projects/linux·blob master · refs

285 lines · 8.5 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2#include "test_util.h"
3#include "kvm_util.h"
4#include "processor.h"
5#include "vmx.h"
6#include "svm_util.h"
7
8/*
9 * Arbitrary, never shoved into KVM/hardware, just need to avoid conflict with
10 * the "real" exceptions used, #SS/#GP/#DF (12/13/8).
11 */
12#define FAKE_TRIPLE_FAULT_VECTOR 0xaa
13
14/* Arbitrary 32-bit error code injected by this test. */
15#define SS_ERROR_CODE 0xdeadbeef
16
17/*
18 * Bit '0' is set on Intel if the exception occurs while delivering a previous
19 * event/exception. AMD's wording is ambiguous, but presumably the bit is set
20 * if the exception occurs while delivering an external event, e.g. NMI or INTR,
21 * but not for exceptions that occur when delivering other exceptions or
22 * software interrupts.
23 *
24 * Note, Intel's name for it, "External event", is misleading and much more
25 * aligned with AMD's behavior, but the SDM is quite clear on its behavior.
26 */
27#define ERROR_CODE_EXT_FLAG BIT(0)
28
29/*
30 * Bit '1' is set if the fault occurred when looking up a descriptor in the
31 * IDT, which is the case here as the IDT is empty/NULL.
32 */
33#define ERROR_CODE_IDT_FLAG BIT(1)
34
35/*
36 * The #GP that occurs when vectoring #SS should show the index into the IDT
37 * for #SS, plus have the "IDT flag" set.
38 */
39#define GP_ERROR_CODE_AMD ((SS_VECTOR * 8) | ERROR_CODE_IDT_FLAG)
40#define GP_ERROR_CODE_INTEL ((SS_VECTOR * 8) | ERROR_CODE_IDT_FLAG | ERROR_CODE_EXT_FLAG)
41
42/*
43 * Intel and AMD both shove '0' into the error code on #DF, regardless of what
44 * led to the double fault.
45 */
46#define DF_ERROR_CODE 0
47
48#define INTERCEPT_SS (BIT_ULL(SS_VECTOR))
49#define INTERCEPT_SS_DF (INTERCEPT_SS | BIT_ULL(DF_VECTOR))
50#define INTERCEPT_SS_GP_DF (INTERCEPT_SS_DF | BIT_ULL(GP_VECTOR))
51
52static void l2_ss_pending_test(void)
53{
54 GUEST_SYNC(SS_VECTOR);
55}
56
57static void l2_ss_injected_gp_test(void)
58{
59 GUEST_SYNC(GP_VECTOR);
60}
61
62static void l2_ss_injected_df_test(void)
63{
64 GUEST_SYNC(DF_VECTOR);
65}
66
67static void l2_ss_injected_tf_test(void)
68{
69 GUEST_SYNC(FAKE_TRIPLE_FAULT_VECTOR);
70}
71
72static void svm_run_l2(struct svm_test_data *svm, void *l2_code, int vector,
73 u32 error_code)
74{
75 struct vmcb *vmcb = svm->vmcb;
76 struct vmcb_control_area *ctrl = &vmcb->control;
77
78 vmcb->save.rip = (u64)l2_code;
79 run_guest(vmcb, svm->vmcb_gpa);
80
81 if (vector == FAKE_TRIPLE_FAULT_VECTOR)
82 return;
83
84 GUEST_ASSERT_EQ(ctrl->exit_code, (SVM_EXIT_EXCP_BASE + vector));
85 GUEST_ASSERT_EQ(ctrl->exit_info_1, error_code);
86 GUEST_ASSERT(!ctrl->int_state);
87}
88
89static void l1_svm_code(struct svm_test_data *svm)
90{
91 struct vmcb_control_area *ctrl = &svm->vmcb->control;
92
93 generic_svm_setup(svm, NULL);
94 svm->vmcb->save.idtr.limit = 0;
95 ctrl->intercept |= BIT_ULL(INTERCEPT_SHUTDOWN);
96
97 ctrl->intercept_exceptions = INTERCEPT_SS_GP_DF;
98 svm_run_l2(svm, l2_ss_pending_test, SS_VECTOR, SS_ERROR_CODE);
99 svm_run_l2(svm, l2_ss_injected_gp_test, GP_VECTOR, GP_ERROR_CODE_AMD);
100
101 ctrl->intercept_exceptions = INTERCEPT_SS_DF;
102 svm_run_l2(svm, l2_ss_injected_df_test, DF_VECTOR, DF_ERROR_CODE);
103
104 ctrl->intercept_exceptions = INTERCEPT_SS;
105 svm_run_l2(svm, l2_ss_injected_tf_test, FAKE_TRIPLE_FAULT_VECTOR, 0);
106 GUEST_ASSERT_EQ(ctrl->exit_code, SVM_EXIT_SHUTDOWN);
107
108 GUEST_DONE();
109}
110
111static void vmx_run_l2(void *l2_code, int vector, u32 error_code)
112{
113 GUEST_ASSERT(!vmwrite(GUEST_RIP, (u64)l2_code));
114
115 GUEST_ASSERT_EQ(vector == SS_VECTOR ? vmlaunch() : vmresume(), 0);
116
117 if (vector == FAKE_TRIPLE_FAULT_VECTOR)
118 return;
119
120 GUEST_ASSERT_EQ(vmreadz(VM_EXIT_REASON), EXIT_REASON_EXCEPTION_NMI);
121 GUEST_ASSERT_EQ((vmreadz(VM_EXIT_INTR_INFO) & 0xff), vector);
122 GUEST_ASSERT_EQ(vmreadz(VM_EXIT_INTR_ERROR_CODE), error_code);
123 GUEST_ASSERT(!vmreadz(GUEST_INTERRUPTIBILITY_INFO));
124}
125
126static void l1_vmx_code(struct vmx_pages *vmx)
127{
128 GUEST_ASSERT_EQ(prepare_for_vmx_operation(vmx), true);
129
130 GUEST_ASSERT_EQ(load_vmcs(vmx), true);
131
132 prepare_vmcs(vmx, NULL);
133 GUEST_ASSERT_EQ(vmwrite(GUEST_IDTR_LIMIT, 0), 0);
134
135 /*
136 * VMX disallows injecting an exception with error_code[31:16] != 0,
137 * and hardware will never generate a VM-Exit with bits 31:16 set.
138 * KVM should likewise truncate the "bad" userspace value.
139 */
140 GUEST_ASSERT_EQ(vmwrite(EXCEPTION_BITMAP, INTERCEPT_SS_GP_DF), 0);
141 vmx_run_l2(l2_ss_pending_test, SS_VECTOR, (u16)SS_ERROR_CODE);
142 vmx_run_l2(l2_ss_injected_gp_test, GP_VECTOR, GP_ERROR_CODE_INTEL);
143
144 GUEST_ASSERT_EQ(vmwrite(EXCEPTION_BITMAP, INTERCEPT_SS_DF), 0);
145 vmx_run_l2(l2_ss_injected_df_test, DF_VECTOR, DF_ERROR_CODE);
146
147 GUEST_ASSERT_EQ(vmwrite(EXCEPTION_BITMAP, INTERCEPT_SS), 0);
148 vmx_run_l2(l2_ss_injected_tf_test, FAKE_TRIPLE_FAULT_VECTOR, 0);
149 GUEST_ASSERT_EQ(vmreadz(VM_EXIT_REASON), EXIT_REASON_TRIPLE_FAULT);
150
151 GUEST_DONE();
152}
153
154static void __attribute__((__flatten__)) l1_guest_code(void *test_data)
155{
156 if (this_cpu_has(X86_FEATURE_SVM))
157 l1_svm_code(test_data);
158 else
159 l1_vmx_code(test_data);
160}
161
162static void assert_ucall_vector(struct kvm_vcpu *vcpu, int vector)
163{
164 struct ucall uc;
165
166 TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_IO);
167
168 switch (get_ucall(vcpu, &uc)) {
169 case UCALL_SYNC:
170 TEST_ASSERT(vector == uc.args[1],
171 "Expected L2 to ask for %d, got %ld", vector, uc.args[1]);
172 break;
173 case UCALL_DONE:
174 TEST_ASSERT(vector == -1,
175 "Expected L2 to ask for %d, L2 says it's done", vector);
176 break;
177 case UCALL_ABORT:
178 REPORT_GUEST_ASSERT(uc);
179 break;
180 default:
181 TEST_FAIL("Expected L2 to ask for %d, got unexpected ucall %lu", vector, uc.cmd);
182 }
183}
184
185static void queue_ss_exception(struct kvm_vcpu *vcpu, bool inject)
186{
187 struct kvm_vcpu_events events;
188
189 vcpu_events_get(vcpu, &events);
190
191 TEST_ASSERT(!events.exception.pending,
192 "Vector %d unexpectedlt pending", events.exception.nr);
193 TEST_ASSERT(!events.exception.injected,
194 "Vector %d unexpectedly injected", events.exception.nr);
195
196 events.flags = KVM_VCPUEVENT_VALID_PAYLOAD;
197 events.exception.pending = !inject;
198 events.exception.injected = inject;
199 events.exception.nr = SS_VECTOR;
200 events.exception.has_error_code = true;
201 events.exception.error_code = SS_ERROR_CODE;
202 vcpu_events_set(vcpu, &events);
203}
204
205/*
206 * Verify KVM_{G,S}ET_EVENTS play nice with pending vs. injected exceptions
207 * when an exception is being queued for L2. Specifically, verify that KVM
208 * honors L1 exception intercept controls when a #SS is pending/injected,
209 * triggers a #GP on vectoring the #SS, morphs to #DF if #GP isn't intercepted
210 * by L1, and finally causes (nested) SHUTDOWN if #DF isn't intercepted by L1.
211 */
212int main(int argc, char *argv[])
213{
214 gva_t nested_test_data_gva;
215 struct kvm_vcpu_events events;
216 struct kvm_vcpu *vcpu;
217 struct kvm_vm *vm;
218
219 TEST_REQUIRE(kvm_has_cap(KVM_CAP_EXCEPTION_PAYLOAD));
220 TEST_REQUIRE(kvm_cpu_has(X86_FEATURE_SVM) || kvm_cpu_has(X86_FEATURE_VMX));
221
222 vm = vm_create_with_one_vcpu(&vcpu, l1_guest_code);
223 vm_enable_cap(vm, KVM_CAP_EXCEPTION_PAYLOAD, -2ul);
224
225 if (kvm_cpu_has(X86_FEATURE_SVM))
226 vcpu_alloc_svm(vm, &nested_test_data_gva);
227 else
228 vcpu_alloc_vmx(vm, &nested_test_data_gva);
229
230 vcpu_args_set(vcpu, 1, nested_test_data_gva);
231
232 /* Run L1 => L2. L2 should sync and request #SS. */
233 vcpu_run(vcpu);
234 assert_ucall_vector(vcpu, SS_VECTOR);
235
236 /* Pend #SS and request immediate exit. #SS should still be pending. */
237 queue_ss_exception(vcpu, false);
238 vcpu->run->immediate_exit = true;
239 vcpu_run_complete_io(vcpu);
240
241 /* Verify the pending events comes back out the same as it went in. */
242 vcpu_events_get(vcpu, &events);
243 TEST_ASSERT_EQ(events.flags & KVM_VCPUEVENT_VALID_PAYLOAD,
244 KVM_VCPUEVENT_VALID_PAYLOAD);
245 TEST_ASSERT_EQ(events.exception.pending, true);
246 TEST_ASSERT_EQ(events.exception.nr, SS_VECTOR);
247 TEST_ASSERT_EQ(events.exception.has_error_code, true);
248 TEST_ASSERT_EQ(events.exception.error_code, SS_ERROR_CODE);
249
250 /*
251 * Run for real with the pending #SS, L1 should get a VM-Exit due to
252 * #SS interception and re-enter L2 to request #GP (via injected #SS).
253 */
254 vcpu->run->immediate_exit = false;
255 vcpu_run(vcpu);
256 assert_ucall_vector(vcpu, GP_VECTOR);
257
258 /*
259 * Inject #SS, the #SS should bypass interception and cause #GP, which
260 * L1 should intercept before KVM morphs it to #DF. L1 should then
261 * disable #GP interception and run L2 to request #DF (via #SS => #GP).
262 */
263 queue_ss_exception(vcpu, true);
264 vcpu_run(vcpu);
265 assert_ucall_vector(vcpu, DF_VECTOR);
266
267 /*
268 * Inject #SS, the #SS should bypass interception and cause #GP, which
269 * L1 is no longer interception, and so should see a #DF VM-Exit. L1
270 * should then signal that is done.
271 */
272 queue_ss_exception(vcpu, true);
273 vcpu_run(vcpu);
274 assert_ucall_vector(vcpu, FAKE_TRIPLE_FAULT_VECTOR);
275
276 /*
277 * Inject #SS yet again. L1 is not intercepting #GP or #DF, and so
278 * should see nested TRIPLE_FAULT / SHUTDOWN.
279 */
280 queue_ss_exception(vcpu, true);
281 vcpu_run(vcpu);
282 assert_ucall_vector(vcpu, -1);
283
284 kvm_vm_free(vm);
285}