From nobody Thu Oct 2 01:01:44 2025 Received: from mail-pg1-f201.google.com (mail-pg1-f201.google.com [209.85.215.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF32231354A for ; Thu, 25 Sep 2025 17:29:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758821371; cv=none; b=p9vK0LBy2sPiKgz5kfBw1fMWEbumnpX3FoqNhzIYT2lTgZ1YFDxC0jhPKgm/EaBUjrUnNpndd38iwUYFcfMKbAmO3DxubPzWV7o7gXwQDrrXjsJ4NQ85bcv0viqUVUhOB86IPXLScRoPT9gfZlg7nXkUbhsMNSAISttHmX+VNa4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758821371; c=relaxed/simple; bh=xx91kaM8zfaoJEfsnflUjFDkM3EzKmV5y85jRHTVBqk=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=mxoNCC1BAlAFsYBwwxDx3jyfRciLpaXFGHv6YycAwL5mOYEqj+xZt/2XyjC35/uY5aXRVUXyJt23fFmcy2hPW2lIfuofnPGFh55EJLpCumxunKblc8UauWJ+CgLSUs3hEt/qjxkUbMlDaQ8H7iPNdE6SHOjgD13VBQXsytwwQr8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--sagis.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=zse5uVos; arc=none smtp.client-ip=209.85.215.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--sagis.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="zse5uVos" Received: by mail-pg1-f201.google.com with SMTP id 41be03b00d2f7-b54a30515cfso1731139a12.1 for ; Thu, 25 Sep 2025 10:29:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1758821368; x=1759426168; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=uVcHgjF8bZbQcV2iSiYNl9kU+EHyscxLqETDjVDPU48=; b=zse5uVosywTJ042cvfUru4JRVHVR/lo5yIsWwgf36YT2OcqXdPh4rxmQMBHf/fqmzp +tFfRQeGzC3WpX4G4meK6+kz5P0wz1wmhARzHM6YITnIswpRA0uStw9xkCLLrFozSjjb k1YVh2wZvUHQ/IEM7PkBuej0u+1VlJFwRMEhO2XWC5vxsq7xzN1Ftog/sdhELIMB+xUO IPOaNkaL+8qSLbNjobEhYRRl/IUqjs9wEBdA9koQpOZ6SDXrncGrLpH3nOYxglECG6qL opNwZQGozDrgjQdvjgn4obuXPkrfWcAKHv4IlZFQJ93CdFPzK75OvpmL875mh2W3V+09 gw8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1758821368; x=1759426168; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=uVcHgjF8bZbQcV2iSiYNl9kU+EHyscxLqETDjVDPU48=; b=f2klAq/aWSQppq+bSsRoQx+4HRRR92wmNtYj8GRlawTrEJjZclIa4HkA0Z9jisWRW0 bO/vodH0GuLkYF9QhHYj6fXfaTaqVk8coxtAZsOkkQB4UXNcBcZMDBocF7V0j0jnM+Ws MuACiSbhVPfRGgZ5dmDmqIMRtlzc1Q7sXD6DpEsamqTmr+CfH8BJ2TbjETtDBeYorV+H OuUxcS2LI9pt8Q9xj0BVcdMtEDr3hbXdlrq1VFOGEFeYZn33vnpoailmJmazGO7khZN7 SBmXBtJw8Ts0T+lVe7Wcs3bhbJ20Uxe7pOCQrUC9+Jh+oVey7nfHw5KMRyvqqsQCkDAx jhWg== X-Gm-Message-State: AOJu0YxrSfWLX9KBgYCquS0mKGugfRtAnZUJZdDYiRL2Q8gK2qmm0llv v4QnsufVAYeef1H+Eg6Y6vcj4wyNaeFDLvXVCPDtQ+xJDpeZiCMHPjKndifECyIsug6lMnNLjiJ LRA== X-Google-Smtp-Source: AGHT+IG9AJw6xYfZvbyyqhgBN+Q7ZNk6dh+OK2KGZhFSFOzyee1k1LKRYFhqhW75y1aQ/kh+PuFSno7gqA== X-Received: from pliy11.prod.google.com ([2002:a17:903:3d0b:b0:267:a5c9:8a4c]) (user=sagis job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:3bc4:b0:265:b60f:d18 with SMTP id d9443c01a7336-27ed6ad0c80mr32448345ad.1.1758821368252; Thu, 25 Sep 2025 10:29:28 -0700 (PDT) Date: Thu, 25 Sep 2025 10:28:46 -0700 In-Reply-To: <20250925172851.606193-1-sagis@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20250925172851.606193-1-sagis@google.com> X-Mailer: git-send-email 2.51.0.536.g15c5d4f767-goog Message-ID: <20250925172851.606193-19-sagis@google.com> Subject: [PATCH v11 18/21] KVM: selftests: Add support for TDX TDCALL from guest From: Sagi Shahar To: linux-kselftest@vger.kernel.org, Paolo Bonzini , Shuah Khan , Sean Christopherson , Ackerley Tng , Ryan Afranji , Andrew Jones , Isaku Yamahata , Erdem Aktas , Rick Edgecombe , Sagi Shahar , Roger Wang , Binbin Wu , Oliver Upton , "Pratik R. Sampat" , Reinette Chatre , Ira Weiny , Chao Gao , Chenyi Qiang Cc: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Erdem Aktas Add support for TDX guests to issue TDCALLs to the TDX module. Signed-off-by: Erdem Aktas Co-developed-by: Sagi Shahar Signed-off-by: Sagi Shahar --- tools/testing/selftests/kvm/Makefile.kvm | 8 ++ .../selftests/kvm/include/x86/tdx/tdcall.h | 34 +++++++ .../selftests/kvm/lib/x86/tdx/tdcall.S | 93 +++++++++++++++++++ .../kvm/lib/x86/tdx/tdcall_offsets.c | 16 ++++ 4 files changed, 151 insertions(+) create mode 100644 tools/testing/selftests/kvm/include/x86/tdx/tdcall.h create mode 100644 tools/testing/selftests/kvm/lib/x86/tdx/tdcall.S create mode 100644 tools/testing/selftests/kvm/lib/x86/tdx/tdcall_offsets.c diff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selft= ests/kvm/Makefile.kvm index 52c90f1c0484..2d4fd68984a0 100644 --- a/tools/testing/selftests/kvm/Makefile.kvm +++ b/tools/testing/selftests/kvm/Makefile.kvm @@ -20,6 +20,7 @@ LIBKVM +=3D lib/userfaultfd_util.c LIBKVM_STRING +=3D lib/string_override.c =20 LIBKVM_ASM_DEFS +=3D lib/x86/tdx/td_boot_offsets.c +LIBKVM_ASM_DEFS +=3D lib/x86/tdx/tdcall_offsets.c =20 LIBKVM_x86 +=3D lib/x86/apic.c LIBKVM_x86 +=3D lib/x86/handlers.S @@ -33,6 +34,7 @@ LIBKVM_x86 +=3D lib/x86/ucall.c LIBKVM_x86 +=3D lib/x86/vmx.c LIBKVM_x86 +=3D lib/x86/tdx/tdx_util.c LIBKVM_x86 +=3D lib/x86/tdx/td_boot.S +LIBKVM_x86 +=3D lib/x86/tdx/tdcall.S =20 LIBKVM_arm64 +=3D lib/arm64/gic.c LIBKVM_arm64 +=3D lib/arm64/gic_v3.c @@ -343,7 +345,13 @@ $(OUTPUT)/lib/x86/tdx/td_boot.o: $(OUTPUT)/include/x86= /tdx/td_boot_offsets.h $(OUTPUT)/include/x86/tdx/td_boot_offsets.h: $(OUTPUT)/lib/x86/tdx/td_boot= _offsets.s FORCE $(call filechk,offsets,__TDX_BOOT_OFFSETS_H__) =20 +$(OUTPUT)/lib/x86/tdx/tdcall.o: $(OUTPUT)/include/x86/tdx/tdcall_offsets.h + +$(OUTPUT)/include/x86/tdx/tdcall_offsets.h: $(OUTPUT)/lib/x86/tdx/tdcall_o= ffsets.s FORCE + $(call filechk,offsets,__TDCALL__OFFSETS_H__) + EXTRA_CLEAN +=3D $(OUTPUT)/include/x86/tdx/td_boot_offsets.h +EXTRA_CLEAN +=3D $(OUTPUT)/include/x86/tdx/tdcall_offsets.h =20 $(shell mkdir -p $(sort $(dir $(TEST_GEN_PROGS)))) $(SPLIT_TEST_GEN_OBJ): $(GEN_HDRS) diff --git a/tools/testing/selftests/kvm/include/x86/tdx/tdcall.h b/tools/t= esting/selftests/kvm/include/x86/tdx/tdcall.h new file mode 100644 index 000000000000..60c70646f876 --- /dev/null +++ b/tools/testing/selftests/kvm/include/x86/tdx/tdcall.h @@ -0,0 +1,34 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* Adapted from arch/x86/include/asm/shared/tdx.h */ + +#ifndef SELFTESTS_TDX_TDCALL_H +#define SELFTESTS_TDX_TDCALL_H + +#include + +#define TDX_TDCALL_HAS_OUTPUT BIT(0) + +#ifndef __ASSEMBLY__ + +#include + +/* + * Used in __tdx_tdcall() to pass down and get back registers' values of + * the TDCALL instruction when requesting services from the VMM. + * + * This is a software only structure and not part of the TDX module/VMM AB= I. + */ +struct tdx_tdcall_args { + u64 r10; + u64 r11; + u64 r12; + u64 r13; + u64 r14; + u64 r15; +}; + +/* Used to request services from the VMM */ +u64 __tdx_tdcall(struct tdx_tdcall_args *args, unsigned long flags); + +#endif // __ASSEMBLY__ +#endif // SELFTESTS_TDX_TDCALL_H diff --git a/tools/testing/selftests/kvm/lib/x86/tdx/tdcall.S b/tools/testi= ng/selftests/kvm/lib/x86/tdx/tdcall.S new file mode 100644 index 000000000000..05869e86b9d8 --- /dev/null +++ b/tools/testing/selftests/kvm/lib/x86/tdx/tdcall.S @@ -0,0 +1,93 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* Adapted from arch/x86/virt/vmx/tdx/tdxcall.S */ + +#ifndef __ASSEMBLY__ +#define __ASSEMBLY__ +#endif + +#include +#include "tdx/tdcall.h" +#include "tdx/tdcall_offsets.h" + +/* + * TDCALL is supported in Binutils >=3D 2.36, add it for older version. + */ +#define tdcall .byte 0x66,0x0f,0x01,0xcc + +/* + * Bitmasks of exposed registers (with VMM). + */ +#define TDX_R10 BIT(10) +#define TDX_R11 BIT(11) +#define TDX_R12 BIT(12) +#define TDX_R13 BIT(13) +#define TDX_R14 BIT(14) +#define TDX_R15 BIT(15) + +/* + * These registers are clobbered to hold arguments for each + * TDVMCALL. They are safe to expose to the VMM. + * Each bit in this mask represents a register ID. Bit field + * details can be found in TDX GHCI specification, section + * titled "TDCALL [TDG.VP.VMCALL] leaf". + */ +#define TDVMCALL_EXPOSE_REGS_MASK \ + (TDX_R10 | TDX_R11 | TDX_R12 | TDX_R13 | TDX_R14 | TDX_R15) + +.code64 +.section .text + +.globl __tdx_tdcall +.type __tdx_tdcall, @function +__tdx_tdcall: + /* Set up stack frame */ + push %rbp + movq %rsp, %rbp + + /* Save callee-saved GPRs as mandated by the x86_64 ABI */ + push %r15 + push %r14 + push %r13 + push %r12 + + /* Mangle function call ABI into TDCALL ABI: */ + /* Set TDCALL leaf ID (TDVMCALL (0)) in RAX */ + xor %eax, %eax + + /* Copy tdcall registers from arg struct: */ + movq TDX_TDCALL_R10(%rdi), %r10 + movq TDX_TDCALL_R11(%rdi), %r11 + movq TDX_TDCALL_R12(%rdi), %r12 + movq TDX_TDCALL_R13(%rdi), %r13 + movq TDX_TDCALL_R14(%rdi), %r14 + movq TDX_TDCALL_R15(%rdi), %r15 + + movl $TDVMCALL_EXPOSE_REGS_MASK, %ecx + + tdcall + + /* TDVMCALL leaf return code is in R10 */ + movq %r10, %rax + + /* Copy tdcall result registers to arg struct if needed */ + testq $TDX_TDCALL_HAS_OUTPUT, %rsi + jz .Lout + + movq %r10, TDX_TDCALL_R10(%rdi) + movq %r11, TDX_TDCALL_R11(%rdi) + movq %r12, TDX_TDCALL_R12(%rdi) + movq %r13, TDX_TDCALL_R13(%rdi) + movq %r14, TDX_TDCALL_R14(%rdi) + movq %r15, TDX_TDCALL_R15(%rdi) +.Lout: + /* Restore callee-saved GPRs as mandated by the x86_64 ABI */ + pop %r12 + pop %r13 + pop %r14 + pop %r15 + + pop %rbp + ret + +/* Disable executable stack */ +.section .note.GNU-stack,"",%progbits diff --git a/tools/testing/selftests/kvm/lib/x86/tdx/tdcall_offsets.c b/too= ls/testing/selftests/kvm/lib/x86/tdx/tdcall_offsets.c new file mode 100644 index 000000000000..dcd4457be6e5 --- /dev/null +++ b/tools/testing/selftests/kvm/lib/x86/tdx/tdcall_offsets.c @@ -0,0 +1,16 @@ +// SPDX-License-Identifier: GPL-2.0 +#define COMPILE_OFFSETS + +#include + +#include "tdx/tdcall.h" + +static void __attribute__((used)) common(void) +{ + OFFSET(TDX_TDCALL_R10, tdx_tdcall_args, r10); + OFFSET(TDX_TDCALL_R11, tdx_tdcall_args, r11); + OFFSET(TDX_TDCALL_R12, tdx_tdcall_args, r12); + OFFSET(TDX_TDCALL_R13, tdx_tdcall_args, r13); + OFFSET(TDX_TDCALL_R14, tdx_tdcall_args, r14); + OFFSET(TDX_TDCALL_R15, tdx_tdcall_args, r15); +} --=20 2.51.0.536.g15c5d4f767-goog