Re: [kvm-unit-tests PATCH v2 14/17] x86 AMD SEV-ES: Load GDT with UEFI segments

From: Zixuan Wang <zxwang42@gmail.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Zixuan Wang <zixuanwang@google.com>,
	kvm@vger.kernel.org, drjones@redhat.com,
	Marc Orr <marcorr@google.com>,
	"Hyunwook (Wooky) Baek" <baekhw@google.com>,
	tmroeder@google.com, erdemaktas@google.com, rientjes@google.com,
	seanjc@google.com, brijesh.singh@amd.com,
	Thomas.Lendacky@amd.com, varad.gautam@suse.com, jroedel@suse.de,
	bp@suse.de
Subject: Re: [kvm-unit-tests PATCH v2 14/17] x86 AMD SEV-ES: Load GDT with UEFI segments
Date: Mon, 20 Sep 2021 21:41:04 -0700	[thread overview]
Message-ID: <CAEDJ5ZQEcmV8d_YXyV-7c6u1Q7FTGSY7esw-08vYyYzoNfLVsg@mail.gmail.com> (raw)
In-Reply-To: <34173c4c-d704-5d28-8aac-c2debf224a86@redhat.com>

On Mon, Sep 20, 2021 at 6:27 PM Paolo Bonzini <pbonzini@redhat.com> wrote:
>
> On 27/08/21 05:12, Zixuan Wang wrote:
> > + *
> > + * This is because KVM-Unit-Tests reuses UEFI #VC handler that requires UEFI
> > + * code and data segments to run. The UEFI #VC handler crashes the guest VM if
> > + * these segments are not available. So we need to copy these two UEFI segments
> > + * into KVM-Unit-Tests GDT.
> > + *
> > + * UEFI uses 0x30 as code segment and 0x38 as data segment. Fortunately, these
> > + * segments can be safely overridden in KVM-Unit-Tests as they are used as
> > + * protected mode and real mode segments (see x86/efi/efistart64.S for more
> > + * details), which are not used in EFI set up process.
>
> Is 0x30/0x38 the same as kvm-unit-tests's 0x08/0x10?  Can kvm-unit-tests
> simply change its ring-0 64-bit CS/DS to 0x30 and 0x38 instead of 0x08
> and 0x10?  I can help with that too, since there would be some more
> shuffling to keep similar descriptors together:
>
>   * 0x00         NULL descriptor               NULL descriptor
>   * 0x08         intr_alt_stack TSS            ring-0 code segment (32-bit)
>   * 0x10 (0x13)  **unused**                    ring-3 code segment (64-bit)
>   * 0x18         ring-0 code segment (P=0)     ring-0 code segment (64-bit, P=0)
>   * 0x20         ring-0 code segment (16-bit)  same
>   * 0x28         ring-0 data segment (16-bit)  same
>   * 0x30         ring-0 code segment (32-bit)  ring-0 code segment (64-bit)
>   * 0x38         ring-0 data segment (32-bit)  ring-0 data segment (32/64-bit)
>   * 0x40 (0x43)  ring-3 code segment (32-bit)  same
>   * 0x48 (0x4b)  ring-3 data segment (32-bit)  ring-3 data segment (32/64-bit)
>   * 0x50-0x78    free to use for test cases    same
>
> or:
>
> old     new
> ----    ----
> 0x00    0x00
> 0x20    0x08
> 0x48    0x10
> 0x18    0x18
> 0x28    0x20
> 0x30    0x28
> 0x08    0x30
> 0x10    0x38
> 0x38    0x40
> 0x40    0x48
>
> Thanks,
>
> Paolo
>

Thank you for the detailed explanation! Updating KVM-unit-tests GDT is
one way to solve the problem, but we found a more straightforward
solution [1]:

We found it possible to update the 'code segment selector' field in
the #VC IDT entry and point it to the KVM-unit-tests code segment.
This allows the UEFI #VC handler to use KVM-unit-tests segments, and
we do not need to copy the UEFI segments.

I will update this into the next version.

[1] https://github.com/TheNetAdmin/KVM-Unit-Tests-dev-fork/commit/ab480fd0fbad813c2922526a0bccadf121cb9240

Best regards,
Zixuan