From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga04.intel.com (mga04.intel.com [192.55.52.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id ECB4980369 for ; Wed, 8 Mar 2017 10:38:16 -0800 (PST) Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmsmga104.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 08 Mar 2017 10:38:16 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.36,265,1486454400"; d="scan'208";a="73188463" Received: from dhillons-mobl1.amr.corp.intel.com (HELO localhost) ([10.254.182.128]) by orsmga005.jf.intel.com with ESMTP; 08 Mar 2017 10:38:15 -0800 MIME-Version: 1.0 To: Brijesh Singh , edk2-devel@lists.01.org, lersek@redhat.com Message-ID: <148899829524.16179.6226467722763003659@jljusten-skl> From: Jordan Justen In-Reply-To: <148884285589.29188.3336162059588227554.stgit@brijesh-build-machine> Cc: Thomas.Lendacky@amd.com, leo.duran@amd.com, brijesh.sing@amd.com References: <148884284887.29188.7643544710695103939.stgit@brijesh-build-machine> <148884285589.29188.3336162059588227554.stgit@brijesh-build-machine> User-Agent: alot/0.5.1 Date: Wed, 08 Mar 2017 10:38:15 -0800 Subject: Re: [RFC PATCH v1 1/5] OvmfPkg/ResetVector: Set memory encryption when SEV is active X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Mar 2017 18:38:17 -0000 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable On 2017-03-06 15:27:35, Brijesh Singh wrote: > SEV guest VMs have the concept of private and shared memory. Private > memory is encrypted with the guest-specific key, while shared memory > may be encrypted with hypervisor key. The C-bit (encryption attribute) > in PTE indicates whether the page is private or shared. > = > If SEV is active, set the memory encryption attribute while building > the page table. > = > Contributed-under: TianoCore Contribution Agreement 1.0 > Signed-off-by: Brijesh Singh > --- > OvmfPkg/ResetVector/Ia32/PageTables64.asm | 52 +++++++++++++++++++++++= ++++++ > 1 file changed, 52 insertions(+) > = > diff --git a/OvmfPkg/ResetVector/Ia32/PageTables64.asm b/OvmfPkg/ResetVec= tor/Ia32/PageTables64.asm > index 6201cad..eaf9732 100644 > --- a/OvmfPkg/ResetVector/Ia32/PageTables64.asm > +++ b/OvmfPkg/ResetVector/Ia32/PageTables64.asm > @@ -26,6 +26,7 @@ BITS 32 > %define PAGE_GLOBAL 0x0100 > %define PAGE_2M_MBO 0x080 > %define PAGE_2M_PAT 0x01000 > +%define KVM_FEATURE_SEV 0x08 > = > %define PAGE_2M_PDE_ATTR (PAGE_2M_MBO + \ > PAGE_ACCESSED + \ > @@ -37,6 +38,33 @@ BITS 32 > PAGE_READ_WRITE + \ > PAGE_PRESENT) > = > +; Check if Secure Encrypted Virtualization (SEV) feature > +; is enabled in KVM > +; > +; If SEV is enabled, then EAX will contain Memory encryption bit positi= on > +; > +CheckKVMSEVFeature: Code style would be CheckKvmSevFeature. -Jordan > + ; Check for SEV feature > + ; CPUID KVM_FEATURE - Bit 8 > + mov eax, 0x40000001 > + cpuid > + bt eax, KVM_FEATURE_SEV > + jnc NoSev > + > + ; Get memory encryption information > + ; CPUID Fn8000_001F[EBX] - Bits 5:0 > + ; > + mov eax, 0x8000001f > + cpuid > + mov eax, ebx > + and eax, 0x3f > + jmp SevExit > + > +NoSev: > + xor eax, eax > + > +SevExit: > + OneTimeCallRet CheckKVMSEVFeature > = > ; > ; Modified: EAX, ECX > @@ -60,18 +88,41 @@ clearPageTablesMemoryLoop: > mov dword[ecx * 4 + PT_ADDR (0) - 4], eax > loop clearPageTablesMemoryLoop > = > + ; Check if it SEV-enabled Guest > + ; > + OneTimeCall CheckKVMSEVFeature > + xor edx, edx > + test eax, eax > + jz SevNotActive > + > + ; If SEV is enabled, Memory encryption bit is always above 31 > + mov ebx, 32 > + sub ebx, eax > + bts edx, eax > + > +SevNotActive: > + > + ; > ; > ; Top level Page Directory Pointers (1 * 512GB entry) > ; > + ; edx contain the memory encryption bit mask, must be applied > + ; to upper 31 bit on 64-bit address > + ; > mov dword[PT_ADDR (0)], PT_ADDR (0x1000) + PAGE_PDP_ATTR > + mov dword[PT_ADDR (4)], edx > = > ; > ; Next level Page Directory Pointers (4 * 1GB entries =3D> 4GB) > ; > mov dword[PT_ADDR (0x1000)], PT_ADDR (0x2000) + PAGE_PDP_ATTR > + mov dword[PT_ADDR (0x1004)], edx > mov dword[PT_ADDR (0x1008)], PT_ADDR (0x3000) + PAGE_PDP_ATTR > + mov dword[PT_ADDR (0x100C)], edx > mov dword[PT_ADDR (0x1010)], PT_ADDR (0x4000) + PAGE_PDP_ATTR > + mov dword[PT_ADDR (0x1004)], edx > mov dword[PT_ADDR (0x1018)], PT_ADDR (0x5000) + PAGE_PDP_ATTR > + mov dword[PT_ADDR (0x100C)], edx > = > ; > ; Page Table Entries (2048 * 2MB entries =3D> 4GB) > @@ -83,6 +134,7 @@ pageTableEntriesLoop: > shl eax, 21 > add eax, PAGE_2M_PDE_ATTR > mov [ecx * 8 + PT_ADDR (0x2000 - 8)], eax > + mov [(ecx * 8 + PT_ADDR (0x2000 - 8)) + 4], edx > loop pageTableEntriesLoop > = > ; > = > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel