| Message ID | 20240320083945.991426-41-michael.roth@amd.com |
|---|---|
| State | New |
| Headers | show |
| Series | Add AMD Secure Nested Paging (SEV-SNP) support | expand |
On Wed, Mar 20, 2024 at 03:39:36AM -0500, Michael Roth <michael.roth@amd.com> wrote: > From: Brijesh Singh <brijesh.singh@amd.com> > > A recent version of OVMF expanded the reset vector GUID list to add > SEV-specific metadata GUID. The SEV metadata describes the reserved > memory regions such as the secrets and CPUID page used during the SEV-SNP > guest launch. > > The pc_system_get_ovmf_sev_metadata_ptr() is used to retieve the SEV > metadata pointer from the OVMF GUID list. > > Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> > Signed-off-by: Michael Roth <michael.roth@amd.com> > --- > hw/i386/pc_sysfw_ovmf.c | 33 +++++++++++++++++++++++++++++++++ > include/hw/i386/pc.h | 26 ++++++++++++++++++++++++++ > 2 files changed, 59 insertions(+) > > diff --git a/hw/i386/pc_sysfw_ovmf.c b/hw/i386/pc_sysfw_ovmf.c > index 07a4c267fa..32efa34614 100644 > --- a/hw/i386/pc_sysfw_ovmf.c > +++ b/hw/i386/pc_sysfw_ovmf.c > @@ -35,6 +35,31 @@ static const int bytes_after_table_footer = 32; > static bool ovmf_flash_parsed; > static uint8_t *ovmf_table; > static int ovmf_table_len; > +static OvmfSevMetadata *ovmf_sev_metadata_table; > + > +#define OVMF_SEV_META_DATA_GUID "dc886566-984a-4798-A75e-5585a7bf67cc" > +typedef struct __attribute__((__packed__)) OvmfSevMetadataOffset { > + uint32_t offset; > +} OvmfSevMetadataOffset; > + > +static void pc_system_parse_sev_metadata(uint8_t *flash_ptr, size_t flash_size) > +{ > + OvmfSevMetadata *metadata; > + OvmfSevMetadataOffset *data; > + > + if (!pc_system_ovmf_table_find(OVMF_SEV_META_DATA_GUID, (uint8_t **)&data, > + NULL)) { > + return; > + } > + > + metadata = (OvmfSevMetadata *)(flash_ptr + flash_size - data->offset); > + if (memcmp(metadata->signature, "ASEV", 4) != 0) { > + return; > + } > + > + ovmf_sev_metadata_table = g_malloc(metadata->len); > + memcpy(ovmf_sev_metadata_table, metadata, metadata->len); > +} > > void pc_system_parse_ovmf_flash(uint8_t *flash_ptr, size_t flash_size) > { > @@ -90,6 +115,9 @@ void pc_system_parse_ovmf_flash(uint8_t *flash_ptr, size_t flash_size) > */ > memcpy(ovmf_table, ptr - tot_len, tot_len); > ovmf_table += tot_len; > + > + /* Copy the SEV metadata table (if exist) */ > + pc_system_parse_sev_metadata(flash_ptr, flash_size); > } Can we move this call to x86_firmware_configure() @ pc_sysfw.c, and move sev specific bits to somewhere to sev specific file? We don't have to parse sev metadata for non-SEV case, right? We don't have to touch common ovmf file. It also will be consistent with tdx case. TDX patch series adds tdx_parse_tdvf() to x86_firmware_configure(). thanks, > > /** > @@ -159,3 +187,8 @@ bool pc_system_ovmf_table_find(const char *entry, uint8_t **data, > } > return false; > } > + > +OvmfSevMetadata *pc_system_get_ovmf_sev_metadata_ptr(void) > +{ > + return ovmf_sev_metadata_table; > +} > diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h > index fb1d4106e5..df9a61540d 100644 > --- a/include/hw/i386/pc.h > +++ b/include/hw/i386/pc.h > @@ -163,6 +163,32 @@ void pc_acpi_smi_interrupt(void *opaque, int irq, int level); > #define PCI_HOST_ABOVE_4G_MEM_SIZE "above-4g-mem-size" > #define PCI_HOST_PROP_SMM_RANGES "smm-ranges" > > +typedef enum { > + SEV_DESC_TYPE_UNDEF, > + /* The section contains the region that must be validated by the VMM. */ > + SEV_DESC_TYPE_SNP_SEC_MEM, > + /* The section contains the SNP secrets page */ > + SEV_DESC_TYPE_SNP_SECRETS, > + /* The section contains address that can be used as a CPUID page */ > + SEV_DESC_TYPE_CPUID, > + > +} ovmf_sev_metadata_desc_type; > + > +typedef struct __attribute__((__packed__)) OvmfSevMetadataDesc { > + uint32_t base; > + uint32_t len; > + ovmf_sev_metadata_desc_type type; > +} OvmfSevMetadataDesc; > + > +typedef struct __attribute__((__packed__)) OvmfSevMetadata { > + uint8_t signature[4]; > + uint32_t len; > + uint32_t version; > + uint32_t num_desc; > + OvmfSevMetadataDesc descs[]; > +} OvmfSevMetadata; > + > +OvmfSevMetadata *pc_system_get_ovmf_sev_metadata_ptr(void); > > void pc_pci_as_mapping_init(MemoryRegion *system_memory, > MemoryRegion *pci_address_space); > -- > 2.25.1 > >
On Wed, Mar 20, 2024 at 10:55:35AM -0700, Isaku Yamahata wrote: > On Wed, Mar 20, 2024 at 03:39:36AM -0500, > Michael Roth <michael.roth@amd.com> wrote: > > > From: Brijesh Singh <brijesh.singh@amd.com> > > > > A recent version of OVMF expanded the reset vector GUID list to add > > SEV-specific metadata GUID. The SEV metadata describes the reserved > > memory regions such as the secrets and CPUID page used during the SEV-SNP > > guest launch. > > > > The pc_system_get_ovmf_sev_metadata_ptr() is used to retieve the SEV > > metadata pointer from the OVMF GUID list. > > > > Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> > > Signed-off-by: Michael Roth <michael.roth@amd.com> > > --- > > hw/i386/pc_sysfw_ovmf.c | 33 +++++++++++++++++++++++++++++++++ > > include/hw/i386/pc.h | 26 ++++++++++++++++++++++++++ > > 2 files changed, 59 insertions(+) > > > > diff --git a/hw/i386/pc_sysfw_ovmf.c b/hw/i386/pc_sysfw_ovmf.c > > index 07a4c267fa..32efa34614 100644 > > --- a/hw/i386/pc_sysfw_ovmf.c > > +++ b/hw/i386/pc_sysfw_ovmf.c > > @@ -35,6 +35,31 @@ static const int bytes_after_table_footer = 32; > > static bool ovmf_flash_parsed; > > static uint8_t *ovmf_table; > > static int ovmf_table_len; > > +static OvmfSevMetadata *ovmf_sev_metadata_table; > > + > > +#define OVMF_SEV_META_DATA_GUID "dc886566-984a-4798-A75e-5585a7bf67cc" > > +typedef struct __attribute__((__packed__)) OvmfSevMetadataOffset { > > + uint32_t offset; > > +} OvmfSevMetadataOffset; > > + > > +static void pc_system_parse_sev_metadata(uint8_t *flash_ptr, size_t flash_size) > > +{ > > + OvmfSevMetadata *metadata; > > + OvmfSevMetadataOffset *data; > > + > > + if (!pc_system_ovmf_table_find(OVMF_SEV_META_DATA_GUID, (uint8_t **)&data, > > + NULL)) { > > + return; > > + } > > + > > + metadata = (OvmfSevMetadata *)(flash_ptr + flash_size - data->offset); > > + if (memcmp(metadata->signature, "ASEV", 4) != 0) { > > + return; > > + } > > + > > + ovmf_sev_metadata_table = g_malloc(metadata->len); > > + memcpy(ovmf_sev_metadata_table, metadata, metadata->len); > > +} > > > > void pc_system_parse_ovmf_flash(uint8_t *flash_ptr, size_t flash_size) > > { > > @@ -90,6 +115,9 @@ void pc_system_parse_ovmf_flash(uint8_t *flash_ptr, size_t flash_size) > > */ > > memcpy(ovmf_table, ptr - tot_len, tot_len); > > ovmf_table += tot_len; > > + > > + /* Copy the SEV metadata table (if exist) */ > > + pc_system_parse_sev_metadata(flash_ptr, flash_size); > > } > > Can we move this call to x86_firmware_configure() @ pc_sysfw.c, and move sev > specific bits to somewhere to sev specific file? We don't have to parse sev > metadata for non-SEV case, right? > > We don't have to touch common ovmf file. It also will be consistent with tdx > case. TDX patch series adds tdx_parse_tdvf() to x86_firmware_configure(). Yep, makes sense to handle it similarly for SNP. Thanks, Mike > > thanks, > > > > > /** > > @@ -159,3 +187,8 @@ bool pc_system_ovmf_table_find(const char *entry, uint8_t **data, > > } > > return false; > > } > > + > > +OvmfSevMetadata *pc_system_get_ovmf_sev_metadata_ptr(void) > > +{ > > + return ovmf_sev_metadata_table; > > +} > > diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h > > index fb1d4106e5..df9a61540d 100644 > > --- a/include/hw/i386/pc.h > > +++ b/include/hw/i386/pc.h > > @@ -163,6 +163,32 @@ void pc_acpi_smi_interrupt(void *opaque, int irq, int level); > > #define PCI_HOST_ABOVE_4G_MEM_SIZE "above-4g-mem-size" > > #define PCI_HOST_PROP_SMM_RANGES "smm-ranges" > > > > +typedef enum { > > + SEV_DESC_TYPE_UNDEF, > > + /* The section contains the region that must be validated by the VMM. */ > > + SEV_DESC_TYPE_SNP_SEC_MEM, > > + /* The section contains the SNP secrets page */ > > + SEV_DESC_TYPE_SNP_SECRETS, > > + /* The section contains address that can be used as a CPUID page */ > > + SEV_DESC_TYPE_CPUID, > > + > > +} ovmf_sev_metadata_desc_type; > > + > > +typedef struct __attribute__((__packed__)) OvmfSevMetadataDesc { > > + uint32_t base; > > + uint32_t len; > > + ovmf_sev_metadata_desc_type type; > > +} OvmfSevMetadataDesc; > > + > > +typedef struct __attribute__((__packed__)) OvmfSevMetadata { > > + uint8_t signature[4]; > > + uint32_t len; > > + uint32_t version; > > + uint32_t num_desc; > > + OvmfSevMetadataDesc descs[]; > > +} OvmfSevMetadata; > > + > > +OvmfSevMetadata *pc_system_get_ovmf_sev_metadata_ptr(void); > > > > void pc_pci_as_mapping_init(MemoryRegion *system_memory, > > MemoryRegion *pci_address_space); > > -- > > 2.25.1 > > > > > > -- > Isaku Yamahata <isaku.yamahata@intel.com>
diff --git a/hw/i386/pc_sysfw_ovmf.c b/hw/i386/pc_sysfw_ovmf.c index 07a4c267fa..32efa34614 100644 --- a/hw/i386/pc_sysfw_ovmf.c +++ b/hw/i386/pc_sysfw_ovmf.c @@ -35,6 +35,31 @@ static const int bytes_after_table_footer = 32; static bool ovmf_flash_parsed; static uint8_t *ovmf_table; static int ovmf_table_len; +static OvmfSevMetadata *ovmf_sev_metadata_table; + +#define OVMF_SEV_META_DATA_GUID "dc886566-984a-4798-A75e-5585a7bf67cc" +typedef struct __attribute__((__packed__)) OvmfSevMetadataOffset { + uint32_t offset; +} OvmfSevMetadataOffset; + +static void pc_system_parse_sev_metadata(uint8_t *flash_ptr, size_t flash_size) +{ + OvmfSevMetadata *metadata; + OvmfSevMetadataOffset *data; + + if (!pc_system_ovmf_table_find(OVMF_SEV_META_DATA_GUID, (uint8_t **)&data, + NULL)) { + return; + } + + metadata = (OvmfSevMetadata *)(flash_ptr + flash_size - data->offset); + if (memcmp(metadata->signature, "ASEV", 4) != 0) { + return; + } + + ovmf_sev_metadata_table = g_malloc(metadata->len); + memcpy(ovmf_sev_metadata_table, metadata, metadata->len); +} void pc_system_parse_ovmf_flash(uint8_t *flash_ptr, size_t flash_size) { @@ -90,6 +115,9 @@ void pc_system_parse_ovmf_flash(uint8_t *flash_ptr, size_t flash_size) */ memcpy(ovmf_table, ptr - tot_len, tot_len); ovmf_table += tot_len; + + /* Copy the SEV metadata table (if exist) */ + pc_system_parse_sev_metadata(flash_ptr, flash_size); } /** @@ -159,3 +187,8 @@ bool pc_system_ovmf_table_find(const char *entry, uint8_t **data, } return false; } + +OvmfSevMetadata *pc_system_get_ovmf_sev_metadata_ptr(void) +{ + return ovmf_sev_metadata_table; +} diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h index fb1d4106e5..df9a61540d 100644 --- a/include/hw/i386/pc.h +++ b/include/hw/i386/pc.h @@ -163,6 +163,32 @@ void pc_acpi_smi_interrupt(void *opaque, int irq, int level); #define PCI_HOST_ABOVE_4G_MEM_SIZE "above-4g-mem-size" #define PCI_HOST_PROP_SMM_RANGES "smm-ranges" +typedef enum { + SEV_DESC_TYPE_UNDEF, + /* The section contains the region that must be validated by the VMM. */ + SEV_DESC_TYPE_SNP_SEC_MEM, + /* The section contains the SNP secrets page */ + SEV_DESC_TYPE_SNP_SECRETS, + /* The section contains address that can be used as a CPUID page */ + SEV_DESC_TYPE_CPUID, + +} ovmf_sev_metadata_desc_type; + +typedef struct __attribute__((__packed__)) OvmfSevMetadataDesc { + uint32_t base; + uint32_t len; + ovmf_sev_metadata_desc_type type; +} OvmfSevMetadataDesc; + +typedef struct __attribute__((__packed__)) OvmfSevMetadata { + uint8_t signature[4]; + uint32_t len; + uint32_t version; + uint32_t num_desc; + OvmfSevMetadataDesc descs[]; +} OvmfSevMetadata; + +OvmfSevMetadata *pc_system_get_ovmf_sev_metadata_ptr(void); void pc_pci_as_mapping_init(MemoryRegion *system_memory, MemoryRegion *pci_address_space);