summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* OvmfPkg: Add VirtHstiDxe to OVMF firmware buildKonstantin Kostiuk2024-04-226-0/+9
| | | | | | | | Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* OvmfPkg: Add VirtHstiDxe driverKonstantin Kostiuk2024-04-225-0/+382
| | | | | | | | | | | | | | | | | | | The driver supports qemu machine types 'pc' and 'q35'. This patch adds some helper functions to manage the bitmasks. The implemented features depend on both OVMF build configuration and qemu VM configuration. For q35 a single security feature is supported and checked: In SMM-enabled builds the driver will verify smram is properly locked. That test should never fail. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Konstantin Kostiuk <kkostiuk@redhat.com> Initial-patch-by: Konstantin Kostiuk <kkostiuk@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* OvmfPkg/IntelTdx: Update TDVF READMEMin M Xu2024-04-221-26/+38
| | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4756 There are below updates in this patch: 1. Rename README to README.md so that it can be show as markdown document. 2. Update some information about TDVF. 2. Fix some typo. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* Maintainers: AMD as SPI driver stack maintainerAbner Chang2024-04-201-0/+11
| | | | | | | | Signed-off-by: Abner Chang <abner.chang@amd.com> Cc: Andrew Fish <afish@apple.com> Cc: Leif Lindholm <quic_llindhol@quicinc.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
* MdeModulePkg: Add SPI NOR FLash SFDP drivers to DSCabnchang2024-04-201-1/+3
| | | | | | | | | | | | | BZ#: 4471 SPI NOR Flash JEDEC Serial Flash Discoverable Driver implementation. Signed-off-by: Abner Chang <abner.chang@amd.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Abdul Lateef Attar <abdattar@amd.com> Cc: Brit Chesley <brit.chesley@amd.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* MdeModulePkg/SpiNorFlashJedecSfdp: SPI NOR Flash JEDEC SFDPabnchang2024-04-2011-0/+4166
| | | | | | | | | | | | | BZ#: 4471 SPI NOR Flash JEDEC Serial Flash Discoverable Driver implementation. Signed-off-by: Abner Chang <abner.chang@amd.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Ray Ni <ray.ni@intel.com> Cc: Abdul Lateef Attar <abdattar@amd.com> Cc: Brit Chesley <brit.chesley@amd.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* MdeModulePkg: Add definitions in DEC for SPI NOR Flash SFDP driverAbner Chang2024-04-201-1/+27
| | | | | | | | | | | BZ#: 4473 Signed-off-by: Abner Chang <abner.chang@amd.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Abdul Lateef Attar <abdattar@amd.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn> Reviewed-by: Abdul Lateef Attar <abdattar@amd.com>
* MdePkg/Include: Add SPI NOR Flash JEDEC SFDP header fileabnchang2024-04-201-0/+324
| | | | | | | | | | | | | | | | BZ#: 4472 Add definition of JEDEC Serial Flash Discoverable Parameters (SFDP) specification. https://www.jedec.org/standards-documents/docs/jesd216b Signed-off-by: Abner Chang <abner.chang@amd.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Cc: Abdul Lateef Attar <abdattar@amd.com> Cc: Brit Chesley <brit.chesley@amd.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn> Reviewed-by: Abdul Lateef Attar <abdattar@amd.com>
* MdePkg/Include: Update definitions of SPI related header filesabnchang2024-04-203-3/+35
| | | | | | | | | | | | | | BZ#: 4471 Update definitions according to PI spec 1.8 errata A Signed-off-by: Abner Chang <abner.chang@amd.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Cc: Abdul Lateef Attar <abdattar@amd.com> Cc: Brit Chesley <brit.chesley@amd.com> Reviewed-by: Abdul Lateef Attar <abdattar@amd.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* OvmfPkg/BaseMemEncryptLib: Check for presence of an SVSM when not at VMPL0Tom Lendacky2024-04-171-3/+6
| | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 Currently, an SEV-SNP guest will terminate if it is not running at VMPL0. The requirement for running at VMPL0 is removed if an SVSM is present. Update the current VMPL0 check to additionally check for the presence of an SVSM is the guest is not running at VMPL0. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* Ovmfpkg/CcExitLib: Provide SVSM discovery supportTom Lendacky2024-04-173-4/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 The SVSM specification documents an alternative method of discovery for the SVSM using a reserved CPUID bit and a reserved MSR. For the CPUID support, the #VC handler of an SEV-SNP guest should modify the returned value in the EAX register for the 0x8000001f CPUID function by setting bit 28 when an SVSM is present. For the MSR support, new reserved MSR 0xc001f000 has been defined. A #VC should be generated when accessing this MSR. The #VC handler is expected to ignore writes to this MSR and return the physical calling area address (CAA) on reads of this MSR. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* UefiCpuPkg/MpInitLib: AP creation support under an SVSMTom Lendacky2024-04-171-9/+19
| | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 When running under an SVSM, the VMPL level of the APs that are started must match the VMPL level provided by the SVSM. Additionally, each AP must have a Calling Area for use with the SVSM protocol. Update the AP creation to properly support running under an SVSM. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Ray Ni <ray.ni@intel.com> Acked-by: Ray Ni <ray.ni@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* OvmfPkg/AmdSvsmLib: Add support for the SVSM create/delete vCPU callsTom Lendacky2024-04-171-1/+53
| | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 The RMPADJUST instruction is used to alter the VMSA attribute of a page, but the VMSA attribute can only be changed when running at VMPL0. When an SVSM is present, use the SVSM_CORE_CREATE_VCPU and SVSM_CORE_DELTE_VCPU calls to add or remove the VMSA attribute on a page instead of issuing the RMPADJUST instruction directly. Implement the AmdSvsmSnpVmsaRmpAdjust() API to perform the proper operation to update the VMSA attribute. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* OvmfPkg/BaseMemEncryptSevLib: Maximize Page State Change efficiencyTom Lendacky2024-04-171-0/+7
| | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 Similar to the Page State Change optimization added previously, also take into account the possiblity of using the SVSM for PVALIDATE instructions. Conditionally adjust the maximum number of entries based on how many entries the SVSM calling area can support. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* OvmfPkg/AmdSvsmLib: Add support for the SVSM_CORE_PVALIDATE callTom Lendacky2024-04-171-1/+182
| | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 The PVALIDATE instruction can only be performed at VMPL0. An SVSM will be present when running at VMPL1 or higher. When an SVSM is present, use the SVSM_CORE_PVALIDATE call to perform memory validation instead of issuing the PVALIDATE instruction directly. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* OvmfPkg: Create a calling area used to communicate with the SVSMTom Lendacky2024-04-178-6/+42
| | | | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 An SVSM requires a calling area page whose address (CAA) is used by the SVSM to communicate and process the SVSM request. Add a pre-defined page area to the OvmfPkg and AmdSev packages and define corresponding PCDs used to communicate the location and size of the area. Keep the AmdSev package in sync with the OvmfPkg and adjust the AmdSev launch and hash area memory locations. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* OvmfPkg/BaseMemEncryptSevLib: Use AmdSvsmSnpPvalidate() to validate pagesTom Lendacky2024-04-174-74/+9
| | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 The PVALIDATE instruction is used to change the SNP validation of a page, but that can only be done when running at VMPL0. To prepare for running at a less priviledged VMPL, use the AmdSvsmLib library API to perform the PVALIDATE. The AmdSvsmLib library will perform the proper operation on behalf of the caller. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com>
* UefiCpuPkg/MpInitLib: Use AmdSvsmSnpVmsaRmpAdjust() to set/clear VMSATom Lendacky2024-04-175-81/+9
| | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 The RMPADJUST instruction is used to change the VMSA attribute of a page, but the VMSA attribute can only be changed when running at VMPL0. To prepare for running at a less priviledged VMPL, use the AmdSvsmLib library API to perform the RMPADJUST. The AmdSvsmLib library will perform the proper operation on behalf of the caller. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Ray Ni <ray.ni@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Acked-by: Ray Ni <ray.ni@intel.com>
* Ovmfpkg/AmdSvsmLib: Create AmdSvsmLib to handle SVSM related servicesTom Lendacky2024-04-176-4/+309
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 Add initial support for the new AmdSvsmLib library to OvmfPkg. The initial implementation fully implements the library interfaces. The SVSM presence check, AmdSvsmIsSvsmPresent(), determines the presence of an SVSM by checking if an SVSM has been advertised in the SEV-SNP Secrets Page. The VMPL API, AmdSvsmSnpGetVmpl(), returns the VMPL level at which OVMF is currently running. The CAA API, AmdSvsmSnpGetCaa(), returns the Calling Area Address when an SVSM is present, 0 otherwise. The PVALIDATE API, AmdSvsmSnpPvalidate(), copies the PVALIDATE logic from the BaseMemEncryptSevLib library for the initial implementation. The BaseMemEncryptSevLib library will be changed to use this new API so that the decision as to whether the SVSM is needed to perform the operation can be isolated to this library. The VMSA API, AmdSvsmSnpVmsaRmpAdjust(), copies the RMPUPDATE logic from the MpInitLib library for the initial implementation. The MpInitLib library will be changed to use this new API so that the decision as to whether the SVSM is needed to perform the operation can be isolated to this library. Cc: Anatol Belski <anbelski@linux.microsoft.com> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jianyong Wu <jianyong.wu@arm.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com>
* Ovmfpkg: Prepare OvmfPkg to use the AmdSvsmLib libraryTom Lendacky2024-04-179-1/+10
| | | | | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 The MpInitLib library will be updated to use the new AmdSvsmLib library. To prevent any build breakage, update the OvmfPkg DSCs file to include the AmdSvsmLib NULL library. Cc: Anatol Belski <anbelski@linux.microsoft.com> Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Corvin Köhne <corvink@freebsd.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jianyong Wu <jianyong.wu@arm.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Cc: Rebecca Cran <rebecca@bsdio.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com>
* UefiPayloadPkg: Prepare UefiPayloadPkg to use the AmdSvsmLib libraryTom Lendacky2024-04-171-0/+1
| | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 The MpInitLib library will be updated to use the new AmdSvsmLib library. To prevent any build breakage, update the UefiPayloadPkg DSC file to include the AmdSvsmLib NULL library. Cc: Gua Guo <gua.guo@intel.com> Cc: Guo Dong <guo.dong@intel.com> Cc: James Lu <james.lu@intel.com> Cc: Sean Rhodes <sean@starlabs.systems> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Reviewed-by: Guo Dong <guo.dong@intel.com>
* UefiCpuPkg/AmdSvsmLib: Create the AmdSvsmLib library to support an SVSMTom Lendacky2024-04-176-1/+255
| | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 In order to support an SEV-SNP guest running under an SVSM at VMPL1 or lower, a new library must be created. This library includes an interface to detect if running under an SVSM, an interface to return the current VMPL, an interface to perform memory validation and an interface to set or clear the attribute that allows a page to be used as a VMSA. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Ray Ni <ray.ni@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Acked-by: Ray Ni <ray.ni@intel.com>
* MdePkg/BaseLib: Add a new VMGEXIT instruction invocation for SVSMTom Lendacky2024-04-174-0/+174
| | | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 The SVSM specification relies on a specific register calling convention to hold the parameters that are associated with the SVSM request. The SVSM is invoked by requesting the hypervisor to run the VMPL0 VMSA of the guest using the GHCB MSR Protocol or a GHCB NAE event. Create a new version of the VMGEXIT instruction that will adhere to this calling convention and load the SVSM function arguments into the proper register before invoking the VMGEXIT instruction. On return, perform the atomic exchange on the SVSM call pending value as specified in the SVSM specification. Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* MdePkg/Register/Amd: Define the SVSM related informationTom Lendacky2024-04-174-2/+156
| | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 The Secure VM Service Module specification defines the interfaces needed to allow multi-VMPL level execution of an SEV-SNP guest. Define the SVSM related structures for the SVSM Calling Area as well as the SVSM CAA MSR. The SVSM CAA MSR is an MSR register that is reserved for software use and will not be implemented in hardware. Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* OvmfPkg/BaseMemEncryptSevLib: Maximize Page State Change efficiencyTom Lendacky2024-04-171-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 When building the Page State Change entries for a range of memory, it can happen that multiple calls to BuildPageStateBuffer() need to be made. If the size of the input work area passed to BuildPageStateBuffer() exceeds the number of entries that can be passed to the hypervisor using the GHCB shared buffer, the Page State Change VMGEXIT support will issue multiple VMGEXITs to process all entries in the buffer. However, it could be that the final VMGEXIT for each round of Page State Changes is only for a small number of entries and subsequent VMGEXITs may still be issued to handle the full range of memory requested. To maximize the number of entries processed during the Page State Change VMGEXIT, limit BuildPageStateBuffer() to not build entries that exceed the maximum number of entries that can be handled in a single Page State Change VMGEXIT. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* OvmfPkg/BaseMemEncryptSevLib: Re-organize page state change supportTom Lendacky2024-04-177-52/+146
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 In preparation for running under an SVSM at VMPL1 or higher (higher numerically, lower privilege), re-organize the way a page state change is performed in order to free up the GHCB for use by the SVSM support. Currently, the page state change logic directly uses the GHCB shared buffer to build the page state change structures. However, this will be in conflict with the use of the GHCB should an SVSM call be required. Instead, use a separate buffer (an area in the workarea during SEC and an allocated page during PEI/DXE) to hold the page state change request and only update the GHCB shared buffer as needed. Since the information is copied to, and operated on, in the GHCB shared buffer this has the added benefit of not requiring to save the start and end entries for use when validating the memory during the page state change sequence. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com>
* MdePkg: Avoid hardcoded value for number of Page State Change entriesTom Lendacky2024-04-171-3/+4
| | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 The SNP_PAGE_STATE_MAX_ENTRY is based on the number of entries that can fit in the GHCB shared buffer. As a result, the SNP_PAGE_STATE_CHANGE_INFO structure maps the full GHCB shared buffer based on the shared buffer size being 2032 bytes. Instead of using a hardcoded value for SNP_PAGE_STATE_MAX_ENTRY, use a build calculated value. Since the SNP_PAGE_STATE_CHANGE_INFO is used as a mapping, eliminate the hardcoded array size so that the structure can be used based on any size buffer. Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com>
* OvmfPkg/BaseMemEncryptSevLib: Calculate memory size for Page State ChangeTom Lendacky2024-04-171-4/+8
| | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 Calculate the amount of memory that can be use to build the Page State Change data (SNP_PAGE_STATE_CHANGE_INFO) instead of using a hard-coded size. This allows for changes to the GHCB shared buffer size without having to make changes to the page state change code. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* OvmfPkg/BaseMemEncryptSevLib: Fix uncrustify errorsTom Lendacky2024-04-171-12/+15
| | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 In prep for follow-on patches, fix an area of the code that does not meet the uncrustify coding standards. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* OvmfPkg/PlatformPei: Retrieve APIC IDs from the hypervisorTom Lendacky2024-04-172-1/+92
| | | | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 If the hypervisor supports retrieval of the vCPU APIC IDs, retrieve them before any APs are actually started. The APIC IDs can be used to start the APs for any SEV-SNP guest, but is a requirement for an SEV-SNP guest that is running under an SVSM. After retrieving the APIC IDs, save the address of the APIC ID data structure in a GUIDed HOB. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* UefiCpuPkg/MpInitLib: Always use AP Create if GhcbApicIds HOB is presentTom Lendacky2024-04-178-14/+133
| | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 Currently, the first time an AP is started for an SEV-SNP guest, it relies on the VMSA as set by the hypervisor. If the list of APIC IDs has been retrieved, this is not necessary. The list of APIC IDs will be identified by a GUIDed HOB. If the GUIDed HOB is present, use the SEV-SNP AP Create protocol to start the AP for the first time and each time thereafter. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Ray Ni <ray.ni@intel.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Acked-by: Ray Ni <ray.ni@intel.com>
* MdePkg: GHCB APIC ID retrieval support definitionsTom Lendacky2024-04-171-1/+11
| | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 When an SVSM is present, starting the APs requires knowledge of the APIC IDs. Create the definitions required to retrieve and hold the APIC ID information of all the vCPUs present in the guest. Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* OvmfPkg/BaseMemEncryptLib: Fix error check from AsmRmpAdjust()Tom Lendacky2024-04-171-4/+4
| | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 The AsmRmpAdjust() function returns a UINT32, however in SevSnpIsVmpl0() the return value is checked with EFI_ERROR() when it should just be compared to 0. Fix the error check. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* SecurityPkg: Delete TdTcg2Dxe and HashLibTdx in SecurityPkgMin M Xu2024-04-176-3293/+0
| | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4752 TdTcg2Dxe and HashLibTdx have been moved to OvmfPkg. So delete the codes in SecurityPkg and update SecurityPkg.dsc. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* OvmfPkg: Update TdTcg2Dxe path in OvmfPkgX64 and IntelTdxX64.dscMin M Xu2024-04-174-6/+6
| | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4752 Previously the TdTcg2Dxe and its corresponding HashLibTdx were in SecurityPkg. This patch updates the paths in OvmfPkgX64.dsc and IntelTdxX64.dsc after TdTcg2Dxe and HashLibTdxLib have been moved to OvmfPkg. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* OvmfPkg/TdTcg2Dxe: Add TdTcg2DxeMin M Xu2024-04-173-0/+3029
| | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4752 This library is the one of SecurityPkg/Tcg/TdTcg2Dxe. It is designed for Intel TDX enlightened OVMF. So moving it from SecurityPkg to OvmfPkg. To prevent breaking the build, the moving is splitted into 2 patch. SecurityPkg/Tcg/TdTcg2Dxe will be deleted in the next patch. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* OmvfPkg/HashLibTdx: Add HashLibTdxMin M Xu2024-04-172-0/+250
| | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4752 This library is the one of SecurityPkg/Library/HashLibTdx. It is designed for Intel TDX enlightened OVMF. So moving it from SecurityPkg to OvmfPkg. To prevent breaking the build, the moving is splitted into 2 patch. SecurityPkg/Library/HashLibTdx will be deleted in the next patch. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* Security/SecTpmMeasurementLibTdx: Delete unused SecTpmMeasurementLibTdxMin M Xu2024-04-173-211/+0
| | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4752 Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* NetworkPkg/WifiConnectionManagerDxe: Update UI according to UEFI specLiqi Liu2024-04-161-39/+74
| | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4736 In UEFI_Spec_2_10_Aug29.pdf page 1694 section 35.5.4 for EFI_BROWSER_ACTION_FORM_OPEN: NOTE: EFI_FORM_BROWSER2_PROTOCOL.BrowserCallback() cannot be used with this browser action because question values have not been retrieved yet. So should not call HiiGetBrowserData() and HiiSetBrowserData() in FORM_OPEN call back function. Now use wifi list key and enroll cert key instead of the connect action key, move wifi info display from open action to close action. Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Cc: Felix Polyudov <Felixp@ami.com> Signed-off-by: Liqi Liu <liqi.liu@intel.com> Reviewed-by: Zachary Clark-williams <zachary.clark-williams@intel.com> Acked-by: Michael D Kinney <michael.d.kinney@intel.com>
* SecurityPkg/OpalPasswordDxe: Force reparsing IFR binary when RETRIEVECindyX Kuo2024-04-165-12/+86
| | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4735 When change callback action from FORM_OPEN to RETRIEVE, it is observed that NVNE disks will not be displayed when the user enters the formset at the first time. Revisit the formset can see the update. 1. Add HiiUpdateForm() to force reparsing the IFR binary when RETRIEVE. 2. Create dummy label with suppressif statement in VFR for form update usage. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Cc: Ming Tan <ming.tan@intel.com> Cc: Arthur Chen <arthur.g.chen@intel.com> Cc: Xiao X Chen <xiao.x.chen@intel.com> Cc: Tina Chen <tina.chen@intel.com> Signed-off-by: CindyX Kuo <cindyx.kuo@intel.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Tina Chen <tina.chen@intel.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/OpalPasswordDxe: Change callback action to meet UEFI specCindy Kuo2024-04-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4735 Should not call HiiGetBrowserData() and HiiSetBrowserData() in ACTION_FORM_OPEN callback function. Those APIs are called within OpalHiiSetBrowserData/OpalHiiGetBrowserData which have been used by OpalHii.c. Change callback action from FORM_OPEN to RETRIEVE to meet UEFI spec. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Cc: Ming Tan <ming.tan@intel.com> Cc: Arthur Chen <arthur.g.chen@intel.com> Cc: Xiao X Chen <xiao.x.chen@intel.com> Cc: Tina Chen <tina.chen@intel.com> Signed-off-by: CindyX Kuo <cindyx.kuo@intel.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Tina Chen <tina.chen@intel.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* ShellPkg/SmbiosView: Support New ProcessorUpgrade for SMBIOS Type4Jason Lou2024-04-161-1/+29
