Tom: I run the standalone ECC checker. sev-es-v23 version pass ECC checker. There is no ecc issue any more.
Thanks Liming > -----Original Message----- > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Lendacky, > Thomas > Sent: Wednesday, August 12, 2020 11:49 PM > To: Gao, Liming <liming....@intel.com>; devel@edk2.groups.io; Laszlo Ersek > <ler...@redhat.com> > Cc: Brijesh Singh <brijesh.si...@amd.com>; Ard Biesheuvel > <ard.biesheu...@arm.com>; Dong, Eric <eric.d...@intel.com>; Justen, > Jordan L <jordan.l.jus...@intel.com>; Kinney, Michael D > <michael.d.kin...@intel.com>; Ni, Ray <ray...@intel.com>; Andrew Fish > <af...@apple.com>; Anthony Perard <anthony.per...@citrix.com>; You, Benjamin > <benjamin....@intel.com>; Bi, Dandan > <dandan...@intel.com>; Dong, Guo <guo.d...@intel.com>; Wu, Hao A > <hao.a...@intel.com>; Wang, Jian J <jian.j.w...@intel.com>; > Julien Grall <jul...@xen.org>; Leif Lindholm <l...@nuviainc.com>; Ma, Maurice > <maurice...@intel.com> > Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support > > Hi Liming, > > Thank you, the updated series can be found here: > > https://github.com/AMDESE/ovmf/tree/sev-es-v23 > > Thanks, > Tom > > On 8/12/20 10:28 AM, Gao, Liming wrote: > > Tom: > > I understand your point. Now, I run this script on Windows OS. I don't > > try it on Linux agent. You can upload new patch set to your > fork branch. I will verify it and let your know the result. > > > > And, I plan to merge ECC checker this week. So, more patches can be > > verified. > > > > Thanks > > Liming > >> -----Original Message----- > >> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Lendacky, > >> Thomas > >> Sent: Wednesday, August 12, 2020 11:18 PM > >> To: Gao, Liming <liming....@intel.com>; devel@edk2.groups.io; Laszlo Ersek > >> <ler...@redhat.com> > >> Cc: Brijesh Singh <brijesh.si...@amd.com>; Ard Biesheuvel > >> <ard.biesheu...@arm.com>; Dong, Eric <eric.d...@intel.com>; Justen, > >> Jordan L <jordan.l.jus...@intel.com>; Kinney, Michael D > >> <michael.d.kin...@intel.com>; Ni, Ray <ray...@intel.com>; Andrew Fish > >> <af...@apple.com>; Anthony Perard <anthony.per...@citrix.com>; You, > >> Benjamin <benjamin....@intel.com>; Bi, Dandan > >> <dandan...@intel.com>; Dong, Guo <guo.d...@intel.com>; Wu, Hao A > >> <hao.a...@intel.com>; Wang, Jian J > <jian.j.w...@intel.com>; > >> Julien Grall <jul...@xen.org>; Leif Lindholm <l...@nuviainc.com>; Ma, > >> Maurice <maurice...@intel.com> > >> Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support > >> > >> Hi Liming, > >> > >> So I'm not sure what the next step is then... Since the ECC checker isn't > >> merged yet, are you saying that I should submit the series again with the > >> changes and that you won't be running the stand-alone tool again? Or will > >> you run the tool again and submit more issues to resolve if the tool finds > >> any? If it's the latter, I would really like to be able to run this tool > >> stand-alone, as you have done, so that I don't have to keep re-submitting > >> the series (because it looks like the tool doesn't catch everything and > >> fixing one thing may then expose another). > >> > >> Thanks, > >> Tom > >> > >> On 8/12/20 9:34 AM, Gao, Liming wrote: > >>> Tom: > >>> > >>> -----Original Message----- > >>> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Lendacky, > >>> Thomas > >>> Sent: 2020年8月12日 0:18 > >>> To: Laszlo Ersek <ler...@redhat.com>; Gao, Liming <liming....@intel.com>; > >>> devel@edk2.groups.io > >>> Cc: Brijesh Singh <brijesh.si...@amd.com>; Ard Biesheuvel > >>> <ard.biesheu...@arm.com>; Dong, Eric <eric.d...@intel.com>; > Justen, > >> Jordan L <jordan.l.jus...@intel.com>; Kinney, Michael D > >> <michael.d.kin...@intel.com>; Ni, Ray <ray...@intel.com>; Andrew Fish > >> <af...@apple.com>; Anthony Perard <anthony.per...@citrix.com>; You, > >> Benjamin <benjamin....@intel.com>; Bi, Dandan > >> <dandan...@intel.com>; Dong, Guo <guo.d...@intel.com>; Wu, Hao A > >> <hao.a...@intel.com>; Wang, Jian J > <jian.j.w...@intel.com>; > >> Julien Grall <jul...@xen.org>; Leif Lindholm <l...@nuviainc.com>; Ma, > >> Maurice <maurice...