1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) 2018, Red Hat, Inc. 4 * 5 * Tests for Enlightened VMCS, including nested guest state. 6 */ 7 #include <fcntl.h> 8 #include <stdio.h> 9 #include <stdlib.h> 10 #include <string.h> 11 #include <sys/ioctl.h> 12 #include <linux/bitmap.h> 13 14 #include "test_util.h" 15 16 #include "kvm_util.h" 17 18 #include "hyperv.h" 19 #include "vmx.h" 20 21 static int ud_count; 22 23 static void guest_ud_handler(struct ex_regs *regs) 24 { 25 ud_count++; 26 regs->rip += 3; /* VMLAUNCH */ 27 } 28 29 static void guest_nmi_handler(struct ex_regs *regs) 30 { 31 } 32 33 static inline void rdmsr_from_l2(u32 msr) 34 { 35 /* Currently, L1 doesn't preserve GPRs during vmexits. */ 36 __asm__ __volatile__ ("rdmsr" : : "c"(msr) : 37 "rax", "rbx", "rdx", "rsi", "rdi", "r8", "r9", 38 "r10", "r11", "r12", "r13", "r14", "r15"); 39 } 40 41 /* Exit to L1 from L2 with RDMSR instruction */ 42 void l2_guest_code(void) 43 { 44 u64 unused; 45 46 GUEST_SYNC(7); 47 48 GUEST_SYNC(8); 49 50 /* Forced exit to L1 upon restore */ 51 GUEST_SYNC(9); 52 53 vmcall(); 54 55 /* MSR-Bitmap tests */ 56 rdmsr_from_l2(MSR_FS_BASE); /* intercepted */ 57 rdmsr_from_l2(MSR_FS_BASE); /* intercepted */ 58 rdmsr_from_l2(MSR_GS_BASE); /* not intercepted */ 59 vmcall(); 60 rdmsr_from_l2(MSR_GS_BASE); /* intercepted */ 61 62 /* L2 TLB flush tests */ 63 hyperv_hypercall(HVCALL_FLUSH_VIRTUAL_ADDRESS_SPACE | HV_HYPERCALL_FAST_BIT, 0x0, 64 HV_FLUSH_ALL_VIRTUAL_ADDRESS_SPACES | HV_FLUSH_ALL_PROCESSORS); 65 rdmsr_from_l2(MSR_FS_BASE); 66 /* 67 * Note: hypercall status (RAX) is not preserved correctly by L1 after 68 * synthetic vmexit, use unchecked version. 69 */ 70 __hyperv_hypercall(HVCALL_FLUSH_VIRTUAL_ADDRESS_SPACE | HV_HYPERCALL_FAST_BIT, 0x0, 71 HV_FLUSH_ALL_VIRTUAL_ADDRESS_SPACES | HV_FLUSH_ALL_PROCESSORS, 72 &unused); 73 74 /* Done, exit to L1 and never come back. */ 75 vmcall(); 76 } 77 78 void guest_code(struct vmx_pages *vmx_pages, struct hyperv_test_pages *hv_pages, 79 gpa_t hv_hcall_page_gpa) 80 { 81 wrmsr(HV_X64_MSR_GUEST_OS_ID, HYPERV_LINUX_OS_ID); 82 wrmsr(HV_X64_MSR_HYPERCALL, hv_hcall_page_gpa); 83 84 x2apic_enable(); 85 86 GUEST_SYNC(1); 87 GUEST_SYNC(2); 88 89 enable_vp_assist(hv_pages->vp_assist_gpa, hv_pages->vp_assist); 90 evmcs_enable(); 91 92 GUEST_ASSERT(prepare_for_vmx_operation(vmx_pages)); 93 GUEST_SYNC(3); 94 GUEST_ASSERT(load_evmcs(hv_pages)); 95 GUEST_ASSERT(vmptrstz() == hv_pages->enlightened_vmcs_gpa); 96 97 GUEST_SYNC(4); 98 GUEST_ASSERT(vmptrstz() == hv_pages->enlightened_vmcs_gpa); 99 100 prepare_vmcs(vmx_pages, l2_guest_code); 101 102 GUEST_SYNC(5); 103 GUEST_ASSERT(vmptrstz() == hv_pages->enlightened_vmcs_gpa); 104 current_evmcs->revision_id = -1u; 105 GUEST_ASSERT(vmlaunch()); 106 current_evmcs->revision_id = EVMCS_VERSION; 107 GUEST_SYNC(6); 108 109 vmwrite(PIN_BASED_VM_EXEC_CONTROL, vmreadz(PIN_BASED_VM_EXEC_CONTROL) | 110 PIN_BASED_NMI_EXITING); 111 112 /* L2 TLB flush setup */ 113 current_evmcs->partition_assist_page = hv_pages->partition_assist_gpa; 114 current_evmcs->hv_enlightenments_control.nested_flush_hypercall = 1; 115 current_evmcs->hv_vm_id = 1; 116 current_evmcs->hv_vp_id = 1; 117 current_vp_assist->nested_control.features.directhypercall = 1; 118 *(u32 *)(hv_pages->partition_assist) = 0; 119 120 GUEST_ASSERT(!vmlaunch()); 121 GUEST_ASSERT_EQ(vmreadz(VM_EXIT_REASON), EXIT_REASON_EXCEPTION_NMI); 122 GUEST_ASSERT_EQ((vmreadz(VM_EXIT_INTR_INFO) & 0xff), NMI_VECTOR); 123 GUEST_ASSERT(vmptrstz() == hv_pages->enlightened_vmcs_gpa); 124 125 /* 126 * NMI forces L2->L1 exit, resuming L2 and hope that EVMCS is 127 * up-to-date (RIP points where it should and not at the beginning 128 * of l2_guest_code(). GUEST_SYNC(9) checks that. 129 */ 130 GUEST_ASSERT(!vmresume()); 131 132 GUEST_SYNC(10); 133 134 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_VMCALL); 135 current_evmcs->guest_rip += 3; /* vmcall */ 136 137 /* Intercept RDMSR 0xc0000100 */ 138 vmwrite(CPU_BASED_VM_EXEC_CONTROL, vmreadz(CPU_BASED_VM_EXEC_CONTROL) | 139 CPU_BASED_USE_MSR_BITMAPS); 140 __set_bit(MSR_FS_BASE & 0x1fff, vmx_pages->msr + 0x400); 141 GUEST_ASSERT(!vmresume()); 142 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_MSR_READ); 143 current_evmcs->guest_rip += 2; /* rdmsr */ 144 145 /* Enable enlightened MSR bitmap */ 146 current_evmcs->hv_enlightenments_control.msr_bitmap = 1; 147 GUEST_ASSERT(!vmresume()); 148 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_MSR_READ); 149 current_evmcs->guest_rip += 2; /* rdmsr */ 150 151 /* Intercept RDMSR 0xc0000101 without telling KVM about it */ 152 __set_bit(MSR_GS_BASE & 0x1fff, vmx_pages->msr + 0x400); 153 /* Make sure HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP is set */ 154 current_evmcs->hv_clean_fields |= HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP; 155 GUEST_ASSERT(!vmresume()); 156 /* Make sure we don't see EXIT_REASON_MSR_READ here so eMSR bitmap works */ 157 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_VMCALL); 158 current_evmcs->guest_rip += 3; /* vmcall */ 159 160 /* Now tell KVM we've changed MSR-Bitmap */ 161 current_evmcs->hv_clean_fields &= ~HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP; 162 GUEST_ASSERT(!vmresume()); 163 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_MSR_READ); 164 current_evmcs->guest_rip += 2; /* rdmsr */ 165 166 /* 167 * L2 TLB flush test. First VMCALL should be handled directly by L0, 168 * no VMCALL exit expected. 169 */ 170 GUEST_ASSERT(!vmresume()); 171 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_MSR_READ); 172 current_evmcs->guest_rip += 2; /* rdmsr */ 173 /* Enable synthetic vmexit */ 174 *(u32 *)(hv_pages->partition_assist) = 1; 175 GUEST_ASSERT(!vmresume()); 176 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == HV_VMX_SYNTHETIC_EXIT_REASON_TRAP_AFTER_FLUSH); 177 178 GUEST_ASSERT(!vmresume()); 179 GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_VMCALL); 180 GUEST_SYNC(11); 181 182 /* Try enlightened vmptrld with an incorrect GPA */ 183 evmcs_vmptrld(0xdeadbeef, hv_pages->enlightened_vmcs); 184 GUEST_ASSERT(vmlaunch()); 185 GUEST_ASSERT(ud_count == 1); 186 GUEST_DONE(); 187 } 188 189 void inject_nmi(struct kvm_vcpu *vcpu) 190 { 191 struct kvm_vcpu_events events; 192 193 vcpu_events_get(vcpu, &events); 194 195 events.nmi.pending = 1; 196 events.flags |= KVM_VCPUEVENT_VALID_NMI_PENDING; 197 198 vcpu_events_set(vcpu, &events); 199 } 200 201 static struct kvm_vcpu *save_restore_vm(struct kvm_vm *vm, 202 struct kvm_vcpu *vcpu) 203 { 204 struct kvm_regs regs1, regs2; 205 struct kvm_x86_state *state; 206 207 state = vcpu_save_state(vcpu); 208 memset(®s1, 0, sizeof(regs1)); 209 vcpu_regs_get(vcpu, ®s1); 210 211 kvm_vm_release(vm); 212 213 /* Restore state in a new VM. */ 214 vcpu = vm_recreate_with_one_vcpu(vm); 215 vcpu_set_hv_cpuid(vcpu); 216 vcpu_enable_evmcs(vcpu); 217 vcpu_load_state(vcpu, state); 218 kvm_x86_state_cleanup(state); 219 220 memset(®s2, 0, sizeof(regs2)); 221 vcpu_regs_get(vcpu, ®s2); 222 TEST_ASSERT(!memcmp(®s1, ®s2, sizeof(regs2)), 223 "Unexpected register values after vcpu_load_state; rdi: %lx rsi: %lx", 224 (ulong) regs2.rdi, (ulong) regs2.rsi); 225 return vcpu; 226 } 227 228 int main(int argc, char *argv[]) 229 { 230 gva_t vmx_pages_gva = 0, hv_pages_gva = 0; 231 gva_t hcall_page; 232 233 struct kvm_vcpu *vcpu; 234 struct kvm_vm *vm; 235 struct ucall uc; 236 int stage; 237 238 TEST_REQUIRE(kvm_cpu_has(X86_FEATURE_VMX)); 239 TEST_REQUIRE(kvm_has_cap(KVM_CAP_NESTED_STATE)); 240 TEST_REQUIRE(kvm_has_cap(KVM_CAP_HYPERV_ENLIGHTENED_VMCS)); 241 TEST_REQUIRE(kvm_hv_cpu_has(HV_X64_NESTED_DIRECT_FLUSH)); 242 243 vm = vm_create_with_one_vcpu(&vcpu, guest_code); 244 245 hcall_page = vm_alloc_pages(vm, 1); 246 memset(addr_gva2hva(vm, hcall_page), 0x0, getpagesize()); 247 248 vcpu_set_hv_cpuid(vcpu); 249 vcpu_enable_evmcs(vcpu); 250 251 vcpu_alloc_vmx(vm, &vmx_pages_gva); 252 vcpu_alloc_hyperv_test_pages(vm, &hv_pages_gva); 253 vcpu_args_set(vcpu, 3, vmx_pages_gva, hv_pages_gva, addr_gva2gpa(vm, hcall_page)); 254 vcpu_set_msr(vcpu, HV_X64_MSR_VP_INDEX, vcpu->id); 255 256 vm_install_exception_handler(vm, UD_VECTOR, guest_ud_handler); 257 vm_install_exception_handler(vm, NMI_VECTOR, guest_nmi_handler); 258 259 pr_info("Running L1 which uses EVMCS to run L2\n"); 260 261 for (stage = 1;; stage++) { 262 vcpu_run(vcpu); 263 TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_IO); 264 265 switch (get_ucall(vcpu, &uc)) { 266 case UCALL_ABORT: 267 REPORT_GUEST_ASSERT(uc); 268 /* NOT REACHED */ 269 case UCALL_SYNC: 270 break; 271 case UCALL_DONE: 272 goto done; 273 default: 274 TEST_FAIL("Unknown ucall %lu", uc.cmd); 275 } 276 277 /* UCALL_SYNC is handled here. */ 278 TEST_ASSERT(!strcmp((const char *)uc.args[0], "hello") && 279 uc.args[1] == stage, "Stage %d: Unexpected register values vmexit, got %lx", 280 stage, (ulong)uc.args[1]); 281 282 vcpu = save_restore_vm(vm, vcpu); 283 284 /* Force immediate L2->L1 exit before resuming */ 285 if (stage == 8) { 286 pr_info("Injecting NMI into L1 before L2 had a chance to run after restore\n"); 287 inject_nmi(vcpu); 288 } 289 290 /* 291 * Do KVM_GET_NESTED_STATE/KVM_SET_NESTED_STATE for a freshly 292 * restored VM (before the first KVM_RUN) to check that 293 * KVM_STATE_NESTED_EVMCS is not lost. 294 */ 295 if (stage == 9) { 296 pr_info("Trying extra KVM_GET_NESTED_STATE/KVM_SET_NESTED_STATE cycle\n"); 297 vcpu = save_restore_vm(vm, vcpu); 298 } 299 } 300 301 done: 302 kvm_vm_free(vm); 303 } 304