The host emulates a protected guest's vGIC, so the list registers are copied between the host and EL2 each time the host runs the vCPU. If the copy back is lost, the host never sees the guest's EOI and presents the interrupt again. EL2 keeps its own copy of the guest's virtual timer state, which the host can't change, and restores it each time the host runs the vCPU. Check that the virtual timer's PPI arrives exactly once, with CVAL and CTL kept across exits before and while it's pending, that SGIs pass between two vCPUs, and that the timer wakes a vCPU in WFI. Signed-off-by: Fuad Tabba --- tools/testing/selftests/kvm/Makefile.kvm | 1 + tools/testing/selftests/kvm/arm64/pkvm_irq.c | 268 +++++++++++++++++++ 2 files changed, 269 insertions(+) create mode 100644 tools/testing/selftests/kvm/arm64/pkvm_irq.c diff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selftests/kvm/Makefile.kvm index 1e40e793aa6f3..13998964facd5 100644 --- a/tools/testing/selftests/kvm/Makefile.kvm +++ b/tools/testing/selftests/kvm/Makefile.kvm @@ -192,6 +192,7 @@ TEST_GEN_PROGS_arm64 += arm64/mmio_sign_ext TEST_GEN_PROGS_arm64 += arm64/page_fault_test TEST_GEN_PROGS_arm64 += arm64/pkvm_host_abi TEST_GEN_PROGS_arm64 += arm64/pkvm_id_regs +TEST_GEN_PROGS_arm64 += arm64/pkvm_irq TEST_GEN_PROGS_arm64 += arm64/pkvm_mem_share TEST_GEN_PROGS_arm64 += arm64/pkvm_psci TEST_GEN_PROGS_arm64 += arm64/pkvm_smccc diff --git a/tools/testing/selftests/kvm/arm64/pkvm_irq.c b/tools/testing/selftests/kvm/arm64/pkvm_irq.c new file mode 100644 index 0000000000000..f92fa6f0de8de --- /dev/null +++ b/tools/testing/selftests/kvm/arm64/pkvm_irq.c @@ -0,0 +1,268 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * pkvm_irq - the virtual timer's PPI and SGIs in a protected VM. + * + * Copyright (C) 2026 Google LLC + * Author: Fuad Tabba + */ + +#include + +#include +#include +#include + +#include "arch_timer.h" +#include "gic.h" +#include "gic_v3.h" +#include "kvm_util.h" +#include "pkvm.h" +#include "processor.h" +#include "test_util.h" + +#define TIMER_MS 10 +#define WAIT_MS 30000 +#define NR_EXITS 16 +#define SGI_ROUNDS 16 + +#define SGI_PING 1 +#define SGI_PONG 2 + +/* Set in the guest's copy by the host before the first run. */ +static u32 vtimer_irq; +static u64 boot_entry; +static u64 vcpu_mpidr[2]; +static u64 vcpu_ctx[2]; + +static u32 irqs[2]; +static u32 last_intid[2]; +static u32 ready; + +#define wait_until(cond) \ +do { \ + u64 __end = timer_get_cntct(VIRTUAL) + msec_to_cycles(WAIT_MS); \ + \ + while (!(cond)) \ + __GUEST_ASSERT(timer_get_cntct(VIRTUAL) < __end, \ + "timed out waiting for %s", #cond); \ +} while (0) + +static void guest_irq_handler(struct ex_regs *regs) +{ + u32 intid = gic_get_and_ack_irq(); + u32 cpu = guest_get_vcpuid(); + + if (intid == IAR_SPURIOUS) + return; + + if (intid == vtimer_irq) { + __GUEST_ASSERT(timer_get_ctl(VIRTUAL) & CTL_ISTATUS, "CNTV_CTL 0x%x", + timer_get_ctl(VIRTUAL)); + GUEST_ASSERT(timer_get_cntct(VIRTUAL) >= timer_get_cval(VIRTUAL)); + /* Mask the timer before the EOI, or its level-sensitive PPI is taken again. */ + timer_set_ctl(VIRTUAL, CTL_IMASK); + } + + WRITE_ONCE(last_intid[cpu], intid); + gic_set_eoi(intid); + WRITE_ONCE(irqs[cpu], irqs[cpu] + 1); +} + +static void guest_irq_init(unsigned int nr_cpus) +{ + local_irq_disable(); + pkvm_guest_init(); + gic_init(GIC_V3, nr_cpus); +} + +static u64 start_vtimer(void) +{ + u64 cval = timer_get_cntct(VIRTUAL) + msec_to_cycles(TIMER_MS); + + gic_irq_enable(vtimer_irq); + timer_set_cval(VIRTUAL, cval); + timer_set_ctl(VIRTUAL, CTL_ENABLE); + return cval; +} + +static void guest_vtimer(void) +{ + u64 cval; + int i; + + guest_irq_init(1); + cval = start_vtimer(); + + /* Exits before the timer fires, then with its interrupt pending but masked. */ + for (i = 0; i < NR_EXITS; i++) + GUEST_SYNC(i); + wait_until(timer_get_ctl(VIRTUAL) & CTL_ISTATUS); + for (i = 0; i < NR_EXITS; i++) + GUEST_SYNC(i); + + GUEST_ASSERT_EQ(timer_get_cval(VIRTUAL), cval); + GUEST_ASSERT_EQ(timer_get_ctl(VIRTUAL), CTL_ENABLE | CTL_ISTATUS); + GUEST_ASSERT_EQ(READ_ONCE(irqs[0]), 0); + + local_irq_enable(); + wait_until(READ_ONCE(irqs[0])); + + /* The EOI must reach the host, or it presents the interrupt again. */ + for (i = 0; i < NR_EXITS; i++) + GUEST_SYNC(i); + local_irq_disable(); + + GUEST_ASSERT_EQ(READ_ONCE(irqs[0]), 1); + GUEST_ASSERT_EQ(READ_ONCE(last_intid[0]), vtimer_irq); + GUEST_DONE(); +} + +static void send_sgi(int id, u32 intid) +{ + u64 mpidr = vcpu_mpidr[id]; + + /* The target reads this vCPU's counters once it has taken the SGI. */ + dsb(ishst); + write_sysreg_s(FIELD_PREP(ICC_SGI1R_SGI_ID_MASK, intid) | + FIELD_PREP(ICC_SGI1R_AFFINITY_1_MASK, MPIDR_AFFINITY_LEVEL(mpidr, 1)) | + FIELD_PREP(ICC_SGI1R_TARGET_LIST_MASK, BIT(MPIDR_AFFINITY_LEVEL(mpidr, 0))), + SYS_ICC_SGI1R_EL1); + isb(); +} + +static void guest_sgi_primary(void) +{ + u32 k; + + guest_irq_init(2); + gic_irq_enable(SGI_PONG); + + GUEST_ASSERT_EQ(pkvm_hvc(PSCI_0_2_FN64_CPU_ON, vcpu_mpidr[1], boot_entry, vcpu_ctx[1]), + PSCI_RET_SUCCESS); + wait_until(READ_ONCE(ready)); + + local_irq_enable(); + for (k = 1; k <= SGI_ROUNDS; k++) { + send_sgi(1, SGI_PING); + + /* vCPU 1 sends PONG only once it has taken PING, so neither is in flight. */ + wait_until(READ_ONCE(irqs[0]) >= k); + GUEST_ASSERT_EQ(READ_ONCE(irqs[0]), k); + GUEST_ASSERT_EQ(READ_ONCE(irqs[1]), k); + GUEST_ASSERT_EQ(READ_ONCE(last_intid[0]), SGI_PONG); + GUEST_ASSERT_EQ(READ_ONCE(last_intid[1]), SGI_PING); + } + local_irq_disable(); + + GUEST_DONE(); +} + +/* The