linux-kernel - [PATCH v7 4/4] KVM SEV-ES: Add tests to validate VC handling for IO instructions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20220613170420.18521-5-vkarasulli@suse.de>
Date:   Mon, 13 Jun 2022 19:04:20 +0200
From:   Vasant Karasulli <vkarasulli@...e.de>
To:     linux-kernel@...r.kernel.org, kvm@...r.kernel.org
Cc:     bp@...en8.de, jroedel@...e.de, thomas.lendacky@....com,
        x86@...nel.org, seanjc@...gle.com,
        Vasant Karasulli <vkarasulli@...e.de>
Subject: [PATCH v7 4/4] KVM SEV-ES: Add tests to validate VC handling for IO instructions

These tests:
   1. install a kretprobe on the #VC handler (sev_es_ghcb_hv_call, to
      access GHCB before/after the resulting VMGEXIT).
   2. trigger an NAE by issuing an IO instruction.
   3. check that the kretprobe was hit with the right
      exit_code available in GHCB.

To run these tests, configuration options CONFIG_X86_TESTS and
CONFIG_AMD_SEV_ES_TEST_VC have to be enabled. These tests run
at the kernel boot time. Result of the test execution can be
monitored in the kernel log.

Signed-off-by: Vasant Karasulli <vkarasulli@...e.de>
---
 arch/x86/tests/sev-test-vc.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/arch/x86/tests/sev-test-vc.c b/arch/x86/tests/sev-test-vc.c
index 629aa0ca1c86..33ca761bf9cb 100644
--- a/arch/x86/tests/sev-test-vc.c
+++ b/arch/x86/tests/sev-test-vc.c
@@ -8,7 +8,9 @@
 #include <asm/cpufeature.h>
 #include <asm/sev-common.h>
 #include <asm/debugreg.h>
+#include <asm/io.h>
 #include <asm/svm.h>
+#include <asm/apicdef.h>
 #include <kunit/test.h>
 #include <linux/kprobes.h>

@@ -101,11 +103,36 @@ static void sev_es_nae_dr7_rw(struct kunit *test)
 		   native_set_debugreg(7, native_get_debugreg(7)));
 }

+static void sev_es_nae_ioio(struct kunit *test)
+{
+	unsigned long port = 0x80;
+	char val = 0;
+
+	check_op(test, SVM_EXIT_IOIO, val = inb(port));
+	check_op(test, SVM_EXIT_IOIO, outb(val, port));
+	check_op(test, SVM_EXIT_IOIO, insb(port, &val, sizeof(val)));
+	check_op(test, SVM_EXIT_IOIO, outsb(port, &val, sizeof(val)));
+}
+
+static void sev_es_nae_mmio(struct kunit *test)
+{
+	unsigned long lapic_ver_pa = APIC_DEFAULT_PHYS_BASE + APIC_LVR;
+	unsigned long __iomem *lapic = ioremap(lapic_ver_pa, 0x4);
+	unsigned long lapic_version = 0;
+
+	check_op(test, SVM_VMGEXIT_MMIO_READ, lapic_version = *lapic);
+	check_op(test, SVM_VMGEXIT_MMIO_WRITE, *lapic = lapic_version);
+
+	iounmap(lapic);
+}
+
 static struct kunit_case sev_es_vc_testcases[] = {
 	KUNIT_CASE(sev_es_nae_cpuid),
 	KUNIT_CASE(sev_es_nae_wbinvd),
 	KUNIT_CASE(sev_es_nae_msr),
 	KUNIT_CASE(sev_es_nae_dr7_rw),
+	KUNIT_CASE(sev_es_nae_ioio),
+	KUNIT_CASE(sev_es_nae_mmio),
 	{}
 };

--
2.32.0