kvm.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Zixuan Wang <zixuanwang@google.com>
To: kvm@vger.kernel.org, pbonzini@redhat.com, drjones@redhat.com
Cc: marcorr@google.com, baekhw@google.com, tmroeder@google.com,
	erdemaktas@google.com, rientjes@google.com, seanjc@google.com,
	brijesh.singh@amd.com, Thomas.Lendacky@amd.com,
	varad.gautam@suse.com, jroedel@suse.de, bp@suse.de,
	Zixuan Wang <zixuanwang@google.com>
Subject: [kvm-unit-tests RFC 10/16] x86 AMD SEV: Initial support
Date: Wed, 18 Aug 2021 00:08:59 +0000	[thread overview]
Message-ID: <20210818000905.1111226-11-zixuanwang@google.com> (raw)
In-Reply-To: <20210818000905.1111226-1-zixuanwang@google.com>

AMD Secure Encrypted Virtualization (SEV) is a hardware accelerated
memory encryption feature that protects guest VMs from host attacks.

This commit provides set up code and a test case for AMD SEV. The set up
code checks if SEV is supported and enabled, and then sets SEV c-bit for
each page table entry.

Signed-off-by: Zixuan Wang <zixuanwang@google.com>
Co-developed-by: Hyunwook (Wooky) Baek <baekhw@google.com>
---
 configure           |  9 +++++++
 lib/x86/amd_sev.c   | 50 +++++++++++++++++++++++++++++++++++
 lib/x86/amd_sev.h   | 41 +++++++++++++++++++++++++++++
 lib/x86/asm/setup.h |  3 +++
 lib/x86/setup.c     | 24 +++++++++++++++++
 x86/Makefile.common | 10 +++++++
 x86/Makefile.x86_64 |  3 +++
 x86/amd_sev.c       | 64 +++++++++++++++++++++++++++++++++++++++++++++
 8 files changed, 204 insertions(+)
 create mode 100644 lib/x86/amd_sev.c
 create mode 100644 lib/x86/amd_sev.h
 create mode 100644 x86/amd_sev.c

diff --git a/configure b/configure
index 3094375..c165ba7 100755
--- a/configure
+++ b/configure
@@ -31,6 +31,8 @@ earlycon=
 target_efi=
 efi_include_path=
 efi_libs_path=
+amd_sev=
+amd_sev_variant=
 
 usage() {
     cat <<-EOF
@@ -77,6 +79,7 @@ usage() {
 	    --efi-libs-path        Path to GNU-EFI libraries, e.g. "/usr/lib/". This dir should
 	                           contain 3 files from GNU-EFI: crt0-efi-x86_64.o, libefi.a,
 	                           and libgnuefi.a
+	    --amd-sev=VARIANT      AMD SEV variant, [SEV|ES|SNP]
 EOF
     exit 1
 }
@@ -150,6 +153,10 @@ while [[ "$1" = -* ]]; do
 	--efi-libs-path)
 	    efi_libs_path="$arg"
 	    ;;
+	--amd-sev)
+	    amd_sev=y
+	    [ "${arg^^}" != "SEV" ] && amd_sev_variant="${arg^^}"
+	    ;;
 	--help)
 	    usage
 	    ;;
@@ -361,6 +368,8 @@ HOST_KEY_DOCUMENT=$host_key_document
 TARGET_EFI=$target_efi
 EFI_INCLUDE_PATH=$efi_include_path
 EFI_LIBS_PATH=$efi_libs_path
+AMD_SEV=$amd_sev
+AMD_SEV_VARIANT=$amd_sev_variant
 EOF
 if [ "$arch" = "arm" ] || [ "$arch" = "arm64" ]; then
     echo "TARGET=$target" >> config.mak
diff --git a/lib/x86/amd_sev.c b/lib/x86/amd_sev.c
new file mode 100644
index 0000000..bd8d536
--- /dev/null
+++ b/lib/x86/amd_sev.c
@@ -0,0 +1,50 @@
+/*
+ * AMD SEV support in KVM-Unit-Tests
+ *
+ * Copyright (c) 2021, Google Inc
+ *
+ * Authors:
+ *   Zixuan Wang <zixuanwang@google.com>
+ *
+ * SPDX-License-Identifier: LGPL-2.0-or-later
+ */
+
+#include "amd_sev.h"
+#include "x86/processor.h"
+
+static unsigned long long amd_sev_c_bit_pos;
+
+EFI_STATUS setup_amd_sev(void)
+{
+	struct cpuid cpuid_out;
+
+	/* Test if we can query SEV features */
+	cpuid_out = cpuid(CPUID_FN_LARGEST_EXT_FUNC_NUM);
+	if (cpuid_out.a < CPUID_FN_ENCRYPT_MEM_CAPAB) {
+		return EFI_UNSUPPORTED;
+	}
+
+	/* Test if SEV is supported */
+	cpuid_out = cpuid(CPUID_FN_ENCRYPT_MEM_CAPAB);
+	if (!(cpuid_out.a & SEV_SUPPORT_MASK)) {
+		return EFI_UNSUPPORTED;
+	}
+
+	/* Test if SEV is enabled */
+	if (!(rdmsr(MSR_SEV_STATUS) & SEV_ENABLED_MASK)) {
+		return EFI_NOT_READY;
+	}
+
+	/* Extract C-Bit position from ebx[5:0]
+	 * AMD64 Architecture Programmer's Manual Volume 3
+	 *   - Section " Function 8000_001Fh - Encrypted Memory Capabilities"
+	 */
+	amd_sev_c_bit_pos = (unsigned long long)(cpuid_out.b & 0x3f);
+
+	return EFI_SUCCESS;
+}
+
+unsigned long long get_amd_sev_c_bit_mask(void)
+{
+	return 1ull << amd_sev_c_bit_pos;
+}
diff --git a/lib/x86/amd_sev.h b/lib/x86/amd_sev.h
new file mode 100644
index 0000000..c1b08e8
--- /dev/null
+++ b/lib/x86/amd_sev.h
@@ -0,0 +1,41 @@
+/*
+ * AMD SEV support in KVM-Unit-Tests
+ *
+ * Copyright (c) 2021, Google Inc
+ *
+ * Authors:
+ *   Zixuan Wang <zixuanwang@google.com>
+ *
+ * SPDX-License-Identifier: LGPL-2.0-or-later
+ */
+
+#ifndef _X86_AMD_SEV_H_
+#define _X86_AMD_SEV_H_
+
+#include "libcflat.h"
+#include "desc.h"
+#include "asm/page.h"
+
+#ifdef ALIGN
+#undef ALIGN
+#endif
+#include <efi.h>
+
+/* AMD Programmer's Manual Volume 3
+ *   - Section "Function 8000_0000h - Maximum Extended Function Number and Vendor String"
+ *   - Section "Function 8000_001Fh - Encrypted Memory Capabilities"
+ */
+#define CPUID_FN_LARGEST_EXT_FUNC_NUM 0x80000000
+#define CPUID_FN_ENCRYPT_MEM_CAPAB    0x8000001f
+#define SEV_SUPPORT_MASK              0b10
+
+/* AMD Programmer's Manual Volume 2
+ *   - Section "SEV_STATUS MSR"
+ */
+#define MSR_SEV_STATUS   0xc0010131
+#define SEV_ENABLED_MASK 0b1
+
+EFI_STATUS setup_amd_sev(void);
+unsigned long long get_amd_sev_c_bit_mask(void);
+
+#endif /* _X86_AMD_SEV_H_ */
diff --git a/lib/x86/asm/setup.h b/lib/x86/asm/setup.h
index c32168e..1d69c6e 100644
--- a/lib/x86/asm/setup.h
+++ b/lib/x86/asm/setup.h
@@ -7,6 +7,9 @@
 #include "x86/processor.h"
 #include "x86/smp.h"
 #include "asm/page.h"
+#ifdef CONFIG_AMD_SEV
+#include "x86/amd_sev.h"
+#endif /* CONFIG_AMD_SEV */
 
 #ifdef ALIGN
 #undef ALIGN
diff --git a/lib/x86/setup.c b/lib/x86/setup.c
index 0b0dbea..aaa1cce 100644
--- a/lib/x86/setup.c
+++ b/lib/x86/setup.c
@@ -214,6 +214,25 @@ EFI_STATUS setup_efi_pre_boot(UINTN *mapkey, efi_bootinfo_t *efi_bootinfo)
 		return status;
 	}
 
+#ifdef CONFIG_AMD_SEV
+	status = setup_amd_sev();
+	if (EFI_ERROR(status)) {
+		printf("setup_amd_sev() failed: ");
+		switch (status) {
+		case EFI_UNSUPPORTED:
+			printf("SEV is not supported\n");
+			break;
+		case EFI_NOT_READY:
+			printf("SEV is not enabled\n");
+			break;
+		default:
+			printf("Unknown error\n");
+			break;
+		}
+		return status;
+	}
+#endif /* CONFIG_AMD_SEV */
+
 	return EFI_SUCCESS;
 }
 
@@ -232,6 +251,11 @@ static void setup_page_table(void)
 	/* Set default flags */
 	flags = PT_PRESENT_MASK | PT_WRITABLE_MASK | PT_USER_MASK;
 
+#ifdef CONFIG_AMD_SEV
+	/* Set AMD SEV C-Bit for page table entries */
+	flags |= get_amd_sev_c_bit_mask();
+#endif /* CONFIG_AMD_SEV */
+
 	/* Level 5 */
 	curr_pt = (pgd_t *)&ptl5;
 	curr_pt[0] = ((phys_addr_t)&ptl4) | flags;
diff --git a/x86/Makefile.common b/x86/Makefile.common
index e77de6b..8f9ddad 100644
--- a/x86/Makefile.common
+++ b/x86/Makefile.common
@@ -25,6 +25,9 @@ cflatobjs += lib/x86/delay.o
 ifeq ($(TARGET_EFI),y)
 cflatobjs += lib/x86/setup.o
 cflatobjs += lib/efi.o
+ifeq ($(AMD_SEV),y)
+cflatobjs += lib/x86/amd_sev.o
+endif
 endif
 
 OBJDIRS += lib/x86
@@ -38,6 +41,13 @@ COMMON_CFLAGS += -Wa,--divide
 endif
 COMMON_CFLAGS += -O1
 
+ifeq ($(AMD_SEV),y)
+COMMON_CFLAGS += -DCONFIG_AMD_SEV
+ifneq ($(AMD_SEV_VARIANT),)
+COMMON_CFLAGS += -DCONFIG_AMD_SEV_$(AMD_SEV_VARIANT)
+endif
+endif
+
 # stack.o relies on frame pointers.
 KEEP_FRAME_POINTER := y
 
diff --git a/x86/Makefile.x86_64 b/x86/Makefile.x86_64
index 7e8a57a..c1af80c 100644
--- a/x86/Makefile.x86_64
+++ b/x86/Makefile.x86_64
@@ -32,6 +32,9 @@ tests += $(TEST_DIR)/pks.$(exe)
 tests += $(TEST_DIR)/pmu_lbr.$(exe)
 tests += $(TEST_DIR)/emulator.$(exe)
 tests += $(TEST_DIR)/vmware_backdoors.$(exe)
+ifeq ($(AMD_SEV),y)
+tests += $(TEST_DIR)/amd_sev.$(exe)
+endif
 
 # The following test cases are disabled when building EFI tests because they
 # use absolute addresses in their inline assembly code, which cannot compile
diff --git a/x86/amd_sev.c b/x86/amd_sev.c
new file mode 100644
index 0000000..a07a48f
--- /dev/null
+++ b/x86/amd_sev.c
@@ -0,0 +1,64 @@
+/*
+ * AMD SEV test cases
+ *
+ * Copyright (c) 2021, Google Inc
+ *
+ * Authors:
+ *   Hyunwook (Wooky) Baek <baekhw@google.com>
+ *   Zixuan Wang <zixuanwang@google.com>
+ *
+ * SPDX-License-Identifier: LGPL-2.0-or-later
+ */
+
+#include "libcflat.h"
+#include "x86/processor.h"
+#include "x86/amd_sev.h"
+
+#define EXIT_SUCCESS 0
+#define EXIT_FAILURE 1
+
+static int test_sev_activation(void)
+{
+	struct cpuid cpuid_out;
+	u64 msr_out;
+
+	printf("SEV activation test is loaded.\n");
+
+	/* Tests if CPUID function to check SEV is implemented */
+	cpuid_out = cpuid(CPUID_FN_LARGEST_EXT_FUNC_NUM);
+	printf("CPUID Fn8000_0000[EAX]: 0x%08x\n", cpuid_out.a);
+	if (cpuid_out.a < CPUID_FN_ENCRYPT_MEM_CAPAB) {
+		printf("CPUID does not support FN%08x\n",
+		       CPUID_FN_ENCRYPT_MEM_CAPAB);
+		return EXIT_FAILURE;
+	}
+
+	/* Tests if SEV is supported */
+	cpuid_out = cpuid(CPUID_FN_ENCRYPT_MEM_CAPAB);
+	printf("CPUID Fn8000_001F[EAX]: 0x%08x\n", cpuid_out.a);
+	printf("CPUID Fn8000_001F[EBX]: 0x%08x\n", cpuid_out.b);
+	if (!(cpuid_out.a & SEV_SUPPORT_MASK)) {
+		printf("SEV is not supported.\n");
+		return EXIT_FAILURE;
+	}
+	printf("SEV is supported\n");
+
+	/* Tests if SEV is enabled */
+	msr_out = rdmsr(MSR_SEV_STATUS);
+	printf("MSR C001_0131[EAX]: 0x%08lx\n", msr_out & 0xffffffff);
+	if (!(msr_out & SEV_ENABLED_MASK)) {
+		printf("SEV is not enabled.\n");
+		return EXIT_FAILURE;
+	}
+	printf("SEV is enabled\n");
+
+	return EXIT_SUCCESS;
+}
+
+int main(void)
+{
+	int rtn;
+	rtn = test_sev_activation();
+	report(rtn == EXIT_SUCCESS, "SEV activation test.");
+	return report_summary();
+}
-- 
2.33.0.rc1.237.g0d66db33f3-goog


  parent reply	other threads:[~2021-08-18  0:09 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-18  0:08 [kvm-unit-tests RFC 00/16] x86_64 UEFI and AMD SEV/SEV-ES support Zixuan Wang
2021-08-18  0:08 ` [kvm-unit-tests RFC 01/16] x86 UEFI: Copy code from GNU-EFI Zixuan Wang
2021-08-18  0:08 ` [kvm-unit-tests RFC 02/16] x86 UEFI: Boot from UEFI Zixuan Wang
2021-08-18  0:08 ` [kvm-unit-tests RFC 03/16] x86 UEFI: Move setjmp.h out of desc.h Zixuan Wang
2021-08-18  0:08 ` [kvm-unit-tests RFC 04/16] x86 UEFI: Load KVM-Unit-Tests IDT after UEFI boot up Zixuan Wang
2021-08-18  0:08 ` [kvm-unit-tests RFC 05/16] x86 UEFI: Load GDT and TSS " Zixuan Wang
2021-08-18  0:08 ` [kvm-unit-tests RFC 06/16] x86 UEFI: Set up memory allocator Zixuan Wang
2021-08-18  0:08 ` [kvm-unit-tests RFC 07/16] x86 UEFI: Set up RSDP after UEFI boot up Zixuan Wang
2021-08-18  0:08 ` [kvm-unit-tests RFC 08/16] x86 UEFI: Set up page tables Zixuan Wang
2021-08-18  0:08 ` [kvm-unit-tests RFC 09/16] x86 UEFI: Convert x86 test cases to PIC Zixuan Wang
2021-08-18  0:08 ` Zixuan Wang [this message]
2021-08-18  0:09 ` [kvm-unit-tests RFC 11/16] x86 AMD SEV: Page table with c-bit Zixuan Wang
2021-08-18  0:09 ` [kvm-unit-tests RFC 12/16] x86 AMD SEV-ES: Check SEV-ES status Zixuan Wang
2021-08-18  0:09 ` [kvm-unit-tests RFC 13/16] x86 AMD SEV-ES: Load GDT with UEFI segments Zixuan Wang
2021-08-18  0:09 ` [kvm-unit-tests RFC 14/16] x86 AMD SEV-ES: Copy UEFI #VC IDT entry Zixuan Wang
2021-08-20 23:50   ` Sean Christopherson
2021-08-21  0:37     ` Marc Orr
2021-08-21  0:47     ` Zixuan Wang
2021-08-18  0:09 ` [kvm-unit-tests RFC 15/16] x86 AMD SEV-ES: Set up GHCB page Zixuan Wang
2021-08-18  0:09 ` [kvm-unit-tests RFC 16/16] x86 AMD SEV-ES: Add test cases Zixuan Wang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210818000905.1111226-11-zixuanwang@google.com \
    --to=zixuanwang@google.com \
    --cc=Thomas.Lendacky@amd.com \
    --cc=baekhw@google.com \
    --cc=bp@suse.de \
    --cc=brijesh.singh@amd.com \
    --cc=drjones@redhat.com \
    --cc=erdemaktas@google.com \
    --cc=jroedel@suse.de \
    --cc=kvm@vger.kernel.org \
    --cc=marcorr@google.com \
    --cc=pbonzini@redhat.com \
    --cc=rientjes@google.com \
    --cc=seanjc@google.com \
    --cc=tmroeder@google.com \
    --cc=varad.gautam@suse.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).