<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word"> <div class="WordSection1"> I recommend you split the patch set to OvmfPkg update and UefiPkg update, unless there is strong reason that you have to mix them together.<o:p></o:p> <o:p> </o:p> With that, I can merge the OvmfPkg at first and we can move forward there, while waiting UefiPkg review.<o:p></o:p> <o:p> </o:p> If you agree, please rebase and resubmit.<o:p></o:p> <o:p> </o:p> Thank you<o:p></o:p> Yao Jiewen<o:p></o:p> <o:p> </o:p> <div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt"> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: Singh, Brijesh <brijesh.singh@amd.com> Sent: Monday, November 8, 2021 10:11 AM To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io; Singh, Brijesh <brijesh.singh@amd.com> Cc: James Bottomley <jejb@linux.ibm.com>; Xu, Min M <min.m.xu@intel.com>; Lendacky, Thomas <Thomas.Lendacky@amd.com>; Justen, Jordan L <jordan.l.justen@intel.com>; Ard Biesheuvel <ardb+tianocore@kernel.org>; Erdem Aktas <erdemaktas@google.com>; Roth, Michael <Michael.Roth@amd.com>; Gerd Hoffmann <kraxel@redhat.com>; Ni, Ray <ray.ni@intel.com>; Kumar, Rahul1 <rahul1.kumar@intel.com> Subject: Re: [edk2-devel] [PATCH v11 00/32] Add AMD Secure Nested Paging (SEV-SNP) support<o:p></o:p> </div> </div> <o:p> </o:p> [AMD Official Use Only]<o:p></o:p> <o:p> </o:p> <div> <div> Hi,<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> I am not getting any response from the UefiCpuPkg maintainers, I am not sure if the Ray/Rahul are on vacation or need more information.<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> Jiewen and Gerd,<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> Any recommendations how we proceed further ? I can send the rebased version and we can go ahead and commit it. If UefiCpuPkg maintainer does not like something, then I am always happy to rework the stuff after the commit. I would like to send some cleanup patches post SNP series that will simplify some of the MemEncryptIs{Sev,Es,Snp}Enabled() based on our recent workarea patches. It will also help/align with the TDX series.<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> -Brijesh<o:p></o:p> </div> <div class="MsoNormal" align="center" style="text-align:center"> <hr size="2" width="98%" align="center"> </div> <div id="divRplyFwdMsg"> From: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a> <<a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a>> on behalf of Brijesh Singh via groups.io <<a href="mailto:brijesh.singh=amd.com@groups.io">brijesh.singh=amd.com@groups.io</a>> Sent: Sunday, October 31, 2021 4:40 PM To: Yao, Jiewen <<a href="mailto:jiewen.yao@intel.com">jiewen.yao@intel.com</a>>; <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a> <<a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a>> Cc: Singh, Brijesh <<a href="mailto:brijesh.singh@amd.com">brijesh.singh@amd.com</a>>; James Bottomley <<a href="mailto:jejb@linux.ibm.com">jejb@linux.ibm.com</a>>; Xu, Min M <<a href="mailto:min.m.xu@intel.com">min.m.xu@intel.com</a>>; Lendacky, Thomas <<a href="mailto:Thomas.Lendacky@amd.com">Thomas.Lendacky@amd.com</a>>; Justen, Jordan L <<a href="mailto:jordan.l.justen@intel.com">jordan.l.justen@intel.com</a>>; Ard Biesheuvel <<a