* [PATCH V2 1/1] OvmfPkg/VmgExitLig: HALT on #VE when access to private memory
@ 2022-10-28 8:24 Min Xu
2022-10-28 8:30 ` Yao, Jiewen
0 siblings, 1 reply; 2+ messages in thread
From: Min Xu @ 2022-10-28 8:24 UTC (permalink / raw)
To: devel
Cc: Min M Xu, Erdem Aktas, Gerd Hoffmann, James Bottomley, Jiewen Yao,
Tom Lendacky
From: Min M Xu <min.m.xu@intel.com>
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4125
EPT-violation #VE should be always on shared memory, which means the
shared bit of the GuestPA should be set. But in current #VE Handler
it is not checked. When it occurs, stop TD immediately and log out
the error.
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
---
.../Library/VmgExitLib/VmTdExitVeHandler.c | 40 ++++++++++++++-----
1 file changed, 29 insertions(+), 11 deletions(-)
diff --git a/OvmfPkg/Library/VmgExitLib/VmTdExitVeHandler.c b/OvmfPkg/Library/VmgExitLib/VmTdExitVeHandler.c
index b73e877c093b..c89268c5d8e8 100644
--- a/OvmfPkg/Library/VmgExitLib/VmTdExitVeHandler.c
+++ b/OvmfPkg/Library/VmgExitLib/VmTdExitVeHandler.c
@@ -300,23 +300,41 @@ MmioExit (
IN TDCALL_VEINFO_RETURN_DATA *Veinfo
)
{
- UINT64 Status;
- UINT32 MmioSize;
- UINT32 RegSize;
- UINT8 OpCode;
- BOOLEAN SeenRex;
- UINT64 *Reg;
- UINT8 *Rip;
- UINT64 Val;
- UINT32 OpSize;
- MODRM ModRm;
- REX Rex;
+ UINT64 Status;
+ UINT32 MmioSize;
+ UINT32 RegSize;
+ UINT8 OpCode;
+ BOOLEAN SeenRex;
+ UINT64 *Reg;
+ UINT8 *Rip;
+ UINT64 Val;
+ UINT32 OpSize;
+ MODRM ModRm;
+ REX Rex;
+ TD_RETURN_DATA TdReturnData;
+ UINT8 Gpaw;
+ UINT64 TdSharedPageMask;
Rip = (UINT8 *)Regs->Rip;
Val = 0;
Rex.Val = 0;
SeenRex = FALSE;
+ Status = TdCall (TDCALL_TDINFO, 0, 0, 0, &TdReturnData);
+ if (Status == TDX_EXIT_REASON_SUCCESS) {
+ Gpaw = (UINT8)(TdReturnData.TdInfo.Gpaw & 0x3f);
+ TdSharedPageMask = 1ULL << (Gpaw - 1);
+ } else {
+ DEBUG ((DEBUG_ERROR, "TDCALL failed with status=%llx\n", Status));
+ return Status;
+ }
+
+ if ((Veinfo->GuestPA & TdSharedPageMask) == 0) {
+ DEBUG ((DEBUG_ERROR, "EPT-violation #VE on private memory is not allowed!"));
+ TdVmCall (TDVMCALL_HALT, 0, 0, 0, 0, 0);
+ CpuDeadLoop ();
+ }
+
//
// Default to 32bit transfer
//
--
2.29.2.windows.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH V2 1/1] OvmfPkg/VmgExitLig: HALT on #VE when access to private memory
2022-10-28 8:24 [PATCH V2 1/1] OvmfPkg/VmgExitLig: HALT on #VE when access to private memory Min Xu
@ 2022-10-28 8:30 ` Yao, Jiewen
0 siblings, 0 replies; 2+ messages in thread
From: Yao, Jiewen @ 2022-10-28 8:30 UTC (permalink / raw)
To: Xu, Min M, devel@edk2.groups.io
Cc: Aktas, Erdem, Gerd Hoffmann, James Bottomley, Tom Lendacky
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
> -----Original Message-----
> From: Xu, Min M <min.m.xu@intel.com>
> Sent: Friday, October 28, 2022 4:24 PM
> To: devel@edk2.groups.io
> Cc: Xu, Min M <min.m.xu@intel.com>; Aktas, Erdem
> <erdemaktas@google.com>; Gerd Hoffmann <kraxel@redhat.com>; James
> Bottomley <jejb@linux.ibm.com>; Yao, Jiewen <jiewen.yao@intel.com>;
> Tom Lendacky <thomas.lendacky@amd.com>
> Subject: [PATCH V2 1/1] OvmfPkg/VmgExitLig: HALT on #VE when access to
> private memory
>
> From: Min M Xu <min.m.xu@intel.com>
>
> BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4125
>
> EPT-violation #VE should be always on shared memory, which means the
> shared bit of the GuestPA should be set. But in current #VE Handler
> it is not checked. When it occurs, stop TD immediately and log out
> the error.
>
> Cc: Erdem Aktas <erdemaktas@google.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: James Bottomley <jejb@linux.ibm.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Tom Lendacky <thomas.lendacky@amd.com>
> Signed-off-by: Min Xu <min.m.xu@intel.com>
> ---
> .../Library/VmgExitLib/VmTdExitVeHandler.c | 40 ++++++++++++++-----
> 1 file changed, 29 insertions(+), 11 deletions(-)
>
> diff --git a/OvmfPkg/Library/VmgExitLib/VmTdExitVeHandler.c
> b/OvmfPkg/Library/VmgExitLib/VmTdExitVeHandler.c
> index b73e877c093b..c89268c5d8e8 100644
> --- a/OvmfPkg/Library/VmgExitLib/VmTdExitVeHandler.c
> +++ b/OvmfPkg/Library/VmgExitLib/VmTdExitVeHandler.c
> @@ -300,23 +300,41 @@ MmioExit (
> IN TDCALL_VEINFO_RETURN_DATA *Veinfo
> )
> {
> - UINT64 Status;
> - UINT32 MmioSize;
> - UINT32 RegSize;
> - UINT8 OpCode;
> - BOOLEAN SeenRex;
> - UINT64 *Reg;
> - UINT8 *Rip;
> - UINT64 Val;
> - UINT32 OpSize;
> - MODRM ModRm;
> - REX Rex;
> + UINT64 Status;
> + UINT32 MmioSize;
> + UINT32 RegSize;
> + UINT8 OpCode;
> + BOOLEAN SeenRex;
> + UINT64 *Reg;
> + UINT8 *Rip;
> + UINT64 Val;
> + UINT32 OpSize;
> + MODRM ModRm;
> + REX Rex;
> + TD_RETURN_DATA TdReturnData;
> + UINT8 Gpaw;
> + UINT64 TdSharedPageMask;
>
> Rip = (UINT8 *)Regs->Rip;
> Val = 0;
> Rex.Val = 0;
> SeenRex = FALSE;
>
> + Status = TdCall (TDCALL_TDINFO, 0, 0, 0, &TdReturnData);
> + if (Status == TDX_EXIT_REASON_SUCCESS) {
> + Gpaw = (UINT8)(TdReturnData.TdInfo.Gpaw & 0x3f);
> + TdSharedPageMask = 1ULL << (Gpaw - 1);
> + } else {
> + DEBUG ((DEBUG_ERROR, "TDCALL failed with status=%llx\n", Status));
> + return Status;
> + }
> +
> + if ((Veinfo->GuestPA & TdSharedPageMask) == 0) {
> + DEBUG ((DEBUG_ERROR, "EPT-violation #VE on private memory is not
> allowed!"));
> + TdVmCall (TDVMCALL_HALT, 0, 0, 0, 0, 0);
> + CpuDeadLoop ();
> + }
> +
> //
> // Default to 32bit transfer
> //
> --
> 2.29.2.windows.2
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-10-28 8:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-10-28 8:24 [PATCH V2 1/1] OvmfPkg/VmgExitLig: HALT on #VE when access to private memory Min Xu
2022-10-28 8:30 ` Yao, Jiewen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox