From: "Lendacky, Thomas" <thomas.lendacky@amd.com>
To: Laszlo Ersek <lersek@redhat.com>, devel@edk2.groups.io
Cc: Brijesh Singh <brijesh.singh@amd.com>,
Ard Biesheuvel <ard.biesheuvel@arm.com>,
Eric Dong <eric.dong@intel.com>,
Jordan Justen <jordan.l.justen@intel.com>,
Liming Gao <liming.gao@intel.com>,
Michael D Kinney <michael.d.kinney@intel.com>,
Ray Ni <ray.ni@intel.com>, Andrew Fish <afish@apple.com>,
Anthony Perard <anthony.perard@citrix.com>,
Benjamin You <benjamin.you@intel.com>,
Dandan Bi <dandan.bi@intel.com>, Guo Dong <guo.dong@intel.com>,
Hao A Wu <hao.a.wu@intel.com>,
Jian J Wang <jian.j.wang@intel.com>,
Julien Grall <julien@xen.org>, Leif Lindholm <leif@nuviainc.com>,
Maurice Ma <maurice.ma@intel.com>
Subject: Re: [edk2-devel] [PATCH v12 00/46] SEV-ES guest support
Date: Mon, 27 Jul 2020 12:49:17 -0500 [thread overview]
Message-ID: <3890a4e7-7095-8570-a4b2-8e4cc6116b49@amd.com> (raw)
In-Reply-To: <bd72a972-9f69-05b6-69e2-b55c44fbaa07@redhat.com>
On 7/27/20 12:43 PM, Laszlo Ersek wrote:
> On 07/27/20 19:41, Laszlo Ersek wrote:
>> Hi Tom,
Hi Laszlo,
>>
>> On 07/27/20 17:25, Lendacky, Thomas wrote:
>>> From: Tom Lendacky <thomas.lendacky@amd.com>
>>>
>>> This patch series provides support for running EDK2/OVMF under SEV-ES.
>>>
>>> Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on the
>>> SEV support to protect the guest register state from the hypervisor. See
>>> "AMD64 Architecture Programmer's Manual Volume 2: System Programming",
>>> section "15.35 Encrypted State (SEV-ES)" [1].
>>>
>>> In order to allow a hypervisor to perform functions on behalf of a guest,
>>> there is architectural support for notifying a guest's operating system
>>> when certain types of VMEXITs are about to occur. This allows the guest to
>>> selectively share information with the hypervisor to satisfy the requested
>>> function. The notification is performed using a new exception, the VMM
>>> Communication exception (#VC). The information is shared through the
>>> Guest-Hypervisor Communication Block (GHCB) using the VMGEXIT instruction.
>>> The GHCB format and the protocol for using it is documented in "SEV-ES
>>> Guest-Hypervisor Communication Block Standardization" [2].
>>>
>>> The main areas of the EDK2 code that are updated to support SEV-ES are
>>> around the exception handling support and the AP boot support.
>>>
>>> Exception support is required starting in Sec, continuing through Pei
>>> and into Dxe in order to handle #VC exceptions that are generated. Each
>>> AP requires it's own GHCB page as well as a page to hold values specific
>>> to that AP.
>>>
>>> AP booting poses some interesting challenges. The INIT-SIPI-SIPI sequence
>>> is typically used to boot the APs. However, the hypervisor is not allowed
>>> to update the guest registers. The GHCB document [2] talks about how SMP
>>> booting under SEV-ES is performed.
>>>
>>> Since the GHCB page must be a shared (unencrypted) page, the processor
>>> must be running in long mode in order for the guest and hypervisor to
>>> communicate with each other. As a result, SEV-ES is only supported under
>>> the X64 architecture.
