiOvmfPk= gTokenSpaceGuid.PcdOvmf 0x00B000|0x001000=0D gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase|gUefiCpuPkgTokenSpaceGuid.P= cdSevEsWorkAreaSize=0D =0D +0x00C000|0x001000=0D +gSevLaunchSecretGuid.PcdSevLaunchSecretBase|gSevLaunchSecretGuid.PcdSevLau= nchSecretSize=0D +=0D 0x010000|0x010000=0D gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase|gUefiOvmfPkgTokenSpace= Guid.PcdOvmfSecPeiTempRamSize=0D =0D diff --git a/OvmfPkg/ResetVector/ResetVector.inf b/OvmfPkg/ResetVector/Rese= tVector.inf index a53ae6c194..72fd78eef4 100644 --- a/OvmfPkg/ResetVector/ResetVector.inf +++ b/OvmfPkg/ResetVector/ResetVector.inf @@ -43,3 +43,7 @@ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesSize=0D gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase=0D gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamSize=0D +=0D +[FixedPcd]=0D + gSevLaunchSecretGuid.PcdSevLaunchSecretBase=0D + gSevLaunchSecretGuid.PcdSevLaunchSecretSize=0D diff --git a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm b/OvmfPkg/ResetVe= ctor/Ia16/ResetVectorVtf0.asm index 980e0138e7..7d3214e55d 100644 --- a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm +++ b/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm @@ -35,6 +35,8 @@ ALIGN 16 ; the build time RIP value. The GUID must always be 48 bytes from the=0D ; end of the firmware.=0D ;=0D +; 0xffffffc2 (-0x3e) - Base Location of the SEV Launch Secret=0D +; 0xffffffc6 (-0x3a) - Size of SEV Launch Secret=0D ; 0xffffffca (-0x36) - IP value=0D ; 0xffffffcc (-0x34) - CS segment base [31:16]=0D ; 0xffffffce (-0x32) - Size of the SEV-ES reset block=0D @@ -51,6 +53,8 @@ ALIGN 16 TIMES (32 - (sevEsResetBlockEnd - sevEsResetBlockStart)) DB 0=0D =0D sevEsResetBlockStart:=0D + DD SEV_LAUNCH_SECRET_BASE=0D + DD SEV_LAUNCH_SECRET_SIZE=0D DD SEV_ES_AP_RESET_IP=0D DW sevEsResetBlockEnd - sevEsResetBlockStart=0D DB 0xDE, 0x71, 0xF7, 0x00, 0x7E, 0x1A, 0xCB, 0x4F=0D diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb b/OvmfPkg/ResetVector/Re= setVector.nasmb index 4913b379a9..c5e0fe93ab 100644 --- a/OvmfPkg/ResetVector/ResetVector.nasmb +++ b/OvmfPkg/ResetVector/ResetVector.nasmb @@ -83,5 +83,7 @@ %include "Main.asm"=0D =0D %define SEV_ES_AP_RESET_IP FixedPcdGet32 (PcdSevEsWorkAreaBase)=0D + %define SEV_LAUNCH_SECRET_BASE FixedPcdGet32 (PcdSevLaunchSecretBase)=0D + %define SEV_LAUNCH_SECRET_SIZE FixedPcdGet32 (PcdSevLaunchSecretSize)=0D %include "Ia16/ResetVectorVtf0.asm"=0D =0D --=20 2.26.2