From: Zixuan Wang <zixuanwang@xxxxxxxxxx>
AMD SEV-ES introduces a GHCB page for guest/host communication. This
page should be unencrypted, i.e. its c-bit should be unset, otherwise
the guest VM may crash when #VC exception happens.
By default, KVM-Unit-Tests only sets up 2MiB pages, i.e. only Level 2
page table entries are provided. Unsetting GHCB Level 2 pte's c-bit
still crashes the guest VM. The solution is to unset only its Level 1
pte's c-bit.
This commit provides GHCB page set up code that:
1. finds GHCB Level 1 pte
2. if not found, installs corresponding Level 1 pages
3. unsets GHCB Level 1 pte's c-bit
In this commit, KVM-Unit-Tests can run in an SEV-ES VM and boot into
test cases' main().
Signed-off-by: Zixuan Wang <zixuanwang@xxxxxxxxxx>
---
lib/x86/amd_sev.c | 37 +++++++++++++++++++++++++++++++++++++
lib/x86/amd_sev.h | 7 +++++++
lib/x86/setup.c | 4 ++++
3 files changed, 48 insertions(+)
diff --git a/lib/x86/amd_sev.c b/lib/x86/amd_sev.c
index 50352df..6672214 100644
--- a/lib/x86/amd_sev.c
+++ b/lib/x86/amd_sev.c
@@ -11,6 +11,7 @@
#include "amd_sev.h"
#include "x86/processor.h"
+#include "x86/vm.h"
static unsigned short amd_sev_c_bit_pos;
@@ -117,6 +118,42 @@ efi_status_t setup_amd_sev_es(void)
return EFI_SUCCESS;
}
+void setup_ghcb_pte(pgd_t *page_table)
+{
+ /*
+ * SEV-ES guest uses GHCB page to communicate with the host. This page
+ * must be unencrypted, i.e. its c-bit should be unset. To do so, this
+ * function searches GHCB's L1 pte, creates corresponding L1 ptes if not
+ * found, and unsets the c-bit of GHCB's L1 pte.
+ */
+ phys_addr_t ghcb_addr, ghcb_base_addr;
+ pteval_t *pte;
+
+ /* Read the current GHCB page addr */
+ ghcb_addr = rdmsr(SEV_ES_GHCB_MSR_INDEX);
+
+ /* Search Level 1 page table entry for GHCB page */
+ pte = get_pte_level(page_table, (void *)ghcb_addr, 1);
+
+ /* Create Level 1 pte for GHCB page if not found */
+ if (pte == NULL) {
+ /* Find Level 2 page base address */
+ ghcb_base_addr = ghcb_addr & ~(LARGE_PAGE_SIZE - 1);
+ /* Install Level 1 ptes */
+ install_pages(page_table, ghcb_base_addr, LARGE_PAGE_SIZE, (void *)ghcb_base_addr);
+ /* Find Level 2 pte, set as 4KB pages */
+ pte = get_pte_level(page_table, (void *)ghcb_addr, 2);
+ assert(pte);
+ *pte &= ~(PT_PAGE_SIZE_MASK);
+ /* Find Level 1 GHCB pte */
+ pte = get_pte_level(page_table, (void *)ghcb_addr, 1);
+ assert(pte);
+ }
+
+ /* Unset c-bit in Level 1 GHCB pte */
+ *pte &= ~(get_amd_sev_c_bit_mask());
+}
+
unsigned long long get_amd_sev_c_bit_mask(void)
{
if (amd_sev_enabled()) {
diff --git a/lib/x86/amd_sev.h b/lib/x86/amd_sev.h
index 0ea1fda..6a10f84 100644
--- a/lib/x86/amd_sev.h
+++ b/lib/x86/amd_sev.h
@@ -45,8 +45,15 @@ efi_status_t setup_amd_sev(void);
*/
#define SEV_ES_VC_HANDLER_VECTOR 29
+/*
+ * AMD Programmer's Manual Volume 2
+ * - Section "GHCB"
+ */
+#define SEV_ES_GHCB_MSR_INDEX 0xc0010130
+
bool amd_sev_es_enabled(void);
efi_status_t setup_amd_sev_es(void);
+void setup_ghcb_pte(pgd_t *page_table);
unsigned long long get_amd_sev_c_bit_mask(void);
unsigned long long get_amd_sev_addr_upperbound(void);
diff --git a/lib/x86/setup.c b/lib/x86/setup.c
index 529c3d0..1f2cdde 100644
--- a/lib/x86/setup.c
+++ b/lib/x86/setup.c
@@ -314,6 +314,10 @@ static void setup_page_table(void)
curr_pt[i] = ((phys_addr_t)(i << 21)) | flags;
}
+ if (amd_sev_es_enabled()) {
+ setup_ghcb_pte((pgd_t *)&ptl4);
+ }
+
/* Load 4-level page table */
write_cr3((ulong)&ptl4);
}
--
2.33.0
