From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM02-DM3-obe.outbound.protection.outlook.com (NAM02-DM3-obe.outbound.protection.outlook.com [40.107.95.48]) by mx.groups.io with SMTP id smtpd.web11.40068.1636339793942808928 for ; Sun, 07 Nov 2021 18:49:54 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@amd.com header.s=selector1 header.b=oAJ3kuzU; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.95.48, mailfrom: brijesh.singh@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=lmKBWpg/Aief/5zTPjNP8CRPKh7CJ8Atmd6XVoBFpKaTkZgniz5a8qY8XBVPbyso9JGYxuIEHWy9S/Ki4u9K3KTvX2BfqJx25vtarDmKvh8zTMVOXHcRLgoaniZsSAPc92lCUb5wOmgswnoumaZhDtdFQYVvf4tjiCt0rUQXBAokevGj9yKFRYf2YGY6di734HnFgt11+/CLv4kIoIvxl2m8m144Aund9fQs9brWD/YziC9PWJ9yuZk3aiM6c5oGGj+nq3ib/t+nM5vLwpwQDiU1PnJLH7Fgq2VWjNsk6YbDIFTrYeljuBy4WFi3P5eOSqIOYq/OURZF3viZgT/KuA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=k/TecQDpPnKEtiyTlkBqd3sFpC6Azo+THSyK10iU2ig=; b=aUfbSejrAsAscnkLICLg03Bn198teGtWmyQ1eGEAG03FHe9zwU0UOCpZmLJzc6AYvAKJemnrluZsWm7O57evu4huyfbV/ZLpkLAHwtFeyanSFhCzwQlk7wxjg7VgAQ3qzJDoujTx2a8ikvued1GuqUaRpu5dZUBADFE9cCG7dK+c50NLnjvWdiAOGoFzaAdQlQ+63PQxN4vBZl8r5Gi3yo3OfnOoSKdk3uNQj0IUbaIR24RrM8d+74Cwt1SWz+P8xyzzYSN7OJSicz0ZWDJYADWoG7o5hVGx/dCjGiLDHTd+r6m4XAmZR0yu24BoJ9niYPg1yk/CTzyAyYQ5bQWZ3g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=k/TecQDpPnKEtiyTlkBqd3sFpC6Azo+THSyK10iU2ig=; b=oAJ3kuzUvN6wshmL6uk55Q62AUZOggy4m+2lxY6EFC/s/wRL1lv9e4qqDNJQ72XVZLc3uESyFKshVHLveX6s27eEIlcxEzdHA9CYF+OgiEpfB7EYkQ/dhK/NWuI5/ZcX+RoIpoY/tb/IDju2uub810tO3SG0idiJ3SdS/E8XEEQ= Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SN6PR12MB2784.namprd12.prod.outlook.com (2603:10b6:805:68::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4669.11; Mon, 8 Nov 2021 02:49:51 +0000 Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::e4da:b3ea:a3ec:761c]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::e4da:b3ea:a3ec:761c%7]) with mapi id 15.20.4669.016; Mon, 8 Nov 2021 02:49:50 +0000 From: "Brijesh Singh" To: "Yao, Jiewen" , "devel@edk2.groups.io" CC: James Bottomley , "Xu, Min M" , "Lendacky, Thomas" , "Justen, Jordan L" , Ard Biesheuvel , Erdem Aktas , "Roth, Michael" , Gerd Hoffmann , "Ni, Ray" , "Kumar, Rahul1" Subject: Re: [edk2-devel] [PATCH v11 00/32] Add AMD Secure Nested Paging (SEV-SNP) support Thread-Topic: [edk2-devel] [PATCH v11 00/32] Add AMD Secure Nested Paging (SEV-SNP) support Thread-Index: AQHXx8R2RMy2AKmuH06FeLreB/xINKvhYnYAgAFy6wCABxt7gIAAKLAAgAOW4oCAC0o954AAAmOAgAAIY1U= Date: Mon, 8 Nov 2021 02:49:50 +0000 Message-ID: References: <20211023041349.1263726-1-brijesh.singh@amd.com> <7c252991-d51a-461e-da8e-8f1de6fe41ba@amd.com> <16B33B74BAC60F9D.13000@groups.io> In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_88914ebd-7e6c-4e12-a031-a9906be2db14_Enabled=True;MSIP_Label_88914ebd-7e6c-4e12-a031-a9906be2db14_SiteId=3dd8961f-e488-4e60-8e11-a82d994e183d;MSIP_Label_88914ebd-7e6c-4e12-a031-a9906be2db14_SetDate=2021-11-08T02:49:49.987Z;MSIP_Label_88914ebd-7e6c-4e12-a031-a9906be2db14_Name=AMD Official Use Only;MSIP_Label_88914ebd-7e6c-4e12-a031-a9906be2db14_ContentBits=0;MSIP_Label_88914ebd-7e6c-4e12-a031-a9906be2db14_Method=Standard; suggested_attachment_session_id: 16133631-1112-4852-9492-eef61e7581bb authentication-results: intel.com; dkim=none (message not signed) header.d=none;intel.com; dmarc=none action=none header.from=amd.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e7a51777-8304-498c-8c43-08d9a2626f72 x-ms-traffictypediagnostic: SN6PR12MB2784: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: DTLt9V0c9xHVQIW0IydjOHUJ0I5djXhA25ithzfKjbXq/lm0sQQSdlL8nsSZ9Tk04K2zIMTMwA8Vy9ZiQf3UWjaSCeGW0qeJPYDN8sua2vnIszt7VhXfjJZrW16JrV6U86FBUptBAn8r23YGYa52fCBHZNkDh3Um+/I4RJsSMlxeQ4nWbtW7oTDjdQZgrrdskJexT8Sh2QJ2a/GNHqJUETU8pqCVbe8Ynw8uyCV5Za3ENchT+rcHC8fBrbJ7Om7ThHcqfJgJAGgJEKEs1FjaOhAyxNHJWrkl9bnaDfP7rgjarouA4xizGwguj72CztWg9444V8eiRBnuxeS55Gyoh5kl6XBdH98XrSO01ZRQiBNv64zKqaNQlGsXN17uuYbYQzV6Wv1SeINmAeTgw+qtqosr9OWGaSWi4LYJ1YLGV71NWMA6aj8GgBTHJbt6Vzwx1k4uNe+GdssPR0gYPwxGdQjO5pSbQ2IJvubi2gxbbRl4WUG0VANnRtbvumVrfNAvnUtow+OhA98cktiXbgH3Jc/iGfy/xnY4dE/zsx4R9Viby1CQPAyEbbwfFlPjnr9TnUjSNwaPFL1btnfbrv4ViasMqmDTlOnbw11uc9kasjv/IOC2pibGv7bGzzzQmvnpXrBOaCZ1grdwf5yVFC2M9LaSzqZAAEHkigbDTHhpvRM/Z+zJ7caP5AIKqAERq0RCj8Za/jX4p4YQYn2ucjpsE9fo6esZfuiV6NJNJsVqThyZ6vZzpSPXvySbo5SajJ5ywyqJ0MnaaX0602vZFiKcdCbAB1BMZDlVdnbTCWfTiKw8WfZo+W0MNtZ4DxqaJdKLfcmTfOtJi+JtK+fRYjcOIg== x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2718.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(9686003)(8936002)(55016002)(508600001)(966005)(38100700002)(122000001)(66476007)(66556008)(66446008)(64756008)(76116006)(66946007)(45080400002)(26005)(186003)(8676002)(54906003)(2906002)(110136005)(7416002)(316002)(4326008)(30864003)(19627235002)(86362001)(83380400001)(52536014)(19627405001)(6506007)(5660300002)(71200400001)(7696005)(166002)(53546011)(38070700005)(33656002)(579004);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?519DbeLQbWEFj5DNKzHDT/0s1kjJBwZMGQVDmOIJ3A4UreAXdB5XVYZIuNGq?= =?us-ascii?Q?0iMttJUEN+zqq8z8edbB1TeNNsXc/NC0VH9Xvx+dL987Iz8CX+K53TkbWuVA?= =?us-ascii?Q?W9kBgWoEZgaP6RoANFYL+csHMUj4PGlWjClPhWdsNeyOQ4XDk05wu61V7vx4?= =?us-ascii?Q?bmPtOWbWMtfYWYK2KWBLOrPa6lztOaJGn2NFu75bRykK/jMHF8e6aM7Do2mZ?= =?us-ascii?Q?KYaBxs8VDvxOZ3lN95G9nISXJHwiY+e3FMRRVd6HYIPw8qUXKIr9LkyIsKWu?= =?us-ascii?Q?HocI7nP8Mm1XpZW0khd+5ufUilLGEeVDUyvhVK6FNtdnE1WPVpejSc2rOuO+?= =?us-ascii?Q?WYwZboX50mYlqnK02hUbT+JVXEdnh8nAg6mmuqtY9mpUX6Wb1E8bbkLVm2E2?= =?us-ascii?Q?MdeY0WiT9Uq1UjCRS6ZJzeCBQsSKaKPQZfDHvzfEjuI5mqa25GpwLiMz1dDy?= =?us-ascii?Q?+HMIqOX6udjTtSIIceDLOV00SdZZIwkNY/AH5sljN+RP92EpMRYIhvewW5Wo?= =?us-ascii?Q?EkYJ/HQ7ZVld08Ntt3evipdw7U7dDuDtVZfnOdboe2bmXqKizbccRSjMpNHP?= =?us-ascii?Q?+rqn9DHxVwJlhZuiTPOv7S/vFGX5+dQ990T0mpZBRJDTAEkVK200XLqCDkaM?= =?us-ascii?Q?Gzb/niY4we+WTK0O9Ha7u1SEzZDhrhiL9ep/KMpBIYSC+tWH+uXBcS3K9nhj?= =?us-ascii?Q?t+mopYKcY3BQXj+nNd2U7FEx4BQPOaSkZSppl29evGIU1IF3XSQhbeCsLeN2?= =?us-ascii?Q?PWjtSzOhCx0DvfKdEOTlmzpPkuN74tbN2yVFJgtQqMzH19Tr5+BQ5qJ8sfY9?= =?us-ascii?Q?d/ceabsfjO5fs5ilQZANGlcfQFDwF36rGd13gGMmFUf2d0DBPt7PzMAPQLQ2?= =?us-ascii?Q?wCe0fg/H1H2I+4xiAT19nIuLFM/8aLOpRonJ7k/bk7srYcq3fmsx4nDJkKHl?= =?us-ascii?Q?f0CccgoZJMKK4hZfP5y7YRZL2Sxuy1ltExjqXurgSYI3EwZzouG6CUMQJO69?= =?us-ascii?Q?VdhkVcgtCaKqcMTdXRH9GvN6PXfAs70rmT4ajN1DzmPnSsHqMVA8HbkRxFDw?= =?us-ascii?Q?NXBoAvevf2qq207gVNj6Kd3qFeD21xFc4p2SpO68wyYhGUJhxdKVP6CB+99o?= =?us-ascii?Q?JV9mlBPUnEebouJNpMcUdvn9BNAhBLerrFExSRX1+uRKTOfshwrQoMc4ZQIE?= =?us-ascii?Q?dGCx1rjzKHy/1Ddu773bWGZU4JQD/m0/fAje/A6ulLS5teAGcK64uvINOLmx?= =?us-ascii?Q?boG0S0w6HsnM8E1OCsoYGnsP8u3z3TeyjOP4vmQjwRhKrpmCOY8asMtUFkJF?= =?us-ascii?Q?kl9NuScTz+LIjVJgwnlHZI4OxNERE4IaM4hP1KPg68mDz2sf5UkoGWP+nnyg?= =?us-ascii?Q?4iy8K1dwuTDzyRIO8MeWmD13YSbalFJ1cFmPV1qM2eLh1J3id5QJCvLL9iAs?= =?us-ascii?Q?J9/6I8E7RZ3RtlMCS3zNqDqHhV+fvEFVocCuAWANeMMrbiasRnAZGz84zbyc?= =?us-ascii?Q?emN+hu8VMTh1XDAjpw8PFoOXZkX8e1GlNaI6fJnhUoJ3fBYO/lZSSKkUEJtY?= =?us-ascii?Q?MWZfP8FOuPLRFdb7lSSgfebx+gsoLEuGeaXb+W17u4ONfhusEImv2MtfP9Uu?= =?us-ascii?Q?cQ=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: e7a51777-8304-498c-8c43-08d9a2626f72 X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Nov 2021 02:49:50.8309 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: SlhtWNAdCCJxLlnsvqRHeNPlAc4dOr46KdhL2ZYMQpFJXKH6Y+eUXUgbMVRLZgTL4EvHCxUt/xOQllKYh+6Qpw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR12MB2784 Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_SN6PR12MB2718B0F70360FE22AD7A2CCAE5919SN6PR12MB2718namp_" --_000_SN6PR12MB2718B0F70360FE22AD7A2CCAE5919SN6PR12MB2718namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable [AMD Official Use Only] Without UefiCpuPkg we will have a broken SNP support and I would prefer not= to commit a broken SEV-SNP support. The UefiCpuPkg is required for the mul= tiple CPU boot and based all the feedback we have added a new ConfidentialC= ompting PCD that is set and used for OVMF. Splitting all that support is mu= ch more work for no reason. I will wait couple of more days to see if UefiCpuPkg maintainer reply other= wise I will go ahead and send v12 with the rebased. thanks, Brijesh ________________________________ From: Yao, Jiewen Sent: Sunday, November 7, 2021 8:14 PM To: Singh, Brijesh ; devel@edk2.groups.io Cc: James Bottomley ; Xu, Min M ; L= endacky, Thomas ; Justen, Jordan L ; Ard Biesheuvel ; Erdem Aktas ; Roth, Michael ; Gerd Hoffmann ; Ni, Ray ; Kumar, Rahul1 ; Yao, Jiewen Subject: RE: [edk2-devel] [PATCH v11 00/32] Add AMD Secure Nested Paging (S= EV-SNP) support [AMD Official Use Only] I recommend you split the patch set to OvmfPkg update and UefiPkg update, u= nless there is strong reason that you have to mix them together. With that, I can merge the OvmfPkg at first and we can move forward there, = while waiting UefiPkg review. If you agree, please rebase and resubmit. Thank you Yao Jiewen From: Singh, Brijesh Sent: Monday, November 8, 2021 10:11 AM To: Yao, Jiewen ; devel@edk2.groups.io; Singh, Brijes= h Cc: James Bottomley ; Xu, Min M ; L= endacky, Thomas ; Justen, Jordan L ; Ard Biesheuvel ; Erdem Aktas ; Roth, Michael ; Gerd Hoffmann ; Ni, Ray ; Kumar, Rahul1 Subject: Re: [edk2-devel] [PATCH v11 00/32] Add AMD Secure Nested Paging (S= EV-SNP) support [AMD Official Use Only] Hi, I am not getting any response from the UefiCpuPkg maintainers, I am not su= re if the Ray/Rahul are on vacation or need more information. Jiewen and Gerd, Any recommendations how we proceed further ? I can send the rebased version= and we can go ahead and commit it. If UefiCpuPkg maintainer does not like = something, then I am always happy to rework the stuff after the commit. I w= ould like to send some cleanup patches post SNP series that will simplify s= ome of the MemEncryptIs{Sev,Es,Snp}Enabled() based on our recent workarea p= atches. It will also help/align with the TDX series. -Brijesh ________________________________ From: devel@edk2.groups.io > on behalf of Brijesh Singh via groups.io <= brijesh.singh=3Damd.com@groups.io= > Sent: Sunday, October 31, 2021 4:40 PM To: Yao, Jiewen >; devel@= edk2.groups.io > Cc: Singh, Brijesh >; J= ames Bottomley >; Xu, Min M <= min.m.xu@intel.com>; Lendacky, Thomas >; Justen, Jordan L >; Ard Biesheuvel >; Erdem Aktas >; Roth, Michael >; Gerd Hoffmann >; Ray Ni >; Rahul Kumar > Subject: Re: [edk2-devel] [PATCH v11 00/32] Add AMD Secure Nested Paging (S= EV-SNP) support Hi Ray and Rahul, Gentle ping. Could you please Ack or R-b the files touched in UefiCpuPkg? -Brijesh On 10/29/21 9:52 AM, Brijesh Singh wrote: > Hi Jiewen, > > I have not heard anything back from UefiCpuPkg maintainer yet, I will > send another gentle ping on Monday again and hope maintainer get to it. > > -Brijesh > > On 10/29/21 7:26 AM, Yao, Jiewen wrote: >> Hi Brijesh >> Have you got R-B from UefiCpuPkg maintainer? >> >> >> >>> -----Original Message----- >>> From: Brijesh Singh > >>> Sent: Monday, October 25, 2021 7:54 AM >>> To: devel@edk2.groups.io; Yao, Jiewen > >>> Cc: brijesh.singh@amd.com; James Bottomle= y >; Xu, Min M >>> >; Tom Lendacky >; Justen, >>> Jordan L >;= Ard Biesheuvel >>> >; Erdem Ak= tas >; >>> Michael Roth >; Gerd = Hoffmann > >>> Subject: Re: [edk2-devel] [PATCH v11 00/32] Add AMD Secure Nested Pagin= g >>> (SEV-SNP) support >>> >>> Thank Jiewen, >>> >>> I have ping'ed UefiCpuPkg maintainer (Ray and Rahul) on every patch >>> which touches the UefiCpuPkg. If maintainer wants me to rework on >>> something then I will work accordingly. If they are okay with v11 then >>> now the merge will create a conflict (due to the TDX patches merge >>> commit). I have rebased my series to the recent master and have pushed >>> it here: https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A= %2F%2Fgithub.com%2FAMDESE%2Fovmf%2Ftree%2Fsnp-v12&data=3D04%7C01%7Cbrij= esh.singh%40amd.com%7C400c84b654c6423f739e08d99cb72382%7C3dd8961fe4884e608e= 11a82d994e183d%7C0%7C0%7C637713132658929026%7CUnknown%7CTWFpbGZsb3d8eyJWIjo= iMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdat= a=3DloCp%2FptHiWgvAtdp6zjDH5jDeq9mKLYBwedNU%2FT0IzM%3D&reserved=3D0. I can post the >>> series if you prefer it. >>> >>> thanks >>> >>> On 10/23/21 8:46 PM, Yao, Jiewen via groups.io wrote: >>>> Yes. I will try my best to merge. >>>> >>>> I checked the patch set but I did not find the "R-B" from UefiCpuPkg >>> maintainer. Neither from email nor from you v11. >>>> Did I miss something? >>>> >>>> Thank you >>>> Yao Jiewen >>>> >>>> >>>>> -----Original Message----- >>>>> From: Brijesh Singh > >>>>> Sent: Saturday, October 23, 2021 12:13 PM >>>>> To: devel@edk2.groups.io >>>>> Cc: James Bottomley >; = Xu, Min M >>> >; >>>>> Yao, Jiewen >; Tom = Lendacky >>>>> >; Justen, Jo= rdan L >; >>>>> Ard Biesheuvel >; Erdem Aktas >>>>> >; Michael Roth <= Michael.Roth@amd.com>; Gerd >>>>> Hoffmann >; Brijesh Singh= > >>>>> Subject: [PATCH v11 00/32] Add AMD Secure Nested Paging (SEV-SNP) >>> support >>>>> Hi Gerd and Jiewen, >>>>> >>>>> CI was a bit unstable during my v10 submission, so, I was not able to >>>>> run it to the completion. Finally, I managed to get the CI going, >>>>> and it reported few Windows 32-bit build errors. The v11 fixes those = build >>>>> errors. Please consider this for the merge. >>>>> >>>>> Thank you so much for all your support in reviewing the series. >>>>> >>>>> ---------------------------------------------------------------------= -------- >>>>> BZ: >>> https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fbug= zilla. >>> tianocore.org%2Fshow_bug.cgi%3Fid%3D3275&data=3D04%7C01%7Cbrijesh. >>> singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8961fe488 >>> 4e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUnknown%7 >>> CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJ >>> XVCI6Mn0%3D%7C3000&sdata=3DL41krO6G221HaIsG92FloIzgCDqMLAAsU26 >>> jaEMF7yw%3D&reserved=3D0 >>>>> SEV-SNP builds upon existing SEV and SEV-ES functionality while addin= g >>>>> new hardware-based memory protections. SEV-SNP adds strong memory >>>>> integrity >>>>> protection to help prevent malicious hypervisor-based attacks like da= ta >>>>> replay, memory re-mapping and more in order to create an isolated mem= ory >>>>> encryption environment. >>>>> >>>>> This series provides the basic building blocks to support booting the= SEV-SNP >>>>> VMs, it does not cover all the security enhancement introduced by the= SEV- >>> SNP >>>>> such as interrupt protection. >>>>> >>>>> Many of the integrity guarantees of SEV-SNP are enforced through a ne= w >>>>> structure called the Reverse Map Table (RMP). Adding a new page to SE= V-SNP >>>>> VM requires a 2-step process. First, the hypervisor assigns a page to= the >>>>> guest using the new RMPUPDATE instruction. This transitions the page = to >>>>> guest-invalid. Second, the guest validates the page using the new PVA= LIDATE >>>>> instruction. The SEV-SNP VMs can use the new "Page State Change Reque= st >>>>> NAE" >>>>> defined in the GHCB specification to ask hypervisor to add or remove = page >>>>> from the RMP table. >>>>> >>>>> Each page assigned to the SEV-SNP VM can either be validated or unval= idated, >>>>> as indicated by the Validated flag in the page's RMP entry. There are= two >>>>> approaches that can be taken for the page validation: Pre-validation = and >>>>> Lazy Validation. >>>>> >>>>> Under pre-validation, the pages are validated prior to first use. And= under >>>>> lazy validation, pages are validated when first accessed. An access t= o a >>>>> unvalidated page results in a #VC exception, at which time the except= ion >>>>> handler may validate the page. Lazy validation requires careful track= ing of >>>>> the validated pages to avoid validating the same GPA more than once. = The >>>>> recently introduced "Unaccepted" memory type can be used to communica= te >>>>> the >>>>> unvalidated memory ranges to the Guest OS. >>>>> >>>>> At this time we only support the pre-validation. OVMF detects all the >>> available >>>>> system RAM in the PEI phase. When SEV-SNP is enabled, the memory is >>> validated >>>>> before it is made available to the EDK2 core. >>>>> >>>>> Now that series contains all the basic support required to launch SEV= -SNP >>>>> guest. We are still missing the Interrupt security feature provided b= y the >>>>> SNP. The feature will be added after the base support is accepted. >>>>> >>>>> Additional resources >>>>> --------------------- >>>>> SEV-SNP whitepaper >>>>> >>> https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww= .a%2F&data=3D04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08= d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658929026%= 7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWw= iLCJXVCI6Mn0%3D%7C1000&sdata=3DWznkScyKwwPKfde08y%2Fb1KTmUgVt2al9%2Bupz= %2FATGOHE%3D&reserved=3D0 >>> md.com%2Fsystem%2Ffiles%2FTechDocs%2FSEV-SNP-strengthening-vm- >>> &data=3D04%7C01%7Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d0da >>> 08d9969026e2%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C63770 >>> 6369230826414%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQ >>> IjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=3DnVMSG% >>> 2FvSS2Wa21lu1lGrHr9OYX8hL7FoAcQXBBiCztc%3D&reserved=3D0 >>>>> isolation-with-integrity-protection-and-more.pdf >>>>> >>>>> APM 2: >>> https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww= .a%2F&data=3D04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08= d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658929026%= 7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWw= iLCJXVCI6Mn0%3D%7C1000&sdata=3DWznkScyKwwPKfde08y%2Fb1KTmUgVt2al9%2Bupz= %2FATGOHE%3D&reserved=3D0 >>> md.com%2Fsystem%2Ffiles%2FTechDocs%2F24593.pdf&data=3D04%7C01%7 >>> Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8 >>> 961fe4884e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUnk >>> nown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1h >>> aWwiLCJXVCI6Mn0%3D%7C3000&sdata=3DG8Xg2glOGY2EjHpeQ3WM4gZCh >>> uI0k8QcLDTbpJiTplg%3D&reserved=3D0 (section 15.36) >>>>> The complete source is available at >>>>> >>> https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgit= hub.c%2F&data=3D04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739= e08d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C6377131326589290= 26%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1h= aWwiLCJXVCI6Mn0%3D%7C1000&sdata=3DWx6h8FQ0289ZBQJa3iTk3Sb7zkmQO6D6VZFvR= X5lEeM%3D&reserved=3D0 >>> om%2FAMDESE%2Fovmf%2Ftree%2Fsnp- >>> v11&data=3D04%7C01%7Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d >>> 0da08d9969026e2%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C63 >>> 7706369230826414%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiL >>> CJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=3DHMH >>> Fq8G%2FPqdhzNW3Ashmc4%2Bmv1RcDULD4vniofhiS54%3D&reserved=3D0 >>>>> GHCB spec: >>>>> >>> https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdev= elop >>> er.amd.com%2Fwp- >>> content%2Fresources%2F56421.pdf&data=3D04%7C01%7Cbrijesh.singh%40a >>> md.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8961fe4884e608e11 >>> a82d994e183d%7C0%7C0%7C637706369230826414%7CUnknown%7CTWFpbGZ >>> sb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0 >>> %3D%7C3000&sdata=3DYiPgZU87fdnl5rJpD0E2ue9aTKbqUwizuBrKxom0FiU% >>> 3D&reserved=3D0 >>>>> SEV-SNP firmware specification: >>>>> >>> https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww= .a%2F&data=3D04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08= d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658939021%= 7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWw= iLCJXVCI6Mn0%3D%7C1000&sdata=3DHs%2BB9e%2FrZ0aYV3XPtJ9ZegaaIAMURuH1Dc9C= 1CeBauU%3D&reserved=3D0 >>> md.com%2Fsystem%2Ffiles%2FTechDocs%2F56860.pdf&data=3D04%7C01%7 >>> Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8 >>> 961fe4884e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUnk >>> nown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1h >>> aWwiLCJXVCI6Mn0%3D%7C3000&sdata=3DbfQsY4%2BRnlFGuD3Bg%2BFPb3l >>> RgSGgpomNocXswHqkm%2F4%3D&reserved=3D0 >>>>> Change since v10: >>>>> * fix 'unresolved external symbol __allshl' link error when building= I32 for >>>>> VS2017. >>>>> >>>>> Changes since v9: >>>>> * Move CCAttrs Pcd define in MdePkg >>>>> * Add comment to indicate that allocating the identity map PT is tem= porary >>> until >>>>> we get lazy validation >>>>> >>>>> Changes since v8: >>>>> * drop the generic metadata and make it specific to SEV. >>>>> >>>>> Changes since v7: >>>>> * Move SEV specific changes in MpLib in AmdSev file >>>>> * Update the GHCB register function to not restore the GHCB MSR beca= use >>>>> we were already in the MSR protocol mode. >>>>> * Drop the SNP name from PcdSnpSecPreValidate. >>>>> * Add new section for GHCB memory in the OVMF metadata. >>>>> >>>>> Change since v6: >>>>> * Drop the SNP boot block GUID and switch to using the Metadata guid= ed >>>>> structure >>>>> proposed by Min in TDX series. >>>>> * Exclude the GHCB page from the pre-validated region. It simplifies= the >>> reset >>>>> vector code where we do not need to unvalidate the GHCB page. >>>>> * Now that GHCB page is not validated so move the VMPL check from re= set >>>>> vector >>>>> code to the MemEncryptSevLib on the first page validation. >>>>> * Introduce the ConfidentialComputingGuestAttr PCD to communicate wh= ich >>>>> memory encryption is active so that MpInitLib can make use of it. >>>>> * Drop the SEVES specific PCD as the information can be communicated= via >>>>> the ConfidentialComputingGuestAttr. >>>>> * Move the SNP specific AP creation function in AmdSev.c. >>>>> * Define the SNP Blob GUID in a new file. >>>>> >>>>> Change since v5: >>>>> * When possible use the CPUID value from CPUID page >>>>> * Move the SEV specific functions from SecMain.c in AmdSev.c >>>>> * Rebase to the latest code >>>>> * Add the review feedback from Yao. >>>>> >>>>> Change since v4: >>>>> * Use the correct MSR for the SEV_STATUS >>>>> * Add VMPL-0 check >>>>> >>>>> Change since v3: >>>>> * ResetVector: move all SEV specific code in AmdSev.asm and add macr= os to >>>>> keep >>>>> the code readable. >>>>> * Drop extending the EsWorkArea to contain SNP specific state. >>>>> * Drop the GhcbGpa library and call the VmgExit directly to register= GHCB >>> GPA. >>>>> * Install the CC blob config table from AmdSevDxe instead of extendi= ng the >>>>> AmdSev/SecretsDxe for it. >>>>> * Add the separate PCDs for the SNP Secrets. >>>>> >>>>> Changes since v2: >>>>> * Add support for the AP creation. >>>>> * Use the module-scoping override to make AmdSevDxe use the IO port = for >>> PCI >>>>> reads. >>>>> * Use the reserved memory type for CPUID and Secrets page. >>>>> * >>>>> Changes since v1: >>>>> * Drop the interval tree support to detect the pre-validated overlap= region. >>>>> * Use an array to keep track of pre-validated regions. >>>>> * Add support to query the Hypervisor feature and verify that SNP fe= ature is >>>>> supported. >>>>> * Introduce MemEncryptSevClearMmioPageEncMask() to clear the C-bit >>> from >>>>> MMIO ranges. >>>>> * Pull the SevSecretDxe and SevSecretPei into OVMF package build. >>>>> * Extend the SevSecretDxe to expose confidential computing blob loca= tion >>>>> through >>>>> EFI configuration table. >>>>> >>>>> Brijesh Singh (28): >>>>> OvmfPkg/SecMain: move SEV specific routines in AmdSev.c >>>>> UefiCpuPkg/MpInitLib: move SEV specific routines in AmdSev.c >>>>> OvmfPkg/ResetVector: move clearing GHCB in SecMain >>>>> OvmfPkg/ResetVector: introduce SEV metadata descriptor for VMM use >>>>> OvmfPkg: reserve SNP secrets page >>>>> OvmfPkg: reserve CPUID page >>>>> OvmfPkg/ResetVector: pre-validate the data pages used in SEC phase >>>>> OvmfPkg/MemEncryptSevLib: add MemEncryptSevSnpEnabled() >>>>> OvmfPkg/SecMain: register GHCB gpa for the SEV-SNP guest >>>>> OvmfPkg/PlatformPei: register GHCB gpa for the SEV-SNP guest >>>>> OvmfPkg/AmdSevDxe: do not use extended PCI config space >>>>> OvmfPkg/MemEncryptSevLib: add support to validate system RAM >>>>> OvmfPkg/MemEncryptSevLib: add function to check the VMPL0 >>>>> OvmfPkg/BaseMemEncryptSevLib: skip the pre-validated system RAM >>>>> OvmfPkg/MemEncryptSevLib: add support to validate > 4GB memory in P= EI >>>>> phase >>>>> OvmfPkg/SecMain: validate the memory used for decompressing Fv >>>>> OvmfPkg/PlatformPei: validate the system RAM when SNP is active >>>>> UefiCpuPkg: Define ConfidentialComputingGuestAttr >>>>> OvmfPkg/PlatformPei: set PcdConfidentialComputingAttr when SEV is >>>>> active >>>>> UefiCpuPkg/MpInitLib: use PcdConfidentialComputingAttr to check SEV >>>>> status >>>>> UefiCpuPkg: add PcdGhcbHypervisorFeatures >>>>> OvmfPkg/PlatformPei: set the Hypervisor Features PCD >>>>> MdePkg/GHCB: increase the GHCB protocol max version >>>>> UefiCpuPkg/MpLib: add support to register GHCB GPA when SEV-SNP is >>>>> enabled >>>>> OvmfPkg/MemEncryptSevLib: change the page state in the RMP table >>>>> OvmfPkg/MemEncryptSevLib: skip page state change for Mmio address >>>>> OvmfPkg/PlatformPei: mark cpuid and secrets memory reserved in EFI = map >>>>> OvmfPkg/AmdSev: expose the SNP reserved pages through configuration >>>>> table >>>>> >>>>> Michael Roth (3): >>>>> OvmfPkg/ResetVector: use SEV-SNP-validated CPUID values >>>>> OvmfPkg/VmgExitLib: use SEV-SNP-validated CPUID values >>>>> UefiCpuPkg/MpInitLib: use BSP to do extended topology check >>>>> >>>>> Tom Lendacky (1): >>>>> UefiCpuPkg/MpInitLib: Use SEV-SNP AP Creation NAE event to launch A= Ps >>>>> >>>>> MdePkg/MdePkg.dec | 4 + >>>>> OvmfPkg/OvmfPkg.dec | 18 + >>>>> UefiCpuPkg/UefiCpuPkg.dec | 5 + >>>>> OvmfPkg/AmdSev/AmdSevX64.dsc | 8 +- >>>>> OvmfPkg/Bhyve/BhyveX64.dsc | 5 +- >>>>> OvmfPkg/OvmfPkgIa32.dsc | 4 + >>>>> OvmfPkg/OvmfPkgIa32X64.dsc | 9 +- >>>>> OvmfPkg/OvmfPkgX64.dsc | 8 +- >>>>> OvmfPkg/OvmfXen.dsc | 5 +- >>>>> OvmfPkg/OvmfPkgX64.fdf | 6 + >>>>> OvmfPkg/AmdSevDxe/AmdSevDxe.inf | 7 + >>>>> .../DxeMemEncryptSevLib.inf | 3 + >>>>> .../PeiMemEncryptSevLib.inf | 7 + >>>>> .../SecMemEncryptSevLib.inf | 3 + >>>>> OvmfPkg/Library/VmgExitLib/SecVmgExitLib.inf | 2 + >>>>> OvmfPkg/Library/VmgExitLib/VmgExitLib.inf | 3 + >>>>> OvmfPkg/PlatformPei/PlatformPei.inf | 7 + >>>>> OvmfPkg/ResetVector/ResetVector.inf | 5 + >>>>> OvmfPkg/Sec/SecMain.inf | 4 + >>>>> UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf | 6 +- >>>>> UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf | 6 +- >>>>> .../Include/ConfidentialComputingGuestAttr.h | 25 + >>>>> MdePkg/Include/Register/Amd/Ghcb.h | 2 +- >>>>> .../Guid/ConfidentialComputingSevSnpBlob.h | 33 ++ >>>>> OvmfPkg/Include/Library/MemEncryptSevLib.h | 26 + >>>>> .../X64/SnpPageStateChange.h | 36 ++ >>>>> .../BaseMemEncryptSevLib/X64/VirtualMemory.h | 24 + >>>>> OvmfPkg/PlatformPei/Platform.h | 5 + >>>>> OvmfPkg/Sec/AmdSev.h | 95 ++++ >>>>> UefiCpuPkg/Library/MpInitLib/MpLib.h | 93 ++++ >>>>> OvmfPkg/AmdSevDxe/AmdSevDxe.c | 23 + >>>>> .../DxeMemEncryptSevLibInternal.c | 27 ++ >>>>> .../Ia32/MemEncryptSevLib.c | 17 + >>>>> .../PeiMemEncryptSevLibInternal.c | 27 ++ >>>>> .../SecMemEncryptSevLibInternal.c | 19 + >>>>> .../X64/DxeSnpSystemRamValidate.c | 40 ++ >>>>> .../X64/PeiDxeVirtualMemory.c | 167 ++++++- >>>>> .../X64/PeiSnpSystemRamValidate.c | 127 +++++ >>>>> .../X64/SecSnpSystemRamValidate.c | 82 ++++ >>>>> .../X64/SnpPageStateChangeInternal.c | 294 ++++++++++++ >>>>> OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 444 >>> ++++++++++++++++-- >>>>> OvmfPkg/PlatformPei/AmdSev.c | 231 +++++++++ >>>>> OvmfPkg/PlatformPei/MemDetect.c | 2 + >>>>> OvmfPkg/Sec/AmdSev.c | 298 ++++++++++++ >>>>> OvmfPkg/Sec/SecMain.c | 158 +------ >>>>> UefiCpuPkg/Library/MpInitLib/AmdSev.c | 239 ++++++++++ >>>>> UefiCpuPkg/Library/MpInitLib/DxeMpLib.c | 16 +- >>>>> UefiCpuPkg/Library/MpInitLib/Ia32/AmdSev.c | 70 +++ >>>>> UefiCpuPkg/Library/MpInitLib/MpLib.c | 345 +++++--------- >>>>> UefiCpuPkg/Library/MpInitLib/PeiMpLib.c | 4 +- >>>>> UefiCpuPkg/Library/MpInitLib/X64/AmdSev.c | 261 ++++++++++ >>>>> OvmfPkg/FvmainCompactScratchEnd.fdf.inc | 5 + >>>>> OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 17 + >>>>> OvmfPkg/ResetVector/Ia32/AmdSev.asm | 86 +++- >>>>> OvmfPkg/ResetVector/ResetVector.nasmb | 18 + >>>>> OvmfPkg/ResetVector/X64/OvmfSevMetadata.asm | 74 +++ >>>>> UefiCpuPkg/Library/MpInitLib/MpEqu.inc | 2 + >>>>> UefiCpuPkg/Library/MpInitLib/X64/AmdSev.nasm | 200 ++++++++ >>>>> UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm | 100 +--- >>>>> 59 files changed, 3329 insertions(+), 528 deletions(-) >>>>> create mode 100644 MdePkg/Include/ConfidentialComputingGuestAttr.h >>>>> create mode 100644 >>>>> OvmfPkg/Include/Guid/ConfidentialComputingSevSnpBlob.h >>>>> create mode 100644 >>>>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChange.h >>>>> create mode 100644 OvmfPkg/Sec/AmdSev.h >>>>> create mode 100644 >>>>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemRamValidate.c >>>>> create mode 100644 >>>>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c >>>>> create mode 100644 >>>>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c >>>>> create mode 100644 >>>>> >>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c >>>>> create mode 100644 OvmfPkg/Sec/AmdSev.c >>>>> create mode 100644 UefiCpuPkg/Library/MpInitLib/AmdSev.c >>>>> create mode 100644 UefiCpuPkg/Library/MpInitLib/Ia32/AmdSev.c >>>>> create mode 100644 UefiCpuPkg/Library/MpInitLib/X64/AmdSev.c >>>>> create mode 100644 OvmfPkg/ResetVector/X64/OvmfSevMetadata.asm >>>>> create mode 100644 UefiCpuPkg/Library/MpInitLib/X64/AmdSev.nasm >>>>> >>>>> -- >>>>> 2.25.1 >>>> >>>> >>>> --_000_SN6PR12MB2718B0F70360FE22AD7A2CCAE5919SN6PR12MB2718namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

[AMD Official Use Only]


Without UefiCpuPkg we will have a broken SNP support and I would prefer not= to commit a broken SEV-SNP support. The UefiCpuPkg is required for the mul= tiple CPU boot and based all the feedback we have added a new ConfidentialC= ompting PCD that is set and used for OVMF. Splitting all that support is much more work for no reason. = ;

I will wait couple of more days to see if UefiCpuPkg maintainer reply other= wise I will go ahead and send v12 with the rebased.

thanks,
Brijesh
From: Yao, Jiewen <jiewe= n.yao@intel.com>
Sent: Sunday, November 7, 2021 8:14 PM
To: Singh, Brijesh <brijesh.singh@amd.com>; devel@edk2.groups.= io <devel@edk2.groups.io>
Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M <min.m.= xu@intel.com>; Lendacky, Thomas <Thomas.Lendacky@amd.com>; Justen,= Jordan L <jordan.l.justen@intel.com>; Ard Biesheuvel <ardb+tianoc= ore@kernel.org>; Erdem Aktas <erdemaktas@google.com>; Roth, Michael <Michael.Roth@amd.com>; Gerd Hoffmann <kraxel@redhat.com&= gt;; Ni, Ray <ray.ni@intel.com>; Kumar, Rahul1 <rahul1.kumar@intel= .com>; Yao, Jiewen <jiewen.yao@intel.com>
Subject: RE: [edk2-devel] [PATCH v11 00/32] Add AMD Secure Nested Pa= ging (SEV-SNP) support
 

[AMD Official Use Only]


I recommend you split the patch set to OvmfPkg upd= ate and UefiPkg update, unless there is strong reason that you have to mix = them together.

 

With that, I can merge the OvmfPkg at first and we= can move forward there, while waiting UefiPkg review.

 

If you agree, please rebase and resubmit.

 

Thank you

Yao Jiewen

 

From: Singh, Brijesh <brijesh.singh@amd.= com>
Sent: Monday, November 8, 2021 10:11 AM
To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io; = Singh, Brijesh <brijesh.singh@amd.com>
Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M <min.m.= xu@intel.com>; Lendacky, Thomas <Thomas.Lendacky@amd.com>; Justen,= Jordan L <jordan.l.justen@intel.com>; Ard Biesheuvel <ardb+tianoc= ore@kernel.org>; Erdem Aktas <erdemaktas@google.com>; Roth, Michael <Michael.Roth@amd.com>; Gerd Hoffmann <kraxel@redhat.com&= gt;; Ni, Ray <ray.ni@intel.com>; Kumar, Rahul1 <rahul1.kumar@intel= .com>
Subject: Re: [edk2-devel] [PATCH v11 00/32] Add AMD Secure Nested Pa= ging (SEV-SNP) support

 

[AMD Official Use Only]

 

Hi,<= /span>

&nbs= p;

I am= not getting any response from the UefiCpuPkg maintainers,  I am not s= ure if the Ray/Rahul are on vacation or need more information.<= /p>

&nbs= p;

Jiew= en and Gerd,

&nbs= p;

Any = recommendations how we proceed further ? I can send the rebased version and= we can go ahead and commit it. If UefiCpuPkg maintainer does not like some= thing, then I am always happy to rework the stuff after the commit. I would like to send some cleanup patches post= SNP series that will simplify some of the MemEncryptIs{Sev,Es,Snp}Enabled(= ) based on our recent workarea patches. It will also help/align with the TD= X series.

&nbs= p;

-Bri= jesh

From: devel@edk2.groups.io <devel@edk2.groups.io> on behalf of= Brijesh Singh via groups.io <brijesh.singh=3Damd.com@groups.io>
Sent: Sunday, October 31, 2021 4:40 PM
To: Yao, Jiewen <jiewen.y= ao@intel.com>; devel@edk2.groups.io <devel@edk2.groups.io>
Cc: Singh, Brijesh <brij= esh.singh@amd.com>; James Bottomley <jejb@linux.ibm.com>; Xu, Min M <min.m.xu@intel.com>; Lendacky, Thomas <Thomas.Lendacky@amd.com= >; Justen, Jordan L <jor= dan.l.justen@intel.com>; Ard Biesheuvel <ardb+tianocore@kernel.org>; Erdem Aktas <erdemaktas@google= .com>; Roth, Michael <Mic= hael.Roth@amd.com>; Gerd Hoffmann <kraxel@redhat.com>; Ray Ni <ray.ni@intel.com>; Rahul Kumar <rahul1.kumar@int= el.com>
Subject: Re: [edk2-devel] [PATCH v11 00/32] Add AMD Secure Nested Pa= ging (SEV-SNP) support

 

Hi Ray and Rahul,
Gentle ping. Could you please Ack or R-b the files touched in UefiCpuPkg?
-Brijesh

On 10/29/21 9:52 AM, Brijesh Singh wrote:
> Hi Jiewen,
>
> I have not heard anything back from UefiCpuPkg maintainer yet, I will<= br> > send another gentle ping on Monday again and hope maintainer get to it= .
>
> -Brijesh
>
> On 10/29/21 7:26 AM, Yao, Jiewen wrote:
>> Hi Brijesh
>> Have you got R-B from UefiCpuPkg maintainer?
>>
>>
>>
>>> -----Original Message-----
>>> From: Brijesh Singh <brijesh.singh@amd.com>
>>> Sent: Monday, October 25, 2021 7:54 AM
>>> To: devel@edk2.groups.= io; Yao, Jiewen <jiewen.yao@= intel.com>
>>> Cc: brijesh.singh@amd= .com; James Bottomley <jejb@li= nux.ibm.com>; Xu, Min M
>>> <min.m.xu@intel.com>; Tom Lendacky <thomas.= lendacky@amd.com>; Justen,
>>> Jordan L <jord= an.l.justen@intel.com>; Ard Biesheuvel
>>> <ardb+tianocor= e@kernel.org>; Erdem Aktas <erdemaktas@google.com>;
>>> Michael Roth <Micha= el.Roth@amd.com>; Gerd Hoffmann <kraxel@redhat.com>
>>> Subject: Re: [edk2-devel] [PATCH v11 00/32] Add AMD Secure Nes= ted Paging
>>> (SEV-SNP) support
>>>
>>> Thank Jiewen,
>>>
>>> I have ping'ed UefiCpuPkg maintainer (Ray and Rahul) on every = patch
>>> which touches the UefiCpuPkg. If maintainer wants me to rework= on
>>> something then I will work accordingly. If they are okay with = v11 then
>>> now the merge will create a conflict (due to the TDX patches m= erge
>>> commit). I have rebased my series to the recent master and hav= e pushed
>>> it here: https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgithub.= com%2FAMDESE%2Fovmf%2Ftree%2Fsnp-v12&amp;data=3D04%7C01%7Cbrijesh.singh= %40amd.com%7C400c84b654c6423f739e08d99cb72382%7C3dd8961fe4884e608e11a82d994= e183d%7C0%7C0%7C637713132658929026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAw= MDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=3Dl= oCp%2FptHiWgvAtdp6zjDH5jDeq9mKLYBwedNU%2FT0IzM%3D&amp;reserved=3D0. I can post the
>>> series if you prefer it.
>>>
>>> thanks
>>>
>>> On 10/23/21 8:46 PM, Yao, Jiewen via groups.io wrote:
>>>> Yes. I will try my best to merge.
>>>>
>>>> I checked the patch set but I did not find the "R-B&q= uot; from UefiCpuPkg
>>> maintainer. Neither from email nor from you v11.
>>>> Did I miss something?
>>>>
>>>> Thank you
>>>> Yao Jiewen
>>>>
>>>>
>>>>> -----Original Message-----
>>>>> From: Brijesh Singh <brijesh.singh@amd.com>
>>>>> Sent: Saturday, October 23, 2021 12:13 PM
>>>>> To: devel@edk2= .groups.io
>>>>> Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M
>>> <min.m.xu@intel.com>;
>>>>> Yao, Jiewen <jiewen.yao@intel.com>; Tom Lendacky
>>>>> <thomas.= lendacky@amd.com>; Justen, Jordan L <jordan.l.justen@intel.com>;
>>>>> Ard Biesheuvel <ardb+tianocore@kernel.org>; Erdem Aktas
>>>>> <erdemakta= s@google.com>; Michael Roth <Michael.Roth@amd.com>; Gerd
>>>>> Hoffmann <krax= el@redhat.com>; Brijesh Singh <brijesh.singh@amd.com>
>>>>> Subject: [PATCH v11 00/32] Add AMD Secure Nested Pagin= g (SEV-SNP)
>>> support
>>>>> Hi Gerd and Jiewen,
>>>>>
>>>>> CI was a bit unstable during my v10 submission, so, I = was not able to
>>>>> run it to the completion. Finally, I managed to get th= e CI going,
>>>>> and it reported few Windows 32-bit build errors. The v= 11 fixes those build
>>>>> errors. Please consider this for the merge.
>>>>>
>>>>> Thank you so much for all your support in reviewing th= e series.
>>>>>
>>>>> ------------------------------------------------------= -----------------------
>>>>> BZ:
>>> https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fbugzill= a.
>>> tianocore.org%2Fshow_bug.cgi%3Fid%3D3275&amp;data=3D04%7C0= 1%7Cbrijesh.
>>> singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8961fe= 488
>>> 4e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUnknown%7<= br> >>> CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1ha= WwiLCJ
>>> XVCI6Mn0%3D%7C3000&amp;sdata=3DL41krO6G221HaIsG92FloIzgCDq= MLAAsU26
>>> jaEMF7yw%3D&amp;reserved=3D0
>>>>> SEV-SNP builds upon existing SEV and SEV-ES functional= ity while adding
>>>>> new hardware-based memory protections. SEV-SNP adds st= rong memory
>>>>> integrity
>>>>> protection to help prevent malicious hypervisor-based = attacks like data
>>>>> replay, memory re-mapping and more in order to create = an isolated memory
>>>>> encryption environment.
>>>>>
>>>>> This series provides the basic building blocks to supp= ort booting the SEV-SNP
>>>>> VMs, it does not cover all the security enhancement in= troduced by the SEV-
>>> SNP
>>>>> such as interrupt protection.
>>>>>
>>>>> Many of the integrity guarantees of SEV-SNP are enforc= ed through a new
>>>>> structure called the Reverse Map Table (RMP). Adding a= new page to SEV-SNP
>>>>> VM requires a 2-step process. First, the hypervisor as= signs a page to the
>>>>> guest using the new RMPUPDATE instruction. This transi= tions the page to
>>>>> guest-invalid. Second, the guest validates the page us= ing the new PVALIDATE
>>>>> instruction. The SEV-SNP VMs can use the new "Pag= e State Change Request
>>>>> NAE"
>>>>> defined in the GHCB specification to ask hypervisor to= add or remove page
>>>>> from the RMP table.
>>>>>
>>>>> Each page assigned to the SEV-SNP VM can either be val= idated or unvalidated,
>>>>> as indicated by the Validated flag in the page's RMP e= ntry. There are two
>>>>> approaches that can be taken for the page validation: = Pre-validation and
>>>>> Lazy Validation.
>>>>>
>>>>> Under pre-validation, the pages are validated prior to= first use. And under
>>>>> lazy validation, pages are validated when first access= ed. An access to a
>>>>> unvalidated page results in a #VC exception, at which = time the exception
>>>>> handler may validate the page. Lazy validation require= s careful tracking of
>>>>> the validated pages to avoid validating the same GPA m= ore than once. The
>>>>> recently introduced "Unaccepted" memory type= can be used to communicate
>>>>> the
>>>>> unvalidated memory ranges to the Guest OS.
>>>>>
>>>>> At this time we only support the pre-validation. OVMF = detects all the
>>> available
>>>>> system RAM in the PEI phase. When SEV-SNP is enabled, = the memory is
>>> validated
>>>>> before it is made available to the EDK2 core.
>>>>>
>>>>> Now that series contains all the basic support require= d to launch SEV-SNP
>>>>> guest. We are still missing the Interrupt security fea= ture provided by the
>>>>> SNP. The feature will be added after the base support = is accepted.
>>>>>
>>>>> Additional resources
>>>>> ---------------------
>>>>> SEV-SNP whitepaper
>>>>>
>>> https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.a%2= F&amp;data=3D04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08= d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658929026%= 7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWw= iLCJXVCI6Mn0%3D%7C1000&amp;sdata=3DWznkScyKwwPKfde08y%2Fb1KTmUgVt2al9%2= Bupz%2FATGOHE%3D&amp;reserved=3D0
>>> md.com%2Fsystem%2Ffiles%2FTechDocs%2FSEV-SNP-strengthening-vm-=
>>> &amp;data=3D04%7C01%7Cbrijesh.singh%40amd.com%7Cddc5570780= ff4a91d0da
>>> 08d9969026e2%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C6377= 0
>>> 6369230826414%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQ=
>>> IjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdat= a=3DnVMSG%
>>> 2FvSS2Wa21lu1lGrHr9OYX8hL7FoAcQXBBiCztc%3D&amp;reserved=3D= 0
>>>>> isolation-with-integrity-protection-and-more.pdf
>>>>>
>>>>> APM 2:
>>> https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.a%2= F&amp;data=3D04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08= d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658929026%= 7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWw= iLCJXVCI6Mn0%3D%7C1000&amp;sdata=3DWznkScyKwwPKfde08y%2Fb1KTmUgVt2al9%2= Bupz%2FATGOHE%3D&amp;reserved=3D0
>>> md.com%2Fsystem%2Ffiles%2FTechDocs%2F24593.pdf&amp;data=3D= 04%7C01%7
>>> Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C= 3dd8
>>> 961fe4884e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUn= k
>>> nown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI= 6Ik1h
>>> aWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=3DG8Xg2glOGY2EjHpeQ3WM= 4gZCh
>>> uI0k8QcLDTbpJiTplg%3D&amp;reserved=3D0 (section 15.36)
>>>>> The complete source is available at
>>>>>
>>> https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgithub.= c%2F&amp;data=3D04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739= e08d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C6377131326589290= 26%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1h= aWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=3DWx6h8FQ0289ZBQJa3iTk3Sb7zkmQO6D6V= ZFvRX5lEeM%3D&amp;reserved=3D0
>>> om%2FAMDESE%2Fovmf%2Ftree%2Fsnp-
>>> v11&amp;data=3D04%7C01%7Cbrijesh.singh%40amd.com%7Cddc5570= 780ff4a91d
>>> 0da08d9969026e2%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C6= 3
>>> 7706369230826414%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiL=
>>> CJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;s= data=3DHMH
>>> Fq8G%2FPqdhzNW3Ashmc4%2Bmv1RcDULD4vniofhiS54%3D&amp;reserv= ed=3D0
>>>>> GHCB spec:
>>>>>
>>> https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdevelop=
>>> er.amd.com%2Fwp-
>>> content%2Fresources%2F56421.pdf&amp;data=3D04%7C01%7Cbrije= sh.singh%40a
>>> md.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8961fe4884e608e= 11
>>> a82d994e183d%7C0%7C0%7C637706369230826414%7CUnknown%7CTWFpbGZ<= br> >>> sb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXV= CI6Mn0
>>> %3D%7C3000&amp;sdata=3DYiPgZU87fdnl5rJpD0E2ue9aTKbqUwizuBr= Kxom0FiU%
>>> 3D&amp;reserved=3D0
>>>>> SEV-SNP firmware specification:
>>>>>
>>> https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.a%2= F&amp;data=3D04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08= d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658939021%= 7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWw= iLCJXVCI6Mn0%3D%7C1000&amp;sdata=3DHs%2BB9e%2FrZ0aYV3XPtJ9ZegaaIAMURuH1= Dc9C1CeBauU%3D&amp;reserved=3D0
>>> md.com%2Fsystem%2Ffiles%2FTechDocs%2F56860.pdf&amp;data=3D= 04%7C01%7
>>> Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C= 3dd8
>>> 961fe4884e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUn= k
>>> nown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI= 6Ik1h
>>> aWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=3DbfQsY4%2BRnlFGuD3Bg%= 2BFPb3l
>>> RgSGgpomNocXswHqkm%2F4%3D&amp;reserved=3D0
>>>>> Change since v10:
>>>>>  * fix 'unresolved external symbol __allshl' link= error when building I32 for
>>>>> VS2017.
>>>>>
>>>>> Changes since v9:
>>>>>  * Move CCAttrs Pcd define in MdePkg
>>>>>  * Add comment to indicate that allocating the id= entity map PT is temporary
>>> until
>>>>> we get lazy validation
>>>>>
>>>>> Changes since v8:
>>>>>  * drop the generic metadata and make it specific= to SEV.
>>>>>
>>>>> Changes since v7:
>>>>>  * Move SEV specific changes in MpLib in AmdSev f= ile
>>>>>  * Update the GHCB register function to not resto= re the GHCB MSR because
>>>>>    we were already in the MSR protocol = mode.
>>>>>  * Drop the SNP name from PcdSnpSecPreValidate. >>>>>  * Add new section for GHCB memory in the OVMF me= tadata.
>>>>>
>>>>> Change since v6:
>>>>>  * Drop the SNP boot block GUID and switch to usi= ng the Metadata guided
>>>>> structure
>>>>>    proposed by Min in TDX series.
>>>>>  * Exclude the GHCB page from the pre-validated r= egion. It simplifies the
>>> reset
>>>>>    vector code where we do not need to = unvalidate the GHCB page.
>>>>>  * Now that GHCB page is not validated so move th= e VMPL check from reset
>>>>> vector
>>>>>    code to the MemEncryptSevLib on the = first page validation.
>>>>>  * Introduce the ConfidentialComputingGuestAttr P= CD to communicate which
>>>>>    memory encryption is active so that = MpInitLib can make use of it.
>>>>>  * Drop the SEVES specific PCD as the information= can be communicated via
>>>>>    the ConfidentialComputingGuestAttr.<= br> >>>>>  * Move the SNP specific AP creation function in = AmdSev.c.
>>>>>  * Define the SNP Blob GUID in a new file.
>>>>>
>>>>> Change since v5:
>>>>>  * When possible use the CPUID value from CPUID p= age
>>>>>  * Move the SEV specific functions from SecMain.c= in AmdSev.c
>>>>>  * Rebase to the latest code
>>>>>  * Add the review feedback from Yao.
>>>>>
>>>>> Change since v4:
>>>>>  * Use the correct MSR for the SEV_STATUS
>>>>>  * Add VMPL-0 check
>>>>>
>>>>> Change since v3:
>>>>>  * ResetVector: move all SEV specific code in Amd= Sev.asm and add macros to
>>>>> keep
>>>>>    the code readable.
>>>>>  * Drop extending the EsWorkArea to contain SNP s= pecific state.
>>>>>  * Drop the GhcbGpa library and call the VmgExit = directly to register GHCB
>>> GPA.
>>>>>  * Install the CC blob config table from AmdSevDx= e instead of extending the
>>>>>    AmdSev/SecretsDxe for it.
>>>>>  * Add the separate PCDs for the SNP Secrets.
>>>>>
>>>>> Changes since v2:
>>>>>  * Add support for the AP creation.
>>>>>  * Use the module-scoping override to make AmdSev= Dxe use the IO port for
>>> PCI
>>>>> reads.
>>>>>  * Use the reserved memory type for CPUID and Sec= rets page.
>>>>>  *
>>>>> Changes since v1:
>>>>>  * Drop the interval tree support to detect the p= re-validated overlap region.
>>>>>  * Use an array to keep track of pre-validated re= gions.
>>>>>  * Add support to query the Hypervisor feature an= d verify that SNP feature is
>>>>> supported.
>>>>>  * Introduce MemEncryptSevClearMmioPageEncMask() = to clear the C-bit
>>> from
>>>>> MMIO ranges.
>>>>>  * Pull the SevSecretDxe and SevSecretPei into OV= MF package build.
>>>>>  * Extend the SevSecretDxe to expose confidential= computing blob location
>>>>> through
>>>>>    EFI configuration table.
>>>>>
>>>>> Brijesh Singh (28):
>>>>>   OvmfPkg/SecMain: move SEV specific routine= s in AmdSev.c
>>>>>   UefiCpuPkg/MpInitLib: move SEV specific ro= utines in AmdSev.c
>>>>>   OvmfPkg/ResetVector: move clearing GHCB in= SecMain
>>>>>   OvmfPkg/ResetVector: introduce SEV metadat= a descriptor for VMM use
>>>>>   OvmfPkg: reserve SNP secrets page
>>>>>   OvmfPkg: reserve CPUID page
>>>>>   OvmfPkg/ResetVector: pre-validate the data= pages used in SEC phase
>>>>>   OvmfPkg/MemEncryptSevLib: add MemEncryptSe= vSnpEnabled()
>>>>>   OvmfPkg/SecMain: register GHCB gpa for the= SEV-SNP guest
>>>>>   OvmfPkg/PlatformPei: register GHCB gpa for= the SEV-SNP guest
>>>>>   OvmfPkg/AmdSevDxe: do not use extended PCI= config space
>>>>>   OvmfPkg/MemEncryptSevLib: add support to v= alidate system RAM
>>>>>   OvmfPkg/MemEncryptSevLib: add function to = check the VMPL0
>>>>>   OvmfPkg/BaseMemEncryptSevLib: skip the pre= -validated system RAM
>>>>>   OvmfPkg/MemEncryptSevLib: add support to v= alidate > 4GB memory in PEI
>>>>>     phase
>>>>>   OvmfPkg/SecMain: validate the memory used = for decompressing Fv
>>>>>   OvmfPkg/PlatformPei: validate the system R= AM when SNP is active
>>>>>   UefiCpuPkg: Define ConfidentialComputingGu= estAttr
>>>>>   OvmfPkg/PlatformPei: set PcdConfidentialCo= mputingAttr when SEV is
>>>>>     active
>>>>>   UefiCpuPkg/MpInitLib: use PcdConfidentialC= omputingAttr to check SEV
>>>>>     status
>>>>>   UefiCpuPkg: add PcdGhcbHypervisorFeatures<= br> >>>>>   OvmfPkg/PlatformPei: set the Hypervisor Fe= atures PCD
>>>>>   MdePkg/GHCB: increase the GHCB protocol ma= x version
>>>>>   UefiCpuPkg/MpLib: add support to register = GHCB GPA when SEV-SNP is
>>>>>     enabled
>>>>>   OvmfPkg/MemEncryptSevLib: change the page = state in the RMP table
>>>>>   OvmfPkg/MemEncryptSevLib: skip page state = change for Mmio address
>>>>>   OvmfPkg/PlatformPei: mark cpuid and secret= s memory reserved in EFI map
>>>>>   OvmfPkg/AmdSev: expose the SNP reserved pa= ges through configuration
>>>>>     table
>>>>>
>>>>> Michael Roth (3):
>>>>>   OvmfPkg/ResetVector: use SEV-SNP-validated= CPUID values
>>>>>   OvmfPkg/VmgExitLib: use SEV-SNP-validated = CPUID values
>>>>>   UefiCpuPkg/MpInitLib: use BSP to do extend= ed topology check
>>>>>
>>>>> Tom Lendacky (1):
>>>>>   UefiCpuPkg/MpInitLib: Use SEV-SNP AP Creat= ion NAE event to launch APs
>>>>>
>>>>>  MdePkg/MdePkg.dec     &= nbsp;           &nbs= p;           |  = ; 4 +
>>>>>  OvmfPkg/OvmfPkg.dec     = ;            &n= bsp;         |  18 +
>>>>>  UefiCpuPkg/UefiCpuPkg.dec    = ;            &n= bsp;    |   5 +
>>>>>  OvmfPkg/AmdSev/AmdSevX64.dsc   &n= bsp;            = ;  |   8 +-
>>>>>  OvmfPkg/Bhyve/BhyveX64.dsc   &nbs= p;            &= nbsp;   |   5 +-
>>>>>  OvmfPkg/OvmfPkgIa32.dsc    &= nbsp;           &nbs= p;      |   4 +
>>>>>  OvmfPkg/OvmfPkgIa32X64.dsc   &nbs= p;            &= nbsp;   |   9 +-
>>>>>  OvmfPkg/OvmfPkgX64.dsc    &n= bsp;            = ;       |   8 +-
>>>>>  OvmfPkg/OvmfXen.dsc     = ;            &n= bsp;         |   5 +-
>>>>>  OvmfPkg/OvmfPkgX64.fdf    &n= bsp;            = ;       |   6 +
>>>>>  OvmfPkg/AmdSevDxe/AmdSevDxe.inf   = ;            | =   7 +
>>>>>  .../DxeMemEncryptSevLib.inf   &nb= sp;            =    |   3 +
>>>>>  .../PeiMemEncryptSevLib.inf   &nb= sp;            =    |   7 +
>>>>>  .../SecMemEncryptSevLib.inf   &nb= sp;            =    |   3 +
>>>>>  OvmfPkg/Library/VmgExitLib/SecVmgExitLib.inf&nbs= p; |   2 +
>>>>>  OvmfPkg/Library/VmgExitLib/VmgExitLib.inf &= nbsp;   |   3 +
>>>>>  OvmfPkg/PlatformPei/PlatformPei.inf  &= nbsp;        |   7 +
>>>>>  OvmfPkg/ResetVector/ResetVector.inf  &= nbsp;        |   5 +
>>>>>  OvmfPkg/Sec/SecMain.inf    &= nbsp;           &nbs= p;      |   4 +
>>>>>  UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf |&= nbsp;  6 +-
>>>>>  UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf |&= nbsp;  6 +-
>>>>>  .../Include/ConfidentialComputingGuestAttr.h&nbs= p; |  25 +
>>>>>  MdePkg/Include/Register/Amd/Ghcb.h  &n= bsp;         |   2 +-
>>>>>  .../Guid/ConfidentialComputingSevSnpBlob.h =    |  33 ++
>>>>>  OvmfPkg/Include/Library/MemEncryptSevLib.h =    |  26 +
>>>>>  .../X64/SnpPageStateChange.h   &n= bsp;            = ;  |  36 ++
>>>>>  .../BaseMemEncryptSevLib/X64/VirtualMemory.h&nbs= p; |  24 +
>>>>>  OvmfPkg/PlatformPei/Platform.h   =              |&= nbsp;  5 +
>>>>>  OvmfPkg/Sec/AmdSev.h    &nbs= p;            &= nbsp;        |  95 ++++
>>>>>  UefiCpuPkg/Library/MpInitLib/MpLib.h  =         |  93 ++++
>>>>>  OvmfPkg/AmdSevDxe/AmdSevDxe.c   &= nbsp;           &nbs= p; |  23 +
>>>>>  .../DxeMemEncryptSevLibInternal.c  &nb= sp;          |  27 ++
>>>>>  .../Ia32/MemEncryptSevLib.c   &nb= sp;            =    |  17 +
>>>>>  .../PeiMemEncryptSevLibInternal.c  &nb= sp;          |  27 ++
>>>>>  .../SecMemEncryptSevLibInternal.c  &nb= sp;          |  19 +
>>>>>  .../X64/DxeSnpSystemRamValidate.c  &nb= sp;          |  40 ++
>>>>>  .../X64/PeiDxeVirtualMemory.c   &= nbsp;           &nbs= p; | 167 ++++++-
>>>>>  .../X64/PeiSnpSystemRamValidate.c  &nb= sp;          | 127 +++++
>>>>>  .../X64/SecSnpSystemRamValidate.c  &nb= sp;          |  82 ++++ >>>>>  .../X64/SnpPageStateChangeInternal.c  =         | 294 ++++++++++++
>>>>>  OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | = 444
>>> ++++++++++++++++--
>>>>>  OvmfPkg/PlatformPei/AmdSev.c   &n= bsp;            = ;  | 231 +++++++++
>>>>>  OvmfPkg/PlatformPei/MemDetect.c   = ;            | =   2 +
>>>>>  OvmfPkg/Sec/AmdSev.c    &nbs= p;            &= nbsp;        | 298 ++++++++++++
>>>>>  OvmfPkg/Sec/SecMain.c    &nb= sp;            =         | 158 +------
>>>>>  UefiCpuPkg/Library/MpInitLib/AmdSev.c  = ;       | 239 ++++++++++
>>>>>  UefiCpuPkg/Library/MpInitLib/DxeMpLib.c &nb= sp;     |  16 +-
>>>>>  UefiCpuPkg/Library/MpInitLib/Ia32/AmdSev.c =    |  70 +++
>>>>>  UefiCpuPkg/Library/MpInitLib/MpLib.c  =         | 345 +++++---------
>>>>>  UefiCpuPkg/Library/MpInitLib/PeiMpLib.c &nb= sp;     |   4 +-
>>>>>  UefiCpuPkg/Library/MpInitLib/X64/AmdSev.c &= nbsp;   | 261 ++++++++++
>>>>>  OvmfPkg/FvmainCompactScratchEnd.fdf.inc &nb= sp;     |   5 +
>>>>>  OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm&nbs= p; |  17 +
>>>>>  OvmfPkg/ResetVector/Ia32/AmdSev.asm  &= nbsp;        |  86 +++-
>>>>>  OvmfPkg/ResetVector/ResetVector.nasmb  = ;       |  18 +
>>>>>  OvmfPkg/ResetVector/X64/OvmfSevMetadata.asm = ;  |  74 +++
>>>>>  UefiCpuPkg/Library/MpInitLib/MpEqu.inc &nbs= p;      |   2 +
>>>>>  UefiCpuPkg/Library/MpInitLib/X64/AmdSev.nasm&nbs= p; | 200 ++++++++
>>>>>  UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm | = 100 +---
>>>>>  59 files changed, 3329 insertions(+), 528 deleti= ons(-)
>>>>>  create mode 100644 MdePkg/Include/ConfidentialCo= mputingGuestAttr.h
>>>>>  create mode 100644
>>>>> OvmfPkg/Include/Guid/ConfidentialComputingSevSnpBlob.h=
>>>>>  create mode 100644
>>>>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateC= hange.h
>>>>>  create mode 100644 OvmfPkg/Sec/AmdSev.h
>>>>>  create mode 100644
>>>>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemR= amValidate.c
>>>>>  create mode 100644
>>>>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemR= amValidate.c
>>>>>  create mode 100644
>>>>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemR= amValidate.c
>>>>>  create mode 100644
>>>>>
>>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInt= ernal.c
>>>>>  create mode 100644 OvmfPkg/Sec/AmdSev.c
>>>>>  create mode 100644 UefiCpuPkg/Library/MpInitLib/= AmdSev.c
>>>>>  create mode 100644 UefiCpuPkg/Library/MpInitLib/= Ia32/AmdSev.c
>>>>>  create mode 100644 UefiCpuPkg/Library/MpInitLib/= X64/AmdSev.c
>>>>>  create mode 100644 OvmfPkg/ResetVector/X64/OvmfS= evMetadata.asm
>>>>>  create mode 100644 UefiCpuPkg/Library/MpInitLib/= X64/AmdSev.nasm
>>>>>
>>>>> --
>>>>> 2.25.1
>>>>
>>>>
>>>>




--_000_SN6PR12MB2718B0F70360FE22AD7A2CCAE5919SN6PR12MB2718namp_--