1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright (C) 2018, Red Hat, Inc.
4 *
5 * Tests for Enlightened VMCS, including nested guest state.
6 */
7 #define _GNU_SOURCE /* for program_invocation_short_name */
8 #include <fcntl.h>
9 #include <stdio.h>
10 #include <stdlib.h>
11 #include <string.h>
12 #include <sys/ioctl.h>
13 #include <linux/bitmap.h>
14
15 #include "test_util.h"
16
17 #include "kvm_util.h"
18
19 #include "vmx.h"
20
21 static int ud_count;
22
guest_ud_handler(struct ex_regs * regs)23 static void guest_ud_handler(struct ex_regs *regs)
24 {
25 ud_count++;
26 regs->rip += 3; /* VMLAUNCH */
27 }
28
guest_nmi_handler(struct ex_regs * regs)29 static void guest_nmi_handler(struct ex_regs *regs)
30 {
31 }
32
33 /* Exits to L1 destroy GRPs! */
rdmsr_fs_base(void)34 static inline void rdmsr_fs_base(void)
35 {
36 __asm__ __volatile__ ("mov $0xc0000100, %%rcx; rdmsr" : : :
37 "rax", "rbx", "rcx", "rdx",
38 "rsi", "rdi", "r8", "r9", "r10", "r11", "r12",
39 "r13", "r14", "r15");
40 }
rdmsr_gs_base(void)41 static inline void rdmsr_gs_base(void)
42 {
43 __asm__ __volatile__ ("mov $0xc0000101, %%rcx; rdmsr" : : :
44 "rax", "rbx", "rcx", "rdx",
45 "rsi", "rdi", "r8", "r9", "r10", "r11", "r12",
46 "r13", "r14", "r15");
47 }
48
l2_guest_code(void)49 void l2_guest_code(void)
50 {
51 GUEST_SYNC(7);
52
53 GUEST_SYNC(8);
54
55 /* Forced exit to L1 upon restore */
56 GUEST_SYNC(9);
57
58 vmcall();
59
60 /* MSR-Bitmap tests */
61 rdmsr_fs_base(); /* intercepted */
62 rdmsr_fs_base(); /* intercepted */
63 rdmsr_gs_base(); /* not intercepted */
64 vmcall();
65 rdmsr_gs_base(); /* intercepted */
66
67 /* Done, exit to L1 and never come back. */
68 vmcall();
69 }
70
guest_code(struct vmx_pages * vmx_pages)71 void guest_code(struct vmx_pages *vmx_pages)
72 {
73 #define L2_GUEST_STACK_SIZE 64
74 unsigned long l2_guest_stack[L2_GUEST_STACK_SIZE];
75
76 x2apic_enable();
77
78 GUEST_SYNC(1);
79 GUEST_SYNC(2);
80
81 enable_vp_assist(vmx_pages->vp_assist_gpa, vmx_pages->vp_assist);
82
83 GUEST_ASSERT(vmx_pages->vmcs_gpa);
84 GUEST_ASSERT(prepare_for_vmx_operation(vmx_pages));
85 GUEST_SYNC(3);
86 GUEST_ASSERT(load_vmcs(vmx_pages));
87 GUEST_ASSERT(vmptrstz() == vmx_pages->enlightened_vmcs_gpa);
88
89 GUEST_SYNC(4);
90 GUEST_ASSERT(vmptrstz() == vmx_pages->enlightened_vmcs_gpa);
91
92 prepare_vmcs(vmx_pages, l2_guest_code,
93 &l2_guest_stack[L2_GUEST_STACK_SIZE]);
94
95 GUEST_SYNC(5);
96 GUEST_ASSERT(vmptrstz() == vmx_pages->enlightened_vmcs_gpa);
97 current_evmcs->revision_id = -1u;
98 GUEST_ASSERT(vmlaunch());
99 current_evmcs->revision_id = EVMCS_VERSION;
100 GUEST_SYNC(6);
101
102 vmwrite(PIN_BASED_VM_EXEC_CONTROL, vmreadz(PIN_BASED_VM_EXEC_CONTROL) |
103 PIN_BASED_NMI_EXITING);
104
105 GUEST_ASSERT(!vmlaunch());
106 GUEST_ASSERT(vmptrstz() == vmx_pages->enlightened_vmcs_gpa);
107
108 /*
109 * NMI forces L2->L1 exit, resuming L2 and hope that EVMCS is
110 * up-to-date (RIP points where it should and not at the beginning
111 * of l2_guest_code(). GUEST_SYNC(9) checkes that.
