Re: [edk2-devel] [PATCH v15 00/46] SEV-ES guest support

["Laszlo Ersek" <lersek@redhat.com>]

On 08/17/20 06:09, Gao, Liming wrote:
> This patch set have been merged edk2 7f7f511c5a74676523ed48435350f6e35282b62b..7f0b28415cb464832155d5b3ff6eb63612f58645

Thank you!
Laszlo

> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Liming Gao
> Sent: 2020年8月14日 9:20
> To: Laszlo Ersek <lersek@redhat.com>; Tom Lendacky <thomas.lendacky@amd.com>; devel@edk2.groups.io
> Cc: Brijesh Singh <brijesh.singh@amd.com>; Ard Biesheuvel <ard.biesheuvel@arm.com>; Dong, Eric <eric.dong@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>; Kinney, Michael D <michael.d.kinney@intel.com>; Ni, Ray <ray.ni@intel.com>; Andrew Fish <afish@apple.com>; Anthony Perard <anthony.perard@citrix.com>; You, Benjamin <benjamin.you@intel.com>; Bi, Dandan <dandan.bi@intel.com>; Dong, Guo <guo.dong@intel.com>; Wu, Hao A <hao.a.wu@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Julien Grall <julien@xen.org>; Leif Lindholm <leif@nuviainc.com>; Ma, Maurice <maurice.ma@intel.com>
> Subject: Re: [edk2-devel] [PATCH v15 00/46] SEV-ES guest support
> 
> Laszlo:
> 
> -----Original Message-----
> From: Laszlo Ersek <lersek@redhat.com>
> Sent: 2020年8月14日 3:54
> To: Tom Lendacky <thomas.lendacky@amd.com>; devel@edk2.groups.io
> Cc: Brijesh Singh <brijesh.singh@amd.com>; Ard Biesheuvel <ard.biesheuvel@arm.com>; Dong, Eric <eric.dong@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>; Gao, Liming <liming.gao@intel.com>; Kinney, Michael D <michael.d.kinney@intel.com>; Ni, Ray <ray.ni@intel.com>; Andrew Fish <afish@apple.com>; Anthony Perard <anthony.perard@citrix.com>; You, Benjamin <benjamin.you@intel.com>; Bi, Dandan <dandan.bi@intel.com>; Dong, Guo <guo.dong@intel.com>; Wu, Hao A <hao.a.wu@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Julien Grall <julien@xen.org>; Leif Lindholm <leif@nuviainc.com>; Ma, Maurice <maurice.ma@intel.com>
> Subject: Re: [PATCH v15 00/46] SEV-ES guest support
> 
> On 08/13/20 15:22, Tom Lendacky wrote:
>> From: Tom Lendacky <thomas.lendacky@amd.com>
>>
>> This patch series provides support for running EDK2/OVMF under SEV-ES.
>>
>> Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on 
>> the SEV support to protect the guest register state from the 
>> hypervisor. See
>> "AMD64 Architecture Programmer's Manual Volume 2: System Programming", 
>> section "15.35 Encrypted State (SEV-ES)" [1].
>>
>> In order to allow a hypervisor to perform functions on behalf of a 
>> guest, there is architectural support for notifying a guest's 
>> operating system when certain types of VMEXITs are about to occur.
>> This allows the guest to selectively share information with the 
>> hypervisor to satisfy the requested function. The notification is 
>> performed using a new exception, the VMM Communication exception 
>> (#VC). The information is shared through the Guest-Hypervisor Communication Block (GHCB) using the VMGEXIT instruction.
>> The GHCB format and the protocol for using it is documented in "SEV-ES 
>> Guest-Hypervisor Communication Block Standardization" [2].
>>
>> The main areas of the EDK2 code that are updated to support SEV-ES are 
>> around the exception handling support and the AP boot support.
>>
>> Exception support is required starting in Sec, continuing through Pei 
>> and into Dxe in order to handle #VC exceptions that are generated.
>> Each AP requires it's own GHCB page as well as a page to hold values 
>> specific to that AP.
>>
>> AP booting poses some interesting challenges. The INIT-SIPI-SIPI 
>> sequence is typically used to boot the APs. However, the hypervisor is 
>> not allowed to update the guest registers. The GHCB document [2] talks 
>> about how SMP booting under SEV-ES is performed.
>>
>> Since the GHCB page must be a shared (unencrypted) page, the processor 
>> must be running in long mode in order for the guest and hypervisor to 
>> communicate with each other. As a result, SEV-ES is only supported 
>> under the X64 architecture.
>>
>> This series adds a new library requirement for the VmgExitLib library 
>> against the UefiCpuPkg CpuExceptionHandlerLib library and the 
>> UefiCpuPkg MpInitLib library. The edk2-platforms repo requires 
>> updates/patches to add the new library requirement. To accomodate 
>> that, this series could be split between:
>>
>> patch number 10:
>>   UefiPayloadPkg: Prepare UefiPayloadPkg to use the VmgExitLib library
>>
>> and patch number 11:
>>   UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC 
>> exception
>>
>> The updates to edk2-platforms can be applied at the split.
>>
>> [1] https://www.amd.com/system/files/TechDocs/24593.pdf
>> [2] https://developer.amd.com/wp-content/resources/56421.pdf
>>
>> ---
>>
>> These patches are based on commit:
>> 65904cdbb33c ("UefiCpuPkg/MtrrLibUnitTest: Change to use static array 
>> for CI test")
>>
>> A version of the tree can be found at:
>> https://github.com/AMDESE/ovmf/tree/sev-es-v24
>>
>> Cc: Andrew Fish <afish@apple.com>
>> Cc: Anthony Perard <anthony.perard@citrix.com>
>> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
>> Cc: Benjamin You <benjamin.you@intel.com>
>> Cc: Dandan Bi <dandan.bi@intel.com>
>> Cc: Eric Dong <eric.dong@intel.com>
>> Cc: Guo Dong <guo.dong@intel.com>
>> Cc: Hao A Wu <hao.a.wu@intel.com>
>> Cc: Jian J Wang <jian.j.wang@intel.com>
>> Cc: Jordan Justen <jordan.l.justen@intel.com>
>> Cc: Julien Grall <julien@xen.org>
>> Cc: Laszlo Ersek <lersek@redhat.com>
>> Cc: Leif Lindholm <leif@nuviainc.com>
>> Cc: Liming Gao <liming.gao@intel.com>
>> Cc: Maurice Ma <maurice.ma@intel.com>
>> Cc: Michael D Kinney <michael.d.kinney@intel.com>
>> Cc: Ray Ni <ray.ni@intel.com>
>>
>> Changes since v14:
>> - Address ECC errors
>>   - Fix non-boolean comparison to use a comparison operator
>>   - Separate declaration and initialization of variables
>>   - Add period to first line of block comments
>>   - Split single-line multiple declaration into multiple lines
> 
> The changes look good to me, thanks!
> 
> In this particular case, the updates do not invalidate my "Regression-tested-by" given under v14:
> 
> https://edk2.groups.io/g/devel/message/63921
> 
> """
> For all patches except #10 ("UefiPayloadPkg: Prepare UefiPayloadPkg to use the VmgExitLib library") and #46 ("Maintainers.txt: Add reviewers for the OvmfPkg SEV-related files"):
> 
> Regression-tested-by: Laszlo Ersek <lersek@redhat.com> """
> 
> So whoever merges this series should please apply that to the respective patches.
> 
> [Liming] Got it. This patch set has passed all review. I will help merge it for this stable tag stable202008. 
> 
> Thanks!
> Laszlo
> 
> 
> 
>