5e2e5647b9
Based on the following patch from Brijesh Singh <brijesh.singh@amd.com>: [PATCH v2 1/2] OvmfPkg/AmdSevDxe: Clear the C-bit from SMM Saved State http://mid.mail-archive.com/20180228161415.28723-2-brijesh.singh@amd.com https://lists.01.org/pipermail/edk2-devel/2018-February/022016.html Original commit message from Brijesh: > When OVMF is built with SMM, SMMSaved State area (SMM_DEFAULT_SMBASE + > SMRAM_SAVE_STATE_MAP_OFFSET) contains data which need to be accessed by > both guest and hypervisor. Since the data need to be accessed by both > hence we must map the SMMSaved State area as unencrypted (i.e C-bit > cleared). > > This patch clears the SavedStateArea address before SMBASE relocation. > Currently, we do not clear the SavedStateArea address after SMBASE is > relocated due to the following reasons: > > 1) Guest BIOS never access the relocated SavedStateArea. > > 2) The C-bit works on page-aligned address, but the SavedStateArea > address is not a page-aligned. Theoretically, we could roundup the > address and clear the C-bit of aligned address but looking carefully we > found that some portion of the page contains code -- which will causes a > bigger issue for the SEV guest. When SEV is enabled, all the code must > be encrypted otherwise hardware will cause trap. Changes by Laszlo: - separate AmdSevDxe bits from SmmCpuFeaturesLib bits; - spell out PcdLib dependency with #include and in LibraryClasses; - replace (SMM_DEFAULT_SMBASE + SMRAM_SAVE_STATE_MAP_OFFSET) calculation with call to new MemEncryptSevLocateInitialSmramSaveStateMapPages() function; - consequently, pass page-aligned BaseAddress to MemEncryptSevClearPageEncMask(); - zero the pages before clearing the C-bit; - pass Flush=TRUE to MemEncryptSevClearPageEncMask(); - harden the treatment of MemEncryptSevClearPageEncMask() failure. Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Brijesh Singh <brijesh.singh@amd.com> Cc: Jordan Justen <jordan.l.justen@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Brijesh Singh <brijesh.singh@amd.com> Reviewed-by: Brijesh Singh <brijesh.singh@amd.com>
49 lines
1.3 KiB
INI
49 lines
1.3 KiB
INI
#/** @file
|
|
#
|
|
# Driver clears the encryption attribute from MMIO regions when SEV is enabled
|
|
#
|
|
# Copyright (c) 2017, AMD Inc. All rights reserved.<BR>
|
|
#
|
|
# This program and the accompanying materials are licensed and made available
|
|
# under the terms and conditions of the BSD License which accompanies this
|
|
# distribution. The full text of the license may be found at
|
|
# http://opensource.org/licenses/bsd-license.php
|
|
#
|
|
# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR
|
|
# IMPLIED.
|
|
#
|
|
#**/
|
|
|
|
[Defines]
|
|
INF_VERSION = 1.25
|
|
BASE_NAME = AmdSevDxe
|
|
FILE_GUID = 2ec9da37-ee35-4de9-86c5-6d9a81dc38a7
|
|
MODULE_TYPE = DXE_DRIVER
|
|
VERSION_STRING = 1.0
|
|
ENTRY_POINT = AmdSevDxeEntryPoint
|
|
|
|
[Sources]
|
|
AmdSevDxe.c
|
|
|
|
[Packages]
|
|
MdeModulePkg/MdeModulePkg.dec
|
|
MdePkg/MdePkg.dec
|
|
OvmfPkg/OvmfPkg.dec
|
|
|
|
[LibraryClasses]
|
|
BaseLib
|
|
BaseMemoryLib
|
|
DebugLib
|
|
DxeServicesTableLib
|
|
MemEncryptSevLib
|
|
MemoryAllocationLib
|
|
PcdLib
|
|
UefiDriverEntryPoint
|
|
|
|
[Depex]
|
|
TRUE
|
|
|
|
[FeaturePcd]
|
|
gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire
|