OvmfPkg: introduce a common work area
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Both the TDX and SEV support needs to reserve a page in MEMFD as a work
area. The page will contain meta data specific to the guest type.
Currently, the SEV-ES support reserves a page in MEMFD
(PcdSevEsWorkArea) for the work area. This page can be reused as a TDX
work area when Intel TDX is enabled.
Based on the discussion [1], it was agreed to rename the SevEsWorkArea
to the OvmfWorkArea, and add a header that can be used to indicate the
work area type.
[1] https://edk2.groups.io/g/devel/message/78262?p=,,,20,0,0,0::\
created,0,SNP,20,2,0,84476064
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Reviewed-by: Min Xu <min.m.xu@intel.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
2021-08-17 15:46:49 +02:00
|
|
|
/** @file
|
|
|
|
|
|
|
|
Work Area structure definition
|
|
|
|
|
|
|
|
Copyright (c) 2021, AMD Inc.
|
|
|
|
|
|
|
|
SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
|
|
**/
|
|
|
|
|
|
|
|
#ifndef __OVMF_WORK_AREA_H__
|
|
|
|
#define __OVMF_WORK_AREA_H__
|
|
|
|
|
2022-04-19 02:26:23 +02:00
|
|
|
#include <ConfidentialComputingGuestAttr.h>
|
2023-02-03 04:31:36 +01:00
|
|
|
#include <IndustryStandard/Tpm20.h>
|
OvmfPkg: introduce a common work area
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Both the TDX and SEV support needs to reserve a page in MEMFD as a work
area. The page will contain meta data specific to the guest type.
Currently, the SEV-ES support reserves a page in MEMFD
(PcdSevEsWorkArea) for the work area. This page can be reused as a TDX
work area when Intel TDX is enabled.
Based on the discussion [1], it was agreed to rename the SevEsWorkArea
to the OvmfWorkArea, and add a header that can be used to indicate the
work area type.
[1] https://edk2.groups.io/g/devel/message/78262?p=,,,20,0,0,0::\
created,0,SNP,20,2,0,84476064
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Reviewed-by: Min Xu <min.m.xu@intel.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
2021-08-17 15:46:49 +02:00
|
|
|
|
|
|
|
//
|
|
|
|
// Confidential computing work area header definition. Any change
|
|
|
|
// to the structure need to be kept in sync with the
|
|
|
|
// PcdOvmfConfidentialComputingWorkAreaHeader.
|
|
|
|
//
|
2021-09-17 07:37:24 +02:00
|
|
|
// PcdOvmfConfidentialComputingWorkAreaHeader ==
|
|
|
|
// sizeof (CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER)
|
|
|
|
// PcdOvmfConfidentialComputingWorkAreaHeader defined in:
|
|
|
|
// OvmfPkg/OvmfPkg.dec
|
2022-12-09 14:03:48 +01:00
|
|
|
// OvmfPkg/Include/Fdf/OvmfPkgDefines.fdf.inc
|
OvmfPkg: introduce a common work area
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Both the TDX and SEV support needs to reserve a page in MEMFD as a work
area. The page will contain meta data specific to the guest type.
Currently, the SEV-ES support reserves a page in MEMFD
(PcdSevEsWorkArea) for the work area. This page can be reused as a TDX
work area when Intel TDX is enabled.
Based on the discussion [1], it was agreed to rename the SevEsWorkArea
to the OvmfWorkArea, and add a header that can be used to indicate the
work area type.
[1] https://edk2.groups.io/g/devel/message/78262?p=,,,20,0,0,0::\
created,0,SNP,20,2,0,84476064
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Reviewed-by: Min Xu <min.m.xu@intel.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
2021-08-17 15:46:49 +02:00
|
|
|
typedef struct _CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER {
|
|
|
|
UINT8 GuestType;
|
|
|
|
UINT8 Reserved1[3];
|
|
|
|
} CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER;
|
|
|
|
|
|
|
|
//
|
|
|
|
// Internal structure for holding SEV-ES information needed during SEC phase
|
|
|
|
// and valid only during SEC phase and early PEI during platform
|
|
|
|
// initialization.
|
|
|
|
//
|
|
|
|
// This structure is also used by assembler files:
|
|
|
|
// OvmfPkg/ResetVector/ResetVector.nasmb
|
|
|
|
// OvmfPkg/ResetVector/Ia32/PageTables64.asm
|
|
|
|
// OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm
|
|
|
|
// any changes must stay in sync with its usage.
|
|
|
|
//
|
|
|
|
typedef struct _SEC_SEV_ES_WORK_AREA {
|
2022-02-21 15:59:13 +01:00
|
|
|
//
|
|
|
|
// Hold the SevStatus MSR value read by OvmfPkg/ResetVector/Ia32/AmdSev.c
|
|
|
|
//
|
|
|
|
UINT64 SevStatusMsrValue;
|
OvmfPkg: introduce a common work area
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Both the TDX and SEV support needs to reserve a page in MEMFD as a work
area. The page will contain meta data specific to the guest type.
Currently, the SEV-ES support reserves a page in MEMFD
(PcdSevEsWorkArea) for the work area. This page can be reused as a TDX
work area when Intel TDX is enabled.
Based on the discussion [1], it was agreed to rename the SevEsWorkArea
to the OvmfWorkArea, and add a header that can be used to indicate the
work area type.
[1] https://edk2.groups.io/g/devel/message/78262?p=,,,20,0,0,0::\
created,0,SNP,20,2,0,84476064
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Reviewed-by: Min Xu <min.m.xu@intel.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
2021-08-17 15:46:49 +02:00
|
|
|
|
|
|
|
UINT64 RandomData;
|
|
|
|
|
|
|
|
UINT64 EncryptionMask;
|
2022-02-21 15:59:13 +01:00
|
|
|
|
|
|
|
//
|
|
|
|
// Indicator that the VC handler is called. It is used during the SevFeature
|
|
|
|
// detection in OvmfPkg/ResetVector/Ia32/AmdSev.c
|
|
|
|
//
|
|
|
|
UINT8 ReceivedVc;
|
OvmfPkg: introduce a common work area
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Both the TDX and SEV support needs to reserve a page in MEMFD as a work
area. The page will contain meta data specific to the guest type.
Currently, the SEV-ES support reserves a page in MEMFD
(PcdSevEsWorkArea) for the work area. This page can be reused as a TDX
work area when Intel TDX is enabled.
Based on the discussion [1], it was agreed to rename the SevEsWorkArea
to the OvmfWorkArea, and add a header that can be used to indicate the
work area type.
[1] https://edk2.groups.io/g/devel/message/78262?p=,,,20,0,0,0::\
created,0,SNP,20,2,0,84476064
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Reviewed-by: Min Xu <min.m.xu@intel.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
2021-08-17 15:46:49 +02:00
|
|
|
} SEC_SEV_ES_WORK_AREA;
|
|
|
|
|
|
|
|
//
|
|
|
|
// The SEV work area definition.
|
|
|
|
//
|
|
|
|
typedef struct _SEV_WORK_AREA {
|
|
|
|
CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER Header;
|
|
|
|
|
|
|
|
SEC_SEV_ES_WORK_AREA SevEsWorkArea;
|
|
|
|
} SEV_WORK_AREA;
|
|
|
|
|
2023-02-03 04:31:36 +01:00
|
|
|
//
|
|
|
|
// Start of TDX Specific WorkArea definition
|
|
|
|
//
|
|
|
|
|
|
|
|
#define TDX_MEASUREMENT_TDHOB_BITMASK 0x1
|
|
|
|
#define TDX_MEASUREMENT_CFVIMG_BITMASK 0x2
|
|
|
|
|
|
|
|
typedef struct _TDX_MEASUREMENTS_DATA {
|
|
|
|
UINT32 MeasurementsBitmap;
|
|
|
|
UINT8 TdHobHashValue[SHA384_DIGEST_SIZE];
|
|
|
|
UINT8 CfvImgHashValue[SHA384_DIGEST_SIZE];
|
|
|
|
} TDX_MEASUREMENTS_DATA;
|
|
|
|
|
2022-01-19 02:33:44 +01:00
|
|
|
//
|
|
|
|
// The TDX work area definition
|
|
|
|
//
|
|
|
|
typedef struct _SEC_TDX_WORK_AREA {
|
2023-02-03 04:31:36 +01:00
|
|
|
UINT32 PageTableReady;
|
|
|
|
UINT32 Gpaw;
|
|
|
|
UINT64 HobList;
|
|
|
|
TDX_MEASUREMENTS_DATA TdxMeasurementsData;
|
2022-01-19 02:33:44 +01:00
|
|
|
} SEC_TDX_WORK_AREA;
|
|
|
|
|
|
|
|
typedef struct _TDX_WORK_AREA {
|
|
|
|
CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER Header;
|
|
|
|
SEC_TDX_WORK_AREA SecTdxWorkArea;
|
|
|
|
} TDX_WORK_AREA;
|
|
|
|
|
2023-02-03 04:31:36 +01:00
|
|
|
//
|
|
|
|
// End of TDX Specific WorkArea definition
|
|
|
|
//
|
|
|
|
|
OvmfPkg: introduce a common work area
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Both the TDX and SEV support needs to reserve a page in MEMFD as a work
area. The page will contain meta data specific to the guest type.
Currently, the SEV-ES support reserves a page in MEMFD
(PcdSevEsWorkArea) for the work area. This page can be reused as a TDX
work area when Intel TDX is enabled.
Based on the discussion [1], it was agreed to rename the SevEsWorkArea
to the OvmfWorkArea, and add a header that can be used to indicate the
work area type.
[1] https://edk2.groups.io/g/devel/message/78262?p=,,,20,0,0,0::\
created,0,SNP,20,2,0,84476064
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Reviewed-by: Min Xu <min.m.xu@intel.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
2021-08-17 15:46:49 +02:00
|
|
|
typedef union {
|
|
|
|
CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER Header;
|
|
|
|
SEV_WORK_AREA SevWorkArea;
|
2022-01-19 02:33:44 +01:00
|
|
|
TDX_WORK_AREA TdxWorkArea;
|
OvmfPkg: introduce a common work area
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Both the TDX and SEV support needs to reserve a page in MEMFD as a work
area. The page will contain meta data specific to the guest type.
Currently, the SEV-ES support reserves a page in MEMFD
(PcdSevEsWorkArea) for the work area. This page can be reused as a TDX
work area when Intel TDX is enabled.
Based on the discussion [1], it was agreed to rename the SevEsWorkArea
to the OvmfWorkArea, and add a header that can be used to indicate the
work area type.
[1] https://edk2.groups.io/g/devel/message/78262?p=,,,20,0,0,0::\
created,0,SNP,20,2,0,84476064
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Erdem Aktas <erdemaktas@google.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Reviewed-by: Min Xu <min.m.xu@intel.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
2021-08-17 15:46:49 +02:00
|
|
|
} OVMF_WORK_AREA;
|
|
|
|
|
|
|
|
#endif
|