| | | | | | | | | | | | | The patch updates SmbiosView to support new ProcessorUpgrade for SMBIOS Type4 based on SMBIOS 3.8.0. Signed-off-by: Jason Lou <yun.lou@intel.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn> Reviewed-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Zhichao Gao <zhichao.gao@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Star Zeng <star.zeng@intel.com> Cc: Zhichao Gao <zhichao.gao@intel.com>
* MdePkg/SmBios.h: Add New ProcessorUpgrade definitions for SMBIOS Type4Jason Lou2024-04-161-1/+8
| | | | | | | | | | | | | | | | | | The patch adds new ProcessorUpgrade definitions for SMBIOS Type4 based on SMBIOS 3.8.0. Signed-off-by: Jason Lou <yun.lou@intel.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn> Reviewed-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Zhichao Gao <zhichao.gao@intel.com> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Cc: Star Zeng <star.zeng@intel.com> Cc: Zhichao Gao <zhichao.gao@intel.com> Cc: Benny Lin <benny.lin@intel.com> Cc: Gua Guo <gua.guo@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn>
* UefiCpuPkg/UefiCpuPkg.dsc: Add CpuMmio2Dxe.inf to LoongArch64 fieldChao Li2024-04-161-0/+1
| | | | | | | | | | LoongArch64 requires CpuMmio2Dxe, add it into LoongArch64 field. Cc: Ray Ni <ray.ni@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Chao Li <lichao@loongson.cn> Reviewed-by: Ray Ni <ray.ni@intel.com>
* UefiCpuPkg: Add CpuDxe driver for LoongArch64Chao Li2024-04-165-4/+1527
| | | | | | | | | | | | | | | Added LoongArch64 CPU driver into CpuDxe. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4734 Cc: Ray Ni <ray.ni@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Chao Li <lichao@loongson.cn> Co-authored-by: Baoqi Zhang <zhangbaoqi@loongson.cn> Co-authored-by: Dongyan Qian <qiandongyan@loongson.cn> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Ray Ni <ray.ni@intel.com>
* UefiCpuPkg: Add multiprocessor library for LoongArch64Chao Li2024-04-166-12/+2871
| | | | | | | | | | | | | Added LoongArch multiprocessor initialization instance into MpInitLib. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4734 Cc: Ray Ni <ray.ni@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Chao Li <lichao@loongson.cn> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Ray Ni <ray.ni@intel.com>
* UefiCpuPkg: Add a new GUID to store the processors resourceChao Li2024-04-162-0/+32
| | | | | | | | | | | | | On a multi-processor system, if the BSP dose not know how many APs are online or cannot wake up the AP via broadcast, it can collect AP resouces before wakeing up the AP and add a new HOB to save the processor resouces. Cc: Ray Ni <ray.ni@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Chao Li <lichao@loongson.cn> Reviewed-by: Ray Ni <ray.ni@intel.com>
* UefiCpuPkg: Add CpuMmuLib to UefiCpuPkgChao Li2024-04-169-0/+1008
| | | | | | | | | | | | | | | | | | Add a new base library named CpuMmuLib and add a LoongArch64 instance with in the library. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4734 Cc: Ray Ni <ray.ni@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Chao Li <lichao@loongson.cn> Co-authored-by: Baoqi Zhang <zhangbaoqi@loongson.cn> Co-authored-by: Dongyan Qian <qiandongyan@loongson.cn> Co-authored-by: Xianglai Li <lixianglai@loongson.cn> Co-authored-by: Bibo Mao <maobibo@loongson.cn> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Ray Ni <ray.ni@intel.com>
* UefiCpuPkg: Added a new PCD named PcdLoongArchExceptionVectorBaseAddressChao Li2024-04-161-0/+6
| | | | | | | | | | | | | | | Added PcdLoongArchExceptionVectorBaseAddress use for storing the CPU exception vector base address. This PCD can be populated at build time or changed at runtime, and is used only by LoongArch. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4734 Cc: Ray Ni <ray.ni@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Chao Li <lichao@loongson.cn> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Ray Ni <ray.ni@intel.com>
* UefiCpuPkg: Add CpuMmuLib.h to UefiCpuPkgChao Li2024-04-162-0/+45
| | | | | | | | | | | | | | | | | | | | | Add a new header file CpuMmuLib.h, whitch is referenced from ArmPkg/Include/Library/ArmMmuLib.h. Currently, only support for LoongArch64 is added, and more architectures can be accommodated in the future. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4734 Cc: Ray Ni <ray.ni@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Leif Lindholm <quic_llindhol@quicinc.com> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Sami Mujawar <sami.mujawar@arm.com> Cc: Sunil V L <sunilvl@ventanamicro.com> Cc: Andrei Warkentin <andrei.warkentin@intel.com> Signed-off-by: Chao Li <lichao@loongson.cn> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Ray Ni <ray.ni@intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 18:08:55 +0000