From: Brijesh Singh <brijesh.singh@amd.com>
To: Thomas.Lendacky@amd.com, ehabkost@redhat.com,
crosthwaite.peter@gmail.com, armbru@redhat.com, mst@redhat.com,
p.fedin@samsung.com, qemu-devel@nongnu.org,
lcapitulino@redhat.com, pbonzini@redhat.com, rth@twiddle.net
Cc: brijesh.ksingh@gmail.com
Subject: [Qemu-devel] [RFC PATCH v3 17/18] i386: clear C-bit in SEV guest page table walk
Date: Tue, 1 Nov 2016 11:54:46 -0400 [thread overview]
Message-ID: <147801568599.18237.15809185364145648409.stgit@brijesh-build-machine> (raw)
In-Reply-To: <147801550845.18237.12915616525154608660.stgit@brijesh-build-machine>
In SEV-enabled guest the physical addresses in page table will
have C-bit set, we need to clear the C-bit when walking the page table.
The C-bit position should be available in cpuid Fn8000_001f[EBX]
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
---
target-i386/helper.c | 37 ++++++++++++++++++++++++++++++-------
target-i386/monitor.c | 33 +++++++++++++++++++++++++++++++++
2 files changed, 63 insertions(+), 7 deletions(-)
diff --git a/target-i386/helper.c b/target-i386/helper.c
index e707350..cc5c37c 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -22,6 +22,7 @@
#include "exec/exec-all.h"
#include "sysemu/kvm.h"
#include "kvm_i386.h"
+#include "sysemu/sev.h"
#ifndef CONFIG_USER_ONLY
#include "sysemu/sysemu.h"
#include "monitor/monitor.h"
@@ -1006,6 +1007,22 @@ do_check_protect_pse36:
return 1;
}
+static uint64_t get_me_mask(void)
+{
+ uint64_t me_mask = 0;
+
+ /* In SEV guest page tables addresses will have memory encryption bit set,
+ * C-bit should be cleared while doing the page table walk.
+ */
+ if (sev_enabled()) {
+ uint32_t pos;
+ pos = kvm_arch_get_supported_cpuid(kvm_state, 0x8000001f, 0, R_EBX);
+ me_mask = (1UL << pos);
+ }
+
+ return ~me_mask;
+}
+
hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
{
X86CPU *cpu = X86_CPU(cs);
@@ -1014,6 +1031,12 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
uint64_t pte;
uint32_t page_offset;
int page_size;
+ uint64_t me_mask;
+
+ me_mask = get_me_mask();
+
+ /* In SEV guest, CR3 will have memory encryption bit set, clear it */
+ env->cr[3] &= me_mask;
if (!(env->cr[0] & CR0_PG_MASK)) {
pte = addr & env->a20_mask;
@@ -1034,13 +1057,13 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
}
pml4e_addr = ((env->cr[3] & ~0xfff) + (((addr >> 39) & 0x1ff) << 3)) &
env->a20_mask;
- pml4e = ldq_phys_debug(cs, pml4e_addr);
+ pml4e = ldq_phys_debug(cs, pml4e_addr) & me_mask;
if (!(pml4e & PG_PRESENT_MASK)) {
return -1;
}
pdpe_addr = ((pml4e & PG_ADDRESS_MASK) +
(((addr >> 30) & 0x1ff) << 3)) & env->a20_mask;
- pdpe = ldq_phys_debug(cs, pdpe_addr);
+ pdpe = ldq_phys_debug(cs, pdpe_addr) & me_mask;
if (!(pdpe & PG_PRESENT_MASK)) {
return -1;
}
@@ -1055,14 +1078,14 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
{
pdpe_addr = ((env->cr[3] & ~0x1f) + ((addr >> 27) & 0x18)) &
env->a20_mask;
- pdpe = ldq_phys_debug(cs, pdpe_addr);
+ pdpe = ldq_phys_debug(cs, pdpe_addr) & me_mask;
if (!(pdpe & PG_PRESENT_MASK))
return -1;
}
pde_addr = ((pdpe & PG_ADDRESS_MASK) +
(((addr >> 21) & 0x1ff) << 3)) & env->a20_mask;
- pde = ldq_phys_debug(cs, pde_addr);
+ pde = ldq_phys_debug(cs, pde_addr) & me_mask;
if (!(pde & PG_PRESENT_MASK)) {
return -1;
}
@@ -1075,7 +1098,7 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
pte_addr = ((pde & PG_ADDRESS_MASK) +
(((addr >> 12) & 0x1ff) << 3)) & env->a20_mask;
page_size = 4096;
- pte = ldq_phys_debug(cs, pte_addr);
+ pte = ldq_phys_debug(cs, pte_addr) & me_mask;
}
if (!(pte & PG_PRESENT_MASK)) {
return -1;
@@ -1085,7 +1108,7 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
/* page directory entry */
pde_addr = ((env->cr[3] & ~0xfff) + ((addr >> 20) & 0xffc)) & env->a20_mask;
- pde = ldl_phys_debug(cs, pde_addr);
+ pde = ldl_phys_debug(cs, pde_addr) & me_mask;
if (!(pde & PG_PRESENT_MASK))
return -1;
if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) {
@@ -1094,7 +1117,7 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
} else {
/* page directory entry */
pte_addr = ((pde & ~0xfff) + ((addr >> 10) & 0xffc)) & env->a20_mask;
- pte = ldl_phys_debug(cs, pte_addr);
+ pte = ldl_phys_debug(cs, pte_addr) & me_mask;
if (!(pte & PG_PRESENT_MASK)) {
return -1;
}
diff --git a/target-i386/monitor.c b/target-i386/monitor.c
index 2d125c5..ffb0479 100644
--- a/target-i386/monitor.c
+++ b/target-i386/monitor.c
@@ -27,6 +27,7 @@
#include "monitor/hmp-target.h"
#include "hw/i386/pc.h"
#include "sysemu/kvm.h"
+#include "sysemu/sev.h"
#include "hmp.h"
@@ -54,6 +55,22 @@ static void print_pte(Monitor *mon, hwaddr addr,
pte & PG_RW_MASK ? 'W' : '-');
}
+static uint64_t get_me_mask(void)
+{
+ uint64_t me_mask = 0;
+
+ /* In SEV guest page tables addresses will have memory encryption bit set,
+ * C-bit should be cleared while doing the page table walk.
+ */
+ if (sev_enabled()) {
+ uint32_t pos;
+ pos = kvm_arch_get_supported_cpuid(kvm_state, 0x8000001f, 0, R_EBX);
+ me_mask = (1UL << pos);
+ }
+
+ return ~me_mask;
+}
+
static void tlb_info_32(Monitor *mon, CPUArchState *env)
{
unsigned int l1, l2;
@@ -129,15 +146,21 @@ static void tlb_info_64(Monitor *mon, CPUState *cs)
uint64_t l1, l2, l3, l4;
uint64_t pml4e, pdpe, pde, pte;
uint64_t pml4_addr, pdp_addr, pd_addr, pt_addr;
+ uint64_t me_mask;
+
+ me_mask = get_me_mask();
pml4_addr = env->cr[3] & 0x3fffffffff000ULL;
+ pml4_addr &= me_mask;
for (l1 = 0; l1 < 512; l1++) {
pml4e = ldq_phys_debug(cs, pml4_addr + l1 * 8);
+ pml4e &= me_mask;
pml4e = le64_to_cpu(pml4e);
if (pml4e & PG_PRESENT_MASK) {
pdp_addr = pml4e & 0x3fffffffff000ULL;
for (l2 = 0; l2 < 512; l2++) {
pdpe = ldq_phys_debug(cs, pdp_addr + l2 * 8);
+ pdpe &= me_mask;
pdpe = le64_to_cpu(pdpe);
if (pdpe & PG_PRESENT_MASK) {
if (pdpe & PG_PSE_MASK) {
@@ -148,6 +171,7 @@ static void tlb_info_64(Monitor *mon, CPUState *cs)
pd_addr = pdpe & 0x3fffffffff000ULL;
for (l3 = 0; l3 < 512; l3++) {
pde = ldq_phys_debug(cs, pd_addr + l3 * 8);
+ pde &= me_mask;
pde = le64_to_cpu(pde);
if (pde & PG_PRESENT_MASK) {
if (pde & PG_PSE_MASK) {
@@ -160,6 +184,7 @@ static void tlb_info_64(Monitor *mon, CPUState *cs)
for (l4 = 0; l4 < 512; l4++) {
pte = ldq_phys_debug(cs,
pt_addr + l4 * 8);
+ pte &= me_mask;
pte = le64_to_cpu(pte);
if (pte & PG_PRESENT_MASK) {
print_pte(mon, (l1 << 39) +
@@ -338,12 +363,17 @@ static void mem_info_64(Monitor *mon, CPUState *cs)
CPUArchState *env = &cpu->env;
uint64_t pml4e, pdpe, pde, pte;
uint64_t pml4_addr, pdp_addr, pd_addr, pt_addr, start, end;
+ uint64_t me_mask;
+
+ me_mask = get_me_mask();
pml4_addr = env->cr[3] & 0x3fffffffff000ULL;
+ pml4_addr &= me_mask;
last_prot = 0;
start = -1;
for (l1 = 0; l1 < 512; l1++) {
pml4e = ldq_phys_debug(cs, pml4_addr + l1 * 8);
+ pml4e &= me_mask;
pml4e = le64_to_cpu(pml4e);
end = l1 << 39;
if (pml4e & PG_PRESENT_MASK) {
@@ -351,6 +381,7 @@ static void mem_info_64(Monitor *mon, CPUState *cs)
for (l2 = 0; l2 < 512; l2++) {
pdpe = ldq_phys_debug(cs, pdp_addr + l2 * 8);
pdpe = le64_to_cpu(pdpe);
+ pdpe &= me_mask;
end = (l1 << 39) + (l2 << 30);
if (pdpe & PG_PRESENT_MASK) {
if (pdpe & PG_PSE_MASK) {
@@ -362,6 +393,7 @@ static void mem_info_64(Monitor *mon, CPUState *cs)
pd_addr = pdpe & 0x3fffffffff000ULL;
for (l3 = 0; l3 < 512; l3++) {
pde = ldq_phys_debug(cs, pd_addr + l3 * 8);
+ pde &= me_mask;
pde = le64_to_cpu(pde);
end = (l1 << 39) + (l2 << 30) + (l3 << 21);
if (pde & PG_PRESENT_MASK) {
@@ -375,6 +407,7 @@ static void mem_info_64(Monitor *mon, CPUState *cs)
for (l4 = 0; l4 < 512; l4++) {
pte = ldq_phys_debug(cs,
pt_addr + l4 * 8);
+ pte &= me_mask;
pte = le64_to_cpu(pte);
end = (l1 << 39) + (l2 << 30) +
(l3 << 21) + (l4 << 12);
next prev parent reply other threads:[~2016-11-01 15:54 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-01 15:51 [Qemu-devel] [RFC PATCH v3 00/18] x86: Secure Encrypted Virtualization (AMD) Brijesh Singh
2016-11-01 15:51 ` [Qemu-devel] [RFC PATCH v3 01/18] memattrs: add debug attrs Brijesh Singh
2016-11-01 15:52 ` [Qemu-devel] [RFC PATCH v3 02/18] exec: add guest RAM read and write ops Brijesh Singh
2016-11-01 15:52 ` [Qemu-devel] [RFC PATCH v3 03/18] exec: add debug version of physical memory read and write apis Brijesh Singh
2016-11-01 15:52 ` [Qemu-devel] [RFC PATCH v3 04/18] monitor: use debug version of memory access apis Brijesh Singh
2016-11-01 15:52 ` [Qemu-devel] [RFC PATCH v3 05/18] core: add new security-policy object Brijesh Singh
2016-11-01 15:52 ` [Qemu-devel] [RFC PATCH v3 06/18] kvm: add memory encryption APIs Brijesh Singh
2016-11-01 15:53 ` [Qemu-devel] [RFC PATCH v3 07/18] sev: add Secure Encrypted Virtulization (SEV) support Brijesh Singh
2016-11-01 15:53 ` [Qemu-devel] [RFC PATCH v3 08/18] hmp: display memory encryption support in 'info kvm' Brijesh Singh
2016-11-01 15:53 ` [Qemu-devel] [RFC PATCH v3 09/18] core: loader: create memory encryption context before copying data Brijesh Singh
2016-11-01 15:53 ` [Qemu-devel] [RFC PATCH v3 10/18] sev: add LAUNCH_START command Brijesh Singh
2016-11-01 15:53 ` [Qemu-devel] [RFC PATCH v3 11/18] sev: add LAUNCH_UPDATE command Brijesh Singh
2016-11-01 15:53 ` [Qemu-devel] [RFC PATCH v3 12/18] sev: add LAUNCH_FINISH command Brijesh Singh
2016-11-01 15:54 ` [Qemu-devel] [RFC PATCH v3 13/18] sev: add DEBUG_DECRYPT command Brijesh Singh
2016-11-01 15:54 ` [Qemu-devel] [RFC PATCH v3 14/18] sev: add DEBUG_ENCRYPT command Brijesh Singh
2016-11-01 15:54 ` [Qemu-devel] [RFC PATCH v3 15/18] i386: register memory encryption ops Brijesh Singh
2016-11-01 15:54 ` [Qemu-devel] [RFC PATCH v3 16/18] target-i386: add cpuid Fn8000_001f Brijesh Singh
2016-11-01 15:54 ` Brijesh Singh [this message]
2016-11-01 15:54 ` [Qemu-devel] [RFC PATCH v3 18/18] migration: disable save/restore and migration on SEV guest Brijesh Singh
2016-11-01 16:22 ` [Qemu-devel] [RFC PATCH v3 00/18] x86: Secure Encrypted Virtualization (AMD) no-reply
2016-11-01 16:31 ` Peter Maydell
2016-11-01 16:24 ` no-reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=147801568599.18237.15809185364145648409.stgit@brijesh-build-machine \
--to=brijesh.singh@amd.com \
--cc=Thomas.Lendacky@amd.com \
--cc=armbru@redhat.com \
--cc=brijesh.ksingh@gmail.com \
--cc=crosthwaite.peter@gmail.com \
--cc=ehabkost@redhat.com \
--cc=lcapitulino@redhat.com \
--cc=mst@redhat.com \
--cc=p.fedin@samsung.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=rth@twiddle.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).