From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.81]) by mx.groups.io with SMTP id smtpd.web09.162.1630513078582068804 for ; Wed, 01 Sep 2021 09:17:58 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="body hash did not verify" header.i=@amd.com header.s=selector1 header.b=ijaEO+zj; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.237.81, mailfrom: brijesh.singh@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DVE2gy5+zQxEaGTkDrax5h63nzhJTm14R/jwcpFYIhGgelN2gxneb2Gk8UkW0P3ZNSXRjbI+qGlU204tPKasmiaGfPXUbEBqMVCDh3ccLwJ7nExaG64RP5UVTunZ/sJXpAFpiOxaY5YXuSCG/Pvue2a4WDN1YYaXNF4wBUj8/QP/1VD2Z98HuTSoqHPOzS49k5tZM+wpol5JEgosuQ8IqLZxmLkYjTZqiyavlBJoLPVn91HqdiO9eOVA/WnTylx2fHUImdiW/WdRKENrixJxfxTpBDi8FewevZGeHFvjZcWOl7+9IJH6RMSEWsxOa8N8Ref8jExe8ZPGw8UtSxn09A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=0qF2tIYl2bGbK/jM/39hEVTg7rjtu/4XtKkHbJToEFw=; b=VA8q8E74ZzvAoKuvdOvd5qQGIGbdsO8FKJimzjMhhPBvTndWWEIK5NeBxW3aQV9+yaAuFfxQW/w7mbTXNUT5ySvDP5o+Khtv6v8qjkpk/Hmf8cSrm1aW31EuZ5Jbmon20wRmk9zbhBdUYoJSq8S2t3XEtV9H08sP7h8bPazYtCw3uDz5XPYHjBa7SokpO2Y5DaLcKDTd4NFTjmRBWqD2eVDGaYKiI9pQHGFEXkTjfnWOYZ6gXx/doKkXejLT5VethiWtSVt/m/StDjTHMk4/TyJ1dlBW3tVlS3YuqZ20sm+9eTSizfJj0hjLaeDvysrOAZm2Mju2NTCQhYzIUb1NrQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=0qF2tIYl2bGbK/jM/39hEVTg7rjtu/4XtKkHbJToEFw=; b=ijaEO+zj0dUSome1an5lq3gqm4By+HKJt6tsOC6hvmSnp44OQmq7VgNUGK8fzXCsCDwdmUgHw+/bTY0K8yVjQsBaDvT2YQ2Oj4haMMiKAwmReeE6CiVb0cs8qqjgRBXbizfAU4WAqxxygpnltOQVy3ckiaktoqiXugUp0Rtd3kc= Authentication-Results: edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4512.namprd12.prod.outlook.com (2603:10b6:806:71::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.17; Wed, 1 Sep 2021 16:17:56 +0000 Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4457.025; Wed, 1 Sep 2021 16:17:56 +0000 From: "Brijesh Singh" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [PATCH v6 28/29] OvmfPkg/AmdSev: expose the SNP reserved pages through configuration table Date: Wed, 1 Sep 2021 11:16:45 -0500 Message-ID: <20210901161646.24763-29-brijesh.singh@amd.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210901161646.24763-1-brijesh.singh@amd.com> References: <20210901161646.24763-1-brijesh.singh@amd.com> X-ClientProxiedBy: SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) Return-Path: brijesh.singh@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SN4PR0501CA0062.namprd05.prod.outlook.com (2603:10b6:803:41::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4478.12 via Frontend Transport; Wed, 1 Sep 2021 16:17:55 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 0fc78444-01f1-4fbf-9bed-08d96d640eb1 X-MS-TrafficTypeDiagnostic: SA0PR12MB4512: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:5516; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 7muMB3tPQ7vsmGaRxJVV5l1Op2NppblWruYYIr0eGQxRuCT2XZd5CAsQCgiEEIKLI8FJ4hLjFBIjGNAx73+L7oRz81OsyrsOtx3lZNAWt//8aHNPdFm2YbuwO2s0H9pTaiguIU5f6DNs7uO6rlK8u3zPm7KQiNHNCDLjUF+5UU8uIgAUcDVyewa7YdfR9y4M1qmLU9hIo08yx+ZpP3SvmoFx3+sPNDkzOz4O1oef5/Bk4HbWedysU3S58rMUJFZq8Q0T2cNU3P6e0NcymB+j0mb5lDGaqJuvZUKzYWS5OVGjGZ5IbB24wv8t96lSLrE+pH2nhqv7fmaFPhYlQU/GgOJy8SYxmBeDdwaxZi/aYcKx0GD7UnM/cXskLQr9OMuaPrV8LY4oNbKFagk6aaT1nN7kNAfbbL4+AB1B3w5C5G1DGJ51Ju6tHBKJXcSRejn6M7mI3xOtV9sLNi+tiUjzh9k0wmB+6d6Dc1pV2BiomXzZXhmPNxf52eP/bP42IJvACa339vDir5IRNx90RgmyhmyCB+m96ly5krMt7FdaumT/sZt1dQcvdbocNs0gQNKM+33u7jTLhutZofPi43YbZM5L4CQt0klRfTQsQYPuEgKLW/JVQcClNvZK+f6846/1dKVm6YeAFwRVgy/fTOPcI3KUeBNH1TXpHgSuLJHJYlwBphs6LmFNinxl5+FSvyrWwfyXxZyaikujGH4tmxhodWri9PkOnjN1g4lNLXjB4CJ7+daSFZA+16mvWG4wJ8roND6glXht4nN5ZYEThTNOCA3f2xpQHZSevjfEQuP1aHQ= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2718.