From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f74.google.com (mail-pj1-f74.google.com [209.85.216.74]) by mx.groups.io with SMTP id smtpd.web10.4725.1670619869768464730 for ; Fri, 09 Dec 2022 13:04:29 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@google.com header.s=20210112 header.b=oG4u2NXU; spf=pass (domain: flex--acdunlap.bounces.google.com, ip: 209.85.216.74, mailfrom: 33aktywgkbzqy01ib9yd4cc492.0ca12j29218q.4fcidg.6c@flex--acdunlap.bounces.google.com) Received: by mail-pj1-f74.google.com with SMTP id z12-20020a17090abd8c00b0021a0a65a7e2so7199122pjr.7 for ; Fri, 09 Dec 2022 13:04:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=1GkKkQG1STxXg+jGq29LLjhpergm3BAOaSjHCk81evo=; b=oG4u2NXU5D/uqNGKg4yEqctCUAECIdEfMXgwqx4LbM9h6WoEemtTpSh9CzWctgqDjJ JsxXCx0CRwqVGZWprmGfwKR3QGyqS3UBDYeSVXbkiVdqbJz9pW4759AspAKunTtMvk6d NbzTf3mA6oxAya9S85vGRd6J+G/rY+PTP64pUYyjpXhKZ1cZbwhP2xZKcd7FPkBSdylo IEPSeyWEY/wbRp+CrggSmm09HWI8fAMxp+gI0PFuyjzH4nWDE3VO9Mo7NSXF1lVh82NM YIxxV+DFTJoO72FFgmfkgBDQcSe9c6PTIlJ34tcpG2qpVNL3iYl/WhyieapUHAoqGG/0 8X7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=1GkKkQG1STxXg+jGq29LLjhpergm3BAOaSjHCk81evo=; b=I64qfxG/Zs1Kqw/zrI4n4yqOd1UFhEMzKihue8A847ykarj32OUieuvPuujMw2FJV2 bQjO5tuS6MQrk3kinBStCqC0HCVnfmJ4bWKFjWzUuO9X/FMpOIAmgmJhnfBYpvoUuA02 TGGtk7gJLU75Z2Ip82saUOELM15FYv3UeSf+k8R8qywVPHP5UPwH7/xLA8+XAC+C9DET rxlX0/w4qZvIOviyOZRVmLn9wLk3f7NbDxyOCY8rMf/lf9KEJDrHrqDIHlOleDh2HDXQ blMn5GSxUNMUlLa+y+G+EEcz3RkEwmNzG4fgkqr4RQ76aJD9Uov0KNRjSCWPnhSTuqg6 k+6A== X-Gm-Message-State: ANoB5pmAm1u3b9kGSTtYYFUwtnHVdIsLzay5GYkXfR4+49DkIZFhdOjz 7zx9V+U9X2JpRotAMlGuT60iFd2Ow0jnF0UFJyL8V8CuMpvsCJRoE9VunqF/4ZfIS0JpvvKNKPu Ogd3bwbOzzrKHOR8/tFfEr0IGw8R/A8slHNhLk6XO9ijq1BZ/SDoW8J+EiGg4Ni0B X-Google-Smtp-Source: AA0mqf65o2cE9ECqlCIhK5QmGAut+6rivohqXhZY6sHgfFmBYzKSvnrNXKtnEWcbCIEssZ3QAYCTpyQJfY/BwA== X-Received: from acdunlap03.bve.corp.google.com ([2620:0:1008:11:9c55:ddcf:a880:90f3]) (user=acdunlap job=sendgmr) by 2002:a17:902:ebc1:b0:176:a6c5:20c9 with SMTP id p1-20020a170902ebc100b00176a6c520c9mr34463120plg.57.1670619869008; Fri, 09 Dec 2022 13:04:29 -0800 (PST) Date: Fri, 9 Dec 2022 13:04:16 -0800 Mime-Version: 1.0 X-Mailer: git-send-email 2.39.0.rc1.256.g54fd8350bd-goog Message-ID: Subject: [PATCH v3] OvmfPkg/PlatformPei: Validate SEC's GHCB page From: "Adam Dunlap" To: devel@edk2.groups.io Cc: Ard Biesheuvel , Jiewen Yao , Jordan Justen , Gerd Hoffmann , Brijesh Singh , Erdem Aktas , James Bottomley , Min Xu , Tom Lendacky , Dionna Glaze , Adam Dunlap Content-Type: text/plain; charset="UTF-8" When running under SEV-ES, a page of shared memory is allocated for the GHCB during the SEC phase at address 0x809000. This page of memory is eventually passed to the OS as EfiConventionalMemory. When running SEV-SNP, this page is not PVALIDATE'd in the RMP table, meaning that if the guest OS tries to access the page, it will think that the host has voilated the security guarantees and will likely crash. This patch validates this page immediately after EDK2 switches to using the GHCB page allocated for the PEI phase. This was tested by writing a UEFI application that reads to and writes from one byte of each page of memory and checks to see if a #VC exception is generated indicating that the page was not validated. Fixes: 6995a1b79bab ("OvmfPkg: Create a GHCB page for use during Sec phase") Signed-off-by: Adam Dunlap --- Removed the PcdStatus variable and just use Status for all statuses in this function. Use uncrustify to fix some formatting errors. OvmfPkg/PlatformPei/AmdSev.c | 40 ++++++++++++++++++++++++------------ 1 file changed, 27 insertions(+), 13 deletions(-) diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c index e1b9fd9b7f..b2f2f3ac26 100644 --- a/OvmfPkg/PlatformPei/AmdSev.c +++ b/OvmfPkg/PlatformPei/AmdSev.c @@ -212,7 +212,7 @@ AmdSevEsInitialize ( UINTN GhcbBackupPageCount; SEV_ES_PER_CPU_DATA *SevEsData; UINTN PageCount; - RETURN_STATUS PcdStatus, DecryptStatus; + RETURN_STATUS Status; IA32_DESCRIPTOR Gdtr; VOID *Gdt; @@ -220,8 +220,8 @@ AmdSevEsInitialize ( return; } - PcdStatus = PcdSetBoolS (PcdSevEsIsEnabled, TRUE); - ASSERT_RETURN_ERROR (PcdStatus); + Status = PcdSetBoolS (PcdSevEsIsEnabled, TRUE); + ASSERT_RETURN_ERROR (Status); // // Allocate GHCB and per-CPU variable pages. @@ -240,20 +240,20 @@ AmdSevEsInitialize ( // only clear the encryption mask for the GHCB pages. // for (PageCount = 0; PageCount < GhcbPageCount; PageCount += 2) { - DecryptStatus = MemEncryptSevClearPageEncMask ( - 0, - GhcbBasePa + EFI_PAGES_TO_SIZE (PageCount), - 1 - ); - ASSERT_RETURN_ERROR (DecryptStatus); + Status = MemEncryptSevClearPageEncMask ( + 0, + GhcbBasePa + EFI_PAGES_TO_SIZE (PageCount), + 1 + ); + ASSERT_RETURN_ERROR (Status); } ZeroMem (GhcbBase, EFI_PAGES_TO_SIZE (GhcbPageCount)); - PcdStatus = PcdSet64S (PcdGhcbBase, GhcbBasePa); - ASSERT_RETURN_ERROR (PcdStatus); - PcdStatus = PcdSet64S (PcdGhcbSize, EFI_PAGES_TO_SIZE (GhcbPageCount)); - ASSERT_RETURN_ERROR (PcdStatus); + Status = PcdSet64S (PcdGhcbBase, GhcbBasePa); + ASSERT_RETURN_ERROR (Status); + Status = PcdSet64S (PcdGhcbSize, EFI_PAGES_TO_SIZE (GhcbPageCount)); + ASSERT_RETURN_ERROR (Status); DEBUG (( DEBUG_INFO, @@ -295,6 +295,20 @@ AmdSevEsInitialize ( AsmWriteMsr64 (MSR_SEV_ES_GHCB, GhcbBasePa); + // + // Now that the PEI GHCB is set up, the SEC GHCB page is no longer necessary + // to keep shared. Later, it is exposed to the OS as EfiConventionalMemory, so + // it needs to be marked private. The size of the region is hardcoded in + // OvmfPkg/ResetVector/ResetVector.nasmb in the definition of + // SNP_SEC_MEM_BASE_DESC_2. + // + Status = MemEncryptSevSetPageEncMask ( + 0, // Cr3 -- use system Cr3 + FixedPcdGet32 (PcdOvmfSecGhcbBase), // BaseAddress + 1 // NumPages + ); + ASSERT_RETURN_ERROR (Status); + // // The SEV support will clear the C-bit from non-RAM areas. The early GDT // lives in a non-RAM area, so when an exception occurs (like a #VC) the GDT -- 2.39.0.rc1.256.g54fd8350bd-goog