OvmfPkg: Update Sec to support Tdx

RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429

There are below major changes in this commit.

1. SecEntry.nasm
In TDX BSP and APs goes to the same entry point in SecEntry.nasm.

BSP initialize the temporary stack and then jumps to SecMain, just as
legacy Ovmf does.

APs spin in a modified mailbox loop using initial mailbox structure.
Its structure defition is in OvmfPkg/Include/IndustryStandard/IntelTdx.h.
APs wait for command to see if the command is for me. If so execute the
command.

2. Sec/SecMain.c
When host VMM create the Td guest, the system memory informations are
stored in TdHob, which is a memory region described in Tdx metadata.
The system memory region in TdHob should be accepted before it can be
accessed. So the major task of this patch is to process the TdHobList
to accept the memory. After that TDVF follow the standard OVMF flow
and jump to PEI phase.

PcdUse1GPageTable is set to FALSE by default in OvmfPkgX64.dsc. It gives
no chance for Intel TDX to support 1G page table. To support 1G page
table this PCD is set to TRUE in OvmfPkgX64.dsc.

TDX_GUEST_SUPPORTED is defined in OvmfPkgX64.dsc. This macro wraps the
Tdx specific code.

TDX only works on X64, so the code is only valid in X64 arch.

Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>

diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
index 785049c88962f95671249bd54b064734bef3778d..c173a72134f44f45a072b11337170fd88faaaeaa 100644 (file)
--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
+++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
@@ -208,6 +208,7 @@
 [LibraryClasses.common]\r
   BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
   VmgExitLib|OvmfPkg/Library/VmgExitLib/VmgExitLib.inf\r
+  TdxLib|MdePkg/Library/TdxLib/TdxLib.inf\r
 \r
 [LibraryClasses.common.SEC]\r
   TimerLib|OvmfPkg/Library/AcpiTimerLib/BaseRomAcpiTimerLib.inf\r

diff --git a/OvmfPkg/Bhyve/BhyveX64.dsc b/OvmfPkg/Bhyve/BhyveX64.dsc
index 5fa08bebd73ca699efe78e20de3919413b4bd5a8..656e407473bbe0b6732c7c77bfa3662a2d97e86b 100644 (file)
--- a/OvmfPkg/Bhyve/BhyveX64.dsc
+++ b/OvmfPkg/Bhyve/BhyveX64.dsc
@@ -228,6 +228,7 @@
 [LibraryClasses.common]\r
   BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
   VmgExitLib|UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.inf\r
+  TdxLib|MdePkg/Library/TdxLib/TdxLib.inf\r
 \r
 [LibraryClasses.common.SEC]\r
 !ifdef $(DEBUG_ON_SERIAL_PORT)\r

diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc
index b8a82380202ce10727d556704ebdc2eebca986b8..c307f1cc75504b457984bda57469fdb1ff47b5b4 100644 (file)
--- a/OvmfPkg/CloudHv/CloudHvX64.dsc
+++ b/OvmfPkg/CloudHv/CloudHvX64.dsc
@@ -237,6 +237,7 @@
 [LibraryClasses.common]\r
   BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
   VmgExitLib|OvmfPkg/Library/VmgExitLib/VmgExitLib.inf\r
+  TdxLib|MdePkg/Library/TdxLib/TdxLib.inf\r
 \r
 [LibraryClasses.common.SEC]\r
   TimerLib|OvmfPkg/Library/AcpiTimerLib/BaseRomAcpiTimerLib.inf\r

diff --git a/OvmfPkg/Include/TdxCommondefs.inc b/OvmfPkg/Include/TdxCommondefs.inc
new file mode 100644 (file)
index 0000000..970eac9
--- /dev/null
+++ b/OvmfPkg/Include/TdxCommondefs.inc
@@ -0,0 +1,51 @@
+;------------------------------------------------------------------------------\r
+; @file\r
+; TDX Common defitions used by the APs in mailbox\r
+;\r
+; Copyright (c) 2021, Intel Corporation. All rights reserved.<BR>\r
+; SPDX-License-Identifier: BSD-2-Clause-Patent\r
+;\r
+;------------------------------------------------------------------------------\r
+\r
+CommandOffset                             equ       00h\r
+ApicidOffset                              equ       04h\r
+WakeupVectorOffset                        equ       08h\r
+OSArgsOffset                              equ       10h\r
+FirmwareArgsOffset                        equ       800h\r
+WakeupArgsRelocatedMailBox                equ       800h\r
+AcceptPageArgsPhysicalStart               equ       800h\r
+AcceptPageArgsPhysicalEnd                 equ       808h\r
+AcceptPageArgsChunkSize                   equ       810h\r
+AcceptPageArgsPageSize                    equ       818h\r
+CpuArrivalOffset                          equ       900h\r
+CpusExitingOffset                         equ       0a00h\r
+TalliesOffset                             equ       0a08h\r
+ErrorsOffset                              equ       0e08h\r
+\r
+SIZE_4KB                                  equ       1000h\r
+SIZE_2MB                                  equ       200000h\r
+SIZE_1GB                                  equ       40000000h\r
+\r
+PAGE_ACCEPT_LEVEL_4K                      equ       0\r
+PAGE_ACCEPT_LEVEL_2M                      equ       1\r
+PAGE_ACCEPT_LEVEL_1G                      equ       2\r
+\r
+TDX_PAGE_ALREADY_ACCEPTED                 equ       0x00000b0a\r
+TDX_PAGE_SIZE_MISMATCH                    equ       0xc0000b0b\r
+\r
+; Errors of APs in Mailbox\r
+ERROR_NON                                 equ       0\r
+ERROR_INVALID_ACCEPT_PAGE_SIZE            equ       1\r
+ERROR_ACCEPT_PAGE_ERROR                   equ       2\r
+ERROR_INVALID_FALLBACK_PAGE_LEVEL         equ       3\r
+\r
+MpProtectedModeWakeupCommandNoop          equ       0\r
+MpProtectedModeWakeupCommandWakeup        equ       1\r
+MpProtectedModeWakeupCommandSleep         equ       2\r
+MpProtectedModeWakeupCommandAcceptPages   equ       3\r
+\r
+MailboxApicIdInvalid                      equ       0xffffffff\r
+MailboxApicidBroadcast                    equ       0xfffffffe\r
+\r
+%define TDCALL_TDINFO                          0x1\r
+%define TDCALL_TDACCEPTPAGE                    0x6\r

diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
index 27005eec89f29dd214c5eb25208a3352aad80782..0eac0c02c6303fc90c40a54248f0e879f53cc967 100644 (file)
--- a/OvmfPkg/Microvm/MicrovmX64.dsc
+++ b/OvmfPkg/Microvm/MicrovmX64.dsc
@@ -232,6 +232,7 @@
   PlatformHookLib|MdeModulePkg/Library/BasePlatformHookLibNull/BasePlatformHookLibNull.inf\r
   FdtLib|EmbeddedPkg/Library/FdtLib/FdtLib.inf\r
   VirtioMmioDeviceLib|OvmfPkg/Library/VirtioMmioDeviceLib/VirtioMmioDeviceLib.inf\r
+  TdxLib|MdePkg/Library/TdxLib/TdxLib.inf\r
 \r
 [LibraryClasses.common.SEC]\r
   QemuFwCfgLib|OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgSecLib.inf\r

diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
index c58ef8494470fa39a3cfdf35363095a02740ea48..98a6748c62ddd8958ba7e6adc2c25b86957650d9 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -238,6 +238,8 @@
 [LibraryClasses.common]\r
   BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
   VmgExitLib|UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.inf\r
+  TdxLib|MdePkg/Library/TdxLib/TdxLib.inf\r
+  TdxMailboxLib|OvmfPkg/Library/TdxMailboxLib/TdxMailboxLib.inf\r
 \r
 [LibraryClasses.common.SEC]\r
   TimerLib|OvmfPkg/Library/AcpiTimerLib/BaseRomAcpiTimerLib.inf\r

diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index 227b9845619f07deb02940d4cc6cf3721326cc8d..2df5b299961094ce5034c2f7e8ad6b8311bc1732 100644 (file)
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -93,6 +93,13 @@
   INTEL:*_*_*_CC_FLAGS = /D DISABLE_NEW_DEPRECATED_INTERFACES\r
   GCC:*_*_*_CC_FLAGS = -D DISABLE_NEW_DEPRECATED_INTERFACES\r
 \r
+  #\r
+  # Add TDX_GUEST_SUPPORTED\r
+  #\r
+  MSFT:*_*_*_CC_FLAGS = /D TDX_GUEST_SUPPORTED\r
+  INTEL:*_*_*_CC_FLAGS = /D TDX_GUEST_SUPPORTED\r
+  GCC:*_*_*_CC_FLAGS = -D TDX_GUEST_SUPPORTED\r
+\r
 !include NetworkPkg/NetworkBuildOptions.dsc.inc\r
 \r
 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER]\r
@@ -238,6 +245,8 @@
 [LibraryClasses.common]\r
   BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
   VmgExitLib|OvmfPkg/Library/VmgExitLib/VmgExitLib.inf\r
+  TdxLib|MdePkg/Library/TdxLib/TdxLib.inf\r
+  TdxMailboxLib|OvmfPkg/Library/TdxMailboxLib/TdxMailboxLib.inf\r
 \r
 [LibraryClasses.common.SEC]\r
   TimerLib|OvmfPkg/Library/AcpiTimerLib/BaseRomAcpiTimerLib.inf\r
@@ -558,6 +567,10 @@
   gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesCode|0x100\r
   gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesData|0x100\r
 \r
+  #\r
+  # TDX need 1G PageTable support\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable|TRUE\r
+\r
   #\r
   # Network Pcds\r
   #\r
@@ -669,6 +682,7 @@
   OvmfPkg/Sec/SecMain.inf {\r
     <LibraryClasses>\r
       NULL|MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaCustomDecompressLib.inf\r
+      NULL|OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf\r
   }\r
 \r
   #\r

diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc
index efa97f09f32b73821ed69c7288af36c651e24228..aa27e2256ae9a3ffd3d9d13e2199e1b1e448aea0 100644 (file)
--- a/OvmfPkg/OvmfXen.dsc
+++ b/OvmfPkg/OvmfXen.dsc
@@ -227,6 +227,7 @@
 [LibraryClasses.common]\r
   BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
   VmgExitLib|UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.inf\r
+  TdxLib|MdePkg/Library/TdxLib/TdxLib.inf\r
 \r
 [LibraryClasses.common.SEC]\r
   QemuFwCfgLib|OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgSecLib.inf\r

diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c
index 02520e25ab9a8cb24353c29f5c3d5f245adc4fac..ca9717a7b526f8544df0d54c6dee4381250ccff0 100644 (file)
--- a/OvmfPkg/Sec/SecMain.c
+++ b/OvmfPkg/Sec/SecMain.c
@@ -26,9 +26,8 @@
 #include <Library/ExtractGuidedSectionLib.h>\r
 #include <Library/LocalApicLib.h>\r
 #include <Library/CpuExceptionHandlerLib.h>\r
-\r
 #include <Ppi/TemporaryRamSupport.h>\r
-\r
+#include <Library/PlatformInitLib.h>\r
 #include "AmdSev.h"\r
 \r
 #define SEC_IDT_ENTRY_COUNT  34\r
@@ -738,6 +737,20 @@ SecCoreStartupWithStack (
   UINT32                Index;\r
   volatile UINT8        *Table;\r
 \r
+ #if defined (TDX_GUEST_SUPPORTED)\r
+  if (TdIsEnabled ()) {\r
+    //\r
+    // For Td guests, the memory map info is in TdHobLib. It should be processed\r
+    // first so that the memory is accepted. Otherwise access to the unaccepted\r
+    // memory will trigger tripple fault.\r
+    //\r
+    if (ProcessTdxHobList () != EFI_SUCCESS) {\r
+      CpuDeadLoop ();\r
+    }\r
+  }\r
+\r
+ #endif\r
+\r
   //\r
   // To ensure SMM can't be compromised on S3 resume, we must force re-init of\r
   // the BaseExtractGuidedSectionLib. Since this is before library contructors\r
@@ -756,6 +769,7 @@ SecCoreStartupWithStack (
   // we use a loop rather than CopyMem.\r
   //\r
   IdtTableInStack.PeiService = NULL;\r
+\r
   for (Index = 0; Index < SEC_IDT_ENTRY_COUNT; Index++) {\r
     //\r
     // Declare the local variables that actually move the data elements as\r
@@ -813,6 +827,17 @@ SecCoreStartupWithStack (
     AsmEnableCache ();\r
   }\r
 \r
+ #if defined (TDX_GUEST_SUPPORTED)\r
+  if (TdIsEnabled ()) {\r
+    //\r
+    // InitializeCpuExceptionHandlers () should be called in Td guests so that\r
+    // #VE exceptions can be handled correctly.\r
+    //\r
+    InitializeCpuExceptionHandlers (NULL);\r
+  }\r
+\r
+ #endif\r
+\r
   DEBUG ((\r
     DEBUG_INFO,\r
     "SecCoreStartupWithStack(0x%x, 0x%x)\n",\r

diff --git a/OvmfPkg/Sec/SecMain.inf b/OvmfPkg/Sec/SecMain.inf
index 95cf0025e100c34961339ce5cd37431ec4c5f9a7..4b5b089ccd696efb812a8d015ae5cf00dda19f7f 100644 (file)
--- a/OvmfPkg/Sec/SecMain.inf
+++ b/OvmfPkg/Sec/SecMain.inf
@@ -77,6 +77,9 @@
   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase\r
   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecValidatedStart\r
   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecValidatedEnd\r
+  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupBase\r
+  gUefiOvmfPkgTokenSpaceGuid.PcdTdxAcceptPageSize\r
+  gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase\r
 \r
 [FeaturePcd]\r
   gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire\r

diff --git a/OvmfPkg/Sec/X64/SecEntry.nasm b/OvmfPkg/Sec/X64/SecEntry.nasm
index 1cc680a70716d45e6bf7222b36f954b49f397202..4528fec309a092ad42720c451cec58745deb8b88 100644 (file)
--- a/OvmfPkg/Sec/X64/SecEntry.nasm
+++ b/OvmfPkg/Sec/X64/SecEntry.nasm
@@ -10,12 +10,17 @@
 ;------------------------------------------------------------------------------\r
 \r
 #include <Base.h>\r
+%include "TdxCommondefs.inc"\r
 \r
 DEFAULT REL\r
 SECTION .text\r
 \r
 extern ASM_PFX(SecCoreStartupWithStack)\r
 \r
+%macro  tdcall  0\r
+  db  0x66, 0x0f, 0x01, 0xcc\r
+%endmacro\r
+\r
 ;\r
 ; SecCore Entry Point\r
 ;\r
@@ -35,6 +40,32 @@ extern ASM_PFX(SecCoreStartupWithStack)
 global ASM_PFX(_ModuleEntryPoint)\r
 ASM_PFX(_ModuleEntryPoint):\r
 \r
+    ;\r
+    ; Guest type is stored in OVMF_WORK_AREA\r
+    ;\r
+    %define OVMF_WORK_AREA        FixedPcdGet32 (PcdOvmfWorkAreaBase)\r
+    %define VM_GUEST_TYPE_TDX     2\r
+    mov     eax, OVMF_WORK_AREA\r
+    cmp     byte[eax], VM_GUEST_TYPE_TDX\r
+    jne     InitStack\r
+\r
+    mov     rax, TDCALL_TDINFO\r
+    tdcall\r
+\r
+    ;\r
+    ; R8  [31:0]  NUM_VCPUS\r
+    ;     [63:32] MAX_VCPUS\r
+    ; R9  [31:0]  VCPU_INDEX\r
+    ; Td Guest set the VCPU0 as the BSP, others are the APs\r
+    ; APs jump to spinloop and get released by DXE's MpInitLib\r
+    ;\r
+    mov     rax, r9\r
+    and     rax, 0xffff\r
+    test    rax, rax\r
+    jne     ParkAp\r
+\r
+InitStack:\r
+\r
     ;\r
     ; Fill the temporary RAM with the initial stack value.\r
     ; The loop below will seed the heap as well, but that's harmless.\r
@@ -67,3 +98,54 @@ ASM_PFX(_ModuleEntryPoint):
     sub     rsp, 0x20\r
     call    ASM_PFX(SecCoreStartupWithStack)\r
 \r
+    ;\r
+    ; Note: BSP never gets here. APs will be unblocked by DXE\r
+    ;\r
+    ; R8  [31:0]  NUM_VCPUS\r
+    ;     [63:32] MAX_VCPUS\r
+    ; R9  [31:0]  VCPU_INDEX\r
+    ;\r
+ParkAp:\r
+\r
+    mov     rbp,  r9\r
+\r
+.do_wait_loop:\r
+    mov     rsp, FixedPcdGet32 (PcdOvmfSecGhcbBackupBase)\r
+\r
+    ;\r
+    ; register itself in [rsp + CpuArrivalOffset]\r
+    ;\r
+    mov       rax, 1\r
+    lock xadd dword [rsp + CpuArrivalOffset], eax\r
+    inc       eax\r
+\r
+.check_arrival_cnt:\r
+    cmp       eax, r8d\r
+    je        .check_command\r
+    mov       eax, dword[rsp + CpuArrivalOffset]\r
+    jmp       .check_arrival_cnt\r
+\r
+.check_command:\r
+    mov     eax, dword[rsp + CommandOffset]\r
+    cmp     eax, MpProtectedModeWakeupCommandNoop\r
+    je      .check_command\r
+\r
+    cmp     eax, MpProtectedModeWakeupCommandWakeup\r
+    je      .do_wakeup\r
+\r
+    ; Don't support this command, so ignore\r
+    jmp     .check_command\r
+\r
+.do_wakeup:\r
+    ;\r
+    ; BSP sets these variables before unblocking APs\r
+    ;   RAX:  WakeupVectorOffset\r
+    ;   RBX:  Relocated mailbox address\r
+    ;   RBP:  vCpuId\r
+    ;\r
+    mov     rax, 0\r
+    mov     eax, dword[rsp + WakeupVectorOffset]\r
+    mov     rbx, [rsp + WakeupArgsRelocatedMailBox]\r
+    nop\r
+    jmp     rax\r
+    jmp     $\r