[PATCH 8/9] OvmfPkg/QemuFlashFvbServicesRuntimeDxe: Disable interrupts when using GHCB

["Lendacky, Thomas" <thomas.lendacky@amd.com>]

From: Tom Lendacky <thomas.lendacky@amd.com>

The QemuFlashPtrWrite() flash services runtime uses the GHCB and VmgExit()
directly to perform the flash write when running as an SEV-ES guest. If an
interrupt arrives between VmgInit() and VmgDone(), the Dr7 read in the
interrupt handler will generate a #VC, which can overwrite information in
the GHCB that QemuFlashPtrWrite() has set. Prevent this from occurring by
disabling interrupts around the usage of the GHCB.

Fixes: 437eb3f7a8db ("OvmfPkg/QemuFlashFvbServicesRuntimeDxe: Bypass flash detection with SEV-ES")
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
---
 OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlashDxe.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlashDxe.c b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlashDxe.c
index 5d5a117c48e0..872e58db7cc0 100644
--- a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlashDxe.c
+++ b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlashDxe.c
@@ -9,6 +9,7 @@
 
 **/
 
+#include <Library/BaseLib.h>
 #include <Library/UefiRuntimeLib.h>
 #include <Library/MemEncryptSevLib.h>
 #include <Library/VmgExitLib.h>
@@ -54,6 +55,7 @@ QemuFlashPtrWrite (
     GHCB                      *Ghcb;
     UINT32                    ScratchIndex;
     UINT32                    ScratchBit;
+    BOOLEAN                   InterruptsEnabled;
 
     Msr.GhcbPhysicalAddress = AsmReadMsr64 (MSR_SEV_ES_GHCB);
     Ghcb = Msr.Ghcb;
@@ -61,6 +63,15 @@ QemuFlashPtrWrite (
     ScratchIndex = GhcbSwScratch / 8;
     ScratchBit   = GhcbSwScratch & 0x07;
 
+    //
+    // Be sure that an interrupt can't cause a #VC while the GHCB is
+    // being used.
+    //
+    InterruptsEnabled = GetInterruptState ();
+    if (InterruptsEnabled) {
+      DisableInterrupts ();
+    }
+
     //
     // Writing to flash is emulated by the hypervisor through the use of write
     // protection. This won't work for an SEV-ES guest because the write won't
@@ -74,6 +85,10 @@ QemuFlashPtrWrite (
     Ghcb->SaveArea.ValidBitmap[ScratchIndex] |= (1 << ScratchBit);
     VmgExit (Ghcb, SVM_EXIT_MMIO_WRITE, (UINT64) (UINTN) Ptr, 1);
     VmgDone (Ghcb);
+
+    if (InterruptsEnabled) {
+      EnableInterrupts ();
+    }
   } else {
     *Ptr = Value;
   }
-- 
2.28.0