Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
Thank you Liming, I'll send out v15 within the next day or so. Thanks, Tom On 8/12/20 11:50 AM, Gao, Liming wrote: > Tom: > I run the standalone ECC checker. sev-es-v23 version pass ECC checker. > There is no ecc issue any more. > > Thanks > Liming >> -Original Message- >> From: devel@edk2.groups.io On Behalf Of Lendacky, >> Thomas >> Sent: Wednesday, August 12, 2020 11:49 PM >> To: Gao, Liming ; devel@edk2.groups.io; Laszlo Ersek >> >> Cc: Brijesh Singh ; Ard Biesheuvel >> ; Dong, Eric ; Justen, >> Jordan L ; Kinney, Michael D >> ; Ni, Ray ; Andrew Fish >> ; Anthony Perard ; You, Benjamin >> ; Bi, Dandan >> ; Dong, Guo ; Wu, Hao A >> ; Wang, Jian J ; >> Julien Grall ; Leif Lindholm ; Ma, >> Maurice >> Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support >> >> Hi Liming, >> >> Thank you, the updated series can be found here: >> >> >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAMDESE%2Fovmf%2Ftree%2Fsev-es-v23data=02%7C01%7Cthomas.lendacky%40amd.com%7C28879517b7664a435a3308d83edfd6f5%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637328478394063635sdata=4trIK4Icdo1uDkDQc38ON1YPllMLAoGmR4w2WyD504w%3Dreserved=0 >> >> Thanks, >> Tom >> >> On 8/12/20 10:28 AM, Gao, Liming wrote: >>> Tom: >>> I understand your point. Now, I run this script on Windows OS. I don't >>> try it on Linux agent. You can upload new patch set to your >> fork branch. I will verify it and let your know the result. >>> >>> And, I plan to merge ECC checker this week. So, more patches can be >>> verified. >>> >>> Thanks >>> Liming >>>> -Original Message- >>>> From: devel@edk2.groups.io On Behalf Of Lendacky, >>>> Thomas >>>> Sent: Wednesday, August 12, 2020 11:18 PM >>>> To: Gao, Liming ; devel@edk2.groups.io; Laszlo Ersek >>>> >>>> Cc: Brijesh Singh ; Ard Biesheuvel >>>> ; Dong, Eric ; Justen, >>>> Jordan L ; Kinney, Michael D >>>> ; Ni, Ray ; Andrew Fish >>>> ; Anthony Perard ; You, >>>> Benjamin ; Bi, Dandan >>>> ; Dong, Guo ; Wu, Hao A >>>> ; Wang, Jian J >> ; >>>> Julien Grall ; Leif Lindholm ; Ma, >>>> Maurice >>>> Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support >>>> >>>> Hi Liming, >>>> >>>> So I'm not sure what the next step is then... Since the ECC checker isn't >>>> merged yet, are you saying that I should submit the series again with the >>>> changes and that you won't be running the stand-alone tool again? Or will >>>> you run the tool again and submit more issues to resolve if the tool finds >>>> any? If it's the latter, I would really like to be able to run this tool >>>> stand-alone, as you have done, so that I don't have to keep re-submitting >>>> the series (because it looks like the tool doesn't catch everything and >>>> fixing one thing may then expose another). >>>> >>>> Thanks, >>>> Tom >>>> >>>> On 8/12/20 9:34 AM, Gao, Liming wrote: >>>>> Tom: >>>>> >>>>> -Original Message- >>>>> From: devel@edk2.groups.io On Behalf Of Lendacky, >>>>> Thomas >>>>> Sent: 2020年8月12日 0:18 >>>>> To: Laszlo Ersek ; Gao, Liming ; >>>>> devel@edk2.groups.io >>>>> Cc: Brijesh Singh ; Ard Biesheuvel >>>>> ; Dong, Eric ; >> Justen, >>>> Jordan L ; Kinney, Michael D >>>> ; Ni, Ray ; Andrew Fish >>>> ; Anthony Perard ; You, >>>> Benjamin ; Bi, Dandan >>>> ; Dong, Guo ; Wu, Hao A >>>> ; Wang, Jian J >> ; >>>> Julien Grall ; Leif Lindholm ; Ma, >>>> Maurice >>>>> Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support >>>>> >>>>> On 8/11/20 9:49 AM, Laszlo Ersek wrote: >>>>>> On 08/11/20 03:12, Gao, Liming wrote: >>>>>>> Tom: >>>>>>> I run ECC plugin >>>> >> (https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F63271dat >>>> >> a=02%7C01%7Cthomas.lendacky%40amd.com%7C4285f946d86342630a4708d83ecccf27%7C3dd8961fe4884e608e11a82d994e183d%7C >>>> 0%7C0%7C637328396655798086sdata=2
Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
Tom: I run the standalone ECC checker. sev-es-v23 version pass ECC checker. There is no ecc issue any more. Thanks Liming > -Original Message- > From: devel@edk2.groups.io On Behalf Of Lendacky, > Thomas > Sent: Wednesday, August 12, 2020 11:49 PM > To: Gao, Liming ; devel@edk2.groups.io; Laszlo Ersek > > Cc: Brijesh Singh ; Ard Biesheuvel > ; Dong, Eric ; Justen, > Jordan L ; Kinney, Michael D > ; Ni, Ray ; Andrew Fish > ; Anthony Perard ; You, Benjamin > ; Bi, Dandan > ; Dong, Guo ; Wu, Hao A > ; Wang, Jian J ; > Julien Grall ; Leif Lindholm ; Ma, Maurice > > Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support > > Hi Liming, > > Thank you, the updated series can be found here: > > https://github.com/AMDESE/ovmf/tree/sev-es-v23 > > Thanks, > Tom > > On 8/12/20 10:28 AM, Gao, Liming wrote: > > Tom: > > I understand your point. Now, I run this script on Windows OS. I don't > > try it on Linux agent. You can upload new patch set to your > fork branch. I will verify it and let your know the result. > > > > And, I plan to merge ECC checker this week. So, more patches can be > > verified. > > > > Thanks > > Liming > >> -Original Message- > >> From: devel@edk2.groups.io On Behalf Of Lendacky, > >> Thomas > >> Sent: Wednesday, August 12, 2020 11:18 PM > >> To: Gao, Liming ; devel@edk2.groups.io; Laszlo Ersek > >> > >> Cc: Brijesh Singh ; Ard Biesheuvel > >> ; Dong, Eric ; Justen, > >> Jordan L ; Kinney, Michael D > >> ; Ni, Ray ; Andrew Fish > >> ; Anthony Perard ; You, > >> Benjamin ; Bi, Dandan > >> ; Dong, Guo ; Wu, Hao A > >> ; Wang, Jian J > ; > >> Julien Grall ; Leif Lindholm ; Ma, > >> Maurice > >> Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support > >> > >> Hi Liming, > >> > >> So I'm not sure what the next step is then... Since the ECC checker isn't > >> merged yet, are you saying that I should submit the series again with the > >> changes and that you won't be running the stand-alone tool again? Or will > >> you run the tool again and submit more issues to resolve if the tool finds > >> any? If it's the latter, I would really like to be able to run this tool > >> stand-alone, as you have done, so that I don't have to keep re-submitting > >> the series (because it looks like the tool doesn't catch everything and > >> fixing one thing may then expose another). > >> > >> Thanks, > >> Tom > >> > >> On 8/12/20 9:34 AM, Gao, Liming wrote: > >>> Tom: > >>> > >>> -Original Message- > >>> From: devel@edk2.groups.io On Behalf Of Lendacky, > >>> Thomas > >>> Sent: 2020年8月12日 0:18 > >>> To: Laszlo Ersek ; Gao, Liming ; > >>> devel@edk2.groups.io > >>> Cc: Brijesh Singh ; Ard Biesheuvel > >>> ; Dong, Eric ; > Justen, > >> Jordan L ; Kinney, Michael D > >> ; Ni, Ray ; Andrew Fish > >> ; Anthony Perard ; You, > >> Benjamin ; Bi, Dandan > >> ; Dong, Guo ; Wu, Hao A > >> ; Wang, Jian J > ; > >> Julien Grall ; Leif Lindholm ; Ma, > >> Maurice > >>> Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support > >>> > >>> On 8/11/20 9:49 AM, Laszlo Ersek wrote: > >>>> On 08/11/20 03:12, Gao, Liming wrote: > >>>>> Tom: > >>>>> I run ECC plugin > >> > (https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F63271dat > >> > a=02%7C01%7Cthomas.lendacky%40amd.com%7C4285f946d86342630a4708d83ecccf27%7C3dd8961fe4884e608e11a82d994e183d%7C > >> 0%7C0%7C637328396655798086sdata=27ydFZdocl9RV7MbrLRKw0L2GiOGtWLlpsuaw9wj2fo%3Dreserved=0) > >> in my > local > >> machine. It reports below issues. Can you help update the patches to fix > >> them? > >>>>> I use the standalone EccCheck from > >> > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fshenglei10%2Fedk2%2Ftree%2Fecc_script > >> ;data=02%7C01%7Cthomas.lendacky%40amd.com%7C4285f946d86342630a4708d83ecccf27%7C3dd8961fe4884e608e11a82d994e18 > 3d > >> %7C0%7C0%7C637328396655798086sdata=b8VUf6uNw%2FzNBZCKU0IUUakDLJPmVsK4ghJirmQwCwY%3Dreserved=0. > >>>>> > >>>>> EFI coding style error > >>>>> *Error code: 8005 > >>
Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
Hi Liming, Thank you, the updated series can be found here: https://github.com/AMDESE/ovmf/tree/sev-es-v23 Thanks, Tom On 8/12/20 10:28 AM, Gao, Liming wrote: > Tom: > I understand your point. Now, I run this script on Windows OS. I don't try > it on Linux agent. You can upload new patch set to your fork branch. I will > verify it and let your know the result. > > And, I plan to merge ECC checker this week. So, more patches can be > verified. > > Thanks > Liming >> -Original Message- >> From: devel@edk2.groups.io On Behalf Of Lendacky, >> Thomas >> Sent: Wednesday, August 12, 2020 11:18 PM >> To: Gao, Liming ; devel@edk2.groups.io; Laszlo Ersek >> >> Cc: Brijesh Singh ; Ard Biesheuvel >> ; Dong, Eric ; Justen, >> Jordan L ; Kinney, Michael D >> ; Ni, Ray ; Andrew Fish >> ; Anthony Perard ; You, Benjamin >> ; Bi, Dandan >> ; Dong, Guo ; Wu, Hao A >> ; Wang, Jian J ; >> Julien Grall ; Leif Lindholm ; Ma, >> Maurice >> Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support >> >> Hi Liming, >> >> So I'm not sure what the next step is then... Since the ECC checker isn't >> merged yet, are you saying that I should submit the series again with the >> changes and that you won't be running the stand-alone tool again? Or will >> you run the tool again and submit more issues to resolve if the tool finds >> any? If it's the latter, I would really like to be able to run this tool >> stand-alone, as you have done, so that I don't have to keep re-submitting >> the series (because it looks like the tool doesn't catch everything and >> fixing one thing may then expose another). >> >> Thanks, >> Tom >> >> On 8/12/20 9:34 AM, Gao, Liming wrote: >>> Tom: >>> >>> -Original Message- >>> From: devel@edk2.groups.io On Behalf Of Lendacky, >>> Thomas >>> Sent: 2020年8月12日 0:18 >>> To: Laszlo Ersek ; Gao, Liming ; >>> devel@edk2.groups.io >>> Cc: Brijesh Singh ; Ard Biesheuvel >>> ; Dong, Eric ; Justen, >> Jordan L ; Kinney, Michael D >> ; Ni, Ray ; Andrew Fish >> ; Anthony Perard ; You, Benjamin >> ; Bi, Dandan >> ; Dong, Guo ; Wu, Hao A >> ; Wang, Jian J ; >> Julien Grall ; Leif Lindholm ; Ma, >> Maurice >>> Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support >>> >>> On 8/11/20 9:49 AM, Laszlo Ersek wrote: >>>> On 08/11/20 03:12, Gao, Liming wrote: >>>>> Tom: >>>>> I run ECC plugin >> (https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F63271dat >> a=02%7C01%7Cthomas.lendacky%40amd.com%7C4285f946d86342630a4708d83ecccf27%7C3dd8961fe4884e608e11a82d994e183d%7C >> 0%7C0%7C637328396655798086sdata=27ydFZdocl9RV7MbrLRKw0L2GiOGtWLlpsuaw9wj2fo%3Dreserved=0) >> in my local >> machine. It reports below issues. Can you help update the patches to fix >> them? >>>>> I use the standalone EccCheck from >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fshenglei10%2Fedk2%2Ftree%2Fecc_script >> ;data=02%7C01%7Cthomas.lendacky%40amd.com%7C4285f946d86342630a4708d83ecccf27%7C3dd8961fe4884e608e11a82d994e183d >> %7C0%7C0%7C637328396655798086sdata=b8VUf6uNw%2FzNBZCKU0IUUakDLJPmVsK4ghJirmQwCwY%3Dreserved=0. >>>>> >>>>> EFI coding style error >>>>> *Error code: 8005 >>>>> *Variable name does not follow the rules: 1. First character should be >>>>> upper case 2. Must contain lower case characters 3. No >> white space characters 4. Global variable name must start with a 'g' >>>>> *file: D:\AllPkg\edk2\OvmfPkg\Sec\SecMain.c >>>>> *Line number: 867 >>>>> *The variable name [*Ds] does not follow the rules >>>> >>>> I don't understand this report; with this series applied, line 867 is >>>> the following: >>>> >>>> 867 UINT8 *Src, *Dst; >>>> >>>> coming from patch v14 37/46, "OvmfPkg/Sec: Add #VC exception handling >>>> for Sec phase". >>>> >>>> Perhaps ECC is confused because we have two declarations on the same >>>> line; I'm not sure. >>>> >>>> In general I too like to keep declarations on separate lines, but >>>> there are exceptions. Declaring *Src and *Dst on the same line is >>>> pretty reasonable, and trivial. >>>> >>>> I think it's time
Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
Tom: I understand your point. Now, I run this script on Windows OS. I don't try it on Linux agent. You can upload new patch set to your fork branch. I will verify it and let your know the result. And, I plan to merge ECC checker this week. So, more patches can be verified. Thanks Liming > -Original Message- > From: devel@edk2.groups.io On Behalf Of Lendacky, > Thomas > Sent: Wednesday, August 12, 2020 11:18 PM > To: Gao, Liming ; devel@edk2.groups.io; Laszlo Ersek > > Cc: Brijesh Singh ; Ard Biesheuvel > ; Dong, Eric ; Justen, > Jordan L ; Kinney, Michael D > ; Ni, Ray ; Andrew Fish > ; Anthony Perard ; You, Benjamin > ; Bi, Dandan > ; Dong, Guo ; Wu, Hao A > ; Wang, Jian J ; > Julien Grall ; Leif Lindholm ; Ma, Maurice > > Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support > > Hi Liming, > > So I'm not sure what the next step is then... Since the ECC checker isn't > merged yet, are you saying that I should submit the series again with the > changes and that you won't be running the stand-alone tool again? Or will > you run the tool again and submit more issues to resolve if the tool finds > any? If it's the latter, I would really like to be able to run this tool > stand-alone, as you have done, so that I don't have to keep re-submitting > the series (because it looks like the tool doesn't catch everything and > fixing one thing may then expose another). > > Thanks, > Tom > > On 8/12/20 9:34 AM, Gao, Liming wrote: > > Tom: > > > > -Original Message- > > From: devel@edk2.groups.io On Behalf Of Lendacky, > > Thomas > > Sent: 2020年8月12日 0:18 > > To: Laszlo Ersek ; Gao, Liming ; > > devel@edk2.groups.io > > Cc: Brijesh Singh ; Ard Biesheuvel > > ; Dong, Eric ; Justen, > Jordan L ; Kinney, Michael D > ; Ni, Ray ; Andrew Fish > ; Anthony Perard ; You, Benjamin > ; Bi, Dandan > ; Dong, Guo ; Wu, Hao A > ; Wang, Jian J ; > Julien Grall ; Leif Lindholm ; Ma, Maurice > > > Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support > > > > On 8/11/20 9:49 AM, Laszlo Ersek wrote: > >> On 08/11/20 03:12, Gao, Liming wrote: > >>> Tom: > >>> I run ECC plugin > (https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F63271dat > a=02%7C01%7Cthomas.lendacky%40amd.com%7C4285f946d86342630a4708d83ecccf27%7C3dd8961fe4884e608e11a82d994e183d%7C > 0%7C0%7C637328396655798086sdata=27ydFZdocl9RV7MbrLRKw0L2GiOGtWLlpsuaw9wj2fo%3Dreserved=0) > in my local > machine. It reports below issues. Can you help update the patches to fix them? > >>> I use the standalone EccCheck from > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fshenglei10%2Fedk2%2Ftree%2Fecc_script > ;data=02%7C01%7Cthomas.lendacky%40amd.com%7C4285f946d86342630a4708d83ecccf27%7C3dd8961fe4884e608e11a82d994e183d > %7C0%7C0%7C637328396655798086sdata=b8VUf6uNw%2FzNBZCKU0IUUakDLJPmVsK4ghJirmQwCwY%3Dreserved=0. > >>> > >>> EFI coding style error > >>> *Error code: 8005 > >>> *Variable name does not follow the rules: 1. First character should be > >>> upper case 2. Must contain lower case characters 3. No > white space characters 4. Global variable name must start with a 'g' > >>> *file: D:\AllPkg\edk2\OvmfPkg\Sec\SecMain.c > >>> *Line number: 867 > >>> *The variable name [*Ds] does not follow the rules > >> > >> I don't understand this report; with this series applied, line 867 is > >> the following: > >> > >> 867 UINT8 *Src, *Dst; > >> > >> coming from patch v14 37/46, "OvmfPkg/Sec: Add #VC exception handling > >> for Sec phase". > >> > >> Perhaps ECC is confused because we have two declarations on the same > >> line; I'm not sure. > >> > >> In general I too like to keep declarations on separate lines, but > >> there are exceptions. Declaring *Src and *Dst on the same line is > >> pretty reasonable, and trivial. > >> > >> I think it's time for us to put the ECC exception list to use, under > >> OvmfPkg. > >> > >> Tom, please try to reproduce this error locally, and then modify > >> "OvmfPkg/OvmfPkg.ci.yaml", adding an exception under the EccCheck block. > >> > >> ... Oh wait, we haven't even merged Shenglei's series for that! The > >> latest posting is: > >> > >> [edk2-devel] [PATCH v9 00/16] > >> Add a plugin to check Ecc issues for edk2 on open ci > >> > >> and
Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
Hi Liming, So I'm not sure what the next step is then... Since the ECC checker isn't merged yet, are you saying that I should submit the series again with the changes and that you won't be running the stand-alone tool again? Or will you run the tool again and submit more issues to resolve if the tool finds any? If it's the latter, I would really like to be able to run this tool stand-alone, as you have done, so that I don't have to keep re-submitting the series (because it looks like the tool doesn't catch everything and fixing one thing may then expose another). Thanks, Tom On 8/12/20 9:34 AM, Gao, Liming wrote: > Tom: > > -Original Message- > From: devel@edk2.groups.io On Behalf Of Lendacky, > Thomas > Sent: 2020年8月12日 0:18 > To: Laszlo Ersek ; Gao, Liming ; > devel@edk2.groups.io > Cc: Brijesh Singh ; Ard Biesheuvel > ; Dong, Eric ; Justen, Jordan L > ; Kinney, Michael D ; > Ni, Ray ; Andrew Fish ; Anthony Perard > ; You, Benjamin ; Bi, > Dandan ; Dong, Guo ; Wu, Hao A > ; Wang, Jian J ; Julien Grall > ; Leif Lindholm ; Ma, Maurice > > Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support > > On 8/11/20 9:49 AM, Laszlo Ersek wrote: >> On 08/11/20 03:12, Gao, Liming wrote: >>> Tom: >>> I run ECC plugin >>> (https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F63271data=02%7C01%7Cthomas.lendacky%40amd.com%7C4285f946d86342630a4708d83ecccf27%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637328396655798086sdata=27ydFZdocl9RV7MbrLRKw0L2GiOGtWLlpsuaw9wj2fo%3Dreserved=0) >>> in my local machine. It reports below issues. Can you help update the >>> patches to fix them? >>> I use the standalone EccCheck from >>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fshenglei10%2Fedk2%2Ftree%2Fecc_scriptdata=02%7C01%7Cthomas.lendacky%40amd.com%7C4285f946d86342630a4708d83ecccf27%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637328396655798086sdata=b8VUf6uNw%2FzNBZCKU0IUUakDLJPmVsK4ghJirmQwCwY%3Dreserved=0. >>> >>> >>> EFI coding style error >>> *Error code: 8005 >>> *Variable name does not follow the rules: 1. First character should be >>> upper case 2. Must contain lower case characters 3. No white space >>> characters 4. Global variable name must start with a 'g' >>> *file: D:\AllPkg\edk2\OvmfPkg\Sec\SecMain.c >>> *Line number: 867 >>> *The variable name [*Ds] does not follow the rules >> >> I don't understand this report; with this series applied, line 867 is >> the following: >> >> 867 UINT8 *Src, *Dst; >> >> coming from patch v14 37/46, "OvmfPkg/Sec: Add #VC exception handling >> for Sec phase". >> >> Perhaps ECC is confused because we have two declarations on the same >> line; I'm not sure. >> >> In general I too like to keep declarations on separate lines, but >> there are exceptions. Declaring *Src and *Dst on the same line is >> pretty reasonable, and trivial. >> >> I think it's time for us to put the ECC exception list to use, under >> OvmfPkg. >> >> Tom, please try to reproduce this error locally, and then modify >> "OvmfPkg/OvmfPkg.ci.yaml", adding an exception under the EccCheck block. >> >> ... Oh wait, we haven't even merged Shenglei's series for that! The >> latest posting is: >> >> [edk2-devel] [PATCH v9 00/16] >> Add a plugin to check Ecc issues for edk2 on open ci >> >> and it's still under review. >> >> Indeed, Liming says above that he used the "standalone EccCheck". >> >> OK. In this case, I state that some of these ECC reports for OvmfPkg >> should be waived. >> >> I'm in general of the opinion that ECC is too strict, and package >> maintainers should have power to selectively enforce or override ECC >> reports. That's why I agreed to the ECC CI plugin in the first place >> -- becase we have exception lists that are controllable under specific >> package directories (in the *.ci.yaml files). >> >> In the present case, running the standalone ECC check has worse >> granularity than the upcoming ECC CI plugin. So, because I can't ask >> Tom to add a new exception to "OvmfPkg/OvmfPkg.ci.yaml" right now >> (before we merge this series), I'm replacing that with a waiver in this >> email. >> >> Of course, if maintainers of other packages want the ECC reports >> issued under their packages addressed, that's their call. I can only >> waive ECC reports under OvmfPkg. >> >>> EF
Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
Tom:
-Original Message-
From: devel@edk2.groups.io On Behalf Of Lendacky, Thomas
Sent: 2020年8月12日 0:18
To: Laszlo Ersek ; Gao, Liming ;
devel@edk2.groups.io
Cc: Brijesh Singh ; Ard Biesheuvel
; Dong, Eric ; Justen, Jordan L
; Kinney, Michael D ;
Ni, Ray ; Andrew Fish ; Anthony Perard
; You, Benjamin ; Bi, Dandan
; Dong, Guo ; Wu, Hao A
; Wang, Jian J ; Julien Grall
; Leif Lindholm ; Ma, Maurice
Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
On 8/11/20 9:49 AM, Laszlo Ersek wrote:
> On 08/11/20 03:12, Gao, Liming wrote:
>> Tom:
>> I run ECC plugin
>> (https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F63271data=02%7C01%7Cthomas.lendacky%40amd.com%7C9c0fb2b16af248090fdb08d83e05c821%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637327542159394484sdata=tCG%2FO%2BgAaAFijo2ULCSyUivk1%2Fo5XTUt%2FyY0f7Hxd7g%3Dreserved=0)
>> in my local machine. It reports below issues. Can you help update the
>> patches to fix them?
>> I use the standalone EccCheck from
>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fshenglei10%2Fedk2%2Ftree%2Fecc_scriptdata=02%7C01%7Cthomas.lendacky%40amd.com%7C9c0fb2b16af248090fdb08d83e05c821%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637327542159394484sdata=J4ItgPOb7FCzO7NH12mhDNC7VrMuhxO6TFVTN51pR%2Fk%3Dreserved=0.
>>
>>
>> EFI coding style error
>> *Error code: 8005
>> *Variable name does not follow the rules: 1. First character should be
>> upper case 2. Must contain lower case characters 3. No white space
>> characters 4. Global variable name must start with a 'g'
>> *file: D:\AllPkg\edk2\OvmfPkg\Sec\SecMain.c
>> *Line number: 867
>> *The variable name [*Ds] does not follow the rules
>
> I don't understand this report; with this series applied, line 867 is
> the following:
>
> 867 UINT8 *Src, *Dst;
>
> coming from patch v14 37/46, "OvmfPkg/Sec: Add #VC exception handling
> for Sec phase".
>
> Perhaps ECC is confused because we have two declarations on the same
> line; I'm not sure.
>
> In general I too like to keep declarations on separate lines, but
> there are exceptions. Declaring *Src and *Dst on the same line is
> pretty reasonable, and trivial.
>
> I think it's time for us to put the ECC exception list to use, under
> OvmfPkg.
>
> Tom, please try to reproduce this error locally, and then modify
> "OvmfPkg/OvmfPkg.ci.yaml", adding an exception under the EccCheck block.
>
> ... Oh wait, we haven't even merged Shenglei's series for that! The
> latest posting is:
>
> [edk2-devel] [PATCH v9 00/16]
> Add a plugin to check Ecc issues for edk2 on open ci
>
> and it's still under review.
>
> Indeed, Liming says above that he used the "standalone EccCheck".
>
> OK. In this case, I state that some of these ECC reports for OvmfPkg
> should be waived.
>
> I'm in general of the opinion that ECC is too strict, and package
> maintainers should have power to selectively enforce or override ECC
> reports. That's why I agreed to the ECC CI plugin in the first place
> -- becase we have exception lists that are controllable under specific
> package directories (in the *.ci.yaml files).
>
> In the present case, running the standalone ECC check has worse
> granularity than the upcoming ECC CI plugin. So, because I can't ask
> Tom to add a new exception to "OvmfPkg/OvmfPkg.ci.yaml" right now
> (before we merge this series), I'm replacing that with a waiver in this email.
>
> Of course, if maintainers of other packages want the ECC reports
> issued under their packages addressed, that's their call. I can only
> waive ECC reports under OvmfPkg.
>
>> EFI coding style error
>> *Error code: 9003
>> *The first line of text in a comment block should be a brief description
>> of the element being documented and the brief description must end with a
>> period.
>> *file:
>> D:\AllPkg\edk2\OvmfPkg\Library\BaseMemEncryptSevLib\MemEncryptSevLibInternal.c
>> *Line number: 72
>> *Comment description should end with period '.'
>
> Disagree; sometimes people use well-formed full English sentences,
> sometimes only thought fragments.
>
>> EFI coding style error
>> *Error code: 3002
>> *Non-Boolean comparisons should use a compare operator (==, !=, >, < >=,
>> <=)
>> *file: D:\AllPkg\edk2\OvmfPkg\Library\VmgExitLib\VmgExitVcHandler.c
>> *Line number: 1280
>> *Predicate Expression: OpCount
>
> On the other hand, this report *is* worth fixing.
>
>1280 while (OpCount) {
>
>
Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
On 08/11/20 16:40, Tom Lendacky wrote: > I'm trying to run this tool on my Ubuntu installs (both 18.04 and 20.04) > and it consistently fails trying to execute a git command: > > $ python3 BaseTools/Scripts/EccCheck.py > usage: git [--version] [--help] [-C ] [-c =] >[--exec-path[=]] [--html-path] [--man-path] > [--info-path] >[-p | --paginate | -P | --no-pager] [--no-replace-objects] > [--bare] >[--git-dir=] [--work-tree=] > [--namespace=] > [] > > These are common Git commands used in various situations: > > start a working area (see also: git help tutorial) >clone Clone a repository into a new directory >init Create an empty Git repository or reinitialize > an existing one > > work on the current change (see also: git help everyday) >add Add file contents to the index >mvMove or rename a file, a directory, or a symlink >restore Restore working tree files >rmRemove files from the working tree and from the > index >sparse-checkout Initialize and modify the sparse-checkout > > examine the history and state (see also: git help revisions) >bisectUse binary search to find the commit that > introduced a bug >diff Show changes between commits, commit and working > tree, etc >grep Print lines matching a pattern >log Show commit logs >show Show various types of objects >statusShow the working tree status > > grow, mark and tweak your common history >branchList, create, or delete branches >commitRecord changes to the repository >merge Join two or more development histories together >rebaseReapply commits on top of another base tip >reset Reset current HEAD to the specified state >switchSwitch branches >tag Create, list, delete or verify a tag object > signed with GPG > > collaborate (see also: git help workflows) >fetch Download objects and refs from another repository >pull Fetch from and integrate with another repository > or a local branch >push Update remote refs along with associated objects > > 'git help -a' and 'git help -g' list available subcommands and some > concept guides. See 'git help ' or 'git help ' > to read about a specific subcommand or concept. > See 'git help git' for an overview of the system. > Fail to run GIT > ECC tool detect error > > I've also tried specifying -1, a commit id, etc., but the same thing happens. > > Has this been run/tested on Ubuntu? Is there something specific that needs > to be done in order to run this tool? I'd like to know as well. Thanks Laszlo -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64014): https://edk2.groups.io/g/devel/message/64014 Mute This Topic: https://groups.io/mt/76056465/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
*Variable Name: Data
>
> Agree this should be fixed; I should have noticed it during review. My
> apologies.
>
> 845 UINT8 *Data = (UINT8 *) Ghcb->SharedBuffer;
>
> Comes from patch #17 ("OvmfPkg/VmgExitLib: Add support for NPF NAE
> events (MMIO)").
>
>> EFI coding style error
>> *Error code: 5007
>> *There should be no initialization of a variable as part of its declaration
>> *file: D:\AllPkg\edk2\OvmfPkg\Library\VmgExitLib\VmgExitVcHandler.c
>> *Line number: 849
>> *Variable Name: Data
>
> Yes, this should be fixed too:
>
> 849 UINT16 *Data = (UINT16 *) Ghcb->SharedBuffer;
>
> Again, I should have noticed it; I'm sorry.
>
> It comes from patch #17 ("OvmfPkg/VmgExitLib: Add support for NPF NAE
> events (MMIO)") again.
>
> Tom: given that a new iteration seems justified after all (I'm really
> sorry about that -- with Shenglei's series hopefully soon merged, such
> issues will be reported earlier!), if you'd like, you could address the
> two ECC reports too that I said were too strict and should be ignored.
> (That means breaking the "*Dst" declaration to a new line, and adding a
> period to the comment.) Up to you; I certainly don't insist on those.
No worries, easy enough to do if I'm already updating the others.
I would like to be able to run this tool on my system, though, to see if
anything else gets flagged after fixing the above mentioned issues. But
the tool fails for me as I described in another post. The reason I say
that is, for example, the issue about the comment description ending with
a period was actually in multiple spots of the commit, even though the
tool only flagged one. I'd hate to think I've fixed everything only to
have the tool find more issues after I've submitted another series, all
because I couldn't run the tool.
Thanks,
Tom
>
> Thanks!
> Laszlo
>
>>
>> Thanks
>> Liming
>> -Original Message-
>> From: Laszlo Ersek
>> Sent: 2020年8月11日 3:36
>> To: devel@edk2.groups.io; thomas.lenda...@amd.com
>> Cc: Brijesh Singh ; Ard Biesheuvel
>> ; Dong, Eric ; Justen, Jordan L
>> ; Gao, Liming ; Kinney,
>> Michael D ; Ni, Ray ; Andrew
>> Fish ; Anthony Perard ; You,
>> Benjamin ; Bi, Dandan ; Dong,
>> Guo ; Wu, Hao A ; Wang, Jian J
>> ; Julien Grall ; Leif Lindholm
>> ; Ma, Maurice
>> Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
>>
>> On 08/07/20 21:38, Lendacky, Thomas wrote:
>>> From: Tom Lendacky
>>>
>>> This patch series provides support for running EDK2/OVMF under SEV-ES.
>>>
>>> Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on
>>> the SEV support to protect the guest register state from the
>>> hypervisor. See
>>> "AMD64 Architecture Programmer's Manual Volume 2: System Programming",
>>> section "15.35 Encrypted State (SEV-ES)" [1].
>>>
>>> In order to allow a hypervisor to perform functions on behalf of a
>>> guest, there is architectural support for notifying a guest's
>>> operating system when certain types of VMEXITs are about to occur.
>>> This allows the guest to selectively share information with the
>>> hypervisor to satisfy the requested function. The notification is
>>> performed using a new exception, the VMM Communication exception
>>> (#VC). The information is shared through the Guest-Hypervisor Communication
>>> Block (GHCB) using the VMGEXIT instruction.
>>> The GHCB format and the protocol for using it is documented in "SEV-ES
>>> Guest-Hypervisor Communication Block Standardization" [2].
>>>
>>> The main areas of the EDK2 code that are updated to support SEV-ES are
>>> around the exception handling support and the AP boot support.
>>>
>>> Exception support is required starting in Sec, continuing through Pei
>>> and into Dxe in order to handle #VC exceptions that are generated.
>>> Each AP requires it's own GHCB page as well as a page to hold values
>>> specific to that AP.
>>>
>>> AP booting poses some interesting challenges. The INIT-SIPI-SIPI
>>> sequence is typically used to boot the APs. However, the hypervisor is
>>> not allowed to update the guest registers. The GHCB document [2] talks
>>> about how SMP booting under SEV-ES is performed.
>>>
>>> Since the GHCB page must be a shared (unencrypted) page, the processor
>>> must be running in long mode in order for the guest and hypervisor to
>>> communicate with each ot
Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
quot; declaration to a new line, and adding a
period to the comment.) Up to you; I certainly don't insist on those.
Thanks!
Laszlo
>
> Thanks
> Liming
> -Original Message-
> From: Laszlo Ersek
> Sent: 2020年8月11日 3:36
> To: devel@edk2.groups.io; thomas.lenda...@amd.com
> Cc: Brijesh Singh ; Ard Biesheuvel
> ; Dong, Eric ; Justen, Jordan L
> ; Gao, Liming ; Kinney,
> Michael D ; Ni, Ray ; Andrew
> Fish ; Anthony Perard ; You,
> Benjamin ; Bi, Dandan ; Dong,
> Guo ; Wu, Hao A ; Wang, Jian J
> ; Julien Grall ; Leif Lindholm
> ; Ma, Maurice
> Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
>
> On 08/07/20 21:38, Lendacky, Thomas wrote:
>> From: Tom Lendacky
>>
>> This patch series provides support for running EDK2/OVMF under SEV-ES.
>>
>> Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on
>> the SEV support to protect the guest register state from the
>> hypervisor. See
>> "AMD64 Architecture Programmer's Manual Volume 2: System Programming",
>> section "15.35 Encrypted State (SEV-ES)" [1].
>>
>> In order to allow a hypervisor to perform functions on behalf of a
>> guest, there is architectural support for notifying a guest's
>> operating system when certain types of VMEXITs are about to occur.
>> This allows the guest to selectively share information with the
>> hypervisor to satisfy the requested function. The notification is
>> performed using a new exception, the VMM Communication exception
>> (#VC). The information is shared through the Guest-Hypervisor Communication
>> Block (GHCB) using the VMGEXIT instruction.
>> The GHCB format and the protocol for using it is documented in "SEV-ES
>> Guest-Hypervisor Communication Block Standardization" [2].
>>
>> The main areas of the EDK2 code that are updated to support SEV-ES are
>> around the exception handling support and the AP boot support.
>>
>> Exception support is required starting in Sec, continuing through Pei
>> and into Dxe in order to handle #VC exceptions that are generated.
>> Each AP requires it's own GHCB page as well as a page to hold values
>> specific to that AP.
>>
>> AP booting poses some interesting challenges. The INIT-SIPI-SIPI
>> sequence is typically used to boot the APs. However, the hypervisor is
>> not allowed to update the guest registers. The GHCB document [2] talks
>> about how SMP booting under SEV-ES is performed.
>>
>> Since the GHCB page must be a shared (unencrypted) page, the processor
>> must be running in long mode in order for the guest and hypervisor to
>> communicate with each other. As a result, SEV-ES is only supported
>> under the X64 architecture.
>>
>> This series adds a new library requirement for the VmgExitLib library
>> against the UefiCpuPkg CpuExceptionHandlerLib library and the
>> UefiCpuPkg MpInitLib library. The edk2-platforms repo requires
>> updates/patches to add the new library requirement. To accomodate
>> that, this series could be split between:
>>
>> patch number 10:
>> UefiPayloadPkg: Prepare UefiPayloadPkg to use the VmgExitLib library
>>
>> and patch number 11:
>> UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC
>> exception
>>
>> The updates to edk2-platforms can be applied at the split.
>>
>> [1] https://www.amd.com/system/files/TechDocs/24593.pdf
>> [2] https://developer.amd.com/wp-content/resources/56421.pdf
>>
>> ---
>>
>> These patches are based on commit:
>> 9565ab67c209 ("ShellPkg: smbiosview - Change some type 17 field values
>> format")
>>
>> A version of the tree can be found at:
>> https://github.com/AMDESE/ovmf/tree/sev-es-v22
>>
>> Cc: Andrew Fish
>> Cc: Anthony Perard
>> Cc: Ard Biesheuvel
>> Cc: Benjamin You
>> Cc: Dandan Bi
>> Cc: Eric Dong
>> Cc: Guo Dong
>> Cc: Hao A Wu
>> Cc: Jian J Wang
>> Cc: Jordan Justen
>> Cc: Julien Grall
>> Cc: Laszlo Ersek
>> Cc: Leif Lindholm
>> Cc: Liming Gao
>> Cc: Maurice Ma
>> Cc: Michael D Kinney
>> Cc: Ray Ni
>>
>> Changes since v13:
>> - Fixup the AsmRelocateApLoop() call site so IA32 successfully boots APs.
>> Do this by appending the three new parameters without altering the
>> original parameter passing order.
>> - Minor updates to description text and help text to expand the GHCB
>> acronym.
>>
>> Changes since v12:
>> - Change IA32 VMGEXIT .nasm file to issue an i
Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
refs from another repository pull Fetch from and integrate with another repository or a local branch push Update remote refs along with associated objects 'git help -a' and 'git help -g' list available subcommands and some concept guides. See 'git help ' or 'git help ' to read about a specific subcommand or concept. See 'git help git' for an overview of the system. Fail to run GIT ECC tool detect error I've also tried specifying -1, a commit id, etc., but the same thing happens. Has this been run/tested on Ubuntu? Is there something specific that needs to be done in order to run this tool? Thanks, Tom > > Thanks > Liming > -Original Message- > From: Laszlo Ersek > Sent: 2020年8月11日 3:36 > To: devel@edk2.groups.io; thomas.lenda...@amd.com > Cc: Brijesh Singh ; Ard Biesheuvel > ; Dong, Eric ; Justen, Jordan L > ; Gao, Liming ; Kinney, > Michael D ; Ni, Ray ; Andrew > Fish ; Anthony Perard ; You, > Benjamin ; Bi, Dandan ; Dong, > Guo ; Wu, Hao A ; Wang, Jian J > ; Julien Grall ; Leif Lindholm > ; Ma, Maurice > Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support > > On 08/07/20 21:38, Lendacky, Thomas wrote: >> From: Tom Lendacky >> >> This patch series provides support for running EDK2/OVMF under SEV-ES. >> >> Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on >> the SEV support to protect the guest register state from the >> hypervisor. See >> "AMD64 Architecture Programmer's Manual Volume 2: System Programming", >> section "15.35 Encrypted State (SEV-ES)" [1]. >> >> In order to allow a hypervisor to perform functions on behalf of a >> guest, there is architectural support for notifying a guest's >> operating system when certain types of VMEXITs are about to occur. >> This allows the guest to selectively share information with the >> hypervisor to satisfy the requested function. The notification is >> performed using a new exception, the VMM Communication exception >> (#VC). The information is shared through the Guest-Hypervisor Communication >> Block (GHCB) using the VMGEXIT instruction. >> The GHCB format and the protocol for using it is documented in "SEV-ES >> Guest-Hypervisor Communication Block Standardization" [2]. >> >> The main areas of the EDK2 code that are updated to support SEV-ES are >> around the exception handling support and the AP boot support. >> >> Exception support is required starting in Sec, continuing through Pei >> and into Dxe in order to handle #VC exceptions that are generated. >> Each AP requires it's own GHCB page as well as a page to hold values >> specific to that AP. >> >> AP booting poses some interesting challenges. The INIT-SIPI-SIPI >> sequence is typically used to boot the APs. However, the hypervisor is >> not allowed to update the guest registers. The GHCB document [2] talks >> about how SMP booting under SEV-ES is performed. >> >> Since the GHCB page must be a shared (unencrypted) page, the processor >> must be running in long mode in order for the guest and hypervisor to >> communicate with each other. As a result, SEV-ES is only supported >> under the X64 architecture. >> >> This series adds a new library requirement for the VmgExitLib library >> against the UefiCpuPkg CpuExceptionHandlerLib library and the >> UefiCpuPkg MpInitLib library. The edk2-platforms repo requires >> updates/patches to add the new library requirement. To accomodate >> that, this series could be split between: >> >> patch number 10: >> UefiPayloadPkg: Prepare UefiPayloadPkg to use the VmgExitLib library >> >> and patch number 11: >> UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC >> exception >> >> The updates to edk2-platforms can be applied at the split. >> >> [1] >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.amd.com%2Fsystem%2Ffiles%2FTechDocs%2F24593.pdfdata=02%7C01%7Cthomas.lendacky%40amd.com%7Ce7a200ac9bfb47bff77e08d83d93abe6%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637327052903689176sdata=laSNrQUXRN7lLHNNWKvVSRqJk7VGviYtTTJ%2F%2BqiTQKY%3Dreserved=0 >> [2] >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdeveloper.amd.com%2Fwp-content%2Fresources%2F56421.pdfdata=02%7C01%7Cthomas.lendacky%40amd.com%7Ce7a200ac9bfb47bff77e08d83d93abe6%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637327052903689176sdata=yCRA3fdXO3Mgg%2BiqgQ3ERY4WUHs3OVmzPA7jL8Tq0wE%3Dreserved=0 >> >> --- >> >> These patches are
Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
Tom: I run ECC plugin (https://edk2.groups.io/g/devel/message/63271) in my local machine. It reports below issues. Can you help update the patches to fix them? I use the standalone EccCheck from https://github.com/shenglei10/edk2/tree/ecc_script. EFI coding style error *Error code: 8005 *Variable name does not follow the rules: 1. First character should be upper case 2. Must contain lower case characters 3. No white space characters 4. Global variable name must start with a 'g' *file: D:\AllPkg\edk2\OvmfPkg\Sec\SecMain.c *Line number: 867 *The variable name [*Ds] does not follow the rules EFI coding style error *Error code: 9003 *The first line of text in a comment block should be a brief description of the element being documented and the brief description must end with a period. *file: D:\AllPkg\edk2\OvmfPkg\Library\BaseMemEncryptSevLib\MemEncryptSevLibInternal.c *Line number: 72 *Comment description should end with period '.' EFI coding style error *Error code: 3002 *Non-Boolean comparisons should use a compare operator (==, !=, >, < >=, <=) *file: D:\AllPkg\edk2\OvmfPkg\Library\VmgExitLib\VmgExitVcHandler.c *Line number: 1280 *Predicate Expression: OpCount EFI coding style error *Error code: 5007 *There should be no initialization of a variable as part of its declaration *file: D:\AllPkg\edk2\OvmfPkg\Library\VmgExitLib\VmgExitVcHandler.c *Line number: 845 *Variable Name: Data EFI coding style error *Error code: 5007 *There should be no initialization of a variable as part of its declaration *file: D:\AllPkg\edk2\OvmfPkg\Library\VmgExitLib\VmgExitVcHandler.c *Line number: 849 *Variable Name: Data Thanks Liming -Original Message- From: Laszlo Ersek Sent: 2020年8月11日 3:36 To: devel@edk2.groups.io; thomas.lenda...@amd.com Cc: Brijesh Singh ; Ard Biesheuvel ; Dong, Eric ; Justen, Jordan L ; Gao, Liming ; Kinney, Michael D ; Ni, Ray ; Andrew Fish ; Anthony Perard ; You, Benjamin ; Bi, Dandan ; Dong, Guo ; Wu, Hao A ; Wang, Jian J ; Julien Grall ; Leif Lindholm ; Ma, Maurice Subject: Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support On 08/07/20 21:38, Lendacky, Thomas wrote: > From: Tom Lendacky > > This patch series provides support for running EDK2/OVMF under SEV-ES. > > Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on > the SEV support to protect the guest register state from the > hypervisor. See > "AMD64 Architecture Programmer's Manual Volume 2: System Programming", > section "15.35 Encrypted State (SEV-ES)" [1]. > > In order to allow a hypervisor to perform functions on behalf of a > guest, there is architectural support for notifying a guest's > operating system when certain types of VMEXITs are about to occur. > This allows the guest to selectively share information with the > hypervisor to satisfy the requested function. The notification is > performed using a new exception, the VMM Communication exception > (#VC). The information is shared through the Guest-Hypervisor Communication > Block (GHCB) using the VMGEXIT instruction. > The GHCB format and the protocol for using it is documented in "SEV-ES > Guest-Hypervisor Communication Block Standardization" [2]. > > The main areas of the EDK2 code that are updated to support SEV-ES are > around the exception handling support and the AP boot support. > > Exception support is required starting in Sec, continuing through Pei > and into Dxe in order to handle #VC exceptions that are generated. > Each AP requires it's own GHCB page as well as a page to hold values > specific to that AP. > > AP booting poses some interesting challenges. The INIT-SIPI-SIPI > sequence is typically used to boot the APs. However, the hypervisor is > not allowed to update the guest registers. The GHCB document [2] talks > about how SMP booting under SEV-ES is performed. > > Since the GHCB page must be a shared (unencrypted) page, the processor > must be running in long mode in order for the guest and hypervisor to > communicate with each other. As a result, SEV-ES is only supported > under the X64 architecture. > > This series adds a new library requirement for the VmgExitLib library > against the UefiCpuPkg CpuExceptionHandlerLib library and the > UefiCpuPkg MpInitLib library. The edk2-platforms repo requires > updates/patches to add the new library requirement. To accomodate > that, this series could be split between: > > patch number 10: > UefiPayloadPkg: Prepare UefiPayloadPkg to use the VmgExitLib library > > and patch number 11: > UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC > exception > > The updates to edk2-platforms can be applied at the split. > > [1] https://www.amd.com/system/files/TechDo
Re: [edk2-devel] [PATCH v14 00/46] SEV-ES guest support
On 08/07/20 21:38, Lendacky, Thomas wrote:
> From: Tom Lendacky
>
> This patch series provides support for running EDK2/OVMF under SEV-ES.
>
> Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on the
> SEV support to protect the guest register state from the hypervisor. See
> "AMD64 Architecture Programmer's Manual Volume 2: System Programming",
> section "15.35 Encrypted State (SEV-ES)" [1].
>
> In order to allow a hypervisor to perform functions on behalf of a guest,
> there is architectural support for notifying a guest's operating system
> when certain types of VMEXITs are about to occur. This allows the guest to
> selectively share information with the hypervisor to satisfy the requested
> function. The notification is performed using a new exception, the VMM
> Communication exception (#VC). The information is shared through the
> Guest-Hypervisor Communication Block (GHCB) using the VMGEXIT instruction.
> The GHCB format and the protocol for using it is documented in "SEV-ES
> Guest-Hypervisor Communication Block Standardization" [2].
>
> The main areas of the EDK2 code that are updated to support SEV-ES are
> around the exception handling support and the AP boot support.
>
> Exception support is required starting in Sec, continuing through Pei
> and into Dxe in order to handle #VC exceptions that are generated. Each
> AP requires it's own GHCB page as well as a page to hold values specific
> to that AP.
>
> AP booting poses some interesting challenges. The INIT-SIPI-SIPI sequence
> is typically used to boot the APs. However, the hypervisor is not allowed
> to update the guest registers. The GHCB document [2] talks about how SMP
> booting under SEV-ES is performed.
>
> Since the GHCB page must be a shared (unencrypted) page, the processor
> must be running in long mode in order for the guest and hypervisor to
> communicate with each other. As a result, SEV-ES is only supported under
> the X64 architecture.
>
> This series adds a new library requirement for the VmgExitLib library
> against the UefiCpuPkg CpuExceptionHandlerLib library and the UefiCpuPkg
> MpInitLib library. The edk2-platforms repo requires updates/patches to
> add the new library requirement. To accomodate that, this series could be
> split between:
>
> patch number 10:
> UefiPayloadPkg: Prepare UefiPayloadPkg to use the VmgExitLib library
>
> and patch number 11:
> UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC exception
>
> The updates to edk2-platforms can be applied at the split.
>
> [1] https://www.amd.com/system/files/TechDocs/24593.pdf
> [2] https://developer.amd.com/wp-content/resources/56421.pdf
>
> ---
>
> These patches are based on commit:
> 9565ab67c209 ("ShellPkg: smbiosview - Change some type 17 field values
> format")
>
> A version of the tree can be found at:
> https://github.com/AMDESE/ovmf/tree/sev-es-v22
>
> Cc: Andrew Fish
> Cc: Anthony Perard
> Cc: Ard Biesheuvel
> Cc: Benjamin You
> Cc: Dandan Bi
> Cc: Eric Dong
> Cc: Guo Dong
> Cc: Hao A Wu
> Cc: Jian J Wang
> Cc: Jordan Justen
> Cc: Julien Grall
> Cc: Laszlo Ersek
> Cc: Leif Lindholm
> Cc: Liming Gao
> Cc: Maurice Ma
> Cc: Michael D Kinney
> Cc: Ray Ni
>
> Changes since v13:
> - Fixup the AsmRelocateApLoop() call site so IA32 successfully boots APs.
> Do this by appending the three new parameters without altering the
> original parameter passing order.
> - Minor updates to description text and help text to expand the GHCB
> acronym.
>
> Changes since v12:
> - Change IA32 VMGEXIT .nasm file to issue an int 3. Depending on the
> version of NASM, the "BITS 64" trick to get NASM to recognize the
> VMMCALL instruction (VMGEXIT is a REP VMMCALL) caused an error. Since
> SEV-ES is X64 only, VMGEXIT should never be called in IA32.
>
> Changes since v11:
> - Make the XGETBV and VMGEXIT .nasm files buildable for all environments
> and remove the updates that add these instructions to GccInline.c
>
> Changes since v10:
> - Fix conflicts around GccInline.c file after moving to latest commit
> - Fix conflicts with OVMF PCD values after moving to latest commit
>
> Changes since v9:
> - Fixed bit field declarations in the GHCB structure to use UINT32
> and not UINT64.
> - Fixed a warning produced by VS2019 in the instruction parsing code
> by expliciting casting a bit shift to an INT64.
> - Sorted section entries in the OVMF VmgExitLib INF file.
> - Moved the new Maintainers.txt entry so entries remain sorted.
> - Documentation style fixes for return values.
> - Miscellaneous code style fixes.
>
> Changes since v8:
> - Move IOIO exit info definitions into Ghcb.h file
> - Add a macro for calculating IO instruction bytes (IOIO_DATA_BYTES)
> - Exception handler support for debug registers
> - Moved the DRx register saving changes into the UefiCpuPkg patch for
> base #VC support in CpuExceptionHandlerLib.
> - OvmfPkg VmgExitLib
> - Remove the .uni file
> - Update .inf file:
