Re: [edk2-devel] [PATCH v8 15/46] OvmfPkg/VmgExitLib: Add support for CPUID NAE events

["Lendacky, Thomas" <thomas.lendacky@amd.com>]

On 5/22/20 5:27 AM, Laszlo Ersek wrote:
> On 05/19/20 23:50, Lendacky, Thomas wrote:
>> BZ: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2198&data=02%7C01%7Cthomas.lendacky%40amd.com%7C34f8c61055564e148e1408d7fe3ab37f%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637257400397998277&sdata=96rpbKClaJMRK86jpyryqNPdUVsPDqMBOFgSuO9j%2BzA%3D&reserved=0
>>
>> Under SEV-ES, a CPUID intercept generates a #VC exception. VMGEXIT must be
>> used to allow the hypervisor to handle this intercept.
>>
>> Add support to construct the required GHCB values to support a CPUID NAE
>> event. Additionally, CPUID 0x0000_000d requires XCR0 to be supplied in
>> the GHCB, so add support to issue the XGETBV instruction.
>>
>> Cc: Jordan Justen <jordan.l.justen@intel.com>
>> Cc: Laszlo Ersek <lersek@redhat.com>
>> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
>> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
>> ---
>>   .../Library/VmgExitLib/X64/VmgExitVcHandler.c | 58 +++++++++++++++++++
>>   1 file changed, 58 insertions(+)
>>
>> diff --git a/OvmfPkg/Library/VmgExitLib/X64/VmgExitVcHandler.c b/OvmfPkg/Library/VmgExitLib/X64/VmgExitVcHandler.c
>> index 906b32e93d53..2f62795edf61 100644
>> --- a/OvmfPkg/Library/VmgExitLib/X64/VmgExitVcHandler.c
>> +++ b/OvmfPkg/Library/VmgExitLib/X64/VmgExitVcHandler.c
>> @@ -12,6 +12,8 @@
>>   #include <Library/VmgExitLib.h>
>>   #include <Register/Amd/Msr.h>
>>   
>> +#define CR4_OSXSAVE (1 << 18)
>> +
> 
> (1) Please drop this macro, and:

Done.

> 
>>   //
>>   // Instruction execution mode definition
>>   //
>> @@ -637,6 +639,58 @@ IoioExit (
>>     return 0;
>>   }
>>   
>> +/**
>> +  Handle a CPUID event.
>> +
>> +  Use the VMGEXIT instruction to handle a CPUID event.
>> +
>> +  @param[in, out] Ghcb             Pointer to the Guest-Hypervisor Communication
>> +                                   Block
>> +  @param[in, out] Regs             x64 processor context
>> +  @param[in]      InstructionData  Instruction parsing context
>> +
>> +  @retval 0                        Event handled successfully
>> +  @retval Others                   New exception value to propagate
>> +
>> +**/
>> +STATIC
>> +UINT64
>> +CpuidExit (
>> +  IN OUT GHCB                     *Ghcb,
>> +  IN OUT EFI_SYSTEM_CONTEXT_X64   *Regs,
>> +  IN     SEV_ES_INSTRUCTION_DATA  *InstructionData
>> +  )
>> +{
>> +  UINT64  Status;
>> +
>> +  Ghcb->SaveArea.Rax = Regs->Rax;
>> +  GhcbSetRegValid (Ghcb, GhcbRax);
>> +  Ghcb->SaveArea.Rcx = Regs->Rcx;
>> +  GhcbSetRegValid (Ghcb, GhcbRcx);
>> +  if (Regs->Rax == 0x0000000d) {
> 
> (2a) Can we use CPUID_EXTENDED_STATE here, from <Register/Intel/Cpuid.h>?

Yup.

> 
> (2b) If so, I'd suggest updating the commit message too: replace "CPUID
> 0x0000_000d" with "CPUID 0x0000_000d (CPUID_EXTENDED_STATE)".

Will do.

> 
>> +    Ghcb->SaveArea.XCr0 = (AsmReadCr4 () & CR4_OSXSAVE) ? AsmXGetBv (0) : 1;
> 
> (3) Here, please use the IA32_CR4 type from <Library/BaseLib.h>:
> 
>      IA32_CR4 Cr4;
> 
>      Cr4.UintN = AsmReadCr4 ();
>      Ghcb->SaveArea.XCr0 = (Cr4.Bits.OSXSAVE == 1) ? AsmXGetBv (0) : 1;

Will do.

> 
> 
> Some of the style requests I made under earlier patches in this series
> apply here, so I won't spell them out again.
> 
> 
> With the style updated:
> 
> Acked-by: Laszlo Ersek <lersek@redhat.com>

Thanks!
Tom

> 
> Thanks
> Laszlo
> 
>> +    GhcbSetRegValid (Ghcb, GhcbXCr0);
>> +  }
>> +
>> +  Status = VmgExit (Ghcb, SVM_EXIT_CPUID, 0, 0);
>> +  if (Status) {
>> +    return Status;
>> +  }
>> +
>> +  if (!GhcbIsRegValid (Ghcb, GhcbRax) ||
>> +      !GhcbIsRegValid (Ghcb, GhcbRbx) ||
>> +      !GhcbIsRegValid (Ghcb, GhcbRcx) ||
>> +      !GhcbIsRegValid (Ghcb, GhcbRdx)) {
>> +    return UnsupportedExit (Ghcb, Regs, InstructionData);
>> +  }
>> +  Regs->Rax = Ghcb->SaveArea.Rax;
>> +  Regs->Rbx = Ghcb->SaveArea.Rbx;
>> +  Regs->Rcx = Ghcb->SaveArea.Rcx;
>> +  Regs->Rdx = Ghcb->SaveArea.Rdx;
>> +
>> +  return 0;
>> +}
>> +
>>   /**
>>     Handle a #VC exception.
>>   
>> @@ -681,6 +735,10 @@ VmgExitHandleVc (
>>   
>>     ExitCode = Regs->ExceptionData;
>>     switch (ExitCode) {
>> +  case SVM_EXIT_CPUID:
>> +    NaeExit = CpuidExit;
>> +    break;
>> +
>>     case SVM_EXIT_IOIO_PROT:
>>       NaeExit = IoioExit;
>>       break;
>>
>