1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * vmx_set_nested_state_test
4 *
5 * Copyright (C) 2019, Google LLC.
6 *
7 * This test verifies the integrity of calling the ioctl KVM_SET_NESTED_STATE.
8 */
9
10 #include "test_util.h"
11 #include "kvm_util.h"
12 #include "processor.h"
13 #include "vmx.h"
14
15 #include <errno.h>
16 #include <linux/kvm.h>
17 #include <string.h>
18 #include <sys/ioctl.h>
19 #include <unistd.h>
20
21 /*
22 * Mirror of VMCS12_REVISION in arch/x86/kvm/vmx/vmcs12.h. If that value
23 * changes this should be updated.
24 */
25 #define VMCS12_REVISION 0x11e57ed0
26 #define VCPU_ID 5
27
28 bool have_evmcs;
29
test_nested_state(struct kvm_vm * vm,struct kvm_nested_state * state)30 void test_nested_state(struct kvm_vm *vm, struct kvm_nested_state *state)
31 {
32 vcpu_nested_state_set(vm, VCPU_ID, state, false);
33 }
34
test_nested_state_expect_errno(struct kvm_vm * vm,struct kvm_nested_state * state,int expected_errno)35 void test_nested_state_expect_errno(struct kvm_vm *vm,
36 struct kvm_nested_state *state,
37 int expected_errno)
38 {
39 int rv;
40
41 rv = vcpu_nested_state_set(vm, VCPU_ID, state, true);
42 TEST_ASSERT(rv == -1 && errno == expected_errno,
43 "Expected %s (%d) from vcpu_nested_state_set but got rv: %i errno: %s (%d)",
44 strerror(expected_errno), expected_errno, rv, strerror(errno),
45 errno);
46 }
47
test_nested_state_expect_einval(struct kvm_vm * vm,struct kvm_nested_state * state)48 void test_nested_state_expect_einval(struct kvm_vm *vm,
49 struct kvm_nested_state *state)
50 {
51 test_nested_state_expect_errno(vm, state, EINVAL);
52 }
53
test_nested_state_expect_efault(struct kvm_vm * vm,struct kvm_nested_state * state)54 void test_nested_state_expect_efault(struct kvm_vm *vm,
55 struct kvm_nested_state *state)
56 {
57 test_nested_state_expect_errno(vm, state, EFAULT);
58 }
59
set_revision_id_for_vmcs12(struct kvm_nested_state * state,u32 vmcs12_revision)60 void set_revision_id_for_vmcs12(struct kvm_nested_state *state,
61 u32 vmcs12_revision)
62 {
63 /* Set revision_id in vmcs12 to vmcs12_revision. */
64 memcpy(&state->data, &vmcs12_revision, sizeof(u32));
65 }
66
set_default_state(struct kvm_nested_state * state)67 void set_default_state(struct kvm_nested_state *state)
68 {
69 memset(state, 0, sizeof(*state));
70 state->flags = KVM_STATE_NESTED_RUN_PENDING |
71 KVM_STATE_NESTED_GUEST_MODE;
72 state->format = 0;
73 state->size = sizeof(*state);
74 }
75
set_default_vmx_state(struct kvm_nested_state * state,int size)76 void set_default_vmx_state(struct kvm_nested_state *state, int size)
77 {
78 memset(state, 0, size);
79 state->flags = KVM_STATE_NESTED_GUEST_MODE |
80 KVM_STATE_NESTED_RUN_PENDING;
81 if (have_evmcs)
82 state->flags |= KVM_STATE_NESTED_EVMCS;
83 state->format = 0;
84 state->size = size;
85 state->hdr.vmx.vmxon_pa = 0x1000;
86 state->hdr.vmx.vmcs12_pa = 0x2000;
87 state->hdr.vmx.smm.flags = 0;
88 set_revision_id_for_vmcs12(state, VMCS12_REVISION);
89 }
90
test_vmx_nested_state(struct kvm_vm * vm)91 void test_vmx_nested_state(struct kvm_vm *vm)
92 {
93 /* Add a page for VMCS12. */
94 const int state_sz = sizeof(struct kvm_nested_state) + getpagesize();
95 struct kvm_nested_state *state =
96 (struct kvm_nested_state *)malloc(state_sz);
97
98 /* The format must be set to 0. 0 for VMX, 1 for SVM. */
99 set_default_vmx_state(state, state_sz);
100 state->format = 1;
101 test_nested_state_expect_einval(vm, state);
102
103 /*
104 * We cannot virtualize anything if the guest does not have VMX
105 * enabled.
106 */
107 set_default_vmx_state(state, state_sz);
108 test_nested_state_expect_einval(vm, state);
109
110 /*
111 * We cannot virtualize anything if the guest does not have VMX
112 * enabled. We expect KVM_SET_NESTED_STATE to return 0 if vmxon_pa
113 * is set to -1ull, but the flags must be zero.
114 */
115 set_default_vmx_state(state, state_sz);
116 state->hdr.vmx.vmxon_pa = -1ull;
117 test_nested_state_expect_einval(vm, state);
118
119 state->hdr.vmx.vmcs12_pa = -1ull;
120 state->flags = KVM_STATE_NESTED_EVMCS;
121 test_nested_state_expect_einval(vm, state);
122
123 state->flags = 0;
124 test_nested_state(vm, state);
125
126 /* Enable VMX in the guest CPUID. */
127 vcpu_set_cpuid(vm, VCPU_ID, kvm_get_supported_cpuid());
128
129 /*
130 * Setting vmxon_pa == -1ull and vmcs_pa == -1ull exits early without
131 * setting the nested state but flags other than eVMCS must be clear.
132 * The eVMCS flag can be set if the enlightened VMCS capability has
133 * been enabled.
134 */
135 set_default_vmx_state(state, state_sz);
136 state->hdr.vmx.vmxon_pa = -1ull;
137 state->hdr.vmx.vmcs12_pa = -1ull;
138 test_nested_state_expect_einval(vm, state);
139
140 state->flags &= KVM_STATE_NESTED_EVMCS;
141 if (have_evmcs) {
142 test_nested_state_expect_einval(vm, state);
143 vcpu_enable_evmcs(vm, VCPU_ID);
144 }
145 test_nested_state(vm, state);
146
147 /* It is invalid to have vmxon_pa == -1ull and SMM flags non-zero. */
148 state->hdr.vmx.smm.flags = 1;
149 test_nested_state_expect_einval(vm, state);
150
151 /* It is invalid to have vmxon_pa == -1ull and vmcs_pa != -1ull. */
152 set_default_vmx_state(state, state_sz);
153 state->hdr.vmx.vmxon_pa = -1ull;
154 state->flags = 0;
155 test_nested_state_expect_einval(vm, state);
156
157 /* It is invalid to have vmxon_pa set to a non-page aligned address. */
158 set_default_vmx_state(state, state_sz);
159 state->hdr.vmx.vmxon_pa = 1;
160 test_nested_state_expect_einval(vm, state);
161
162 /*
163 * It is invalid to have KVM_STATE_NESTED_SMM_GUEST_MODE and
164 * KVM_STATE_NESTED_GUEST_MODE set together.
165 */
166 set_default_vmx_state(state, state_sz);
167 state->flags = KVM_STATE_NESTED_GUEST_MODE |
168 KVM_STATE_NESTED_RUN_PENDING;
169 state->hdr.vmx.smm.flags = KVM_STATE_NESTED_SMM_GUEST_MODE;
170 test_nested_state_expect_einval(vm, state);
171
172 /*
173 * It is invalid to have any of the SMM flags set besides:
174 * KVM_STATE_NESTED_SMM_GUEST_MODE
175 * KVM_STATE_NESTED_SMM_VMXON
176 */
177 set_default_vmx_state(state, state_sz);
178 state->hdr.vmx.smm.flags = ~(KVM_STATE_NESTED_SMM_GUEST_MODE |
179 KVM_STATE_NESTED_SMM_VMXON);
180 test_nested_state_expect_einval(vm, state);
181
182 /* Outside SMM, SMM flags must be zero. */
183 set_default_vmx_state(state, state_sz);
184 state->flags = 0;
185 state->hdr.vmx.smm.flags = KVM_STATE_NESTED_SMM_GUEST_MODE;
186 test_nested_state_expect_einval(vm, state);
187
188 /* Size must be large enough to fit kvm_nested_state and vmcs12. */
189 set_default_vmx_state(state, state_sz);
190 state->size = sizeof(*state);
191 test_nested_state(vm, state);
192
193 /* vmxon_pa cannot be the same address as vmcs_pa. */
194 set_default_vmx_state(state, state_sz);
195 state->hdr.vmx.vmxon_pa = 0;
196 state->hdr.vmx.vmcs12_pa = 0;
197 test_nested_state_expect_einval(vm, state);
198
199 /* The revision id for vmcs12 must be VMCS12_REVISION. */
200 set_default_vmx_state(state, state_sz);
201 set_revision_id_for_vmcs12(state, 0);
202 test_nested_state_expect_einval(vm, state);
203
204 /*
205 * Test that if we leave nesting the state reflects that when we get
206 * it again.
207 */
208 set_default_vmx_state(state, state_sz);
209 state->hdr.vmx.vmxon_pa = -1ull;
210 state->hdr.vmx.vmcs12_pa = -1ull;
211 state->flags = 0;
212 test_nested_state(vm, state);
213 vcpu_nested_state_get(vm, VCPU_ID, state);
214 TEST_ASSERT(state->size >= sizeof(*state) && state->size <= state_sz,
215 "Size must be between %d and %d. The size returned was %d.",
216 sizeof(*state), state_sz, state->size);
217 TEST_ASSERT(state->hdr.vmx.vmxon_pa == -1ull, "vmxon_pa must be -1ull.");
218 TEST_ASSERT(state->hdr.vmx.vmcs12_pa == -1ull, "vmcs_pa must be -1ull.");
219
220 free(state);
221 }
222
main(int argc,char * argv[])223 int main(int argc, char *argv[])
224 {
225 struct kvm_vm *vm;
226 struct kvm_nested_state state;
227
228 have_evmcs = kvm_check_cap(KVM_CAP_HYPERV_ENLIGHTENED_VMCS);
229
230 if (!kvm_check_cap(KVM_CAP_NESTED_STATE)) {
231 printf("KVM_CAP_NESTED_STATE not available, skipping test\n");
232 exit(KSFT_SKIP);
233 }
234
235 /*
236 * AMD currently does not implement set_nested_state, so for now we
237 * just early out.
238 */
239 nested_vmx_check_supported();
240
241 vm = vm_create_default(VCPU_ID, 0, 0);
242
243 /* Passing a NULL kvm_nested_state causes a EFAULT. */
244 test_nested_state_expect_efault(vm, NULL);
245
246 /* 'size' cannot be smaller than sizeof(kvm_nested_state). */
247 set_default_state(&state);
248 state.size = 0;
249 test_nested_state_expect_einval(vm, &state);
250
251 /*
252 * Setting the flags 0xf fails the flags check. The only flags that
253 * can be used are:
254 * KVM_STATE_NESTED_GUEST_MODE
255 * KVM_STATE_NESTED_RUN_PENDING
256 * KVM_STATE_NESTED_EVMCS
257 */
258 set_default_state(&state);
259 state.flags = 0xf;
260 test_nested_state_expect_einval(vm, &state);
261
262 /*
263 * If KVM_STATE_NESTED_RUN_PENDING is set then
264 * KVM_STATE_NESTED_GUEST_MODE has to be set as well.
265 */
266 set_default_state(&state);
267 state.flags = KVM_STATE_NESTED_RUN_PENDING;
268 test_nested_state_expect_einval(vm, &state);
269
270 test_vmx_nested_state(vm);
271
272 kvm_vm_free(vm);
273 return 0;
274 }
275