On Tue, Apr 23, 2024 at 03:59:58PM -0500, Michael Roth wrote:
> For the most part, OVMF will clear the encryption bit for MMIO regions,
> but there is currently one known exception during SEC when the APIC
> base address is accessed via MMIO with the encryption bit set for
> SEV-ES/SEV-SNP guests.
what exactly accesses the lapic that early?
> +/**
> + Map known MMIO regions unencrypted if SEV-ES is active.
> +
> + During early booting, page table entries default to having the encryption
> bit
> + set for SEV-ES/SEV-SNP guests. In cases where there is MMIO to an address,
> the
> + encryption bit should be cleared. Clear it here for any known MMIO accesses
> + during SEC, which is currently just the APIC base address.
> +
> +**/
> +VOID
> +SecMapApicBaseUnencrypted (
> + VOID
> + )
> +{
> + PAGE_MAP_AND_DIRECTORY_POINTER *Level4Entry;
> + PAGE_MAP_AND_DIRECTORY_POINTER *Level3Entry;
> + PAGE_MAP_AND_DIRECTORY_POINTER *Level2Entry;
> + PAGE_TABLE_4K_ENTRY *Level1Entry;
> + SEC_SEV_ES_WORK_AREA *SevEsWorkArea;
> + PHYSICAL_ADDRESS Cr3;
> + UINT64 ApicAddress;
> + UINT64 PgTableMask;
> + UINT32 Level1Page;
> + UINT64 Level1Address;
> + UINT64 Level1Flags;
> + UINTN PteIndex;
> +
> + if (!SevEsIsEnabled ()) {
> + return;
> + }
That is incompatible with 5-level paging. The current reset vector will
never turn on 5-level paging in case SEV is active because we have more
incompatibilities elsewhere (BaseMemEncryptSevLib IIRC). But still,
it's moving things into the wrong direction ...
Ideally CpuPageTableLib should be used for this.
take care,
Gerd
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#118211): https://edk2.groups.io/g/devel/message/118211
Mute This Topic: https://groups.io/mt/105698125/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
