From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM12-DM6-obe.outbound.protection.outlook.com (NAM12-DM6-obe.outbound.protection.outlook.com [40.107.243.52]) by mx.groups.io with SMTP id smtpd.web11.47445.1624283882525010976 for ; Mon, 21 Jun 2021 06:58:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@amd.com header.s=selector1 header.b=AU1BGVZw; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.243.52, mailfrom: ashish.kalra@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mu/gEsXgIW0Ym7QKs3OxqCvnRyWOXL2s9k8Xw6a+UZqDgPu/BCHt1cBBbysB282/aoDz0usf+f6bEPCtTN9dqJnnXCwwIuJ9j5SF6ni5HH6gjjbXhPPizFWRYBfbXveuRp/6uCPQDDnaHWQxl2KfXVZLQIg/uU40kn6aYqu6z5eaY+9PRDWK/v4sM9HVfQUY9eyTTZnOEVkCPZGJZIaxb0uaF2hHl+8/XDgmrwQcyhvmgv/DGZ6ha0piLTJnrs3yLLEowQyRUYaWLqLu7x11ZShOZTT0Ayfxfx1ZOOVmuAYwArN/q8jsu07nFwywT3VGfpz2Voheh94MM0rti7f4nw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7isUSTVSvhhFrn3A7XiWREdPwGvyNnFr1I93yOsfC/4=; b=PGMcYT+2/q8aVR6PrXKKPwuNrzvJtrqh4eNVmviGLGeRmj/e4QG8s27JqQZlLeGPGzeOZxexGqp8KgpvWMBHa9adj7EzYtY55x8Um3sOb2KN7MCqlz4NSGMmtNp1z8Ovn6SkXmLNoTb7wZDpM8CJWTnngm5Mq8ja/Co3ups7X3GukIacAWREerk1JrbNAaeyHJXWNR/XXTjGYKOeicl8pcrjJpldMdDFeBDDkh88ANSh18hFIeaCpWJDRq+VfEvE+rOMLxwUrhgtW0zF+cOz96lvHDv83VYy9a4J+kdvbR0Iq8P4w3KajuDcPK7Hgaz7DnNqFb7pqcg6JYx5UxLy5Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7isUSTVSvhhFrn3A7XiWREdPwGvyNnFr1I93yOsfC/4=; b=AU1BGVZwcOpjGAFvfwfAfKfIl/TYese6o8bx9Y9POS1a6oDRCBro0mb+r2R/x9gSC2YE3MkdbPaZlzh8BnXd5M+LWdpaUEqtA0xuAKwZU+VukHtv6KPP+7gYIqud2zmmv7Gnlh4n8gPprSbTojvAIRj+3xjII+90Bobs2YeynIM= Authentication-Results: edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) by SN6PR12MB2686.namprd12.prod.outlook.com (2603:10b6:805:72::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4242.21; Mon, 21 Jun 2021 13:58:00 +0000 Received: from SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::958d:2e44:518c:744c]) by SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::958d:2e44:518c:744c%7]) with mapi id 15.20.4242.023; Mon, 21 Jun 2021 13:58:00 +0000 From: "Ashish Kalra" To: devel@edk2.groups.io Cc: brijesh.singh@amd.com, Thomas.Lendacky@amd.com, jejb@linux.ibm.com, erdemaktas@google.com, jiewen.yao@intel.com, min.m.xu@intel.com, lersek@redhat.com, jordan.l.justen@intel.com, ard.biesheuvel@arm.com Subject: [PATCH v4 4/4] OvmfPkg/PlatformDxe: Add support for SEV live migration. Date: Mon, 21 Jun 2021 13:57:51 +0000 Message-Id: X-Mailer: git-send-email 2.17.1 In-Reply-To: References: X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: SN4PR0401CA0006.namprd04.prod.outlook.com (2603:10b6:803:21::16) To SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) Return-Path: Ashish.Kalra@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from ashkalra_ubuntu_server.amd.com (165.204.77.1) by SN4PR0401CA0006.namprd04.prod.outlook.com (2603:10b6:803:21::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4242.21 via Frontend Transport; Mon, 21 Jun 2021 13:58:00 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 059e359f-61c6-43cf-dc0e-08d934bc94b9 X-MS-TrafficTypeDiagnostic: SN6PR12MB2686: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7691; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: g26ENslH9f8GOGf1azn4HF+AV6NrOzb/Tb3n5w9GxCPiL9vHD/TkM7zp3WqJs/a7KHKtHcOPFHn5fgemEkeW05sA7HtV4HNbfPtC1arwniyRjZGkR4KJv4bg0ZbXns6mo1VtrDoMTcNtwEE4pYpYdF7uADRkjXhLxEH6YonYqKvShYuvhCRQoz0j2WrKtDkbbCW4f9f/J6pRaH4HC14fbgU/2BZQjUoxTjr4GSeBpPRF3jbLbsc10d9LRNe6zTCWsj8PTUf0l2c4UqIUd47+l06ims/n5HvRS2S1ligTTFaY0cgF4UspM+lJnXyPI2mmRH9G3r5a2VuyGmukppYJzVEqK4eQt2o6YuUJnXvlikSOh8XzL1wXzs65NOydK5cYMdLJl/wyOhQqy/VTQIC/RucjaBUUypxBOP93M0wvyANfj4+VouM7EoefQWmN7G3cgVOJK1eBOpFMyruINt3yzza/RQEAY2DUEOBv7oB96jdFrq57BL+g8ZARGKVHB1tw829heAQ2vm8ktAMiAR8PLa2qXPtxiXxEE0yjRzAdW2ClUVgcgVIXmjMajDorO7WdiguoPBfUSqz6SEypgQF1ntsDaCO5s3xH+lAWtfzBRl2NRrgWCulfy/8YixFcq3z34b02cKpD+64mBzg5pojz3q+ALvmzZnyqpdq8IXaCfPA= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2767.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(376002)(366004)(136003)(346002)(396003)(39860400002)(38350700002)(38100700002)(66556008)(66476007)(36756003)(8676002)(5660300002)(6666004)(2616005)(956004)(66946007)(6916009)(16526019)(186003)(6486002)(8936002)(316002)(83380400001)(26005)(2906002)(4326008)(478600001)(86362001)(52116002)(7696005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?+eYgrMqlxptnoPj1ozDZkPdd4bLuc6lWQyd01fdqAYMzUqUb9KakEZzLPTK2?= =?us-ascii?Q?58VmnHe7eydr3qng9I6O/A4SaO5TYEVrdsA9n89eW6Qu2JhKXi+IVcXMZcue?= =?us-ascii?Q?QsDEEhwh4UQtQ9LRY0UhX8bGRXSokMg9dvbtaAyquuNqaHP9NHsMjglx23Ht?= =?us-ascii?Q?NwRZbmI8RLtvrKhIRXkh17jfN8bHjyvtzX9o0BfDs35sgLGT6byGI07Z9rRL?= =?us-ascii?Q?2e+14fKaxw59ap1DyZIVNdo28T22ihyszdmEV83dxBfvWmoD/4Pp+DVPeQm+?= =?us-ascii?Q?k/JVIL757ODIYtTeFs/vGmh+kazHApNnjMcemn53OzOrrUHXD4wIEN8mfmfL?= =?us-ascii?Q?2x23tawamATykWX6JJVfkr831Wj6hzVMDLrD2aXDxJsDTKJBlVb3r8cPg5Fm?= =?us-ascii?Q?KCUo6OTpZIjf2pZ/rxqJNQ/S+9JagM03Z3QL3BVDos0KAEAJe0hHMLDlqsIV?= =?us-ascii?Q?1i9hUKZJ6rLgdtjTLTWJvTjdSmgobcXPqh5Kra3PrXQkp46MVWxC7MrX6wB0?= =?us-ascii?Q?tc7x7ADXNnVTsczA5RBzkDgeoSGlenEOp4JKzNlIDzWb9ybrUVS/QitunV0p?= =?us-ascii?Q?CYlJS433JC1KD1srbGYPf/5nhwjYo4IlHoeNm6ADlQgZMi/pDkzveEpYuoYX?= =?us-ascii?Q?G7GuRr4lZGM14Rvih67gLwVshi8UcTj4CAVgJSq4WKVhnobO6u6LjLGgIHSG?= =?us-ascii?Q?UbJtvC/aohWMg8sIDH1bdqiCXF0RsYZVswTq/tcrJ8lCcPqpW5qBruZKf8OY?= =?us-ascii?Q?UubiswCjsB+YIPS7TeYzltmsrOzaqn+okIQvdBOnfI6QNsKku2Co1FjI7WIU?= =?us-ascii?Q?HKmkOzNdkIxZEOYyvvfVP+8comXJuDMkUU1ZXe5yICtig73XI1Xn8JMbnkLQ?= =?us-ascii?Q?hPsOTVBGXmU5RiGJmVEKTx6YRQhHtI28fzgBSNDnnfsMwUn8etyerhMzakrT?= =?us-ascii?Q?Ba82nuF/IkA+CGlempVGYNlOfMGVuq5ryJAu6VxG+ULfUeVa5MVDEykAAXeO?= =?us-ascii?Q?ooFDveW8L/tLdiwv2zTu16vP7pYKmoUYHwUEnNu8SdTX9/bM7IBWymQgNV/N?= =?us-ascii?Q?ct6ZCUSslqIy19cynWjsTlB6u6czrjwFaQWm5JqN1ToPr8z9x0pULPNXoLRa?= =?us-ascii?Q?NWFQRFrYVvfx5NhozBYjOe/pyKAtI3OnX+yl/Xl2KGapx7qW/afhKN4Co/zY?= =?us-ascii?Q?Poq/AGvZcY0kt9RcphCnBn3hw1JDAwPNMldTswhwMuy1xpKv29gzsnHzv/HD?= =?us-ascii?Q?cqnjWZEpH374psK7YGY6j0fymxB81kR3ZLAQPEP4TGCDrFg2prvidW0T9wGw?