[edk2-devel] [PATCH v15 00/46] SEV-ES guest support
Laszlo Ersek
lersek at redhat.com
Thu Aug 13 19:53:47 UTC 2020
On 08/13/20 15:22, Tom Lendacky wrote:
> From: Tom Lendacky <thomas.lendacky at amd.com>
>
> This patch series provides support for running EDK2/OVMF under SEV-ES.
>
> Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on the
> SEV support to protect the guest register state from the hypervisor. See
> "AMD64 Architecture Programmer's Manual Volume 2: System Programming",
> section "15.35 Encrypted State (SEV-ES)" [1].
>
> In order to allow a hypervisor to perform functions on behalf of a guest,
> there is architectural support for notifying a guest's operating system
> when certain types of VMEXITs are about to occur. This allows the guest to
> selectively share information with the hypervisor to satisfy the requested
> function. The notification is performed using a new exception, the VMM
> Communication exception (#VC). The information is shared through the
> Guest-Hypervisor Communication Block (GHCB) using the VMGEXIT instruction.
> The GHCB format and the protocol for using it is documented in "SEV-ES
> Guest-Hypervisor Communication Block Standardization" [2].
>
> The main areas of the EDK2 code that are updated to support SEV-ES are
> around the exception handling support and the AP boot support.
>
> Exception support is required starting in Sec, continuing through Pei
> and into Dxe in order to handle #VC exceptions that are generated. Each
> AP requires it's own GHCB page as well as a page to hold values specific
> to that AP.
>
> AP booting poses some interesting challenges. The INIT-SIPI-SIPI sequence
> is typically used to boot the APs. However, the hypervisor is not allowed
> to update the guest registers. The GHCB document [2] talks about how SMP
> booting under SEV-ES is performed.
>
> Since the GHCB page must be a shared (unencrypted) page, the processor
> must be running in long mode in order for the guest and hypervisor to
> communicate with each other. As a result, SEV-ES is only supported under
> the X64 architecture.
>
> This series adds a new library requirement for the VmgExitLib library
> against the UefiCpuPkg CpuExceptionHandlerLib library and the UefiCpuPkg
> MpInitLib library. The edk2-platforms repo requires updates/patches to
> add the new library requirement. To accomodate that, this series could be
> split between:
>
> patch number 10:
> UefiPayloadPkg: Prepare UefiPayloadPkg to use the VmgExitLib library
>
> and patch number 11:
> UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC exception
>
> The updates to edk2-platforms can be applied at the split.
>
> [1] https://www.amd.com/system/files/TechDocs/24593.pdf
> [2] https://developer.amd.com/wp-content/resources/56421.pdf
>
> ---
>
> These patches are based on commit:
> 65904cdbb33c ("UefiCpuPkg/MtrrLibUnitTest: Change to use static array for CI test")
>
> A version of the tree can be found at:
> https://github.com/AMDESE/ovmf/tree/sev-es-v24
>
> Cc: Andrew Fish <afish at apple.com>
> Cc: Anthony Perard <anthony.perard at citrix.com>
> Cc: Ard Biesheuvel <ard.biesheuvel at arm.com>
> Cc: Benjamin You <benjamin.you at intel.com>
> Cc: Dandan Bi <dandan.bi at intel.com>
> Cc: Eric Dong <eric.dong at intel.com>
> Cc: Guo Dong <guo.dong at intel.com>
> Cc: Hao A Wu <hao.a.wu at intel.com>
> Cc: Jian J Wang <jian.j.wang at intel.com>
> Cc: Jordan Justen <jordan.l.justen at intel.com>
> Cc: Julien Grall <julien at xen.org>
> Cc: Laszlo Ersek <lersek at redhat.com>
> Cc: Leif Lindholm <leif at nuviainc.com>
> Cc: Liming Gao <liming.gao at intel.com>
> Cc: Maurice Ma <maurice.ma at intel.com>
> Cc: Michael D Kinney <michael.d.kinney at intel.com>
> Cc: Ray Ni <ray.ni at intel.com>
>
> Changes since v14:
> - Address ECC errors
> - Fix non-boolean comparison to use a comparison operator
> - Separate declaration and initialization of variables
> - Add period to first line of block comments
> - Split single-line multiple declaration into multiple lines
The changes look good to me, thanks!
In this particular case, the updates do not invalidate my
"Regression-tested-by" given under v14:
https://edk2.groups.io/g/devel/message/63921
"""
For all patches except #10 ("UefiPayloadPkg: Prepare UefiPayloadPkg to
use the VmgExitLib library") and #46 ("Maintainers.txt: Add reviewers
for the OvmfPkg SEV-related files"):
Regression-tested-by: Laszlo Ersek <lersek at redhat.com>
"""
So whoever merges this series should please apply that to the respective
patches.
Thanks!
Laszlo
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#64254): https://edk2.groups.io/g/devel/message/64254
Mute This Topic: https://groups.io/mt/76166920/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list