From: "Laszlo Ersek" <lersek@redhat.com>
To: devel@edk2.groups.io, thomas.lendacky@amd.com
Cc: Brijesh Singh <brijesh.singh@amd.com>,
Eric Dong <eric.dong@intel.com>, Ray Ni <ray.ni@intel.com>,
Rahul Kumar <rahul1.kumar@intel.com>,
Jordan Justen <jordan.l.justen@intel.com>,
Ard Biesheuvel <ard.biesheuvel@arm.com>
Subject: Re: [edk2-devel] [PATCH v2 10/11] UefiCpuPkg, OvmfPkg: Disable interrupts when using the GHCB
Date: Mon, 19 Oct 2020 23:07:06 +0200 [thread overview]
Message-ID: <b9128284-001c-26a7-b242-2631753ca23a@redhat.com> (raw)
In-Reply-To: <817ead39c5331b3b10055c32c36aa55fdbe2f8b1.1602864557.git.thomas.lendacky@amd.com>
On 10/16/20 18:09, Lendacky, Thomas wrote:
> From: Tom Lendacky <thomas.lendacky@amd.com>
>
> BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3008
>
> The QemuFlashPtrWrite() flash services runtime uses the GHCB and VmgExit()
> directly to perform the flash write when running as an SEV-ES guest. If an
> interrupt arrives between VmgInit() and VmgExit(), the Dr7 read in the
> interrupt handler will generate a #VC, which can overwrite information in
> the GHCB that QemuFlashPtrWrite() has set. This has been seen with the
> timer interrupt firing and the CpuExceptionHandlerLib library code,
> UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/
> Xcode5ExceptionHandlerAsm.nasm and
> ExceptionHandlerAsm.nasm
> reading the Dr7 register while QemuFlashPtrWrite() is using the GHCB. In
> general, it is necessary to protect the GHCB whenever it is used, not just
> in QemuFlashPtrWrite().
>
> Disable interrupts around the usage of the GHCB by modifying the VmgInit()
> and VmgDone() interfaces:
> - VmgInit() will take an extra parameter that is a pointer to a BOOLEAN
> that will hold the interrupt state at the time of invocation. VmgInit()
> will get and save this interrupt state before updating the GHCB.
> - VmgDone() will take an extra parameter that is used to indicate whether
> interrupts are to be (re)enabled. Before exiting, VmgDone() will enable
> interrupts if that is requested.
>
> Fixes: 437eb3f7a8db7681afe0e6064d3a8edb12abb766
> Cc: Eric Dong <eric.dong@intel.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Rahul Kumar <rahul1.kumar@intel.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
> Cc: Tom Lendacky <thomas.lendacky@amd.com>
> Cc: Brijesh Singh <brijesh.singh@amd.com>
> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
> ---
> UefiCpuPkg/Include/Library/VmgExitLib.h | 14 ++++++++---
> OvmfPkg/Library/VmgExitLib/VmgExitLib.c | 26 +++++++++++++++++---
> OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c | 5 ++--
> OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlashDxe.c | 5 ++--
> UefiCpuPkg/Library/MpInitLib/DxeMpLib.c | 5 ++--
> UefiCpuPkg/Library/MpInitLib/MpLib.c | 7 +++---
> UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.c | 18 ++++++++------
> 7 files changed, 55 insertions(+), 25 deletions(-)
>
> diff --git a/UefiCpuPkg/Include/Library/VmgExitLib.h b/UefiCpuPkg/Include/Library/VmgExitLib.h
> index ba5ea024839e..617b6cf8d2e7 100644
> --- a/UefiCpuPkg/Include/Library/VmgExitLib.h
> +++ b/UefiCpuPkg/Include/Library/VmgExitLib.h
> @@ -50,13 +50,16 @@ VmgExit (
> Performs the necessary steps in preparation for invoking VMGEXIT. Must be
> called before setting any fields within the GHCB.
>
> - @param[in, out] Ghcb A pointer to the GHCB
> + @param[in, out] Ghcb A pointer to the GHCB
> + @param[in, out] InterruptState A pointer to hold the current interrupt
> + state, used for restoring in VmgDone ()
>
> **/
> VOID
> EFIAPI
> VmgInit (
> - IN OUT GHCB *Ghcb
> + IN OUT GHCB *Ghcb,
> + IN OUT BOOLEAN *InterruptState
> );
>
> /**
> @@ -65,13 +68,16 @@ VmgInit (
> Performs the necessary steps to cleanup after invoking VMGEXIT. Must be
> called after obtaining needed fields within the GHCB.
>
> - @param[in, out] Ghcb A pointer to the GHCB
> + @param[in, out] Ghcb A pointer to the GHCB
> + @param[in] InterruptState An indicator to conditionally (re)enable
> + interrupts
>
> **/
> VOID
> EFIAPI
> VmgDone (
> - IN OUT GHCB *Ghcb
> + IN OUT GHCB *Ghcb,
> + IN BOOLEAN InterruptState
> );
>
> /**
> diff --git a/OvmfPkg/Library/VmgExitLib/VmgExitLib.c b/OvmfPkg/Library/VmgExitLib/VmgExitLib.c
> index ae86d850ba61..18b102df5f9a 100644
> --- a/OvmfPkg/Library/VmgExitLib/VmgExitLib.c
> +++ b/OvmfPkg/Library/VmgExitLib/VmgExitLib.c
> @@ -132,15 +132,27 @@ VmgExit (
> Performs the necessary steps in preparation for invoking VMGEXIT. Must be
> called before setting any fields within the GHCB.
>
> - @param[in, out] Ghcb A pointer to the GHCB
> + @param[in, out] Ghcb A pointer to the GHCB
> + @param[in, out] InterruptState A pointer to hold the current interrupt
> + state, used for restoring in VmgDone ()
>
> **/
> VOID
> EFIAPI
> VmgInit (
> - IN OUT GHCB *Ghcb
> + IN OUT GHCB *Ghcb,
> + IN OUT BOOLEAN *InterruptState
> )
> {
> + //
> + // Be sure that an interrupt can't cause a #VC while the GHCB is
> + // being used.
> + //
> + *InterruptState = GetInterruptState ();
> + if (*InterruptState) {
> + DisableInterrupts ();
> + }
> +
> SetMem (&Ghcb->SaveArea, sizeof (Ghcb->SaveArea), 0);
> }
>
> @@ -150,15 +162,21 @@ VmgInit (
> Performs the necessary steps to cleanup after invoking VMGEXIT. Must be
> called after obtaining needed fields within the GHCB.
>
> - @param[in, out] Ghcb A pointer to the GHCB
> + @param[in, out] Ghcb A pointer to the GHCB
> + @param[in] InterruptState An indicator to conditionally (re)enable
> + interrupts
>
> **/
> VOID
> EFIAPI
> VmgDone (
> - IN OUT GHCB *Ghcb
> + IN OUT GHCB *Ghcb,
> + IN BOOLEAN InterruptState
> )
> {
> + if (InterruptState) {
> + EnableInterrupts ();
> + }
> }
>
> /**
> diff --git a/OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c b/OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c
> index 9bf9d160179c..1671db3a01b1 100644
> --- a/OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c
> +++ b/OvmfPkg/Library/VmgExitLib/VmgExitVcHandler.c
> @@ -1568,6 +1568,7 @@ VmgExitHandleVc (
> SEV_ES_INSTRUCTION_DATA InstructionData;
> UINT64 ExitCode, Status;
> EFI_STATUS VcRet;
> + BOOLEAN InterruptState;
>
> VcRet = EFI_SUCCESS;
>
> @@ -1578,7 +1579,7 @@ VmgExitHandleVc (
> Regs = SystemContext.SystemContextX64;
> Ghcb = Msr.Ghcb;
>
> - VmgInit (Ghcb);
> + VmgInit (Ghcb, &InterruptState);
>
> ExitCode = Regs->ExceptionData;
> switch (ExitCode) {
> @@ -1662,7 +1663,7 @@ VmgExitHandleVc (
> VcRet = EFI_PROTOCOL_ERROR;
> }
>
> - VmgDone (Ghcb);
> + VmgDone (Ghcb, InterruptState);
>
> return VcRet;
> }
> diff --git a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlashDxe.c b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlashDxe.c
> index f9b21b54137d..1b0742967f71 100644
> --- a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlashDxe.c
> +++ b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlashDxe.c
> @@ -52,6 +52,7 @@ QemuFlashPtrWrite (
> if (MemEncryptSevEsIsEnabled ()) {
> MSR_SEV_ES_GHCB_REGISTER Msr;
> GHCB *Ghcb;
> + BOOLEAN InterruptState;
>
> Msr.GhcbPhysicalAddress = AsmReadMsr64 (MSR_SEV_ES_GHCB);
> Ghcb = Msr.Ghcb;
> @@ -63,12 +64,12 @@ QemuFlashPtrWrite (
> // #VC exception. Instead, use the the VMGEXIT MMIO write support directly
> // to perform the update.
> //
> - VmgInit (Ghcb);
> + VmgInit (Ghcb, &InterruptState);
> Ghcb->SharedBuffer[0] = Value;
> Ghcb->SaveArea.SwScratch = (UINT64) (UINTN) Ghcb->SharedBuffer;
> VmgSetOffsetValid (Ghcb, GhcbSwScratch);
> VmgExit (Ghcb, SVM_EXIT_MMIO_WRITE, (UINT64) (UINTN) Ptr, 1);
> - VmgDone (Ghcb);
> + VmgDone (Ghcb, InterruptState);
> } else {
> *Ptr = Value;
> }
> diff --git a/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c b/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c
> index 2c00d72ddefe..7839c249760e 100644
> --- a/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c
> +++ b/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c
> @@ -171,6 +171,7 @@ GetSevEsAPMemory (
> EFI_PHYSICAL_ADDRESS StartAddress;
> MSR_SEV_ES_GHCB_REGISTER Msr;
> GHCB *Ghcb;
> + BOOLEAN InterruptState;
>
> //
> // Allocate 1 page for AP jump table page
> @@ -192,9 +193,9 @@ GetSevEsAPMemory (
> Msr.GhcbPhysicalAddress = AsmReadMsr64 (MSR_SEV_ES_GHCB);
> Ghcb = Msr.Ghcb;
>
> - VmgInit (Ghcb);
> + VmgInit (Ghcb, &InterruptState);
> VmgExit (Ghcb, SVM_EXIT_AP_JUMP_TABLE, 0, (UINT64) (UINTN) StartAddress);
> - VmgDone (Ghcb);
> + VmgDone (Ghcb, InterruptState);
>
> return (UINTN) StartAddress;
> }
> diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpInitLib/MpLib.c
> index 07426274f639..4f4b26a7c196 100644
> --- a/UefiCpuPkg/Library/MpInitLib/MpLib.c
> +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c
> @@ -884,6 +884,7 @@ ApWakeupFunction (
> GHCB *Ghcb;
> UINT64 Status;
> BOOLEAN DoDecrement;
> + BOOLEAN InterruptState;
>
> DoDecrement = (BOOLEAN) (CpuMpData->InitFlag == ApInitConfig);
>
> @@ -891,7 +892,7 @@ ApWakeupFunction (
> Msr.GhcbPhysicalAddress = AsmReadMsr64 (MSR_SEV_ES_GHCB);
> Ghcb = Msr.Ghcb;
>
> - VmgInit (Ghcb);
> + VmgInit (Ghcb, &InterruptState);
>
> if (DoDecrement) {
> DoDecrement = FALSE;
> @@ -905,11 +906,11 @@ ApWakeupFunction (
>
> Status = VmgExit (Ghcb, SVM_EXIT_AP_RESET_HOLD, 0, 0);
> if ((Status == 0) && (Ghcb->SaveArea.SwExitInfo2 != 0)) {
> - VmgDone (Ghcb);
> + VmgDone (Ghcb, InterruptState);
> break;
> }
>
> - VmgDone (Ghcb);
> + VmgDone (Ghcb, InterruptState);
> }
>
> //
> diff --git a/UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.c b/UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.c
> index b000232c472e..24defd624c63 100644
> --- a/UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.c
> +++ b/UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.c
> @@ -57,15 +57,16 @@ VmgExit (
> Performs the necessary steps in preparation for invoking VMGEXIT. Must be
> called before setting any fields within the GHCB.
>
> - The base library function does nothing.
> -
> - @param[in, out] Ghcb A pointer to the GHCB
> + @param[in, out] Ghcb A pointer to the GHCB
> + @param[in, out] InterruptState A pointer to hold the current interrupt
> + state, used for restoring in VmgDone ()
>
> **/
> VOID
> EFIAPI
> VmgInit (
> - IN OUT GHCB *Ghcb
> + IN OUT GHCB *Ghcb,
> + IN OUT BOOLEAN *InterruptState
> )
> {
> }
> @@ -76,15 +77,16 @@ VmgInit (
> Performs the necessary steps to cleanup after invoking VMGEXIT. Must be
> called after obtaining needed fields within the GHCB.
>
> - The base library function does nothing.
> -
> - @param[in, out] Ghcb A pointer to the GHCB
> + @param[in, out] Ghcb A pointer to the GHCB
> + @param[in] InterruptState An indicator to conditionally (re)enable
> + interrupts
>
> **/
> VOID
> EFIAPI
> VmgDone (
> - IN OUT GHCB *Ghcb
> + IN OUT GHCB *Ghcb,
> + IN BOOLEAN InterruptState
> )
> {
> }
>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
next prev parent reply other threads:[~2020-10-19 21:07 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-16 16:09 [PATCH v2 00/11] SEV-ES guest support fixes and cleanup Lendacky, Thomas
2020-10-16 16:09 ` [PATCH v2 01/11] MdePkg, OvmfPkg: Clean up GHCB field offsets and save area Lendacky, Thomas
2020-10-19 1:41 ` 回复: " gaoliming
2020-10-19 12:50 ` Lendacky, Thomas
2020-10-19 20:17 ` Laszlo Ersek
2020-10-19 20:48 ` Lendacky, Thomas
2020-10-19 20:42 ` Laszlo Ersek
2020-10-20 1:08 ` 回复: " gaoliming
2020-10-20 8:31 ` Laszlo Ersek
2020-10-20 13:10 ` Lendacky, Thomas
2020-10-21 0:54 ` 回复: " gaoliming
2020-10-21 21:54 ` Lendacky, Thomas
2020-10-22 1:25 ` 回复: [edk2-devel] " gaoliming
2020-10-22 13:12 ` Laszlo Ersek
2020-10-23 2:57 ` 回复: " gaoliming
2020-10-26 16:34 ` Lendacky, Thomas
2020-10-27 7:57 ` Dong, Eric
2020-10-28 17:42 ` Lendacky, Thomas
2020-10-21 12:29 ` Laszlo Ersek
2020-10-16 16:09 ` [PATCH v2 02/11] UefiCpuPkg/VmgExitLib: Add interfaces to set/read GHCB ValidBitmap bits Lendacky, Thomas
2020-10-19 20:46 ` [edk2-devel] " Laszlo Ersek
2020-10-16 16:09 ` [PATCH v2 03/11] OvmfPkg/VmgExitLib: Implement new VmgExitLib interfaces Lendacky, Thomas
2020-10-19 20:51 ` [edk2-devel] " Laszlo Ersek
2020-10-16 16:09 ` [PATCH v2 04/11] OvmfPkg/VmgExitLib: Set the SW exit fields when performing VMGEXIT Lendacky, Thomas
2020-10-19 20:53 ` [edk2-devel] " Laszlo Ersek
2020-10-16 16:09 ` [PATCH v2 05/11] OvmfPkg/VmgExitLib: Set the SwScratch valid bit for IOIO events Lendacky, Thomas
2020-10-19 20:54 ` [edk2-devel] " Laszlo Ersek
2020-10-16 16:09 ` [PATCH v2 06/11] OvmfPkg/VmgExitLib: Set the SwScratch valid bit for MMIO events Lendacky, Thomas
2020-10-16 16:09 ` [PATCH v2 07/11] UefiCpuPkg/MpInitLib: Set the SW exit fields when performing VMGEXIT Lendacky, Thomas
2020-10-16 16:09 ` [PATCH v2 08/11] OvmfPkg/QemuFlashFvbServicesRuntimeDxe: Set the SwScratch valid bit Lendacky, Thomas
2020-10-19 20:57 ` [edk2-devel] " Laszlo Ersek
2020-10-16 16:09 ` [PATCH v2 09/11] OvmfPkg/QemuFlashFvbServicesRuntimeDxe: Fix erase blocks for SEV-ES Lendacky, Thomas
2020-10-16 16:09 ` [PATCH v2 10/11] UefiCpuPkg, OvmfPkg: Disable interrupts when using the GHCB Lendacky, Thomas
2020-10-19 21:07 ` Laszlo Ersek [this message]
2020-10-16 16:09 ` [PATCH v2 11/11] UefiCpuPkg/MpInitLib: For SEV-ES guest, set stack based on processor number Lendacky, Thomas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b9128284-001c-26a7-b242-2631753ca23a@redhat.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox