From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) by mx.groups.io with SMTP id smtpd.web08.6098.1634195606416904078 for ; Thu, 14 Oct 2021 00:13:26 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=FjLV5GS4; spf=pass (domain: redhat.com, ip: 216.205.24.124, mailfrom: kraxel@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1634195605; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=LcGGxIb4qW1TZvb3UHpyrg6TDTHf8+b9gAsxQZu6WTY=; b=FjLV5GS40WKe0nMLMfb7ya782qPogWkYG2dsrYI5FjOglqN2lMQ2vaD5UdyO/7QeGy5BMn f9XEFa0jt6Pb75wMZk0xpEOAMkIIKHDNrobZJdtB0ExStnbygNY4FWtvOQrbASxP8n5AH6 qVobY7czyC1nDHukZWrMEmLAOOC5gDM= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-189-wV7IqRF8M2e4m4EFv5xwxg-1; Thu, 14 Oct 2021 03:13:22 -0400 X-MC-Unique: wV7IqRF8M2e4m4EFv5xwxg-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 9402B9F92E; Thu, 14 Oct 2021 07:13:20 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.39.192.23]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 3F6B680466; Thu, 14 Oct 2021 07:13:20 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 2B80818007AC; Thu, 14 Oct 2021 09:13:18 +0200 (CEST) Date: Thu, 14 Oct 2021 09:13:18 +0200 From: "Gerd Hoffmann" To: Brijesh Singh Cc: devel@edk2.groups.io, James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth Subject: Re: [PATCH v9 07/32] OvmfPkg/ResetVector: pre-validate the data pages used in SEC phase Message-ID: <20211014071318.jg5vvhumn6n7xmfj@sirius.home.kraxel.org> References: <20211013165713.727815-1-brijesh.singh@amd.com> <20211013165713.727815-8-brijesh.singh@amd.com> MIME-Version: 1.0 In-Reply-To: <20211013165713.727815-8-brijesh.singh@amd.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=kraxel@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Wed, Oct 13, 2021 at 11:56:48AM -0500, Brijesh Singh wrote: > BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3275 > > An SEV-SNP guest requires that private memory (aka pages mapped encrypted) > must be validated before being accessed. > > The validation process consist of the following sequence: > > 1) Set the memory encryption attribute in the page table (aka C-bit). > Note: If the processor is in non-PAE mode, then all the memory accesses > are considered private. > 2) Add the memory range as private in the RMP table. This can be performed > using the Page State Change VMGEXIT defined in the GHCB specification. > 3) Use the PVALIDATE instruction to set the Validated Bit in the RMP table. > > During the guest creation time, the VMM encrypts the OVMF_CODE.fd using > the SEV-SNP firmware provided LAUNCH_UPDATE_DATA command. In addition to > encrypting the content, the command also validates the memory region. > This allows us to execute the code without going through the validation > sequence. > > During execution, the reset vector need to access some data pages > (such as page tables, SevESWorkarea, Sec stack). The data pages are > accessed as private memory. The data pages are not part of the > OVMF_CODE.fd, so they were not validated during the guest creation. > > There are two approaches we can take to validate the data pages before > the access: > > a) Enhance the OVMF reset vector code to validate the pages as described > above (go through step 2 - 3). > OR > b) Validate the pages during the guest creation time. The SEV firmware > provides a command which can be used by the VMM to validate the pages > without affecting the measurement of the launch. > > Approach #b seems much simpler; it does not require any changes to the > OVMF reset vector code. > > Update the OVMF metadata with the list of regions that must be > pre-validated by the VMM before the boot. Acked-by: Gerd Hoffmann take care, Gerd