[PATCH 0/6] svm intercept tests

[PATCH 0/6] svm intercept tests

[Avi Kivity]

This patchset adds three more svm tests: cr3 read intercept, cr3 read
intercept (disabled), and cr3 read intercept through the instruction
emulator.  As usual, 66.7% of the tests pass.

Avi Kivity (6):
  test: add scratch word for use by svm tests
  test: add intercepted and unintercepted cr3 read tests for svm
  test: add pause() instruction accessor
  test: add cli() and sti() instruction accessors
  test: ensure svm tests are executed with interrupts disabled by
    default
  test: verify that the emulator honours svm intercepts

 kvm/test/lib/x86/processor.h |   15 +++++++++
 kvm/test/x86/svm.c           |   65 +++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 79 insertions(+), 1 deletions(-)

[PATCH 1/6] test: add scratch word for use by svm tests

[Avi Kivity]

Signed-off-by: Avi Kivity <avi@redhat.com>
---
 kvm/test/x86/svm.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/kvm/test/x86/svm.c b/kvm/test/x86/svm.c
index af0e60c..5bb64ff 100644
--- a/kvm/test/x86/svm.c
+++ b/kvm/test/x86/svm.c
@@ -63,6 +63,7 @@ struct test {
     bool (*succeeded)(struct test *test);
     struct vmcb *vmcb;
     int exits;
+    ulong scratch;
 };
 
 static void test_thunk(struct test *test)
-- 
1.7.1

[PATCH 2/6] test: add intercepted and unintercepted cr3 read tests for svm

[Avi Kivity]

Signed-off-by: Avi Kivity <avi@redhat.com>
---
 kvm/test/x86/svm.c |   26 +++++++++++++++++++++++++-
 1 files changed, 25 insertions(+), 1 deletions(-)

diff --git a/kvm/test/x86/svm.c b/kvm/test/x86/svm.c
index 5bb64ff..222356d 100644
--- a/kvm/test/x86/svm.c
+++ b/kvm/test/x86/svm.c
@@ -146,12 +146,36 @@ static bool check_vmrun(struct test *test)
     return test->vmcb->control.exit_code == SVM_EXIT_VMRUN;
 }
 
+static void prepare_cr3_intercept(struct test *test)
+{
+    default_prepare(test);
+    test->vmcb->control.intercept_cr_read |= 1 << 3;
+}
+
+static void test_cr3_intercept(struct test *test)
+{
+    asm volatile ("mov %%cr3, %0" : "=r"(test->scratch) : : "memory");
+}
+
+static bool check_cr3_intercept(struct test *test)
+{
+    return test->vmcb->control.exit_code == SVM_EXIT_READ_CR3;
+}
+
+static bool check_cr3_nointercept(struct test *test)
+{
+    return null_check(test) && test->scratch == read_cr3();
+}
+
 static struct test tests[] = {
     { "null", default_prepare, null_test, default_finished, null_check },
     { "vmrun", default_prepare, test_vmrun, default_finished, check_vmrun },
     { "vmrun intercept check", prepare_no_vmrun_int, null_test,
       default_finished, check_no_vmrun_int },
-
+    { "cr3 read intercept", prepare_cr3_intercept, test_cr3_intercept,
+      default_finished, check_cr3_intercept },
+    { "cr3 read nointercept", default_prepare, test_cr3_intercept,
+      default_finished, check_cr3_nointercept },
 };
 
 int main(int ac, char **av)
-- 
1.7.1

[PATCH 3/6] test: add pause() instruction accessor

[Avi Kivity]

Signed-off-by: Avi Kivity <avi@redhat.com>
---
 kvm/test/lib/x86/processor.h |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/kvm/test/lib/x86/processor.h b/kvm/test/lib/x86/processor.h
index ea44a9d..0376d04 100644
--- a/kvm/test/lib/x86/processor.h
+++ b/kvm/test/lib/x86/processor.h
@@ -243,4 +243,9 @@ static inline struct cpuid cpuid(u32 function)
     return cpuid_indexed(function, 0);
 }
 
+static inline void pause(void)
+{
+    asm volatile ("pause");
+}
+
 #endif
-- 
1.7.1

[PATCH 4/6] test: add cli() and sti() instruction accessors

[Avi Kivity]

Signed-off-by: Avi Kivity <avi@redhat.com>
---
 kvm/test/lib/x86/processor.h |   10 ++++++++++
 1 files changed, 10 insertions(+), 0 deletions(-)

diff --git a/kvm/test/lib/x86/processor.h b/kvm/test/lib/x86/processor.h
index 0376d04..67d7ca5 100644
--- a/kvm/test/lib/x86/processor.h
+++ b/kvm/test/lib/x86/processor.h
@@ -248,4 +248,14 @@ static inline void pause(void)
     asm volatile ("pause");
 }
 
+static inline void cli(void)
+{
+    asm volatile ("cli");
+}
+
+static inline void sti(void)
+{
+    asm volatile ("sti");
+}
+
 #endif
-- 
1.7.1

[PATCH 5/6] test: ensure svm tests are executed with interrupts disabled by default

[Avi Kivity]

Signed-off-by: Avi Kivity <avi@redhat.com>
---
 kvm/test/x86/svm.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/kvm/test/x86/svm.c b/kvm/test/x86/svm.c
index 222356d..3c30118 100644
--- a/kvm/test/x86/svm.c
+++ b/kvm/test/x86/svm.c
@@ -110,6 +110,7 @@ static bool test_run(struct test *test, struct vmcb *vmcb)
 static void default_prepare(struct test *test)
 {
     vmcb_ident(test->vmcb);
+    cli();
 }
 
 static bool default_finished(struct test *test)
-- 
1.7.1

[PATCH 6/6] test: verify that the emulator honours svm intercepts

[Avi Kivity]

Signed-off-by: Avi Kivity <avi@redhat.com>
---
 kvm/test/x86/svm.c |   37 +++++++++++++++++++++++++++++++++++++
 1 files changed, 37 insertions(+), 0 deletions(-)

diff --git a/kvm/test/x86/svm.c b/kvm/test/x86/svm.c
index 3c30118..cb26af6 100644
--- a/kvm/test/x86/svm.c
+++ b/kvm/test/x86/svm.c
@@ -3,6 +3,7 @@
 #include "processor.h"
 #include "msr.h"
 #include "vm.h"
+#include "smp.h"
 
 static void setup_svm(void)
 {
@@ -168,6 +169,39 @@ static bool check_cr3_nointercept(struct test *test)
     return null_check(test) && test->scratch == read_cr3();
 }
 
+static void corrupt_cr3_intercept_bypass(void *_test)
+{
+    struct test *test = _test;
+    extern volatile u32 mmio_insn;
+
+    while (!__sync_bool_compare_and_swap(&test->scratch, 1, 2))
+        pause();
+    pause();
+    pause();
+    pause();
+    mmio_insn = 0x90d8200f;  // mov %cr3, %rax; nop
+}
+
+static void prepare_cr3_intercept_bypass(struct test *test)
+{
+    default_prepare(test);
+    test->vmcb->control.intercept_cr_read |= 1 << 3;
+    on_cpu_async(1, corrupt_cr3_intercept_bypass, test);
+}
+
+static void test_cr3_intercept_bypass(struct test *test)
+{
+    ulong a = 0xa0000;
+
+    test->scratch = 1;
+    while (test->scratch != 2)
+        barrier();
+
+    asm volatile ("mmio_insn: mov %0, (%0); nop"
+                  : "+a"(a) : : "memory");
+    test->scratch = a;
+}
+
 static struct test tests[] = {
     { "null", default_prepare, null_test, default_finished, null_check },
     { "vmrun", default_prepare, test_vmrun, default_finished, check_vmrun },
@@ -177,6 +211,8 @@ static struct test tests[] = {
       default_finished, check_cr3_intercept },
     { "cr3 read nointercept", default_prepare, test_cr3_intercept,
       default_finished, check_cr3_nointercept },
+    { "cr3 read intercept emulate", prepare_cr3_intercept_bypass,
+      test_cr3_intercept_bypass, default_finished, check_cr3_intercept }
 };
 
 int main(int ac, char **av)
@@ -185,6 +221,7 @@ int main(int ac, char **av)
     struct vmcb *vmcb;
 
     setup_vm();
+    smp_init();
 
     if (!(cpuid(0x80000001).c & 4)) {
         printf("SVM not availble\n");
-- 
1.7.1

Re: [PATCH 6/6] test: verify that the emulator honours svm intercepts

[Avi Kivity]

  On 07/28/2010 07:25 PM, Avi Kivity wrote:
>
> +static void corrupt_cr3_intercept_bypass(void *_test)
> +{
> +    struct test *test = _test;
> +    extern volatile u32 mmio_insn;
> +
> +    while (!__sync_bool_compare_and_swap(&test->scratch, 1, 2))
> +        pause();
> +    pause();
> +    pause();
> +    pause();
> +    mmio_insn = 0x90d8200f;  // mov %cr3, %rax; nop
> +}
> +
> +static void prepare_cr3_intercept_bypass(struct test *test)
> +{
> +    default_prepare(test);
> +    test->vmcb->control.intercept_cr_read |= 1<<  3;
> +    on_cpu_async(1, corrupt_cr3_intercept_bypass, test);
> +}
> +
> +static void test_cr3_intercept_bypass(struct test *test)
> +{
> +    ulong a = 0xa0000;
> +
> +    test->scratch = 1;
> +    while (test->scratch != 2)
> +        barrier();
> +
> +    asm volatile ("mmio_insn: mov %0, (%0); nop"
> +                  : "+a"(a) : : "memory");
> +    test->scratch = a;
> +}

ftrace makes it quite easy to see how things go wrong:

>  qemu-system-x86-10545 [004] 98291.582062: kvm_exit: reason vmrun rip 
> 0x4003d4

step into the guest

>  qemu-system-x86-10546 [006] 98291.582064: kvm_inj_virq: irq 32

here's out evil IPI

>  qemu-system-x86-10545 [004] 98291.582064: kvm_nested_vmrun: rip: 
> 0x00000000004003d1 vmcb: 0x0000000007ff8000 nrip: 0x0000000000400330 
> int_ctl: 0x00000000 event_inj: 0x00000000 npt: off
>  qemu-system-x86-10546 [006] 98291.582065: kvm_inj_virq: irq 32
>  qemu-system-x86-10545 [004] 98291.582065: kvm_nested_intercepts: 
> cr_read: 0008 cr_write: 0000 excp: 00000000 intercept: 0000000300000000

Note cr3 reads are intercepted

>  qemu-system-x86-10546 [006] 98291.582065: kvm_entry: vcpu 1
>  qemu-system-x86-10545 [004] 98291.582070: kvm_entry: vcpu 0
>  qemu-system-x86-10545 [004] 98291.582072: kvm_exit: reason npf rip 
> 0x400368
>  qemu-system-x86-10545 [004] 98291.582073: kvm_nested_vmexit: rip: 
> 0x0000000000400368 reason: npf ext_inf1: 0x0000000000000006 ext_inf2: 
> 0x00000000000a0000 ext_int: 0x00000000 ext_int_err: 0x00000000

access assigned mmio -> trap to host

>  qemu-system-x86-10546 [006] 98291.582074: kvm_exit: reason npf rip 
> 0x4013c9
>  qemu-system-x86-10545 [004] 98291.582074: kvm_page_fault: address 
> a0000 error_code 6
>  qemu-system-x86-10546 [006] 98291.582074: kvm_page_fault: address 
> fee000b0 error_code 6

IPI on its way out

>  qemu-system-x86-10545 [004] 98291.582075: kvm_emulate_insn: 0:400368: 
> 0f 20 d8 (prot64)

Emulating mov %cr3, %rax

-- 
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.

Re: [PATCH 6/6] test: verify that the emulator honours svm intercepts

[Roedel, Joerg]

On Wed, Jul 28, 2010 at 02:04:35PM -0400, Avi Kivity wrote:
>   On 07/28/2010 07:25 PM, Avi Kivity wrote:
> >
> > +static void corrupt_cr3_intercept_bypass(void *_test)
> > +{
> > +    struct test *test = _test;
> > +    extern volatile u32 mmio_insn;
> > +
> > +    while (!__sync_bool_compare_and_swap(&test->scratch, 1, 2))
> > +        pause();
> > +    pause();
> > +    pause();
> > +    pause();
> > +    mmio_insn = 0x90d8200f;  // mov %cr3, %rax; nop
> > +}
> > +
> > +static void prepare_cr3_intercept_bypass(struct test *test)
> > +{
> > +    default_prepare(test);
> > +    test->vmcb->control.intercept_cr_read |= 1<<  3;
> > +    on_cpu_async(1, corrupt_cr3_intercept_bypass, test);
> > +}
> > +
> > +static void test_cr3_intercept_bypass(struct test *test)
> > +{
> > +    ulong a = 0xa0000;
> > +
> > +    test->scratch = 1;
> > +    while (test->scratch != 2)
> > +        barrier();
> > +
> > +    asm volatile ("mmio_insn: mov %0, (%0); nop"
> > +                  : "+a"(a) : : "memory");
> > +    test->scratch = a;
> > +}
> 
> ftrace makes it quite easy to see how things go wrong:
> 
> >  qemu-system-x86-10545 [004] 98291.582062: kvm_exit: reason vmrun rip 
> > 0x4003d4
> 
> step into the guest
> 
> >  qemu-system-x86-10546 [006] 98291.582064: kvm_inj_virq: irq 32
> 
> here's out evil IPI
> 
> >  qemu-system-x86-10545 [004] 98291.582064: kvm_nested_vmrun: rip: 
> > 0x00000000004003d1 vmcb: 0x0000000007ff8000 nrip: 0x0000000000400330 
> > int_ctl: 0x00000000 event_inj: 0x00000000 npt: off
> >  qemu-system-x86-10546 [006] 98291.582065: kvm_inj_virq: irq 32
> >  qemu-system-x86-10545 [004] 98291.582065: kvm_nested_intercepts: 
> > cr_read: 0008 cr_write: 0000 excp: 00000000 intercept: 0000000300000000
> 
> Note cr3 reads are intercepted
> 
> >  qemu-system-x86-10546 [006] 98291.582065: kvm_entry: vcpu 1
> >  qemu-system-x86-10545 [004] 98291.582070: kvm_entry: vcpu 0
> >  qemu-system-x86-10545 [004] 98291.582072: kvm_exit: reason npf rip 
> > 0x400368
> >  qemu-system-x86-10545 [004] 98291.582073: kvm_nested_vmexit: rip: 
> > 0x0000000000400368 reason: npf ext_inf1: 0x0000000000000006 ext_inf2: 
> > 0x00000000000a0000 ext_int: 0x00000000 ext_int_err: 0x00000000
> 
> access assigned mmio -> trap to host
> 
> >  qemu-system-x86-10546 [006] 98291.582074: kvm_exit: reason npf rip 
> > 0x4013c9
> >  qemu-system-x86-10545 [004] 98291.582074: kvm_page_fault: address 
> > a0000 error_code 6
> >  qemu-system-x86-10546 [006] 98291.582074: kvm_page_fault: address 
> > fee000b0 error_code 6
> 
> IPI on its way out
> 
> >  qemu-system-x86-10545 [004] 98291.582075: kvm_emulate_insn: 0:400368: 
> > 0f 20 d8 (prot64)
> 
> Emulating mov %cr3, %rax

Yeah, its the failure case we discussed yesterday. Another question, is
there any way to run these tests bare-metal to verify them first on real
silicon? This would be very helpful to have the proof that a test really
works, especially in the nested-svm case.
The dependency on the testdev seem to make things difficult. But I
havn't investigated this further yet.

	Joerg

-- 
Joerg Roedel - AMD Operating System Research Center

Advanced Micro Devices GmbH Einsteinring 24 85609 Dornach
General Managers: Alberto Bozzo, Andrew Bowd
Registration: Dornach, Landkr. Muenchen; Registerger. Muenchen, HRB Nr. 43632

Re: [PATCH 6/6] test: verify that the emulator honours svm intercepts

[Avi Kivity]

  On 07/29/2010 10:43 AM, Roedel, Joerg wrote:
> Another question, is
> there any way to run these tests bare-metal to verify them first on real
> silicon?

Sure, you can use grub's multiboot capabilities to boot a .flat file.

> This would be very helpful to have the proof that a test really
> works, especially in the nested-svm case.
> The dependency on the testdev seem to make things difficult. But I
> havn't investigated this further yet.
>

Most tests use testdev for the serial port and for the memory size.  We 
can switch the serial port to a real serial device (or to screen display 
via int 10), and query the memory size from the BIOS.

-- 
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.

Re: [PATCH 6/6] test: verify that the emulator honours svm intercepts

[Roedel, Joerg]

On Thu, Jul 29, 2010 at 03:48:55AM -0400, Avi Kivity wrote:
>   On 07/29/2010 10:43 AM, Roedel, Joerg wrote:
> > Another question, is
> > there any way to run these tests bare-metal to verify them first on real
> > silicon?
> 
> Sure, you can use grub's multiboot capabilities to boot a .flat file.

This requires to objcopy them to a binary format first, no? The
multiboot spec states that the binaries need to be 32 bit elf files
while the .flat files are 64 bit per default. I think I remember that
grub checks for that. Anyway, thats an easy thing to do.

> Most tests use testdev for the serial port and for the memory size.  We 
> can switch the serial port to a real serial device (or to screen display 
> via int 10), and query the memory size from the BIOS.

Yeah, that would be really helpful.

	Joerg

-- 
Joerg Roedel - AMD Operating System Research Center

Advanced Micro Devices GmbH Einsteinring 24 85609 Dornach
General Managers: Alberto Bozzo, Andrew Bowd
Registration: Dornach, Landkr. Muenchen; Registerger. Muenchen, HRB Nr. 43632

Re: [PATCH 0/6] svm intercept tests

[Roedel, Joerg]

On Wed, Jul 28, 2010 at 12:25:45PM -0400, Avi Kivity wrote:
> This patchset adds three more svm tests: cr3 read intercept, cr3 read
> intercept (disabled), and cr3 read intercept through the instruction
> emulator.  As usual, 66.7% of the tests pass.

For the next_rip test I added another feature to the test-framework. Can
you apply the attached patch please to it? It will save me from some
rebasing when you write more tests before I finish my two tests :-)

	Joerg


>From 282dafc0d476b016967c91742008ecf21aaf36e1 Mon Sep 17 00:00:00 2001
From: Joerg Roedel <joerg.roedel@amd.com>
Date: Wed, 28 Jul 2010 15:56:32 +0200
Subject: [PATCH] test: Run tests only if supported on the current hardware

Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
---
 kvm/test/x86/svm.c |   38 +++++++++++++++++++++++++-------------
 1 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/kvm/test/x86/svm.c b/kvm/test/x86/svm.c
index cb26af6..054bd2e 100644
--- a/kvm/test/x86/svm.c
+++ b/kvm/test/x86/svm.c
@@ -58,6 +58,7 @@ static void vmcb_ident(struct vmcb *vmcb)
 
 struct test {
     const char *name;
+    bool (*supported)(void);
     void (*prepare)(struct test *test);
     void (*guest_func)(struct test *test);
     bool (*finished)(struct test *test);
@@ -108,6 +109,11 @@ static bool test_run(struct test *test, struct vmcb *vmcb)
     return success;
 }
 
+static bool default_supported(void)
+{
+    return true;
+}
+
 static void default_prepare(struct test *test)
 {
     vmcb_ident(test->vmcb);
@@ -203,21 +209,24 @@ static void test_cr3_intercept_bypass(struct test *test)
 }
 
 static struct test tests[] = {
-    { "null", default_prepare, null_test, default_finished, null_check },
-    { "vmrun", default_prepare, test_vmrun, default_finished, check_vmrun },
-    { "vmrun intercept check", prepare_no_vmrun_int, null_test,
-      default_finished, check_no_vmrun_int },
-    { "cr3 read intercept", prepare_cr3_intercept, test_cr3_intercept,
+    { "null", default_supported, default_prepare, null_test,
+      default_finished, null_check },
+    { "vmrun", default_supported, default_prepare, test_vmrun,
+       default_finished, check_vmrun },
+    { "vmrun intercept check", default_supported, prepare_no_vmrun_int,
+      null_test, default_finished, check_no_vmrun_int },
+    { "cr3 read intercept", default_supported, prepare_cr3_intercept,
+      test_cr3_intercept, default_finished, check_cr3_intercept },
+    { "cr3 read nointercept", default_supported, default_prepare,
+      test_cr3_intercept, default_finished, check_cr3_nointercept },
+    { "cr3 read intercept emulate", default_supported,
+      prepare_cr3_intercept_bypass, test_cr3_intercept_bypass,
       default_finished, check_cr3_intercept },
-    { "cr3 read nointercept", default_prepare, test_cr3_intercept,
-      default_finished, check_cr3_nointercept },
-    { "cr3 read intercept emulate", prepare_cr3_intercept_bypass,
-      test_cr3_intercept_bypass, default_finished, check_cr3_intercept }
 };
 
 int main(int ac, char **av)
 {
-    int i, nr, passed;
+    int i, nr, passed, done;
     struct vmcb *vmcb;
 
     setup_vm();
@@ -233,11 +242,14 @@ int main(int ac, char **av)
     vmcb = alloc_page();
 
     nr = ARRAY_SIZE(tests);
-    passed = 0;
+    passed = done = 0;
     for (i = 0; i < nr; ++i) {
+        if (!tests[i].supported())
+            continue;
+	done   += 1;
         passed += test_run(&tests[i], vmcb);
     }
 
-    printf("\nSUMMARY: %d TESTS, %d FAILURES\n", nr, (nr - passed));
-    return passed == nr ? 0 : 1;
+    printf("\nSUMMARY: %d TESTS, %d FAILURES\n", done, (done - passed));
+    return passed == done ? 0 : 1;
 }
-- 
1.7.0.4


-- 
Joerg Roedel - AMD Operating System Research Center

Advanced Micro Devices GmbH Einsteinring 24 85609 Dornach
General Managers: Alberto Bozzo, Andrew Bowd
Registration: Dornach, Landkr. Muenchen; Registerger. Muenchen, HRB Nr. 43632

Re: [PATCH 6/6] test: verify that the emulator honours svm intercepts

[Avi Kivity]

  On 07/29/2010 10:59 AM, Roedel, Joerg wrote:
> On Thu, Jul 29, 2010 at 03:48:55AM -0400, Avi Kivity wrote:
>>    On 07/29/2010 10:43 AM, Roedel, Joerg wrote:
>>> Another question, is
>>> there any way to run these tests bare-metal to verify them first on real
>>> silicon?
>> Sure, you can use grub's multiboot capabilities to boot a .flat file.
> This requires to objcopy them to a binary format first, no? The
> multiboot spec states that the binaries need to be 32 bit elf files
> while the .flat files are 64 bit per default. I think I remember that
> grub checks for that. Anyway, thats an easy thing to do.

They are multiboot files, that's how -kernel manages to load them (it's 
a multiboot + linux bootloader).

-- 
error compiling committee.c: too many arguments to function

Re: [PATCH 0/6] svm intercept tests

[Marcelo Tosatti]

On Thu, Jul 29, 2010 at 10:16:42AM +0200, Roedel, Joerg wrote:
> On Wed, Jul 28, 2010 at 12:25:45PM -0400, Avi Kivity wrote:
> > This patchset adds three more svm tests: cr3 read intercept, cr3 read
> > intercept (disabled), and cr3 read intercept through the instruction
> > emulator.  As usual, 66.7% of the tests pass.
> 
> For the next_rip test I added another feature to the test-framework. Can
> you apply the attached patch please to it? It will save me from some
> rebasing when you write more tests before I finish my two tests :-)
> 
> 	Joerg
> 
> 
> >From 282dafc0d476b016967c91742008ecf21aaf36e1 Mon Sep 17 00:00:00 2001
> From: Joerg Roedel <joerg.roedel@amd.com>
> Date: Wed, 28 Jul 2010 15:56:32 +0200
> Subject: [PATCH] test: Run tests only if supported on the current hardware
> 
> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
> ---
>  kvm/test/x86/svm.c |   38 +++++++++++++++++++++++++-------------
>  1 files changed, 25 insertions(+), 13 deletions(-)

Applied, thanks.