BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3275
The PEI phases uses MemEncryptSevSnpValidateSystemRam() to validate
the system RAM. MemEncryptSev{Set,Clear}PageEncMask() is
later used by libraries/drivers to change the page state from private
to shared and vice versa.
The AmdSevDxe driver calls the MemEncryptSevClearPageEncMask() to remove
the encryption attribute from the reserved and non-existent memory regions.
Those regions where not part of system RAM, and was not pre-validated
during PEI phase, so we fail to change the page state for it.
There are multiple approaches to fix it:
1) Add a new parameter to MemEncryptSevClearPageEncMask(), that should be
set by the caller to indicate whether the region is RAM.
OR
2) Lookup the address in the interval tree maintained by the
MemEncryptSevSnpValidateSystemRam() to determine whether we validated
the page in the past.
OR
3) Iterate through the Memory space GCD to calculate if the address range
is RAM.
For now, we have chosen #2, it does not require a changes to the
caller of MemEncryptSevClearPageEncMask() and lookup routine is
already available.
Extend the SEV-ES workarea to pass the interval tree root pointer
so that we can perform the lookup later. If the specified address
was not present in the tree, then do not invalidate the page as it
could result in page state change failure.
Cc: James Bottomley <[email protected]>
Cc: Min Xu <[email protected]>
Cc: Jiewen Yao <[email protected]>
Cc: Tom Lendacky <[email protected]>
Cc: Jordan Justen <[email protected]>
Cc: Ard Biesheuvel <[email protected]>
Cc: Laszlo Ersek <[email protected]>
Signed-off-by: Brijesh Singh <[email protected]>
---
OvmfPkg/Include/Library/MemEncryptSevLib.h | 3 ++
OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf | 4 ++
OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeSnpSetPageState.c | 31
+++++++++++++++
OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c | 42
++++++++++++--------
4 files changed, 63 insertions(+), 17 deletions(-)
diff --git a/OvmfPkg/Include/Library/MemEncryptSevLib.h
b/OvmfPkg/Include/Library/MemEncryptSevLib.h
index 47d6802b61..712590b64d 100644
--- a/OvmfPkg/Include/Library/MemEncryptSevLib.h
+++ b/OvmfPkg/Include/Library/MemEncryptSevLib.h
@@ -54,6 +54,9 @@ typedef struct _SEC_SEV_ES_WORK_AREA {
UINT64 RandomData;
UINT64 EncryptionMask;
+
+ UINT64 SnpSystemRamValidatedRootAddress;
+
} SEC_SEV_ES_WORK_AREA;
//
diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf
b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf
index fa8f7719a7..43b842254f 100644
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf
@@ -38,6 +38,7 @@
X64/PeiDxeVirtualMemory.c
X64/SnpPageStateChangeInternal.c
X64/PeiDxeSnpSetPageState.c
+ X64/SnpPageStateTrack.c
X64/VirtualMemory.c
X64/VirtualMemory.h
@@ -58,3 +59,6 @@
[Pcd]
gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask
+
+[FixedPcd]
+ gUefiCpuPkgTokenSpaceGuid.PcdSevEsWorkAreaBase
diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeSnpSetPageState.c
b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeSnpSetPageState.c
index 0a3d58ac22..9fe6831368 100644
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeSnpSetPageState.c
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiDxeSnpSetPageState.c
@@ -10,8 +10,12 @@
#include <Uefi/UefiBaseType.h>
#include <Library/BaseLib.h>
+#include <Library/MemEncryptSevLib.h>
+#include <Library/PcdLib.h>
+#include <Library/DebugLib.h>
#include "PeiSnpPageStateChange.h"
+#include "SnpPageStateTrack.h"
VOID
SnpSetMemoryPrivate (
@@ -28,5 +32,32 @@ SnpSetMemoryShared (
IN UINTN Length
)
{
+ SEC_SEV_ES_WORK_AREA *SevEsWorkArea;
+ SNP_VALIDATED_RANGE *RootNode, *Range;
+
+ //
+ // Get the Page State tracker root node. The information will be used to
lookup
+ // the address in the page state tracker.
+ //
+ SevEsWorkArea = (SEC_SEV_ES_WORK_AREA *) FixedPcdGet32
(PcdSevEsWorkAreaBase);
+ RootNode = (SNP_VALIDATED_RANGE *)
SevEsWorkArea->SnpSystemRamValidatedRootAddress;
+
+ //
+ // Check if the region is validated during the System RAM validation process.
+ // If region is not validated then do nothing. This typically will happen if
+ // we are getting called to make the page state change for the MMIO region.
+ // The MMIO regions fall within reserved memory type and does not require
+ // page state changes.
+ //
+ Range = FindOverlapRange (RootNode, PhysicalAddress, PhysicalAddress +
Length);
+ if (Range == NULL) {
+ DEBUG ((EFI_D_INFO, "%a:%a %Lx - %Lx is not RAM, skipping it.\n",
+ gEfiCallerBaseName,
+ __FUNCTION__,
+ PhysicalAddress,
+ PhysicalAddress + Length));
+ return;
+ }
+
SetPageStateInternal (PhysicalAddress, EFI_SIZE_TO_PAGES (Length),
SevSnpPageShared, FALSE);
}
diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c
b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c
index 41bf301efe..2e049d3df7 100644
--- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c
+++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c
@@ -18,8 +18,6 @@
#include "SnpPageStateTrack.h"
#include "VirtualMemory.h"
-STATIC SNP_VALIDATED_RANGE *mRootNode;
-
STATIC
SNP_VALIDATED_RANGE *
SetPageStateChangeInitialize (
@@ -64,15 +62,34 @@ SevSnpValidateSystemRam (
UINTN EndAddress;
SNP_VALIDATED_RANGE *Range;
EFI_STATUS Status;
+ SEC_SEV_ES_WORK_AREA *SevEsWorkArea;
+ SNP_VALIDATED_RANGE *RootNode;
EndAddress = BaseAddress + EFI_PAGES_TO_SIZE (NumPages);
+ // The Root of SNP_VALIDATED_RANGE is saved in the EsWorkArea.
+ SevEsWorkArea = (SEC_SEV_ES_WORK_AREA *) FixedPcdGet32
(PcdSevEsWorkAreaBase);
+ RootNode = (SNP_VALIDATED_RANGE *)
SevEsWorkArea->SnpSystemRamValidatedRootAddress;
+
+ //
+ // If the Root is NULL then its the first call. Lets initialize the List
before
+ // we process the request.
+ //
+ if (RootNode == NULL) {
+ RootNode = SetPageStateChangeInitialize ();
+
+ //
+ // Save the RootNode in the workarea
+ //
+ SevEsWorkArea->SnpSystemRamValidatedRootAddress = (UINT64) (UINTN)
RootNode;
+ }
+
//
// The page table used in PEI can address up to 4GB memory. If we are asked
to validate
// a range above the 4GB, then create an identity mapping so that the
PVALIDATE instruction
- // can execute correctly. If the page table entry is not present then
PVALIDATE will
- // cause the #GP.
//
+ //
+
if (BaseAddress >= SIZE_4GB) {
Status = InternalMemEncryptSevCreateIdentityMap1G (0, BaseAddress,
EFI_PAGES_TO_SIZE (NumPages));
@@ -81,25 +98,16 @@ SevSnpValidateSystemRam (
}
}
- //
- // If the Root is NULL then its the first call. Lets initialize the List
before
- // we process the request.
- //
- if (mRootNode == NULL) {
- mRootNode = SetPageStateChangeInitialize ();
- }
-
//
// Check if the range is already validated
//
- EndAddress = BaseAddress + EFI_PAGES_TO_SIZE(NumPages);
- Range = FindOverlapRange (mRootNode, BaseAddress, EndAddress);
+ Range = FindOverlapRange (RootNode, BaseAddress, EndAddress);
//
// Range is not validated
if (Range == NULL) {
SetPageStateInternal (BaseAddress, NumPages, SevSnpPagePrivate, TRUE);
- AddRangeToIntervalTree (mRootNode, BaseAddress, EndAddress);
+ AddRangeToIntervalTree (RootNode, BaseAddress, EndAddress);
return;
}
@@ -110,12 +118,12 @@ SevSnpValidateSystemRam (
if (BaseAddress < Range->StartAddress) {
NumPages = EFI_SIZE_TO_PAGES (Range->StartAddress - BaseAddress);
SetPageStateInternal (BaseAddress, NumPages, SevSnpPagePrivate, TRUE);
- AddRangeToIntervalTree (mRootNode, BaseAddress, Range->StartAddress);
+ AddRangeToIntervalTree (RootNode, BaseAddress, Range->StartAddress);
}
if (EndAddress > Range->EndAddress) {
NumPages = EFI_SIZE_TO_PAGES (EndAddress - Range->EndAddress);
SetPageStateInternal (Range->EndAddress, NumPages, SevSnpPagePrivate,
TRUE);
- AddRangeToIntervalTree (mRootNode, Range->StartAddress, EndAddress);
+ AddRangeToIntervalTree (RootNode, Range->StartAddress, EndAddress);
}
}
--
2.17.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#73235): https://edk2.groups.io/g/devel/message/73235
Mute This Topic: https://groups.io/mt/81584596/21656
Group Owner: [email protected]
Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
