From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (NAM12-BN8-obe.outbound.protection.outlook.com [40.107.237.61]) by mx.groups.io with SMTP id smtpd.web12.852.1631557211439854610 for ; Mon, 13 Sep 2021 11:20:12 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="body hash did not verify" header.i=@amd.com header.s=selector1 header.b=HZ485r7x; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.237.61, mailfrom: brijesh.singh@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jNGRTtiV/iCEapXgMKMIPOKgE5SWM3G7g1gjjJSZwqQ3tDLBXgq+tZs7FN139Id1qrgfCPyViyD9q6vkPN539RkwbAbsfgPvy75wY6oVkZc9YRPmcXv/aeUJSIowq0xJo5g7Cyxi4p0XC/zbqRYtf6wrNMXKn+JwVKsheQHHY7OfhZsS7xf2PMheo4KeC+ckxlKlyJWFu2YPk81guTPQk6zTKzjH5Q96k1xLg/ZAlaM1PgbzG0QNCa2sysgTtoyyd0AvSypdaEBDWQX8Kd7dt0aIe3KmLnOLZrBmsxEPyqda+0LmHkpr+jgqDLDcudxyU6eaFwdHPb5GCcuUUcdiLg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=qXYRP+aR4/i1z7BMbxfsNn9vdi4PDHz1KPX6notyqJQ=; b=RNXRUzLtkmkHGjHg8A7fDgb49wUP+v2tNnJn3j/HswmCxeIfR2glS9aDrXJ9NgE+LbiKPZV52xYjgG1fi6ZX9oUQ2BqgEPlTYVR+Vp6CBB+lUw3L/PUApwiqDjqGm1WfHwnLRP2Tch88StweBM8i+R0b8VUnyGKbAOofRGJfU1xqSZkICsoB/HY7vnNgwmZAUaHKeBVcwcdjI+gzlUhZdgSWjbP6d4uPLA9uWcWe8l3Nokjg5uyj1ymeB1nPEN9Fv95C6TLXLSmXaYfQg9pJeCDBa1FAKEK13cYbXmfyN8vDkucs2oG4A6oPfAEkenZJ91aXqOoW/PapZSflWKxmrg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qXYRP+aR4/i1z7BMbxfsNn9vdi4PDHz1KPX6notyqJQ=; b=HZ485r7x1lUesFXgzPILu3GVOaErFcP616xNRhM1TXKeiZJUAgXHdmexdN4HY2RfSklPqiiu167Y5eHQOj2Dh+UVjaVd7gR/xMpFS82AkX8GmGKjfTzo9kp/v0rhoMSYvvlBzMvGBWxtb5evHp+jS9Xsj1huH4zuSNpk3LLuV7I= Authentication-Results: edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SN1PR12MB2512.namprd12.prod.outlook.com (2603:10b6:802:31::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4500.14; Mon, 13 Sep 2021 18:20:10 +0000 Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4500.019; Mon, 13 Sep 2021 18:20:10 +0000 From: "Brijesh Singh" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [PATCH v7 15/31] OvmfPkg/BaseMemEncryptSevLib: skip the pre-validated system RAM Date: Mon, 13 Sep 2021 13:19:25 -0500 Message-ID: <20210913181941.23405-16-brijesh.singh@amd.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210913181941.23405-1-brijesh.singh@amd.com> References: <20210913181941.23405-1-brijesh.singh@amd.com> X-ClientProxiedBy: SA9P221CA0012.NAMP221.PROD.OUTLOOK.COM (2603:10b6:806:25::17) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) Return-Path: brijesh.singh@amd.com MIME-Version: 1.0 Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SA9P221CA0012.NAMP221.PROD.OUTLOOK.COM (2603:10b6:806:25::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4500.14 via Frontend Transport; Mon, 13 Sep 2021 18:20:10 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 695e7103-9956-4581-97c3-08d976e31f3e X-MS-TrafficTypeDiagnostic: SN1PR12MB2512: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8882; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: wHMAp+xtCUqW9eW5RWcMz+KN55dvW7sQmU0laTOkhpfQyxdmLy1OzWHjtJioHhKa4Dqio+24BjJu0SefZ1SjjMm7KdaW7+nxmAJlhU94CCj3PlVMB3S9EWe97i0GaFdVXZNYu91MSozBXPtpZRIfN66bC6rx9hvtlTq7opJ4ncs+Ob2r2TSngbh3kmuR3DQZ24ucIk1BQJu6mahJ5zFbikgZW/GC3LrzPwR5v15KaeHvZyydIu9PlPVaqLpOrCHbqcmsE51tbjji1tFc97qKjZLNnLxuamVbfAT4wq93sMT7ffqMf66wzmtgeh8Lz4PRANLvpPyOofxjgb685uC8vJbz7qoQhSngmaJuiP8MrJ7IhHzqtqpTloJylRDIwC8KFsVkXJJEt/XxkVk0rbYeBDRGjjZUWhiGEoftc4rHbYjJ1m2J/AMU2X1qQ1Rkpf22IbBus2sJkkW0IF7W9gacyQtKm7zSFYr+RKS9G5aiGK7gfzrp8UCugThOhAEUn0rjWTCx4/qKjaPDFjrLgDCeVvRt0C9AL0Lv5GMmoGOMa3a7QYl/ZWbBgOaXYTWQfRpYo4MKw8P/YLDALIghjK8pi9mxCuHUQKeG/UZuwYUqL1ucCxprm4T9ad0yhMX3Yj8Qxn0qVzPxkmgcYC/KzJBMuGHAonH+Ge6/NcALIZVGVEmc93K5YvcEYvHUOlnLsWpZ737WogUz7CBsu0YN1hEM420rA1yWhhWYMwQ6ky9zv48IcsXHtf4bSzZePw8YLdaYn88AqqQ2ixwfZslLWvrSLs+/t/bD6bHYuIjm3pPpc4wqoTMJNr7Ib3eKgiXRql0q X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2718.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(396003)(346002)(39860400002)(366004)(376002)(136003)(83380400001)(478600001)(86362001)(8936002)(966005)(6486002)(8676002)(186003)(6916009)(2906002)(15650500001)(38350700002)(38100700002)(26005)(36756003)(19627235002)(956004)(2616005)(66946007)(6666004)(66556008)(54906003)(5660300002)(52116002)(44832011)(66476007)(316002)(4326008)(1076003)(7696005)(213903007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?DGn0xGQrDVLypJxTqq3eGIOtaVDI5Qx/sHu9CrwK6Oor0YldLrDd60A9r5U9?= =?us-ascii?Q?cLTlFqRV1+Tg9cTcbHf5G2sRAv+6Mhjm+iMcVsCvgP0XSM6n0yHYSDNwja4L?= =?us-ascii?Q?sCN0rtn2KxcuoAita4O/bPyLrwX6tllRJZ5H11ELc+K+oWVqXsNl9n1Fpeah?= =?us-ascii?Q?4cf3sr0KiYKR81IorHhH9KKjlDwEkBgZm8a/T2xiuF5Bv34hh8GnuDbhu7be?= =?us-ascii?Q?KyWhvfKrM5dUqMGXmMYv9voqvOBLVOoEgFHaSml5uIAr6h47goi7nADYCzIy?= =?us-ascii?Q?7juVrkauaX89IFh4BVnCZNIVvupl7GZkvowLePxIDwfgWDjcjaXbM0x7zrrs?= =?us-ascii?Q?mHvBK7tZhEB7/qeBJKTkJaUQF1uG8wwh67f4PXjK/e/+fQ5uS/AP0AZqzCEH?= =?us-ascii?Q?A3cHrhF8iy2B2Y4RYshY3JPTF+4W+/srgLN7Ul+3QPFOWW+txGRXiDqnyh1q?= =?us-ascii?Q?HsIsXiaD2n9qs/10YAalD7fG3WaKZ1i4rgLGNr1IDyumeHvnJhfI8xAMlJGb?= =?us-ascii?Q?W6+/PiOIjxT04v+S367AXOQu+KqSWbYq/tukpIAhtMspXPGWplntRBwSUPtV?= =?us-ascii?Q?3c+7vFghKesygyWjRZhwXENWgbHh1Nkd5komqqQUbH7jZqbaM5bSWkdiM/OF?= =?us-ascii?Q?WsWNBGl7xzm0x5JwKYefOBdXn5EIXeZMOHtgCo/SUr0cyCplq4wcSnn20SLP?= =?us-ascii?Q?6D+I/0TAjwCfEWzugf6POB5ZfodDVuGXxjHoeCrYtS9MAmL7q/BuSd8M45C7?= =?us-ascii?Q?PJOgeIFmTCrOC6Ny+W5MyCTqQZ6Fewj0bYVY/x02YMjiIjzBJOaQlsYwKp/N?= =?us-ascii?Q?Mygx3bga5Sm5bddJ2LbrgQtHMI2IlGOqJl5Su+HbR9n7kF34mAttwFkug999?= =?us-ascii?Q?C9aBhU0eYoTbsfVIbDbMg7mPC/EotcFPk/gOoz4c0F3gLFtqGV9NstXH2cPM?= =?us-ascii?Q?y3csgz7j70rZw6O6AeS3z37gs3u8GiMBHz5ReWLmJ1KGuV1hexHQYzbGfNCu?= =?us-ascii?Q?mKwuYiIoSUMJsZmBX7KtIn4MG1v1tAFryw+S9+LDimf0LkqGhjnd3+PlCyIq?= =?us-ascii?Q?om7GtJ38XTmr3dAFntdtVa1pvnKaiN8SZ2eZm5i8VRK5OlE3eGMW7nGifQ6B?= =?us-ascii?Q?H63MWjqFAROFQNsJLhsituo2hrOtxiloXU1PZKj8LTfJMYWYYYaqDXE7kw+8?= =?us-ascii?Q?Bu0RXqT1eBLfYE3vuw9w5/52lyrB6NsPhxePuYfyrWaQ64okERm6AI+xVAt3?= =?us-ascii?Q?nB1fA/0u5G7cQjMoYImmvmqDpxQv2lGcOsWPqtQ5JCrbAvrluUMUfotq7JMq?= =?us-ascii?Q?XoRh6WWmz+uq7+x5RDkkdOf3?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 695e7103-9956-4581-97c3-08d976e31f3e X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Sep 2021 18:20:10.5544 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: irOtvorE/oXdEmrjstUuUzlwFWrOG5OBishVB8IuV7pCX5QINMAjDtWUfRWPGqjDHxi4pJFa0Iw9Tl9+fHIWiQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB2512 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 The MemEncryptSevSnpPreValidateSystemRam() is used for pre-validating the system RAM. As the boot progress, each phase validates a fixed region of the RAM. In the PEI phase, the PlatformPei detects all the available RAM and calls to pre-validate the detected system RAM. While validating the system RAM in PEI phase, we must skip previously validated system RAM to avoid the double validation. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Acked-by: Jiewen Yao Signed-off-by: Brijesh Singh --- .../PeiMemEncryptSevLib.inf | 20 ++++ .../X64/PeiSnpSystemRamValidate.c | 102 +++++++++++++++++- 2 files changed, 121 insertions(+), 1 deletion(-) diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf index 0402e49a1028..1cc9dd6691a2 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf @@ -57,4 +57,24 @@ [FeaturePcd] gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire =20 [FixedPcd] + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfCpuidBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfCpuidSize gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecretsSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbPageTableBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbPageTableSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPageTablesSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfLockBoxStorageBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfLockBoxStorageSize + gEfiMdePkgTokenSpaceGuid.PcdGuidedExtractHandlerTableAddress + gUefiOvmfPkgTokenSpaceGuid.PcdGuidedExtractHandlerTableSize diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValida= te.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c index 64aab7f45b6d..eae7a31773a4 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c @@ -14,6 +14,81 @@ =20 #include "SnpPageStateChange.h" =20 +typedef struct { + UINT64 StartAddress; + UINT64 EndAddress; +} SNP_PRE_VALIDATED_RANGE; + +STATIC SNP_PRE_VALIDATED_RANGE mPreValidatedRange[] =3D { + // The below address range was part of the OVMF metadata, and range + // should be pre-validated by the Hypervisor. + { + FixedPcdGet32 (PcdOvmfSecPageTablesBase), + FixedPcdGet32 (PcdOvmfSecPageTablesBase) + FixedPcdGet32 (PcdOvmfSecPa= geTablesSize), + }, + { + FixedPcdGet32 (PcdOvmfLockBoxStorageBase), + FixedPcdGet32 (PcdOvmfLockBoxStorageBase) + FixedPcdGet32 (PcdOvmfLock= BoxStorageSize), + }, + { + FixedPcdGet64 (PcdGuidedExtractHandlerTableAddress), + FixedPcdGet64 (PcdGuidedExtractHandlerTableAddress) + FixedPcdGet32 (P= cdGuidedExtractHandlerTableSize) + }, + { + FixedPcdGet32 (PcdOvmfSecGhcbPageTableBase), + FixedPcdGet32 (PcdOvmfSecGhcbPageTableBase) + FixedPcdGet32 (PcdOvmfSe= cGhcbPageTableSize), + }, + { + FixedPcdGet32 (PcdOvmfSecGhcbBase), + FixedPcdGet32 (PcdOvmfSecGhcbBase) + FixedPcdGet32 (PcdOvmfSecGhcbSize= ), + }, + { + FixedPcdGet32 (PcdOvmfWorkAreaBase), + FixedPcdGet32 (PcdOvmfWorkAreaBase) + FixedPcdGet32 (PcdOvmfWorkAreaSi= ze), + }, + { + FixedPcdGet32 (PcdOvmfSecGhcbBackupBase), + FixedPcdGet32 (PcdOvmfSecGhcbBackupBase) + FixedPcdGet32 (PcdOvmfSecGh= cbBackupSize), + }, + { + FixedPcdGet32 (PcdOvmfSnpSecretsBase), + FixedPcdGet32 (PcdOvmfSnpSecretsBase) + FixedPcdGet32 (PcdOvmfSnpSecre= tsSize), + }, + { + FixedPcdGet32 (PcdOvmfCpuidBase), + FixedPcdGet32 (PcdOvmfCpuidBase) + FixedPcdGet32 (PcdOvmfCpuidSize), + }, + { + FixedPcdGet32 (PcdOvmfSecPeiTempRamBase), + FixedPcdGet32 (PcdOvmfSecPeiTempRamBase) + FixedPcdGet32 (PcdOvmfSecPe= iTempRamSize), + }, +}; + +STATIC +BOOLEAN +DetectPreValidatedOverLap ( + IN PHYSICAL_ADDRESS StartAddress, + IN PHYSICAL_ADDRESS EndAddress, + OUT SNP_PRE_VALIDATED_RANGE *OverlapRange + ) +{ + UINTN i; + + // + // Check if the specified address range exist in pre-validated array. + // + for (i =3D 0; i < ARRAY_SIZE (mPreValidatedRange); i++) { + if ((mPreValidatedRange[i].StartAddress < EndAddress) && + (StartAddress < mPreValidatedRange[i].EndAddress)) { + OverlapRange->StartAddress =3D mPreValidatedRange[i].StartAddress; + OverlapRange->EndAddress =3D mPreValidatedRange[i].EndAddress; + return TRUE; + } + } + + return FALSE; +} + /** Pre-validate the system RAM when SEV-SNP is enabled in the guest VM. =20 @@ -28,9 +103,34 @@ MemEncryptSevSnpPreValidateSystemRam ( IN UINTN NumPages ) { + PHYSICAL_ADDRESS EndAddress; + SNP_PRE_VALIDATED_RANGE OverlapRange; + if (!MemEncryptSevSnpIsEnabled ()) { return; } =20 - InternalSetPageState (BaseAddress, NumPages, SevSnpPagePrivate, TRUE); + EndAddress =3D BaseAddress + EFI_PAGES_TO_SIZE (NumPages); + + while (BaseAddress < EndAddress) { + // + // Check if the range overlaps with the pre-validated ranges. + // + if (DetectPreValidatedOverLap (BaseAddress, EndAddress, &OverlapRange)= ) { + // Validate the non-overlap regions. + if (BaseAddress < OverlapRange.StartAddress) { + NumPages =3D EFI_SIZE_TO_PAGES (OverlapRange.StartAddress - BaseAd= dress); + + InternalSetPageState (BaseAddress, NumPages, SevSnpPagePrivate, TR= UE); + } + + BaseAddress =3D OverlapRange.EndAddress; + continue; + } + + // Validate the remaining pages. + NumPages =3D EFI_SIZE_TO_PAGES (EndAddress - BaseAddress); + InternalSetPageState (BaseAddress, NumPages, SevSnpPagePrivate, TRUE); + BaseAddress =3D EndAddress; + } } --=20 2.17.1