From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM04-BN3-obe.outbound.protection.outlook.com (NAM04-BN3-obe.outbound.protection.outlook.com [40.107.68.83]) by mx.groups.io with SMTP id smtpd.web12.1872.1576183179868888156 for ; Thu, 12 Dec 2019 12:39:40 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@amdcloud.onmicrosoft.com header.s=selector2-amdcloud-onmicrosoft-com header.b=GUlBI6li; spf=none, err=SPF record not found (domain: amd.com, ip: 40.107.68.83, mailfrom: thomas.lendacky@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=oIT4921saMJID9LAsTJH0uKGu+J12fLr2onaW6AFhtAy+CZe0PGe/pmXqnguEo7nsRvJQqOlf0y/ccwdTPJWcFS8JCTQxnfKwlCmQdNyxCPSdR8uMc4EX9vgT9oqUo1q+LUa5K4bZbuUDMRtPJrGj2v/tv5gOJvK7rysxTS7M7jYT4g5o87V07dHMbn9bM1VC7LAd5zkRaqAtaA4Qbo18VI5+qQF422swrrgg8Q3cP17WkksY9f7KgWH27uH1U/U1+I9WDCY2eNWqrD/r/uOTyQfgu9Y9wFPI35BfgHzxIIRt7XCRWmsMzu0UGCLipdMrQz3qCoiVooaxITNHhwcOA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=k1KylgXB90pe3kZGVj31nv7kY3aJ9eKvZlVmFjfUgS4=; b=n2ESbVq57V3FfQ+D49pLPtPmo1pvZD6hfDTbtKnJoiHnzoqlaiPrWnhl49clTOMnrf13XzQ5wE9wn5dSY3Oyy1f8dxT5R37FU6iM+bDu6qDAMeX6pIrMR0In8qwpIRuyWEns3rT2wySGIowYxuI3Y704cmCBOuRrmrKCZ7DffFzLnE7qjFqDau1lE+B+w4G8aA4hQ2UER4NtxPyXGUUaCd9Fp4rH8HFcomwvVXvb57MgBfioF9VbcYpJCNsNmO/G+M/o5AO3etLdbcfbygsOzSM5LxasP31h5JAJzIa8Xvr/4HH0TLubOfBkI6Cjx3MFzIUXbLQGhBaMMYkvdWLUWg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector2-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=k1KylgXB90pe3kZGVj31nv7kY3aJ9eKvZlVmFjfUgS4=; b=GUlBI6lixMrXPVjaVsn0wHlcMIJLUa9d0HkPoywKa9IVRDhBEtYsuywc6EnCoxH0+qJvJ0Pb0LCxmyhcaTyNOPV+2pleNJeCKLcFb8bpv49ougLUa8LYDuS//WVsfTnEIh85VeWWvygUHsNzzibSX/HC0FQxdhryNB6sHwVm9Kc= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Lendacky@amd.com; Received: from DM6PR12MB3163.namprd12.prod.outlook.com (20.179.71.154) by DM6PR12MB2732.namprd12.prod.outlook.com (20.176.116.26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2516.14; Thu, 12 Dec 2019 20:39:38 +0000 Received: from DM6PR12MB3163.namprd12.prod.outlook.com ([fe80::c16f:b437:4266:dbc1]) by DM6PR12MB3163.namprd12.prod.outlook.com ([fe80::c16f:b437:4266:dbc1%4]) with mapi id 15.20.2516.020; Thu, 12 Dec 2019 20:39:38 +0000 Subject: Re: [RFC PATCH v3 22/43] UefiCpuPkg/CpuExceptionHandler: Add support for DR7 Read/Write NAE events To: "Ni, Ray" , "devel@edk2.groups.io" Cc: "Justen, Jordan L" , Laszlo Ersek , Ard Biesheuvel , "Kinney, Michael D" , "Gao, Liming" , "Dong, Eric" , Brijesh Singh References: <734D49CCEBEEF84792F5B80ED585239D5C399A29@SHSMSX104.ccr.corp.intel.com> From: "Lendacky, Thomas" Message-ID: Date: Thu, 12 Dec 2019 14:39:36 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.2.2 In-Reply-To: <734D49CCEBEEF84792F5B80ED585239D5C399A29@SHSMSX104.ccr.corp.intel.com> X-ClientProxiedBy: SN6PR08CA0014.namprd08.prod.outlook.com (2603:10b6:805:66::27) To DM6PR12MB3163.namprd12.prod.outlook.com (2603:10b6:5:15e::26) Return-Path: thomas.lendacky@amd.com MIME-Version: 1.0 X-Originating-IP: [165.204.77.1] X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: c79907c5-167d-4aa0-9c58-08d77f4367e5 X-MS-TrafficTypeDiagnostic: DM6PR12MB2732:|DM6PR12MB2732: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7691; X-Forefront-PRVS: 0249EFCB0B X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4636009)(376002)(136003)(396003)(346002)(39850400004)(366004)(199004)(189003)(13464003)(186003)(478600001)(966005)(53546011)(2616005)(26005)(6512007)(81156014)(316002)(4326008)(8936002)(81166006)(19627235002)(36756003)(6506007)(8676002)(2906002)(110136005)(45080400002)(6486002)(52116002)(66946007)(5660300002)(54906003)(86362001)(31696002)(31686004)(66556008)(66476007);DIR:OUT;SFP:1101;SCL:1;SRVR:DM6PR12MB2732;H:DM6PR12MB3163.namprd12.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1; Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 5q45FtwD5SuMWFo/k0mHpcA8qdyCsPAzDWImifjLqJeSG6sFW4n2y+Qeywpg2uIlIhe9vY76Y2rf1klNhgerpKFC/ugIrLbJLU7ABcksG/pjkVRTolOmMu6a4SSr/K5XGopum7uE+x+kYm05up3vYgIqLz3y/2QwgxzNV8WbTe+1YPwg8ACHZSHjdsDQZhboXBvsDMDD9mvpzR1NyXlIgGTIorSzPKdZZ4z+TOwrxQ/J7dPXHxdghJl5QSrndgoU35sf7U3/h82Lq4ljf1usJNI3wW2Ywsq53iECFs9plzb8/mcubwGoH55rGvOlbXxIDaRDvUD7zn2sh183u5kkRO7DnVuUm4YDe+bPP1K/ywpDvvltRIL8gCpT9iYS/9pDvXxOKE74Nyd3cfrQvn3NgJWMDQW4//N8WnVki4RVIPsUXo9UM47sq0f2OZdFfo+3Q5WvVsi+2ruNNqoSbJypfIuRcqcuhpwMlqiynBSefsZ9RJbR0js8H2MneEThJ6OATc4OwKgILIGF9bZ4a+yTk8oeB5T769e+EZaIQpU7Nz4= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: c79907c5-167d-4aa0-9c58-08d77f4367e5 X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Dec 2019 20:39:38.1510 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: x54LfnFjAP06PGSN/60+uThY313LSCMxdkEG9a7YZ7DhCTicb32khXVZjKfTV5hFAJpeuLsnRH06lB9XnJ6C4w== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB2732 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit On 12/12/19 12:53 AM, Ni, Ray wrote: > Tom, > Why all DR registers are not pushed to stack in VC handler? > I thought only DR7 pushing is skipped. It was probably just to be on the safe side in case the hypervisor didn't remove the intercept for them. And since none of the other debug registers are used by the #VC handler and their values aren't restored on exit, I just decided not to push them. But I can push them if you think it best. Thanks, Tom > > Thanks, > Ray > >> -----Original Message----- >> From: Tom Lendacky >> Sent: Thursday, November 21, 2019 4:07 AM >> To: devel@edk2.groups.io >> Cc: Justen, Jordan L ; Laszlo Ersek ; Ard Biesheuvel >> ; Kinney, Michael D ; Gao, Liming ; Dong, >> Eric ; Ni, Ray ; Brijesh Singh >> Subject: [RFC PATCH v3 22/43] UefiCpuPkg/CpuExceptionHandler: Add support for DR7 Read/Write NAE events >> >> BZ: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2198&data=02%7C01%7Cthomas.lendacky%40amd.com%7C6858e5b903674581483b08d77ed0123b%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637117304434355086&sdata=jRdTglBwajIycWATDilfbyC%2BrvPOTFCUl0MqhhuE5nA%3D&reserved=0 >> >> Under SEV-ES, a DR7 read or write intercept generates a #VC exception. >> The #VC handler must provide special support to the guest for this. On >> a DR7 write, the #VC handler must cache the value and issue a VMGEXIT >> to notify the hypervisor of the write. However, the #VC handler must >> not actually set the value of the DR7 register. On a DR7 read, the #VC >> handler must return the cached value of the DR7 register to the guest. >> VMGEXIT is not invoked for a DR7 register read. >> >> To avoid exception recursion, a #VC exception will not try to read and >> push the actual debug registers into the EFI_SYSTEM_CONTEXT_X64 struct >> and instead push zeroes. The #VC exception handler does not make use of >> the debug registers from saved context. >> >> Cc: Eric Dong >> Cc: Ray Ni >> Cc: Laszlo Ersek >> Signed-off-by: Tom Lendacky >> --- >> .../X64/AMDSevVcCommon.c | 68 +++++++++++++++++++ >> .../X64/ExceptionHandlerAsm.nasm | 15 ++++ >> 2 files changed, 83 insertions(+) >> >> diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/AMDSevVcCommon.c >> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/AMDSevVcCommon.c >> index 1d7c34e7e442..22393f72d795 100644 >> --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/AMDSevVcCommon.c >> +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/AMDSevVcCommon.c >> @@ -13,6 +13,12 @@ >> >> #define CR4_OSXSAVE (1 << 18) >> >> +#define DR7_RESET_VALUE 0x400 >> +typedef struct { >> + BOOLEAN Dr7Cached; >> + UINT64 Dr7; >> +} SEV_ES_PER_CPU_DATA; >> + >> typedef enum { >> LongMode64Bit = 0, >> LongModeCompat32Bit, >> @@ -1081,6 +1087,60 @@ RdtscExit ( >> return 0; >> } >> >> +STATIC >> +UINTN >> +Dr7WriteExit ( >> + GHCB *Ghcb, >> + EFI_SYSTEM_CONTEXT_X64 *Regs, >> + SEV_ES_INSTRUCTION_DATA *InstructionData >> + ) >> +{ >> + SEV_ES_INSTRUCTION_OPCODE_EXT *Ext = &InstructionData->Ext; >> + SEV_ES_PER_CPU_DATA *SevEsData = (SEV_ES_PER_CPU_DATA *) (Ghcb + 1); >> + INTN *Register; >> + UINTN Status; >> + >> + DecodeModRm (Regs, InstructionData); >> + >> + /* MOV DRn always treats MOD == 3 no matter how encoded */ >> + Register = GetRegisterPointer (Regs, Ext->ModRm.Rm); >> + >> + /* Using a value of 0 for ExitInfo1 means RAX holds the value */ >> + Ghcb->SaveArea.Rax = *Register; >> + GhcbSetRegValid (Ghcb, GhcbRax); >> + >> + Status = VmgExit (Ghcb, SvmExitDr7Write, 0, 0); >> + if (Status) { >> + return Status; >> + } >> + >> + SevEsData->Dr7 = *Register; >> + SevEsData->Dr7Cached = TRUE; >> + >> + return 0; >> +} >> + >> +STATIC >> +UINTN >> +Dr7ReadExit ( >> + GHCB *Ghcb, >> + EFI_SYSTEM_CONTEXT_X64 *Regs, >> + SEV_ES_INSTRUCTION_DATA *InstructionData >> + ) >> +{ >> + SEV_ES_INSTRUCTION_OPCODE_EXT *Ext = &InstructionData->Ext; >> + SEV_ES_PER_CPU_DATA *SevEsData = (SEV_ES_PER_CPU_DATA *) (Ghcb + 1); >> + INTN *Register; >> + >> + DecodeModRm (Regs, InstructionData); >> + >> + /* MOV DRn always treats MOD == 3 no matter how encoded */ >> + Register = GetRegisterPointer (Regs, Ext->ModRm.Rm); >> + *Register = (SevEsData->Dr7Cached) ? SevEsData->Dr7 : DR7_RESET_VALUE; >> + >> + return 0; >> +} >> + >> UINTN >> DoVcCommon ( >> GHCB *Ghcb, >> @@ -1097,6 +1157,14 @@ DoVcCommon ( >> >> ExitCode = Regs->ExceptionData; >> switch (ExitCode) { >> + case SvmExitDr7Read: >> + NaeExit = Dr7ReadExit; >> + break; >> + >> + case SvmExitDr7Write: >> + NaeExit = Dr7WriteExit; >> + break; >> + >> case SvmExitRdtsc: >> NaeExit = RdtscExit; >> break; >> diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/ExceptionHandlerAsm.nasm >> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/ExceptionHandlerAsm.nasm >> index 19198f273137..a0549f7ae6bd 100644 >> --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/ExceptionHandlerAsm.nasm >> +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/ExceptionHandlerAsm.nasm >> @@ -225,6 +225,9 @@ HasErrorCode: >> push rax >> >> ;; UINT64 Dr0, Dr1, Dr2, Dr3, Dr6, Dr7; >> + cmp qword [rbp + 8], 29 >> + je VcDebugRegs ; For SEV-ES (#VC) Debug registers ignored >> + >> mov rax, dr7 >> push rax >> mov rax, dr6 >> @@ -237,7 +240,19 @@ HasErrorCode: >> push rax >> mov rax, dr0 >> push rax >> + jmp DrFinish >> >> +VcDebugRegs: >> +;; UINT64 Dr0, Dr1, Dr2, Dr3, Dr6, Dr7 are skipped for #VC to avoid exception recursion >> + xor rax, rax >> + push rax >> + push rax >> + push rax >> + push rax >> + push rax >> + push rax >> + >> +DrFinish: >> ;; FX_SAVE_STATE_X64 FxSaveState; >> sub rsp, 512 >> mov rdi, rsp >> -- >> 2.17.1 >