From 1715c9d6e1aa977b407081fb3164edbf1534fb5c Mon Sep 17 00:00:00 2001 From: Louis Burda Date: Fri, 3 Feb 2023 11:59:43 -0600 Subject: Properly implement target gfn stepping --- test/kvm-step.c | 3 +- test/kvm-targetstep | Bin 0 -> 118904 bytes test/kvm-targetstep.c | 227 ++++++++++++++++++ test/kvm-targetstep_guest | 1 + test/kvm-targetstep_guest.S | 40 ++++ test/qemu-eviction.c | 92 +++++++- test/sev-es.c | 546 -------------------------------------------- test/sev.c | 544 ------------------------------------------- 8 files changed, 355 insertions(+), 1098 deletions(-) create mode 100755 test/kvm-targetstep create mode 100644 test/kvm-targetstep.c create mode 100755 test/kvm-targetstep_guest create mode 100644 test/kvm-targetstep_guest.S delete mode 100644 test/sev-es.c delete mode 100644 test/sev.c (limited to 'test') diff --git a/test/kvm-step.c b/test/kvm-step.c index 2d24598..4cae764 100644 --- a/test/kvm-step.c +++ b/test/kvm-step.c @@ -34,7 +34,7 @@ monitor(struct kvm *kvm, bool baseline) ret = ioctl(kvm_dev, KVM_CPC_READ_COUNTS, counts); if (ret) err(1, "KVM_CPC_READ_COUNTS"); - printf("Event: rip:%llu cnt:%llu inst:%llu data:%llu ret:%llu\n", + printf("Event: rip:%08llx cnt:%llu inst:%08llx data:%08llx ret:%llu\n", vm_get_rip(), event.step.fault_count, event.step.fault_gfns[0], event.step.fault_gfns[1], event.step.retinst); @@ -146,7 +146,6 @@ main(int argc, const char **argv) if (ret && errno == EAGAIN) continue; if (ret) err(1, "KVM_CPC_POLL_EVENT"); - printf("%lu\n", event.id); if (event.type == CPC_EVENT_PAUSE) break; ret = ioctl(kvm_dev, KVM_CPC_ACK_EVENT, &event.id); diff --git a/test/kvm-targetstep b/test/kvm-targetstep new file mode 100755 index 0000000..be21a1d Binary files /dev/null and b/test/kvm-targetstep differ diff --git a/test/kvm-targetstep.c b/test/kvm-targetstep.c new file mode 100644 index 0000000..f30563c --- /dev/null +++ b/test/kvm-targetstep.c @@ -0,0 +1,227 @@ +#include "test/kvm-eviction.h" +#include "test/kvm.h" +#include "test/util.h" +#include "cachepc/uapi.h" + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +static int child; +static struct cpc_event event; + +uint64_t +monitor(struct kvm *kvm, bool baseline) +{ + uint8_t counts[L1_SETS]; + int ret; + + ret = ioctl(kvm_dev, KVM_CPC_POLL_EVENT, &event); + if (ret && errno == EAGAIN) return 0; + if (ret) err(1, "KVM_CPC_POLL_EVENT"); + + if (!baseline && event.type == CPC_EVENT_GUEST + && event.guest.type == CPC_GUEST_STOP_TRACK) + return 2; + + if (event.type == CPC_EVENT_TRACK_STEP) { + ret = ioctl(kvm_dev, KVM_CPC_READ_COUNTS, counts); + if (ret) err(1, "KVM_CPC_READ_COUNTS"); + + printf("Event: rip:%08llx cnt:%llu inst:%08llx data:%08llx ret:%llu\n", + vm_get_rip(), event.step.fault_count, + event.step.fault_gfns[0], event.step.fault_gfns[1], + event.step.retinst); + print_counts(counts); + printf("\n"); + print_counts_raw(counts); + printf("\n"); + } + + ret = ioctl(kvm_dev, KVM_CPC_ACK_EVENT, &event.id); + if (ret) err(1, "KVM_CPC_ACK_EVENT"); + + return 1; +} + +void +kill_child(void) +{ + printf("Killing vm..\n"); + kill(child, SIGKILL); +} + +int +main(int argc, const char **argv) +{ + struct ipc *ipc; + struct guest guest; + struct kvm kvm; + uint8_t baseline[L1_SETS]; + struct cpc_track_cfg cfg; + bool inst_gfn_avail; + uint64_t inst_gfn; + uint64_t eventcnt; + uint32_t arg; + int ret; + + vmtype = "kvm"; + if (argc > 1) vmtype = argv[1]; + if (strcmp(vmtype, "kvm") && strcmp(vmtype, "sev") + && strcmp(vmtype, "sev-es") + && strcmp(vmtype, "sev-snp")) + errx(1, "invalid vm mode: %s", vmtype); + + setvbuf(stdout, NULL, _IONBF, 0); + + kvm_setup_init(); + + ipc = ipc_alloc(); + + child = fork(); + if (child < 0) err(1, "fork"); + + if (child == 0) { + pin_process(0, TARGET_CORE, true); + + guest_init(&guest, "test/kvm-targetstep_guest"); + vm_init(&kvm, &guest); + guest_deinit(&guest); + + /* reset kernel module state */ + ret = ioctl(kvm_dev, KVM_CPC_RESET, NULL); + if (ret < 0) err(1, "KVM_CPC_RESET"); + + ipc_signal_parent(ipc); + ipc_wait_parent(ipc); + + printf("VM start\n"); + + do { + ret = ioctl(kvm.vcpufd, KVM_RUN, NULL); + if (ret < 0) err(1, "KVM_RUN"); + } while (kvm.run->exit_reason == KVM_EXIT_HLT); + + printf("VM exit\n"); + + vm_deinit(&kvm); + } else { + pin_process(0, SECONDARY_CORE, true); + + atexit(kill_child); + + ipc_wait_child(ipc); + + printf("Monitor start\n"); + + memset(&cfg, 0, sizeof(cfg)); + cfg.mode = CPC_TRACK_STEPS; + cfg.steps.with_data = true; + ret = ioctl(kvm_dev, KVM_CPC_TRACK_MODE, &cfg); + if (ret) err(1, "KVM_CPC_TRACK_MODE"); + + arg = true; + ret = ioctl(kvm_dev, KVM_CPC_CALC_BASELINE, &arg); + if (ret) err(1, "KVM_CPC_CALC_BASELINE"); + + ipc_signal_child(ipc); + + /* run vm while baseline is calculated */ + eventcnt = 0; + while (eventcnt < 50) { + eventcnt += monitor(&kvm, true); + } + + ret = ioctl(kvm_dev, KVM_CPC_VM_REQ_PAUSE); + if (ret) err(1, "KVM_CPC_VM_REQ_PAUSE"); + + while (1) { + ret = ioctl(kvm_dev, KVM_CPC_POLL_EVENT, &event); + if (ret && errno == EAGAIN) continue; + if (ret) err(1, "KVM_CPC_POLL_EVENT"); + + if (event.type == CPC_EVENT_PAUSE) break; + + ret = ioctl(kvm_dev, KVM_CPC_ACK_EVENT, &event.id); + if (ret) err(1, "KVM_CPC_ACK_EVENT"); + } + + arg = false; + ret = ioctl(kvm_dev, KVM_CPC_CALC_BASELINE, &arg); + if (ret) err(1, "KVM_CPC_CALC_BASELINE"); + + ret = ioctl(kvm_dev, KVM_CPC_READ_BASELINE, baseline); + if (ret) err(1, "KVM_CPC_READ_BASELINE"); + + printf("\nBaseline:\n"); + print_counts(baseline); + printf("\n"); + print_counts_raw(baseline); + printf("\n\n"); + + arg = true; + ret = ioctl(kvm_dev, KVM_CPC_APPLY_BASELINE, &arg); + if (ret) err(1, "KMV_CPC_APPLY_BASELINE"); + + memset(&cfg, 0, sizeof(cfg)); + cfg.mode = CPC_TRACK_PAGES; + ret = ioctl(kvm_dev, KVM_CPC_TRACK_MODE, &cfg); + if (ret) err(1, "KVM_CPC_TRACK_MODE"); + + ret = ioctl(kvm_dev, KVM_CPC_ACK_EVENT, &event.id); + if (ret) err(1, "KVM_CPC_ACK_EVENT"); + + /* wait for CPC_GUEST_START_TRACK */ + + inst_gfn_avail = false; + while (1) { + ret = ioctl(kvm_dev, KVM_CPC_POLL_EVENT, &event); + if (ret && errno == EAGAIN) continue; + if (ret) err(1, "KVM_CPC_POLL_EVENT"); + + if (inst_gfn_avail && event.type == CPC_EVENT_GUEST + && event.guest.type == CPC_GUEST_START_TRACK) + break; + + if (event.type == CPC_EVENT_TRACK_PAGE) { + inst_gfn = event.page.inst_gfn; + inst_gfn_avail = true; + } + + ret = ioctl(kvm_dev, KVM_CPC_ACK_EVENT, &event.id); + if (ret) err(1, "KVM_CPC_ACK_EVENT"); + } + + /* start step tracking for target gfn */ + + printf("Target GFN: %08llx\n", inst_gfn); + + memset(&cfg, 0, sizeof(cfg)); + cfg.mode = CPC_TRACK_STEPS; + cfg.steps.target_gfn = inst_gfn; + cfg.steps.use_target = true; + cfg.steps.with_data = true; + ret = ioctl(kvm_dev, KVM_CPC_TRACK_MODE, &cfg); + if (ret) err(1, "KVM_CPC_TRACK_MODE"); + + ret = ioctl(kvm_dev, KVM_CPC_ACK_EVENT, &event.id); + if (ret) err(1, "KVM_CPC_ACK_EVENT"); + + while (monitor(&kvm, false) != 2); + + printf("Monitor exit\n"); + } + + ipc_free(ipc); + + kvm_setup_deinit(); +} + diff --git a/test/kvm-targetstep_guest b/test/kvm-targetstep_guest new file mode 100755 index 0000000..2dab495 --- /dev/null +++ b/test/kvm-targetstep_guest @@ -0,0 +1 @@ +¹»¸îÙ»ÀŠ»@Š»ÀŠ¹»¸îÙéÖ¿ \ No newline at end of file diff --git a/test/kvm-targetstep_guest.S b/test/kvm-targetstep_guest.S new file mode 100644 index 0000000..6625c54 --- /dev/null +++ b/test/kvm-targetstep_guest.S @@ -0,0 +1,40 @@ +#include "cachepc/const.h" + +#define TARGET_SET 15 + +.text +.align(16) +.code16gcc + +guest: +.rept L1_LINESIZE * L1_SETS * 2 + nop +.endr + + mov $0, %cx + mov $CPC_GUEST_START_TRACK, %bx + mov $KVM_HC_CPC_VMMCALL_SIGNAL, %ax + vmmcall + + mov $(L1_LINESIZE * (L1_SETS + 11)), %bx + movb (%bx), %bl + + mov $(L1_LINESIZE * (L1_SETS + 13)), %bx + movb (%bx), %bl + + mov $(L1_LINESIZE * (L1_SETS + 15)), %bx + movb (%bx), %bl + + # this should only be partially single-stepped if + # single-stepping is limited to the first page +.rept L1_LINESIZE * L1_SETS * 2 + nop +.endr + + mov $0, %cx + mov $CPC_GUEST_STOP_TRACK, %bx + mov $KVM_HC_CPC_VMMCALL_SIGNAL, %ax + vmmcall + + jmp guest + diff --git a/test/qemu-eviction.c b/test/qemu-eviction.c index 823e0ac..2392472 100644 --- a/test/qemu-eviction.c +++ b/test/qemu-eviction.c @@ -16,6 +16,7 @@ #include static struct cpc_event event; +static struct cpc_event_batch batch; int monitor(bool baseline) @@ -56,6 +57,24 @@ monitor(bool baseline) return 1; } +void +read_batch(void) +{ + uint32_t i; + int ret; + + ret = ioctl(kvm_dev, KVM_CPC_READ_BATCH, &batch); + if (ret && errno == EAGAIN) return; + if (ret && errno != EAGAIN) err(1, "KVM_CPC_READ_BATCH"); + + for (i = 0; i < batch.cnt; i++) { + if (batch.buf[i].type != CPC_EVENT_TRACK_PAGE) + continue; + + printf("GFN %08llx\n", batch.buf[i].page.inst_gfn); + } +} + void reset(int sig) { @@ -63,6 +82,8 @@ reset(int sig) ret = ioctl(kvm_dev, KVM_CPC_RESET); if (ret) err(1, "KVM_CPC_RESET"); + + exit(1); } int @@ -70,6 +91,7 @@ main(int argc, const char **argv) { uint8_t baseline[L1_SETS]; struct cpc_track_cfg cfg; + bool first_guest_event; uint32_t eventcnt; uint32_t arg; int ret; @@ -83,6 +105,8 @@ main(int argc, const char **argv) ret = ioctl(kvm_dev, KVM_CPC_RESET); if (ret) err(1, "KVM_CPC_RESET"); + signal(SIGINT, reset); + arg = true; ret = ioctl(kvm_dev, KVM_CPC_CALC_BASELINE, &arg); if (ret) err(1, "KVM_CPC_CALC_BASELINE"); @@ -90,6 +114,7 @@ main(int argc, const char **argv) memset(&cfg, 0, sizeof(cfg)); cfg.mode = CPC_TRACK_STEPS; cfg.steps.with_data = true; + cfg.steps.use_filter = true; ret = ioctl(kvm_dev, KVM_CPC_TRACK_MODE, &cfg); if (ret) err(1, "KVM_CPC_RESET"); @@ -129,23 +154,78 @@ main(int argc, const char **argv) print_counts_raw(baseline); printf("\n\n"); + memset(&cfg, 0, sizeof(&cfg)); + cfg.mode = CPC_TRACK_NONE; + ret = ioctl(kvm_dev, KVM_CPC_TRACK_MODE, &cfg); + if (ret) err(1, "KVM_CPC_TRACK_MODE"); + + ret = ioctl(kvm_dev, KVM_CPC_ACK_EVENT, &event.id); + if (ret) err(1, "KVM_CPC_ACK_EVENT"); + + /* wait until guest program is run */ + printf("Press enter to continue..\n"); + getchar(); + + arg = true; + ret = ioctl(kvm_dev, KVM_CPC_BATCH_EVENTS, &arg); + if (ret) err(1, "KVM_CPC_BATCH_EVENTS"); + + memset(&cfg, 0, sizeof(cfg)); + cfg.mode = CPC_TRACK_PAGES; + ret = ioctl(kvm_dev, KVM_CPC_TRACK_MODE, &cfg); + if (ret) err(1, "KVM_CPC_TRACK_MODE"); + + batch.cnt = 0; + batch.maxcnt = CPC_EVENT_BATCH_MAX; + batch.buf = malloc(sizeof(struct cpc_event) * batch.maxcnt); + if (!batch.buf) err(1, "malloc"); + + first_guest_event = true; + while (1) { + ret = ioctl(kvm_dev, KVM_CPC_POLL_EVENT, &event); + if (ret && errno == EAGAIN) continue; + if (ret) err(1, "KVM_CPC_POLL_EVENT"); + + printf("EVENT %i\n", event.type); + + if (event.type == CPC_EVENT_GUEST + && event.guest.type == CPC_GUEST_START_TRACK) { + if (!first_guest_event) + break; + first_guest_event = false; + } + + if (event.type == CPC_EVENT_BATCH) + read_batch(); + + ret = ioctl(kvm_dev, KVM_CPC_ACK_EVENT, &event.id); + if (ret) err(1, "KVM_CPC_ACK_EVENT"); + } + + read_batch(); + + if (!batch.cnt) errx(1, "empty batch buffer"); memset(&cfg, 0, sizeof(cfg)); - cfg.steps.target_gfn = 0; /* TODO */ - cfg.steps.use_target = true; cfg.mode = CPC_TRACK_STEPS; - ret = ioctl(kvm_dev, KVM_CPC_TRACK_MODE, &arg); - if (ret) err(1, "KVM_CPC_RESET"); + cfg.steps.target_gfn = batch.buf[batch.cnt - 3].page.inst_gfn; + cfg.steps.use_target = true; + cfg.steps.use_filter = true; + cfg.steps.with_data = true; + ret = ioctl(kvm_dev, KVM_CPC_TRACK_MODE, &cfg); + if (ret) err(1, "KVM_CPC_TRACK_MODE"); ret = ioctl(kvm_dev, KVM_CPC_ACK_EVENT, &event.id); if (ret) err(1, "KVM_CPC_ACK_EVENT"); - signal(SIGINT, reset); - while (monitor(false) != 2); + signal(SIGINT, NULL); + ret = ioctl(kvm_dev, KVM_CPC_RESET); if (ret) err(1, "KVM_CPC_RESET"); + free(batch.buf); + kvm_setup_deinit(); } diff --git a/test/sev-es.c b/test/sev-es.c deleted file mode 100644 index ad9b1e5..0000000 --- a/test/sev-es.c +++ /dev/null @@ -1,546 +0,0 @@ -#define _GNU_SOURCE - -#include "cachepc/uapi.h" - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#define ARRLEN(x) (sizeof(x) / sizeof((x)[0])) -#define MIN(a,b) ((a) > (b) ? (b) : (a)) - -#define SAMPLE_COUNT 100 - -#define TARGET_CORE 2 -#define SECONDARY_CORE 3 - -#define TARGET_CACHE_LINESIZE 64 -#define TARGET_SET 15 - -struct kvm { - int vmfd, vcpufd; - void *mem; - size_t memsize; - struct kvm_run *run; -}; - -/* start and end for guest assembly */ -extern uint8_t __start_guest_with[]; -extern uint8_t __stop_guest_with[]; -extern uint8_t __start_guest_without[]; -extern uint8_t __stop_guest_without[]; - -bool ready = false; -bool processed = false; - -ssize_t sysret; -pid_t victim_pid; - -/* ioctl dev fds */ -int kvm_dev, sev_dev, kvm_dev; - -enum { - GSTATE_UNINIT, - GSTATE_LUPDATE, - GSTATE_LSECRET, - GSTATE_RUNNING, - GSTATE_SUPDATE, - GSTATE_RUPDATE, - GSTATE_SENT -}; - -const char *sev_fwerr_strs[] = { - "Success", - "Platform state is invalid", - "Guest state is invalid", - "Platform configuration is invalid", - "Buffer too small", - "Platform is already owned", - "Certificate is invalid", - "Policy is not allowed", - "Guest is not active", - "Invalid address", - "Bad signature", - "Bad measurement", - "Asid is already owned", - "Invalid ASID", - "WBINVD is required", - "DF_FLUSH is required", - "Guest handle is invalid", - "Invalid command", - "Guest is active", - "Hardware error", - "Hardware unsafe", - "Feature not supported", - "Invalid parameter", - "Out of resources", - "Integrity checks failed" -}; - -const char *sev_gstate_strs[] = { - "UNINIT", - "LUPDATE", - "LSECRET", - "RUNNING", - "SUPDATE", - "RUPDATE", - "SEND" -}; - -void -hexdump(void *data, int len) -{ - int i; - - for (i = 0; i < len; i++) { - if (i % 16 == 0 && i) - printf("\n"); - printf("%02X ", *(uint8_t *)(data + i)); - } - printf("\n"); -} - -// REF: https://events19.linuxfoundation.org/wp-content/uploads/2017/12/Extending-Secure-Encrypted-Virtualization-with-SEV-ES-Thomas-Lendacky-AMD.pdf -// REF: https://www.spinics.net/lists/linux-kselftest/msg27206.html -__attribute__((section("guest_with"))) void -vm_guest_with(void) -{ - while (1) { - asm volatile("mov (%[v]), %%bl" - : : [v] "r" (TARGET_CACHE_LINESIZE * TARGET_SET)); - //asm volatile("out %%al, (%%dx)" : : ); - asm volatile("hlt"); - //asm volatile("rep; vmmcall\n\r"); - } -} - -__attribute__((section("guest_without"))) void -vm_guest_without(void) -{ - while (1) { - asm volatile("hlt"); - //asm volatile("out %%al, (%%dx)" : : ); - } -} - -bool -pin_process(pid_t pid, int cpu, bool assert) -{ - cpu_set_t cpuset; - int ret; - - CPU_ZERO(&cpuset); - CPU_SET(cpu, &cpuset); - ret = sched_setaffinity(pid, sizeof(cpu_set_t), &cpuset); - if (ret < 0) { - if (assert) err(1, "sched_setaffinity"); - return false; - } - - return true; -} - -int -read_stat_core(pid_t pid) -{ - char path[256]; - char line[2048]; - FILE *file; - char *p; - int i, cpu; - - snprintf(path, sizeof(path), "/proc/%u/stat", pid); - file = fopen(path, "r"); - if (!file) return -1; - - if (!fgets(line, sizeof(line), file)) - err(1, "read stat"); - - p = line; - for (i = 0; i < 38 && (p = strchr(p, ' ')); i++) - p += 1; - - if (!p) errx(1, "stat format"); - cpu = atoi(p); - - fclose(file); - - return cpu; -} - -const char * -sev_fwerr_str(int code) -{ - if (code < 0 || code >= ARRLEN(sev_fwerr_strs)) - return "Unknown error"; - - return sev_fwerr_strs[code]; -} - -const char * -sev_gstate_str(int code) -{ - if (code < 0 || code >= ARRLEN(sev_gstate_strs)) - return "Unknown gstate"; - - return sev_gstate_strs[code]; -} - -int -sev_ioctl(int vmfd, int cmd, void *data, int *error) -{ - struct kvm_sev_cmd input; - int ret; - - memset(&input, 0, sizeof(input)); - input.id = cmd; - input.sev_fd = sev_dev; - input.data = (uintptr_t) data; - - ret = ioctl(vmfd, KVM_MEMORY_ENCRYPT_OP, &input); - if (error) *error = input.error; - - return ret; -} - -uint8_t * -sev_get_measure(int vmfd) -{ - struct kvm_sev_launch_measure msrmt; - int ret, fwerr; - uint8_t *data; - - memset(&msrmt, 0, sizeof(msrmt)); - ret = sev_ioctl(vmfd, KVM_SEV_LAUNCH_MEASURE, &msrmt, &fwerr); - if (ret < 0 && fwerr != SEV_RET_INVALID_LEN) - errx(1, "LAUNCH_MEASURE: (%s) %s", strerror(errno), sev_fwerr_str(fwerr)); - - data = malloc(msrmt.len); - msrmt.uaddr = (uintptr_t) data; - - ret = sev_ioctl(vmfd, KVM_SEV_LAUNCH_MEASURE, &msrmt, &fwerr); - if (ret < 0) - errx(1, "LAUNCH_MEASURE: (%s) %s", strerror(errno), sev_fwerr_str(fwerr)); - - return data; -} - -uint8_t -sev_guest_state(int vmfd, uint32_t handle) -{ - struct kvm_sev_guest_status status; - int ret, fwerr; - - status.handle = handle; - ret = sev_ioctl(vmfd, KVM_SEV_GUEST_STATUS, &status, &fwerr); - if (ret < 0) { - errx(1, "KVM_SEV_GUEST_STATUS: (%s) %s", - strerror(errno), sev_fwerr_str(fwerr)); - } - - return status.state; -} - -void -sev_dbg_encrypt(int vmfd, void *dst, void *src, size_t size) -{ - struct kvm_sev_dbg enc; - int ret, fwerr; - - enc.src_uaddr = (uintptr_t) src; - enc.dst_uaddr = (uintptr_t) dst; - enc.len = size; - ret = sev_ioctl(vmfd, KVM_SEV_DBG_ENCRYPT, &enc, &fwerr); - if (ret < 0) errx(1, "KVM_SEV_DBG_ENCRYPT: (%s) %s", - strerror(errno), sev_fwerr_str(fwerr)); -} - -void -sev_dbg_decrypt(int vmfd, void *dst, void *src, size_t size) -{ - struct kvm_sev_dbg enc; - int ret, fwerr; - - enc.src_uaddr = (uintptr_t) src; - enc.dst_uaddr = (uintptr_t) dst; - enc.len = size; - ret = sev_ioctl(vmfd, KVM_SEV_DBG_DECRYPT, &enc, &fwerr); - if (ret < 0) errx(1, "KVM_SEV_DBG_DECRYPT: (%s) %s", - strerror(errno), sev_fwerr_str(fwerr)); -} - -void -sev_kvm_init(struct kvm *kvm, size_t ramsize, void *code_start, void *code_stop) -{ - // REF: https://www.amd.com/system/files/TechDocs/55766_SEV-KM_API_Specification.pdf - struct kvm_sev_launch_update_data update; - struct kvm_sev_launch_start start; - struct kvm_userspace_memory_region region; - struct kvm_regs regs; - struct kvm_sregs sregs; - uint8_t *msrmt; - int ret, fwerr; - - /* Create a kvm instance */ - kvm->vmfd = ioctl(kvm_dev, KVM_CREATE_VM, 0); - if (kvm->vmfd < 0) err(1, "KVM_CREATE_VM"); - - /* Allocate guest memory */ - kvm->memsize = ramsize; - kvm->mem = mmap(NULL, kvm->memsize, PROT_READ | PROT_WRITE, - MAP_SHARED | MAP_ANONYMOUS, -1, 0); - if (!kvm->mem) err(1, "Allocating guest memory"); - assert(code_stop - code_start <= kvm->memsize); - memcpy(kvm->mem, code_start, code_stop - code_start); - - /* Map it into the vm */ - memset(®ion, 0, sizeof(region)); - region.slot = 0; - region.memory_size = kvm->memsize; - region.guest_phys_addr = 0; - region.userspace_addr = (uintptr_t) kvm->mem; - ret = ioctl(kvm->vmfd, KVM_SET_USER_MEMORY_REGION, ®ion); - if (ret < 0) err(1, "KVM_SET_USER_MEMORY_REGION"); - - /* Enable SEV for vm */ - ret = sev_ioctl(kvm->vmfd, KVM_SEV_ES_INIT, NULL, &fwerr); - if (ret < 0) errx(1, "KVM_SEV_ES_INIT: (%s) %s", - strerror(errno), sev_fwerr_str(fwerr)); - - /* Create virtual cpu */ - kvm->vcpufd = ioctl(kvm->vmfd, KVM_CREATE_VCPU, 0); - if (kvm->vcpufd < 0) err(1, "KVM_CREATE_VCPU"); - - /* Map the shared kvm_run structure and following data */ - ret = ioctl(kvm_dev, KVM_GET_VCPU_MMAP_SIZE, NULL); - if (ret < 0) err(1, "KVM_GET_VCPU_MMAP_SIZE"); - if (ret < sizeof(struct kvm_run)) - errx(1, "KVM_GET_VCPU_MMAP_SIZE too small"); - kvm->run = mmap(NULL, ret, PROT_READ | PROT_WRITE, - MAP_SHARED, kvm->vcpufd, 0); - if (!kvm->run) err(1, "mmap vcpu"); - - /* Initialize segment regs */ - memset(&sregs, 0, sizeof(sregs)); - ret = ioctl(kvm->vcpufd, KVM_GET_SREGS, &sregs); - if (ret < 0) err(1, "KVM_GET_SREGS"); - sregs.cs.base = 0; - sregs.cs.selector = 0; - ret = ioctl(kvm->vcpufd, KVM_SET_SREGS, &sregs); - if (ret < 0) err(1, "KVM_SET_SREGS"); - - /* Initialize rest of registers */ - memset(®s, 0, sizeof(regs)); - regs.rip = 0; - regs.rsp = kvm->memsize - 8; - regs.rbp = kvm->memsize - 8; - ret = ioctl(kvm->vcpufd, KVM_SET_REGS, ®s); - if (ret < 0) err(1, "KVM_SET_REGS"); - - /* Generate encryption keys and set policy */ - memset(&start, 0, sizeof(start)); - start.handle = 0; - start.policy = 1 << 2; /* require ES */ - ret = sev_ioctl(kvm->vmfd, KVM_SEV_LAUNCH_START, &start, &fwerr); - if (ret < 0) errx(1, "KVM_SEV_LAUNCH_START: (%s) %s", - strerror(errno), sev_fwerr_str(fwerr)); - - /* Prepare the vm memory (by encrypting it) */ - memset(&update, 0, sizeof(update)); - update.uaddr = (uintptr_t) kvm->mem; - update.len = ramsize; - ret = sev_ioctl(kvm->vmfd, KVM_SEV_LAUNCH_UPDATE_DATA, &update, &fwerr); - if (ret < 0) errx(1, "KVM_SEV_LAUNCH_UPDATE_DATA: (%s) %s", - strerror(errno), sev_fwerr_str(fwerr)); - - /* Prepare the vm save area */ - ret = sev_ioctl(kvm->vmfd, KVM_SEV_LAUNCH_UPDATE_VMSA, NULL, &fwerr); - if (ret < 0) errx(1, "KVM_SEV_LAUNCH_UPDATE_VMSA: (%s) %s",strerror(errno), sev_fwerr_str(fwerr)); - - /* Collect a measurement (necessary) */ - msrmt = sev_get_measure(kvm->vmfd); - free(msrmt); - - /* Finalize launch process */ - ret = sev_ioctl(kvm->vmfd, KVM_SEV_LAUNCH_FINISH, 0, &fwerr); - if (ret < 0) errx(1, "KVM_SEV_LAUNCH_FINISH: (%s) %s", - strerror(errno), sev_fwerr_str(fwerr)); - ret = sev_guest_state(kvm->vmfd, start.handle); - if (ret != GSTATE_RUNNING) - errx(1, "Bad guest state: %s", sev_gstate_str(fwerr)); -} - -void -sev_kvm_deinit(struct kvm *kvm) -{ - close(kvm->vmfd); - close(kvm->vcpufd); - munmap(kvm->mem, kvm->memsize); -} - -uint8_t * -read_counts() -{ - uint8_t *counts; - int ret; - - counts = malloc(64); - if (!counts) err(1, "malloc"); - ret = ioctl(kvm_dev, KVM_CPC_READ_COUNTS, counts); - if (ret == -1) err(1, "ioctl READ_COUNTS"); - - return counts; -} - -void -print_counts(uint8_t *counts) -{ - int i; - - for (i = 0; i < 64; i++) { - if (i % 16 == 0 && i) - printf("\n"); - if (counts[i] == 1) - printf("\x1b[38;5;88m"); - else if (counts[i] > 1) - printf("\x1b[38;5;196m"); - printf("%2i ", i); - if (counts[i] > 0) - printf("\x1b[0m"); - } - printf("\n Target Set %i Count: %u\n", TARGET_SET, counts[TARGET_SET]); - printf("\n"); -} - -uint8_t * -collect(struct kvm *kvm) -{ - struct kvm_regs regs; - int ret; - - ret = ioctl(kvm->vcpufd, KVM_RUN, NULL); - if (ret < 0) err(1, "KVM_RUN"); - - if (kvm->run->exit_reason == KVM_EXIT_MMIO) { - memset(®s, 0, sizeof(regs)); - ret = ioctl(kvm->vcpufd, KVM_GET_REGS, ®s); - if (ret < 0) err(1, "KVM_GET_REGS"); - errx(1, "KVM_EXIT_MMIO: Victim %s at 0x%08llx: rip=0x%08llx\n", - kvm->run->mmio.is_write ? "write" : "read", - kvm->run->mmio.phys_addr, regs.rip); - } else if (kvm->run->exit_reason != KVM_EXIT_HLT) { - errx(1, "KVM died: %i\n", kvm->run->exit_reason); - } - - return read_counts(); -} - -int -main(int argc, const char **argv) -{ - uint8_t without_access[SAMPLE_COUNT][64]; - uint8_t with_access[SAMPLE_COUNT][64]; - struct kvm kvm_without_access, kvm_with_access; - uint8_t *counts, *baseline; - uint32_t arg, measure; - int i, k, ret; - - setvbuf(stdout, NULL, _IONBF, 0); - - pin_process(0, TARGET_CORE, true); - - sev_dev = open("/dev/sev", O_RDWR | O_CLOEXEC); - if (sev_dev < 0) err(1, "open /dev/sev"); - - kvm_dev = open("/dev/kvm", O_RDWR | O_CLOEXEC); - if (kvm_dev < 0) err(1, "open /dev/kvm"); - - /* Make sure we have the stable version of the API */ - ret = ioctl(kvm_dev, KVM_GET_API_VERSION, NULL); - if (ret < 0) err(1, "KVM_GET_API_VERSION"); - if (ret != 12) errx(1, "KVM_GET_API_VERSION %d, expected 12", ret); - - /* init L1 miss counter for host kernel */ - ret = ioctl(kvm_dev, KVM_CPC_RESET); - if (ret < 0) err(1, "ioctl KVM_CPC_RESET"); - - baseline = malloc(64); - if (!baseline) err(1, "calloc"); - - sev_kvm_init(&kvm_with_access, 64 * 64 * 8 * 2, __start_guest_with, __stop_guest_with); - sev_kvm_init(&kvm_without_access, 64 * 64 * 8 * 2, __start_guest_without, __stop_guest_without); - - /* one run to get into while loop (after stack setup) */ - ioctl(kvm_with_access.vcpufd, KVM_RUN, NULL); - ioctl(kvm_without_access.vcpufd, KVM_RUN, NULL); - - measure = true; - ret = ioctl(kvm_dev, KVM_CPC_CALC_BASELINE, &measure); - if (ret == -1) err(1, "ioctl MEASURE_BASELINE"); - - for (i = 0; i < SAMPLE_COUNT; i++) { - counts = collect(&kvm_without_access); - memcpy(without_access[i], counts, 64); - free(counts); - - counts = collect(&kvm_with_access); - memcpy(with_access[i], counts, 64); - free(counts); - } - - measure = false; - ret = ioctl(kvm_dev, KVM_CPC_CALC_BASELINE, &measure); - if (ret == -1) err(1, "ioctl MEASURE_BASELINE"); - - ret = ioctl(kvm_dev, KVM_CPC_READ_BASELINE, baseline); - if (ret == -1) err(1, "ioctl READ_BASELINE"); - - - for (i = 0; i < SAMPLE_COUNT; i++) { - for (k = 0; k < 64; k++) { - with_access[i][k] -= baseline[k]; - without_access[i][k] -= baseline[k]; - } - - printf("Evictions with access:\n"); - print_counts(with_access[i]); - - printf("Evictions withoCALCt access:\n"); - print_counts(without_access[i]); - } - - for (i = 0; i < SAMPLE_COUNT; i++) { - assert(with_access[i][TARGET_SET] > 0); - //assert(without_access[i][TARGET_SET] == 0); - } - - sev_kvm_deinit(&kvm_with_access); - sev_kvm_deinit(&kvm_without_access); - - free(baseline); - - close(kvm_dev); - close(sev_dev); -} - diff --git a/test/sev.c b/test/sev.c deleted file mode 100644 index 20921c6..0000000 --- a/test/sev.c +++ /dev/null @@ -1,544 +0,0 @@ -#define _GNU_SOURCE - -#include "cachepc/uapi.h" - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#define ARRLEN(x) (sizeof(x) / sizeof((x)[0])) -#define MIN(a,b) ((a) > (b) ? (b) : (a)) - -#define SAMPLE_COUNT 100 - -#define TARGET_CORE 2 -#define SECONDARY_CORE 3 - -#define TARGET_CACHE_LINESIZE 64 -#define TARGET_SET 15 - -struct kvm { - int fd, vmfd, vcpufd; - void *mem; - size_t memsize; - struct kvm_run *run; -}; - -/* start and end for guest assembly */ -extern uint8_t __start_guest_with[]; -extern uint8_t __stop_guest_with[]; -extern uint8_t __start_guest_without[]; -extern uint8_t __stop_guest_without[]; - -bool ready = false; -bool processed = false; - -ssize_t sysret; -pid_t victim_pid; - -/* ioctl dev fds */ -int kvm_dev, sev_dev, kvm_dev; - -enum { - GSTATE_UNINIT, - GSTATE_LUPDATE, - GSTATE_LSECRET, - GSTATE_RUNNING, - GSTATE_SUPDATE, - GSTATE_RUPDATE, - GSTATE_SENT -}; - -const char *sev_fwerr_strs[] = { - "Success", - "Platform state is invalid", - "Guest state is invalid", - "Platform configuration is invalid", - "Buffer too small", - "Platform is already owned", - "Certificate is invalid", - "Policy is not allowed", - "Guest is not active", - "Invalid address", - "Bad signature", - "Bad measurement", - "Asid is already owned", - "Invalid ASID", - "WBINVD is required", - "DF_FLUSH is required", - "Guest handle is invalid", - "Invalid command", - "Guest is active", - "Hardware error", - "Hardware unsafe", - "Feature not supported", - "Invalid parameter", - "Out of resources", - "Integrity checks failed" -}; - -const char *sev_gstate_strs[] = { - "UNINIT", - "LUPDATE", - "LSECRET", - "RUNNING", - "SUPDATE", - "RUPDATE", - "SEND" -}; - -void -hexdump(void *data, int len) -{ - int i; - - for (i = 0; i < len; i++) { - if (i % 16 == 0 && i) - printf("\n"); - printf("%02X ", *(uint8_t *)(data + i)); - } - printf("\n"); -} - -// REF: https://events19.linuxfoundation.org/wp-content/uploads/2017/12/Extending-Secure-Encrypted-Virtualization-with-SEV-ES-Thomas-Lendacky-AMD.pdf -// REF: https://www.spinics.net/lists/linux-kselftest/msg27206.html -__attribute__((section("guest_with"))) void -vm_guest_with(void) -{ - while (1) { - asm volatile("mov (%[v]), %%bl" - : : [v] "r" (TARGET_CACHE_LINESIZE * TARGET_SET)); - asm volatile("out %%al, (%%dx)" : : ); - //asm volatile("hlt"); - //asm volatile("rep; vmmcall\n\r"); - } -} - -__attribute__((section("guest_without"))) void -vm_guest_without(void) -{ - while (1) { - //asm volatile("hlt"); - asm volatile("out %%al, (%%dx)" : : ); - } -} - -bool -pin_process(pid_t pid, int cpu, bool assert) -{ - cpu_set_t cpuset; - int ret; - - CPU_ZERO(&cpuset); - CPU_SET(cpu, &cpuset); - ret = sched_setaffinity(pid, sizeof(cpu_set_t), &cpuset); - if (ret < 0) { - if (assert) err(1, "sched_setaffinity"); - return false; - } - - return true; -} - -int -read_stat_core(pid_t pid) -{ - char path[256]; - char line[2048]; - FILE *file; - char *p; - int i, cpu; - - snprintf(path, sizeof(path), "/proc/%u/stat", pid); - file = fopen(path, "r"); - if (!file) return -1; - - if (!fgets(line, sizeof(line), file)) - err(1, "read stat"); - - p = line; - for (i = 0; i < 38 && (p = strchr(p, ' ')); i++) - p += 1; - - if (!p) errx(1, "stat format"); - cpu = atoi(p); - - fclose(file); - - return cpu; -} - -const char * -sev_fwerr_str(int code) -{ - if (code < 0 || code >= ARRLEN(sev_fwerr_strs)) - return "Unknown error"; - - return sev_fwerr_strs[code]; -} - -const char * -sev_gstate_str(int code) -{ - if (code < 0 || code >= ARRLEN(sev_gstate_strs)) - return "Unknown gstate"; - - return sev_gstate_strs[code]; -} - -int -sev_ioctl(int vmfd, int cmd, void *data, int *error) -{ - struct kvm_sev_cmd input; - int ret; - - memset(&input, 0, sizeof(input)); - input.id = cmd; - input.sev_fd = sev_dev; - input.data = (uintptr_t) data; - - ret = ioctl(vmfd, KVM_MEMORY_ENCRYPT_OP, &input); - if (error) *error = input.error; - - return ret; -} - -uint8_t * -sev_get_measure(int vmfd) -{ - struct kvm_sev_launch_measure msrmt; - int ret, fwerr; - uint8_t *data; - - memset(&msrmt, 0, sizeof(msrmt)); - ret = sev_ioctl(vmfd, KVM_SEV_LAUNCH_MEASURE, &msrmt, &fwerr); - if (ret < 0 && fwerr != SEV_RET_INVALID_LEN) - errx(1, "LAUNCH_MEASURE: (%s) %s", strerror(errno), sev_fwerr_str(fwerr)); - - data = malloc(msrmt.len); - msrmt.uaddr = (uintptr_t) data; - - ret = sev_ioctl(vmfd, KVM_SEV_LAUNCH_MEASURE, &msrmt, &fwerr); - if (ret < 0) - errx(1, "LAUNCH_MEASURE: (%s) %s", strerror(errno), sev_fwerr_str(fwerr)); - - return data; -} - -uint8_t -sev_guest_state(int vmfd, uint32_t handle) -{ - struct kvm_sev_guest_status status; - int ret, fwerr; - - status.handle = handle; - ret = sev_ioctl(vmfd, KVM_SEV_GUEST_STATUS, &status, &fwerr); - if (ret < 0) { - errx(1, "KVM_SEV_GUEST_STATUS: (%s) %s", - strerror(errno), sev_fwerr_str(fwerr)); - } - - return status.state; -} - -void -sev_debug_encrypt(int vmfd, void *src, void *dst, size_t size) -{ - struct kvm_sev_dbg enc; - int ret, fwerr; - - enc.src_uaddr = (uintptr_t) src; - enc.dst_uaddr = (uintptr_t) dst; - enc.len = size; - ret = sev_ioctl(vmfd, KVM_SEV_DBG_ENCRYPT, &enc, &fwerr); - if (ret < 0) errx(1, "KVM_SEV_DBG_ENCRYPT: (%s) %s", - strerror(errno), sev_fwerr_str(fwerr)); -} - -void -sev_debug_decrypt(int vmfd, void *src, void *dst, size_t size) -{ - struct kvm_sev_dbg enc; - int ret, fwerr; - - enc.src_uaddr = (uintptr_t) src; - enc.dst_uaddr = (uintptr_t) dst; - enc.len = size; - ret = sev_ioctl(vmfd, KVM_SEV_DBG_DECRYPT, &enc, &fwerr); - if (ret < 0) errx(1, "KVM_SEV_DBG_DECRYPT: (%s) %s", - strerror(errno), sev_fwerr_str(fwerr)); -} - -void -sev_kvm_init(struct kvm *kvm, size_t ramsize, void *code_start, void *code_stop) -{ - // REF: https://www.amd.com/system/files/TechDocs/55766_SEV-KM_API_Specification.pdf - struct kvm_sev_launch_update_data update; - struct kvm_sev_launch_start start; - struct kvm_userspace_memory_region region; - struct kvm_regs regs; - struct kvm_sregs sregs; - uint8_t *msrmt; - int ret, fwerr; - - /* Create a kvm instance */ - kvm->vmfd = ioctl(kvm_dev, KVM_CREATE_VM, 0); - if (kvm->vmfd < 0) err(1, "KVM_CREATE_VM"); - - /* Allocate guest memory */ - kvm->memsize = ramsize; - kvm->mem = mmap(NULL, kvm->memsize, PROT_READ | PROT_WRITE, - MAP_SHARED | MAP_ANONYMOUS, -1, 0); - if (!kvm->mem) err(1, "Allocating guest memory"); - assert(code_stop - code_start <= kvm->memsize); - memcpy(kvm->mem, code_start, code_stop - code_start); - - /* Map it into the vm */ - memset(®ion, 0, sizeof(region)); - region.slot = 0; - region.memory_size = kvm->memsize; - region.guest_phys_addr = 0x0000; - region.userspace_addr = (uintptr_t) kvm->mem; - ret = ioctl(kvm->vmfd, KVM_SET_USER_MEMORY_REGION, ®ion); - if (ret < 0) err(1, "KVM_SET_USER_MEMORY_REGION"); - - /* Enable SEV for vm */ - ret = sev_ioctl(kvm->vmfd, KVM_SEV_INIT, NULL, &fwerr); - if (ret < 0) errx(1, "KVM_SEV_INIT: (%s) %s", - strerror(errno), sev_fwerr_str(fwerr)); - - /* Generate encryption keys and set policy */ - memset(&start, 0, sizeof(start)); - start.handle = 0; - start.policy = 0; - ret = sev_ioctl(kvm->vmfd, KVM_SEV_LAUNCH_START, &start, &fwerr); - if (ret < 0) errx(1, "KVM_SEV_LAUNCH_START: (%s) %s", - strerror(errno), sev_fwerr_str(fwerr)); - - /* Prepare the vm memory (by encrypting it) */ - memset(&update, 0, sizeof(update)); - update.uaddr = (uintptr_t) kvm->mem; - update.len = ramsize; - ret = sev_ioctl(kvm->vmfd, KVM_SEV_LAUNCH_UPDATE_DATA, &update, &fwerr); - if (ret < 0) errx(1, "KVM_SEV_LAUNCH_UPDATE_DATA: (%s) %s", - strerror(errno), sev_fwerr_str(fwerr)); - - /* Collect a measurement (necessary) */ - msrmt = sev_get_measure(kvm->vmfd); - free(msrmt); - - /* Finalize launch process */ - ret = sev_ioctl(kvm->vmfd, KVM_SEV_LAUNCH_FINISH, 0, &fwerr); - if (ret < 0) errx(1, "KVM_SEV_LAUNCH_FINISH: (%s) %s", - strerror(errno), sev_fwerr_str(fwerr)); - ret = sev_guest_state(kvm->vmfd, start.handle); - if (ret != GSTATE_RUNNING) - errx(1, "Bad guest state: %s", sev_gstate_str(fwerr)); - - /* Create virtual cpu core */ - kvm->vcpufd = ioctl(kvm->vmfd, KVM_CREATE_VCPU, 0); - if (kvm->vcpufd < 0) err(1, "KVM_CREATE_VCPU"); - - /* Map the shared kvm_run structure and following data */ - ret = ioctl(kvm_dev, KVM_GET_VCPU_MMAP_SIZE, NULL); - if (ret < 0) err(1, "KVM_GET_VCPU_MMAP_SIZE"); - if (ret < sizeof(struct kvm_run)) - errx(1, "KVM_GET_VCPU_MMAP_SIZE too small"); - kvm->run = mmap(NULL, ret, PROT_READ | PROT_WRITE, - MAP_SHARED, kvm->vcpufd, 0); - if (!kvm->run) err(1, "mmap vcpu"); - - /* Initialize segment regs */ - memset(&sregs, 0, sizeof(sregs)); - ret = ioctl(kvm->vcpufd, KVM_GET_SREGS, &sregs); - if (ret < 0) err(1, "KVM_GET_SREGS"); - sregs.cs.base = 0; - sregs.cs.selector = 0; - ret = ioctl(kvm->vcpufd, KVM_SET_SREGS, &sregs); - if (ret < 0) err(1, "KVM_SET_SREGS"); - - /* Initialize rest of registers */ - memset(®s, 0, sizeof(regs)); - regs.rip = 0x0; - regs.rsp = kvm->memsize - 1; - regs.rbp = kvm->memsize - 1; - regs.rax = 0; - regs.rdx = 0; - regs.rflags = 0x2; - ret = ioctl(kvm->vcpufd, KVM_SET_REGS, ®s); - if (ret < 0) err(1, "KVM_SET_REGS"); -} - -void -sev_kvm_deinit(struct kvm *kvm) -{ - close(kvm->vmfd); - close(kvm->vcpufd); - munmap(kvm->mem, kvm->memsize); -} - -cpc_msrmt_t * -read_counts() -{ - cpc_msrmt_t *counts; - int ret; - - counts = malloc(64 * sizeof(cpc_msrmt_t)); - if (!counts) err(1, "malloc"); - ret = ioctl(kvm_dev, KVM_CPC_READ_COUNTS, counts); - if (ret == -1) err(1, "ioctl READ_COUNTS"); - - return counts; -} - -void -print_counts(cpc_msrmt_t *counts) -{ - int i; - - for (i = 0; i < 64; i++) { - if (i % 16 == 0 && i) - printf("\n"); - if (counts[i] == 1) - printf("\x1b[38;5;88m"); - else if (counts[i] > 1) - printf("\x1b[38;5;196m"); - printf("%2i ", i); - if (counts[i] > 0) - printf("\x1b[0m"); - } - printf("\n Target Set %i Count: %llu\n", TARGET_SET, counts[TARGET_SET]); - printf("\n"); -} - -cpc_msrmt_t * -collect(const char *prefix, void *code_start, void *code_stop) -{ - struct kvm_regs regs; - struct kvm kvm; - cpc_msrmt_t *counts; - int ret; - - sev_kvm_init(&kvm, 64 * 64 * 8 * 2, code_start, code_stop); - - /* run vm twice, use count without initial stack setup */ - ret = ioctl(kvm.vcpufd, KVM_RUN, NULL); - ret = ioctl(kvm.vcpufd, KVM_RUN, NULL); - if (ret < 0) err(1, "KVM_RUN"); - - if (kvm.run->exit_reason == KVM_EXIT_MMIO) { - memset(®s, 0, sizeof(regs)); - ret = ioctl(kvm.vcpufd, KVM_GET_REGS, ®s); - if (ret < 0) err(1, "KVM_GET_REGS"); - errx(1, "Victim access OOB: %llu %08llx => %02X\n", - kvm.run->mmio.phys_addr, regs.rip, - ((uint8_t *)kvm.mem)[regs.rip]); - } else if (kvm.run->exit_reason != KVM_EXIT_IO) { - errx(1, "KVM died: %i\n", kvm.run->exit_reason); - } - - counts = read_counts(); - - sev_kvm_deinit(&kvm); - - return counts; -} - -int -main(int argc, const char **argv) -{ - cpc_msrmt_t without_access[SAMPLE_COUNT][64]; - cpc_msrmt_t with_access[SAMPLE_COUNT][64]; - cpc_msrmt_t *counts, *baseline; - uint32_t arg, measure; - int i, k, ret; - - setvbuf(stdout, NULL, _IONBF, 0); - - pin_process(0, TARGET_CORE, true); - - sev_dev = open("/dev/sev", O_RDWR | O_CLOEXEC); - if (sev_dev < 0) err(1, "open /dev/sev"); - - kvm_dev = open("/dev/kvm", O_RDWR | O_CLOEXEC); - if (kvm_dev < 0) err(1, "open /dev/kvm"); - - /* Make sure we have the stable version of the API */ - ret = ioctl(kvm_dev, KVM_GET_API_VERSION, NULL); - if (ret < 0) err(1, "KVM_GET_API_VERSION"); - if (ret != 12) errx(1, "KVM_GET_API_VERSION %d, expected 12", ret); - - /* init L1 miss counter for host kernel */ - arg = 0x002264D8; - ret = ioctl(kvm_dev, KVM_CPC_INIT_PMC, &arg); - if (ret < 0) err(1, "ioctl INIT_PMC"); - - baseline = calloc(sizeof(cpc_msrmt_t), 64); - if (!baseline) err(1, "calloc"); - - measure = true; - ret = ioctl(kvm_dev, KVM_CPC_MEASURE_BASELINE, &measure); - if (ret == -1) err(1, "ioctl MEASURE_BASELINE"); - - for (i = 0; i < SAMPLE_COUNT; i++) { - counts = collect("without", __start_guest_without, __stop_guest_without); - memcpy(without_access[i], counts, 64 * sizeof(cpc_msrmt_t)); - free(counts); - - counts = collect("with", __start_guest_with, __stop_guest_with); - memcpy(with_access[i], counts, 64 * sizeof(cpc_msrmt_t)); - free(counts); - } - - measure = false; - ret = ioctl(kvm_dev, KVM_CPC_MEASURE_BASELINE, &measure); - if (ret == -1) err(1, "ioctl MEASURE_BASELINE"); - - ret = ioctl(kvm_dev, KVM_CPC_READ_BASELINE, baseline); - if (ret == -1) err(1, "ioctl READ_BASELINE"); - - for (i = 0; i < SAMPLE_COUNT; i++) { - for (k = 0; k < 64; k++) { - with_access[i][k] -= baseline[k]; - without_access[i][k] -= baseline[k]; - } - - printf("Evictions with access:\n"); - print_counts(with_access[i]); - - printf("Evictions without access:\n"); - print_counts(without_access[i]); - } - - for (i = 0; i < SAMPLE_COUNT; i++) { - assert(with_access[i][TARGET_SET] > 0); - //assert(without_access[i][TARGET_SET] == 0); - } - - free(baseline); - - close(kvm_dev); - close(sev_dev); -} - -- cgit v1.2.3-71-gd317