public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Laszlo Ersek" <lersek@redhat.com>
To: "Gao, Liming" <liming.gao@intel.com>,
	Tom Lendacky <thomas.lendacky@amd.com>,
	"devel@edk2.groups.io" <devel@edk2.groups.io>
Cc: Brijesh Singh <brijesh.singh@amd.com>,
	Ard Biesheuvel <ard.biesheuvel@arm.com>,
	"Dong, Eric" <eric.dong@intel.com>,
	"Justen, Jordan L" <jordan.l.justen@intel.com>,
	"Kinney, Michael D" <michael.d.kinney@intel.com>,
	"Ni, Ray" <ray.ni@intel.com>
Subject: Re: [PATCH v12 07/46] MdePkg/BaseLib: Add support for the VMGEXIT instruction
Date: Tue, 28 Jul 2020 14:04:23 +0200	[thread overview]
Message-ID: <1d539df5-142e-7ab1-faa6-0d0f6eea1608@redhat.com> (raw)
In-Reply-To: <MWHPR11MB16308153B3264F4130B92A1B80730@MWHPR11MB1630.namprd11.prod.outlook.com>

On 07/28/20 09:39, Gao, Liming wrote:
> This error is reported from nasm compiler. My nasm compiler version is
> 2.11.08. It may be a little old. 2.12 should be fine.
>
> This change also requires to update
> edk2\BaseTools\Conf\tools_def.template and mention nasm compiler
> version.

"tools_def.template" says:

  NASM 2.10 or later for use with the GCC toolchain family

Bumping the NASM requirement from 2.10 to 2.12 will rule out:

- Debian "jessie" (oldoldstable),
- Ubuntu "xenial" (16.04 LTS),
- and RHEL7,

as build hosts.

Debian "jessie" is no longer supported (LTS ended in June 2020), but
Ubuntu "xenial" and RHEL7 are still supported by their vendors.

I seem to recall that it was me to recommend "BITS 64" in front of "rep
vmmcall" in the IA32 NASM source file:

  https://edk2.groups.io/g/devel/message/48292
  http://mid.mail-archive.com/e8a8e21e-4045-1b2b-f959-13fbe00132d9@redhat.com

I don't understand why my testing worked back then, and now it doesn't.
(IOW, I can also reproduce the error that Liming reported!) It's likely
because I didn't specify the elf32 output format back then.

Indeed: the following command fails:

> "nasm" \
>   -I"$WORKSPACE"/MdePkg/Library/BaseLib/Ia32/ \
>   -I"$WORKSPACE"/MdePkg/Library/BaseLib/Ia32/ \
>   -I"$WORKSPACE"/MdePkg/Library/BaseLib/ \
>   -I"$WORKSPACE"/Build/OvmfIa32/NOOPT_GCC48/IA32/MdePkg/Library/BaseLib/BaseLib/DEBUG/ \
>   -I"$WORKSPACE"/MdePkg/ \
>   -I"$WORKSPACE"/MdePkg/Include/ \
>   -I"$WORKSPACE"/MdePkg/Test/UnitTest/Include/ \
>   -I"$WORKSPACE"/MdePkg/Include/Ia32/ \
>   -f elf32 \
>   -o "$WORKSPACE"/Build/OvmfIa32/NOOPT_GCC48/IA32/MdePkg/Library/BaseLib/BaseLib/OUTPUT/Ia32/VmgExit.obj \
>   "$WORKSPACE"/Build/OvmfIa32/NOOPT_GCC48/IA32/MdePkg/Library/BaseLib/BaseLib/OUTPUT/Ia32/VmgExit.iii

but if I remove "-f elf32", it completes fine. :(

The AMD manual says about VMGEXIT:

> The VMGEXIT opcode is only valid within a guest when run with SEV-ES
> mode active. If the guest is not run with SEV-ES mode active, the
> VMGEXIT opcode will be treated as a VMMCALL opcode and will behave
> exactly like a VMMCALL.

VMGEXIT is a SEV-ES-only form of guest-host communication. SEV-ES mode
depends on SEV. A SEV guest can only interact with the host (= decrypt
its pages for the host to access) if the guest is executing in long
mode.

So does it even make sense to *attempt* implementing AsmVmgExit()
"correctly" for IA32?

I don't want to complicate the build dependencies in this series
further, so I won't suggest that we simply *not* implement AsmVmgExit()
for IA32 at all. (Purely from a BaseLib perspective, this would be a
valid approach, but then call sites would have to be *build-time*
restricted to X64 too. The call sites *are* already restricted to X64,
AIUI, but that happens at runtime (= dynamic checks), not at build
time.)

So here's what I suggest: implement AsmVmgExit() for IA32 in the C
language, namely as a call to CpuBreakpoint().

I wouldn't like to tighten the NASM version requirement for *all* of
edk2, for the sake of building a BaseLib primitive for IA32 that we
never *call* on IA32.

Thanks,
Laszlo

>
> Thanks
> Liming
> -----Original Message-----
> From: Tom Lendacky <thomas.lendacky@amd.com>
> Sent: 2020t7\b28å 12:08
> To: Gao, Liming <liming.gao@intel.com>; devel@edk2.groups.io
> Cc: Brijesh Singh <brijesh.singh@amd.com>; Ard Biesheuvel <ard.biesheuvel@arm.com>; Dong, Eric <eric.dong@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>; Laszlo Ersek <lersek@redhat.com>; Kinney, Michael D <michael.d.kinney@intel.com>; Ni, Ray <ray.ni@intel.com>
> Subject: Re: [PATCH v12 07/46] MdePkg/BaseLib: Add support for the VMGEXIT instruction
>
> On 7/27/20 8:34 PM, Gao, Liming wrote:
>> Tom:
>
> Hi Liming,
>
>>    I meet with GCC failure on this patch. Can you help check it? If nasm doesn't support the vmmcall instruction in 32-bit mode, you have to use inline assembly to support it.
>
> What version of GCC are you using. I was able to successfully build the
> Ia32 version with my GCC level. The Ia32 version uses a trick to do switch to 64-bit just to encode the instruction. Looks like that doesn't work with your version of GCC.
>
> I can probably switch to defining the instruction as bytes. Let me look into that and possibly send you a patch to test.
>
> Thanks,
> Tom
>
>>
>> Edk2/Build/IntelFsp2Pkg/DEBUG_GCC5/IA32/MdePkg/Library/BaseLib/BaseLib
>> /OUTPUT/Ia32/VmgExit.iii:33: error: elf32 output format does not
>> support 64-bit code
>> GNUmakefile:741: recipe for target
>>
>> Thanks
>> Liming
>> -----Original Message-----
>> From: Tom Lendacky <thomas.lendacky@amd.com>
>> Sent: 2020t7\b27å 23:26
>> To: devel@edk2.groups.io
>> Cc: Brijesh Singh <brijesh.singh@amd.com>; Ard Biesheuvel
>> <ard.biesheuvel@arm.com>; Dong, Eric <eric.dong@intel.com>; Justen,
>> Jordan L <jordan.l.justen@intel.com>; Laszlo Ersek
>> <lersek@redhat.com>; Gao, Liming <liming.gao@intel.com>; Kinney,
>> Michael D <michael.d.kinney@intel.com>; Ni, Ray <ray.ni@intel.com>
>> Subject: [PATCH v12 07/46] MdePkg/BaseLib: Add support for the VMGEXIT
>> instruction
>>
>> From: Tom Lendacky <thomas.lendacky@amd.com>
>>
>> BZ:
>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugz
>> illa.tianocore.org%2Fshow_bug.cgi%3Fid%3D2198&amp;data=02%7C01%7Cthoma
>> s.lendacky%40amd.com%7C77c8250cd9e14f2929a008d832965726%7C3dd8961fe488
>> 4e608e11a82d994e183d%7C0%7C0%7C637314968570901400&amp;sdata=6zqseI3tVm
>> aw351w9mfEymMnDcjDzjvcBrhARU6r3Ho%3D&amp;reserved=0
>>
>> VMGEXIT is a new instruction used for Hypervisor/Guest communication when running as an SEV-ES guest. A VMGEXIT will cause an automatic exit (AE) to occur, resulting in a #VMEXIT with an exit code value of 0x403.
>>
>> Provide the necessary support to execute the VMGEXIT instruction, which is "rep; vmmcall".
>>
>> Cc: Michael D Kinney <michael.d.kinney@intel.com>
>> Cc: Liming Gao <liming.gao@intel.com>
>> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
>> ---
>>   MdePkg/Library/BaseLib/BaseLib.inf       |  2 ++
>>   MdePkg/Include/Library/BaseLib.h         | 14 +++++++++
>>   MdePkg/Library/BaseLib/Ia32/VmgExit.nasm | 37 ++++++++++++++++++++++++  MdePkg/Library/BaseLib/X64/VmgExit.nasm  | 32 ++++++++++++++++++++
>>   4 files changed, 85 insertions(+)
>>   create mode 100644 MdePkg/Library/BaseLib/Ia32/VmgExit.nasm
>>   create mode 100644 MdePkg/Library/BaseLib/X64/VmgExit.nasm
>>
>> diff --git a/MdePkg/Library/BaseLib/BaseLib.inf
>> b/MdePkg/Library/BaseLib/BaseLib.inf
>> index 3b93b5db8d24..3b85c56c3c03 100644
>> --- a/MdePkg/Library/BaseLib/BaseLib.inf
>> +++ b/MdePkg/Library/BaseLib/BaseLib.inf
>> @@ -184,6 +184,7 @@ [Sources.Ia32]
>>     Ia32/DisableCache.nasm| GCC
>>     Ia32/RdRand.nasm
>>     Ia32/XGetBv.nasm
>> +  Ia32/VmgExit.nasm
>>
>>     Ia32/DivS64x64Remainder.c
>>     Ia32/InternalSwitchStack.c | MSFT
>> @@ -317,6 +318,7 @@ [Sources.X64]
>>     X64/DisablePaging64.nasm
>>     X64/RdRand.nasm
>>     X64/XGetBv.nasm
>> +  X64/VmgExit.nasm
>>     ChkStkGcc.c  | GCC
>>
>>   [Sources.EBC]
>> diff --git a/MdePkg/Include/Library/BaseLib.h
>> b/MdePkg/Include/Library/BaseLib.h
>> index 7edf0051a0a0..04fb329eaabb 100644
>> --- a/MdePkg/Include/Library/BaseLib.h
>> +++ b/MdePkg/Include/Library/BaseLib.h
>> @@ -7848,6 +7848,20 @@ AsmXGetBv (
>>     );
>>
>>
>> +/**
>> +  Executes a VMGEXIT instruction (VMMCALL with a REP prefix)
>> +
>> +  Executes a VMGEXIT instruction. This function is only available on
>> + IA-32 and  x64.
>> +
>> +**/
>> +VOID
>> +EFIAPI
>> +AsmVmgExit (
>> +  VOID
>> +  );
>> +
>> +
>>   /**
>>     Patch the immediate operand of an IA32 or X64 instruction such that the byte,
>>     word, dword or qword operand is encoded at the end of the
>> instruction's diff --git a/MdePkg/Library/BaseLib/Ia32/VmgExit.nasm
>> b/MdePkg/Library/BaseLib/Ia32/VmgExit.nasm
>> new file mode 100644
>> index 000000000000..a4b37385cc7a
>> --- /dev/null
>> +++ b/MdePkg/Library/BaseLib/Ia32/VmgExit.nasm
>> @@ -0,0 +1,37 @@
>> +;--------------------------------------------------------------------
>> +--
>> +--------
>> +;
>> +; Copyright (C) 2020, Advanced Micro Devices, Inc. All rights
>> +reserved.<BR> ; SPDX-License-Identifier: BSD-2-Clause-Patent ; ;
>> +Module
>> +Name:
>> +;
>> +;   VmgExit.Asm
>> +;
>> +; Abstract:
>> +;
>> +;   AsmVmgExit function
>> +;
>> +; Notes:
>> +;
>> +;--------------------------------------------------------------------
>> +--
>> +--------
>> +
>> +    SECTION .text
>> +
>> +;--------------------------------------------------------------------
>> +--
>> +--------
>> +; VOID
>> +; EFIAPI
>> +; AsmVmgExit (
>> +;   VOID
>> +;   );
>> +;--------------------------------------------------------------------
>> +--
>> +--------
>> +global ASM_PFX(AsmVmgExit)
>> +ASM_PFX(AsmVmgExit):
>> +;
>> +; NASM doesn't support the vmmcall instruction in 32-bit mode, so
>> +work around ; this by temporarily switching to 64-bit mode.
>> +;
>> +BITS    64
>> +    rep     vmmcall
>> +BITS    32
>> +    ret
>> +
>> diff --git a/MdePkg/Library/BaseLib/X64/VmgExit.nasm
>> b/MdePkg/Library/BaseLib/X64/VmgExit.nasm
>> new file mode 100644
>> index 000000000000..26f034593c67
>> --- /dev/null
>> +++ b/MdePkg/Library/BaseLib/X64/VmgExit.nasm
>> @@ -0,0 +1,32 @@
>> +;--------------------------------------------------------------------
>> +--
>> +--------
>> +;
>> +; Copyright (C) 2020, Advanced Micro Devices, Inc. All rights
>> +reserved.<BR> ; SPDX-License-Identifier: BSD-2-Clause-Patent ; ;
>> +Module
>> +Name:
>> +;
>> +;   VmgExit.Asm
>> +;
>> +; Abstract:
>> +;
>> +;   AsmVmgExit function
>> +;
>> +; Notes:
>> +;
>> +;--------------------------------------------------------------------
>> +--
>> +--------
>> +
>> +    DEFAULT REL
>> +    SECTION .text
>> +
>> +;--------------------------------------------------------------------
>> +--
>> +--------
>> +; VOID
>> +; EFIAPI
>> +; AsmVmgExit (
>> +;   VOID
>> +;   );
>> +;--------------------------------------------------------------------
>> +--
>> +--------
>> +global ASM_PFX(AsmVmgExit)
>> +ASM_PFX(AsmVmgExit):
>> +    rep     vmmcall
>> +    ret
>> +
>> --
>> 2.27.0
>>
>


  reply	other threads:[~2020-07-28 12:04 UTC|newest]

Thread overview: 61+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-27 15:25 [PATCH v12 00/46] SEV-ES guest support Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 01/46] MdeModulePkg: Create PCDs to be used in support of SEV-ES Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 02/46] UefiCpuPkg: Create PCD " Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 03/46] MdePkg: Add the MSR definition for the GHCB register Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 04/46] MdePkg: Add a structure definition for the GHCB Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 05/46] MdeModulePkg/DxeIplPeim: Support GHCB pages when creating page tables Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 06/46] MdePkg/BaseLib: Add support for the XGETBV instruction Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 07/46] MdePkg/BaseLib: Add support for the VMGEXIT instruction Lendacky, Thomas
2020-07-28  1:34   ` Liming Gao
2020-07-28  4:07     ` Lendacky, Thomas
2020-07-28  7:39       ` Liming Gao
2020-07-28 12:04         ` Laszlo Ersek [this message]
2020-07-28 13:44           ` Liming Gao
2020-07-28 14:13           ` Lendacky, Thomas
2020-07-28 15:19             ` Laszlo Ersek
2020-07-29  1:13               ` Liming Gao
2020-07-27 15:25 ` [PATCH v12 08/46] UefiCpuPkg: Implement library support for VMGEXIT Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 09/46] OvmfPkg: Prepare OvmfPkg to use the VmgExitLib library Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 10/46] UefiPayloadPkg: Prepare UefiPayloadPkg " Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 11/46] UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC exception Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 12/46] OvmfPkg/VmgExitLib: Implement library support for VmgExitLib in OVMF Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 13/46] OvmfPkg/VmgExitLib: Add support for IOIO_PROT NAE events Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 14/46] OvmfPkg/VmgExitLib: Support string IO " Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 15/46] OvmfPkg/VmgExitLib: Add support for CPUID " Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 16/46] OvmfPkg/VmgExitLib: Add support for MSR_PROT " Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 17/46] OvmfPkg/VmgExitLib: Add support for NPF NAE events (MMIO) Lendacky, Thomas
2020-07-27 15:25 ` [PATCH v12 18/46] OvmfPkg/VmgExitLib: Add support for WBINVD NAE events Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 19/46] OvmfPkg/VmgExitLib: Add support for RDTSC " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 20/46] OvmfPkg/VmgExitLib: Add support for RDPMC " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 21/46] OvmfPkg/VmgExitLib: Add support for INVD " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 22/46] OvmfPkg/VmgExitLib: Add support for VMMCALL " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 23/46] OvmfPkg/VmgExitLib: Add support for RDTSCP " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 24/46] OvmfPkg/VmgExitLib: Add support for MONITOR/MONITORX " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 25/46] OvmfPkg/VmgExitLib: Add support for MWAIT/MWAITX " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 26/46] OvmfPkg/VmgExitLib: Add support for DR7 Read/Write " Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 27/46] OvmfPkg/MemEncryptSevLib: Add an SEV-ES guest indicator function Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 28/46] OvmfPkg: Add support to perform SEV-ES initialization Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 29/46] OvmfPkg: Create a GHCB page for use during Sec phase Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 30/46] OvmfPkg/PlatformPei: Reserve GHCB-related areas if S3 is supported Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 31/46] OvmfPkg: Create GHCB pages for use during Pei and Dxe phase Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 32/46] OvmfPkg/PlatformPei: Move early GDT into ram when SEV-ES is enabled Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 33/46] UefiCpuPkg: Create an SEV-ES workarea PCD Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 34/46] OvmfPkg: Reserve a page in memory for the SEV-ES usage Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 35/46] OvmfPkg/PlatformPei: Reserve SEV-ES work area if S3 is supported Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 36/46] OvmfPkg/ResetVector: Add support for a 32-bit SEV check Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 37/46] OvmfPkg/Sec: Add #VC exception handling for Sec phase Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 38/46] OvmfPkg/Sec: Enable cache early to speed up booting Lendacky, Thomas
2020-07-27 15:26 ` [PATCH v12 39/46] OvmfPkg/QemuFlashFvbServicesRuntimeDxe: Bypass flash detection with SEV-ES Lendacky, Thomas
2020-07-27 17:41 ` [edk2-devel] [PATCH v12 00/46] SEV-ES guest support Laszlo Ersek
2020-07-27 17:43   ` Laszlo Ersek
2020-07-27 17:49     ` Lendacky, Thomas
2020-07-28 10:07       ` Laszlo Ersek
2020-07-28 12:52         ` Lendacky, Thomas
2020-07-28 13:59           ` Laszlo Ersek
2020-07-27 18:43 ` [PATCH v12 40/46] UefiCpuPkg: Add a 16-bit protected mode code segment descriptor Lendacky, Thomas
2020-07-27 18:43 ` [PATCH v12 41/46] UefiCpuPkg/MpInitLib: Add CPU MP data flag to indicate if SEV-ES is enabled Lendacky, Thomas
2020-07-27 18:43 ` [PATCH v12 42/46] UefiCpuPkg: Allow AP booting under SEV-ES Lendacky, Thomas
2020-07-27 18:43 ` [PATCH v12 43/46] OvmfPkg: Use the SEV-ES work area for the SEV-ES AP reset vector Lendacky, Thomas
2020-07-27 18:43 ` [PATCH v12 44/46] OvmfPkg: Move the GHCB allocations into reserved memory Lendacky, Thomas
2020-07-27 18:43 ` [PATCH v12 45/46] UefiCpuPkg/MpInitLib: Prepare SEV-ES guest APs for OS use Lendacky, Thomas
2020-07-27 18:43 ` [PATCH v12 46/46] Maintainers.txt: Add reviewers for the OvmfPkg SEV-related files Lendacky, Thomas

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1d539df5-142e-7ab1-faa6-0d0f6eea1608@redhat.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox