[Bug]: AMD SEV-SNP: SVSM-populated secrets fields not respected

[deeglaze]

Is there an existing issue for this?

• I have searched existing issues

Bug Type

• Firmware
• Tool
• Unit Test

Code first?

• Yes

What packages are impacted?

OvmfPkg

Which targets are impacted by this bug?

DEBUG, NO-TARGET, NOOPT, RELEASE

Current Behavior

The PcdsFixedAtBuild-classified PcdOvmfSecSvsmCaaBase and PcdOvmfSecSvsmCaaSize as located at

edk2/OvmfPkg/OvmfPkgX64.fdf

Line 97 in 87f1432

0x00F000|0x001000

ought to instead be populated as

• the 64-bit value at offset 0x150 of the AMD SEV secrets page
• 0x1000

respectively [1]. Relatedly, the base/size values at offsets 0x140, 0x148 ought to define a reserved memory HOB. We can restrict these allocations to be within few pre-determined areas to ensure we know exactly which HOBs to break up.

[1] https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/58019.pdf table 1

Expected Behavior

The CAA_BASE can be set by the SVSM itself in the Secrets page, subject to some restrictions

Steps To Reproduce

Populate the CAA_BASE field in SVSM be somewhere else and try to communicate with SVSM at that address. If you're lucky it crashes. If you're unlucky, you corrupt memory.

Build Environment

- OS(s): Any
- Tool Chain(s): Any

Version Information

Current

Urgency

Medium

Are you going to fix this?

Someone else needs to fix it

Do you need maintainer feedback?

Maintainer feedback requested

Anything else?

Request feedback from Thomas Lendacky.