linux-kernel - [PATCH v2 13/13] KVM: selftests: add SEV-ES boot tests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211216171358.61140-14-michael.roth@amd.com>
Date:   Thu, 16 Dec 2021 11:13:58 -0600
From:   Michael Roth <michael.roth@....com>
To:     <linux-kselftest@...r.kernel.org>
CC:     <kvm@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <x86@...nel.org>, Nathan Tempelman <natet@...gle.com>,
        Marc Orr <marcorr@...gle.com>,
        "Steve Rutherford" <srutherford@...gle.com>,
        Sean Christopherson <seanjc@...gle.com>,
        Mingwei Zhang <mizhang@...gle.com>,
        Brijesh Singh <brijesh.singh@....com>,
        Tom Lendacky <thomas.lendacky@....com>,
        Varad Gautam <varad.gautam@...e.com>,
        Shuah Khan <shuah@...nel.org>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        "David Woodhouse" <dwmw@...zon.co.uk>,
        Ricardo Koller <ricarkol@...gle.com>,
        "Jim Mattson" <jmattson@...gle.com>,
        Joerg Roedel <joro@...tes.org>,
        "Thomas Gleixner" <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "Borislav Petkov" <bp@...en8.de>,
        "H . Peter Anvin" <hpa@...or.com>,
        Krish Sadhukhan <krish.sadhukhan@...cle.com>,
        Peter Gonda <pgonda@...gle.com>
Subject: [PATCH v2 13/13] KVM: selftests: add SEV-ES boot tests

Extend the existing SEV boot tests to also cover SEV-ES guests. Also
add some tests for handling #VC exceptions for cpuid instructions using
both MSR-based and GHCB-based vmgexits.

Signed-off-by: Michael Roth <michael.roth@....com>
---
 .../selftests/kvm/x86_64/sev_all_boot_test.c  | 63 ++++++++++++++++++-
 1 file changed, 62 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/kvm/x86_64/sev_all_boot_test.c b/tools/testing/selftests/kvm/x86_64/sev_all_boot_test.c
index 329a740a7cb2..63c26bf4ecb6 100644
--- a/tools/testing/selftests/kvm/x86_64/sev_all_boot_test.c
+++ b/tools/testing/selftests/kvm/x86_64/sev_all_boot_test.c
@@ -18,6 +18,7 @@
 #include "svm_util.h"
 #include "linux/psp-sev.h"
 #include "sev.h"
+#include "sev_exitlib.h"
 
 #define VCPU_ID			2
 #define PAGE_SIZE		4096
@@ -31,6 +32,10 @@
 
 #define TOTAL_PAGES		(512 + SHARED_PAGES + PRIVATE_PAGES)
 
+/* Globals for use by #VC handler. */
+static void *ghcb0_gva;
+static vm_paddr_t ghcb0_gpa;
+
 static void fill_buf(uint8_t *buf, size_t pages, size_t stride, uint8_t val)
 {
 	int i, j;
@@ -165,6 +170,47 @@ guest_sev_code(struct ucall *uc, uint8_t *shared_buf, uint8_t *private_buf)
 	guest_test_done(uc);
 }
 
+static void vc_handler(struct ex_regs *regs)
+{
+	sev_es_handle_vc(ghcb0_gva, ghcb0_gpa, regs);
+}
+
+static void __attribute__((__flatten__))
+guest_sev_es_code(struct ucall *uc, uint8_t *shared_buf,
+		  uint8_t *private_buf, uint64_t ghcb_gpa, void *ghcb_gva)
+{
+	uint32_t eax, ebx, ecx, edx;
+	uint64_t sev_status;
+
+	guest_test_start(uc);
+
+again:
+	/* Check CPUID values via GHCB MSR protocol. */
+	eax = 0x8000001f;
+	ecx = 0;
+	cpuid(&eax, &ebx, &ecx, &edx);
+
+	/* Check SEV bit. */
+	GUEST_SHARED_ASSERT(uc, eax & (1 << 1));
+	/* Check SEV-ES bit. */
+	GUEST_SHARED_ASSERT(uc, eax & (1 << 3));
+
+	if (!ghcb0_gva) {
+		ghcb0_gva = ghcb_gva;
+		ghcb0_gpa = ghcb_gpa;
+		/* Check CPUID bits again using GHCB-based protocol. */
+		goto again;
+	}
+
+	/* Check SEV and SEV-ES enabled bits (bits 0 and 1, respectively). */
+	sev_status = rdmsr(MSR_AMD64_SEV);
+	GUEST_SHARED_ASSERT(uc, (sev_status & 0x3) == 3);
+
+	guest_test_common(uc, shared_buf, private_buf);
+
+	guest_test_done(uc);
+}
+
 static struct sev_vm *
 setup_test_common(void *guest_code, uint64_t policy, struct ucall **uc,
 		  uint8_t **shared_buf, uint8_t **private_buf)
@@ -200,7 +246,18 @@ setup_test_common(void *guest_code, uint64_t policy, struct ucall **uc,
 	fill_buf(*private_buf, PRIVATE_PAGES, PAGE_STRIDE, 0x42);
 
 	/* Set up guest params. */
-	vcpu_args_set(vm, VCPU_ID, 4, uc_vaddr, shared_vaddr, private_vaddr);
+	if (policy & SEV_POLICY_ES) {
+		vm_vaddr_t ghcb_vaddr = vm_vaddr_alloc_shared(vm, PAGE_SIZE, PAGE_SIZE);
+
+		vcpu_args_set(vm, VCPU_ID, 6, uc_vaddr, shared_vaddr, private_vaddr,
+			      addr_gva2gpa(vm, ghcb_vaddr), ghcb_vaddr);
+		/* Set up VC handler. */
+		vm_init_descriptor_tables(vm);
+		vm_install_exception_handler(vm, 29, vc_handler);
+		vcpu_init_descriptor_tables(vm, VCPU_ID);
+	} else {
+		vcpu_args_set(vm, VCPU_ID, 4, uc_vaddr, shared_vaddr, private_vaddr);
+	}
 
 	/*
 	 * Hand these back to test harness, translation is needed now since page
@@ -251,5 +308,9 @@ int main(int argc, char *argv[])
 	test_sev(guest_sev_code, SEV_POLICY_NO_DBG);
 	test_sev(guest_sev_code, 0);
 
+	/* SEV-ES tests */
+	test_sev(guest_sev_es_code, SEV_POLICY_ES | SEV_POLICY_NO_DBG);
+	test_sev(guest_sev_es_code, SEV_POLICY_ES);
+
 	return 0;
 }
-- 
2.25.1