AMD SEV-ES introduces a GHCB page for guest/host communication. This
page should be unencrypted, i.e. its c-bit should be unset, otherwise
the guest VM may crash when #VC exception happens.
By default, KVM-Unit-Tests only sets up 2MiB pages, i.e. only Level 2
page table entries are provided. Unsetting GHCB Level 2 pte's c-bit
still crashes the guest VM. The solution is to unset only its Level 1
pte's c-bit.
This commit provides GHCB page set up code that:
1. finds GHCB Level 1 pte
2. if not found, installs corresponding Level 1 pages
3. unsets GHCB Level 1 pte's c-bit
In this commit, KVM-Unit-Tests can run in an SEV-ES VM and boot into
test cases' main().
Signed-off-by: Zixuan Wang <zixuanwang@xxxxxxxxxx>
---
lib/x86/amd_sev.c | 35 +++++++++++++++++++++++++++++++++++
lib/x86/amd_sev.h | 6 ++++++
lib/x86/setup.c | 4 ++++
3 files changed, 45 insertions(+)
diff --git a/lib/x86/amd_sev.c b/lib/x86/amd_sev.c
index 04b6912..7f6265a 100644
--- a/lib/x86/amd_sev.c
+++ b/lib/x86/amd_sev.c
@@ -11,6 +11,7 @@
#include "amd_sev.h"
#include "x86/processor.h"
+#include "x86/vm.h"
static unsigned long long amd_sev_c_bit_pos;
@@ -64,6 +65,40 @@ EFI_STATUS setup_amd_sev_es(void){
return EFI_SUCCESS;
}
+void setup_ghcb_pte(pgd_t *page_table)
+{
+ /* SEV-ES guest uses GHCB page to communicate with host. This page must
+ * be unencrypted, i.e. its c-bit should be unset.
+ */
+ phys_addr_t ghcb_addr, ghcb_base_addr;
+ pteval_t *pte;
+
+ /* Read the current GHCB page addr */
+ ghcb_addr = rdmsr(SEV_ES_GHCB_MSR_INDEX);
+
+ /* Find Level 1 page table entry for GHCB page */
+ pte = get_pte_level(page_table, (void *)ghcb_addr, 1);
+
+ /* Create Level 1 pte for GHCB page if not found */
+ if (pte == NULL) {
+ /* Find Level 2 page base address */
+ ghcb_base_addr = ghcb_addr & ~(LARGE_PAGE_SIZE-1);
+ /* Install Level 1 ptes */
+ install_pages(page_table, ghcb_base_addr, LARGE_PAGE_SIZE,
+ (void *)ghcb_base_addr);
+ /* Find Level 2 pte, set as 4KB pages */
+ pte = get_pte_level(page_table, (void *)ghcb_addr, 2);
+ assert(pte);
+ *pte &= ~(PT_PAGE_SIZE_MASK);
+ /* Find Level 1 GHCB pte */
+ pte = get_pte_level(page_table, (void *)ghcb_addr, 1);
+ assert(pte);
+ }
+
+ /* Unset c-bit in Level 1 GHCB pte */
+ *pte &= ~(get_amd_sev_c_bit_mask());
+}
+
static void copy_gdt_entry(gdt_entry_t *dst, gdt_entry_t *src, unsigned segment)
{
unsigned index;
diff --git a/lib/x86/amd_sev.h b/lib/x86/amd_sev.h
index 5ebd4a6..2f08cdb 100644
--- a/lib/x86/amd_sev.h
+++ b/lib/x86/amd_sev.h
@@ -41,9 +41,15 @@
*/
#define SEV_ES_VC_HANDLER_VECTOR 29
+/* AMD Programmer's Manual Volume 2
+ * - Section "GHCB"
+ */
+#define SEV_ES_GHCB_MSR_INDEX 0xc0010130
+
EFI_STATUS setup_amd_sev(void);
#ifdef CONFIG_AMD_SEV_ES
EFI_STATUS setup_amd_sev_es(void);
+void setup_ghcb_pte(pgd_t *page_table);
void copy_uefi_segments(void);
#endif /* CONFIG_AMD_SEV_ES */
diff --git a/lib/x86/setup.c b/lib/x86/setup.c
index d828638..d782c39 100644
--- a/lib/x86/setup.c
+++ b/lib/x86/setup.c
@@ -290,6 +290,10 @@ static void setup_page_table(void)
curr_pt[i] = ((phys_addr_t)(i << 21)) | flags;
}
+#ifdef CONFIG_AMD_SEV_ES
+ setup_ghcb_pte((pgd_t *)&ptl4);
+#endif /* CONFIG_AMD_SEV_ES */
+
/* Load 4-level page table */
write_cr3((ulong)&ptl4);
}
--
2.33.0.rc1.237.g0d66db33f3-goog
