1 #include "libcflat.h" 2 #include "desc.h" 3 #include "processor.h" 4 #include "asm/page.h" 5 #include "x86/vm.h" 6 #include "access.h" 7 8 #define true 1 9 #define false 0 10 11 static _Bool verbose = false; 12 13 typedef unsigned long pt_element_t; 14 static int invalid_mask; 15 16 /* Test code/data is at 32MiB, paging structures at 33MiB. */ 17 #define AT_CODE_DATA_PHYS 32 * 1024 * 1024 18 #define AT_PAGING_STRUCTURES_PHYS 33 * 1024 * 1024 19 20 #define PT_BASE_ADDR_MASK ((pt_element_t)((((pt_element_t)1 << 36) - 1) & PAGE_MASK)) 21 #define PT_PSE_BASE_ADDR_MASK (PT_BASE_ADDR_MASK & ~(1ull << 21)) 22 23 #define CR0_WP_MASK (1UL << 16) 24 #define CR4_SMEP_MASK (1UL << 20) 25 26 #define PFERR_PRESENT_MASK (1U << 0) 27 #define PFERR_WRITE_MASK (1U << 1) 28 #define PFERR_USER_MASK (1U << 2) 29 #define PFERR_RESERVED_MASK (1U << 3) 30 #define PFERR_FETCH_MASK (1U << 4) 31 #define PFERR_PK_MASK (1U << 5) 32 33 #define MSR_EFER 0xc0000080 34 #define EFER_NX_MASK (1ull << 11) 35 36 #define PT_INDEX(address, level) \ 37 (((address) >> (12 + ((level)-1) * 9)) & 511) 38 39 /* 40 * Page table access check tests. Each number/bit represent an individual 41 * test case. The main test will bump a counter by 1 to run all permutations 42 * of the below test cases (sans illegal combinations). 43 * 44 * Keep the PRESENT and reserved bits in the higher numbers so that they aren't 45 * toggled on every test, e.g. to keep entries in the TLB. 46 */ 47 enum { 48 AC_PTE_WRITABLE_BIT, 49 AC_PTE_USER_BIT, 50 AC_PTE_ACCESSED_BIT, 51 AC_PTE_DIRTY_BIT, 52 AC_PTE_NX_BIT, 53 AC_PTE_PRESENT_BIT, 54 AC_PTE_BIT51_BIT, 55 AC_PTE_BIT36_BIT, 56 57 AC_PDE_WRITABLE_BIT, 58 AC_PDE_USER_BIT, 59 AC_PDE_ACCESSED_BIT, 60 AC_PDE_DIRTY_BIT, 61 AC_PDE_PSE_BIT, 62 AC_PDE_NX_BIT, 63 AC_PDE_PRESENT_BIT, 64 AC_PDE_BIT51_BIT, 65 AC_PDE_BIT36_BIT, 66 AC_PDE_BIT13_BIT, 67 68 /* 69 * special test case to DISABLE writable bit on page directory 70 * pointer table entry. 71 */ 72 AC_PDPTE_NO_WRITABLE_BIT, 73 74 AC_PKU_AD_BIT, 75 AC_PKU_WD_BIT, 76 AC_PKU_PKEY_BIT, 77 78 AC_ACCESS_USER_BIT, 79 AC_ACCESS_WRITE_BIT, 80 AC_ACCESS_FETCH_BIT, 81 AC_ACCESS_TWICE_BIT, 82 83 AC_CPU_EFER_NX_BIT, 84 AC_CPU_CR0_WP_BIT, 85 AC_CPU_CR4_SMEP_BIT, 86 AC_CPU_CR4_PKE_BIT, 87 88 NR_AC_FLAGS 89 }; 90 91 #define AC_PTE_PRESENT_MASK (1 << AC_PTE_PRESENT_BIT) 92 #define AC_PTE_WRITABLE_MASK (1 << AC_PTE_WRITABLE_BIT) 93 #define AC_PTE_USER_MASK (1 << AC_PTE_USER_BIT) 94 #define AC_PTE_ACCESSED_MASK (1 << AC_PTE_ACCESSED_BIT) 95 #define AC_PTE_DIRTY_MASK (1 << AC_PTE_DIRTY_BIT) 96 #define AC_PTE_NX_MASK (1 << AC_PTE_NX_BIT) 97 #define AC_PTE_BIT51_MASK (1 << AC_PTE_BIT51_BIT) 98 #define AC_PTE_BIT36_MASK (1 << AC_PTE_BIT36_BIT) 99 100 #define AC_PDE_PRESENT_MASK (1 << AC_PDE_PRESENT_BIT) 101 #define AC_PDE_WRITABLE_MASK (1 << AC_PDE_WRITABLE_BIT) 102 #define AC_PDE_USER_MASK (1 << AC_PDE_USER_BIT) 103 #define AC_PDE_ACCESSED_MASK (1 << AC_PDE_ACCESSED_BIT) 104 #define AC_PDE_DIRTY_MASK (1 << AC_PDE_DIRTY_BIT) 105 #define AC_PDE_PSE_MASK (1 << AC_PDE_PSE_BIT) 106 #define AC_PDE_NX_MASK (1 << AC_PDE_NX_BIT) 107 #define AC_PDE_BIT51_MASK (1 << AC_PDE_BIT51_BIT) 108 #define AC_PDE_BIT36_MASK (1 << AC_PDE_BIT36_BIT) 109 #define AC_PDE_BIT13_MASK (1 << AC_PDE_BIT13_BIT) 110 111 #define AC_PDPTE_NO_WRITABLE_MASK (1 << AC_PDPTE_NO_WRITABLE_BIT) 112 113 #define AC_PKU_AD_MASK (1 << AC_PKU_AD_BIT) 114 #define AC_PKU_WD_MASK (1 << AC_PKU_WD_BIT) 115 #define AC_PKU_PKEY_MASK (1 << AC_PKU_PKEY_BIT) 116 117 #define AC_ACCESS_USER_MASK (1 << AC_ACCESS_USER_BIT) 118 #define AC_ACCESS_WRITE_MASK (1 << AC_ACCESS_WRITE_BIT) 119 #define AC_ACCESS_FETCH_MASK (1 << AC_ACCESS_FETCH_BIT) 120 #define AC_ACCESS_TWICE_MASK (1 << AC_ACCESS_TWICE_BIT) 121 122 #define AC_CPU_EFER_NX_MASK (1 << AC_CPU_EFER_NX_BIT) 123 #define AC_CPU_CR0_WP_MASK (1 << AC_CPU_CR0_WP_BIT) 124 #define AC_CPU_CR4_SMEP_MASK (1 << AC_CPU_CR4_SMEP_BIT) 125 #define AC_CPU_CR4_PKE_MASK (1 << AC_CPU_CR4_PKE_BIT) 126 127 const char *ac_names[] = { 128 [AC_PTE_PRESENT_BIT] = "pte.p", 129 [AC_PTE_ACCESSED_BIT] = "pte.a", 130 [AC_PTE_WRITABLE_BIT] = "pte.rw", 131 [AC_PTE_USER_BIT] = "pte.user", 132 [AC_PTE_DIRTY_BIT] = "pte.d", 133 [AC_PTE_NX_BIT] = "pte.nx", 134 [AC_PTE_BIT51_BIT] = "pte.51", 135 [AC_PTE_BIT36_BIT] = "pte.36", 136 [AC_PDE_PRESENT_BIT] = "pde.p", 137 [AC_PDE_ACCESSED_BIT] = "pde.a", 138 [AC_PDE_WRITABLE_BIT] = "pde.rw", 139 [AC_PDE_USER_BIT] = "pde.user", 140 [AC_PDE_DIRTY_BIT] = "pde.d", 141 [AC_PDE_PSE_BIT] = "pde.pse", 142 [AC_PDE_NX_BIT] = "pde.nx", 143 [AC_PDE_BIT51_BIT] = "pde.51", 144 [AC_PDE_BIT36_BIT] = "pde.36", 145 [AC_PDE_BIT13_BIT] = "pde.13", 146 [AC_PDPTE_NO_WRITABLE_BIT] = "pdpte.ro", 147 [AC_PKU_AD_BIT] = "pkru.ad", 148 [AC_PKU_WD_BIT] = "pkru.wd", 149 [AC_PKU_PKEY_BIT] = "pkey=1", 150 [AC_ACCESS_WRITE_BIT] = "write", 151 [AC_ACCESS_USER_BIT] = "user", 152 [AC_ACCESS_FETCH_BIT] = "fetch", 153 [AC_ACCESS_TWICE_BIT] = "twice", 154 [AC_CPU_EFER_NX_BIT] = "efer.nx", 155 [AC_CPU_CR0_WP_BIT] = "cr0.wp", 156 [AC_CPU_CR4_SMEP_BIT] = "cr4.smep", 157 [AC_CPU_CR4_PKE_BIT] = "cr4.pke", 158 }; 159 160 static inline void *va(pt_element_t phys) 161 { 162 return (void *)phys; 163 } 164 165 typedef struct { 166 pt_element_t pt_pool_pa; 167 unsigned int pt_pool_current; 168 int pt_levels; 169 } ac_pt_env_t; 170 171 typedef struct { 172 unsigned flags; 173 void *virt; 174 pt_element_t phys; 175 pt_element_t *ptep; 176 pt_element_t expected_pte; 177 pt_element_t *pdep; 178 pt_element_t expected_pde; 179 pt_element_t ignore_pde; 180 int expected_fault; 181 unsigned expected_error; 182 int pt_levels; 183 184 /* 5-level paging, 1-based to avoid math. */ 185 pt_element_t page_tables[6]; 186 } ac_test_t; 187 188 typedef struct { 189 unsigned short limit; 190 unsigned long linear_addr; 191 } __attribute__((packed)) descriptor_table_t; 192 193 194 static void ac_test_show(ac_test_t *at); 195 196 static unsigned long shadow_cr0; 197 static unsigned long shadow_cr3; 198 static unsigned long shadow_cr4; 199 static unsigned long long shadow_efer; 200 201 typedef void (*walk_fn)(pt_element_t *ptep, int level, unsigned long virt); 202 203 /* Returns the size of the range covered by the last processed entry. */ 204 static unsigned long walk_va(ac_test_t *at, int min_level, unsigned long virt, 205 walk_fn callback, bool leaf_only) 206 { 207 unsigned long parent_pte = shadow_cr3; 208 int i; 209 210 for (i = at->pt_levels; i >= min_level; --i) { 211 pt_element_t *parent_pt = va(parent_pte & PT_BASE_ADDR_MASK); 212 unsigned int index = PT_INDEX(virt, i); 213 pt_element_t *ptep = &parent_pt[index]; 214 215 assert(!leaf_only || (*ptep & PT_PRESENT_MASK)); 216 217 if (!leaf_only || i == 1 || (*ptep & PT_PAGE_SIZE_MASK)) 218 callback(ptep, i, virt); 219 220 if (i == 1 || *ptep & PT_PAGE_SIZE_MASK) 221 break; 222 223 parent_pte = *ptep; 224 } 225 226 return 1ul << PGDIR_BITS(i); 227 } 228 229 static void walk_ptes(ac_test_t *at, unsigned long virt, unsigned long end, 230 walk_fn callback) 231 { 232 unsigned long page_size; 233 234 for ( ; virt < end; virt = ALIGN_DOWN(virt + page_size, page_size)) 235 page_size = walk_va(at, 1, virt, callback, true); 236 } 237 238 static void set_cr0_wp(int wp) 239 { 240 unsigned long cr0 = shadow_cr0; 241 242 cr0 &= ~CR0_WP_MASK; 243 if (wp) 244 cr0 |= CR0_WP_MASK; 245 if (cr0 != shadow_cr0) { 246 write_cr0(cr0); 247 shadow_cr0 = cr0; 248 } 249 } 250 251 static void clear_user_mask(pt_element_t *ptep, int level, unsigned long virt) 252 { 253 *ptep &= ~PT_USER_MASK; 254 255 /* Flush to avoid spurious #PF */ 256 invlpg((void*)virt); 257 } 258 259 static void set_user_mask(pt_element_t *ptep, int level, unsigned long virt) 260 { 261 *ptep |= PT_USER_MASK; 262 263 /* Flush to avoid spurious #PF */ 264 invlpg((void*)virt); 265 } 266 267 static unsigned set_cr4_smep(ac_test_t *at, int smep) 268 { 269 extern char stext, etext; 270 unsigned long code_start = (unsigned long)&stext; 271 unsigned long code_end = (unsigned long)&etext; 272 unsigned long cr4 = shadow_cr4; 273 unsigned r; 274 275 cr4 &= ~CR4_SMEP_MASK; 276 if (smep) 277 cr4 |= CR4_SMEP_MASK; 278 if (cr4 == shadow_cr4) 279 return 0; 280 281 if (smep) 282 walk_ptes(at, code_start, code_end, clear_user_mask); 283 r = write_cr4_checking(cr4); 284 if (r || !smep) 285 walk_ptes(at, code_start, code_end, set_user_mask); 286 if (!r) 287 shadow_cr4 = cr4; 288 return r; 289 } 290 291 static void set_cr4_pke(int pke) 292 { 293 unsigned long cr4 = shadow_cr4; 294 295 cr4 &= ~X86_CR4_PKE; 296 if (pke) 297 cr4 |= X86_CR4_PKE; 298 if (cr4 == shadow_cr4) 299 return; 300 301 /* Check that protection keys do not affect accesses when CR4.PKE=0. */ 302 if ((shadow_cr4 & X86_CR4_PKE) && !pke) 303 write_pkru(0xfffffffc); 304 write_cr4(cr4); 305 shadow_cr4 = cr4; 306 } 307 308 static void set_efer_nx(int nx) 309 { 310 unsigned long long efer = shadow_efer; 311 312 efer &= ~EFER_NX_MASK; 313 if (nx) 314 efer |= EFER_NX_MASK; 315 if (efer != shadow_efer) { 316 wrmsr(MSR_EFER, efer); 317 shadow_efer = efer; 318 } 319 } 320 321 static void ac_env_int(ac_pt_env_t *pt_env, int page_table_levels) 322 { 323 extern char page_fault, kernel_entry; 324 set_idt_entry(14, &page_fault, 0); 325 set_idt_entry(0x20, &kernel_entry, 3); 326 327 pt_env->pt_pool_pa = AT_PAGING_STRUCTURES_PHYS; 328 pt_env->pt_pool_current = 0; 329 pt_env->pt_levels = page_table_levels; 330 } 331 332 static pt_element_t ac_test_alloc_pt(ac_pt_env_t *pt_env) 333 { 334 pt_element_t pt; 335 336 /* 337 * Each test needs at most pt_levels-1 structures per virtual address, 338 * and no existing scenario uses more than four addresses. 339 */ 340 assert(pt_env->pt_pool_current < (4 * (pt_env->pt_levels - 1))); 341 342 pt = pt_env->pt_pool_pa + (pt_env->pt_pool_current * PAGE_SIZE); 343 pt_env->pt_pool_current++; 344 memset(va(pt), 0, PAGE_SIZE); 345 return pt; 346 } 347 348 static void __ac_test_init(ac_test_t *at, unsigned long virt, 349 ac_pt_env_t *pt_env, ac_test_t *buddy) 350 { 351 unsigned long buddy_virt = buddy ? (unsigned long)buddy->virt : 0; 352 pt_element_t *root_pt = va(shadow_cr3 & PT_BASE_ADDR_MASK); 353 int i; 354 355 /* 356 * The test infrastructure, e.g. this function, must use a different 357 * top-level SPTE than the test, otherwise modifying SPTEs can affect 358 * normal behavior, e.g. crash the test due to marking code SPTEs 359 * USER when CR4.SMEP=1. 360 */ 361 assert(PT_INDEX(virt, pt_env->pt_levels) != 362 PT_INDEX((unsigned long)__ac_test_init, pt_env->pt_levels)); 363 364 set_efer_nx(1); 365 set_cr0_wp(1); 366 at->flags = 0; 367 at->virt = (void *)virt; 368 at->phys = AT_CODE_DATA_PHYS; 369 at->pt_levels = pt_env->pt_levels; 370 371 at->page_tables[0] = -1ull; 372 at->page_tables[1] = -1ull; 373 374 /* 375 * Zap the existing top-level PTE as it may be reused from a previous 376 * sub-test. This allows runtime PTE modification to assert that two 377 * overlapping walks don't try to install different paging structures. 378 */ 379 root_pt[PT_INDEX(virt, pt_env->pt_levels)] = 0; 380 381 for (i = at->pt_levels; i > 1; i--) { 382 /* 383 * Buddies can reuse any part of the walk that share the same 384 * index. This is weird, but intentional, as several tests 385 * want different walks to merge at lower levels. 386 */ 387 if (buddy && PT_INDEX(virt, i) == PT_INDEX(buddy_virt, i)) 388 at->page_tables[i] = buddy->page_tables[i]; 389 else 390 at->page_tables[i] = ac_test_alloc_pt(pt_env); 391 } 392 } 393 394 static void ac_test_init(ac_test_t *at, unsigned long virt, ac_pt_env_t *pt_env) 395 { 396 __ac_test_init(at, virt, pt_env, NULL); 397 } 398 399 static int ac_test_bump_one(ac_test_t *at) 400 { 401 at->flags = ((at->flags | invalid_mask) + 1) & ~invalid_mask; 402 return at->flags < (1 << NR_AC_FLAGS); 403 } 404 405 #define F(x) ((flags & x##_MASK) != 0) 406 407 static _Bool ac_test_legal(ac_test_t *at) 408 { 409 int flags = at->flags; 410 unsigned reserved; 411 412 if (F(AC_CPU_CR4_SMEP)) 413 return false; 414 415 if (F(AC_ACCESS_FETCH) && F(AC_ACCESS_WRITE)) 416 return false; 417 418 /* 419 * Since we convert current page to kernel page when cr4.smep=1, 420 * we can't switch to user mode. 421 */ 422 if (F(AC_ACCESS_USER) && F(AC_CPU_CR4_SMEP)) 423 return false; 424 425 /* 426 * Only test protection key faults if CR4.PKE=1. 427 */ 428 if (!F(AC_CPU_CR4_PKE) && 429 (F(AC_PKU_AD) || F(AC_PKU_WD))) { 430 return false; 431 } 432 433 /* 434 * pde.bit13 checks handling of reserved bits in largepage PDEs. It is 435 * meaningless if there is a PTE. 436 */ 437 if (!F(AC_PDE_PSE) && F(AC_PDE_BIT13)) 438 return false; 439 440 /* 441 * Shorten the test by avoiding testing too many reserved bit combinations. 442 * Skip testing multiple reserved bits to shorten the test. Reserved bit 443 * page faults are terminal and multiple reserved bits do not affect the 444 * error code; the odds of a KVM bug are super low, and the odds of actually 445 * being able to detect a bug are even lower. 446 */ 447 reserved = (AC_PDE_BIT51_MASK | AC_PDE_BIT36_MASK | AC_PDE_BIT13_MASK | 448 AC_PTE_BIT51_MASK | AC_PTE_BIT36_MASK); 449 if (!F(AC_CPU_EFER_NX)) 450 reserved |= AC_PDE_NX_MASK | AC_PTE_NX_MASK; 451 452 /* Only test one reserved bit at a time. */ 453 reserved &= flags; 454 if (reserved & (reserved - 1)) 455 return false; 456 457 return true; 458 } 459 460 static int ac_test_bump(ac_test_t *at) 461 { 462 int ret; 463 464 do { 465 ret = ac_test_bump_one(at); 466 } while (ret && !ac_test_legal(at)); 467 468 return ret; 469 } 470 471 static pt_element_t ac_test_permissions(ac_test_t *at, unsigned flags, 472 bool writable, bool user, 473 bool executable) 474 { 475 bool kwritable = !F(AC_CPU_CR0_WP) && !F(AC_ACCESS_USER); 476 pt_element_t expected = 0; 477 478 if (F(AC_ACCESS_USER) && !user) 479 at->expected_fault = 1; 480 481 if (F(AC_ACCESS_WRITE) && !writable && !kwritable) 482 at->expected_fault = 1; 483 484 if (F(AC_ACCESS_FETCH) && !executable) 485 at->expected_fault = 1; 486 487 if (F(AC_ACCESS_FETCH) && user && F(AC_CPU_CR4_SMEP)) 488 at->expected_fault = 1; 489 490 if (user && !F(AC_ACCESS_FETCH) && F(AC_PKU_PKEY) && F(AC_CPU_CR4_PKE)) { 491 if (F(AC_PKU_AD)) { 492 at->expected_fault = 1; 493 at->expected_error |= PFERR_PK_MASK; 494 } else if (F(AC_ACCESS_WRITE) && F(AC_PKU_WD) && !kwritable) { 495 at->expected_fault = 1; 496 at->expected_error |= PFERR_PK_MASK; 497 } 498 } 499 500 if (!at->expected_fault) { 501 expected |= PT_ACCESSED_MASK; 502 if (F(AC_ACCESS_WRITE)) 503 expected |= PT_DIRTY_MASK; 504 } 505 506 return expected; 507 } 508 509 static void ac_emulate_access(ac_test_t *at, unsigned flags) 510 { 511 bool pde_valid, pte_valid; 512 bool user, writable, executable; 513 514 if (F(AC_ACCESS_USER)) 515 at->expected_error |= PFERR_USER_MASK; 516 517 if (F(AC_ACCESS_WRITE)) 518 at->expected_error |= PFERR_WRITE_MASK; 519 520 if (F(AC_ACCESS_FETCH)) 521 at->expected_error |= PFERR_FETCH_MASK; 522 523 if (!F(AC_PDE_ACCESSED)) 524 at->ignore_pde = PT_ACCESSED_MASK; 525 526 pde_valid = F(AC_PDE_PRESENT) 527 && !F(AC_PDE_BIT51) && !F(AC_PDE_BIT36) && !F(AC_PDE_BIT13) 528 && !(F(AC_PDE_NX) && !F(AC_CPU_EFER_NX)); 529 530 if (!pde_valid) { 531 at->expected_fault = 1; 532 if (F(AC_PDE_PRESENT)) { 533 at->expected_error |= PFERR_RESERVED_MASK; 534 } else { 535 at->expected_error &= ~PFERR_PRESENT_MASK; 536 } 537 goto fault; 538 } 539 540 writable = !F(AC_PDPTE_NO_WRITABLE) && F(AC_PDE_WRITABLE); 541 user = F(AC_PDE_USER); 542 executable = !F(AC_PDE_NX); 543 544 if (F(AC_PDE_PSE)) { 545 at->expected_pde |= ac_test_permissions(at, flags, writable, 546 user, executable); 547 goto no_pte; 548 } 549 550 at->expected_pde |= PT_ACCESSED_MASK; 551 552 pte_valid = F(AC_PTE_PRESENT) 553 && !F(AC_PTE_BIT51) && !F(AC_PTE_BIT36) 554 && !(F(AC_PTE_NX) && !F(AC_CPU_EFER_NX)); 555 556 if (!pte_valid) { 557 at->expected_fault = 1; 558 if (F(AC_PTE_PRESENT)) { 559 at->expected_error |= PFERR_RESERVED_MASK; 560 } else { 561 at->expected_error &= ~PFERR_PRESENT_MASK; 562 } 563 goto fault; 564 } 565 566 writable &= F(AC_PTE_WRITABLE); 567 user &= F(AC_PTE_USER); 568 executable &= !F(AC_PTE_NX); 569 570 at->expected_pte |= ac_test_permissions(at, flags, writable, user, 571 executable); 572 573 no_pte: 574 fault: 575 if (!at->expected_fault) 576 at->ignore_pde = 0; 577 if (!F(AC_CPU_EFER_NX) && !F(AC_CPU_CR4_SMEP)) 578 at->expected_error &= ~PFERR_FETCH_MASK; 579 } 580 581 static void ac_set_expected_status(ac_test_t *at) 582 { 583 invlpg(at->virt); 584 585 if (at->ptep) 586 at->expected_pte = *at->ptep; 587 at->expected_pde = *at->pdep; 588 at->ignore_pde = 0; 589 at->expected_fault = 0; 590 at->expected_error = PFERR_PRESENT_MASK; 591 592 if (at->flags & AC_ACCESS_TWICE_MASK) { 593 ac_emulate_access(at, at->flags & 594 ~AC_ACCESS_WRITE_MASK & 595 ~AC_ACCESS_FETCH_MASK & 596 ~AC_ACCESS_USER_MASK); 597 at->expected_fault = 0; 598 at->expected_error = PFERR_PRESENT_MASK; 599 at->ignore_pde = 0; 600 } 601 602 ac_emulate_access(at, at->flags); 603 } 604 605 static pt_element_t ac_get_pt(ac_test_t *at, int i, pt_element_t *ptep) 606 { 607 pt_element_t pte; 608 609 pte = *ptep; 610 if (pte && !