Message ID | 20220829171021.701198-9-pgonda@google.com (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
Series | KVM: selftests: Add simple SEV test | expand |
On Mon, Aug 29, 2022, Peter Gonda wrote: > + for (i = 0; i <= NR_SYNCS; ++i) { > + vcpu_run(vcpu); > + switch (get_ucall(vcpu, &uc)) { > + case UCALL_SYNC: > + continue; > + case UCALL_DONE: > + return; > + case UCALL_ABORT: > + TEST_ASSERT(false, "%s at %s:%ld\n\tvalues: %#lx, %#lx", > + (const char *)uc.args[0], __FILE__, > + uc.args[1], uc.args[2], uc.args[3]); REPORT_GUEST_ASSERT > + default: > + TEST_ASSERT( > + false, "Unexpected exit: %s", > + exit_reason_str(vcpu->run->exit_reason)); TEST_FAIL > + } > + } > +} > + > +static void guest_sev_code(void) > +{ > + uint32_t eax, ebx, ecx, edx; > + uint64_t sev_status; > + > + GUEST_SYNC(1); > + > + GUEST_ASSERT(this_cpu_has(X86_FEATURE_SEV)); > + > + sev_status = rdmsr(MSR_AMD64_SEV); > + GUEST_ASSERT((sev_status & 0x1) == 1); Add a #define for the magic 0x1. And the "== 1" is unnecessary. Hmm, and the querying of SEV/SEV-ES/etc status in MSR_AMD64_SEV should be done in helpers. > + > + GUEST_DONE(); > +} > + > +static struct sev_vm *setup_test_common(void *guest_code, uint64_t policy, > + struct kvm_vcpu **vcpu) > +{ > + uint8_t measurement[512]; > + struct sev_vm *sev; > + struct kvm_vm *vm; > + int i; > + > + sev = sev_vm_create(policy, TOTAL_PAGES); > + TEST_ASSERT(sev, "sev_vm_create() failed to create VM\n"); See earlier comments on using TEST_REQUIRE. > + > + vm = sev->vm; > + > + /* Set up VCPU and initial guest kernel. */ > + *vcpu = vm_vcpu_add(vm, 0, guest_code); > + kvm_vm_elf_load(vm, program_invocation_name); > + > + /* Allocations/setup done. Encrypt initial guest payload. */ > + sev_vm_launch(sev); > + > + /* Dump the initial measurement. A test to actually verify it would be nice. */ > + sev_vm_launch_measure(sev, measurement); > + pr_info("guest measurement: "); > + for (i = 0; i < 32; ++i) > + pr_info("%02x", measurement[i]); > + pr_info("\n"); > + > + sev_vm_launch_finish(sev); I believe this entire function gets replaced with vm = ____vm_create_with_one_vcpu(VM_MODE_PXXV48_4K_SEV, &vcpu, 0, guest_code); > + > + return sev; > +} > + > +static void test_sev(void *guest_code, uint64_t policy) > +{ > + struct sev_vm *sev; > + struct kvm_vcpu *vcpu; > + > + sev = setup_test_common(guest_code, policy, &vcpu); > + > + /* Guest is ready to run. Do the tests. */ Comment doesn't add much value. > + guest_run_loop(vcpu); > + > + pr_info("guest ran successfully\n"); Meh, the test passing is a good indication the test ran successfully. > + > + sev_vm_free(sev); > +} > + > +int main(int argc, char *argv[]) > +{ > + /* SEV tests */ Again, stating the obvious. > + test_sev(guest_sev_code, SEV_POLICY_NO_DBG); > + test_sev(guest_sev_code, 0); > + > + return 0; > +} > -- > 2.37.2.672.g94769d06f0-goog >
diff --git a/tools/testing/selftests/kvm/.gitignore b/tools/testing/selftests/kvm/.gitignore index d625a3f83780..ca57969a0923 100644 --- a/tools/testing/selftests/kvm/.gitignore +++ b/tools/testing/selftests/kvm/.gitignore @@ -33,6 +33,7 @@ /x86_64/pmu_event_filter_test /x86_64/set_boot_cpu_id /x86_64/set_sregs_test +/x86_64/sev_all_boot_test /x86_64/sev_migrate_tests /x86_64/smm_test /x86_64/state_test diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile index 0a70e50f0498..10a7ea09ea98 100644 --- a/tools/testing/selftests/kvm/Makefile +++ b/tools/testing/selftests/kvm/Makefile @@ -123,6 +123,7 @@ TEST_GEN_PROGS_x86_64 += x86_64/tsc_msrs_test TEST_GEN_PROGS_x86_64 += x86_64/vmx_pmu_caps_test TEST_GEN_PROGS_x86_64 += x86_64/xen_shinfo_test TEST_GEN_PROGS_x86_64 += x86_64/xen_vmcall_test +TEST_GEN_PROGS_x86_64 += x86_64/sev_all_boot_test TEST_GEN_PROGS_x86_64 += x86_64/sev_migrate_tests TEST_GEN_PROGS_x86_64 += x86_64/amx_test TEST_GEN_PROGS_x86_64 += x86_64/max_vcpuid_cap_test diff --git a/tools/testing/selftests/kvm/x86_64/sev_all_boot_test.c b/tools/testing/selftests/kvm/x86_64/sev_all_boot_test.c new file mode 100644 index 000000000000..be8ed3720767 --- /dev/null +++ b/tools/testing/selftests/kvm/x86_64/sev_all_boot_test.c @@ -0,0 +1,127 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Basic SEV boot tests. + * + * Copyright (C) 2021 Advanced Micro Devices + */ +#define _GNU_SOURCE /* for program_invocation_short_name */ +#include <fcntl.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <sys/ioctl.h> + +#include "test_util.h" + +#include "kvm_util.h" +#include "processor.h" +#include "svm_util.h" +#include "linux/psp-sev.h" +#include "sev.h" + +#define PAGE_STRIDE 32 + +#define SHARED_PAGES 8192 +#define SHARED_VADDR_MIN 0x1000000 + +#define PRIVATE_PAGES 2048 +#define PRIVATE_VADDR_MIN (SHARED_VADDR_MIN + SHARED_PAGES * PAGE_SIZE) + +#define TOTAL_PAGES (512 + SHARED_PAGES + PRIVATE_PAGES) + +#define NR_SYNCS 1 + +static void guest_run_loop(struct kvm_vcpu *vcpu) +{ + struct ucall uc; + int i; + + for (i = 0; i <= NR_SYNCS; ++i) { + vcpu_run(vcpu); + switch (get_ucall(vcpu, &uc)) { + case UCALL_SYNC: + continue; + case UCALL_DONE: + return; + case UCALL_ABORT: + TEST_ASSERT(false, "%s at %s:%ld\n\tvalues: %#lx, %#lx", + (const char *)uc.args[0], __FILE__, + uc.args[1], uc.args[2], uc.args[3]); + default: + TEST_ASSERT( + false, "Unexpected exit: %s", + exit_reason_str(vcpu->run->exit_reason)); + } + } +} + +static void guest_sev_code(void) +{ + uint32_t eax, ebx, ecx, edx; + uint64_t sev_status; + + GUEST_SYNC(1); + + GUEST_ASSERT(this_cpu_has(X86_FEATURE_SEV)); + + sev_status = rdmsr(MSR_AMD64_SEV); + GUEST_ASSERT((sev_status & 0x1) == 1); + + GUEST_DONE(); +} + +static struct sev_vm *setup_test_common(void *guest_code, uint64_t policy, + struct kvm_vcpu **vcpu) +{ + uint8_t measurement[512]; + struct sev_vm *sev; + struct kvm_vm *vm; + int i; + + sev = sev_vm_create(policy, TOTAL_PAGES); + TEST_ASSERT(sev, "sev_vm_create() failed to create VM\n"); + + vm = sev->vm; + + /* Set up VCPU and initial guest kernel. */ + *vcpu = vm_vcpu_add(vm, 0, guest_code); + kvm_vm_elf_load(vm, program_invocation_name); + + /* Allocations/setup done. Encrypt initial guest payload. */ + sev_vm_launch(sev); + + /* Dump the initial measurement. A test to actually verify it would be nice. */ + sev_vm_launch_measure(sev, measurement); + pr_info("guest measurement: "); + for (i = 0; i < 32; ++i) + pr_info("%02x", measurement[i]); + pr_info("\n"); + + sev_vm_launch_finish(sev); + + return sev; +} + +static void test_sev(void *guest_code, uint64_t policy) +{ + struct sev_vm *sev; + struct kvm_vcpu *vcpu; + + sev = setup_test_common(guest_code, policy, &vcpu); + + /* Guest is ready to run. Do the tests. */ + guest_run_loop(vcpu); + + pr_info("guest ran successfully\n"); + + sev_vm_free(sev); +} + +int main(int argc, char *argv[]) +{ + /* SEV tests */ + test_sev(guest_sev_code, SEV_POLICY_NO_DBG); + test_sev(guest_sev_code, 0); + + return 0; +}
A very simple of booting SEV guests that checks related CPUID bits. This is a stripped down version of "[PATCH v2 08/13] KVM: selftests: add SEV boot tests" from Michael but much simpler. Suggested-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Peter Gonda <pgonda@google.com> --- tools/testing/selftests/kvm/.gitignore | 1 + tools/testing/selftests/kvm/Makefile | 1 + .../selftests/kvm/x86_64/sev_all_boot_test.c | 127 ++++++++++++++++++ 3 files changed, 129 insertions(+) create mode 100644 tools/testing/selftests/kvm/x86_64/sev_all_boot_test.c