Re: TCG MOR and processor caches

[Laszlo Ersek <lersek@redhat.com>]

On 09/27/18 13:45, Laszlo Ersek wrote:
> On 09/27/18 12:59, Marc-André Lureau wrote:
>> Hi,
>>
>> According to "TCG Platform Reset Attack Mitigation Specification", if
>> MOR bit is set, "it must initiate a vendor-specific method that
>> overwrites all of system memory and the processor caches"
>>
>> In QuarkPlatformPkg/Platform/Pei/PlatformInit/MemoryCallback.c and
>> QuarkPlatformPkg/Platform/Pei/PlatformInit/MrcWrapper.c, there is some
>> code to clear RAM, however I don't see code that would clear the
>> processor caches.
>>
>> For edk2/qemu, Paolo suggested it may be simpler to clear the cache
>> unconditionally. How would you implement that? Using
>> EFI_CPU_ARCH_PROTOCOL.FlushDataCache? (or direct AsmWbinvd call)
> 
> I would call the appropriate low-level BaseLib.h function somewhere in
> OvmfPkg/PlatformPei (unconditionally, yes). I haven't looked into
> AsmWbinvd(), but if that's the right function, call that. (Checking the
> Intel SDM re: WBINVD, I agree it could be the right one.)

BTW: I assume the caches should be flushed on all logical processors; is
that correct? If so, then EFI_PEI_MP_SERVICES_PPI will be needed, to run
AsmWbinvd() on all processors. Luckily, OvmfPkg/PlatformPei already uses
that service; see "OvmfPkg/PlatformPei/FeatureControl.c".

Thanks
Laszlo