From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f202.google.com (mail-pf1-f202.google.com [209.85.210.202]) by mx.groups.io with SMTP id smtpd.web11.129.1663965311401539168 for ; Fri, 23 Sep 2022 13:35:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@google.com header.s=20210112 header.b=gf1nIFB/; spf=pass (domain: flex--dionnaglaze.bounces.google.com, ip: 209.85.210.202, mailfrom: 3fhguywskbycotzyylrwlaprzzrwp.nzxop6pwpovd.r2z503.tz@flex--dionnaglaze.bounces.google.com) Received: by mail-pf1-f202.google.com with SMTP id cg5-20020a056a00290500b0053511889856so607673pfb.18 for ; Fri, 23 Sep 2022 13:35:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date; bh=OrX8ljZMCzAjCIQQ/yqu3rgnW2RK94WmfpLLVFtaYJo=; b=gf1nIFB/DAwCq/weJSSzf8gB29tNX1IEYHGxTIM1XemHQV0MDoyMsO3fuIu28U0Ec0 fSQurTXBgyV/S7tp3poMAymgPKSPgwVDfnjU/pA5dLZrrkgYSi2JVphS3KKsnDhctmqD +fC8Uyc+LT8/M9YjAREJWiscYoH3yOrfupVzqmylL1ZmfjuGk1SFEYNS5MmHM7NESL1u 31bkXRnayZU4pc8ljrzNSOWQ5AAZhXZbqOr8C0DPh1Bt8gEO9IpyIJPNbr1jz/Ie4X2W wKqIwKtRZsPaPuBS37V1gTCAWAcbvdAREjOlJVr+W4nucLz5fD85ny2aJ5HEKF/qEK01 ReZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date; bh=OrX8ljZMCzAjCIQQ/yqu3rgnW2RK94WmfpLLVFtaYJo=; b=ujaGULNNym6x3Ljj6FeIcsD+taDbIzYfV0/U778jjMabN7bFVIqpE/IN9IAwbnDllk oSrH32WM3G/CK3rSbRgicADyZA+ZDUnA6tfll8rRjDxkfCQtgxUqaW6bz+G0SWxOA2a+ 10Ra0gJCZnEDztGU18KpY7FxAWeE5Jrvv73kxuZ+Pdj6aTcQqyTwK4bqdQn70jOy3EXL Khbe1JEvVOPwV2iMBhQ7Rfk51GwxmPwCTHaGX1G2Tha7UXro87I3COFWYM9kHAeUiifd WOmcc4RJ/pUFCVevG+G0f9aPNgsA5EKKyXkdzhSwwVV8LRWzvYKI1qEu6XxBZWRqrsFh ztOA== X-Gm-Message-State: ACrzQf3BWGb0P3ytLa9QvzeYS+2xp8CsPsP3OK0CWUkznlMCDz4BNE1U 4YmXHGw2vFiOft2G2s2fqqUCcGvdUEiJcm/UjLDqfj+9XCgIxVm0X1fZblD4v7QOIbWKTS7lH8l +69Zuoifdh2zlireKLQW7EdXSH+vEZVs1jePEAyhjlf5OLamqAlOYRj1opS7mtLf7De2rwIyv X-Google-Smtp-Source: AMsMyM5c3cAg7gNf/p6sBbuGD3QV7LW4KhdVz97rpEC+9xx8mkf+sEojD0I394XGD7h2EAsczbcDR3lF00idAxe5vg== X-Received: from dionnaglaze.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:2ee6]) (user=dionnaglaze job=sendgmr) by 2002:a17:902:eb90:b0:176:b24a:e69b with SMTP id q16-20020a170902eb9000b00176b24ae69bmr10121964plg.86.1663965310660; Fri, 23 Sep 2022 13:35:10 -0700 (PDT) Date: Fri, 23 Sep 2022 20:34:28 +0000 In-Reply-To: <20220923203431.1428535-1-dionnaglaze@google.com> Mime-Version: 1.0 References: <20220923203431.1428535-1-dionnaglaze@google.com> X-Mailer: git-send-email 2.37.3.998.g577e59143f-goog Message-ID: <20220923203431.1428535-2-dionnaglaze@google.com> Subject: [PATCH 1/4] OvmfPkg: Realize EfiMemoryAcceptProtocol in AmdSevDxe From: "Dionna Glaze" To: devel@edk2.groups.io Cc: Dionna Glaze , Gerd Hoffmann , James Bottomley , Jiewen Yao , Tom Lendacky , Sophia Wolf Content-Type: text/plain; charset="UTF-8" From: Sophia Wolf When a guest OS does not support unaccepted memory, the unaccepted memory must be accepted before returning a memory map to the caller. EfiMemoryAcceptProtocol is defined in MdePkg and is implementated / Installed in AmdSevDxe for AMD SEV-SNP memory