On Wed, Mar 20, 2024 at 10:55:35AM -0700, Isaku Yamahata wrote:
> On Wed, Mar 20, 2024 at 03:39:36AM -0500,
> Michael Roth <michael.roth@xxxxxxx> wrote:
>
> > From: Brijesh Singh <brijesh.singh@xxxxxxx>
> >
> > A recent version of OVMF expanded the reset vector GUID list to add
> > SEV-specific metadata GUID. The SEV metadata describes the reserved
> > memory regions such as the secrets and CPUID page used during the SEV-SNP
> > guest launch.
> >
> > The pc_system_get_ovmf_sev_metadata_ptr() is used to retieve the SEV
> > metadata pointer from the OVMF GUID list.
> >
> > Signed-off-by: Brijesh Singh <brijesh.singh@xxxxxxx>
> > Signed-off-by: Michael Roth <michael.roth@xxxxxxx>
> > ---
> > hw/i386/pc_sysfw_ovmf.c | 33 +++++++++++++++++++++++++++++++++
> > include/hw/i386/pc.h | 26 ++++++++++++++++++++++++++
> > 2 files changed, 59 insertions(+)
> >
> > diff --git a/hw/i386/pc_sysfw_ovmf.c b/hw/i386/pc_sysfw_ovmf.c
> > index 07a4c267fa..32efa34614 100644
> > --- a/hw/i386/pc_sysfw_ovmf.c
> > +++ b/hw/i386/pc_sysfw_ovmf.c
> > @@ -35,6 +35,31 @@ static const int bytes_after_table_footer = 32;
> > static bool ovmf_flash_parsed;
> > static uint8_t *ovmf_table;
> > static int ovmf_table_len;
> > +static OvmfSevMetadata *ovmf_sev_metadata_table;
> > +
> > +#define OVMF_SEV_META_DATA_GUID "dc886566-984a-4798-A75e-5585a7bf67cc"
> > +typedef struct __attribute__((__packed__)) OvmfSevMetadataOffset {
> > + uint32_t offset;
> > +} OvmfSevMetadataOffset;
> > +
> > +static void pc_system_parse_sev_metadata(uint8_t *flash_ptr, size_t flash_size)
> > +{
> > + OvmfSevMetadata *metadata;
> > + OvmfSevMetadataOffset *data;
> > +
> > + if (!pc_system_ovmf_table_find(OVMF_SEV_META_DATA_GUID, (uint8_t **)&data,
> > + NULL)) {
> > + return;
> > + }
> > +
> > + metadata = (OvmfSevMetadata *)(flash_ptr + flash_size - data->offset);
> > + if (memcmp(metadata->signature, "ASEV", 4) != 0) {
> > + return;
> > + }
> > +
> > + ovmf_sev_metadata_table = g_malloc(metadata->len);
> > + memcpy(ovmf_sev_metadata_table, metadata, metadata->len);
> > +}
> >
> > void pc_system_parse_ovmf_flash(uint8_t *flash_ptr, size_t flash_size)
> > {
> > @@ -90,6 +115,9 @@ void pc_system_parse_ovmf_flash(uint8_t *flash_ptr, size_t flash_size)
> > */
> > memcpy(ovmf_table, ptr - tot_len, tot_len);
> > ovmf_table += tot_len;
> > +
> > + /* Copy the SEV metadata table (if exist) */
> > + pc_system_parse_sev_metadata(flash_ptr, flash_size);
> > }
>
> Can we move this call to x86_firmware_configure() @ pc_sysfw.c, and move sev
> specific bits to somewhere to sev specific file? We don't have to parse sev
> metadata for non-SEV case, right?
>
> We don't have to touch common ovmf file. It also will be consistent with tdx
> case. TDX patch series adds tdx_parse_tdvf() to x86_firmware_configure().
Yep, makes sense to handle it similarly for SNP.
Thanks,
Mike
>
> thanks,
>
> >
> > /**
> > @@ -159,3 +187,8 @@ bool pc_system_ovmf_table_find(const char *entry, uint8_t **data,
> > }
> > return false;
> > }
> > +
> > +OvmfSevMetadata *pc_system_get_ovmf_sev_metadata_ptr(void)
> > +{
> > + return ovmf_sev_metadata_table;
> > +}
> > diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
> > index fb1d4106e5..df9a61540d 100644
> > --- a/include/hw/i386/pc.h
> > +++ b/include/hw/i386/pc.h
> > @@ -163,6 +163,32 @@ void pc_acpi_smi_interrupt(void *opaque, int irq, int level);
> > #define PCI_HOST_ABOVE_4G_MEM_SIZE "above-4g-mem-size"
> > #define PCI_HOST_PROP_SMM_RANGES "smm-ranges"
> >
> > +typedef enum {
> > + SEV_DESC_TYPE_UNDEF,
> > + /* The section contains the region that must be validated by the VMM. */
> > + SEV_DESC_TYPE_SNP_SEC_MEM,
> > + /* The section contains the SNP secrets page */
> > + SEV_DESC_TYPE_SNP_SECRETS,
> > + /* The section contains address that can be used as a CPUID page */
> > + SEV_DESC_TYPE_CPUID,
> > +
> > +} ovmf_sev_metadata_desc_type;
> > +
> > +typedef struct __attribute__((__packed__)) OvmfSevMetadataDesc {
> > + uint32_t base;
> > + uint32_t len;
> > + ovmf_sev_metadata_desc_type type;
> > +} OvmfSevMetadataDesc;
> > +
> > +typedef struct __attribute__((__packed__)) OvmfSevMetadata {
> > + uint8_t signature[4];
> > + uint32_t len;
> > + uint32_t version;
> > + uint32_t num_desc;
> > + OvmfSevMetadataDesc descs[];
> > +} OvmfSevMetadata;
> > +
> > +OvmfSevMetadata *pc_system_get_ovmf_sev_metadata_ptr(void);
> >
> > void pc_pci_as_mapping_init(MemoryRegion *system_memory,
> > MemoryRegion *pci_address_space);
> > --
> > 2.25.1
> >
> >
>
> --
> Isaku Yamahata <isaku.yamahata@xxxxxxxxx>
