From: "Min Xu" <min.m.xu@intel.com>
To: devel@edk2.groups.io
Cc: Min Xu <min.m.xu@intel.com>, Jian J Wang <jian.j.wang@intel.com>,
Hao A Wu <hao.a.wu@intel.com>,
Brijesh Singh <brijesh.singh@amd.com>,
Erdem Aktas <erdemaktas@google.com>,
James Bottomley <jejb@linux.ibm.com>,
Jiewen Yao <jiewen.yao@intel.com>,
Tom Lendacky <thomas.lendacky@amd.com>,
Gerd Hoffmann <kraxel@redhat.com>
Subject: [PATCH V4 19/31] MdeModulePkg: EFER should not be changed in TDX
Date: Mon, 13 Dec 2021 20:56:50 +0800 [thread overview]
Message-ID: <a87abf723ceda28c48b2946fe8806baae292feec.1639399598.git.min.m.xu@intel.com> (raw)
In-Reply-To: <cover.1639399598.git.min.m.xu@intel.com>
RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
In TDX IA32_ERER is RO to host VMM. It could not be changed.
PcdIa32EferChangeAllowed is added in MdeModulePkg.dec and it is
to be set to FALSE in Tdx guest.
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Hao A Wu <hao.a.wu@intel.com>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
---
MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf | 1 +
MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c | 7 +++++++
MdeModulePkg/MdeModulePkg.dec | 5 +++++
3 files changed, 13 insertions(+)
diff --git a/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf b/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf
index 19b8a4c8aefa..106b679b6bd0 100644
--- a/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf
+++ b/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf
@@ -117,6 +117,7 @@
gEfiMdeModulePkgTokenSpaceGuid.PcdUse5LevelPageTable ## SOMETIMES_CONSUMES
gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase ## CONSUMES
gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbSize ## CONSUMES
+ gEfiMdeModulePkgTokenSpaceGuid.PcdIa32EferChangeAllowed ## CONSUMES
[Pcd.IA32,Pcd.X64,Pcd.ARM,Pcd.AARCH64]
gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack ## SOMETIMES_CONSUMES
diff --git a/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c b/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c
index 0700f310b203..5c647c74e773 100644
--- a/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c
+++ b/MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.c
@@ -159,6 +159,13 @@ IsEnableNonExecNeeded (
return FALSE;
}
+ //
+ // Intel TDX sets this flag to FALSE.
+ //
+ if (!PcdGetBool (PcdIa32EferChangeAllowed)) {
+ return FALSE;
+ }
+
//
// XD flag (BIT63) in page table entry is only valid if IA32_EFER.NXE is set.
// Features controlled by Following PCDs need this feature to be enabled.
diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
index 463e889e9a68..453f2a74b11d 100644
--- a/MdeModulePkg/MdeModulePkg.dec
+++ b/MdeModulePkg/MdeModulePkg.dec
@@ -2138,6 +2138,11 @@
# @Prompt GHCB Pool Size
gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbSize|0|UINT64|0x00030008
+ ## This dynamic PCD indicates if IA32_EFER can be changed. The default value is TRUE but in
+ # Intel TDX change of IA32_EFER is not allowed.
+ # @Prompt The flag which indicates if IA32_EFER is allowed to be changed.
+ gEfiMdeModulePkgTokenSpaceGuid.PcdIa32EferChangeAllowed|TRUE|BOOLEAN|0x00030009
+
[PcdsDynamicEx]
## This dynamic PCD enables the default variable setting.
# Its value is the default store ID value. The default value is zero as Standard default.
--
2.29.2.windows.2
next prev parent reply other threads:[~2021-12-13 12:59 UTC|newest]
Thread overview: 68+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-13 12:56 [PATCH V4 00/31] Enable Intel TDX in OvmfPkg (Config-A) Min Xu
2021-12-13 12:56 ` [PATCH V4 01/31] MdePkg: Add Tdx.h Min Xu
2021-12-13 12:56 ` [PATCH V4 02/31] MdePkg: Introduce basic Tdx functions in BaseLib Min Xu
2021-12-15 6:33 ` Gerd Hoffmann
2021-12-13 12:56 ` [PATCH V4 03/31] MdePkg: Add TdxLib to wrap Tdx operations Min Xu
2021-12-15 6:44 ` Gerd Hoffmann
2021-12-13 12:56 ` [PATCH V4 04/31] UefiCpuPkg: Extend VmgExitLibNull to handle #VE exception Min Xu
2021-12-13 12:56 ` [PATCH V4 05/31] OvmfPkg: Extend VmgExitLib " Min Xu
2021-12-15 6:56 ` [edk2-devel] " Gerd Hoffmann
2022-01-20 6:34 ` Min Xu
2021-12-13 12:56 ` [PATCH V4 06/31] UefiCpuPkg/CpuExceptionHandler: Add base support for the " Min Xu
2021-12-13 12:56 ` [PATCH V4 07/31] MdePkg: Add helper functions for Tdx guest in BaseIoLibIntrinsic Min Xu
2021-12-13 12:56 ` [PATCH V4 08/31] MdePkg: Support mmio " Min Xu
2021-12-15 7:02 ` Gerd Hoffmann
2021-12-13 12:56 ` [PATCH V4 09/31] MdePkg: Support IoFifo " Min Xu
2021-12-15 7:18 ` Gerd Hoffmann
2021-12-13 12:56 ` [PATCH V4 10/31] MdePkg: Support IoRead/IoWrite " Min Xu
2021-12-15 7:18 ` Gerd Hoffmann
2021-12-13 12:56 ` [PATCH V4 11/31] UefiCpuPkg: Support TDX in BaseXApicX2ApicLib Min Xu
2021-12-13 12:56 ` [PATCH V4 12/31] MdePkg: Add macro to check SEV / TDX guest Min Xu
2021-12-13 12:56 ` [PATCH V4 13/31] UefiCpuPkg: Enable Tdx support in MpInitLib Min Xu
2021-12-15 7:33 ` Gerd Hoffmann
2021-12-13 12:56 ` [PATCH V4 14/31] OvmfPkg: Add IntelTdx.h in OvmfPkg/Include/IndustryStandard Min Xu
2021-12-15 7:37 ` Gerd Hoffmann
2021-12-16 6:43 ` Min Xu
2021-12-13 12:56 ` [PATCH V4 15/31] OvmfPkg: Add TdxMailboxLib Min Xu
2021-12-15 7:47 ` Gerd Hoffmann
2021-12-13 12:56 ` [PATCH V4 16/31] MdePkg: Add EFI_RESOURCE_ATTRIBUTE_ENCRYPTED in PiHob.h Min Xu
2021-12-13 12:56 ` [PATCH V4 17/31] OvmfPkg: Update Sec to support Tdx Min Xu
2021-12-15 8:18 ` Gerd Hoffmann
2021-12-16 8:11 ` [edk2-devel] " Min Xu
2021-12-13 12:56 ` [PATCH V4 18/31] OvmfPkg: Check Tdx in QemuFwCfgPei to avoid DMA operation Min Xu
2021-12-15 8:19 ` Gerd Hoffmann
2021-12-13 12:56 ` Min Xu [this message]
2021-12-13 12:56 ` [PATCH V4 20/31] MdeModulePkg: Add PcdTdxSharedBitMask Min Xu
2021-12-15 8:22 ` Gerd Hoffmann
2021-12-13 12:56 ` [PATCH V4 21/31] UefiCpuPkg: Update AddressEncMask in CpuPageTable Min Xu
2021-12-15 8:38 ` Gerd Hoffmann
2021-12-16 8:23 ` Min Xu
2021-12-13 12:56 ` [PATCH V4 22/31] OvmfPkg: Update PlatformPei to support TDX Min Xu
2021-12-15 8:53 ` Gerd Hoffmann
2022-01-20 9:07 ` [edk2-devel] " Min Xu
2022-01-13 19:18 ` Vishal Annapurve
2022-01-14 2:23 ` Min Xu
2022-01-14 2:37 ` Vishal Annapurve
2022-01-14 2:40 ` Min Xu
2021-12-13 12:56 ` [PATCH V4 23/31] OvmfPkg: Update AcpiPlatformDxe to alter MADT table Min Xu
2021-12-15 8:54 ` Gerd Hoffmann
2021-12-13 12:56 ` [PATCH V4 24/31] OvmfPkg: Add TdxDxe driver Min Xu
2021-12-15 9:05 ` Gerd Hoffmann
2021-12-13 12:56 ` [PATCH V4 25/31] OvmfPkg/BaseMemEncryptTdxLib: Add TDX helper library Min Xu
2021-12-15 9:16 ` Gerd Hoffmann
2022-01-21 2:54 ` Min Xu
2022-01-21 8:04 ` Gerd Hoffmann
2022-01-21 8:31 ` [edk2-devel] " Min Xu
2021-12-13 12:56 ` [PATCH V4 26/31] OvmfPkg/QemuFwCfgLib: Support Tdx in QemuFwCfgDxe Min Xu
2021-12-15 9:16 ` Gerd Hoffmann
2021-12-13 12:56 ` [PATCH V4 27/31] OvmfPkg: Update IoMmuDxe to support TDX Min Xu
2021-12-15 9:18 ` Gerd Hoffmann
2021-12-13 12:56 ` [PATCH V4 28/31] OvmfPkg: Rename XenTimerDxe to LocalApicTimerDxe Min Xu
2021-12-15 9:19 ` Gerd Hoffmann
2021-12-13 12:57 ` [PATCH V4 29/31] UefiCpuPkg: Setting initial-count register as the last step Min Xu
2021-12-15 9:20 ` Gerd Hoffmann
2021-12-13 12:57 ` [PATCH V4 30/31] OvmfPkg: Switch timer in build time for OvmfPkg Min Xu
2021-12-15 9:21 ` Gerd Hoffmann
2021-12-13 12:57 ` [PATCH V4 31/31] OvmfPkg: Move LocalApicTimerDxe to UefiCpuPkg Min Xu
2021-12-15 9:26 ` Gerd Hoffmann
2021-12-16 8:29 ` [edk2-devel] " Min Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a87abf723ceda28c48b2946fe8806baae292feec.1639399598.git.min.m.xu@intel.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox