From: Erdem Aktas erdemaktas@google.com

TDX requires additional IOCTLs to initialize VM and vCPUs, to add private memory and to finalize the VM memory. Also additional utility functions are provided to create a guest image that will include test code.

TDX enabled VM's memory is encrypted and cannot be modified or observed by the VMM. We need to create a guest image that includes the testing code.

When TDX is enabled, vCPUs will enter guest mode with 32 bit mode with paging disabled. TDX requires the CPU to run on long mode with paging enabled. The guest image should have transition code from 32 bit to 64 bit, enable paging and run the testing code. There has to be predifined offset values for each data structure that will be used by the guest code. The guest image layout is as following:

| Page Tables | GDTR | GDT | Stack | Testing Code | Transition Boot Code |

Guest image will be loaded to the bottom of the first 4GB of the memory.

Signed-off-by: Erdem Aktas erdemaktas@google.com Signed-off-by: Sagi Shahar sagis@google.com Signed-off-by: Ryan Afranji afranji@google.com --- tools/testing/selftests/kvm/Makefile | 1 + .../selftests/kvm/include/kvm_util_base.h | 6 + .../selftests/kvm/include/x86_64/processor.h | 1 + .../selftests/kvm/lib/x86_64/processor.c | 27 ++ tools/testing/selftests/kvm/lib/x86_64/tdx.h | 86 +++++ .../selftests/kvm/lib/x86_64/tdx_lib.c | 338 ++++++++++++++++++ 6 files changed, 459 insertions(+) create mode 100644 tools/testing/selftests/kvm/lib/x86_64/tdx.h create mode 100644 tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c

diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile index 690b499c3471..ad4d60dadc06 100644 --- a/tools/testing/selftests/kvm/Makefile +++ b/tools/testing/selftests/kvm/Makefile @@ -52,6 +52,7 @@ LIBKVM_x86_64 += lib/x86_64/handlers.S LIBKVM_x86_64 += lib/x86_64/perf_test_util.c LIBKVM_x86_64 += lib/x86_64/processor.c LIBKVM_x86_64 += lib/x86_64/svm.c +LIBKVM_x86_64 += lib/x86_64/tdx_lib.c LIBKVM_x86_64 += lib/x86_64/ucall.c LIBKVM_x86_64 += lib/x86_64/vmx.c

diff --git a/tools/testing/selftests/kvm/include/kvm_util_base.h b/tools/testing/selftests/kvm/include/kvm_util_base.h index 2de7a7a2e56b..8d3bcf1719c6 100644 --- a/tools/testing/selftests/kvm/include/kvm_util_base.h +++ b/tools/testing/selftests/kvm/include/kvm_util_base.h @@ -653,6 +653,12 @@ static inline struct kvm_vm *vm_create_barebones(void) return ____vm_create(VM_MODE_DEFAULT, 0, KVM_VM_TYPE_DEFAULT); }

+/* TDX VMs are always created with no memory and memory is added later */ +static inline struct kvm_vm *vm_create_tdx(void) +{ + return ____vm_create(VM_MODE_DEFAULT, 0, KVM_X86_TDX_VM); +} + static inline struct kvm_vm *vm_create(uint32_t nr_runnable_vcpus) { return __vm_create(VM_MODE_DEFAULT, nr_runnable_vcpus, 0); diff --git a/tools/testing/selftests/kvm/include/x86_64/processor.h b/tools/testing/selftests/kvm/include/x86_64/processor.h index 45edf45821d0..57bbab7d025c 100644 --- a/tools/testing/selftests/kvm/include/x86_64/processor.h +++ b/tools/testing/selftests/kvm/include/x86_64/processor.h @@ -855,6 +855,7 @@ enum pg_level { #define PG_SIZE_1G PG_LEVEL_SIZE(PG_LEVEL_1G)

void __virt_pg_map(struct kvm_vm *vm, uint64_t vaddr, uint64_t paddr, int level); +struct kvm_vcpu *vm_vcpu_add_tdx(struct kvm_vm *vm, uint32_t vcpu_id);

/* * Basic CPU control in CR0 diff --git a/tools/testing/selftests/kvm/lib/x86_64/processor.c b/tools/testing/selftests/kvm/lib/x86_64/processor.c index f35626df1dea..2a6e28c769f2 100644 --- a/tools/testing/selftests/kvm/lib/x86_64/processor.c +++ b/tools/testing/selftests/kvm/lib/x86_64/processor.c @@ -8,6 +8,7 @@ #include "test_util.h" #include "kvm_util.h" #include "processor.h" +#include "tdx.h"

#ifndef NUM_INTERRUPTS #define NUM_INTERRUPTS 256 @@ -641,6 +642,32 @@ struct kvm_vcpu *vm_arch_vcpu_add(struct kvm_vm *vm, uint32_t vcpu_id, return vcpu; }

+/* + * Adds a vCPU to a TD (Trusted Domain) with minimum defaults. It will not set + * up any general purpose registers as they will be initialized by the TDX. In + * TDX, vCPUs RIP is set to 0xFFFFFFF0. See Intel TDX EAS Section "Initial State + * of Guest GPRs" for more information on vCPUs initial register values when + * entering the TD first time. + * + * Input Args: + * vm - Virtual Machine + * vcpuid - The id of the VCPU to add to the VM. + */ +struct kvm_vcpu *vm_vcpu_add_tdx(struct kvm_vm *vm, uint32_t vcpu_id) +{ + struct kvm_mp_state mp_state; + struct kvm_vcpu *vcpu; + + vcpu = __vm_vcpu_add(vm, vcpu_id); + initialize_td_vcpu(vcpu); + + /* Setup the MP state */ + mp_state.mp_state = 0; + vcpu_mp_state_set(vcpu, &mp_state); + + return vcpu; +} + struct kvm_vcpu *vm_arch_vcpu_recreate(struct kvm_vm *vm, uint32_t vcpu_id) { struct kvm_vcpu *vcpu = __vm_vcpu_add(vm, vcpu_id); diff --git a/tools/testing/selftests/kvm/lib/x86_64/tdx.h b/tools/testing/selftests/kvm/lib/x86_64/tdx.h new file mode 100644 index 000000000000..61b997dfc420 --- /dev/null +++ b/tools/testing/selftests/kvm/lib/x86_64/tdx.h @@ -0,0 +1,86 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef KVM_LIB_TDX_H_ +#define KVM_LIB_TDX_H_ + +#include <kvm_util.h> +#include "processor.h" + +/* + * Max page size for the guest image. + */ +#define TDX_GUEST_MAX_NR_PAGES 10000 + +/* + * Page Table Address used when paging is enabled. + */ +#define TDX_GUEST_PT_FIXED_ADDR (0xFFFFFFFF -\ + (TDX_GUEST_MAX_NR_PAGES * PAGE_SIZE) + 1) + +/* + * Max Page Table Size + * To map 4GB memory region with 2MB pages, there needs to be 1 page for PML4, + * 1 Page for PDPT, 4 pages for PD. Reserving 6 pages for PT. + */ +#define TDX_GUEST_NR_PT_PAGES (1 + 1 + 4) + +/* + * Predefined GDTR values. + */ +#define TDX_GUEST_GDTR_ADDR (TDX_GUEST_PT_FIXED_ADDR + (TDX_GUEST_NR_PT_PAGES *\ + PAGE_SIZE)) +#define TDX_GUEST_GDTR_BASE (TDX_GUEST_GDTR_ADDR + PAGE_SIZE) +#define TDX_GUEST_LINEAR_CODE64_SEL 0x38 + +#define TDX_GUEST_STACK_NR_PAGES (3) +#define TDX_GUEST_STACK_BASE (TDX_GUEST_GDTR_BASE + (TDX_GUEST_STACK_NR_PAGES *\ + PAGE_SIZE) - 1) +/* + * Reserving some pages to copy the test code. This is an arbitrary number for + * now to simplify to guest image layout calculation. + * TODO: calculate the guest code dynamcially. + */ +#define TDX_GUEST_CODE_ENTRY (TDX_GUEST_GDTR_BASE + (TDX_GUEST_STACK_NR_PAGES *\ + PAGE_SIZE)) + +#define KVM_MAX_CPUID_ENTRIES 256 + +/* + * TODO: Move page attributes to processor.h file. + */ +#define _PAGE_PRESENT (1UL<<0) /* is present */ +#define _PAGE_RW (1UL<<1) /* writeable */ +#define _PAGE_PS (1UL<<7) /* page size bit*/ + +#define GDT_ENTRY(flags, base, limit) \ + ((((base) & 0xff000000ULL) << (56-24)) | \ + (((flags) & 0x0000f0ffULL) << 40) | \ + (((limit) & 0x000f0000ULL) << (48-16)) | \ + (((base) & 0x00ffffffULL) << 16) | \ + (((limit) & 0x0000ffffULL))) + +struct tdx_cpuid_data { + struct kvm_cpuid2 cpuid; + struct kvm_cpuid_entry2 entries[KVM_MAX_CPUID_ENTRIES]; +}; + +struct __packed tdx_gdtr { + uint16_t limit; + uint32_t base; +}; + +struct page_table { + uint64_t pml4[512]; + uint64_t pdpt[512]; + uint64_t pd[4][512]; +}; + +void add_td_memory(struct kvm_vm *vm, void *source_page, + uint64_t gpa, int size); +void finalize_td_memory(struct kvm_vm *vm); +void initialize_td(struct kvm_vm *vm); +void initialize_td_vcpu(struct kvm_vcpu *vcpu); +void prepare_source_image(struct kvm_vm *vm, void *guest_code, + size_t guest_code_size, + uint64_t guest_code_signature); + +#endif // KVM_LIB_TDX_H_ diff --git a/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c b/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c new file mode 100644 index 000000000000..72bf2ff24a29 --- /dev/null +++ b/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c @@ -0,0 +1,338 @@ +// SPDX-License-Identifier: GPL-2.0 +#include <linux/stringify.h> +#include "asm/kvm.h" +#include "tdx.h" +#include <stdlib.h> +#include <malloc.h> +#include "processor.h" +#include <string.h> + +char *tdx_cmd_str[] = { + "KVM_TDX_CAPABILITIES", + "KVM_TDX_INIT_VM", + "KVM_TDX_INIT_VCPU", + "KVM_TDX_INIT_MEM_REGION", + "KVM_TDX_FINALIZE_VM" +}; + +#define TDX_MAX_CMD_STR (ARRAY_SIZE(tdx_cmd_str)) +#define EIGHT_INT3_INSTRUCTIONS 0xCCCCCCCCCCCCCCCC + +#define XFEATURE_LBR 15 +#define XFEATURE_XTILECFG 17 +#define XFEATURE_XTILEDATA 18 +#define XFEATURE_MASK_LBR (1 << XFEATURE_LBR) +#define XFEATURE_MASK_XTILECFG (1 << XFEATURE_XTILECFG) +#define XFEATURE_MASK_XTILEDATA (1 << XFEATURE_XTILEDATA) +#define XFEATURE_MASK_XTILE (XFEATURE_MASK_XTILECFG | XFEATURE_MASK_XTILEDATA) + + +static void tdx_ioctl(int fd, int ioctl_no, uint32_t flags, void *data) +{ + struct kvm_tdx_cmd tdx_cmd; + int r; + + TEST_ASSERT(ioctl_no < TDX_MAX_CMD_STR, "Unknown TDX CMD : %d\n", + ioctl_no); + + memset(&tdx_cmd, 0x0, sizeof(tdx_cmd)); + tdx_cmd.id = ioctl_no; + tdx_cmd.flags = flags; + tdx_cmd.data = (uint64_t)data; + r = ioctl(fd, KVM_MEMORY_ENCRYPT_OP, &tdx_cmd); + TEST_ASSERT(r == 0, "%s failed: %d %d", tdx_cmd_str[ioctl_no], r, + errno); +} + +static struct tdx_cpuid_data get_tdx_cpuid_data(struct kvm_vm *vm) +{ + static struct tdx_cpuid_data cpuid_data; + int ret, i; + + if (cpuid_data.cpuid.nent) + return cpuid_data; + + memset(&cpuid_data, 0, sizeof(cpuid_data)); + cpuid_data.cpuid.nent = KVM_MAX_CPUID_ENTRIES; + ret = ioctl(vm->kvm_fd, KVM_GET_SUPPORTED_CPUID, &cpuid_data); + if (ret) { + TEST_FAIL("KVM_GET_SUPPORTED_CPUID failed %d %d\n", + ret, errno); + cpuid_data.cpuid.nent = 0; + return cpuid_data; + } + + for (i = 0; i < KVM_MAX_CPUID_ENTRIES; i++) { + struct kvm_cpuid_entry2 *e = &cpuid_data.entries[i]; + + /* TDX doesn't support LBR and AMX features yet. + * Disable those bits from the XCR0 register. + */ + if (e->function == 0xd && (e->index == 0)) { + e->eax &= ~XFEATURE_MASK_LBR; + e->eax &= ~XFEATURE_MASK_XTILE; + } + } + + return cpuid_data; +} + +/* + * Initialize a VM as a TD. + * + */ +void initialize_td(struct kvm_vm *vm) +{ + struct tdx_cpuid_data cpuid_data; + int rc; + + /* No guest VMM controlled cpuid information yet. */ + struct kvm_tdx_init_vm init_vm; + + rc = kvm_check_cap(KVM_CAP_X2APIC_API); + TEST_ASSERT(rc, "TDX: KVM_CAP_X2APIC_API is not supported!"); + rc = kvm_check_cap(KVM_CAP_SPLIT_IRQCHIP); + TEST_ASSERT(rc, "TDX: KVM_CAP_SPLIT_IRQCHIP is not supported!"); + + vm_enable_cap(vm, KVM_CAP_X2APIC_API, + KVM_X2APIC_API_USE_32BIT_IDS | + KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK); + vm_enable_cap(vm, KVM_CAP_SPLIT_IRQCHIP, 24); + + /* Allocate and setup memoryfor the td guest. */ + vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS, + TDX_GUEST_PT_FIXED_ADDR, + 0, TDX_GUEST_MAX_NR_PAGES, 0); + + memset(&init_vm, 0, sizeof(init_vm)); + + cpuid_data = get_tdx_cpuid_data(vm); + + init_vm.max_vcpus = 1; + init_vm.attributes = 0; + memcpy(&init_vm.cpuid, &cpuid_data, sizeof(cpuid_data)); + tdx_ioctl(vm->fd, KVM_TDX_INIT_VM, 0, &init_vm); +} + + +void initialize_td_vcpu(struct kvm_vcpu *vcpu) +{ + struct tdx_cpuid_data cpuid_data; + + cpuid_data = get_tdx_cpuid_data(vcpu->vm); + vcpu_init_cpuid(vcpu, (struct kvm_cpuid2 *) &cpuid_data); + tdx_ioctl(vcpu->fd, KVM_TDX_INIT_VCPU, 0, NULL); +} + +void add_td_memory(struct kvm_vm *vm, void *source_pages, + uint64_t gpa, int size) +{ + struct kvm_tdx_init_mem_region mem_region = { + .source_addr = (uint64_t)source_pages, + .gpa = gpa, + .nr_pages = size / PAGE_SIZE, + }; + uint32_t metadata = KVM_TDX_MEASURE_MEMORY_REGION; + + TEST_ASSERT((mem_region.nr_pages > 0) && + ((mem_region.nr_pages * PAGE_SIZE) == size), + "Cannot add partial pages to the guest memory.\n"); + TEST_ASSERT(((uint64_t)source_pages & (PAGE_SIZE - 1)) == 0, + "Source memory buffer is not page aligned\n"); + tdx_ioctl(vm->fd, KVM_TDX_INIT_MEM_REGION, metadata, &mem_region); +} + +void finalize_td_memory(struct kvm_vm *vm) +{ + tdx_ioctl(vm->fd, KVM_TDX_FINALIZE_VM, 0, NULL); +} + +void build_gdtr_table(void *gdtr_target, void *gdt_target) +{ + uint64_t gdt_table[] = { + GDT_ENTRY(0, 0, 0), // NULL_SEL + GDT_ENTRY(0xc093, 0, 0xfffff), // LINEAR_DATA32_SEL + GDT_ENTRY(0xc09b, 0, 0xfffff), // LINEAR_CODE32_SEL + GDT_ENTRY(0, 0, 0), // NULL_SEL + GDT_ENTRY(0, 0, 0), // NULL_SEL + GDT_ENTRY(0, 0, 0), // NULL_SEL + GDT_ENTRY(0, 0, 0), // NULL_SEL + GDT_ENTRY(0xa09b, 0, 0xfffff) // LINEAR_CODE64_SEL + }; + + struct tdx_gdtr gdtr; + + gdtr.limit = sizeof(gdt_table) - 1; + gdtr.base = TDX_GUEST_GDTR_BASE; + + memcpy(gdt_target, gdt_table, sizeof(gdt_table)); + memcpy(gdtr_target, &gdtr, sizeof(gdtr)); +} + + +/* + * Constructing 1:1 mapping for the lowest 4GB address space using 2MB pages + * which will be used by the TDX guest when paging is enabled. + * TODO: use virt_pg_map() functions to dynamically allocate the page tables. + */ +void build_page_tables(void *pt_target, uint64_t pml4_base_address) +{ + uint64_t i; + struct page_table *pt; + + pt = malloc(sizeof(struct page_table)); + TEST_ASSERT(pt != NULL, "Could not allocate memory for page tables!\n"); + memset((void *) &(pt->pml4[0]), 0, sizeof(pt->pml4)); + memset((void *) &(pt->pdpt[0]), 0, sizeof(pt->pdpt)); + for (i = 0; i < 4; i++) + memset((void *) &(pt->pd[i][0]), 0, sizeof(pt->pd[i])); + + pt->pml4[0] = (pml4_base_address + PAGE_SIZE) | + _PAGE_PRESENT | _PAGE_RW; + for (i = 0; i < 4; i++) + pt->pdpt[i] = (pml4_base_address + (i + 2) * PAGE_SIZE) | + _PAGE_PRESENT | _PAGE_RW; + + uint64_t *pde = &(pt->pd[0][0]); + + for (i = 0; i < sizeof(pt->pd) / sizeof(pt->pd[0][0]); i++, pde++) + *pde = (i << 21) | _PAGE_PRESENT | _PAGE_RW | _PAGE_PS; + memcpy(pt_target, pt, 6 * PAGE_SIZE); +} + +static void +__attribute__((__flatten__, section("guest_boot_section"))) guest_boot(void) +{ + asm volatile(" .code32\n\t;" + "main_32:\n\t;" + " cli\n\t;" + " movl $" __stringify(TDX_GUEST_STACK_BASE) ", %%esp\n\t;" + " movl $" __stringify(TDX_GUEST_GDTR_ADDR) ", %%eax\n\t;" + " lgdt (%%eax)\n\t;" + " movl $0x660, %%eax\n\t;" + " movl %%eax, %%cr4\n\t;" + " movl $" __stringify(TDX_GUEST_PT_FIXED_ADDR) ", %%eax\n\t;" + " movl %%eax, %%cr3\n\t;" + " movl $0x80000023, %%eax\n\t;" + " movl %%eax, %%cr0\n\t;" + " ljmp $" __stringify(TDX_GUEST_LINEAR_CODE64_SEL) + ", $" __stringify(TDX_GUEST_CODE_ENTRY) "\n\t;" + /* + * This is where the CPU will start running. + * Do not remove any int3 instruction below. + */ + "reset_vector:\n\t;" + " jmp main_32\n\t;" + " int3\n\t;" + " int3\n\t;" + " int3\n\t;" + " int3\n\t;" + " int3\n\t;" + " int3\n\t;" + " int3\n\t;" + " int3\n\t;" + " int3\n\t;" + " int3\n\t;" + " int3\n\t;" + " int3\n\t;" + " int3\n\t;" + " int3\n\t;" + ".code64\n\t" + :::"rax"); +} + +extern char *__start_guest_boot_section; +extern char *__stop_guest_boot_section; +#define GUEST_BOOT_SIZE ((uint64_t)&__stop_guest_boot_section -\ + (uint64_t)&__start_guest_boot_section) + +/* + * Copies the guest code to the guest image. If signature value is not 0, it + * will verify that the guest code ends with the signature provided. We might + * need to check the signature to prevent compiler to add additional instruction + * to the end of the guest code which might create problems in some cases ie + * when copying code for resetvector. + */ +void copy_guest_code(void *target, void *guest_function, size_t code_size, + uint64_t signature) +{ + uint64_t *end; + + TEST_ASSERT((target != NULL) && (guest_function != NULL) && + (code_size > 0), "Invalid inputs to copy guest code\n"); + if (signature) { + while (code_size >= sizeof(signature)) { + end = guest_function + code_size - sizeof(signature); + if (*end == signature) + break; + /* Trimming the unwanted code at the end added by + * compiler. We need to add nop instruction to the + * begginning of the buffer to make sure that the guest + * code is aligned from the bottom and top as expected + * based on the original code size. This is important + * for reset vector which is copied to the bottom of + * the first 4GB memory. + */ + code_size--; + *(unsigned char *)target = 0x90; + target++; + } + TEST_ASSERT(code_size >= sizeof(signature), + "Guest code does not end with the signature: %lx\n" + , signature); + } + + memcpy(target, guest_function, code_size); +} + +void prepare_source_image(struct kvm_vm *vm, void *guest_code, + size_t guest_code_size, uint64_t guest_code_signature) +{ + void *source_mem, *pt_address, *code_address, *gdtr_address, + *gdt_address, *guest_code_base; + int number_of_pages; + + number_of_pages = (GUEST_BOOT_SIZE + guest_code_size) / PAGE_SIZE + 1 + + TDX_GUEST_NR_PT_PAGES + TDX_GUEST_STACK_NR_PAGES; + TEST_ASSERT(number_of_pages < TDX_GUEST_MAX_NR_PAGES, + "Initial image does not fit to the memory"); + + source_mem = memalign(PAGE_SIZE, + (TDX_GUEST_MAX_NR_PAGES * PAGE_SIZE)); + TEST_ASSERT(source_mem != NULL, + "Could not allocate memory for guest image\n"); + + pt_address = source_mem; + gdtr_address = source_mem + (TDX_GUEST_NR_PT_PAGES * PAGE_SIZE); + gdt_address = gdtr_address + PAGE_SIZE; + code_address = source_mem + (TDX_GUEST_MAX_NR_PAGES * PAGE_SIZE) - + GUEST_BOOT_SIZE; + guest_code_base = gdt_address + (TDX_GUEST_STACK_NR_PAGES * + PAGE_SIZE); + + build_page_tables(pt_address, TDX_GUEST_PT_FIXED_ADDR); + build_gdtr_table(gdtr_address, gdt_address); + + /* reset vector code should end with int3 instructions. + * The unused bytes at the reset vector with int3 to trigger triple + * fault shutdown if the guest manages to get into the unused code. + * Using the last 8 int3 instruction as a signature to find the function + * end offset for guest boot code that includes the instructions for + * reset vector. + * TODO: Using signature to find the exact size is a little strange but + * compiler might add additional bytes to the end of the function which + * makes it hard to calculate the offset addresses correctly. + * Alternatively, we can construct the jmp instruction for the reset + * vector manually to prevent any offset mismatch when copying the + * compiler generated code. + */ + copy_guest_code(code_address, guest_boot, GUEST_BOOT_SIZE, + EIGHT_INT3_INSTRUCTIONS); + if (guest_code) + copy_guest_code(guest_code_base, guest_code, guest_code_size, + guest_code_signature); + + add_td_memory(vm, source_mem, TDX_GUEST_PT_FIXED_ADDR, + (TDX_GUEST_MAX_NR_PAGES * PAGE_SIZE)); + free(source_mem); +}

The test checks report_fatal_error functionality.

Signed-off-by: Sagi Shahar sagis@google.com --- tools/testing/selftests/kvm/lib/x86_64/tdx.h | 17 ++++++ .../selftests/kvm/x86_64/tdx_vm_tests.c | 55 +++++++++++++++++++ 2 files changed, 72 insertions(+)

diff --git a/tools/testing/selftests/kvm/lib/x86_64/tdx.h b/tools/testing/selftests/kvm/lib/x86_64/tdx.h index d5de52657112..351ece3e80e2 100644 --- a/tools/testing/selftests/kvm/lib/x86_64/tdx.h +++ b/tools/testing/selftests/kvm/lib/x86_64/tdx.h @@ -51,6 +51,7 @@ #define _PAGE_RW (1UL<<1) /* writeable */ #define _PAGE_PS (1UL<<7) /* page size bit*/

+#define TDX_REPORT_FATAL_ERROR 0x10003 #define TDX_INSTRUCTION_IO 30

#define TDX_SUCCESS_PORT 0x30 @@ -212,6 +213,22 @@ static inline void tdvmcall_success(void) tdvmcall_io(TDX_SUCCESS_PORT, /*size=*/4, TDX_IO_WRITE, &code); }

+/* + * Report an error to user space. + * data_gpa may point to an optional shared guest memory holding the error string. + * Return value from tdvmcall is ignored since execution is not expected to + * continue beyond this point. + */ +static inline void tdvmcall_fatal(uint64_t error_code) +{ + struct kvm_regs regs; + + memset(&regs, 0, sizeof(regs)); + regs.r11 = TDX_REPORT_FATAL_ERROR; + regs.r12 = error_code; + regs.rcx = 0x1C00; + tdcall(&regs); +}

#define TDX_FUNCTION_SIZE(name) ((uint64_t)&__stop_sec_ ## name -\ (uint64_t)&__start_sec_ ## name) \ diff --git a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c index 590e45aa7570..1db5400ca5ef 100644 --- a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c +++ b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c @@ -91,6 +91,60 @@ void verify_td_lifecycle(void) printf("\t ... PASSED\n"); }

+/* + * Verifies TDX_REPORT_FATAL_ERROR functionality. + */ +TDX_GUEST_FUNCTION(guest_code_report_fatal_error) +{ + uint64_t err; + /* Note: err should follow the GHCI spec definition: + * bits 31:0 should be set to 0. + * bits 62:32 are used for TD-specific extended error code. + * bit 63 is used to mark additional information in shared memory. + */ + err = 0x0BAAAAAD00000000; + + if (err) + tdvmcall_fatal(err); + + tdvmcall_success(); +} + +void verify_report_fatal_error(void) +{ + struct kvm_vcpu *vcpu; + struct kvm_vm *vm; + + printf("Verifying report_fatal_error:\n"); + /* Create a TD VM with no memory.*/ + vm = vm_create_tdx(); + + /* Allocate TD guest memory and initialize the TD.*/ + initialize_td(vm); + + /* Initialize the TD vcpu and copy the test code to the guest memory.*/ + vcpu = vm_vcpu_add_tdx(vm, 0); + + /* Setup and initialize VM memory */ + prepare_source_image(vm, guest_code_report_fatal_error, + TDX_FUNCTION_SIZE(guest_code_report_fatal_error), + 0); + finalize_td_memory(vm); + + vcpu_run(vcpu); + ASSERT_EQ(vcpu->run->exit_reason, KVM_EXIT_SYSTEM_EVENT); + ASSERT_EQ(vcpu->run->system_event.ndata, 3); + ASSERT_EQ(vcpu->run->system_event.data[0], TDX_REPORT_FATAL_ERROR); + ASSERT_EQ(vcpu->run->system_event.data[1], 0x0BAAAAAD00000000); + ASSERT_EQ(vcpu->run->system_event.data[2], 0); + + vcpu_run(vcpu); + CHECK_GUEST_COMPLETION(vcpu); + + kvm_vm_free(vm); + printf("\t ... PASSED\n"); +} + int main(int argc, char **argv) { if (!is_tdx_enabled()) { @@ -99,6 +153,7 @@ int main(int argc, char **argv) }

run_in_new_process(&verify_td_lifecycle); + run_in_new_process(&verify_report_fatal_error);

return 0; }

The test reads CPUID values from inside a TD VM and compare them to expected values.

The test targets CPUID values which are virtualized as "As Configured", "As Configured (if Native)", "Calculated", "Fixed" and "Native" according to the TDX spec.

Signed-off-by: Sagi Shahar sagis@google.com --- tools/testing/selftests/kvm/lib/x86_64/tdx.h | 13 ++ .../selftests/kvm/x86_64/tdx_vm_tests.c | 132 ++++++++++++++++++ 2 files changed, 145 insertions(+)

diff --git a/tools/testing/selftests/kvm/lib/x86_64/tdx.h b/tools/testing/selftests/kvm/lib/x86_64/tdx.h index c78dba1af14f..a28d15417d3e 100644 --- a/tools/testing/selftests/kvm/lib/x86_64/tdx.h +++ b/tools/testing/selftests/kvm/lib/x86_64/tdx.h @@ -56,6 +56,7 @@

#define TDX_SUCCESS_PORT 0x30 #define TDX_TEST_PORT 0x31 +#define TDX_DATA_REPORT_PORT 0x32 #define TDX_IO_READ 0 #define TDX_IO_WRITE 1

@@ -231,6 +232,18 @@ static inline void tdvmcall_fatal(uint64_t error_code) tdcall(&regs); }

+/* + * Reports a 32 bit value from the guest to user space using a TDVM IO call. + * Data is reported on port TDX_DATA_REPORT_PORT. + */ +static inline uint64_t tdvm_report_to_user_space(uint32_t data) +{ + // Need to upcast data to match tdvmcall_io signature. + uint64_t data_64 = data; + + return tdvmcall_io(TDX_DATA_REPORT_PORT, /*size=*/4, TDX_IO_WRITE, &data_64); +} + #define TDX_FUNCTION_SIZE(name) ((uint64_t)&__stop_sec_ ## name -\ (uint64_t)&__start_sec_ ## name) \

diff --git a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c index a93629cfd13f..3f51f936ea5a 100644 --- a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c +++ b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c @@ -77,6 +77,27 @@ bool is_tdx_enabled(void) return !!(kvm_check_cap(KVM_CAP_VM_TYPES) & BIT(KVM_X86_TDX_VM)); }

+/* + * Find a specific CPUID entry. + */ +static struct kvm_cpuid_entry2 * +find_cpuid_entry(struct tdx_cpuid_data cpuid_data, uint32_t function, + uint32_t index) +{ + struct kvm_cpuid_entry2 *e; + int i; + + for (i = 0; i < cpuid_data.cpuid.nent; i++) { + e = &cpuid_data.entries[i]; + + if (e->function == function && + (e->index == index || + !(e->flags & KVM_CPUID_FLAG_SIGNIFCANT_INDEX))) + return e; + } + return NULL; +} + /* * Do a dummy io exit to verify that the TD has been initialized correctly and * guest can run some code inside. @@ -251,6 +272,116 @@ void verify_td_ioexit(void) printf("\t ... PASSED\n"); }

+/* + * Verifies CPUID functionality by reading CPUID values in guest. The guest + * will then send the values to userspace using an IO write to be checked + * against the expected values. + */ +TDX_GUEST_FUNCTION(guest_code_cpuid) +{ + uint64_t err; + uint32_t eax, ebx, edx, ecx; + + // Read CPUID leaf 0x1. + cpuid(1, &eax, &ebx, &ecx, &edx); + + err = tdvm_report_to_user_space(ebx); + if (err) + tdvmcall_fatal(err); + + err = tdvm_report_to_user_space(ecx); + if (err) + tdvmcall_fatal(err); + + tdvmcall_success(); +} + +void verify_td_cpuid(void) +{ + struct kvm_vcpu *vcpu; + struct kvm_vm *vm; + uint32_t ebx, ecx; + struct kvm_cpuid_entry2 *cpuid_entry; + struct tdx_cpuid_data cpuid_data; + uint32_t guest_clflush_line_size; + uint32_t guest_max_addressable_ids, host_max_addressable_ids; + uint32_t guest_sse3_enabled; + uint32_t guest_fma_enabled; + uint32_t guest_initial_apic_id; + int ret; + + printf("Verifying TD CPUID:\n"); + /* Create a TD VM with no memory.*/ + vm = vm_create_tdx(); + + /* Allocate TD guest memory and initialize the TD.*/ + initialize_td(vm); + + /* Initialize the TD vcpu and copy the test code to the guest memory.*/ + vcpu = vm_vcpu_add_tdx(vm, 0); + + /* Setup and initialize VM memory */ + prepare_source_image(vm, guest_code_cpuid, + TDX_FUNCTION_SIZE(guest_code_cpuid), 0); + finalize_td_memory(vm); + + /* Wait for guest to report ebx value */ + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_IO(vcpu, TDX_DATA_REPORT_PORT, 4, TDX_IO_WRITE); + ebx = *(uint32_t *)((void *)vcpu->run + vcpu->run->io.data_offset); + + /* Wait for guest to report either ecx value or error */ + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_IO(vcpu, TDX_DATA_REPORT_PORT, 4, TDX_IO_WRITE); + ecx = *(uint32_t *)((void *)vcpu->run + vcpu->run->io.data_offset); + + /* Wait for guest to complete execution */ + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_GUEST_COMPLETION(vcpu); + + /* Verify the CPUID values we got from the guest. */ + printf("\t ... Verifying CPUID values from guest\n"); + + /* Get KVM CPUIDs for reference */ + memset(&cpuid_data, 0, sizeof(cpuid_data)); + cpuid_data.cpuid.nent = KVM_MAX_CPUID_ENTRIES; + ret = ioctl(vm->kvm_fd, KVM_GET_SUPPORTED_CPUID, &cpuid_data); + TEST_ASSERT(!ret, "KVM_GET_SUPPORTED_CPUID failed\n"); + cpuid_entry = find_cpuid_entry(cpuid_data, 1, 0); + TEST_ASSERT(cpuid_entry, "CPUID entry missing\n"); + + host_max_addressable_ids = (cpuid_entry->ebx >> 16) & 0xFF; + + guest_sse3_enabled = ecx & 0x1; // Native + guest_clflush_line_size = (ebx >> 8) & 0xFF; // Fixed + guest_max_addressable_ids = (ebx >> 16) & 0xFF; // As Configured + guest_fma_enabled = (ecx >> 12) & 0x1; // As Configured (if Native) + guest_initial_apic_id = (ebx >> 24) & 0xFF; // Calculated + + ASSERT_EQ(guest_sse3_enabled, 1); + ASSERT_EQ(guest_clflush_line_size, 8); + ASSERT_EQ(guest_max_addressable_ids, host_max_addressable_ids); + + /* TODO: This only tests the native value. To properly test + * "As Configured (if Native)" we need to override this value + * in the TD params + */ + ASSERT_EQ(guest_fma_enabled, 1); + + /* TODO: guest_initial_apic_id is calculated based on the number of + * VCPUs in the TD. From the spec: "Virtual CPU index, starting from 0 + * and allocated sequentially on each successful TDH.VP.INIT" + * To test non-trivial values we either need a TD with multiple VCPUs + * or to pick a different calculated value. + */ + ASSERT_EQ(guest_initial_apic_id, 0); + + kvm_vm_free(vm); + printf("\t ... PASSED\n"); +}

int main(int argc, char **argv) { @@ -262,6 +393,7 @@ int main(int argc, char **argv) run_in_new_process(&verify_td_lifecycle); run_in_new_process(&verify_report_fatal_error); run_in_new_process(&verify_td_ioexit); + run_in_new_process(&verify_td_cpuid);

return 0; }

The test verifies IO writes of various sizes from the guest to the host.

Google-Bug-Id: 235407183

Signed-off-by: Sagi Shahar sagis@google.com --- tools/testing/selftests/kvm/lib/x86_64/tdx.h | 3 + .../selftests/kvm/x86_64/tdx_vm_tests.c | 85 +++++++++++++++++++ 2 files changed, 88 insertions(+)

diff --git a/tools/testing/selftests/kvm/lib/x86_64/tdx.h b/tools/testing/selftests/kvm/lib/x86_64/tdx.h index 39b000118e26..f1f44c2ad40e 100644 --- a/tools/testing/selftests/kvm/lib/x86_64/tdx.h +++ b/tools/testing/selftests/kvm/lib/x86_64/tdx.h @@ -51,6 +51,9 @@ #define _PAGE_RW (1UL<<1) /* writeable */ #define _PAGE_PS (1UL<<7) /* page size bit*/

+#define TDX_VMCALL_SUCCESS 0x0000000000000000 +#define TDX_VMCALL_INVALID_OPERAND 0x8000000000000000 + #define TDX_GET_TD_VM_CALL_INFO 0x10000 #define TDX_REPORT_FATAL_ERROR 0x10003 #define TDX_INSTRUCTION_IO 30 diff --git a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c index cf8260db1f5b..ee60f77fe38e 100644 --- a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c +++ b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c @@ -489,6 +489,90 @@ void verify_get_td_vmcall_info(void) printf("\t ... PASSED\n"); }

+/* + * Verifies IO functionality by writing values of different sizes + * to the host. + */ +TDX_GUEST_FUNCTION(guest_io_writes) +{ + uint64_t byte_1 = 0xAB; + uint64_t byte_2 = 0xABCD; + uint64_t byte_4 = 0xFFABCDEF; + uint64_t ret; + + ret = tdvmcall_io(TDX_TEST_PORT, 1, TDX_IO_WRITE, &byte_1); + if (ret) + tdvmcall_fatal(ret); + + ret = tdvmcall_io(TDX_TEST_PORT, 2, TDX_IO_WRITE, &byte_2); + if (ret) + tdvmcall_fatal(ret); + + ret = tdvmcall_io(TDX_TEST_PORT, 4, TDX_IO_WRITE, &byte_4); + if (ret) + tdvmcall_fatal(ret); + + // Write an invalid number of bytes. + ret = tdvmcall_io(TDX_TEST_PORT, 5, TDX_IO_WRITE, &byte_4); + if (ret) + tdvmcall_fatal(ret); + + tdvmcall_success(); +} + +void verify_guest_writes(void) +{ + struct kvm_vcpu *vcpu; + struct kvm_vm *vm; + uint8_t byte_1; + uint16_t byte_2; + uint32_t byte_4; + + printf("Verifying guest writes:\n"); + /* Create a TD VM with no memory.*/ + vm = vm_create_tdx(); + + /* Allocate TD guest memory and initialize the TD.*/ + initialize_td(vm); + + /* Initialize the TD vcpu and copy the test code to the guest memory.*/ + vcpu = vm_vcpu_add_tdx(vm, 0); + + /* Setup and initialize VM memory */ + prepare_source_image(vm, guest_io_writes, + TDX_FUNCTION_SIZE(guest_io_writes), 0); + finalize_td_memory(vm); + + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_IO(vcpu, TDX_TEST_PORT, 1, TDX_IO_WRITE); + byte_1 = *(uint8_t *)((void *)vcpu->run + vcpu->run->io.data_offset); + + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_IO(vcpu, TDX_TEST_PORT, 2, TDX_IO_WRITE); + byte_2 = *(uint16_t *)((void *)vcpu->run + vcpu->run->io.data_offset); + + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_IO(vcpu, TDX_TEST_PORT, 4, TDX_IO_WRITE); + byte_4 = *(uint32_t *)((void *)vcpu->run + vcpu->run->io.data_offset); + + ASSERT_EQ(byte_1, 0xAB); + ASSERT_EQ(byte_2, 0xABCD); + ASSERT_EQ(byte_4, 0xFFABCDEF); + + vcpu_run(vcpu); + ASSERT_EQ(vcpu->run->exit_reason, KVM_EXIT_SYSTEM_EVENT); + ASSERT_EQ(vcpu->run->system_event.data[1], TDX_VMCALL_INVALID_OPERAND); + + vcpu_run(vcpu); + CHECK_GUEST_COMPLETION(vcpu); + + kvm_vm_free(vm); + printf("\t ... PASSED\n"); +} + int main(int argc, char **argv) { if (!is_tdx_enabled()) { @@ -501,6 +585,7 @@ int main(int argc, char **argv) run_in_new_process(&verify_td_ioexit); run_in_new_process(&verify_td_cpuid); run_in_new_process(&verify_get_td_vmcall_info); + run_in_new_process(&verify_guest_writes);

return 0; }

The test verifies reads and writes for MSR registers with different access level.

Signed-off-by: Sagi Shahar sagis@google.com --- tools/testing/selftests/kvm/lib/x86_64/tdx.h | 34 +++ .../selftests/kvm/x86_64/tdx_vm_tests.c | 229 ++++++++++++++++++ 2 files changed, 263 insertions(+)

diff --git a/tools/testing/selftests/kvm/lib/x86_64/tdx.h b/tools/testing/selftests/kvm/lib/x86_64/tdx.h index f1f44c2ad40e..263834979727 100644 --- a/tools/testing/selftests/kvm/lib/x86_64/tdx.h +++ b/tools/testing/selftests/kvm/lib/x86_64/tdx.h @@ -57,6 +57,8 @@ #define TDX_GET_TD_VM_CALL_INFO 0x10000 #define TDX_REPORT_FATAL_ERROR 0x10003 #define TDX_INSTRUCTION_IO 30 +#define TDX_INSTRUCTION_RDMSR 31 +#define TDX_INSTRUCTION_WRMSR 32

#define TDX_SUCCESS_PORT 0x30 #define TDX_TEST_PORT 0x31 @@ -258,6 +260,38 @@ static inline uint64_t tdvmcall_get_td_vmcall_info(uint64_t *r11, uint64_t *r12, return regs.r10; }

+/* + * Read MSR register. + */ +static inline uint64_t tdvmcall_rdmsr(uint64_t index, uint64_t *ret_value) +{ + struct kvm_regs regs; + + memset(&regs, 0, sizeof(regs)); + regs.r11 = TDX_INSTRUCTION_RDMSR; + regs.r12 = index; + regs.rcx = 0x1C00; + tdcall(&regs); + *ret_value = regs.r11; + return regs.r10; +} + +/* + * Write MSR register. + */ +static inline uint64_t tdvmcall_wrmsr(uint64_t index, uint64_t value) +{ + struct kvm_regs regs; + + memset(&regs, 0, sizeof(regs)); + regs.r11 = TDX_INSTRUCTION_WRMSR; + regs.r12 = index; + regs.r13 = value; + regs.rcx = 0x3C00; + tdcall(&regs); + return regs.r10; +} + /* * Reports a 32 bit value from the guest to user space using a TDVM IO call. * Data is reported on port TDX_DATA_REPORT_PORT. diff --git a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c index 85b5ab99424e..fb3b8de7e5cd 100644 --- a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c +++ b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c @@ -55,6 +55,40 @@ (VCPU)->run->system_event.data[1]); \ } while (0)

+ +/* + * Define a filter which denies all MSR access except the following: + * MTTR_BASE_0: Allow read/write access + * MTTR_BASE_1: Allow read access + * MTTR_BASE_2: Allow write access + */ +static u64 allow_bits = 0xFFFFFFFFFFFFFFFF; +#define MTTR_BASE_0 (0x200) +#define MTTR_BASE_1 (0x202) +#define MTTR_BASE_2 (0x204) +struct kvm_msr_filter test_filter = { + .flags = KVM_MSR_FILTER_DEFAULT_DENY, + .ranges = { + { + .flags = KVM_MSR_FILTER_READ | + KVM_MSR_FILTER_WRITE, + .nmsrs = 1, + .base = MTTR_BASE_0, + .bitmap = (uint8_t *)&allow_bits, + }, { + .flags = KVM_MSR_FILTER_READ, + .nmsrs = 1, + .base = MTTR_BASE_1, + .bitmap = (uint8_t *)&allow_bits, + }, { + .flags = KVM_MSR_FILTER_WRITE, + .nmsrs = 1, + .base = MTTR_BASE_2, + .bitmap = (uint8_t *)&allow_bits, + }, + }, +}; + static uint64_t read_64bit_from_guest(struct kvm_vcpu *vcpu, uint64_t port) { uint32_t lo, hi; @@ -656,6 +690,199 @@ void verify_guest_reads(void) printf("\t ... PASSED\n"); }

+/* + * Verifies MSR read functionality. + */ +TDX_GUEST_FUNCTION(guest_msr_read) +{ + uint64_t data; + uint64_t ret; + + ret = tdvmcall_rdmsr(MTTR_BASE_0, &data); + if (ret) + tdvmcall_fatal(ret); + + ret = tdvm_report_64bit_to_user_space(data); + if (ret) + tdvmcall_fatal(ret); + + ret = tdvmcall_rdmsr(MTTR_BASE_1, &data); + if (ret) + tdvmcall_fatal(ret); + + ret = tdvm_report_64bit_to_user_space(data); + if (ret) + tdvmcall_fatal(ret); + + /* We expect this call to fail since MTTR_BASE_2 is write only */ + ret = tdvmcall_rdmsr(MTTR_BASE_2, &data); + if (ret) { + ret = tdvm_report_64bit_to_user_space(ret); + if (ret) + tdvmcall_fatal(ret); + } else { + tdvmcall_fatal(-99); + } + + tdvmcall_success(); +} + +void verify_guest_msr_reads(void) +{ + struct kvm_vcpu *vcpu; + struct kvm_vm *vm; + uint64_t data; + int ret; + + printf("Verifying guest msr reads:\n"); + + /* Create a TD VM with no memory.*/ + vm = vm_create_tdx(); + + /* Set explicit MSR filter map to control access to the MSR registers + * used in the test. + */ + printf("\t ... Setting test MSR filter\n"); + ret = kvm_check_cap(KVM_CAP_X86_USER_SPACE_MSR); + TEST_ASSERT(ret, "KVM_CAP_X86_USER_SPACE_MSR is unavailable"); + vm_enable_cap(vm, KVM_CAP_X86_USER_SPACE_MSR, KVM_MSR_EXIT_REASON_FILTER); + + ret = kvm_check_cap(KVM_CAP_X86_MSR_FILTER); + TEST_ASSERT(ret, "KVM_CAP_X86_MSR_FILTER is unavailable"); + + ret = ioctl(vm->fd, KVM_X86_SET_MSR_FILTER, &test_filter); + TEST_ASSERT(ret == 0, + "KVM_X86_SET_MSR_FILTER failed, ret: %i errno: %i (%s)", + ret, errno, strerror(errno)); + + /* Allocate TD guest memory and initialize the TD.*/ + initialize_td(vm); + + /* Initialize the TD vcpu and copy the test code to the guest memory.*/ + vcpu = vm_vcpu_add_tdx(vm, 0); + + /* Setup and initialize VM memory */ + prepare_source_image(vm, guest_msr_read, + TDX_FUNCTION_SIZE(guest_msr_read), 0); + finalize_td_memory(vm); + + printf("\t ... Setting test MTTR values\n"); + /* valid values for mttr type are 0, 1, 4, 5, 6 */ + vcpu_set_msr(vcpu, MTTR_BASE_0, 4); + vcpu_set_msr(vcpu, MTTR_BASE_1, 5); + vcpu_set_msr(vcpu, MTTR_BASE_2, 6); + + printf("\t ... Running guest\n"); + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + data = read_64bit_from_guest(vcpu, TDX_DATA_REPORT_PORT); + ASSERT_EQ(data, 4); + + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + data = read_64bit_from_guest(vcpu, TDX_DATA_REPORT_PORT); + ASSERT_EQ(data, 5); + + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + data = read_64bit_from_guest(vcpu, TDX_DATA_REPORT_PORT); + ASSERT_EQ(data, TDX_VMCALL_INVALID_OPERAND); + + vcpu_run(vcpu); + CHECK_GUEST_COMPLETION(vcpu); + + kvm_vm_free(vm); + printf("\t ... PASSED\n"); +} + +/* + * Verifies MSR write functionality. + */ +TDX_GUEST_FUNCTION(guest_msr_write) +{ + uint64_t ret; + + ret = tdvmcall_wrmsr(MTTR_BASE_0, 4); + if (ret) + tdvmcall_fatal(ret); + + /* We expect this call to fail since MTTR_BASE_1 is read only */ + ret = tdvmcall_wrmsr(MTTR_BASE_1, 5); + if (ret) { + ret = tdvm_report_64bit_to_user_space(ret); + if (ret) + tdvmcall_fatal(ret); + } else { + tdvmcall_fatal(-99); + } + + + ret = tdvmcall_wrmsr(MTTR_BASE_2, 6); + if (ret) + tdvmcall_fatal(ret); + + tdvmcall_success(); +} + +void verify_guest_msr_writes(void) +{ + struct kvm_vcpu *vcpu; + struct kvm_vm *vm; + uint64_t data; + int ret; + + printf("Verifying guest msr writes:\n"); + + /* Create a TD VM with no memory.*/ + vm = vm_create_tdx(); + + /* Set explicit MSR filter map to control access to the MSR registers + * used in the test. + */ + printf("\t ... Setting test MSR filter\n"); + ret = kvm_check_cap(KVM_CAP_X86_USER_SPACE_MSR); + TEST_ASSERT(ret, "KVM_CAP_X86_USER_SPACE_MSR is unavailable"); + vm_enable_cap(vm, KVM_CAP_X86_USER_SPACE_MSR, KVM_MSR_EXIT_REASON_FILTER); + + ret = kvm_check_cap(KVM_CAP_X86_MSR_FILTER); + TEST_ASSERT(ret, "KVM_CAP_X86_MSR_FILTER is unavailable"); + + ret = ioctl(vm->fd, KVM_X86_SET_MSR_FILTER, &test_filter); + TEST_ASSERT(ret == 0, + "KVM_X86_SET_MSR_FILTER failed, ret: %i errno: %i (%s)", + ret, errno, strerror(errno)); + + /* Allocate TD guest memory and initialize the TD.*/ + initialize_td(vm); + + /* Initialize the TD vcpu and copy the test code to the guest memory.*/ + vcpu = vm_vcpu_add_tdx(vm, 0); + + /* Setup and initialize VM memory */ + prepare_source_image(vm, guest_msr_write, + TDX_FUNCTION_SIZE(guest_msr_write), 0); + finalize_td_memory(vm); + + printf("\t ... Running guest\n"); + /* Only the write to MTTR_BASE_1 should trigger an exit */ + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + data = read_64bit_from_guest(vcpu, TDX_DATA_REPORT_PORT); + ASSERT_EQ(data, TDX_VMCALL_INVALID_OPERAND); + + vcpu_run(vcpu); + CHECK_GUEST_COMPLETION(vcpu); + + printf("\t ... Verifying MTTR values writen by guest\n"); + + ASSERT_EQ(vcpu_get_msr(vcpu, MTTR_BASE_0), 4); + ASSERT_EQ(vcpu_get_msr(vcpu, MTTR_BASE_1), 0); + ASSERT_EQ(vcpu_get_msr(vcpu, MTTR_BASE_2), 6); + + kvm_vm_free(vm); + printf("\t ... PASSED\n"); +} + int main(int argc, char **argv) { if (!is_tdx_enabled()) { @@ -670,6 +897,8 @@ int main(int argc, char **argv) run_in_new_process(&verify_get_td_vmcall_info); run_in_new_process(&verify_guest_writes); run_in_new_process(&verify_guest_reads); + run_in_new_process(&verify_guest_msr_reads); + run_in_new_process(&verify_guest_msr_writes);

return 0; }

The test verifies MMIO reads of various sizes from the host to the guest.

Signed-off-by: Sagi Shahar sagis@google.com --- tools/testing/selftests/kvm/lib/x86_64/tdx.h | 21 ++++ .../selftests/kvm/x86_64/tdx_vm_tests.c | 113 ++++++++++++++++++ 2 files changed, 134 insertions(+)

diff --git a/tools/testing/selftests/kvm/lib/x86_64/tdx.h b/tools/testing/selftests/kvm/lib/x86_64/tdx.h index b11200028546..7045d617dd78 100644 --- a/tools/testing/selftests/kvm/lib/x86_64/tdx.h +++ b/tools/testing/selftests/kvm/lib/x86_64/tdx.h @@ -60,12 +60,15 @@ #define TDX_INSTRUCTION_IO 30 #define TDX_INSTRUCTION_RDMSR 31 #define TDX_INSTRUCTION_WRMSR 32 +#define TDX_INSTRUCTION_VE_REQUEST_MMIO 48

#define TDX_SUCCESS_PORT 0x30 #define TDX_TEST_PORT 0x31 #define TDX_DATA_REPORT_PORT 0x32 #define TDX_IO_READ 0 #define TDX_IO_WRITE 1 +#define TDX_MMIO_READ 0 +#define TDX_MMIO_WRITE 1

#define GDT_ENTRY(flags, base, limit) \ ((((base) & 0xff000000ULL) << (56-24)) | \ @@ -308,6 +311,24 @@ static inline uint64_t tdvmcall_hlt(uint64_t interrupt_blocked_flag) return regs.r10; }

+/* + * Execute MMIO request instruction for read. + */ +static inline uint64_t tdvmcall_mmio_read(uint64_t address, uint64_t size, uint64_t *data_out) +{ + struct kvm_regs regs; + + memset(&regs, 0, sizeof(regs)); + regs.r11 = TDX_INSTRUCTION_VE_REQUEST_MMIO; + regs.r12 = size; + regs.r13 = TDX_MMIO_READ; + regs.r14 = address; + regs.rcx = 0x7C00; + tdcall(&regs); + *data_out = regs.r11; + return regs.r10; +} + /* * Reports a 32 bit value from the guest to user space using a TDVM IO call. * Data is reported on port TDX_DATA_REPORT_PORT. diff --git a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c index 39604aac54bd..963e4feae31a 100644 --- a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c +++ b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only

#include "asm/kvm.h" +#include "linux/kernel.h" #include <bits/stdint-uintn.h> #include <fcntl.h> #include <limits.h> @@ -47,6 +48,24 @@ (VCPU)->run->io.direction); \ } while (0)

+#define CHECK_MMIO(VCPU, ADDR, SIZE, DIR) \ + do { \ + TEST_ASSERT((VCPU)->run->exit_reason == KVM_EXIT_MMIO, \ + "Got exit_reason other than KVM_EXIT_MMIO: %u (%s)\n", \ + (VCPU)->run->exit_reason, \ + exit_reason_str((VCPU)->run->exit_reason)); \ + \ + TEST_ASSERT(((VCPU)->run->exit_reason == KVM_EXIT_MMIO) && \ + ((VCPU)->run->mmio.phys_addr == (ADDR)) && \ + ((VCPU)->run->mmio.len == (SIZE)) && \ + ((VCPU)->run->mmio.is_write == (DIR)), \ + "Got an unexpected MMIO exit values: %u (%s) %llu %d %d\n", \ + (VCPU)->run->exit_reason, \ + exit_reason_str((VCPU)->run->exit_reason), \ + (VCPU)->run->mmio.phys_addr, (VCPU)->run->mmio.len, \ + (VCPU)->run->mmio.is_write); \ + } while (0) + #define CHECK_GUEST_FAILURE(VCPU) \ do { \ if ((VCPU)->run->exit_reason == KVM_EXIT_SYSTEM_EVENT) \ @@ -89,6 +108,8 @@ struct kvm_msr_filter test_filter = { }, };

+#define MMIO_VALID_ADDRESS (TDX_GUEST_MAX_NR_PAGES * PAGE_SIZE + 1) + static uint64_t read_64bit_from_guest(struct kvm_vcpu *vcpu, uint64_t port) { uint32_t lo, hi; @@ -970,6 +991,97 @@ void verify_guest_hlt(void) _verify_guest_hlt(0); }

+TDX_GUEST_FUNCTION(guest_mmio_reads) +{ + uint64_t data; + uint64_t ret; + + ret = tdvmcall_mmio_read(MMIO_VALID_ADDRESS, 1, &data); + if (ret) + tdvmcall_fatal(ret); + if (data != 0x12) + tdvmcall_fatal(1); + + ret = tdvmcall_mmio_read(MMIO_VALID_ADDRESS, 2, &data); + if (ret) + tdvmcall_fatal(ret); + if (data != 0x1234) + tdvmcall_fatal(2); + + ret = tdvmcall_mmio_read(MMIO_VALID_ADDRESS, 4, &data); + if (ret) + tdvmcall_fatal(ret); + if (data != 0x12345678) + tdvmcall_fatal(4); + + ret = tdvmcall_mmio_read(MMIO_VALID_ADDRESS, 8, &data); + if (ret) + tdvmcall_fatal(ret); + if (data != 0x1234567890ABCDEF) + tdvmcall_fatal(8); + + // Read an invalid number of bytes. + ret = tdvmcall_mmio_read(MMIO_VALID_ADDRESS, 10, &data); + if (ret) + tdvmcall_fatal(ret); + + tdvmcall_success(); +} + +/* + * Varifies guest MMIO reads. + */ +void verify_mmio_reads(void) +{ + struct kvm_vcpu *vcpu; + struct kvm_vm *vm; + + printf("Verifying TD MMIO reads:\n"); + /* Create a TD VM with no memory.*/ + vm = vm_create_tdx(); + + /* Allocate TD guest memory and initialize the TD.*/ + initialize_td(vm); + + /* Initialize the TD vcpu and copy the test code to the guest memory.*/ + vcpu = vm_vcpu_add_tdx(vm, 0); + + /* Setup and initialize VM memory */ + prepare_source_image(vm, guest_mmio_reads, + TDX_FUNCTION_SIZE(guest_mmio_reads), 0); + finalize_td_memory(vm); + + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_MMIO(vcpu, MMIO_VALID_ADDRESS, 1, TDX_MMIO_READ); + *(uint8_t *)vcpu->run->mmio.data = 0x12; + + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_MMIO(vcpu, MMIO_VALID_ADDRESS, 2, TDX_MMIO_READ); + *(uint16_t *)vcpu->run->mmio.data = 0x1234; + + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_MMIO(vcpu, MMIO_VALID_ADDRESS, 4, TDX_MMIO_READ); + *(uint32_t *)vcpu->run->mmio.data = 0x12345678; + + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_MMIO(vcpu, MMIO_VALID_ADDRESS, 8, TDX_MMIO_READ); + *(uint64_t *)vcpu->run->mmio.data = 0x1234567890ABCDEF; + + vcpu_run(vcpu); + ASSERT_EQ(vcpu->run->exit_reason, KVM_EXIT_SYSTEM_EVENT); + ASSERT_EQ(vcpu->run->system_event.data[1], TDX_VMCALL_INVALID_OPERAND); + + vcpu_run(vcpu); + CHECK_GUEST_COMPLETION(vcpu); + + kvm_vm_free(vm); + printf("\t ... PASSED\n"); +} + int main(int argc, char **argv) { if (!is_tdx_enabled()) { @@ -987,6 +1099,7 @@ int main(int argc, char **argv) run_in_new_process(&verify_guest_msr_reads); run_in_new_process(&verify_guest_msr_writes); run_in_new_process(&verify_guest_hlt); + run_in_new_process(&verify_mmio_reads);

return 0; }

This test issues a CPUID TDVMCALL from inside the guest to get the CPUID values as seen by KVM.

Signed-off-by: Sagi Shahar sagis@google.com --- tools/testing/selftests/kvm/lib/x86_64/tdx.h | 23 ++++ .../selftests/kvm/x86_64/tdx_vm_tests.c | 102 ++++++++++++++++++ 2 files changed, 125 insertions(+)

diff --git a/tools/testing/selftests/kvm/lib/x86_64/tdx.h b/tools/testing/selftests/kvm/lib/x86_64/tdx.h index 17e3649e5729..3729543a05a3 100644 --- a/tools/testing/selftests/kvm/lib/x86_64/tdx.h +++ b/tools/testing/selftests/kvm/lib/x86_64/tdx.h @@ -56,6 +56,7 @@

#define TDX_GET_TD_VM_CALL_INFO 0x10000 #define TDX_REPORT_FATAL_ERROR 0x10003 +#define TDX_INSTRUCTION_CPUID 10 #define TDX_INSTRUCTION_HLT 12 #define TDX_INSTRUCTION_IO 30 #define TDX_INSTRUCTION_RDMSR 31 @@ -347,6 +348,28 @@ static inline uint64_t tdvmcall_mmio_write(uint64_t address, uint64_t size, uint return regs.r10; }

+/* + * Execute CPUID instruction. + */ +static inline uint64_t tdvmcall_cpuid(uint32_t eax, uint32_t ecx, + uint32_t *ret_eax, uint32_t *ret_ebx, + uint32_t *ret_ecx, uint32_t *ret_edx) +{ + struct kvm_regs regs; + + memset(&regs, 0, sizeof(regs)); + regs.r11 = TDX_INSTRUCTION_CPUID; + regs.r12 = eax; + regs.r13 = ecx; + regs.rcx = 0xFC00; + tdcall(&regs); + *ret_eax = regs.r12; + *ret_ebx = regs.r13; + *ret_ecx = regs.r14; + *ret_edx = regs.r15; + return regs.r10; +} + /* * Reports a 32 bit value from the guest to user space using a TDVM IO call. * Data is reported on port TDX_DATA_REPORT_PORT. diff --git a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c index 382119bd444b..934f2f7a5df9 100644 --- a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c +++ b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c @@ -459,6 +459,107 @@ void verify_td_cpuid(void) printf("\t ... PASSED\n"); }

+/* + * Verifies CPUID TDVMCALL functionality. + * The guest will then send the values to userspace using an IO write to be + * checked against the expected values. + */ +TDX_GUEST_FUNCTION(guest_code_cpuid_tdcall) +{ + uint64_t err; + uint32_t eax, ebx, ecx, edx; + + // Read CPUID leaf 0x1 from host. + err = tdvmcall_cpuid(/*eax=*/1, /*ecx=*/0, &eax, &ebx, &ecx, &edx); + if (err) + tdvmcall_fatal(err); + + err = tdvm_report_to_user_space(eax); + if (err) + tdvmcall_fatal(err); + + err = tdvm_report_to_user_space(ebx); + if (err) + tdvmcall_fatal(err); + + err = tdvm_report_to_user_space(ecx); + if (err) + tdvmcall_fatal(err); + + err = tdvm_report_to_user_space(edx); + if (err) + tdvmcall_fatal(err); + + tdvmcall_success(); +} + +void verify_td_cpuid_tdcall(void) +{ + struct kvm_vcpu *vcpu; + struct kvm_vm *vm; + uint32_t eax, ebx, ecx, edx; + struct kvm_cpuid_entry2 *cpuid_entry; + struct tdx_cpuid_data cpuid_data; + int ret; + + printf("Verifying TD CPUID TDVMCALL:\n"); + /* Create a TD VM with no memory.*/ + vm = vm_create_tdx(); + + /* Allocate TD guest memory and initialize the TD.*/ + initialize_td(vm); + + /* Initialize the TD vcpu and copy the test code to the guest memory.*/ + vcpu = vm_vcpu_add_tdx(vm, 0); + + /* Setup and initialize VM memory */ + prepare_source_image(vm, guest_code_cpuid_tdcall, + TDX_FUNCTION_SIZE(guest_code_cpuid_tdcall), 0); + finalize_td_memory(vm); + + /* Wait for guest to report CPUID values */ + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_IO(vcpu, TDX_DATA_REPORT_PORT, 4, TDX_IO_WRITE); + eax = *(uint32_t *)((void *)vcpu->run + vcpu->run->io.data_offset); + + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_IO(vcpu, TDX_DATA_REPORT_PORT, 4, TDX_IO_WRITE); + ebx = *(uint32_t *)((void *)vcpu->run + vcpu->run->io.data_offset); + + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_IO(vcpu, TDX_DATA_REPORT_PORT, 4, TDX_IO_WRITE); + ecx = *(uint32_t *)((void *)vcpu->run + vcpu->run->io.data_offset); + + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_IO(vcpu, TDX_DATA_REPORT_PORT, 4, TDX_IO_WRITE); + edx = *(uint32_t *)((void *)vcpu->run + vcpu->run->io.data_offset); + + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + CHECK_GUEST_COMPLETION(vcpu); + + /* Get KVM CPUIDs for reference */ + memset(&cpuid_data, 0, sizeof(cpuid_data)); + cpuid_data.cpuid.nent = KVM_MAX_CPUID_ENTRIES; + ret = ioctl(vm->kvm_fd, KVM_GET_SUPPORTED_CPUID, &cpuid_data); + TEST_ASSERT(!ret, "KVM_GET_SUPPORTED_CPUID failed\n"); + cpuid_entry = find_cpuid_entry(cpuid_data, 1, 0); + TEST_ASSERT(cpuid_entry, "CPUID entry missing\n"); + + ASSERT_EQ(cpuid_entry->eax, eax); + // Mask lapic ID when comparing ebx. + ASSERT_EQ(cpuid_entry->ebx & ~0xFF000000, ebx & ~0xFF000000); + ASSERT_EQ(cpuid_entry->ecx, ecx); + ASSERT_EQ(cpuid_entry->edx, edx); + + kvm_vm_free(vm); + printf("\t ... PASSED\n"); +} + /* * Verifies get_td_vmcall_info functionality. */ @@ -1184,6 +1285,7 @@ int main(int argc, char **argv) run_in_new_process(&verify_report_fatal_error); run_in_new_process(&verify_td_ioexit); run_in_new_process(&verify_td_cpuid); + run_in_new_process(&verify_td_cpuid_tdcall); run_in_new_process(&verify_get_td_vmcall_info); run_in_new_process(&verify_guest_writes); run_in_new_process(&verify_guest_reads);

From: Roger Wang runanwang@google.com

Adds a test for TDG.VP.INFO

Signed-off-by: Roger Wang runanwang@google.com Signed-off-by: Sagi Shahar sagis@google.com --- tools/testing/selftests/kvm/lib/x86_64/tdx.h | 103 ++++++++---- .../selftests/kvm/lib/x86_64/tdx_lib.c | 18 ++- .../selftests/kvm/x86_64/tdx_vm_tests.c | 150 ++++++++++++++++++ 3 files changed, 235 insertions(+), 36 deletions(-)

diff --git a/tools/testing/selftests/kvm/lib/x86_64/tdx.h b/tools/testing/selftests/kvm/lib/x86_64/tdx.h index 3729543a05a3..7af2d189043f 100644 --- a/tools/testing/selftests/kvm/lib/x86_64/tdx.h +++ b/tools/testing/selftests/kvm/lib/x86_64/tdx.h @@ -10,6 +10,11 @@ */ #define TDX_GUEST_MAX_NR_PAGES 10000

+/* + * Max number of vCPUs for the guest VM + */ + #define TDX_GUEST_MAX_NUM_VCPUS 3 + /* * Page Table Address used when paging is enabled. */ @@ -71,6 +76,11 @@ #define TDX_MMIO_READ 0 #define TDX_MMIO_WRITE 1

+#define TDX_TDCALL_INFO 1 + +#define TDX_TDPARAM_ATTR_SEPT_VE_DISABLE_BIT (1UL << 28) +#define TDX_TDPARAM_ATTR_PKS_BIT (1UL << 30) + #define GDT_ENTRY(flags, base, limit) \ ((((base) & 0xff000000ULL) << (56-24)) | \ (((flags) & 0x0000f0ffULL) << 40) | \ @@ -98,6 +108,7 @@ void add_td_memory(struct kvm_vm *vm, void *source_page, uint64_t gpa, int size); void finalize_td_memory(struct kvm_vm *vm); void initialize_td(struct kvm_vm *vm); +void initialize_td_with_attributes(struct kvm_vm *vm, uint64_t attributes); void initialize_td_vcpu(struct kvm_vcpu *vcpu); void prepare_source_image(struct kvm_vm *vm, void *guest_code, size_t guest_code_size, @@ -116,40 +127,41 @@ void prepare_source_image(struct kvm_vm *vm, void *guest_code, static inline void tdcall(struct kvm_regs *regs) { asm volatile ( - "mov %13, %%rax;\n\t" - "mov %14, %%rbx;\n\t" - "mov %15, %%rcx;\n\t" - "mov %16, %%rdx;\n\t" - "mov %17, %%r8;\n\t" - "mov %18, %%r9;\n\t" - "mov %19, %%r10;\n\t" - "mov %20, %%r11;\n\t" - "mov %21, %%r12;\n\t" - "mov %22, %%r13;\n\t" - "mov %23, %%r14;\n\t" - "mov %24, %%r15;\n\t" - "mov %25, %%rbp;\n\t" - "mov %26, %%rsi;\n\t" - "mov %27, %%rdi;\n\t" + "mov %14, %%rax;\n\t" + "mov %15, %%rbx;\n\t" + "mov %16, %%rcx;\n\t" + "mov %17, %%rdx;\n\t" + "mov %18, %%r8;\n\t" + "mov %19, %%r9;\n\t" + "mov %20, %%r10;\n\t" + "mov %21, %%r11;\n\t" + "mov %22, %%r12;\n\t" + "mov %23, %%r13;\n\t" + "mov %24, %%r14;\n\t" + "mov %25, %%r15;\n\t" + "mov %26, %%rbp;\n\t" + "mov %27, %%rsi;\n\t" + "mov %28, %%rdi;\n\t" ".byte 0x66, 0x0F, 0x01, 0xCC;\n\t" "mov %%rax, %0;\n\t" "mov %%rbx, %1;\n\t" - "mov %%rdx, %2;\n\t" - "mov %%r8, %3;\n\t" - "mov %%r9, %4;\n\t" - "mov %%r10, %5;\n\t" - "mov %%r11, %6;\n\t" - "mov %%r12, %7;\n\t" - "mov %%r13, %8;\n\t" - "mov %%r14, %9;\n\t" - "mov %%r15, %10;\n\t" - "mov %%rsi, %11;\n\t" - "mov %%rdi, %12;\n\t" - : "=m" (regs->rax), "=m" (regs->rbx), "=m" (regs->rdx), - "=m" (regs->r8), "=m" (regs->r9), "=m" (regs->r10), - "=m" (regs->r11), "=m" (regs->r12), "=m" (regs->r13), - "=m" (regs->r14), "=m" (regs->r15), "=m" (regs->rsi), - "=m" (regs->rdi) + "mov %%rcx, %2;\n\t" + "mov %%rdx, %3;\n\t" + "mov %%r8, %4;\n\t" + "mov %%r9, %5;\n\t" + "mov %%r10, %6;\n\t" + "mov %%r11, %7;\n\t" + "mov %%r12, %8;\n\t" + "mov %%r13, %9;\n\t" + "mov %%r14, %10;\n\t" + "mov %%r15, %11;\n\t" + "mov %%rsi, %12;\n\t" + "mov %%rdi, %13;\n\t" + : "=m" (regs->rax), "=m" (regs->rbx), "=m" (regs->rcx), + "=m" (regs->rdx), "=m" (regs->r8), "=m" (regs->r9), + "=m" (regs->r10), "=m" (regs->r11), "=m" (regs->r12), + "=m" (regs->r13), "=m" (regs->r14), "=m" (regs->r15), + "=m" (regs->rsi), "=m" (regs->rdi) : "m" (regs->rax), "m" (regs->rbx), "m" (regs->rcx), "m" (regs->rdx), "m" (regs->r8), "m" (regs->r9), "m" (regs->r10), "m" (regs->r11), "m" (regs->r12), @@ -370,6 +382,35 @@ static inline uint64_t tdvmcall_cpuid(uint32_t eax, uint32_t ecx, return regs.r10; }

+/* + * Execute TDG.VP.INFO instruction. + */ +static inline uint64_t tdcall_vp_info(uint64_t *rcx, uint64_t *rdx, + uint64_t *r8, uint64_t *r9, + uint64_t *r10, uint64_t *r11) +{ + struct kvm_regs regs; + + memset(&regs, 0, sizeof(regs)); + regs.rax = TDX_TDCALL_INFO; + tdcall(&regs); + + if (rcx) + *rcx = regs.rcx; + if (rdx) + *rdx = regs.rdx; + if (r8) + *r8 = regs.r8; + if (r9) + *r9 = regs.r9; + if (r10) + *r10 = regs.r10; + if (r11) + *r11 = regs.r11; + + return regs.rax; +} + /* * Reports a 32 bit value from the guest to user space using a TDVM IO call. * Data is reported on port TDX_DATA_REPORT_PORT. diff --git a/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c b/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c index 72bf2ff24a29..dc9a44ae4064 100644 --- a/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c +++ b/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c @@ -78,10 +78,10 @@ static struct tdx_cpuid_data get_tdx_cpuid_data(struct kvm_vm *vm) }

/* - * Initialize a VM as a TD. + * Initialize a VM as a TD with attributes. * */ -void initialize_td(struct kvm_vm *vm) +void initialize_td_with_attributes(struct kvm_vm *vm, uint64_t attributes) { struct tdx_cpuid_data cpuid_data; int rc; @@ -99,7 +99,7 @@ void initialize_td(struct kvm_vm *vm) KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK); vm_enable_cap(vm, KVM_CAP_SPLIT_IRQCHIP, 24);

- /* Allocate and setup memoryfor the td guest. */ + /* Allocate and setup memory for the td guest. */ vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS, TDX_GUEST_PT_FIXED_ADDR, 0, TDX_GUEST_MAX_NR_PAGES, 0); @@ -108,12 +108,20 @@ void initialize_td(struct kvm_vm *vm)

cpuid_data = get_tdx_cpuid_data(vm);

- init_vm.max_vcpus = 1; - init_vm.attributes = 0; + init_vm.max_vcpus = TDX_GUEST_MAX_NUM_VCPUS; + init_vm.attributes = attributes; memcpy(&init_vm.cpuid, &cpuid_data, sizeof(cpuid_data)); tdx_ioctl(vm->fd, KVM_TDX_INIT_VM, 0, &init_vm); }

+/* + * Initialize a VM as a TD with no attributes. + * + */ +void initialize_td(struct kvm_vm *vm) +{ + initialize_td_with_attributes(vm, 0); +}

void initialize_td_vcpu(struct kvm_vcpu *vcpu) { diff --git a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c index 1776b39b7d9e..8d49099e1ed8 100644 --- a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c +++ b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c @@ -2,6 +2,7 @@

#include "asm/kvm.h" #include "linux/kernel.h" +#include <assert.h> #include <bits/stdint-uintn.h> #include <fcntl.h> #include <limits.h> @@ -1366,6 +1367,154 @@ void verify_host_reading_private_mem(void) printf("\t ... PASSED\n"); }

+/* + * Do a TDG.VP.INFO call from the guest + */ +TDX_GUEST_FUNCTION(guest_tdcall_vp_info) +{ + uint64_t err; + uint64_t rcx, rdx, r8, r9, r10, r11; + + err = tdcall_vp_info(&rcx, &rdx, &r8, &r9, &r10, &r11); + if (err) + tdvmcall_fatal(err); + + /* return values to user space host */ + err = tdvm_report_64bit_to_user_space(rcx); + if (err) + tdvmcall_fatal(err); + + err = tdvm_report_64bit_to_user_space(rdx); + if (err) + tdvmcall_fatal(err); + + err = tdvm_report_64bit_to_user_space(r8); + if (err) + tdvmcall_fatal(err); + + err = tdvm_report_64bit_to_user_space(r9); + if (err) + tdvmcall_fatal(err); + + err = tdvm_report_64bit_to_user_space(r10); + if (err) + tdvmcall_fatal(err); + + err = tdvm_report_64bit_to_user_space(r11); + if (err) + tdvmcall_fatal(err); + + tdvmcall_success(); +} + +/* + * TDG.VP.INFO call from the guest. Verify the right values are returned + */ +void verify_tdcall_vp_info(void) +{ + const int num_vcpus = 2; + struct kvm_vcpu *vcpus[num_vcpus]; + struct kvm_vm *vm; + uint64_t rcx, rdx, r8, r9, r10, r11; + uint32_t ret_num_vcpus, ret_max_vcpus; + uint64_t attributes; + uint32_t i; + struct kvm_cpuid_entry2 *cpuid_entry; + struct tdx_cpuid_data cpuid_data; + int max_pa = -1; + int ret; + + printf("Verifying TDG.VP.INFO call:\n"); + /* Create a TD VM with no memory.*/ + vm = vm_create_tdx(); + + /* Setting attributes parameter used by TDH.MNG.INIT to 0x50000000 */ + attributes = TDX_TDPARAM_ATTR_SEPT_VE_DISABLE_BIT | + TDX_TDPARAM_ATTR_PKS_BIT; + + /* Allocate TD guest memory and initialize the TD.*/ + initialize_td_with_attributes(vm, attributes); + + /* Create vCPUs*/ + for (i = 0; i < num_vcpus; i++) + vcpus[i] = vm_vcpu_add_tdx(vm, i); + + /* Setup and initialize VM memory */ + prepare_source_image(vm, guest_tdcall_vp_info, + TDX_FUNCTION_SIZE(guest_tdcall_vp_info), 0); + finalize_td_memory(vm); + + /* Get KVM CPUIDs for reference */ + memset(&cpuid_data, 0, sizeof(cpuid_data)); + cpuid_data.cpuid.nent = KVM_MAX_CPUID_ENTRIES; + ret = ioctl(vm->kvm_fd, KVM_GET_SUPPORTED_CPUID, &cpuid_data); + TEST_ASSERT(!ret, "KVM_GET_SUPPORTED_CPUID failed\n"); + cpuid_entry = find_cpuid_entry(cpuid_data, 0x80000008, 0); + TEST_ASSERT(cpuid_entry, "CPUID entry missing\n"); + max_pa = cpuid_entry->eax & 0xff; + + for (i = 0; i < num_vcpus; i++) { + struct kvm_vcpu *vcpu = vcpus[i]; + + /* Wait for guest to report rcx value */ + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + rcx = read_64bit_from_guest(vcpu, TDX_DATA_REPORT_PORT); + + /* Wait for guest to report rdx value */ + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + rdx = read_64bit_from_guest(vcpu, TDX_DATA_REPORT_PORT); + + /* Wait for guest to report r8 value */ + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + r8 = read_64bit_from_guest(vcpu, TDX_DATA_REPORT_PORT); + + /* Wait for guest to report r9 value */ + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + r9 = read_64bit_from_guest(vcpu, TDX_DATA_REPORT_PORT); + + /* Wait for guest to report r10 value */ + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + r10 = read_64bit_from_guest(vcpu, TDX_DATA_REPORT_PORT); + + /* Wait for guest to report r11 value */ + vcpu_run(vcpu); + CHECK_GUEST_FAILURE(vcpu); + r11 = read_64bit_from_guest(vcpu, TDX_DATA_REPORT_PORT); + + ret_num_vcpus = r8 & 0xFFFFFFFF; + ret_max_vcpus = (r8 >> 32) & 0xFFFFFFFF; + + /* first bits 5:0 of rcx represent the GPAW */ + ASSERT_EQ(rcx & 0x3F, max_pa); + /* next 63:6 bits of rcx is reserved and must be 0 */ + ASSERT_EQ(rcx >> 6, 0); + ASSERT_EQ(rdx, attributes); + ASSERT_EQ(ret_num_vcpus, num_vcpus); + ASSERT_EQ(ret_max_vcpus, TDX_GUEST_MAX_NUM_VCPUS); + /* VCPU_INDEX = i */ + ASSERT_EQ(r9, i); + /* verify reserved registers are 0 */ + ASSERT_EQ(r10, 0); + ASSERT_EQ(r11, 0); + + /* Wait for guest to complete execution */ + vcpu_run(vcpu); + + CHECK_GUEST_FAILURE(vcpu); + CHECK_GUEST_COMPLETION(vcpu); + + printf("\t ... Guest completed run on VCPU=%u\n", i); + } + + kvm_vm_free(vm); + printf("\t ... PASSED\n"); +} + int main(int argc, char **argv) { if (!is_tdx_enabled()) { @@ -1387,6 +1536,7 @@ int main(int argc, char **argv) run_in_new_process(&verify_mmio_reads); run_in_new_process(&verify_mmio_writes); run_in_new_process(&verify_host_reading_private_mem); + run_in_new_process(&verify_tdcall_vp_info);

return 0; }

Here is one more test to exercise KVM_TDX_CAPABILITIES on top of this patch series.

From f9c4c9013040ce7dee84e1d3370875e5158900bf Mon Sep 17 00:00:00 2001 Message-Id: f9c4c9013040ce7dee84e1d3370875e5158900bf.1661995648.git.isaku.yamahata@intel.com In-Reply-To: 6ce32225079b83991b9f170730a8810005a079b0.1661995647.git.isaku.yamahata@intel.com References: 6ce32225079b83991b9f170730a8810005a079b0.1661995647.git.isaku.yamahata@intel.com From: Isaku Yamahata isaku.yamahata@intel.com Date: Wed, 16 Mar 2022 09:15:40 -0700 Subject: [PATCH] KVM: selftest: tdx: call KVM_TDX_CAPABILITIES for test

Add exercise of KVM_TDX_CAPABILITIES. The result isn't used.

Signed-off-by: Isaku Yamahata isaku.yamahata@intel.com --- tools/testing/selftests/kvm/lib/x86_64/tdx.h | 1 + .../selftests/kvm/lib/x86_64/tdx_lib.c | 52 +++++++++++++++++-- .../selftests/kvm/x86_64/tdx_vm_tests.c | 3 ++ 3 files changed, 53 insertions(+), 3 deletions(-)

diff --git a/tools/testing/selftests/kvm/lib/x86_64/tdx.h b/tools/testing/selftests/kvm/lib/x86_64/tdx.h index be8564f4672d..bfa3709a76e5 100644 --- a/tools/testing/selftests/kvm/lib/x86_64/tdx.h +++ b/tools/testing/selftests/kvm/lib/x86_64/tdx.h @@ -119,6 +119,7 @@ struct page_table { void add_td_memory(struct kvm_vm *vm, void *source_page, uint64_t gpa, int size); void finalize_td_memory(struct kvm_vm *vm); +void get_tdx_capabilities(struct kvm_vm *vm); void initialize_td(struct kvm_vm *vm); void initialize_td_with_attributes(struct kvm_vm *vm, uint64_t attributes); void initialize_td_vcpu(struct kvm_vcpu *vcpu); diff --git a/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c b/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c index 23893949c3a1..b07af314737a 100644 --- a/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c +++ b/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c @@ -27,10 +27,9 @@ char *tdx_cmd_str[] = { #define XFEATURE_MASK_XTILE (XFEATURE_MASK_XTILECFG | XFEATURE_MASK_XTILEDATA)

-static void tdx_ioctl(int fd, int ioctl_no, uint32_t flags, void *data) +static int __tdx_ioctl(int fd, int ioctl_no, uint32_t flags, void *data) { struct kvm_tdx_cmd tdx_cmd; - int r;

TEST_ASSERT(ioctl_no < TDX_MAX_CMD_STR, "Unknown TDX CMD : %d\n", ioctl_no); @@ -39,7 +38,15 @@ static void tdx_ioctl(int fd, int ioctl_no, uint32_t flags, void *data) tdx_cmd.id = ioctl_no; tdx_cmd.flags = flags; tdx_cmd.data = (uint64_t)data; - r = ioctl(fd, KVM_MEMORY_ENCRYPT_OP, &tdx_cmd); + return ioctl(fd, KVM_MEMORY_ENCRYPT_OP, &tdx_cmd); +} + + +static void tdx_ioctl(int fd, int ioctl_no, uint32_t flags, void *data) +{ + int r; + + r = __tdx_ioctl(fd, ioctl_no, flags, data); TEST_ASSERT(r == 0, "%s failed: %d %d", tdx_cmd_str[ioctl_no], r, errno); } @@ -77,6 +84,45 @@ static struct tdx_cpuid_data get_tdx_cpuid_data(struct kvm_vm *vm) return cpuid_data; }

+/* Call KVM_TDX_CAPABILITIES for API test. The result isn't used. */ +void get_tdx_capabilities(struct kvm_vm *vm) +{ + int i; + int rc; + int nr_cpuid_configs = 8; + struct kvm_tdx_capabilities *tdx_cap = NULL; + + while (true) { + tdx_cap = realloc( + tdx_cap, sizeof(*tdx_cap) + + nr_cpuid_configs * sizeof(*tdx_cap->cpuid_configs)); + tdx_cap->nr_cpuid_configs = nr_cpuid_configs; + TEST_ASSERT(tdx_cap != NULL, + "Could not allocate memory for tdx capability " + "nr_cpuid_configs %d\n", nr_cpuid_configs); + rc = __tdx_ioctl(vm->fd, KVM_TDX_CAPABILITIES, 0, tdx_cap); + if (rc < 0 && errno == E2BIG) { + nr_cpuid_configs *= 2; + continue; + } + TEST_ASSERT(rc == 0, "%s failed: %d %d", + tdx_cmd_str[KVM_TDX_CAPABILITIES], rc, errno); + break; + } + pr_debug("tdx_cap: attrs: fixed0 0x%016llx fixed1 0x%016llx\n" + "tdx_cap: xfam fixed0 0x%016llx fixed1 0x%016llx\n", + tdx_cap->attrs_fixed0, tdx_cap->attrs_fixed1, + tdx_cap->xfam_fixed0, tdx_cap->xfam_fixed1); + for (i = 0; i < tdx_cap->nr_cpuid_configs; i++) { + const struct kvm_tdx_cpuid_config *config = + &tdx_cap->cpuid_configs[i]; + pr_debug("cpuid config[%d]: leaf 0x%x sub_leaf 0x%x " + "eax 0x%08x ebx 0x%08x ecx 0x%08x edx 0x%08x\n", + i, config->leaf, config->sub_leaf, + config->eax, config->ebx, config->ecx, config->edx); + } +} + /* * Initialize a VM as a TD with attributes. * diff --git a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c index a96abada54b6..b3f9e3fa41f4 100644 --- a/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c +++ b/tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c @@ -197,6 +197,9 @@ void verify_td_lifecycle(void) /* Create a TD VM with no memory.*/ vm = vm_create_tdx();

+ /* Get TDX capabilities */ + get_tdx_capabilities(vm); + /* Allocate TD guest memory and initialize the TD.*/ initialize_td(vm);