href="mailto:ardb+tianocore@kernel.org">ardb+tianocore@kernel.org</a>>; Erdem Aktas <<a href="mailto:erdemaktas@google.com">erdemaktas@google.com</a>>; Roth, Michael <<a href="mailto:Michael.Roth@amd.com">Michael.Roth@amd.com</a>>; Gerd Hoffmann <<a href="mailto:kraxel@redhat.com">kraxel@redhat.com</a>>; Ray Ni <<a href="mailto:ray.ni@intel.com">ray.ni@intel.com</a>>; Rahul Kumar <<a href="mailto:rahul1.kumar@intel.com">rahul1.kumar@intel.com</a>> Subject: Re: [edk2-devel] [PATCH v11 00/32] Add AMD Secure Nested Paging (SEV-SNP) support <o:p></o:p> <div> <o:p></o:p> </div> </div> <div> <div> Hi Ray and Rahul, Gentle ping. Could you please Ack or R-b the files touched in UefiCpuPkg? -Brijesh On 10/29/21 9:52 AM, Brijesh Singh wrote: > Hi Jiewen, > > I have not heard anything back from UefiCpuPkg maintainer yet, I will > send another gentle ping on Monday again and hope maintainer get to it. > > -Brijesh > > On 10/29/21 7:26 AM, Yao, Jiewen wrote: >> Hi Brijesh >> Have you got R-B from UefiCpuPkg maintainer? >> >> >> >>> -----Original Message----- >>> From: Brijesh Singh <<a href="mailto:brijesh.singh@amd.com">brijesh.singh@amd.com</a>> >>> Sent: Monday, October 25, 2021 7:54 AM >>> To: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a>; Yao, Jiewen <<a href="mailto:jiewen.yao@intel.com">jiewen.yao@intel.com</a>> >>> Cc: <a href="mailto:brijesh.singh@amd.com">brijesh.singh@amd.com</a>; James Bottomley <<a href="mailto:jejb@linux.ibm.com">jejb@linux.ibm.com</a>>; Xu, Min M >>> <<a href="mailto:min.m.xu@intel.com">min.m.xu@intel.com</a>>; Tom Lendacky <<a href="mailto:thomas.lendacky@amd.com">thomas.lendacky@amd.com</a>>; Justen, >>> Jordan L <<a href="mailto:jordan.l.justen@intel.com">jordan.l.justen@intel.com</a>>; Ard Biesheuvel >>> <<a href="mailto:ardb+tianocore@kernel.org">ardb+tianocore@kernel.org</a>>; Erdem Aktas <<a href="mailto:erdemaktas@google.com">erdemaktas@google.com</a>>; >>> Michael Roth <<a href="mailto:Michael.Roth@amd.com">Michael.Roth@amd.com</a>>; Gerd Hoffmann <<a href="mailto:kraxel@redhat.com">kraxel@redhat.com</a>> >>> Subject: Re: [edk2-devel] [PATCH v11 00/32] Add AMD Secure Nested Paging >>> (SEV-SNP) support >>> >>> Thank Jiewen, >>> >>> I have ping'ed UefiCpuPkg maintainer (Ray and Rahul) on every patch >>> which touches the UefiCpuPkg. If maintainer wants me to rework on >>> something then I will work accordingly. If they are okay with v11 then >>> now the merge will create a conflict (due to the TDX patches merge >>> commit). I have rebased my series to the recent master and have pushed >>> it here: <a href="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAMDESE%2Fovmf%2Ftree%2Fsnp-v12&data=04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658929026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=loCp%2FptHiWgvAtdp6zjDH5jDeq9mKLYBwedNU%2FT0IzM%3D&reserved=0"> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAMDESE%2Fovmf%2Ftree%2Fsnp-v12&data=04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658929026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=loCp%2FptHiWgvAtdp6zjDH5jDeq9mKLYBwedNU%2FT0IzM%3D&reserved=0</a>. I can post the >>> series if you prefer it. >>> >>> thanks >>> >>> On 10/23/21 8:46 PM, Yao, Jiewen via groups.io wrote: >>>> Yes. I will try