@intel.com> > >>> Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support > >>> > >>> On 8/11/20 9:49 AM, Laszlo Ersek wrote: > >>>> On 08/11/20 03:12, Gao, Liming wrote: > >>>>> Tom: > >>>>> I run ECC plugin > >> > (https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F63271&dat > >> > a=02%7C01%7Cthomas.lendacky%40amd.com%7C4285f946d86342630a4708d83ecccf27%7C3dd8961fe4884e608e11a82d994e183d%7C > >> 0%7C0%7C637328396655798086&sdata=27ydFZdocl9RV7MbrLRKw0L2GiOGtWLlpsuaw9wj2fo%3D&reserved=0) > >> in my > local > >> machine. It reports below issues. Can you help update the patches to fix > >> them? > >>>>> I use the standalone EccCheck from > >> > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fshenglei10%2Fedk2%2Ftree%2Fecc_script& > >> ;data=02%7C01%7Cthomas.lendacky%40amd.com%7C4285f946d86342630a4708d83ecccf27%7C3dd8961fe4884e608e11a82d994e18 > 3d > >> %7C0%7C0%7C637328396655798086&sdata=b8VUf6uNw%2FzNBZCKU0IUUakDLJPmVsK4ghJirmQwCwY%3D&reserved=0. > >>>>> > >>>>> EFI coding style error > >>>>> *Error code: 8005 > >>>>> *Variable name does not follow the rules: 1. First character should > >>>>> be upper case 2. Must contain lower case characters 3. No > >> white space characters 4. Global variable name must start with a 'g' > >>>>> *file: D:\AllPkg\edk2\OvmfPkg\Sec\SecMain.c > >>>>> *Line number: 867 > >>>>> *The variable name [*Ds] does not follow the rules > >>>> > >>>> I don't understand this report; with this series applied, line 867 is > >>>> the following: > >>>> > >>>> 867 UINT8 *Src, *Dst; > >>>> > >>>> coming from patch v14 37/46, "OvmfPkg/Sec: Add #VC exception handling > >>>> for Sec phase". > >>>> > >>>> Perhaps ECC is confused because we have two declarations on the same > >>>> line; I'm not sure. > >>>> > >>>> In general I too like to keep declarations on separate lines, but > >>>> there are exceptions. Declaring *Src and *Dst on the same line is > >>>> pretty reasonable, and trivial. > >>>> > >>>> I think it's time for us to put the ECC exception list to use, under > >>>> OvmfPkg. > >>>> > >>>> Tom, please try to reproduce this error locally, and then modify > >>>> "OvmfPkg/OvmfPkg.ci.yaml", adding an exception under the EccCheck block. > >>>> > >>>> ... Oh wait, we haven't even merged Shenglei's series for that! The > >>>> latest posting is: > >>>> > >>>> [edk2-devel] [PATCH v9 00/16] > >>>> Add a plugin to check Ecc issues for edk2 on open ci > >>>> > >>>> and it's still under review. > >>>> > >>>> Indeed, Liming says above that he used the "standalone EccCheck". > >>>> > >>>> OK. In this case, I state that some of these ECC reports for OvmfPkg > >>>> should be waived. > >>>> > >>>> I'm in general of the opinion that ECC is too strict, and package > >>>> maintainers should have power to selectively enforce or override ECC > >>>> reports. That's why I agreed to the ECC CI plugin in the first place > >>>> -- becase we have exception lists that are controllable under specific > >>>> package directories (in the *.ci.yaml files). > >>>> > >>>> In the present case, running the standalone ECC check has worse > >>>> granularity than the upcoming ECC CI plugin. So, because I can't ask > >>>> Tom to add a new exception to "OvmfPkg/OvmfPkg.ci.yaml" right now > >>>> (before we merge this series), I'm replacing that with a waiver in this > >>>> email. > >>>> > >>>> Of course, if maintainers of other packages want the ECC reports > >>>> issued under their packages addressed, that's their call. I can only > >>>> waive ECC reports under OvmfPkg. > >>>> > >>>>> EFI coding style error > >>>>> *Error code: 9003 > >>>>> *The first line of text in a comment block should be a brief > >>>>> description of the element being documented and the brief > >> description must end with a period. > >>>>> *file: > >>>>> D:\AllPkg\edk2\OvmfPkg\Library\BaseMemEncryptSevLib\MemEncryptSevLibInternal.c > >>>>> *Line number: 72 > >>>>> *Comment description should end with period '.' > >>>> > >>>> Disagree; sometimes people use well-formed full English sentences, > >>>> sometimes only thought fragments. > >>>> > >>>>> EFI coding style error > >>>>> *Error code: 3002 > >>>>> *Non-Boolean comparisons should use a compare operator (==, !