From: "Liming Gao" <liming.gao@intel.com>
To: Laszlo Ersek <lersek@redhat.com>,
Tom Lendacky <thomas.lendacky@amd.com>,
"devel@edk2.groups.io" <devel@edk2.groups.io>
Cc: Brijesh Singh <brijesh.singh@amd.com>,
Ard Biesheuvel <ard.biesheuvel@arm.com>,
"Dong, Eric" <eric.dong@intel.com>,
"Justen, Jordan L" <jordan.l.justen@intel.com>,
"Kinney, Michael D" <michael.d.kinney@intel.com>,
"Ni, Ray" <ray.ni@intel.com>, Andrew Fish <afish@apple.com>,
Anthony Perard <anthony.perard@citrix.com>,
"You, Benjamin" <benjamin.you@intel.com>,
"Bi, Dandan" <dandan.bi@intel.com>,
"Dong, Guo" <guo.dong@intel.com>,
"Wu, Hao A" <hao.a.wu@intel.com>,
"Wang, Jian J" <jian.j.wang@intel.com>,
Julien Grall <julien@xen.org>, Leif Lindholm <leif@nuviainc.com>,
"Ma, Maurice" <maurice.ma@intel.com>
Subject: Re: [PATCH v15 00/46] SEV-ES guest support
Date: Fri, 14 Aug 2020 01:19:53 +0000 [thread overview]
Message-ID: <CY4PR11MB15269F3F067CFF113AD0FD2980400@CY4PR11MB1526.namprd11.prod.outlook.com> (raw)
In-Reply-To: <3bdffcbb-dba1-ce8b-5b3c-ed7d94dc1db5@redhat.com>
Laszlo:
-----Original Message-----
From: Laszlo Ersek <lersek@redhat.com>
Sent: 2020年8月14日 3:54
To: Tom Lendacky <thomas.lendacky@amd.com>; devel@edk2.groups.io
Cc: Brijesh Singh <brijesh.singh@amd.com>; Ard Biesheuvel <ard.biesheuvel@arm.com>; Dong, Eric <eric.dong@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>; Gao, Liming <liming.gao@intel.com>; Kinney, Michael D <michael.d.kinney@intel.com>; Ni, Ray <ray.ni@intel.com>; Andrew Fish <afish@apple.com>; Anthony Perard <anthony.perard@citrix.com>; You, Benjamin <benjamin.you@intel.com>; Bi, Dandan <dandan.bi@intel.com>; Dong, Guo <guo.dong@intel.com>; Wu, Hao A <hao.a.wu@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Julien Grall <julien@xen.org>; Leif Lindholm <leif@nuviainc.com>; Ma, Maurice <maurice.ma@intel.com>
Subject: Re: [PATCH v15 00/46] SEV-ES guest support
On 08/13/20 15:22, Tom Lendacky wrote:
> From: Tom Lendacky <thomas.lendacky@amd.com>
>
> This patch series provides support for running EDK2/OVMF under SEV-ES.
>
> Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on
> the SEV support to protect the guest register state from the
> hypervisor. See
> "AMD64 Architecture Programmer's Manual Volume 2: System Programming",
> section "15.35 Encrypted State (SEV-ES)" [1].
>
> In order to allow a hypervisor to perform functions on behalf of a
> guest, there is architectural support for notifying a guest's
> operating system when certain types of VMEXITs are about to occur.
> This allows the guest to selectively share information with the
> hypervisor to satisfy the requested function. The notification is
> performed using a new exception, the VMM Communication exception
> (#VC). The information is shared through the Guest-Hypervisor Communication Block (GHCB) using the VMGEXIT instruction.
> The GHCB format and the protocol for using it is documented in "SEV-ES
> Guest-Hypervisor Communication Block Standardization" [2].
>
> The main areas of the EDK2 code that are updated to support SEV-ES are
> around the exception handling support and the AP boot support.
>
> Exception support is required starting in Sec, continuing through Pei
> and into Dxe in order to handle #VC exceptions that are generated.
> Each AP requires it's own GHCB page as well as a page to hold values
> specific to that AP.
>
> AP booting poses some interesting challenges. The INIT-SIPI-SIPI
> sequence is typically used to boot the APs. However, the hypervisor is
> not allowed to update the guest registers. The GHCB document [2] talks
> about how SMP booting under SEV-ES is performed.
>
> Since the GHCB page must be a shared (unencrypted) page, the processor
> must be running in long mode in order for the guest and hypervisor to
> communicate with each other. As a result, SEV-ES is only supported
> under the X64 architecture.
>
> This series adds a new library requirement for the VmgExitLib library
> against the UefiCpuPkg CpuExceptionHandlerLib library and the
> UefiCpuPkg MpInitLib library. The edk2-platforms repo requires
> updates/patches to add the new library requirement. To accomodate
> that, this series could be split between:
>
> patch number 10:
> UefiPayloadPkg: Prepare UefiPayloadPkg to use the VmgExitLib library
>
> and patch number 11:
> UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC
> exception
>
> The updates to edk2-platforms can be applied at the split.
>
> [1] https://www.amd.com/system/files/TechDocs/24593.pdf
> [2] https://developer.amd.com/wp-content/resources/56421.pdf
>
> ---
>
> These patches are based on commit:
> 65904cdbb33c ("UefiCpuPkg/MtrrLibUnitTest: Change to use static array
> for CI test")
>
> A version of the tree can be found at:
> https://github.com/AMDESE/ovmf/tree/sev-es-v24
>
> Cc: Andrew Fish <afish@apple.com>
> Cc: Anthony Perard <anthony.perard@citrix.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
> Cc: Benjamin You <benjamin.you@intel.com>
> Cc: Dandan Bi <dandan.bi@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> Cc: Guo Dong <guo.dong@intel.com>
> Cc: Hao A Wu <hao.a.wu@intel.com>
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Julien Grall <julien@xen.org>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Leif Lindholm <leif@nuviainc.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Maurice Ma <maurice.ma@intel.com>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Ray Ni <ray.ni@intel.com>
>
> Changes since v14:
> - Address ECC errors
> - Fix non-boolean comparison to use a comparison operator
> - Separate declaration and initialization of variables
> - Add period to first line of block comments
> - Split single-line multiple declaration into multiple lines
The changes look good to me, thanks!
In this particular case, the updates do not invalidate my "Regression-tested-by" given under v14:
https://edk2.groups.io/g/devel/message/63921
"""
For all patches except #10 ("UefiPayloadPkg: Prepare UefiPayloadPkg to use the VmgExitLib library") and #46 ("Maintainers.txt: Add reviewers for the OvmfPkg SEV-related files"):
Regression-tested-by: Laszlo Ersek <lersek@redhat.com> """
So whoever merges this series should please apply that to the respective patches.
[Liming] Got it. This patch set has passed all review. I will help merge it for this stable tag stable202008.
Thanks!
Laszlo
next prev parent reply other threads:[~2020-08-14 1:19 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-13 13:22 [PATCH v15 00/46] SEV-ES guest support Lendacky, Thomas
2020-08-13 13:22 ` [PATCH v15 01/46] MdeModulePkg: Create PCDs to be used in support of SEV-ES Lendacky, Thomas
2020-08-13 13:22 ` [PATCH v15 02/46] UefiCpuPkg: Create PCD " Lendacky, Thomas
2020-08-13 13:22 ` [PATCH v15 03/46] MdePkg: Add the MSR definition for the GHCB register Lendacky, Thomas
2020-08-13 13:22 ` [PATCH v15 04/46] MdePkg: Add a structure definition for the GHCB Lendacky, Thomas
2020-08-13 13:22 ` [PATCH v15 05/46] MdeModulePkg/DxeIplPeim: Support GHCB pages when creating page tables Lendacky, Thomas
2020-08-13 13:22 ` [PATCH v15 06/46] MdePkg/BaseLib: Add support for the XGETBV instruction Lendacky, Thomas
2020-08-13 13:22 ` [PATCH v15 07/46] MdePkg/BaseLib: Add support for the VMGEXIT instruction Lendacky, Thomas
2020-08-13 13:22 ` [PATCH v15 08/46] UefiCpuPkg: Implement library support for VMGEXIT Lendacky, Thomas
2020-08-13 13:22 ` [PATCH v15 09/46] OvmfPkg: Prepare OvmfPkg to use the VmgExitLib library Lendacky, Thomas
2020-08-13 13:22 ` [PATCH v15 10/46] UefiPayloadPkg: Prepare UefiPayloadPkg " Lendacky, Thomas
2020-08-13 13:22 ` [PATCH v15 11/46] UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC exception Lendacky, Thomas
2020-08-13 13:22 ` [PATCH v15 12/46] OvmfPkg/VmgExitLib: Implement library support for VmgExitLib in OVMF Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 13/46] OvmfPkg/VmgExitLib: Add support for IOIO_PROT NAE events Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 14/46] OvmfPkg/VmgExitLib: Support string IO " Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 15/46] OvmfPkg/VmgExitLib: Add support for CPUID " Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 16/46] OvmfPkg/VmgExitLib: Add support for MSR_PROT " Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 17/46] OvmfPkg/VmgExitLib: Add support for NPF NAE events (MMIO) Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 18/46] OvmfPkg/VmgExitLib: Add support for WBINVD NAE events Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 19/46] OvmfPkg/VmgExitLib: Add support for RDTSC " Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 20/46] OvmfPkg/VmgExitLib: Add support for RDPMC " Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 21/46] OvmfPkg/VmgExitLib: Add support for INVD " Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 22/46] OvmfPkg/VmgExitLib: Add support for VMMCALL " Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 23/46] OvmfPkg/VmgExitLib: Add support for RDTSCP " Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 24/46] OvmfPkg/VmgExitLib: Add support for MONITOR/MONITORX " Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 25/46] OvmfPkg/VmgExitLib: Add support for MWAIT/MWAITX " Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 26/46] OvmfPkg/VmgExitLib: Add support for DR7 Read/Write " Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 27/46] OvmfPkg/MemEncryptSevLib: Add an SEV-ES guest indicator function Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 28/46] OvmfPkg: Add support to perform SEV-ES initialization Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 29/46] OvmfPkg: Create a GHCB page for use during Sec phase Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 30/46] OvmfPkg/PlatformPei: Reserve GHCB-related areas if S3 is supported Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 31/46] OvmfPkg: Create GHCB pages for use during Pei and Dxe phase Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 32/46] OvmfPkg/PlatformPei: Move early GDT into ram when SEV-ES is enabled Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 33/46] UefiCpuPkg: Create an SEV-ES workarea PCD Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 34/46] OvmfPkg: Reserve a page in memory for the SEV-ES usage Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 35/46] OvmfPkg/PlatformPei: Reserve SEV-ES work area if S3 is supported Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 36/46] OvmfPkg/ResetVector: Add support for a 32-bit SEV check Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 37/46] OvmfPkg/Sec: Add #VC exception handling for Sec phase Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 38/46] OvmfPkg/Sec: Enable cache early to speed up booting Lendacky, Thomas
2020-08-13 13:23 ` [PATCH v15 39/46] OvmfPkg/QemuFlashFvbServicesRuntimeDxe: Bypass flash detection with SEV-ES Lendacky, Thomas
2020-08-13 16:24 ` [PATCH v15 40/46] UefiCpuPkg: Add a 16-bit protected mode code segment descriptor Lendacky, Thomas
2020-08-13 16:24 ` [PATCH v15 41/46] UefiCpuPkg/MpInitLib: Add CPU MP data flag to indicate if SEV-ES is enabled Lendacky, Thomas
2020-08-13 16:24 ` [PATCH v15 42/46] UefiCpuPkg: Allow AP booting under SEV-ES Lendacky, Thomas
2020-08-13 16:24 ` [PATCH v15 43/46] OvmfPkg: Use the SEV-ES work area for the SEV-ES AP reset vector Lendacky, Thomas
2020-08-13 16:24 ` [PATCH v15 44/46] OvmfPkg: Move the GHCB allocations into reserved memory Lendacky, Thomas
2020-08-13 16:24 ` [PATCH v15 45/46] UefiCpuPkg/MpInitLib: Prepare SEV-ES guest APs for OS use Lendacky, Thomas
2020-08-13 16:24 ` [PATCH v15 46/46] Maintainers.txt: Add reviewers for the OvmfPkg SEV-related files Lendacky, Thomas
2020-08-13 19:53 ` [PATCH v15 00/46] SEV-ES guest support Laszlo Ersek
2020-08-14 1:19 ` Liming Gao [this message]
[not found] ` <162AFDBB197F7CE0.20848@groups.io>
2020-08-17 4:09 ` [edk2-devel] " Liming Gao
2020-08-17 17:03 ` Laszlo Ersek
2020-08-17 17:55 ` Lendacky, Thomas
2020-08-18 1:16 ` Liming Gao
2020-08-18 13:04 ` Lendacky, Thomas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CY4PR11MB15269F3F067CFF113AD0FD2980400@CY4PR11MB1526.namprd11.prod.outlook.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox