These tests: 1. install a kretprobe on the #VC handler (sev_es_ghcb_hv_call, to access GHCB before/after the resulting VMGEXIT). 2. trigger an NAE by executing either CPUID or WBINVD. 3. check that the kretprobe was hit with the right exit_code available in GHCB. To run these tests, configuration options CONFIG_X86_TESTS and CONFIG_AMD_SEV_ES_TEST_VC have to be enabled. These tests run at the kernel boot time. Result of the test execution can be monitored in the kernel log. Signed-off-by: Vasant Karasulli <vkarasulli@xxxxxxx> --- arch/x86/tests/Makefile | 3 + arch/x86/tests/sev-test-vc.c | 104 +++++++++++++++++++++++++++++++++++ 2 files changed, 107 insertions(+) create mode 100644 arch/x86/tests/Makefile create mode 100644 arch/x86/tests/sev-test-vc.c diff --git a/arch/x86/tests/Makefile b/arch/x86/tests/Makefile new file mode 100644 index 000000000000..4beca64bd2aa --- /dev/null +++ b/arch/x86/tests/Makefile @@ -0,0 +1,3 @@ +# SPDX-License-Identifier: GPL-2.0 + +obj-$(CONFIG_AMD_SEV_TEST_VC) += sev-test-vc.o diff --git a/arch/x86/tests/sev-test-vc.c b/arch/x86/tests/sev-test-vc.c new file mode 100644 index 000000000000..900ca357a273 --- /dev/null +++ b/arch/x86/tests/sev-test-vc.c @@ -0,0 +1,104 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copyright (C) 2021 SUSE + * + * Author: Varad Gautam <varad.gautam@xxxxxxxx> + */ + +#include <asm/cpufeature.h> +#include <asm/sev-common.h> +#include <asm/svm.h> +#include <kunit/test.h> +#include <linux/kprobes.h> + +static struct kretprobe hv_call_krp; + +static int hv_call_krp_entry(struct kretprobe_instance *krpi, + struct pt_regs *regs) +{ + unsigned long ghcb_vaddr = regs_get_kernel_argument(regs, 0); + *((unsigned long *) krpi->data) = ghcb_vaddr; + + return 0; +} + +static int hv_call_krp_ret(struct kretprobe_instance *krpi, + struct pt_regs *regs) +{ + unsigned long ghcb_vaddr = *((unsigned long *) krpi->data); + struct ghcb *ghcb = (struct ghcb *) ghcb_vaddr; + struct kunit *test = current->kunit_test; + + if (test && strstr(test->name, "sev_es_")) + *((u64 *)&test->priv) = ghcb->save.sw_exit_code; + + return 0; +} + +int sev_es_test_vc_init(struct kunit *test) +{ + int ret; + + if (!cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT)) { + kunit_info(test, "Not a SEV-ES guest. Skipping."); + ret = -EINVAL; + goto out; + } + + memset(&hv_call_krp, 0, sizeof(hv_call_krp)); + hv_call_krp.entry_handler = hv_call_krp_entry; + hv_call_krp.handler = hv_call_krp_ret; + hv_call_krp.maxactive = 100; + hv_call_krp.data_size = sizeof(unsigned long); + hv_call_krp.kp.symbol_name = "sev_es_ghcb_hv_call"; + hv_call_krp.kp.addr = 0; + + ret = register_kretprobe(&hv_call_krp); + if (ret) { + kunit_info(test, "Could not register kretprobe. Skipping."); + goto out; + } + +out: + return ret; +} + +void sev_es_test_vc_exit(struct kunit *test) +{ + if (hv_call_krp.kp.addr) + unregister_kretprobe(&hv_call_krp); +} + +#define check_op(kt, ec, op) \ +do { \ + struct kunit *t = (struct kunit *) kt; \ + op; \ + KUNIT_EXPECT_EQ(t, (typeof(ec)) ec, \ + ((typeof(ec))((u64)(t->priv))));\ +} while (0) + +static void sev_es_nae_cpuid(struct kunit *test) +{ + unsigned int cpuid_fn = 0x8000001f; + + check_op(test, SVM_EXIT_CPUID, native_cpuid_eax(cpuid_fn)); +} + +static void sev_es_nae_wbinvd(struct kunit *test) +{ + check_op(test, SVM_EXIT_WBINVD, wbinvd()); +} + +static struct kunit_case sev_es_vc_testcases[] = { + KUNIT_CASE(sev_es_nae_cpuid), + KUNIT_CASE(sev_es_nae_wbinvd), + {} +}; + +static struct kunit_suite sev_es_vc_test_suite = { + .name = "sev_es_test_vc", + .init = sev_es_test_vc_init, + .exit = sev_es_test_vc_exit, + .test_cases = sev_es_vc_testcases, +}; +kunit_test_suite(sev_es_vc_test_suite); -- 2.32.0