xref: /aosp_15_r20/external/linux-kselftest/android/patches/0014-ANDROID-kvm-Test-that-pVM-memory-is-wiped-during-tea.patch (revision 053f45be4e351dfd5e965df293cd45b779f579ee)

From 1c3b492b2863b4833ec3f9a4df5a827e69c64af8 Mon Sep 17 00:00:00 2001
From: Quentin Perret <[email protected]>
Date: Thu, 17 Feb 2022 19:34:27 +0000
Subject: [PATCH 14/20] ANDROID: kvm: Test that pVM memory is wiped during
 teardown

In protected KVM mode, we expect the hypervisor to protect guest secrets
when they are torn down. Add a test checking this property by running a
minimal guest, and checking that the content of memory has been wiped by
the hypervisor after teardown.

Note: although some of the pKVM code has already landed upstream, the
functionality tested here hasn't at the time of writing. Once it does,
this test should be sent upstream for review to replace this ANDROID
patch.

(cherry picked from commit a9dc703806031c8535c84c9905979f86dfaec1d3)
Bug: 218934075
Signed-off-by: Quentin Perret <[email protected]>
---
 .../selftests/kvm/aarch64/pvm_wipe_mem.c      | 174 ++++++++++++++++++
 1 file changed, 174 insertions(+)
 create mode 100644 tools/testing/selftests/kvm/aarch64/pvm_wipe_mem.c

diff --git a/tools/testing/selftests/kvm/aarch64/pvm_wipe_mem.c b/tools/testing/selftests/kvm/aarch64/pvm_wipe_mem.c
new file mode 100644
index 000000000000..4af8ca3c4bad
--- /dev/null
+++ b/tools/testing/selftests/kvm/aarch64/pvm_wipe_mem.c
@@ -0,0 +1,174 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Test checking that memory of protected guests is wiped after teardown.
+ *
+ * Copyright (C) 2022, Google LLC.
+ */
+
+#define _GNU_SOURCE
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <linux/kvm.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+
+#include "kselftest.h"
+
+#define KVM_VM_TYPE_ARM_PROTECTED	(1UL << 31)
+
+#define REG_X(number)	(0x6030000000100000ULL + (number) * 2UL)
+#define REG_PC		0x6030000000100040ULL
+
+static void set_one_reg(int vcpufd, uint64_t reg_id, uint64_t val)
+{
+	uint64_t reg_data;
+	struct kvm_one_reg reg;
+	int ret;
+
+	reg.addr = (__u64) &reg_data;
+	reg_data = val;
+	reg.id = reg_id;
+
+	ret = ioctl(vcpufd, KVM_SET_ONE_REG, &reg);
+	if (ret < 0)
+		ksft_exit_fail_msg("Failed to set reg: %d\n", ret);
+}
+
+static int get_kvm(void)
+{
+	size_t run_size;
+	int kvm, ret;
+
+	kvm = open("/dev/kvm", O_RDWR | O_CLOEXEC);
+	if (kvm < 0)
+		ksft_exit_skip("KVM not supported\n");
+
+	ret = ioctl(kvm, KVM_GET_API_VERSION, NULL);
+	if (ret != 12)
+		ksft_exit_fail_msg("KVM_GET_API_VERSION %d, expected 12", ret);
+
+	run_size = ioctl(kvm, KVM_GET_VCPU_MMAP_SIZE, NULL);
+	if (run_size < sizeof(struct kvm_run))
+		ksft_exit_fail_msg("KVM_GET_VCPU_MMAP_SIZE unexpectedly small\n");
+
+	return kvm;
+}
+
+static int create_protected_vm(int kvm)
+{
+	int vmfd = ioctl(kvm, KVM_CREATE_VM, KVM_VM_TYPE_ARM_PROTECTED);
+
+	if (vmfd < 0)
+		ksft_exit_skip("Protected guests not supported: %d\n", vmfd);
+
+	return vmfd;
+}
+
+static int create_vcpu(int vmfd, struct kvm_run **run)
+{
+	struct kvm_vcpu_init vcpu_init;
+	int vcpufd, ret;
+
+	ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, &vcpu_init);
+	if (ret)
+		ksft_exit_fail_msg("Failed to set kvm_vcpu_init %d\n", ret);
+
+	vcpufd = ioctl(vmfd, KVM_CREATE_VCPU, (unsigned long)0);
+	if (vcpufd < 0)
+		ksft_exit_fail_msg("Failed to create VCPU: %d\n", vcpufd);
+
+	*run = mmap(NULL, sizeof(**run), PROT_READ | PROT_WRITE, MAP_SHARED, vcpufd, 0);
+	if (!run)
+		ksft_exit_fail_msg("Failed to mmap vcpu_run struct\n");
+
+	ret = ioctl(vcpufd, KVM_ARM_VCPU_INIT, &vcpu_init);
+	if (ret)
+		ksft_exit_fail_msg("Failed to initialize VCPU %d\n", ret);
+
+	return vcpufd;
+}
+
+static void teardown(int kvm, int vmfd, int vcpufd, struct kvm_run *run)
+{
+	int ret = munmap(run, sizeof(*run));
+
+	if (ret)
+		ksft_exit_fail_msg("Failed to unmap vCPU run: %d\n", ret);
+
+	ret = close(vcpufd);
+	if (ret)
+		ksft_exit_fail_msg("Failed to destroy VCPU: %d\n", ret);
+
+	ret = close(vmfd);
+	if (ret)
+		ksft_exit_fail_msg("Failed to destroy VM: %d\n", ret);
+
+	ret = close(kvm);
+	if (ret)
+		ksft_exit_fail_msg("Failed to close KVM fd: %d\n", ret);
+}
+
+int main(void)
+{
+	struct kvm_userspace_memory_region region;
+	long page_size = sysconf(_SC_PAGESIZE);
+	int ret, kvm, vmfd, vcpufd;
+	uint32_t guest_code[2];
+	struct kvm_run *run;
+	uint8_t *guest_mem;
+	size_t run_size;
+
+	kvm = get_kvm();
+	vmfd = create_protected_vm(kvm);
+	vcpufd = create_vcpu(vmfd, &run);
+
+	/* Create a one-page memslot for the guest */
+	guest_mem = mmap(NULL, page_size, PROT_READ | PROT_WRITE,
+			MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+	if (guest_mem == MAP_FAILED)
+		ksft_exit_fail_msg("Failed to mmap guest memory\n");
+	region = (struct kvm_userspace_memory_region) {
+		.slot = 0,
+		.guest_phys_addr = 1UL << 30,
+		.memory_size = page_size,
+		.userspace_addr = (uint64_t)guest_mem,
+	};
+
+	/* Copy some code in guest memory. */
+	guest_code[0] = 0xf9400001;	/* 1:  ldr	x1, [x0]  */
+	guest_code[1] = 0x17ffffff;	/*     b	1b	  */
+	memcpy(guest_mem, guest_code, sizeof(guest_code));
+	ret = ioctl(vmfd, KVM_SET_USER_MEMORY_REGION, &region);
+	if (ret)
+		ksft_exit_fail_msg("Failed to set memory region: %d\n", ret);
+
+	/*
+	 * Get the VCPU to run one instruction, to be sure the page containing
+	 * the code has been faulted in.
+	 */
+	set_one_reg(vcpufd, REG_PC, region.guest_phys_addr);
+	set_one_reg(vcpufd, REG_X(0), region.guest_phys_addr + region.memory_size);
+	ret = ioctl(vcpufd, KVM_RUN, NULL);
+	if (ret)
+		ksft_exit_fail_msg("Failed to run vcpu: %d\n", ret);
+	if (run->exit_reason != KVM_EXIT_MMIO)
+		ksft_exit_fail_msg("Unexpected KVM exit reason: %u\n", run->exit_reason);
+
+	/*
+	 * Tear the guest down, and check that the donated memory has been
+	 * wiped by the hypervisor.
+	 */
+	teardown(kvm, vmfd, vcpufd, run);
+	if (!memcmp(guest_mem, guest_code, sizeof(guest_code)))
+		ksft_exit_fail_msg("Protected guest memory has not been poisoned\n");
+
+	ksft_exit_pass();
+}
--
2.42.0.609.gbb76f46606-goog