From: "Laszlo Ersek" <lersek@redhat.com>
To: devel@edk2.groups.io, thomas.lendacky@amd.com, ashish.kalra@amd.com
Cc: dovmurik@linux.vnet.ibm.com, brijesh.singh@amd.com,
tobin@ibm.com, Jon.Grimm@amd.com, jejb@linux.ibm.com,
frankeh@us.ibm.com, dgilbert@redhat.com,
jordan.l.justen@intel.com, ard.biesheuvel@arm.com
Subject: Re: [edk2-devel] [PATCH v3 0/3] SEV Page Encryption Bitmap support for OVMF.
Date: Thu, 10 Dec 2020 08:53:55 +0100 [thread overview]
Message-ID: <c6cbb282-ca41-acc3-35dc-d34772055737@redhat.com> (raw)
In-Reply-To: <c3040d0c-5113-18f5-d036-e123e60b7137@amd.com>
On 12/08/20 15:57, Lendacky, Thomas wrote:
> On 12/7/20 8:44 PM, Laszlo Ersek wrote:
>> On 12/04/20 09:10, Ashish Kalra wrote:
>>> On Fri, Dec 04, 2020 at 04:50:05AM +0100, Laszlo Ersek wrote:
>>>> On 12/04/20 01:03, Ashish Kalra wrote:
>>>>> From: Ashish Kalra <ashish.kalra@amd.com>
>>>>>
>>>>> By default all the SEV guest memory regions are considered encrypted,
>>>>> if a guest changes the encryption attribute of the page (e.g mark a
>>>>> page as decrypted) then notify hypervisor. Hypervisor will need to
>>>>> track the unencrypted pages. The information will be used during
>>>>> guest live migration, guest page migration and guest debugging.
>>>>>
>>>>> The patch-set also adds a new SEV and SEV-ES hypercall abstraction
>>>>> library to support SEV Page encryption/decryption status hypercalls
>>>>> for SEV and SEV-ES guests.
>>>>>
>>>>> BaseMemEncryptSevLib invokes hypercalls via this new hypercall library.
>>>>>
>>>>> A branch containing these patches is available here:
>>>>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fashkalra%2Fedk2%2Ftree%2Fsev_page_encryption_bitmap_v3&data=04%7C01%7Cthomas.lendacky%40amd.com%7Caa286d7e06864008110008d89b233ebc%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637429922982193672%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=EjrGD2LNlji8ualk8KClh%2BhqJa5Fm0UzlmPc4%2FQvb2g%3D&reserved=0
>>>>>
>>>>> Changes since v2:
>>>>> - GHCB_BASE setup during reset-vector as decrypted is marked explicitly
>>>>> in the hypervisor page encryption bitmap after setting the
>>>>> PcdSevEsIsEnabled PCD.
>>>>>
>>>>> Changes since v1:
>>>>> - Mark GHCB_BASE setup during reset-vector as decrypted explicitly in
>>>>> the hypervisor page encryption bitmap.
>>>>> - Resending the series with correct shallow threading.
>>>>>
>>>>> Ashish Kalra (2):
>>>>> OvmfPkg/MemEncryptHypercallLib: add library to support SEV hypercalls.
>>>>> OvmfPkg/PlatformPei: Mark SEC GHCB page in the page encrpytion bitmap.
>>>>>
>>>>> Brijesh Singh (1):
>>>>> OvmfPkg/BaseMemEncryptLib: Support to issue unencrypted hypercall
>>>>>
>>>>> .../Include/Library/MemEncryptHypercallLib.h | 37 ++++++
>>>>> .../BaseMemEncryptSevLib.inf | 1 +
>>>>> .../BaseMemEncryptSevLib/X64/VirtualMemory.c | 18 +++
>>>>> .../MemEncryptHypercallLib.c | 105 ++++++++++++++++++
>>>>> .../MemEncryptHypercallLib.inf | 39 +++++++
>>>>> .../X64/AsmHelperStub.nasm | 39 +++++++
>>>>> OvmfPkg/OvmfPkgX64.dsc | 1 +
>>>>> OvmfPkg/PlatformPei/AmdSev.c | 10 ++
>>>>> 8 files changed, 250 insertions(+)
>>>>> create mode 100644 OvmfPkg/Include/Library/MemEncryptHypercallLib.h
>>>>> create mode 100644 OvmfPkg/Library/MemEncryptHypercallLib/MemEncryptHypercallLib.c
>>>>> create mode 100644 OvmfPkg/Library/MemEncryptHypercallLib/MemEncryptHypercallLib.inf
>>>>> create mode 100644 OvmfPkg/Library/MemEncryptHypercallLib/X64/AsmHelperStub.nasm
>>>>>
>>>>
>>>> I'll need some time to get to this series.
>>>>
>>>> I'm fairly certain though, from a quick skim, that this series breaks
>>>> all DSC files under OvmfPkg except X64. Please fix that.
>>>>
>>>>
>>>
>>> Ok thanks Laszlo, i will fix this.
>>
>> Thanks.
>>
>> I can see a new comment for the series from Dov Murik, and I think
>> that's awesome. I'd welcome if there were lively exchanges around OVMF
>> patch sets. I'm selfish of course: I'd like to delegate reviews.
>>
>> So, on this patch set, I notice it does not add the new
>> (MemEncryptHypercallLib-related) files to Maintainers.txt, namely
>> section "OvmfPkg: SEV-related modules".
>>
>> Please include such a patch in v4 -- if Tom and Brijesh agree, I'd like
>> to put the new lib explicitly under their reviewership.
>
> Yes, no issues with that.
Thank you guys!
Laszlo
>
>>
>> Also, I plan to review this series (v4, at this point) only for
>> formalities. I'd like to receive an R-b from Tom or Brijesh [*], and
>> another from Dov or a colleague at IBM, for this series; those together
>> should suffice for merging the library.
>>
>> [*] Brijesh seems to be the original author of patch#2, so maybe Tom is
>> a better-poised reviewer for this.
>
> Will do. I know a new version is coming as well as discussion about the
> hypercall in general, so lets see where that goes.
>
> Thanks,
> Tom
>
>>
>> Thanks
>> Laszlo
>>
>
>
>
>
>
prev parent reply other threads:[~2020-12-10 7:54 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-04 0:03 [PATCH v3 0/3] SEV Page Encryption Bitmap support for OVMF Ashish Kalra
2020-12-04 0:03 ` [PATCH v3 1/3] OvmfPkg/MemEncryptHypercallLib: add library to support SEV hypercalls Ashish Kalra
2020-12-06 12:43 ` Dov Murik
2020-12-08 14:23 ` Ashish Kalra
2020-12-04 0:03 ` [PATCH v3 2/3] OvmfPkg/BaseMemEncryptLib: Support to issue unencrypted hypercall Ashish Kalra
2020-12-04 0:03 ` [PATCH v3 3/3] OvmfPkg/PlatformPei: Mark SEC GHCB page in the page encrpytion bitmap Ashish Kalra
2020-12-04 3:50 ` [edk2-devel] [PATCH v3 0/3] SEV Page Encryption Bitmap support for OVMF Laszlo Ersek
2020-12-04 8:10 ` Ashish Kalra
2020-12-08 2:44 ` Laszlo Ersek
2020-12-08 4:44 ` Brijesh Singh
2020-12-08 14:57 ` Lendacky, Thomas
2020-12-10 7:53 ` Laszlo Ersek [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c6cbb282-ca41-acc3-35dc-d34772055737@redhat.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox