From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM11-DM6-obe.outbound.protection.outlook.com (NAM11-DM6-obe.outbound.protection.outlook.com [40.107.223.49]) by mx.groups.io with SMTP id smtpd.web11.47435.1624283837645170051 for ; Mon, 21 Jun 2021 06:57:17 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@amd.com header.s=selector1 header.b=NbE4kgPC; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.223.49, mailfrom: ashish.kalra@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=NLoLFaJ0KJQ9nsVqARhA0F2HYxcJxa3OxYKrIBzNg89eSryEjILo/sbFpsgUWJS0Gq9RzBUjEf0iQUksfPxcatnMPkjE0tIP4SVJVNmA0VJoPAcFEps7LJeNPYkz4D0ijbGoS0XuqrWxg83ipjUJauaeIJXAVYLFdbiOW0WGCd3IGa5RSHuVl0cWNEKhxn4AwTU6orHoD8Je57Streq8AWV9bhIZ3NmkHPfQeI5tzHWfLtTIKD7RJGUuFqh0aDajD5byEjnTAMXWXsSwOi71d9BxheFtbDy+hbPyXJkYlxlUa1QHwmv2+3mBZfGHkHL0SjfEZnJHzbptsCFn9J8xqw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sDsYiUHbgCCsciVssX8I7wKSLZYM3PDdu4kQzH2qfX4=; b=n6QXd8gPLJ+xevYgt8zrJiXofVtgirdTB4kDOhjQO81cxeXWNW+mJXd1PVvCd/MIbPlJXhwSFsgpYZKN39HEuLYqwjQ2FIpMP29FvD18lpa7t1I+KhmJOOLmD8yp5epLNWUQ8jP0otAhXK65Kid3uHzwVq23t0VDPgpZRxcKOmulBH/dDirHjSqbnl3wMJQegeC+eJluaMddLFZruF0zOhr9hM06Gk0uWoAQsDcktWOb+EWYaxksdSAOuKHCIERCBm3/WQ+gzrSPZQ9Cshlg7Zkuw2jc5Nt+T1Nw93aGojdcoFuES0fmOvCcvIH/swZk/DPKlr0woxrRStqFqXAPBg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sDsYiUHbgCCsciVssX8I7wKSLZYM3PDdu4kQzH2qfX4=; b=NbE4kgPCz3GNJSv18C/NLH6H1a5dX+qJpJJToTfF6WJjYZASAL00a+5QzvWkWqQRLcocwrysWPD8cnQ8xkiOpM+GM+tfDRmGULMyeX92kcJhAVB8BP/TVQVun1Q8q/4gxgzjWZw5fF1DW6fjzxC/pbmUIsYCzXkELEa8NFO16OA= Authentication-Results: edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) by SN6PR12MB2781.namprd12.prod.outlook.com (2603:10b6:805:67::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4242.23; Mon, 21 Jun 2021 13:57:16 +0000 Received: from SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::958d:2e44:518c:744c]) by SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::958d:2e44:518c:744c%7]) with mapi id 15.20.4242.023; Mon, 21 Jun 2021 13:57:16 +0000 From: "Ashish Kalra" To: devel@edk2.groups.io Cc: brijesh.singh@amd.com, Thomas.Lendacky@amd.com, jejb@linux.ibm.com, erdemaktas@google.com, jiewen.yao@intel.com, min.m.xu@intel.com, lersek@redhat.com, jordan.l.justen@intel.com, ard.biesheuvel@arm.com Subject: [PATCH v4 2/4] OvmfPkg/BaseMemEncryptLib: Support to issue unencrypted hypercall Date: Mon, 21 Jun 2021 13:57:06 +0000 Message-Id: <3bfdbe553d597f489a03c21fbc0f6c614f92c32f.1624281247.git.ashish.kalra@amd.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: References: X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: SN4PR0801CA0014.namprd08.prod.outlook.com (2603:10b6:803:29::24) To SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) Return-Path: Ashish.Kalra@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from ashkalra_ubuntu_server.amd.com (165.204.77.1) by SN4PR0801CA0014.namprd08.prod.outlook.com (2603:10b6:803:29::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4242.18 via Frontend Transport; Mon, 21 Jun 2021 13:57:15 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 5d77dc17-f487-4c4d-db01-08d934bc79eb X-MS-TrafficTypeDiagnostic: SN6PR12MB2781: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:5236; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: HeXbFTqewZByXoBea8pn2wXS/obq2cd7d3KWEpJlhT4tIxKfXIIKhHA9Qu8uos1wX/Mo/YPJbHzwpGREYJT/ZySYTvNbW9eAocdBOcAtyC4gbQxq3IXo9F2XYiRqdjy3mIjJaOEISKY3jO2cKBOUQlZ5Ru4hXdzgsRssXAN1QhHMyzAlrqrCFPsMRH/xL2NT27WOxPj8BMGpYV6Ui8tTrkz5J187ezcq+Jiu15jb7Cf/eAw/vrl3yYYjHYZNujlgOEF4K/+PVVKjH/UhWxaRiKaUP3QW2sJTUO+Qgw12B+R4OBmw9UB+X9KmDuihZcBnKtS/prIsymsIsqUswQuKT52t4NHTFsEr/eE2p+fhcdB5C9iBM4EffLzn5/vwPrlmlX1rYepeyHS4T4CSFQHqegfCA6swbDzuCKIULMdBrL3nl3eov2z65obDEUPGq5XRpje9a+6TnNG5FCnYVMswGRuywg7m42MBiyWJmGYfvjWMjWXT366MKOT0K8racA7h1MFe4LpXdAm8vUD6qsKqY3Ig2EyigDtNM9MswFf3nHIqOuvQ6yIf0IA35FVG3qeHksXApOltHQjhWPEowexer+ITh/nMv2QyAnhtmg/lbkvF1nIWaapH4nY+xm0ASXYcxL8kclYj/pxVc+E2lYQodCvnr8Aihmp6xClNruNsmgk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2767.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(376002)(39860400002)(346002)(396003)(366004)(136003)(66556008)(66476007)(5660300002)(86362001)(7696005)(66946007)(2616005)(2906002)(38100700002)(38350700002)(956004)(6486002)(36756003)(52116002)(8936002)(26005)(83380400001)(4326008)(6666004)(478600001)(16526019)(186003)(8676002)(6916009)(19627235002)(316002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?6+GQHNo+HRm0AP4IVvJGL5z7+qSeAYkN8kdBy4DCbL/UiogQY/ju1lf9ELKc?= =?us-ascii?Q?L/iAB2zhVrBZ+NxZe9xHzSH/GiYkJNPmUETD9Syl/PTUCCklyMkviuGPLSHt?= =?us-ascii?Q?nXsS6F4JgnlbOC7w5xSPsp9zQzIlaQPxkfyUKR3ec7jqUk8q3uTTRkIYQx/g?= =?us-ascii?Q?pDmc2aMezYhqqJEl1y2blLbS3VGlN+AtiamGFlfMNiMNhgQim0jHjjCsJXJv?= =?us-ascii?Q?nGR+MsOBiIc6jD6gRqkgO5mQL1S/SGGdwzBw616wTe+XddIyXx8lcSYI23qc?= =?us-ascii?Q?tFJTY9fXLm0o+0UTZL2p+v/rk7OAacd0Xqah0GdBWnT5SJr8qns7dxGGO/zd?= =?us-ascii?Q?Gt9gS+LPODc21aklNkZ4x8bMP8ewN3vPJyJ8Vi/UimdPb5vUqPBavUL6fGDd?= =?us-ascii?Q?FEvB/qSLGB/G570lTd5kLtcmMvyYX51O6Ox4HsFHitoz4kM1FJV/I4/mQX06?= =?us-ascii?Q?/IfE61H2rwgZBtqWldG4/27CZNCEM9j5LLxsvIQs67Ud8Hl/6STZiI58QGgb?= =?us-ascii?Q?6LejrO0fqwcPEqX95XLNI4bQ0raAbsGE9tw3gG4H0fkfwQBlPznIbFTI5J8y?= =?us-ascii?Q?6c+ww+JaHXn/EfHxPwPUY8/wgxUTpl7dgW2tGSjD99VjL3JuXSFwCjoHFmlL?= =?us-ascii?Q?LGZiMGHVGYnhdoB25/5Z1bNaqS5IYHS5YRV5c/yVO2QhyGcoPz6wZmblKdkH?= =?us-ascii?Q?nKxRRoxeTu6zki9oSBgQU+GKlr+4w2sZmlHYadP39+75H5LvB2FOeOyQYUXc?= =?us-ascii?Q?n7FQLgANfXJh84KAITixZ+bDMkYeaf6e8dZT4IHLEogwY3umkcgpnJBxYLzO?= =?us-ascii?Q?zziOGoS5ZqNfArEwA036TIsfNacIK66PnKSc9cqGVCQmBw+euAJBPIJVwngY?= =?us-ascii?Q?mzgcElac6LQGUFXv1uHKuPATgY9Gdrp8mgSbloolxXk2vdml57P0xbob6z+r?= =?us-ascii?Q?b1qzBvoQwk4j0lHBjCamSfo0BlDpkorJzxRPO94gNm+j7pZj8ZjVuDs73oHH?= =?us-ascii?Q?miYd2j5R28Aoh/7ep21Nqm/kqhkETRHyqtiWhC0JOd2epgGbfwvrtXkStWE7?= =?us-ascii?Q?r6SlBGqbswjyc9B/mwraVYsYYwkh4fmyPsmPLfiUYsWtjYcWahRyQNMzsFbG?= =?us-ascii?Q?dol2LYvdQtK/8PZA4K0id19aevU9avUXoeFVl1+1wOwF0HiOiWSO3okuh4tn?= =?us-ascii?Q?XYFVE3QU5Mo7Enqb3mZ8rgZRCbZcPmRSTKA2Z991Yv9iLG4TJSQ0ZgIEfVOh?= =?us-ascii?Q?Y3K8IQ1wicliyBhHEsA3cvhwVC7lDqvyP+QA0Ik4u/ei3eLrc5UwFyr6+pCB?= =?us-ascii?Q?Dl7Ec4pFwXlnGkMjCsB7C8ID?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5d77dc17-f487-4c4d-db01-08d934bc79eb X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2767.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Jun 2021 13:57:16.1697 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: bV5DaS7Gmg2g7kHcV+fr5rN6NvfhPDL/gqbF65nQ/FqQz4kwGoGFo12zEt7+2+Yq0PPLZyJ5hm75h/W2YYDwtQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR12MB2781 Content-Type: text/plain From: Brijesh Singh By default all the SEV guest memory regions are considered encrypted, if a guest changes the encryption attribute of the page (e.g mark a page as decrypted) then notify hypervisor. Hypervisor will need to track the unencrypted pages. The information will be used during guest live migration, guest page migration and guest debugging. Invoke hypercall via the new hypercall library. This hypercall is used to notify hypervisor when a page is marked as 'decrypted' (i.e C-bit removed). Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Signed-off-by: Brijesh Singh Signed-off-by: Ashish Kalra --- OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf | 1 + OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf | 1 + OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c | 22 ++++++++++++++++++++ 3 files changed, 24 insertions(+) diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf index f2e162d680..aefcd7c0f7 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf @@ -49,6 +49,7 @@ DebugLib MemoryAllocationLib PcdLib + MemEncryptHypercallLib [FeaturePcd] gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf index 03a78c32df..7503f56a0b 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf @@ -49,6 +49,7 @@ DebugLib MemoryAllocationLib PcdLib + MemEncryptHypercallLib [FeaturePcd] gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c index c696745f9d..12b3a9fcfb 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeVirtualMemory.c @@ -15,6 +15,7 @@ #include #include #include +#include #include "VirtualMemory.h" @@ -585,6 +586,9 @@ SetMemoryEncDec ( UINT64 AddressEncMask; BOOLEAN IsWpEnabled; RETURN_STATUS Status; + UINTN Size; + BOOLEAN CBitChanged; + PHYSICAL_ADDRESS OrigPhysicalAddress; // // Set PageMapLevel4Entry to suppress incorrect compiler/analyzer warnings. @@ -636,6 +640,10 @@ SetMemoryEncDec ( Status = EFI_SUCCESS; + Size = Length; + CBitChanged = FALSE; + OrigPhysicalAddress = PhysicalAddress; + while (Length != 0) { // @@ -695,6 +703,7 @@ SetMemoryEncDec ( )); PhysicalAddress += BIT30; Length -= BIT30; + CBitChanged = TRUE; } else { // // We must split the page @@ -749,6 +758,7 @@ SetMemoryEncDec ( SetOrClearCBit (&PageDirectory2MEntry->Uint64, Mode); PhysicalAddress += BIT21; Length -= BIT21; + CBitChanged = TRUE; } else { // // We must split up this page into 4K pages @@ -791,6 +801,7 @@ SetMemoryEncDec ( SetOrClearCBit (&PageTableEntry->Uint64, Mode); PhysicalAddress += EFI_PAGE_SIZE; Length -= EFI_PAGE_SIZE; + CBitChanged = TRUE; } } } @@ -808,6 +819,17 @@ SetMemoryEncDec ( // CpuFlushTlb(); + // + // Notify Hypervisor on C-bit status + // + if (CBitChanged) { + SetMemoryEncDecHypercall3 ( + OrigPhysicalAddress, + EFI_SIZE_TO_PAGES(Size), + KVM_MAP_GPA_RANGE_ENC_STAT(!Mode) + ); + } + Done: // // Restore page table write protection, if any. -- 2.17.1