From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) by mx.groups.io with SMTP id smtpd.web08.10244.1610035009746003575 for ; Thu, 07 Jan 2021 07:56:49 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=gN2AIcen; spf=pass (domain: redhat.com, ip: 216.205.24.124, mailfrom: lersek@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1610035008; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tam9NhaIZu5YpCYxLLcnmAWo1FbZ9cU3WgIEDzvzK4E=; b=gN2AIcenaKsJv4vwb1bbfU/zcHWJdBh8P4848OLJc+k0Rf5P27e1tac5S0Q+DvH1g8M5Rq 2fZ6jzqychpOHqdeXLqNkYfa2F4DeZEkMy+mL/CsUgaAtIGgeN2kQQiUd6y6uIdkaSKxmz 5UzdOSp04pB2JqNtXxrudoAOmLbOGeE= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-567-oM08tzikMwqqJT1u47XHFA-1; Thu, 07 Jan 2021 10:56:44 -0500 X-MC-Unique: oM08tzikMwqqJT1u47XHFA-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 9BE8D15720; Thu, 7 Jan 2021 15:56:42 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-112-164.ams2.redhat.com [10.36.112.164]) by smtp.corp.redhat.com (Postfix) with ESMTP id 4BB3A60C90; Thu, 7 Jan 2021 15:56:40 +0000 (UTC) Subject: Re: [edk2-devel] [PATCH v2 07/15] OvmfPkg/MemEncryptSevLib: Obtain encryption mask using the new interface To: devel@edk2.groups.io, thomas.lendacky@amd.com Cc: Brijesh Singh , James Bottomley , Jordan Justen , Ard Biesheuvel , Rebecca Cran , Peter Grehan , Anthony Perard , Julien Grall References: From: "Laszlo Ersek" Message-ID: <5e744e37-399c-3301-45df-10d12fd2104d@redhat.com> Date: Thu, 7 Jan 2021 16:56:39 +0100 MIME-Version: 1.0 In-Reply-To: X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=lersek@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit On 01/06/21 22:21, Lendacky, Thomas wrote: > From: Tom Lendacky > > BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3108 > > The early assembler code performs validation for some of the SEV-related > information, specifically the encryption bit position. The new > MemEncryptSevGetEncryptionMask() interface provides access to this > validated value. > > To ensure that we always use a validated encryption mask for an SEV-ES > guest, update all locations that use CPUID to calculate the encryption > mask to use the new interface. > > Also, clean up some call areas where extra masking was being performed > and where a function call was being used instead of the local variable > that was just set using the function. > > Cc: Jordan Justen > Cc: Laszlo Ersek > Cc: Ard Biesheuvel > Cc: Rebecca Cran > Cc: Peter Grehan > Cc: Brijesh Singh > Cc: Anthony Perard > Cc: Julien Grall > Signed-off-by: Tom Lendacky > --- > OvmfPkg/Bhyve/PlatformPei/AmdSev.c | 12 ++---------- > OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c | 15 +++++---------- > OvmfPkg/PlatformPei/AmdSev.c | 12 ++---------- > OvmfPkg/XenPlatformPei/AmdSev.c | 12 ++---------- > 4 files changed, 11 insertions(+), 40 deletions(-) (1) Because we modify multiple modules in this patch, the subject line should rather be: OvmfPkg: Obtain SEV encryption mask with the new MemEncryptSevLib API (69 chars). I can do this if / when I merge v2. Reviewed-by: Laszlo Ersek Thanks, Laszlo > > diff --git a/OvmfPkg/Bhyve/PlatformPei/AmdSev.c b/OvmfPkg/Bhyve/PlatformPei/AmdSev.c > index e484f4b311fe..e3ed78581c1b 100644 > --- a/OvmfPkg/Bhyve/PlatformPei/AmdSev.c > +++ b/OvmfPkg/Bhyve/PlatformPei/AmdSev.c > @@ -1,7 +1,7 @@ > /**@file > Initialize Secure Encrypted Virtualization (SEV) support > > - Copyright (c) 2017, Advanced Micro Devices. All rights reserved.
> + Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.
> > SPDX-License-Identifier: BSD-2-Clause-Patent > > @@ -15,8 +15,6 @@ > #include > #include > #include > -#include > -#include > #include > > #include "Platform.h" > @@ -32,7 +30,6 @@ AmdSevInitialize ( > VOID > ) > { > - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; > UINT64 EncryptionMask; > RETURN_STATUS PcdStatus; > > @@ -43,15 +40,10 @@ AmdSevInitialize ( > return; > } > > - // > - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) > - // > - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL); > - EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits); > - > // > // Set Memory Encryption Mask PCD > // > + EncryptionMask = MemEncryptSevGetEncryptionMask (); > PcdStatus = PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, EncryptionMask); > ASSERT_RETURN_ERROR (PcdStatus); > > diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c > index 5e110c84ff81..6422bc53bd5d 100644 > --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c > +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/VirtualMemory.c > @@ -3,7 +3,7 @@ > Virtual Memory Management Services to set or clear the memory encryption bit > > Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.
> - Copyright (c) 2017, AMD Incorporated. All rights reserved.
> + Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.
> > SPDX-License-Identifier: BSD-2-Clause-Patent > > @@ -12,6 +12,7 @@ > **/ > > #include > +#include > #include > #include > > @@ -39,17 +40,12 @@ GetMemEncryptionAddressMask ( > ) > { > UINT64 EncryptionMask; > - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; > > if (mAddressEncMaskChecked) { > return mAddressEncMask; > } > > - // > - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) > - // > - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL); > - EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits); > + EncryptionMask = MemEncryptSevGetEncryptionMask (); > > mAddressEncMask = EncryptionMask & PAGING_1G_ADDRESS_MASK_64; > mAddressEncMaskChecked = TRUE; > @@ -289,8 +285,7 @@ SetPageTablePoolReadOnly ( > LevelSize[3] = SIZE_1GB; > LevelSize[4] = SIZE_512GB; > > - AddressEncMask = GetMemEncryptionAddressMask() & > - PAGING_1G_ADDRESS_MASK_64; > + AddressEncMask = GetMemEncryptionAddressMask(); > PageTable = (UINT64 *)(UINTN)PageTableBase; > PoolUnitSize = PAGE_TABLE_POOL_UNIT_SIZE; > > @@ -437,7 +432,7 @@ Split1GPageTo2M ( > > AddressEncMask = GetMemEncryptionAddressMask (); > ASSERT (PageDirectoryEntry != NULL); > - ASSERT (*PageEntry1G & GetMemEncryptionAddressMask ()); > + ASSERT (*PageEntry1G & AddressEncMask); > // > // Fill in 1G page entry. > // > diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c > index 4a515a484720..954d53eba4e8 100644 > --- a/OvmfPkg/PlatformPei/AmdSev.c > +++ b/OvmfPkg/PlatformPei/AmdSev.c > @@ -1,7 +1,7 @@ > /**@file > Initialize Secure Encrypted Virtualization (SEV) support > > - Copyright (c) 2017, Advanced Micro Devices. All rights reserved.
> + Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.
> > SPDX-License-Identifier: BSD-2-Clause-Patent > > @@ -17,9 +17,7 @@ > #include > #include > #include > -#include > #include > -#include > #include > > #include "Platform.h" > @@ -116,7 +114,6 @@ AmdSevInitialize ( > VOID > ) > { > - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; > UINT64 EncryptionMask; > RETURN_STATUS PcdStatus; > > @@ -127,15 +124,10 @@ AmdSevInitialize ( > return; > } > > - // > - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) > - // > - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL); > - EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits); > - > // > // Set Memory Encryption Mask PCD > // > + EncryptionMask = MemEncryptSevGetEncryptionMask (); > PcdStatus = PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, EncryptionMask); > ASSERT_RETURN_ERROR (PcdStatus); > > diff --git a/OvmfPkg/XenPlatformPei/AmdSev.c b/OvmfPkg/XenPlatformPei/AmdSev.c > index 7ebbb5cc1fd2..4ed448632ae2 100644 > --- a/OvmfPkg/XenPlatformPei/AmdSev.c > +++ b/OvmfPkg/XenPlatformPei/AmdSev.c > @@ -1,7 +1,7 @@ > /**@file > Initialize Secure Encrypted Virtualization (SEV) support > > - Copyright (c) 2017, Advanced Micro Devices. All rights reserved.
> + Copyright (c) 2017 - 2020, Advanced Micro Devices. All rights reserved.
> Copyright (c) 2019, Citrix Systems, Inc. > > SPDX-License-Identifier: BSD-2-Clause-Patent > @@ -14,8 +14,6 @@ > #include > #include > #include > -#include > -#include > > #include "Platform.h" > > @@ -30,7 +28,6 @@ AmdSevInitialize ( > VOID > ) > { > - CPUID_MEMORY_ENCRYPTION_INFO_EBX Ebx; > UINT64 EncryptionMask; > RETURN_STATUS PcdStatus; > > @@ -41,15 +38,10 @@ AmdSevInitialize ( > return; > } > > - // > - // CPUID Fn8000_001F[EBX] Bit 0:5 (memory encryption bit position) > - // > - AsmCpuid (CPUID_MEMORY_ENCRYPTION_INFO, NULL, &Ebx.Uint32, NULL, NULL); > - EncryptionMask = LShiftU64 (1, Ebx.Bits.PtePosBits); > - > // > // Set Memory Encryption Mask PCD > // > + EncryptionMask = MemEncryptSevGetEncryptionMask (); > PcdStatus = PcdSet64S (PcdPteMemoryEncryptionAddressOrMask, EncryptionMask); > ASSERT_RETURN_ERROR (PcdStatus); > >