From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.groups.io with SMTP id smtpd.web09.178.1619801383797555600 for ; Fri, 30 Apr 2021 09:49:44 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=HjjSN7k/; spf=pass (domain: redhat.com, ip: 170.10.133.124, mailfrom: lersek@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1619801383; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=F9tUl5mZWY0R5+D5Y6S3pZo08oTQmkSWIL68MaWnvyA=; b=HjjSN7k/OkY+IBP+OMoRLHpIRrdSh7PiPbMu20aU6KUCmFF9cwoFVgChzgO4S3FCKp+rsb vKTA94fT8UtgOgKtfFc9IvHNO6DYkvmkb1NsJKBfqtRxodLhSqMvKpKGJ4IY9jmrGXu4/K vFcaDIb+XktPhiAYKTjOCHURvQrj6yU= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-490--PJ9-3BjPyKM8j7AZahcvA-1; Fri, 30 Apr 2021 12:49:39 -0400 X-MC-Unique: -PJ9-3BjPyKM8j7AZahcvA-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id C1D4D107ACE4; Fri, 30 Apr 2021 16:49:37 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-112-248.ams2.redhat.com [10.36.112.248]) by smtp.corp.redhat.com (Postfix) with ESMTP id 87FB319C66; Fri, 30 Apr 2021 16:49:35 +0000 (UTC) Subject: Re: [edk2-devel] [PATCH RFC v2 00/28] Add AMD Secure Nested Paging (SEV-SNP) support To: devel@edk2.groups.io, brijesh.singh@amd.com Cc: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas References: <20210430115148.22267-1-brijesh.singh@amd.com> From: "Laszlo Ersek" Message-ID: <345e8bd4-ec38-430c-a361-3045601ba143@redhat.com> Date: Fri, 30 Apr 2021 18:49:34 +0200 MIME-Version: 1.0 In-Reply-To: <20210430115148.22267-1-brijesh.singh@amd.com> X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=lersek@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Hi, On 04/30/21 13:51, Brijesh Singh wrote: > BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3275 > > SEV-SNP builds upon existing SEV and SEV-ES functionality while adding > new hardware-based memory protections. SEV-SNP adds strong memory integrity > protection to help prevent malicious hypervisor-based attacks like data > replay, memory re-mapping and more in order to create an isolated memory > encryption environment. > > This series provides the basic building blocks to support booting the SEV-SNP > VMs, it does not cover all the security enhancement introduced by the SEV-SNP > such as interrupt protection. I've added this to my review queue. Thanks Laszlo > > Many of the integrity guarantees of SEV-SNP are enforced through a new > structure called the Reverse Map Table (RMP). Adding a new page to SEV-SNP > VM requires a 2-step process. First, the hypervisor assigns a page to the > guest using the new RMPUPDATE instruction. This transitions the page to > guest-invalid. Second, the guest validates the page using the new PVALIDATE > instruction. The SEV-SNP VMs can use the new "Page State Change Request NAE" > defined in the GHCB specification to ask hypervisor to add or remove page > from the RMP table. > > Each page assigned to the SEV-SNP VM can either be validated or unvalidated, > as indicated by the Validated flag in the page's RMP entry. There are two > approaches that can be taken for the page validation: Pre-validation and > Lazy Validation. > > Under pre-validation, the pages are validated prior to first use. And under > lazy validation, pages are validated when first accessed. An access to a > unvalidated page results in a #VC exception, at which time the exception > handler may validate the page. Lazy validation requires careful tracking of > the validated pages to avoid validating the same GPA more than once. The > recently introduced "Unaccepted" memory type can be used to communicate the > unvalidated memory ranges to the Guest OS. > > At this time we only support the pre-validation. OVMF detects all the available > system RAM in the PEI phase. When SEV-SNP is enabled, the memory is validated > before it is made available to the EDK2 core. > > This series does not implements the following SEV-SNP features yet: > > * CPUID filtering > * AP bring up using the new SEV-SNP NAE > * Lazy validation > * Interrupt security > > The series is based on commit: > 01c0ab90be (origin/master, origin/HEAD, master) AzurePipelines: Add support for ArmPlatformPkg > > Additional resources > --------------------- > SEV-SNP whitepaper > https://www.amd.com/system/files/TechDocs/SEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more.pdf > > APM 2: https://www.amd.com/system/files/TechDocs/24593.pdf (section 15.36) > > The complete source is available at > https://github.com/AMDESE/ovmf/tree/sev-snp-rfc-2 > > GHCB spec: > https://developer.amd.com/wp-content/resources/56421.pdf > > SEV-SNP firmware specification: > https://developer.amd.com/sev/ > > Cc: James Bottomley > Cc: Min Xu > Cc: Jiewen Yao > Cc: Tom Lendacky > Cc: Jordan Justen > Cc: Ard Biesheuvel > Cc: Laszlo Ersek > Cc: Erdem Aktas > > Changes since v1: > * Drop the interval tree support to detect the pre-validated overlap region. > * Use an array to keep track of pre-validated regions. > * Add support to query the Hypervisor feature and verify that SNP feature is supported. > * Introduce MemEncryptSevClearMmioPageEncMask() to clear the C-bit from MMIO ranges. > * Pull the SevSecretDxe and SevSecretPei into OVMF package build. > * Extend the SevSecretDxe to expose confidential computing blob location through > EFI configuration table. > > Brijesh Singh (28): > MdePkg: Expand the SEV MSR to include the SNP definition > MdePkg: Define the GHCB Hypervisor features > MdePkg: Define the GHCB GPA structure > MdePkg: Define the Page State Change VMGEXIT structures > MdePkg: Add AsmPvalidate() support > OvmfPkg/BaseMemEncryptSevLib: Introduce > MemEncryptSevClearMmioPageEncMask() > OvmfPkg: Use MemEncryptSevClearMmioPageEncMask() to clear EncMask from > Mmio > OvmfPkg/BaseMemEncryptSevLib: Remove CacheFlush parameter > OvmfPkg/VmgExitLib: Allow PMBASE register access in Dxe phase > OvmfPkg/MemEncryptSevLib: add MemEncryptSevSnpEnabled() > OvmfPkg: Reserve Secrets page in MEMFD > OvmfPkg: Reserve CPUID page for the SEV-SNP guest > OvmfPkg: Validate the data pages used in the Reset vector and SEC > phase > UefiCpuPkg: Define the SEV-SNP specific dynamic PCDs > OvmfPkg/MemEncryptSevLib: extend the workarea to include SNP enabled > field > OvmfPkg/MemEncryptSevLib: Extend Es Workarea to include hv features > OvmfPkg/ResetVector: Invalidate the GHCB page > OvmfPkg: Add a library to support registering GHCB GPA > OvmfPkg: register GHCB gpa for the SEV-SNP guest > UefiCpuPkg/MpLib: add support to register GHCB GPA when SEV-SNP is > enabled > OvmfPkg/MemEncryptSevLib: Add support to validate system RAM > OvmfPkg/BaseMemEncryptSevLib: Skip the pre-validated system RAM > OvmfPkg/MemEncryptSevLib: Add support to validate > 4GB memory in PEI > phase > OvmfPkg/SecMain: Pre-validate the memory used for decompressing Fv > OvmfPkg/PlatformPei: Validate the system RAM when SNP is active > OvmfPkg/MemEncryptSevLib: Change the page state in the RMP table > OvmfPkg/AmdSev: Expose the SNP reserved pages through configuration > table > MdePkg/GHCB: Increase the GHCB protocol max version > > MdePkg/Include/Library/BaseLib.h | 37 +++ > MdePkg/Include/Register/Amd/Fam17Msr.h | 36 ++- > MdePkg/Include/Register/Amd/Ghcb.h | 37 ++- > MdePkg/Library/BaseLib/BaseLib.inf | 1 + > MdePkg/Library/BaseLib/X64/Pvalidate.nasm | 43 +++ > OvmfPkg/AmdSev/SecretDxe/SecretDxe.c | 21 ++ > OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf | 4 + > OvmfPkg/AmdSev/SecretPei/SecretPei.c | 16 +- > OvmfPkg/AmdSev/SecretPei/SecretPei.inf | 1 + > OvmfPkg/AmdSevDxe/AmdSevDxe.c | 13 +- > OvmfPkg/FvmainCompactScratchEnd.fdf.inc | 5 + > .../Guid/ConfidentialComputingSecret.h | 17 ++ > OvmfPkg/Include/Library/GhcbRegisterLib.h | 27 ++ > OvmfPkg/Include/Library/MemEncryptSevLib.h | 66 ++++- > OvmfPkg/IoMmuDxe/AmdSevIoMmu.c | 6 +- > .../DxeMemEncryptSevLib.inf | 3 + > .../DxeMemEncryptSevLibInternal.c | 27 ++ > .../Ia32/MemEncryptSevLib.c | 58 +++- > .../PeiMemEncryptSevLib.inf | 7 + > .../PeiMemEncryptSevLibInternal.c | 27 ++ > .../SecMemEncryptSevLib.inf | 3 + > .../SecMemEncryptSevLibInternal.c | 19 ++ > .../X64/DxeSnpSystemRamValidate.c | 40 +++ > .../X64/MemEncryptSevLib.c | 49 +++- > .../X64/PeiDxeVirtualMemory.c | 203 +++++++++++++- > .../X64/PeiSnpSystemRamValidate.c | 126 +++++++++ > .../X64/SecSnpSystemRamValidate.c | 36 +++ > .../X64/SecVirtualMemory.c | 8 +- > .../X64/SnpPageStateChange.h | 31 +++ > .../X64/SnpPageStateChangeInternal.c | 261 ++++++++++++++++++ > .../BaseMemEncryptSevLib/X64/VirtualMemory.h | 52 +++- > .../Library/GhcbRegisterLib/GhcbRegisterLib.c | 97 +++++++ > .../GhcbRegisterLib/GhcbRegisterLib.inf | 33 +++ > .../SmmCpuFeaturesLib/SmmCpuFeaturesLib.c | 3 +- > OvmfPkg/Library/VmgExitLib/SecVmgExitLib.inf | 4 + > OvmfPkg/Library/VmgExitLib/VmgExitLib.inf | 7 + > OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 45 +++ > OvmfPkg/OvmfPkg.dec | 21 ++ > OvmfPkg/OvmfPkgIa32.dsc | 2 + > OvmfPkg/OvmfPkgIa32X64.dsc | 2 + > OvmfPkg/OvmfPkgX64.dsc | 3 + > OvmfPkg/OvmfPkgX64.fdf | 17 +- > OvmfPkg/PlatformPei/AmdSev.c | 84 +++++- > OvmfPkg/PlatformPei/MemDetect.c | 13 + > OvmfPkg/PlatformPei/PlatformPei.inf | 5 + > .../FwBlockServiceDxe.c | 5 +- > .../QemuFlashSmm.c | 5 +- > OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 23 ++ > OvmfPkg/ResetVector/Ia32/PageTables64.asm | 216 +++++++++++++++ > OvmfPkg/ResetVector/ResetVector.inf | 4 + > OvmfPkg/ResetVector/ResetVector.nasmb | 6 + > OvmfPkg/Sec/SecMain.c | 103 +++++++ > OvmfPkg/Sec/SecMain.inf | 3 + > UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf | 1 + > UefiCpuPkg/Library/MpInitLib/MpEqu.inc | 1 + > UefiCpuPkg/Library/MpInitLib/MpLib.c | 2 + > UefiCpuPkg/Library/MpInitLib/MpLib.h | 2 + > UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf | 1 + > UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm | 51 ++++ > UefiCpuPkg/UefiCpuPkg.dec | 11 + > 60 files changed, 1970 insertions(+), 80 deletions(-) > create mode 100644 MdePkg/Library/BaseLib/X64/Pvalidate.nasm > create mode 100644 OvmfPkg/Include/Library/GhcbRegisterLib.h > create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemRamValidate.c > create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c > create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c > create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChange.h > create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c > create mode 100644 OvmfPkg/Library/GhcbRegisterLib/GhcbRegisterLib.c > create mode 100644 OvmfPkg/Library/GhcbRegisterLib/GhcbRegisterLib.inf >