From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM11-BN8-obe.outbound.protection.outlook.com (NAM11-BN8-obe.outbound.protection.outlook.com [40.107.236.87]) by mx.groups.io with SMTP id smtpd.web08.65835.1638213701849893967 for ; Mon, 29 Nov 2021 11:21:42 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@amd.com header.s=selector1 header.b=yWYctY0a; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.236.87, mailfrom: brijesh.singh@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=JSkEGJNYOMiiHnNplA13z4mx52zSPjGCpN3rBNIC16JMvTtNcj1o7XzMaFXrswlrvymWekhtGCwQZEjCHctGR9LvIDnzrmlk3ZRhTSHdt4Aocqf0l+qSEhW9QAzwq+ENPfUbdhUD4r3MAT1OWAUXUpePHIRX3NHE+1mCUFotK5qM/PTiXokn43hV9UblNaRqVRx5DyRHz/g8V87qZItXR2UJ6QQlETYxQzko7lBzPKhgWK1abCPusjgpSam8HnISxOkteDKNQDKiR67xrQc3DPkfW3Z0A8H6X6TYH6OvjJShalSKR+fAGCg3JUz0D/vjS7a+VdyQFgzNOpzuxJ2iuQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=x/BwuoU3zdKYMIs47gsubuUDg62hjR1IzZlPcWNfrAs=; b=XfIo+5Alh/dxposjF+deUdXDkMwuUD52HbU09zz1Gvkb2BqAJfP/bpOO6XutfyOuwIf3faMUrDWHGKjKFHqCjpSzsFwncPnDZ34KqRB42pAapXRNH+K7+T0AYGoyEiTKC+IO2FenlPag61y+AeQb0uqiNrWdE1sRIQUNEl9GTVYEL0dYM5lhDQJTtm2W4ZuLIBnpy4sYiYQeGHbX5UJwWkwx8SFBzexiR2sgROM1E6VyacFSNx4hyyNjf2b3rOaKCn9r7a/ViTuC0BsrGiQvTbs7yFovSLpvOSk5QSgkMVZgplurA4a0cVCt8HVbh1xK103Uq4xNhPrzqVRFFBR8Sg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=x/BwuoU3zdKYMIs47gsubuUDg62hjR1IzZlPcWNfrAs=; b=yWYctY0aJoeKZiOu0a91YxIVoNZlGIVTOyezJK6o7Spwg8OQnAq8/+miawIc2Fiu5MXn3XHkCWGhjdojSAfF1tj/10akSHaRoe7o3Yq45eVIwkJdXhBpC1i/NTULCOVrEnL6cSgL7notsoIcBSnhPgoizzCkeqcE0rknab/2y24= Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SN1PR12MB2414.namprd12.prod.outlook.com (2603:10b6:802:2e::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.22; Mon, 29 Nov 2021 19:21:39 +0000 Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::35:281:b7f8:ed4c]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::35:281:b7f8:ed4c%5]) with mapi id 15.20.4734.024; Mon, 29 Nov 2021 19:21:39 +0000 Cc: brijesh.singh@amd.com, James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Michael D Kinney , Liming Gao , Zhiguang Liu , Ray Ni , Rahul Kumar , Eric Dong Subject: Re: [edk2-devel] [PATCH v13 00/32] Add AMD Secure Nested Paging (SEV-SNP) support To: devel@edk2.groups.io References: <20211112173959.2505972-1-brijesh.singh@amd.com> <16BB21DA37CA6E86.23256@groups.io> From: "Brijesh Singh" Message-ID: <556749a0-d4a4-1c0d-9e34-22c1393dc12b@amd.com> Date: Mon, 29 Nov 2021 13:21:35 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.13.0 In-Reply-To: <16BB21DA37CA6E86.23256@groups.io> X-ClientProxiedBy: BL1PR13CA0068.namprd13.prod.outlook.com (2603:10b6:208:2b8::13) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) Return-Path: brijesh.singh@amd.com MIME-Version: 1.0 Received: from [10.236.30.107] (165.204.77.1) by BL1PR13CA0068.namprd13.prod.outlook.com (2603:10b6:208:2b8::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4755.8 via Frontend Transport; Mon, 29 Nov 2021 19:21:37 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 7da26c8d-2b17-4935-c1fd-08d9b36d778a X-MS-TrafficTypeDiagnostic: SN1PR12MB2414: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: TYmC8CuRR8SPpZwkZeYtuMTlGYXfafsv47jOzXFjuEbniKmtiTgzUUbOvnRvWICGuk9QZkAHxyG/DBW4z8orPauv9ReUdszcwZTr/kZkQNIq4/NzWKrolFKMcK0qw8/1Q62xvqOr75dO8kGLO0c2oxXgmmp/kfUvjTBao7jtf19g0ZS5zjYd1N7F9gRaPe/TZJGi8YKb/vJoGdN2SrhpiY6T/HOug9OOYpnN2RcL7Oj5Yd6jA1m5jfGum77hu8LUpIdua+H/Xx0JHdYvH/mFAvKClNhYjxlB9o2tCPnxDcJZXpn2bHlHpYSOQMnrkovrDWihFZN6O8SLIPBFkXC3rwCWz5HuHZ8y/vNo4bq+pLwi0wkchqADHpRNH1iDNX4ihnwxGcX2q06w6jIGNbcNjLp44FvUw+heNyPXekcnSzkFJZ/R6CDpF59pdjpNCuRMshNfV1gzV7fVUSMQUwC4zuhQd+AyP0rjhxPhax4pTOs6x39NPDwbqjh3GdnfhJwy0d6/tUui3hd/I0IDKZLGhmweNO42Kgutk6VPRA59NxpzWVOReijspn55tkKTN2UamR6v2QVPn7fCGlTqosuGwiSskwKYOlOE2GQ+fw2vmU8tyjSZ95jGbywqw2PsdHJIrDn7vLKNisDiivgSXbmUsE3zvU72QuNSO1vAgO60sNjeUrx6/gDQ6sG2qNh1E83AgNNYhgK0MxhngVPUKvGK1HXr2qKjbjkdljRrrzC4nx8EZIaaZpxT9uDo/Jy9ECgz2CczEm5bXOCw1mhECRl+PpPLrVf0Tg62PJn2HX4BHnN/cy/4yOecuI4kqlZzQ8lgaDDwWhkYjRHYrIUMbHv67BPdZ693hnrnMOXHRZ2HjxE= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2718.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(5660300002)(54906003)(86362001)(19627235002)(8936002)(2906002)(66946007)(16576012)(316002)(8676002)(956004)(30864003)(6916009)(6486002)(4326008)(66556008)(66476007)(53546011)(966005)(45080400002)(83380400001)(186003)(38100700002)(31686004)(2616005)(26005)(508600001)(7416002)(36756003)(31696002)(44832011)(43740500002)(45980500001);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?VGJQd2tiRjZWNE84ZHpEeWZzN0JoYXRVd0RPaHFCcyswKzd4UnlwalBaajV4?= =?utf-8?B?UFF4b1RSTXFPdDF1ZlVtQnd5a2hyay9mUVNhOXFTQytmOXVYNVF6Z25UNVM1?= =?utf-8?B?TlZsOUVKRDZrczg1TmY4c2xFS1NGNnNQcEVyczJQMXpzMDBYMGFLZzlLbFh4?= =?utf-8?B?dHJqdXlMRU90bjh0U2dvVDBSNm8zazE0Zjg1VWlGUER1dXF2MDh6Z1A0akxs?= =?utf-8?B?TUxqVWlFdXYrNDNPQkZHQmE1dWlLNFFCQm1Cc01ibGtNMStKeklWTU1UbzBY?= =?utf-8?B?VmhjaXFVblpwb3plV0prRk92R2ZCWmpwNTQvWmxIT2cxaG9xWjRjQkdncFhJ?= =?utf-8?B?eVF3TlJBSGNpVkNDNlFlUDZqYVNsTk4zd3I1RGhMc3hQaXpPTE1GZWFQTjlO?= =?utf-8?B?UGdDSnR1NWVKc0h2eGV4UHRrRXlvMTQ1aEtUQXRPWmNTSDh2Z1VLTU9yT3c3?= =?utf-8?B?eThzWHR2Ulg1c2xEVXp6TjlIaCt4aUtkN3FvTmtjeEs3YXNyWE1lM3dENzBH?= =?utf-8?B?TCt6U1Z5eE5oSjRkM01xLzMvNmJZL0pXckhIVG8rTnoyTHIybHJGakNVcnVq?= =?utf-8?B?RWJIbTJrRzRPRGNKRjFsdmpoVFJtN010R3NiY2lEaSs1SFJQWFUzZGJDTHA0?= =?utf-8?B?NWtSOERpK2UyZ3F4dWkrd283bkhFNTFxRDRacy9USWx3SDEyZ3NJVmtSTHpl?= =?utf-8?B?T1NhQTlrYklDcFJuUmU1enNxdDkweUtCQlk1emdpSFJab1hzb21kSmJaMHZo?= =?utf-8?B?T0RiQnNSbWp4VndCRnJzVUpBMFRtNTNNSUd2Y1hmSk8vVGdLRzNFRzRUdjRM?= =?utf-8?B?Rmx1YXRIUTBvb1hlcUJwUGZOMUdGL0o3bEJZRXI2SzdBWU9KcXFCVlBlelRm?= =?utf-8?B?Z1dNbkxIaXRpQmMrK2xhV2dkcXFZOWwxdTFoVEtCOHRUcGRsaUU2WnNMYVQr?= =?utf-8?B?Q2pQWXczWExURzlKUEcvZkJvOWxCN0JFQ0czSEdxSVdiN3d3SHdFb3hYdFl5?= =?utf-8?B?K05mSTdPVHR4SHdHSkRrcDAzL3h6WWFJTWtlUlZyS0llRG44SnZJVzNoYlNs?= =?utf-8?B?czNmYWxEbGFMTHV3cVRaMzN2Qm12VVVKOFQwOGJjV1MreG5xSm9PZUJuYk45?= =?utf-8?B?L1hZbWNMNHhTdkdlZ1c5SEdoN3E0WFZsc0ZzUzk4Y2tlRFVwYVlQMHFpaVJI?= =?utf-8?B?WlplMjJZUjBJMW4ycmxhWmM4SllxamV0WWR2Q0xSQkZvZ1Foa2h5WmIzY2tV?= =?utf-8?B?QXZ3Q2MyUGJEdTZ1dlV4TmVadFE3azVrSXEzb3hkc0lvZ09kQ2V0dWs4OG4x?= =?utf-8?B?TWFJbjBlUjZqdTAwdTlCQXVGKzZGSUtXWkNRMHhVWUwxU3BFbGlBWUxPZmpH?= =?utf-8?B?L3JvVjVqdDVZSFBtOGs0TlB3MHFOZDQwejRGWjlBNG9NNG9mNW5sazRDTXhB?= =?utf-8?B?WEk1V2h6ajJJcHkzV1Y5Y3Z5OHF3VHV2TnZVZFV2QWRaaWVDS1JXTEpJSE85?= =?utf-8?B?MkE3M29nZ3JuQzJDRnpnTFMwQmRUQzRMYnd0SGs0QTh6MHJEVThVanRuWlRF?= =?utf-8?B?clFiZ2lYczV3aWs3enplMDNkR2g4ZTZzWjhnS0VsM0JiT0RPSUkxRXpKUTQ1?= =?utf-8?B?SUx2V1dQcVVUSnorYWllNTU3S1RvQVZ2dnZ5VmpFSnBIZDl5U0c0Tnk0V3BG?= =?utf-8?B?dm5DcC9nOEZIS1JWaGM4SUFjWmNxRFdvNDdKVmh0M3N2SHhpeEZTTWNvMmJp?= =?utf-8?B?N1B0N2ltSFFGTWR2SWZlNk1hOXdCOEFZdHd3aEkvSmNJWG05aGM2UE1TdmIx?= =?utf-8?B?aENYeWRPZE43QndtQk55SXlXTXQ2MUlKM0xzemg4Z0NJQXVGbG4yNm83Umhp?= =?utf-8?B?TjlRZ0NPYVdOazgxUDd4cXVQdnkvT3ltR2JMcHo3bm1aL2haM3hqSHNlbGMw?= =?utf-8?B?T21nS3JEbzgzczVhYkR1ZkhYdmRMeHhUMVZQK2FxYWFidC9JaFFzTHBVdTgr?= =?utf-8?B?UFNLeDZQMmpkNGp4ZDhQVTJabXQrRC9OMTFGRWI3UzBrekI1ZG1wb0gySm9z?= =?utf-8?B?VG1IRElUWWdpNmZGaHN2bXhEVE9kbXMvOHZHc21oNm1hT3lrb1BpL3RFczJr?= =?utf-8?B?eThpaVhSTjdYcXF4UmRZS0hDa1NUd1ZPU1ZzMVNWQkhqbE1IaXo2ZnU3ZzVO?= =?utf-8?Q?j4FggoowmEGIJsp2jpx0JTc=3D?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7da26c8d-2b17-4935-c1fd-08d9b36d778a X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Nov 2021 19:21:39.0813 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Ei8R1I4La8edYdxjIi85fFTe8nF3z4GiT5YMUpPpFDu3zluIRjTPFyAIlb9CWtaOoaPcrofWFSzF3X0Tld/6hQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB2414 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Hi Edk2 Maintainers, The SNP support development finished almost two months ago. I have addressed all the feedback from the Ovmf maintainer, and the patches are ready to be merged. We are waiting for UefiCpuPkg maintainers to ack the patches as it touches a few areas in the EDK2 core. As defined, I've been following the edk2 process; I have kept sending the gentle ping one after another every other week without results. As a contributor, I am not sure what I am missing. Can I ask ovmf maintainer to reach out directly to UefiCpuPkg maintainer to understand what is blocking? Other cleanups/optimization depends on this series; I would like to keep improving the code and make OVMF ready for the confidential computing use case and not be discouraged by the lack of responses. Thanks Brijesh On 11/26/21 9:21 AM, Brijesh Singh via groups.io wrote: > Hi Ray, > > Can you please ack the remaining patches so that it can be merged? > > thanks > > On 11/12/21 11:39 AM, Brijesh Singh wrote: >> --------------------------------------------------------------------------- >> Hi Ray, >> >> Thanks for your reviews and continuous support; I have updated a couple of patches >> to address your comment. As I said in my previous reply, I will working on a >> follow-up series to group some of those Sev specific variables in CpuData. >> >> I hope that is okay with you. >> >> thanks >> ---------------------------------------------------------------------------- >> >> BZ: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D3275&data=04%7C01%7Cbrijesh.singh%40amd.com%7C12c8f5b9e6e74f316eb808d9b0f079b0%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637735371437948485%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=MaxkCh6bBq%2BxjR3c7YBaczFmSBNlp6CJfsM6UKEl%2BdE%3D&reserved=0 >> >> SEV-SNP builds upon existing SEV and SEV-ES functionality while adding >> new hardware-based memory protections. SEV-SNP adds strong memory integrity >> protection to help prevent malicious hypervisor-based attacks like data >> replay, memory re-mapping and more in order to create an isolated memory >> encryption environment. >> >> This series provides the basic building blocks to support booting the SEV-SNP >> VMs, it does not cover all the security enhancement introduced by the SEV-SNP >> such as interrupt protection. >> >> Many of the integrity guarantees of SEV-SNP are enforced through a new >> structure called the Reverse Map Table (RMP). Adding a new page to SEV-SNP >> VM requires a 2-step process. First, the hypervisor assigns a page to the >> guest using the new RMPUPDATE instruction. This transitions the page to >> guest-invalid. Second, the guest validates the page using the new PVALIDATE >> instruction. The SEV-SNP VMs can use the new "Page State Change Request NAE" >> defined in the GHCB specification to ask hypervisor to add or remove page >> from the RMP table. >> >> Each page assigned to the SEV-SNP VM can either be validated or unvalidated, >> as indicated by the Validated flag in the page's RMP entry. There are two >> approaches that can be taken for the page validation: Pre-validation and >> Lazy Validation. >> >> Under pre-validation, the pages are validated prior to first use. And under >> lazy validation, pages are validated when first accessed. An access to a >> unvalidated page results in a #VC exception, at which time the exception >> handler may validate the page. Lazy validation requires careful tracking of >> the validated pages to avoid validating the same GPA more than once. The >> recently introduced "Unaccepted" memory type can be used to communicate the >> unvalidated memory ranges to the Guest OS. >> >> At this time we only support the pre-validation. OVMF detects all the available >> system RAM in the PEI phase. When SEV-SNP is enabled, the memory is validated >> before it is made available to the EDK2 core. >> >> Now that series contains all the basic support required to launch SEV-SNP >> guest. We are still missing the Interrupt security feature provided by the >> SNP. The feature will be added after the base support is accepted. >> >> Additional resources >> --------------------- >> SEV-SNP whitepaper >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.amd.com%2Fsystem%2Ffiles%2FTechDocs%2FSEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more.pdf&data=04%7C01%7Cbrijesh.singh%40amd.com%7C12c8f5b9e6e74f316eb808d9b0f079b0%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637735371437948485%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=IscTAPfML8wT7L37UY7xZWLU7sINgvcw3dTAn1ge0I8%3D&reserved=0 >> >> APM 2: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.amd.com%2Fsystem%2Ffiles%2FTechDocs%2F24593.pdf&data=04%7C01%7Cbrijesh.singh%40amd.com%7C12c8f5b9e6e74f316eb808d9b0f079b0%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637735371437948485%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=nnxB790ZvinJeAL2FDhi2VvHDbdSXAtyJNhWMcY%2F6cg%3D&reserved=0 (section 15.36) >> >> The complete source is available at >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAMDESE%2Fovmf%2Ftree%2Fsnp-v13&data=04%7C01%7Cbrijesh.singh%40amd.com%7C12c8f5b9e6e74f316eb808d9b0f079b0%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637735371437948485%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=3KQX6nOiXKGba16EarC%2FGBv%2B5qb5DoqyZ5PwQoKzqVM%3D&reserved=0 >> >> GHCB spec: >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdeveloper.amd.com%2Fwp-content%2Fresources%2F56421.pdf&data=04%7C01%7Cbrijesh.singh%40amd.com%7C12c8f5b9e6e74f316eb808d9b0f079b0%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637735371437948485%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=lruiWt%2FKo2q%2FO6YEvOuEYPLcIikoKM3xkJndZP9ri8M%3D&reserved=0 >> >> SEV-SNP firmware specification: >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.amd.com%2Fsystem%2Ffiles%2FTechDocs%2F56860.pdf&data=04%7C01%7Cbrijesh.singh%40amd.com%7C12c8f5b9e6e74f316eb808d9b0f079b0%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637735371437948485%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=gM6YIvx3LyH98I0jBEb2RFh7Vv1NAgyxd3td6wcwyAI%3D&reserved=0 >> >> Change since v12: >> * MpLib: Add comment to clarify that SEV-SNP enabled implicitly means SEV and SEV-ES are active. >> * MpLib: Move the extended topology initialization in AmdSev.c >> >> Change since v11: >> * rebase to the latest >> * fix the UefiCpuPkg PCD definition patch header. >> >> Change since v10: >> * fix 'unresolved external symbol __allshl' link error when building I32 for VS2017. >> >> Changes since v9: >> * Move CCAttrs Pcd define in MdePkg >> * Add comment to indicate that allocating the identity map PT is temporary until we get lazy validation >> >> Changes since v8: >> * drop the generic metadata and make it specific to SEV. >> >> Changes since v7: >> * Move SEV specific changes in MpLib in AmdSev file >> * Update the GHCB register function to not restore the GHCB MSR because >> we were already in the MSR protocol mode. >> * Drop the SNP name from PcdSnpSecPreValidate. >> * Add new section for GHCB memory in the OVMF metadata. >> >> Change since v6: >> * Drop the SNP boot block GUID and switch to using the Metadata guided structure >> proposed by Min in TDX series. >> * Exclude the GHCB page from the pre-validated region. It simplifies the reset >> vector code where we do not need to unvalidate the GHCB page. >> * Now that GHCB page is not validated so move the VMPL check from reset vector >> code to the MemEncryptSevLib on the first page validation. >> * Introduce the ConfidentialComputingGuestAttr PCD to communicate which >> memory encryption is active so that MpInitLib can make use of it. >> * Drop the SEVES specific PCD as the information can be communicated via >> the ConfidentialComputingGuestAttr. >> * Move the SNP specific AP creation function in AmdSev.c. >> * Define the SNP Blob GUID in a new file. >> >> Change since v5: >> * When possible use the CPUID value from CPUID page >> * Move the SEV specific functions from SecMain.c in AmdSev.c >> * Rebase to the latest code >> * Add the review feedback from Yao. >> >> Change since v4: >> * Use the correct MSR for the SEV_STATUS >> * Add VMPL-0 check >> >> Change since v3: >> * ResetVector: move all SEV specific code in AmdSev.asm and add macros to keep >> the code readable. >> * Drop extending the EsWorkArea to contain SNP specific state. >> * Drop the GhcbGpa library and call the VmgExit directly to register GHCB GPA. >> * Install the CC blob config table from AmdSevDxe instead of extending the >> AmdSev/SecretsDxe for it. >> * Add the separate PCDs for the SNP Secrets. >> >> Changes since v2: >> * Add support for the AP creation. >> * Use the module-scoping override to make AmdSevDxe use the IO port for PCI reads. >> * Use the reserved memory type for CPUID and Secrets page. >> * >> Changes since v1: >> * Drop the interval tree support to detect the pre-validated overlap region. >> * Use an array to keep track of pre-validated regions. >> * Add support to query the Hypervisor feature and verify that SNP feature is supported. >> * Introduce MemEncryptSevClearMmioPageEncMask() to clear the C-bit from MMIO ranges. >> * Pull the SevSecretDxe and SevSecretPei into OVMF package build. >> * Extend the SevSecretDxe to expose confidential computing blob location through >> EFI configuration table. >> >> Brijesh Singh (28): >> OvmfPkg/SecMain: move SEV specific routines in AmdSev.c >> UefiCpuPkg/MpInitLib: move SEV specific routines in AmdSev.c >> OvmfPkg/ResetVector: move clearing GHCB in SecMain >> OvmfPkg/ResetVector: introduce SEV metadata descriptor for VMM use >> OvmfPkg: reserve SNP secrets page >> OvmfPkg: reserve CPUID page >> OvmfPkg/ResetVector: pre-validate the data pages used in SEC phase >> OvmfPkg/MemEncryptSevLib: add MemEncryptSevSnpEnabled() >> OvmfPkg/SecMain: register GHCB gpa for the SEV-SNP guest >> OvmfPkg/PlatformPei: register GHCB gpa for the SEV-SNP guest >> OvmfPkg/AmdSevDxe: do not use extended PCI config space >> OvmfPkg/MemEncryptSevLib: add support to validate system RAM >> OvmfPkg/MemEncryptSevLib: add function to check the VMPL0 >> OvmfPkg/BaseMemEncryptSevLib: skip the pre-validated system RAM >> OvmfPkg/MemEncryptSevLib: add support to validate > 4GB memory in PEI >> phase >> OvmfPkg/SecMain: validate the memory used for decompressing Fv >> OvmfPkg/PlatformPei: validate the system RAM when SNP is active >> MdePkg: Define ConfidentialComputingGuestAttr >> OvmfPkg/PlatformPei: set PcdConfidentialComputingAttr when SEV is >> active >> UefiCpuPkg/MpInitLib: use PcdConfidentialComputingAttr to check SEV >> status >> UefiCpuPkg: add PcdGhcbHypervisorFeatures >> OvmfPkg/PlatformPei: set the Hypervisor Features PCD >> MdePkg/GHCB: increase the GHCB protocol max version >> UefiCpuPkg/MpLib: add support to register GHCB GPA when SEV-SNP is >> enabled >> OvmfPkg/MemEncryptSevLib: change the page state in the RMP table >> OvmfPkg/MemEncryptSevLib: skip page state change for Mmio address >> OvmfPkg/PlatformPei: mark cpuid and secrets memory reserved in EFI map >> OvmfPkg/AmdSev: expose the SNP reserved pages through configuration >> table >> >> Michael Roth (3): >> OvmfPkg/ResetVector: use SEV-SNP-validated CPUID values >> OvmfPkg/VmgExitLib: use SEV-SNP-validated CPUID values >> UefiCpuPkg/MpInitLib: use BSP to do extended topology check >> >> Tom Lendacky (1): >> UefiCpuPkg/MpInitLib: Use SEV-SNP AP Creation NAE event to launch APs >> >> MdePkg/MdePkg.dec | 4 + >> OvmfPkg/OvmfPkg.dec | 19 + >> UefiCpuPkg/UefiCpuPkg.dec | 5 + >> OvmfPkg/AmdSev/AmdSevX64.dsc | 8 +- >> OvmfPkg/Bhyve/BhyveX64.dsc | 5 +- >> OvmfPkg/OvmfPkgIa32.dsc | 4 + >> OvmfPkg/OvmfPkgIa32X64.dsc | 9 +- >> OvmfPkg/OvmfPkgX64.dsc | 8 +- >> OvmfPkg/OvmfXen.dsc | 5 +- >> OvmfPkg/OvmfPkgX64.fdf | 6 + >> OvmfPkg/AmdSevDxe/AmdSevDxe.inf | 7 + >> .../DxeMemEncryptSevLib.inf | 3 + >> .../PeiMemEncryptSevLib.inf | 7 + >> .../SecMemEncryptSevLib.inf | 3 + >> OvmfPkg/Library/VmgExitLib/SecVmgExitLib.inf | 2 + >> OvmfPkg/Library/VmgExitLib/VmgExitLib.inf | 3 + >> OvmfPkg/PlatformPei/PlatformPei.inf | 7 + >> OvmfPkg/ResetVector/ResetVector.inf | 5 + >> OvmfPkg/Sec/SecMain.inf | 4 + >> UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf | 6 +- >> UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf | 6 +- >> .../Include/ConfidentialComputingGuestAttr.h | 25 + >> MdePkg/Include/Register/Amd/Ghcb.h | 2 +- >> .../Guid/ConfidentialComputingSevSnpBlob.h | 33 ++ >> OvmfPkg/Include/Library/MemEncryptSevLib.h | 26 + >> .../X64/SnpPageStateChange.h | 36 ++ >> .../BaseMemEncryptSevLib/X64/VirtualMemory.h | 24 + >> OvmfPkg/PlatformPei/Platform.h | 5 + >> OvmfPkg/Sec/AmdSev.h | 95 ++++ >> UefiCpuPkg/Library/MpInitLib/MpLib.h | 103 ++++ >> OvmfPkg/AmdSevDxe/AmdSevDxe.c | 23 + >> .../DxeMemEncryptSevLibInternal.c | 27 ++ >> .../Ia32/MemEncryptSevLib.c | 17 + >> .../PeiMemEncryptSevLibInternal.c | 27 ++ >> .../SecMemEncryptSevLibInternal.c | 19 + >> .../X64/DxeSnpSystemRamValidate.c | 40 ++ >> .../X64/PeiDxeVirtualMemory.c | 167 ++++++- >> .../X64/PeiSnpSystemRamValidate.c | 127 +++++ >> .../X64/SecSnpSystemRamValidate.c | 82 ++++ >> .../X64/SnpPageStateChangeInternal.c | 294 ++++++++++++ >> OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 444 ++++++++++++++++-- >> OvmfPkg/PlatformPei/AmdSev.c | 231 +++++++++ >> OvmfPkg/PlatformPei/MemDetect.c | 2 + >> OvmfPkg/Sec/AmdSev.c | 298 ++++++++++++ >> OvmfPkg/Sec/SecMain.c | 158 +------ >> UefiCpuPkg/Library/MpInitLib/AmdSev.c | 260 ++++++++++ >> UefiCpuPkg/Library/MpInitLib/DxeMpLib.c | 16 +- >> UefiCpuPkg/Library/MpInitLib/Ia32/AmdSev.c | 70 +++ >> UefiCpuPkg/Library/MpInitLib/MpLib.c | 347 +++++--------- >> UefiCpuPkg/Library/MpInitLib/PeiMpLib.c | 4 +- >> UefiCpuPkg/Library/MpInitLib/X64/AmdSev.c | 261 ++++++++++ >> OvmfPkg/FvmainCompactScratchEnd.fdf.inc | 5 + >> OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 14 + >> OvmfPkg/ResetVector/Ia32/AmdSev.asm | 86 +++- >> OvmfPkg/ResetVector/ResetVector.nasmb | 18 + >> OvmfPkg/ResetVector/X64/OvmfSevMetadata.asm | 74 +++ >> UefiCpuPkg/Library/MpInitLib/MpEqu.inc | 2 + >> UefiCpuPkg/Library/MpInitLib/X64/AmdSev.nasm | 200 ++++++++ >> UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm | 100 +--- >> 59 files changed, 3360 insertions(+), 528 deletions(-) >> create mode 100644 MdePkg/Include/ConfidentialComputingGuestAttr.h >> create mode 100644 OvmfPkg/Include/Guid/ConfidentialComputingSevSnpBlob.h >> create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChange.h >> create mode 100644 OvmfPkg/Sec/AmdSev.h >> create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemRamValidate.c >> create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c >> create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c >> create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c >> create mode 100644 OvmfPkg/Sec/AmdSev.c >> create mode 100644 UefiCpuPkg/Library/MpInitLib/AmdSev.c >> create mode 100644 UefiCpuPkg/Library/MpInitLib/Ia32/AmdSev.c >> create mode 100644 UefiCpuPkg/Library/MpInitLib/X64/AmdSev.c >> create mode 100644 OvmfPkg/ResetVector/X64/OvmfSevMetadata.asm >> create mode 100644 UefiCpuPkg/Library/MpInitLib/X64/AmdSev.nasm >> > > > > >