From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM02-BL2-obe.outbound.protection.outlook.com (NAM02-BL2-obe.outbound.protection.outlook.com [40.107.75.75]) by mx.groups.io with SMTP id smtpd.web09.7717.1618313360366999267 for ; Tue, 13 Apr 2021 04:29:20 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="body hash did not verify" header.i=@amd.com header.s=selector1 header.b=2bCtI0r8; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.75.75, mailfrom: brijesh.singh@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Yw3LLFq54rKFal10Z/BE9fuWQTS0/NnX8w8P0WPzwUhicnnGluzsZYLVCraiNucRa9UjTyzn+AfETaR5FdMsD+hnRYdf63f8Rn7KV2VK8Dw81uRyWJ2uLu03VWepDlPlvhHh+e4VjyMyB7EXnDOFLqDctyYuwRFTvV97W3RTrKeMNQM9PS3gFc1F8FGdRcd0EzhYx+yXAdCz4iv4j7+XWFrhO2HfyM5X/eNRRjwlda0F3H4j2X8KfEHPzkOHMcoRPwKcKVEea0mdjjuTeH5gWH+JEUonpoYA/EePls7FfjUYHlLeIL/Mt61j5xUe8d6bCHFtU+kJaFAnuNFzJH7ZTQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=I7TqXYywYHUhZAsyWcCauMt4zGOZ9UkzfYrFsfv8nbM=; b=j+7RLPeiJX36QypUhh1xtS/bHLUmtbL76YPLDheHqQhZljSQ2dP+hd1CC5WjzVRAAdM/GVvumgkrH0XmwBdkUL6dwEPOMrkHf0oRA0EdVz2ispudplEC4aOod/PmeqrYJecEUTIZHYx7oD9YHjJrwmsAAhZW4I6Pm52SnjZic8dfwlrVCfa/5B3xXZil889CsAdG1AKUQknAPe1XDrXcL80AFQxfH4/pUIkEJm7a88O00hjF05QhkWRjF2LjxjeL47ohnbXXdub1fTd9MKYjJwQEdaPsKXPsWEJVUDbnHjLYGA+lNdMQFatny7EwNtaTEVqZxjYLUlRPPYdLsUCc8w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=I7TqXYywYHUhZAsyWcCauMt4zGOZ9UkzfYrFsfv8nbM=; b=2bCtI0r8gnSMUeHs6ji84BERGNNnGcy1My88bvgDofi52ESHcD70vXpfRo5AkvXRgAHjUHuVpDHXlMEBY1GveGfGpaDikpZ+vfrv4Lh4fn+3b7Aaoi83Jbf7I/xWZRIj9W4c7tux5/xMlA1z3rKc7x0HbR52fW1eo5Fo7dz2Ulc= Authentication-Results: kernel.org; dkim=none (message not signed) header.d=none;kernel.org; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SN1PR12MB2511.namprd12.prod.outlook.com (2603:10b6:802:23::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4020.22; Tue, 13 Apr 2021 11:29:18 +0000 Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::9898:5b48:a062:db94]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::9898:5b48:a062:db94%6]) with mapi id 15.20.4020.022; Tue, 13 Apr 2021 11:29:17 +0000 CC: brijesh.singh@amd.com, James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel Subject: Re: [RFC PATCH 01/19] OvmfPkg: Reserve the Secrets and Cpuid page for the SEV-SNP guest To: Laszlo Ersek , devel@edk2.groups.io References: <20210324153215.17971-1-brijesh.singh@amd.com> <20210324153215.17971-2-brijesh.singh@amd.com> <6bfc9b77-57ae-02ea-5be1-eeb15eab446b@amd.com> <778bc927-94b0-56cb-708b-612d2498dc4b@redhat.com> From: "Brijesh Singh" Message-ID: Date: Tue, 13 Apr 2021 06:29:14 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.9.0 In-Reply-To: <778bc927-94b0-56cb-708b-612d2498dc4b@redhat.com> X-Originating-IP: [165.204.77.11] X-ClientProxiedBy: SA0PR12CA0015.namprd12.prod.outlook.com (2603:10b6:806:6f::20) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) Return-Path: brijesh.singh@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from Brijeshs-MacBook-Pro.local (165.204.77.11) by SA0PR12CA0015.namprd12.prod.outlook.com (2603:10b6:806:6f::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4020.17 via Frontend Transport; Tue, 13 Apr 2021 11:29:16 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 90e48c6f-954f-41e6-f6f0-08d8fe6f5fca X-MS-TrafficTypeDiagnostic: SN1PR12MB2511: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8273; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: eJdOswlV/nvvrYRNJOOfmy88Xuv53FLel7X0gUlNyGGi39Nf+NHp6Y8toBC/06nzpltfBLfzqSoLRtZkqc+5cFnpCKhLpw8VTxAYo/bOaKFEQTZEcEa02g0JspcIvt6JUcF2NZx4gEBRqskYMofF7l+6dmFBu1SlgdsBy43z6Rv3RWJ2Bm+9/esdZkd5ZnH3iz31mMhC7Yz/Kntn26eWcFe9RrFO9EUwxmnTd9/FJswg3UonaqsqhNdZjeo5yELtw1r1TXlaMv2/vYck+NKzoOXKy/6l7iOczs+4LlRc9uU3ew+nuLgEwQ5Jr1+fcff/jF6GLMoJhWFLzMMc4wFMs7dVktZwy50zr9xbS+da7B0nfo3JSLVAByEid7K4Bpgw/hwTvy7X3YCKwLXazjchrKqvxez/zQSKAy7foAPJ30zqWGAGQyJhcV8x53jRUDs6fK3jLqopBgzljLH45OgaLRv99DfWRWV3dvLYnhUMMt2ZTRh8xtvcJevGfJVPyy5X6wmYKQG+GKR2ht6/3Kn1uVjOHjqSqutCqwBIoUTHvNa9SHOxiu1xr7dmfKNM6jtu28bgoDKxpjUnFxQKlgREZijOGCDJr5VcIjfRLZcJSzqlp7JXdZ/T11pRdGwB2DVFwpqzwIBlYNMknKYmy/Xx3/3G73kleJKTRdn2Tk9ox3DsYM2UiwsnScT0aa+z2aymGed67O9MAbGHqYGE4J4aX1aZXdH/n/n6RnvCl3xWq3JYkI3uoUJfH7cCb/mOwl2N7Lu1/Ezf95ahpj0AQpceC3GHyDiqjePTfcuYDw+TJ8msggWWtgknORUtCS1yldPt X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2718.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(136003)(376002)(366004)(39860400002)(346002)(396003)(45080400002)(316002)(54906003)(38350700002)(83380400001)(2906002)(36756003)(478600001)(86362001)(44832011)(31686004)(53546011)(5660300002)(66476007)(26005)(956004)(66946007)(8936002)(2616005)(4326008)(66556008)(16526019)(38100700002)(6486002)(6512007)(52116002)(8676002)(19627235002)(186003)(966005)(6506007)(31696002)(45980500001)(43740500002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: =?us-ascii?Q?P85Dpmr6dTDzadW5QreEEUXcTevlnghPRlpuv6yFdue6TNqP80BOa/dXp8hg?= =?us-ascii?Q?9AekCgfVd9ZuSAvNBAZW6FUs72oL48SMb4kE2aQQNZq8Zbb8Jdc5oPxcXF0M?= =?us-ascii?Q?e/KyEtgOJLSq0NgZvOpqIkqsJywul/xZB//qOQMQ5GUXODVgCIkarwcglfbX?= =?us-ascii?Q?cdSKhefyZlcbbo48l1wXiW/aEe1hyWJr2uFbxX1XlVx2AnxXi9IIkg1G3Ddo?= =?us-ascii?Q?oSLz7j+9kow2nXEhLCTgZnDBgb6RcAXIvpY6UxN6XGOqtbR9+V8NntrkFKvv?= =?us-ascii?Q?SlqLksCs6LTWDEmuhtcPchlu0zU8629QRWocifCq6UOrNTPmQlpX1YgQz++F?= =?us-ascii?Q?4HsoovlelDhm+Bw8a8aPO+YHKYv3RqdgVoFMou5A5f7M19+EWfr1U+X7LjWh?= =?us-ascii?Q?IGbqgKs2gShsLjyyNF6w9U4A1QrandaXeuFTygSX+gpLWxAjjZg1kIERdW0O?= =?us-ascii?Q?I/HCSb4z6ea3gLvSTNbxCE+i6B2NY0yNTSvgKiEtfXa+Eypn/yDA5Y6oZJs/?= =?us-ascii?Q?QHlsf+IPYdn6WDGm3+yI1XjQ/t7EsWPLTVgtElYvVJFqGBKI2Fe4TXhIsaGv?= =?us-ascii?Q?JkJInjkVIue8Bo6YWjncFheYUW7YmXXvdl0cDOuj1T4wf0lFK0j/YKTleMkn?= =?us-ascii?Q?k1frpmsmfdh6I+6cduHj4b9i67kK6mtgu4HdTgiwGUbrttZQdAHMQPrc6AAg?= =?us-ascii?Q?cLtw5yBb5ApaA151mrzG/U6xK39641pIQYWmocI2Ojq8589TS+lct06qOFMg?= =?us-ascii?Q?4CVYlXI2jpc9Ho8A9OMOTm1X6E6PvmCqx9nhd6V50Yx6xc/ZJrFDT5xYqwfl?= =?us-ascii?Q?9/7uc5rkbBnMSBW05ZLTrRyL8JYA6b9G0uZ75PKkJoXAnQHCvX6u7Q2ARe6f?= =?us-ascii?Q?Xyxj2/JklRm00+BuwC6dczBWzWHa7JyMinr65l8EKIoWWyMYhmZSMuo6ydGH?= =?us-ascii?Q?zrC+aaiqaEqDTEqdSru2YRPytWwJcGmHaBeL5N+BOEG0Ro7IbqCHXq3VMmPB?= =?us-ascii?Q?EjI0P6Ms55GjY9q3rU5chQpKLeqZ3s33fi4LnpXfUFPjTDszKQ0fT+M3DA62?= =?us-ascii?Q?Z3XHx9QldF8K7FJJ5iROJOJFM5b0uxaMBeo/LO8WlG8DT9lImAAoiBiCE+4E?= =?us-ascii?Q?t5XzPBC0+VsbjyIt/Ztc8uaFct8cM+mpjG7fH55pw02yPUoeX52rKGbNcWsn?= =?us-ascii?Q?8HIt7RUG8M9Ia1ELu9nEDy7mMbaBDWHUap10ChNzS3BYdmptB2x2Ktor2sCk?= =?us-ascii?Q?qp2g4uwjtjEZQUBuz5Rpirb1cK9Tn0xg5pUWB+dBvCYN36+W5s7Nt/czW5Pn?= =?us-ascii?Q?zuunZR32mEa7+pktzjjFWcyK?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 90e48c6f-954f-41e6-f6f0-08d8fe6f5fca X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Apr 2021 11:29:17.5976 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: gWSVhmWU3uP24hQ0B1UlD+0vT3Gw6l2x8FjMa0Q1XS/ewoqxuvrSc5JUztjQcE38I8r73bavWBcqk+LdVK+xng== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB2511 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US On 4/13/21 4:49 AM, Laszlo Ersek wrote: > On 04/12/21 16:52, Brijesh Singh wrote: >> Hi James and Laszlo, >> >> I was planning to work to add the support to reserve the Secrets and >> CPUID page in E820 map and then create the EFI configuration table entry >> for it so that guest OS can reach to it. We have two packages >> "SecretDxe" and "SecretPei" in OvmfPkg/AmdSev. Any issues if I use them >> in the OvmfPkg.dsc ? Here is what I was thinking: >> >> 1) Rename the PcdSevLaunchSecretBase -> PcdSevSecretsBase >> >> 2) When SNP is enabled then VMM use this page as secrets page for the SN= P >> >> 3) When SEV or SEV-ES is enabled then VMM uses this page as a launch >> secret page >> >> This will allow me to drop PcdOvmfSnpSecretsBase. This will not just >> save 4-bytes but also minimize the code duplication. > I'm pretty unhappy about needing a separate page for each such purpose. > We're wasting room in MEMFD. The GUIDed structs that we expose to QEMU > seem to be flexible enough to describe non-page-aligned addresses, > right? Can we pack larger amounts of cruft into MEMFD pages? With the GUID approach we should be able to pack multiple fields into a page but unfortunately in the case of SEV-SNP both the CPUID and Secrets need to be a page size. Without SNP support the we reserve the following page for the SEV/SEV-ES: 1 page for Launch Secret. 2 pages for the GHCB 1 page for EsWorkArea Both the EsWorkArea and LaunchSecret does not need to be the page aligned or page sized. Since the SNP needs a full page for the secrets so=C2=A0 I was inclined to use the same secrets page for both SEV and SNP.= =C2=A0 At the end all we need to do is=C2=A0 reserve one extra page for CPUID to make the SNP work. In future the EsWorkArea page can be used to pack additional information without needed to reserve full page (if feature does not require page). > > I'm not looking forward to the day when we run out of slack in MEMFD and > we get to shift PEIFV / DXEFV. (Every time we need to increase the DXEFV > size, the same risk exists -- which is why I've been thinking for a > while now that OVMF includes too many features already.) This can > introduce obscure changes to the UEFI memory map, which has caused > compat problems in the past, for example with the "crash" utility. > > The feature creep in OVMF has gone off the rails in the last few years, > really. (Not that I'm not guilty myself.) > > Thanks, > Laszlo > >> Thoughts ? >> >> -Brijesh >> >> On 3/24/21 10:31 AM, Brijesh Singh wrote: >>> BZ: https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2= Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D3275&data=3D04%7C01%7Cbri= jesh.singh%40amd.com%7C04be68371db9458cbdc108d8fe61713a%7C3dd8961fe4884e608= e11a82d994e183d%7C0%7C0%7C637539041773579324%7CUnknown%7CTWFpbGZsb3d8eyJWIj= oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sda= ta=3DJ62%2BVSCZRawAkzsi9xtS43cpowZxSCx%2BwcDYNwdF3qA%3D&reserved=3D0 >>> >>> During the SEV-SNP guest launch sequence, two special pages need to >>> be inserted, the secrets page and cpuid page. The secrets page, >>> contain the VM platform communication keys. The guest BIOS and OS >>> can use this key to communicate with the SEV firmware to get the >>> attestation report. The Cpuid page, contain the CPUIDs entries >>> filtered through the AMD-SEV firmware. >>> >>> The VMM will locate the secrets and cpuid page addresses through a >>> fixed GUID and pass them to SEV firmware to populate further. >>> For more information about the page content, see the SEV-SNP spec. >>> >>> To simplify the pre-validation range calculation in the next patch, >>> the CPUID and Secrets pages are moved to the start of the >>> MEMFD_BASE_ADDRESS. >>> >>> Cc: James Bottomley >>> Cc: Min Xu >>> Cc: Jiewen Yao >>> Cc: Tom Lendacky >>> Cc: Jordan Justen >>> Cc: Ard Biesheuvel >>> Cc: Laszlo Ersek >>> Signed-off-by: Brijesh Singh >>> --- >>> OvmfPkg/OvmfPkg.dec | 8 +++++++ >>> OvmfPkg/OvmfPkgX64.fdf | 24 ++++++++++++-------- >>> OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 19 ++++++++++++++++ >>> OvmfPkg/ResetVector/ResetVector.inf | 4 ++++ >>> OvmfPkg/ResetVector/ResetVector.nasmb | 2 ++ >>> 5 files changed, 48 insertions(+), 9 deletions(-) >>> >>> diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec >>> index 4348bb45c6..062926772d 100644 >>> --- a/OvmfPkg/OvmfPkg.dec >>> +++ b/OvmfPkg/OvmfPkg.dec >>> @@ -317,6 +317,14 @@ >>> gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretBase|0x0|UINT32|0x42 >>> gUefiOvmfPkgTokenSpaceGuid.PcdSevLaunchSecretSize|0x0|UINT32|0x43 >>> =20 >>> + ## The base address of the CPUID page used by SEV-SNP >>> + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase|0|UINT32|0x48 >>> + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize|0|UINT32|0x49 >>> + >>> + ## The base address of the Secrets page used by SEV-SNP >>> + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase|0|UINT32|0x50 >>> + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize|0|UINT32|0x51 >>> + >>> [PcdsDynamic, PcdsDynamicEx] >>> gUefiOvmfPkgTokenSpaceGuid.PcdEmuVariableEvent|0|UINT64|2 >>> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFlashVariablesEnable|FALSE|BOOLEAN= |0x10 >>> diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf >>> index d519f85328..ea214600be 100644 >>> --- a/OvmfPkg/OvmfPkgX64.fdf >>> +++ b/OvmfPkg/OvmfPkgX64.fdf >>> @@ -67,27 +67,33 @@ ErasePolarity =3D 1 >>> BlockSize =3D 0x10000 >>> NumBlocks =3D 0xD0 >>> =20 >>> -0x000000|0x006000 >>> +0x000000|0x001000 >>> +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase|gUefiOvmfPkgTokenSpaceG= uid.PcdOvmfSnpCpuidSize >>> + >>> +0x001000|0x001000 >>> +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase|gUefiOvmfPkgTokenSpac= eGuid.PcdOvmfSnpSecretsSize >>> + >>> +0x002000|0x006000 >>> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesBase|gUefiOvmfPkgTokenS= paceGuid.PcdOvmfSecPageTablesSize >>> =20 >>> -0x006000|0x001000 >>> +0x008000|0x001000 >>> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfLockBoxStorageBase|gUefiOvmfPkgToken= SpaceGuid.PcdOvmfLockBoxStorageSize >>> =20 >>> -0x007000|0x001000 >>> +0x009000|0x001000 >>> gEfiMdePkgTokenSpaceGuid.PcdGuidedExtractHandlerTableAddress|gUefiOvmf= PkgTokenSpaceGuid.PcdGuidedExtractHandlerTableSize >>> =20 >>> -0x008000|0x001000 >>> +0x00A000|0x001000 >>> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbPageTableBase|gUefiOvmfPkgTok= enSpaceGuid.PcdOvmfSecGhcbPageTableSize >>> =20 >>> -0x009000|0x002000 >>> +0x00B000|0x002000 >>> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBase|gUefiOvmfPkgTokenSpaceGu= id.PcdOvmfSecGhcbSize >>> =20 >>> -0x00B000|0x001000 >>> -gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase|gUefiCpuPkgTokenSpaceGu= id.PcdSevEsWorkAreaSize >>> - >>> -0x00C000|0x001000 >>> +0x00D000|0x001000 >>> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupBase|gUefiOvmfPkgTokenS= paceGuid.PcdOvmfSecGhcbBackupSize >>> =20 >>> +0x00F000|0x001000 >>> +gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase|gUefiCpuPkgTokenSpaceGu= id.PcdSevEsWorkAreaSize >>> + >>> 0x010000|0x010000 >>> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase|gUefiOvmfPkgTokenS= paceGuid.PcdOvmfSecPeiTempRamSize >>> =20 >>> diff --git a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm b/OvmfPkg/Res= etVector/Ia16/ResetVectorVtf0.asm >>> index 9c0b5853a4..5456f02924 100644 >>> --- a/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm >>> +++ b/OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm >>> @@ -47,6 +47,25 @@ TIMES (15 - ((guidedStructureEnd - guidedStructureSt= art + 15) % 16)) DB 0 >>> ; >>> guidedStructureStart: >>> =20 >>> +; >>> +; SEV-SNP boot support >>> +; >>> +; sevSnpBlock: >>> +; For the initial boot of SEV-SNP guest, a Secrets and CPUID page mu= st be >>> +; reserved by the BIOS at a RAM area defined by SEV_SNP_SECRETS_PAGE >>> +; and SEV_SNP_CPUID_PAGE. A VMM will locate this information using t= he >>> +; SEV-SNP boot block. >>> +; >>> +; GUID (SEV-SNP boot block): bd39c0c2-2f8e-4243-83e8-1b74cebcb7d9 >>> +; >>> +sevSnpBootBlockStart: >>> + DD SEV_SNP_SECRETS_PAGE >>> + DD SEV_SNP_CPUID_PAGE >>> + DW sevSnpBootBlockEnd - sevSnpBootBlockStart >>> + DB 0xC2, 0xC0, 0x39, 0xBD, 0x8e, 0x2F, 0x43, 0x42 >>> + DB 0x83, 0xE8, 0x1B, 0x74, 0xCE, 0xBC, 0xB7, 0xD9 >>> +sevSnpBootBlockEnd: >>> + >>> ; >>> ; SEV Secret block >>> ; >>> diff --git a/OvmfPkg/ResetVector/ResetVector.inf b/OvmfPkg/ResetVector/= ResetVector.inf >>> index dc38f68919..d890bb6b29 100644 >>> --- a/OvmfPkg/ResetVector/ResetVector.inf >>> +++ b/OvmfPkg/ResetVector/ResetVector.inf >>> @@ -37,6 +37,10 @@ >>> gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase >>> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBase >>> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbSize >>> + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidBase >>> + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpCpuidSize >>> + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase >>> + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize >>> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbPageTableBase >>> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbPageTableSize >>> gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesBase >>> diff --git a/OvmfPkg/ResetVector/ResetVector.nasmb b/OvmfPkg/ResetVecto= r/ResetVector.nasmb >>> index 5fbacaed5f..2c194958f4 100644 >>> --- a/OvmfPkg/ResetVector/ResetVector.nasmb >>> +++ b/OvmfPkg/ResetVector/ResetVector.nasmb >>> @@ -75,6 +75,8 @@ >>> %define SEV_ES_WORK_AREA (FixedPcdGet32 (PcdSevEsWorkAreaBase)) >>> %define SEV_ES_WORK_AREA_RDRAND (FixedPcdGet32 (PcdSevEsWorkAreaBase= ) + 8) >>> %define SEV_ES_WORK_AREA_ENC_MASK (FixedPcdGet32 (PcdSevEsWorkAreaBa= se) + 16) >>> + %define SEV_SNP_SECRETS_PAGE FixedPcdGet32 (PcdOvmfSnpSecretsBase) >>> + %define SEV_SNP_CPUID_PAGE FixedPcdGet32 (PcdOvmfSnpCpuidBase) >>> %define SEV_ES_VC_TOP_OF_STACK (FixedPcdGet32 (PcdOvmfSecPeiTempRamB= ase) + FixedPcdGet32 (PcdOvmfSecPeiTempRamSize)) >>> %include "Ia32/Flat32ToFlat64.asm" >>> %include "Ia32/PageTables64.asm"