my best to merge. >>>> >>>> I checked the patch set but I did not find the "R-B" from UefiCpuPkg >>> maintainer. Neither from email nor from you v11. >>>> Did I miss something? >>>> >>>> Thank you >>>> Yao Jiewen >>>> >>>> >>>>> -----Original Message----- >>>>> From: Brijesh Singh <<a href="mailto:brijesh.singh@amd.com">brijesh.singh@amd.com</a>> >>>>> Sent: Saturday, October 23, 2021 12:13 PM >>>>> To: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a> >>>>> Cc: James Bottomley <<a href="mailto:jejb@linux.ibm.com">jejb@linux.ibm.com</a>>; Xu, Min M >>> <<a href="mailto:min.m.xu@intel.com">min.m.xu@intel.com</a>>; >>>>> Yao, Jiewen <<a href="mailto:jiewen.yao@intel.com">jiewen.yao@intel.com</a>>; Tom Lendacky >>>>> <<a href="mailto:thomas.lendacky@amd.com">thomas.lendacky@amd.com</a>>; Justen, Jordan L <<a href="mailto:jordan.l.justen@intel.com">jordan.l.justen@intel.com</a>>; >>>>> Ard Biesheuvel <<a href="mailto:ardb+tianocore@kernel.org">ardb+tianocore@kernel.org</a>>; Erdem Aktas >>>>> <<a href="mailto:erdemaktas@google.com">erdemaktas@google.com</a>>; Michael Roth <<a href="mailto:Michael.Roth@amd.com">Michael.Roth@amd.com</a>>; Gerd >>>>> Hoffmann <<a href="mailto:kraxel@redhat.com">kraxel@redhat.com</a>>; Brijesh Singh <<a href="mailto:brijesh.singh@amd.com">brijesh.singh@amd.com</a>> >>>>> Subject: [PATCH v11 00/32] Add AMD Secure Nested Paging (SEV-SNP) >>> support >>>>> Hi Gerd and Jiewen, >>>>> >>>>> CI was a bit unstable during my v10 submission, so, I was not able to >>>>> run it to the completion. Finally, I managed to get the CI going, >>>>> and it reported few Windows 32-bit build errors. The v11 fixes those build >>>>> errors. Please consider this for the merge. >>>>> >>>>> Thank you so much for all your support in reviewing the series. >>>>> >>>>> ----------------------------------------------------------------------------- >>>>> BZ: >>> <a href="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla"> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla</a>. >>> tianocore.org%2Fshow_bug.cgi%3Fid%3D3275&data=04%7C01%7Cbrijesh. >>> singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8961fe488 >>> 4e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUnknown%7 >>> CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJ >>> XVCI6Mn0%3D%7C3000&sdata=L41krO6G221HaIsG92FloIzgCDqMLAAsU26 >>> jaEMF7yw%3D&reserved=0 >>>>> SEV-SNP builds upon existing SEV and SEV-ES functionality while adding >>>>> new hardware-based memory protections. SEV-SNP adds strong memory >>>>> integrity >>>>> protection to help prevent malicious hypervisor-based attacks like data >>>>> replay, memory re-mapping and more in order to create an isolated memory >>>>> encryption environment. >>>>> >>>>> This series provides the basic building blocks to support booting the SEV-SNP >>>>> VMs, it does not cover all the security enhancement introduced by the SEV- >>> SNP >>>>> such as interrupt protection. >>>>> >>>>> Many of the integrity guarantees of SEV-SNP are enforced through a new >>>>> structure called the Reverse Map Table (RMP). Adding a new page to SEV-SNP >>>>> VM requires a 2-step process. First, the hypervisor assigns a page to the >>>>> guest using the new RMPUPDATE instruction. This transitions the page to >>>>> guest-invalid. Second, the guest validates the page using the new PVALIDATE >>>>> instruction. The SEV-SNP VMs can use the new "Page State Change Request >>>>> NAE" >>>>> defined in the GHCB specification to ask hypervisor to add or remove page >>>>> from the RMP table. >>>>> >>>>> Each page assigned to the SEV-SNP VM can either be validated or unvalidated, >>>>> as indicated by the Validated flag in the page's RMP entry. There are two >>>>> approaches that can be taken for the page validation: Pre-validation and >>>>> Lazy Validation. >>>>> >>>>> Under pre-validation, the pages are validated prior to first use. And under >>>>> lazy validation, pages are validated when first accessed. An access to a >>>>> unvalidated page results in a #VC exception, at which time the exception >>>>> handler may validate the page. Lazy validation requires careful tracking of >>>>> the validated pages to avoid validating the same GPA more than once. The >>>>> recently introduced "Unaccepted" memory type can be used to communicate >>>>> the >>>>> unvalidated memory ranges to the Guest OS. >>>>> >>>>> At this time we only support the pre-validation. OVMF detects all the >>> available >>>>> system RAM in the PEI phase. When SEV-SNP is enabled, the memory is >>> validated >>>>> before it is made available to the EDK2 core. >>>>> >>>>> Now that series contains all the basic support required to launch SEV-SNP >>>>> guest. We are still missing the Interrupt security feature provided by the >>>>> SNP. The feature will be added after the base support is accepted. >>>>> >>>>> Additional resources >>>>> --------------------- >>>>> SEV-SNP whitepaper >>>>> >>> <a href="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.a%2F&data=04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658929026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=WznkScyKwwPKfde08y%2Fb1KTmUgVt2al9%2Bupz%2FATGOHE%3D&reserved=0"> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.a%2F&data=04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658929026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=WznkScyKwwPKfde08y%2Fb1KTmUgVt2al9%2Bupz%2FATGOHE%3D&reserved=0</a> >>> md.com%2Fsystem%2Ffiles%2FTechDocs%2FSEV-SNP-strengthening-vm- >>> &data=04%7C01%7Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d0da >>> 08d9969026e2%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C63770 >>> 6369230826414%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQ >>> IjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=nVMSG% >>> 2FvSS2Wa21lu1lGrHr9OYX8hL7FoAcQXBBiCztc%3D&reserved=0 >>>>> isolation-with-integrity-protection-and-more.pdf >>>>> >>>>> APM 2: >>> <a href="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.a%2F&data=04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658929026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=WznkScyKwwPKfde08y%2Fb1KTmUgVt2al9%2Bupz%2FATGOHE%3D&reserved=0"> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.a%2F&data=04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658929026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=WznkScyKwwPKfde08y%2Fb1KTmUgVt2al9%2Bupz%2FATGOHE%3D&reserved=0</a> >>> md.com%2Fsystem%2Ffiles%2FTechDocs%2F24593.pdf&data=04%7C01%7 >>> Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8 >>> 961fe4884e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUnk >>> nown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1h >>> aWwiLCJXVCI6Mn0%3D%7C3000&sdata=G8Xg2glOGY2EjHpeQ3WM4gZCh >>> uI0k8QcLDTbpJiTplg%3D&reserved=0 (section 15.36) >>>>> The complete source is available at >>>>> >>> <a href="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.c%2F&data=04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658929026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Wx6h8FQ0289ZBQJa3iTk3Sb7zkmQO6D6VZFvRX5lEeM%3D&reserved=0"> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.c%2F&data=04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658929026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Wx6h8FQ0289ZBQJa3iTk3Sb7zkmQO6D6VZFvRX5lEeM%3D&reserved=0</a> >>> om%2FAMDESE%2Fovmf%2Ftree%2Fsnp- >>> v11&data=04%7C01%7Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d >>> 0da08d9969026e2%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C63 >>> 7706369230826414%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiL >>> CJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=HMH >>> Fq8G%2FPqdhzNW3Ashmc4%2Bmv1RcDULD4vniofhiS54%3D&reserved=0 >>>>> GHCB spec: >>>>> >>> <a href="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdevelop"> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdevelop</a> >>> er.amd.com%2Fwp- >>> content%2Fresources%2F56421.pdf&data=04%7C01%7Cbrijesh.singh%40a >>> md.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8961fe4884e608e11 >>> a82d994e183d%7C0%7C0%7C637706369230826414%7CUnknown%7CTWFpbGZ >>> sb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0 >>> %3D%7C3000&sdata=YiPgZU87fdnl5rJpD0E2ue9aTKbqUwizuBrKxom0FiU% >>> 3D&reserved=0 >>>>> SEV-SNP firmware specification: >>>>> >>> <a href="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.a%2F&data=04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658939021%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Hs%2BB9e%2FrZ0aYV3XPtJ9ZegaaIAMURuH1Dc9C1CeBauU%3D&reserved=0"> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.a%2F&data=04%7C01%7Cbrijesh.singh%40amd.com%7C400c84b654c6423f739e08d99cb72382%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637713132658939021%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Hs%2BB9e%2FrZ0aYV3XPtJ9ZegaaIAMURuH1Dc9C1CeBauU%3D&reserved=0</a> >>> md.com%2Fsystem%2Ffiles%2FTechDocs%2F56860.pdf&data=04%7C01%7 >>> Cbrijesh.singh%40amd.com%7Cddc5570780ff4a91d0da08d9969026e2%7C3dd8 >>> 961fe4884e608e11a82d994e183d%7C0%7C0%7C637706369230826414%7CUnk >>> nown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1h >>> aWwiLCJXVCI6Mn0%3D%7C3000&sdata=bfQsY4%2BRnlFGuD3Bg%2BFPb3l >>> RgSGgpomNocXswHqkm%2F4%3D&reserved=0 >>>>> Change since v10: >>>>> * fix 'unresolved external symbol __allshl' link error when building I32 for >>>>> VS2017. >>>>> >>>>> Changes since v9: >>>>> * Move CCAttrs Pcd define in MdePkg >>>>> * Add comment to indicate that allocating the identity map PT is temporary >>> until >>>>> we get lazy validation >>>>> >>>>> Changes since v8: >>>>> * drop the generic metadata and make it specific to SEV. >>>>> >>>>> Changes since v7: >>>>> * Move SEV specific changes in MpLib in AmdSev file >>>>> * Update the GHCB register function to not restore the GHCB MSR because >>>>> we were already in the MSR protocol mode. >>>>> * Drop the SNP name from PcdSnpSecPreValidate. >>>>> * Add new section for GHCB memory in the OVMF metadata. >>>>> >>>>> Change since v6: >>>>> * Drop the SNP boot block GUID and switch to using the Metadata guided >>>>> structure >>>>> proposed by Min in TDX series. >>>>> * Exclude the GHCB page from the pre-validated region. It simplifies the >>> reset >>>>> vector code where we do not need to unvalidate the GHCB page. >>>>> * Now that GHCB page is not validated so move the VMPL check from reset >>>>> vector >>>>> code to the MemEncryptSevLib on the first page validation. >>>>> * Introduce the ConfidentialComputingGuestAttr PCD to communicate which >>>>> memory encryption is active so that MpInitLib can make use of it. >>>>> * Drop the SEVES specific PCD as the information can be communicated via >>>>> the ConfidentialComputingGuestAttr. >>>>> * Move the SNP specific AP creation function in AmdSev.c. >>>>> * Define the SNP Blob GUID in a new file. >>>>> >>>>> Change since v5: >>>>> * When possible use the CPUID value from CPUID page >>>>> * Move the SEV specific functions from SecMain.c in AmdSev.c >>>>> * Rebase to the latest code >>>>> * Add the review feedback from Yao. >>>>> >>>>> Change since v4: >>>>> * Use the correct MSR for the SEV_STATUS >>>>> * Add VMPL-0 check >>>>> >>>>> Change since v3: >>>>> * ResetVector: move all SEV specific code in AmdSev.asm and add macros to >>>>> keep >>>>> the code readable. >>>>> * Drop extending the EsWorkArea to contain SNP specific state. >>>>> * Drop the GhcbGpa library and call the VmgExit directly to register GHCB >>> GPA. >>>>> * Install the CC blob config table from AmdSevDxe instead of extending the >>>>> AmdSev/SecretsDxe for it. >>>>> * Add the separate PCDs for the SNP Secrets. >>>>> >>>>> Changes since v2: >>>>> * Add support for the AP creation. >>>>> * Use the module-scoping override to make AmdSevDxe use the IO port for >>> PCI >>>>> reads. >>>>> * Use the reserved memory type for CPUID and Secrets page. >>>>> * >>>>> Changes since v1: >>>>> * Drop the interval tree support to detect the pre-validated overlap region. >>>>> * Use an array to keep track of pre-validated regions. >>>>> * Add support to query the Hypervisor feature and verify that SNP feature is >>>>> supported. >>>>> * Introduce MemEncryptSevClearMmioPageEncMask() to clear the C-bit >>> from >>>>> MMIO ranges. >>>>> * Pull the SevSecretDxe and SevSecretPei into OVMF package build. >>>>> * Extend the SevSecretDxe to expose confidential computing blob location >>>>> through >>>>> EFI configuration table. >>>>> >>>>> Brijesh Singh (28): >>>>> OvmfPkg/SecMain: move SEV specific routines in AmdSev.c >>>>> UefiCpuPkg/MpInitLib: move SEV specific routines in AmdSev.c >>>>> OvmfPkg/ResetVector: move clearing GHCB in SecMain >>>>> OvmfPkg/ResetVector: introduce SEV metadata descriptor for VMM use >>>>> OvmfPkg: reserve SNP secrets page >>>>> OvmfPkg: reserve CPUID page >>>>> OvmfPkg/ResetVector: pre-validate the data pages used in SEC phase >>>>> OvmfPkg/MemEncryptSevLib: add MemEncryptSevSnpEnabled() >>>>> OvmfPkg/SecMain: register GHCB gpa for the SEV-SNP guest >>>>> OvmfPkg/PlatformPei: register GHCB gpa for the SEV-SNP guest >>>>> OvmfPkg/AmdSevDxe: do not use extended PCI config space >>>>> OvmfPkg/MemEncryptSevLib: add support to validate system RAM >>>>> OvmfPkg/MemEncryptSevLib: add function to check the VMPL0 >>>>> OvmfPkg/BaseMemEncryptSevLib: skip the pre-validated system RAM >>>>> OvmfPkg/MemEncryptSevLib: add support to validate > 4GB memory in PEI >>>>> phase >>>>> OvmfPkg/SecMain: validate the memory used for decompressing Fv >>>>> OvmfPkg/PlatformPei: validate the system RAM when SNP is active >>>>> UefiCpuPkg: Define ConfidentialComputingGuestAttr >>>>> OvmfPkg/PlatformPei: set PcdConfidentialComputingAttr when SEV is >>>>> active >>>>> UefiCpuPkg/MpInitLib: use PcdConfidentialComputingAttr to check SEV >>>>> status >>>>> UefiCpuPkg: add PcdGhcbHypervisorFeatures >>>>> OvmfPkg/PlatformPei: set the Hypervisor Features PCD >>>>> MdePkg/GHCB: increase the GHCB protocol max version >>>>> UefiCpuPkg/MpLib: add support to register GHCB GPA when SEV-SNP is >>>>> enabled >>>>> OvmfPkg/MemEncryptSevLib: change the page state in the RMP table >>>>> OvmfPkg/MemEncryptSevLib: skip page state change for Mmio address >>>>> OvmfPkg/PlatformPei: mark cpuid and secrets memory reserved in EFI map >>>>> OvmfPkg/AmdSev: expose the SNP reserved pages through configuration >>>>> table >>>>> >>>>> Michael Roth (3): >>>>> OvmfPkg/ResetVector: use SEV-SNP-validated CPUID values >>>>> OvmfPkg/VmgExitLib: use SEV-SNP-validated CPUID values >>>>> UefiCpuPkg/MpInitLib: use BSP to do extended topology check >>>>> >>>>> Tom Lendacky (1): >>>>> UefiCpuPkg/MpInitLib: Use SEV-SNP AP Creation NAE event to launch APs >>>>> >>>>> MdePkg/MdePkg.dec | 4 + >>>>> OvmfPkg/OvmfPkg.dec | 18 + >>>>> UefiCpuPkg/UefiCpuPkg.dec | 5 + >>>>> OvmfPkg/AmdSev/AmdSevX64.dsc | 8 +- >>>>> OvmfPkg/Bhyve/BhyveX64.dsc | 5 +- >>>>> OvmfPkg/OvmfPkgIa32.dsc | 4 + >>>>> OvmfPkg/OvmfPkgIa32X64.dsc | 9 +- >>>>> OvmfPkg/OvmfPkgX64.dsc | 8 +- >>>>> OvmfPkg/OvmfXen.dsc | 5 +- >>>>> OvmfPkg/OvmfPkgX64.fdf | 6 + >>>>> OvmfPkg/AmdSevDxe/AmdSevDxe.inf | 7 + >>>>> .../DxeMemEncryptSevLib.inf | 3 + >>>>> .../PeiMemEncryptSevLib.inf | 7 + >>>>> .../SecMemEncryptSevLib.inf | 3 + >>>>> OvmfPkg/Library/VmgExitLib/SecVmgExitLib.inf | 2 + >>>>> OvmfPkg/Library/VmgExitLib/VmgExitLib.inf | 3 + >>>>> OvmfPkg/PlatformPei/PlatformPei.inf | 7 + >>>>> OvmfPkg/ResetVector/ResetVector.inf | 5 + >>>>> OvmfPkg/Sec/SecMain.inf | 4 + >>>>> UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf | 6 +- >>>>> UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf | 6 +- >>>>> .../Include/ConfidentialComputingGuestAttr.h | 25 + >>>>> MdePkg/Include/Register/Amd/Ghcb.h | 2 +- >>>>> .../Guid/ConfidentialComputingSevSnpBlob.h | 33 ++ >>>>> OvmfPkg/Include/Library/MemEncryptSevLib.h | 26 + >>>>> .../X64/SnpPageStateChange.h | 36 ++ >>>>> .../BaseMemEncryptSevLib/X64/VirtualMemory.h | 24 + >>>>> OvmfPkg/PlatformPei/Platform.h | 5 + >>>>> OvmfPkg/Sec/AmdSev.h | 95 ++++ >>>>> UefiCpuPkg/Library/MpInitLib/MpLib.h | 93 ++++ >>>>> OvmfPkg/AmdSevDxe/AmdSevDxe.c | 23 + >>>>> .../DxeMemEncryptSevLibInternal.c | 27 ++ >>>>> .../Ia32/MemEncryptSevLib.c | 17 + >>>>> .../PeiMemEncryptSevLibInternal.c | 27 ++ >>>>> .../SecMemEncryptSevLibInternal.c | 19 + >>>>> .../X64/DxeSnpSystemRamValidate.c | 40 ++ >>>>> .../X64/PeiDxeVirtualMemory.c | 167 ++++++- >>>>> .../X64/PeiSnpSystemRamValidate.c | 127 +++++ >>>>> .../X64/SecSnpSystemRamValidate.c | 82 ++++ >>>>> .../X64/SnpPageStateChangeInternal.c | 294 ++++++++++++ >>>>> OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 444 >>> ++++++++++++++++-- >>>>> OvmfPkg/PlatformPei/AmdSev.c | 231 +++++++++ >>>>> OvmfPkg/PlatformPei/MemDetect.c | 2 + >>>>> OvmfPkg/Sec/AmdSev.c | 298 ++++++++++++ >>>>> OvmfPkg/Sec/SecMain.c | 158 +------ >>>>> UefiCpuPkg/Library/MpInitLib/AmdSev.c | 239 ++++++++++ >>>>> UefiCpuPkg/Library/MpInitLib/DxeMpLib.c | 16 +- >>>>> UefiCpuPkg/Library/MpInitLib/Ia32/AmdSev.c | 70 +++ >>>>> UefiCpuPkg/Library/MpInitLib/MpLib.c | 345 +++++--------- >>>>> UefiCpuPkg/Library/MpInitLib/PeiMpLib.c | 4 +- >>>>> UefiCpuPkg/Library/MpInitLib/X64/AmdSev.c | 261 ++++++++++ >>>>> OvmfPkg/FvmainCompactScratchEnd.fdf.inc | 5 + >>>>> OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 17 + >>>>> OvmfPkg/ResetVector/Ia32/AmdSev.asm | 86 +++- >>>>> OvmfPkg/ResetVector/ResetVector.nasmb | 18 + >>>>> OvmfPkg/ResetVector/X64/OvmfSevMetadata.asm | 74 +++ >>>>> UefiCpuPkg/Library/MpInitLib/MpEqu.inc | 2 + >>>>> UefiCpuPkg/Library/MpInitLib/X64/AmdSev.nasm | 200 ++++++++ >>>>> UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm | 100 +--- >>>>> 59 files changed, 3329 insertions(+), 528 deletions(-) >>>>> create mode 100644 MdePkg/Include/ConfidentialComputingGuestAttr.h >>>>> create mode 100644 >>>>> OvmfPkg/Include/Guid/ConfidentialComputingSevSnpBlob.h >>>>> create mode 100644 >>>>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChange.h >>>>> create mode 100644 OvmfPkg/Sec/AmdSev.h >>>>> create mode 100644 >>>>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/DxeSnpSystemRamValidate.c >>>>> create mode 100644 >>>>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c >>>>> create mode 100644 >>>>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/SecSnpSystemRamValidate.c >>>>> create mode 100644 >>>>> >>> OvmfPkg/Library/BaseMemEncryptSevLib/X64/SnpPageStateChangeInternal.c >>>>> create mode 100644 OvmfPkg/Sec/AmdSev.c >>>>> create mode 100644 UefiCpuPkg/Library/MpInitLib/AmdSev.c >>>>> create mode 100644 UefiCpuPkg/Library/MpInitLib/Ia32/AmdSev.c >>>>> create mode 100644 UefiCpuPkg/Library/MpInitLib/X64/AmdSev.c >>>>> create mode 100644 OvmfPkg/ResetVector/X64/OvmfSevMetadata.asm >>>>> create mode 100644 UefiCpuPkg/Library/MpInitLib/X64/AmdSev.nasm >>>>> >>>>> -- >>>>> 2.25.1 >>>> >>>> >>>> <o:p></o:p> </div> </div> </div> </div> </div> </body> </html> <div width="1" style="color:white;clear:both">_._,_._,_</div> <hr> Groups.io Links: You receive all messages sent to this group. <a target="_blank" href="https://edk2.groups.io/g/devel/message/83426">View/Reply Online (#83426)</a> | | <a target="_blank" href="https://groups.io/mt/86530708/1813853">Mute This Topic</a> | <a href="https://edk2.groups.io/g/devel/post">New Topic</a> <a href="https://edk2.groups.io/g/devel/editsub/1813853">Your Subscription</a> | <a href="mailto:devel+owner@edk2.groups.io">Contact Group Owner</a> | <a href="https://edk2.groups.io/g/devel/unsub">Unsubscribe</a> [edk2-devel-archive@redhat.com] <div width="1" style="color:white;clear:both">_._,_._,_</div>