[PATCH 0/2] work area fixes

[PATCH 0/2] work area fixes

[Brijesh Singh]

We missed updating the AmdSev package and Ia32 buid to use new work area.

Brijesh Singh (2):
  Ovmfpkg: update Ia32 build to use new work area
  OvmfPkg/AmdSev: update the fdf to use new workarea PCD

 OvmfPkg/AmdSev/AmdSevX64.fdf          | 9 ++++++++-
 OvmfPkg/OvmfPkgIa32X64.fdf            | 3 +++
 OvmfPkg/ResetVector/ResetVector.nasmb | 3 ++-
 3 files changed, 13 insertions(+), 2 deletions(-)

-- 
2.25.1

[PATCH 1/2] Ovmfpkg: update Ia32 build to use new work area

[Brijesh Singh]

The commit 80e67af9afca added support for the generic work area concept
used mainly by the encrypted VMs. In the past, the work area was
preliminary used by the SEV-ES VMs. The SEV-ES support is available for
the X64 builds only. But now, that work area header contains fields that
nonencrypted VMs and SEV VMs can use. They can be built for IA32. So,
moving the work area defines outside of X64.

Fixes: 80e67af9afca ("OvmfPkg: introduce a common work area")
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
---
 OvmfPkg/OvmfPkgIa32X64.fdf            | 3 +++
 OvmfPkg/ResetVector/ResetVector.nasmb | 3 ++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
index 245ca94044df..9d8695922f97 100644
--- a/OvmfPkg/OvmfPkgIa32X64.fdf
+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -76,6 +76,9 @@ [FD.MEMFD]
 0x007000|0x001000
 gEfiMdePkgTokenSpaceGuid.PcdGuidedExtractHandlerTableAddress|gUefiOvmfPkgTokenSpaceGuid.PcdGuidedExtractHandlerTableSize
 
+0x008000|0x001000
+gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaSize
+
 0x010000|0x010000
 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamSize
 
diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb b/OvmfPkg/ResetVector/ResetVector.nasmb
index d1d800c56745..21b5fd82b830 100644
--- a/OvmfPkg/ResetVector/ResetVector.nasmb
+++ b/OvmfPkg/ResetVector/ResetVector.nasmb
@@ -47,6 +47,8 @@
 %include "Ia32/SearchForBfvBase.asm"
 %include "Ia32/SearchForSecEntry.asm"
 
+%define WORK_AREA_GUEST_TYPE (FixedPcdGet32 (PcdOvmfWorkAreaBase))
+
 %ifdef ARCH_X64
   #include <AutoGen.h>
 
@@ -72,7 +74,6 @@
   %define GHCB_PT_ADDR (FixedPcdGet32 (PcdOvmfSecGhcbPageTableBase))
   %define GHCB_BASE (FixedPcdGet32 (PcdOvmfSecGhcbBase))
   %define GHCB_SIZE (FixedPcdGet32 (PcdOvmfSecGhcbSize))
-  %define WORK_AREA_GUEST_TYPE (FixedPcdGet32 (PcdOvmfWorkAreaBase))
   %define SEV_ES_WORK_AREA (FixedPcdGet32 (PcdSevEsWorkAreaBase))
   %define SEV_ES_WORK_AREA_RDRAND (FixedPcdGet32 (PcdSevEsWorkAreaBase) + 8)
   %define SEV_ES_WORK_AREA_ENC_MASK (FixedPcdGet32 (PcdSevEsWorkAreaBase) + 16)
-- 
2.25.1

Re: [PATCH 1/2] Ovmfpkg: update Ia32 build to use new work area

[Gerd Hoffmann]

On Thu, Oct 14, 2021 at 01:17:10PM -0500, Brijesh Singh wrote:
> The commit 80e67af9afca added support for the generic work area concept
> used mainly by the encrypted VMs. In the past, the work area was
> preliminary used by the SEV-ES VMs. The SEV-ES support is available for
> the X64 builds only. But now, that work area header contains fields that
> nonencrypted VMs and SEV VMs can use. They can be built for IA32. So,
> moving the work area defines outside of X64.

Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>

Re: [PATCH 1/2] Ovmfpkg: update Ia32 build to use new work area

[Min Xu]

On October 15, 2021 2:17 AM, Brijesh Singh wrote:
> 
> The commit 80e67af9afca added support for the generic work area concept
> used mainly by the encrypted VMs. In the past, the work area was preliminary
> used by the SEV-ES VMs. The SEV-ES support is available for the X64 builds only.
> But now, that work area header contains fields that nonencrypted VMs and SEV
> VMs can use. They can be built for IA32. So, moving the work area defines
> outside of X64.
> 
> Fixes: 80e67af9afca ("OvmfPkg: introduce a common work area")
> Cc: James Bottomley <jejb@linux.ibm.com>
> Cc: Min Xu <min.m.xu@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Tom Lendacky <thomas.lendacky@amd.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
> Cc: Erdem Aktas <erdemaktas@google.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
> ---
>  OvmfPkg/OvmfPkgIa32X64.fdf            | 3 +++
>  OvmfPkg/ResetVector/ResetVector.nasmb | 3 ++-
>  2 files changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
> index 245ca94044df..9d8695922f97 100644
> --- a/OvmfPkg/OvmfPkgIa32X64.fdf
> +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
> @@ -76,6 +76,9 @@ [FD.MEMFD]
>  0x007000|0x001000
> 
> gEfiMdePkgTokenSpaceGuid.PcdGuidedExtractHandlerTableAddress|gUefiOvmf
> PkgTokenSpaceGuid.PcdGuidedExtractHandlerTableSize
> 
> +0x008000|0x001000
> +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase|gUefiOvmfPkgTokenS
> paceGu
> +id.PcdOvmfWorkAreaSize
> +
>  0x010000|0x010000
> 
> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase|gUefiOvmfPkgTo
> kenSpaceGuid.PcdOvmfSecPeiTempRamSize
> 
> diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb
> b/OvmfPkg/ResetVector/ResetVector.nasmb
> index d1d800c56745..21b5fd82b830 100644
> --- a/OvmfPkg/ResetVector/ResetVector.nasmb
> +++ b/OvmfPkg/ResetVector/ResetVector.nasmb
> @@ -47,6 +47,8 @@
>  %include "Ia32/SearchForBfvBase.asm"
>  %include "Ia32/SearchForSecEntry.asm"
> 
> +%define WORK_AREA_GUEST_TYPE (FixedPcdGet32 (PcdOvmfWorkAreaBase))
> +
>  %ifdef ARCH_X64
>    #include <AutoGen.h>
> 
> @@ -72,7 +74,6 @@
>    %define GHCB_PT_ADDR (FixedPcdGet32 (PcdOvmfSecGhcbPageTableBase))
>    %define GHCB_BASE (FixedPcdGet32 (PcdOvmfSecGhcbBase))
>    %define GHCB_SIZE (FixedPcdGet32 (PcdOvmfSecGhcbSize))
> -  %define WORK_AREA_GUEST_TYPE (FixedPcdGet32 (PcdOvmfWorkAreaBase))
>    %define SEV_ES_WORK_AREA (FixedPcdGet32 (PcdSevEsWorkAreaBase))
>    %define SEV_ES_WORK_AREA_RDRAND (FixedPcdGet32
> (PcdSevEsWorkAreaBase) + 8)
>    %define SEV_ES_WORK_AREA_ENC_MASK (FixedPcdGet32
> (PcdSevEsWorkAreaBase) + 16)
> --
> 2.25.1

Reviewed-by: Min Xu <min.m.xu@intel.com>

Thanks.
Min

[PATCH 2/2] OvmfPkg/AmdSev: update the fdf to use new workarea PCD

[Brijesh Singh]

The commit 80e67af9afca added support for the generic work area concept
used mainly by the encrypted VMs but missed update the AmdSev package.

Fixes: 80e67af9afca ("OvmfPkg: introduce a common work area")
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Reported-by: Dov Murik <dovmurik@linux.ibm.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
---
 OvmfPkg/AmdSev/AmdSevX64.fdf | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
index 542722ac6b37..56626098862c 100644
--- a/OvmfPkg/AmdSev/AmdSevX64.fdf
+++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
@@ -57,7 +57,7 @@ [FD.MEMFD]
 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbSize
 
 0x00B000|0x001000
-gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase|gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize
+gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaSize
 
 0x00C000|0x000C00
 gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretBase|gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretSize
@@ -79,6 +79,13 @@ [FD.MEMFD]
 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvSize
 FV = DXEFV
 
+##########################################################################################
+# Set the SEV-ES specific work area PCDs
+#
+SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase = $(MEMFD_BASE_ADDRESS) +  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader
+SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize = gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaSize - gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader
+##########################################################################################
+
 ################################################################################
 
 [FV.SECFV]
-- 
2.25.1

Re: [PATCH 2/2] OvmfPkg/AmdSev: update the fdf to use new workarea PCD

[Gerd Hoffmann]

On Thu, Oct 14, 2021 at 01:17:11PM -0500, Brijesh Singh wrote:
> The commit 80e67af9afca added support for the generic work area concept
> used mainly by the encrypted VMs but missed update the AmdSev package.
> 
> Fixes: 80e67af9afca ("OvmfPkg: introduce a common work area")

Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>

take care,
  Gerd

Re: [PATCH 2/2] OvmfPkg/AmdSev: update the fdf to use new workarea PCD

[Dov Murik]

[+Tobin]


On 14/10/2021 21:17, Brijesh Singh wrote:
> The commit 80e67af9afca added support for the generic work area concept
> used mainly by the encrypted VMs but missed update the AmdSev package.
> 
> Fixes: 80e67af9afca ("OvmfPkg: introduce a common work area")

Thanks Brijesh.

The fix does allow me to launch SEV-ES guests, which is good news.
However, the guest's measurement has changed, so I wonder what this
change causes.

The details:

I tested 3 commits (always building the AmdSevX64 target):

1. commit 7b4a99be8a39 - edk2-stable202108

I successfully launch SEV and SEV-ES guests and my measurement check
script verifies the digest correctly (including the "measured linux
boot" hashes table added by QEMU).

2. commit f10a112f08f3 - master (Oct 14)

I successfully launch SEV guests, but SEV-ES guests crash with "error:
kvm run failed Invalid argument". The measurement check verifies digest
correctly.

3. master + this AmdSevX64.fdf patch

I successfully launch SEV guests and measurement calculation is OK. As
far SEV-ES guests, the measurement check doesn't match what I expect. If
I ignore the mismatched measurement and continue the launch, the guest
runs OK with SEV-ES.


So this patch fixes the problem (SEV-ES guest crashes on launch) but
shows another problem (bad guest measurement).


Note that for this test, my measurement calculation script automatically
takes the OVMF image I'm using to boot the VM.  From my reading of the
QEMU code, the only pieces that should affect the measurement is the
OVMF image, the hashes table, and the VMSAs for each vcpu.  The OVMF
image is updated on every check, and the rest shouldn't have changed
between those 3 revisions that I tested.


It might be an issue with my measurement checking script which was
assuming something that has changed with the introduction of the new
work area, but I can't think of something like that. Note again that
plain SEV measurement is still working OK.


Do you encounter similar issues with VM measurement?


-Dov



> Cc: James Bottomley <jejb@linux.ibm.com>
> Cc: Min Xu <min.m.xu@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Tom Lendacky <thomas.lendacky@amd.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
> Cc: Erdem Aktas <erdemaktas@google.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Reported-by: Dov Murik <dovmurik@linux.ibm.com>
> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
> ---
>  OvmfPkg/AmdSev/AmdSevX64.fdf | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
> index 542722ac6b37..56626098862c 100644
> --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
> +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
> @@ -57,7 +57,7 @@ [FD.MEMFD]
>  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbSize
>  
>  0x00B000|0x001000
> -gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase|gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize
> +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaSize
>  
>  0x00C000|0x000C00
>  gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretBase|gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretSize
> @@ -79,6 +79,13 @@ [FD.MEMFD]
>  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvSize
>  FV = DXEFV
>  
> +##########################################################################################
> +# Set the SEV-ES specific work area PCDs
> +#
> +SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase = $(MEMFD_BASE_ADDRESS) +  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader
> +SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize = gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaSize - gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader
> +##########################################################################################
> +
>  ################################################################################
>  
>  [FV.SECFV]
> 

Re: [PATCH 2/2] OvmfPkg/AmdSev: update the fdf to use new workarea PCD

[Brijesh Singh]

On 10/16/21 1:38 PM, Dov Murik wrote:
> [+Tobin]
>
>
> On 14/10/2021 21:17, Brijesh Singh wrote:
>> The commit 80e67af9afca added support for the generic work area concept
>> used mainly by the encrypted VMs but missed update the AmdSev package.
>>
>> Fixes: 80e67af9afca ("OvmfPkg: introduce a common work area")
> Thanks Brijesh.
>
> The fix does allow me to launch SEV-ES guests, which is good news.
> However, the guest's measurement has changed, so I wonder what this
> change causes.
>
> The details:
>
> I tested 3 commits (always building the AmdSevX64 target):
>
> 1. commit 7b4a99be8a39 - edk2-stable202108
>
> I successfully launch SEV and SEV-ES guests and my measurement check
> script verifies the digest correctly (including the "measured linux
> boot" hashes table added by QEMU).
>
> 2. commit f10a112f08f3 - master (Oct 14)
>
> I successfully launch SEV guests, but SEV-ES guests crash with "error:
> kvm run failed Invalid argument". The measurement check verifies digest
> correctly.
>
> 3. master + this AmdSevX64.fdf patch
>
> I successfully launch SEV guests and measurement calculation is OK. As
> far SEV-ES guests, the measurement check doesn't match what I expect. If
> I ignore the mismatched measurement and continue the launch, the guest
> runs OK with SEV-ES.
>
>
> So this patch fixes the problem (SEV-ES guest crashes on launch) but
> shows another problem (bad guest measurement).
>
>
> Note that for this test, my measurement calculation script automatically
> takes the OVMF image I'm using to boot the VM.  From my reading of the
> QEMU code, the only pieces that should affect the measurement is the
> OVMF image, the hashes table, and the VMSAs for each vcpu.  The OVMF
> image is updated on every check, and the rest shouldn't have changed
> between those 3 revisions that I tested.
>
>
> It might be an issue with my measurement checking script which was
> assuming something that has changed with the introduction of the new
> work area, but I can't think of something like that. Note again that
> plain SEV measurement is still working OK.
>
I assume you are including the IP for the APs during your VMSA hash
computation. The IP for the AP is obtained through the SevEsResetGuid
[1]. It points to Fixed(PcdSevEsWorkArea). After we introduced the
generic Ovmf workarea concept the PcdSevEsWorkArea no longer start from
the beginning of the workarea. See the hunk below

+##########################################################################################
+# Set the SEV-ES specific work area PCDs
+#
+SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase = $(MEMFD_BASE_ADDRESS) +  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader
+SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize = gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaSize - gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader
+##########################################################################################
+

[1]
https://github.com/tianocore/edk2/blob/master/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm#L109

Make sure you are using the correct value for the AP IP in your
computation. If you have hard coded AP IP in your script then I would
recommend to update the script to  retrieve the value from the OVMF_CODE.fd.

Hope this helps.

> Do you encounter similar issues with VM measurement?
>
>
> -Dov
>
>
>
>> Cc: James Bottomley <jejb@linux.ibm.com>
>> Cc: Min Xu <min.m.xu@intel.com>
>> Cc: Jiewen Yao <jiewen.yao@intel.com>
>> Cc: Tom Lendacky <thomas.lendacky@amd.com>
>> Cc: Jordan Justen <jordan.l.justen@intel.com>
>> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
>> Cc: Erdem Aktas <erdemaktas@google.com>
>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>> Reported-by: Dov Murik <dovmurik@linux.ibm.com>
>> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
>> ---
>>  OvmfPkg/AmdSev/AmdSevX64.fdf | 9 ++++++++-
>>  1 file changed, 8 insertions(+), 1 deletion(-)
>>
>> diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
>> index 542722ac6b37..56626098862c 100644
>> --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
>> +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
>> @@ -57,7 +57,7 @@ [FD.MEMFD]
>>  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbSize
>>  
>>  0x00B000|0x001000
>> -gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase|gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize
>> +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaSize
>>  
>>  0x00C000|0x000C00
>>  gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretBase|gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretSize
>> @@ -79,6 +79,13 @@ [FD.MEMFD]
>>  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvSize
>>  FV = DXEFV
>>  
>> +##########################################################################################
>> +# Set the SEV-ES specific work area PCDs
>> +#
>> +SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase = $(MEMFD_BASE_ADDRESS) +  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader
>> +SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize = gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaSize - gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader
>> +##########################################################################################
>> +
>>  ################################################################################
>>  
>>  [FV.SECFV]
>>

Re: [PATCH 2/2] OvmfPkg/AmdSev: update the fdf to use new workarea PCD

[Dov Murik]

On 17/10/2021 1:32, Brijesh Singh wrote:
> 
> On 10/16/21 1:38 PM, Dov Murik wrote:
>> [+Tobin]
>>
>>
>> On 14/10/2021 21:17, Brijesh Singh wrote:
>>> The commit 80e67af9afca added support for the generic work area concept
>>> used mainly by the encrypted VMs but missed update the AmdSev package.
>>>
>>> Fixes: 80e67af9afca ("OvmfPkg: introduce a common work area")
>> Thanks Brijesh.
>>
>> The fix does allow me to launch SEV-ES guests, which is good news.
>> However, the guest's measurement has changed, so I wonder what this
>> change causes.
>>
>> The details:
>>
>> I tested 3 commits (always building the AmdSevX64 target):
>>
>> 1. commit 7b4a99be8a39 - edk2-stable202108
>>
>> I successfully launch SEV and SEV-ES guests and my measurement check
>> script verifies the digest correctly (including the "measured linux
>> boot" hashes table added by QEMU).
>>
>> 2. commit f10a112f08f3 - master (Oct 14)
>>
>> I successfully launch SEV guests, but SEV-ES guests crash with "error:
>> kvm run failed Invalid argument". The measurement check verifies digest
>> correctly.
>>
>> 3. master + this AmdSevX64.fdf patch
>>
>> I successfully launch SEV guests and measurement calculation is OK. As
>> far SEV-ES guests, the measurement check doesn't match what I expect. If
>> I ignore the mismatched measurement and continue the launch, the guest
>> runs OK with SEV-ES.
>>
>>
>> So this patch fixes the problem (SEV-ES guest crashes on launch) but
>> shows another problem (bad guest measurement).
>>
>>
>> Note that for this test, my measurement calculation script automatically
>> takes the OVMF image I'm using to boot the VM.  From my reading of the
>> QEMU code, the only pieces that should affect the measurement is the
>> OVMF image, the hashes table, and the VMSAs for each vcpu.  The OVMF
>> image is updated on every check, and the rest shouldn't have changed
>> between those 3 revisions that I tested.
>>
>>
>> It might be an issue with my measurement checking script which was
>> assuming something that has changed with the introduction of the new
>> work area, but I can't think of something like that. Note again that
>> plain SEV measurement is still working OK.
>>
> I assume you are including the IP for the APs during your VMSA hash
> computation. The IP for the AP is obtained through the SevEsResetGuid
> [1]. It points to Fixed(PcdSevEsWorkArea). After we introduced the
> generic Ovmf workarea concept the PcdSevEsWorkArea no longer start from
> the beginning of the workarea. See the hunk below
> 
> +##########################################################################################
> +# Set the SEV-ES specific work area PCDs
> +#
> +SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase = $(MEMFD_BASE_ADDRESS) +  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader
> +SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize = gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaSize - gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader
> +##########################################################################################
> +
> 
> [1]
> https://github.com/tianocore/edk2/blob/master/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm#L109
> 
> Make sure you are using the correct value for the AP IP in your
> computation. If you have hard coded AP IP in your script then I would
> recommend to update the script to  retrieve the value from the OVMF_CODE.fd.
> 
> Hope this helps.
> 

Yep, that was indeed the issue. The VMSA for vcpu0 is identical to the
previous version, but there was a 4-byte shift in the IP field in VMSA
for the AP vcpus.

Thanks for your help debugging this.

So, FWIW:

Reviewed-by: Dov Murik <dovmurik@linux.ibm.com>
Tested-by: Dov Murik <dovmurik@linux.ibm.com>


-Dov

>> Do you encounter similar issues with VM measurement?
>>
>>
>> -Dov
>>
>>
>>
>>> Cc: James Bottomley <jejb@linux.ibm.com>
>>> Cc: Min Xu <min.m.xu@intel.com>
>>> Cc: Jiewen Yao <jiewen.yao@intel.com>
>>> Cc: Tom Lendacky <thomas.lendacky@amd.com>
>>> Cc: Jordan Justen <jordan.l.justen@intel.com>
>>> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
>>> Cc: Erdem Aktas <erdemaktas@google.com>
>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>> Reported-by: Dov Murik <dovmurik@linux.ibm.com>
>>> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
>>> ---
>>>  OvmfPkg/AmdSev/AmdSevX64.fdf | 9 ++++++++-
>>>  1 file changed, 8 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
>>> index 542722ac6b37..56626098862c 100644
>>> --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
>>> +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
>>> @@ -57,7 +57,7 @@ [FD.MEMFD]
>>>  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbSize
>>>  
>>>  0x00B000|0x001000
>>> -gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase|gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize
>>> +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaSize
>>>  
>>>  0x00C000|0x000C00
>>>  gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretBase|gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretSize
>>> @@ -79,6 +79,13 @@ [FD.MEMFD]
>>>  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvSize
>>>  FV = DXEFV
>>>  
>>> +##########################################################################################
>>> +# Set the SEV-ES specific work area PCDs
>>> +#
>>> +SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase = $(MEMFD_BASE_ADDRESS) +  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader
>>> +SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize = gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaSize - gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader
>>> +##########################################################################################
>>> +
>>>  ################################################################################
>>>  
>>>  [FV.SECFV]
>>>

Re: [edk2-devel] [PATCH 2/2] OvmfPkg/AmdSev: update the fdf to use new workarea PCD

[Min Xu]

On October 15, 2021 2:17 AM, Brijesh Singh wrote:
> The commit 80e67af9afca added support for the generic work area concept
> used mainly by the encrypted VMs but missed update the AmdSev package.
> 
> Fixes: 80e67af9afca ("OvmfPkg: introduce a common work area")
> Cc: James Bottomley <jejb@linux.ibm.com>
> Cc: Min Xu <min.m.xu@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Tom Lendacky <thomas.lendacky@amd.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
> Cc: Erdem Aktas <erdemaktas@google.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Reported-by: Dov Murik <dovmurik@linux.ibm.com>
> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
> ---
>  OvmfPkg/AmdSev/AmdSevX64.fdf | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf
> b/OvmfPkg/AmdSev/AmdSevX64.fdf index 542722ac6b37..56626098862c
> 100644
> --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
> +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
> @@ -57,7 +57,7 @@ [FD.MEMFD]
> 
> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBase|gUefiOvmfPkgTokenSpac
> eGuid.PcdOvmfSecGhcbSize
> 
>  0x00B000|0x001000
> -
> gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase|gUefiCpuPkgTokenSpace
> Guid.PcdSevEsWorkAreaSize
> +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase|gUefiOvmfPkgTokenS
> paceGu
> +id.PcdOvmfWorkAreaSize
> 
>  0x00C000|0x000C00
> 
> gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretBase|gUefiOvmfPkgTokenS
> paceGuid.PcdSevLaunchSecretSize
> @@ -79,6 +79,13 @@ [FD.MEMFD]
> 
> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvBase|gUefiOvmfPkgTokenS
> paceGuid.PcdOvmfDxeMemFvSize
>  FV = DXEFV
> 
> +################################################################
> #######
> +################### # Set the SEV-ES specific work area PCDs # SET
> +gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase =
> $(MEMFD_BASE_ADDRESS)
> ++  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase +
> +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHead
> er
> +SET gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaSize =
> +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaSize -
> +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHead
> er
> +################################################################
> #######
> +###################
> +
> 
> #################################################################
> ###############
> 
>  [FV.SECFV]
> --
> 2.25.1
> 
Reviewed-by: Min Xu <min.m.xu@intel.com>

Thanks.
Min

Re: [edk2-devel] [PATCH 0/2] work area fixes

[Yao, Jiewen]

Series: Acked-by: Jiewen Yao <Jiewen.yao@intel.com>

> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Brijesh
> Singh via groups.io
> Sent: Friday, October 15, 2021 2:17 AM
> To: devel@edk2.groups.io
> Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M <min.m.xu@intel.com>;
> Yao, Jiewen <jiewen.yao@intel.com>; Tom Lendacky
> <thomas.lendacky@amd.com>; Justen, Jordan L <jordan.l.justen@intel.com>;
> Ard Biesheuvel <ardb+tianocore@kernel.org>; Erdem Aktas
> <erdemaktas@google.com>; Michael Roth <Michael.Roth@amd.com>; Gerd
> Hoffmann <kraxel@redhat.com>; Brijesh Singh <brijesh.singh@amd.com>
> Subject: [edk2-devel] [PATCH 0/2] work area fixes
> 
> We missed updating the AmdSev package and Ia32 buid to use new work area.
> 
> Brijesh Singh (2):
>   Ovmfpkg: update Ia32 build to use new work area
>   OvmfPkg/AmdSev: update the fdf to use new workarea PCD
> 
>  OvmfPkg/AmdSev/AmdSevX64.fdf          | 9 ++++++++-
>  OvmfPkg/OvmfPkgIa32X64.fdf            | 3 +++
>  OvmfPkg/ResetVector/ResetVector.nasmb | 3 ++-
>  3 files changed, 13 insertions(+), 2 deletions(-)
> 
> --
> 2.25.1
> 
> 
> 
> 
> 

Re: [edk2-devel] [PATCH 0/2] work area fixes

[Yao, Jiewen]

Hi
This patch failed in PR - https://github.com/tianocore/edk2/pull/2076

Please take a look.

You are encouraged to try PR before submit next time.

Thank you
Yao Jiewen

> -----Original Message-----
> From: Yao, Jiewen
> Sent: Monday, October 18, 2021 12:53 PM
> To: devel@edk2.groups.io; brijesh.singh@amd.com
> Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M <min.m.xu@intel.com>;
> Tom Lendacky <thomas.lendacky@amd.com>; Justen, Jordan L
> <jordan.l.justen@intel.com>; Ard Biesheuvel <ardb+tianocore@kernel.org>;
> Erdem Aktas <erdemaktas@google.com>; Michael Roth
> <Michael.Roth@amd.com>; Gerd Hoffmann <kraxel@redhat.com>
> Subject: RE: [edk2-devel] [PATCH 0/2] work area fixes
> 
> Series: Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
> 
> > -----Original Message-----
> > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Brijesh
> > Singh via groups.io
> > Sent: Friday, October 15, 2021 2:17 AM
> > To: devel@edk2.groups.io
> > Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M
> <min.m.xu@intel.com>;
> > Yao, Jiewen <jiewen.yao@intel.com>; Tom Lendacky
> > <thomas.lendacky@amd.com>; Justen, Jordan L <jordan.l.justen@intel.com>;
> > Ard Biesheuvel <ardb+tianocore@kernel.org>; Erdem Aktas
> > <erdemaktas@google.com>; Michael Roth <Michael.Roth@amd.com>; Gerd
> > Hoffmann <kraxel@redhat.com>; Brijesh Singh <brijesh.singh@amd.com>
> > Subject: [edk2-devel] [PATCH 0/2] work area fixes
> >
> > We missed updating the AmdSev package and Ia32 buid to use new work area.
> >
> > Brijesh Singh (2):
> >   Ovmfpkg: update Ia32 build to use new work area
> >   OvmfPkg/AmdSev: update the fdf to use new workarea PCD
> >
> >  OvmfPkg/AmdSev/AmdSevX64.fdf          | 9 ++++++++-
> >  OvmfPkg/OvmfPkgIa32X64.fdf            | 3 +++
> >  OvmfPkg/ResetVector/ResetVector.nasmb | 3 ++-
> >  3 files changed, 13 insertions(+), 2 deletions(-)
> >
> > --
> > 2.25.1
> >
> >
> >
> > 
> >

Re: [edk2-devel] [PATCH 0/2] work area fixes

[Brijesh Singh]

On 10/18/21 8:14 AM, Yao, Jiewen wrote:
> Hi
> This patch failed in PR - https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftianocore%2Fedk2%2Fpull%2F2076&data=04%7C01%7Cbrijesh.singh%40amd.com%7C20804cf7726f4528ee2608d9923950ba%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637701597143373879%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=S4RXWkQ5Hs4yr8FvEvKJSYGVPZS7mrBfvjRUKZFdsZ8%3D&reserved=0
>
> Please take a look.
>
> You are encouraged to try PR before submit next time.

I did ran PR before the submission and it all passed. The error this
link is reports have something to do with the python script used for
running the PR itself. I am not sure what I can do to fix it. Sounds
like a bug in the tool ?



>
> Thank you
> Yao Jiewen
>
>> -----Original Message-----
>> From: Yao, Jiewen
>> Sent: Monday, October 18, 2021 12:53 PM
>> To: devel@edk2.groups.io; brijesh.singh@amd.com
>> Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M <min.m.xu@intel.com>;
>> Tom Lendacky <thomas.lendacky@amd.com>; Justen, Jordan L
>> <jordan.l.justen@intel.com>; Ard Biesheuvel <ardb+tianocore@kernel.org>;
>> Erdem Aktas <erdemaktas@google.com>; Michael Roth
>> <Michael.Roth@amd.com>; Gerd Hoffmann <kraxel@redhat.com>
>> Subject: RE: [edk2-devel] [PATCH 0/2] work area fixes
>>
>> Series: Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
>>
>>> -----Original Message-----
>>> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Brijesh
>>> Singh via groups.io
>>> Sent: Friday, October 15, 2021 2:17 AM
>>> To: devel@edk2.groups.io
>>> Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M
>> <min.m.xu@intel.com>;
>>> Yao, Jiewen <jiewen.yao@intel.com>; Tom Lendacky
>>> <thomas.lendacky@amd.com>; Justen, Jordan L <jordan.l.justen@intel.com>;
>>> Ard Biesheuvel <ardb+tianocore@kernel.org>; Erdem Aktas
>>> <erdemaktas@google.com>; Michael Roth <Michael.Roth@amd.com>; Gerd
>>> Hoffmann <kraxel@redhat.com>; Brijesh Singh <brijesh.singh@amd.com>
>>> Subject: [edk2-devel] [PATCH 0/2] work area fixes
>>>
>>> We missed updating the AmdSev package and Ia32 buid to use new work area.
>>>
>>> Brijesh Singh (2):
>>>   Ovmfpkg: update Ia32 build to use new work area
>>>   OvmfPkg/AmdSev: update the fdf to use new workarea PCD
>>>
>>>  OvmfPkg/AmdSev/AmdSevX64.fdf          | 9 ++++++++-
>>>  OvmfPkg/OvmfPkgIa32X64.fdf            | 3 +++
>>>  OvmfPkg/ResetVector/ResetVector.nasmb | 3 ++-
>>>  3 files changed, 13 insertions(+), 2 deletions(-)
>>>
>>> --
>>> 2.25.1
>>>
>>>
>>>
>>> 
>>>

Re: [edk2-devel] [PATCH 0/2] work area fixes

[Yao, Jiewen]

That is weird. But I am not tool person.

HI Liming/Mike/Sean
Would you please take a look and help us understand what's happening?

Thank you
Yao Jiewen

> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Brijesh
> Singh via groups.io
> Sent: Monday, October 18, 2021 10:45 PM
> To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> Cc: brijesh.singh@amd.com; James Bottomley <jejb@linux.ibm.com>; Xu, Min M
> <min.m.xu@intel.com>; Tom Lendacky <thomas.lendacky@amd.com>; Justen,
> Jordan L <jordan.l.justen@intel.com>; Ard Biesheuvel
> <ardb+tianocore@kernel.org>; Erdem Aktas <erdemaktas@google.com>;
> Michael Roth <Michael.Roth@amd.com>; Gerd Hoffmann <kraxel@redhat.com>
> Subject: Re: [edk2-devel] [PATCH 0/2] work area fixes
> 
> 
> On 10/18/21 8:14 AM, Yao, Jiewen wrote:
> > Hi
> > This patch failed in PR -
> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.c
> om%2Ftianocore%2Fedk2%2Fpull%2F2076&amp;data=04%7C01%7Cbrijesh.sing
> h%40amd.com%7C20804cf7726f4528ee2608d9923950ba%7C3dd8961fe4884e6
> 08e11a82d994e183d%7C0%7C0%7C637701597143373879%7CUnknown%7CTW
> FpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI
> 6Mn0%3D%7C1000&amp;sdata=S4RXWkQ5Hs4yr8FvEvKJSYGVPZS7mrBfvjRUKZF
> dsZ8%3D&amp;reserved=0
> >
> > Please take a look.
> >
> > You are encouraged to try PR before submit next time.
> 
> I did ran PR before the submission and it all passed. The error this
> link is reports have something to do with the python script used for
> running the PR itself. I am not sure what I can do to fix it. Sounds
> like a bug in the tool ?
> 
> 
> 
> >
> > Thank you
> > Yao Jiewen
> >
> >> -----Original Message-----
> >> From: Yao, Jiewen
> >> Sent: Monday, October 18, 2021 12:53 PM
> >> To: devel@edk2.groups.io; brijesh.singh@amd.com
> >> Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M
> <min.m.xu@intel.com>;
> >> Tom Lendacky <thomas.lendacky@amd.com>; Justen, Jordan L
> >> <jordan.l.justen@intel.com>; Ard Biesheuvel <ardb+tianocore@kernel.org>;
> >> Erdem Aktas <erdemaktas@google.com>; Michael Roth
> >> <Michael.Roth@amd.com>; Gerd Hoffmann <kraxel@redhat.com>
> >> Subject: RE: [edk2-devel] [PATCH 0/2] work area fixes
> >>
> >> Series: Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
> >>
> >>> -----Original Message-----
> >>> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Brijesh
> >>> Singh via groups.io
> >>> Sent: Friday, October 15, 2021 2:17 AM
> >>> To: devel@edk2.groups.io
> >>> Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M
> >> <min.m.xu@intel.com>;
> >>> Yao, Jiewen <jiewen.yao@intel.com>; Tom Lendacky
> >>> <thomas.lendacky@amd.com>; Justen, Jordan L
> <jordan.l.justen@intel.com>;
> >>> Ard Biesheuvel <ardb+tianocore@kernel.org>; Erdem Aktas
> >>> <erdemaktas@google.com>; Michael Roth <Michael.Roth@amd.com>;
> Gerd
> >>> Hoffmann <kraxel@redhat.com>; Brijesh Singh <brijesh.singh@amd.com>
> >>> Subject: [edk2-devel] [PATCH 0/2] work area fixes
> >>>
> >>> We missed updating the AmdSev package and Ia32 buid to use new work
> area.
> >>>
> >>> Brijesh Singh (2):
> >>>   Ovmfpkg: update Ia32 build to use new work area
> >>>   OvmfPkg/AmdSev: update the fdf to use new workarea PCD
> >>>
> >>>  OvmfPkg/AmdSev/AmdSevX64.fdf          | 9 ++++++++-
> >>>  OvmfPkg/OvmfPkgIa32X64.fdf            | 3 +++
> >>>  OvmfPkg/ResetVector/ResetVector.nasmb | 3 ++-
> >>>  3 files changed, 13 insertions(+), 2 deletions(-)
> >>>
> >>> --
> >>> 2.25.1
> >>>
> >>>
> >>>
> >>>
> >>>
> 
> 
> 
> 

Re: [edk2-devel] [PATCH 0/2] work area fixes

[Min Xu]

Jiewen
I just create a new PR based on the latest commit (2108698346) for the patch-set of "work area fixes" and it seems all checks have passed. https://github.com/tianocore/edk2/pull/2078

I suspect the previous failure was caused by the un-stability of EDK2 CI system. Maybe you can create a new PR and try it again.