(pte & PT_PAGE_SIZE_MASK) && 611 (pte & PT_BASE_ADDR_MASK) != at->page_tables[i]) { 612 printf("\nPT collision. VA = 0x%lx, level = %d, index = %ld, found PT = 0x%lx, want PT = 0x%lx\n", 613 (unsigned long)at->virt, i, 614 PT_INDEX((unsigned long)at->virt, i), 615 pte, at->page_tables[i]); 616 abort(); 617 } 618 619 /* 620 * Preserve A/D bits to avoid writing upper level PTEs, 621 * which cannot be unsyc'd when KVM uses shadow paging. 622 */ 623 pte = at->page_tables[i] | (pte & (PT_DIRTY_MASK | PT_ACCESSED_MASK)); 624 return pte; 625 } 626 627 static void ac_test_setup_ptes(ac_test_t *at) 628 { 629 unsigned long parent_pte = shadow_cr3; 630 int flags = at->flags; 631 int i; 632 633 at->ptep = 0; 634 for (i = at->pt_levels; i >= 1 && (i >= 2 || !F(AC_PDE_PSE)); --i) { 635 pt_element_t *parent_pt = va(parent_pte & PT_BASE_ADDR_MASK); 636 unsigned index = PT_INDEX((unsigned long)at->virt, i); 637 pt_element_t *ptep = &parent_pt[index]; 638 pt_element_t pte; 639 640 switch (i) { 641 case 5: 642 case 4: 643 pte = ac_get_pt(at, i, ptep); 644 pte |= PT_PRESENT_MASK | PT_WRITABLE_MASK | PT_USER_MASK; 645 break; 646 case 3: 647 pte = ac_get_pt(at, i, ptep); 648 pte |= PT_PRESENT_MASK | PT_USER_MASK; 649 if (!F(AC_PDPTE_NO_WRITABLE)) 650 pte |= PT_WRITABLE_MASK; 651 break; 652 case 2: 653 if (!F(AC_PDE_PSE)) { 654 pte = ac_get_pt(at, i, ptep); 655 656 /* The protection key is ignored on non-leaf entries. */ 657 if (F(AC_PKU_PKEY)) 658 pte |= 2ull << 59; 659 } else { 660 pte = at->phys & PT_PSE_BASE_ADDR_MASK; 661 pte |= PT_PAGE_SIZE_MASK; 662 if (F(AC_PKU_PKEY)) 663 pte |= 1ull << 59; 664 } 665 if (F(AC_PDE_PRESENT)) 666 pte |= PT_PRESENT_MASK; 667 if (F(AC_PDE_WRITABLE)) 668 pte |= PT_WRITABLE_MASK; 669 if (F(AC_PDE_USER)) 670 pte |= PT_USER_MASK; 671 if (F(AC_PDE_ACCESSED)) 672 pte |= PT_ACCESSED_MASK; 673 if (F(AC_PDE_DIRTY)) 674 pte |= PT_DIRTY_MASK; 675 if (F(AC_PDE_NX)) 676 pte |= PT64_NX_MASK; 677 if (F(AC_PDE_BIT51)) 678 pte |= 1ull << 51; 679 if (F(AC_PDE_BIT36)) 680 pte |= 1ull << 36; 681 if (F(AC_PDE_BIT13)) 682 pte |= 1ull << 13; 683 at->pdep = ptep; 684 break; 685 case 1: 686 pte = at->phys & PT_BASE_ADDR_MASK; 687 if (F(AC_PKU_PKEY)) 688 pte |= 1ull << 59; 689 if (F(AC_PTE_PRESENT)) 690 pte |= PT_PRESENT_MASK; 691 if (F(AC_PTE_WRITABLE)) 692 pte |= PT_WRITABLE_MASK; 693 if (F(AC_PTE_USER)) 694 pte |= PT_USER_MASK; 695 if (F(AC_PTE_ACCESSED)) 696 pte |= PT_ACCESSED_MASK; 697 if (F(AC_PTE_DIRTY)) 698 pte |= PT_DIRTY_MASK; 699 if (F(AC_PTE_NX)) 700 pte |= PT64_NX_MASK; 701 if (F(AC_PTE_BIT51)) 702 pte |= 1ull << 51; 703 if (F(AC_PTE_BIT36)) 704 pte |= 1ull << 36; 705 at->ptep = ptep; 706 break; 707 default: 708 assert(0); 709 } 710 711 if (pte != *ptep) 712 *ptep = pte; 713 714 parent_pte = pte; 715 } 716 ac_set_expected_status(at); 717 } 718 719 static void __dump_pte(pt_element_t *ptep, int level, unsigned long virt) 720 { 721 printf("------L%d I%lu: %lx\n", level, PT_INDEX(virt, level), *ptep); 722 } 723 724 static void dump_mapping(ac_test_t *at) 725 { 726 unsigned long virt = (unsigned long)at->virt; 727 int flags = at->flags; 728 729 printf("Dump mapping: address: %p\n", at->virt); 730 walk_va(at, F(AC_PDE_PSE) ? 2 : 1, virt, __dump_pte, false); 731 } 732 733 static void ac_test_check(ac_test_t *at, _Bool *success_ret, _Bool cond, 734 const char *fmt, ...) 735 { 736 va_list ap; 737 char buf[500]; 738 739 if (!*success_ret) { 740 return; 741 } 742 743 if (!cond) { 744 return; 745 } 746 747 *success_ret = false; 748 749 if (!verbose) { 750 puts("\n"); 751 ac_test_show(at); 752 } 753 754 va_start(ap, fmt); 755 vsnprintf(buf, sizeof(buf), fmt, ap); 756 va_end(ap); 757 printf("FAIL: %s\n", buf); 758 dump_mapping(at); 759 } 760 761 static int pt_match(pt_element_t pte1, pt_element_t pte2, pt_element_t ignore) 762 { 763 pte1 &= ~ignore; 764 pte2 &= ~ignore; 765 return pte1 == pte2; 766 } 767 768 static int ac_test_do_access(ac_test_t *at) 769 { 770 static unsigned unique = 42; 771 int fault = 0; 772 unsigned e; 773 static unsigned char user_stack[4096]; 774 unsigned long rsp; 775 _Bool success = true; 776 int flags = at->flags; 777 778 ++unique; 779 if (!(unique & 65535)) { 780 puts("."); 781 } 782 783 *((unsigned char *)at->phys) = 0xc3; /* ret */ 784 785 unsigned r = unique; 786 set_cr0_wp(F(AC_CPU_CR0_WP)); 787 set_efer_nx(F(AC_CPU_EFER_NX)); 788 set_cr4_pke(F(AC_CPU_CR4_PKE)); 789 if (F(AC_CPU_CR4_PKE)) { 790 /* WD2=AD2=1, WD1=F(AC_PKU_WD), AD1=F(AC_PKU_AD) */ 791 write_pkru(0x30 | (F(AC_PKU_WD) ? 8 : 0) | 792 (F(AC_PKU_AD) ? 4 : 0)); 793 } 794 795 set_cr4_smep(at, F(AC_CPU_CR4_SMEP)); 796 797 if (F(AC_ACCESS_TWICE)) { 798 asm volatile ("mov $fixed2, %%rsi \n\t" 799 "mov (%[addr]), %[reg] \n\t" 800 "fixed2:" 801 : [reg]"=r"(r), [fault]"=a"(fault), "=b"(e) 802 : [addr]"r"(at->virt) 803 : "rsi"); 804 fault = 0; 805 } 806 807 asm volatile ("mov $fixed1, %%rsi \n\t" 808 "mov %%rsp, %[rsp0] \n\t" 809 "cmp $0, %[user] \n\t" 810 "jz do_access \n\t" 811 "push %%rax; mov %[user_ds], %%ax; mov %%ax, %%ds; pop %%rax \n\t" 812 "pushq %[user_ds] \n\t" 813 "pushq %[user_stack_top] \n\t" 814 "pushfq \n\t" 815 "pushq %[user_cs] \n\t" 816 "pushq $do_access \n\t" 817 "iretq \n" 818 "do_access: \n\t" 819 "cmp $0, %[fetch] \n\t" 820 "jnz 2f \n\t" 821 "cmp $0, %[write] \n\t" 822 "jnz 1f \n\t" 823 "mov (%[addr]), %[reg] \n\t" 824 "jmp done \n\t" 825 "1: mov %[reg], (%[addr]) \n\t" 826 "jmp done \n\t" 827 "2: call *%[addr] \n\t" 828 "done: \n" 829 "fixed1: \n" 830 "int %[kernel_entry_vector] \n\t" 831 ".section .text.entry \n\t" 832 "kernel_entry: \n\t" 833 "mov %[rsp0], %%rsp \n\t" 834 "jmp back_to_kernel \n\t" 835 ".section .text \n\t" 836 "back_to_kernel:" 837 : [reg]"+r"(r), "+a"(fault), "=b"(e), "=&d"(rsp), 838 [rsp0]"=m"(tss[0].rsp0) 839 : [addr]"r"(at->virt), 840 [write]"r"(F(AC_ACCESS_WRITE)), 841 [user]"r"(F(AC_ACCESS_USER)), 842 [fetch]"r"(F(AC_ACCESS_FETCH)), 843 [user_ds]"i"(USER_DS), 844 [user_cs]"i"(USER_CS), 845 [user_stack_top]"r"(user_stack + sizeof user_stack), 846 [kernel_entry_vector]"i"(0x20) 847 : "rsi"); 848 849 asm volatile (".section .text.pf \n\t" 850 "page_fault: \n\t" 851 "pop %rbx \n\t" 852 "mov %rsi, (%rsp) \n\t" 853 "movl $1, %eax \n\t" 854 "iretq \n\t" 855 ".section .text"); 856 857 ac_test_check(at, &success, fault && !at->expected_fault, 858 "unexpected fault"); 859 ac_test_check(at, &success, !fault && at->expected_fault, 860 "unexpected access"); 861 ac_test_check(at, &success, fault && e != at->expected_error, 862 "error code %x expected %x", e, at->expected_error); 863 if (at->ptep) 864 ac_test_check(at, &success, *at->ptep != at->expected_pte, 865 "pte %x expected %x", *at->ptep, at->expected_pte); 866 ac_test_check(at, &success, 867 !pt_match(*at->pdep, at->expected_pde, at->ignore_pde), 868 "pde %x expected %x", *at->pdep, at->expected_pde); 869 870 if (success && verbose) { 871 if (at->expected_fault) { 872 printf("PASS (%x)\n", at->expected_error); 873 } else { 874 printf("PASS\n"); 875 } 876 } 877 return success; 878 } 879 880 static void ac_test_show(ac_test_t *at) 881 { 882 char line[5000]; 883 884 *line = 0; 885 strcat(line, "test"); 886 for (int i = 0; i < NR_AC_FLAGS; ++i) 887 if (at->flags & (1 << i)) { 888 strcat(line, " "); 889 strcat(line, ac_names[i]); 890 } 891 892 strcat(line, ": "); 893 printf("%s", line); 894 } 895 896 /* 897 * This test case is used to triger the bug which is fixed by 898 * commit e09e90a5 in the kvm tree 899 */ 900 static int corrupt_hugepage_triger(ac_pt_env_t *pt_env) 901 { 902 ac_test_t at1, at2; 903 904 ac_test_init(&at1, 0xffff923400000000ul, pt_env); 905 __ac_test_init(&at2, 0xffffe66600000000ul, pt_env, &at1); 906 907 at2.flags = AC_CPU_CR0_WP_MASK | AC_PDE_PSE_MASK | AC_PDE_PRESENT_MASK; 908 ac_test_setup_ptes(&at2); 909 if (!ac_test_do_access(&at2)) 910 goto err; 911 912 at1.flags = at2.flags | AC_PDE_WRITABLE_MASK; 913 ac_test_setup_ptes(&at1); 914 if (!ac_test_do_access(&at1)) 915 goto err; 916 917 at1.flags |= AC_ACCESS_WRITE_MASK; 918 ac_set_expected_status(&at1); 919 if (!ac_test_do_access(&at1)) 920 goto err; 921 922 at2.flags |= AC_ACCESS_WRITE_MASK; 923 ac_set_expected_status(&at2); 924 if (!ac_test_do_access(&at2)) 925 goto err; 926 927 return 1; 928 929 err: 930 printf("corrupt_hugepage_triger test fail\n"); 931 return 0; 932 } 933 934 /* 935 * This test case is used to triger the bug which is fixed by 936 * commit 3ddf6c06e13e in the kvm tree 937 */ 938 static int check_pfec_on_prefetch_pte(ac_pt_env_t *pt_env) 939 { 940 ac_test_t at1, at2; 941 942 ac_test_init(&at1, 0xffff923406001000ul, pt_env); 943 __ac_test_init(&at2, 0xffff923406003000ul, pt_env, &at1); 944 945 at1.flags = AC_PDE_PRESENT_MASK | AC_PTE_PRESENT_MASK; 946 ac_test_setup_ptes(&at1); 947 948 at2.flags = at1.flags | AC_PTE_NX_MASK; 949 ac_test_setup_ptes(&at2); 950 951 if (!ac_test_do_access(&at1)) { 952 printf("%s: prepare fail\n", __FUNCTION__); 953 goto err; 954 } 955 956 if (!ac_test_do_access(&at2)) { 957 printf("%s: check PFEC on prefetch pte path fail\n", 958 __FUNCTION__); 959 goto err; 960 } 961 962 return 1; 963 964 err: 965 return 0; 966 } 967 968 /* 969 * If the write-fault access is from supervisor and CR0.WP is not set on the 970 * vcpu, kvm will fix it by adjusting pte access - it sets the W bit on pte 971 * and clears U bit. This is the chance that kvm can change pte access from 972 * readonly to writable. 973 * 974 * Unfortunately, the pte access is the access of 'direct' shadow page table, 975 * means direct sp.role.access = pte_access, then we will create a writable 976 * spte entry on the readonly shadow page table. It will cause Dirty bit is 977 * not tracked when two guest ptes point to the same large page. Note, it 978 * does not have other impact except Dirty bit since cr0.wp is encoded into 979 * sp.role. 980 * 981 * Note: to trigger this bug, hugepage should be disabled on host. 982 */ 983 static int check_large_pte_dirty_for_nowp(ac_pt_env_t *pt_env) 984 { 985 ac_test_t at1, at2; 986 987 ac_test_init(&at1, 0xffff923403000000ul, pt_env); 988 __ac_test_init(&at2, 0xffffe66606000000ul, pt_env, &at1); 989 990 at2.flags = AC_PDE_PRESENT_MASK | AC_PDE_PSE_MASK; 991 ac_test_setup_ptes(&at2); 992 if (!ac_test_do_access(&at2)) { 993 printf("%s: read on the first mapping fail.\n", __FUNCTION__); 994 goto err; 995 } 996 997 at1.flags = at2.flags | AC_ACCESS_WRITE_MASK; 998 ac_test_setup_ptes(&at1); 999 if (!ac_test_do_access(&at1)) { 1000 printf("%s: write on the second mapping fail.\n", __FUNCTION__); 1001 goto err; 1002 } 1003 1004 at2.flags |= AC_ACCESS_WRITE_MASK; 1005 ac_set_expected_status(&at2); 1006 if (!ac_test_do_access(&at2)) { 1007 printf("%s: write on the first mapping fail.\n", __FUNCTION__); 1008 goto err; 1009 } 1010 1011 return 1; 1012 1013 err: 1014 return 0; 1015 } 1016 1017 static int check_smep_andnot_wp(ac_pt_env_t *pt_env) 1018 { 1019 ac_test_t at1; 1020 int err_prepare_andnot_wp, err_smep_andnot_wp; 1021 1022 if (!this_cpu_has(X86_FEATURE_SMEP)) { 1023 return 1; 1024 } 1025 1026 ac_test_init(&at1, 0xffff923406001000ul, pt_env); 1027 1028 at1.flags = AC_PDE_PRESENT_MASK | AC_PTE_PRESENT_MASK | 1029 AC_PDE_USER_MASK | AC_PTE_USER_MASK | 1030 AC_PDE_ACCESSED_MASK | AC_PTE_ACCESSED_MASK | 1031 AC_CPU_CR4_SMEP_MASK | 1032 AC_CPU_CR0_WP_MASK | 1033 AC_ACCESS_WRITE_MASK; 1034 ac_test_setup_ptes(&at1); 1035 1036 /* 1037 * Here we write the ro user page when 1038 * cr0.wp=0, then we execute it and SMEP 1039 * fault should happen. 1040 */ 1041 err_prepare_andnot_wp = ac_test_do_access(&at1); 1042 if (!err_prepare_andnot_wp) { 1043 printf("%s: SMEP prepare fail\n", __FUNCTION__); 1044 goto clean_up; 1045 } 1046 1047 at1.flags &= ~AC_ACCESS_WRITE_MASK; 1048 at1.flags |= AC_ACCESS_FETCH_MASK; 1049 ac_set_expected_status(&at1); 1050 err_smep_andnot_wp = ac_test_do_access(&at1); 1051 1052 clean_up: 1053 set_cr4_smep(&at1, 0); 1054 1055 if (!err_prepare_andnot_wp) 1056 goto err; 1057 if (!err_smep_andnot_wp) { 1058 printf("%s: check SMEP without wp fail\n", __FUNCTION__); 1059 goto err; 1060 } 1061 return 1; 1062 1063 err: 1064 return 0; 1065 } 1066 1067 static int check_effective_sp_permissions(ac_pt_env_t *pt_env) 1068 { 1069 unsigned long ptr1 = 0xffff923480000000; 1070 unsigned long ptr2 = ptr1 + SZ_2M; 1071 unsigned long ptr3 = ptr1 + SZ_1G; 1072 unsigned long ptr4 = ptr3 + SZ_2M; 1073 ac_test_t at1, at2, at3, at4; 1074 int err_read_at1, err_write_at2; 1075 int err_read_at3, err_write_at4; 1076 1077 /* 1078 * pgd[] pud[] pmd[] virtual address pointers 1079 * /->pmd(u--)->pte1(uw-)->page1 <- ptr1 (u--) 1080 * /->pud1(uw-)--->pmd(uw-)->pte2(uw-)->page2 <- ptr2 (uw-) 1081 * pgd-| 1082 * \->pud2(u--)--->pmd(u--)->pte1(uw-)->page1 <- ptr3 (u--) 1083 * \->pmd(uw-)->pte2(uw-)->page2 <- ptr4 (u--) 1084 * pud1 and pud2 point to the same pmd page. 1085 */ 1086 1087 ac_test_init(&at1, ptr1, pt_env); 1088 at1.flags = AC_PDE_PRESENT_MASK | AC_PTE_PRESENT_MASK | 1089 AC_PDE_USER_MASK | AC_PTE_USER_MASK | 1090 AC_PDE_ACCESSED_MASK | AC_PTE_ACCESSED_MASK | 1091 AC_PTE_WRITABLE_MASK | AC_ACCESS_USER_MASK; 1092 ac_test_setup_ptes(&at1); 1093 1094 __ac_test_init(&at2, ptr2, pt_env, &at1); 1095 at2.flags = at1.flags | AC_PDE_WRITABLE_MASK | AC_PTE_DIRTY_MASK | AC_ACCESS_WRITE_MASK; 1096 ac_test_setup_ptes(&at2); 1097 1098 __ac_test_init(&at3, ptr3, pt_env, &at1); 1099 /* Override the PMD (1-based index) to point at ptr1's PMD. */ 1100 at3.page_tables[3] = at1.page_tables[3]; 1101 at3.flags = AC_PDPTE_NO_WRITABLE_MASK | at1.flags; 1102 ac_test_setup_ptes(&at3); 1103 1104 /* Alias ptr2, only the PMD will differ; manually override the PMD. */ 1105 __ac_test_init(&at4, ptr4, pt_env, &at2); 1106 at4.page_tables[3] = at1.page_tables[3]; 1107 at4.flags = AC_PDPTE_NO_WRITABLE_MASK | at2.flags; 1108 ac_test_setup_ptes(&at4); 1109 1110 err_read_at1 = ac_test_do_access(&at1); 1111 if (!err_read_at1) { 1112 printf("%s: read access at1 fail\n", __FUNCTION__); 1113 return 0; 1114 } 1115 1116 err_write_at2 = ac_test_do_access(&at2); 1117 if (!err_write_at2) { 1118 printf("%s: write access at2 fail\n", __FUNCTION__); 1119 return 0; 1120 } 1121 1122 err_read_at3 = ac_test_do_access(&at3); 1123 if (!err_read_at3) { 1124 printf("%s: read access at3 fail\n", __FUNCTION__); 1125 return 0; 1126 } 1127 1128 err_write_at4 = ac_test_do_access(&at4); 1129 if (!err_write_at4) { 1130 printf("%s: write access at4 should fail\n", __FUNCTION__); 1131 return 0; 1132 } 1133 1134 return 1; 1135 } 1136 1137 static int ac_test_exec(ac_test_t *at, ac_pt_env_t *pt_env) 1138 { 1139 int r; 1140 1141 if (verbose) { 1142 ac_test_show(at); 1143 } 1144 ac_test_setup_ptes(at); 1145 r = ac_test_do_access(at); 1146 return r; 1147 } 1148 1149 typedef int (*ac_test_fn)(ac_pt_env_t *pt_env); 1150 const ac_test_fn ac_test_cases[] = 1151 { 1152 corrupt_hugepage_triger, 1153 check_pfec_on_prefetch_pte, 1154 check_large_pte_dirty_for_nowp, 1155 check_smep_andnot_wp, 1156 check_effective_sp_permissions, 1157 }; 1158 1159 int ac_test_run(int pt_levels) 1160 { 1161 ac_test_t at; 1162 ac_pt_env_t pt_env; 1163 int i, tests, successes; 1164 1165 printf("run\n"); 1166 tests = successes = 0; 1167 1168 shadow_cr0 = read_cr0(); 1169 shadow_cr4 = read_cr4(); 1170 shadow_cr3 = read_cr3(); 1171 shadow_efer = rdmsr(MSR_EFER); 1172 1173 if (cpuid_maxphyaddr() >= 52) { 1174 invalid_mask |= AC_PDE_BIT51_MASK; 1175 invalid_mask |= AC_PTE_BIT51_MASK; 1176 } 1177 if (cpuid_maxphyaddr() >= 37) { 1178 invalid_mask |= AC_PDE_BIT36_MASK; 1179 invalid_mask |= AC_PTE_BIT36_MASK; 1180 } 1181 1182 ac_env_int(&pt_env, pt_levels); 1183 ac_test_init(&at, 0xffff923400000000ul, &pt_env); 1184 1185 if (this_cpu_has(X86_FEATURE_PKU)) { 1186 set_cr4_pke(1); 1187 set_cr4_pke(0); 1188 /* Now PKRU = 0xFFFFFFFF. */ 1189 } else { 1190 tests++; 1191 if (write_cr4_checking(shadow_cr4 | X86_CR4_PKE) == GP_VECTOR) { 1192 successes++; 1193 invalid_mask |= AC_PKU_AD_MASK; 1194 invalid_mask |= AC_PKU_WD_MASK; 1195 invalid_mask |= AC_PKU_PKEY_MASK; 1196 invalid_mask |= AC_CPU_CR4_PKE_MASK; 1197 printf("CR4.PKE not available, disabling PKE tests\n"); 1198 } else { 1199 printf("Set PKE in CR4 - expect #GP: FAIL!\n"); 1200 set_cr4_pke(0); 1201 } 1202 } 1203 1204 if (!this_cpu_has(X86_FEATURE_SMEP)) { 1205 tests++; 1206 if (set_cr4_smep(&at, 1) == GP_VECTOR) { 1207 successes++; 1208 invalid_mask |= AC_CPU_CR4_SMEP_MASK; 1209 printf("CR4.SMEP not available, disabling SMEP tests\n"); 1210 } else { 1211 printf("Set SMEP in CR4 - expect #GP: FAIL!\n"); 1212 set_cr4_smep(&at, 0); 1213 } 1214 } 1215 1216 /* Toggling LA57 in 64-bit mode (guaranteed for this test) is illegal. */ 1217 if (this_cpu_has(X86_FEATURE_LA57)) { 1218 tests++; 1219 if (write_cr4_checking(shadow_cr4 ^ X86_CR4_LA57) == GP_VECTOR) 1220 successes++; 1221 1222 /* Force a VM-Exit on KVM, which doesn't intercept LA57 itself. */ 1223 tests++; 1224 if (write_cr4_checking(shadow_cr4 ^ (X86_CR4_LA57 | X86_CR4_PSE)) == GP_VECTOR) 1225 successes++; 1226 } 1227 1228 do { 1229 ++tests; 1230 successes += ac_test_exec(&at, &pt_env); 1231 } while (ac_test_bump(&at)); 1232 1233 for (i = 0; i < ARRAY_SIZE(ac_test_cases); i++) { 1234 ac_env_int(&pt_env, pt_levels); 1235 1236 ++tests; 1237 successes += ac_test_cases[i](&pt_env); 1238 } 1239 1240 printf("\n%d tests, %d failures\n", tests, tests - successes); 1241 1242 return successes == tests; 1243 } 1244