From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM02-SN1-obe.outbound.protection.outlook.com (NAM02-SN1-obe.outbound.protection.outlook.com [40.107.96.45]) by mx.groups.io with SMTP id smtpd.web11.19004.1627907615937459561 for ; Mon, 02 Aug 2021 05:33:36 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@amd.com header.s=selector1 header.b=ukEfW4ob; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.96.45, mailfrom: ashish.kalra@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TF78S/jSJrHGOGsiEny06hFDGJYyDeSjdyC0bk+nH9ElCzNO5ooxdmjosrqYwpoqm5L8lTGZtzH/2ee5T4qSfy8qy9gp/i7Un7iEJFS1uhgDDxTzD7+kPgtp3L7IaOEhG6UwxcZe1kkWfH+9hhhXBWclKj93WrYbizjGCNgfxQinUrLJjwIMrP/QUEeFd1mJLsay+U2CnjO8As1zvSSFgz9F+w+Chw3d7Dyfko+cSfowZvthuuFXMDytH2yOHFyJOffpLMIR1HmmptPvMPnYdh7rFZ7YNwuj2cfdWgbkX2s2LD076hEBuCLIE8/IOX1y5KJ+42usBT+YZPuh78iLzA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3ujnQP7nOpAaYajA2Z5enJS9rxeNEVCiUMMQvFnOCa0=; b=j7nE7vceyG08NI27mDqkn1PL8mwesg7+xHoPkUVGTSV/fja8w7GbUKXXVSBAvSJ/MUjQ5Mqdp4Qnnw1ZmU0fGjN36t67uBaK6GtewVY6TmT3cY5MnLMfJ8l1lhl+O7JIT/i5Z9ggg69lBeXAsaBSCBzXsW1Dgg0aq8Z0RP+WT2FPF3wxRAwAg6EzHrFRah2QOsmw++OwrYX7R9iaLsp8l3Y920PJ6N5Mzd9ze8lswbaWu/OBd50RkoyjcvSWkgSUefKyb3jbyZesDyZ+DpgQ81vJfGP/Dhzlijx1zFwBVISgD8YrxZidteKDi0HvXAsig7alx64jtB3Vmt+ResQApA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3ujnQP7nOpAaYajA2Z5enJS9rxeNEVCiUMMQvFnOCa0=; b=ukEfW4obVHDiW8mT8RmvNgOimGFWlxISsh8X6K2ACAH6p2bLduIvCz6yPfB5hl0Vo96GVDDv26g2zNFxS91T/TXbfqRBQmehPD6R3/opKao4U+gOm+p4V6XQj1g48EiwdJO7EFs5dycNMCjIsI2YeABC3y6NL1pEqauD10SAXgU= Authentication-Results: edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) by SN1PR12MB2445.namprd12.prod.outlook.com (2603:10b6:802:31::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4352.25; Mon, 2 Aug 2021 12:33:32 +0000 Received: from SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::491e:2642:bae2:8b73]) by SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::491e:2642:bae2:8b73%7]) with mapi id 15.20.4373.026; Mon, 2 Aug 2021 12:33:32 +0000 From: "Ashish Kalra" To: devel@edk2.groups.io Cc: dovmurik@linux.vnet.ibm.com, brijesh.singh@amd.com, tobin@ibm.com, Thomas.Lendacky@amd.com, jejb@linux.ibm.com, jordan.l.justen@intel.com, ard.biesheuvel@arm.com, erdemaktas@google.com, jiewen.yao@intel.com, min.m.xu@intel.com Subject: [PATCH v6 6/6] OvmfPkg/AmdSevDxe: Add support for SEV live migration. Date: Mon, 2 Aug 2021 12:33:21 +0000 Message-Id: X-Mailer: git-send-email 2.17.1 In-Reply-To: References: X-ClientProxiedBy: SA0PR11CA0047.namprd11.prod.outlook.com (2603:10b6:806:d0::22) To SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) Return-Path: Ashish.Kalra@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from ashkalra_ubuntu_server.amd.com (165.204.77.1) by SA0PR11CA0047.namprd11.prod.outlook.com (2603:10b6:806:d0::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.18 via Frontend Transport; Mon, 2 Aug 2021 12:33:32 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 1cf800a9-aa9e-4ce0-27cc-08d955b1bd52 X-MS-TrafficTypeDiagnostic: SN1PR12MB2445: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: KNicmTSnizX/MhukegKgC2R3NJM1CxcuqzVZ7D0pwLajSX4Ee+ooVz63rhYlSu2x+SrXHqXXF6RHbUPRnD3hfFCZifA6RSKQNmdiF9cd0hpk1q81R5TDXUHjVBSe9J4575iwh5iKP0i5ghh/Z/8P6OqSGQ/XiYlEEzMij4bAnpNvkBfuHxku93Zv73U5QM3yq+PjXXs0inwBathtHYWSf0gg3FrXct0Epqk3eBlwc8YzGpKsxbSj+ShyBPgdd8EBRKMeEPj13H9z0Je70g81hNZNe8tiSE6WcuSSwHtw0OPtnBBF3bAVfZvCHZMzQD6uedhAMyIUJR2/gXKZuMN1SKahwZfLxD1bxh8VzVXu5I1UxKRjGhSHsLfFKCvhXcsbby4I3KePucxh6GzM3X8Ec0qrlET2xr5DWlSdcC/zw5BgKu0EBnS2HQ70TRiKbgg4OkVDpyRETsBmolLtcwQFQqcuHbHvIWC6N2sT+s605tVv69hcZyakr7p6Rbovm1Zr59Gb9vin+2WoImiNSlfOVSgORx02FErCeB0MEmbEIijEwMS/LVh4NwaqFf3GTrBIFTYNbecxPnwOHfkan+qTXQIBSP7I8DLoIGUkk8PyGDD2gYWv3AIDciMzdMWN/KEqRbTrK7WH5N8QO9eQsdD6qzjUE7AIMd3NPvzrsDg8IYvpK3J9GDTDSYJTUi9tnnTIP5arzzKbfmXpGR2xsPYPSg== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2767.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(136003)(396003)(376002)(366004)(39860400002)(346002)(956004)(6916009)(5660300002)(4326008)(316002)(7696005)(66946007)(66556008)(66476007)(6486002)(8676002)(478600001)(36756003)(86362001)(52116002)(8936002)(38100700002)(6666004)(83380400001)(38350700002)(2906002)(2616005)(186003)(26005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?NsT69ST/1MBISAW6M8FXtdlKlw0uSx7O8Ok1gwUQqUHSuREVTJLgo30S/Kep?= =?us-ascii?Q?q+pklNxPZ23W4hhwhDjpPJ9DZZJzGsG9fuMVv+YxCDCSqlAKQAjrJaVriD79?= =?us-ascii?Q?HIK1ONGQeXgetXb+4sZs/5xzPxvsZEXZKjnoJ0JUgZADlkIbHEh98MEmOFkV?= =?us-ascii?Q?/z+svllCQQMAMoNXbOgB32x666jcgLvNl4xiPV3lgmO3oVzfYBQEWu9mU/Iz?= =?us-ascii?Q?mphLuqjFLEmEtwI4AhNgHT0729seY4shfLo/zbj+6hoTP09ESYJ4inMXT7kn?= =?us-ascii?Q?SV6CI4vz8JDnKh0nAwmCpV7w1a89E5Ft3OefuQsQ5RJ89VX9ppNpHWpAjJ/i?= =?us-ascii?Q?1Y1p/v0hO66xMMkFXSZgcAi6QtbA7TusOG7ZP7M1V7sdlgUcSprbM1hHOk8x?= =?us-ascii?Q?jTsO8/54YkMfjqUZ4C7oZeZI2hGB355uWUYLtAIu/rmEh0vf46sLZRye120K?= =?us-ascii?Q?yiYQUUAEjTnXaFVOxQdv5FVsOFmdUUmUDpbRgn+xNbDp7Xl5N0youT+1WRFN?= =?us-ascii?Q?MNHwbh9FuJXrJeW/k19h2AFcjSliHWFTewFHEDUyuV0J9frMXkjcTo6/A5i5?= =?us-ascii?Q?TTDuMaf4j34BSGv5EK7Ng8afRdr2cEo1H+w1+HbbDklgnUCK2sdfj9loLvN4?= =?us-ascii?Q?8T4iRhRqb/fROzuqiqHSw8K/AiyCWs+4/SdqLB7dVhTSQna2CCQm11FgCxqL?= =?us-ascii?Q?czDZGCIp4xggIyS0lbCz1lSyeu7T3wpGqj/H+qXKDUaspaHNVoSWZS6bTYLq?= =?us-ascii?Q?1TUoA7kq7Hwjrs22ikKPMLbYipYNNZDHxRBs1EJUqbU3FB9cJcWJ2icGeD5k?= =?us-ascii?Q?rGlm/4Ai3tFTpo14hoXU2rQeMVPk+iN8fsewxbRyVZ2Ncp8z8sX8xFPjmZO/?= =?us-ascii?Q?hjSBxO0jBN8bP4+U39tO9bPQe16/k9j49d5EXQrkOlNVlf5qB9h8o0qTSuRM?= =?us-ascii?Q?1l554EK1+tdcLN1S+E8fMAvZTRDe1QuqghTVUjaYjaXofGhMFxyXg2Aqsp9S?= =?us-ascii?Q?HByINRV9yHmpCu3AF8NRs2vV7PP9KKa3eu0RW4/vq9JJTRegtQrhuRHnkC91?= =?us-ascii?Q?zf0BIkyCculOZf+bS+y1uJtbRywIelOI2BWOABlGQXeTltKQEmvXl9yqzhy+?= =?us-ascii?Q?5mJ+X0BT+L8ReYxvJ9zXGqihWMUs0Ns3QdVlskh8z97eB+Z2PMBCmy/X7197?= =?us-ascii?Q?1B1Lt7U3/qGscLoGZGx7ulGhkpdZINPA+cDRxs8O79Axv2doNxYVKsyZcBi2?= =?us-ascii?Q?Wuwf1ZKr75N89EoG1JYEF22OQUb6XHMytU4pycZafh9oD/4LqKy/3u0v2mkx?= =?us-ascii?Q?ZTw/gifX7hSHSLRAORt0F7FS?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1cf800a9-aa9e-4ce0-27cc-08d955b1bd52 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2767.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Aug 2021 12:33:32.4455 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: /jKjqHiMwC4qOF2cuS6647Xz1T2KZnUD2+jai1LbbpRukMSZG7ftmzl/hXEljUMdSSmNYe2kMEh9NQuQDFlXVg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB2445 Content-Type: text/plain From: Ashish Kalra Check for SEV live migration feature support, if detected setup a new UEFI enviroment variable to indicate OVMF support for SEV live migration. The new runtime UEFI environment variable is set via the notification function registered for the EFI_END_OF_DXE_EVENT_GROUP_GUID event in AmdSevDxe driver. AmdSevDxe module is an apriori driver so it gets loaded between PEI and DXE phases and the SetVariable call will fail at the driver's entry point as the Variable DXE module is still not loaded yet. So we need to wait for an event notification which is signaled after the Variable DXE module is loaded, hence, using the EndOfDxe event notification to make this call. Signed-off-by: Ashish Kalra --- OvmfPkg/AmdSevDxe/AmdSevDxe.c | 64 ++++++++++++++++++++ OvmfPkg/AmdSevDxe/AmdSevDxe.inf | 4 ++ OvmfPkg/Include/Guid/AmdSevMemEncryptLib.h | 20 ++++++ OvmfPkg/OvmfPkg.dec | 1 + 4 files changed, 89 insertions(+) diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.c b/OvmfPkg/AmdSevDxe/AmdSevDxe.c index c66c4e9b92..bfad71b9c6 100644 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.c +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.c @@ -15,10 +15,47 @@ #include #include #include +#include +#include #include #include +#include +#include #include +STATIC +VOID +EFIAPI +AmdSevDxeOnEndOfDxe ( + IN EFI_EVENT Event, + IN VOID *EventToSignal + ) +{ + EFI_STATUS Status; + BOOLEAN SevLiveMigrationEnabled; + + SevLiveMigrationEnabled = MemEncryptSevLiveMigrationIsEnabled(); + + if (SevLiveMigrationEnabled) { + Status = gRT->SetVariable ( + L"SevLiveMigrationEnabled", + &gAmdSevMemEncryptGuid, + EFI_VARIABLE_NON_VOLATILE | + EFI_VARIABLE_BOOTSERVICE_ACCESS | + EFI_VARIABLE_RUNTIME_ACCESS, + sizeof SevLiveMigrationEnabled, + &SevLiveMigrationEnabled + ); + + DEBUG (( + DEBUG_INFO, + "%a: Setting SevLiveMigrationEnabled variable, status = %lx\n", + __FUNCTION__, + Status + )); + } +} + EFI_STATUS EFIAPI AmdSevDxeEntryPoint ( @@ -30,6 +67,7 @@ AmdSevDxeEntryPoint ( EFI_GCD_MEMORY_SPACE_DESCRIPTOR *AllDescMap; UINTN NumEntries; UINTN Index; + EFI_EVENT Event; // // Do nothing when SEV is not enabled @@ -130,5 +168,31 @@ AmdSevDxeEntryPoint ( } } + // + // AmdSevDxe module is an apriori driver so it gets loaded between PEI + // and DXE phases and the SetVariable call will fail at the driver's + // entry point as the Variable DXE module is still not loaded yet. + // So we need to wait for an event notification which is signaled + // after the Variable DXE module is loaded, hence, using the + // EndOfDxe event notification to make this call. + // + // Register EFI_END_OF_DXE_EVENT_GROUP_GUID event. + // The notification function sets the runtime variable indicating OVMF + // support for SEV live migration. + // + Status = gBS->CreateEventEx ( + EVT_NOTIFY_SIGNAL, + TPL_CALLBACK, + AmdSevDxeOnEndOfDxe, + NULL, + &gEfiEndOfDxeEventGroupGuid, + &Event + ); + + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_INFO, "%a: CreateEventEx(): %r\n", + __FUNCTION__, Status)); + } + return EFI_SUCCESS; } diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf b/OvmfPkg/AmdSevDxe/AmdSevDxe.inf index 0676fcc5b6..2ad1fb8632 100644 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.inf @@ -45,3 +45,7 @@ [Pcd] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfHostBridgePciDevId + +[Guids] + gAmdSevMemEncryptGuid + gEfiEndOfDxeEventGroupGuid ## CONSUMES ## Event diff --git a/OvmfPkg/Include/Guid/AmdSevMemEncryptLib.h b/OvmfPkg/Include/Guid/AmdSevMemEncryptLib.h new file mode 100644 index 0000000000..8ab283860b --- /dev/null +++ b/OvmfPkg/Include/Guid/AmdSevMemEncryptLib.h @@ -0,0 +1,20 @@ +/** @file + + AMD Memory Encryption GUID, define a new GUID for defining + new UEFI environment variables assocaiated with SEV Memory Encryption. + + Copyright (c) 2021, AMD Inc. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef __AMD_SEV_MEMENCRYPT_LIB_H__ +#define __AMD_SEV_MEMENCRYPT_LIB_H__ + +#define AMD_SEV_MEMENCRYPT_GUID \ +{0x0cf29b71, 0x9e51, 0x433a, {0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8, 0x75}} + +extern EFI_GUID gAmdSevMemEncryptGuid; + +#endif diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index 2ab27f0c73..3978852557 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -125,6 +125,7 @@ gQemuKernelLoaderFsMediaGuid = {0x1428f772, 0xb64a, 0x441e, {0xb8, 0xc3, 0x9e, 0xbd, 0xd7, 0xf8, 0x93, 0xc7}} gGrubFileGuid = {0xb5ae312c, 0xbc8a, 0x43b1, {0x9c, 0x62, 0xeb, 0xb8, 0x26, 0xdd, 0x5d, 0x07}} gConfidentialComputingSecretGuid = {0xadf956ad, 0xe98c, 0x484c, {0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47}} + gAmdSevMemEncryptGuid = {0x0cf29b71, 0x9e51, 0x433a, {0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8, 0x75}} [Ppis] # PPI whose presence in the PPI database signals that the TPM base address -- 2.17.1