1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * svm_vmcall_test 4 * 5 * Copyright © 2021 Amazon.com, Inc. or its affiliates. 6 * 7 * Xen shared_info / pvclock testing 8 */ 9 10 #include "test_util.h" 11 #include "kvm_util.h" 12 #include "processor.h" 13 14 #include <stdint.h> 15 #include <time.h> 16 #include <sched.h> 17 #include <signal.h> 18 #include <pthread.h> 19 20 #include <sys/eventfd.h> 21 22 /* Defined in include/linux/kvm_types.h */ 23 #define GPA_INVALID (~(ulong)0) 24 25 #define SHINFO_REGION_GVA 0xc0000000ULL 26 #define SHINFO_REGION_GPA 0xc0000000ULL 27 #define SHINFO_REGION_SLOT 10 28 29 #define DUMMY_REGION_GPA (SHINFO_REGION_GPA + (3 * PAGE_SIZE)) 30 #define DUMMY_REGION_SLOT 11 31 32 #define SHINFO_ADDR (SHINFO_REGION_GPA) 33 #define VCPU_INFO_ADDR (SHINFO_REGION_GPA + 0x40) 34 #define PVTIME_ADDR (SHINFO_REGION_GPA + PAGE_SIZE) 35 #define RUNSTATE_ADDR (SHINFO_REGION_GPA + PAGE_SIZE + PAGE_SIZE - 15) 36 37 #define SHINFO_VADDR (SHINFO_REGION_GVA) 38 #define VCPU_INFO_VADDR (SHINFO_REGION_GVA + 0x40) 39 #define RUNSTATE_VADDR (SHINFO_REGION_GVA + PAGE_SIZE + PAGE_SIZE - 15) 40 41 #define EVTCHN_VECTOR 0x10 42 43 #define EVTCHN_TEST1 15 44 #define EVTCHN_TEST2 66 45 #define EVTCHN_TIMER 13 46 47 #define XEN_HYPERCALL_MSR 0x40000000 48 49 #define MIN_STEAL_TIME 50000 50 51 #define SHINFO_RACE_TIMEOUT 2 /* seconds */ 52 53 #define __HYPERVISOR_set_timer_op 15 54 #define __HYPERVISOR_sched_op 29 55 #define __HYPERVISOR_event_channel_op 32 56 57 #define SCHEDOP_poll 3 58 59 #define EVTCHNOP_send 4 60 61 #define EVTCHNSTAT_interdomain 2 62 63 struct evtchn_send { 64 u32 port; 65 }; 66 67 struct sched_poll { 68 u32 *ports; 69 unsigned int nr_ports; 70 u64 timeout; 71 }; 72 73 struct pvclock_vcpu_time_info { 74 u32 version; 75 u32 pad0; 76 u64 tsc_timestamp; 77 u64 system_time; 78 u32 tsc_to_system_mul; 79 s8 tsc_shift; 80 u8 flags; 81 u8 pad[2]; 82 } __attribute__((__packed__)); /* 32 bytes */ 83 84 struct pvclock_wall_clock { 85 u32 version; 86 u32 sec; 87 u32 nsec; 88 } __attribute__((__packed__)); 89 90 struct vcpu_runstate_info { 91 uint32_t state; 92 uint64_t state_entry_time; 93 uint64_t time[5]; /* Extra field for overrun check */ 94 }; 95 96 struct compat_vcpu_runstate_info { 97 uint32_t state; 98 uint64_t state_entry_time; 99 uint64_t time[5]; 100 } __attribute__((__packed__));; 101 102 struct arch_vcpu_info { 103 unsigned long cr2; 104 unsigned long pad; /* sizeof(vcpu_info_t) == 64 */ 105 }; 106 107 struct vcpu_info { 108 uint8_t evtchn_upcall_pending; 109 uint8_t evtchn_upcall_mask; 110 unsigned long evtchn_pending_sel; 111 struct arch_vcpu_info arch; 112 struct pvclock_vcpu_time_info time; 113 }; /* 64 bytes (x86) */ 114 115 struct shared_info { 116 struct vcpu_info vcpu_info[32]; 117 unsigned long evtchn_pending[64]; 118 unsigned long evtchn_mask[64]; 119 struct pvclock_wall_clock wc; 120 uint32_t wc_sec_hi; 121 /* arch_shared_info here */ 122 }; 123 124 #define RUNSTATE_running 0 125 #define RUNSTATE_runnable 1 126 #define RUNSTATE_blocked 2 127 #define RUNSTATE_offline 3 128 129 static const char *runstate_names[] = { 130 "running", 131 "runnable", 132 "blocked", 133 "offline" 134 }; 135 136 struct { 137 struct kvm_irq_routing info; 138 struct kvm_irq_routing_entry entries[2]; 139 } irq_routes; 140 141 static volatile bool guest_saw_irq; 142 143 static void evtchn_handler(struct ex_regs *regs) 144 { 145 struct vcpu_info *vi = (void *)VCPU_INFO_VADDR; 146 vi->evtchn_upcall_pending = 0; 147 vi->evtchn_pending_sel = 0; 148 guest_saw_irq = true; 149 150 GUEST_SYNC(0x20); 151 } 152 153 static void guest_wait_for_irq(void) 154 { 155 while (!guest_saw_irq) 156 __asm__ __volatile__ ("rep nop" : : : "memory"); 157 guest_saw_irq = false; 158 } 159 160 static void guest_code(void) 161 { 162 struct vcpu_runstate_info *rs = (void *)RUNSTATE_VADDR; 163 int i; 164 165 __asm__ __volatile__( 166 "sti\n" 167 "nop\n" 168 ); 169 170 /* Trigger an interrupt injection */ 171 GUEST_SYNC(0); 172 173 guest_wait_for_irq(); 174 175 /* Test having the host set runstates manually */ 176 GUEST_SYNC(RUNSTATE_runnable); 177 GUEST_ASSERT(rs->time[RUNSTATE_runnable] != 0); 178 GUEST_ASSERT(rs->state == 0); 179 180 GUEST_SYNC(RUNSTATE_blocked); 181 GUEST_ASSERT(rs->time[RUNSTATE_blocked] != 0); 182 GUEST_ASSERT(rs->state == 0); 183 184 GUEST_SYNC(RUNSTATE_offline); 185 GUEST_ASSERT(rs->time[RUNSTATE_offline] != 0); 186 GUEST_ASSERT(rs->state == 0); 187 188 /* Test runstate time adjust */ 189 GUEST_SYNC(4); 190 GUEST_ASSERT(rs->time[RUNSTATE_blocked] == 0x5a); 191 GUEST_ASSERT(rs->time[RUNSTATE_offline] == 0x6b6b); 192 193 /* Test runstate time set */ 194 GUEST_SYNC(5); 195 GUEST_ASSERT(rs->state_entry_time >= 0x8000); 196 GUEST_ASSERT(rs->time[RUNSTATE_runnable] == 0); 197 GUEST_ASSERT(rs->time[RUNSTATE_blocked] == 0x6b6b); 198 GUEST_ASSERT(rs->time[RUNSTATE_offline] == 0x5a); 199 200 /* sched_yield() should result in some 'runnable' time */ 201 GUEST_SYNC(6); 202 GUEST_ASSERT(rs->time[RUNSTATE_runnable] >= MIN_STEAL_TIME); 203 204 /* Attempt to deliver a *masked* interrupt */ 205 GUEST_SYNC(7); 206 207 /* Wait until we see the bit set */ 208 struct shared_info *si = (void *)SHINFO_VADDR; 209 while (!si->evtchn_pending[0]) 210 __asm__ __volatile__ ("rep nop" : : : "memory"); 211 212 /* Now deliver an *unmasked* interrupt */ 213 GUEST_SYNC(8); 214 215 guest_wait_for_irq(); 216 217 /* Change memslots and deliver an interrupt */ 218 GUEST_SYNC(9); 219 220 guest_wait_for_irq(); 221 222 /* Deliver event channel with KVM_XEN_HVM_EVTCHN_SEND */ 223 GUEST_SYNC(10); 224 225 guest_wait_for_irq(); 226 227 GUEST_SYNC(11); 228 229 /* Our turn. Deliver event channel (to ourselves) with 230 * EVTCHNOP_send hypercall. */ 231 unsigned long rax; 232 struct evtchn_send s = { .port = 127 }; 233 __asm__ __volatile__ ("vmcall" : 234 "=a" (rax) : 235 "a" (__HYPERVISOR_event_channel_op), 236 "D" (EVTCHNOP_send), 237 "S" (&s)); 238 239 GUEST_ASSERT(rax == 0); 240 241 guest_wait_for_irq(); 242 243 GUEST_SYNC(12); 244 245 /* Deliver "outbound" event channel to an eventfd which 246 * happens to be one of our own irqfds. */ 247 s.port = 197; 248 __asm__ __volatile__ ("vmcall" : 249 "=a" (rax) : 250 "a" (__HYPERVISOR_event_channel_op), 251 "D" (EVTCHNOP_send), 252 "S" (&s)); 253 254 GUEST_ASSERT(rax == 0); 255 256 guest_wait_for_irq(); 257 258 GUEST_SYNC(13); 259 260 /* Set a timer 100ms in the future. */ 261 __asm__ __volatile__ ("vmcall" : 262 "=a" (rax) : 263 "a" (__HYPERVISOR_set_timer_op), 264 "D" (rs->state_entry_time + 100000000)); 265 GUEST_ASSERT(rax == 0); 266 267 GUEST_SYNC(14); 268 269 /* Now wait for the timer */ 270 guest_wait_for_irq(); 271 272 GUEST_SYNC(15); 273 274 /* The host has 'restored' the timer. Just wait for it. */ 275 guest_wait_for_irq(); 276 277 GUEST_SYNC(16); 278 279 /* Poll for an event channel port which is already set */ 280 u32 ports[1] = { EVTCHN_TIMER }; 281 struct sched_poll p = { 282 .ports = ports, 283 .nr_ports = 1, 284 .timeout = 0, 285 }; 286 287 __asm__ __volatile__ ("vmcall" : 288 "=a" (rax) : 289 "a" (__HYPERVISOR_sched_op), 290 "D" (SCHEDOP_poll), 291 "S" (&p)); 292 293 GUEST_ASSERT(rax == 0); 294 295 GUEST_SYNC(17); 296 297 /* Poll for an unset port and wait for the timeout. */ 298 p.timeout = 100000000; 299 __asm__ __volatile__ ("vmcall" : 300 "=a" (rax) : 301 "a" (__HYPERVISOR_sched_op), 302 "D" (SCHEDOP_poll), 303 "S" (&p)); 304 305 GUEST_ASSERT(rax == 0); 306 307 GUEST_SYNC(18); 308 309 /* A timer will wake the masked port we're waiting on, while we poll */ 310 p.timeout = 0; 311 __asm__ __volatile__ ("vmcall" : 312 "=a" (rax) : 313 "a" (__HYPERVISOR_sched_op), 314 "D" (SCHEDOP_poll), 315 "S" (&p)); 316 317 GUEST_ASSERT(rax == 0); 318 319 GUEST_SYNC(19); 320 321 /* A timer wake an *unmasked* port which should wake us with an 322 * actual interrupt, while we're polling on a different port. */ 323 ports[0]++; 324 p.timeout = 0; 325 __asm__ __volatile__ ("vmcall" : 326 "=a" (rax) : 327 "a" (__HYPERVISOR_sched_op), 328 "D" (SCHEDOP_poll), 329 "S" (&p)); 330 331 GUEST_ASSERT(rax == 0); 332 333 guest_wait_for_irq(); 334 335 GUEST_SYNC(20); 336 337 /* Timer should have fired already */ 338 guest_wait_for_irq(); 339 340 GUEST_SYNC(21); 341 /* Racing host ioctls */ 342 343 guest_wait_for_irq(); 344 345 GUEST_SYNC(22); 346 /* Racing vmcall against host ioctl */ 347 348 ports[0] = 0; 349 350 p = (struct sched_poll) { 351 .ports = ports, 352 .nr_ports = 1, 353 .timeout = 0 354 }; 355 356 wait_for_timer: 357 /* 358 * Poll for a timer wake event while the worker thread is mucking with 359 * the shared info. KVM XEN drops timer IRQs if the shared info is 360 * invalid when the timer expires. Arbitrarily poll 100 times before 361 * giving up and asking the VMM to re-arm the timer. 