@@ -56,6 +56,7 @@
#define TDX_SUCCESS_PORT 0x30
#define TDX_TEST_PORT 0x31
+#define TDX_DATA_REPORT_PORT 0x32
#define TDX_IO_READ 0
#define TDX_IO_WRITE 1
@@ -231,6 +232,18 @@ static inline void tdvmcall_fatal(uint64_t error_code)
tdcall(®s);
}
+/*
+ * Reports a 32 bit value from the guest to user space using a TDVM IO call.
+ * Data is reported on port TDX_DATA_REPORT_PORT.
+ */
+static inline uint64_t tdvm_report_to_user_space(uint32_t data)
+{
+ // Need to upcast data to match tdvmcall_io signature.
+ uint64_t data_64 = data;
+
+ return tdvmcall_io(TDX_DATA_REPORT_PORT, /*size=*/4, TDX_IO_WRITE, &data_64);
+}
+
#define TDX_FUNCTION_SIZE(name) ((uint64_t)&__stop_sec_ ## name -\
(uint64_t)&__start_sec_ ## name) \
@@ -77,6 +77,27 @@ bool is_tdx_enabled(void)
return !!(kvm_check_cap(KVM_CAP_VM_TYPES) & BIT(KVM_X86_TDX_VM));
}
+/*
+ * Find a specific CPUID entry.
+ */
+static struct kvm_cpuid_entry2 *
+find_cpuid_entry(struct tdx_cpuid_data cpuid_data, uint32_t function,
+ uint32_t index)
+{
+ struct kvm_cpuid_entry2 *e;
+ int i;
+
+ for (i = 0; i < cpuid_data.cpuid.nent; i++) {
+ e = &cpuid_data.entries[i];
+
+ if (e->function == function &&
+ (e->index == index ||
+ !(e->flags & KVM_CPUID_FLAG_SIGNIFCANT_INDEX)))
+ return e;
+ }
+ return NULL;
+}
+
/*
* Do a dummy io exit to verify that the TD has been initialized correctly and
* guest can run some code inside.
@@ -251,6 +272,116 @@ void verify_td_ioexit(void)
printf("\t ... PASSED\n");
}
+/*
+ * Verifies CPUID functionality by reading CPUID values in guest. The guest
+ * will then send the values to userspace using an IO write to be checked
+ * against the expected values.
+ */
+TDX_GUEST_FUNCTION(guest_code_cpuid)
+{
+ uint64_t err;
+ uint32_t eax, ebx, edx, ecx;
+
+ // Read CPUID leaf 0x1.
+ cpuid(1, &eax, &ebx, &ecx, &edx);
+
+ err = tdvm_report_to_user_space(ebx);
+ if (err)
+ tdvmcall_fatal(err);
+
+ err = tdvm_report_to_user_space(ecx);
+ if (err)
+ tdvmcall_fatal(err);
+
+ tdvmcall_success();
+}
+
+void verify_td_cpuid(void)
+{
+ struct kvm_vcpu *vcpu;
+ struct kvm_vm *vm;
+ uint32_t ebx, ecx;
+ struct kvm_cpuid_entry2 *cpuid_entry;
+ struct tdx_cpuid_data cpuid_data;
+ uint32_t guest_clflush_line_size;
+ uint32_t guest_max_addressable_ids, host_max_addressable_ids;
+ uint32_t guest_sse3_enabled;
+ uint32_t guest_fma_enabled;
+ uint32_t guest_initial_apic_id;
+ int ret;
+
+ printf("Verifying TD CPUID:\n");
+ /* Create a TD VM with no memory.*/
+ vm = vm_create_tdx();
+
+ /* Allocate TD guest memory and initialize the TD.*/
+ initialize_td(vm);
+
+ /* Initialize the TD vcpu and copy the test code to the guest memory.*/
+ vcpu = vm_vcpu_add_tdx(vm, 0);
+
+ /* Setup and initialize VM memory */
+ prepare_source_image(vm, guest_code_cpuid,
+ TDX_FUNCTION_SIZE(guest_code_cpuid), 0);
+ finalize_td_memory(vm);
+
+ /* Wait for guest to report ebx value */
+ vcpu_run(vcpu);
+ CHECK_GUEST_FAILURE(vcpu);
+ CHECK_IO(vcpu, TDX_DATA_REPORT_PORT, 4, TDX_IO_WRITE);
+ ebx = *(uint32_t *)((void *)vcpu->run + vcpu->run->io.data_offset);
+
+ /* Wait for guest to report either ecx value or error */
+ vcpu_run(vcpu);
+ CHECK_GUEST_FAILURE(vcpu);
+ CHECK_IO(vcpu, TDX_DATA_REPORT_PORT, 4, TDX_IO_WRITE);
+ ecx = *(uint32_t *)((void *)vcpu->run + vcpu->run->io.data_offset);
+
+ /* Wait for guest to complete execution */
+ vcpu_run(vcpu);
+ CHECK_GUEST_FAILURE(vcpu);
+ CHECK_GUEST_COMPLETION(vcpu);
+
+ /* Verify the CPUID values we got from the guest. */
+ printf("\t ... Verifying CPUID values from guest\n");
+
+ /* Get KVM CPUIDs for reference */
+ memset(&cpuid_data, 0, sizeof(cpuid_data));
+ cpuid_data.cpuid.nent = KVM_MAX_CPUID_ENTRIES;
+ ret = ioctl(vm->kvm_fd, KVM_GET_SUPPORTED_CPUID, &cpuid_data);
+ TEST_ASSERT(!ret, "KVM_GET_SUPPORTED_CPUID failed\n");
+ cpuid_entry = find_cpuid_entry(cpuid_data, 1, 0);
+ TEST_ASSERT(cpuid_entry, "CPUID entry missing\n");
+
+ host_max_addressable_ids = (cpuid_entry->ebx >> 16) & 0xFF;
+
+ guest_sse3_enabled = ecx & 0x1; // Native
+ guest_clflush_line_size = (ebx >> 8) & 0xFF; // Fixed
+ guest_max_addressable_ids = (ebx >> 16) & 0xFF; // As Configured
+ guest_fma_enabled = (ecx >> 12) & 0x1; // As Configured (if Native)
+ guest_initial_apic_id = (ebx >> 24) & 0xFF; // Calculated
+
+ ASSERT_EQ(guest_sse3_enabled, 1);
+ ASSERT_EQ(guest_clflush_line_size, 8);
+ ASSERT_EQ(guest_max_addressable_ids, host_max_addressable_ids);
+
+ /* TODO: This only tests the native value. To properly test
+ * "As Configured (if Native)" we need to override this value
+ * in the TD params
+ */
+ ASSERT_EQ(guest_fma_enabled, 1);
+
+ /* TODO: guest_initial_apic_id is calculated based on the number of
+ * VCPUs in the TD. From the spec: "Virtual CPU index, starting from 0
+ * and allocated sequentially on each successful TDH.VP.INIT"
+ * To test non-trivial values we either need a TD with multiple VCPUs
+ * or to pick a different calculated value.
+ */
+ ASSERT_EQ(guest_initial_apic_id, 0);
+
+ kvm_vm_free(vm);
+ printf("\t ... PASSED\n");
+}
int main(int argc, char **argv)
{
@@ -262,6 +393,7 @@ int main(int argc, char **argv)
run_in_new_process(&verify_td_lifecycle);
run_in_new_process(&verify_report_fatal_error);
run_in_new_process(&verify_td_ioexit);
+ run_in_new_process(&verify_td_cpuid);
return 0;
}
The test reads CPUID values from inside a TD VM and compare them to expected values. The test targets CPUID values which are virtualized as "As Configured", "As Configured (if Native)", "Calculated", "Fixed" and "Native" according to the TDX spec. Signed-off-by: Sagi Shahar <sagis@google.com> --- tools/testing/selftests/kvm/lib/x86_64/tdx.h | 13 ++ .../selftests/kvm/x86_64/tdx_vm_tests.c | 132 ++++++++++++++++++ 2 files changed, 145 insertions(+)