From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by mx.groups.io with SMTP id smtpd.web08.9101.1645271933665661448 for ; Sat, 19 Feb 2022 03:58:54 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="unable to parse pub key" header.i=@intel.com header.s=intel header.b=f3ntBpQY; spf=pass (domain: intel.com, ip: 192.55.52.151, mailfrom: min.m.xu@intel.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1645271934; x=1676807934; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=hC1GzTzjSDuLxHkUFoIasoRoBUF7+H0H+T/nShRySBA=; b=f3ntBpQYJo3mNBFluKU2TeMfmif/7T7LNGix+8AvatM/zYmhXnCw2v7j hBOUA1SadEE/l5f+dToqX1GVCY/Qukt44F6yRoUQDYR18YW1s1YQZ1rfi 4vitXNKMwc1fJFfdM6GMhkzjerZQ0M1qpnEnxrMnIk9VfEiE4fIkPN33i SFyWk9OBrxLzYO3rg5345bmbxwhmnsrEJn9PzYH83YW0jj/vpuOY5+CTF nd7d/66/RBp9IxKF2IAN78kX+ueGkLW+jfMSEF0aGFT9p9Xp12tv9Uc6h GuUKx6MCWZdj7+5q3F2ZvtQca7murF1yVQDkMob3zUAQDAx+BbJbMPuCy g==; X-IronPort-AV: E=McAfee;i="6200,9189,10262"; a="231915519" X-IronPort-AV: E=Sophos;i="5.88,381,1635231600"; d="scan'208";a="231915519" Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Feb 2022 03:58:37 -0800 X-IronPort-AV: E=Sophos;i="5.88,381,1635231600"; d="scan'208";a="546691363" Received: from mxu9-mobl1.ccr.corp.intel.com ([10.249.175.253]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Feb 2022 03:58:34 -0800 From: "Min Xu" To: devel@edk2.groups.io Cc: Min Xu , Jian J Wang , Hao A Wu , Brijesh Singh , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [PATCH V6 30/42] MdeModulePkg: EFER should not be changed in TDX Date: Sat, 19 Feb 2022 19:56:43 +0800 Message-Id: <5c6271685e10141a89272ff03a9406fa53365e90.1645261991.git.min.m.xu@intel.com> X-Mailer: git-send-email 2.29.2.windows.2 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429 In TDX IA32_ERER is RO to host VMM. It could not be changed. PcdIa32EferChangeAllowed is added in MdeModulePkg.dec and it is to be set to FALSE in Tdx guest. Cc: Jian J Wang Cc: Hao A Wu Cc: Brijesh Singh Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Cc: Gerd Hoffmann Acked-by: Gerd Hoffmann Signed-off-by: Min Xu --- MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf | 1 + MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c | 7 +++++++ MdeModulePkg/MdeModulePkg.dec | 5 +++++ 3 files changed, 13 insertions(+) diff --git a/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf b/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf index 19b8a4c8aefa..106b679b6bd0 100644 --- a/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf +++ b/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf @@ -117,6 +117,7 @@ gEfiMdeModulePkgTokenSpaceGuid.PcdUse5LevelPageTable ## SOMETIMES_CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase ## CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbSize ## CONSUMES + gEfiMdeModulePkgTokenSpaceGuid.PcdIa32EferChangeAllowed ## CONSUMES [Pcd.IA32,Pcd.X64,Pcd.ARM,Pcd.AARCH64] gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack ## SOMETIMES_CONSUMES diff --git a/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c b/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c index 0700f310b203..5c647c74e773 100644 --- a/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c +++ b/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c @@ -159,6 +159,13 @@ IsEnableNonExecNeeded ( return FALSE; } + // + // Intel TDX sets this flag to FALSE. + // + if (!PcdGetBool (PcdIa32EferChangeAllowed)) { + return FALSE; + } + // // XD flag (BIT63) in page table entry is only valid if IA32_EFER.NXE is set. // Features controlled by Following PCDs need this feature to be enabled. diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec index 463e889e9a68..453f2a74b11d 100644 --- a/MdeModulePkg/MdeModulePkg.dec +++ b/MdeModulePkg/MdeModulePkg.dec @@ -2138,6 +2138,11 @@ # @Prompt GHCB Pool Size gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbSize|0|UINT64|0x00030008 + ## This dynamic PCD indicates if IA32_EFER can be changed. The default value is TRUE but in + # Intel TDX change of IA32_EFER is not allowed. + # @Prompt The flag which indicates if IA32_EFER is allowed to be changed. + gEfiMdeModulePkgTokenSpaceGuid.PcdIa32EferChangeAllowed|TRUE|BOOLEAN|0x00030009 + [PcdsDynamicEx] ## This dynamic PCD enables the default variable setting. # Its value is the default store ID value. The default value is zero as Standard default. -- 2.29.2.windows.2