From: Zixuan Wang <zixuanwang@google.com>
To: kvm@vger.kernel.org, pbonzini@redhat.com, drjones@redhat.com
Cc: marcorr@google.com, baekhw@google.com, tmroeder@google.com,
erdemaktas@google.com, rientjes@google.com, seanjc@google.com,
brijesh.singh@amd.com, Thomas.Lendacky@amd.com,
varad.gautam@suse.com, jroedel@suse.de, bp@suse.de,
Zixuan Wang <zixuanwang@google.com>
Subject: [kvm-unit-tests RFC 13/16] x86 AMD SEV-ES: Load GDT with UEFI segments
Date: Wed, 18 Aug 2021 00:09:02 +0000 [thread overview]
Message-ID: <20210818000905.1111226-14-zixuanwang@google.com> (raw)
In-Reply-To: <20210818000905.1111226-1-zixuanwang@google.com>
Before this commit, KVM-Unit-Tests set up process crashes when executing
'lgdt' instruction under SEV-ES. This is because lgdt triggers UEFI
procedures (e.g. UEFI #VC handler) that require UEFI's code and data
segments. But these segments are are not compatible with KVM-Unit-Tests
GDT:
UEFI uses 0x30 as code segment and 0x38 as data segment, but in
KVM-Unit-Tests' GDT, 0x30 is a data segment, and 0x38 is a code segment.
This discrepancy crashes the UEFI procedures and thus crashes the 'lgdt'
execution.
This commit fixes this issue by copying UEFI GDT's code and data
segments into KVM-Unit-Tests GDT, so that UEFI procedures (e.g. UEFI #VC
handler) can work.
In this commit, the guest VM passes setup_gdt_tss() but crashes in
load_idt(), which will be fixed by follow-up commits.
Signed-off-by: Zixuan Wang <zixuanwang@google.com>
---
lib/x86/amd_sev.c | 36 ++++++++++++++++++++++++++++++++++++
lib/x86/amd_sev.h | 1 +
lib/x86/setup.c | 4 ++++
3 files changed, 41 insertions(+)
diff --git a/lib/x86/amd_sev.c b/lib/x86/amd_sev.c
index a31d352..c2aebdf 100644
--- a/lib/x86/amd_sev.c
+++ b/lib/x86/amd_sev.c
@@ -53,6 +53,42 @@ EFI_STATUS setup_amd_sev_es(void){
return EFI_SUCCESS;
}
+
+static void copy_gdt_entry(gdt_entry_t *dst, gdt_entry_t *src, unsigned segment)
+{
+ unsigned index;
+
+ index = segment / sizeof(gdt_entry_t);
+ dst[index] = src[index];
+}
+
+/* Defined in x86/efi/efistart64.S */
+extern gdt_entry_t gdt64[];
+
+/* Copy UEFI's code and data segments to KVM-Unit-Tests GDT.
+ *
+ * This is because KVM-Unit-Tests reuses UEFI #VC handler that requires UEFI
+ * code and data segments to run. The UEFI #VC handler crashes the guest VM if
+ * these segments are not available. So we need to copy these two UEFI segments
+ * into KVM-Unit-Tests GDT.
+ *
+ * UEFI uses 0x30 as code segment and 0x38 as data segment. Fortunately, these
+ * segments can be safely overridden in KVM-Unit-Tests as they are used as
+ * protected mode and real mode segments (see x86/efi/efistart64.S for more
+ * details), which are not used in EFI set up process.
+ */
+void copy_uefi_segments(void)
+{
+ /* GDT and GDTR in current UEFI */
+ gdt_entry_t *gdt_curr;
+ struct descriptor_table_ptr gdtr_curr;
+
+ /* Copy code and data segments from UEFI */
+ sgdt(&gdtr_curr);
+ gdt_curr = (gdt_entry_t *)gdtr_curr.base;
+ copy_gdt_entry(gdt64, gdt_curr, read_cs());
+ copy_gdt_entry(gdt64, gdt_curr, read_ds());
+}
#endif /* CONFIG_AMD_SEV_ES */
unsigned long long get_amd_sev_c_bit_mask(void)
diff --git a/lib/x86/amd_sev.h b/lib/x86/amd_sev.h
index a2eccfc..4d81cae 100644
--- a/lib/x86/amd_sev.h
+++ b/lib/x86/amd_sev.h
@@ -39,6 +39,7 @@
EFI_STATUS setup_amd_sev(void);
#ifdef CONFIG_AMD_SEV_ES
EFI_STATUS setup_amd_sev_es(void);
+void copy_uefi_segments(void);
#endif /* CONFIG_AMD_SEV_ES */
unsigned long long get_amd_sev_c_bit_mask(void);
diff --git a/lib/x86/setup.c b/lib/x86/setup.c
index d29f415..d828638 100644
--- a/lib/x86/setup.c
+++ b/lib/x86/setup.c
@@ -348,6 +348,10 @@ static void setup_gdt_tss(void)
tss_hi->limit_low = (u16)((curr_tss_addr >> 32) & 0xffff);
tss_hi->base_low = (u16)((curr_tss_addr >> 48) & 0xffff);
+#ifdef CONFIG_AMD_SEV_ES
+ copy_uefi_segments();
+#endif /* CONFIG_AMD_SEV_ES */
+
load_gdt_tss(tss_offset);
}
--
2.33.0.rc1.237.g0d66db33f3-goog
next prev parent reply other threads:[~2021-08-18 0:09 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-18 0:08 [kvm-unit-tests RFC 00/16] x86_64 UEFI and AMD SEV/SEV-ES support Zixuan Wang
2021-08-18 0:08 ` [kvm-unit-tests RFC 01/16] x86 UEFI: Copy code from GNU-EFI Zixuan Wang
2021-08-18 0:08 ` [kvm-unit-tests RFC 02/16] x86 UEFI: Boot from UEFI Zixuan Wang
2021-08-18 0:08 ` [kvm-unit-tests RFC 03/16] x86 UEFI: Move setjmp.h out of desc.h Zixuan Wang
2021-08-18 0:08 ` [kvm-unit-tests RFC 04/16] x86 UEFI: Load KVM-Unit-Tests IDT after UEFI boot up Zixuan Wang
2021-08-18 0:08 ` [kvm-unit-tests RFC 05/16] x86 UEFI: Load GDT and TSS " Zixuan Wang
2021-08-18 0:08 ` [kvm-unit-tests RFC 06/16] x86 UEFI: Set up memory allocator Zixuan Wang
2021-08-18 0:08 ` [kvm-unit-tests RFC 07/16] x86 UEFI: Set up RSDP after UEFI boot up Zixuan Wang
2021-08-18 0:08 ` [kvm-unit-tests RFC 08/16] x86 UEFI: Set up page tables Zixuan Wang
2021-08-18 0:08 ` [kvm-unit-tests RFC 09/16] x86 UEFI: Convert x86 test cases to PIC Zixuan Wang
2021-08-18 0:08 ` [kvm-unit-tests RFC 10/16] x86 AMD SEV: Initial support Zixuan Wang
2021-08-18 0:09 ` [kvm-unit-tests RFC 11/16] x86 AMD SEV: Page table with c-bit Zixuan Wang
2021-08-18 0:09 ` [kvm-unit-tests RFC 12/16] x86 AMD SEV-ES: Check SEV-ES status Zixuan Wang
2021-08-18 0:09 ` Zixuan Wang [this message]
2021-08-18 0:09 ` [kvm-unit-tests RFC 14/16] x86 AMD SEV-ES: Copy UEFI #VC IDT entry Zixuan Wang
2021-08-20 23:50 ` Sean Christopherson
2021-08-21 0:37 ` Marc Orr
2021-08-21 0:47 ` Zixuan Wang
2021-08-18 0:09 ` [kvm-unit-tests RFC 15/16] x86 AMD SEV-ES: Set up GHCB page Zixuan Wang
2021-08-18 0:09 ` [kvm-unit-tests RFC 16/16] x86 AMD SEV-ES: Add test cases Zixuan Wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210818000905.1111226-14-zixuanwang@google.com \
--to=zixuanwang@google.com \
--cc=Thomas.Lendacky@amd.com \
--cc=baekhw@google.com \
--cc=bp@suse.de \
--cc=brijesh.singh@amd.com \
--cc=drjones@redhat.com \
--cc=erdemaktas@google.com \
--cc=jroedel@suse.de \
--cc=kvm@vger.kernel.org \
--cc=marcorr@google.com \
--cc=pbonzini@redhat.com \
--cc=rientjes@google.com \
--cc=seanjc@google.com \
--cc=tmroeder@google.com \
--cc=varad.gautam@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).