112 */
113 GUEST_ASSERT(!vmresume());
114
115 GUEST_SYNC(10);
116
117 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_VMCALL);
118 current_evmcs->guest_rip += 3; /* vmcall */
119
120 /* Intercept RDMSR 0xc0000100 */
121 vmwrite(CPU_BASED_VM_EXEC_CONTROL, vmreadz(CPU_BASED_VM_EXEC_CONTROL) |
122 CPU_BASED_USE_MSR_BITMAPS);
123 set_bit(MSR_FS_BASE & 0x1fff, vmx_pages->msr + 0x400);
124 GUEST_ASSERT(!vmresume());
125 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_MSR_READ);
126 current_evmcs->guest_rip += 2; /* rdmsr */
127
128 /* Enable enlightened MSR bitmap */
129 current_evmcs->hv_enlightenments_control.msr_bitmap = 1;
130 GUEST_ASSERT(!vmresume());
131 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_MSR_READ);
132 current_evmcs->guest_rip += 2; /* rdmsr */
133
134 /* Intercept RDMSR 0xc0000101 without telling KVM about it */
135 set_bit(MSR_GS_BASE & 0x1fff, vmx_pages->msr + 0x400);
136 /* Make sure HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP is set */
137 current_evmcs->hv_clean_fields |= HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP;
138 GUEST_ASSERT(!vmresume());
139 /* Make sure we don't see EXIT_REASON_MSR_READ here so eMSR bitmap works */
140 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_VMCALL);
141 current_evmcs->guest_rip += 3; /* vmcall */
142
143 /* Now tell KVM we've changed MSR-Bitmap */
144 current_evmcs->hv_clean_fields &= ~HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP;
145 GUEST_ASSERT(!vmresume());
146 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_MSR_READ);
147 current_evmcs->guest_rip += 2; /* rdmsr */
148
149 GUEST_ASSERT(!vmresume());
150 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_VMCALL);
151 GUEST_SYNC(11);
152
153 /* Try enlightened vmptrld with an incorrect GPA */
154 evmcs_vmptrld(0xdeadbeef, vmx_pages->enlightened_vmcs);
155 GUEST_ASSERT(vmlaunch());
156 GUEST_ASSERT(ud_count == 1);
157 GUEST_DONE();
158 }
159
inject_nmi(struct kvm_vcpu * vcpu)160 void inject_nmi(struct kvm_vcpu *vcpu)
161 {
162 struct kvm_vcpu_events events;
163
164 vcpu_events_get(vcpu, &events);
165
166 events.nmi.pending = 1;
167 events.flags |= KVM_VCPUEVENT_VALID_NMI_PENDING;
168
169 vcpu_events_set(vcpu, &events);
170 }
171
save_restore_vm(struct kvm_vm * vm,struct kvm_vcpu * vcpu)172 static struct kvm_vcpu *save_restore_vm(struct kvm_vm *vm,
173 struct kvm_vcpu *vcpu)
174 {
175 struct kvm_regs regs1, regs2;
176 struct kvm_x86_state *state;
177
178 state = vcpu_save_state(vcpu);
179 memset(®s1, 0, sizeof(regs1));
180 vcpu_regs_get(vcpu, ®s1);
181
182 kvm_vm_release(vm);
183
184 /* Restore state in a new VM. */
185 vcpu = vm_recreate_with_one_vcpu(vm);
186 vcpu_set_hv_cpuid(vcpu);
187 vcpu_enable_evmcs(vcpu);
188 vcpu_load_state(vcpu, state);
189 kvm_x86_state_cleanup(state);
190
191 memset(®s2, 0, sizeof(regs2));
192 vcpu_regs_get(vcpu, ®s2);
193 TEST_ASSERT(!memcmp(®s1, ®s2, sizeof(regs2)),
194 "Unexpected register values after vcpu_load_state; rdi: %lx rsi: %lx",
195 (ulong) regs2.rdi, (ulong) regs2.rsi);
196 return vcpu;
197 }
198
main(int argc,char * argv[])199 int main(int argc, char *argv[])
200 {
201 vm_vaddr_t vmx_pages_gva = 0;
202
203 struct kvm_vcpu *vcpu;
204 struct kvm_vm *vm;
205 struct kvm_run *run;
206 struct ucall uc;
207 int stage;
208
209 vm = vm_create_with_one_vcpu(&vcpu, guest_code);
210
211 TEST_REQUIRE(kvm_cpu_has(X86_FEATURE_VMX));
212 TEST_REQUIRE(kvm_has_cap(KVM_CAP_NESTED_STATE));
213 TEST_REQUIRE(kvm_has_cap(KVM_CAP_HYPERV_ENLIGHTENED_VMCS));
214
215 vcpu_set_hv_cpuid(vcpu);
216 vcpu_enable_evmcs(vcpu);
217
218 vcpu_alloc_vmx(vm, &vmx_pages_gva);
219 vcpu_args_set(vcpu, 1, vmx_pages_gva);
220
221 vm_init_descriptor_tables(vm);
222 vcpu_init_descriptor_tables(vcpu);
223 vm_install_exception_handler(vm, UD_VECTOR, guest_ud_handler);
224 vm_install_exception_handler(vm, NMI_VECTOR, guest_nmi_handler);
225
226 pr_info("Running L1 which uses EVMCS to run L2\n");
227
228 for (stage = 1;; stage++) {
229 run = vcpu->run;
230
231 vcpu_run(vcpu);
232 TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
233 "Stage %d: unexpected exit reason: %u (%s),\n",
234 stage, run->exit_reason,
235 exit_reason_str(run->exit_reason));
236
237 switch (get_ucall(vcpu, &uc)) {
238 case UCALL_ABORT:
239 REPORT_GUEST_ASSERT(uc);
240 /* NOT REACHED */
241 case UCALL_SYNC:
242 break;
243 case UCALL_DONE:
244 goto done;
245 default:
246 TEST_FAIL("Unknown ucall %lu", uc.cmd);
247 }
248
249 /* UCALL_SYNC is handled here. */
250 TEST_ASSERT(!strcmp((const char *)uc.args[0], "hello") &&
251 uc.args[1] == stage, "Stage %d: Unexpected register values vmexit, got %lx",
252 stage, (ulong)uc.args[1]);
253
254 vcpu = save_restore_vm(vm, vcpu);
255
256 /* Force immediate L2->L1 exit before resuming */
257 if (stage == 8) {
258 pr_info("Injecting NMI into L1 before L2 had a chance to run after restore\n");
259 inject_nmi(vcpu);
260 }
261
262 /*
263 * Do KVM_GET_NESTED_STATE/KVM_SET_NESTED_STATE for a freshly
264 * restored VM (before the first KVM_RUN) to check that
265 * KVM_STATE_NESTED_EVMCS is not lost.
266 */
267 if (stage == 9) {
268 pr_info("Trying extra KVM_GET_NESTED_STATE/KVM_SET_NESTED_STATE cycle\n");
269 vcpu = save_restore_vm(vm, vcpu);
270 }
271 }
272
273 done:
274 kvm_vm_free(vm);
275 }
276