=, >, < > >>>>> >=, <=) > >>>>> *file: D:\AllPkg\edk2\OvmfPkg\Library\VmgExitLib\VmgExitVcHandler.c > >>>>> *Line number: 1280 > >>>>> *Predicate Expression: OpCount > >>>> > >>>> On the other hand, this report *is* worth fixing. > >>>> > >>>> 1280 while (OpCount) { > >>>> > >>>> I've myself asked Tom for observing this rule at several locations, > >>>> but we both missed the one reported above. It comes from patch #14 > >>>> ("OvmfPkg/VmgExitLib: Support string IO for IOIO_PROT NAE events"). > >>>> > >>>>> EFI coding style error > >>>>> *Error code: 5007 > >>>>> *There should be no initialization of a variable as part of its > >>>>> declaration > >>>>> *file: D:\AllPkg\edk2\OvmfPkg\Library\VmgExitLib\VmgExitVcHandler.c > >>>>> *Line number: 845 > >>>>> *Variable Name: Data > >>>> > >>>> Agree this should be fixed; I should have noticed it during review. My > >>>> apologies. > >>>> > >>>> 845 UINT8 *Data = (UINT8 *) Ghcb->SharedBuffer; > >>>> > >>>> Comes from patch #17 ("OvmfPkg/VmgExitLib: Add support for NPF NAE > >>>> events (MMIO)"). > >>>> > >>>>> EFI coding style error > >>>>> *Error code: 5007 > >>>>> *There should be no initialization of a variable as part of its > >>>>> declaration > >>>>> *file: D:\AllPkg\edk2\OvmfPkg\Library\VmgExitLib\VmgExitVcHandler.c > >>>>> *Line number: 849 > >>>>> *Variable Name: Data > >>>> > >>>> Yes, this should be fixed too: > >>>> > >>>> 849 UINT16 *Data = (UINT16 *) Ghcb->SharedBuffer; > >>>> > >>>> Again, I should have noticed it; I'm sorry. > >>>> > >>>> It comes from patch #17 ("OvmfPkg/VmgExitLib: Add support for NPF NAE > >>>> events (MMIO)") again. > >>>> > >>>> Tom: given that a new iteration seems justified after all (I'm really > >>>> sorry about that -- with Shenglei's series hopefully soon merged, such > >>>> issues will be reported earlier!), if you'd like, you could address > >>>> the two ECC reports too that I said were too strict and should be > >>>> ignored. > >>>> (That means breaking the "*Dst" declaration to a new line, and adding > >>>> a period to the comment.) Up to you; I certainly don't insist on those. > >>> > >>> No worries, easy enough to do if I'm already updating the others. > >>> > >>> I would like to be able to run this tool on my system, though, to see if > >>> anything else gets flagged after fixing the above mentioned > >> issues. But the tool fails for me as I described in another post. The > >> reason I say that is, for example, the issue about the comment > >> description ending with a period was actually in multiple spots of the > >> commit, even though the tool only flagged one. I'd hate to > >> think I've fixed everything only to have the tool find more issues after > >> I've submitted another series, all because I couldn't run the > >> tool. > >>> > >>> Thanks, > >>> Tom > >>> > >>> [Liming] ECC checker will be merged in open CI to check the patch and > >>> report the issues. Then, you don't need to run it in your > local > >> machine. I use this patch set as test case to verify ECC checker > >> functionality. And, it reports those issues. I think they are valuable > for > >> this patch set, so I raise them. Sorry for the late notice. > >>> > >>> Thanks > >>> Liming > >>>> > >>>> Thanks! > >>>> Laszlo > >>>> > >>>>> > >>>>> Thanks > >>>>> Liming > >>>>> -----Original Message----- > >>>>> From: Laszlo Ersek <ler...@redhat.com> > >>>>> Sent: 2020年8月11日 3:36 > >>>>> To: devel@edk2.groups.io; thomas.lenda...@amd.com > >>>>> Cc: Brijesh Singh <brijesh.si...@amd.com>; Ard Biesheuvel > >>>>> <ard.biesheu...@arm.com>; Dong, Eric <eric.d...@intel.com>; Justen, > >>>>> Jordan L <jordan.l.jus...@intel.com>; Gao, Liming > >>>>> <liming....@intel.com>; Kinney, Michael D > >>>>> <michael.d.kin...@intel.com>; Ni, Ray <ray...@intel.com>; Andrew Fish > >>>>> <af...@apple.com>; Anthony Perard <anthony.per...@citrix.com>; You, > >>>>> Benjamin <benjamin....@intel.com>; Bi, Dandan <dandan...@intel.com>; > >>>>> Dong, Guo <guo.d...@intel.com>; Wu, Hao A <hao.a...@intel.com>; Wang, > >>>>> Jian J <jian.j.w...@intel.com>; Julien Grall <jul...@xen.org>; Leif > >>>>> Lindholm <l...@nuviainc.com>; Ma, Maurice <maurice...@intel.com> > >>>>> Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support > >>>>> > >>>>> On 08/07/20 21:38, Lendacky, Thomas wrote: > >>>>>> From: Tom Lendacky <thomas.lenda...@amd.com> > >>>>>> > >>>>>> This patch series provides support for running EDK2/OVMF under SEV-ES. > >>>>>> > >>>>>> Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands > >>>>>> on the SEV support to protect the guest register state from the > >>>>>> hypervisor. See > >>>>>> "AMD64 Architecture Programmer's Manual Volume 2: System > >>>>>> Programming", section "15.35 Encrypted State (SEV-ES)" [1]. > >>>>>> > >>>>>> In order to allow a hypervisor to perform functions on behalf of a > >>>>>> guest, there is architectural support for notifying a guest's > >>>>>> operating system when certain types of VMEXITs are about to occur. > >>>>>> This allows the guest to selectively share information with the > >>>>>> hypervisor to satisfy the requested function. The notification is > >>>>>> performed using a new exception, the VMM Communication exception > >>>>>> (#VC). The information is shared through the Guest-Hypervisor > >>>>>> Communication Block (GHCB) using the VMGEXIT instruction. > >>>>>> The GHCB format and the protocol for using it is documented in > >>>>>> "SEV-ES Guest-Hypervisor Communication Block Standardization" [2]. > >>>>>> > >>>>>> The main areas of the EDK2 code that are updated to support SEV-ES > >>>>>> are around the exception handling support and the AP boot support. > >>>>>> > >>>>>> Exception support is required starting in Sec, continuing through > >>>>>> Pei and into Dxe in order to handle #VC exceptions that are generated. > >>>>>> Each AP requires it's own GHCB page as well as a page to hold values > >>>>>> specific to that AP. > >>>>>> > >>>>>> AP booting poses some interesting challenges. The INIT-SIPI-SIPI > >>>>>> sequence is typically used to boot the APs. However, the hypervisor > >>>>>> is not allowed to update the guest registers. The GHCB document [2] > >>>>>> talks about how SMP booting under SEV-ES is performed. > >>>>>> > >>>>>> Since the GHCB page must be a shared (unencrypted) page, the > >>>>>> processor must be running in long mode in order for the guest and > >>>>>> hypervisor to communicate with each other. As a result, SEV-ES is > >>>>>> only supported under the X64 architecture. > >>>>>> > >>>>>> This series adds a new library requirement for the VmgExitLib > >>>>>> library against the UefiCpuPkg CpuExceptionHandlerLib library and > >>>>>> the UefiCpuPkg MpInitLib library. The edk2-platforms repo requires > >>>>>> updates/patches to add the new library requirement. To accomodate > >>>>>> that, this series could be split between: > >>>>>> > >>>>>> patch number 10: > >>>>>> UefiPayloadPkg: Prepare UefiPayloadPkg to use the VmgExitLib > >>>>>> library > >>>>>> > >>>>>> and patch number 11: > >>>>>> UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC > >>>>>> exception > >>>>>> > >>>>>> The updates to edk2-platforms can be applied at the split. > >>>>>> > >>>>>> [1] > >>>>>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fww > >>>>>> w.amd.com%2Fsystem%2Ffiles%2FTechDocs%2F24593.pdf&data=02%7C01%7 > >>>>>> Cthomas.lendacky%40amd.com%7C9c0fb2b16af248090fdb08d83e05c821%7C3dd8 > >>>>>> 961fe4884e608e11a82d994e183d%7C0%7C0%7C637327542159394484&sdata= > >>>>>> zusPC5xFZWfLxt6T5Psxb1%2Fw4mrVWnkrrECkuKSsxLk%3D&reserved=0 > >>>>>> [2] > >>>>>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fde > >>>>>> veloper.amd.com%2Fwp-content%2Fresources%2F56421.pdf&data=02%7C0 > >>>>>> 1%7Cthomas.lendacky%40amd.com%7C9c0fb2b16af248090fdb08d83e05c821%7C3 > >>>>>> dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637327542159394484&sda > >>>>>> ta=yk7o8h1lajI449tZfXGbPumnkvRjswKp1FRmSUdewh4%3D&reserved=0 > >>>>>> > >>>>>> --- > >>>>>> > >>>>>> These patches are based on commit: > >>>>>> 9565ab67c209 ("ShellPkg: smbiosview - Change some type 17 field > >>>>>> values > >>>>>> format") > >>>>>> > >>>>>> A version of the tree can be found at: > >>>>>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgi > >>>>>> thub.com%2FAMDESE%2Fovmf%2Ftree%2Fsev-es-v22&data=02%7C01%7Cthom > >>>>>> as.lendacky%40amd.com%7C9c0fb2b16af248090fdb08d83e05c821%7C3dd8961fe > >>>>>> 4884e608e11a82d994e183d%7C0%7C0%7C637327542159404476&sdata=6b9Eq > >>>>>> EVAy1VK38oMSuAPJhOourJpPXUnRIgMcSWRMQc%3D&reserved=0 > >>>>>> > >>>>>> Cc: Andrew Fish <af...@apple.com> > >>>>>> Cc: Anthony Perard <anthony.per...@citrix.com> > >>>>>> Cc: Ard Biesheuvel <ard.biesheu...@arm.com> > >>>>>> Cc: Benjamin You <benjamin....@intel.com> > >>>>>> Cc: Dandan Bi <dandan...@intel.com> > >>>>>> Cc: Eric Dong <eric.d...@intel.com> > >>>>>> Cc: Guo Dong <guo.d...@intel.com> > >>>>>> Cc: Hao A Wu <hao.a...@intel.com> > >>>>>> Cc: Jian J Wang <jian.j.w...@intel.com> > >>>>>> Cc: Jordan Justen <jordan.l.jus...@intel.com> > >>>>>> Cc: Julien Grall <jul...@xen.org> > >>>>>> Cc: Laszlo Ersek <ler...@redhat.com> > >>>>>> Cc: Leif Lindholm <l...@nuviainc.com> > >>>>>> Cc: Liming Gao <liming....@intel.com> > >>>>>> Cc: Maurice Ma <maurice...@intel.com> > >>>>>> Cc: Michael D Kinney <michael.d.kin...@intel.com> > >>>>>> Cc: Ray Ni <ray...@intel.com> > >>>>>> > >>>>>> Changes since v13: > >>>>>> - Fixup the AsmRelocateApLoop() call site so IA32 successfully boots > >>>>>> APs. > >>>>>> Do this by appending the three new parameters without altering the > >>>>>> original parameter passing order. > >>>>>> - Minor updates to description text and help text to expand the GHCB > >>>>>> acronym. > >>>>>> > >>>>>> Changes since v12: > >>>>>> - Change IA32 VMGEXIT .nasm file to issue an int 3. Depending on the > >>>>>> version of NASM, the "BITS 64" trick to get NASM to recognize the > >>>>>> VMMCALL instruction (VMGEXIT is a REP VMMCALL) caused an error. Since > >>>>>> SEV-ES is X64 only, VMGEXIT should never be called in IA32. > >>>>>> > >>>>>> Changes since v11: > >>>>>> - Make the XGETBV and VMGEXIT .nasm files buildable for all > >>>>>> environments > >>>>>> and remove the updates that add these instructions to GccInline.c > >>>>>> > >>>>>> Changes since v10: > >>>>>> - Fix conflicts around GccInline.c file after moving to latest > >>>>>> commit > >>>>>> - Fix conflicts with OVMF PCD values after moving to latest commit > >>>>>> > >>>>>> Changes since v9: > >>>>>> - Fixed bit field declarations in the GHCB structure to use UINT32 > >>>>>> and not UINT64. > >>>>>> - Fixed a warning produced by VS2019 in the instruction parsing code > >>>>>> by expliciting casting a bit shift to an INT64. > >>>>>> - Sorted section entries in the OVMF VmgExitLib INF file. > >>>>>> - Moved the new Maintainers.txt entry so entries remain sorted. > >>>>>> - Documentation style fixes for return values. > >>>>>> - Miscellaneous code style fixes. > >>>>>> > >>>>>> Changes since v8: > >>>>>> - Move IOIO exit info definitions into Ghcb.h file > >>>>>> - Add a macro for calculating IO instruction bytes > >>>>>> (IOIO_DATA_BYTES) > >>>>>> - Exception handler support for debug registers > >>>>>> - Moved the DRx register saving changes into the UefiCpuPkg patch for > >>>>>> base #VC support in CpuExceptionHandlerLib. > >>>>>> - OvmfPkg VmgExitLib > >>>>>> - Remove the .uni file > >>>>>> - Update .inf file: > >>>>>> - New file location for VmgExitVcHandler.c > >>>>>> - Add additional Packages and LibraryClasses > >>>>>> - Introduce a header file to hold the #VC instruction parsing related > >>>>>> definitions > >>>>>> - Include additional #defines for instruction decoding to replace > >>>>>> hard coded values for things like instruction prefixes and escapes. > >>>>>> - Replace hardcoded CPUID values with values from existing header files > >>>>>> and use existing CR4 definition for accessing CR4 data. > >>>>>> - Change the type used for obtaining data addresses in the instruction > >>>>>> parsing > >>>>>> - Switch from INTN to UINT64 and use compiler conversions and casting > >>>>>> to perform the correct address calculation > >>>>>> - ResetVector code: > >>>>>> - Revert some inadvertant changes introduced in v7 for reserving the > >>>>>> SEV-ES work area memory and for checking the status of SEV-ES. > >>>>>> - AP Booting > >>>>>> - Provide support for non-broadcast INIT-SIPI-SIPI AP boot (minimize > >>>>>> code duplication by creating a function to set the AP jump table > >>>>>> vector address). > >>>>>> - Fix file/directory entry in maintainer changes. > >>>>>> - Various coding style fixes > >>>>>> - Commenting, if statements, etc. > >>>>>> - Various documentation style fixes > >>>>>> > >>>>>> Changes since v7: > >>>>>> - Reserve the SEV-ES workarea when S3 is enabled > >>>>>> - Fix warnings issued by the Visual Studio compiler > >>>>>> - Create a NULL VmgExitLib instance that is used for VMGEXIT > >>>>>> related operations as well as #VC handling. Then create the full > >>>>>> VmgExitLib support only in OvmfPkg - where it will be used. This > >>>>>> removes a bunch of implementation code from platforms that will > >>>>>> not be using the functionality. > >>>>>> - Remove single use interfaces from the VmgExitLib (VmgMmioWrite > >>>>>> and VmgSetApJumpTable) > >>>>>> > >>>>>> Changes since v6: > >>>>>> - Add function comments to all functions, including local functions > >>>>>> - Add function parameter direction to all functions (in/out) > >>>>>> - Add support for MMIO MOVZX/MOVSX instructions > >>>>>> - Ensure the per-CPU variable page remains encrypted > >>>>>> - Coding-style fixes as identified by Ecc > >>>>>> > >>>>>> Changes since v5: > >>>>>> - Remove extraneous VmgExitLib usage > >>>>>> - Miscellaneous changes to address feedback (coding style, etc.) > >>>>>> > >>>>>> Changes since v4: > >>>>>> - Move the SEV-ES protocol negotiation out of the SEC exception handler > >>>>>> and into the SecMain.c file. As a result: > >>>>>> - Move the SecGhcb related PCDs out of UefiCpuPkg and into OvmfPkg > >>>>>> - Combine SecAMDSevVcHandler.c and PeiDxeAMDSevVcHandler.c into a > >>>>>> single AMDSevVcHandler.c > >>>>>> - Consolidate VmgExitLib usage into common LibraryClasses sections > >>>>>> - Add documentation comments to the VmgExitLib functions > >>>>>> > >>>>>> Changes since v3: > >>>>>> - Remove the need for the MP library finalization routine. The AP > >>>>>> jump table address will be held by the hypervisor rather than > >>>>>> communicated via the GHCB MSR. This removes some fragility around > >>>>>> the UEFI to OS transition. > >>>>>> - Rename the SEV-ES RIP reset area to SEV-ES workarea and use it to > >>>>>> communicate the SEV-ES status, so that SEC CPU exception handling is > >>>>>> only established for an SEV-ES guest. > >>>>>> - Fix SMM build breakageAdd around QemuFlashPtrWrite(). > >>>>>> - Fix SMM build breakage by adding VC exception support the SMM CPU > >>>>>> exception handling. > >>>>>> - Add memory fencing around the invocation of AsmVmgExit(). > >>>>>> - Clarify comments around the SEV-ES AP reset RIP values and usage. > >>>>>> - Move some PCD definitions from MdeModulePkg to UefiCpuPkg. > >>>>>> - Remove the 16-bit code selector definition from MdeModulePkg > >>>>>> > >>>>>> Changes since v2: > >>>>>> - Added a way to locate the SEV-ES fixed AP RIP address for starting > >>>>>> AP's to avoid updating the actual flash image (build time location > >>>>>> that is identified with a GUID value). > >>>>>> - Create a VmgExit library to replace static inline functions. > >>>>>> - Move some PCDs to the appropriate packages > >>>>>> - Add support for writing to QEMU flash under SEV-ES > >>>>>> - Add additional MMIO opcode support > >>>>>> - Cleaned up the GHCB MSR CPUID protocol support > >>>>>> > >>>>>> Changes since v1: > >>>>>> - Patches reworked to be more specific to the component/area being > >>>>>> updated > >>>>>> and order of definition/usage > >>>>>> - Created a library for VMGEXIT-related functions to replace use of > >>>>>> inline > >>>>>> functions > >>>>>> - Allocation method for GDT changed from AllocatePool to > >>>>>> AllocatePages > >>>>>> - Early caching only enabled for SEV-ES guests > >>>>>> - Ensure AP loop mode set to halt loop mode for SEV-ES guests > >>>>>> - Reserved SEC GHCB-related memory areas when S3 is enabled > >>>>>> > >>>>>> Tom Lendacky (46): > >>>>>> MdeModulePkg: Create PCDs to be used in support of SEV-ES > >>>>>> UefiCpuPkg: Create PCD to be used in support of SEV-ES > >>>>>> MdePkg: Add the MSR definition for the GHCB register > >>>>>> MdePkg: Add a structure definition for the GHCB > >>>>>> MdeModulePkg/DxeIplPeim: Support GHCB pages when creating page tables > >>>>>> MdePkg/BaseLib: Add support for the XGETBV instruction > >>>>>> MdePkg/BaseLib: Add support for the VMGEXIT instruction > >>>>>> UefiCpuPkg: Implement library support for VMGEXIT > >>>>>> OvmfPkg: Prepare OvmfPkg to use the VmgExitLib library > >>>>>> UefiPayloadPkg: Prepare UefiPayloadPkg to use the VmgExitLib library > >>>>>> UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC > >>>>>> exception > >>>>>> OvmfPkg/VmgExitLib: Implement library support for VmgExitLib in OVMF > >>>>>> OvmfPkg/VmgExitLib: Add support for IOIO_PROT NAE events > >>>>>> OvmfPkg/VmgExitLib: Support string IO for IOIO_PROT NAE events > >>>>>> OvmfPkg/VmgExitLib: Add support for CPUID NAE events > >>>>>> OvmfPkg/VmgExitLib: Add support for MSR_PROT NAE events > >>>>>> OvmfPkg/VmgExitLib: Add support for NPF NAE events (MMIO) > >>>>>> OvmfPkg/VmgExitLib: Add support for WBINVD NAE events > >>>>>> OvmfPkg/VmgExitLib: Add support for RDTSC NAE events > >>>>>> OvmfPkg/VmgExitLib: Add support for RDPMC NAE events > >>>>>> OvmfPkg/VmgExitLib: Add support for INVD NAE events > >>>>>> OvmfPkg/VmgExitLib: Add support for VMMCALL NAE events > >>>>>> OvmfPkg/VmgExitLib: Add support for RDTSCP NAE events > >>>>>> OvmfPkg/VmgExitLib: Add support for MONITOR/MONITORX NAE events > >>>>>> OvmfPkg/VmgExitLib: Add support for MWAIT/MWAITX NAE events > >>>>>> OvmfPkg/VmgExitLib: Add support for DR7 Read/Write NAE events > >>>>>> OvmfPkg/MemEncryptSevLib: Add an SEV-ES guest indicator function > >>>>>> OvmfPkg: Add support to perform SEV-ES initialization > >>>>>> OvmfPkg: Create a GHCB page for use during Sec phase > >>>>>> OvmfPkg/PlatformPei: Reserve GHCB-related areas if S3 is supported > >>>>>> OvmfPkg: Create GHCB pages for use during Pei and Dxe phase > >>>>>> OvmfPkg/PlatformPei: Move early GDT into ram when SEV-ES is enabled > >>>>>> UefiCpuPkg: Create an SEV-ES workarea PCD > >>>>>> OvmfPkg: Reserve a page in memory for the SEV-ES usage > >>>>>> OvmfPkg/PlatformPei: Reserve SEV-ES work area if S3 is supported > >>>>>> OvmfPkg/ResetVector: Add support for a 32-bit SEV check > >>>>>> OvmfPkg/Sec: Add #VC exception handling for Sec phase > >>>>>> OvmfPkg/Sec: Enable cache early to speed up booting > >>>>>> OvmfPkg/QemuFlashFvbServicesRuntimeDxe: Bypass flash detection with > >>>>>> SEV-ES > >>>>>> UefiCpuPkg: Add a 16-bit protected mode code segment descriptor > >>>>>> UefiCpuPkg/MpInitLib: Add CPU MP data flag to indicate if SEV-ES is > >>>>>> enabled > >>>>>> UefiCpuPkg: Allow AP booting under SEV-ES > >>>>>> OvmfPkg: Use the SEV-ES work area for the SEV-ES AP reset vector > >>>>>> OvmfPkg: Move the GHCB allocations into reserved memory > >>>>>> UefiCpuPkg/MpInitLib: Prepare SEV-ES guest APs for OS use > >>>>>> Maintainers.txt: Add reviewers for the OvmfPkg SEV-related files > >>>>>> > >>>>>> MdeModulePkg/MdeModulePkg.dec | 9 + > >>>>>> OvmfPkg/OvmfPkg.dec | 9 + > >>>>>> UefiCpuPkg/UefiCpuPkg.dec | 17 + > >>>>>> OvmfPkg/OvmfPkgIa32.dsc | 6 + > >>>>>> OvmfPkg/OvmfPkgIa32X64.dsc | 6 + > >>>>>> OvmfPkg/OvmfPkgX64.dsc | 6 + > >>>>>> OvmfPkg/OvmfXen.dsc | 1 + > >>>>>> UefiCpuPkg/UefiCpuPkg.dsc | 2 + > >>>>>> UefiPayloadPkg/UefiPayloadPkgIa32.dsc | 2 + > >>>>>> UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc | 2 + > >>>>>> OvmfPkg/OvmfPkgX64.fdf | 9 + > >>>>>> MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf | 2 + > >>>>>> MdePkg/Library/BaseLib/BaseLib.inf | 4 + > >>>>>> OvmfPkg/Library/VmgExitLib/VmgExitLib.inf | 36 + > >>>>>> OvmfPkg/PlatformPei/PlatformPei.inf | 9 + > >>>>>> .../FvbServicesRuntimeDxe.inf | 2 + > >>>>>> OvmfPkg/ResetVector/ResetVector.inf | 8 + > >>>>>> OvmfPkg/Sec/SecMain.inf | 4 + > >>>>>> .../DxeCpuExceptionHandlerLib.inf | 1 + > >>>>>> .../PeiCpuExceptionHandlerLib.inf | 1 + > >>>>>> .../SecPeiCpuExceptionHandlerLib.inf | 1 + > >>>>>> .../SmmCpuExceptionHandlerLib.inf | 1 + > >>>>>> .../Xcode5SecPeiCpuExceptionHandlerLib.inf | 1 + > >>>>>> UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf | 4 + > >>>>>> UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf | 4 + > >>>>>> .../Library/VmgExitLibNull/VmgExitLibNull.inf | 27 + > >>>>>> .../Core/DxeIplPeim/X64/VirtualMemory.h | 12 +- > >>>>>> MdePkg/Include/Library/BaseLib.h | 31 + > >>>>>> MdePkg/Include/Register/Amd/Fam17Msr.h | 46 + > >>>>>> MdePkg/Include/Register/Amd/Ghcb.h | 166 ++ > >>>>>> .../IndustryStandard/InstructionParsing.h | 83 + > >>>>>> OvmfPkg/Include/Library/MemEncryptSevLib.h | 12 + > >>>>>> .../QemuFlash.h | 13 + > >>>>>> UefiCpuPkg/CpuDxe/CpuGdt.h | 4 +- > >>>>>> UefiCpuPkg/Include/Library/VmgExitLib.h | 103 + > >>>>>> UefiCpuPkg/Library/MpInitLib/MpLib.h | 68 +- > >>>>>> .../Core/DxeIplPeim/Ia32/DxeLoadFunc.c | 4 +- > >>>>>> .../Core/DxeIplPeim/X64/DxeLoadFunc.c | 11 +- > >>>>>> .../Core/DxeIplPeim/X64/VirtualMemory.c | 57 +- > >>>>>> .../MemEncryptSevLibInternal.c | 75 +- > >>>>>> OvmfPkg/Library/VmgExitLib/VmgExitLib.c | 159 ++ > >>>>>> OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 1716 +++++++++++++++++ > >>>>>> OvmfPkg/PlatformPei/AmdSev.c | 89 + > >>>>>> OvmfPkg/PlatformPei/MemDetect.c | 43 + > >>>>>> .../QemuFlash.c | 23 +- > >>>>>> .../QemuFlashDxe.c | 40 + > >>>>>> .../QemuFlashSmm.c | 16 + > >>>>>> OvmfPkg/Sec/SecMain.c | 188 +- > >>>>>> UefiCpuPkg/CpuDxe/CpuGdt.c | 8 +- > >>>>>> .../CpuExceptionCommon.c | 10 +- > >>>>>> .../PeiDxeSmmCpuException.c | 20 +- > >>>>>> .../SecPeiCpuException.c | 19 + > >>>>>> UefiCpuPkg/Library/MpInitLib/DxeMpLib.c | 120 +- > >>>>>> UefiCpuPkg/Library/MpInitLib/MpLib.c | 337 +++- > >>>>>> UefiCpuPkg/Library/MpInitLib/PeiMpLib.c | 19 + > >>>>>> .../Library/VmgExitLibNull/VmgExitLibNull.c | 121 ++ > >>>>>> UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 2 +- > >>>>>> Maintainers.txt | 10 + > >>>>>> MdeModulePkg/MdeModulePkg.uni | 8 + > >>>>>> MdePkg/Library/BaseLib/Ia32/VmgExit.nasm | 38 + > >>>>>> MdePkg/Library/BaseLib/Ia32/XGetBv.nasm | 31 + > >>>>>> MdePkg/Library/BaseLib/X64/VmgExit.nasm | 32 + > >>>>>> MdePkg/Library/BaseLib/X64/XGetBv.nasm | 34 + > >>>>>> OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm | 100 + > >>>>>> OvmfPkg/ResetVector/Ia32/PageTables64.asm | 351 +++- > >>>>>> OvmfPkg/ResetVector/ResetVector.nasmb | 20 + > >>>>>> .../X64/ExceptionHandlerAsm.nasm | 17 + > >>>>>> .../X64/Xcode5ExceptionHandlerAsm.nasm | 17 + > >>>>>> UefiCpuPkg/Library/MpInitLib/Ia32/MpEqu.inc | 2 +- > >>>>>> .../Library/MpInitLib/Ia32/MpFuncs.nasm | 20 +- > >>>>>> UefiCpuPkg/Library/MpInitLib/X64/MpEqu.inc | 4 +- > >>>>>> UefiCpuPkg/Library/MpInitLib/X64/MpFuncs.nasm | 369 +++- > >>>>>> .../Library/VmgExitLibNull/VmgExitLibNull.uni | 15 + > >>>>>> .../ResetVector/Vtf0/Ia16/Real16ToFlat32.asm | 9 + > >>>>>> UefiCpuPkg/UefiCpuPkg.uni | 11 + > >>>>>> 75 files changed, 4777 insertions(+), 100 deletions(-) create mode > >>>>>> 100644 OvmfPkg/Library/VmgExitLib/VmgExitLib.inf > >>>>>> create mode 100644 > >>>>>> UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.inf > >>>>>> create mode 100644 MdePkg/Include/Register/Amd/Ghcb.h > >>>>>> create mode 100644 > >>>>>> OvmfPkg/Include/IndustryStandard/InstructionParsing.h > >>>>>> create mode 100644 UefiCpuPkg/Include/Library/VmgExitLib.h > >>>>>> create mode 100644 OvmfPkg/Library/VmgExitLib/VmgExitLib.c > >>>>>> create mode 100644 OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c > >>>>>> create mode 100644 > >>>>>> UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.c > >>>>>> create mode 100644 MdePkg/Library/BaseLib/Ia32/VmgExit.nasm > >>>>>> create mode 100644 MdePkg/Library/BaseLib/Ia32/XGetBv.nasm > >>>>>> create mode 100644 MdePkg/Library/BaseLib/X64/VmgExit.nasm > >>>>>> create mode 100644 MdePkg/Library/BaseLib/X64/XGetBv.nasm > >>>>>> create mode 100644 OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm > >>>>>> create mode 100644 > >>>>>> UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.uni > >>>>>> > >>>>> > >>>>> For all patches except #10 ("UefiPayloadPkg: Prepare UefiPayloadPkg to > >>>>> use the VmgExitLib library") and #46 ("Maintainers.txt: > >> Add reviewers for the OvmfPkg SEV-related files"): > >>>>> > >>>>> Regression-tested-by: Laszlo Ersek <ler...@redhat.com> > >>>>> > >>>>> Thanks > >>>>> Laszlo > >>>>> > >>>> > >>> > >>> > >>> > >> > >> > > > > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64115): https://edk2.groups.io/g/devel/message/64115 Mute This Topic: https://groups.io/mt/76056465/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
