| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 31 Aug 2022 18:22:45 -0700
From: Isaku Yamahata <isaku.yamahata@...il.com>
To: Sagi Shahar <sagis@...gle.com>
Cc: linux-kselftest@...r.kernel.org,
Paolo Bonzini <pbonzini@...hat.com>,
Sean Christopherson <seanjc@...gle.com>,
Isaku Yamahata <isaku.yamahata@...el.com>,
Erdem Aktas <erdemaktas@...gle.com>,
Ryan Afranji <afranji@...gle.com>,
Roger Wang <runanwang@...gle.com>,
Shuah Khan <shuah@...nel.org>,
Andrew Jones <drjones@...hat.com>,
Marc Zyngier <maz@...nel.org>, Ben Gardon <bgardon@...gle.com>,
Jim Mattson <jmattson@...gle.com>,
David Matlack <dmatlack@...gle.com>,
Peter Xu <peterx@...hat.com>, Oliver Upton <oupton@...gle.com>,
Ricardo Koller <ricarkol@...gle.com>,
Yang Zhong <yang.zhong@...el.com>,
Wei Wang <wei.w.wang@...el.com>,
Xiaoyao Li <xiaoyao.li@...el.com>,
Peter Gonda <pgonda@...gle.com>, Marc Orr <marcorr@...gle.com>,
Emanuele Giuseppe Esposito <eesposit@...hat.com>,
Christian Borntraeger <borntraeger@...ibm.com>,
Eric Auger <eric.auger@...hat.com>,
Yanan Wang <wangyanan55@...wei.com>,
Aaron Lewis <aaronlewis@...gle.com>,
Vitaly Kuznetsov <vkuznets@...hat.com>,
Peter Shier <pshier@...gle.com>,
Axel Rasmussen <axelrasmussen@...gle.com>,
Zhenzhong Duan <zhenzhong.duan@...el.com>,
"Maciej S . Szmigiero" <maciej.szmigiero@...cle.com>,
Like Xu <like.xu@...ux.intel.com>,
linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
isaku.yamahata@...il.com
Subject: Re: [RFC PATCH v2 02/17] KVM: selftest: Add helper functions to
create TDX VMs
On Tue, Aug 30, 2022 at 10:19:45PM +0000,
Sagi Shahar <sagis@...gle.com> wrote:
...
> diff --git a/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c b/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c
> new file mode 100644
> index 000000000000..72bf2ff24a29
> --- /dev/null
> +++ b/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c
> @@ -0,0 +1,338 @@
> +// SPDX-License-Identifier: GPL-2.0
> +#include <linux/stringify.h>
> +#include "asm/kvm.h"
> +#include "tdx.h"
> +#include <stdlib.h>
> +#include <malloc.h>
> +#include "processor.h"
> +#include <string.h>
> +
> +char *tdx_cmd_str[] = {
> + "KVM_TDX_CAPABILITIES",
> + "KVM_TDX_INIT_VM",
> + "KVM_TDX_INIT_VCPU",
> + "KVM_TDX_INIT_MEM_REGION",
> + "KVM_TDX_FINALIZE_VM"
> +};
> +
> +#define TDX_MAX_CMD_STR (ARRAY_SIZE(tdx_cmd_str))
> +#define EIGHT_INT3_INSTRUCTIONS 0xCCCCCCCCCCCCCCCC
> +
> +#define XFEATURE_LBR 15
> +#define XFEATURE_XTILECFG 17
> +#define XFEATURE_XTILEDATA 18
> +#define XFEATURE_MASK_LBR (1 << XFEATURE_LBR)
> +#define XFEATURE_MASK_XTILECFG (1 << XFEATURE_XTILECFG)
> +#define XFEATURE_MASK_XTILEDATA (1 << XFEATURE_XTILEDATA)
> +#define XFEATURE_MASK_XTILE (XFEATURE_MASK_XTILECFG | XFEATURE_MASK_XTILEDATA)
> +
> +
> +static void tdx_ioctl(int fd, int ioctl_no, uint32_t flags, void *data)
> +{
> + struct kvm_tdx_cmd tdx_cmd;
> + int r;
> +
> + TEST_ASSERT(ioctl_no < TDX_MAX_CMD_STR, "Unknown TDX CMD : %d\n",
> + ioctl_no);
> +
> + memset(&tdx_cmd, 0x0, sizeof(tdx_cmd));
> + tdx_cmd.id = ioctl_no;
> + tdx_cmd.flags = flags;
> + tdx_cmd.data = (uint64_t)data;
> + r = ioctl(fd, KVM_MEMORY_ENCRYPT_OP, &tdx_cmd);
> + TEST_ASSERT(r == 0, "%s failed: %d %d", tdx_cmd_str[ioctl_no], r,
> + errno);
> +}
> +
> +static struct tdx_cpuid_data get_tdx_cpuid_data(struct kvm_vm *vm)
> +{
> + static struct tdx_cpuid_data cpuid_data;
> + int ret, i;
> +
> + if (cpuid_data.cpuid.nent)
> + return cpuid_data;
> +
> + memset(&cpuid_data, 0, sizeof(cpuid_data));
> + cpuid_data.cpuid.nent = KVM_MAX_CPUID_ENTRIES;
> + ret = ioctl(vm->kvm_fd, KVM_GET_SUPPORTED_CPUID, &cpuid_data);
> + if (ret) {
> + TEST_FAIL("KVM_GET_SUPPORTED_CPUID failed %d %d\n",
> + ret, errno);
> + cpuid_data.cpuid.nent = 0;
> + return cpuid_data;
> + }
> +
> + for (i = 0; i < KVM_MAX_CPUID_ENTRIES; i++) {
> + struct kvm_cpuid_entry2 *e = &cpuid_data.entries[i];
> +
> + /* TDX doesn't support LBR and AMX features yet.
> + * Disable those bits from the XCR0 register.
> + */
> + if (e->function == 0xd && (e->index == 0)) {
> + e->eax &= ~XFEATURE_MASK_LBR;
> + e->eax &= ~XFEATURE_MASK_XTILE;
> + }
> + }
> +
> + return cpuid_data;
> +}
CET also needs adjust. How about the followings?
diff --git a/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c b/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c
index 1c3e47006cd2..123db9b76f82 100644
--- a/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c
+++ b/tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c
@@ -25,7 +25,7 @@ char *tdx_cmd_str[] = {
#define XFEATURE_MASK_XTILECFG (1 << XFEATURE_XTILECFG)
#define XFEATURE_MASK_XTILEDATA (1 << XFEATURE_XTILEDATA)
#define XFEATURE_MASK_XTILE (XFEATURE_MASK_XTILECFG | XFEATURE_MASK_XTILEDATA)
-
+#define XFEATURE_MASK_CET ((1 << 11) | (1 << 12))
static int __tdx_ioctl(int fd, int ioctl_no, uint32_t flags, void *data)
{
@@ -72,12 +72,26 @@ static struct tdx_cpuid_data get_tdx_cpuid_data(struct kvm_vm *vm)
for (i = 0; i < KVM_MAX_CPUID_ENTRIES; i++) {
struct kvm_cpuid_entry2 *e = &cpuid_data.entries[i];
- /* TDX doesn't support LBR and AMX features yet.
+ /* TDX doesn't support LBR yet.
* Disable those bits from the XCR0 register.
*/
if (e->function == 0xd && (e->index == 0)) {
e->eax &= ~XFEATURE_MASK_LBR;
- e->eax &= ~XFEATURE_MASK_XTILE;
+
+ /*
+ * TDX modules requires both CET_{U, S} to be set even
+ * if only one is supported.
+ */
+ if (e->eax & XFEATURE_MASK_CET) {
+ e->eax |= XFEATURE_MASK_CET;
+ }
+ /*
+ * TDX module requires both XTILE_{CFG, DATA} to be set.
+ * Both bits are required for AMX to be functional.
+ */
+ if ((e->eax & XFEATURE_MASK_XTILE) != XFEATURE_MASK_XTILE) {
+ e->eax &= ~XFEATURE_MASK_XTILE;
+ }
}
}
--
Isaku Yamahata <isaku.yamahata@...il.com>
Powered by blists - more mailing lists