From nobody Mon Nov 25 12:55:42 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+69866+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+69866+1787277+3901457@groups.io; arc=fail (BodyHash is different from the expected one); dmarc=fail(p=none dis=none) header.from=amd.com Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1609968209304802.5768824568584; Wed, 6 Jan 2021 13:23:29 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id CF27YY1788612xPmQLxOv0hu; Wed, 06 Jan 2021 13:23:27 -0800 X-Received: from NAM10-MW2-obe.outbound.protection.outlook.com (NAM10-MW2-obe.outbound.protection.outlook.com [40.107.94.73]) by mx.groups.io with SMTP id smtpd.web11.489.1609968202441317657 for ; Wed, 06 Jan 2021 13:23:22 -0800 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Yf1fctfa766CgRxMkiWYRQzFEbPM9ydaQZvInCp/z18eEjsPCKGVWRVbCnJGnH0B5J3oC/O/4P+uO7bXO4S77V4Hicm14H+wLe4BuVer6a7x2lvFzFiD81zTYYgEmHr2Cbmuv85EEqjtv/osYp89ENDtIVv2X5ZsK/7wierAZdukZqcaWwWiEFpKow8RlNqzBRc8JXa+EWxWJfYW7BqLOhA4gt1qVSgHOvrUElxSpJu87A7Ckx8wkIEkL+aLdDR8gR2+Fe104y+pes2zIa4aMBnn+2+eUIAHVEJWSBk0FOBSbs1jMDh2iMMRxQ20mjKPcGKYlRyKcJAcN214/C7uEg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xrWe/lVlufpffDCm+3yDZdIMpp8lRR1l0HrvZ/IqIgI=; b=N/hOWXSLEj3MA50Z2zYyUgY90iY6BykCk80elp2ufaAVV5J8ktslYS8Y2hIZcSfk+6v4qMZdRbGG20j0ufmF6/D3doLEQDAfwzMGayTNy+HrbtmfEuOyqQ41W9pAd7mAWjA2O6d1zFJh4KpM9M9jl73kPLTOBjyYu5qvAGOc6e9sn2JEQgdolA5t/FHBUn/Ls3tvpibxwBQkyuE1t8gaXl2zW3dO13ySD0E1ULuCsmPinMFPvhhDpMN92gawoLtk5u1sdwLezbVZ1sXkY6baz/gF8y7QgNn8R6JCRnbbqfL5m66E5oSqmRqrqxFgLLe+hLEDxCfTnPEBHuuTOWre/Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none X-Received: from DM5PR12MB1355.namprd12.prod.outlook.com (2603:10b6:3:6e::7) by DM5PR12MB1259.namprd12.prod.outlook.com (2603:10b6:3:75::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3742.6; Wed, 6 Jan 2021 21:23:20 +0000 X-Received: from DM5PR12MB1355.namprd12.prod.outlook.com ([fe80::d95e:b9d:1d6a:e845]) by DM5PR12MB1355.namprd12.prod.outlook.com ([fe80::d95e:b9d:1d6a:e845%12]) with mapi id 15.20.3721.024; Wed, 6 Jan 2021 21:23:20 +0000 From: "Lendacky, Thomas" To: devel@edk2.groups.io CC: Brijesh Singh , James Bottomley , Jordan Justen , Laszlo Ersek , Ard Biesheuvel Subject: [edk2-devel] [PATCH v2 08/15] OvmfPkg/AmdSevDxe: Clear encryption bit on PCIe MMCONFIG range Date: Wed, 6 Jan 2021 15:21:34 -0600 Message-ID: In-Reply-To: References: X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: SA0PR11CA0037.namprd11.prod.outlook.com (2603:10b6:806:d0::12) To DM5PR12MB1355.namprd12.prod.outlook.com (2603:10b6:3:6e::7) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-Received: from tlendack-t1.amd.com (165.204.77.1) by SA0PR11CA0037.namprd11.prod.outlook.com (2603:10b6:806:d0::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3742.6 via Frontend Transport; Wed, 6 Jan 2021 21:23:19 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: fdb60507-decb-4245-4b06-08d8b2894a7e X-MS-TrafficTypeDiagnostic: DM5PR12MB1259: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info: k+2H+gUQW4/mmvRf88F5QgV1KIudZXaJTCWSFROdj8wJzC+7hyr5iBRr0Aeqnnk3bv/RxbmxV6UTmQ+nK7NGquA7BKhysxl7JVcWrqWvnVMwwSow96lUwTlxQXFzHPpy1OY/39eYUvjWLv0mP4UY58A+dqIH7pS7Jz2Jaty3rMcc4J8gbCI+NG1cXy49zvY4IfJunnImiV14wuC0iH+1zxoDzRB23gjbhnXz95I/xrR/fMJ+PEIsaxRdeLAt2DcXfUTgF1mf8rfSNk4V2LoP3xMKGDdmtyKrdMLfSS1zKRbrsEH2MEczgmCx+TB1LxuHewTIkmw5/MU5ZQUWm+ZP042+YpVOpvdCgQNJVWZEtjzYAdpl/MKzqiPqRccWr7saciCTCfcleI30/eIOacHFwCpmv/mqiCK2xzYJgrItYtYUBQjcTVhJRvjm8302RKQdRF7O+CAziCV9yPN7QLYycw== X-MS-Exchange-AntiSpam-MessageData: =?us-ascii?Q?1A/r129cXAWBE2Hc/Yc+wov8sHdppbyhKxkBGkXlIs+rCV0DlUy58kYWNfwx?