acceptance. Cc: Gerd Hoffmann Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Signed-off-by: Sophia Wolf --- OvmfPkg/AmdSevDxe/AmdSevDxe.c | 34 ++++++++++++++++++ OvmfPkg/AmdSevDxe/AmdSevDxe.inf | 3 ++ OvmfPkg/Include/Library/MemEncryptSevLib.h | 14 ++++++++ .../Ia32/MemEncryptSevLib.c | 17 +++++++++ .../X64/DxeSnpSystemRamValidate.c | 35 +++++++++++++++++++ .../X64/PeiSnpSystemRamValidate.c | 17 +++++++++ .../X64/SecSnpSystemRamValidate.c | 18 ++++++++++ 7 files changed, 138 insertions(+) diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.c b/OvmfPkg/AmdSevDxe/AmdSevDxe.c index 662d3c4ccb..6e3a1fc7d7 100644 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.c +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.c @@ -20,6 +20,7 @@ #include #include #include +#include STATIC CONFIDENTIAL_COMPUTING_SNP_BLOB_LOCATION mSnpBootDxeTable = { SIGNATURE_32 ('A', 'M', 'D', 'E'), @@ -31,6 +32,29 @@ STATIC CONFIDENTIAL_COMPUTING_SNP_BLOB_LOCATION mSnpBootDxeTable = { FixedPcdGet32 (PcdOvmfCpuidSize), }; +STATIC EFI_HANDLE mAmdSevDxeHandle = NULL; + +STATIC +EFI_STATUS +EFIAPI +AmdSevMemoryAccept ( + IN EFI_MEMORY_ACCEPT_PROTOCOL *This, + IN EFI_PHYSICAL_ADDRESS StartAddress, + IN UINTN Size +) +{ + MemEncryptSnpAcceptPages ( + StartAddress, + EFI_SIZE_TO_PAGES (Size) + ); + + return EFI_SUCCESS; +} + +STATIC EFI_MEMORY_ACCEPT_PROTOCOL mMemoryAcceptProtocol = { + AmdSevMemoryAccept +}; + EFI_STATUS EFIAPI AmdSevDxeEntryPoint ( @@ -147,6 +171,16 @@ AmdSevDxeEntryPoint ( } } + Status = gBS->InstallProtocolInterface ( + &mAmdSevDxeHandle, + &gEfiMemoryAcceptProtocolGuid, + EFI_NATIVE_INTERFACE, + &mMemoryAcceptProtocol + ); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "Install EfiMemoryAcceptProtocol failed.\n")); + } + // // If its SEV-SNP active guest then install the CONFIDENTIAL_COMPUTING_SEV_SNP_BLOB. // It contains the location for both the Secrets and CPUID page. diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf b/OvmfPkg/AmdSevDxe/AmdSevDxe.inf index 9acf860cf2..5ddddabc32 100644 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.inf @@ -47,6 +47,9 @@ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize +[Protocols] + gEfiMemoryAcceptProtocolGuid + [Guids] gConfidentialComputingSevSnpBlobGuid diff --git a/OvmfPkg/Include/Library/MemEncryptSevLib.h b/OvmfPkg/Include/Library/MemEncryptSevLib.h index 4fa9c0d700..05ec10471d 100644 --- a/OvmfPkg/Include/Library/MemEncryptSevLib.h +++ b/OvmfPkg/Include/Library/MemEncryptSevLib.h @@ -228,4 +228,18 @@ MemEncryptSevSnpPreValidateSystemRam ( IN UINTN NumPages ); +/** + Accept pages system RAM when SEV-SNP is enabled in the guest VM. + + @param[in] BaseAddress Base address + @param[in] NumPages Number of pages starting from the base address + +**/ +VOID +EFIAPI +MemEncryptSnpAcceptPages ( + IN PHYSICAL_ADDRESS BaseAddress, + IN UINTN NumPages + ); + #endif // _MEM_ENCRYPT_SEV_LIB_H_ diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c b/OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c index f92299fc77..f0747d792e 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c @@ -153,3 +153,20 @@ MemEncryptSevSnpPreValidateSystemRam ( { ASSERT (FALSE); } + +/** + Accept pages system RAM when SEV-SNP is enabled in the guest VM. + + @param[in] BaseAddress Base address + @param[in] NumPages Number of pages starting from the base address + +**/ +VOID +EFIAPI +MemEncryptSnpAcceptPages ( + IN PHYSICAL_ADDRESS BaseAddress, + IN UINTN NumPages + ) +{ + ASSERT (FALSE); +} diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemRamValidate.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemRamValidate.c index d3a95e4913..7693e0ca66 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemRamValidate.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemRamValidate.c @@ -14,6 +14,7 @@ #include #include "SnpPageStateChange.h" +#include "VirtualMemory.h" /** Pre-validate the system RAM when SEV-SNP is enabled in the guest VM. @@ -38,3 +39,37 @@ MemEncryptSevSnpPreValidateSystemRam ( // ASSERT (FALSE); } + +/** + Accept pages system RAM when SEV-SNP is enabled in the guest VM. + + @param[in] BaseAddress Base address + @param[in] NumPages Number of pages starting from the base address + +**/ +VOID +EFIAPI +MemEncryptSnpAcceptPages ( + IN PHYSICAL_ADDRESS BaseAddress, + IN UINTN NumPages + ) +{ + EFI_STATUS Status; + + if (!MemEncryptSevSnpIsEnabled ()) { + return; + } + if (BaseAddress >= SIZE_4GB) { + Status = InternalMemEncryptSevCreateIdentityMap1G ( + 0, + BaseAddress, + EFI_PAGES_TO_SIZE (NumPages) + ); + if (EFI_ERROR (Status)) { + ASSERT (FALSE); + CpuDeadLoop (); + } + } + + InternalSetPageState (BaseAddress, NumPages, SevSnpPagePrivate, TRUE); +} diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c index 4970165444..1c52bfe691 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c @@ -126,3 +126,20 @@ MemEncryptSevSnpPreValidateSystemRam ( BaseAddress = EndAddress; } } + +/** + Accept pages system RAM when SEV-SNP is enabled in the guest VM. + + @param[in] BaseAddress Base address + @param[in] NumPages Number of pages starting from the base address + +**/ +VOID +EFIAPI +MemEncryptSnpAcceptPages ( + IN PHYSICAL_ADDRESS BaseAddress, + IN UINTN NumPages + ) +{ + ASSERT (FALSE); +} diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c index 7797febb8a..edfebf6ef4 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c @@ -10,6 +10,7 @@ #include #include +#include #include #include "SnpPageStateChange.h" @@ -80,3 +81,20 @@ MemEncryptSevSnpPreValidateSystemRam ( InternalSetPageState (BaseAddress, NumPages, SevSnpPagePrivate, TRUE); } + +/** + Accept pages system RAM when SEV-SNP is enabled in the guest VM. + + @param[in] BaseAddress Base address + @param[in] NumPages Number of pages starting from the base address + +**/ +VOID +EFIAPI +MemEncryptSnpAcceptPages ( + IN PHYSICAL_ADDRESS BaseAddress, + IN UINTN NumPages + ) +{ + ASSERT(FALSE); +} -- 2.37.3.998.g577e59143f-goog