[lkml]   [2021]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[RFC PATCH 0/4] TDX KVM selftests
TDX stands for Trust Domain Extensions which isolates VMs from the
virtual-machine manager (VMM)/hypervisor and any other software on the

Intel has recently submitted a set of RFC patches for KVM support for
TDX and more information can be found on the latest TDX Support

Due to the nature of the confidential computing environment that TDX
provides, it is very difficult to verify/test the KVM support. TDX
requires UEFI and the guest kernel to be enlightened which are all under

We are working on a set of selftests to close this gap and be able to
verify the KVM functionality to support TDX lifecycle and GHCI [1]

We are looking for any feedback on:
- Patch series itself
- Any suggestion on how we should approach testing TDX functionality.
Does selftests seems reasonable or should we switch to using KVM
unit tests. I would be happy to get some perspective on how KVM unit
tests can help us more.
- Any test case or scenario that we should add.
- Anything else I have not thought of yet.

Current patch series provide the following capabilities:

- Provide helper functions to create a TD (Trusted Domain) using the KVM
- Provide helper functions to create a guest image that can include any
testing code
- Provide helper functions and wrapper functions to write testing code
using GHCI interface
- Add a test case that verifies TDX life cycle
- Add a test case that verifies TDX GHCI port IO

- Use existing function to create page tables dynamically
(ie __virt_pg_map())
- Remove arbitrary defined magic numbers for data structure offsets
- Add TDVMCALL for error reporting
- Add additional test cases as some listed below
- Add #VE handlers to help testing more complicated test cases

Other test cases that we are planning to add:
(with credit to

VM call interface Input Output Result
GetTdVmCallInfo R12=0 None VMCALL_SUCCESS
MapGPA Map private page (GPA.S=0) VMCALL_SUCCESS
MapGPA Map shared page (GPA.S=1) VMCALL_SUCCESS
MapGPA Map already private page as private VMCALL_INVALID_OPERAND
MapGPA Map already shared page as shared VMCALL_INVALID_OPERAND
SetupEventNotifyInterrupt Valid interrupt value (32:255) VMCALL_SUCCESS
SetupEventNotifyInterrupt Invalid value (>255) VMCALL_INVALID_OPERAND
Instruction.CPUID R12(EAX)=1, R13(ECX)=0 EBX[8:15]=0x8
Instruction.IO Read/Write 1/2/4 bytes VMCALL_SUCCESS
Instruction.IO Read/Write 3 bytes VMCALL_INVALID_OPERAND
Instruction.RDMSR Accessible register R11=msr_value VMCALL_SUCCESS
Inaccessible register VMCALL_INVALID_OPERAND
Instruction.RDMSR Accessible register VMCALL_SUCCESS
Inaccessible register VMCALL_INVALID_OPERAND

[1] Intel TDX Guest-Hypervisor Communication Interface

Erdem Aktas (4):
KVM: selftests: Add support for creating non-default type VMs
KVM: selftest: Add helper functions to create TDX VMs
KVM: selftest: Adding TDX life cycle test.
KVM: selftest: Adding test case for TDX port IO

tools/testing/selftests/kvm/Makefile | 6 +-
.../testing/selftests/kvm/include/kvm_util.h | 1 +
.../selftests/kvm/include/x86_64/processor.h | 5 +
tools/testing/selftests/kvm/lib/kvm_util.c | 29 +-
.../selftests/kvm/lib/x86_64/processor.c | 23 ++
tools/testing/selftests/kvm/lib/x86_64/tdx.h | 220 ++++++++++++
.../selftests/kvm/lib/x86_64/tdx_lib.c | 314 ++++++++++++++++++
.../selftests/kvm/x86_64/tdx_vm_tests.c | 209 ++++++++++++
8 files changed, 800 insertions(+), 7 deletions(-)
create mode 100644 tools/testing/selftests/kvm/lib/x86_64/tdx.h
create mode 100644 tools/testing/selftests/kvm/lib/x86_64/tdx_lib.c
create mode 100644 tools/testing/selftests/kvm/x86_64/tdx_vm_tests.c


 \ /
  Last update: 2021-07-26 20:42    [W:0.114 / U:2.216 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site