From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (NAM11-CO1-obe.outbound.protection.outlook.com []) by mx.groups.io with SMTP id smtpd.web12.25.1616599950939575559 for ; Wed, 24 Mar 2021 08:32:31 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@amd.com header.s=selector1 header.b=ZRPx5QFF; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: , mailfrom: brijesh.singh@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mkBybhhoEFPE0R2CJEj614P9OIq//S+KGDkdpoKadzQ0LLgsO44ATAosZsbfEtImiB70QbhvgQGGZ4JE+frRVhSCSagM6k3SFCNs5Ttx14Of7GL8hnovIhJebEsZqsCn+h4Ont5A/vWFAQXRl0PlCaTAxUIHEgPjCgPQoWDp+TDQNIuDvoCVPSqoyJOntmYndw0VVo/nQIVKLxCfPyaWOCmYdGEBGmwQ9L40zeldOj6vdrBjpsPu+xrPNDpucw4teoWqvsDwjK3pC5HH4TcW2GadE/utqYRgDGveYczTpm/2VRDBXCcqqwIfpyfHYONuoCHVn0e4CKWzG8+1Csd/dg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9sJMnLquLBpuV5DkD/ETuSiPDI2ZOt6f7mk8NIyM0bY=; b=VRv/RyzylkTy6+oY46tPb/G3jZmG8bTAn+lJiNvU13zI+25358NqOia7WfC8Ft81q9YO5vNgWH2A8rzLqSWXUsEY/THkrHKPTAuh4Dytz+U5bL6tmJbxHvbH3PaFgzGiehU/ksHmg4GkRY3dRxWbcKBRwvqt2fXuwItCPRxPqjoNMOOFNAj4zYFLC8haZdFI8JYbqhBUuJLz8go7Wtu9TntrM7GPNp/q6qZdTXfcaHV/50oiwB3brPMthwTISSHgba/yb4PqnXZE5ckRtbyfnFAFZzg93Z3EFOAma4QisBYxX3tGw6Bb2zpJlSJuHx7OhjggYl6Kk0hHVkIrOE75Vw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9sJMnLquLBpuV5DkD/ETuSiPDI2ZOt6f7mk8NIyM0bY=; b=ZRPx5QFFJ3qN1dJKy3zf7w9dOffw/hIKuEEDT/TlB/IchKnzC6nVYJ4u7jDJJGWWloujuPotIFaO02Gl1eI/VuDm7NU1LMUqxRwHLX/HYCP8nsc+O81gcsemVG3G2c/lijwJbsPBPkSB6AM3YWW3SVGod5SNfwKPnppcGw5HTys= Authentication-Results: edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SN1PR12MB2541.namprd12.prod.outlook.com (2603:10b6:802:24::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3955.18; Wed, 24 Mar 2021 15:32:29 +0000 Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::30fb:2d6c:a0bf:2f1d]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::30fb:2d6c:a0bf:2f1d%3]) with mapi id 15.20.3955.027; Wed, 24 Mar 2021 15:32:29 +0000 From: "Brijesh Singh" To: devel@edk2.groups.io Cc: Brijesh Singh , James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Laszlo Ersek Subject: [RFC PATCH 01/19] OvmfPkg: Reserve the Secrets and Cpuid page for the SEV-SNP guest Date: Wed, 24 Mar 2021 10:31:57 -0500 Message-Id: <20210324153215.17971-2-brijesh.singh@amd.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210324153215.17971-1-brijesh.singh@amd.com> References: <20210324153215.17971-1-brijesh.singh@amd.com> X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: SA9PR11CA0006.namprd11.prod.outlook.com (2603:10b6:806:6e::11) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) Return-Path: brijesh.singh@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SA9PR11CA0006.namprd11.prod.outlook.com (2603:10b6:806:6e::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3955.18 via Frontend Transport; Wed, 24 Mar 2021 15:32:28 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: d962e520-efa2-4ca0-e44c-08d8eeda08cc X-MS-TrafficTypeDiagnostic: SN1PR12MB2541: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:3968; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: XeNTq9rvk6u9o5EUYJ+FJFyw9XkRchFxxavhpy8duCIeiPwea5sZd4D9CzgOx9xvhWxeQ3x718S5N9nQc3xv40x+XFktx9KUrxjwfBr+gFBFZde06D40uC3UNO8le3ODFp+b+NHx+M2xRTcDaS33ShF73q/sZjRf/8We68AWMBYE4XwFA3OIhMknXSgb9v0TszSCSuzUYw0xXj+OflA3FlRv9QG4fg4I3MejfHXft/qaUBfBJ876gvvxgn8cpdFooXDwBQXF4K3cSJh4QtQWDWlzGG8V19WLTG/ZDk1wMPOSsqJviaSwyXGvhxwUPSOBJBZM8ZcnqMYbFz6I6ui5fzSEEAqC78RhhHze96aELS/3Dp6Qe8SBqSpE8WtI5Qa4ESyeBaFSR60PaAhZ5T0nxwXGIYel3ZObBZjdUHMjEBfPzjSEj68/bBjAb6MVLX2HCXbthlZGtnmT4XLS4J+QhU93mCcUFy0TNKII4CfTUZUBtfHJTGv5vbpZA7ue2/OIKnF2SUhb8wqIFLZ5aRFqVn4qWs9rGZQIa3TVew2QSjGO7XigN44WFNw9ZjXGnCkhxhP2F/Mpyxf5cL/E/xhyoqBqx+fUn8meJJ5vznYWbAQlnCJV5JJ386tXuwWPpLuu6ey/1oYfNyjG550YbTlJaRUWQBc+uP0IyDSgVqf0bnzeGJ9Bu+rrI8XW/21vqjILkV5j37v1ypaf9A5tAiqByKv1TZ4nDxKtYKeT/qP8u4a4xEvYJ4ELbJMMGba4Rm64 X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2718.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(136003)(376002)(396003)(39860400002)(346002)(36756003)(8676002)(316002)(52116002)(54906003)(7696005)(5660300002)(1076003)(66946007)(6916009)(8936002)(83380400001)(2906002)(86362001)(6666004)(6486002)(38100700001)(26005)(66556008)(478600001)(956004)(66476007)(2616005)(966005)(19627235002)(4326008)(44832011)(186003)(16526019);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: =?us-ascii?Q?776GZlXGiqT55KV9OMF5P2v9KUeBrP9Wd46EQpXcDnSwHte05BQ917qtR7eT?= =?us-ascii?Q?ntYl03bzPbghCHc0SwUY04R4XNAvd918AJCWgg61iLNR1YR4tzuiUvDOx5HH?= =?us-ascii?Q?wueXWZgMzbVSMWz1IX71w5PS5OceEg5Wc76f9mJHtNH/DMd/iPJodm68MHVH?= =?us-ascii?Q?oL6uEGDZ2MVTmkxdFBJnneixYhhx/PWprwWaJRR9KHFPHNShCmb4sw2kV4BW?= =?us-ascii?Q?m+Mgf52+x4pL6Bf+/e2R/uSfkTNOGmMygTuCc6JSNvzq0nY1u3oH0vIRApT9?= =?us-ascii?Q?ajURM8s89djN245Wzn4B4vr5GC7D8o3wVZsg3/7s1Ol3lnRTXOJbWu8i/0Mr?= =?us-ascii?Q?d+SBN+kzwrFi4Pj1k/xCtEDWh8Fe/Utnn2TxFr7Vve72C2Y0NOLO7/g2wbNF?= =?us-ascii?Q?cuLctbX2LdSMamnSOna1y0BlOoJR8jJvS3h2LM9HfjA4xyDpVK7Wlb2CvfWE?= =?us-ascii?Q?RuQxoAKbQByhHAF/EHlty2Yvbu8omvRXQCxMfw7f9hACNC/yx91UsQuKbFYh?= =?us-ascii?Q?ITrhYbN0DLX0sgksdBeAtUgawhCsR0jmX6F0U2nBQJUBEWZ0QUFNgJzc9PJB?= =?us-ascii?Q?Q6B2ZwdHLgvlTrm6gY3YChQ9XpbrszgmaCKrQHlx78sDwIMyJPOU6QdIg60Y?= =?us-ascii?Q?4Atbq57PDDb4fG1/6tFyyxFhQIx1akjKLXRrfvSxHj8Eyidmd3mSwL0kXpzs?= =?us-ascii?Q?GAF0LgfnB8RmBZ4T0zTlueKe/p7n0gywshMl1CpwY2imew+g33QAcopWeihR?= =?us-ascii?Q?uAWDHrRZ4yE1a4pn2cpieie1zbh4JApsrSlSq2YyJWpDJt/J+KOUjbnI3CP9?= =?us-ascii?Q?yOBEbhpZQ0hla6z3SatqUg6OpT+9C0WYQbC7BZKM995+uqU8CJc3g3vgiTYt?= =?us-ascii?Q?pgCi4Ms3akU55iVyG6U+IeekJJHqhd86mWKQpg+ZwndfsTuVyrNZWhBDfKNk?= =?us-ascii?Q?ULiPMQlj9xDLv7qI2tkkR5UolAZi7fZQ0OZbIPwEpPbJAHUaIdW7WGP72q/T?= =?us-ascii?Q?EDSR3RqLHONUtUgiD1pDpJw1xw5kwyGi36PGUvrH4u+iVL9Ob56Lsr7+9YGX?= =?us-ascii?Q?a7G0EHy/cnbb8GbqcOM3psxoyN6EgPssxxJu5JkD78sH7SzB/7SreilGvzNa?= =?us-ascii?Q?yJDZTE9A/apctAXIIETQpm3WfCar9yptl1pbue2hhKMoQ5i1kSQxxaHBwWum?= =?us-ascii?Q?EcP6wtQEByrg9pNnR2bi1CreErWcxFSXG5LrQp0vEadFHihiEEaFcXhfXtnq?= =?us-ascii?Q?1chmCHX1gWzCfIh/jJGQx1hbfN+haelrMnCPq7E2pOiNlzsBv4QgoGMjY7HK?= =?us-ascii?Q?KxCuigGaAkYm4ZCr7LeLzbPU?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: d962e520-efa2-4ca0-e44c-08d8eeda08cc X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Mar 2021 15:32:29.2980 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: awSUd+A50QRFzZqtttXdN0X84ZZaDSfTnskhRVQ9aS9M0ArU2+cYhdC/SVBdzCef3EGi3JOi7yd/OiTfaFJnjQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB2541 Content-Type: text/plain BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3275 During the SEV-SNP guest launch sequence, two special pages need to be inserted, the secrets page and cpuid page. The secrets page, contain the VM platform communication keys. The guest BIOS and OS can use this key to communicate with the SEV firmware to get the attestation report. The Cpuid page, contain the CPUIDs entries filtered through the AMD-SEV firmware. The VMM will locate the secrets and cpuid page addresses through a fixed GUID and pass them to SEV firmware to populate further. For more information about the page content, see the SEV-SNP spec. To simplify the pre-validation range calculation in the next patch, the CPUID and Secrets pages are moved to the start of the MEMFD_BASE_ADDRESS. Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Laszlo Ersek Signed-off-by: Brijesh Singh --- OvmfPkg/OvmfPkg.dec | 8 +++++++ OvmfPkg/OvmfPkgX64.fdf | 24 ++++++++++++-------- OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 19 ++++++++++++++++ OvmfPkg/ResetVector/ResetVector.inf | 4 ++++ OvmfPkg/ResetVector/ResetVector.nasmb | 2 ++ 5 files changed, 48 insertions(+), 9 deletions(-) diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index 4348bb45c6..062926772d 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -317,6 +317,14 @@ gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretBase|0x0|UINT32|0x42 gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretSize|0x0|UINT32|0x43 + ## The base address of the CPUID page used by SEV-SNP + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase|0|UINT32|0x48 + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize|0|UINT32|0x49 + + ## The base address of the Secrets page used by SEV-SNP + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase|0|UINT32|0x50 + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize|0|UINT32|0x51 + [PcdsDynamic, PcdsDynamicEx] gUefiOvmfPkgTokenSpaceGuid.PcdEmuVariableEvent|0|UINT64|2 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFlashVariablesEnable|FALSE|BOOLEAN|0x10 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf index d519f85328..ea214600be 100644 --- a/OvmfPkg/OvmfPkgX64.fdf +++ b/OvmfPkg/OvmfPkgX64.fdf @@ -67,27 +67,33 @@ ErasePolarity = 1 BlockSize = 0x10000 NumBlocks = 0xD0 -0x000000|0x006000 +0x000000|0x001000 +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize + +0x001000|0x001000 +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize + +0x002000|0x006000 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesSize -0x006000|0x001000 +0x008000|0x001000 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfLockBoxStorageBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfLockBoxStorageSize -0x007000|0x001000 +0x009000|0x001000 gEfiMdePkgTokenSpaceGuid.PcdGuidedExtractHandlerTableAddress|gUefiOvmfPkgTokenSpaceGuid.PcdGuidedExtractHandlerTableSize -0x008000|0x001000 +0x00A000|0x001000 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbPageTableBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbPageTableSize -0x009000|0x002000 +0x00B000|0x002000 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbSize -0x00B000|0x001000 -gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase|gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize - -0x00C000|0x001000 +0x00D000|0x001000 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupSize +0x00F000|0x001000 +gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase|gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize + 0x010000|0x010000 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamSize diff --git a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm b/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm index 9c0b5853a4..5456f02924 100644 --- a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm +++ b/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm @@ -47,6 +47,25 @@ TIMES (15 - ((guidedStructureEnd - guidedStructureStart + 15) % 16)) DB 0 ; guidedStructureStart: +; +; SEV-SNP boot support +; +; sevSnpBlock: +; For the initial boot of SEV-SNP guest, a Secrets and CPUID page must be +; reserved by the BIOS at a RAM area defined by SEV_SNP_SECRETS_PAGE +; and SEV_SNP_CPUID_PAGE. A VMM will locate this information using the +; SEV-SNP boot block. +; +; GUID (SEV-SNP boot block): bd39c0c2-2f8e-4243-83e8-1b74cebcb7d9 +; +sevSnpBootBlockStart: + DD SEV_SNP_SECRETS_PAGE + DD SEV_SNP_CPUID_PAGE + DW sevSnpBootBlockEnd - sevSnpBootBlockStart + DB 0xC2, 0xC0, 0x39, 0xBD, 0x8e, 0x2F, 0x43, 0x42 + DB 0x83, 0xE8, 0x1B, 0x74, 0xCE, 0xBC, 0xB7, 0xD9 +sevSnpBootBlockEnd: + ; ; SEV Secret block ; diff --git a/OvmfPkg/ResetVector/ResetVector.inf b/OvmfPkg/ResetVector/ResetVector.inf index dc38f68919..d890bb6b29 100644 --- a/OvmfPkg/ResetVector/ResetVector.inf +++ b/OvmfPkg/ResetVector/ResetVector.inf @@ -37,6 +37,10 @@ gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbPageTableBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbPageTableSize gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesBase diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb b/OvmfPkg/ResetVector/ResetVector.nasmb index 5fbacaed5f..2c194958f4 100644 --- a/OvmfPkg/ResetVector/ResetVector.nasmb +++ b/OvmfPkg/ResetVector/ResetVector.nasmb @@ -75,6 +75,8 @@ %define SEV_ES_WORK_AREA (FixedPcdGet32 (PcdSevEsWorkAreaBase)) %define SEV_ES_WORK_AREA_RDRAND (FixedPcdGet32 (PcdSevEsWorkAreaBase) + 8) %define SEV_ES_WORK_AREA_ENC_MASK (FixedPcdGet32 (PcdSevEsWorkAreaBase) + 16) + %define SEV_SNP_SECRETS_PAGE FixedPcdGet32 (PcdOvmfSnpSecretsBase) + %define SEV_SNP_CPUID_PAGE FixedPcdGet32 (PcdOvmfSnpCpuidBase) %define SEV_ES_VC_TOP_OF_STACK (FixedPcdGet32 (PcdOvmfSecPeiTempRamBase) + FixedPcdGet32 (PcdOvmfSecPeiTempRamSize)) %include "Ia32/Flat32ToFlat64.asm" %include "Ia32/PageTables64.asm" -- 2.17.1