= =?us-ascii?Q?LsTjvYH6OZIaV/7SPgJvZS1H?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 059e359f-61c6-43cf-dc0e-08d934bc94b9 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2767.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Jun 2021 13:58:00.4779 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 13boqePrrkRoeoSgfgV0XxpbuErfX/Um9ERl2dBLzEBH+H1ZKk4tKotkChc1simNB+9b+CSyVUwCUBYpRSAVRA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR12MB2686 Content-Type: text/plain From: Ashish Kalra Detect for KVM hypervisor and check for SEV live migration feature support via KVM_FEATURE_CPUID, if detected setup a new UEFI enviroment variable to indicate OVMF support for SEV live migration. Signed-off-by: Ashish Kalra --- OvmfPkg/Include/Guid/MemEncryptLib.h | 20 ++++ OvmfPkg/OvmfPkg.dec | 1 + OvmfPkg/PlatformDxe/AmdSev.c | 108 ++++++++++++++++++++ OvmfPkg/PlatformDxe/Platform.c | 5 + OvmfPkg/PlatformDxe/Platform.inf | 2 + OvmfPkg/PlatformDxe/PlatformConfig.h | 5 + 6 files changed, 141 insertions(+) diff --git a/OvmfPkg/Include/Guid/MemEncryptLib.h b/OvmfPkg/Include/Guid/MemEncryptLib.h new file mode 100644 index 0000000000..4c046ba439 --- /dev/null +++ b/OvmfPkg/Include/Guid/MemEncryptLib.h @@ -0,0 +1,20 @@ +/** @file + + AMD Memory Encryption GUID, define a new GUID for defining + new UEFI enviroment variables assocaiated with SEV Memory Encryption. + + Copyright (c) 2020, AMD Inc. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef __MEMENCRYPT_LIB_H__ +#define __MEMENCRYPT_LIB_H__ + +#define MEMENCRYPT_GUID \ +{0x0cf29b71, 0x9e51, 0x433a, {0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8, 0x75}} + +extern EFI_GUID gMemEncryptGuid; + +#endif diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index 6ae733f6e3..e452dc8494 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -122,6 +122,7 @@ gQemuKernelLoaderFsMediaGuid = {0x1428f772, 0xb64a, 0x441e, {0xb8, 0xc3, 0x9e, 0xbd, 0xd7, 0xf8, 0x93, 0xc7}} gGrubFileGuid = {0xb5ae312c, 0xbc8a, 0x43b1, {0x9c, 0x62, 0xeb, 0xb8, 0x26, 0xdd, 0x5d, 0x07}} gConfidentialComputingSecretGuid = {0xadf956ad, 0xe98c, 0x484c, {0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47}} + gMemEncryptGuid = {0x0cf29b71, 0x9e51, 0x433a, {0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8, 0x75}} [Ppis] # PPI whose presence in the PPI database signals that the TPM base address diff --git a/OvmfPkg/PlatformDxe/AmdSev.c b/OvmfPkg/PlatformDxe/AmdSev.c new file mode 100644 index 0000000000..3dbf17a8cd --- /dev/null +++ b/OvmfPkg/PlatformDxe/AmdSev.c @@ -0,0 +1,108 @@ +/**@file + Detect KVM hypervisor support for SEV live migration and if + detected, setup a new UEFI enviroment variable indicating + OVMF support for SEV live migration. + + Copyright (c) 2020, Advanced Micro Devices. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ +// +// The package level header files this module uses +// + +#include +#include +#include +#include +#include +#include + +#define KVM_FEATURE_MIGRATION_CONTROL 17 + +/** + Figures out if we are running inside KVM HVM and + KVM HVM supports SEV Live Migration feature. + + @retval TRUE KVM was detected and Live Migration supported + @retval FALSE KVM was not detected or Live Migration not supported + +**/ +BOOLEAN +KvmDetectSevLiveMigrationFeature( + VOID + ) +{ + UINT8 Signature[13]; + UINT32 mKvmLeaf = 0; + UINT32 RegEax, RegEbx, RegEcx, RegEdx; + + Signature[12] = '\0'; + for (mKvmLeaf = 0x40000000; mKvmLeaf < 0x40010000; mKvmLeaf += 0x100) { + AsmCpuid (mKvmLeaf, + NULL, + (UINT32 *) &Signature[0], + (UINT32 *) &Signature[4], + (UINT32 *) &Signature[8]); + + if (!AsciiStrCmp ((CHAR8 *) Signature, "KVMKVMKVM\0\0\0")) { + DEBUG (( + DEBUG_ERROR, + "%a: KVM Detected, signature = %s\n", + __FUNCTION__, + Signature + )); + + RegEax = 0x40000001; + RegEcx = 0; + AsmCpuid (0x40000001, &RegEax, &RegEbx, &RegEcx, &RegEdx); + if (RegEax & (1 << KVM_FEATURE_MIGRATION_CONTROL)) { + DEBUG (( + DEBUG_ERROR, + "%a: Live Migration feature supported\n", + __FUNCTION__ + )); + return TRUE; + } + } + } + + return FALSE; +} + +/** + + Function checks if SEV Live Migration support is available, if present then it sets + a UEFI enviroment variable to be queried later using Runtime services. + + **/ +VOID +AmdSevSetConfig( + VOID + ) +{ + EFI_STATUS Status; + BOOLEAN SevLiveMigrationEnabled; + + SevLiveMigrationEnabled = KvmDetectSevLiveMigrationFeature(); + + if (SevLiveMigrationEnabled) { + Status = gRT->SetVariable ( + L"SevLiveMigrationEnabled", + &gMemEncryptGuid, + EFI_VARIABLE_NON_VOLATILE | + EFI_VARIABLE_BOOTSERVICE_ACCESS | + EFI_VARIABLE_RUNTIME_ACCESS, + sizeof (BOOLEAN), + &SevLiveMigrationEnabled + ); + + DEBUG (( + DEBUG_ERROR, + "%a: Setting SevLiveMigrationEnabled variable, status = %lx\n", + __FUNCTION__, + Status + )); + } +} diff --git a/OvmfPkg/PlatformDxe/Platform.c b/OvmfPkg/PlatformDxe/Platform.c index f2e51960ce..f61302d98b 100644 --- a/OvmfPkg/PlatformDxe/Platform.c +++ b/OvmfPkg/PlatformDxe/Platform.c @@ -763,6 +763,11 @@ PlatformInit ( { EFI_STATUS Status; + // + // Set Amd Sev configuation + // + AmdSevSetConfig(); + ExecutePlatformConfig (); mConfigAccess.ExtractConfig = &ExtractConfig; diff --git a/OvmfPkg/PlatformDxe/Platform.inf b/OvmfPkg/PlatformDxe/Platform.inf index 14727c1220..2896f0a1d1 100644 --- a/OvmfPkg/PlatformDxe/Platform.inf +++ b/OvmfPkg/PlatformDxe/Platform.inf @@ -24,6 +24,7 @@ PlatformConfig.c PlatformConfig.h PlatformForms.vfr + AmdSev.c [Packages] MdePkg/MdePkg.dec @@ -56,6 +57,7 @@ [Guids] gEfiIfrTianoGuid gOvmfPlatformConfigGuid + gMemEncryptGuid [Depex] gEfiHiiConfigRoutingProtocolGuid AND diff --git a/OvmfPkg/PlatformDxe/PlatformConfig.h b/OvmfPkg/PlatformDxe/PlatformConfig.h index 716514da21..4f662aafa4 100644 --- a/OvmfPkg/PlatformDxe/PlatformConfig.h +++ b/OvmfPkg/PlatformDxe/PlatformConfig.h @@ -44,6 +44,11 @@ PlatformConfigLoad ( OUT UINT64 *OptionalElements ); +VOID +AmdSevSetConfig( + VOID + ); + // // Feature flags for OptionalElements. // -- 2.17.1