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(396003)(376002)(346002)(366004)(39860400002)(136003)(66476007)(66946007)(66556008)(4326008)(478600001)(316002)(26005)(2616005)(956004)(186003)(44832011)(5660300002)(966005)(86362001)(54906003)(7696005)(8936002)(36756003)(2906002)(8676002)(38100700002)(38350700002)(6486002)(6666004)(52116002)(1076003)(6916009);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?vpjScBLbt4wYu+mn7eq7nKgYbuOY9dFfIePp135ir5lugVg2NTrTnQNZMhte?= =?us-ascii?Q?ntkIyDB6vn0D8Yh8yFxuoTmWkfoLTK50q8+uOx1ai0TwOfXsEQtNr299VlFq?= =?us-ascii?Q?R91mU9dqW2C3dXz/fI3P2K3jGbPYcMInTenJhbFIJ31L7L6NwE5cnTj0D76/?= =?us-ascii?Q?HC+YSZA3vzv6TESMVvuQ3iDoi0RhZjwHu7u5pGKTkxHqZEVCv5/pUvKOtM9n?= =?us-ascii?Q?/anITqI7fMLaJxlrTWq6kIfZuI07rOMpx6m5zQtvUh8kK3flWW1zm625qVT+?= =?us-ascii?Q?+HzKaHaLc+uuBBh58dxf90PiqtqA2k4GHo7+lm7QkAhnIpiMrjMhMQPggs/O?= =?us-ascii?Q?LKt8+6lfsiipqAWTSomzWv2sNYZHJL/2nL9gAGGD6nADYpJghxsE8jIzgKeN?= =?us-ascii?Q?PxalwcHIkpmH/5M+mQWOoUpQdcXHBHtu+QOzzo+fzVlDgN3j0RbIOHh1Whgu?= =?us-ascii?Q?f3+NIZo5NbtWmG0pjEPiakU8RWoHtIMQ/Mholo1pKCT5zt6q5PNbtiGGDDb7?= =?us-ascii?Q?mpyXGyv5p5+zhiWvvCvZeXo1x4KV4T8VprvJL51uLO6x2c1euudbS7C0bryl?= =?us-ascii?Q?Pmt77+Q9J/2knLdjNoUyf8GqVgoctBo1Wg4U9gLBf6Lxsk+oKPM4rnBbpMQg?= =?us-ascii?Q?UBjzK0UCsH3b0Co+Ffxmiq7n00lUmD0q3BMGdjuD0fSlbrAs8T8aUQEaSTbH?= =?us-ascii?Q?jW9A7IEhV9xg69PSTsLW+f9pZQQxeULHywiBTDQ6sQTcMoZN/69Sm2UkJere?= =?us-ascii?Q?V7GjtMuH/5120Lq7Fqv1+6RUzo+UrHfxh88z9YuqBx2sPSuFzOpuzBQ9vDOD?= =?us-ascii?Q?1WMV1fP4EW9ResxyL/bLL6Es+baamHi+UW290LkCZwbMd4vro8Ss+t0wSglu?= =?us-ascii?Q?pZP5BGB6x+1fRVd98TRNZsc/H8yOrCG/VrmtvtrTCGmeOPTK9AOx8AtwR4Zx?= =?us-ascii?Q?llm3rUIgsPZtqZDUTyYfDDv2dF0DMYftgiMWLJ6TItTbQQ4huXt44l4JQ20P?= =?us-ascii?Q?ZBNNbi+zJEyI01I4/hraHDOLfqoN9rL8lInCO3Eeib2b5syZ3ZXPRpFyQGmG?= =?us-ascii?Q?jEmKNjrjQpUPX9OQWEYPkBCrBPieTORsOYnj7afrHPPiiLxtbFlc13374KVn?= =?us-ascii?Q?LYLepIdb3HsGz6/wjd+BqVjMmDhmSgmiuMclrP5jjJb618xKlkmHehyzMGkB?= =?us-ascii?Q?K6coEeUkish6S7JzhjQTQDY57cqeyRXerwH5/95OTYYnv53wE/+Cv0J/qnfr?= =?us-ascii?Q?gUrLg2vzwLqPtcug9PIptuHLHlozGUXq/Sw5p8eBwbcP7J3T7N9Do6kV04+p?= =?us-ascii?Q?La+E4gm4OZ7XNyH9LAlF2F+U?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0fc78444-01f1-4fbf-9bed-08d96d640eb1 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2021 16:17:56.2372 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: dFyvSzfRSRi+lghXVleSfaSILuwA2ToApoRWWU4ogXDTsgOzZuvRapjCjkaoy5mGFehiBqXdj3ISbxQFfySp8g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4512 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 Now that both the secrets and cpuid pages are reserved in the HOB, extract the location details through fixed PCD and make it available to the guest OS through the configuration table. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Signed-off-by: Brijesh Singh --- OvmfPkg/OvmfPkg.dec | 1 + OvmfPkg/AmdSevDxe/AmdSevDxe.inf | 7 ++++++ .../Guid/ConfidentialComputingSecret.h | 18 +++++++++++++++ OvmfPkg/AmdSevDxe/AmdSevDxe.c | 23 +++++++++++++++++++ 4 files changed, 49 insertions(+) diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index d040ee02b94f..f4a53ab49901 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -124,6 +124,7 @@ [Guids] gQemuKernelLoaderFsMediaGuid =3D {0x1428f772, 0xb64a, 0x441e, {= 0xb8, 0xc3, 0x9e, 0xbd, 0xd7, 0xf8, 0x93, 0xc7}} gGrubFileGuid =3D {0xb5ae312c, 0xbc8a, 0x43b1, {= 0x9c, 0x62, 0xeb, 0xb8, 0x26, 0xdd, 0x5d, 0x07}} gConfidentialComputingSecretGuid =3D {0xadf956ad, 0xe98c, 0x484c, {= 0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47}} + gConfidentialComputingSevBlobGuid =3D {0x067b1f5f, 0xcf26, 0x44c5, {= 0x85, 0x54, 0x93, 0xd7, 0x77, 0x91, 0x2d, 0x42}} =20 [Ppis] # PPI whose presence in the PPI database signals that the TPM base addre= ss diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf b/OvmfPkg/AmdSevDxe/AmdSevDxe.= inf index 0676fcc5b6a4..74a55c189a09 100644 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.inf @@ -42,6 +42,13 @@ [FeaturePcd] =20 [FixedPcd] gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize + +[Guids] + gConfidentialComputingSevBlobGuid =20 [Pcd] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfHostBridgePciDevId diff --git a/OvmfPkg/Include/Guid/ConfidentialComputingSecret.h b/OvmfPkg/I= nclude/Guid/ConfidentialComputingSecret.h index 7026fc5b089f..769f2831f3e5 100644 --- a/OvmfPkg/Include/Guid/ConfidentialComputingSecret.h +++ b/OvmfPkg/Include/Guid/ConfidentialComputingSecret.h @@ -18,11 +18,29 @@ { 0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47 }, \ } =20 +#define CONFIDENTIAL_COMPUTING_SEV_BLOB_GUID \ + { 0x067b1f5f, \ + 0xcf26, \ + 0x44c5, \ + { 0x85, 0x54, 0x93, 0xd7, 0x77, 0x91, 0x2d, 0x42 }, \ + } + typedef struct { UINT64 Base; UINT64 Size; } CONFIDENTIAL_COMPUTING_SECRET_LOCATION; =20 +typedef struct { + UINT32 Header; + UINT16 Version; + UINT16 Reserved1; + UINT64 SecretsPhysicalAddress; + UINT32 SecretsSize; + UINT64 CpuidPhysicalAddress; + UINT32 CpuidLSize; +} CONFIDENTIAL_COMPUTING_SEV_BLOB_LOCATION; + extern EFI_GUID gConfidentialComputingSecretGuid; +extern EFI_GUID gConfidentialComputingSevBlobGuid; =20 #endif // SEV_LAUNCH_SECRET_H_ diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.c b/OvmfPkg/AmdSevDxe/AmdSevDxe.c index c66c4e9b9272..3af40f4cf29b 100644 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.c +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.c @@ -17,8 +17,20 @@ #include #include #include +#include +#include #include =20 +STATIC CONFIDENTIAL_COMPUTING_SEV_BLOB_LOCATION mSnpBootDxeTable =3D { + SIGNATURE_32('A','M','D','E'), + 1, + 0, + (UINT64)(UINTN) FixedPcdGet32 (PcdOvmfSnpSecretsBase), + FixedPcdGet32 (PcdOvmfSnpSecretsSize), + (UINT64)(UINTN) FixedPcdGet32 (PcdOvmfSnpCpuidBase), + FixedPcdGet32 (PcdOvmfSnpCpuidSize), +}; + EFI_STATUS EFIAPI AmdSevDxeEntryPoint ( @@ -130,5 +142,16 @@ AmdSevDxeEntryPoint ( } } =20 + // + // If its SEV-SNP active guest then install the CONFIDENTIAL_COMPUTING_S= EV_BLOB. + // It contains the location for both the Secrets and CPUID page. + // + if (MemEncryptSevSnpIsEnabled ()) { + return gBS->InstallConfigurationTable ( + &gConfidentialComputingSevBlobGuid, + &mSnpBootDxeTable + ); + } + return EFI_SUCCESS; } --=20 2.17.1