From nobody Thu Apr 2 01:31:55 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1774272823925424.0363514639247; Mon, 23 Mar 2026 06:33:43 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w4fP9-0000yy-EU; Mon, 23 Mar 2026 09:33:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w4fOR-0000XD-56; Mon, 23 Mar 2026 09:32:31 -0400 Received: from sgoci-sdnproxy-4.icoremail.net ([129.150.39.64]) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w4fON-00029V-9i; Mon, 23 Mar 2026 09:32:30 -0400 Received: from prodtpl.icoremail.net (unknown [10.12.1.20]) by hzbj-icmmx-7 (Coremail) with SMTP id AQAAfwA3NpLmQMFp1U9sCA--.2530S2; Mon, 23 Mar 2026 21:32:22 +0800 (CST) Received: from phytium.com.cn (unknown [218.76.62.144]) by mail (Coremail) with SMTP id AQAAf8DwwZLcQMFp0nsEAA--.10052S7; Mon, 23 Mar 2026 21:32:17 +0800 (CST) From: Tao Tang To: Fabiano Rosas , Laurent Vivier , Paolo Bonzini Cc: qemu-devel@nongnu.org, qemu-arm@nongnu.org, Peter Maydell , Chen Baozi , Pierrick Bouvier , Chao Liu , Tao Tang Subject: [RFC v3 4/4] [NOT-MERGE] tests/qtest: add q35 SMM-only x86 attrs coverage Date: Mon, 23 Mar 2026 21:32:10 +0800 Message-Id: <20260323133210.1523868-5-tangtao1634@phytium.com.cn> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260323133210.1523868-1-tangtao1634@phytium.com.cn> References: <20260323133210.1523868-1-tangtao1634@phytium.com.cn> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: AQAAf8DwwZLcQMFp0nsEAA--.10052S7 X-CM-SenderInfo: pwdqw3tdrrljuu6sx5pwlxzhxfrphubq/1tbiAQADBWnAQfgOywAAsS Authentication-Results: hzbj-icmmx-7; spf=neutral smtp.mail=tangtao163 4@phytium.com.cn; X-Coremail-Antispam: 1Uk129KBjvJXoW3Ar43Gw43Wry3WFykArW8JFb_yoW3Wr4xpF yDAFnF9r4a9F1xZrs7Ja1xC3WYqFs7Ca48urW7GwsYkF45Crn2yryq9Fyvqr9rJrW0vw4r u3WDJFZrGan8JaDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUj1kv1TuYvTs0mT0YCTnIWj DUYxn0WfASr-VFAU7a7-sFnT9fnUUIcSsGvfJ3UbIYCTnIWIevJa73UjIFyTuYvj4RJUUU UUUUU Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=129.150.39.64; envelope-from=tangtao1634@phytium.com.cn; helo=sgoci-sdnproxy-4.icoremail.net X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1774272826456158500 Content-Type: text/plain; charset="utf-8" Add a q35-only test path for x86 secure attrs by introducing an optional test-only RAM region that is mapped only into the SMM address space. The new qtest-x86-attrs-test enables this region with `-global mch.x-smm-test-ram=3Don` and verifies that accesses with the `secure` attribute reach the SMM-only region, while default accesses do not. This provides the x86 cross-verification that qtest-attrs-test does not cover, where normal RAM is visible from both the default and SMM address spaces. This is a NOT-MERGE commit. Signed-off-by: Tao Tang --- hw/pci-host/q35.c | 24 +++++++ include/hw/pci-host/q35.h | 8 +++ tests/qtest/meson.build | 1 + tests/qtest/qtest-x86-attrs-test.c | 109 +++++++++++++++++++++++++++++ 4 files changed, 142 insertions(+) create mode 100644 tests/qtest/qtest-x86-attrs-test.c diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c index e85e4227b3..5c23375dd6 100644 --- a/hw/pci-host/q35.c +++ b/hw/pci-host/q35.c @@ -572,6 +572,11 @@ static void mch_realize(PCIDevice *d, Error **errp) return; } =20 + if (mch->enable_smm_test_ram && !mch->has_smm_ranges) { + error_setg(errp, "x-smm-test-ram requires SMM support"); + return; + } + /* setup pci memory mapping */ pc_pci_as_mapping_init(mch->system_memory, mch->pci_address_space); =20 @@ -653,6 +658,23 @@ static void mch_realize(PCIDevice *d, Error **errp) memory_region_add_subregion(&mch->smram, MCH_HOST_BRIDGE_SMBASE_ADDR, &mch->smbase_window); =20 + if (mch->enable_smm_test_ram) { + /* + * This is a QEMU-specific, test-only region. It is mapped only in= to + * mch->smram so qtest can verify that x86 secure attrs select the= SMM + * address space rather than the default one. + */ + memory_region_init_ram(&mch->smm_test_ram, OBJECT(mch), + "smm-test-ram", + MCH_HOST_BRIDGE_SMM_TEST_RAM_SIZE, errp); + if (*errp) { + return; + } + memory_region_add_subregion(&mch->smram, + MCH_HOST_BRIDGE_SMM_TEST_RAM_BASE, + &mch->smm_test_ram); + } + object_property_add_const_link(qdev_get_machine(), "smram", OBJECT(&mch->smram)); } @@ -661,6 +683,8 @@ static const Property mch_props[] =3D { DEFINE_PROP_UINT16("extended-tseg-mbytes", MCHPCIState, ext_tseg_mbyte= s, 64), DEFINE_PROP_BOOL("smbase-smram", MCHPCIState, has_smram_at_smbase, tru= e), + DEFINE_PROP_BOOL("x-smm-test-ram", MCHPCIState, enable_smm_test_ram, + false), }; =20 static void mch_class_init(ObjectClass *klass, const void *data) diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h index ddafc3f2e3..1ca26f0e63 100644 --- a/include/hw/pci-host/q35.h +++ b/include/hw/pci-host/q35.h @@ -49,8 +49,10 @@ struct MCHPCIState { MemoryRegion smram, low_smram, high_smram; MemoryRegion tseg_blackhole, tseg_window; MemoryRegion smbase_blackhole, smbase_window; + MemoryRegion smm_test_ram; bool has_smram_at_smbase; bool has_smm_ranges; + bool enable_smm_test_ram; Range pci_hole; uint64_t below_4g_mem_size; uint64_t above_4g_mem_size; @@ -99,6 +101,12 @@ struct Q35PCIHost { #define MCH_HOST_BRIDGE_PCIEXBAR_SIZE 8 /* 64bit register */ #define MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT 0xb0000000 #define MCH_HOST_BRIDGE_PCIEXBAR_MAX (0x10000000) /* 256M */ +/* + * Optional qtest-only RAM window used to expose an address that exists on= ly + * in the SMM address space, so x86 secure attrs can be cross-checked. + */ +#define MCH_HOST_BRIDGE_SMM_TEST_RAM_BASE 0xfef00000 +#define MCH_HOST_BRIDGE_SMM_TEST_RAM_SIZE (64 * KiB) #define MCH_HOST_BRIDGE_PCIEXBAR_ADMSK Q35_MASK(64, 35, 28) #define MCH_HOST_BRIDGE_PCIEXBAR_128ADMSK ((uint64_t)(1 << 26)) #define MCH_HOST_BRIDGE_PCIEXBAR_64ADMSK ((uint64_t)(1 << 25)) diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build index 87aa104d23..fcdd95bf7f 100644 --- a/tests/qtest/meson.build +++ b/tests/qtest/meson.build @@ -116,6 +116,7 @@ qtests_i386 =3D \ 'cpu-plug-test', 'migration-test', 'qtest-attrs-test', + 'qtest-x86-attrs-test', ] =20 if dbus_display and config_all_devices.has_key('CONFIG_VGA') diff --git a/tests/qtest/qtest-x86-attrs-test.c b/tests/qtest/qtest-x86-att= rs-test.c new file mode 100644 index 0000000000..d9a67d5309 --- /dev/null +++ b/tests/qtest/qtest-x86-attrs-test.c @@ -0,0 +1,109 @@ +/* + * QTest for x86 memory access with transaction attributes + * + * Verify q35 SMM address-space access with the secure attribute. + * + * Copyright (c) 2026 Phytium Technology + * + * Author: + * Tao Tang + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "libqtest.h" + +#define TEST_ADDR_OFFSET_NS 0x1000ULL +#define TEST_X86_BASE 0x0ULL +#define TEST_X86_SMM_BASE 0xfef00000ULL + +#define TEST_ADDR_X86 (TEST_X86_BASE + TEST_ADDR_OFFSET_NS) + +#define X86_MACHINE_ARGS "-machine q35,smm=3Don -m 1G -accel tcg " \ + "-global mch.x-smm-test-ram=3Don" + +static void test_x86_scalar_attrs(void) +{ + QTestState *qts; + uint8_t val; + + if (!qtest_has_machine("q35")) { + g_test_skip("q35 machine not available"); + return; + } + + qts =3D qtest_init(X86_MACHINE_ARGS); + + qtest_writeb_attrs(qts, TEST_ADDR_X86, 0x11, NULL); + val =3D qtest_readb_attrs(qts, TEST_ADDR_X86, NULL); + g_assert_cmpuint(val, =3D=3D, 0x11); + + qtest_writeb_attrs(qts, TEST_ADDR_X86 + 0x1, 0x22, "secure"); + val =3D qtest_readb_attrs(qts, TEST_ADDR_X86 + 0x1, "secure"); + g_assert_cmpuint(val, =3D=3D, 0x22); + + + qtest_writeb_attrs(qts, TEST_X86_SMM_BASE + 0x2, 0x33, "secure"); + val =3D qtest_readb_attrs(qts, TEST_X86_SMM_BASE + 0x2, "secure"); + g_assert_cmpuint(val, =3D=3D, 0x33); + + qtest_quit(qts); +} + +static void test_x86_bulk_attrs(void) +{ + QTestState *qts; + uint8_t wbuf[8] =3D { 1, 2, 3, 4, 5, 6, 7, 8 }; + uint8_t rbuf[8]; + size_t i; + + if (!qtest_has_machine("q35")) { + g_test_skip("q35 machine not available"); + return; + } + + qts =3D qtest_init(X86_MACHINE_ARGS); + + qtest_memwrite_attrs(qts, TEST_ADDR_X86 + 0x100, wbuf, sizeof(wbuf), N= ULL); + qtest_memread_attrs(qts, TEST_ADDR_X86 + 0x100, rbuf, sizeof(rbuf), NU= LL); + g_assert(memcmp(wbuf, rbuf, sizeof(wbuf)) =3D=3D 0); + + qtest_memwrite_attrs(qts, TEST_ADDR_X86 + 0x180, + wbuf, sizeof(wbuf), "secure"); + qtest_memread_attrs(qts, TEST_ADDR_X86 + 0x180, + rbuf, sizeof(rbuf), "secure"); + g_assert(memcmp(wbuf, rbuf, sizeof(wbuf)) =3D=3D 0); + + qtest_memwrite_attrs(qts, TEST_X86_SMM_BASE + 0x100, + wbuf, sizeof(wbuf), "secure"); + qtest_memread_attrs(qts, TEST_X86_SMM_BASE + 0x100, + rbuf, sizeof(rbuf), "secure"); + g_assert(memcmp(wbuf, rbuf, sizeof(wbuf)) =3D=3D 0); + + qtest_memset_attrs(qts, TEST_X86_SMM_BASE + 0x120, + 0x5a, sizeof(rbuf), "secure"); + qtest_memread_attrs(qts, TEST_X86_SMM_BASE + 0x120, + rbuf, sizeof(rbuf), "secure"); + for (i =3D 0; i < sizeof(rbuf); i++) { + g_assert_cmpuint(rbuf[i], =3D=3D, 0x5a); + } + + qtest_bufwrite_attrs(qts, TEST_X86_SMM_BASE + 0x200, + wbuf, sizeof(wbuf), "secure"); + qtest_bufread_attrs(qts, TEST_X86_SMM_BASE + 0x200, + rbuf, sizeof(rbuf), "secure"); + g_assert(memcmp(wbuf, rbuf, sizeof(wbuf)) =3D=3D 0); + + qtest_quit(qts); +} + +int main(int argc, char **argv) +{ + g_test_init(&argc, &argv, NULL); + + qtest_add_func("/qtest/x86/attrs/scalar", test_x86_scalar_attrs); + qtest_add_func("/qtest/x86/attrs/bulk", test_x86_bulk_attrs); + + return g_test_run(); +} --=20 2.34.1