primary's guest_irq_init() set up ucall and the distributor. */ +static void guest_sgi_secondary(void) +{ + u32 k; + + gic_init(GIC_V3, 2); + gic_irq_enable(SGI_PING); + local_irq_enable(); + WRITE_ONCE(ready, 1); + + for (k = 1; k <= SGI_ROUNDS; k++) { + wait_until(READ_ONCE(irqs[1]) >= k); + send_sgi(0, SGI_PONG); + } + local_irq_disable(); + + GUEST_DONE(); +} + +static void guest_wfi(void) +{ + guest_irq_init(1); + start_vtimer(); + + /* WFI can complete before the timer fires, so wait in it until the handler has run. */ + while (!READ_ONCE(irqs[0])) { + wfi(); + local_irq_enable(); + isb(); /* handle IRQ */ + local_irq_disable(); + } + + GUEST_ASSERT_EQ(READ_ONCE(irqs[0]), 1); + GUEST_ASSERT_EQ(READ_ONCE(last_intid[0]), vtimer_irq); + GUEST_DONE(); +} + +static void irq_vm_setup(struct kvm_vm *vm, struct kvm_vcpu *vcpu) +{ + vm_install_exception_handler(vm, VECTOR_IRQ_CURRENT, guest_irq_handler); + write_guest_global(vm, vtimer_irq, vcpu_get_vtimer_irq(vcpu)); +} + +static void test_one_vcpu(void *guest_code) +{ + struct kvm_vcpu *vcpu; + struct kvm_vm *vm; + + vm = pkvm_vm_create_with_one_vcpu(&vcpu, guest_code); + irq_vm_setup(vm, vcpu); + + pkvm_run_loop(vcpu, NULL); + + kvm_vm_free(vm); +} + +static void wire_mpidr(struct kvm_vm *vm, struct kvm_vcpu *vcpu) +{ + u64 mpidr = vcpu_get_reg(vcpu, KVM_ARM64_SYS_REG(SYS_MPIDR_EL1)); + + write_guest_global(vm, vcpu_mpidr[vcpu->id], mpidr & MPIDR_HWID_BITMASK); +} + +static void *vcpu_thread(void *vcpu) +{ + pkvm_run_loop(vcpu, NULL); + return NULL; +} + +static void test_sgi(void) +{ + struct kvm_vcpu *vcpus[2]; + pthread_t thread; + struct kvm_vm *vm; + gpa_t ctx; + + vm = pkvm_vm_create(2, 0, vcpus); + irq_vm_setup(vm, vcpus[0]); + + pkvm_vcpu_setup_boot(vcpus[0], guest_sgi_primary); + wire_mpidr(vm, vcpus[0]); + wire_mpidr(vm, vcpus[1]); + write_guest_global(vm, boot_entry, pkvm_idmap_gpa(vm)); + ctx = pkvm_vcpu_setup_boot_secondary(vcpus[1], guest_sgi_secondary); + write_guest_global(vm, vcpu_ctx[1], ctx); + + pthread_create(&thread, NULL, vcpu_thread, vcpus[1]); + pkvm_run_loop(vcpus[0], NULL); + pthread_join(thread, NULL); + + kvm_vm_free(vm); +} + +int main(void) +{ + TEST_REQUIRE(pkvm_supported()); + + ksft_print_header(); + ksft_set_plan(3); + + test_one_vcpu(guest_vtimer); + ksft_test_result_pass("virtual timer PPI across exits\n"); + test_sgi(); + ksft_test_result_pass("SGIs between two vCPUs: %d rounds\n", SGI_ROUNDS); + test_one_vcpu(guest_wfi); + ksft_test_result_pass("the virtual timer wakes a vCPU waiting in WFI\n"); + + ksft_finished(); +} -- 2.47.3