Module memory 

Routines to prepare VTL2 memory for launching the kernel.

Structs

BitmapHex 🔒

core::fmt::Display adapter that prints a page-bitmap (little-endian per byte within each u64 word) as a compact hex string. One hex char per 4 pages, so a full 2 MB / 4 KB = 512-page chunk fits in 128 hex chars.

DiagChunkHash 🔒

DiagPerPageState 🔒

Per-page expected-hash tracking state. Populated during SNP preflight (or TDX Phase A) against the measured loader-emitted SHA-384 hashes.

DiagSavedBadPage 🔒

One corrupt page’s full 4 KB contents plus the shim vs loader hashes, captured during Phase A when we first noticed the mismatch.

HexBytes 🔒

core::fmt::Display adapter that prints a byte slice as lowercase hex, no separators. Convenient for hashes in log lines.

RleRanges 🔒

core::fmt::Display adapter that walks a page-bitmap and emits corrupt page-index ranges in the form 0x8-0xa,0x11,0x20-0x21. Human-readable alternative to the raw hex bitmap.

Constants

DIAG_BITMAP_WORDS 🔒

Bitmap word count (u64s) for one 2 MB chunk.

DIAG_EMPTY_SAVED_PAGE 🔒

DIAG_HASH_BITMAP_WORDS 🔒

DIAG_MAX_BAD_PAGE_HASHES 🔒

Cap on how many per-bad-page SHA-384 lines we emit per Phase B mismatch, so a wholly-corrupt chunk doesn’t spam thousands of log lines.

DIAG_MAX_CHUNKS 🔒

Maximum number of 2 MB chunks we track. Debug builds hash roughly kernel + initrd (~80 MB), giving ~40 chunks; leave generous headroom.

DIAG_MAX_HASH_PAGES 🔒

Maximum number of individual 4 KB pages we can track for per-page expected-hash comparison. Sized with headroom over the current shared-page count observed in soaks (~20 K pages = 40 x 2 MB chunks).

DIAG_MAX_PAGES_PER_CHUNK 🔒

Max pages we can bitmap in a single 2 MB accept chunk (2 MB / 4 KB = 512).

DIAG_MAX_SAVED_BAD_PAGES 🔒

Number of corrupt pages for which we save the full 4 KB contents so we can hex-dump them on final report.

DIAG_PAGE_SIZE 🔒

Diagnostic page size == HV page size (4 KB).

Statics

DIAG_CHUNK_HASHES 🔒

DIAG_FULL_PAGE_DUMPED 🔒

One-shot latch guarding the full 4 KB hex dump of a corrupted page. Whichever phase (B or C) trips a mismatch first gets to dump; every subsequent detection just logs the header/bitmap/hashes and skips the full dump. Keeps COM3 quiet even when many chunks are corrupted.

DIAG_PER_PAGE 🔒

Per-page expected-hash tracking (populated in DiagPerPageState::record and reported in diag_report_per_page_expected).

DIAG_RUNNING_A 🔒

Functions

accept_pending_vtl2_memory 🔒

Accepts VTL2 memory in the specified range that is currently marked as pending, i.e. not yet assigned as exclusive and private.

accept_vtl2_memory 🔒

Accepts VTL2 memory in the specified gpa range.

diag_claim_full_page_dump 🔒

Returns true and latches on the first call; returns false thereafter.

diag_dump_full_page_diff 🔒

Emit a full 4 KB page as hex, one log line per 64-byte cache line, with pre and post side by side. Used when we have both Phase-A and Phase-C bytes for the first corrupted page.

diag_dump_full_page_single 🔒

Emit a full 4 KB page as hex, one log line per 64-byte cache line. Used when only the current (Phase-D) bytes are available for the first bad page and there is no pre-image to compare side by side.

diag_dump_saved_page 🔒

Emit a saved corrupt page (captured in Phase A) as hex, one log line per 64-byte cache line, along with the shim vs loader hashes.

diag_emit_per_page_expected 🔒

diag_init_expected_hashes 🔒

Cache the loader-emitted per-page expected hashes so DiagPerPageState::record can compare each 4 KB page against them. Must be called once, before the acceptance loop in setup_vtl2_memory. If the IGVM doesn’t have the expected-page-hashes region (older loader) or the region magic/version mismatched, per-page compare is left disabled and DiagPerPageState::record silently skips the per-page work.

diag_record_phase_a 🔒

Record the Phase-A hash of a chunk that was just copied out of a shared page into ram_buffer. Also feeds the bytes into a running combined Phase-A hasher so it can be compared against imported_regions_hash() on final mismatch. Per-page expected hashes are checked separately so SNP can report all corrupt shared pages before any imported page is converted.

diag_report_per_page_expected 🔒

Emit the per-page expected-hash comparison summary, corrupt-page bitmap, RLE ranges, and full 4 KB dumps of the first DIAG_MAX_SAVED_BAD_PAGES corrupt pages. On SNP, also called during preflight, before conversion. Keep RANGES -> BAD_BEGIN -> BAD_LINE (64 lines) -> BAD_END unchanged: the host’s GHCB COM3 parser breaks at the first BAD_END.

diag_report_phase_c 🔒

Called from verify_imported_regions_hash when the combined Phase-C hash does not match the expected measured value. Reports:

diag_verify_phase_b 🔒

Immediately after the shared -> private transition and copy-back, compare the same chunk (via the identity map) against the Phase-A bytes we captured before the transition, at 4 KB PAGE granularity. On mismatch, emits:

diag_verify_shared_imported_regions 🔒

Inspect every pending SNP imported page through a C=0 mapping before any imported page changes visibility. Do not read these GPAs through the private identity map, and do not call the post-accept diagnostic reporter here.

pending_import_chunks 🔒

Split a pending imported range at the local map’s 2 MB boundaries.

setup_vtl2_memory

On isolated systems, transitions all VTL2 RAM to be private and accepted, with the appropriate VTL permissions applied.

verify_imported_regions_hash