From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail05.groups.io (mail05.groups.io [45.79.224.7]) by spool.mail.gandi.net (Postfix) with ESMTPS id EF24FD80CAA for ; Tue, 30 Apr 2024 10:25:17 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=QPN6MMU8Y9aGU2pEnLKLthH2YyVo+TRp+urJJ9ieJ24=; c=relaxed/simple; d=groups.io; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:In-Reply-To:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Resent-Date:Resent-From:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Type:Content-Disposition; s=20240206; t=1714472716; v=1; b=atmU41X34rbujvmdX0X0ltc/5kAbn8H9aEd57MODDwM3g3Lc/774X0Sw77Zhk7qZl+WW6oKP a3qWx7vkHJ9RCAkjnj2q2e9kNgsFLO8hwMuPahQumyGnjWV+VlL7vBHXvBNr9KzHgetfEjWhDf/ OEdToBYEHgnUtR4ZUkM1bCd/ZvrGPKKb2pv872/Sq97dwNmvM1S1e5tdItD5Py8NFr6aHnLJhyc hmBuw6M4G/bA2BnFDsdI1vmVNPlkTRI90q0ur2KmP/nQaJLDHhbcGXWZJwOjb1waDHLAw37/9fk 630HgRqyxvej+RuPmxsdL+q8gN4ukvYEUh47a9plI8tkQ== X-Received: by 127.0.0.2 with SMTP id ZuP7YY7687511xdHiRKdO6R4; Tue, 30 Apr 2024 03:25:16 -0700 X-Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.groups.io with SMTP id smtpd.web11.11862.1714472715571583391 for ; Tue, 30 Apr 2024 03:25:15 -0700 X-Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-381-IALgNV-zMjSUP6Zi_SRXlw-1; Tue, 30 Apr 2024 06:25:11 -0400 X-MC-Unique: IALgNV-zMjSUP6Zi_SRXlw-1 X-Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 972AE1C0314A; Tue, 30 Apr 2024 10:25:10 +0000 (UTC) X-Received: from sirius.home.kraxel.org (unknown [10.39.192.134]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 4BCC5EC680; Tue, 30 Apr 2024 10:25:10 +0000 (UTC) X-Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 5218A1829F19; Tue, 30 Apr 2024 12:25:09 +0200 (CEST) Date: Tue, 30 Apr 2024 12:25:09 +0200 From: "Gerd Hoffmann" To: devel@edk2.groups.io, Michael.Roth@amd.com Cc: Tom Lendacky , Ard Biesheuvel , Erdem Aktas , Jiewen Yao , Min Xu , Jianyong Wu , Anatol Belski Subject: Re: [edk2-devel] [PATCH v3] OvmfPkg: Don't make APIC MMIO accesses with encryption bit set Message-ID: References: <20240426195007.1964795-1-michael.roth@amd.com> MIME-Version: 1.0 In-Reply-To: <20240426195007.1964795-1-michael.roth@amd.com> X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.5 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Resent-Date: Tue, 30 Apr 2024 03:25:15 -0700 Resent-From: kraxel@redhat.com Reply-To: devel@edk2.groups.io,kraxel@redhat.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: Kbtb5DLugZvwbUCHzxVNMmAfx7686176AA= Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20240206 header.b=atmU41X3; spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 45.79.224.7 as permitted sender) smtp.mailfrom=bounce@groups.io; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=redhat.com (policy=none) On Fri, Apr 26, 2024 at 02:50:07PM GMT, Roth, Michael via groups.io wrote: > For the most part, OVMF will clear the encryption bit for MMIO regions, > but there is currently one known exception during SEC when the APIC > base address is accessed via MMIO with the encryption bit set for > SEV-ES/SEV-SNP guests. In the case of SEV-SNP, this requires special > handling on the hypervisor side which may not be available in the > future[1], so make the necessary changes in the SEC-configured page > table to clear the encryption bit for 4K region containing the APIC > base address. > > Since CpuPageTableLib is used to handle the splitting, some additional > care must be taken to clear the C-bit in all non-leaf PTEs since the > library expects that to be the case. Add handling for that when setting > up the SEC page table. > > While here, drop special handling for the APIC base address in the > SEV-ES/SNP #VC handler. Please split this into smaller patches (one for each commit message paragraph). > -0x011000|0x00F000 > +0x011000|0x001000 > +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecApicPageTableBase|gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecApicPageTableSize Hmm, I think we need to figure how we'll organize page table allocation best. This becomes a bit messy, even more so once we enable 5-level paging for sev because one page isn't enough then ... Is it possible to move the GHCB page setup to SecCoreStartupWithStack() too? If so it would be nice to setup both GHCB and APIC page in C code, and it should also allow to cleanup the page table memory reservation and simplify the reset vector. Note: I'm fine with this as-is for the next stable tag, the comments are more for the next patch series, when enabling 5-level paging for sev, where this must be touched again. > + ApicAddress = (UINT64)GetLocalApicBaseAddress (); > + Buffer = (VOID *)(UINTN)FixedPcdGet32 (PcdOvmfSecApicPageTableBase); > + Cr3 = AsmReadCr3 (); > + > + MapAttribute.Uint64 = ApicAddress; > + MapAttribute.Bits.Present = 1; > + MapAttribute.Bits.ReadWrite = 1; > + MapMask.Uint64 = MAX_UINT64; > + BufferSize = SIZE_4KB; > + > + Status = PageTableMap ( > + (UINTN *)&Cr3, > + Paging4Level, > + Buffer, > + &BufferSize, > + ApicAddress, > + SIZE_4KB, > + &MapAttribute, > + &MapMask, > + NULL > + ); Very nice. take care, Gerd -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#118436): https://edk2.groups.io/g/devel/message/118436 Mute This Topic: https://groups.io/mt/105757219/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-