* [PATCH] KVM: selftests: test behavior of unmapped L2 APIC-access address
@ 2020-10-26 18:09 Jim Mattson
2020-10-31 14:04 ` Paolo Bonzini
0 siblings, 1 reply; 2+ messages in thread
From: Jim Mattson @ 2020-10-26 18:09 UTC (permalink / raw)
To: kvm, Paolo Bonzini; +Cc: Jim Mattson, Ricardo Koller, Peter Shier
Add a regression test for commit 671ddc700fd0 ("KVM: nVMX: Don't leak
L1 MMIO regions to L2").
First, check to see that an L2 guest can be launched with a valid
APIC-access address that is backed by a page of L1 physical memory.
Next, set the APIC-access address to a (valid) L1 physical address
that is not backed by memory. KVM can't handle this situation, so
resuming L2 should result in a KVM exit for internal error
(emulation).
Signed-off-by: Jim Mattson <jmattson@google.com>
Reviewed-by: Ricardo Koller <ricarkol@google.com>
Reviewed-by: Peter Shier <pshier@google.com>
---
tools/testing/selftests/kvm/.gitignore | 1 +
tools/testing/selftests/kvm/Makefile | 1 +
.../selftests/kvm/include/x86_64/vmx.h | 6 +
tools/testing/selftests/kvm/lib/x86_64/vmx.c | 9 ++
.../kvm/x86_64/vmx_apic_access_test.c | 142 ++++++++++++++++++
5 files changed, 159 insertions(+)
create mode 100644 tools/testing/selftests/kvm/x86_64/vmx_apic_access_test.c
diff --git a/tools/testing/selftests/kvm/.gitignore b/tools/testing/selftests/kvm/.gitignore
index 307ceaadbbb9..d2c2d6205008 100644
--- a/tools/testing/selftests/kvm/.gitignore
+++ b/tools/testing/selftests/kvm/.gitignore
@@ -15,6 +15,7 @@
/x86_64/vmx_preemption_timer_test
/x86_64/svm_vmcall_test
/x86_64/sync_regs_test
+/x86_64/vmx_apic_access_test
/x86_64/vmx_close_while_nested_test
/x86_64/vmx_dirty_log_test
/x86_64/vmx_set_nested_state_test
diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
index 7ebe71fbca53..30afbad36cd5 100644
--- a/tools/testing/selftests/kvm/Makefile
+++ b/tools/testing/selftests/kvm/Makefile
@@ -49,6 +49,7 @@ TEST_GEN_PROGS_x86_64 += x86_64/state_test
TEST_GEN_PROGS_x86_64 += x86_64/vmx_preemption_timer_test
TEST_GEN_PROGS_x86_64 += x86_64/svm_vmcall_test
TEST_GEN_PROGS_x86_64 += x86_64/sync_regs_test
+TEST_GEN_PROGS_x86_64 += x86_64/vmx_apic_access_test
TEST_GEN_PROGS_x86_64 += x86_64/vmx_close_while_nested_test
TEST_GEN_PROGS_x86_64 += x86_64/vmx_dirty_log_test
TEST_GEN_PROGS_x86_64 += x86_64/vmx_set_nested_state_test
diff --git a/tools/testing/selftests/kvm/include/x86_64/vmx.h b/tools/testing/selftests/kvm/include/x86_64/vmx.h
index 54d624dd6c10..e78d7e26ba61 100644
--- a/tools/testing/selftests/kvm/include/x86_64/vmx.h
+++ b/tools/testing/selftests/kvm/include/x86_64/vmx.h
@@ -573,6 +573,10 @@ struct vmx_pages {
void *eptp_hva;
uint64_t eptp_gpa;
void *eptp;
+
+ void *apic_access_hva;
+ uint64_t apic_access_gpa;
+ void *apic_access;
};
union vmx_basic {
@@ -615,5 +619,7 @@ void nested_map_memslot(struct vmx_pages *vmx, struct kvm_vm *vm,
uint32_t memslot, uint32_t eptp_memslot);
void prepare_eptp(struct vmx_pages *vmx, struct kvm_vm *vm,
uint32_t eptp_memslot);
+void prepare_virtualize_apic_accesses(struct vmx_pages *vmx, struct kvm_vm *vm,
+ uint32_t eptp_memslot);
#endif /* SELFTEST_KVM_VMX_H */
diff --git a/tools/testing/selftests/kvm/lib/x86_64/vmx.c b/tools/testing/selftests/kvm/lib/x86_64/vmx.c
index f1e00d43eea2..2448b30e8efa 100644
--- a/tools/testing/selftests/kvm/lib/x86_64/vmx.c
+++ b/tools/testing/selftests/kvm/lib/x86_64/vmx.c
@@ -542,3 +542,12 @@ void prepare_eptp(struct vmx_pages *vmx, struct kvm_vm *vm,
vmx->eptp_hva = addr_gva2hva(vm, (uintptr_t)vmx->eptp);
vmx->eptp_gpa = addr_gva2gpa(vm, (uintptr_t)vmx->eptp);
}
+
+void prepare_virtualize_apic_accesses(struct vmx_pages *vmx, struct kvm_vm *vm,
+ uint32_t eptp_memslot)
+{
+ vmx->apic_access = (void *)vm_vaddr_alloc(vm, getpagesize(),
+ 0x10000, 0, 0);
+ vmx->apic_access_hva = addr_gva2hva(vm, (uintptr_t)vmx->apic_access);
+ vmx->apic_access_gpa = addr_gva2gpa(vm, (uintptr_t)vmx->apic_access);
+}
diff --git a/tools/testing/selftests/kvm/x86_64/vmx_apic_access_test.c b/tools/testing/selftests/kvm/x86_64/vmx_apic_access_test.c
new file mode 100644
index 000000000000..1f65342d6cb7
--- /dev/null
+++ b/tools/testing/selftests/kvm/x86_64/vmx_apic_access_test.c
@@ -0,0 +1,142 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * vmx_apic_access_test
+ *
+ * Copyright (C) 2020, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ *
+ * The first subtest simply checks to see that an L2 guest can be
+ * launched with a valid APIC-access address that is backed by a
+ * page of L1 physical memory.
+ *
+ * The second subtest sets the APIC-access address to a (valid) L1
+ * physical address that is not backed by memory. KVM can't handle
+ * this situation, so resuming L2 should result in a KVM exit for
+ * internal error (emulation). This is not an architectural
+ * requirement. It is just a shortcoming of KVM. The internal error
+ * is unfortunate, but it's better than what used to happen!
+ */
+
+#include "test_util.h"
+#include "kvm_util.h"
+#include "processor.h"
+#include "vmx.h"
+
+#include <string.h>
+#include <sys/ioctl.h>
+
+#include "kselftest.h"
+
+#define VCPU_ID 0
+
+/* The virtual machine object. */
+static struct kvm_vm *vm;
+
+static void l2_guest_code(void)
+{
+ /* Exit to L1 */
+ __asm__ __volatile__("vmcall");
+}
+
+static void l1_guest_code(struct vmx_pages *vmx_pages, unsigned long high_gpa)
+{
+#define L2_GUEST_STACK_SIZE 64
+ unsigned long l2_guest_stack[L2_GUEST_STACK_SIZE];
+ uint32_t control;
+
+ GUEST_ASSERT(prepare_for_vmx_operation(vmx_pages));
+ GUEST_ASSERT(load_vmcs(vmx_pages));
+
+ /* Prepare the VMCS for L2 execution. */
+ prepare_vmcs(vmx_pages, l2_guest_code,
+ &l2_guest_stack[L2_GUEST_STACK_SIZE]);
+ control = vmreadz(CPU_BASED_VM_EXEC_CONTROL);
+ control |= CPU_BASED_ACTIVATE_SECONDARY_CONTROLS;
+ vmwrite(CPU_BASED_VM_EXEC_CONTROL, control);
+ control = vmreadz(SECONDARY_VM_EXEC_CONTROL);
+ control |= SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+ vmwrite(SECONDARY_VM_EXEC_CONTROL, control);
+ vmwrite(APIC_ACCESS_ADDR, vmx_pages->apic_access_gpa);
+
+ /* Try to launch L2 with the memory-backed APIC-access address. */
+ GUEST_SYNC(vmreadz(APIC_ACCESS_ADDR));
+ GUEST_ASSERT(!vmlaunch());
+ GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_VMCALL);
+
+ vmwrite(APIC_ACCESS_ADDR, high_gpa);
+
+ /* Try to resume L2 with the unbacked APIC-access address. */
+ GUEST_SYNC(vmreadz(APIC_ACCESS_ADDR));
+ GUEST_ASSERT(!vmresume());
+ GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_VMCALL);
+
+ GUEST_DONE();
+}
+
+int main(int argc, char *argv[])
+{
+ unsigned long apic_access_addr = ~0ul;
+ unsigned int paddr_width;
+ unsigned int vaddr_width;
+ vm_vaddr_t vmx_pages_gva;
+ unsigned long high_gpa;
+ struct vmx_pages *vmx;
+ bool done = false;
+
+ nested_vmx_check_supported();
+
+ vm = vm_create_default(VCPU_ID, 0, (void *) l1_guest_code);
+ vcpu_set_cpuid(vm, VCPU_ID, kvm_get_supported_cpuid());
+
+ kvm_get_cpu_address_width(&paddr_width, &vaddr_width);
+ high_gpa = (1ul << paddr_width) - getpagesize();
+ if ((unsigned long)DEFAULT_GUEST_PHY_PAGES * getpagesize() > high_gpa) {
+ print_skip("No unbacked physical page available");
+ exit(KSFT_SKIP);
+ }
+
+ vmx = vcpu_alloc_vmx(vm, &vmx_pages_gva);
+ prepare_virtualize_apic_accesses(vmx, vm, 0);
+ vcpu_args_set(vm, VCPU_ID, 2, vmx_pages_gva, high_gpa);
+
+ while (!done) {
+ volatile struct kvm_run *run = vcpu_state(vm, VCPU_ID);
+ struct ucall uc;
+
+ vcpu_run(vm, VCPU_ID);
+ if (apic_access_addr == high_gpa) {
+ TEST_ASSERT(run->exit_reason ==
+ KVM_EXIT_INTERNAL_ERROR,
+ "Got exit reason other than KVM_EXIT_INTERNAL_ERROR: %u (%s)\n",
+ run->exit_reason,
+ exit_reason_str(run->exit_reason));
+ TEST_ASSERT(run->internal.suberror ==
+ KVM_INTERNAL_ERROR_EMULATION,
+ "Got internal suberror other than KVM_INTERNAL_ERROR_EMULATION: %u\n",
+ run->internal.suberror);
+ break;
+ }
+ TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
+ "Got exit_reason other than KVM_EXIT_IO: %u (%s)\n",
+ run->exit_reason,
+ exit_reason_str(run->exit_reason));
+
+ switch (get_ucall(vm, VCPU_ID, &uc)) {
+ case UCALL_ABORT:
+ TEST_FAIL("%s at %s:%ld", (const char *)uc.args[0],
+ __FILE__, uc.args[1]);
+ /* NOT REACHED */
+ case UCALL_SYNC:
+ apic_access_addr = uc.args[1];
+ break;
+ case UCALL_DONE:
+ done = true;
+ break;
+ default:
+ TEST_ASSERT(false, "Unknown ucall %lu", uc.cmd);
+ }
+ }
+ kvm_vm_free(vm);
+ return 0;
+}
--
2.29.0.rc1.297.gfa9743e501-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] KVM: selftests: test behavior of unmapped L2 APIC-access address
2020-10-26 18:09 [PATCH] KVM: selftests: test behavior of unmapped L2 APIC-access address Jim Mattson
@ 2020-10-31 14:04 ` Paolo Bonzini
0 siblings, 0 replies; 2+ messages in thread
From: Paolo Bonzini @ 2020-10-31 14:04 UTC (permalink / raw)
To: Jim Mattson, kvm; +Cc: Ricardo Koller, Peter Shier
On 26/10/20 19:09, Jim Mattson wrote:
> Add a regression test for commit 671ddc700fd0 ("KVM: nVMX: Don't leak
> L1 MMIO regions to L2").
>
> First, check to see that an L2 guest can be launched with a valid
> APIC-access address that is backed by a page of L1 physical memory.
>
> Next, set the APIC-access address to a (valid) L1 physical address
> that is not backed by memory. KVM can't handle this situation, so
> resuming L2 should result in a KVM exit for internal error
> (emulation).
>
> Signed-off-by: Jim Mattson <jmattson@google.com>
> Reviewed-by: Ricardo Koller <ricarkol@google.com>
> Reviewed-by: Peter Shier <pshier@google.com>
> ---
> tools/testing/selftests/kvm/.gitignore | 1 +
> tools/testing/selftests/kvm/Makefile | 1 +
> .../selftests/kvm/include/x86_64/vmx.h | 6 +
> tools/testing/selftests/kvm/lib/x86_64/vmx.c | 9 ++
> .../kvm/x86_64/vmx_apic_access_test.c | 142 ++++++++++++++++++
> 5 files changed, 159 insertions(+)
> create mode 100644 tools/testing/selftests/kvm/x86_64/vmx_apic_access_test.c
>
> diff --git a/tools/testing/selftests/kvm/.gitignore b/tools/testing/selftests/kvm/.gitignore
> index 307ceaadbbb9..d2c2d6205008 100644
> --- a/tools/testing/selftests/kvm/.gitignore
> +++ b/tools/testing/selftests/kvm/.gitignore
> @@ -15,6 +15,7 @@
> /x86_64/vmx_preemption_timer_test
> /x86_64/svm_vmcall_test
> /x86_64/sync_regs_test
> +/x86_64/vmx_apic_access_test
> /x86_64/vmx_close_while_nested_test
> /x86_64/vmx_dirty_log_test
> /x86_64/vmx_set_nested_state_test
> diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
> index 7ebe71fbca53..30afbad36cd5 100644
> --- a/tools/testing/selftests/kvm/Makefile
> +++ b/tools/testing/selftests/kvm/Makefile
> @@ -49,6 +49,7 @@ TEST_GEN_PROGS_x86_64 += x86_64/state_test
> TEST_GEN_PROGS_x86_64 += x86_64/vmx_preemption_timer_test
> TEST_GEN_PROGS_x86_64 += x86_64/svm_vmcall_test
> TEST_GEN_PROGS_x86_64 += x86_64/sync_regs_test
> +TEST_GEN_PROGS_x86_64 += x86_64/vmx_apic_access_test
> TEST_GEN_PROGS_x86_64 += x86_64/vmx_close_while_nested_test
> TEST_GEN_PROGS_x86_64 += x86_64/vmx_dirty_log_test
> TEST_GEN_PROGS_x86_64 += x86_64/vmx_set_nested_state_test
> diff --git a/tools/testing/selftests/kvm/include/x86_64/vmx.h b/tools/testing/selftests/kvm/include/x86_64/vmx.h
> index 54d624dd6c10..e78d7e26ba61 100644
> --- a/tools/testing/selftests/kvm/include/x86_64/vmx.h
> +++ b/tools/testing/selftests/kvm/include/x86_64/vmx.h
> @@ -573,6 +573,10 @@ struct vmx_pages {
> void *eptp_hva;
> uint64_t eptp_gpa;
> void *eptp;
> +
> + void *apic_access_hva;
> + uint64_t apic_access_gpa;
> + void *apic_access;
> };
>
> union vmx_basic {
> @@ -615,5 +619,7 @@ void nested_map_memslot(struct vmx_pages *vmx, struct kvm_vm *vm,
> uint32_t memslot, uint32_t eptp_memslot);
> void prepare_eptp(struct vmx_pages *vmx, struct kvm_vm *vm,
> uint32_t eptp_memslot);
> +void prepare_virtualize_apic_accesses(struct vmx_pages *vmx, struct kvm_vm *vm,
> + uint32_t eptp_memslot);
>
> #endif /* SELFTEST_KVM_VMX_H */
> diff --git a/tools/testing/selftests/kvm/lib/x86_64/vmx.c b/tools/testing/selftests/kvm/lib/x86_64/vmx.c
