This series introduces support for SNP features to KVM-Unit-Tests environment. Goal of this work is to use KUT to build and develop a test suite for KVM hypervisor with SEV-SNP support to test basic functionality as well as determine whether hypervisor can handle edge cases that a normal SNP guest otherwise wouldn't perform/request. These patches are rebased on top of [1] and are available at: https://github.com/pvpk1994/kvm-unit-tests-1/tree/SNP_RFC_v2 which are in turn rebased on kvm-unit-tests/master (201b9e8bdc84) ============ Patch Layout ============ Patches 1-2: Provide MMIO access support to the APIC page by unsetting C-bit in guest page table for SEV-ES/SEV-SNP guest. Patch 3: Renames SEV-ES's #VC handler to a more generic name that applies to both SEV-ES and SEV-SNP. No functional change. Patch 4: Adds support in x86/efi/run for running SEV-SNP unit tests under UEFI Patches 5-6: Adds support for SEV-SNP enablement and CC-blob discovery. Patch 7: Sets up GHCB page table attributes for new page table. Patches 8-12: Page state change conversions using MSR and GHCB protocol approaches. Patches 13-14: Page state change conversions from 2M intermixed states to 2M Shared/Private states. Patch 15: PSMASH/UNSMASH page state change requests on 2M large pages. Patch 16: Injecting random non-zero page offsets via page state change requests. ================================ Procedure to run this test-suite ================================ SEV-SNP KUT guest requires UEFI/OVMF to bootup. Information on how to run the SEV-SNP tests with UEFI support can be found in x86/efi/README.md introduced in this patchset. Tested this patchset against the following: (Kernel, OVMF, QEMU): Upstream QEMU: (commit: e2f346aa9864) Merge tag 'sdmmc-20240716' of https://github.com/philmd/qemu into staging Upstream OVMF: (commit: 11c50d6ca10a) MdeModulePkg/UfsBlockIoPei: Wait fDeviceInit Be Cleared by Devices Upstream kernel: kvm/next (commit: 1c5a0b55abeb) Merge tag 'kvmarm-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD System can be configured as follows to run UEFI SNP tests: ./configure --enable-efi This will configure KUT to use #VC handler that it sets up once GHCB page is mapped. ./configure --enable-efi --amdsev-efi-vc The above configuration option will build KUT and let SNP test use #VC handler that is setup by OVMF throughout the lifetime of SNP guest. The SNP tests introduced in this patchset run well with both the above configuration options (--enable-efi and --enable-efi --amdsev-efi-vc). Once configured, SEV-SNP unit tests can be tested as follows: export QEMU=/path/to/qemu-system-x86_64 export EFI_UEFI=/path/to/OVMF.fd EFI_SNP=y ./x86/efi/run ./x86/amd_sev.efi ========== References ========== [1] https://lore.kernel.org/all/20240612144539.16147-1-vsntk18@xxxxxxxxx/ ========= Changelog ========= v1 -> v2: * Rebased on AMD SEV-ES #VC handler patchset [1] * Rebased [1] on KUT's master (201b9e8bdc8b). * Introduced a new test where test issues PSMASH/UNSMASH page state change requests on 2M ranges. * Introduced a new test where test injects random current page offsets to examine how hypervisor handles page state change requests with non-zero page offsets for 2M large pages. * Implemented non-identity mappings for all page state change tests (4K/2M) to avoid any odd side-effects arising due to page state conversions on identity mapped pages. * Implemented a new helper (vmalloc_pages()) to allocate non-identity mapped pages that would also be helpful for non-SNP related tests. * Introduced pgtable_va_to_pa() to help convert a guest virtual address to guest physical address by doing page table walk that would be helpful when we have non identity mapped pages where virt_to_phys() won't work. * Introduced snp_free_pages() interface to help bring back all the pages back to default guest-owned states before freeing up the physical pages after the SNP tests finish. * Got rid of the check where end_entry is being forcefully truncated to 252 when sizeof(struct snp_psc_desc) exceeds GHCB shared buffer size. Instead, VMGEXIT_PSC_MAX_ENTRY is now calculated based on the size of the GHCB shared buffer. * Introduced add_psc_entry() helper to facilitate easy addition of a new page state change entry for patches that need individual entries to be added. * Dropped "RFC" tag. * v1: https://lore.kernel.org/all/20240419125759.242870-1-papaluri@xxxxxxx/ Pavan Kumar Paluri (16): x86/apic: Use common library outb() implementation x86/apic: Add MMIO access support for SEV-ES/SNP guest with C-bit unset x86 AMD SEV-ES: Rename setup_amd_sev_es() to setup_vc_handler() x86/efi: Add support for running tests with UEFI in SEV-SNP environment x86 AMD SEV-SNP: Enable SEV-SNP support x86 AMD SEV-SNP: Add tests for presence of confidential computing blob x86 AMD SEV-ES: Set GHCB page attributes for a new page table x86 AMD SEV-SNP: Test Private->Shared page state changes using GHCB MSR x86: Introduce gva to gpa address translation helper x86: Add support for installing large pages x86 AMD SEV-SNP: Change guest pages from Private->Shared using GHCB NAE x86 AMD SEV-SNP: Change guest pages from Shared->Private using GHCB NAE x86 AMD SEV-SNP: Change guest pages from Intermix->Private using GHCB NAE x86 AMD SEV-SNP: Change guest pages from Intermix->Shared using GHCB NAE x86 AMD SEV-SNP: Issue PSMASH/UNSMASH PSC requests on 2M ranges x86 AMD SEV-SNP: Inject random cur_page offsets for 2M ranges lib/asm-generic/page.h | 2 + lib/linux/efi.h | 1 + lib/x86/amd_sev.c | 357 ++++++++++++++++++++++++++++++++++- lib/x86/amd_sev.h | 124 +++++++++++- lib/x86/amd_sev_vc.c | 2 +- lib/x86/apic.c | 22 ++- lib/x86/setup.c | 15 +- lib/x86/svm.h | 1 + lib/x86/vm.c | 70 +++++++ lib/x86/vm.h | 6 + x86/amd_sev.c | 420 +++++++++++++++++++++++++++++++++++++++++ x86/efi/README.md | 6 + x86/efi/run | 33 +++- 13 files changed, 1038 insertions(+), 21 deletions(-) -- 2.34.1
