From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f201.google.com (mail-pl1-f201.google.com [209.85.214.201]) by mx.groups.io with SMTP id smtpd.web11.1243.1670612331242607378 for ; Fri, 09 Dec 2022 10:58:51 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@google.com header.s=20210112 header.b=WWDE2vtZ; spf=pass (domain: flex--acdunlap.bounces.google.com, ip: 209.85.214.201, mailfrom: 3aowtywgkbeuhjkbushwnvvnsl.jvtklclslkrj.nyvbwz.pv@flex--acdunlap.bounces.google.com) Received: by mail-pl1-f201.google.com with SMTP id b17-20020a170903229100b00189da3b178bso4847936plh.7 for ; Fri, 09 Dec 2022 10:58:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=cHnSrIDd4Sgj/ie6jAjcH9PGGfrhE3+9zG/6DpY013w=; b=WWDE2vtZ1fsYTvvTEpH6Knwk+6l0m/82dgRISo7jDbzkAu0/fD3/aOPlkCj1ZjF5yY JZnFpJJneXD5SAcpQ487XLA/l14ltVoXY5ezLH++uQ7hQ8BvV/5vACaXvz2tWo1FQwSg 6fVHYW1SmUT42pV91/f9E11v5Rj76jtaNcjMdXn3xmsR2M4QFc8xR04gwWX7/uQznywq W4hMszJBNq1gdhkDVaWja1V9nFTzSOmnluZvn0ZIS94RH3xhsamPH1/e9D2vjv5SBCRR li+5NwbqZgDHr6u/lDKdbjA9RblfgAHvkzyacWwjj1MoJMcIAN8SPE6YY4ztas3hTfPG D0dQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=cHnSrIDd4Sgj/ie6jAjcH9PGGfrhE3+9zG/6DpY013w=; b=EW+zjGKoEYlYdf2vbIEQ+1BGGQf+pDSNSqHm67dFo8RwK9urhcOFkLNSXfwsp/o5U5 n5R8/obSkiqEVDgoz+JmCijxBnag/11mZu3EjyqzLk7IYZFY7wwuslH1hmh9XyRmaJgI 7KZDimR0M2RzHhG498j5NltjgNWeehJ9OakVpZYAKvHnucptWh0Cpmw6uOha5VXmMbDs hKZaDx7KRHGARe9vuMJ4NzCvOb0CA9dh9OeFDZxm3oXTCeAHmCBX17+ozsWK6ObYLscq 0TLFuVGORqr4XHqzISIa+3NeLAYYMDRa/PZlhQ9xV0t2YdbDf9Y+IXVCTwE8KMJaNnY7 miWg== X-Gm-Message-State: ANoB5pnC+sqlCxdmlhUczzt0C1MzfzkOuxsT/+McGoZ9Hz69mkihxqz5 vi3iUlihR+CB6mo0Rjws8BX9dhn9XyzSor0Vbwc4uA43V+EvBZnmfB1Wf1ajoF2PPiQNSSXTpOF 9k7EstqxGj5QfqBGZa4FLmdks4aApv5W8rexzyzOp9NSl9NhNvRCSvrygY5PXIORW X-Google-Smtp-Source: AA0mqf6/VHEIh6BW7wA1PibREytTkPA3tteWmxxSWeaomvaA9iQdWjsDs983FfrYhUtPbGN+CReYxXdEmUxFLg== X-Received: from acdunlap03.bve.corp.google.com ([2620:0:1008:11:9c55:ddcf:a880:90f3]) (user=acdunlap job=sendgmr) by 2002:a05:6a00:a88:b0:574:2c5e:b18c with SMTP id b8-20020a056a000a8800b005742c5eb18cmr74165102pfl.10.1670612330392; Fri, 09 Dec 2022 10:58:50 -0800 (PST) Date: Fri, 9 Dec 2022 10:58:41 -0800 In-Reply-To: Mime-Version: 1.0 References: X-Mailer: git-send-email 2.39.0.rc1.256.g54fd8350bd-goog Message-ID: <9b9c4946b7b825d2dc6ba2d6aab9ea703db81bf7.1670611881.git.acdunlap@google.com> Subject: [PATCH v2] OvmfPkg/PlatformPei: Validate SEC's GHCB page From: "Adam Dunlap" To: devel@edk2.groups.io Cc: Ard Biesheuvel , Jiewen Yao , Jordan Justen , Gerd Hoffmann , Brijesh Singh , Erdem Aktas , James Bottomley , Min Xu , Tom Lendacky , Dionna Glaze , Adam Dunlap Content-Type: text/plain; charset="UTF-8" When running under SEV-ES, a page of shared memory is allocated for the GHCB during the SEC phase at address 0x809000. This page of memory is eventually passed to the OS as EfiConventionalMemory. When running SEV-SNP, this page is not PVALIDATE'd in the RMP table, meaning that if the guest OS tries to access the page, it will think that the host has voilated the security guarantees and will likely crash. This patch validates this page immediately after EDK2 switches to using the GHCB page allocated for the PEI phase. This was tested by writing a UEFI application that reads to and writes from one byte of each page of memory and checks to see if a #VC exception is generated indicating that the page was not validated. Fixes: 6995a1b79bab ("OvmfPkg: Create a GHCB page for use during Sec phase") Signed-off-by: Adam Dunlap --- OvmfPkg/PlatformPei/AmdSev.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c index e1b9fd9b7f..df560a8679 100644 --- a/OvmfPkg/PlatformPei/AmdSev.c +++ b/OvmfPkg/PlatformPei/AmdSev.c @@ -212,7 +212,7 @@ AmdSevEsInitialize ( UINTN GhcbBackupPageCount; SEV_ES_PER_CPU_DATA *SevEsData; UINTN PageCount; - RETURN_STATUS PcdStatus, DecryptStatus; + RETURN_STATUS PcdStatus, Status; IA32_DESCRIPTOR Gdtr; VOID *Gdt; @@ -240,12 +240,12 @@ AmdSevEsInitialize ( // only clear the encryption mask for the GHCB pages. // for (PageCount = 0; PageCount < GhcbPageCount; PageCount += 2) { - DecryptStatus = MemEncryptSevClearPageEncMask ( + Status = MemEncryptSevClearPageEncMask ( 0, GhcbBasePa + EFI_PAGES_TO_SIZE (PageCount), 1 ); - ASSERT_RETURN_ERROR (DecryptStatus); + ASSERT_RETURN_ERROR (Status); } ZeroMem (GhcbBase, EFI_PAGES_TO_SIZE (GhcbPageCount)); @@ -295,6 +295,21 @@ AmdSevEsInitialize ( AsmWriteMsr64 (MSR_SEV_ES_GHCB, GhcbBasePa); + // + // Now that the PEI GHCB is set up, the SEC GHCB page is no longer necessary + // to keep shared. Later, it is exposed to the OS as EfiConventionalMemory, so + // it needs to be marked private. The size of the region is hardcoded in + // OvmfPkg/ResetVector/ResetVector.nasmb in the definition of + // SNP_SEC_MEM_BASE_DESC_2. + // + + Status = MemEncryptSevSetPageEncMask ( + 0, // Cr3 -- use system Cr3 + FixedPcdGet32 (PcdOvmfSecGhcbBase), + 1 // Number of pages + ); + ASSERT_RETURN_ERROR (Status); + // // The SEV support will clear the C-bit from non-RAM areas. The early GDT // lives in a non-RAM area, so when an exception occurs (like a #VC) the GDT -- 2.39.0.rc1.256.g54fd8350bd-goog