Building Secure Firmware by Jiewen Yao & Vincent Zimmer

Author:Jiewen Yao & Vincent Zimmer
Language: eng
Format: epub
ISBN: 9781484261064
Publisher: Apress

Let’s take one example – the CPUID instruction. The CPUID instruction uses the EAX register for the input and uses the EAX, EBX, ECX, and EDX registers for the output. In the virtualization environment without SEV-ES, when the guest domain executes the CPUID instruction, it triggers a VmExit. The hypervisor parses the VmExit reason to know it was a CPUID instruction that triggered the VmExit. Then the hypervisor gets the EAX value as the CPUID index and sets EAX/EBX/ECX/EDX in the guest general-purpose register fields and resumes the guest.

However, this flow does not work with SEV-ES because the hypervisor is not allowed to read EAX from the guest or write EAX/EBX/ECD/EDX to the guest directly. There are two ways to resolve this problem: 1) The guest software can replace the CPUID instruction with an alternate operation which writes to EAX in the GHCB, triggers VmExit, and reads EAX/EBX/ECX/EDX from the GHCB. This brings compatibility problems with existing guest software binaries. 2) Another way is to leverage a new VMM communication exception (#VC). See Figure 13-6. When the guest software executes CPUID, the CPU hardware triggers a #VC exception with an error code to indicate what the instruction is. Then the guest #VC exception handler can write the instruction (CPUID) and its input parameters (EAX) to the GHCB and trigger VmExit. The corresponding hypervisor handler parses the instruction and input data in the GHCB, writes the output data for the instruction to the GHCB, and resumes to the guest. Then the guest #VC handler reads the output parameters (EAX/EBX/ECX/EDX) of the instruction (CPUID) into the CPU registers. With the help of the new #VC handler, the compatibility is maintained.

Figure 13-6AMD SEV-ES Communication with GHCB and #VC

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.