public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
* [RFC v4 00/13] x86: Secure Encrypted Virtualization (AMD)
@ 2017-05-10 22:09 Brijesh Singh
  2017-05-10 22:09 ` [RFC v4 01/13] UefiCpuPkg: Define AMD Memory Encryption specific CPUID and MSR Brijesh Singh
                   ` (12 more replies)
  0 siblings, 13 replies; 42+ messages in thread
From: Brijesh Singh @ 2017-05-10 22:09 UTC (permalink / raw)
  To: edk2-devel
  Cc: Thomas.Lendacky, leo.duran, Brijesh Singh, Jeff Fan, Liming Gao,
	Jordan Justen, Laszlo Ersek, Jiewen Yao

This RFC series provides support for AMD's new Secure Encrypted 
Virtualization (SEV) feature.

SEV is an extension to the AMD-V architecture which supports running
multiple VMs under the control of a hypervisor. The SEV feature allows
the memory contents of a virtual machine (VM) to be transparently encrypted
with a key unique to the guest VM. The memory controller contains a
high performance encryption engine which can be programmed with multiple
keys for use by a different VMs in the system. The programming and
management of these keys is handled by the AMD Secure Processor firmware
which exposes a commands for these tasks.

SEV guest VMs have the concept of private and shared memory.  Private memory is
encrypted with the guest-specific key, while shared memory may be encrypted
with hypervisor key.  Certain types of memory (namely instruction pages and
guest page tables) are always treated as private memory by the hardware.
For data memory, SEV guest VMs can choose which pages they would like to be
private. The choice is done using the standard CPU page tables using the C-bit,
and is fully controlled by the guest. Due to security reasons all the DMA
operations inside the  guest must be performed on shared pages (C-bit clear).
Note that since C-bit is only controllable by the guest OS when it is operating
in 64-bit or 32-bit PAE mode, in all other modes the SEV hardware forces the
C-bit to a 1.

The following links provide additional details:

AMD Memory Encryption whitepaper:
http://amd-dev.wpengine.netdna-cdn.com/wordpress/media/2013/12/AMD_Memory_Encryption_Whitepaper_v7-Public.pdf

AMD64 Architecture Programmer's Manual:
    http://support.amd.com/TechDocs/24593.pdf
    SME is section 7.10
    SEV is section 15.34

Secure Encrypted Virutualization Key Management:
http://support.amd.com/TechDocs/55766_SEV-KM API_Specification.pdf

KVM Forum Presentation:
http://www.linux-kvm.org/images/7/74/02x08A-Thomas_Lendacky-AMDs_Virtualizatoin_Memory_Encryption_Technology.pdf

[1] http://marc.info/?l=linux-mm&m=148846752931115&w=2

---

Patch series is based on commit b61fda11295b (NetworkPkg: Fix issue in dns driver when building DHCP packet.)

https://github.com/codomania/edk2/tree/sev-rfc-4

The patch series is tested with OvmfIa32.dsc, OvmfIa32X64.dsc and OvmfX64.dsc.
Since memory encryption bit is not accessiable when processor is in 32-bit mode
hence any DMA access in this mode would cause assert. I have also tested the
suspend and resume path, it seems to be working fine. I still need to work to
finish adding the SEV Dma support in QemuFwCfgS3Lib package (see TODO).

Changes since v3:
 - update AmdSevDxe driver to produce IOMMU protocol
 - remove BmDmaLib dependency
 - update QemuFwCfgLib to use IOMMU protocol to allocate SEV DMA buffer

Changes since v2:
 - move memory encryption CPUID and MSR definition into UefiCpuPkg
 - fix the argument order for SUB instruction in ResetVector and add more
   comments
 - update PlatformPei to use BaseMemEncryptSevLib
 - break the overlong comment lines to 79 chars
 - variable aligment and other formating fixes
 - split the SEV DMA support patch for QemuFwCfgLib into multiple patches as
   recommended by Laszlo
 - add AmdSevDxe driver which runs very early in DXE phase and clear the C-bit
   from MMIO memory region
 - drop 'QemuVideoDxe: Clear C-bit from framebuffer' patch since AmdSevDxe
   driver takes care of clearing the C-bit from MMIO region
 - Verified that Qemu PFLASH works fine with SEV guest, Found a KVM driver issue
   which was causing #PF when PFLASH was enabled. I have submitted patch to
   fix it in upstream http://marc.info/?l=kvm&m=149304930814202&w=2

Changes since v1:
 - bug fixes in OvmfPkg/ResetVector (pointed by Tom Lendacky)
 - add SEV CPUID and MSR register definition in standard include file
 - remove the MemEncryptLib dependency from PlatformPei. Move AmdSevInitialize()
   implementation in local file inside the PlatformPei package
 - rename MemCryptSevLib to MemEncryptSevLib and add functions to set or
   clear memory encryption attribute on memory region
 - integerate SEV support in BmDmaLib
 - split QemuFwCfgDxePei.c into QemuFwCfgDxe.c and QemuFwCfgPei.c to
   allow building seperate QemuFwCfgLib for Dxe and Pei phase
   (recommended by Laszlo Ersek)
 - add SEV support in QemuFwCfgLib
 - clear the memory encryption attribute from framebuffer memory region


TODO:
 - add support for DMA operation in QemuFwCfgS3Lib when SEV is enabled
 - investigate SMM/SMI support
 - add virtio support

Cc: Jeff Fan <jeff.fan@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Leo Duran <leo.duran@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Leo Duran <leo.duran@amd.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <Thomas.Lendacky@amd.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>

Brijesh Singh (13):
  UefiCpuPkg: Define AMD Memory Encryption specific CPUID and MSR
  OvmfPkg/ResetVector: Set C-bit when building initial page table
  OvmfPkg: Update dsc to use IoLib from BaseIoLibIntrinsicSev.inf
  OvmfPkg/BaseMemcryptSevLib: Add SEV helper library
  OvmfPkg/PlatformPei: Set memory encryption PCD when SEV is enabled
  OvmfPkg:AmdSevDxe: add AmdSevDxe driver
  OvmfPkg/QemuFwCfgLib: Provide Pei and Dxe specific library
  OvmfPkg/QemuFwCfgLib: Prepare for SEV support
  OvmfPkg/QemuFwCfgLib: Implement SEV internal function for SEC phase
  OvmfPkg/QemuFwCfgLib: Implement SEV internal functions for PEI phase
  OvmfPkg/QemuFwCfgLib: Implement SEV internal function for Dxe phase
  OvmfPkg/QemuFwCfgLib: Add option to dynamic alloc FW_CFG_DMA Access
  OvmfPkg/QemuFwCfgLib: Add SEV support

 OvmfPkg/OvmfPkgIa32.dsc                                                |   9 +-
 OvmfPkg/OvmfPkgIa32X64.dsc                                             |  10 +-
 OvmfPkg/OvmfPkgX64.dsc                                                 |  10 +-
 OvmfPkg/OvmfPkgIa32X64.fdf                                             |   2 +
 OvmfPkg/OvmfPkgX64.fdf                                                 |   2 +
 OvmfPkg/AmdSevDxe/AmdSevDxe.inf                                        |  49 +++
 OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf          |  50 +++
 OvmfPkg/Library/QemuFwCfgLib/{QemuFwCfgLib.inf => QemuFwCfgDxeLib.inf} |  10 +-
 OvmfPkg/Library/QemuFwCfgLib/{QemuFwCfgLib.inf => QemuFwCfgPeiLib.inf} |   7 +-
 OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgSecLib.inf                       |   1 +
 OvmfPkg/PlatformPei/PlatformPei.inf                                    |   3 +
 OvmfPkg/AmdSevDxe/AmdSevIommu.h                                        |  43 ++
 OvmfPkg/AmdSevDxe/AmdSevMmio.h                                         |  41 ++
 OvmfPkg/Include/Library/MemEncryptSevLib.h                             |  81 ++++
 OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.h        |  34 ++
 OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.h               | 184 ++++++++
 OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgLibInternal.h                    |  36 ++
 OvmfPkg/PlatformPei/Platform.h                                         |   5 +
 UefiCpuPkg/Include/Register/Amd/Cpuid.h                                | 162 +++++++
 UefiCpuPkg/Include/Register/Amd/Fam17Msr.h                             |  62 +++
 UefiCpuPkg/Include/Register/Amd/Msr.h                                  |  29 ++
 OvmfPkg/AmdSevDxe/AmdSevDxe.c                                          |  52 +++
 OvmfPkg/AmdSevDxe/AmdSevIommu.c                                        | 459 ++++++++++++++++++++
 OvmfPkg/AmdSevDxe/AmdSevMmio.c                                         |  50 +++
 OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c           | 126 ++++++
 OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.c        |  43 ++
 OvmfPkg/Library/BaseMemEncryptSevLib/X64/MemEncryptSevLib.c            | 127 ++++++
 OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c               | 422 ++++++++++++++++++
 OvmfPkg/Library/QemuFwCfgLib/{QemuFwCfgPeiDxe.c => QemuFwCfgDxe.c}     | 107 +++++
 OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgLib.c                            |  67 ++-
 OvmfPkg/Library/QemuFwCfgLib/{QemuFwCfgPeiDxe.c => QemuFwCfgPei.c}     |  72 ++-
 OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgSec.c                            |  57 +++
 OvmfPkg/PlatformPei/AmdSev.c                                           |  62 +++
 OvmfPkg/PlatformPei/Platform.c                                         |   1 +
 OvmfPkg/ResetVector/Ia32/PageTables64.asm                              |  70 ++-
 35 files changed, 2523 insertions(+), 22 deletions(-)
 create mode 100644 OvmfPkg/AmdSevDxe/AmdSevDxe.inf
 create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf
 copy OvmfPkg/Library/QemuFwCfgLib/{QemuFwCfgLib.inf => QemuFwCfgDxeLib.inf} (77%)
 rename OvmfPkg/Library/QemuFwCfgLib/{QemuFwCfgLib.inf => QemuFwCfgPeiLib.inf} (83%)
 create mode 100644 OvmfPkg/AmdSevDxe/AmdSevIommu.h
 create mode 100644 OvmfPkg/AmdSevDxe/AmdSevMmio.h
 create mode 100644 OvmfPkg/Include/Library/MemEncryptSevLib.h
 create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.h
 create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.h
 create mode 100644 UefiCpuPkg/Include/Register/Amd/Cpuid.h
 create mode 100644 UefiCpuPkg/Include/Register/Amd/Fam17Msr.h
 create mode 100644 UefiCpuPkg/Include/Register/Amd/Msr.h
 create mode 100644 OvmfPkg/AmdSevDxe/AmdSevDxe.c
 create mode 100644 OvmfPkg/AmdSevDxe/AmdSevIommu.c
 create mode 100644 OvmfPkg/AmdSevDxe/AmdSevMmio.c
 create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/Ia32/MemEncryptSevLib.c
 create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/MemEncryptSevLibInternal.c
 create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/MemEncryptSevLib.c
 create mode 100644 OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c
 copy OvmfPkg/Library/QemuFwCfgLib/{QemuFwCfgPeiDxe.c => QemuFwCfgDxe.c} (50%)
 rename OvmfPkg/Library/QemuFwCfgLib/{QemuFwCfgPeiDxe.c => QemuFwCfgPei.c} (61%)
 create mode 100644 OvmfPkg/PlatformPei/AmdSev.c

-- 
2.7.4



^ permalink raw reply	[flat|nested] 42+ messages in thread

end of thread, other threads:[~2017-05-18  8:50 UTC | newest]

Thread overview: 42+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-05-10 22:09 [RFC v4 00/13] x86: Secure Encrypted Virtualization (AMD) Brijesh Singh
2017-05-10 22:09 ` [RFC v4 01/13] UefiCpuPkg: Define AMD Memory Encryption specific CPUID and MSR Brijesh Singh
2017-05-11  0:30   ` Fan, Jeff
2017-05-10 22:09 ` [RFC v4 02/13] OvmfPkg/ResetVector: Set C-bit when building initial page table Brijesh Singh
2017-05-11 11:40   ` Laszlo Ersek
2017-05-10 22:09 ` [RFC v4 03/13] OvmfPkg: Update dsc to use IoLib from BaseIoLibIntrinsicSev.inf Brijesh Singh
2017-05-11 11:46   ` Laszlo Ersek
2017-05-10 22:09 ` [RFC v4 04/13] OvmfPkg/BaseMemcryptSevLib: Add SEV helper library Brijesh Singh
2017-05-11 14:04   ` Laszlo Ersek
2017-05-11 18:03     ` Brijesh Singh
2017-05-10 22:09 ` [RFC v4 05/13] OvmfPkg/PlatformPei: Set memory encryption PCD when SEV is enabled Brijesh Singh
2017-05-11 14:37   ` Laszlo Ersek
2017-05-11 18:04     ` Brijesh Singh
2017-05-10 22:09 ` [RFC v4 06/13] OvmfPkg:AmdSevDxe: add AmdSevDxe driver Brijesh Singh
2017-05-11  0:56   ` Yao, Jiewen
2017-05-11 15:19   ` Laszlo Ersek
2017-05-11 15:53     ` Laszlo Ersek
2017-05-11 17:43       ` Jordan Justen
2017-05-11 18:01         ` Brijesh Singh
2017-05-15 17:47           ` Jordan Justen
2017-05-16 12:04             ` Brijesh Singh
2017-05-16 17:56               ` Jordan Justen
2017-05-16 20:25                 ` Brijesh Singh
2017-05-18  8:50                   ` Laszlo Ersek
2017-05-11 20:14         ` Laszlo Ersek
2017-05-11 18:12     ` Brijesh Singh
2017-05-10 22:09 ` [RFC v4 07/13] OvmfPkg/QemuFwCfgLib: Provide Pei and Dxe specific library Brijesh Singh
2017-05-11 15:40   ` Laszlo Ersek
2017-05-11 18:16     ` Brijesh Singh
2017-05-10 22:09 ` [RFC v4 08/13] OvmfPkg/QemuFwCfgLib: Prepare for SEV support Brijesh Singh
2017-05-11 15:57   ` Laszlo Ersek
2017-05-10 22:09 ` [RFC v4 09/13] OvmfPkg/QemuFwCfgLib: Implement SEV internal function for SEC phase Brijesh Singh
2017-05-11 16:24   ` Laszlo Ersek
2017-05-11 18:21     ` Brijesh Singh
2017-05-10 22:09 ` [RFC v4 10/13] OvmfPkg/QemuFwCfgLib: Implement SEV internal functions for PEI phase Brijesh Singh
2017-05-11 16:38   ` Laszlo Ersek
2017-05-10 22:09 ` [RFC v4 11/13] OvmfPkg/QemuFwCfgLib: Implement SEV internal function for Dxe phase Brijesh Singh
2017-05-11 17:07   ` Laszlo Ersek
2017-05-10 22:09 ` [RFC v4 12/13] OvmfPkg/QemuFwCfgLib: Add option to dynamic alloc FW_CFG_DMA Access Brijesh Singh
2017-05-11 17:10   ` Laszlo Ersek
2017-05-10 22:09 ` [RFC v4 13/13] OvmfPkg/QemuFwCfgLib: Add SEV support Brijesh Singh
2017-05-11 17:44   ` Laszlo Ersek

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox