SnpPageStateChangeInternal.c 8.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300
  1. /** @file
  2. SEV-SNP Page Validation functions.
  3. Copyright (c) 2021 AMD Incorporated. All rights reserved.<BR>
  4. SPDX-License-Identifier: BSD-2-Clause-Patent
  5. **/
  6. #include <Uefi/UefiBaseType.h>
  7. #include <Library/BaseLib.h>
  8. #include <Library/BaseMemoryLib.h>
  9. #include <Library/MemEncryptSevLib.h>
  10. #include <Library/DebugLib.h>
  11. #include <Library/CcExitLib.h>
  12. #include <Register/Amd/Ghcb.h>
  13. #include <Register/Amd/Msr.h>
  14. #include "SnpPageStateChange.h"
  15. #define IS_ALIGNED(x, y) ((((x) & (y - 1)) == 0))
  16. #define PAGES_PER_LARGE_ENTRY 512
  17. STATIC
  18. UINTN
  19. MemoryStateToGhcbOp (
  20. IN SEV_SNP_PAGE_STATE State
  21. )
  22. {
  23. UINTN Cmd;
  24. switch (State) {
  25. case SevSnpPageShared: Cmd = SNP_PAGE_STATE_SHARED;
  26. break;
  27. case SevSnpPagePrivate: Cmd = SNP_PAGE_STATE_PRIVATE;
  28. break;
  29. default: ASSERT (0);
  30. }
  31. return Cmd;
  32. }
  33. VOID
  34. SnpPageStateFailureTerminate (
  35. VOID
  36. )
  37. {
  38. MSR_SEV_ES_GHCB_REGISTER Msr;
  39. //
  40. // Use the GHCB MSR Protocol to request termination by the hypervisor
  41. //
  42. Msr.GhcbPhysicalAddress = 0;
  43. Msr.GhcbTerminate.Function = GHCB_INFO_TERMINATE_REQUEST;
  44. Msr.GhcbTerminate.ReasonCodeSet = GHCB_TERMINATE_GHCB;
  45. Msr.GhcbTerminate.ReasonCode = GHCB_TERMINATE_GHCB_GENERAL;
  46. AsmWriteMsr64 (MSR_SEV_ES_GHCB, Msr.GhcbPhysicalAddress);
  47. AsmVmgExit ();
  48. ASSERT (FALSE);
  49. CpuDeadLoop ();
  50. }
  51. /**
  52. This function issues the PVALIDATE instruction to validate or invalidate the memory
  53. range specified. If PVALIDATE returns size mismatch then it retry validating with
  54. smaller page size.
  55. */
  56. STATIC
  57. VOID
  58. PvalidateRange (
  59. IN SNP_PAGE_STATE_CHANGE_INFO *Info,
  60. IN UINTN StartIndex,
  61. IN UINTN EndIndex,
  62. IN BOOLEAN Validate
  63. )
  64. {
  65. UINTN Address, RmpPageSize, Ret, i;
  66. for ( ; StartIndex <= EndIndex; StartIndex++) {
  67. //
  68. // Get the address and the page size from the Info.
  69. //
  70. Address = Info->Entry[StartIndex].GuestFrameNumber << EFI_PAGE_SHIFT;
  71. RmpPageSize = Info->Entry[StartIndex].PageSize;
  72. Ret = AsmPvalidate (RmpPageSize, Validate, Address);
  73. //
  74. // If we fail to validate due to size mismatch then try with the
  75. // smaller page size. This senario will occur if the backing page in
  76. // the RMP entry is 4K and we are validating it as a 2MB.
  77. //
  78. if ((Ret == PVALIDATE_RET_SIZE_MISMATCH) && (RmpPageSize == PvalidatePageSize2MB)) {
  79. for (i = 0; i < PAGES_PER_LARGE_ENTRY; i++) {
  80. Ret = AsmPvalidate (PvalidatePageSize4K, Validate, Address);
  81. if (Ret) {
  82. break;
  83. }
  84. Address = Address + EFI_PAGE_SIZE;
  85. }
  86. }
  87. //
  88. // If validation failed then do not continue.
  89. //
  90. if (Ret) {
  91. DEBUG ((
  92. DEBUG_ERROR,
  93. "%a:%a: Failed to %a address 0x%Lx Error code %d\n",
  94. gEfiCallerBaseName,
  95. __FUNCTION__,
  96. Validate ? "Validate" : "Invalidate",
  97. Address,
  98. Ret
  99. ));
  100. SnpPageStateFailureTerminate ();
  101. }
  102. }
  103. }
  104. STATIC
  105. EFI_PHYSICAL_ADDRESS
  106. BuildPageStateBuffer (
  107. IN EFI_PHYSICAL_ADDRESS BaseAddress,
  108. IN EFI_PHYSICAL_ADDRESS EndAddress,
  109. IN SEV_SNP_PAGE_STATE State,
  110. IN BOOLEAN UseLargeEntry,
  111. IN SNP_PAGE_STATE_CHANGE_INFO *Info
  112. )
  113. {
  114. EFI_PHYSICAL_ADDRESS NextAddress;
  115. UINTN i, RmpPageSize;
  116. // Clear the page state structure
  117. SetMem (Info, sizeof (*Info), 0);
  118. i = 0;
  119. NextAddress = EndAddress;
  120. //
  121. // Populate the page state entry structure
  122. //
  123. while ((BaseAddress < EndAddress) && (i < SNP_PAGE_STATE_MAX_ENTRY)) {
  124. //
  125. // Is this a 2MB aligned page? Check if we can use the Large RMP entry.
  126. //
  127. if (UseLargeEntry && IS_ALIGNED (BaseAddress, SIZE_2MB) &&
  128. ((EndAddress - BaseAddress) >= SIZE_2MB))
  129. {
  130. RmpPageSize = PvalidatePageSize2MB;
  131. NextAddress = BaseAddress + SIZE_2MB;
  132. } else {
  133. RmpPageSize = PvalidatePageSize4K;
  134. NextAddress = BaseAddress + EFI_PAGE_SIZE;
  135. }
  136. Info->Entry[i].GuestFrameNumber = BaseAddress >> EFI_PAGE_SHIFT;
  137. Info->Entry[i].PageSize = RmpPageSize;
  138. Info->Entry[i].Operation = MemoryStateToGhcbOp (State);
  139. Info->Entry[i].CurrentPage = 0;
  140. Info->Header.EndEntry = (UINT16)i;
  141. BaseAddress = NextAddress;
  142. i++;
  143. }
  144. return NextAddress;
  145. }
  146. STATIC
  147. VOID
  148. PageStateChangeVmgExit (
  149. IN GHCB *Ghcb,
  150. IN SNP_PAGE_STATE_CHANGE_INFO *Info
  151. )
  152. {
  153. EFI_STATUS Status;
  154. //
  155. // As per the GHCB specification, the hypervisor can resume the guest before
  156. // processing all the entries. Checks whether all the entries are processed.
  157. //
  158. // The stragtegy here is to wait for the hypervisor to change the page
  159. // state in the RMP table before guest access the memory pages. If the
  160. // page state was not successful, then later memory access will result
  161. // in the crash.
  162. //
  163. while (Info->Header.CurrentEntry <= Info->Header.EndEntry) {
  164. Ghcb->SaveArea.SwScratch = (UINT64)Ghcb->SharedBuffer;
  165. CcExitVmgSetOffsetValid (Ghcb, GhcbSwScratch);
  166. Status = CcExitVmgExit (Ghcb, SVM_EXIT_SNP_PAGE_STATE_CHANGE, 0, 0);
  167. //
  168. // The Page State Change VMGEXIT can pass the failure through the
  169. // ExitInfo2. Lets check both the return value as well as ExitInfo2.
  170. //
  171. if ((Status != 0) || (Ghcb->SaveArea.SwExitInfo2)) {
  172. SnpPageStateFailureTerminate ();
  173. }
  174. }
  175. }
  176. /**
  177. The function is used to set the page state when SEV-SNP is active. The page state
  178. transition consist of changing the page ownership in the RMP table, and using the
  179. PVALIDATE instruction to update the Validated bit in RMP table.
  180. When the UseLargeEntry is set to TRUE, then function will try to use the large RMP
  181. entry (whevever possible).
  182. */
  183. VOID
  184. InternalSetPageState (
  185. IN EFI_PHYSICAL_ADDRESS BaseAddress,
  186. IN UINTN NumPages,
  187. IN SEV_SNP_PAGE_STATE State,
  188. IN BOOLEAN UseLargeEntry
  189. )
  190. {
  191. GHCB *Ghcb;
  192. EFI_PHYSICAL_ADDRESS NextAddress, EndAddress;
  193. MSR_SEV_ES_GHCB_REGISTER Msr;
  194. BOOLEAN InterruptState;
  195. SNP_PAGE_STATE_CHANGE_INFO *Info;
  196. Msr.GhcbPhysicalAddress = AsmReadMsr64 (MSR_SEV_ES_GHCB);
  197. Ghcb = Msr.Ghcb;
  198. EndAddress = BaseAddress + EFI_PAGES_TO_SIZE (NumPages);
  199. DEBUG ((
  200. DEBUG_VERBOSE,
  201. "%a:%a Address 0x%Lx - 0x%Lx State = %a LargeEntry = %d\n",
  202. gEfiCallerBaseName,
  203. __FUNCTION__,
  204. BaseAddress,
  205. EndAddress,
  206. State == SevSnpPageShared ? "Shared" : "Private",
  207. UseLargeEntry
  208. ));
  209. while (BaseAddress < EndAddress) {
  210. UINTN CurrentEntry, EndEntry;
  211. //
  212. // Initialize the GHCB
  213. //
  214. CcExitVmgInit (Ghcb, &InterruptState);
  215. //
  216. // Build the page state structure
  217. //
  218. Info = (SNP_PAGE_STATE_CHANGE_INFO *)Ghcb->SharedBuffer;
  219. NextAddress = BuildPageStateBuffer (
  220. BaseAddress,
  221. EndAddress,
  222. State,
  223. UseLargeEntry,
  224. Info
  225. );
  226. //
  227. // Save the current and end entry from the page state structure. We need
  228. // it later.
  229. //
  230. CurrentEntry = Info->Header.CurrentEntry;
  231. EndEntry = Info->Header.EndEntry;
  232. //
  233. // If the caller requested to change the page state to shared then
  234. // invalidate the pages before making the page shared in the RMP table.
  235. //
  236. if (State == SevSnpPageShared) {
  237. PvalidateRange (Info, CurrentEntry, EndEntry, FALSE);
  238. }
  239. //
  240. // Invoke the page state change VMGEXIT.
  241. //
  242. PageStateChangeVmgExit (Ghcb, Info);
  243. //
  244. // If the caller requested to change the page state to private then
  245. // validate the pages after it has been added in the RMP table.
  246. //
  247. if (State == SevSnpPagePrivate) {
  248. PvalidateRange (Info, CurrentEntry, EndEntry, TRUE);
  249. }
  250. CcExitVmgDone (Ghcb, InterruptState);
  251. BaseAddress = NextAddress;
  252. }
  253. }