From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (NAM11-CO1-obe.outbound.protection.outlook.com []) by mx.groups.io with SMTP id smtpd.web12.25.1616599950939575559 for ; Wed, 24 Mar 2021 08:32:32 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@amd.com header.s=selector1 header.b=cW/Y2TbR; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: , mailfrom: brijesh.singh@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=MxGVz/Jpgn81ONJrEmbIae8fSV1dbGkdMXdItMR+WKSNGelHvJTPIW/lUXHxOeFJhAOwHKT+QAS19mzkpN0tepVrNwgqS4gVj2KfgY23a+XgKh4zr0iLK1oG3Pr3Lq+sXkN6NKqWzb1I6ueBhWuCjQxawpuHNPP0VlQXFdYi/0gcWThvZHvymZw1NezlVCjUyClLlccwwv4h2KnZeHAqnwWRs/24sOeRrl4lmn6P8ic39NvZaezYjrWNoB1W7+OW/3tF8HWOWecxY2lrv4VGJLNAAOimfL0Fm0bdk24+1fPmZUtsDFoPt6Lgxnm9RYfqPXmUebKxKRE3/pCGWUIWUQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EwPVpIpZ9xvU7DWnYOOvMIHQu2fSPlxOJtDC4pref0k=; b=c/EyCoBDruJ9uaHui585hgEyZ2HafZbSNK8sHoB9/vlZEPJ1HfSoVbuJbzCCbNL/EPNCAffxPFREBrY6o/gSYmh0/y6rA+9s0GAvukbbAfmRHxxAYTLeyFQfVvkpjCbsRy7MOOH81RyTyeGOwirJZBrLXuo5Vly8VkMS6hziadVNVU+mV7kZksjZwJz7um7dySsYfDckVOK6QCttQcYts4+c1pR/jY/kNgZvkKEasjAcReR9EWzmVkDIEIVTGoCyh+Gw6mllC8tMJmZSuAALH8w9G66vWG/nVUXnIU9jgrn0lrqJTR63gC4Ip8G1QWcB0MuANBCq3RTWueAnSOCLNg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EwPVpIpZ9xvU7DWnYOOvMIHQu2fSPlxOJtDC4pref0k=; b=cW/Y2TbRR2V8vyE8T5KVMAsqAq6iYm8YxF+fbNya3BDbFPtwwRzYIWfXE43K69CQo3J6NLHv2rWOgSuVkK8t707KmQUDtv5u+v7joynoUTzjzW5daDXNyK161C5kMDh5PPOgFmb2pCpgMabyw4+655/tatx+S9C2O/v0xCNg3PQ= Authentication-Results: edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SN1PR12MB2541.namprd12.prod.outlook.com (2603:10b6:802:24::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3955.18; Wed, 24 Mar 2021 15:32:29 +0000 Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::30fb:2d6c:a0bf:2f1d]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::30fb:2d6c:a0bf:2f1d%3]) with mapi id 15.20.3955.027; Wed, 24 Mar 2021 15:32:29 +0000 From: "Brijesh Singh" To: devel@edk2.groups.io Cc: Brijesh Singh , James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Laszlo Ersek Subject: [RFC PATCH 02/19] OvmfPkg: validate the data pages used in the SEC phase Date: Wed, 24 Mar 2021 10:31:58 -0500 Message-Id: <20210324153215.17971-3-brijesh.singh@amd.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210324153215.17971-1-brijesh.singh@amd.com> References: <20210324153215.17971-1-brijesh.singh@amd.com> X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: SA9PR11CA0006.namprd11.prod.outlook.com (2603:10b6:806:6e::11) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) Return-Path: brijesh.singh@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SA9PR11CA0006.namprd11.prod.outlook.com (2603:10b6:806:6e::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3955.18 via Frontend Transport; Wed, 24 Mar 2021 15:32:29 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 04995a66-aa34-4b24-e6e9-08d8eeda0922 X-MS-TrafficTypeDiagnostic: SN1PR12MB2541: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: nSIUB69o8M+Sup601/AVdo4DgU+7J25R2siy4UkabLFB01l1JfAT1sWwj2hbPha+wctC8xwPkiwpBBp6LraxFDWMdcNHnmw9xievEiH7ByJsoqrbcmDwSS5Tyn3XECdEr5TfKhqvsYqG1VNkzoEaT4S/cb0ArQZVr85QMKmVXdYR4ssXDuCNlbZT7aw15XIj/gZWELUHihQMTKcnFGEJes3N9rcKihWQ2CbOLKQCQTZP97DQAAxhDX1QBfGrcG6xaVpp7Agapjwt//cUzMGKKMJol6FXyeYOBaR9GrBW0n3bn7WGh+4whpjI3RPHp4W3Hj97wENDjnz/Tw+WvhJ74H3rFcsM4sIJwH4NbmxTTExR0CXrZ+2TSN8d3ADFaOeQqorM4gaKJ+qkc6LP0Zsve/kK/+SujohAuFmnjrKmr2OO/0dLHxZF0F79dU94FPGLXv4mZ0UTCG5thzZ5rooNxu5/UJexyxRBalesa0cZcVeNUAVD/eeVvQnzAQj8RXwECg9409qV4eq/hjBH5SawqAZ489V6ful8l65aIgOHrpLmaddsuVdNNCoVxlmI2LmEaDeIGGNBGyTLGs8q4beW7TPe3rRyPN5FtFL3LDxAcejx6gF+7nsQ2tQnpdlNEKw5dK5sBDBKH1/H6lo2DwDQXhHqRnp19gSldhYdA0aP/h8VEVI0W+3jeZ+M0j+fZQp6kgpbHW7v+bgmWvEEeGJRuTDcF4wnF4tl9KcQbRggcE+KVNDHa4VGDJeuAMuIq0W1 X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2718.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(136003)(376002)(396003)(39860400002)(346002)(36756003)(8676002)(316002)(52116002)(54906003)(7696005)(5660300002)(1076003)(66946007)(6916009)(8936002)(15650500001)(83380400001)(2906002)(86362001)(6666004)(6486002)(38100700001)(26005)(66556008)(478600001)(956004)(66476007)(2616005)(966005)(19627235002)(4326008)(44832011)(186003)(16526019);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: =?us-ascii?Q?STOkmO57P9Dp+iq5g7kLU+h6eKfg39v3/QYQkAzr0yzry5m316KwABDlAEtp?= =?us-ascii?Q?4WosnPss7H2stwQO7RctGEixR9i6qjlHrS9PKOtNoAukseyFyzMEhjq5Dz+9?= =?us-ascii?Q?X5q8FN6Hs5lR8Y6bV3OsH2rofpID0RhUIaWug5Xed2nhBIiUyViGG0tYa2Be?= =?us-ascii?Q?1yzoj8m8uRkh7mGT9VRkDuaGqNJ2gTLCJ9jJjCGdQC6jO+iFKOanA8Lfd1xE?= =?us-ascii?Q?27j/Jqakt6bODLqkOYaOK8E4mAJx9453QhcXZWdI8tcbdOhZdeddsIhmvFMs?= =?us-ascii?Q?wDedbhDHIU08jIPVSPLqrf18JcoO/tmwtBSdiSI5QP8blEZMUtGPDRcPwHCr?= =?us-ascii?Q?R3ADZpEKjC4dCP1fOHT1RXu8gi0Go96nFHGqdNcybYYJTiyzyYzNq/nYEA2L?= =?us-ascii?Q?HAUikr7w4M031OuoRoXmV3oWqh9H5OVr3/gnc8HKfqPcO3mDY8Qx3OICGYJP?= =?us-ascii?Q?QSG7Ox2nHNDncEc0kS+Xk+ChbHL8tZ13WiSrafTnA4YQIv0oJ4xtdZr+d1Ur?= =?us-ascii?Q?rGuFh9UBWWJwCvgrur1aIXzROtZpu96+rHlQ+gcNvgbOoMc8UqS43Il+ZgB9?= =?us-ascii?Q?mm/pyVemD/SgSxgDvGWrwQG4G8LYr8tKsXkFFDTyc7WM87tKuiozOC361USL?= =?us-ascii?Q?OYMbImPQo9YiUS0mQlsjenT7dAp6n3weMj+u6AWwxu8SLA2RChw3GpML8TyP?= =?us-ascii?Q?jf4FR6qDy5zZXz/OryRNTKHiMIJJkgsgX0sDvLQhy6HMXRS2+sWR0MiSS4lX?= =?us-ascii?Q?0RbIJ6ehSej0uF/b4Q3vyvtEs7MVQkDLXwUmqhK34E/lHOe6Nqik4aVJHpy7?= =?us-ascii?Q?Xf5GcKCDqspXUl08WKtqGMk+NElLauHGSHS04cXtVM+6lAF/Xl9VXyxVvlOJ?= =?us-ascii?Q?/tEuwNNadAHLVMSUyAEVT9a+VkLbkfWr6vd/UUM8CvpFXTlYsGxEvMftm7NP?= =?us-ascii?Q?Z5OZCGHB0JT9c0vjSPdLbBw3zMeBYPlKkTWqgkurWQiBDjkOJwpjixM6R6Bl?= =?us-ascii?Q?o/pXsww8+tTxAAKya7iFXE+LY9kVaDGyEKYTb2DUKMZhRHnJvBO2ynPZ6QWw?= =?us-ascii?Q?05JhBO7wTlVZWb9pEOD3yCBo/I9pa4uo8eGimA+jFVlTY5rMtWFKjkyWPDUK?= =?us-ascii?Q?C0g4/xW/GgkbA/WBqQY1uREo99ffXD0IIpudqTFoCucwi0lUQ0GCNkJ+8mlY?= =?us-ascii?Q?vVvcIUiwMp81UYNWla6FvrrSWdl2Y4+oXjwp7AVXmM9xwv4YixKxJDpZGQMb?= =?us-ascii?Q?gxx/Uaan6V4VAYH0WMe+VVVD+025j3T/05BMTsfnxxMpN4DSDVqqFpfBbZhb?= =?us-ascii?Q?OW0pvBhEVHTBDXXJP1MDmfLY?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 04995a66-aa34-4b24-e6e9-08d8eeda0922 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Mar 2021 15:32:29.7747 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Z5bcj04iQsOO7MVzI2rSRQLRqn9cM7zTyMMoknqZBOtZN6iMGXq1yZ4CPrlrvimsx1Gk/df+I+uYZNmgQpCOzA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB2541 Content-Type: text/plain BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3275 An SEV-SNP guest requires that private memory (aka pages mapped as encrypted) must be validated before being accessed. The validation process consist of the following sequence: 1) Set the memory encryption attribute in the page table (aka C-bit). Note: If the processor is in non-PAE mode, then all the memory accesses are considered private. 2) Add the memory range as private in the RMP table. This can be performed using the Page State Change VMGEXIT defined in the GHCB specification. 3) Use the PVALIDATE instruction to set the Validated Bit in the RMP table. During the guest creation time, the VMM encrypts the OVMF_CODE.fd using the SEV-SNP firmware provided LAUNCH_UPDATE_DATA command. In addition to encrypting the content, the command also validates the memory region. This allows us to execute the code without going through the validation sequence. During execution, the reset vector need to access some data pages (such as page tables, SevESWorkarea, Sec stack). The data pages are accessed as private memory. The data pages are not part of the OVMF_CODE.fd, so they were not validated during the guest creation. There are two approaches we can take to validate the data pages before the access: a) Enhance the OVMF reset vector code to validate the pages as described above (go through step 2 - 3). OR b) Validate the pages during the guest creation time. The SEV firmware provides a command which can be used by the VMM to validate the pages without affecting the measurement of the launch. Approach #b seems much simpler; it does not require any changes to the OVMF reset vector code. Extend the SnpBootBlock to provide the range that can be pre-validated using the SEV-SNP firmware command during the guest creation time. At the end of the guest creation the pre-validated range looks like this: 0x800000 0x801000 (CPUID Page [Validated + Measured]) 0x801000 0x802000 (Secrets Page [Validated + Measured]) 0x802000 0x820000 (Data Pages for the SEC phase [Validated + unmeasured]) Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Laszlo Ersek Signed-off-by: Brijesh Singh --- OvmfPkg/OvmfPkg.dec | 4 ++++ OvmfPkg/OvmfPkgX64.fdf | 9 ++++++++- OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 5 +++++ OvmfPkg/ResetVector/ResetVector.inf | 1 + OvmfPkg/ResetVector/ResetVector.nasmb | 2 ++ 5 files changed, 20 insertions(+), 1 deletion(-) diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index 062926772d..6fb70e2c10 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -325,6 +325,10 @@ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase|0|UINT32|0x50 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize|0|UINT32|0x51 + ## The range of memory pre-validated through the SEV-SNP launch sequence + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpLaunchValidatedStart|0|UINT32|0x52 + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpLaunchValidatedEnd|0|UINT32|0x53 + [PcdsDynamic, PcdsDynamicEx] gUefiOvmfPkgTokenSpaceGuid.PcdEmuVariableEvent|0|UINT64|2 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFlashVariablesEnable|FALSE|BOOLEAN|0x10 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf index ea214600be..16383453f1 100644 --- a/OvmfPkg/OvmfPkgX64.fdf +++ b/OvmfPkg/OvmfPkgX64.fdf @@ -105,7 +105,14 @@ FV = PEIFV gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvSize FV = DXEFV -################################################################################ +############################################################################## +# +# The range of the pages validated through the SEV-SNP launch sequence. +# +SET gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpLaunchValidatedStart = $(MEMFD_BASE_ADDRESS) +SET gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpLaunchValidatedEnd = gUefiOvmfPkgTokenSpaceGuid.PcdOvmfPeiMemFvBase + +############################################################################### [FV.SECFV] FvNameGuid = 763BED0D-DE9F-48F5-81F1-3E90E1B1A015 diff --git a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm b/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm index 5456f02924..9be887c4fc 100644 --- a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm +++ b/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm @@ -56,11 +56,16 @@ guidedStructureStart: ; and SEV_SNP_CPUID_PAGE. A VMM will locate this information using the ; SEV-SNP boot block. ; +; In addition to Secret and CPUID page, the SEV-SNP boot block also contain +; the range of memory that must be pre-validated by the VMM before the execution. +; ; GUID (SEV-SNP boot block): bd39c0c2-2f8e-4243-83e8-1b74cebcb7d9 ; sevSnpBootBlockStart: DD SEV_SNP_SECRETS_PAGE DD SEV_SNP_CPUID_PAGE + DD SEV_SNP_LAUNCH_VALIDATED_START + DD SEV_SNP_LAUNCH_VALIDATED_END DW sevSnpBootBlockEnd - sevSnpBootBlockStart DB 0xC2, 0xC0, 0x39, 0xBD, 0x8e, 0x2F, 0x43, 0x42 DB 0x83, 0xE8, 0x1B, 0x74, 0xCE, 0xBC, 0xB7, 0xD9 diff --git a/OvmfPkg/ResetVector/ResetVector.inf b/OvmfPkg/ResetVector/ResetVector.inf index d890bb6b29..49a527c0b1 100644 --- a/OvmfPkg/ResetVector/ResetVector.inf +++ b/OvmfPkg/ResetVector/ResetVector.inf @@ -47,6 +47,7 @@ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesSize gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfPeiMemFvBase [FixedPcd] gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretBase diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb b/OvmfPkg/ResetVector/ResetVector.nasmb index 2c194958f4..6d399c4739 100644 --- a/OvmfPkg/ResetVector/ResetVector.nasmb +++ b/OvmfPkg/ResetVector/ResetVector.nasmb @@ -77,6 +77,8 @@ %define SEV_ES_WORK_AREA_ENC_MASK (FixedPcdGet32 (PcdSevEsWorkAreaBase) + 16) %define SEV_SNP_SECRETS_PAGE FixedPcdGet32 (PcdOvmfSnpSecretsBase) %define SEV_SNP_CPUID_PAGE FixedPcdGet32 (PcdOvmfSnpCpuidBase) + %define SEV_SNP_LAUNCH_VALIDATED_START FixedPcdGet32 (PcdOvmfSecPageTablesBase) + %define SEV_SNP_LAUNCH_VALIDATED_END FixedPcdGet32 (PcdOvmfPeiMemFvBase) %define SEV_ES_VC_TOP_OF_STACK (FixedPcdGet32 (PcdOvmfSecPeiTempRamBase) + FixedPcdGet32 (PcdOvmfSecPeiTempRamSize)) %include "Ia32/Flat32ToFlat64.asm" %include "Ia32/PageTables64.asm" -- 2.17.1