Re: [edk2-devel] [PATCH 04/16] UefiCpuPkg/CcExitLib: Extend the CcExitLib library to support an SVSM

["Ni, Ray" <ray.ni@intel.com>]

Acked-by: Ray Ni <ray.ni@intel.com>

Thanks,
Ray
> -----Original Message-----
> From: Tom Lendacky <thomas.lendacky@amd.com>
> Sent: Saturday, January 27, 2024 6:13 AM
> To: devel@edk2.groups.io
> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>; Aktas, Erdem
> <erdemaktas@google.com>; Gerd Hoffmann <kraxel@redhat.com>; Yao,
> Jiewen <jiewen.yao@intel.com>; Laszlo Ersek <lersek@redhat.com>; Liming
> Gao <gaoliming@byosoft.com.cn>; Kinney, Michael D
> <michael.d.kinney@intel.com>; Xu, Min M <min.m.xu@intel.com>; Liu,
> Zhiguang <zhiguang.liu@intel.com>; Kumar, Rahul R
> <rahul.r.kumar@intel.com>; Ni, Ray <ray.ni@intel.com>; Michael Roth
> <michael.roth@amd.com>
> Subject: [PATCH 04/16] UefiCpuPkg/CcExitLib: Extend the CcExitLib library to
> support an SVSM
> 
> BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654
> 
> In order to support an SEV-SNP guest running under an SVSM at VMPL1 or
> lower, the CcExitLib library must be extended with new intefaces.
> 
> This includes an interface to detect if running under an SVSM, an
> interface to return the current VMPL, an interface to perform memory
> validation and an interface to set or clear the attribute that allows a
> page to be used as a VMSA.
> 
> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
> ---
>  UefiCpuPkg/Include/Library/CcExitLib.h           | 71 ++++++++++++++++-
>  UefiCpuPkg/Library/CcExitLibNull/CcExitLibNull.c | 82
> +++++++++++++++++++-
>  2 files changed, 151 insertions(+), 2 deletions(-)
> 
> diff --git a/UefiCpuPkg/Include/Library/CcExitLib.h
> b/UefiCpuPkg/Include/Library/CcExitLib.h
> index 3381d583691f..2a9de5d5e8e7 100644
> --- a/UefiCpuPkg/Include/Library/CcExitLib.h
> +++ b/UefiCpuPkg/Include/Library/CcExitLib.h
> @@ -6,7 +6,7 @@
>       #VC exceptions.
>     - Handle #VE exception in TDX.
> 
> -  Copyright (C) 2020, Advanced Micro Devices, Inc. All rights reserved.<BR>
> +  Copyright (C) 2020 - 2024, Advanced Micro Devices, Inc. All rights
> reserved.<BR>
>    Copyright (c) 2020 - 2022, Intel Corporation. All rights reserved.<BR>
>    SPDX-License-Identifier: BSD-2-Clause-Patent
> 
> @@ -147,6 +147,75 @@ CcExitHandleVc (
>    IN OUT EFI_SYSTEM_CONTEXT  SystemContext
>    );
> 
> +/**
> +  Report the presence of an Secure Virtual Services Module (SVSM).
> +
> +  Determines the presence of an SVSM.
> +
> +  @retval  TRUE                   An SVSM is present
> +  @retval  FALSE                  An SVSM is not present
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +CcExitSnpSvsmPresent (
> +  VOID
> +  );
> +
> +/**
> +  Report the VMPL level at which the SEV-SNP guest is running.
> +
> +  Determines the VMPL level at which the guest is running. If an SVSM is
> +  not present, then it must be VMPL0, otherwise return what is reported
> +  by the SVSM.
> +
> +  @return                         The VMPL level
> +
> +**/
> +UINT8
> +EFIAPI
> +CcExitSnpGetVmpl (
> +  VOID
> +  );
> +
> +/**
> +  Perform a PVALIDATE operation for the page ranges specified.
> +
> +  Validate or rescind the validation of the specified pages.
> +
> +  @param[in]       Info           Pointer to a page state change structure
> +
> +**/
> +VOID
> +EFIAPI
> +CcExitSnpPvalidate (
> +  IN SNP_PAGE_STATE_CHANGE_INFO  *Info
> +  );
> +
> +/**
> +  Perform an RMPADJUST operation to alter the VMSA setting of a page.
> +
> +  Add or remove the VMSA attribute for a page.
> +
> +  @param[in]       Vmsa           Pointer to an SEV-ES save area page
> +  @param[in]       ApicId         APIC ID associated with the VMSA
> +  @param[in]       SetVmsa        Boolean indicator as to whether to set or
> +                                  or clear the VMSA setting for the page
> +
> +  @retval  EFI_SUCCESS            RMPADJUST operation successful
> +  @retval  EFI_UNSUPPORTED        Operation is not supported
> +  @retval  EFI_INVALID_PARAMETER  RMPADJUST operation failed, an invalid
> +                                  parameter was supplied
> +
> +**/
> +EFI_STATUS
> +EFIAPI
> +CcExitSnpVmsaRmpAdjust (
> +  IN SEV_ES_SAVE_AREA  *Vmsa,
> +  IN UINT32            ApicId,
> +  IN BOOLEAN           SetVmsa
> +  );
> +
>  /**
>    Handle a #VE exception.
> 
> diff --git a/UefiCpuPkg/Library/CcExitLibNull/CcExitLibNull.c
> b/UefiCpuPkg/Library/CcExitLibNull/CcExitLibNull.c
> index 230e50705b4a..60b19c0433c7 100644
> --- a/UefiCpuPkg/Library/CcExitLibNull/CcExitLibNull.c
> +++ b/UefiCpuPkg/Library/CcExitLibNull/CcExitLibNull.c
> @@ -1,7 +1,7 @@
>  /** @file
>    CcExit Base Support Library.
> 
> -  Copyright (C) 2020, Advanced Micro Devices, Inc. All rights reserved.<BR>
> +  Copyright (C) 2020 - 2024, Advanced Micro Devices, Inc. All rights
> reserved.<BR>
>    Copyright (c) 2020 - 2022, Intel Corporation. All rights reserved.<BR>
>    SPDX-License-Identifier: BSD-2-Clause-Patent
> 
> @@ -165,6 +165,86 @@ CcExitHandleVc (
>    return EFI_UNSUPPORTED;
>  }
> 
> +/**
> +  Report the presence of an Secure Virtual Services Module (SVSM).
> +
> +  Determines the presence of an SVSM.
> +
> +  @retval  TRUE                   An SVSM is present
> +  @retval  FALSE                  An SVSM is not present
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +CcExitSnpSvsmPresent (
> +  VOID
> +  )
> +{
> +  return FALSE;
> +}
> +
> +/**
> +  Report the VMPL level at which the SEV-SNP guest is running.
> +
> +  Determines the VMPL level at which the guest is running. If an SVSM is
> +  not present, then it must be VMPL0, otherwise return what is reported
> +  by the SVSM.
> +
> +  @return                         The VMPL level
> +
> +**/
> +UINT8
> +EFIAPI
> +CcExitSnpGetVmpl (
> +  VOID
> +  )
> +{
> +  return 0;
> +}
> +
> +/**
> +  Perform a PVALIDATE operation for the page ranges specified.
> +
> +  Validate or rescind the validation of the specified pages.
> +
> +  @param[in]       Info           Pointer to a page state change structure
> +
> +**/
> +VOID
> +EFIAPI
> +CcExitSnpPvalidate (
> +  IN SNP_PAGE_STATE_CHANGE_INFO  *Info
> +  )
> +{
> +}
> +
> +/**
> +  Perform an RMPADJUST operation to alter the VMSA setting of a page.
> +
> +  Add or remove the VMSA attribute for a page.
> +
> +  @param[in]       Vmsa           Pointer to an SEV-ES save area page
> +  @param[in]       ApicId         APIC ID associated with the VMSA
> +  @param[in]       SetVmsa        Boolean indicator as to whether to set or
> +                                  or clear the VMSA setting for the page
> +
> +  @retval  EFI_SUCCESS            RMPADJUST operation successful
> +  @retval  EFI_UNSUPPORTED        Operation is not supported
> +  @retval  EFI_INVALID_PARAMETER  RMPADJUST operation failed, an invalid
> +                                  parameter was supplied
> +
> +**/
> +EFI_STATUS
> +EFIAPI
> +CcExitSnpVmsaRmpAdjust (
> +  IN SEV_ES_SAVE_AREA  *Vmsa,
> +  IN UINT32            ApicId,
> +  IN BOOLEAN           SetVmsa
> +  )
> +{
> +  return EFI_UNSUPPORTED;
> +}
> +
>  /**
>    Handle a #VE exception.
> 
> --
> 2.42.0



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#115019): https://edk2.groups.io/g/devel/message/115019
Mute This Topic: https://groups.io/mt/103986445/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-