>>>
>>> [1] https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.amd.com%2Fsystem%2Ffiles%2FTechDocs%2F24593.pdf&data=02%7C01%7Cthomas.lendacky%40amd.com%7Cb388414fce2747ca9fef08d832549c1e%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637314686421485283&sdata=q1XqA0IvSWYmCHqRFQ704595cECr6MH6MXIJBoKAkog%3D&reserved=0
>>> [2] https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdeveloper.amd.com%2Fwp-content%2Fresources%2F56421.pdf&data=02%7C01%7Cthomas.lendacky%40amd.com%7Cb388414fce2747ca9fef08d832549c1e%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637314686421485283&sdata=EfLCdVJ9EcGQxBRv79NLLrZ8vyiCxepLbkNM%2FsQMOf0%3D&reserved=0
>>>
>>> ---
>>>
>>> These patches are based on commit:
>>> 6074f57e5b19 ("MdePkg/Include/IndustryStandard: Main CXL header")
>>>
>>> A version of the tree can be found at:
>>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAMDESE%2Fovmf%2Ftree%2Fsev-es-v20&data=02%7C01%7Cthomas.lendacky%40amd.com%7Cb388414fce2747ca9fef08d832549c1e%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637314686421485283&sdata=auEp%2Fd6Ju4V3BYG5UW%2BzwJzDersXm%2BuziQnB%2FPLDnYg%3D&reserved=0
>>>
>>> Cc: Andrew Fish <afish@apple.com>
>>> Cc: Anthony Perard <anthony.perard@citrix.com>
>>> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
>>> Cc: Benjamin You <benjamin.you@intel.com>
>>> Cc: Dandan Bi <dandan.bi@intel.com>
>>> Cc: Eric Dong <eric.dong@intel.com>
>>> Cc: Guo Dong <guo.dong@intel.com>
>>> Cc: Hao A Wu <hao.a.wu@intel.com>
>>> Cc: Jian J Wang <jian.j.wang@intel.com>
>>> Cc: Jordan Justen <jordan.l.justen@intel.com>
>>> Cc: Julien Grall <julien@xen.org>
>>> Cc: Laszlo Ersek <lersek@redhat.com>
>>> Cc: Leif Lindholm <leif@nuviainc.com>
>>> Cc: Liming Gao <liming.gao@intel.com>
>>> Cc: Maurice Ma <maurice.ma@intel.com>
>>> Cc: Michael D Kinney <michael.d.kinney@intel.com>
>>> Cc: Ray Ni <ray.ni@intel.com>
>>>
>>> Changes since v11:
>>> - Make the XGETBV and VMGEXIT .nasm files buildable for all environments
>>> and remove the updates that add these instructions to GccInline.c
>>
>> Patches 40-46 (inclusive) seem to be missing from my mailbox (and the
>> list archive on groups.io lacks them too, apparently).
>>
>> Did you get rate-limited by some component when sending the series, perhaps?
>
> On a second / closer look, that seems quite likely, because my INBOX
> does have all the (directly delivered) patches; only my list folder is
> missing the tail.
Yes, I always get an error when I reach 40 emails:
Reported error: 550 5.0.350 Remote server returned an error -> 500 We have
received more than 40 messages in 30 minutes from you. To guard against
autoresponder mail loops, we must reject additional messages from you
temporarily. Please try again later.
So I usually have to wait a few hours and resend the last ones so they
make it to groups.io.
Thanks,
Tom
>
> Thanks
> Laszlo
>
next prev parent reply other threads:[~2020-07-27 17:49 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-27 15:25 [PATCH v12 00/46] SEV-ES guest support Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 01/46] MdeModulePkg: Create PCDs to be used in support of SEV-ES Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 02/46] UefiCpuPkg: Create PCD " Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 03/46] MdePkg: Add the MSR definition for the GHCB register Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 04/46] MdePkg: Add a structure definition for the GHCB Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 05/46] MdeModulePkg/DxeIplPeim: Support GHCB pages when creating page tables Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 06/46] MdePkg/BaseLib: Add support for the XGETBV instruction Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 07/46] MdePkg/BaseLib: Add support for the VMGEXIT instruction Lendacky, Thomas
2020-07-28 1:34 ` Liming Gao
2020-07-28 4:07 ` Lendacky, Thomas
2020-07-28 7:39 ` Liming Gao
2020-07-28 12:04 ` Laszlo Ersek
2020-07-28 13:44 ` Liming Gao
2020-07-28 14:13 ` Lendacky, Thomas
2020-07-28 15:19 ` Laszlo Ersek
2020-07-29 1:13 ` Liming Gao
2020-07-27 15:25 ` [PATCH v12 08/46] UefiCpuPkg: Implement library support for VMGEXIT Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 09/46] OvmfPkg: Prepare OvmfPkg to use the VmgExitLib library Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 10/46] UefiPayloadPkg: Prepare UefiPayloadPkg " Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 11/46] UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC exception Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 12/46] OvmfPkg/VmgExitLib: Implement library support for VmgExitLib in OVMF Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 13/46] OvmfPkg/VmgExitLib: Add support for IOIO_PROT NAE events Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 14/46] OvmfPkg/VmgExitLib: Support string IO " Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 15/46] OvmfPkg/VmgExitLib: Add support for CPUID " Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 16/46] OvmfPkg/VmgExitLib: Add support for MSR_PROT " Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 17/46] OvmfPkg/VmgExitLib: Add support for NPF NAE events (MMIO) Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 18/46] OvmfPkg/VmgExitLib: Add support for WBINVD NAE events Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 19/46] OvmfPkg/VmgExitLib: Add support for RDTSC " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 20/46] OvmfPkg/VmgExitLib: Add support for RDPMC " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 21/46] OvmfPkg/VmgExitLib: Add support for INVD " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 22/46] OvmfPkg/VmgExitLib: Add support for VMMCALL " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 23/46] OvmfPkg/VmgExitLib: Add support for RDTSCP " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 24/46] OvmfPkg/VmgExitLib: Add support for MONITOR/MONITORX " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 25/46] OvmfPkg/VmgExitLib: Add support for MWAIT/MWAITX " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 26/46] OvmfPkg/VmgExitLib: Add support for DR7 Read/Write " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 27/46] OvmfPkg/MemEncryptSevLib: Add an SEV-ES guest indicator function Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 28/46] OvmfPkg: Add support to perform SEV-ES initialization Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 29/46] OvmfPkg: Create a GHCB page for use during Sec phase Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 30/46] OvmfPkg/PlatformPei: Reserve GHCB-related areas if S3 is supported Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 31/46] OvmfPkg: Create GHCB pages for use during Pei and Dxe phase Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 32/46] OvmfPkg/PlatformPei: Move early GDT into ram when SEV-ES is enabled Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 33/46] UefiCpuPkg: Create an SEV-ES workarea PCD Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 34/46] OvmfPkg: Reserve a page in memory for the SEV-ES usage Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 35/46] OvmfPkg/PlatformPei: Reserve SEV-ES work area if S3 is supported Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 36/46] OvmfPkg/ResetVector: Add support for a 32-bit SEV check Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 37/46] OvmfPkg/Sec: Add #VC exception handling for Sec phase Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 38/46] OvmfPkg/Sec: Enable cache early to speed up booting Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 39/46] OvmfPkg/QemuFlashFvbServicesRuntimeDxe: Bypass flash detection with SEV-ES Lendacky, Thomas
2020-07-27 17:41 ` [edk2-devel] [PATCH v12 00/46] SEV-ES guest support Laszlo Ersek
2020-07-27 17:43 ` Laszlo Ersek
2020-07-27 17:49 ` Lendacky, Thomas [this message]
2020-07-28 10:07 ` Laszlo Ersek
2020-07-28 12:52 ` Lendacky, Thomas
2020-07-28 13:59 ` Laszlo Ersek
2020-07-27 18:43 ` [PATCH v12 40/46] UefiCpuPkg: Add a 16-bit protected mode code segment descriptor Lendacky, Thomas
2020-07-27 18:43 ` [PATCH v12 41/46] UefiCpuPkg/MpInitLib: Add CPU MP data flag to indicate if SEV-ES is enabled Lendacky, Thomas
2020-07-27 18:43 ` [PATCH v12 42/46] UefiCpuPkg: Allow AP booting under SEV-ES Lendacky, Thomas
2020-07-27 18:43 ` [PATCH v12 43/46] OvmfPkg: Use the SEV-ES work area for the SEV-ES AP reset vector Lendacky, Thomas
2020-07-27 18:43 ` [PATCH v12 44/46] OvmfPkg: Move the GHCB allocations into reserved memory Lendacky, Thomas
2020-07-27 18:43 ` [PATCH v12 45/46] UefiCpuPkg/MpInitLib: Prepare SEV-ES guest APs for OS use Lendacky, Thomas
2020-07-27 18:43 ` [PATCH v12 46/46] Maintainers.txt: Add reviewers for the OvmfPkg SEV-related files Lendacky, Thomas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3890a4e7-7095-8570-a4b2-8e4cc6116b49@amd.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox