84cddd7 OvmfPkg/AmdSevDxe: Clear encryption bit on PCIe MMCONFIG range

2 files Authored by Tom Lendacky 3 years ago, Committed by mergify[bot] 3 years ago,
    OvmfPkg/AmdSevDxe: Clear encryption bit on PCIe MMCONFIG range
    
    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3108
    
    The PCIe MMCONFIG range should be treated as an MMIO range. However,
    there is a comment in the code explaining why AddIoMemoryBaseSizeHob()
    is not called. The AmdSevDxe walks the GCD map looking for MemoryMappedIo
    or NonExistent type memory and will clear the encryption bit for these
    ranges.
    
    Since the MMCONFIG range does not have one of these types, the encryption
    bit is not cleared for this range. Add support to detect the presence of
    the MMCONFIG range and clear the encryption bit. This will be needed for
    follow-on support that will validate that MMIO is not being performed to
    an encrypted address range under SEV-ES.
    
    Even though the encryption bit was set for this range, this still worked
    under both SEV and SEV-ES because the address range is marked by the
    hypervisor as MMIO in the nested page tables:
    - For SEV, access to this address range triggers a nested page fault (NPF)
      and the hardware supplies the guest physical address (GPA) in the VMCB's
      EXITINFO2 field as part of the exit information. However, the encryption
      bit is not set in the GPA, so the hypervisor can process the request
      without any issues.
    - For SEV-ES, access to this address range triggers a #VC. Since OVMF runs
      identity mapped (VA == PA), the virtual address is used to avoid the
      lookup of the physical address. The virtual address does not have the
      encryption bit set, so the hypervisor can process the request without
      any issues.
    
    Cc: Jordan Justen <jordan.l.justen@intel.com>
    Cc: Laszlo Ersek <lersek@redhat.com>
    Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
    Cc: Brijesh Singh <brijesh.singh@amd.com>
    Reviewed-by: Laszlo Ersek <lersek@redhat.com>
    Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
    Message-Id: <711ae2dcb6cb29e4c60862c18330cff627269b81.1610045305.git.thomas.lendacky@amd.com>
    
        
file modified
+19 -1