From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f201.google.com (mail-pf1-f201.google.com [209.85.210.201]) by mx.groups.io with SMTP id smtpd.web10.6045.1670543095069963485 for ; Thu, 08 Dec 2022 15:44:55 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@google.com header.s=20210112 header.b=Ir/AQR2l; spf=pass (domain: flex--acdunlap.bounces.google.com, ip: 209.85.210.201, mailfrom: 39nasywgkbvetvwd64t8z77z4x.v75wxex4xw3l.za7d8b.17@flex--acdunlap.bounces.google.com) Received: by mail-pf1-f201.google.com with SMTP id b13-20020a056a000a8d00b0057348c50123so2086248pfl.18 for ; Thu, 08 Dec 2022 15:44:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=DV72o7xXk3UP8JdJ266vbGvECNESClWmfLT2QscWxhw=; b=Ir/AQR2lYbrleJW9oupo0OTFVlS410A8tOVVztwKcMt+Umzmj729JYT8grYAlXjVnl n2pBcc1C7zet0oNsSyhIaG5r6wQIIl2Sx8IWVKOJhHMPq7BMX6AVakb5+DjXiKJXsARB 8yrUPzQtCjplCETjmdW4Q6+IzzL63Kod5y75KtSAlB8KNXLdIsukDzJIbV32Ze4mHqpi qu6E47zJFbhsiwALj1vYtIVuzrQ5u2tS6qNtDDp7vojaK4T0lEslw/5Eg+u0gYApPAn2 Tgz67871aZxPdDxkYDO6QS8yIKNK3SJ6jYbj0DHdj+vojb43h96mUB3uLlZtLMJbR/Vc +IQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=DV72o7xXk3UP8JdJ266vbGvECNESClWmfLT2QscWxhw=; b=pQa9AglZ1CVxUvfE3hu4ZUMjRpXW1roHRj4fGDu/f9X9AYOcMVpXNo5CZHsP+I77AY vel4y2Z+lfjxRzFQslKLMCIncJzzoKF4YBp/jOiQqC9TIs+Uke1synjFwTczIYv0L/LT V3h1BkYZ4piEilgvr3/D4RzYtA0QAV9cMOf8xE/O3SXvEOtku9+ANVnNizBVTv5ep7V3 jTb/T3GIqA/g/GSKh+79dy/3y6qz8d8xYOFEFnKzMVrdaOFFM6dMI10xhpwH8el0Wk6J 9V64741aocDB32O+OJ0qjSu8ZUvVARUpsqU2cVndNR/oLlhnVccgkHTGzdmRAzBDkQwX MH1Q== X-Gm-Message-State: ANoB5pkL0PCdeUHQ9sAy5S+3sY3Q0NFxeZoXkJJbbGPx6wveHD3BUYno FcUSf8Sd49ab7XVisBxEno1GeAXS+EiLlFeScvd/Vg9ZNaWuRYRBLF52GAa8wyHE2gEwXPSZXeC euNYIZV/C9ZAciHs+kkRrUtYAOXaPgEAXQRNkVCepTk1TW0mToKJSeWGvFol6tIdF X-Google-Smtp-Source: AA0mqf7Sromy13SRRDL1DPC6ESme4zLmyjmROv4Fgf1Voru8n5PzgDrB+ZfSyEJ5gl9n/FYUMn80Ja5x4i1bHQ== X-Received: from acdunlap03.bve.corp.google.com ([2620:0:1008:11:3835:4494:83a9:5841]) (user=acdunlap job=sendgmr) by 2002:a62:3347:0:b0:574:d1f9:9b16 with SMTP id z68-20020a623347000000b00574d1f99b16mr60569544pfz.65.1670543094260; Thu, 08 Dec 2022 15:44:54 -0800 (PST) Date: Thu, 8 Dec 2022 15:43:36 -0800 Mime-Version: 1.0 X-Mailer: git-send-email 2.39.0.rc1.256.g54fd8350bd-goog Message-ID: Subject: [PATCH] OvmfPkg/PlatformPei: Validate SEC's GHCB page From: acdunlap@google.com To: devel@edk2.groups.io Cc: Adam Dunlap Content-Type: text/plain; charset="UTF-8" When running under SEV-ES, a page of shared memory is allocated for the GHCB during the SEC phase at address 0x809000. This page of memory is eventually passed to the OS as EfiConventionalMemory. When running SEV-SNP, this page is not PVALIDATE'd in the RMP table, meaning that if the guest OS tries to access the page, it will think that the host has voilated the security guarantees and will likely crash. This patch validates this page immediately after EDK2 switches to using the GHCB page allocated for the PEI phase. This was tested by writing a UEFI application that reads to and writes from one bytes of each page of memory and checks to see if a #VC exception is generated indicating that the page was not validated. Signed-off-by: Adam Dunlap --- OvmfPkg/PlatformPei/AmdSev.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c index e1b9fd9b7f..c465732068 100644 --- a/OvmfPkg/PlatformPei/AmdSev.c +++ b/OvmfPkg/PlatformPei/AmdSev.c @@ -206,6 +206,7 @@ AmdSevEsInitialize ( { UINT8 *GhcbBase; PHYSICAL_ADDRESS GhcbBasePa; + PHYSICAL_ADDRESS PrevGhcbPa; UINTN GhcbPageCount; UINT8 *GhcbBackupBase; UINT8 *GhcbBackupPages; @@ -293,8 +294,24 @@ AmdSevEsInitialize ( GhcbRegister (GhcbBasePa); } + PrevGhcbPa = AsmReadMsr64 (MSR_SEV_ES_GHCB); + AsmWriteMsr64 (MSR_SEV_ES_GHCB, GhcbBasePa); + // + // Now that the PEI GHCB is set up, the SEC GHCB page is no longer necessary + // to keep shared. Later, it is exposed to the OS as EfiConventionalMemory, so + // it needs to be marked private. The size of the region is hardcoded in + // OvmfPkg/ResetVector/ResetVector.nasmb in the definition of + // SNP_SEC_MEM_BASE_DESC_2. + // + ASSERT (PrevGhcbPa == FixedPcdGet32(PcdOvmfSecGhcbBase)); + + ASSERT_RETURN_ERROR(MemEncryptSevSetPageEncMask( + 0 /*Cr3 -- use system Cr3*/, + PrevGhcbPa, + 1 /*Number of pages*/)); + // // The SEV support will clear the C-bit from non-RAM areas. The early GDT // lives in a non-RAM area, so when an exception occurs (like a #VC) the GDT -- 2.39.0.rc1.256.g54fd8350bd-goog