1 // SPDX-License-Identifier: GPL-2.0-only 2 #include "test_util.h" 3 #include "kvm_util.h" 4 #include "processor.h" 5 #include "smm.h" 6 #include "vmx.h" 7 8 #include <string.h> 9 #include <sys/ioctl.h> 10 11 #include "kselftest.h" 12 13 #define ARBITRARY_IO_PORT 0x80 14 15 /* 16 * The 64-bit SMRAM state-save area starts at SMBASE + 0xfe00. TR starts at 17 * offset 0xfe90, and attributes is the second 16-bit field in the descriptor. 18 */ 19 #define SMRAM64_TR_ATTRIBUTES_OFFSET 0xfe92 20 #define SMRAM_GPA 0x1000000 21 22 /* 23 * SMI handler that runs in 16-bit Real Mode. Syncs with L0 via port I/O, then 24 * executes RSM to trigger the consumption of invalid guest state. 25 */ 26 static u8 smi_handler[] = { 27 0xe4, ARBITRARY_IO_PORT, /* IN $ARBITRARY_IO_PORT, %al */ 28 0x0f, 0xaa, /* RSM */ 29 }; 30 31 static void l2_guest_code(void) 32 { 33 /* 34 * Generate an exit to L0 userspace, i.e. main(), via I/O to an 35 * arbitrary port. 36 */ 37 asm volatile("inb $" __stringify(ARBITRARY_IO_PORT) ", %%al" 38 ::: "rax"); 39 GUEST_FAIL("L2 resumed after stuffing invalid guest state"); 40 } 41 42 static void l1_guest_code(struct vmx_pages *vmx_pages) 43 { 44 GUEST_ASSERT(prepare_for_vmx_operation(vmx_pages)); 45 GUEST_ASSERT(load_vmcs(vmx_pages)); 46 47 /* Prepare the VMCS for L2 execution. */ 48 prepare_vmcs(vmx_pages, l2_guest_code); 49 50 /* 51 * L2 must be run without unrestricted guest, verify that the selftests 52 * library hasn't enabled it. Because KVM selftests jump directly to 53 * 64-bit mode, unrestricted guest support isn't required. 54 */ 55 GUEST_ASSERT(!(vmreadz(CPU_BASED_VM_EXEC_CONTROL) & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS) || 56 !(vmreadz(SECONDARY_VM_EXEC_CONTROL) & SECONDARY_EXEC_UNRESTRICTED_GUEST)); 57 58 GUEST_ASSERT(!vmlaunch()); 59 60 /* L2 should triple fault after main() stuffs invalid guest state. */ 61 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_TRIPLE_FAULT); 62 GUEST_DONE(); 63 } 64 65 static void vcpu_run_to_io(struct kvm_vcpu *vcpu, bool want_l2) 66 { 67 struct kvm_run *run = vcpu->run; 68 69 vcpu_run(vcpu); 70 71 TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_IO); 72 73 TEST_ASSERT(run->io.port == ARBITRARY_IO_PORT && 74 (!!(run->flags & KVM_RUN_X86_GUEST_MODE) == want_l2 || 75 !kvm_has_cap(KVM_CAP_X86_GUEST_MODE)), 76 "Expected IN from port 0x%x from L%u, got port 0x%x from L%u", 77 ARBITRARY_IO_PORT, 1 + want_l2, run->io.port, 78 1 + !!(run->flags & KVM_RUN_X86_GUEST_MODE)); 79 } 80 81 static struct kvm_vm *vm_create_and_run_l2(struct kvm_vcpu **vcpu) 82 { 83 gva_t vmx_pages_gva; 84 struct kvm_vm *vm; 85 86 vm = vm_create_with_one_vcpu(vcpu, l1_guest_code); 87 88 /* Allocate VMX pages and shared descriptors (vmx_pages). */ 89 vcpu_alloc_vmx(vm, &vmx_pages_gva); 90 vcpu_args_set(*vcpu, 1, vmx_pages_gva); 91 92 /* 93 * The first exit to L0 userspace should be an I/O access from L2. 94 * Running L1 should launch L2 without triggering an exit to userspace. 95 */ 96 vcpu_run_to_io(*vcpu, true); 97 98 return vm; 99 } 100 101 static void test_invalid_l2_guest_state(void) 102 { 103 struct kvm_sregs sregs; 104 struct kvm_vcpu *vcpu; 105 struct kvm_vm *vm; 106 struct ucall uc; 107 108 vm = vm_create_and_run_l2(&vcpu); 109 110 /* 111 * Stuff invalid guest state for L2 by making TR unusable. The next 112 * KVM_RUN should induce a TRIPLE_FAULT in L2 as KVM doesn't support 113 * emulating invalid guest state for L2. 114 */ 115 memset(&sregs, 0, sizeof(sregs)); 116 vcpu_sregs_get(vcpu, &sregs); 117 sregs.tr.unusable = 1; 118 vcpu_sregs_set(vcpu, &sregs); 119 120 vcpu_run(vcpu); 121 122 switch (get_ucall(vcpu, &uc)) { 123 case UCALL_DONE: 124 break; 125 case UCALL_ABORT: 126 REPORT_GUEST_ASSERT(uc); 127 default: 128 TEST_FAIL("Unexpected ucall: %lu", uc.cmd); 129 } 130 131 kvm_vm_free(vm); 132 } 133 134 static void test_invalid_l2_guest_state_rsm(void) 135 { 136 struct kvm_vcpu *vcpu; 137 struct kvm_vm *vm; 138 u16 *tr_attrs; 139 140 if (!kvm_has_cap(KVM_CAP_X86_SMM)) 141 return; 142 143 vm = vm_create_and_run_l2(&vcpu); 144 145 /* 146 * Inject SMI while L2 is active, run the vCPU to get I/O exit from L1, 147 * then stuff TR in the SMRAM state-save area so that RSM restores 148 * invalid L2 state. 149 */ 150 setup_smram(vm, vcpu, SMRAM_GPA, smi_handler, sizeof(smi_handler)); 151 inject_smi(vcpu); 152 153 vcpu_run_to_io(vcpu, false); 154 155 /* Clear the present bit in SMRAM to make TR unusable. */ 156 tr_attrs = addr_gpa2hva(vm, SMRAM_GPA + SMRAM64_TR_ATTRIBUTES_OFFSET); 157 *tr_attrs &= ~BIT(7); 158 159 vcpu_run(vcpu); 160 161 /* 162 * For RSM, L1 gets the SHUTDOWN because RSM is architecturally defined 163 * to result in shutdown if the CPU detects invalid state in SMRAM. 164 */ 165 TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_SHUTDOWN); 166 kvm_vm_free(vm); 167 } 168 169 int main(int argc, char *argv[]) 170 { 171 TEST_REQUIRE(kvm_cpu_has(X86_FEATURE_VMX)); 172 173 test_invalid_l2_guest_state(); 174 test_invalid_l2_guest_state_rsm(); 175 } 176