100 polls should 362 * consume enough time to beat on KVM without taking too long if the 363 * timer IRQ is dropped due to an invalid event channel. 364 */ 365 for (i = 0; i < 100 && !guest_saw_irq; i++) 366 asm volatile("vmcall" 367 : "=a" (rax) 368 : "a" (__HYPERVISOR_sched_op), 369 "D" (SCHEDOP_poll), 370 "S" (&p) 371 : "memory"); 372 373 /* 374 * Re-send the timer IRQ if it was (likely) dropped due to the timer 375 * expiring while the event channel was invalid. 376 */ 377 if (!guest_saw_irq) { 378 GUEST_SYNC(23); 379 goto wait_for_timer; 380 } 381 guest_saw_irq = false; 382 383 GUEST_SYNC(24); 384 } 385 386 static int cmp_timespec(struct timespec *a, struct timespec *b) 387 { 388 if (a->tv_sec > b->tv_sec) 389 return 1; 390 else if (a->tv_sec < b->tv_sec) 391 return -1; 392 else if (a->tv_nsec > b->tv_nsec) 393 return 1; 394 else if (a->tv_nsec < b->tv_nsec) 395 return -1; 396 else 397 return 0; 398 } 399 400 static struct vcpu_info *vinfo; 401 static struct kvm_vcpu *vcpu; 402 403 static void handle_alrm(int sig) 404 { 405 if (vinfo) 406 printf("evtchn_upcall_pending 0x%x\n", vinfo->evtchn_upcall_pending); 407 vcpu_dump(stdout, vcpu, 0); 408 TEST_FAIL("IRQ delivery timed out"); 409 } 410 411 static void *juggle_shinfo_state(void *arg) 412 { 413 struct kvm_vm *vm = (struct kvm_vm *)arg; 414 415 struct kvm_xen_hvm_attr cache_init = { 416 .type = KVM_XEN_ATTR_TYPE_SHARED_INFO, 417 .u.shared_info.gfn = SHINFO_REGION_GPA / PAGE_SIZE 418 }; 419 420 struct kvm_xen_hvm_attr cache_destroy = { 421 .type = KVM_XEN_ATTR_TYPE_SHARED_INFO, 422 .u.shared_info.gfn = GPA_INVALID 423 }; 424 425 for (;;) { 426 __vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &cache_init); 427 __vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &cache_destroy); 428 pthread_testcancel(); 429 }; 430 431 return NULL; 432 } 433 434 int main(int argc, char *argv[]) 435 { 436 struct timespec min_ts, max_ts, vm_ts; 437 struct kvm_xen_hvm_attr evt_reset; 438 struct kvm_vm *vm; 439 pthread_t thread; 440 bool verbose; 441 int ret; 442 443 verbose = argc > 1 && (!strncmp(argv[1], "-v", 3) || 444 !strncmp(argv[1], "--verbose", 10)); 445 446 int xen_caps = kvm_check_cap(KVM_CAP_XEN_HVM); 447 TEST_REQUIRE(xen_caps & KVM_XEN_HVM_CONFIG_SHARED_INFO); 448 449 bool do_runstate_tests = !!(xen_caps & KVM_XEN_HVM_CONFIG_RUNSTATE); 450 bool do_runstate_flag = !!(xen_caps & KVM_XEN_HVM_CONFIG_RUNSTATE_UPDATE_FLAG); 451 bool do_eventfd_tests = !!(xen_caps & KVM_XEN_HVM_CONFIG_EVTCHN_2LEVEL); 452 bool do_evtchn_tests = do_eventfd_tests && !!(xen_caps & KVM_XEN_HVM_CONFIG_EVTCHN_SEND); 453 454 clock_gettime(CLOCK_REALTIME, &min_ts); 455 456 vm = vm_create_with_one_vcpu(&vcpu, guest_code); 457 458 /* Map a region for the shared_info page */ 459 vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS, 460 SHINFO_REGION_GPA, SHINFO_REGION_SLOT, 3, 0); 461 virt_map(vm, SHINFO_REGION_GVA, SHINFO_REGION_GPA, 3); 462 463 struct shared_info *shinfo = addr_gpa2hva(vm, SHINFO_VADDR); 464 465 int zero_fd = open("/dev/zero", O_RDONLY); 466 TEST_ASSERT(zero_fd != -1, "Failed to open /dev/zero"); 467 468 struct kvm_xen_hvm_config hvmc = { 469 .flags = KVM_XEN_HVM_CONFIG_INTERCEPT_HCALL, 470 .msr = XEN_HYPERCALL_MSR, 471 }; 472 473 /* Let the kernel know that we *will* use it for sending all 474 * event channels, which lets it intercept SCHEDOP_poll */ 475 if (do_evtchn_tests) 476 hvmc.flags |= KVM_XEN_HVM_CONFIG_EVTCHN_SEND; 477 478 vm_ioctl(vm, KVM_XEN_HVM_CONFIG, &hvmc); 479 480 struct kvm_xen_hvm_attr lm = { 481 .type = KVM_XEN_ATTR_TYPE_LONG_MODE, 482 .u.long_mode = 1, 483 }; 484 vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &lm); 485 486 if (do_runstate_flag) { 487 struct kvm_xen_hvm_attr ruf = { 488 .type = KVM_XEN_ATTR_TYPE_RUNSTATE_UPDATE_FLAG, 489 .u.runstate_update_flag = 1, 490 }; 491 vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &ruf); 492 493 ruf.u.runstate_update_flag = 0; 494 vm_ioctl(vm, KVM_XEN_HVM_GET_ATTR, &ruf); 495 TEST_ASSERT(ruf.u.runstate_update_flag == 1, 496 "Failed to read back RUNSTATE_UPDATE_FLAG attr"); 497 } 498 499 struct kvm_xen_hvm_attr ha = { 500 .type = KVM_XEN_ATTR_TYPE_SHARED_INFO, 501 .u.shared_info.gfn = SHINFO_REGION_GPA / PAGE_SIZE, 502 }; 503 vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &ha); 504 505 /* 506 * Test what happens when the HVA of the shinfo page is remapped after 507 * the kernel has a reference to it. But make sure we copy the clock 508 * info over since that's only set at setup time, and we test it later. 509 */ 510 struct pvclock_wall_clock wc_copy = shinfo->wc; 511 void *m = mmap(shinfo, PAGE_SIZE, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_PRIVATE, zero_fd, 0); 512 TEST_ASSERT(m == shinfo, "Failed to map /dev/zero over shared info"); 513 shinfo->wc = wc_copy; 514 515 struct kvm_xen_vcpu_attr vi = { 516 .type = KVM_XEN_VCPU_ATTR_TYPE_VCPU_INFO, 517 .u.gpa = VCPU_INFO_ADDR, 518 }; 519 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &vi); 520 521 struct kvm_xen_vcpu_attr pvclock = { 522 .type = KVM_XEN_VCPU_ATTR_TYPE_VCPU_TIME_INFO, 523 .u.gpa = PVTIME_ADDR, 524 }; 525 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &pvclock); 526 527 struct kvm_xen_hvm_attr vec = { 528 .type = KVM_XEN_ATTR_TYPE_UPCALL_VECTOR, 529 .u.vector = EVTCHN_VECTOR, 530 }; 531 vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &vec); 532 533 vm_init_descriptor_tables(vm); 534 vcpu_init_descriptor_tables(vcpu); 535 vm_install_exception_handler(vm, EVTCHN_VECTOR, evtchn_handler); 536 537 if (do_runstate_tests) { 538 struct kvm_xen_vcpu_attr st = { 539 .type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADDR, 540 .u.gpa = RUNSTATE_ADDR, 541 }; 542 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &st); 543 } 544 545 int irq_fd[2] = { -1, -1 }; 546 547 if (do_eventfd_tests) { 548 irq_fd[0] = eventfd(0, 0); 549 irq_fd[1] = eventfd(0, 0); 550 551 /* Unexpected, but not a KVM failure */ 552 if (irq_fd[0] == -1 || irq_fd[1] == -1) 553 do_evtchn_tests = do_eventfd_tests = false; 554 } 555 556 if (do_eventfd_tests) { 557 irq_routes.info.nr = 2; 558 559 irq_routes.entries[0].gsi = 32; 560 irq_routes.entries[0].type = KVM_IRQ_ROUTING_XEN_EVTCHN; 561 irq_routes.entries[0].u.xen_evtchn.port = EVTCHN_TEST1; 562 irq_routes.entries[0].u.xen_evtchn.vcpu = vcpu->id; 563 irq_routes.entries[0].u.xen_evtchn.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL; 564 565 irq_routes.entries[1].gsi = 33; 566 irq_routes.entries[1].type = KVM_IRQ_ROUTING_XEN_EVTCHN; 567 irq_routes.entries[1].u.xen_evtchn.port = EVTCHN_TEST2; 568 irq_routes.entries[1].u.xen_evtchn.vcpu = vcpu->id; 569 irq_routes.entries[1].u.xen_evtchn.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL; 570 571 vm_ioctl(vm, KVM_SET_GSI_ROUTING, &irq_routes.info); 572 573 struct kvm_irqfd ifd = { }; 574 575 ifd.fd = irq_fd[0]; 576 ifd.gsi = 32; 577 vm_ioctl(vm, KVM_IRQFD, &ifd); 578 579 ifd.fd = irq_fd[1]; 580 ifd.gsi = 33; 581 vm_ioctl(vm, KVM_IRQFD, &ifd); 582 583 struct sigaction sa = { }; 584 sa.sa_handler = handle_alrm; 585 sigaction(SIGALRM, &sa, NULL); 586 } 587 588 struct kvm_xen_vcpu_attr tmr = { 589 .type = KVM_XEN_VCPU_ATTR_TYPE_TIMER, 590 .u.timer.port = EVTCHN_TIMER, 591 .u.timer.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL, 592 .u.timer.expires_ns = 0 593 }; 594 595 if (do_evtchn_tests) { 596 struct kvm_xen_hvm_attr inj = { 597 .type = KVM_XEN_ATTR_TYPE_EVTCHN, 598 .u.evtchn.send_port = 127, 599 .u.evtchn.type = EVTCHNSTAT_interdomain, 600 .u.evtchn.flags = 0, 601 .u.evtchn.deliver.port.port = EVTCHN_TEST1, 602 .u.evtchn.deliver.port.vcpu = vcpu->id + 1, 603 .u.evtchn.deliver.port.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL, 604 }; 605 vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &inj); 606 607 /* Test migration to a different vCPU */ 608 inj.u.evtchn.flags = KVM_XEN_EVTCHN_UPDATE; 609 inj.u.evtchn.deliver.port.vcpu = vcpu->id; 610 vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &inj); 611 612 inj.u.evtchn.send_port = 197; 613 inj.u.evtchn.deliver.eventfd.port = 0; 614 inj.u.evtchn.deliver.eventfd.fd = irq_fd[1]; 615 inj.u.evtchn.flags = 0; 616 vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &inj); 617 618 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr); 619 } 620 vinfo = addr_gpa2hva(vm, VCPU_INFO_VADDR); 621 vinfo->evtchn_upcall_pending = 0; 622 623 struct vcpu_runstate_info *rs = addr_gpa2hva(vm, RUNSTATE_ADDR); 624 rs->state = 0x5a; 625 626 bool evtchn_irq_expected = false; 627 628 for (;;) { 629 volatile struct kvm_run *run = vcpu->run; 630 struct ucall uc; 631 632 vcpu_run(vcpu); 633 634 TEST_ASSERT(run->exit_reason == KVM_EXIT_IO, 635 "Got exit_reason other than KVM_EXIT_IO: %u (%s)\n", 636 run->exit_reason, 637 exit_reason_str(run->exit_reason)); 638 639 switch (get_ucall(vcpu, &uc)) { 640 case UCALL_ABORT: 641 REPORT_GUEST_ASSERT(uc); 642 /* NOT REACHED */ 643 case UCALL_SYNC: { 644 struct kvm_xen_vcpu_attr rst; 645 long rundelay; 646 647 if (do_runstate_tests) 648 TEST_ASSERT(rs->state_entry_time == rs->time[0] + 649 rs->time[1] + rs->time[2] + rs->time[3], 650 "runstate times don't add up"); 651 652 switch (uc.args[1]) { 653 case 0: 654 if (verbose) 655 printf("Delivering evtchn upcall\n"); 656 evtchn_irq_expected = true; 657 vinfo->evtchn_upcall_pending = 1; 658 break; 659 660 case RUNSTATE_runnable...RUNSTATE_offline: 661 TEST_ASSERT(!evtchn_irq_expected, "Event channel IRQ not seen"); 662 if (!do_runstate_tests) 663 goto done; 664 if (verbose) 665 printf("Testing runstate %s\n", runstate_names[uc.args[1]]); 666 rst.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_CURRENT; 667 rst.u.runstate.state = uc.args[1]; 668 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &rst); 669 break; 670 671 case 4: 672 if (verbose) 673 printf("Testing RUNSTATE_ADJUST\n"); 674 rst.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADJUST; 675 memset(&rst.u, 0, sizeof(rst.u)); 676 rst.u.runstate.state = (uint64_t)-1; 677 rst.u.runstate.time_blocked = 678 0x5a - rs->time[RUNSTATE_blocked]; 679 rst.u.runstate.time_offline = 680 0x6b6b - rs->time[RUNSTATE_offline]; 681 rst.u.runstate.time_runnable = -rst.u.runstate.time_blocked - 682 rst.u.runstate.time_offline; 683 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &rst); 684 break; 685 686 case 5: 687 if (verbose) 688 printf("Testing RUNSTATE_DATA\n"); 689 rst.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_DATA; 690 memset(&rst.u, 0, sizeof(rst.u)); 691 rst.u.runstate.state = RUNSTATE_running; 692 rst.u.runstate.state_entry_time = 0x6b6b + 0x5a; 693 rst.u.runstate.time_blocked = 0x6b6b; 694 rst.u.runstate.time_offline = 0x5a; 695 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &rst); 696 break; 697 698 case 6: 699 if (verbose) 700 printf("Testing steal time\n"); 701 /* Yield until scheduler delay exceeds target */ 702 rundelay = get_run_delay() + MIN_STEAL_TIME; 703 do { 704 sched_yield(); 705 } while (get_run_delay() < rundelay); 706 break; 707 708 case 7: 709 if (!do_eventfd_tests) 710 goto done; 711 if (verbose) 712 printf("Testing masked event channel\n"); 713 shinfo->evtchn_mask[0] = 1UL << EVTCHN_TEST1; 714 eventfd_write(irq_fd[0], 1UL); 715 alarm(1); 716 break; 717 718 case 8: 719 if (verbose) 720 printf("Testing unmasked event channel\n"); 721 /* Unmask that, but deliver the other one */ 722 shinfo->evtchn_pending[0] = 0; 723 shinfo->evtchn_mask[0] = 0; 724 eventfd_write(irq_fd[1], 1UL); 725 evtchn_irq_expected = true; 726 alarm(1); 727 break; 728 729 case 9: 730 TEST_ASSERT(!evtchn_irq_expected, 731 "Expected event channel IRQ but it didn't happen"); 732 shinfo->evtchn_pending[1] = 0; 733 if (verbose) 734 printf("Testing event channel after memslot change\n"); 735 vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS, 736 DUMMY_REGION_GPA, DUMMY_REGION_SLOT, 1, 0); 737 eventfd_write(irq_fd[0], 1UL); 738 evtchn_irq_expected = true; 739 alarm(1); 740 break; 741 742 case 10: 743 TEST_ASSERT(!evtchn_irq_expected, 744 "Expected event channel IRQ but it didn't happen"); 745 if (!do_evtchn_tests) 746 goto done; 747 748 shinfo->evtchn_pending[0] = 0; 749 if (verbose) 750 printf("Testing injection with KVM_XEN_HVM_EVTCHN_SEND\n"); 751 752 struct kvm_irq_routing_xen_evtchn e; 753 e.port = EVTCHN_TEST2; 754 e.vcpu = vcpu->id; 755 e.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL; 756 757 vm_ioctl(vm, KVM_XEN_HVM_EVTCHN_SEND, &e); 758 evtchn_irq_expected = true; 759 alarm(1); 760 break; 761 762 case 11: 763 TEST_ASSERT(!evtchn_irq_expected, 764 "Expected event channel IRQ but it didn't happen"); 765 shinfo->evtchn_pending[1] = 0; 766 767 if (verbose) 768 printf("Testing guest EVTCHNOP_send direct to evtchn\n"); 769 evtchn_irq_expected = true; 770 alarm(1); 771 break; 772 773 case 12: 774 TEST_ASSERT(!evtchn_irq_expected, 775 "Expected event channel IRQ but it didn't happen"); 776 shinfo->evtchn_pending[0] = 0; 777 778 if (verbose) 779 printf("Testing guest EVTCHNOP_send to eventfd\n"); 780 evtchn_irq_expected = true; 781 alarm(1); 782 break; 783 784 case 13: 785 TEST_ASSERT(!evtchn_irq_expected, 786 "Expected event channel IRQ but it didn't happen"); 787 shinfo->evtchn_pending[1] = 0; 788 789 if (verbose) 790 printf("Testing guest oneshot timer\n"); 791 break; 792 793 case 14: 794 memset(&tmr, 0, sizeof(tmr)); 795 tmr.type = KVM_XEN_VCPU_ATTR_TYPE_TIMER; 796 vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr); 797 TEST_ASSERT(tmr.u.timer.port == EVTCHN_TIMER, 798 "Timer port not returned"); 799 TEST_ASSERT(tmr.u.timer.priority == KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL, 800 "Timer priority not returned"); 801 TEST_ASSERT(tmr.u.timer.expires_ns > rs->state_entry_time, 802 "Timer expiry not returned"); 803 evtchn_irq_expected = true; 804 alarm(1); 805 break; 806 807 case 15: 808 TEST_ASSERT(!evtchn_irq_expected, 809 "Expected event channel IRQ but it didn't happen"); 810 shinfo->evtchn_pending[0] = 0; 811 812 if (verbose) 813 printf("Testing restored oneshot timer\n"); 814 815 tmr.u.timer.expires_ns = rs->state_entry_time + 100000000; 816 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr); 817 evtchn_irq_expected = true; 818 alarm(1); 819 break; 820 821 case 16: 822 TEST_ASSERT(!evtchn_irq_expected, 823 "Expected event channel IRQ but it didn't happen"); 824 825 if (verbose) 826 printf("Testing SCHEDOP_poll with already pending event\n"); 827 shinfo->evtchn_pending[0] = shinfo->evtchn_mask[0] = 1UL << EVTCHN_TIMER; 828 alarm(1); 829 break; 830 831 case 17: 832 if (verbose) 833 printf("Testing SCHEDOP_poll timeout\n"); 834 shinfo->evtchn_pending[0] = 0; 835 alarm(1); 836 break; 837 838 case 18: 839 if (verbose) 840 printf("Testing SCHEDOP_poll wake on masked event\n"); 841 842 tmr.u.timer.expires_ns = rs->state_entry_time + 100000000; 843 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr); 844 alarm(1); 845 break; 846 847 case 19: 848 shinfo->evtchn_pending[0] = shinfo->evtchn_mask[0] = 0; 849 if (verbose) 850 printf("Testing SCHEDOP_poll wake on unmasked event\n"); 851 852 evtchn_irq_expected = true; 853 tmr.u.timer.expires_ns = rs->state_entry_time + 100000000; 854 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr); 855 856 /* Read it back and check the pending time is reported correctly */ 857 tmr.u.timer.expires_ns = 0; 858 vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr); 859 TEST_ASSERT(tmr.u.timer.expires_ns == rs->state_entry_time + 100000000, 860 "Timer not reported pending"); 861 alarm(1); 862 break; 863 864 case 20: 865 TEST_ASSERT(!evtchn_irq_expected, 866 "Expected event channel IRQ but it didn't happen"); 867 /* Read timer and check it is no longer pending */ 868 vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr); 869 TEST_ASSERT(!tmr.u.timer.expires_ns, "Timer still reported pending"); 870 871 shinfo->evtchn_pending[0] = 0; 872 if (verbose) 873 printf("Testing timer in the past\n"); 874 875 evtchn_irq_expected = true; 876 tmr.u.timer.expires_ns = rs->state_entry_time - 100000000ULL; 877 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr); 878 alarm(1); 879 break; 880 881 case 21: 882 TEST_ASSERT(!evtchn_irq_expected, 883 "Expected event channel IRQ but it didn't happen"); 884 alarm(0); 885 886 if (verbose) 887 printf("Testing shinfo lock corruption (KVM_XEN_HVM_EVTCHN_SEND)\n"); 888 889 ret = pthread_create(&thread, NULL, &juggle_shinfo_state, (void *)vm); 890 TEST_ASSERT(ret == 0, "pthread_create() failed: %s", strerror(ret)); 891 892 struct kvm_irq_routing_xen_evtchn uxe = { 893 .port = 1, 894 .vcpu = vcpu->id, 895 .priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL 896 }; 897 898 evtchn_irq_expected = true; 899 for (time_t t = time(NULL) + SHINFO_RACE_TIMEOUT; time(NULL) < t;) 900 __vm_ioctl(vm, KVM_XEN_HVM_EVTCHN_SEND, &uxe); 901 break; 902 903 case 22: 904 TEST_ASSERT(!evtchn_irq_expected, 905 "Expected event channel IRQ but it didn't happen"); 906 907 if (verbose) 908 printf("Testing shinfo lock corruption (SCHEDOP_poll)\n"); 909 910 shinfo->evtchn_pending[0] = 1; 911 912 evtchn_irq_expected = true; 913 tmr.u.timer.expires_ns = rs->state_entry_time + 914 SHINFO_RACE_TIMEOUT * 1000000000ULL; 915 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr); 916 break; 917 918 case 23: 919 /* 920 * Optional and possibly repeated sync point. 921 * Injecting the timer IRQ may fail if the 922 * shinfo is invalid when the timer expires. 923 * If the timer has expired but the IRQ hasn't 924 * been delivered, rearm the timer and retry. 925 */ 926 vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr); 927 928 /* Resume the guest if the timer is still pending. */ 929 if (tmr.u.timer.expires_ns) 930 break; 931 932 /* All done if the IRQ was delivered. */ 933 if (!evtchn_irq_expected) 934 break; 935 936 tmr.u.timer.expires_ns = rs->state_entry_time + 937 SHINFO_RACE_TIMEOUT * 1000000000ULL; 938 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr); 939 break; 940 case 24: 941 TEST_ASSERT(!evtchn_irq_expected, 942 "Expected event channel IRQ but it didn't happen"); 943 944 ret = pthread_cancel(thread); 945 TEST_ASSERT(ret == 0, "pthread_cancel() failed: %s", strerror(ret)); 946 947 ret = pthread_join(thread, 0); 948 TEST_ASSERT(ret == 0, "pthread_join() failed: %s", strerror(ret)); 949 goto done; 950 951 case 0x20: 952 TEST_ASSERT(evtchn_irq_expected, "Unexpected event channel IRQ"); 953 evtchn_irq_expected = false; 954 break; 955 } 956 break; 957 } 958 case UCALL_DONE: 959 goto done; 960 default: 961 TEST_FAIL("Unknown ucall 0x%lx.", uc.cmd); 962 } 963 } 964 965 done: 966 evt_reset.type = KVM_XEN_ATTR_TYPE_EVTCHN; 967 evt_reset.u.evtchn.flags = KVM_XEN_EVTCHN_RESET; 968 vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &evt_reset); 969 970 alarm(0); 971 clock_gettime(CLOCK_REALTIME, &max_ts); 972 973 /* 974 * Just a *really* basic check that things are being put in the 975 * right place. The actual calculations are much the same for 976 * Xen as they are for the KVM variants, so no need to check. 977 */ 978 struct pvclock_wall_clock *wc; 979 struct pvclock_vcpu_time_info *ti, *ti2; 980 981 wc = addr_gpa2hva(vm, SHINFO_REGION_GPA + 0xc00); 982 ti = addr_gpa2hva(vm, SHINFO_REGION_GPA + 0x40 + 0x20); 983 ti2 = addr_gpa2hva(vm, PVTIME_ADDR); 984 985 if (verbose) { 986 printf("Wall clock (v %d) %d.%09d\n", wc->version, wc->sec, wc->nsec); 987 printf("Time info 1: v %u tsc %" PRIu64 " time %" PRIu64 " mul %u shift %u flags %x\n", 988 ti->version, ti->tsc_timestamp, ti->system_time, ti->tsc_to_system_mul, 989 ti->tsc_shift, ti->flags); 990 printf("Time info 2: v %u tsc %" PRIu64 " time %" PRIu64 " mul %u shift %u flags %x\n", 991 ti2->version, ti2->tsc_timestamp, ti2->system_time, ti2->tsc_to_system_mul, 992 ti2->tsc_shift, ti2->flags); 993 } 994 995 vm_ts.tv_sec = wc->sec; 996 vm_ts.tv_nsec = wc->nsec; 997 TEST_ASSERT(wc->version && !(wc->version & 1), 998 "Bad wallclock version %x", wc->version); 999 TEST_ASSERT(cmp_timespec(&min_ts, &vm_ts) <= 0, "VM time too old"); 1000 TEST_ASSERT(cmp_timespec(&max_ts, &vm_ts) >= 0, "VM time too new"); 1001 1002 TEST_ASSERT(ti->version && !(ti->version & 1), 1003 "Bad time_info version %x", ti->version); 1004 TEST_ASSERT(ti2->version && !(ti2->version & 1), 1005 "Bad time_info version %x", ti->version); 1006 1007 if (do_runstate_tests) { 1008 /* 1009 * Fetch runstate and check sanity. Strictly speaking in the 1010 * general case we might not expect the numbers to be identical 1011 * but in this case we know we aren't running the vCPU any more. 1012 */ 1013 struct kvm_xen_vcpu_attr rst = { 1014 .type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_DATA, 1015 }; 1016 vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &rst); 1017 1018 if (verbose) { 1019 printf("Runstate: %s(%d), entry %" PRIu64 " ns\n", 1020 rs->state <= RUNSTATE_offline ? runstate_names[rs->state] : "unknown", 1021 rs->state, rs->state_entry_time); 1022 for (int i = RUNSTATE_running; i <= RUNSTATE_offline; i++) { 1023 printf("State %s: %" PRIu64 " ns\n", 1024 runstate_names[i], rs->time[i]); 1025 } 1026 } 1027 1028 /* 1029 * Exercise runstate info at all points across the page boundary, in 1030 * 32-bit and 64-bit mode. In particular, test the case where it is 1031 * configured in 32-bit mode and then switched to 64-bit mode while 1032 * active, which takes it onto the second page. 1033 */ 1034 unsigned long runstate_addr; 1035 struct compat_vcpu_runstate_info *crs; 1036 for (runstate_addr = SHINFO_REGION_GPA + PAGE_SIZE + PAGE_SIZE - sizeof(*rs) - 4; 1037 runstate_addr < SHINFO_REGION_GPA + PAGE_SIZE + PAGE_SIZE + 4; runstate_addr++) { 1038 1039 rs = addr_gpa2hva(vm, runstate_addr); 1040 crs = (void *)rs; 1041 1042 memset(rs, 0xa5, sizeof(*rs)); 1043 1044 /* Set to compatibility mode */ 1045 lm.u.long_mode = 0; 1046 vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &lm); 1047 1048 /* Set runstate to new address (kernel will write it) */ 1049 struct kvm_xen_vcpu_attr st = { 1050 .type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADDR, 1051 .u.gpa = runstate_addr, 1052 }; 1053 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &st); 1054 1055 if (verbose) 1056 printf("Compatibility runstate at %08lx\n", runstate_addr); 1057 1058 TEST_ASSERT(crs->state == rst.u.runstate.state, "Runstate mismatch"); 1059 TEST_ASSERT(crs->state_entry_time == rst.u.runstate.state_entry_time, 1060 "State entry time mismatch"); 1061 TEST_ASSERT(crs->time[RUNSTATE_running] == rst.u.runstate.time_running, 1062 "Running time mismatch"); 1063 TEST_ASSERT(crs->time[RUNSTATE_runnable] == rst.u.runstate.time_runnable, 1064 "Runnable time mismatch"); 1065 TEST_ASSERT(crs->time[RUNSTATE_blocked] == rst.u.runstate.time_blocked, 1066 "Blocked time mismatch"); 1067 TEST_ASSERT(crs->time[RUNSTATE_offline] == rst.u.runstate.time_offline, 1068 "Offline time mismatch"); 1069 TEST_ASSERT(crs->time[RUNSTATE_offline + 1] == 0xa5a5a5a5a5a5a5a5ULL, 1070 "Structure overrun"); 1071 TEST_ASSERT(crs->state_entry_time == crs->time[0] + 1072 crs->time[1] + crs->time[2] + crs->time[3], 1073 "runstate times don't add up"); 1074 1075 1076 /* Now switch to 64-bit mode */ 1077 lm.u.long_mode = 1; 1078 vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &lm); 1079 1080 memset(rs, 0xa5, sizeof(*rs)); 1081 1082 /* Don't change the address, just trigger a write */ 1083 struct kvm_xen_vcpu_attr adj = { 1084 .type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADJUST, 1085 .u.runstate.state = (uint64_t)-1 1086 }; 1087 vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &adj); 1088 1089 if (verbose) 1090 printf("64-bit runstate at %08lx\n", runstate_addr); 1091 1092 TEST_ASSERT(rs->state == rst.u.runstate.state, "Runstate mismatch"); 1093 TEST_ASSERT(rs->state_entry_time == rst.u.runstate.state_entry_time, 1094 "State entry time mismatch"); 1095 TEST_ASSERT(rs->time[RUNSTATE_running] == rst.u.runstate.time_running, 1096 "Running time mismatch"); 1097 TEST_ASSERT(rs->time[RUNSTATE_runnable] == rst.u.runstate.time_runnable, 1098 "Runnable time mismatch"); 1099 TEST_ASSERT(rs->time[RUNSTATE_blocked] == rst.u.runstate.time_blocked, 1100 "Blocked time mismatch"); 1101 TEST_ASSERT(rs->time[RUNSTATE_offline] == rst.u.runstate.time_offline, 1102 "Offline time mismatch"); 1103 TEST_ASSERT(rs->time[RUNSTATE_offline + 1] == 0xa5a5a5a5a5a5a5a5ULL, 1104 "Structure overrun"); 1105 1106 TEST_ASSERT(rs->state_entry_time == rs->time[0] + 1107 rs->time[1] + rs->time[2] + rs->time[3], 1108 "runstate times don't add up"); 1109 } 1110 } 1111 1112 kvm_vm_free(vm); 1113 return 0; 1114 } 1115