Re: [edk2-devel] [PATCH RFC v2 00/28] Add AMD Secure Nested Paging (SEV-SNP) support

["Laszlo Ersek" <lersek@redhat.com>]

Hi,

On 04/30/21 13:51, Brijesh Singh wrote:
> BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3275
> 
> SEV-SNP builds upon existing SEV and SEV-ES functionality while adding
> new hardware-based memory protections. SEV-SNP adds strong memory integrity
> protection to help prevent malicious hypervisor-based attacks like data
> replay, memory re-mapping and more in order to create an isolated memory
> encryption environment.
>  
> This series provides the basic building blocks to support booting the SEV-SNP
> VMs, it does not cover all the security enhancement introduced by the SEV-SNP
> such as interrupt protection.

I've added this to my review queue.

Thanks
Laszlo

> 
> Many of the integrity guarantees of SEV-SNP are enforced through a new
> structure called the Reverse Map Table (RMP). Adding a new page to SEV-SNP
> VM requires a 2-step process. First, the hypervisor assigns a page to the
> guest using the new RMPUPDATE instruction. This transitions the page to
> guest-invalid. Second, the guest validates the page using the new PVALIDATE
> instruction. The SEV-SNP VMs can use the new "Page State Change Request NAE"
> defined in the GHCB specification to ask hypervisor to add or remove page
> from the RMP table.
> 
> Each page assigned to the SEV-SNP VM can either be validated or unvalidated,
> as indicated by the Validated flag in the page's RMP entry. There are two
> approaches that can be taken for the page validation: Pre-validation and
> Lazy Validation.
> 
> Under pre-validation, the pages are validated prior to first use. And under
> lazy validation, pages are validated when first accessed. An access to a
> unvalidated page results in a #VC exception, at which time the exception
> handler may validate the page. Lazy validation requires careful tracking of
> the validated pages to avoid validating the same GPA more than once. The
> recently introduced "Unaccepted" memory type can be used to communicate the
> unvalidated memory ranges to the Guest OS.
> 
> At this time we only support the pre-validation. OVMF detects all the available
> system RAM in the PEI phase. When SEV-SNP is enabled, the memory is validated
> before it is made available to the EDK2 core.
> 
> This series does not implements the following SEV-SNP features yet:
> 
> * CPUID filtering
> * AP bring up using the new SEV-SNP NAE
> * Lazy validation
> * Interrupt security
> 
> The series is based on commit:
> 01c0ab90be (origin/master, origin/HEAD, master) AzurePipelines: Add support for ArmPlatformPkg
> 
> Additional resources
> ---------------------
> SEV-SNP whitepaper
> https://www.amd.com/system/files/TechDocs/SEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more.pdf
> 
> APM 2: https://www.amd.com/system/files/TechDocs/24593.pdf (section 15.36)
> 
> The complete source is available at
> https://github.com/AMDESE/ovmf/tree/sev-snp-rfc-2
> 
> GHCB spec:
> https://developer.amd.com/wp-content/resources/56421.pdf
> 
> SEV-SNP firmware specification:
> https://developer.amd.com/sev/
> 	         
> Cc: James Bottomley <jejb@linux.ibm.com>
> Cc: Min Xu <min.m.xu@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Tom Lendacky <thomas.lendacky@amd.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Erdem Aktas <erdemaktas@google.com>
> 
> Changes since v1:
>  * Drop the interval tree support to detect the pre-validated overlap region.
>  * Use an array to keep track of pre-validated regions.
>  * Add support to query the Hypervisor feature and verify that SNP feature is supported.
>  * Introduce MemEncryptSevClearMmioPageEncMask() to clear the C-bit from MMIO ranges.
>  * Pull the SevSecretDxe and SevSecretPei into OVMF package build.
>  * Extend the SevSecretDxe to expose confidential computing blob location through
>    EFI configuration table.
> 
> Brijesh Singh (28):
>   MdePkg: Expand the SEV MSR to include the SNP definition
>   MdePkg: Define the GHCB Hypervisor features
>   MdePkg: Define the GHCB GPA structure
>   MdePkg: Define the Page State Change VMGEXIT structures
>   MdePkg: Add AsmPvalidate() support
>   OvmfPkg/BaseMemEncryptSevLib: Introduce
>     MemEncryptSevClearMmioPageEncMask()
>   OvmfPkg: Use MemEncryptSevClearMmioPageEncMask() to clear EncMask from
>     Mmio
>   OvmfPkg/BaseMemEncryptSevLib: Remove CacheFlush parameter
>   OvmfPkg/VmgExitLib: Allow PMBASE register access in Dxe phase
>   OvmfPkg/MemEncryptSevLib: add MemEncryptSevSnpEnabled()
>   OvmfPkg: Reserve Secrets page in MEMFD
>   OvmfPkg: Reserve CPUID page for the SEV-SNP guest
>   OvmfPkg: Validate the data pages used in the Reset vector and SEC
>     phase
>   UefiCpuPkg: Define the SEV-SNP specific dynamic PCDs
>   OvmfPkg/MemEncryptSevLib: extend the workarea to include SNP enabled
>     field
>   OvmfPkg/MemEncryptSevLib: Extend Es Workarea to include hv features
>   OvmfPkg/ResetVector: Invalidate the GHCB page
>   OvmfPkg: Add a library to support registering GHCB GPA
>   OvmfPkg: register GHCB gpa for the SEV-SNP guest
>   UefiCpuPkg/MpLib: add support to register GHCB GPA when SEV-SNP is
>     enabled
>   OvmfPkg/MemEncryptSevLib: Add support to validate system RAM
>   OvmfPkg/BaseMemEncryptSevLib: Skip the pre-validated system RAM
>   OvmfPkg/MemEncryptSevLib: Add support to validate > 4GB memory in PEI
>     phase
>   OvmfPkg/SecMain: Pre-validate the memory used for decompressing Fv
>   OvmfPkg/PlatformPei: Validate the system RAM when SNP is active
>   OvmfPkg/MemEncryptSevLib: Change the page state in the RMP table
>   OvmfPkg/AmdSev: Expose the SNP reserved pages through configuration
>     table
>   MdePkg/GHCB: Increase the GHCB protocol max version
> 
>  MdePkg/Include/Library/BaseLib.h              |  37 +++
>  MdePkg/Include/Register/Amd/Fam17Msr.h        |  36 ++-
>  MdePkg/Include/Register/Amd/Ghcb.h            |  37 ++-
>  MdePkg/Library/BaseLib/BaseLib.inf            |   1 +
>  MdePkg/Library/BaseLib/X64/Pvalidate.nasm     |  43 +++
>  OvmfPkg/AmdSev/SecretDxe/SecretDxe.c          |  21 ++
>  OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf        |   4 +
>  OvmfPkg/AmdSev/SecretPei/SecretPei.c          |  16 +-
>  OvmfPkg/AmdSev/SecretPei/SecretPei.inf        |   1 +
>  OvmfPkg/AmdSevDxe/AmdSevDxe.c                 |  13 +-
>  OvmfPkg/FvmainCompactScratchEnd.fdf.inc       |   5 +
>  .../Guid/ConfidentialComputingSecret.h        |  17 ++
>  OvmfPkg/Include/Library/GhcbRegisterLib.h     |  27 ++
>  OvmfPkg/Include/Library/MemEncryptSevLib.h    |  66 ++++-
>  OvmfPkg/IoMmuDxe/AmdSevIoMmu.c                |   6 +-
>  .../DxeMemEncryptSevLib.inf                   |   3 +
>  .../DxeMemEncryptSevLibInternal.c             |  27 ++
>  .../Ia32/MemEncryptSevLib.c                   |  58 +++-
>  .../PeiMemEncryptSevLib.inf                   |   7 +
>  .../PeiMemEncryptSevLibInternal.c             |  27 ++
>  .../SecMemEncryptSevLib.inf                   |   3 +
>  .../SecMemEncryptSevLibInternal.c             |  19 ++
>  .../X64/DxeSnpSystemRamValidate.c             |  40 +++
>  .../X64/MemEncryptSevLib.c                    |  49 +++-
>  .../X64/PeiDxeVirtualMemory.c                 | 203 +++++++++++++-
>  .../X64/PeiSnpSystemRamValidate.c             | 126 +++++++++
>  .../X64/SecSnpSystemRamValidate.c             |  36 +++
>  .../X64/SecVirtualMemory.c                    |   8 +-
>  .../X64/SnpPageStateChange.h                  |  31 +++
>  .../X64/SnpPageStateChangeInternal.c          | 261 ++++++++++++++++++
>  .../BaseMemEncryptSevLib/X64/VirtualMemory.h  |  52 +++-
>  .../Library/GhcbRegisterLib/GhcbRegisterLib.c |  97 +++++++
>  .../GhcbRegisterLib/GhcbRegisterLib.inf       |  33 +++
>  .../SmmCpuFeaturesLib/SmmCpuFeaturesLib.c     |   3 +-
>  OvmfPkg/Library/VmgExitLib/SecVmgExitLib.inf  |   4 +
>  OvmfPkg/Library/VmgExitLib/VmgExitLib.inf     |   7 +
>  OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c |  45 +++
>  OvmfPkg/OvmfPkg.dec                           |  21 ++
>  OvmfPkg/OvmfPkgIa32.dsc                       |   2 +
>  OvmfPkg/OvmfPkgIa32X64.dsc                    |   2 +
>  OvmfPkg/OvmfPkgX64.dsc                        |   3 +
>  OvmfPkg/OvmfPkgX64.fdf                        |  17 +-
>  OvmfPkg/PlatformPei/AmdSev.c                  |  84 +++++-
>  OvmfPkg/PlatformPei/MemDetect.c               |  13 +
>  OvmfPkg/PlatformPei/PlatformPei.inf           |   5 +
>  .../FwBlockServiceDxe.c                       |   5 +-
>  .../QemuFlashSmm.c                            |   5 +-
>  OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm  |  23 ++
>  OvmfPkg/ResetVector/Ia32/PageTables64.asm     | 216 +++++++++++++++
>  OvmfPkg/ResetVector/ResetVector.inf           |   4 +
>  OvmfPkg/ResetVector/ResetVector.nasmb         |   6 +
>  OvmfPkg/Sec/SecMain.c                         | 103 +++++++
>  OvmfPkg/Sec/SecMain.inf                       |   3 +
>  UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf |   1 +
>  UefiCpuPkg/Library/MpInitLib/MpEqu.inc        |   1 +
>  UefiCpuPkg/Library/MpInitLib/MpLib.c          |   2 +
>  UefiCpuPkg/Library/MpInitLib/MpLib.h          |   2 +
>  UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf |   1 +
>  UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm |  51 ++++
>  UefiCpuPkg/UefiCpuPkg.dec                     |  11 +
>  60 files changed, 1970 insertions(+), 80 deletions(-)
>  create mode 100644 MdePkg/Library/BaseLib/X64/Pvalidate.nasm
>  create mode 100644 OvmfPkg/Include/Library/GhcbRegisterLib.h
>  create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemRamValidate.c
>  create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c
>  create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c
>  create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChange.h
>  create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c
>  create mode 100644 OvmfPkg/Library/GhcbRegisterLib/GhcbRegisterLib.c
>  create mode 100644 OvmfPkg/Library/GhcbRegisterLib/GhcbRegisterLib.inf
>