From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM11-DM6-obe.outbound.protection.outlook.com (NAM11-DM6-obe.outbound.protection.outlook.com [40.107.223.55]) by mx.groups.io with SMTP id smtpd.web09.25556.1635119670586472600 for ; Sun, 24 Oct 2021 16:54:30 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@amd.com header.s=selector1 header.b=xIV6b5iG; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.223.55, mailfrom: brijesh.singh@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UG0qcnH/uIlOwMYhxCmvHMprIXpBkSuIR8XUE3btbbTfLHZ2WT30oixPgKea5cWSDpTkMZbiq/J/CVBU5F6vulNbLakLZKrsRtYBVAvAZkEOTdcKaeiuEK+DS4z+7oBUARWWKX0ySR1G5xV4T1Iis+KhGl5QV0oy46n23TkSywWRg5EVv9GwktCZzjfrt88OLm9PHcSEtn4kmU8wWh8qDJ3UeGvpfIsvrak3KJt3fAczUeuTF1sXbR+rqfNYxuOwotTTMl/naaFpSdW+GJKAEQ9fPtU4TzoO5EA6sf+xFee5Zic8pkSfOJDbyfrY5ArGx2KlXid+GrBB0YiIp7TnPA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=DLg05v5+ToCW7+5y2dr91pe+yDV74t8ZmibSU21HTlE=; b=cY1rE+aWUKDi+Ryg9fHq9PGCOp4Umyq+sgTb0rj7jKgKKelGxgyaeGrLXsprazNfcsUYQ4l5iW2xMIB9bJbsMYq8k6/gHE+3vCcvIhETeL87fTFWQNfxYYQ/UR9T5tX4G9DmNnmCvklTRyHZQAs2KT8fyIEIebqB+FI8gH0vDi9gTwa5/vhMzokITKhOedBLDqobSEA99xQxhq1fPbIfXD1WJ8bWrAXZUFGWuaY+nCLrpwCVH0UGnXC+aVV2hHlhNSkywG+Pz2IYZSNq1famACo2f12sQeUPAAZuDDRIeAojT28R23hppAqhVHtjDRvC3kEVJ9pFVutbA4RcTWDAtA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DLg05v5+ToCW7+5y2dr91pe+yDV74t8ZmibSU21HTlE=; b=xIV6b5iGbvSBQv1sYqq0bXbkbfH5P8Lawy6qbEpXbxXcsAllehiCu0LxLOqexc9xIvIyuCTyxpxy4iSGZQHsE09rLNFQS7sEj6orr8QO25Y8WtFj0CySNnM8O56nnk+7nzkfit/to2XxxeUwo6njaV48ib55kqeEt8O6yX3Gj1o= Authentication-Results: edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4413.namprd12.prod.outlook.com (2603:10b6:806:9e::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4628.18; Sun, 24 Oct 2021 23:54:26 +0000 Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::e4da:b3ea:a3ec:761c]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::e4da:b3ea:a3ec:761c%7]) with mapi id 15.20.4628.020; Sun, 24 Oct 2021 23:54:26 +0000 Message-ID: <7c252991-d51a-461e-da8e-8f1de6fe41ba@amd.com> Date: Sun, 24 Oct 2021 18:54:18 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Thunderbird/91.2.1 Cc: brijesh.singh@amd.com, James Bottomley , "Xu, Min M" , Tom Lendacky , "Justen, Jordan L" , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann Subject: Re: [edk2-devel] [PATCH v11 00/32] Add AMD Secure Nested Paging (SEV-SNP) support To: devel@edk2.groups.io, jiewen.yao@intel.com References: <20211023041349.1263726-1-brijesh.singh@amd.com> From: "Brijesh Singh" In-Reply-To: X-ClientProxiedBy: BN0PR04CA0108.namprd04.prod.outlook.com (2603:10b6:408:ec::23) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) Return-Path: brijesh.singh@amd.com MIME-Version: 1.0 Received: from [172.31.5.42] (165.204.84.11) by BN0PR04CA0108.namprd04.prod.outlook.com (2603:10b6:408:ec::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4628.15 via Frontend Transport; Sun, 24 Oct 2021 23:54:22 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 0411538d-85fe-4837-8797-08d997499c5a X-MS-TrafficTypeDiagnostic: SA0PR12MB4413: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7219; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: JSnRHrPwMCKHJAK2Nq0Me2dqzoehzSFibJjt9xiqsGsQFJsQKWsrlzZeFqh08YKlWpTP6rYl61cMgv/b3uEyEGif5cqtf52yLZDgZYw62+d68rDcs//Ay8FLmHclFGR8vZ5fHYo138zxssXUi5tBAVqyIsdPcmQVB157YkdAXoWXuDTyPx9oswWiL25QKXSK2fk5LAIAYCdr6sq08rqdpqMlC+BmuwQqBBNkAt56JfnnjMaTcUXoYW727m4ltA5/UunNA5ZoASs07EhAaypvaVpQojZPFtM7bVOg5d1uyXDNMI2rgrpvv4woXQDq/Om4Tn/n61CKAqKeER/yaLCxGvoa/jQPmOOv5OLDdne1WdXmaQHOOscLwDacwZcgu/Jza2wPNACrVjCZtUodKWTIVDdK1qsuXb+j+fi2BCXnkRHaFfg83MMAccB29dGaE6zeA5FTyiFO+eWrb61r8i6mTzZtr9sTPWq6ms6kxpeh7QzXZCI23HH8QLfK5xWYCYJu4Kzm2YybkVr6DUEO3As53YF0QPdZdye5f+GjqavKEPA1/qM+NLiClfaL6xb0GWbCPWj+18RdSjU2uF8nN9fEauwUCt3bXgvvvEXADOFu66m4VODbQke/UfJ4KzXAI7LEBL8X/88g9/WwjdqIAh5Izz337twn1zofMO2A3afbvUwFpr+lCzIVnYMYAE5r2w8ucPL9J6/g5Sepp/w1T1Jmgtl8D6UFRdiZHz4d0VVkcGDhxnEiZztz8D84O8yzcH7GYjtpG8MrqsBQ0xHNJmpKtXz9wMD1Q0B2qvRb0/mYQ1lc/gSvFjr6SwdMWnFlIQB0qRxIkwQt3O17AXsXVhoA3l/wnI61iTziBM75F5qL4Kk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2718.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(26005)(8936002)(956004)(4326008)(2616005)(66556008)(66476007)(86362001)(44832011)(8676002)(53546011)(31696002)(6666004)(38100700002)(5660300002)(66946007)(31686004)(316002)(186003)(45080400002)(19627235002)(16576012)(36756003)(508600001)(2906002)(966005)(6486002)(83380400001)(30864003)(54906003)(43740500002)(45980500001);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?dlhsOUhLZWdyczlnMGQ4M2I3bEU1cWwreDhxODVYbXlFOVQzc0JiM3lqU2RI?= =?utf-8?B?MW9laEZqZWpaWGdoY0dGOVB5cS9HZytVanJEQ3YyR2IyYndlZGFIM09YOW0y?= =?utf-8?B?WS9NUkxxUTRGMFlEY0xSd0tkcFNqNDZHd3VsVlRuWkpmNmVYMU1Pa2J4dTcw?= =?utf-8?B?d011MUhaRVdlSGVFQkpYaVZKT1NlSlg2Y0FKWnFvMTdFcmpaTUhqZ25UMWJq?= =?utf-8?B?WlhxWEZQZmFrVTRNZ2tHaElueFdNajFWWXprWlpFOWVRQ1ZzVlRacHRLcWw1?= =?utf-8?B?TTZuOWhUS2ZjYnovYW14Ukw2M2NxS1A3bmRDcVNOdHB6Qmd3dXFTTVY3REVE?= =?utf-8?B?QksybjJMeEUyOStXcDZGcDFhMGRId2ZiRGlFcjJleHVvMk56V0ZaamV6ck1B?= =?utf-8?B?UHMzd21LR015V2planpQZGMrRTdJK1pZenRwa2RoOUk1SmxkQTlpaDZmT2No?= =?utf-8?B?eVZISXZLamVUUVNHNE5aM05UMzh5VVltVkhSSjdmNTM2K28yVzBjMHhZdVd0?= =?utf-8?B?RnNTRXJOK09sWnhDQ1RHd1dCVTFHSWZIcFJGSDgycDNiTnFyMThLS0JnQ05L?= =?utf-8?B?dTRYdkZ2WUFzajdDVDNCYlZHeEpJNElmem1YNnZFa290N0xSd0ZVaWZnTHlF?= =?utf-8?B?WmZlYUhJR1c3S1BVendidkxsMDNqOFQ4SGdFb0t4S3lJR3N1RHlKZVZGQmt4?= =?utf-8?B?YXdGemZBQXRGcElXNVlUMCtIQlZXaFBlZE94OGFtNUZsNWQyQ2lQeFZPendu?= =?utf-8?B?VEZqeXhuMjBEcU1YS3V1MHhjYXA2dVR5OFdYRWw4clNvY3BjamlUN3dpcWFa?= =?utf-8?B?WVZNVGtmakYzTDJHVmFFQ2RrVUk1aWtXUll4Z2U2UFN3VUFpaUxyNk82aVVW?= =?utf-8?B?bkd4czZNL04zVk52V1pBeXRnT09mM0FFRFExd1JFNmc2UVEycVFvRVRwdzU4?= =?utf-8?B?b1ZnTDFFa3loL0sxaFp4RC9JRDVxenlYVTlOYWZKS2g1Smh1QXZaK2NGMnNH?= =?utf-8?B?QlM4VUttS2MzTEVxREpaY3NrZ0M3SDVMbEJDUXlDYXB6VlZEaFkxWkpLMENP?= =?utf-8?B?aVlvaUFvaDNiVXVVcXZoSU1aZSs0WHpvelM2dXIveWcxWDIwQUgrbXIrcU5U?= =?utf-8?B?OVd1bERFOEwyQjY1Zm15YnlOMjROblkyOUJCUjJ4di9nbzFYZUFTRHMzOUpB?= =?utf-8?B?bHErRjRtRzZwSkdveWtyN3J0VElsZjRRSHBKQ3ZXVjdQL1FoMEd3Zkh0VTcw?= =?utf-8?B?cFkxaHpIandMVFhwek5tVERRemRwN00zY3Rka3NFRGtqc3RMRjJwc1pXZEp6?= =?utf-8?B?dmI1MmMyeFlYRGRGTmZsUmpqVkU2Wjk0QjRzT1crcXBHQlY3MG5oT2ZReTJE?= =?utf-8?B?d0ZrOE1NVUd1NXlNZHpkL0tac2pvVWk5RHl4cHlJSHlSV0xXRkU3SGd2V00v?= =?utf-8?B?UmJmaXZrdndId3Zha1VUQ29YQm1qZHM1ZHM5UTNtQjZheVNwc3JOSEJ2V3pl?= =?utf-8?B?WmNkalZGVXFSMGdQZnU1aWRTTXN4Tm52OHBITHErOFBWQVVvTjJVQWhpZ2Fu?= =?utf-8?B?VDZtalVEMjlKWE5RK3pFTHkvaHZBd21vQ2d5RmVqbnc3cllwYUhwQVBxMERJ?= =?utf-8?B?dThNQzQ3V1FnS2k3M0xZMnh4dmJWeHBNazEyc3BYVWNpU3R4VnZEeGNOU0sr?= =?utf-8?B?V2pqdGZlNzNXMHdZVVJIMzFFNmlsOEc0R3Q0cDJzczNmaTNKQlMvN253ckNx?= =?utf-8?B?b3gxTVVxVU1mT2R2NTk3S0xrWkZhakJsSWpkRmlOZ3FQNDM0UTZRZWcxb0Nn?= =?utf-8?B?a0dLMEFYVEFOeVNWMGM5U0FvK254cXdxZnFnOFByQTRSTXhxRjgxNk9oUXJX?= =?utf-8?B?aWprUFhicU8vQ2RUQkhBV3loS011Z21oaEhuMEZiWTBsK2h2Y3NJYnBLelg3?= =?utf-8?B?bXNyMHJMcjRBalZBa2ZrTG11ZEF3THJ1RG5LMVkrU2tUWEJrUVBkeXdEYU1Y?= =?utf-8?B?aFFBenhTZmdSaVNacDVtM1NrZHRxVlZoZldDMytUUWdBRjRjaVpXZWJrSG15?= =?utf-8?B?UzExQXNmZXFXdE5EbmZZbWFsUFBqTUxRWlpmQ281RXZZWXNNcFIrZnM1OE51?= =?utf-8?B?MFh5MUF5Vi8wa3dmWnpBckNVRkl2eWtJT0lEUk5veXZSS1ZoU0RJbVBNVEdr?= =?utf-8?Q?c9SjHO7ipqfc2Mqi7ZuMaSk=3D?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0411538d-85fe-4837-8797-08d997499c5a X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Oct 2021 23:54:26.2560 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: jDc2Ai7UlcX9UnAjpYDCMBFYL2PjC+gzpo/krnbuMBYlsCG1fsvCd7yVGsl5/bvATS/OM6nV2nRcCZIlNpZw8g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4413 Content-Language: en-US Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Thank Jiewen, I have ping'ed UefiCpuPkg maintainer (Ray and Rahul) on every patch which touches the UefiCpuPkg. If maintainer wants me to rework on something then I will work accordingly. If they are okay with v11 then now the merge will create a conflict (due to the TDX patches merge commit). I have rebased my series to the recent master and have pushed it here: https://github.com/AMDESE/ovmf/tree/snp-v12. I can post the series if you prefer it. thanks On 10/23/21 8:46 PM, Yao, Jiewen via groups.io wrote: > Yes. I will try my best to merge. > > I checked the patch set but I did not find the "R-B" from UefiCpuPkg maintainer. Neither from email nor from you v11. > > Did I miss something? > > Thank you > Yao Jiewen > > >> -----Original Message----- >> From: Brijesh Singh >> Sent: Saturday, October 23, 2021 12:13 PM >> To: devel@edk2.groups.io >> Cc: James Bottomley ; Xu, Min M ; >> Yao, Jiewen ; Tom Lendacky >> ; Justen, Jordan L ; >> Ard Biesheuvel ; Erdem Aktas >> ; Michael Roth ; Gerd >> Hoffmann ; Brijesh Singh >> Subject: [PATCH v11 00/32] Add AMD Secure Nested Paging (SEV-SNP) support >> >> Hi Gerd and Jiewen, >> >> CI was a bit unstable during my v10 submission, so, I was not able to >> run it to the completion. Finally, I managed to get the CI going, >> and it reported few Windows 32-bit build errors. The v11 fixes those build >> errors. Please consider this for the merge. >> >> Thank you so much for all your support in reviewing the series. >> >> ----------------------------------------------------------------------------- >> BZ: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D3275&data=04%7C01%7Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=L41krO6G221HaIsG92FloIzgCDqMLAAsU26jaEMF7yw%3D&reserved=0 >> >> SEV-SNP builds upon existing SEV and SEV-ES functionality while adding >> new hardware-based memory protections. SEV-SNP adds strong memory >> integrity >> protection to help prevent malicious hypervisor-based attacks like data >> replay, memory re-mapping and more in order to create an isolated memory >> encryption environment. >> >> This series provides the basic building blocks to support booting the SEV-SNP >> VMs, it does not cover all the security enhancement introduced by the SEV-SNP >> such as interrupt protection. >> >> Many of the integrity guarantees of SEV-SNP are enforced through a new >> structure called the Reverse Map Table (RMP). Adding a new page to SEV-SNP >> VM requires a 2-step process. First, the hypervisor assigns a page to the >> guest using the new RMPUPDATE instruction. This transitions the page to >> guest-invalid. Second, the guest validates the page using the new PVALIDATE >> instruction. The SEV-SNP VMs can use the new "Page State Change Request >> NAE" >> defined in the GHCB specification to ask hypervisor to add or remove page >> from the RMP table. >> >> Each page assigned to the SEV-SNP VM can either be validated or unvalidated, >> as indicated by the Validated flag in the page's RMP entry. There are two >> approaches that can be taken for the page validation: Pre-validation and >> Lazy Validation. >> >> Under pre-validation, the pages are validated prior to first use. And under >> lazy validation, pages are validated when first accessed. An access to a >> unvalidated page results in a #VC exception, at which time the exception >> handler may validate the page. Lazy validation requires careful tracking of >> the validated pages to avoid validating the same GPA more than once. The >> recently introduced "Unaccepted" memory type can be used to communicate >> the >> unvalidated memory ranges to the Guest OS. >> >> At this time we only support the pre-validation. OVMF detects all the available >> system RAM in the PEI phase. When SEV-SNP is enabled, the memory is validated >> before it is made available to the EDK2 core. >> >> Now that series contains all the basic support required to launch SEV-SNP >> guest. We are still missing the Interrupt security feature provided by the >> SNP. The feature will be added after the base support is accepted. >> >> Additional resources >> --------------------- >> SEV-SNP whitepaper >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.amd.com%2Fsystem%2Ffiles%2FTechDocs%2FSEV-SNP-strengthening-vm-&data=04%7C01%7Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=nVMSG%2FvSS2Wa21lu1lGrHr9OYX8hL7FoAcQXBBiCztc%3D&reserved=0 >> isolation-with-integrity-protection-and-more.pdf >> >> APM 2: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.amd.com%2Fsystem%2Ffiles%2FTechDocs%2F24593.pdf&data=04%7C01%7Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=G8Xg2glOGY2EjHpeQ3WM4gZChuI0k8QcLDTbpJiTplg%3D&reserved=0 (section 15.36) >> >> The complete source is available at >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAMDESE%2Fovmf%2Ftree%2Fsnp-v11&data=04%7C01%7Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=HMHFq8G%2FPqdhzNW3Ashmc4%2Bmv1RcDULD4vniofhiS54%3D&reserved=0 >> >> GHCB spec: >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdeveloper.amd.com%2Fwp-content%2Fresources%2F56421.pdf&data=04%7C01%7Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=YiPgZU87fdnl5rJpD0E2ue9aTKbqUwizuBrKxom0FiU%3D&reserved=0 >> >> SEV-SNP firmware specification: >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.amd.com%2Fsystem%2Ffiles%2FTechDocs%2F56860.pdf&data=04%7C01%7Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=bfQsY4%2BRnlFGuD3Bg%2BFPb3lRgSGgpomNocXswHqkm%2F4%3D&reserved=0 >> >> Change since v10: >> * fix 'unresolved external symbol __allshl' link error when building I32 for >> VS2017. >> >> Changes since v9: >> * Move CCAttrs Pcd define in MdePkg >> * Add comment to indicate that allocating the identity map PT is temporary until >> we get lazy validation >> >> Changes since v8: >> * drop the generic metadata and make it specific to SEV. >> >> Changes since v7: >> * Move SEV specific changes in MpLib in AmdSev file >> * Update the GHCB register function to not restore the GHCB MSR because >> we were already in the MSR protocol mode. >> * Drop the SNP name from PcdSnpSecPreValidate. >> * Add new section for GHCB memory in the OVMF metadata. >> >> Change since v6: >> * Drop the SNP boot block GUID and switch to using the Metadata guided >> structure >> proposed by Min in TDX series. >> * Exclude the GHCB page from the pre-validated region. It simplifies the reset >> vector code where we do not need to unvalidate the GHCB page. >> * Now that GHCB page is not validated so move the VMPL check from reset >> vector >> code to the MemEncryptSevLib on the first page validation. >> * Introduce the ConfidentialComputingGuestAttr PCD to communicate which >> memory encryption is active so that MpInitLib can make use of it. >> * Drop the SEVES specific PCD as the information can be communicated via >> the ConfidentialComputingGuestAttr. >> * Move the SNP specific AP creation function in AmdSev.c. >> * Define the SNP Blob GUID in a new file. >> >> Change since v5: >> * When possible use the CPUID value from CPUID page >> * Move the SEV specific functions from SecMain.c in AmdSev.c >> * Rebase to the latest code >> * Add the review feedback from Yao. >> >> Change since v4: >> * Use the correct MSR for the SEV_STATUS >> * Add VMPL-0 check >> >> Change since v3: >> * ResetVector: move all SEV specific code in AmdSev.asm and add macros to >> keep >> the code readable. >> * Drop extending the EsWorkArea to contain SNP specific state. >> * Drop the GhcbGpa library and call the VmgExit directly to register GHCB GPA. >> * Install the CC blob config table from AmdSevDxe instead of extending the >> AmdSev/SecretsDxe for it. >> * Add the separate PCDs for the SNP Secrets. >> >> Changes since v2: >> * Add support for the AP creation. >> * Use the module-scoping override to make AmdSevDxe use the IO port for PCI >> reads. >> * Use the reserved memory type for CPUID and Secrets page. >> * >> Changes since v1: >> * Drop the interval tree support to detect the pre-validated overlap region. >> * Use an array to keep track of pre-validated regions. >> * Add support to query the Hypervisor feature and verify that SNP feature is >> supported. >> * Introduce MemEncryptSevClearMmioPageEncMask() to clear the C-bit from >> MMIO ranges. >> * Pull the SevSecretDxe and SevSecretPei into OVMF package build. >> * Extend the SevSecretDxe to expose confidential computing blob location >> through >> EFI configuration table. >> >> Brijesh Singh (28): >> OvmfPkg/SecMain: move SEV specific routines in AmdSev.c >> UefiCpuPkg/MpInitLib: move SEV specific routines in AmdSev.c >> OvmfPkg/ResetVector: move clearing GHCB in SecMain >> OvmfPkg/ResetVector: introduce SEV metadata descriptor for VMM use >> OvmfPkg: reserve SNP secrets page >> OvmfPkg: reserve CPUID page >> OvmfPkg/ResetVector: pre-validate the data pages used in SEC phase >> OvmfPkg/MemEncryptSevLib: add MemEncryptSevSnpEnabled() >> OvmfPkg/SecMain: register GHCB gpa for the SEV-SNP guest >> OvmfPkg/PlatformPei: register GHCB gpa for the SEV-SNP guest >> OvmfPkg/AmdSevDxe: do not use extended PCI config space >> OvmfPkg/MemEncryptSevLib: add support to validate system RAM >> OvmfPkg/MemEncryptSevLib: add function to check the VMPL0 >> OvmfPkg/BaseMemEncryptSevLib: skip the pre-validated system RAM >> OvmfPkg/MemEncryptSevLib: add support to validate > 4GB memory in PEI >> phase >> OvmfPkg/SecMain: validate the memory used for decompressing Fv >> OvmfPkg/PlatformPei: validate the system RAM when SNP is active >> UefiCpuPkg: Define ConfidentialComputingGuestAttr >> OvmfPkg/PlatformPei: set PcdConfidentialComputingAttr when SEV is >> active >> UefiCpuPkg/MpInitLib: use PcdConfidentialComputingAttr to check SEV >> status >> UefiCpuPkg: add PcdGhcbHypervisorFeatures >> OvmfPkg/PlatformPei: set the Hypervisor Features PCD >> MdePkg/GHCB: increase the GHCB protocol max version >> UefiCpuPkg/MpLib: add support to register GHCB GPA when SEV-SNP is >> enabled >> OvmfPkg/MemEncryptSevLib: change the page state in the RMP table >> OvmfPkg/MemEncryptSevLib: skip page state change for Mmio address >> OvmfPkg/PlatformPei: mark cpuid and secrets memory reserved in EFI map >> OvmfPkg/AmdSev: expose the SNP reserved pages through configuration >> table >> >> Michael Roth (3): >> OvmfPkg/ResetVector: use SEV-SNP-validated CPUID values >> OvmfPkg/VmgExitLib: use SEV-SNP-validated CPUID values >> UefiCpuPkg/MpInitLib: use BSP to do extended topology check >> >> Tom Lendacky (1): >> UefiCpuPkg/MpInitLib: Use SEV-SNP AP Creation NAE event to launch APs >> >> MdePkg/MdePkg.dec | 4 + >> OvmfPkg/OvmfPkg.dec | 18 + >> UefiCpuPkg/UefiCpuPkg.dec | 5 + >> OvmfPkg/AmdSev/AmdSevX64.dsc | 8 +- >> OvmfPkg/Bhyve/BhyveX64.dsc | 5 +- >> OvmfPkg/OvmfPkgIa32.dsc | 4 + >> OvmfPkg/OvmfPkgIa32X64.dsc | 9 +- >> OvmfPkg/OvmfPkgX64.dsc | 8 +- >> OvmfPkg/OvmfXen.dsc | 5 +- >> OvmfPkg/OvmfPkgX64.fdf | 6 + >> OvmfPkg/AmdSevDxe/AmdSevDxe.inf | 7 + >> .../DxeMemEncryptSevLib.inf | 3 + >> .../PeiMemEncryptSevLib.inf | 7 + >> .../SecMemEncryptSevLib.inf | 3 + >> OvmfPkg/Library/VmgExitLib/SecVmgExitLib.inf | 2 + >> OvmfPkg/Library/VmgExitLib/VmgExitLib.inf | 3 + >> OvmfPkg/PlatformPei/PlatformPei.inf | 7 + >> OvmfPkg/ResetVector/ResetVector.inf | 5 + >> OvmfPkg/Sec/SecMain.inf | 4 + >> UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf | 6 +- >> UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf | 6 +- >> .../Include/ConfidentialComputingGuestAttr.h | 25 + >> MdePkg/Include/Register/Amd/Ghcb.h | 2 +- >> .../Guid/ConfidentialComputingSevSnpBlob.h | 33 ++ >> OvmfPkg/Include/Library/MemEncryptSevLib.h | 26 + >> .../X64/SnpPageStateChange.h | 36 ++ >> .../BaseMemEncryptSevLib/X64/VirtualMemory.h | 24 + >> OvmfPkg/PlatformPei/Platform.h | 5 + >> OvmfPkg/Sec/AmdSev.h | 95 ++++ >> UefiCpuPkg/Library/MpInitLib/MpLib.h | 93 ++++ >> OvmfPkg/AmdSevDxe/AmdSevDxe.c | 23 + >> .../DxeMemEncryptSevLibInternal.c | 27 ++ >> .../Ia32/MemEncryptSevLib.c | 17 + >> .../PeiMemEncryptSevLibInternal.c | 27 ++ >> .../SecMemEncryptSevLibInternal.c | 19 + >> .../X64/DxeSnpSystemRamValidate.c | 40 ++ >> .../X64/PeiDxeVirtualMemory.c | 167 ++++++- >> .../X64/PeiSnpSystemRamValidate.c | 127 +++++ >> .../X64/SecSnpSystemRamValidate.c | 82 ++++ >> .../X64/SnpPageStateChangeInternal.c | 294 ++++++++++++ >> OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 444 ++++++++++++++++-- >> OvmfPkg/PlatformPei/AmdSev.c | 231 +++++++++ >> OvmfPkg/PlatformPei/MemDetect.c | 2 + >> OvmfPkg/Sec/AmdSev.c | 298 ++++++++++++ >> OvmfPkg/Sec/SecMain.c | 158 +------ >> UefiCpuPkg/Library/MpInitLib/AmdSev.c | 239 ++++++++++ >> UefiCpuPkg/Library/MpInitLib/DxeMpLib.c | 16 +- >> UefiCpuPkg/Library/MpInitLib/Ia32/AmdSev.c | 70 +++ >> UefiCpuPkg/Library/MpInitLib/MpLib.c | 345 +++++--------- >> UefiCpuPkg/Library/MpInitLib/PeiMpLib.c | 4 +- >> UefiCpuPkg/Library/MpInitLib/X64/AmdSev.c | 261 ++++++++++ >> OvmfPkg/FvmainCompactScratchEnd.fdf.inc | 5 + >> OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 17 + >> OvmfPkg/ResetVector/Ia32/AmdSev.asm | 86 +++- >> OvmfPkg/ResetVector/ResetVector.nasmb | 18 + >> OvmfPkg/ResetVector/X64/OvmfSevMetadata.asm | 74 +++ >> UefiCpuPkg/Library/MpInitLib/MpEqu.inc | 2 + >> UefiCpuPkg/Library/MpInitLib/X64/AmdSev.nasm | 200 ++++++++ >> UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm | 100 +--- >> 59 files changed, 3329 insertions(+), 528 deletions(-) >> create mode 100644 MdePkg/Include/ConfidentialComputingGuestAttr.h >> create mode 100644 >> OvmfPkg/Include/Guid/ConfidentialComputingSevSnpBlob.h >> create mode 100644 >> OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChange.h >> create mode 100644 OvmfPkg/Sec/AmdSev.h >> create mode 100644 >> OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemRamValidate.c >> create mode 100644 >> OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c >> create mode 100644 >> OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c >> create mode 100644 >> OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c >> create mode 100644 OvmfPkg/Sec/AmdSev.c >> create mode 100644 UefiCpuPkg/Library/MpInitLib/AmdSev.c >> create mode 100644 UefiCpuPkg/Library/MpInitLib/Ia32/AmdSev.c >> create mode 100644 UefiCpuPkg/Library/MpInitLib/X64/AmdSev.c >> create mode 100644 OvmfPkg/ResetVector/X64/OvmfSevMetadata.asm >> create mode 100644 UefiCpuPkg/Library/MpInitLib/X64/AmdSev.nasm >> >> -- >> 2.25.1 > > > > >