* [PATCH v7 0/4] KVM: SEV-ES: Add tests to validate #VC handling
@ 2022-06-13 17:04 Vasant Karasulli
2022-06-13 17:04 ` [PATCH v7 1/4] KVM: SEV-ES: Add configuration options to test " Vasant Karasulli
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Vasant Karasulli @ 2022-06-13 17:04 UTC (permalink / raw)
To: linux-kernel, kvm
Cc: bp, jroedel, thomas.lendacky, x86, seanjc, Vasant Karasulli
Hi All,
This is the version 7 of the patch written to add tests for
AMD SEV-ES #VC handling. This version attempts to
address review comments to the previous version of the patch.
Changes v6->v7:
1. Added information about how to run the tests.
2. test->priv no longer points to a location on heap.
Thanks,
Vasant
arch/x86/Kbuild | 2 +
arch/x86/Kconfig.debug | 19 +++++
arch/x86/kernel/Makefile | 7 ++
arch/x86/tests/Makefile | 3 +
arch/x86/tests/sev-test-vc.c | 145 +++++++++++++++++++++++++++++++++++
5 files changed, 176 insertions(+)
create mode 100644 arch/x86/tests/Makefile
create mode 100644 arch/x86/tests/sev-test-vc.c
base-commit: b13baccc3850ca8b8cccbf8ed9912dbaa0fdf7f3
--
2.32.0
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v7 1/4] KVM: SEV-ES: Add configuration options to test #VC handling
2022-06-13 17:04 [PATCH v7 0/4] KVM: SEV-ES: Add tests to validate #VC handling Vasant Karasulli
@ 2022-06-13 17:04 ` Vasant Karasulli
2022-06-13 17:04 ` [PATCH v7 2/4] KVM: SEV-ES: Add tests to validate VC handling for CPUID and WBINVD Vasant Karasulli
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Vasant Karasulli @ 2022-06-13 17:04 UTC (permalink / raw)
To: linux-kernel, kvm
Cc: bp, jroedel, thomas.lendacky, x86, seanjc, Vasant Karasulli
Configuration options CONFIG_X86_TESTS and CONFIG_AMD_SEV_ES_TEST_VC
enable the execution of the KUnit tests added under arch/x86/tests that
test AMD SEV-ES #VC handling.
Signed-off-by: Vasant Karasulli <vkarasulli@suse.de>
---
arch/x86/Kbuild | 2 ++
arch/x86/Kconfig.debug | 19 +++++++++++++++++++
arch/x86/kernel/Makefile | 7 +++++++
3 files changed, 28 insertions(+)
diff --git a/arch/x86/Kbuild b/arch/x86/Kbuild
index 5a83da703e87..ec01cd024bae 100644
--- a/arch/x86/Kbuild
+++ b/arch/x86/Kbuild
@@ -28,5 +28,7 @@ obj-y += net/
obj-$(CONFIG_KEXEC_FILE) += purgatory/
+obj-y += tests/
+
# for cleaning
subdir- += boot tools
diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index 340399f69954..b0687173fb97 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -278,3 +278,22 @@ endchoice
config FRAME_POINTER
depends on !UNWINDER_ORC && !UNWINDER_GUESS
bool
+
+config X86_TESTS
+ bool "x86 unit tests"
+ help
+ This enables building the tests under arch/x86/tests.
+
+if X86_TESTS
+config AMD_SEV_TEST_VC
+ bool "Test for AMD SEV VC exception handling"
+ depends on AMD_MEM_ENCRYPT
+ select FUNCTION_TRACER
+ select KPROBES
+ select KUNIT
+ help
+ Enable KUnit-based testing for AMD SEV #VC exception handling.
+ When this configuration option is enabled, these Kunit tests
+ get executed at the kernel boot time. Results of the test
+ execution can be monitored in the kernel log.
+endif # X86_TESTS
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index 03364dc40d8d..3fa9ce2a700e 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -23,6 +23,13 @@ CFLAGS_REMOVE_head64.o = -pg
CFLAGS_REMOVE_sev.o = -pg
endif
+# AMD_SEV_TEST_VC registers a kprobe by function name. IPA-SRA creates
+# function copies and renames them to have an .isra suffix, which breaks kprobes'
+# lookup. Build with -fno-ipa-sra for the test.
+ifdef CONFIG_AMD_SEV_TEST_VC
+CFLAGS_sev.o += -fno-ipa-sra
+endif
+
KASAN_SANITIZE_head$(BITS).o := n
KASAN_SANITIZE_dumpstack.o := n
KASAN_SANITIZE_dumpstack_$(BITS).o := n
--
2.32.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v7 2/4] KVM: SEV-ES: Add tests to validate VC handling for CPUID and WBINVD
2022-06-13 17:04 [PATCH v7 0/4] KVM: SEV-ES: Add tests to validate #VC handling Vasant Karasulli
2022-06-13 17:04 ` [PATCH v7 1/4] KVM: SEV-ES: Add configuration options to test " Vasant Karasulli
@ 2022-06-13 17:04 ` Vasant Karasulli
2022-06-13 17:04 ` [PATCH v7 3/4] KVM: SEV-ES: Add tests to validate VC handling for MSR and DR7 register accesses Vasant Karasulli
2022-06-13 17:04 ` [PATCH v7 4/4] KVM SEV-ES: Add tests to validate VC handling for IO instructions Vasant Karasulli
3 siblings, 0 replies; 5+ messages in thread
From: Vasant Karasulli @ 2022-06-13 17:04 UTC (permalink / raw)
To: linux-kernel, kvm
Cc: bp, jroedel, thomas.lendacky, x86, seanjc, Vasant Karasulli
These tests:
1. install a kretprobe on the #VC handler (sev_es_ghcb_hv_call, to
access GHCB before/after the resulting VMGEXIT).
2. trigger an NAE by executing either CPUID or WBINVD.
3. check that the kretprobe was hit with the right exit_code
available in GHCB.
To run these tests, configuration options CONFIG_X86_TESTS and
CONFIG_AMD_SEV_ES_TEST_VC have to be enabled. These tests run
at the kernel boot time. Result of the test execution can be
monitored in the kernel log.
Signed-off-by: Vasant Karasulli <vkarasulli@suse.de>
---
arch/x86/tests/Makefile | 3 +
arch/x86/tests/sev-test-vc.c | 104 +++++++++++++++++++++++++++++++++++
2 files changed, 107 insertions(+)
create mode 100644 arch/x86/tests/Makefile
create mode 100644 arch/x86/tests/sev-test-vc.c
diff --git a/arch/x86/tests/Makefile b/arch/x86/tests/Makefile
new file mode 100644
index 000000000000..4beca64bd2aa
--- /dev/null
+++ b/arch/x86/tests/Makefile
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: GPL-2.0
+
+obj-$(CONFIG_AMD_SEV_TEST_VC) += sev-test-vc.o
diff --git a/arch/x86/tests/sev-test-vc.c b/arch/x86/tests/sev-test-vc.c
new file mode 100644
index 000000000000..900ca357a273
--- /dev/null
+++ b/arch/x86/tests/sev-test-vc.c
@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2021 SUSE
+ *
+ * Author: Varad Gautam <varad.gautam@suse.com>
+ */
+
+#include <asm/cpufeature.h>
+#include <asm/sev-common.h>
+#include <asm/svm.h>
+#include <kunit/test.h>
+#include <linux/kprobes.h>
+
+static struct kretprobe hv_call_krp;
+
+static int hv_call_krp_entry(struct kretprobe_instance *krpi,
+ struct pt_regs *regs)
+{
+ unsigned long ghcb_vaddr = regs_get_kernel_argument(regs, 0);
+ *((unsigned long *) krpi->data) = ghcb_vaddr;
+
+ return 0;
+}
+
+static int hv_call_krp_ret(struct kretprobe_instance *krpi,
+ struct pt_regs *regs)
+{
+ unsigned long ghcb_vaddr = *((unsigned long *) krpi->data);
+ struct ghcb *ghcb = (struct ghcb *) ghcb_vaddr;
+ struct kunit *test = current->kunit_test;
+
+ if (test && strstr(test->name, "sev_es_"))
+ *((u64 *)&test->priv) = ghcb->save.sw_exit_code;
+
+ return 0;
+}
+
+int sev_es_test_vc_init(struct kunit *test)
+{
+ int ret;
+
+ if (!cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT)) {
+ kunit_info(test, "Not a SEV-ES guest. Skipping.");
+ ret = -EINVAL;
+ goto out;
+ }
+
+ memset(&hv_call_krp, 0, sizeof(hv_call_krp));
+ hv_call_krp.entry_handler = hv_call_krp_entry;
+ hv_call_krp.handler = hv_call_krp_ret;
+ hv_call_krp.maxactive = 100;
+ hv_call_krp.data_size = sizeof(unsigned long);
+ hv_call_krp.kp.symbol_name = "sev_es_ghcb_hv_call";
+ hv_call_krp.kp.addr = 0;
+
+ ret = register_kretprobe(&hv_call_krp);
+ if (ret) {
+ kunit_info(test, "Could not register kretprobe. Skipping.");
+ goto out;
+ }
+
+out:
+ return ret;
+}
+
+void sev_es_test_vc_exit(struct kunit *test)
+{
+ if (hv_call_krp.kp.addr)
+ unregister_kretprobe(&hv_call_krp);
+}
+
+#define check_op(kt, ec, op) \
+do { \
+ struct kunit *t = (struct kunit *) kt; \
+ op; \
+ KUNIT_EXPECT_EQ(t, (typeof(ec)) ec, \
+ ((typeof(ec))((u64)(t->priv))));\
+} while (0)
+
+static void sev_es_nae_cpuid(struct kunit *test)
+{
+ unsigned int cpuid_fn = 0x8000001f;
+
+ check_op(test, SVM_EXIT_CPUID, native_cpuid_eax(cpuid_fn));
+}
+
+static void sev_es_nae_wbinvd(struct kunit *test)
+{
+ check_op(test, SVM_EXIT_WBINVD, wbinvd());
+}
+
+static struct kunit_case sev_es_vc_testcases[] = {
+ KUNIT_CASE(sev_es_nae_cpuid),
+ KUNIT_CASE(sev_es_nae_wbinvd),
+ {}
+};
+
+static struct kunit_suite sev_es_vc_test_suite = {
+ .name = "sev_es_test_vc",
+ .init = sev_es_test_vc_init,
+ .exit = sev_es_test_vc_exit,
+ .test_cases = sev_es_vc_testcases,
+};
+kunit_test_suite(sev_es_vc_test_suite);
--
2.32.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v7 3/4] KVM: SEV-ES: Add tests to validate VC handling for MSR and DR7 register accesses
2022-06-13 17:04 [PATCH v7 0/4] KVM: SEV-ES: Add tests to validate #VC handling Vasant Karasulli
2022-06-13 17:04 ` [PATCH v7 1/4] KVM: SEV-ES: Add configuration options to test " Vasant Karasulli
2022-06-13 17:04 ` [PATCH v7 2/4] KVM: SEV-ES: Add tests to validate VC handling for CPUID and WBINVD Vasant Karasulli
@ 2022-06-13 17:04 ` Vasant Karasulli
2022-06-13 17:04 ` [PATCH v7 4/4] KVM SEV-ES: Add tests to validate VC handling for IO instructions Vasant Karasulli
3 siblings, 0 replies; 5+ messages in thread
From: Vasant Karasulli @ 2022-06-13 17:04 UTC (permalink / raw)
To: linux-kernel, kvm
Cc: bp, jroedel, thomas.lendacky, x86, seanjc, Vasant Karasulli
These tests:
1. install a kretprobe on the #VC handler (sev_es_ghcb_hv_call, to
access GHCB before/after the resulting VMGEXIT).
2. trigger an NAE by accessing either MSR or DR7.
3. check that the kretprobe was hit with the right exit_code available
in GHCB.
To run these tests, configuration options CONFIG_X86_TESTS and
CONFIG_AMD_SEV_ES_TEST_VC have to be enabled. These tests run
at the kernel boot time. Result of the test execution can be
monitored in the kernel log.
Signed-off-by: Vasant Karasulli <vkarasulli@suse.de>
---
arch/x86/tests/sev-test-vc.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/arch/x86/tests/sev-test-vc.c b/arch/x86/tests/sev-test-vc.c
index 900ca357a273..629aa0ca1c86 100644
--- a/arch/x86/tests/sev-test-vc.c
+++ b/arch/x86/tests/sev-test-vc.c
@@ -7,6 +7,7 @@
#include <asm/cpufeature.h>
#include <asm/sev-common.h>
+#include <asm/debugreg.h>
#include <asm/svm.h>
#include <kunit/test.h>
#include <linux/kprobes.h>
@@ -89,9 +90,22 @@ static void sev_es_nae_wbinvd(struct kunit *test)
check_op(test, SVM_EXIT_WBINVD, wbinvd());
}
+static void sev_es_nae_msr(struct kunit *test)
+{
+ check_op(test, SVM_EXIT_MSR, __rdmsr(MSR_IA32_TSC));
+}
+
+static void sev_es_nae_dr7_rw(struct kunit *test)
+{
+ check_op(test, SVM_EXIT_WRITE_DR7,
+ native_set_debugreg(7, native_get_debugreg(7)));
+}
+
static struct kunit_case sev_es_vc_testcases[] = {
KUNIT_CASE(sev_es_nae_cpuid),
KUNIT_CASE(sev_es_nae_wbinvd),
+ KUNIT_CASE(sev_es_nae_msr),
+ KUNIT_CASE(sev_es_nae_dr7_rw),
{}
};
--
2.32.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v7 4/4] KVM SEV-ES: Add tests to validate VC handling for IO instructions
2022-06-13 17:04 [PATCH v7 0/4] KVM: SEV-ES: Add tests to validate #VC handling Vasant Karasulli
` (2 preceding siblings ...)
2022-06-13 17:04 ` [PATCH v7 3/4] KVM: SEV-ES: Add tests to validate VC handling for MSR and DR7 register accesses Vasant Karasulli
@ 2022-06-13 17:04 ` Vasant Karasulli
3 siblings, 0 replies; 5+ messages in thread
From: Vasant Karasulli @ 2022-06-13 17:04 UTC (permalink / raw)
To: linux-kernel, kvm
Cc: bp, jroedel, thomas.lendacky, x86, seanjc, Vasant Karasulli
These tests:
1. install a kretprobe on the #VC handler (sev_es_ghcb_hv_call, to
access GHCB before/after the resulting VMGEXIT).
2. trigger an NAE by issuing an IO instruction.
3. check that the kretprobe was hit with the right
exit_code available in GHCB.
To run these tests, configuration options CONFIG_X86_TESTS and
CONFIG_AMD_SEV_ES_TEST_VC have to be enabled. These tests run
at the kernel boot time. Result of the test execution can be
monitored in the kernel log.
Signed-off-by: Vasant Karasulli <vkarasulli@suse.de>
---
arch/x86/tests/sev-test-vc.c | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)
diff --git a/arch/x86/tests/sev-test-vc.c b/arch/x86/tests/sev-test-vc.c
index 629aa0ca1c86..33ca761bf9cb 100644
--- a/arch/x86/tests/sev-test-vc.c
+++ b/arch/x86/tests/sev-test-vc.c
@@ -8,7 +8,9 @@
#include <asm/cpufeature.h>
#include <asm/sev-common.h>
#include <asm/debugreg.h>
+#include <asm/io.h>
#include <asm/svm.h>
+#include <asm/apicdef.h>
#include <kunit/test.h>
#include <linux/kprobes.h>
@@ -101,11 +103,36 @@ static void sev_es_nae_dr7_rw(struct kunit *test)
native_set_debugreg(7, native_get_debugreg(7)));
}
+static void sev_es_nae_ioio(struct kunit *test)
+{
+ unsigned long port = 0x80;
+ char val = 0;
+
+ check_op(test, SVM_EXIT_IOIO, val = inb(port));
+ check_op(test, SVM_EXIT_IOIO, outb(val, port));
+ check_op(test, SVM_EXIT_IOIO, insb(port, &val, sizeof(val)));
+ check_op(test, SVM_EXIT_IOIO, outsb(port, &val, sizeof(val)));
+}
+
+static void sev_es_nae_mmio(struct kunit *test)
+{
+ unsigned long lapic_ver_pa = APIC_DEFAULT_PHYS_BASE + APIC_LVR;
+ unsigned long __iomem *lapic = ioremap(lapic_ver_pa, 0x4);
+ unsigned long lapic_version = 0;
+
+ check_op(test, SVM_VMGEXIT_MMIO_READ, lapic_version = *lapic);
+ check_op(test, SVM_VMGEXIT_MMIO_WRITE, *lapic = lapic_version);
+
+ iounmap(lapic);
+}
+
static struct kunit_case sev_es_vc_testcases[] = {
KUNIT_CASE(sev_es_nae_cpuid),
KUNIT_CASE(sev_es_nae_wbinvd),
KUNIT_CASE(sev_es_nae_msr),
KUNIT_CASE(sev_es_nae_dr7_rw),
+ KUNIT_CASE(sev_es_nae_ioio),
+ KUNIT_CASE(sev_es_nae_mmio),
{}
};
--
2.32.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-06-13 19:10 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-13 17:04 [PATCH v7 0/4] KVM: SEV-ES: Add tests to validate #VC handling Vasant Karasulli
2022-06-13 17:04 ` [PATCH v7 1/4] KVM: SEV-ES: Add configuration options to test " Vasant Karasulli
2022-06-13 17:04 ` [PATCH v7 2/4] KVM: SEV-ES: Add tests to validate VC handling for CPUID and WBINVD Vasant Karasulli
2022-06-13 17:04 ` [PATCH v7 3/4] KVM: SEV-ES: Add tests to validate VC handling for MSR and DR7 register accesses Vasant Karasulli
2022-06-13 17:04 ` [PATCH v7 4/4] KVM SEV-ES: Add tests to validate VC handling for IO instructions Vasant Karasulli
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).