From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.groups.io with SMTP id smtpd.web12.1726.1619808255507008336 for ; Fri, 30 Apr 2021 11:44:15 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=LAKbWLnf; spf=pass (domain: redhat.com, ip: 170.10.133.124, mailfrom: lersek@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1619808254; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tcQ/Qstr7E1ob8wiAldmb3d+XkWF7xEnUuDuQOD9WvE=; b=LAKbWLnf71RjmUXKyeNaMngpJlzUxCJPz96FXc8VM6zVqnu0tMcVKE9ctnMlImcnMpaSJ/ 7DOVfK+VED+sqFQV3MjKCkqP8VPhiliH/2/QOSO+Oiy9wiD5zqQNt74Ln8rOxGzrv/WtAJ LxqcA/8XciZMxIL4GuboMA+hUa9Bf78= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-78-BNDUn5skMVK67dlueR6VRA-1; Fri, 30 Apr 2021 14:44:11 -0400 X-MC-Unique: BNDUn5skMVK67dlueR6VRA-1 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 745FE501F0; Fri, 30 Apr 2021 18:44:09 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-112-248.ams2.redhat.com [10.36.112.248]) by smtp.corp.redhat.com (Postfix) with ESMTP id 8FFCA5D742; Fri, 30 Apr 2021 18:44:02 +0000 (UTC) Subject: Re: [edk2-devel] [PATCH v3 0/5] SEV-ES TPM enablement fixes To: devel@edk2.groups.io, thomas.lendacky@amd.com Cc: Joerg Roedel , Borislav Petkov , Ard Biesheuvel , Jordan Justen , Brijesh Singh , Erdem Aktas , James Bottomley , Jiewen Yao , Min Xu , =?UTF-8?Q?Marc-Andr=c3=a9_Lureau?= , Stefan Berger References: From: "Laszlo Ersek" Message-ID: <337e5c84-b5b6-9f55-a3e6-9418891e9f1b@redhat.com> Date: Fri, 30 Apr 2021 20:44:01 +0200 MIME-Version: 1.0 In-Reply-To: X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=lersek@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit On 04/29/21 19:12, Lendacky, Thomas wrote: > This patch series provides fixes for using TPM support with an SEV-ES > guest. > > The fixes include: > > - Decode ModRM byte for MOVZX and MOVSX opcodes. > - Add MMIO support for MOV opcodes 0xA0-0xA3. > - Create a new TPM MMIO ready PPI guid, gOvmfTpmMmioAccessiblePpiGuid > - Mark TPM MMIO range as un-encrypted during PEI phase for an SEV-ES > guest and install the TPM MMIO ready PPI guid. > - Update the Tcg2Config Depex to ensure the new PEIM runs before the > Tcg2Config PEIM > > BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3345 > > --- > > These patches are based on commit: > ab957f036f67 ("BaseTools/Source/Python: New Target/ToolChain/Arch in DSC [BuildOptions]") Merged in commit range ab957f036f67..1e6b0394d6c0, via . Thanks, Laszlo > > Changes since: > > v2: > - Update the TPM PEIM to only perform the mapping change when SEV-ES is > active (with a comment in the code to explain why). > - Update the TPM PEIM file header comment. > - Updates to the INF file (INF_VERSION, Packages, LibraryClasses, etc.). > - Updates to PEIM file order in DSC and FDF files. > - Split out Tcg2Config Depex change to a separate patch. > > v1: > - Create a TPM PEIM that will map the TPM address range as unencrypted and > install a new PPI to indicate the mapping change is complete. > > Cc: Laszlo Ersek > Cc: Ard Biesheuvel > Cc: Jordan Justen > Cc: Brijesh Singh > Cc: Erdem Aktas > Cc: James Bottomley > Cc: Jiewen Yao > Cc: Min Xu > Cc: Marc-André Lureau > Cc: Stefan Berger > > Tom Lendacky (5): > OvfmPkg/VmgExitLib: Properly decode MMIO MOVZX and MOVSX opcodes > OvmfPkg/VmgExitLib: Add support for new MMIO MOV opcodes > OvmfPkg: Define a new PPI GUID to signal TPM MMIO accessability > OvmfPkg/Tcg2ConfigPei: Mark TPM MMIO range as unencrypted for SEV-ES > OvmfPkg/Tcg2ConfigPei: Update Depex for IA32 and X64 > > OvmfPkg/OvmfPkg.dec | 4 + > OvmfPkg/AmdSev/AmdSevX64.dsc | 1 + > OvmfPkg/OvmfPkgIa32.dsc | 1 + > OvmfPkg/OvmfPkgIa32X64.dsc | 1 + > OvmfPkg/OvmfPkgX64.dsc | 1 + > OvmfPkg/AmdSev/AmdSevX64.fdf | 1 + > OvmfPkg/OvmfPkgIa32.fdf | 1 + > OvmfPkg/OvmfPkgIa32X64.fdf | 1 + > OvmfPkg/OvmfPkgX64.fdf | 1 + > OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf | 2 +- > OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf | 40 +++++++ > OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 120 +++++++++++++++++++- > OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPeim.c | 87 ++++++++++++++ > 13 files changed, 258 insertions(+), 3 deletions(-) > create mode 100644 OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf > create mode 100644 OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPeim.c >