linux-kernel - Re: [PATCH v4 4/8] KVM: selftests: Introduce SEV VM type check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ea783d46-0ed5-40b3-b0d4-5b4e741bab9c@amd.com>
Date: Mon, 13 Jan 2025 14:10:21 -0600
From: Pratik Rajesh Sampat <prsampat@....com>
To: "Nikunj A. Dadhania" <nikunj@....com>,
 "Pratik R. Sampat" <pratikrajesh.sampat@....com>, kvm@...r.kernel.org
Cc: seanjc@...gle.com, pbonzini@...hat.com, pgonda@...gle.com,
 thomas.lendacky@....com, michael.roth@....com, shuah@...nel.org,
 linux-kselftest@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4 4/8] KVM: selftests: Introduce SEV VM type check



On 1/13/25 2:18 AM, Nikunj A. Dadhania wrote:
> 
> 
> On 11/15/2024 5:11 AM, Pratik R. Sampat wrote:
>> In preparation for SNP, declutter the vm type check by introducing a
>> SEV-SNP VM type check as well a transitive set of helper functions.
>>
>> The SNP VM type is the subset of SEV-ES. Similarly, the SEV-ES and SNP
>> types are subset of the SEV VM type check.
>>
>> Signed-off-by: Pratik R. Sampat <pratikrajesh.sampat@....com>
>> ---
>>  .../testing/selftests/kvm/include/x86_64/sev.h  |  4 ++++
>>  .../selftests/kvm/lib/x86_64/processor.c        |  4 ++--
>>  tools/testing/selftests/kvm/lib/x86_64/sev.c    | 17 +++++++++++++++++
>>  .../selftests/kvm/x86_64/sev_smoke_test.c       |  2 +-
>>  4 files changed, 24 insertions(+), 3 deletions(-)
>>
>> diff --git a/tools/testing/selftests/kvm/include/x86_64/sev.h b/tools/testing/selftests/kvm/include/x86_64/sev.h
>> index e7df5d0987f6..faed91435963 100644
>> --- a/tools/testing/selftests/kvm/include/x86_64/sev.h
>> +++ b/tools/testing/selftests/kvm/include/x86_64/sev.h
>> @@ -29,6 +29,10 @@ enum sev_guest_state {
>>  
>>  #define VMGEXIT()		{ __asm__ __volatile__("rep; vmmcall"); }
>>  
>> +bool is_sev_vm(struct kvm_vm *vm);
>> +bool is_sev_es_vm(struct kvm_vm *vm);
>> +bool is_sev_snp_vm(struct kvm_vm *vm);
>> +
>>  void sev_vm_launch(struct kvm_vm *vm, uint32_t policy);
>>  void sev_vm_launch_measure(struct kvm_vm *vm, uint8_t *measurement);
>>  void sev_vm_launch_finish(struct kvm_vm *vm);
>> diff --git a/tools/testing/selftests/kvm/lib/x86_64/processor.c b/tools/testing/selftests/kvm/lib/x86_64/processor.c
>> index 636b29ba8985..13f060748fc2 100644
>> --- a/tools/testing/selftests/kvm/lib/x86_64/processor.c
>> +++ b/tools/testing/selftests/kvm/lib/x86_64/processor.c
>> @@ -641,7 +641,7 @@ void kvm_arch_vm_post_create(struct kvm_vm *vm)
>>  	sync_global_to_guest(vm, host_cpu_is_amd);
>>  	sync_global_to_guest(vm, is_forced_emulation_enabled);
>>  
>> -	if (vm->type == KVM_X86_SEV_VM || vm->type == KVM_X86_SEV_ES_VM) {
>> +	if (is_sev_vm(vm)) {
>>  		struct kvm_sev_init init = { 0 };
>>  
>>  		vm_sev_ioctl(vm, KVM_SEV_INIT2, &init);
>> @@ -1158,7 +1158,7 @@ void kvm_get_cpu_address_width(unsigned int *pa_bits, unsigned int *va_bits)
>>  
>>  void kvm_init_vm_address_properties(struct kvm_vm *vm)
>>  {
>> -	if (vm->type == KVM_X86_SEV_VM || vm->type == KVM_X86_SEV_ES_VM) {
>> +	if (is_sev_vm(vm)) {
>>  		vm->arch.sev_fd = open_sev_dev_path_or_exit();
>>  		vm->arch.c_bit = BIT_ULL(this_cpu_property(X86_PROPERTY_SEV_C_BIT));
>>  		vm->gpa_tag_mask = vm->arch.c_bit;
>> diff --git a/tools/testing/selftests/kvm/lib/x86_64/sev.c b/tools/testing/selftests/kvm/lib/x86_64/sev.c
>> index e9535ee20b7f..d6e7a422b69d 100644
>> --- a/tools/testing/selftests/kvm/lib/x86_64/sev.c
>> +++ b/tools/testing/selftests/kvm/lib/x86_64/sev.c
>> @@ -4,6 +4,23 @@
>>  
>>  #include "sev.h"
>>  
>> +bool is_sev_snp_vm(struct kvm_vm *vm)
>> +{
>> +	return vm->type == KVM_X86_SNP_VM;
>> +}
>> +
>> +/* A SNP VM is also a SEV-ES VM */
>> +bool is_sev_es_vm(struct kvm_vm *vm)
>> +{
>> +	return is_sev_snp_vm(vm) || vm->type == KVM_X86_SEV_ES_VM;
>> +}
>> +
>> +/* A SEV-ES and SNP VM is also a SEV VM */
>> +bool is_sev_vm(struct kvm_vm *vm)
>> +{
>> +	return is_sev_snp_vm(vm) || is_sev_es_vm(vm) || vm->type == KVM_X86_SEV_VM;
> 
> As is_sev_es_vm() already checks is_sev_snp_vm(), we can drop SNP VM check here, right ?
> 

That's right, thanks for catching that. I'll get rid of the
is_sev_es_vm() check here.

Pratik