> index f1e00d43eea2..2448b30e8efa 100644
> --- a/tools/testing/selftests/kvm/lib/x86_64/vmx.c
> +++ b/tools/testing/selftests/kvm/lib/x86_64/vmx.c
> @@ -542,3 +542,12 @@ void prepare_eptp(struct vmx_pages *vmx, struct kvm_vm *vm,
> vmx->eptp_hva = addr_gva2hva(vm, (uintptr_t)vmx->eptp);
> vmx->eptp_gpa = addr_gva2gpa(vm, (uintptr_t)vmx->eptp);
> }
> +
> +void prepare_virtualize_apic_accesses(struct vmx_pages *vmx, struct kvm_vm *vm,
> + uint32_t eptp_memslot)
> +{
> + vmx->apic_access = (void *)vm_vaddr_alloc(vm, getpagesize(),
> + 0x10000, 0, 0);
> + vmx->apic_access_hva = addr_gva2hva(vm, (uintptr_t)vmx->apic_access);
> + vmx->apic_access_gpa = addr_gva2gpa(vm, (uintptr_t)vmx->apic_access);
> +}
> diff --git a/tools/testing/selftests/kvm/x86_64/vmx_apic_access_test.c b/tools/testing/selftests/kvm/x86_64/vmx_apic_access_test.c
> new file mode 100644
> index 000000000000..1f65342d6cb7
> --- /dev/null
> +++ b/tools/testing/selftests/kvm/x86_64/vmx_apic_access_test.c
> @@ -0,0 +1,142 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * vmx_apic_access_test
> + *
> + * Copyright (C) 2020, Google LLC.
> + *
> + * This work is licensed under the terms of the GNU GPL, version 2.
> + *
> + * The first subtest simply checks to see that an L2 guest can be
> + * launched with a valid APIC-access address that is backed by a
> + * page of L1 physical memory.
> + *
> + * The second subtest sets the APIC-access address to a (valid) L1
> + * physical address that is not backed by memory. KVM can't handle
> + * this situation, so resuming L2 should result in a KVM exit for
> + * internal error (emulation). This is not an architectural
> + * requirement. It is just a shortcoming of KVM. The internal error
> + * is unfortunate, but it's better than what used to happen!
> + */
> +
> +#include "test_util.h"
> +#include "kvm_util.h"
> +#include "processor.h"
> +#include "vmx.h"
> +
> +#include <string.h>
> +#include <sys/ioctl.h>
> +
> +#include "kselftest.h"
> +
> +#define VCPU_ID 0
> +
> +/* The virtual machine object. */
> +static struct kvm_vm *vm;
> +
> +static void l2_guest_code(void)
> +{
> + /* Exit to L1 */
> + __asm__ __volatile__("vmcall");
> +}
> +
> +static void l1_guest_code(struct vmx_pages *vmx_pages, unsigned long high_gpa)
> +{
> +#define L2_GUEST_STACK_SIZE 64
> + unsigned long l2_guest_stack[L2_GUEST_STACK_SIZE];
> + uint32_t control;
> +
> + GUEST_ASSERT(prepare_for_vmx_operation(vmx_pages));
> + GUEST_ASSERT(load_vmcs(vmx_pages));
> +
> + /* Prepare the VMCS for L2 execution. */
> + prepare_vmcs(vmx_pages, l2_guest_code,
> + &l2_guest_stack[L2_GUEST_STACK_SIZE]);
> + control = vmreadz(CPU_BASED_VM_EXEC_CONTROL);
> + control |= CPU_BASED_ACTIVATE_SECONDARY_CONTROLS;
> + vmwrite(CPU_BASED_VM_EXEC_CONTROL, control);
> + control = vmreadz(SECONDARY_VM_EXEC_CONTROL);
> + control |= SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
> + vmwrite(SECONDARY_VM_EXEC_CONTROL, control);
> + vmwrite(APIC_ACCESS_ADDR, vmx_pages->apic_access_gpa);
> +
> + /* Try to launch L2 with the memory-backed APIC-access address. */
> + GUEST_SYNC(vmreadz(APIC_ACCESS_ADDR));
> + GUEST_ASSERT(!vmlaunch());
> + GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_VMCALL);
> +
> + vmwrite(APIC_ACCESS_ADDR, high_gpa);
> +
> + /* Try to resume L2 with the unbacked APIC-access address. */
> + GUEST_SYNC(vmreadz(APIC_ACCESS_ADDR));
> + GUEST_ASSERT(!vmresume());
> + GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_VMCALL);
> +
> + GUEST_DONE();
> +}
> +
> +int main(int argc, char *argv[])
> +{
> + unsigned long apic_access_addr = ~0ul;
> + unsigned int paddr_width;
> + unsigned int vaddr_width;
> + vm_vaddr_t vmx_pages_gva;
> + unsigned long high_gpa;
> + struct vmx_pages *vmx;
> + bool done = false;
> +
> + nested_vmx_check_supported();
> +
> + vm = vm_create_default(VCPU_ID, 0, (void *) l1_guest_code);
> + vcpu_set_cpuid(vm, VCPU_ID, kvm_get_supported_cpuid());
> +
> + kvm_get_cpu_address_width(&paddr_width, &vaddr_width);
> + high_gpa = (1ul << paddr_width) - getpagesize();
> + if ((unsigned long)DEFAULT_GUEST_PHY_PAGES * getpagesize() > high_gpa) {
> + print_skip("No unbacked physical page available");
> + exit(KSFT_SKIP);
> + }
> +
> + vmx = vcpu_alloc_vmx(vm, &vmx_pages_gva);
> + prepare_virtualize_apic_accesses(vmx, vm, 0);
> + vcpu_args_set(vm, VCPU_ID, 2, vmx_pages_gva, high_gpa);
> +
> + while (!done) {
> + volatile struct kvm_run *run = vcpu_state(vm, VCPU_ID);
> + struct ucall uc;
> +
> + vcpu_run(vm, VCPU_ID);
> + if (apic_access_addr == high_gpa) {
> + TEST_ASSERT(run->exit_reason ==
> + KVM_EXIT_INTERNAL_ERROR,
> + "Got exit reason other than KVM_EXIT_INTERNAL_ERROR: %u (%s)\n",
> + run->exit_reason,
> + exit_reason_str(run->exit_reason));
> + TEST_ASSERT(run->internal.suberror ==
> + KVM_INTERNAL_ERROR_EMULATION,
> + "Got internal suberror other than KVM_INTERNAL_ERROR_EMULATION: %u\n",
> + run->internal.suberror);
> + break;
> + }
> + TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
> + "Got exit_reason other than KVM_EXIT_IO: %u (%s)\n",
> + run->exit_reason,
> + exit_reason_str(run->exit_reason));
> +
> + switch (get_ucall(vm, VCPU_ID, &uc)) {
> + case UCALL_ABORT:
> + TEST_FAIL("%s at %s:%ld", (const char *)uc.args[0],
> + __FILE__, uc.args[1]);
> + /* NOT REACHED */
> + case UCALL_SYNC:
> + apic_access_addr = uc.args[1];
> + break;
> + case UCALL_DONE:
> + done = true;
> + break;
> + default:
> + TEST_ASSERT(false, "Unknown ucall %lu", uc.cmd);
> + }
> + }
> + kvm_vm_free(vm);
> + return 0;
> +}
>
Queued, thanks.
Paolo
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-10-31 14:04 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-26 18:09 [PATCH] KVM: selftests: test behavior of unmapped L2 APIC-access address Jim Mattson
2020-10-31 14:04 ` Paolo Bonzini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).