= =?us-ascii?Q?dPwlxCbXC1Et3N2eMJhBg20gNnP0/Fxu7GzV9YI9xl5E2+yXSIOvnTmAklwn?= =?us-ascii?Q?8L3SLIoGOrnp9wuYA7y4fqkurjp9aAhjBLrzBUcLU9ue0AFfSykjx+pexEOg?= =?us-ascii?Q?X24qhYVxjXuhq6KZHdHQ1RZxOtReVkEnXVjQzXwV7Oq98fPszarE6PoHlAoU?= =?us-ascii?Q?jrwgtQF/6XhyHh4cr6uxg7x2Q26wbPt3CI9s78jrSqeMkdKlRoU2UGkwD9Ho?= =?us-ascii?Q?wGHwjP8gKrmSXtQ36VHg3qYU6ylZXxNKY2PudUMROsTtzqRK2rzNtYlw/YT2?= =?us-ascii?Q?0BsXRdryRp0RqhVkdZ0AdKvxJVz018Rt5fsHhXc6xIRx+Prm2jlFUUMv7FP2?= =?us-ascii?Q?rZJEwKl4lTAblJ9D0V7F5cx2pw8T5Mz0hQsIE2VswgbQdFJTPtwfT3GSpPSt?= =?us-ascii?Q?tIIW0B+5t5BEre5WxaJjD0p1kkLZPjJnPY/pd5KigBe15dHzmXChd/tS5Uvi?= =?us-ascii?Q?qaBYOqU0AbiByg3i37eO7PoTa1VqzYYoA1x3jKmLTrosvGTDpx6zKsmgicel?= =?us-ascii?Q?DBz8oyrzJI6uqIeW32yujk+/00Q45h31OBcHA4tU514/9YWgTd1uT62ZHPjR?= =?us-ascii?Q?+GHBNlOk2zUdBS9a3OO0isF9CNSDr4LnnM69XfGCFt4GIbKcUqGIl/jxCQSj?= =?us-ascii?Q?hokbAJwVsnytY+fvk9dJKw/i4lmQCgIDqqnSsHq+JdBpUm5QC2Dlfl0BCelD?= =?us-ascii?Q?YohTLOQXuwBKWqdiSd9A8NQ0LBLdImsqYVP66B9oKnyoVmN/lxScgRX+y5Il?= =?us-ascii?Q?7vIj6Rj1W2Uu+75uobAhezC0YedVwj2InlfZqJJbZCpTpvPaDQNY2wRQcLVJ?= =?us-ascii?Q?XeeO0SGNvDfwwjKISJEJEOZjR2z7BWPPIvYdb5T2gCUnbRNE2BW3ytrRmP7R?= =?us-ascii?Q?bRW3i9lcWxCgh3hoVKNm7YpDvfhQVGeSfhmY3e8414o4W36pvp2tw3DA1HCt?= =?us-ascii?Q?+ILQ?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-AuthSource: DM5PR12MB1355.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Jan 2021 21:23:19.6772 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-Network-Message-Id: fdb60507-decb-4245-4b06-08d8b2894a7e X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: HdBAvUlO+08c2ZpcpAzpVzai3VteEC/941qoitNMpf1n1a6SYGheSwAXyfemJCXre3lOQ35fDurjpIUZ7OV8Uw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR12MB1259 Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,thomas.lendacky@amd.com X-Gm-Message-State: uKnKXcmR7qTqjOYhLnihNdJox1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1609968207; bh=ujSHZmBGDP2+k1COrMqF7iMaz/2mm1iDrpMVqrMR7lM=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=QtGkOCzI+qu1Its40n44EYto03KM2pFR7hZJ6CgTbOsrBK3MI5DZSJUzLEobNJtPSSS GRCR/7UvQEW/WppKRe2Eiw+KtE/x+u6rg40GP4ZhKJirXRw2CQgVOjKFMeGRyZ5YOypDA V6g+4l1sLxgebzsDSA5PNDnsqlnEh3NfdYc= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Type: text/plain; charset="utf-8" From: Tom Lendacky BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3108 The PCIe MMCONFIG range should be treated as an MMIO range. However, there is a comment in the code explaining why AddIoMemoryBaseSizeHob() is not called. The AmdSevDxe walks the GCD map looking for MemoryMappedIo or NonExistent type memory and will clear the encryption bit for these ranges. Since the MMCONFIG range does not have one of these types, the encryption bit is not cleared for this range. Add support to detect the presence of the MMCONFIG range and clear the encryption bit. This will be needed for follow-on support that will validate that MMIO is not being performed to an encrypted address range under SEV-ES. Even though the encryption bit was set for this range, this still worked under both SEV and SEV-ES because the address range is marked by the hypervisor as MMIO in the nested page tables: - For SEV, access to this address range triggers a nested page fault (NPF) and the hardware supplies the guest physical address (GPA) in the VMCB's EXITINFO2 field as part of the exit information. However, the encryption bit is not set in the GPA, so the hypervisor can process the request without any issues. - For SEV-ES, access to this address range triggers a #VC. Since OVMF runs identity mapped (VA =3D=3D PA), the virtual address is used to avoid the lookup of the physical address. The virtual address does not have the encryption bit set, so the hypervisor can process the request without any issues. Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Brijesh Singh Reviewed-by: Laszlo Ersek Signed-off-by: Tom Lendacky --- OvmfPkg/AmdSevDxe/AmdSevDxe.inf | 8 +++++++- OvmfPkg/AmdSevDxe/AmdSevDxe.c | 20 +++++++++++++++++++- 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf b/OvmfPkg/AmdSevDxe/AmdSevDxe.= inf index dd9ecc789a20..0676fcc5b6a4 100644 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.inf @@ -2,7 +2,7 @@ # # Driver clears the encryption attribute from MMIO regions when SEV is en= abled # -# Copyright (c) 2017, AMD Inc. All rights reserved.
+# Copyright (c) 2017 - 2020, AMD Inc. All rights reserved.
# # SPDX-License-Identifier: BSD-2-Clause-Patent # @@ -39,3 +39,9 @@ [Depex] =20 [FeaturePcd] gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire + +[FixedPcd] + gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress + +[Pcd] + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfHostBridgePciDevId diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.c b/OvmfPkg/AmdSevDxe/AmdSevDxe.c index 595586617882..689bfb376d03 100644 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.c +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.c @@ -4,12 +4,13 @@ in APRIORI. It clears C-bit from MMIO and NonExistent Memory space when = SEV is enabled. =20 - Copyright (c) 2017, AMD Inc. All rights reserved.
+ Copyright (c) 2017 - 2020, AMD Inc. All rights reserved.
=20 SPDX-License-Identifier: BSD-2-Clause-Patent =20 **/ =20 +#include #include #include #include @@ -65,6 +66,23 @@ AmdSevDxeEntryPoint ( FreePool (AllDescMap); } =20 + // + // If PCI Express is enabled, the MMCONFIG area has been reserved, rather + // than marked as MMIO, and so the C-bit won't be cleared by the above w= alk + // through the GCD map. Check for the MMCONFIG area and clear the C-bit = for + // the range. + // + if (PcdGet16 (PcdOvmfHostBridgePciDevId) =3D=3D INTEL_Q35_MCH_DEVICE_ID)= { + Status =3D MemEncryptSevClearPageEncMask ( + 0, + FixedPcdGet64 (PcdPciExpressBaseAddress), + EFI_SIZE_TO_PAGES (SIZE_256MB), + FALSE + ); + + ASSERT_EFI_ERROR (Status); + } + // // When SMM is enabled, clear the C-bit from SMM Saved State Area // --=20 2.30.0 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#69866): https://edk2.groups.io/g/devel/message/69866 Mute This Topic: https://groups.io/mt/79485062/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-