From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 847CA740045 for ; Wed, 28 Feb 2024 08:28:21 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=VZFYWvscDnF7v32xkOMd7HPJiOeh5EgKwX9TaKHjldQ=; c=relaxed/simple; d=groups.io; h=ARC-Seal:ARC-Message-Signature:ARC-Authentication-Results:From:To:CC:Subject:Thread-Topic:Thread-Index:Date:Message-ID:References:In-Reply-To:Accept-Language:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Language:Content-Type:Content-Transfer-Encoding; s=20140610; t=1709108900; v=1; b=p6oYHX6M3CW6T7UN2aZbtPHvl1WRlMdUsisrXy1lGfqwQaFnTqz+risrOqyQSqzvRQJv7dSD FcpXYZagfNyEYsiaiidrSJB1VTUI2sDyEXEluGq2NGu+8Dw1GodYAz1VJ8rJ/zDA03n3JXw4O/a OS035zfEoocvu9BlnqRYTzho= X-Received: by 127.0.0.2 with SMTP id uF8QYY7687511xgKzDLghdXi; Wed, 28 Feb 2024 00:28:20 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.11]) by mx.groups.io with SMTP id smtpd.web11.9005.1709108899460152209 for ; Wed, 28 Feb 2024 00:28:19 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10996"; a="14046069" X-IronPort-AV: E=Sophos;i="6.06,190,1705392000"; d="scan'208";a="14046069" X-Received: from fmviesa001.fm.intel.com ([10.60.135.141]) by orvoesa103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 28 Feb 2024 00:28:07 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.06,190,1705392000"; d="scan'208";a="38392874" X-Received: from fmsmsx603.amr.corp.intel.com ([10.18.126.83]) by fmviesa001.fm.intel.com with ESMTP/TLS/AES256-GCM-SHA384; 28 Feb 2024 00:28:00 -0800 X-Received: from fmsmsx610.amr.corp.intel.com (10.18.126.90) by fmsmsx603.amr.corp.intel.com (10.18.126.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Wed, 28 Feb 2024 00:27:59 -0800 X-Received: from fmsmsx610.amr.corp.intel.com (10.18.126.90) by fmsmsx610.amr.corp.intel.com (10.18.126.90) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Wed, 28 Feb 2024 00:27:59 -0800 X-Received: from FMSEDG603.ED.cps.intel.com (10.1.192.133) by fmsmsx610.amr.corp.intel.com (10.18.126.90) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35 via Frontend Transport; Wed, 28 Feb 2024 00:27:59 -0800 X-Received: from NAM10-MW2-obe.outbound.protection.outlook.com (104.47.55.101) by edgegateway.intel.com (192.55.55.68) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Wed, 28 Feb 2024 00:27:58 -0800 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=AZMT/UWtNXyklbzWgCbQ2iY7eM4cXfhcR8aBAPb+0WlTBkgE6Gcd2N9SmeS1/9gu109yLovqP1yhp6PtTWJxT51WiIG/+3EYe3fgu8tv2GeXjXv6Zqa6UvyL/1WvIxU6K/m4JpSgFN3uwP1vp/3O/mjwgEjUXfHJUQoZ2grFRfhTMDoatDgbvPdEWsnIWGmzuSJPb3O4rPmNaVNfVit0UWEpRlUh67ZxINYxeBANx72gEGcsEpZ2VgQVPVMSepOBsegi0vSO+t1qoUdvnH0JKGxeCQeRV8j88hIRxzx6VF5zT+QV1J78n/smrS62iSL9bNhpfq3nQHXv+z/WJdhmFQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=/ba4DNeJdr3a4FMD9zSUf7lidKt7zGrIhCHLT0xYCVQ=; b=D4Ao3J23EKxlUV4L9hb/DjrlBaA9ezs3aMb84B5t5nDbQ3a4WAyZHl6oIMoiWRHZOdxs1QCzEAicpl5AQu/OCUb8CDQ7fWryphOZSy/s+MVBZiL6ijnKgdW7GTpITAY/pHpsyL80NdsITHNekSsAkMc8EzBv2wvAdBEyE3DNatIPdloOT799+1d8svO+hjoFoLTnvcg6OHiLxOHrDTl0Oao1+9ycxyzuZZjvZDVp/afenchYgCfpc2RHzGQlWymWc71vJ5iFaqhZAJGxTnF7X42s8g4FfYFYzr+QYy7+VtZt/llIWvG3tDh0QBwF4C1csNR5Y/e+d8ViKuBTH/ooLw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none X-Received: from IA0PR11MB8355.namprd11.prod.outlook.com (2603:10b6:208:480::14) by DS0PR11MB7192.namprd11.prod.outlook.com (2603:10b6:8:13a::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7339.22; Wed, 28 Feb 2024 08:27:55 +0000 X-Received: from IA0PR11MB8355.namprd11.prod.outlook.com ([fe80::b09a:4b79:1da2:9bc6]) by IA0PR11MB8355.namprd11.prod.outlook.com ([fe80::b09a:4b79:1da2:9bc6%5]) with mapi id 15.20.7339.022; Wed, 28 Feb 2024 08:27:55 +0000 From: "sunceping" To: "Yamahata, Isaku" , "devel@edk2.groups.io" CC: "Aktas, Erdem" , James Bottomley , "Yao, Jiewen" , "Xu, Min M" , Tom Lendacky , Michael Roth , Gerd Hoffmann Subject: Re: [edk2-devel] [PATCH V1 3/3] OvmfPkg/TdxDxe: Clear the registers before tdcall Thread-Topic: [PATCH V1 3/3] OvmfPkg/TdxDxe: Clear the registers before tdcall Thread-Index: AQHaaHNZemDfMFWJHkuXzOFZ2KGuvrEeH0qAgAFHU6A= Date: Wed, 28 Feb 2024 08:27:55 +0000 Message-ID: References: <20240226211833.3156606-1-cepingx.sun@intel.com> <20240226211833.3156606-4-cepingx.sun@intel.com> In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR11MB8355:EE_|DS0PR11MB7192:EE_ x-ms-office365-filtering-correlation-id: e3b580d1-8539-4091-4143-08dc383729b6 x-ld-processed: 46c98d88-e344-4ed4-8496-4ed7712e255d,ExtAddr x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam-message-info: qtS2HrhP38jIWnDAmYLQZ74CULcOXKQ1mSeGEFP16WS6bTHr/Js8fO6TzhuH3tzoE4e7gQvXOJgpHnNJS9vBje4X0guADta/XI3TrP8aKymLedYLRU2+n8eAodh/N+9/LJ1P9yaAfLQEOmj/uSseJ0epDTb7KyBrBRFQYAFYYK0IK2plolLo/7+cJ0nk/1i3+USWee9c4OX08cfQfvBBKXRx9dEBzGGbdHLdU46iLhhPJcox7JyziJH/VRV9le/HdkwRgGKaBDHrQ9muoE8k/w1oXQsKeeNTSf5Q6RBSegzVQqVXkFMfcxqT9eyo66Wc54XF9GZI6e06QoJyfDJs7ON6B+JY14tz+tRu6mirQ9BcbtugHYqEXkXNvTugQQKaaRAjBdqvvZNpOF64daG0PDohOBETAm4OoTPwXOMqqnFCSNyMthL4htYszU6X6Ittah6Q3TnzLmDFJsWf++33LOK17Kp7bNc2ItmYcUlZzkrSESS+K4Ouu62ldbxonjyMhF1h4FImukSGag+856ap+G0hQXxz7fwMxwFAFQLLjOudy/MlX/QH9TxYY1R74oevGJ76Z/vlJW5aTMvIkaFJeRLQM1wWqwI/RNZTlNWJvXDrdWTOj92XyFq7MH+TP05ldNl19jbpXMmFUyMM36kqCwTrBOd0VSwKg2nNPuLoqHdgLedMtp7sYVWwDfQpsaicuwXH7O1EtKi5oBASz6iowYwb04J/+ri8l1t6GpxIUv0= x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?OiTwnSn9kSG4GVBVDCMjVYJcz/9wy/UleRN4bdoJ9d5mT26Qg2SatCEiASjd?= =?us-ascii?Q?bqUOT+nx4JZW6E/NnKym9v7R9uFiv+N4aDO04Ku90FQIlos9fL76qP51rK3Q?= =?us-ascii?Q?Ywx6Dvyi9cdN74my1QQ/Iko9GWY7ixt0II2PkhYT/DIiQRZMUOTkn8y0+KdO?= =?us-ascii?Q?PTr+3VRvn9bBoXcc8LgEaZu03+uW0h9oM4geAUYKUBBcC6lyqkaSE9hoYE7F?= =?us-ascii?Q?YfejRvcVOEKptWb2A/wndUhmFipDNGlHh7DT1KV66ik1TiRhIKK8Kc+JX7rQ?= =?us-ascii?Q?5wzf8W5gU5l8onUqNTXKBuRhswOT1psea0ObShQwR8tnl0l48MAZNx0UoxAG?= =?us-ascii?Q?UrdezrhUaCKYT+iS1tPhX/t2mr66iyHKVi6s2ibjHyX//xC012z4SSQQ2xs2?= =?us-ascii?Q?rIA15G2OkZKvdf0FutjCMphoOXE7WBVafCS1/g0LYRNj3kGjIimLHUA2F7Vy?= =?us-ascii?Q?WmPGqo9j61rvU/y95KbtXkJVgJ3sUZwyfYsTnU6qOt5oiCJL/xQgNRknkPYy?= =?us-ascii?Q?qnGeAX9j8hhrWushE8j70eLL5RWqYi91HCOIPfvuqkyWEh7kEgZF8tZVeU9t?= =?us-ascii?Q?any927VRn1rR4VFVlukCMTAU5Ec+Nc4OYX8zG/Qsdt3pzGvZmuX/gKUGFyJe?= =?us-ascii?Q?Mx2s9vfHsZdbsu9xQnBLFSfjSy2NpJ2B7r9w4BXY4AVlcT+/OZPPOQ0CIDSU?= =?us-ascii?Q?ZcFky6ekQziVose3A/oe0q7F2En1vjKUB3Rk0BRhqD699HJ7QUMw/wOXlpdC?= =?us-ascii?Q?Osl1/9RXdumhHWyJWjiG7q8PsfTQtql5hBPtIWEWVuNAaJreO29KhxzbgNRn?= =?us-ascii?Q?qUhGonFFYjIw6RVQGurLUsQftNfHQVzm3efIJrTuaV8GlANQ0OJICWbdh6Lb?= =?us-ascii?Q?9KAz3VIc9+FnBI5y8TKvpLPWEaxkUw6OePMZ9VrXzb6PZFTVgv2a30Kyoip1?= =?us-ascii?Q?MlbZkogpb5X2AxlugFsR0Fcy9BBx6+7rkF8WdZRJa+aaUPLRRZDRzBc/tODo?= =?us-ascii?Q?rgXpNmbA5pRS1QeEKn5sTQmPbjeQ+D8GPBulOXBp54OCIplLMsxUhg+vPlRV?= =?us-ascii?Q?XApohIXo1pIOifbzqdW6aTYAgDnqxbJ8tfWb4fko14QXdnu/euC8o5OYEkko?= =?us-ascii?Q?pDEJONiKdMITffy6dY4zSzOGosGOyrE4AviX4T//cynhuo6ucmk7a4vtECZX?= =?us-ascii?Q?3OYpo6qj19nU+EIkQQA7f79LQpE5yMqkK7pVymDihCnlG7OuVpcQUv1l0sqJ?= =?us-ascii?Q?vGyXUKLDB2VBqWC2UNTgDvQD4XWywliOvXcI+mKtpQbGN1+GU6Uo28X+SzQY?= =?us-ascii?Q?EouxaPnQ17iqbuLCuLzD2Irr/pU7/hvgYTYQ5M+OKrTvScnpyNHpz+X7rB3J?= =?us-ascii?Q?knmlAd4Ln7fvPTnJU2+eQyt+TBA94nFERIGWm5/ACWDGQPKmFrhaR2/fR/FE?= =?us-ascii?Q?aDdO1enkpdIUCWevnqPTaxNkisRjHrWCtKAZOo6SuM4aQ9bqCRaPO9kLakY6?= =?us-ascii?Q?963fhycFknJHRNpX4MEcSODElcdWVtFQlVII7+icedXFR4efmX/vaxC0R0EP?= =?us-ascii?Q?L29rJC+F495/VFEjmxaDIRA/cYFL902WPAipdlUs?= MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR11MB8355.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: e3b580d1-8539-4091-4143-08dc383729b6 X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Feb 2024 08:27:55.3344 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: u1FfWt3adHAfGDjQrtH3pXZLyutOlYuETqQqw4hMsd27FjqcS8XZigV5JIJfS+itu74Q8SHoUc+GmQHzCd5DuA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR11MB7192 X-OriginatorOrg: intel.com Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,cepingx.sun@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: S4KyY6czq3m25S90S2XN8qD0x7686176AA= Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=p6oYHX6M; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=intel.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io; arc=reject ("signature check failed: fail, {[1] = sig:microsoft.com:reject}") On Tuesday, February 27, 2024 8:26 PM Yamahata, Isaku wrote: > > +%macro tdcall_regs_preamble 2 > > + mov rax, %1 > > + > > + xor rcx, rcx > > + mov ecx, %2 > > + > > + ; R10 =3D 0 (standard TDVMCALL) > > + > > + xor r10d, r10d > > + > > + ; Zero out unused (for standard TDVMCALL) registers to avoid leaki= ng > > + ; secrets to the VMM. > > + > > + xor esi, esi > > + xor edi, edi > > + > > + xor edx, edx > > + xor ebp, ebp > > + xor r8d, r8d > > + xor r9d, r9d > > + xor r14, r14 > > + xor r15, r15 >=20 > We can just clear the corresponding bit of TDVMCALL_EXPOSE_REGS_MASK in > addition to RBP. > Same to 1/3 and 3/3. We can eliminate tdcall_regs_postamble. > Any reason to bother to zero those registers and pass them to VMM? > Zero out these registers to avoid leaking secrets to the VMM. There are also some registers (e.g., r10, r14...... etc.) are output operan= ds and should be cleared. The tdcall_regs_preamble was already using in the TdVmcall.nasm and TdVmca= llCpuid.nasm . For the ApRunLoop.nasm , it is fixed now. Thanks Ceping -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#116096): https://edk2.groups.io/g/devel/message/116096 Mute This Topic: https://groups.io/mt/104577524/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-