> -----Original Message-----
> From: Yao, Jiewen <jiewen.yao@intel.com>
> Sent: Monday, October 18, 2021 10:49 PM
> To: devel@edk2.groups.io; brijesh.singh@amd.com; Liming Gao
> <gaoliming@byosoft.com.cn>; Kinney, Michael D
> <michael.d.kinney@intel.com>; sean.brogan@microsoft.com
> Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M <min.m.xu@intel.com>;
> Tom Lendacky <thomas.lendacky@amd.com>; Justen, Jordan L
> <jordan.l.justen@intel.com>; Ard Biesheuvel <ardb+tianocore@kernel.org>;
> Erdem Aktas <erdemaktas@google.com>; Michael Roth
> <Michael.Roth@amd.com>; Gerd Hoffmann <kraxel@redhat.com>
> Subject: RE: [edk2-devel] [PATCH 0/2] work area fixes
> 
> That is weird. But I am not tool person.
> 
> HI Liming/Mike/Sean
> Would you please take a look and help us understand what's happening?
> 
> Thank you
> Yao Jiewen
> 
> > -----Original Message-----
> > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Brijesh
> > Singh via groups.io
> > Sent: Monday, October 18, 2021 10:45 PM
> > To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> > Cc: brijesh.singh@amd.com; James Bottomley <jejb@linux.ibm.com>; Xu,
> > Min M <min.m.xu@intel.com>; Tom Lendacky <thomas.lendacky@amd.com>;
> > Justen, Jordan L <jordan.l.justen@intel.com>; Ard Biesheuvel
> > <ardb+tianocore@kernel.org>; Erdem Aktas <erdemaktas@google.com>;
> > Michael Roth <Michael.Roth@amd.com>; Gerd Hoffmann
> <kraxel@redhat.com>
> > Subject: Re: [edk2-devel] [PATCH 0/2] work area fixes
> >
> >
> > On 10/18/21 8:14 AM, Yao, Jiewen wrote:
> > > Hi
> > > This patch failed in PR -
> > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgith
> > ub.c
> >
> om%2Ftianocore%2Fedk2%2Fpull%2F2076&amp;data=04%7C01%7Cbrijesh.sing
> >
> h%40amd.com%7C20804cf7726f4528ee2608d9923950ba%7C3dd8961fe4884e6
> >
> 08e11a82d994e183d%7C0%7C0%7C637701597143373879%7CUnknown%7CTW
> >
> FpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI
> >
> 6Mn0%3D%7C1000&amp;sdata=S4RXWkQ5Hs4yr8FvEvKJSYGVPZS7mrBfvjRUKZF
> > dsZ8%3D&amp;reserved=0
> > >
> > > Please take a look.
> > >
> > > You are encouraged to try PR before submit next time.
> >
> > I did ran PR before the submission and it all passed. The error this
> > link is reports have something to do with the python script used for
> > running the PR itself. I am not sure what I can do to fix it. Sounds
> > like a bug in the tool ?
> >
> >
> >
> > >
> > > Thank you
> > > Yao Jiewen
> > >
> > >> -----Original Message-----
> > >> From: Yao, Jiewen
> > >> Sent: Monday, October 18, 2021 12:53 PM
> > >> To: devel@edk2.groups.io; brijesh.singh@amd.com
> > >> Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M
> > <min.m.xu@intel.com>;
> > >> Tom Lendacky <thomas.lendacky@amd.com>; Justen, Jordan L
> > >> <jordan.l.justen@intel.com>; Ard Biesheuvel
> > >> <ardb+tianocore@kernel.org>; Erdem Aktas <erdemaktas@google.com>;
> > >> Michael Roth <Michael.Roth@amd.com>; Gerd Hoffmann
> > >> <kraxel@redhat.com>
> > >> Subject: RE: [edk2-devel] [PATCH 0/2] work area fixes
> > >>
> > >> Series: Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
> > >>
> > >>> -----Original Message-----
> > >>> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> > >>> Brijesh Singh via groups.io
> > >>> Sent: Friday, October 15, 2021 2:17 AM
> > >>> To: devel@edk2.groups.io
> > >>> Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M
> > >> <min.m.xu@intel.com>;
> > >>> Yao, Jiewen <jiewen.yao@intel.com>; Tom Lendacky
> > >>> <thomas.lendacky@amd.com>; Justen, Jordan L
> > <jordan.l.justen@intel.com>;
> > >>> Ard Biesheuvel <ardb+tianocore@kernel.org>; Erdem Aktas
> > >>> <erdemaktas@google.com>; Michael Roth <Michael.Roth@amd.com>;
> > Gerd
> > >>> Hoffmann <kraxel@redhat.com>; Brijesh Singh
> > >>> <brijesh.singh@amd.com>
> > >>> Subject: [edk2-devel] [PATCH 0/2] work area fixes
> > >>>
> > >>> We missed updating the AmdSev package and Ia32 buid to use new
> > >>> work
> > area.
> > >>>
> > >>> Brijesh Singh (2):
> > >>>   Ovmfpkg: update Ia32 build to use new work area
> > >>>   OvmfPkg/AmdSev: update the fdf to use new workarea PCD
> > >>>
> > >>>  OvmfPkg/AmdSev/AmdSevX64.fdf          | 9 ++++++++-
> > >>>  OvmfPkg/OvmfPkgIa32X64.fdf            | 3 +++
> > >>>  OvmfPkg/ResetVector/ResetVector.nasmb | 3 ++-
> > >>>  3 files changed, 13 insertions(+), 2 deletions(-)
> > >>>
> > >>> --
> > >>> 2.25.1
> > >>>
> > >>>
> > >>>
> > >>>
> > >>>
> >
> >
> > 
> >

Re: [edk2-devel] [PATCH 0/2] work area fixes

[Yao, Jiewen]

Yes, I tried again today. It works.

https://github.com/tianocore/edk2/pull/2080

Pushed:
36b561623a4b8a6c7fea0b1b01f6789f2adf97e0.. 11a4af85a438b5b3d8cde942a209908219c57363

Thank you
Yao Jiewen

> -----Original Message-----
> From: Xu, Min M <min.m.xu@intel.com>
> Sent: Tuesday, October 19, 2021 8:22 AM
> To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io;
> brijesh.singh@amd.com; Liming Gao <gaoliming@byosoft.com.cn>; Kinney,
> Michael D <michael.d.kinney@intel.com>; sean.brogan@microsoft.com
> Cc: James Bottomley <jejb@linux.ibm.com>; Tom Lendacky
> <thomas.lendacky@amd.com>; Justen, Jordan L <jordan.l.justen@intel.com>;
> Ard Biesheuvel <ardb+tianocore@kernel.org>; Erdem Aktas
> <erdemaktas@google.com>; Michael Roth <Michael.Roth@amd.com>; Gerd
> Hoffmann <kraxel@redhat.com>
> Subject: RE: [edk2-devel] [PATCH 0/2] work area fixes
> 
> Jiewen
> I just create a new PR based on the latest commit (2108698346) for the patch-
> set of "work area fixes" and it seems all checks have passed.
> https://github.com/tianocore/edk2/pull/2078
> 
> I suspect the previous failure was caused by the un-stability of EDK2 CI system.
> Maybe you can create a new PR and try it again.
> 
> > -----Original Message-----
> > From: Yao, Jiewen <jiewen.yao@intel.com>
> > Sent: Monday, October 18, 2021 10:49 PM
> > To: devel@edk2.groups.io; brijesh.singh@amd.com; Liming Gao
> > <gaoliming@byosoft.com.cn>; Kinney, Michael D
> > <michael.d.kinney@intel.com>; sean.brogan@microsoft.com
> > Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M
> <min.m.xu@intel.com>;
> > Tom Lendacky <thomas.lendacky@amd.com>; Justen, Jordan L
> > <jordan.l.justen@intel.com>; Ard Biesheuvel <ardb+tianocore@kernel.org>;
> > Erdem Aktas <erdemaktas@google.com>; Michael Roth
> > <Michael.Roth@amd.com>; Gerd Hoffmann <kraxel@redhat.com>
> > Subject: RE: [edk2-devel] [PATCH 0/2] work area fixes
> >
> > That is weird. But I am not tool person.
> >
> > HI Liming/Mike/Sean
> > Would you please take a look and help us understand what's happening?
> >
> > Thank you
> > Yao Jiewen
> >
> > > -----Original Message-----
> > > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Brijesh
> > > Singh via groups.io
> > > Sent: Monday, October 18, 2021 10:45 PM
> > > To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> > > Cc: brijesh.singh@amd.com; James Bottomley <jejb@linux.ibm.com>; Xu,
> > > Min M <min.m.xu@intel.com>; Tom Lendacky
> <thomas.lendacky@amd.com>;
> > > Justen, Jordan L <jordan.l.justen@intel.com>; Ard Biesheuvel
> > > <ardb+tianocore@kernel.org>; Erdem Aktas <erdemaktas@google.com>;
> > > Michael Roth <Michael.Roth@amd.com>; Gerd Hoffmann
> > <kraxel@redhat.com>
> > > Subject: Re: [edk2-devel] [PATCH 0/2] work area fixes
> > >
> > >
> > > On 10/18/21 8:14 AM, Yao, Jiewen wrote:
> > > > Hi
> > > > This patch failed in PR -
> > > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgith
> > > ub.c
> > >
> >
> om%2Ftianocore%2Fedk2%2Fpull%2F2076&amp;data=04%7C01%7Cbrijesh.sing
> > >
> >
> h%40amd.com%7C20804cf7726f4528ee2608d9923950ba%7C3dd8961fe4884e6
> > >
> >
> 08e11a82d994e183d%7C0%7C0%7C637701597143373879%7CUnknown%7CTW
> > >
> >
> FpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI
> > >
> >
> 6Mn0%3D%7C1000&amp;sdata=S4RXWkQ5Hs4yr8FvEvKJSYGVPZS7mrBfvjRUKZF
> > > dsZ8%3D&amp;reserved=0
> > > >
> > > > Please take a look.
> > > >
> > > > You are encouraged to try PR before submit next time.
> > >
> > > I did ran PR before the submission and it all passed. The error this
> > > link is reports have something to do with the python script used for
> > > running the PR itself. I am not sure what I can do to fix it. Sounds
> > > like a bug in the tool ?
> > >
> > >
> > >
> > > >
> > > > Thank you
> > > > Yao Jiewen
> > > >
> > > >> -----Original Message-----
> > > >> From: Yao, Jiewen
> > > >> Sent: Monday, October 18, 2021 12:53 PM
> > > >> To: devel@edk2.groups.io; brijesh.singh@amd.com
> > > >> Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M
> > > <min.m.xu@intel.com>;
> > > >> Tom Lendacky <thomas.lendacky@amd.com>; Justen, Jordan L
> > > >> <jordan.l.justen@intel.com>; Ard Biesheuvel
> > > >> <ardb+tianocore@kernel.org>; Erdem Aktas <erdemaktas@google.com>;
> > > >> Michael Roth <Michael.Roth@amd.com>; Gerd Hoffmann
> > > >> <kraxel@redhat.com>
> > > >> Subject: RE: [edk2-devel] [PATCH 0/2] work area fixes
> > > >>
> > > >> Series: Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
> > > >>
> > > >>> -----Original Message-----
> > > >>> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> > > >>> Brijesh Singh via groups.io
> > > >>> Sent: Friday, October 15, 2021 2:17 AM
> > > >>> To: devel@edk2.groups.io
> > > >>> Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M
> > > >> <min.m.xu@intel.com>;
> > > >>> Yao, Jiewen <jiewen.yao@intel.com>; Tom Lendacky
> > > >>> <thomas.lendacky@amd.com>; Justen, Jordan L
> > > <jordan.l.justen@intel.com>;
> > > >>> Ard Biesheuvel <ardb+tianocore@kernel.org>; Erdem Aktas
> > > >>> <erdemaktas@google.com>; Michael Roth <Michael.Roth@amd.com>;
> > > Gerd
> > > >>> Hoffmann <kraxel@redhat.com>; Brijesh Singh
> > > >>> <brijesh.singh@amd.com>
> > > >>> Subject: [edk2-devel] [PATCH 0/2] work area fixes
> > > >>>
> > > >>> We missed updating the AmdSev package and Ia32 buid to use new
> > > >>> work
> > > area.
> > > >>>
> > > >>> Brijesh Singh (2):
> > > >>>   Ovmfpkg: update Ia32 build to use new work area
> > > >>>   OvmfPkg/AmdSev: update the fdf to use new workarea PCD
> > > >>>
> > > >>>  OvmfPkg/AmdSev/AmdSevX64.fdf          | 9 ++++++++-
> > > >>>  OvmfPkg/OvmfPkgIa32X64.fdf            | 3 +++
> > > >>>  OvmfPkg/ResetVector/ResetVector.nasmb | 3 ++-
> > > >>>  3 files changed, 13 insertions(+), 2 deletions(-)
> > > >>>
> > > >>> --
> > > >>> 2.25.1
> > > >>>
> > > >>>
> > > >>>
> > > >>>
> > > >>>
> > >
> > >
> > > 
> > >