From: "Min Xu" <min.m.xu@intel.com>
To: Brijesh Singh <brijesh.singh@amd.com>,
"devel@edk2.groups.io" <devel@edk2.groups.io>
Cc: James Bottomley <jejb@linux.ibm.com>,
"Yao, Jiewen" <jiewen.yao@intel.com>,
Tom Lendacky <thomas.lendacky@amd.com>,
"Justen, Jordan L" <jordan.l.justen@intel.com>,
Ard Biesheuvel <ardb+tianocore@kernel.org>,
Erdem Aktas <erdemaktas@google.com>,
"Michael Roth" <Michael.Roth@amd.com>
Subject: Re: [PATCH v3 2/3] OvmfPkg/ResetVector: update SEV support to use new work area format
Date: Thu, 19 Aug 2021 14:15:01 +0000 [thread overview]
Message-ID: <PH0PR11MB5064EAED9CDB5D3794F73877C5C09@PH0PR11MB5064.namprd11.prod.outlook.com> (raw)
In-Reply-To: <20210817134651.20444-3-brijesh.singh@amd.com>
Reviewed-by: Min Xu <min.m.xu@intel.com>
> -----Original Message-----
> From: Brijesh Singh <brijesh.singh@amd.com>
> Sent: Tuesday, August 17, 2021 9:47 PM
> To: devel@edk2.groups.io
> Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M
> <min.m.xu@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>; Tom Lendacky
> <thomas.lendacky@amd.com>; Justen, Jordan L <jordan.l.justen@intel.com>;
> Ard Biesheuvel <ardb+tianocore@kernel.org>; Erdem Aktas
> <erdemaktas@google.com>; Michael Roth <Michael.Roth@amd.com>; Brijesh
> Singh <brijesh.singh@amd.com>
> Subject: [PATCH v3 2/3] OvmfPkg/ResetVector: update SEV support to use new
> work area format
>
> BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
>
> Update the SEV support to switch to using the newer work area format.
>
> Cc: James Bottomley <jejb@linux.ibm.com>
> Cc: Min Xu <min.m.xu@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Tom Lendacky <thomas.lendacky@amd.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
> Cc: Erdem Aktas <erdemaktas@google.com>
> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
> ---
> OvmfPkg/ResetVector/ResetVector.inf | 1 +
> OvmfPkg/Sec/SecMain.inf | 2 ++
> OvmfPkg/Sec/SecMain.c | 36 ++++++++++++++++++++++-
> OvmfPkg/ResetVector/Ia32/AmdSev.asm | 8 +++++
> OvmfPkg/ResetVector/Ia32/PageTables64.asm | 4 +++
> OvmfPkg/ResetVector/ResetVector.nasmb | 1 +
> 6 files changed, 51 insertions(+), 1 deletion(-)
>
> diff --git a/OvmfPkg/ResetVector/ResetVector.inf
> b/OvmfPkg/ResetVector/ResetVector.inf
> index d028c92d8cfa..a2520dde5508 100644
> --- a/OvmfPkg/ResetVector/ResetVector.inf
> +++ b/OvmfPkg/ResetVector/ResetVector.inf
> @@ -43,6 +43,7 @@ [Pcd]
> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesSize
> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase
> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamSize
> + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase
>
> [FixedPcd]
> gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretBase
> diff --git a/OvmfPkg/Sec/SecMain.inf b/OvmfPkg/Sec/SecMain.inf index
> 7f78dcee2772..ea4b9611f52d 100644
> --- a/OvmfPkg/Sec/SecMain.inf
> +++ b/OvmfPkg/Sec/SecMain.inf
> @@ -70,6 +70,8 @@ [Pcd]
> gUefiOvmfPkgTokenSpaceGuid.PcdGuidedExtractHandlerTableSize
> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDecompressionScratchEnd
> gEfiMdeModulePkgTokenSpaceGuid.PcdInitValueInTempStack
> +
> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHead
> er
> + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase
>
> [FeaturePcd]
> gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire
> diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c index
> 9db67e17b2aa..707b0d4bbff4 100644
> --- a/OvmfPkg/Sec/SecMain.c
> +++ b/OvmfPkg/Sec/SecMain.c
> @@ -807,6 +807,36 @@ SevEsProtocolCheck (
> Ghcb->GhcbUsage = GHCB_STANDARD_USAGE; }
>
> +/**
> + Determine if the SEV is active.
> +
> + During the early booting, GuestType is set in the work area. Verify
> + that it is an SEV guest.
> +
> + @retval TRUE SEV is enabled
> + @retval FALSE SEV is not enabled
> +
> +**/
> +STATIC
> +BOOLEAN
> +IsSevGuest (
> + VOID
> + )
> +{
> + OVMF_WORK_AREA *WorkArea;
> +
> + //
> + // Ensure that the size of the Confidential Computing work area
> + header // is same as what is provided through a fixed PCD.
> + //
> + ASSERT ((UINTN) FixedPcdGet32
> (PcdOvmfConfidentialComputingWorkAreaHeader) ==
> + sizeof(CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER));
> +
> + WorkArea = (OVMF_WORK_AREA *) FixedPcdGet32
> (PcdOvmfWorkAreaBase);
> +
> + return ((WorkArea != NULL) && (WorkArea->Header.GuestType ==
> +GUEST_TYPE_AMD_SEV)); }
> +
> /**
> Determine if SEV-ES is active.
>
> @@ -826,9 +856,13 @@ SevEsIsEnabled (
> {
> SEC_SEV_ES_WORK_AREA *SevEsWorkArea;
>
> + if (!IsSevGuest()) {
> + return FALSE;
> + }
> +
> SevEsWorkArea = (SEC_SEV_ES_WORK_AREA *) FixedPcdGet32
> (PcdSevEsWorkAreaBase);
>
> - return ((SevEsWorkArea != NULL) && (SevEsWorkArea->SevEsEnabled != 0));
> + return (SevEsWorkArea->SevEsEnabled != 0);
> }
>
> VOID
> diff --git a/OvmfPkg/ResetVector/Ia32/AmdSev.asm
> b/OvmfPkg/ResetVector/Ia32/AmdSev.asm
> index aa95d06eaddb..87d81b01e263 100644
> --- a/OvmfPkg/ResetVector/Ia32/AmdSev.asm
> +++ b/OvmfPkg/ResetVector/Ia32/AmdSev.asm
> @@ -171,6 +171,9 @@ CheckSevFeatures:
> bt eax, 0
> jnc NoSev
>
> + ; Set the work area header to indicate that the SEV is enabled
> + mov byte[WORK_AREA_GUEST_TYPE], 1
> +
> ; Check for SEV-ES memory encryption feature:
> ; CPUID Fn8000_001F[EAX] - Bit 3
> ; CPUID raises a #VC exception if running as an SEV-ES guest
> @@ -257,6 +260,11 @@ SevExit:
> IsSevEsEnabled:
> xor eax, eax
>
> + ; During CheckSevFeatures, the WORK_AREA_GUEST_TYPE is set
> + ; to 1 if SEV is enabled.
> + cmp byte[WORK_AREA_GUEST_TYPE], 1
> + jne SevEsDisabled
> +
> ; During CheckSevFeatures, the SEV_ES_WORK_AREA was set to 1 if
> ; SEV-ES is enabled.
> cmp byte[SEV_ES_WORK_AREA], 1
> diff --git a/OvmfPkg/ResetVector/Ia32/PageTables64.asm
> b/OvmfPkg/ResetVector/Ia32/PageTables64.asm
> index eacdb69ddb9f..f688909f1c7d 100644
> --- a/OvmfPkg/ResetVector/Ia32/PageTables64.asm
> +++ b/OvmfPkg/ResetVector/Ia32/PageTables64.asm
> @@ -42,6 +42,10 @@ BITS 32
> ;
> SetCr3ForPageTables64:
>
> + ; Clear the WorkArea header. The SEV probe routines will populate the
> + ; work area when detected.
> + mov byte[WORK_AREA_GUEST_TYPE], 0
> +
> OneTimeCall CheckSevFeatures
> xor edx, edx
> test eax, eax
> diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb
> b/OvmfPkg/ResetVector/ResetVector.nasmb
> index acec46a32450..d1d800c56745 100644
> --- a/OvmfPkg/ResetVector/ResetVector.nasmb
> +++ b/OvmfPkg/ResetVector/ResetVector.nasmb
> @@ -72,6 +72,7 @@
> %define GHCB_PT_ADDR (FixedPcdGet32 (PcdOvmfSecGhcbPageTableBase))
> %define GHCB_BASE (FixedPcdGet32 (PcdOvmfSecGhcbBase))
> %define GHCB_SIZE (FixedPcdGet32 (PcdOvmfSecGhcbSize))
> + %define WORK_AREA_GUEST_TYPE (FixedPcdGet32
> (PcdOvmfWorkAreaBase))
> %define SEV_ES_WORK_AREA (FixedPcdGet32 (PcdSevEsWorkAreaBase))
> %define SEV_ES_WORK_AREA_RDRAND (FixedPcdGet32
> (PcdSevEsWorkAreaBase) + 8)
> %define SEV_ES_WORK_AREA_ENC_MASK (FixedPcdGet32
> (PcdSevEsWorkAreaBase) + 16)
> --
> 2.17.1
next prev parent reply other threads:[~2021-08-19 14:15 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-17 13:46 [PATCH v3 0/3] reuse the SevEsWork area Brijesh Singh
2021-08-17 13:46 ` [PATCH v3 1/3] OvmfPkg: introduce a common work area Brijesh Singh
2021-08-19 14:14 ` [edk2-devel] " Min Xu
2021-08-17 13:46 ` [PATCH v3 2/3] OvmfPkg/ResetVector: update SEV support to use new work area format Brijesh Singh
2021-08-19 14:15 ` Min Xu [this message]
2021-08-17 13:46 ` [PATCH v3 3/3] OvmfPkg/ResetVector: move the GHCB page setup in AmdSev.asm Brijesh Singh
2021-08-19 14:15 ` Min Xu
2021-08-25 6:31 ` [PATCH v3 0/3] reuse the SevEsWork area Yao, Jiewen
2021-08-27 13:14 ` Yao, Jiewen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=PH0PR11MB5064EAED9CDB5D3794F73877C5C09@PH0PR11MB5064.namprd11.prod.outlook.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox