From: "Lendacky, Thomas" <thomas.lendacky@amd.com>
To: devel@edk2.groups.io
Cc: Jordan Justen <jordan.l.justen@intel.com>,
Laszlo Ersek <lersek@redhat.com>,
Ard Biesheuvel <ard.biesheuvel@linaro.org>,
Michael D Kinney <michael.d.kinney@intel.com>,
Liming Gao <liming.gao@intel.com>,
Eric Dong <eric.dong@intel.com>, Ray Ni <ray.ni@intel.com>,
Brijesh Singh <brijesh.singh@amd.com>
Subject: [PATCH v7 31/43] OvmfPkg/PlatformPei: Move early GDT into ram when SEV-ES is enabled
Date: Wed, 22 Apr 2020 12:41:46 -0500 [thread overview]
Message-ID: <d9fd64868eac2fadcf39f82c32739e55245fea2e.1587577317.git.thomas.lendacky@amd.com> (raw)
In-Reply-To: <cover.1587577317.git.thomas.lendacky@amd.com>
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2198
The SEV support will clear the C-bit from non-RAM areas. The early GDT
lives in a non-RAM area, so when an exception occurs (like a #VC) the GDT
will be read as un-encrypted even though it is encrypted. This will result
in a failure to be able to handle the exception.
Move the GDT into RAM so it can be accessed without error when running as
an SEV-ES guest.
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
---
OvmfPkg/PlatformPei/AmdSev.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c
index 4fd4534cabea..a2b38c591236 100644
--- a/OvmfPkg/PlatformPei/AmdSev.c
+++ b/OvmfPkg/PlatformPei/AmdSev.c
@@ -39,6 +39,8 @@ AmdSevEsInitialize (
PHYSICAL_ADDRESS GhcbBasePa;
UINTN GhcbPageCount, PageCount;
RETURN_STATUS PcdStatus, DecryptStatus;
+ IA32_DESCRIPTOR Gdtr;
+ VOID *Gdt;
if (!MemEncryptSevEsIsEnabled ()) {
return;
@@ -83,6 +85,22 @@ AmdSevEsInitialize (
(UINT64)GhcbPageCount, GhcbBase));
AsmWriteMsr64 (MSR_SEV_ES_GHCB, GhcbBasePa);
+
+ //
+ // The SEV support will clear the C-bit from non-RAM areas. The early GDT
+ // lives in a non-RAM area, so when an exception occurs (like a #VC) the GDT
+ // will be read as un-encrypted even though it was created before the C-bit
+ // was cleared (encrypted). This will result in a failure to be able to
+ // handle the exception.
+ //
+ AsmReadGdtr (&Gdtr);
+
+ Gdt = AllocatePages (EFI_SIZE_TO_PAGES ((UINTN) Gdtr.Limit + 1));
+ ASSERT (Gdt != NULL);
+
+ CopyMem (Gdt, (VOID *) Gdtr.Base, Gdtr.Limit + 1);
+ Gdtr.Base = (UINTN) Gdt;
+ AsmWriteGdtr (&Gdtr);
}
/**
--
2.17.1
next prev parent reply other threads:[~2020-04-22 17:43 UTC|newest]
Thread overview: 81+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-22 17:41 [PATCH v7 00/43] SEV-ES guest support Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 01/43] MdeModulePkg: Create PCDs to be used in support of SEV-ES Lendacky, Thomas
2020-05-02 8:19 ` [edk2-devel] " Dong, Eric
2020-05-04 13:34 ` Lendacky, Thomas
2020-05-04 13:47 ` Dong, Eric
2020-05-04 16:41 ` Lendacky, Thomas
2020-05-05 15:29 ` Laszlo Ersek
2020-05-06 1:53 ` Dong, Eric
2020-05-06 13:19 ` Lendacky, Thomas
2020-05-06 15:06 ` Dong, Eric
2020-05-06 18:33 ` Lendacky, Thomas
2020-05-07 2:28 ` Dong, Eric
2020-05-07 2:38 ` Dong, Eric
2020-05-08 18:58 ` Lendacky, Thomas
2020-05-06 16:24 ` Laszlo Ersek
2020-04-22 17:41 ` [PATCH v7 02/43] UefiCpuPkg: Create PCD " Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 03/43] MdePkg: Add the MSR definition for the GHCB register Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 04/43] MdePkg: Add a structure definition for the GHCB Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 05/43] MdeModulePkg/DxeIplPeim: Support GHCB pages when creating page tables Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 06/43] MdePkg/BaseLib: Add support for the XGETBV instruction Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 07/43] MdePkg/BaseLib: Add support for the VMGEXIT instruction Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 08/43] UefiCpuPkg: Implement library support for VMGEXIT Lendacky, Thomas
2020-05-09 1:06 ` Dong, Eric
2020-05-09 14:08 ` Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 09/43] OvmfPkg: Prepare OvmfPkg to use the VmgExitLib library Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 10/43] UefiPayloadPkg: Prepare UefiPayloadPkg " Lendacky, Thomas
2020-04-22 17:46 ` [edk2-devel] " Guo Dong
2020-04-22 17:41 ` [PATCH v7 11/43] UefiCpuPkg/CpuExceptionHandler: Add base support for the #VC exception Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 12/43] UefiCpuPkg/CpuExceptionHandler: Add support for IOIO_PROT NAE events Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 13/43] UefiCpuPkg/CpuExceptionHandler: Support string IO " Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 14/43] UefiCpuPkg/CpuExceptionHandler: Add support for CPUID " Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 15/43] UefiCpuPkg/CpuExceptionHandler: Add support for MSR_PROT " Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 16/43] UefiCpuPkg/CpuExceptionHandler: Add support for NPF NAE events (MMIO) Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 17/43] UefiCpuPkg/CpuExceptionHandler: Add support for WBINVD NAE events Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 18/43] UefiCpuPkg/CpuExceptionHandler: Add support for RDTSC " Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 19/43] UefiCpuPkg/CpuExceptionHandler: Add support for RDPMC " Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 20/43] UefiCpuPkg/CpuExceptionHandler: Add support for INVD " Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 21/43] UefiCpuPkg/CpuExceptionHandler: Add support for VMMCALL " Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 22/43] UefiCpuPkg/CpuExceptionHandler: Add support for RDTSCP " Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 23/43] UefiCpuPkg/CpuExceptionHandler: Add support for MONITOR/MONITORX " Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 24/43] UefiCpuPkg/CpuExceptionHandler: Add support for MWAIT/MWAITX " Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 25/43] UefiCpuPkg/CpuExceptionHandler: Add support for DR7 Read/Write " Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 26/43] OvmfPkg/MemEncryptSevLib: Add an SEV-ES guest indicator function Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 27/43] OvmfPkg: Add support to perform SEV-ES initialization Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 28/43] OvmfPkg: Create a GHCB page for use during Sec phase Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 29/43] OvmfPkg/PlatformPei: Reserve GHCB-related areas if S3 is supported Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 30/43] OvmfPkg: Create GHCB pages for use during Pei and Dxe phase Lendacky, Thomas
2020-04-22 17:41 ` Lendacky, Thomas [this message]
2020-04-22 17:41 ` [PATCH v7 32/43] UefiCpuPkg: Create an SEV-ES workarea PCD Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 33/43] OvmfPkg: Reserve a page in memory for the SEV-ES usage Lendacky, Thomas
2020-04-30 18:58 ` [edk2-devel] " Laszlo Ersek
2020-04-30 21:12 ` Lendacky, Thomas
2020-04-30 22:09 ` Lendacky, Thomas
2020-05-05 15:25 ` Laszlo Ersek
2020-05-05 15:15 ` Laszlo Ersek
2020-04-22 17:41 ` [PATCH v7 34/43] OvmfPkg/ResetVector: Add support for a 32-bit SEV check Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 35/43] OvmfPkg/Sec: Add #VC exception handling for Sec phase Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 36/43] OvmfPkg/Sec: Enable cache early to speed up booting Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 37/43] OvmfPkg/QemuFlashFvbServicesRuntimeDxe: Bypass flash detection with SEV-ES is enabled Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 38/43] UefiCpuPkg: Add a 16-bit protected mode code segment descriptor Lendacky, Thomas
2020-04-22 17:41 ` [PATCH v7 39/43] UefiCpuPkg/MpInitLib: Add CPU MP data flag to indicate if SEV-ES is enabled Lendacky, Thomas
2020-04-23 4:33 ` [PATCH v7 40/43] UefiCpuPkg: Allow AP booting under SEV-ES Lendacky, Thomas
2020-04-23 4:33 ` [PATCH v7 41/43] OvmfPkg: Use the SEV-ES work area for the SEV-ES AP reset vector Lendacky, Thomas
2020-04-23 4:33 ` [PATCH v7 42/43] OvmfPkg: Move the GHCB allocations into reserved memory Lendacky, Thomas
2020-04-23 4:33 ` [PATCH v7 43/43] UefiCpuPkg/MpInitLib: Prepare SEV-ES guest APs for OS use Lendacky, Thomas
2020-05-08 19:16 ` [PATCH v7 00/43] SEV-ES guest support Lendacky, Thomas
2020-05-09 6:44 ` Ni, Ray
2020-05-09 14:34 ` Lendacky, Thomas
2020-05-09 19:09 ` [edk2-devel] " Andrew Fish
2020-05-11 5:24 ` Ni, Ray
2020-05-12 14:59 ` Lendacky, Thomas
2020-05-14 13:10 ` Ni, Ray
2020-05-14 17:59 ` Lendacky, Thomas
2020-05-15 5:47 ` Ni, Ray
2020-05-15 14:30 ` Lendacky, Thomas
2020-05-18 20:44 ` Brian J. Johnson
2020-05-20 1:57 ` 回复: " Fan Jeff
2020-05-12 16:49 ` Lendacky, Thomas
2020-05-12 17:44 ` Lendacky, Thomas
2020-05-12 20:10 ` Lendacky, Thomas
2020-05-11 15:37 ` Laszlo Ersek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d9fd64868eac2fadcf39f82c32739e55245fea2e.1587577317.git.thomas.lendacky@amd.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox