1ad879127SKrish Sadhukhan #include "svm.h" 2ad879127SKrish Sadhukhan #include "libcflat.h" 3ad879127SKrish Sadhukhan #include "processor.h" 4ad879127SKrish Sadhukhan #include "desc.h" 5ad879127SKrish Sadhukhan #include "msr.h" 6ad879127SKrish Sadhukhan #include "vm.h" 7ad879127SKrish Sadhukhan #include "smp.h" 8ad879127SKrish Sadhukhan #include "types.h" 9ad879127SKrish Sadhukhan #include "alloc_page.h" 10ad879127SKrish Sadhukhan #include "isr.h" 11ad879127SKrish Sadhukhan #include "apic.h" 129da1f4d8SCathy Avery #include "delay.h" 13ad879127SKrish Sadhukhan 14ad879127SKrish Sadhukhan #define SVM_EXIT_MAX_DR_INTERCEPT 0x3f 15ad879127SKrish Sadhukhan 16ad879127SKrish Sadhukhan static void *scratch_page; 17ad879127SKrish Sadhukhan 18ad879127SKrish Sadhukhan #define LATENCY_RUNS 1000000 19ad879127SKrish Sadhukhan 204770e9c8SCathy Avery extern u16 cpu_online_count; 214770e9c8SCathy Avery 22ad879127SKrish Sadhukhan u64 tsc_start; 23ad879127SKrish Sadhukhan u64 tsc_end; 24ad879127SKrish Sadhukhan 25ad879127SKrish Sadhukhan u64 vmrun_sum, vmexit_sum; 26ad879127SKrish Sadhukhan u64 vmsave_sum, vmload_sum; 27ad879127SKrish Sadhukhan u64 stgi_sum, clgi_sum; 28ad879127SKrish Sadhukhan u64 latvmrun_max; 29ad879127SKrish Sadhukhan u64 latvmrun_min; 30ad879127SKrish Sadhukhan u64 latvmexit_max; 31ad879127SKrish Sadhukhan u64 latvmexit_min; 32ad879127SKrish Sadhukhan u64 latvmload_max; 33ad879127SKrish Sadhukhan u64 latvmload_min; 34ad879127SKrish Sadhukhan u64 latvmsave_max; 35ad879127SKrish Sadhukhan u64 latvmsave_min; 36ad879127SKrish Sadhukhan u64 latstgi_max; 37ad879127SKrish Sadhukhan u64 latstgi_min; 38ad879127SKrish Sadhukhan u64 latclgi_max; 39ad879127SKrish Sadhukhan u64 latclgi_min; 40ad879127SKrish Sadhukhan u64 runs; 41ad879127SKrish Sadhukhan 42ad879127SKrish Sadhukhan static void null_test(struct svm_test *test) 43ad879127SKrish Sadhukhan { 44ad879127SKrish Sadhukhan } 45ad879127SKrish Sadhukhan 46ad879127SKrish Sadhukhan static bool null_check(struct svm_test *test) 47ad879127SKrish Sadhukhan { 48096cf7feSPaolo Bonzini return vmcb->control.exit_code == SVM_EXIT_VMMCALL; 49ad879127SKrish Sadhukhan } 50ad879127SKrish Sadhukhan 51ad879127SKrish Sadhukhan static void prepare_no_vmrun_int(struct svm_test *test) 52ad879127SKrish Sadhukhan { 53096cf7feSPaolo Bonzini vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMRUN); 54ad879127SKrish Sadhukhan } 55ad879127SKrish Sadhukhan 56ad879127SKrish Sadhukhan static bool check_no_vmrun_int(struct svm_test *test) 57ad879127SKrish Sadhukhan { 58096cf7feSPaolo Bonzini return vmcb->control.exit_code == SVM_EXIT_ERR; 59ad879127SKrish Sadhukhan } 60ad879127SKrish Sadhukhan 61ad879127SKrish Sadhukhan static void test_vmrun(struct svm_test *test) 62ad879127SKrish Sadhukhan { 63096cf7feSPaolo Bonzini asm volatile ("vmrun %0" : : "a"(virt_to_phys(vmcb))); 64ad879127SKrish Sadhukhan } 65ad879127SKrish Sadhukhan 66ad879127SKrish Sadhukhan static bool check_vmrun(struct svm_test *test) 67ad879127SKrish Sadhukhan { 68096cf7feSPaolo Bonzini return vmcb->control.exit_code == SVM_EXIT_VMRUN; 69ad879127SKrish Sadhukhan } 70ad879127SKrish Sadhukhan 71401299a5SPaolo Bonzini static void prepare_rsm_intercept(struct svm_test *test) 72401299a5SPaolo Bonzini { 73401299a5SPaolo Bonzini default_prepare(test); 74401299a5SPaolo Bonzini vmcb->control.intercept |= 1 << INTERCEPT_RSM; 75401299a5SPaolo Bonzini vmcb->control.intercept_exceptions |= (1ULL << UD_VECTOR); 76401299a5SPaolo Bonzini } 77401299a5SPaolo Bonzini 78401299a5SPaolo Bonzini static void test_rsm_intercept(struct svm_test *test) 79401299a5SPaolo Bonzini { 80401299a5SPaolo Bonzini asm volatile ("rsm" : : : "memory"); 81401299a5SPaolo Bonzini } 82401299a5SPaolo Bonzini 83401299a5SPaolo Bonzini static bool check_rsm_intercept(struct svm_test *test) 84401299a5SPaolo Bonzini { 85401299a5SPaolo Bonzini return get_test_stage(test) == 2; 86401299a5SPaolo Bonzini } 87401299a5SPaolo Bonzini 88401299a5SPaolo Bonzini static bool finished_rsm_intercept(struct svm_test *test) 89401299a5SPaolo Bonzini { 90401299a5SPaolo Bonzini switch (get_test_stage(test)) { 91401299a5SPaolo Bonzini case 0: 92401299a5SPaolo Bonzini if (vmcb->control.exit_code != SVM_EXIT_RSM) { 93401299a5SPaolo Bonzini report(false, "VMEXIT not due to rsm. Exit reason 0x%x", 94401299a5SPaolo Bonzini vmcb->control.exit_code); 95401299a5SPaolo Bonzini return true; 96401299a5SPaolo Bonzini } 97401299a5SPaolo Bonzini vmcb->control.intercept &= ~(1 << INTERCEPT_RSM); 98401299a5SPaolo Bonzini inc_test_stage(test); 99401299a5SPaolo Bonzini break; 100401299a5SPaolo Bonzini 101401299a5SPaolo Bonzini case 1: 102401299a5SPaolo Bonzini if (vmcb->control.exit_code != SVM_EXIT_EXCP_BASE + UD_VECTOR) { 103401299a5SPaolo Bonzini report(false, "VMEXIT not due to #UD. Exit reason 0x%x", 104401299a5SPaolo Bonzini vmcb->control.exit_code); 105401299a5SPaolo Bonzini return true; 106401299a5SPaolo Bonzini } 107401299a5SPaolo Bonzini vmcb->save.rip += 2; 108401299a5SPaolo Bonzini inc_test_stage(test); 109401299a5SPaolo Bonzini break; 110401299a5SPaolo Bonzini 111401299a5SPaolo Bonzini default: 112401299a5SPaolo Bonzini return true; 113401299a5SPaolo Bonzini } 114401299a5SPaolo Bonzini return get_test_stage(test) == 2; 115401299a5SPaolo Bonzini } 116401299a5SPaolo Bonzini 117ad879127SKrish Sadhukhan static void prepare_cr3_intercept(struct svm_test *test) 118ad879127SKrish Sadhukhan { 119ad879127SKrish Sadhukhan default_prepare(test); 120096cf7feSPaolo Bonzini vmcb->control.intercept_cr_read |= 1 << 3; 121ad879127SKrish Sadhukhan } 122ad879127SKrish Sadhukhan 123ad879127SKrish Sadhukhan static void test_cr3_intercept(struct svm_test *test) 124ad879127SKrish Sadhukhan { 125ad879127SKrish Sadhukhan asm volatile ("mov %%cr3, %0" : "=r"(test->scratch) : : "memory"); 126ad879127SKrish Sadhukhan } 127ad879127SKrish Sadhukhan 128ad879127SKrish Sadhukhan static bool check_cr3_intercept(struct svm_test *test) 129ad879127SKrish Sadhukhan { 130096cf7feSPaolo Bonzini return vmcb->control.exit_code == SVM_EXIT_READ_CR3; 131ad879127SKrish Sadhukhan } 132ad879127SKrish Sadhukhan 133ad879127SKrish Sadhukhan static bool check_cr3_nointercept(struct svm_test *test) 134ad879127SKrish Sadhukhan { 135ad879127SKrish Sadhukhan return null_check(test) && test->scratch == read_cr3(); 136ad879127SKrish Sadhukhan } 137ad879127SKrish Sadhukhan 138ad879127SKrish Sadhukhan static void corrupt_cr3_intercept_bypass(void *_test) 139ad879127SKrish Sadhukhan { 140ad879127SKrish Sadhukhan struct svm_test *test = _test; 141ad879127SKrish Sadhukhan extern volatile u32 mmio_insn; 142ad879127SKrish Sadhukhan 143ad879127SKrish Sadhukhan while (!__sync_bool_compare_and_swap(&test->scratch, 1, 2)) 144ad879127SKrish Sadhukhan pause(); 145ad879127SKrish Sadhukhan pause(); 146ad879127SKrish Sadhukhan pause(); 147ad879127SKrish Sadhukhan pause(); 148ad879127SKrish Sadhukhan mmio_insn = 0x90d8200f; // mov %cr3, %rax; nop 149ad879127SKrish Sadhukhan } 150ad879127SKrish Sadhukhan 151ad879127SKrish Sadhukhan static void prepare_cr3_intercept_bypass(struct svm_test *test) 152ad879127SKrish Sadhukhan { 153ad879127SKrish Sadhukhan default_prepare(test); 154096cf7feSPaolo Bonzini vmcb->control.intercept_cr_read |= 1 << 3; 155ad879127SKrish Sadhukhan on_cpu_async(1, corrupt_cr3_intercept_bypass, test); 156ad879127SKrish Sadhukhan } 157ad879127SKrish Sadhukhan 158ad879127SKrish Sadhukhan static void test_cr3_intercept_bypass(struct svm_test *test) 159ad879127SKrish Sadhukhan { 160ad879127SKrish Sadhukhan ulong a = 0xa0000; 161ad879127SKrish Sadhukhan 162ad879127SKrish Sadhukhan test->scratch = 1; 163ad879127SKrish Sadhukhan while (test->scratch != 2) 164ad879127SKrish Sadhukhan barrier(); 165ad879127SKrish Sadhukhan 166ad879127SKrish Sadhukhan asm volatile ("mmio_insn: mov %0, (%0); nop" 167ad879127SKrish Sadhukhan : "+a"(a) : : "memory"); 168ad879127SKrish Sadhukhan test->scratch = a; 169ad879127SKrish Sadhukhan } 170ad879127SKrish Sadhukhan 171ad879127SKrish Sadhukhan static void prepare_dr_intercept(struct svm_test *test) 172ad879127SKrish Sadhukhan { 173ad879127SKrish Sadhukhan default_prepare(test); 174096cf7feSPaolo Bonzini vmcb->control.intercept_dr_read = 0xff; 175096cf7feSPaolo Bonzini vmcb->control.intercept_dr_write = 0xff; 176ad879127SKrish Sadhukhan } 177ad879127SKrish Sadhukhan 178ad879127SKrish Sadhukhan static void test_dr_intercept(struct svm_test *test) 179ad879127SKrish Sadhukhan { 180ad879127SKrish Sadhukhan unsigned int i, failcnt = 0; 181ad879127SKrish Sadhukhan 182ad879127SKrish Sadhukhan /* Loop testing debug register reads */ 183ad879127SKrish Sadhukhan for (i = 0; i < 8; i++) { 184ad879127SKrish Sadhukhan 185ad879127SKrish Sadhukhan switch (i) { 186ad879127SKrish Sadhukhan case 0: 187ad879127SKrish Sadhukhan asm volatile ("mov %%dr0, %0" : "=r"(test->scratch) : : "memory"); 188ad879127SKrish Sadhukhan break; 189ad879127SKrish Sadhukhan case 1: 190ad879127SKrish Sadhukhan asm volatile ("mov %%dr1, %0" : "=r"(test->scratch) : : "memory"); 191ad879127SKrish Sadhukhan break; 192ad879127SKrish Sadhukhan case 2: 193ad879127SKrish Sadhukhan asm volatile ("mov %%dr2, %0" : "=r"(test->scratch) : : "memory"); 194ad879127SKrish Sadhukhan break; 195ad879127SKrish Sadhukhan case 3: 196ad879127SKrish Sadhukhan asm volatile ("mov %%dr3, %0" : "=r"(test->scratch) : : "memory"); 197ad879127SKrish Sadhukhan break; 198ad879127SKrish Sadhukhan case 4: 199ad879127SKrish Sadhukhan asm volatile ("mov %%dr4, %0" : "=r"(test->scratch) : : "memory"); 200ad879127SKrish Sadhukhan break; 201ad879127SKrish Sadhukhan case 5: 202ad879127SKrish Sadhukhan asm volatile ("mov %%dr5, %0" : "=r"(test->scratch) : : "memory"); 203ad879127SKrish Sadhukhan break; 204ad879127SKrish Sadhukhan case 6: 205ad879127SKrish Sadhukhan asm volatile ("mov %%dr6, %0" : "=r"(test->scratch) : : "memory"); 206ad879127SKrish Sadhukhan break; 207ad879127SKrish Sadhukhan case 7: 208ad879127SKrish Sadhukhan asm volatile ("mov %%dr7, %0" : "=r"(test->scratch) : : "memory"); 209ad879127SKrish Sadhukhan break; 210ad879127SKrish Sadhukhan } 211ad879127SKrish Sadhukhan 212ad879127SKrish Sadhukhan if (test->scratch != i) { 213ad879127SKrish Sadhukhan report(false, "dr%u read intercept", i); 214ad879127SKrish Sadhukhan failcnt++; 215ad879127SKrish Sadhukhan } 216ad879127SKrish Sadhukhan } 217ad879127SKrish Sadhukhan 218ad879127SKrish Sadhukhan /* Loop testing debug register writes */ 219ad879127SKrish Sadhukhan for (i = 0; i < 8; i++) { 220ad879127SKrish Sadhukhan 221ad879127SKrish Sadhukhan switch (i) { 222ad879127SKrish Sadhukhan case 0: 223ad879127SKrish Sadhukhan asm volatile ("mov %0, %%dr0" : : "r"(test->scratch) : "memory"); 224ad879127SKrish Sadhukhan break; 225ad879127SKrish Sadhukhan case 1: 226ad879127SKrish Sadhukhan asm volatile ("mov %0, %%dr1" : : "r"(test->scratch) : "memory"); 227ad879127SKrish Sadhukhan break; 228ad879127SKrish Sadhukhan case 2: 229ad879127SKrish Sadhukhan asm volatile ("mov %0, %%dr2" : : "r"(test->scratch) : "memory"); 230ad879127SKrish Sadhukhan break; 231ad879127SKrish Sadhukhan case 3: 232ad879127SKrish Sadhukhan asm volatile ("mov %0, %%dr3" : : "r"(test->scratch) : "memory"); 233ad879127SKrish Sadhukhan break; 234ad879127SKrish Sadhukhan case 4: 235ad879127SKrish Sadhukhan asm volatile ("mov %0, %%dr4" : : "r"(test->scratch) : "memory"); 236ad879127SKrish Sadhukhan break; 237ad879127SKrish Sadhukhan case 5: 238ad879127SKrish Sadhukhan asm volatile ("mov %0, %%dr5" : : "r"(test->scratch) : "memory"); 239ad879127SKrish Sadhukhan break; 240ad879127SKrish Sadhukhan case 6: 241ad879127SKrish Sadhukhan asm volatile ("mov %0, %%dr6" : : "r"(test->scratch) : "memory"); 242ad879127SKrish Sadhukhan break; 243ad879127SKrish Sadhukhan case 7: 244ad879127SKrish Sadhukhan asm volatile ("mov %0, %%dr7" : : "r"(test->scratch) : "memory"); 245ad879127SKrish Sadhukhan break; 246ad879127SKrish Sadhukhan } 247ad879127SKrish Sadhukhan 248ad879127SKrish Sadhukhan if (test->scratch != i) { 249ad879127SKrish Sadhukhan report(false, "dr%u write intercept", i); 250ad879127SKrish Sadhukhan failcnt++; 251ad879127SKrish Sadhukhan } 252ad879127SKrish Sadhukhan } 253ad879127SKrish Sadhukhan 254ad879127SKrish Sadhukhan test->scratch = failcnt; 255ad879127SKrish Sadhukhan } 256ad879127SKrish Sadhukhan 257ad879127SKrish Sadhukhan static bool dr_intercept_finished(struct svm_test *test) 258ad879127SKrish Sadhukhan { 259096cf7feSPaolo Bonzini ulong n = (vmcb->control.exit_code - SVM_EXIT_READ_DR0); 260ad879127SKrish Sadhukhan 261ad879127SKrish Sadhukhan /* Only expect DR intercepts */ 262ad879127SKrish Sadhukhan if (n > (SVM_EXIT_MAX_DR_INTERCEPT - SVM_EXIT_READ_DR0)) 263ad879127SKrish Sadhukhan return true; 264ad879127SKrish Sadhukhan 265ad879127SKrish Sadhukhan /* 266ad879127SKrish Sadhukhan * Compute debug register number. 267ad879127SKrish Sadhukhan * Per Appendix C "SVM Intercept Exit Codes" of AMD64 Architecture 268ad879127SKrish Sadhukhan * Programmer's Manual Volume 2 - System Programming: 269ad879127SKrish Sadhukhan * http://support.amd.com/TechDocs/24593.pdf 270ad879127SKrish Sadhukhan * there are 16 VMEXIT codes each for DR read and write. 271ad879127SKrish Sadhukhan */ 272ad879127SKrish Sadhukhan test->scratch = (n % 16); 273ad879127SKrish Sadhukhan 274ad879127SKrish Sadhukhan /* Jump over MOV instruction */ 275096cf7feSPaolo Bonzini vmcb->save.rip += 3; 276ad879127SKrish Sadhukhan 277ad879127SKrish Sadhukhan return false; 278ad879127SKrish Sadhukhan } 279ad879127SKrish Sadhukhan 280ad879127SKrish Sadhukhan static bool check_dr_intercept(struct svm_test *test) 281ad879127SKrish Sadhukhan { 282ad879127SKrish Sadhukhan return !test->scratch; 283ad879127SKrish Sadhukhan } 284ad879127SKrish Sadhukhan 285ad879127SKrish Sadhukhan static bool next_rip_supported(void) 286ad879127SKrish Sadhukhan { 287ad879127SKrish Sadhukhan return this_cpu_has(X86_FEATURE_NRIPS); 288ad879127SKrish Sadhukhan } 289ad879127SKrish Sadhukhan 290ad879127SKrish Sadhukhan static void prepare_next_rip(struct svm_test *test) 291ad879127SKrish Sadhukhan { 292096cf7feSPaolo Bonzini vmcb->control.intercept |= (1ULL << INTERCEPT_RDTSC); 293ad879127SKrish Sadhukhan } 294ad879127SKrish Sadhukhan 295ad879127SKrish Sadhukhan 296ad879127SKrish Sadhukhan static void test_next_rip(struct svm_test *test) 297ad879127SKrish Sadhukhan { 298ad879127SKrish Sadhukhan asm volatile ("rdtsc\n\t" 299ad879127SKrish Sadhukhan ".globl exp_next_rip\n\t" 300ad879127SKrish Sadhukhan "exp_next_rip:\n\t" ::: "eax", "edx"); 301ad879127SKrish Sadhukhan } 302ad879127SKrish Sadhukhan 303ad879127SKrish Sadhukhan static bool check_next_rip(struct svm_test *test) 304ad879127SKrish Sadhukhan { 305ad879127SKrish Sadhukhan extern char exp_next_rip; 306ad879127SKrish Sadhukhan unsigned long address = (unsigned long)&exp_next_rip; 307ad879127SKrish Sadhukhan 308096cf7feSPaolo Bonzini return address == vmcb->control.next_rip; 309ad879127SKrish Sadhukhan } 310ad879127SKrish Sadhukhan 311ad879127SKrish Sadhukhan extern u8 *msr_bitmap; 312ad879127SKrish Sadhukhan 313ad879127SKrish Sadhukhan static void prepare_msr_intercept(struct svm_test *test) 314ad879127SKrish Sadhukhan { 315ad879127SKrish Sadhukhan default_prepare(test); 316096cf7feSPaolo Bonzini vmcb->control.intercept |= (1ULL << INTERCEPT_MSR_PROT); 317096cf7feSPaolo Bonzini vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR); 318ad879127SKrish Sadhukhan memset(msr_bitmap, 0xff, MSR_BITMAP_SIZE); 319ad879127SKrish Sadhukhan } 320ad879127SKrish Sadhukhan 321ad879127SKrish Sadhukhan static void test_msr_intercept(struct svm_test *test) 322ad879127SKrish Sadhukhan { 323ad879127SKrish Sadhukhan unsigned long msr_value = 0xef8056791234abcd; /* Arbitrary value */ 324ad879127SKrish Sadhukhan unsigned long msr_index; 325ad879127SKrish Sadhukhan 326ad879127SKrish Sadhukhan for (msr_index = 0; msr_index <= 0xc0011fff; msr_index++) { 327ad879127SKrish Sadhukhan if (msr_index == 0xC0010131 /* MSR_SEV_STATUS */) { 328ad879127SKrish Sadhukhan /* 329ad879127SKrish Sadhukhan * Per section 15.34.10 "SEV_STATUS MSR" of AMD64 Architecture 330ad879127SKrish Sadhukhan * Programmer's Manual volume 2 - System Programming: 331ad879127SKrish Sadhukhan * http://support.amd.com/TechDocs/24593.pdf 332ad879127SKrish Sadhukhan * SEV_STATUS MSR (C001_0131) is a non-interceptable MSR. 333ad879127SKrish Sadhukhan */ 334ad879127SKrish Sadhukhan continue; 335ad879127SKrish Sadhukhan } 336ad879127SKrish Sadhukhan 337ad879127SKrish Sadhukhan /* Skips gaps between supported MSR ranges */ 338ad879127SKrish Sadhukhan if (msr_index == 0x2000) 339ad879127SKrish Sadhukhan msr_index = 0xc0000000; 340ad879127SKrish Sadhukhan else if (msr_index == 0xc0002000) 341ad879127SKrish Sadhukhan msr_index = 0xc0010000; 342ad879127SKrish Sadhukhan 343ad879127SKrish Sadhukhan test->scratch = -1; 344ad879127SKrish Sadhukhan 345ad879127SKrish Sadhukhan rdmsr(msr_index); 346ad879127SKrish Sadhukhan 347ad879127SKrish Sadhukhan /* Check that a read intercept occurred for MSR at msr_index */ 348ad879127SKrish Sadhukhan if (test->scratch != msr_index) 349ad879127SKrish Sadhukhan report(false, "MSR 0x%lx read intercept", msr_index); 350ad879127SKrish Sadhukhan 351ad879127SKrish Sadhukhan /* 352ad879127SKrish Sadhukhan * Poor man approach to generate a value that 353ad879127SKrish Sadhukhan * seems arbitrary each time around the loop. 354ad879127SKrish Sadhukhan */ 355ad879127SKrish Sadhukhan msr_value += (msr_value << 1); 356ad879127SKrish Sadhukhan 357ad879127SKrish Sadhukhan wrmsr(msr_index, msr_value); 358ad879127SKrish Sadhukhan 359ad879127SKrish Sadhukhan /* Check that a write intercept occurred for MSR with msr_value */ 360ad879127SKrish Sadhukhan if (test->scratch != msr_value) 361ad879127SKrish Sadhukhan report(false, "MSR 0x%lx write intercept", msr_index); 362ad879127SKrish Sadhukhan } 363ad879127SKrish Sadhukhan 364ad879127SKrish Sadhukhan test->scratch = -2; 365ad879127SKrish Sadhukhan } 366ad879127SKrish Sadhukhan 367ad879127SKrish Sadhukhan static bool msr_intercept_finished(struct svm_test *test) 368ad879127SKrish Sadhukhan { 369096cf7feSPaolo Bonzini u32 exit_code = vmcb->control.exit_code; 370ad879127SKrish Sadhukhan u64 exit_info_1; 371ad879127SKrish Sadhukhan u8 *opcode; 372ad879127SKrish Sadhukhan 373ad879127SKrish Sadhukhan if (exit_code == SVM_EXIT_MSR) { 374096cf7feSPaolo Bonzini exit_info_1 = vmcb->control.exit_info_1; 375ad879127SKrish Sadhukhan } else { 376ad879127SKrish Sadhukhan /* 377ad879127SKrish Sadhukhan * If #GP exception occurs instead, check that it was 378ad879127SKrish Sadhukhan * for RDMSR/WRMSR and set exit_info_1 accordingly. 379ad879127SKrish Sadhukhan */ 380ad879127SKrish Sadhukhan 381ad879127SKrish Sadhukhan if (exit_code != (SVM_EXIT_EXCP_BASE + GP_VECTOR)) 382ad879127SKrish Sadhukhan return true; 383ad879127SKrish Sadhukhan 384096cf7feSPaolo Bonzini opcode = (u8 *)vmcb->save.rip; 385ad879127SKrish Sadhukhan if (opcode[0] != 0x0f) 386ad879127SKrish Sadhukhan return true; 387ad879127SKrish Sadhukhan 388ad879127SKrish Sadhukhan switch (opcode[1]) { 389ad879127SKrish Sadhukhan case 0x30: /* WRMSR */ 390ad879127SKrish Sadhukhan exit_info_1 = 1; 391ad879127SKrish Sadhukhan break; 392ad879127SKrish Sadhukhan case 0x32: /* RDMSR */ 393ad879127SKrish Sadhukhan exit_info_1 = 0; 394ad879127SKrish Sadhukhan break; 395ad879127SKrish Sadhukhan default: 396ad879127SKrish Sadhukhan return true; 397ad879127SKrish Sadhukhan } 398ad879127SKrish Sadhukhan 399ad879127SKrish Sadhukhan /* 400ad879127SKrish Sadhukhan * Warn that #GP exception occured instead. 401ad879127SKrish Sadhukhan * RCX holds the MSR index. 402ad879127SKrish Sadhukhan */ 403ad879127SKrish Sadhukhan printf("%s 0x%lx #GP exception\n", 404ad879127SKrish Sadhukhan exit_info_1 ? "WRMSR" : "RDMSR", get_regs().rcx); 405ad879127SKrish Sadhukhan } 406ad879127SKrish Sadhukhan 407ad879127SKrish Sadhukhan /* Jump over RDMSR/WRMSR instruction */ 408096cf7feSPaolo Bonzini vmcb->save.rip += 2; 409ad879127SKrish Sadhukhan 410ad879127SKrish Sadhukhan /* 411ad879127SKrish Sadhukhan * Test whether the intercept was for RDMSR/WRMSR. 412ad879127SKrish Sadhukhan * For RDMSR, test->scratch is set to the MSR index; 413ad879127SKrish Sadhukhan * RCX holds the MSR index. 414ad879127SKrish Sadhukhan * For WRMSR, test->scratch is set to the MSR value; 415ad879127SKrish Sadhukhan * RDX holds the upper 32 bits of the MSR value, 416ad879127SKrish Sadhukhan * while RAX hold its lower 32 bits. 417ad879127SKrish Sadhukhan */ 418ad879127SKrish Sadhukhan if (exit_info_1) 419ad879127SKrish Sadhukhan test->scratch = 420096cf7feSPaolo Bonzini ((get_regs().rdx << 32) | (vmcb->save.rax & 0xffffffff)); 421ad879127SKrish Sadhukhan else 422ad879127SKrish Sadhukhan test->scratch = get_regs().rcx; 423ad879127SKrish Sadhukhan 424ad879127SKrish Sadhukhan return false; 425ad879127SKrish Sadhukhan } 426ad879127SKrish Sadhukhan 427ad879127SKrish Sadhukhan static bool check_msr_intercept(struct svm_test *test) 428ad879127SKrish Sadhukhan { 429ad879127SKrish Sadhukhan memset(msr_bitmap, 0, MSR_BITMAP_SIZE); 430ad879127SKrish Sadhukhan return (test->scratch == -2); 431ad879127SKrish Sadhukhan } 432ad879127SKrish Sadhukhan 433ad879127SKrish Sadhukhan static void prepare_mode_switch(struct svm_test *test) 434ad879127SKrish Sadhukhan { 435096cf7feSPaolo Bonzini vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR) 436ad879127SKrish Sadhukhan | (1ULL << UD_VECTOR) 437ad879127SKrish Sadhukhan | (1ULL << DF_VECTOR) 438ad879127SKrish Sadhukhan | (1ULL << PF_VECTOR); 439ad879127SKrish Sadhukhan test->scratch = 0; 440ad879127SKrish Sadhukhan } 441ad879127SKrish Sadhukhan 442ad879127SKrish Sadhukhan static void test_mode_switch(struct svm_test *test) 443ad879127SKrish Sadhukhan { 444ad879127SKrish Sadhukhan asm volatile(" cli\n" 445ad879127SKrish Sadhukhan " ljmp *1f\n" /* jump to 32-bit code segment */ 446ad879127SKrish Sadhukhan "1:\n" 447ad879127SKrish Sadhukhan " .long 2f\n" 448ad879127SKrish Sadhukhan " .long " xstr(KERNEL_CS32) "\n" 449ad879127SKrish Sadhukhan ".code32\n" 450ad879127SKrish Sadhukhan "2:\n" 451ad879127SKrish Sadhukhan " movl %%cr0, %%eax\n" 452ad879127SKrish Sadhukhan " btcl $31, %%eax\n" /* clear PG */ 453ad879127SKrish Sadhukhan " movl %%eax, %%cr0\n" 454ad879127SKrish Sadhukhan " movl $0xc0000080, %%ecx\n" /* EFER */ 455ad879127SKrish Sadhukhan " rdmsr\n" 456ad879127SKrish Sadhukhan " btcl $8, %%eax\n" /* clear LME */ 457ad879127SKrish Sadhukhan " wrmsr\n" 458ad879127SKrish Sadhukhan " movl %%cr4, %%eax\n" 459ad879127SKrish Sadhukhan " btcl $5, %%eax\n" /* clear PAE */ 460ad879127SKrish Sadhukhan " movl %%eax, %%cr4\n" 461ad879127SKrish Sadhukhan " movw %[ds16], %%ax\n" 462ad879127SKrish Sadhukhan " movw %%ax, %%ds\n" 463ad879127SKrish Sadhukhan " ljmpl %[cs16], $3f\n" /* jump to 16 bit protected-mode */ 464ad879127SKrish Sadhukhan ".code16\n" 465ad879127SKrish Sadhukhan "3:\n" 466ad879127SKrish Sadhukhan " movl %%cr0, %%eax\n" 467ad879127SKrish Sadhukhan " btcl $0, %%eax\n" /* clear PE */ 468ad879127SKrish Sadhukhan " movl %%eax, %%cr0\n" 469ad879127SKrish Sadhukhan " ljmpl $0, $4f\n" /* jump to real-mode */ 470ad879127SKrish Sadhukhan "4:\n" 471ad879127SKrish Sadhukhan " vmmcall\n" 472ad879127SKrish Sadhukhan " movl %%cr0, %%eax\n" 473ad879127SKrish Sadhukhan " btsl $0, %%eax\n" /* set PE */ 474ad879127SKrish Sadhukhan " movl %%eax, %%cr0\n" 475ad879127SKrish Sadhukhan " ljmpl %[cs32], $5f\n" /* back to protected mode */ 476ad879127SKrish Sadhukhan ".code32\n" 477ad879127SKrish Sadhukhan "5:\n" 478ad879127SKrish Sadhukhan " movl %%cr4, %%eax\n" 479ad879127SKrish Sadhukhan " btsl $5, %%eax\n" /* set PAE */ 480ad879127SKrish Sadhukhan " movl %%eax, %%cr4\n" 481ad879127SKrish Sadhukhan " movl $0xc0000080, %%ecx\n" /* EFER */ 482ad879127SKrish Sadhukhan " rdmsr\n" 483ad879127SKrish Sadhukhan " btsl $8, %%eax\n" /* set LME */ 484ad879127SKrish Sadhukhan " wrmsr\n" 485ad879127SKrish Sadhukhan " movl %%cr0, %%eax\n" 486ad879127SKrish Sadhukhan " btsl $31, %%eax\n" /* set PG */ 487ad879127SKrish Sadhukhan " movl %%eax, %%cr0\n" 488ad879127SKrish Sadhukhan " ljmpl %[cs64], $6f\n" /* back to long mode */ 489ad879127SKrish Sadhukhan ".code64\n\t" 490ad879127SKrish Sadhukhan "6:\n" 491ad879127SKrish Sadhukhan " vmmcall\n" 492ad879127SKrish Sadhukhan :: [cs16] "i"(KERNEL_CS16), [ds16] "i"(KERNEL_DS16), 493ad879127SKrish Sadhukhan [cs32] "i"(KERNEL_CS32), [cs64] "i"(KERNEL_CS64) 494ad879127SKrish Sadhukhan : "rax", "rbx", "rcx", "rdx", "memory"); 495ad879127SKrish Sadhukhan } 496ad879127SKrish Sadhukhan 497ad879127SKrish Sadhukhan static bool mode_switch_finished(struct svm_test *test) 498ad879127SKrish Sadhukhan { 499ad879127SKrish Sadhukhan u64 cr0, cr4, efer; 500ad879127SKrish Sadhukhan 501096cf7feSPaolo Bonzini cr0 = vmcb->save.cr0; 502096cf7feSPaolo Bonzini cr4 = vmcb->save.cr4; 503096cf7feSPaolo Bonzini efer = vmcb->save.efer; 504ad879127SKrish Sadhukhan 505ad879127SKrish Sadhukhan /* Only expect VMMCALL intercepts */ 506096cf7feSPaolo Bonzini if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) 507ad879127SKrish Sadhukhan return true; 508ad879127SKrish Sadhukhan 509ad879127SKrish Sadhukhan /* Jump over VMMCALL instruction */ 510096cf7feSPaolo Bonzini vmcb->save.rip += 3; 511ad879127SKrish Sadhukhan 512ad879127SKrish Sadhukhan /* Do sanity checks */ 513ad879127SKrish Sadhukhan switch (test->scratch) { 514ad879127SKrish Sadhukhan case 0: 515ad879127SKrish Sadhukhan /* Test should be in real mode now - check for this */ 516ad879127SKrish Sadhukhan if ((cr0 & 0x80000001) || /* CR0.PG, CR0.PE */ 517ad879127SKrish Sadhukhan (cr4 & 0x00000020) || /* CR4.PAE */ 518ad879127SKrish Sadhukhan (efer & 0x00000500)) /* EFER.LMA, EFER.LME */ 519ad879127SKrish Sadhukhan return true; 520ad879127SKrish Sadhukhan break; 521ad879127SKrish Sadhukhan case 2: 522ad879127SKrish Sadhukhan /* Test should be back in long-mode now - check for this */ 523ad879127SKrish Sadhukhan if (((cr0 & 0x80000001) != 0x80000001) || /* CR0.PG, CR0.PE */ 524ad879127SKrish Sadhukhan ((cr4 & 0x00000020) != 0x00000020) || /* CR4.PAE */ 525ad879127SKrish Sadhukhan ((efer & 0x00000500) != 0x00000500)) /* EFER.LMA, EFER.LME */ 526ad879127SKrish Sadhukhan return true; 527ad879127SKrish Sadhukhan break; 528ad879127SKrish Sadhukhan } 529ad879127SKrish Sadhukhan 530ad879127SKrish Sadhukhan /* one step forward */ 531ad879127SKrish Sadhukhan test->scratch += 1; 532ad879127SKrish Sadhukhan 533ad879127SKrish Sadhukhan return test->scratch == 2; 534ad879127SKrish Sadhukhan } 535ad879127SKrish Sadhukhan 536ad879127SKrish Sadhukhan static bool check_mode_switch(struct svm_test *test) 537ad879127SKrish Sadhukhan { 538ad879127SKrish Sadhukhan return test->scratch == 2; 539ad879127SKrish Sadhukhan } 540ad879127SKrish Sadhukhan 541ad879127SKrish Sadhukhan extern u8 *io_bitmap; 542ad879127SKrish Sadhukhan 543ad879127SKrish Sadhukhan static void prepare_ioio(struct svm_test *test) 544ad879127SKrish Sadhukhan { 545096cf7feSPaolo Bonzini vmcb->control.intercept |= (1ULL << INTERCEPT_IOIO_PROT); 546ad879127SKrish Sadhukhan test->scratch = 0; 547ad879127SKrish Sadhukhan memset(io_bitmap, 0, 8192); 548ad879127SKrish Sadhukhan io_bitmap[8192] = 0xFF; 549ad879127SKrish Sadhukhan } 550ad879127SKrish Sadhukhan 551ad879127SKrish Sadhukhan static void test_ioio(struct svm_test *test) 552ad879127SKrish Sadhukhan { 553ad879127SKrish Sadhukhan // stage 0, test IO pass 554ad879127SKrish Sadhukhan inb(0x5000); 555ad879127SKrish Sadhukhan outb(0x0, 0x5000); 556ad879127SKrish Sadhukhan if (get_test_stage(test) != 0) 557ad879127SKrish Sadhukhan goto fail; 558ad879127SKrish Sadhukhan 559ad879127SKrish Sadhukhan // test IO width, in/out 560ad879127SKrish Sadhukhan io_bitmap[0] = 0xFF; 561ad879127SKrish Sadhukhan inc_test_stage(test); 562ad879127SKrish Sadhukhan inb(0x0); 563ad879127SKrish Sadhukhan if (get_test_stage(test) != 2) 564ad879127SKrish Sadhukhan goto fail; 565ad879127SKrish Sadhukhan 566ad879127SKrish Sadhukhan outw(0x0, 0x0); 567ad879127SKrish Sadhukhan if (get_test_stage(test) != 3) 568ad879127SKrish Sadhukhan goto fail; 569ad879127SKrish Sadhukhan 570ad879127SKrish Sadhukhan inl(0x0); 571ad879127SKrish Sadhukhan if (get_test_stage(test) != 4) 572ad879127SKrish Sadhukhan goto fail; 573ad879127SKrish Sadhukhan 574ad879127SKrish Sadhukhan // test low/high IO port 575ad879127SKrish Sadhukhan io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8)); 576ad879127SKrish Sadhukhan inb(0x5000); 577ad879127SKrish Sadhukhan if (get_test_stage(test) != 5) 578ad879127SKrish Sadhukhan goto fail; 579ad879127SKrish Sadhukhan 580ad879127SKrish Sadhukhan io_bitmap[0x9000 / 8] = (1 << (0x9000 % 8)); 581ad879127SKrish Sadhukhan inw(0x9000); 582ad879127SKrish Sadhukhan if (get_test_stage(test) != 6) 583ad879127SKrish Sadhukhan goto fail; 584ad879127SKrish Sadhukhan 585ad879127SKrish Sadhukhan // test partial pass 586ad879127SKrish Sadhukhan io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8)); 587ad879127SKrish Sadhukhan inl(0x4FFF); 588ad879127SKrish Sadhukhan if (get_test_stage(test) != 7) 589ad879127SKrish Sadhukhan goto fail; 590ad879127SKrish Sadhukhan 591ad879127SKrish Sadhukhan // test across pages 592ad879127SKrish Sadhukhan inc_test_stage(test); 593ad879127SKrish Sadhukhan inl(0x7FFF); 594ad879127SKrish Sadhukhan if (get_test_stage(test) != 8) 595ad879127SKrish Sadhukhan goto fail; 596ad879127SKrish Sadhukhan 597ad879127SKrish Sadhukhan inc_test_stage(test); 598ad879127SKrish Sadhukhan io_bitmap[0x8000 / 8] = 1 << (0x8000 % 8); 599ad879127SKrish Sadhukhan inl(0x7FFF); 600ad879127SKrish Sadhukhan if (get_test_stage(test) != 10) 601ad879127SKrish Sadhukhan goto fail; 602ad879127SKrish Sadhukhan 603ad879127SKrish Sadhukhan io_bitmap[0] = 0; 604ad879127SKrish Sadhukhan inl(0xFFFF); 605ad879127SKrish Sadhukhan if (get_test_stage(test) != 11) 606ad879127SKrish Sadhukhan goto fail; 607ad879127SKrish Sadhukhan 608ad879127SKrish Sadhukhan io_bitmap[0] = 0xFF; 609ad879127SKrish Sadhukhan io_bitmap[8192] = 0; 610ad879127SKrish Sadhukhan inl(0xFFFF); 611ad879127SKrish Sadhukhan inc_test_stage(test); 612ad879127SKrish Sadhukhan if (get_test_stage(test) != 12) 613ad879127SKrish Sadhukhan goto fail; 614ad879127SKrish Sadhukhan 615ad879127SKrish Sadhukhan return; 616ad879127SKrish Sadhukhan 617ad879127SKrish Sadhukhan fail: 618ad879127SKrish Sadhukhan report(false, "stage %d", get_test_stage(test)); 619ad879127SKrish Sadhukhan test->scratch = -1; 620ad879127SKrish Sadhukhan } 621ad879127SKrish Sadhukhan 622ad879127SKrish Sadhukhan static bool ioio_finished(struct svm_test *test) 623ad879127SKrish Sadhukhan { 624ad879127SKrish Sadhukhan unsigned port, size; 625ad879127SKrish Sadhukhan 626ad879127SKrish Sadhukhan /* Only expect IOIO intercepts */ 627096cf7feSPaolo Bonzini if (vmcb->control.exit_code == SVM_EXIT_VMMCALL) 628ad879127SKrish Sadhukhan return true; 629ad879127SKrish Sadhukhan 630096cf7feSPaolo Bonzini if (vmcb->control.exit_code != SVM_EXIT_IOIO) 631ad879127SKrish Sadhukhan return true; 632ad879127SKrish Sadhukhan 633ad879127SKrish Sadhukhan /* one step forward */ 634ad879127SKrish Sadhukhan test->scratch += 1; 635ad879127SKrish Sadhukhan 636096cf7feSPaolo Bonzini port = vmcb->control.exit_info_1 >> 16; 637096cf7feSPaolo Bonzini size = (vmcb->control.exit_info_1 >> SVM_IOIO_SIZE_SHIFT) & 7; 638ad879127SKrish Sadhukhan 639ad879127SKrish Sadhukhan while (size--) { 640ad879127SKrish Sadhukhan io_bitmap[port / 8] &= ~(1 << (port & 7)); 641ad879127SKrish Sadhukhan port++; 642ad879127SKrish Sadhukhan } 643ad879127SKrish Sadhukhan 644ad879127SKrish Sadhukhan return false; 645ad879127SKrish Sadhukhan } 646ad879127SKrish Sadhukhan 647ad879127SKrish Sadhukhan static bool check_ioio(struct svm_test *test) 648ad879127SKrish Sadhukhan { 649ad879127SKrish Sadhukhan memset(io_bitmap, 0, 8193); 650ad879127SKrish Sadhukhan return test->scratch != -1; 651ad879127SKrish Sadhukhan } 652ad879127SKrish Sadhukhan 653ad879127SKrish Sadhukhan static void prepare_asid_zero(struct svm_test *test) 654ad879127SKrish Sadhukhan { 655096cf7feSPaolo Bonzini vmcb->control.asid = 0; 656ad879127SKrish Sadhukhan } 657ad879127SKrish Sadhukhan 658ad879127SKrish Sadhukhan static void test_asid_zero(struct svm_test *test) 659ad879127SKrish Sadhukhan { 660ad879127SKrish Sadhukhan asm volatile ("vmmcall\n\t"); 661ad879127SKrish Sadhukhan } 662ad879127SKrish Sadhukhan 663ad879127SKrish Sadhukhan static bool check_asid_zero(struct svm_test *test) 664ad879127SKrish Sadhukhan { 665096cf7feSPaolo Bonzini return vmcb->control.exit_code == SVM_EXIT_ERR; 666ad879127SKrish Sadhukhan } 667ad879127SKrish Sadhukhan 668ad879127SKrish Sadhukhan static void sel_cr0_bug_prepare(struct svm_test *test) 669ad879127SKrish Sadhukhan { 670096cf7feSPaolo Bonzini vmcb->control.intercept |= (1ULL << INTERCEPT_SELECTIVE_CR0); 671ad879127SKrish Sadhukhan } 672ad879127SKrish Sadhukhan 673ad879127SKrish Sadhukhan static bool sel_cr0_bug_finished(struct svm_test *test) 674ad879127SKrish Sadhukhan { 675ad879127SKrish Sadhukhan return true; 676ad879127SKrish Sadhukhan } 677ad879127SKrish Sadhukhan 678ad879127SKrish Sadhukhan static void sel_cr0_bug_test(struct svm_test *test) 679ad879127SKrish Sadhukhan { 680ad879127SKrish Sadhukhan unsigned long cr0; 681ad879127SKrish Sadhukhan 682ad879127SKrish Sadhukhan /* read cr0, clear CD, and write back */ 683ad879127SKrish Sadhukhan cr0 = read_cr0(); 684ad879127SKrish Sadhukhan cr0 |= (1UL << 30); 685ad879127SKrish Sadhukhan write_cr0(cr0); 686ad879127SKrish Sadhukhan 687ad879127SKrish Sadhukhan /* 688ad879127SKrish Sadhukhan * If we are here the test failed, not sure what to do now because we 689ad879127SKrish Sadhukhan * are not in guest-mode anymore so we can't trigger an intercept. 690ad879127SKrish Sadhukhan * Trigger a tripple-fault for now. 691ad879127SKrish Sadhukhan */ 692ad879127SKrish Sadhukhan report(false, "sel_cr0 test. Can not recover from this - exiting"); 693ad879127SKrish Sadhukhan exit(report_summary()); 694ad879127SKrish Sadhukhan } 695ad879127SKrish Sadhukhan 696ad879127SKrish Sadhukhan static bool sel_cr0_bug_check(struct svm_test *test) 697ad879127SKrish Sadhukhan { 698096cf7feSPaolo Bonzini return vmcb->control.exit_code == SVM_EXIT_CR0_SEL_WRITE; 699ad879127SKrish Sadhukhan } 700ad879127SKrish Sadhukhan 701ad879127SKrish Sadhukhan static void npt_nx_prepare(struct svm_test *test) 702ad879127SKrish Sadhukhan { 703ad879127SKrish Sadhukhan u64 *pte; 704ad879127SKrish Sadhukhan 7051a0bbf91SSean Christopherson test->scratch = rdmsr(MSR_EFER); 7061a0bbf91SSean Christopherson wrmsr(MSR_EFER, test->scratch | EFER_NX); 7071a0bbf91SSean Christopherson 7083fdf0e6eSSean Christopherson /* Clear the guest's EFER.NX, it should not affect NPT behavior. */ 7093fdf0e6eSSean Christopherson vmcb->save.efer &= ~EFER_NX; 7103fdf0e6eSSean Christopherson 711ad879127SKrish Sadhukhan pte = npt_get_pte((u64)null_test); 712ad879127SKrish Sadhukhan 7139bb2b6ebSSean Christopherson *pte |= PT64_NX_MASK; 714ad879127SKrish Sadhukhan } 715ad879127SKrish Sadhukhan 716ad879127SKrish Sadhukhan static bool npt_nx_check(struct svm_test *test) 717ad879127SKrish Sadhukhan { 718ad879127SKrish Sadhukhan u64 *pte = npt_get_pte((u64)null_test); 719ad879127SKrish Sadhukhan 7201a0bbf91SSean Christopherson wrmsr(MSR_EFER, test->scratch); 7211a0bbf91SSean Christopherson 7229bb2b6ebSSean Christopherson *pte &= ~PT64_NX_MASK; 723ad879127SKrish Sadhukhan 724096cf7feSPaolo Bonzini return (vmcb->control.exit_code == SVM_EXIT_NPF) 725096cf7feSPaolo Bonzini && (vmcb->control.exit_info_1 == 0x100000015ULL); 726ad879127SKrish Sadhukhan } 727ad879127SKrish Sadhukhan 7286faca2a5SKrish Sadhukhan static void npt_np_prepare(struct svm_test *test) 7296faca2a5SKrish Sadhukhan { 7306faca2a5SKrish Sadhukhan u64 *pte; 7316faca2a5SKrish Sadhukhan 7326faca2a5SKrish Sadhukhan scratch_page = alloc_page(); 7336faca2a5SKrish Sadhukhan pte = npt_get_pte((u64)scratch_page); 7346faca2a5SKrish Sadhukhan 7356faca2a5SKrish Sadhukhan *pte &= ~1ULL; 7366faca2a5SKrish Sadhukhan } 7376faca2a5SKrish Sadhukhan 7386faca2a5SKrish Sadhukhan static void npt_np_test(struct svm_test *test) 7396faca2a5SKrish Sadhukhan { 7406faca2a5SKrish Sadhukhan (void) *(volatile u64 *)scratch_page; 7416faca2a5SKrish Sadhukhan } 7426faca2a5SKrish Sadhukhan 7436faca2a5SKrish Sadhukhan static bool npt_np_check(struct svm_test *test) 7446faca2a5SKrish Sadhukhan { 7456faca2a5SKrish Sadhukhan u64 *pte = npt_get_pte((u64)scratch_page); 7466faca2a5SKrish Sadhukhan 7476faca2a5SKrish Sadhukhan *pte |= 1ULL; 7486faca2a5SKrish Sadhukhan 7496faca2a5SKrish Sadhukhan return (vmcb->control.exit_code == SVM_EXIT_NPF) 7506faca2a5SKrish Sadhukhan && (vmcb->control.exit_info_1 == 0x100000004ULL); 7516faca2a5SKrish Sadhukhan } 7526faca2a5SKrish Sadhukhan 753ad879127SKrish Sadhukhan static void npt_us_prepare(struct svm_test *test) 754ad879127SKrish Sadhukhan { 755ad879127SKrish Sadhukhan u64 *pte; 756ad879127SKrish Sadhukhan 757ad879127SKrish Sadhukhan scratch_page = alloc_page(); 758ad879127SKrish Sadhukhan pte = npt_get_pte((u64)scratch_page); 759ad879127SKrish Sadhukhan 760ad879127SKrish Sadhukhan *pte &= ~(1ULL << 2); 761ad879127SKrish Sadhukhan } 762ad879127SKrish Sadhukhan 763ad879127SKrish Sadhukhan static void npt_us_test(struct svm_test *test) 764ad879127SKrish Sadhukhan { 765ad879127SKrish Sadhukhan (void) *(volatile u64 *)scratch_page; 766ad879127SKrish Sadhukhan } 767ad879127SKrish Sadhukhan 768ad879127SKrish Sadhukhan static bool npt_us_check(struct svm_test *test) 769ad879127SKrish Sadhukhan { 770ad879127SKrish Sadhukhan u64 *pte = npt_get_pte((u64)scratch_page); 771ad879127SKrish Sadhukhan 772ad879127SKrish Sadhukhan *pte |= (1ULL << 2); 773ad879127SKrish Sadhukhan 774096cf7feSPaolo Bonzini return (vmcb->control.exit_code == SVM_EXIT_NPF) 775096cf7feSPaolo Bonzini && (vmcb->control.exit_info_1 == 0x100000005ULL); 776ad879127SKrish Sadhukhan } 777ad879127SKrish Sadhukhan 778ad879127SKrish Sadhukhan static void npt_rw_prepare(struct svm_test *test) 779ad879127SKrish Sadhukhan { 780ad879127SKrish Sadhukhan 781ad879127SKrish Sadhukhan u64 *pte; 782ad879127SKrish Sadhukhan 783ad879127SKrish Sadhukhan pte = npt_get_pte(0x80000); 784ad879127SKrish Sadhukhan 785ad879127SKrish Sadhukhan *pte &= ~(1ULL << 1); 786ad879127SKrish Sadhukhan } 787ad879127SKrish Sadhukhan 788ad879127SKrish Sadhukhan static void npt_rw_test(struct svm_test *test) 789ad879127SKrish Sadhukhan { 790ad879127SKrish Sadhukhan u64 *data = (void*)(0x80000); 791ad879127SKrish Sadhukhan 792ad879127SKrish Sadhukhan *data = 0; 793ad879127SKrish Sadhukhan } 794ad879127SKrish Sadhukhan 795ad879127SKrish Sadhukhan static bool npt_rw_check(struct svm_test *test) 796ad879127SKrish Sadhukhan { 797ad879127SKrish Sadhukhan u64 *pte = npt_get_pte(0x80000); 798ad879127SKrish Sadhukhan 799ad879127SKrish Sadhukhan *pte |= (1ULL << 1); 800ad879127SKrish Sadhukhan 801096cf7feSPaolo Bonzini return (vmcb->control.exit_code == SVM_EXIT_NPF) 802096cf7feSPaolo Bonzini && (vmcb->control.exit_info_1 == 0x100000007ULL); 803ad879127SKrish Sadhukhan } 804ad879127SKrish Sadhukhan 805ad879127SKrish Sadhukhan static void npt_rw_pfwalk_prepare(struct svm_test *test) 806ad879127SKrish Sadhukhan { 807ad879127SKrish Sadhukhan 808ad879127SKrish Sadhukhan u64 *pte; 809ad879127SKrish Sadhukhan 810ad879127SKrish Sadhukhan pte = npt_get_pte(read_cr3()); 811ad879127SKrish Sadhukhan 812ad879127SKrish Sadhukhan *pte &= ~(1ULL << 1); 813ad879127SKrish Sadhukhan } 814ad879127SKrish Sadhukhan 815ad879127SKrish Sadhukhan static bool npt_rw_pfwalk_check(struct svm_test *test) 816ad879127SKrish Sadhukhan { 817ad879127SKrish Sadhukhan u64 *pte = npt_get_pte(read_cr3()); 818ad879127SKrish Sadhukhan 819ad879127SKrish Sadhukhan *pte |= (1ULL << 1); 820ad879127SKrish Sadhukhan 821096cf7feSPaolo Bonzini return (vmcb->control.exit_code == SVM_EXIT_NPF) 822a6051f06SNadav Amit && (vmcb->control.exit_info_1 == 0x200000007ULL) 823096cf7feSPaolo Bonzini && (vmcb->control.exit_info_2 == read_cr3()); 824ad879127SKrish Sadhukhan } 825ad879127SKrish Sadhukhan 826ad879127SKrish Sadhukhan static void npt_l1mmio_prepare(struct svm_test *test) 827ad879127SKrish Sadhukhan { 828ad879127SKrish Sadhukhan } 829ad879127SKrish Sadhukhan 830ad879127SKrish Sadhukhan u32 nested_apic_version1; 831ad879127SKrish Sadhukhan u32 nested_apic_version2; 832ad879127SKrish Sadhukhan 833ad879127SKrish Sadhukhan static void npt_l1mmio_test(struct svm_test *test) 834ad879127SKrish Sadhukhan { 835ad879127SKrish Sadhukhan volatile u32 *data = (volatile void*)(0xfee00030UL); 836ad879127SKrish Sadhukhan 837ad879127SKrish Sadhukhan nested_apic_version1 = *data; 838ad879127SKrish Sadhukhan nested_apic_version2 = *data; 839ad879127SKrish Sadhukhan } 840ad879127SKrish Sadhukhan 841ad879127SKrish Sadhukhan static bool npt_l1mmio_check(struct svm_test *test) 842ad879127SKrish Sadhukhan { 843ad879127SKrish Sadhukhan volatile u32 *data = (volatile void*)(0xfee00030); 844ad879127SKrish Sadhukhan u32 lvr = *data; 845ad879127SKrish Sadhukhan 846ad879127SKrish Sadhukhan return nested_apic_version1 == lvr && nested_apic_version2 == lvr; 847ad879127SKrish Sadhukhan } 848ad879127SKrish Sadhukhan 849ad879127SKrish Sadhukhan static void npt_rw_l1mmio_prepare(struct svm_test *test) 850ad879127SKrish Sadhukhan { 851ad879127SKrish Sadhukhan 852ad879127SKrish Sadhukhan u64 *pte; 853ad879127SKrish Sadhukhan 854ad879127SKrish Sadhukhan pte = npt_get_pte(0xfee00080); 855ad879127SKrish Sadhukhan 856ad879127SKrish Sadhukhan *pte &= ~(1ULL << 1); 857ad879127SKrish Sadhukhan } 858ad879127SKrish Sadhukhan 859ad879127SKrish Sadhukhan static void npt_rw_l1mmio_test(struct svm_test *test) 860ad879127SKrish Sadhukhan { 861ad879127SKrish Sadhukhan volatile u32 *data = (volatile void*)(0xfee00080); 862ad879127SKrish Sadhukhan 863ad879127SKrish Sadhukhan *data = *data; 864ad879127SKrish Sadhukhan } 865ad879127SKrish Sadhukhan 866ad879127SKrish Sadhukhan static bool npt_rw_l1mmio_check(struct svm_test *test) 867ad879127SKrish Sadhukhan { 868ad879127SKrish Sadhukhan u64 *pte = npt_get_pte(0xfee00080); 869ad879127SKrish Sadhukhan 870ad879127SKrish Sadhukhan *pte |= (1ULL << 1); 871ad879127SKrish Sadhukhan 872096cf7feSPaolo Bonzini return (vmcb->control.exit_code == SVM_EXIT_NPF) 873096cf7feSPaolo Bonzini && (vmcb->control.exit_info_1 == 0x100000007ULL); 874ad879127SKrish Sadhukhan } 875ad879127SKrish Sadhukhan 876ad879127SKrish Sadhukhan #define TSC_ADJUST_VALUE (1ll << 32) 877f3154609SBill Wendling #define TSC_OFFSET_VALUE (~0ull << 48) 878ad879127SKrish Sadhukhan static bool ok; 879ad879127SKrish Sadhukhan 88010a65fc4SNadav Amit static bool tsc_adjust_supported(void) 88110a65fc4SNadav Amit { 88210a65fc4SNadav Amit return this_cpu_has(X86_FEATURE_TSC_ADJUST); 88310a65fc4SNadav Amit } 88410a65fc4SNadav Amit 885ad879127SKrish Sadhukhan static void tsc_adjust_prepare(struct svm_test *test) 886ad879127SKrish Sadhukhan { 887ad879127SKrish Sadhukhan default_prepare(test); 888096cf7feSPaolo Bonzini vmcb->control.tsc_offset = TSC_OFFSET_VALUE; 889ad879127SKrish Sadhukhan 890ad879127SKrish Sadhukhan wrmsr(MSR_IA32_TSC_ADJUST, -TSC_ADJUST_VALUE); 891ad879127SKrish Sadhukhan int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST); 892ad879127SKrish Sadhukhan ok = adjust == -TSC_ADJUST_VALUE; 893ad879127SKrish Sadhukhan } 894ad879127SKrish Sadhukhan 895ad879127SKrish Sadhukhan static void tsc_adjust_test(struct svm_test *test) 896ad879127SKrish Sadhukhan { 897ad879127SKrish Sadhukhan int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST); 898ad879127SKrish Sadhukhan ok &= adjust == -TSC_ADJUST_VALUE; 899ad879127SKrish Sadhukhan 900ad879127SKrish Sadhukhan uint64_t l1_tsc = rdtsc() - TSC_OFFSET_VALUE; 901ad879127SKrish Sadhukhan wrmsr(MSR_IA32_TSC, l1_tsc - TSC_ADJUST_VALUE); 902ad879127SKrish Sadhukhan 903ad879127SKrish Sadhukhan adjust = rdmsr(MSR_IA32_TSC_ADJUST); 904ad879127SKrish Sadhukhan ok &= adjust <= -2 * TSC_ADJUST_VALUE; 905ad879127SKrish Sadhukhan 906ad879127SKrish Sadhukhan uint64_t l1_tsc_end = rdtsc() - TSC_OFFSET_VALUE; 907ad879127SKrish Sadhukhan ok &= (l1_tsc_end + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE; 908ad879127SKrish Sadhukhan 909ad879127SKrish Sadhukhan uint64_t l1_tsc_msr = rdmsr(MSR_IA32_TSC) - TSC_OFFSET_VALUE; 910ad879127SKrish Sadhukhan ok &= (l1_tsc_msr + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE; 911ad879127SKrish Sadhukhan } 912ad879127SKrish Sadhukhan 913ad879127SKrish Sadhukhan static bool tsc_adjust_check(struct svm_test *test) 914ad879127SKrish Sadhukhan { 915ad879127SKrish Sadhukhan int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST); 916ad879127SKrish Sadhukhan 917ad879127SKrish Sadhukhan wrmsr(MSR_IA32_TSC_ADJUST, 0); 918ad879127SKrish Sadhukhan return ok && adjust <= -2 * TSC_ADJUST_VALUE; 919ad879127SKrish Sadhukhan } 920ad879127SKrish Sadhukhan 921ad879127SKrish Sadhukhan static void latency_prepare(struct svm_test *test) 922ad879127SKrish Sadhukhan { 923ad879127SKrish Sadhukhan default_prepare(test); 924ad879127SKrish Sadhukhan runs = LATENCY_RUNS; 925ad879127SKrish Sadhukhan latvmrun_min = latvmexit_min = -1ULL; 926ad879127SKrish Sadhukhan latvmrun_max = latvmexit_max = 0; 927ad879127SKrish Sadhukhan vmrun_sum = vmexit_sum = 0; 928ad879127SKrish Sadhukhan tsc_start = rdtsc(); 929ad879127SKrish Sadhukhan } 930ad879127SKrish Sadhukhan 931ad879127SKrish Sadhukhan static void latency_test(struct svm_test *test) 932ad879127SKrish Sadhukhan { 933ad879127SKrish Sadhukhan u64 cycles; 934ad879127SKrish Sadhukhan 935ad879127SKrish Sadhukhan start: 936ad879127SKrish Sadhukhan tsc_end = rdtsc(); 937ad879127SKrish Sadhukhan 938ad879127SKrish Sadhukhan cycles = tsc_end - tsc_start; 939ad879127SKrish Sadhukhan 940ad879127SKrish Sadhukhan if (cycles > latvmrun_max) 941ad879127SKrish Sadhukhan latvmrun_max = cycles; 942ad879127SKrish Sadhukhan 943ad879127SKrish Sadhukhan if (cycles < latvmrun_min) 944ad879127SKrish Sadhukhan latvmrun_min = cycles; 945ad879127SKrish Sadhukhan 946ad879127SKrish Sadhukhan vmrun_sum += cycles; 947ad879127SKrish Sadhukhan 948ad879127SKrish Sadhukhan tsc_start = rdtsc(); 949ad879127SKrish Sadhukhan 950ad879127SKrish Sadhukhan asm volatile ("vmmcall" : : : "memory"); 951ad879127SKrish Sadhukhan goto start; 952ad879127SKrish Sadhukhan } 953ad879127SKrish Sadhukhan 954ad879127SKrish Sadhukhan static bool latency_finished(struct svm_test *test) 955ad879127SKrish Sadhukhan { 956ad879127SKrish Sadhukhan u64 cycles; 957ad879127SKrish Sadhukhan 958ad879127SKrish Sadhukhan tsc_end = rdtsc(); 959ad879127SKrish Sadhukhan 960ad879127SKrish Sadhukhan cycles = tsc_end - tsc_start; 961ad879127SKrish Sadhukhan 962ad879127SKrish Sadhukhan if (cycles > latvmexit_max) 963ad879127SKrish Sadhukhan latvmexit_max = cycles; 964ad879127SKrish Sadhukhan 965ad879127SKrish Sadhukhan if (cycles < latvmexit_min) 966ad879127SKrish Sadhukhan latvmexit_min = cycles; 967ad879127SKrish Sadhukhan 968ad879127SKrish Sadhukhan vmexit_sum += cycles; 969ad879127SKrish Sadhukhan 970096cf7feSPaolo Bonzini vmcb->save.rip += 3; 971ad879127SKrish Sadhukhan 972ad879127SKrish Sadhukhan runs -= 1; 973ad879127SKrish Sadhukhan 974ad879127SKrish Sadhukhan tsc_end = rdtsc(); 975ad879127SKrish Sadhukhan 976ad879127SKrish Sadhukhan return runs == 0; 977ad879127SKrish Sadhukhan } 978ad879127SKrish Sadhukhan 979f7fa53dcSPaolo Bonzini static bool latency_finished_clean(struct svm_test *test) 980f7fa53dcSPaolo Bonzini { 981f7fa53dcSPaolo Bonzini vmcb->control.clean = VMCB_CLEAN_ALL; 982f7fa53dcSPaolo Bonzini return latency_finished(test); 983f7fa53dcSPaolo Bonzini } 984f7fa53dcSPaolo Bonzini 985ad879127SKrish Sadhukhan static bool latency_check(struct svm_test *test) 986ad879127SKrish Sadhukhan { 987ad879127SKrish Sadhukhan printf(" Latency VMRUN : max: %ld min: %ld avg: %ld\n", latvmrun_max, 988ad879127SKrish Sadhukhan latvmrun_min, vmrun_sum / LATENCY_RUNS); 989ad879127SKrish Sadhukhan printf(" Latency VMEXIT: max: %ld min: %ld avg: %ld\n", latvmexit_max, 990ad879127SKrish Sadhukhan latvmexit_min, vmexit_sum / LATENCY_RUNS); 991ad879127SKrish Sadhukhan return true; 992ad879127SKrish Sadhukhan } 993ad879127SKrish Sadhukhan 994ad879127SKrish Sadhukhan static void lat_svm_insn_prepare(struct svm_test *test) 995ad879127SKrish Sadhukhan { 996ad879127SKrish Sadhukhan default_prepare(test); 997ad879127SKrish Sadhukhan runs = LATENCY_RUNS; 998ad879127SKrish Sadhukhan latvmload_min = latvmsave_min = latstgi_min = latclgi_min = -1ULL; 999ad879127SKrish Sadhukhan latvmload_max = latvmsave_max = latstgi_max = latclgi_max = 0; 1000ad879127SKrish Sadhukhan vmload_sum = vmsave_sum = stgi_sum = clgi_sum; 1001ad879127SKrish Sadhukhan } 1002ad879127SKrish Sadhukhan 1003ad879127SKrish Sadhukhan static bool lat_svm_insn_finished(struct svm_test *test) 1004ad879127SKrish Sadhukhan { 1005096cf7feSPaolo Bonzini u64 vmcb_phys = virt_to_phys(vmcb); 1006ad879127SKrish Sadhukhan u64 cycles; 1007ad879127SKrish Sadhukhan 1008ad879127SKrish Sadhukhan for ( ; runs != 0; runs--) { 1009ad879127SKrish Sadhukhan tsc_start = rdtsc(); 1010ad879127SKrish Sadhukhan asm volatile("vmload %0\n\t" : : "a"(vmcb_phys) : "memory"); 1011ad879127SKrish Sadhukhan cycles = rdtsc() - tsc_start; 1012ad879127SKrish Sadhukhan if (cycles > latvmload_max) 1013ad879127SKrish Sadhukhan latvmload_max = cycles; 1014ad879127SKrish Sadhukhan if (cycles < latvmload_min) 1015ad879127SKrish Sadhukhan latvmload_min = cycles; 1016ad879127SKrish Sadhukhan vmload_sum += cycles; 1017ad879127SKrish Sadhukhan 1018ad879127SKrish Sadhukhan tsc_start = rdtsc(); 1019ad879127SKrish Sadhukhan asm volatile("vmsave %0\n\t" : : "a"(vmcb_phys) : "memory"); 1020ad879127SKrish Sadhukhan cycles = rdtsc() - tsc_start; 1021ad879127SKrish Sadhukhan if (cycles > latvmsave_max) 1022ad879127SKrish Sadhukhan latvmsave_max = cycles; 1023ad879127SKrish Sadhukhan if (cycles < latvmsave_min) 1024ad879127SKrish Sadhukhan latvmsave_min = cycles; 1025ad879127SKrish Sadhukhan vmsave_sum += cycles; 1026ad879127SKrish Sadhukhan 1027ad879127SKrish Sadhukhan tsc_start = rdtsc(); 1028ad879127SKrish Sadhukhan asm volatile("stgi\n\t"); 1029ad879127SKrish Sadhukhan cycles = rdtsc() - tsc_start; 1030ad879127SKrish Sadhukhan if (cycles > latstgi_max) 1031ad879127SKrish Sadhukhan latstgi_max = cycles; 1032ad879127SKrish Sadhukhan if (cycles < latstgi_min) 1033ad879127SKrish Sadhukhan latstgi_min = cycles; 1034ad879127SKrish Sadhukhan stgi_sum += cycles; 1035ad879127SKrish Sadhukhan 1036ad879127SKrish Sadhukhan tsc_start = rdtsc(); 1037ad879127SKrish Sadhukhan asm volatile("clgi\n\t"); 1038ad879127SKrish Sadhukhan cycles = rdtsc() - tsc_start; 1039ad879127SKrish Sadhukhan if (cycles > latclgi_max) 1040ad879127SKrish Sadhukhan latclgi_max = cycles; 1041ad879127SKrish Sadhukhan if (cycles < latclgi_min) 1042ad879127SKrish Sadhukhan latclgi_min = cycles; 1043ad879127SKrish Sadhukhan clgi_sum += cycles; 1044ad879127SKrish Sadhukhan } 1045ad879127SKrish Sadhukhan 1046ad879127SKrish Sadhukhan tsc_end = rdtsc(); 1047ad879127SKrish Sadhukhan 1048ad879127SKrish Sadhukhan return true; 1049ad879127SKrish Sadhukhan } 1050ad879127SKrish Sadhukhan 1051ad879127SKrish Sadhukhan static bool lat_svm_insn_check(struct svm_test *test) 1052ad879127SKrish Sadhukhan { 1053ad879127SKrish Sadhukhan printf(" Latency VMLOAD: max: %ld min: %ld avg: %ld\n", latvmload_max, 1054ad879127SKrish Sadhukhan latvmload_min, vmload_sum / LATENCY_RUNS); 1055ad879127SKrish Sadhukhan printf(" Latency VMSAVE: max: %ld min: %ld avg: %ld\n", latvmsave_max, 1056ad879127SKrish Sadhukhan latvmsave_min, vmsave_sum / LATENCY_RUNS); 1057ad879127SKrish Sadhukhan printf(" Latency STGI: max: %ld min: %ld avg: %ld\n", latstgi_max, 1058ad879127SKrish Sadhukhan latstgi_min, stgi_sum / LATENCY_RUNS); 1059ad879127SKrish Sadhukhan printf(" Latency CLGI: max: %ld min: %ld avg: %ld\n", latclgi_max, 1060ad879127SKrish Sadhukhan latclgi_min, clgi_sum / LATENCY_RUNS); 1061ad879127SKrish Sadhukhan return true; 1062ad879127SKrish Sadhukhan } 1063ad879127SKrish Sadhukhan 1064ad879127SKrish Sadhukhan bool pending_event_ipi_fired; 1065ad879127SKrish Sadhukhan bool pending_event_guest_run; 1066ad879127SKrish Sadhukhan 1067ad879127SKrish Sadhukhan static void pending_event_ipi_isr(isr_regs_t *regs) 1068ad879127SKrish Sadhukhan { 1069ad879127SKrish Sadhukhan pending_event_ipi_fired = true; 1070ad879127SKrish Sadhukhan eoi(); 1071ad879127SKrish Sadhukhan } 1072ad879127SKrish Sadhukhan 1073ad879127SKrish Sadhukhan static void pending_event_prepare(struct svm_test *test) 1074ad879127SKrish Sadhukhan { 1075ad879127SKrish Sadhukhan int ipi_vector = 0xf1; 1076ad879127SKrish Sadhukhan 1077ad879127SKrish Sadhukhan default_prepare(test); 1078ad879127SKrish Sadhukhan 1079ad879127SKrish Sadhukhan pending_event_ipi_fired = false; 1080ad879127SKrish Sadhukhan 1081ad879127SKrish Sadhukhan handle_irq(ipi_vector, pending_event_ipi_isr); 1082ad879127SKrish Sadhukhan 1083ad879127SKrish Sadhukhan pending_event_guest_run = false; 1084ad879127SKrish Sadhukhan 1085096cf7feSPaolo Bonzini vmcb->control.intercept |= (1ULL << INTERCEPT_INTR); 1086096cf7feSPaolo Bonzini vmcb->control.int_ctl |= V_INTR_MASKING_MASK; 1087ad879127SKrish Sadhukhan 1088ad879127SKrish Sadhukhan apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | 1089ad879127SKrish Sadhukhan APIC_DM_FIXED | ipi_vector, 0); 1090ad879127SKrish Sadhukhan 1091ad879127SKrish Sadhukhan set_test_stage(test, 0); 1092ad879127SKrish Sadhukhan } 1093ad879127SKrish Sadhukhan 1094ad879127SKrish Sadhukhan static void pending_event_test(struct svm_test *test) 1095ad879127SKrish Sadhukhan { 1096ad879127SKrish Sadhukhan pending_event_guest_run = true; 1097ad879127SKrish Sadhukhan } 1098ad879127SKrish Sadhukhan 1099ad879127SKrish Sadhukhan static bool pending_event_finished(struct svm_test *test) 1100ad879127SKrish Sadhukhan { 1101ad879127SKrish Sadhukhan switch (get_test_stage(test)) { 1102ad879127SKrish Sadhukhan case 0: 1103096cf7feSPaolo Bonzini if (vmcb->control.exit_code != SVM_EXIT_INTR) { 1104ad879127SKrish Sadhukhan report(false, "VMEXIT not due to pending interrupt. Exit reason 0x%x", 1105096cf7feSPaolo Bonzini vmcb->control.exit_code); 1106ad879127SKrish Sadhukhan return true; 1107ad879127SKrish Sadhukhan } 1108ad879127SKrish Sadhukhan 1109096cf7feSPaolo Bonzini vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR); 1110096cf7feSPaolo Bonzini vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 1111ad879127SKrish Sadhukhan 1112ad879127SKrish Sadhukhan if (pending_event_guest_run) { 1113ad879127SKrish Sadhukhan report(false, "Guest ran before host received IPI\n"); 1114ad879127SKrish Sadhukhan return true; 1115ad879127SKrish Sadhukhan } 1116ad879127SKrish Sadhukhan 1117ad879127SKrish Sadhukhan irq_enable(); 1118ad879127SKrish Sadhukhan asm volatile ("nop"); 1119ad879127SKrish Sadhukhan irq_disable(); 1120ad879127SKrish Sadhukhan 1121ad879127SKrish Sadhukhan if (!pending_event_ipi_fired) { 1122ad879127SKrish Sadhukhan report(false, "Pending interrupt not dispatched after IRQ enabled\n"); 1123ad879127SKrish Sadhukhan return true; 1124ad879127SKrish Sadhukhan } 1125ad879127SKrish Sadhukhan break; 1126ad879127SKrish Sadhukhan 1127ad879127SKrish Sadhukhan case 1: 1128ad879127SKrish Sadhukhan if (!pending_event_guest_run) { 1129ad879127SKrish Sadhukhan report(false, "Guest did not resume when no interrupt\n"); 1130ad879127SKrish Sadhukhan return true; 1131ad879127SKrish Sadhukhan } 1132ad879127SKrish Sadhukhan break; 1133ad879127SKrish Sadhukhan } 1134ad879127SKrish Sadhukhan 1135ad879127SKrish Sadhukhan inc_test_stage(test); 1136ad879127SKrish Sadhukhan 1137ad879127SKrish Sadhukhan return get_test_stage(test) == 2; 1138ad879127SKrish Sadhukhan } 1139ad879127SKrish Sadhukhan 1140ad879127SKrish Sadhukhan static bool pending_event_check(struct svm_test *test) 1141ad879127SKrish Sadhukhan { 1142ad879127SKrish Sadhukhan return get_test_stage(test) == 2; 1143ad879127SKrish Sadhukhan } 1144ad879127SKrish Sadhukhan 114585dc2aceSPaolo Bonzini static void pending_event_cli_prepare(struct svm_test *test) 1146ad879127SKrish Sadhukhan { 1147ad879127SKrish Sadhukhan default_prepare(test); 1148ad879127SKrish Sadhukhan 1149ad879127SKrish Sadhukhan pending_event_ipi_fired = false; 1150ad879127SKrish Sadhukhan 1151ad879127SKrish Sadhukhan handle_irq(0xf1, pending_event_ipi_isr); 1152ad879127SKrish Sadhukhan 1153ad879127SKrish Sadhukhan apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | 1154ad879127SKrish Sadhukhan APIC_DM_FIXED | 0xf1, 0); 1155ad879127SKrish Sadhukhan 1156ad879127SKrish Sadhukhan set_test_stage(test, 0); 1157ad879127SKrish Sadhukhan } 1158ad879127SKrish Sadhukhan 115985dc2aceSPaolo Bonzini static void pending_event_cli_prepare_gif_clear(struct svm_test *test) 1160ad879127SKrish Sadhukhan { 1161ad879127SKrish Sadhukhan asm("cli"); 1162ad879127SKrish Sadhukhan } 1163ad879127SKrish Sadhukhan 116485dc2aceSPaolo Bonzini static void pending_event_cli_test(struct svm_test *test) 1165ad879127SKrish Sadhukhan { 1166ad879127SKrish Sadhukhan if (pending_event_ipi_fired == true) { 1167ad879127SKrish Sadhukhan set_test_stage(test, -1); 1168ad879127SKrish Sadhukhan report(false, "Interrupt preceeded guest"); 1169ad879127SKrish Sadhukhan vmmcall(); 1170ad879127SKrish Sadhukhan } 1171ad879127SKrish Sadhukhan 117285dc2aceSPaolo Bonzini /* VINTR_MASKING is zero. This should cause the IPI to fire. */ 1173ad879127SKrish Sadhukhan irq_enable(); 1174ad879127SKrish Sadhukhan asm volatile ("nop"); 1175ad879127SKrish Sadhukhan irq_disable(); 1176ad879127SKrish Sadhukhan 1177ad879127SKrish Sadhukhan if (pending_event_ipi_fired != true) { 1178ad879127SKrish Sadhukhan set_test_stage(test, -1); 1179ad879127SKrish Sadhukhan report(false, "Interrupt not triggered by guest"); 1180ad879127SKrish Sadhukhan } 1181ad879127SKrish Sadhukhan 1182ad879127SKrish Sadhukhan vmmcall(); 1183ad879127SKrish Sadhukhan 118485dc2aceSPaolo Bonzini /* 118585dc2aceSPaolo Bonzini * Now VINTR_MASKING=1, but no interrupt is pending so 118685dc2aceSPaolo Bonzini * the VINTR interception should be clear in VMCB02. Check 118785dc2aceSPaolo Bonzini * that L0 did not leave a stale VINTR in the VMCB. 118885dc2aceSPaolo Bonzini */ 1189ad879127SKrish Sadhukhan irq_enable(); 1190ad879127SKrish Sadhukhan asm volatile ("nop"); 1191ad879127SKrish Sadhukhan irq_disable(); 1192ad879127SKrish Sadhukhan } 1193ad879127SKrish Sadhukhan 119485dc2aceSPaolo Bonzini static bool pending_event_cli_finished(struct svm_test *test) 1195ad879127SKrish Sadhukhan { 1196096cf7feSPaolo Bonzini if ( vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1197ad879127SKrish Sadhukhan report(false, "VM_EXIT return to host is not EXIT_VMMCALL exit reason 0x%x", 1198096cf7feSPaolo Bonzini vmcb->control.exit_code); 1199ad879127SKrish Sadhukhan return true; 1200ad879127SKrish Sadhukhan } 1201ad879127SKrish Sadhukhan 1202ad879127SKrish Sadhukhan switch (get_test_stage(test)) { 1203ad879127SKrish Sadhukhan case 0: 1204096cf7feSPaolo Bonzini vmcb->save.rip += 3; 1205ad879127SKrish Sadhukhan 1206ad879127SKrish Sadhukhan pending_event_ipi_fired = false; 1207ad879127SKrish Sadhukhan 1208096cf7feSPaolo Bonzini vmcb->control.int_ctl |= V_INTR_MASKING_MASK; 1209ad879127SKrish Sadhukhan 121085dc2aceSPaolo Bonzini /* Now entering again with VINTR_MASKING=1. */ 1211ad879127SKrish Sadhukhan apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | 1212ad879127SKrish Sadhukhan APIC_DM_FIXED | 0xf1, 0); 1213ad879127SKrish Sadhukhan 1214ad879127SKrish Sadhukhan break; 1215ad879127SKrish Sadhukhan 1216ad879127SKrish Sadhukhan case 1: 1217ad879127SKrish Sadhukhan if (pending_event_ipi_fired == true) { 1218ad879127SKrish Sadhukhan report(false, "Interrupt triggered by guest"); 1219ad879127SKrish Sadhukhan return true; 1220ad879127SKrish Sadhukhan } 1221ad879127SKrish Sadhukhan 1222ad879127SKrish Sadhukhan irq_enable(); 1223ad879127SKrish Sadhukhan asm volatile ("nop"); 1224ad879127SKrish Sadhukhan irq_disable(); 1225ad879127SKrish Sadhukhan 1226ad879127SKrish Sadhukhan if (pending_event_ipi_fired != true) { 1227ad879127SKrish Sadhukhan report(false, "Interrupt not triggered by host"); 1228ad879127SKrish Sadhukhan return true; 1229ad879127SKrish Sadhukhan } 1230ad879127SKrish Sadhukhan 1231ad879127SKrish Sadhukhan break; 1232ad879127SKrish Sadhukhan 1233ad879127SKrish Sadhukhan default: 1234ad879127SKrish Sadhukhan return true; 1235ad879127SKrish Sadhukhan } 1236ad879127SKrish Sadhukhan 1237ad879127SKrish Sadhukhan inc_test_stage(test); 1238ad879127SKrish Sadhukhan 1239ad879127SKrish Sadhukhan return get_test_stage(test) == 2; 1240ad879127SKrish Sadhukhan } 1241ad879127SKrish Sadhukhan 124285dc2aceSPaolo Bonzini static bool pending_event_cli_check(struct svm_test *test) 1243ad879127SKrish Sadhukhan { 1244ad879127SKrish Sadhukhan return get_test_stage(test) == 2; 1245ad879127SKrish Sadhukhan } 1246ad879127SKrish Sadhukhan 124785dc2aceSPaolo Bonzini #define TIMER_VECTOR 222 124885dc2aceSPaolo Bonzini 124985dc2aceSPaolo Bonzini static volatile bool timer_fired; 125085dc2aceSPaolo Bonzini 125185dc2aceSPaolo Bonzini static void timer_isr(isr_regs_t *regs) 125285dc2aceSPaolo Bonzini { 125385dc2aceSPaolo Bonzini timer_fired = true; 125485dc2aceSPaolo Bonzini apic_write(APIC_EOI, 0); 125585dc2aceSPaolo Bonzini } 125685dc2aceSPaolo Bonzini 125785dc2aceSPaolo Bonzini static void interrupt_prepare(struct svm_test *test) 125885dc2aceSPaolo Bonzini { 125985dc2aceSPaolo Bonzini default_prepare(test); 126085dc2aceSPaolo Bonzini handle_irq(TIMER_VECTOR, timer_isr); 126185dc2aceSPaolo Bonzini timer_fired = false; 126285dc2aceSPaolo Bonzini set_test_stage(test, 0); 126385dc2aceSPaolo Bonzini } 126485dc2aceSPaolo Bonzini 126585dc2aceSPaolo Bonzini static void interrupt_test(struct svm_test *test) 126685dc2aceSPaolo Bonzini { 126785dc2aceSPaolo Bonzini long long start, loops; 126885dc2aceSPaolo Bonzini 126985dc2aceSPaolo Bonzini apic_write(APIC_LVTT, TIMER_VECTOR); 127085dc2aceSPaolo Bonzini irq_enable(); 127185dc2aceSPaolo Bonzini apic_write(APIC_TMICT, 1); //Timer Initial Count Register 0x380 one-shot 127285dc2aceSPaolo Bonzini for (loops = 0; loops < 10000000 && !timer_fired; loops++) 127385dc2aceSPaolo Bonzini asm volatile ("nop"); 127485dc2aceSPaolo Bonzini 127585dc2aceSPaolo Bonzini report(timer_fired, "direct interrupt while running guest"); 127685dc2aceSPaolo Bonzini 127785dc2aceSPaolo Bonzini if (!timer_fired) { 127885dc2aceSPaolo Bonzini set_test_stage(test, -1); 127985dc2aceSPaolo Bonzini vmmcall(); 128085dc2aceSPaolo Bonzini } 128185dc2aceSPaolo Bonzini 128285dc2aceSPaolo Bonzini apic_write(APIC_TMICT, 0); 128385dc2aceSPaolo Bonzini irq_disable(); 128485dc2aceSPaolo Bonzini vmmcall(); 128585dc2aceSPaolo Bonzini 128685dc2aceSPaolo Bonzini timer_fired = false; 128785dc2aceSPaolo Bonzini apic_write(APIC_TMICT, 1); 128885dc2aceSPaolo Bonzini for (loops = 0; loops < 10000000 && !timer_fired; loops++) 128985dc2aceSPaolo Bonzini asm volatile ("nop"); 129085dc2aceSPaolo Bonzini 129185dc2aceSPaolo Bonzini report(timer_fired, "intercepted interrupt while running guest"); 129285dc2aceSPaolo Bonzini 129385dc2aceSPaolo Bonzini if (!timer_fired) { 129485dc2aceSPaolo Bonzini set_test_stage(test, -1); 129585dc2aceSPaolo Bonzini vmmcall(); 129685dc2aceSPaolo Bonzini } 129785dc2aceSPaolo Bonzini 129885dc2aceSPaolo Bonzini irq_enable(); 129985dc2aceSPaolo Bonzini apic_write(APIC_TMICT, 0); 130085dc2aceSPaolo Bonzini irq_disable(); 130185dc2aceSPaolo Bonzini 130285dc2aceSPaolo Bonzini timer_fired = false; 130385dc2aceSPaolo Bonzini start = rdtsc(); 130485dc2aceSPaolo Bonzini apic_write(APIC_TMICT, 1000000); 130585dc2aceSPaolo Bonzini asm volatile ("sti; hlt"); 130685dc2aceSPaolo Bonzini 130785dc2aceSPaolo Bonzini report(rdtsc() - start > 10000 && timer_fired, 130885dc2aceSPaolo Bonzini "direct interrupt + hlt"); 130985dc2aceSPaolo Bonzini 131085dc2aceSPaolo Bonzini if (!timer_fired) { 131185dc2aceSPaolo Bonzini set_test_stage(test, -1); 131285dc2aceSPaolo Bonzini vmmcall(); 131385dc2aceSPaolo Bonzini } 131485dc2aceSPaolo Bonzini 131585dc2aceSPaolo Bonzini apic_write(APIC_TMICT, 0); 131685dc2aceSPaolo Bonzini irq_disable(); 131785dc2aceSPaolo Bonzini vmmcall(); 131885dc2aceSPaolo Bonzini 131985dc2aceSPaolo Bonzini timer_fired = false; 132085dc2aceSPaolo Bonzini start = rdtsc(); 132185dc2aceSPaolo Bonzini apic_write(APIC_TMICT, 1000000); 132285dc2aceSPaolo Bonzini asm volatile ("hlt"); 132385dc2aceSPaolo Bonzini 132485dc2aceSPaolo Bonzini report(rdtsc() - start > 10000 && timer_fired, 132585dc2aceSPaolo Bonzini "intercepted interrupt + hlt"); 132685dc2aceSPaolo Bonzini 132785dc2aceSPaolo Bonzini if (!timer_fired) { 132885dc2aceSPaolo Bonzini set_test_stage(test, -1); 132985dc2aceSPaolo Bonzini vmmcall(); 133085dc2aceSPaolo Bonzini } 133185dc2aceSPaolo Bonzini 133285dc2aceSPaolo Bonzini apic_write(APIC_TMICT, 0); 133385dc2aceSPaolo Bonzini irq_disable(); 133485dc2aceSPaolo Bonzini } 133585dc2aceSPaolo Bonzini 133685dc2aceSPaolo Bonzini static bool interrupt_finished(struct svm_test *test) 133785dc2aceSPaolo Bonzini { 133885dc2aceSPaolo Bonzini switch (get_test_stage(test)) { 133985dc2aceSPaolo Bonzini case 0: 134085dc2aceSPaolo Bonzini case 2: 1341096cf7feSPaolo Bonzini if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 134285dc2aceSPaolo Bonzini report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x", 1343096cf7feSPaolo Bonzini vmcb->control.exit_code); 134485dc2aceSPaolo Bonzini return true; 134585dc2aceSPaolo Bonzini } 1346096cf7feSPaolo Bonzini vmcb->save.rip += 3; 134785dc2aceSPaolo Bonzini 1348096cf7feSPaolo Bonzini vmcb->control.intercept |= (1ULL << INTERCEPT_INTR); 1349096cf7feSPaolo Bonzini vmcb->control.int_ctl |= V_INTR_MASKING_MASK; 135085dc2aceSPaolo Bonzini break; 135185dc2aceSPaolo Bonzini 135285dc2aceSPaolo Bonzini case 1: 135385dc2aceSPaolo Bonzini case 3: 1354096cf7feSPaolo Bonzini if (vmcb->control.exit_code != SVM_EXIT_INTR) { 135585dc2aceSPaolo Bonzini report(false, "VMEXIT not due to intr intercept. Exit reason 0x%x", 1356096cf7feSPaolo Bonzini vmcb->control.exit_code); 135785dc2aceSPaolo Bonzini return true; 135885dc2aceSPaolo Bonzini } 135985dc2aceSPaolo Bonzini 136085dc2aceSPaolo Bonzini irq_enable(); 136185dc2aceSPaolo Bonzini asm volatile ("nop"); 136285dc2aceSPaolo Bonzini irq_disable(); 136385dc2aceSPaolo Bonzini 1364096cf7feSPaolo Bonzini vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR); 1365096cf7feSPaolo Bonzini vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 136685dc2aceSPaolo Bonzini break; 136785dc2aceSPaolo Bonzini 136885dc2aceSPaolo Bonzini case 4: 136985dc2aceSPaolo Bonzini break; 137085dc2aceSPaolo Bonzini 137185dc2aceSPaolo Bonzini default: 137285dc2aceSPaolo Bonzini return true; 137385dc2aceSPaolo Bonzini } 137485dc2aceSPaolo Bonzini 137585dc2aceSPaolo Bonzini inc_test_stage(test); 137685dc2aceSPaolo Bonzini 137785dc2aceSPaolo Bonzini return get_test_stage(test) == 5; 137885dc2aceSPaolo Bonzini } 137985dc2aceSPaolo Bonzini 138085dc2aceSPaolo Bonzini static bool interrupt_check(struct svm_test *test) 138185dc2aceSPaolo Bonzini { 138285dc2aceSPaolo Bonzini return get_test_stage(test) == 5; 138385dc2aceSPaolo Bonzini } 138485dc2aceSPaolo Bonzini 1385d4db486bSCathy Avery static volatile bool nmi_fired; 1386d4db486bSCathy Avery 1387d4db486bSCathy Avery static void nmi_handler(isr_regs_t *regs) 1388d4db486bSCathy Avery { 1389d4db486bSCathy Avery nmi_fired = true; 1390d4db486bSCathy Avery apic_write(APIC_EOI, 0); 1391d4db486bSCathy Avery } 1392d4db486bSCathy Avery 1393d4db486bSCathy Avery static void nmi_prepare(struct svm_test *test) 1394d4db486bSCathy Avery { 1395d4db486bSCathy Avery default_prepare(test); 1396d4db486bSCathy Avery nmi_fired = false; 1397d4db486bSCathy Avery handle_irq(NMI_VECTOR, nmi_handler); 1398d4db486bSCathy Avery set_test_stage(test, 0); 1399d4db486bSCathy Avery } 1400d4db486bSCathy Avery 1401d4db486bSCathy Avery static void nmi_test(struct svm_test *test) 1402d4db486bSCathy Avery { 1403d4db486bSCathy Avery apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0); 1404d4db486bSCathy Avery 1405d4db486bSCathy Avery report(nmi_fired, "direct NMI while running guest"); 1406d4db486bSCathy Avery 1407d4db486bSCathy Avery if (!nmi_fired) 1408d4db486bSCathy Avery set_test_stage(test, -1); 1409d4db486bSCathy Avery 1410d4db486bSCathy Avery vmmcall(); 1411d4db486bSCathy Avery 1412d4db486bSCathy Avery nmi_fired = false; 1413d4db486bSCathy Avery 1414d4db486bSCathy Avery apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0); 1415d4db486bSCathy Avery 1416d4db486bSCathy Avery if (!nmi_fired) { 1417d4db486bSCathy Avery report(nmi_fired, "intercepted pending NMI not dispatched"); 1418d4db486bSCathy Avery set_test_stage(test, -1); 1419d4db486bSCathy Avery } 1420d4db486bSCathy Avery 1421d4db486bSCathy Avery } 1422d4db486bSCathy Avery 1423d4db486bSCathy Avery static bool nmi_finished(struct svm_test *test) 1424d4db486bSCathy Avery { 1425d4db486bSCathy Avery switch (get_test_stage(test)) { 1426d4db486bSCathy Avery case 0: 1427d4db486bSCathy Avery if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1428d4db486bSCathy Avery report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x", 1429d4db486bSCathy Avery vmcb->control.exit_code); 1430d4db486bSCathy Avery return true; 1431d4db486bSCathy Avery } 1432d4db486bSCathy Avery vmcb->save.rip += 3; 1433d4db486bSCathy Avery 1434d4db486bSCathy Avery vmcb->control.intercept |= (1ULL << INTERCEPT_NMI); 1435d4db486bSCathy Avery break; 1436d4db486bSCathy Avery 1437d4db486bSCathy Avery case 1: 1438d4db486bSCathy Avery if (vmcb->control.exit_code != SVM_EXIT_NMI) { 1439d4db486bSCathy Avery report(false, "VMEXIT not due to NMI intercept. Exit reason 0x%x", 1440d4db486bSCathy Avery vmcb->control.exit_code); 1441d4db486bSCathy Avery return true; 1442d4db486bSCathy Avery } 1443d4db486bSCathy Avery 1444d4db486bSCathy Avery report(true, "NMI intercept while running guest"); 1445d4db486bSCathy Avery break; 1446d4db486bSCathy Avery 1447d4db486bSCathy Avery case 2: 1448d4db486bSCathy Avery break; 1449d4db486bSCathy Avery 1450d4db486bSCathy Avery default: 1451d4db486bSCathy Avery return true; 1452d4db486bSCathy Avery } 1453d4db486bSCathy Avery 1454d4db486bSCathy Avery inc_test_stage(test); 1455d4db486bSCathy Avery 1456d4db486bSCathy Avery return get_test_stage(test) == 3; 1457d4db486bSCathy Avery } 1458d4db486bSCathy Avery 1459d4db486bSCathy Avery static bool nmi_check(struct svm_test *test) 1460d4db486bSCathy Avery { 1461d4db486bSCathy Avery return get_test_stage(test) == 3; 1462d4db486bSCathy Avery } 1463d4db486bSCathy Avery 14649da1f4d8SCathy Avery #define NMI_DELAY 100000000ULL 14659da1f4d8SCathy Avery 14669da1f4d8SCathy Avery static void nmi_message_thread(void *_test) 14679da1f4d8SCathy Avery { 14689da1f4d8SCathy Avery struct svm_test *test = _test; 14699da1f4d8SCathy Avery 14709da1f4d8SCathy Avery while (get_test_stage(test) != 1) 14719da1f4d8SCathy Avery pause(); 14729da1f4d8SCathy Avery 14739da1f4d8SCathy Avery delay(NMI_DELAY); 14749da1f4d8SCathy Avery 14759da1f4d8SCathy Avery apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]); 14769da1f4d8SCathy Avery 14779da1f4d8SCathy Avery while (get_test_stage(test) != 2) 14789da1f4d8SCathy Avery pause(); 14799da1f4d8SCathy Avery 14809da1f4d8SCathy Avery delay(NMI_DELAY); 14819da1f4d8SCathy Avery 14829da1f4d8SCathy Avery apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]); 14839da1f4d8SCathy Avery } 14849da1f4d8SCathy Avery 14859da1f4d8SCathy Avery static void nmi_hlt_test(struct svm_test *test) 14869da1f4d8SCathy Avery { 14879da1f4d8SCathy Avery long long start; 14889da1f4d8SCathy Avery 14899da1f4d8SCathy Avery on_cpu_async(1, nmi_message_thread, test); 14909da1f4d8SCathy Avery 14919da1f4d8SCathy Avery start = rdtsc(); 14929da1f4d8SCathy Avery 14939da1f4d8SCathy Avery set_test_stage(test, 1); 14949da1f4d8SCathy Avery 14959da1f4d8SCathy Avery asm volatile ("hlt"); 14969da1f4d8SCathy Avery 14979da1f4d8SCathy Avery report((rdtsc() - start > NMI_DELAY) && nmi_fired, 14989da1f4d8SCathy Avery "direct NMI + hlt"); 14999da1f4d8SCathy Avery 15009da1f4d8SCathy Avery if (!nmi_fired) 15019da1f4d8SCathy Avery set_test_stage(test, -1); 15029da1f4d8SCathy Avery 15039da1f4d8SCathy Avery nmi_fired = false; 15049da1f4d8SCathy Avery 15059da1f4d8SCathy Avery vmmcall(); 15069da1f4d8SCathy Avery 15079da1f4d8SCathy Avery start = rdtsc(); 15089da1f4d8SCathy Avery 15099da1f4d8SCathy Avery set_test_stage(test, 2); 15109da1f4d8SCathy Avery 15119da1f4d8SCathy Avery asm volatile ("hlt"); 15129da1f4d8SCathy Avery 15139da1f4d8SCathy Avery report((rdtsc() - start > NMI_DELAY) && nmi_fired, 15149da1f4d8SCathy Avery "intercepted NMI + hlt"); 15159da1f4d8SCathy Avery 15169da1f4d8SCathy Avery if (!nmi_fired) { 15179da1f4d8SCathy Avery report(nmi_fired, "intercepted pending NMI not dispatched"); 15189da1f4d8SCathy Avery set_test_stage(test, -1); 15197e7d9357SCathy Avery vmmcall(); 15209da1f4d8SCathy Avery } 15219da1f4d8SCathy Avery 15229da1f4d8SCathy Avery set_test_stage(test, 3); 15239da1f4d8SCathy Avery } 15249da1f4d8SCathy Avery 15259da1f4d8SCathy Avery static bool nmi_hlt_finished(struct svm_test *test) 15269da1f4d8SCathy Avery { 15279da1f4d8SCathy Avery switch (get_test_stage(test)) { 15289da1f4d8SCathy Avery case 1: 15299da1f4d8SCathy Avery if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 15309da1f4d8SCathy Avery report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x", 15319da1f4d8SCathy Avery vmcb->control.exit_code); 15329da1f4d8SCathy Avery return true; 15339da1f4d8SCathy Avery } 15349da1f4d8SCathy Avery vmcb->save.rip += 3; 15359da1f4d8SCathy Avery 15369da1f4d8SCathy Avery vmcb->control.intercept |= (1ULL << INTERCEPT_NMI); 15379da1f4d8SCathy Avery break; 15389da1f4d8SCathy Avery 15399da1f4d8SCathy Avery case 2: 15409da1f4d8SCathy Avery if (vmcb->control.exit_code != SVM_EXIT_NMI) { 15419da1f4d8SCathy Avery report(false, "VMEXIT not due to NMI intercept. Exit reason 0x%x", 15429da1f4d8SCathy Avery vmcb->control.exit_code); 15439da1f4d8SCathy Avery return true; 15449da1f4d8SCathy Avery } 15459da1f4d8SCathy Avery 15469da1f4d8SCathy Avery report(true, "NMI intercept while running guest"); 15479da1f4d8SCathy Avery break; 15489da1f4d8SCathy Avery 15499da1f4d8SCathy Avery case 3: 15509da1f4d8SCathy Avery break; 15519da1f4d8SCathy Avery 15529da1f4d8SCathy Avery default: 15539da1f4d8SCathy Avery return true; 15549da1f4d8SCathy Avery } 15559da1f4d8SCathy Avery 15569da1f4d8SCathy Avery return get_test_stage(test) == 3; 15579da1f4d8SCathy Avery } 15589da1f4d8SCathy Avery 15599da1f4d8SCathy Avery static bool nmi_hlt_check(struct svm_test *test) 15609da1f4d8SCathy Avery { 15619da1f4d8SCathy Avery return get_test_stage(test) == 3; 15629da1f4d8SCathy Avery } 15639da1f4d8SCathy Avery 15644b4fb247SPaolo Bonzini static volatile int count_exc = 0; 15654b4fb247SPaolo Bonzini 15664b4fb247SPaolo Bonzini static void my_isr(struct ex_regs *r) 15674b4fb247SPaolo Bonzini { 15684b4fb247SPaolo Bonzini count_exc++; 15694b4fb247SPaolo Bonzini } 15704b4fb247SPaolo Bonzini 15714b4fb247SPaolo Bonzini static void exc_inject_prepare(struct svm_test *test) 15724b4fb247SPaolo Bonzini { 15738634a266SPaolo Bonzini default_prepare(test); 15744b4fb247SPaolo Bonzini handle_exception(DE_VECTOR, my_isr); 15754b4fb247SPaolo Bonzini handle_exception(NMI_VECTOR, my_isr); 15764b4fb247SPaolo Bonzini } 15774b4fb247SPaolo Bonzini 15784b4fb247SPaolo Bonzini 15794b4fb247SPaolo Bonzini static void exc_inject_test(struct svm_test *test) 15804b4fb247SPaolo Bonzini { 15814b4fb247SPaolo Bonzini asm volatile ("vmmcall\n\tvmmcall\n\t"); 15824b4fb247SPaolo Bonzini } 15834b4fb247SPaolo Bonzini 15844b4fb247SPaolo Bonzini static bool exc_inject_finished(struct svm_test *test) 15854b4fb247SPaolo Bonzini { 15864b4fb247SPaolo Bonzini switch (get_test_stage(test)) { 15874b4fb247SPaolo Bonzini case 0: 15884b4fb247SPaolo Bonzini if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 15894b4fb247SPaolo Bonzini report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x", 15904b4fb247SPaolo Bonzini vmcb->control.exit_code); 15914b4fb247SPaolo Bonzini return true; 15924b4fb247SPaolo Bonzini } 15932c1ca866SNadav Amit vmcb->save.rip += 3; 15944b4fb247SPaolo Bonzini vmcb->control.event_inj = NMI_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID; 15954b4fb247SPaolo Bonzini break; 15964b4fb247SPaolo Bonzini 15974b4fb247SPaolo Bonzini case 1: 15984b4fb247SPaolo Bonzini if (vmcb->control.exit_code != SVM_EXIT_ERR) { 15994b4fb247SPaolo Bonzini report(false, "VMEXIT not due to error. Exit reason 0x%x", 16004b4fb247SPaolo Bonzini vmcb->control.exit_code); 16014b4fb247SPaolo Bonzini return true; 16024b4fb247SPaolo Bonzini } 16034b4fb247SPaolo Bonzini report(count_exc == 0, "exception with vector 2 not injected"); 16044b4fb247SPaolo Bonzini vmcb->control.event_inj = DE_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID; 16054b4fb247SPaolo Bonzini break; 16064b4fb247SPaolo Bonzini 16074b4fb247SPaolo Bonzini case 2: 16084b4fb247SPaolo Bonzini if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 16094b4fb247SPaolo Bonzini report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x", 16104b4fb247SPaolo Bonzini vmcb->control.exit_code); 16114b4fb247SPaolo Bonzini return true; 16124b4fb247SPaolo Bonzini } 16132c1ca866SNadav Amit vmcb->save.rip += 3; 16144b4fb247SPaolo Bonzini report(count_exc == 1, "divide overflow exception injected"); 16154b4fb247SPaolo Bonzini report(!(vmcb->control.event_inj & SVM_EVTINJ_VALID), "eventinj.VALID cleared"); 16164b4fb247SPaolo Bonzini break; 16174b4fb247SPaolo Bonzini 16184b4fb247SPaolo Bonzini default: 16194b4fb247SPaolo Bonzini return true; 16204b4fb247SPaolo Bonzini } 16214b4fb247SPaolo Bonzini 16224b4fb247SPaolo Bonzini inc_test_stage(test); 16234b4fb247SPaolo Bonzini 16244b4fb247SPaolo Bonzini return get_test_stage(test) == 3; 16254b4fb247SPaolo Bonzini } 16264b4fb247SPaolo Bonzini 16274b4fb247SPaolo Bonzini static bool exc_inject_check(struct svm_test *test) 16284b4fb247SPaolo Bonzini { 16294b4fb247SPaolo Bonzini return count_exc == 1 && get_test_stage(test) == 3; 16304b4fb247SPaolo Bonzini } 16314b4fb247SPaolo Bonzini 16329c838954SCathy Avery static volatile bool virq_fired; 16339c838954SCathy Avery 16349c838954SCathy Avery static void virq_isr(isr_regs_t *regs) 16359c838954SCathy Avery { 16369c838954SCathy Avery virq_fired = true; 16379c838954SCathy Avery } 16389c838954SCathy Avery 16399c838954SCathy Avery static void virq_inject_prepare(struct svm_test *test) 16409c838954SCathy Avery { 16419c838954SCathy Avery handle_irq(0xf1, virq_isr); 16429c838954SCathy Avery default_prepare(test); 16439c838954SCathy Avery vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK | 16449c838954SCathy Avery (0x0f << V_INTR_PRIO_SHIFT); // Set to the highest priority 16459c838954SCathy Avery vmcb->control.int_vector = 0xf1; 16469c838954SCathy Avery virq_fired = false; 16479c838954SCathy Avery set_test_stage(test, 0); 16489c838954SCathy Avery } 16499c838954SCathy Avery 16509c838954SCathy Avery static void virq_inject_test(struct svm_test *test) 16519c838954SCathy Avery { 16529c838954SCathy Avery if (virq_fired) { 16539c838954SCathy Avery report(false, "virtual interrupt fired before L2 sti"); 16549c838954SCathy Avery set_test_stage(test, -1); 16559c838954SCathy Avery vmmcall(); 16569c838954SCathy Avery } 16579c838954SCathy Avery 16589c838954SCathy Avery irq_enable(); 16599c838954SCathy Avery asm volatile ("nop"); 16609c838954SCathy Avery irq_disable(); 16619c838954SCathy Avery 16629c838954SCathy Avery if (!virq_fired) { 16639c838954SCathy Avery report(false, "virtual interrupt not fired after L2 sti"); 16649c838954SCathy Avery set_test_stage(test, -1); 16659c838954SCathy Avery } 16669c838954SCathy Avery 16679c838954SCathy Avery vmmcall(); 16689c838954SCathy Avery 16699c838954SCathy Avery if (virq_fired) { 16709c838954SCathy Avery report(false, "virtual interrupt fired before L2 sti after VINTR intercept"); 16719c838954SCathy Avery set_test_stage(test, -1); 16729c838954SCathy Avery vmmcall(); 16739c838954SCathy Avery } 16749c838954SCathy Avery 16759c838954SCathy Avery irq_enable(); 16769c838954SCathy Avery asm volatile ("nop"); 16779c838954SCathy Avery irq_disable(); 16789c838954SCathy Avery 16799c838954SCathy Avery if (!virq_fired) { 16809c838954SCathy Avery report(false, "virtual interrupt not fired after return from VINTR intercept"); 16819c838954SCathy Avery set_test_stage(test, -1); 16829c838954SCathy Avery } 16839c838954SCathy Avery 16849c838954SCathy Avery vmmcall(); 16859c838954SCathy Avery 16869c838954SCathy Avery irq_enable(); 16879c838954SCathy Avery asm volatile ("nop"); 16889c838954SCathy Avery irq_disable(); 16899c838954SCathy Avery 16909c838954SCathy Avery if (virq_fired) { 16919c838954SCathy Avery report(false, "virtual interrupt fired when V_IRQ_PRIO less than V_TPR"); 16929c838954SCathy Avery set_test_stage(test, -1); 16939c838954SCathy Avery } 16949c838954SCathy Avery 16959c838954SCathy Avery vmmcall(); 16969c838954SCathy Avery vmmcall(); 16979c838954SCathy Avery } 16989c838954SCathy Avery 16999c838954SCathy Avery static bool virq_inject_finished(struct svm_test *test) 17009c838954SCathy Avery { 17019c838954SCathy Avery vmcb->save.rip += 3; 17029c838954SCathy Avery 17039c838954SCathy Avery switch (get_test_stage(test)) { 17049c838954SCathy Avery case 0: 17059c838954SCathy Avery if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 17069c838954SCathy Avery report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x", 17079c838954SCathy Avery vmcb->control.exit_code); 17089c838954SCathy Avery return true; 17099c838954SCathy Avery } 17109c838954SCathy Avery if (vmcb->control.int_ctl & V_IRQ_MASK) { 17119c838954SCathy Avery report(false, "V_IRQ not cleared on VMEXIT after firing"); 17129c838954SCathy Avery return true; 17139c838954SCathy Avery } 17149c838954SCathy Avery virq_fired = false; 17159c838954SCathy Avery vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR); 17169c838954SCathy Avery vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK | 17179c838954SCathy Avery (0x0f << V_INTR_PRIO_SHIFT); 17189c838954SCathy Avery break; 17199c838954SCathy Avery 17209c838954SCathy Avery case 1: 17219c838954SCathy Avery if (vmcb->control.exit_code != SVM_EXIT_VINTR) { 17229c838954SCathy Avery report(false, "VMEXIT not due to vintr. Exit reason 0x%x", 17239c838954SCathy Avery vmcb->control.exit_code); 17249c838954SCathy Avery return true; 17259c838954SCathy Avery } 17269c838954SCathy Avery if (virq_fired) { 17279c838954SCathy Avery report(false, "V_IRQ fired before SVM_EXIT_VINTR"); 17289c838954SCathy Avery return true; 17299c838954SCathy Avery } 17309c838954SCathy Avery vmcb->control.intercept &= ~(1ULL << INTERCEPT_VINTR); 17319c838954SCathy Avery break; 17329c838954SCathy Avery 17339c838954SCathy Avery case 2: 17349c838954SCathy Avery if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 17359c838954SCathy Avery report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x", 17369c838954SCathy Avery vmcb->control.exit_code); 17379c838954SCathy Avery return true; 17389c838954SCathy Avery } 17399c838954SCathy Avery virq_fired = false; 17409c838954SCathy Avery // Set irq to lower priority 17419c838954SCathy Avery vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK | 17429c838954SCathy Avery (0x08 << V_INTR_PRIO_SHIFT); 17439c838954SCathy Avery // Raise guest TPR 17449c838954SCathy Avery vmcb->control.int_ctl |= 0x0a & V_TPR_MASK; 17459c838954SCathy Avery break; 17469c838954SCathy Avery 17479c838954SCathy Avery case 3: 17489c838954SCathy Avery if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 17499c838954SCathy Avery report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x", 17509c838954SCathy Avery vmcb->control.exit_code); 17519c838954SCathy Avery return true; 17529c838954SCathy Avery } 17539c838954SCathy Avery vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR); 17549c838954SCathy Avery break; 17559c838954SCathy Avery 17569c838954SCathy Avery case 4: 17579c838954SCathy Avery // INTERCEPT_VINTR should be ignored because V_INTR_PRIO < V_TPR 17589c838954SCathy Avery if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 17599c838954SCathy Avery report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x", 17609c838954SCathy Avery vmcb->control.exit_code); 17619c838954SCathy Avery return true; 17629c838954SCathy Avery } 17639c838954SCathy Avery break; 17649c838954SCathy Avery 17659c838954SCathy Avery default: 17669c838954SCathy Avery return true; 17679c838954SCathy Avery } 17689c838954SCathy Avery 17699c838954SCathy Avery inc_test_stage(test); 17709c838954SCathy Avery 17719c838954SCathy Avery return get_test_stage(test) == 5; 17729c838954SCathy Avery } 17739c838954SCathy Avery 17749c838954SCathy Avery static bool virq_inject_check(struct svm_test *test) 17759c838954SCathy Avery { 17769c838954SCathy Avery return get_test_stage(test) == 5; 17779c838954SCathy Avery } 17789c838954SCathy Avery 1779da338a31SMaxim Levitsky /* 1780da338a31SMaxim Levitsky * Detect nested guest RIP corruption as explained in kernel commit 1781da338a31SMaxim Levitsky * b6162e82aef19fee9c32cb3fe9ac30d9116a8c73 1782da338a31SMaxim Levitsky * 1783da338a31SMaxim Levitsky * In the assembly loop below 'ins' is executed while IO instructions 1784da338a31SMaxim Levitsky * are not intercepted; the instruction is emulated by L0. 1785da338a31SMaxim Levitsky * 1786da338a31SMaxim Levitsky * At the same time we are getting interrupts from the local APIC timer, 1787da338a31SMaxim Levitsky * and we do intercept them in L1 1788da338a31SMaxim Levitsky * 1789da338a31SMaxim Levitsky * If the interrupt happens on the insb instruction, L0 will VMexit, emulate 1790da338a31SMaxim Levitsky * the insb instruction and then it will inject the interrupt to L1 through 1791da338a31SMaxim Levitsky * a nested VMexit. Due to a bug, it would leave pre-emulation values of RIP, 1792da338a31SMaxim Levitsky * RAX and RSP in the VMCB. 1793da338a31SMaxim Levitsky * 1794da338a31SMaxim Levitsky * In our intercept handler we detect the bug by checking that RIP is that of 1795da338a31SMaxim Levitsky * the insb instruction, but its memory operand has already been written. 1796da338a31SMaxim Levitsky * This means that insb was already executed. 1797da338a31SMaxim Levitsky */ 1798da338a31SMaxim Levitsky 1799da338a31SMaxim Levitsky static volatile int isr_cnt = 0; 1800da338a31SMaxim Levitsky static volatile uint8_t io_port_var = 0xAA; 1801da338a31SMaxim Levitsky extern const char insb_instruction_label[]; 1802da338a31SMaxim Levitsky 1803da338a31SMaxim Levitsky static void reg_corruption_isr(isr_regs_t *regs) 1804da338a31SMaxim Levitsky { 1805da338a31SMaxim Levitsky isr_cnt++; 1806da338a31SMaxim Levitsky apic_write(APIC_EOI, 0); 1807da338a31SMaxim Levitsky } 1808da338a31SMaxim Levitsky 1809da338a31SMaxim Levitsky static void reg_corruption_prepare(struct svm_test *test) 1810da338a31SMaxim Levitsky { 1811da338a31SMaxim Levitsky default_prepare(test); 1812da338a31SMaxim Levitsky set_test_stage(test, 0); 1813da338a31SMaxim Levitsky 1814da338a31SMaxim Levitsky vmcb->control.int_ctl = V_INTR_MASKING_MASK; 1815da338a31SMaxim Levitsky vmcb->control.intercept |= (1ULL << INTERCEPT_INTR); 1816da338a31SMaxim Levitsky 1817da338a31SMaxim Levitsky handle_irq(TIMER_VECTOR, reg_corruption_isr); 1818da338a31SMaxim Levitsky 1819da338a31SMaxim Levitsky /* set local APIC to inject external interrupts */ 1820da338a31SMaxim Levitsky apic_write(APIC_TMICT, 0); 1821da338a31SMaxim Levitsky apic_write(APIC_TDCR, 0); 1822da338a31SMaxim Levitsky apic_write(APIC_LVTT, TIMER_VECTOR | APIC_LVT_TIMER_PERIODIC); 1823da338a31SMaxim Levitsky apic_write(APIC_TMICT, 1000); 1824da338a31SMaxim Levitsky } 1825da338a31SMaxim Levitsky 1826da338a31SMaxim Levitsky static void reg_corruption_test(struct svm_test *test) 1827da338a31SMaxim Levitsky { 1828da338a31SMaxim Levitsky /* this is endless loop, which is interrupted by the timer interrupt */ 1829da338a31SMaxim Levitsky asm volatile ( 1830da338a31SMaxim Levitsky "1:\n\t" 1831da338a31SMaxim Levitsky "movw $0x4d0, %%dx\n\t" // IO port 1832da338a31SMaxim Levitsky "lea %[io_port_var], %%rdi\n\t" 1833da338a31SMaxim Levitsky "movb $0xAA, %[io_port_var]\n\t" 1834da338a31SMaxim Levitsky "insb_instruction_label:\n\t" 1835da338a31SMaxim Levitsky "insb\n\t" 1836da338a31SMaxim Levitsky "jmp 1b\n\t" 1837da338a31SMaxim Levitsky 1838da338a31SMaxim Levitsky : [io_port_var] "=m" (io_port_var) 1839da338a31SMaxim Levitsky : /* no inputs*/ 1840da338a31SMaxim Levitsky : "rdx", "rdi" 1841da338a31SMaxim Levitsky ); 1842da338a31SMaxim Levitsky } 1843da338a31SMaxim Levitsky 1844da338a31SMaxim Levitsky static bool reg_corruption_finished(struct svm_test *test) 1845da338a31SMaxim Levitsky { 1846da338a31SMaxim Levitsky if (isr_cnt == 10000) { 1847da338a31SMaxim Levitsky report(true, 1848da338a31SMaxim Levitsky "No RIP corruption detected after %d timer interrupts", 1849da338a31SMaxim Levitsky isr_cnt); 1850da338a31SMaxim Levitsky set_test_stage(test, 1); 1851da338a31SMaxim Levitsky return true; 1852da338a31SMaxim Levitsky } 1853da338a31SMaxim Levitsky 1854da338a31SMaxim Levitsky if (vmcb->control.exit_code == SVM_EXIT_INTR) { 1855da338a31SMaxim Levitsky 1856da338a31SMaxim Levitsky void* guest_rip = (void*)vmcb->save.rip; 1857da338a31SMaxim Levitsky 1858da338a31SMaxim Levitsky irq_enable(); 1859da338a31SMaxim Levitsky asm volatile ("nop"); 1860da338a31SMaxim Levitsky irq_disable(); 1861da338a31SMaxim Levitsky 1862da338a31SMaxim Levitsky if (guest_rip == insb_instruction_label && io_port_var != 0xAA) { 1863da338a31SMaxim Levitsky report(false, 1864da338a31SMaxim Levitsky "RIP corruption detected after %d timer interrupts", 1865da338a31SMaxim Levitsky isr_cnt); 1866da338a31SMaxim Levitsky return true; 1867da338a31SMaxim Levitsky } 1868da338a31SMaxim Levitsky 1869da338a31SMaxim Levitsky } 1870da338a31SMaxim Levitsky return false; 1871da338a31SMaxim Levitsky } 1872da338a31SMaxim Levitsky 1873da338a31SMaxim Levitsky static bool reg_corruption_check(struct svm_test *test) 1874da338a31SMaxim Levitsky { 1875da338a31SMaxim Levitsky return get_test_stage(test) == 1; 1876da338a31SMaxim Levitsky } 1877da338a31SMaxim Levitsky 18784770e9c8SCathy Avery static void get_tss_entry(void *data) 18794770e9c8SCathy Avery { 18804770e9c8SCathy Avery struct descriptor_table_ptr gdt; 18814770e9c8SCathy Avery struct segment_desc64 *gdt_table; 18824770e9c8SCathy Avery struct segment_desc64 *tss_entry; 18834770e9c8SCathy Avery u16 tr = 0; 18844770e9c8SCathy Avery 18854770e9c8SCathy Avery sgdt(&gdt); 18864770e9c8SCathy Avery tr = str(); 18874770e9c8SCathy Avery gdt_table = (struct segment_desc64 *) gdt.base; 18884770e9c8SCathy Avery tss_entry = &gdt_table[tr / sizeof(struct segment_desc64)]; 18894770e9c8SCathy Avery *((struct segment_desc64 **)data) = tss_entry; 18904770e9c8SCathy Avery } 18914770e9c8SCathy Avery 18924770e9c8SCathy Avery static int orig_cpu_count; 18934770e9c8SCathy Avery 18944770e9c8SCathy Avery static void init_startup_prepare(struct svm_test *test) 18954770e9c8SCathy Avery { 18964770e9c8SCathy Avery struct segment_desc64 *tss_entry; 18974770e9c8SCathy Avery int i; 18984770e9c8SCathy Avery 18994770e9c8SCathy Avery on_cpu(1, get_tss_entry, &tss_entry); 19004770e9c8SCathy Avery 19014770e9c8SCathy Avery orig_cpu_count = cpu_online_count; 19024770e9c8SCathy Avery 19034770e9c8SCathy Avery apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_INIT | APIC_INT_ASSERT, 19044770e9c8SCathy Avery id_map[1]); 19054770e9c8SCathy Avery 19064770e9c8SCathy Avery delay(100000000ULL); 19074770e9c8SCathy Avery 19084770e9c8SCathy Avery --cpu_online_count; 19094770e9c8SCathy Avery 19104770e9c8SCathy Avery *(uint64_t *)tss_entry &= ~DESC_BUSY; 19114770e9c8SCathy Avery 19124770e9c8SCathy Avery apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_STARTUP, id_map[1]); 19134770e9c8SCathy Avery 19144770e9c8SCathy Avery for (i = 0; i < 5 && cpu_online_count < orig_cpu_count; i++) 19154770e9c8SCathy Avery delay(100000000ULL); 19164770e9c8SCathy Avery } 19174770e9c8SCathy Avery 19184770e9c8SCathy Avery static bool init_startup_finished(struct svm_test *test) 19194770e9c8SCathy Avery { 19204770e9c8SCathy Avery return true; 19214770e9c8SCathy Avery } 19224770e9c8SCathy Avery 19234770e9c8SCathy Avery static bool init_startup_check(struct svm_test *test) 19244770e9c8SCathy Avery { 19254770e9c8SCathy Avery return cpu_online_count == orig_cpu_count; 19264770e9c8SCathy Avery } 19274770e9c8SCathy Avery 1928d5da6dfeSCathy Avery static volatile bool init_intercept; 1929d5da6dfeSCathy Avery 1930d5da6dfeSCathy Avery static void init_intercept_prepare(struct svm_test *test) 1931d5da6dfeSCathy Avery { 1932d5da6dfeSCathy Avery init_intercept = false; 1933d5da6dfeSCathy Avery vmcb->control.intercept |= (1ULL << INTERCEPT_INIT); 1934d5da6dfeSCathy Avery } 1935d5da6dfeSCathy Avery 1936d5da6dfeSCathy Avery static void init_intercept_test(struct svm_test *test) 1937d5da6dfeSCathy Avery { 1938d5da6dfeSCathy Avery apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_INIT | APIC_INT_ASSERT, 0); 1939d5da6dfeSCathy Avery } 1940d5da6dfeSCathy Avery 1941d5da6dfeSCathy Avery static bool init_intercept_finished(struct svm_test *test) 1942d5da6dfeSCathy Avery { 1943d5da6dfeSCathy Avery vmcb->save.rip += 3; 1944d5da6dfeSCathy Avery 1945d5da6dfeSCathy Avery if (vmcb->control.exit_code != SVM_EXIT_INIT) { 1946d5da6dfeSCathy Avery report(false, "VMEXIT not due to init intercept. Exit reason 0x%x", 1947d5da6dfeSCathy Avery vmcb->control.exit_code); 1948d5da6dfeSCathy Avery 1949d5da6dfeSCathy Avery return true; 1950d5da6dfeSCathy Avery } 1951d5da6dfeSCathy Avery 1952d5da6dfeSCathy Avery init_intercept = true; 1953d5da6dfeSCathy Avery 1954d5da6dfeSCathy Avery report(true, "INIT to vcpu intercepted"); 1955d5da6dfeSCathy Avery 1956d5da6dfeSCathy Avery return true; 1957d5da6dfeSCathy Avery } 1958d5da6dfeSCathy Avery 1959d5da6dfeSCathy Avery static bool init_intercept_check(struct svm_test *test) 1960d5da6dfeSCathy Avery { 1961d5da6dfeSCathy Avery return init_intercept; 1962d5da6dfeSCathy Avery } 1963d5da6dfeSCathy Avery 19647839b0ecSKrish Sadhukhan /* 19657839b0ecSKrish Sadhukhan * Setting host EFLAGS.TF causes a #DB trap after the VMRUN completes on the 19667839b0ecSKrish Sadhukhan * host side (i.e., after the #VMEXIT from the guest). 19677839b0ecSKrish Sadhukhan * 19687839b0ecSKrish Sadhukhan * [AMD APM] 19697839b0ecSKrish Sadhukhan */ 19707839b0ecSKrish Sadhukhan static volatile u8 host_rflags_guest_main_flag = 0; 19717839b0ecSKrish Sadhukhan static volatile u8 host_rflags_db_handler_flag = 0; 19727839b0ecSKrish Sadhukhan static volatile bool host_rflags_ss_on_vmrun = false; 19737839b0ecSKrish Sadhukhan static volatile bool host_rflags_vmrun_reached = false; 19747839b0ecSKrish Sadhukhan static volatile bool host_rflags_set_tf = false; 19757839b0ecSKrish Sadhukhan static u64 post_vmrun_rip; 19767839b0ecSKrish Sadhukhan 19777839b0ecSKrish Sadhukhan extern u64 *vmrun_rip; 19787839b0ecSKrish Sadhukhan 19797839b0ecSKrish Sadhukhan static void host_rflags_db_handler(struct ex_regs *r) 19807839b0ecSKrish Sadhukhan { 19817839b0ecSKrish Sadhukhan if (host_rflags_ss_on_vmrun) { 19827839b0ecSKrish Sadhukhan if (host_rflags_vmrun_reached) { 19837839b0ecSKrish Sadhukhan r->rflags &= ~X86_EFLAGS_TF; 19847839b0ecSKrish Sadhukhan post_vmrun_rip = r->rip; 19857839b0ecSKrish Sadhukhan } else { 19867839b0ecSKrish Sadhukhan if (r->rip == (u64)&vmrun_rip) 19877839b0ecSKrish Sadhukhan host_rflags_vmrun_reached = true; 19887839b0ecSKrish Sadhukhan } 19897839b0ecSKrish Sadhukhan } else { 19907839b0ecSKrish Sadhukhan r->rflags &= ~X86_EFLAGS_TF; 19917839b0ecSKrish Sadhukhan } 19927839b0ecSKrish Sadhukhan } 19937839b0ecSKrish Sadhukhan 19947839b0ecSKrish Sadhukhan static void host_rflags_prepare(struct svm_test *test) 19957839b0ecSKrish Sadhukhan { 19967839b0ecSKrish Sadhukhan default_prepare(test); 19977839b0ecSKrish Sadhukhan handle_exception(DB_VECTOR, host_rflags_db_handler); 19987839b0ecSKrish Sadhukhan set_test_stage(test, 0); 19997839b0ecSKrish Sadhukhan } 20007839b0ecSKrish Sadhukhan 20017839b0ecSKrish Sadhukhan static void host_rflags_prepare_gif_clear(struct svm_test *test) 20027839b0ecSKrish Sadhukhan { 20037839b0ecSKrish Sadhukhan if (host_rflags_set_tf) 20047839b0ecSKrish Sadhukhan write_rflags(read_rflags() | X86_EFLAGS_TF); 20057839b0ecSKrish Sadhukhan } 20067839b0ecSKrish Sadhukhan 20077839b0ecSKrish Sadhukhan static void host_rflags_test(struct svm_test *test) 20087839b0ecSKrish Sadhukhan { 20097839b0ecSKrish Sadhukhan while (1) { 20107839b0ecSKrish Sadhukhan if (get_test_stage(test) > 0 && host_rflags_set_tf && 20117839b0ecSKrish Sadhukhan (!host_rflags_ss_on_vmrun) && 20127839b0ecSKrish Sadhukhan (!host_rflags_db_handler_flag)) 20137839b0ecSKrish Sadhukhan host_rflags_guest_main_flag = 1; 20147839b0ecSKrish Sadhukhan if (get_test_stage(test) == 3) 20157839b0ecSKrish Sadhukhan break; 20167839b0ecSKrish Sadhukhan vmmcall(); 20177839b0ecSKrish Sadhukhan } 20187839b0ecSKrish Sadhukhan } 20197839b0ecSKrish Sadhukhan 20207839b0ecSKrish Sadhukhan static bool host_rflags_finished(struct svm_test *test) 20217839b0ecSKrish Sadhukhan { 20227839b0ecSKrish Sadhukhan switch (get_test_stage(test)) { 20237839b0ecSKrish Sadhukhan case 0: 20247839b0ecSKrish Sadhukhan if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 20257839b0ecSKrish Sadhukhan report(false, "Unexpected VMEXIT. Exit reason 0x%x", 20267839b0ecSKrish Sadhukhan vmcb->control.exit_code); 20277839b0ecSKrish Sadhukhan return true; 20287839b0ecSKrish Sadhukhan } 20297839b0ecSKrish Sadhukhan vmcb->save.rip += 3; 20307839b0ecSKrish Sadhukhan /* 20317839b0ecSKrish Sadhukhan * Setting host EFLAGS.TF not immediately before VMRUN, causes 20327839b0ecSKrish Sadhukhan * #DB trap before first guest instruction is executed 20337839b0ecSKrish Sadhukhan */ 20347839b0ecSKrish Sadhukhan host_rflags_set_tf = true; 20357839b0ecSKrish Sadhukhan break; 20367839b0ecSKrish Sadhukhan case 1: 20377839b0ecSKrish Sadhukhan if (vmcb->control.exit_code != SVM_EXIT_VMMCALL || 20387839b0ecSKrish Sadhukhan (!host_rflags_guest_main_flag)) { 20397839b0ecSKrish Sadhukhan report(false, "Unexpected VMEXIT or #DB handler" 20407839b0ecSKrish Sadhukhan " invoked before guest main. Exit reason 0x%x", 20417839b0ecSKrish Sadhukhan vmcb->control.exit_code); 20427839b0ecSKrish Sadhukhan return true; 20437839b0ecSKrish Sadhukhan } 20447839b0ecSKrish Sadhukhan vmcb->save.rip += 3; 20457839b0ecSKrish Sadhukhan /* 20467839b0ecSKrish Sadhukhan * Setting host EFLAGS.TF immediately before VMRUN, causes #DB 20477839b0ecSKrish Sadhukhan * trap after VMRUN completes on the host side (i.e., after 20487839b0ecSKrish Sadhukhan * VMEXIT from guest). 20497839b0ecSKrish Sadhukhan */ 20507839b0ecSKrish Sadhukhan host_rflags_ss_on_vmrun = true; 20517839b0ecSKrish Sadhukhan break; 20527839b0ecSKrish Sadhukhan case 2: 20537839b0ecSKrish Sadhukhan if (vmcb->control.exit_code != SVM_EXIT_VMMCALL || 20547839b0ecSKrish Sadhukhan (post_vmrun_rip - (u64)&vmrun_rip) != 3) { 20557839b0ecSKrish Sadhukhan report(false, "Unexpected VMEXIT or RIP mismatch." 20567839b0ecSKrish Sadhukhan " Exit reason 0x%x, VMRUN RIP: %lx, post-VMRUN" 20577839b0ecSKrish Sadhukhan " RIP: %lx", vmcb->control.exit_code, 20587839b0ecSKrish Sadhukhan (u64)&vmrun_rip, post_vmrun_rip); 20597839b0ecSKrish Sadhukhan return true; 20607839b0ecSKrish Sadhukhan } 20617839b0ecSKrish Sadhukhan host_rflags_set_tf = false; 20627839b0ecSKrish Sadhukhan vmcb->save.rip += 3; 20637839b0ecSKrish Sadhukhan break; 20647839b0ecSKrish Sadhukhan default: 20657839b0ecSKrish Sadhukhan return true; 20667839b0ecSKrish Sadhukhan } 20677839b0ecSKrish Sadhukhan inc_test_stage(test); 20687839b0ecSKrish Sadhukhan return get_test_stage(test) == 4; 20697839b0ecSKrish Sadhukhan } 20707839b0ecSKrish Sadhukhan 20717839b0ecSKrish Sadhukhan static bool host_rflags_check(struct svm_test *test) 20727839b0ecSKrish Sadhukhan { 20737839b0ecSKrish Sadhukhan return get_test_stage(test) == 3; 20747839b0ecSKrish Sadhukhan } 20757839b0ecSKrish Sadhukhan 20768660d1b5SKrish Sadhukhan #define TEST(name) { #name, .v2 = name } 20778660d1b5SKrish Sadhukhan 2078ba29942cSKrish Sadhukhan /* 2079ba29942cSKrish Sadhukhan * v2 tests 2080ba29942cSKrish Sadhukhan */ 2081ba29942cSKrish Sadhukhan 2082f32183f5SJim Mattson /* 2083f32183f5SJim Mattson * Ensure that kvm recalculates the L1 guest's CPUID.01H:ECX.OSXSAVE 2084f32183f5SJim Mattson * after VM-exit from an L2 guest that sets CR4.OSXSAVE to a different 2085f32183f5SJim Mattson * value than in L1. 2086f32183f5SJim Mattson */ 2087f32183f5SJim Mattson 2088f32183f5SJim Mattson static void svm_cr4_osxsave_test_guest(struct svm_test *test) 2089f32183f5SJim Mattson { 2090f32183f5SJim Mattson write_cr4(read_cr4() & ~X86_CR4_OSXSAVE); 2091f32183f5SJim Mattson } 2092f32183f5SJim Mattson 2093f32183f5SJim Mattson static void svm_cr4_osxsave_test(void) 2094f32183f5SJim Mattson { 2095f32183f5SJim Mattson if (!this_cpu_has(X86_FEATURE_XSAVE)) { 2096f32183f5SJim Mattson report_skip("XSAVE not detected"); 2097f32183f5SJim Mattson return; 2098f32183f5SJim Mattson } 2099f32183f5SJim Mattson 2100f32183f5SJim Mattson if (!(read_cr4() & X86_CR4_OSXSAVE)) { 2101f32183f5SJim Mattson unsigned long cr4 = read_cr4() | X86_CR4_OSXSAVE; 2102f32183f5SJim Mattson 2103f32183f5SJim Mattson write_cr4(cr4); 2104f32183f5SJim Mattson vmcb->save.cr4 = cr4; 2105f32183f5SJim Mattson } 2106f32183f5SJim Mattson 2107f32183f5SJim Mattson report(cpuid_osxsave(), "CPUID.01H:ECX.XSAVE set before VMRUN"); 2108f32183f5SJim Mattson 2109f32183f5SJim Mattson test_set_guest(svm_cr4_osxsave_test_guest); 2110f32183f5SJim Mattson report(svm_vmrun() == SVM_EXIT_VMMCALL, 2111f32183f5SJim Mattson "svm_cr4_osxsave_test_guest finished with VMMCALL"); 2112f32183f5SJim Mattson 2113f32183f5SJim Mattson report(cpuid_osxsave(), "CPUID.01H:ECX.XSAVE set after VMRUN"); 2114f32183f5SJim Mattson } 2115f32183f5SJim Mattson 2116ba29942cSKrish Sadhukhan static void basic_guest_main(struct svm_test *test) 2117ba29942cSKrish Sadhukhan { 2118ba29942cSKrish Sadhukhan } 2119ba29942cSKrish Sadhukhan 2120eae10e8fSKrish Sadhukhan 2121eae10e8fSKrish Sadhukhan #define SVM_TEST_REG_RESERVED_BITS(start, end, inc, str_name, reg, val, \ 2122eae10e8fSKrish Sadhukhan resv_mask) \ 2123eae10e8fSKrish Sadhukhan { \ 2124eae10e8fSKrish Sadhukhan u64 tmp, mask; \ 2125eae10e8fSKrish Sadhukhan int i; \ 2126eae10e8fSKrish Sadhukhan \ 2127eae10e8fSKrish Sadhukhan for (i = start; i <= end; i = i + inc) { \ 2128eae10e8fSKrish Sadhukhan mask = 1ull << i; \ 2129eae10e8fSKrish Sadhukhan if (!(mask & resv_mask)) \ 2130eae10e8fSKrish Sadhukhan continue; \ 2131eae10e8fSKrish Sadhukhan tmp = val | mask; \ 2132eae10e8fSKrish Sadhukhan reg = tmp; \ 2133eae10e8fSKrish Sadhukhan report(svm_vmrun() == SVM_EXIT_ERR, "Test %s %d:%d: %lx",\ 2134eae10e8fSKrish Sadhukhan str_name, end, start, tmp); \ 2135eae10e8fSKrish Sadhukhan } \ 2136eae10e8fSKrish Sadhukhan } 2137eae10e8fSKrish Sadhukhan 21386d0ecbf6SKrish Sadhukhan #define SVM_TEST_CR_RESERVED_BITS(start, end, inc, cr, val, resv_mask, \ 2139cb6524f3SPaolo Bonzini exit_code, test_name) \ 2140a79c9495SKrish Sadhukhan { \ 2141a79c9495SKrish Sadhukhan u64 tmp, mask; \ 21428ae6d77fSSean Christopherson u32 r; \ 2143a79c9495SKrish Sadhukhan int i; \ 2144a79c9495SKrish Sadhukhan \ 2145a79c9495SKrish Sadhukhan for (i = start; i <= end; i = i + inc) { \ 2146a79c9495SKrish Sadhukhan mask = 1ull << i; \ 2147a79c9495SKrish Sadhukhan if (!(mask & resv_mask)) \ 2148a79c9495SKrish Sadhukhan continue; \ 2149a79c9495SKrish Sadhukhan tmp = val | mask; \ 2150a79c9495SKrish Sadhukhan switch (cr) { \ 2151a79c9495SKrish Sadhukhan case 0: \ 2152a79c9495SKrish Sadhukhan vmcb->save.cr0 = tmp; \ 2153a79c9495SKrish Sadhukhan break; \ 2154a79c9495SKrish Sadhukhan case 3: \ 2155a79c9495SKrish Sadhukhan vmcb->save.cr3 = tmp; \ 2156a79c9495SKrish Sadhukhan break; \ 2157a79c9495SKrish Sadhukhan case 4: \ 2158a79c9495SKrish Sadhukhan vmcb->save.cr4 = tmp; \ 2159a79c9495SKrish Sadhukhan } \ 21608ae6d77fSSean Christopherson r = svm_vmrun(); \ 21618ae6d77fSSean Christopherson report(r == exit_code, "Test CR%d %s%d:%d: %lx, wanted exit 0x%x, got 0x%x",\ 21628ae6d77fSSean Christopherson cr, test_name, end, start, tmp, exit_code, r); \ 2163a79c9495SKrish Sadhukhan } \ 2164a79c9495SKrish Sadhukhan } 2165e8d7a8f6SKrish Sadhukhan 2166a79c9495SKrish Sadhukhan static void test_efer(void) 2167a79c9495SKrish Sadhukhan { 2168e8d7a8f6SKrish Sadhukhan /* 2169e8d7a8f6SKrish Sadhukhan * Un-setting EFER.SVME is illegal 2170e8d7a8f6SKrish Sadhukhan */ 2171ba29942cSKrish Sadhukhan u64 efer_saved = vmcb->save.efer; 2172ba29942cSKrish Sadhukhan u64 efer = efer_saved; 2173ba29942cSKrish Sadhukhan 2174ba29942cSKrish Sadhukhan report (svm_vmrun() == SVM_EXIT_VMMCALL, "EFER.SVME: %lx", efer); 2175ba29942cSKrish Sadhukhan efer &= ~EFER_SVME; 2176ba29942cSKrish Sadhukhan vmcb->save.efer = efer; 2177ba29942cSKrish Sadhukhan report (svm_vmrun() == SVM_EXIT_ERR, "EFER.SVME: %lx", efer); 2178ba29942cSKrish Sadhukhan vmcb->save.efer = efer_saved; 2179e8d7a8f6SKrish Sadhukhan 2180e8d7a8f6SKrish Sadhukhan /* 2181a79c9495SKrish Sadhukhan * EFER MBZ bits: 63:16, 9 2182a79c9495SKrish Sadhukhan */ 2183a79c9495SKrish Sadhukhan efer_saved = vmcb->save.efer; 2184a79c9495SKrish Sadhukhan 2185a79c9495SKrish Sadhukhan SVM_TEST_REG_RESERVED_BITS(8, 9, 1, "EFER", vmcb->save.efer, 2186a79c9495SKrish Sadhukhan efer_saved, SVM_EFER_RESERVED_MASK); 2187a79c9495SKrish Sadhukhan SVM_TEST_REG_RESERVED_BITS(16, 63, 4, "EFER", vmcb->save.efer, 2188a79c9495SKrish Sadhukhan efer_saved, SVM_EFER_RESERVED_MASK); 2189a79c9495SKrish Sadhukhan 21901d7bde08SKrish Sadhukhan /* 21911d7bde08SKrish Sadhukhan * EFER.LME and CR0.PG are both set and CR4.PAE is zero. 21921d7bde08SKrish Sadhukhan */ 21931d7bde08SKrish Sadhukhan u64 cr0_saved = vmcb->save.cr0; 21941d7bde08SKrish Sadhukhan u64 cr0; 21951d7bde08SKrish Sadhukhan u64 cr4_saved = vmcb->save.cr4; 21961d7bde08SKrish Sadhukhan u64 cr4; 21971d7bde08SKrish Sadhukhan 21981d7bde08SKrish Sadhukhan efer = efer_saved | EFER_LME; 21991d7bde08SKrish Sadhukhan vmcb->save.efer = efer; 22001d7bde08SKrish Sadhukhan cr0 = cr0_saved | X86_CR0_PG | X86_CR0_PE; 22011d7bde08SKrish Sadhukhan vmcb->save.cr0 = cr0; 22021d7bde08SKrish Sadhukhan cr4 = cr4_saved & ~X86_CR4_PAE; 22031d7bde08SKrish Sadhukhan vmcb->save.cr4 = cr4; 22041d7bde08SKrish Sadhukhan report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), " 22051d7bde08SKrish Sadhukhan "CR0.PG=1 (%lx) and CR4.PAE=0 (%lx)", efer, cr0, cr4); 22061d7bde08SKrish Sadhukhan 22071d7bde08SKrish Sadhukhan /* 22081d7bde08SKrish Sadhukhan * EFER.LME and CR0.PG are both set and CR0.PE is zero. 2209fc050452SLara Lazier * CR4.PAE needs to be set as we otherwise cannot 2210fc050452SLara Lazier * determine if CR4.PAE=0 or CR0.PE=0 triggered the 2211fc050452SLara Lazier * SVM_EXIT_ERR. 22121d7bde08SKrish Sadhukhan */ 2213fc050452SLara Lazier cr4 = cr4_saved | X86_CR4_PAE; 2214fc050452SLara Lazier vmcb->save.cr4 = cr4; 22151d7bde08SKrish Sadhukhan cr0 &= ~X86_CR0_PE; 22161d7bde08SKrish Sadhukhan vmcb->save.cr0 = cr0; 22171d7bde08SKrish Sadhukhan report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), " 22181d7bde08SKrish Sadhukhan "CR0.PG=1 and CR0.PE=0 (%lx)", efer, cr0); 22191d7bde08SKrish Sadhukhan 22201d7bde08SKrish Sadhukhan /* 22211d7bde08SKrish Sadhukhan * EFER.LME, CR0.PG, CR4.PAE, CS.L, and CS.D are all non-zero. 22221d7bde08SKrish Sadhukhan */ 22231d7bde08SKrish Sadhukhan u32 cs_attrib_saved = vmcb->save.cs.attrib; 22241d7bde08SKrish Sadhukhan u32 cs_attrib; 22251d7bde08SKrish Sadhukhan 22261d7bde08SKrish Sadhukhan cr0 |= X86_CR0_PE; 22271d7bde08SKrish Sadhukhan vmcb->save.cr0 = cr0; 22281d7bde08SKrish Sadhukhan cs_attrib = cs_attrib_saved | SVM_SELECTOR_L_MASK | 22291d7bde08SKrish Sadhukhan SVM_SELECTOR_DB_MASK; 22301d7bde08SKrish Sadhukhan vmcb->save.cs.attrib = cs_attrib; 22311d7bde08SKrish Sadhukhan report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), " 22321d7bde08SKrish Sadhukhan "CR0.PG=1 (%lx), CR4.PAE=1 (%lx), CS.L=1 and CS.D=1 (%x)", 22331d7bde08SKrish Sadhukhan efer, cr0, cr4, cs_attrib); 22341d7bde08SKrish Sadhukhan 22351d7bde08SKrish Sadhukhan vmcb->save.cr0 = cr0_saved; 22361d7bde08SKrish Sadhukhan vmcb->save.cr4 = cr4_saved; 2237a79c9495SKrish Sadhukhan vmcb->save.efer = efer_saved; 22381d7bde08SKrish Sadhukhan vmcb->save.cs.attrib = cs_attrib_saved; 2239a79c9495SKrish Sadhukhan } 2240a79c9495SKrish Sadhukhan 2241a79c9495SKrish Sadhukhan static void test_cr0(void) 2242a79c9495SKrish Sadhukhan { 2243a79c9495SKrish Sadhukhan /* 2244e8d7a8f6SKrish Sadhukhan * Un-setting CR0.CD and setting CR0.NW is illegal combination 2245e8d7a8f6SKrish Sadhukhan */ 2246e8d7a8f6SKrish Sadhukhan u64 cr0_saved = vmcb->save.cr0; 2247e8d7a8f6SKrish Sadhukhan u64 cr0 = cr0_saved; 2248e8d7a8f6SKrish Sadhukhan 2249e8d7a8f6SKrish Sadhukhan cr0 |= X86_CR0_CD; 2250e8d7a8f6SKrish Sadhukhan cr0 &= ~X86_CR0_NW; 2251e8d7a8f6SKrish Sadhukhan vmcb->save.cr0 = cr0; 2252a79c9495SKrish Sadhukhan report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=0: %lx", 2253a79c9495SKrish Sadhukhan cr0); 2254e8d7a8f6SKrish Sadhukhan cr0 |= X86_CR0_NW; 2255e8d7a8f6SKrish Sadhukhan vmcb->save.cr0 = cr0; 2256a79c9495SKrish Sadhukhan report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=1: %lx", 2257a79c9495SKrish Sadhukhan cr0); 2258e8d7a8f6SKrish Sadhukhan cr0 &= ~X86_CR0_NW; 2259e8d7a8f6SKrish Sadhukhan cr0 &= ~X86_CR0_CD; 2260e8d7a8f6SKrish Sadhukhan vmcb->save.cr0 = cr0; 2261a79c9495SKrish Sadhukhan report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=0,NW=0: %lx", 2262a79c9495SKrish Sadhukhan cr0); 2263e8d7a8f6SKrish Sadhukhan cr0 |= X86_CR0_NW; 2264e8d7a8f6SKrish Sadhukhan vmcb->save.cr0 = cr0; 2265a79c9495SKrish Sadhukhan report (svm_vmrun() == SVM_EXIT_ERR, "Test CR0 CD=0,NW=1: %lx", 2266a79c9495SKrish Sadhukhan cr0); 2267e8d7a8f6SKrish Sadhukhan vmcb->save.cr0 = cr0_saved; 22685c052c90SKrish Sadhukhan 22695c052c90SKrish Sadhukhan /* 22705c052c90SKrish Sadhukhan * CR0[63:32] are not zero 22715c052c90SKrish Sadhukhan */ 22725c052c90SKrish Sadhukhan cr0 = cr0_saved; 2273eae10e8fSKrish Sadhukhan 2274eae10e8fSKrish Sadhukhan SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "CR0", vmcb->save.cr0, cr0_saved, 2275eae10e8fSKrish Sadhukhan SVM_CR0_RESERVED_MASK); 22765c052c90SKrish Sadhukhan vmcb->save.cr0 = cr0_saved; 2277a79c9495SKrish Sadhukhan } 2278eae10e8fSKrish Sadhukhan 2279a79c9495SKrish Sadhukhan static void test_cr3(void) 2280a79c9495SKrish Sadhukhan { 2281a79c9495SKrish Sadhukhan /* 2282a79c9495SKrish Sadhukhan * CR3 MBZ bits based on different modes: 228329a01803SNadav Amit * [63:52] - long mode 2284a79c9495SKrish Sadhukhan */ 2285a79c9495SKrish Sadhukhan u64 cr3_saved = vmcb->save.cr3; 2286a79c9495SKrish Sadhukhan 2287a79c9495SKrish Sadhukhan SVM_TEST_CR_RESERVED_BITS(0, 63, 1, 3, cr3_saved, 2288cb6524f3SPaolo Bonzini SVM_CR3_LONG_MBZ_MASK, SVM_EXIT_ERR, ""); 22896d0ecbf6SKrish Sadhukhan 22906d0ecbf6SKrish Sadhukhan vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_MBZ_MASK; 22916d0ecbf6SKrish Sadhukhan report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx", 22926d0ecbf6SKrish Sadhukhan vmcb->save.cr3); 22936d0ecbf6SKrish Sadhukhan 22946d0ecbf6SKrish Sadhukhan /* 22956d0ecbf6SKrish Sadhukhan * CR3 non-MBZ reserved bits based on different modes: 2296cb6524f3SPaolo Bonzini * [11:5] [2:0] - long mode (PCIDE=0) 22976d0ecbf6SKrish Sadhukhan * [2:0] - PAE legacy mode 22986d0ecbf6SKrish Sadhukhan */ 22996d0ecbf6SKrish Sadhukhan u64 cr4_saved = vmcb->save.cr4; 23006d0ecbf6SKrish Sadhukhan u64 *pdpe = npt_get_pml4e(); 23016d0ecbf6SKrish Sadhukhan 23026d0ecbf6SKrish Sadhukhan /* 23036d0ecbf6SKrish Sadhukhan * Long mode 23046d0ecbf6SKrish Sadhukhan */ 23056d0ecbf6SKrish Sadhukhan if (this_cpu_has(X86_FEATURE_PCID)) { 23066d0ecbf6SKrish Sadhukhan vmcb->save.cr4 = cr4_saved | X86_CR4_PCIDE; 23076d0ecbf6SKrish Sadhukhan SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved, 2308cb6524f3SPaolo Bonzini SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_VMMCALL, "(PCIDE=1) "); 23096d0ecbf6SKrish Sadhukhan 23106d0ecbf6SKrish Sadhukhan vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_RESERVED_MASK; 23116d0ecbf6SKrish Sadhukhan report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx", 23126d0ecbf6SKrish Sadhukhan vmcb->save.cr3); 2313cb6524f3SPaolo Bonzini } 23146d0ecbf6SKrish Sadhukhan 23156d0ecbf6SKrish Sadhukhan vmcb->save.cr4 = cr4_saved & ~X86_CR4_PCIDE; 23166d0ecbf6SKrish Sadhukhan 2317993749ffSSean Christopherson if (!npt_supported()) 2318993749ffSSean Christopherson goto skip_npt_only; 2319993749ffSSean Christopherson 23206d0ecbf6SKrish Sadhukhan /* Clear P (Present) bit in NPT in order to trigger #NPF */ 23216d0ecbf6SKrish Sadhukhan pdpe[0] &= ~1ULL; 23226d0ecbf6SKrish Sadhukhan 23236d0ecbf6SKrish Sadhukhan SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved, 2324cb6524f3SPaolo Bonzini SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_NPF, "(PCIDE=0) "); 23256d0ecbf6SKrish Sadhukhan 23266d0ecbf6SKrish Sadhukhan pdpe[0] |= 1ULL; 2327cb6524f3SPaolo Bonzini vmcb->save.cr3 = cr3_saved; 23286d0ecbf6SKrish Sadhukhan 23296d0ecbf6SKrish Sadhukhan /* 23306d0ecbf6SKrish Sadhukhan * PAE legacy 23316d0ecbf6SKrish Sadhukhan */ 23326d0ecbf6SKrish Sadhukhan pdpe[0] &= ~1ULL; 23336d0ecbf6SKrish Sadhukhan vmcb->save.cr4 = cr4_saved | X86_CR4_PAE; 23346d0ecbf6SKrish Sadhukhan SVM_TEST_CR_RESERVED_BITS(0, 2, 1, 3, cr3_saved, 2335cb6524f3SPaolo Bonzini SVM_CR3_PAE_LEGACY_RESERVED_MASK, SVM_EXIT_NPF, "(PAE) "); 23366d0ecbf6SKrish Sadhukhan 23376d0ecbf6SKrish Sadhukhan pdpe[0] |= 1ULL; 2338993749ffSSean Christopherson 2339993749ffSSean Christopherson skip_npt_only: 2340a79c9495SKrish Sadhukhan vmcb->save.cr3 = cr3_saved; 23416d0ecbf6SKrish Sadhukhan vmcb->save.cr4 = cr4_saved; 2342a79c9495SKrish Sadhukhan } 2343a79c9495SKrish Sadhukhan 2344a79c9495SKrish Sadhukhan static void test_cr4(void) 2345a79c9495SKrish Sadhukhan { 2346a79c9495SKrish Sadhukhan /* 2347a79c9495SKrish Sadhukhan * CR4 MBZ bits based on different modes: 2348a79c9495SKrish Sadhukhan * [15:12], 17, 19, [31:22] - legacy mode 2349a79c9495SKrish Sadhukhan * [15:12], 17, 19, [63:22] - long mode 2350a79c9495SKrish Sadhukhan */ 2351a79c9495SKrish Sadhukhan u64 cr4_saved = vmcb->save.cr4; 2352a79c9495SKrish Sadhukhan u64 efer_saved = vmcb->save.efer; 2353a79c9495SKrish Sadhukhan u64 efer = efer_saved; 2354a79c9495SKrish Sadhukhan 2355a79c9495SKrish Sadhukhan efer &= ~EFER_LME; 2356a79c9495SKrish Sadhukhan vmcb->save.efer = efer; 2357a79c9495SKrish Sadhukhan SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved, 2358cb6524f3SPaolo Bonzini SVM_CR4_LEGACY_RESERVED_MASK, SVM_EXIT_ERR, ""); 2359a79c9495SKrish Sadhukhan 2360a79c9495SKrish Sadhukhan efer |= EFER_LME; 2361a79c9495SKrish Sadhukhan vmcb->save.efer = efer; 2362a79c9495SKrish Sadhukhan SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved, 2363cb6524f3SPaolo Bonzini SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR, ""); 2364a79c9495SKrish Sadhukhan SVM_TEST_CR_RESERVED_BITS(32, 63, 4, 4, cr4_saved, 2365cb6524f3SPaolo Bonzini SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR, ""); 2366a79c9495SKrish Sadhukhan 2367a79c9495SKrish Sadhukhan vmcb->save.cr4 = cr4_saved; 2368a79c9495SKrish Sadhukhan vmcb->save.efer = efer_saved; 2369a79c9495SKrish Sadhukhan } 2370a79c9495SKrish Sadhukhan 2371a79c9495SKrish Sadhukhan static void test_dr(void) 2372a79c9495SKrish Sadhukhan { 2373eae10e8fSKrish Sadhukhan /* 2374eae10e8fSKrish Sadhukhan * DR6[63:32] and DR7[63:32] are MBZ 2375eae10e8fSKrish Sadhukhan */ 2376eae10e8fSKrish Sadhukhan u64 dr_saved = vmcb->save.dr6; 2377eae10e8fSKrish Sadhukhan 2378eae10e8fSKrish Sadhukhan SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR6", vmcb->save.dr6, dr_saved, 2379eae10e8fSKrish Sadhukhan SVM_DR6_RESERVED_MASK); 2380eae10e8fSKrish Sadhukhan vmcb->save.dr6 = dr_saved; 2381eae10e8fSKrish Sadhukhan 2382eae10e8fSKrish Sadhukhan dr_saved = vmcb->save.dr7; 2383eae10e8fSKrish Sadhukhan SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR7", vmcb->save.dr7, dr_saved, 2384eae10e8fSKrish Sadhukhan SVM_DR7_RESERVED_MASK); 2385eae10e8fSKrish Sadhukhan 2386eae10e8fSKrish Sadhukhan vmcb->save.dr7 = dr_saved; 2387a79c9495SKrish Sadhukhan } 2388eae10e8fSKrish Sadhukhan 2389abe82380SKrish Sadhukhan /* TODO: verify if high 32-bits are sign- or zero-extended on bare metal */ 2390abe82380SKrish Sadhukhan #define TEST_BITMAP_ADDR(save_intercept, type, addr, exit_code, \ 2391abe82380SKrish Sadhukhan msg) { \ 2392abe82380SKrish Sadhukhan vmcb->control.intercept = saved_intercept | 1ULL << type; \ 2393abe82380SKrish Sadhukhan if (type == INTERCEPT_MSR_PROT) \ 2394abe82380SKrish Sadhukhan vmcb->control.msrpm_base_pa = addr; \ 2395abe82380SKrish Sadhukhan else \ 2396abe82380SKrish Sadhukhan vmcb->control.iopm_base_pa = addr; \ 2397abe82380SKrish Sadhukhan report(svm_vmrun() == exit_code, \ 2398abe82380SKrish Sadhukhan "Test %s address: %lx", msg, addr); \ 2399abe82380SKrish Sadhukhan } 2400abe82380SKrish Sadhukhan 2401abe82380SKrish Sadhukhan /* 2402abe82380SKrish Sadhukhan * If the MSR or IOIO intercept table extends to a physical address that 2403abe82380SKrish Sadhukhan * is greater than or equal to the maximum supported physical address, the 2404abe82380SKrish Sadhukhan * guest state is illegal. 2405abe82380SKrish Sadhukhan * 2406abe82380SKrish Sadhukhan * The VMRUN instruction ignores the lower 12 bits of the address specified 2407abe82380SKrish Sadhukhan * in the VMCB. 2408abe82380SKrish Sadhukhan * 2409abe82380SKrish Sadhukhan * MSRPM spans 2 contiguous 4KB pages while IOPM spans 2 contiguous 4KB 2410abe82380SKrish Sadhukhan * pages + 1 byte. 2411abe82380SKrish Sadhukhan * 2412abe82380SKrish Sadhukhan * [APM vol 2] 2413abe82380SKrish Sadhukhan * 2414abe82380SKrish Sadhukhan * Note: Unallocated MSRPM addresses conforming to consistency checks, generate 2415abe82380SKrish Sadhukhan * #NPF. 2416abe82380SKrish Sadhukhan */ 2417abe82380SKrish Sadhukhan static void test_msrpm_iopm_bitmap_addrs(void) 2418abe82380SKrish Sadhukhan { 2419abe82380SKrish Sadhukhan u64 saved_intercept = vmcb->control.intercept; 2420abe82380SKrish Sadhukhan u64 addr_beyond_limit = 1ull << cpuid_maxphyaddr(); 2421abe82380SKrish Sadhukhan u64 addr = virt_to_phys(msr_bitmap) & (~((1ull << 12) - 1)); 2422abe82380SKrish Sadhukhan 2423abe82380SKrish Sadhukhan TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, 2424abe82380SKrish Sadhukhan addr_beyond_limit - 2 * PAGE_SIZE, SVM_EXIT_ERR, 2425abe82380SKrish Sadhukhan "MSRPM"); 2426abe82380SKrish Sadhukhan TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, 2427abe82380SKrish Sadhukhan addr_beyond_limit - 2 * PAGE_SIZE + 1, SVM_EXIT_ERR, 2428abe82380SKrish Sadhukhan "MSRPM"); 2429abe82380SKrish Sadhukhan TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, 2430abe82380SKrish Sadhukhan addr_beyond_limit - PAGE_SIZE, SVM_EXIT_ERR, 2431abe82380SKrish Sadhukhan "MSRPM"); 2432abe82380SKrish Sadhukhan TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, addr, 2433abe82380SKrish Sadhukhan SVM_EXIT_VMMCALL, "MSRPM"); 2434abe82380SKrish Sadhukhan addr |= (1ull << 12) - 1; 2435abe82380SKrish Sadhukhan TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, addr, 2436abe82380SKrish Sadhukhan SVM_EXIT_VMMCALL, "MSRPM"); 2437abe82380SKrish Sadhukhan 2438abe82380SKrish Sadhukhan TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2439abe82380SKrish Sadhukhan addr_beyond_limit - 4 * PAGE_SIZE, SVM_EXIT_VMMCALL, 2440abe82380SKrish Sadhukhan "IOPM"); 2441abe82380SKrish Sadhukhan TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2442abe82380SKrish Sadhukhan addr_beyond_limit - 3 * PAGE_SIZE, SVM_EXIT_VMMCALL, 2443abe82380SKrish Sadhukhan "IOPM"); 2444abe82380SKrish Sadhukhan TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2445abe82380SKrish Sadhukhan addr_beyond_limit - 2 * PAGE_SIZE - 2, SVM_EXIT_VMMCALL, 2446abe82380SKrish Sadhukhan "IOPM"); 2447abe82380SKrish Sadhukhan TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2448abe82380SKrish Sadhukhan addr_beyond_limit - 2 * PAGE_SIZE, SVM_EXIT_ERR, 2449abe82380SKrish Sadhukhan "IOPM"); 2450abe82380SKrish Sadhukhan TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2451abe82380SKrish Sadhukhan addr_beyond_limit - PAGE_SIZE, SVM_EXIT_ERR, 2452abe82380SKrish Sadhukhan "IOPM"); 2453abe82380SKrish Sadhukhan addr = virt_to_phys(io_bitmap) & (~((1ull << 11) - 1)); 2454abe82380SKrish Sadhukhan TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, addr, 2455abe82380SKrish Sadhukhan SVM_EXIT_VMMCALL, "IOPM"); 2456abe82380SKrish Sadhukhan addr |= (1ull << 12) - 1; 2457abe82380SKrish Sadhukhan TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, addr, 2458abe82380SKrish Sadhukhan SVM_EXIT_VMMCALL, "IOPM"); 2459abe82380SKrish Sadhukhan 2460abe82380SKrish Sadhukhan vmcb->control.intercept = saved_intercept; 2461abe82380SKrish Sadhukhan } 2462abe82380SKrish Sadhukhan 2463a99070ebSKrish Sadhukhan #define TEST_CANONICAL(seg_base, msg) \ 2464a99070ebSKrish Sadhukhan saved_addr = seg_base; \ 2465a99070ebSKrish Sadhukhan seg_base = (seg_base & ((1ul << addr_limit) - 1)) | noncanonical_mask; \ 2466a99070ebSKrish Sadhukhan report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test %s.base for canonical form: %lx", msg, seg_base); \ 2467a99070ebSKrish Sadhukhan seg_base = saved_addr; 2468a99070ebSKrish Sadhukhan 2469a99070ebSKrish Sadhukhan /* 2470a99070ebSKrish Sadhukhan * VMRUN canonicalizes (i.e., sign-extend to bit 63) all base addresses 2471a99070ebSKrish Sadhukhan • in the segment registers that have been loaded. 2472a99070ebSKrish Sadhukhan */ 2473a99070ebSKrish Sadhukhan static void test_vmrun_canonicalization(void) 2474a99070ebSKrish Sadhukhan { 2475a99070ebSKrish Sadhukhan u64 saved_addr; 2476a99070ebSKrish Sadhukhan u8 addr_limit = cpuid_maxphyaddr(); 2477a99070ebSKrish Sadhukhan u64 noncanonical_mask = NONCANONICAL & ~((1ul << addr_limit) - 1); 2478a99070ebSKrish Sadhukhan 2479a99070ebSKrish Sadhukhan TEST_CANONICAL(vmcb->save.es.base, "ES"); 2480a99070ebSKrish Sadhukhan TEST_CANONICAL(vmcb->save.cs.base, "CS"); 2481a99070ebSKrish Sadhukhan TEST_CANONICAL(vmcb->save.ss.base, "SS"); 2482a99070ebSKrish Sadhukhan TEST_CANONICAL(vmcb->save.ds.base, "DS"); 2483a99070ebSKrish Sadhukhan TEST_CANONICAL(vmcb->save.fs.base, "FS"); 2484a99070ebSKrish Sadhukhan TEST_CANONICAL(vmcb->save.gs.base, "GS"); 2485a99070ebSKrish Sadhukhan TEST_CANONICAL(vmcb->save.gdtr.base, "GDTR"); 2486a99070ebSKrish Sadhukhan TEST_CANONICAL(vmcb->save.ldtr.base, "LDTR"); 2487a99070ebSKrish Sadhukhan TEST_CANONICAL(vmcb->save.idtr.base, "IDTR"); 2488a99070ebSKrish Sadhukhan TEST_CANONICAL(vmcb->save.tr.base, "TR"); 2489a99070ebSKrish Sadhukhan } 2490a99070ebSKrish Sadhukhan 2491*665f5677SKrish Sadhukhan /* 2492*665f5677SKrish Sadhukhan * When VMRUN loads a guest value of 1 in EFLAGS.TF, that value does not 2493*665f5677SKrish Sadhukhan * cause a trace trap between the VMRUN and the first guest instruction, but 2494*665f5677SKrish Sadhukhan * rather after completion of the first guest instruction. 2495*665f5677SKrish Sadhukhan * 2496*665f5677SKrish Sadhukhan * [APM vol 2] 2497*665f5677SKrish Sadhukhan */ 2498*665f5677SKrish Sadhukhan u64 guest_rflags_test_trap_rip; 2499*665f5677SKrish Sadhukhan 2500*665f5677SKrish Sadhukhan static void guest_rflags_test_db_handler(struct ex_regs *r) 2501*665f5677SKrish Sadhukhan { 2502*665f5677SKrish Sadhukhan guest_rflags_test_trap_rip = r->rip; 2503*665f5677SKrish Sadhukhan r->rflags &= ~X86_EFLAGS_TF; 2504*665f5677SKrish Sadhukhan } 2505*665f5677SKrish Sadhukhan 2506a79c9495SKrish Sadhukhan static void svm_guest_state_test(void) 2507a79c9495SKrish Sadhukhan { 2508a79c9495SKrish Sadhukhan test_set_guest(basic_guest_main); 2509a79c9495SKrish Sadhukhan test_efer(); 2510a79c9495SKrish Sadhukhan test_cr0(); 2511a79c9495SKrish Sadhukhan test_cr3(); 2512a79c9495SKrish Sadhukhan test_cr4(); 2513a79c9495SKrish Sadhukhan test_dr(); 2514abe82380SKrish Sadhukhan test_msrpm_iopm_bitmap_addrs(); 2515a99070ebSKrish Sadhukhan test_vmrun_canonicalization(); 2516ba29942cSKrish Sadhukhan } 2517ba29942cSKrish Sadhukhan 2518*665f5677SKrish Sadhukhan extern void guest_rflags_test_guest(struct svm_test *test); 2519*665f5677SKrish Sadhukhan extern u64 *insn2; 2520*665f5677SKrish Sadhukhan extern u64 *guest_end; 2521*665f5677SKrish Sadhukhan 2522*665f5677SKrish Sadhukhan asm("guest_rflags_test_guest:\n\t" 2523*665f5677SKrish Sadhukhan "push %rbp\n\t" 2524*665f5677SKrish Sadhukhan ".global insn2\n\t" 2525*665f5677SKrish Sadhukhan "insn2:\n\t" 2526*665f5677SKrish Sadhukhan "mov %rsp,%rbp\n\t" 2527*665f5677SKrish Sadhukhan "vmmcall\n\t" 2528*665f5677SKrish Sadhukhan "vmmcall\n\t" 2529*665f5677SKrish Sadhukhan ".global guest_end\n\t" 2530*665f5677SKrish Sadhukhan "guest_end:\n\t" 2531*665f5677SKrish Sadhukhan "vmmcall\n\t" 2532*665f5677SKrish Sadhukhan "pop %rbp\n\t" 2533*665f5677SKrish Sadhukhan "ret"); 2534*665f5677SKrish Sadhukhan 2535*665f5677SKrish Sadhukhan static void svm_test_singlestep(void) 2536*665f5677SKrish Sadhukhan { 2537*665f5677SKrish Sadhukhan handle_exception(DB_VECTOR, guest_rflags_test_db_handler); 2538*665f5677SKrish Sadhukhan 2539*665f5677SKrish Sadhukhan /* 2540*665f5677SKrish Sadhukhan * Trap expected after completion of first guest instruction 2541*665f5677SKrish Sadhukhan */ 2542*665f5677SKrish Sadhukhan vmcb->save.rflags |= X86_EFLAGS_TF; 2543*665f5677SKrish Sadhukhan report (__svm_vmrun((u64)guest_rflags_test_guest) == SVM_EXIT_VMMCALL && 2544*665f5677SKrish Sadhukhan guest_rflags_test_trap_rip == (u64)&insn2, 2545*665f5677SKrish Sadhukhan "Test EFLAGS.TF on VMRUN: trap expected after completion of first guest instruction"); 2546*665f5677SKrish Sadhukhan /* 2547*665f5677SKrish Sadhukhan * No trap expected 2548*665f5677SKrish Sadhukhan */ 2549*665f5677SKrish Sadhukhan guest_rflags_test_trap_rip = 0; 2550*665f5677SKrish Sadhukhan vmcb->save.rip += 3; 2551*665f5677SKrish Sadhukhan vmcb->save.rflags |= X86_EFLAGS_TF; 2552*665f5677SKrish Sadhukhan report (__svm_vmrun(vmcb->save.rip) == SVM_EXIT_VMMCALL && 2553*665f5677SKrish Sadhukhan guest_rflags_test_trap_rip == 0, "Test EFLAGS.TF on VMRUN: trap not expected"); 2554*665f5677SKrish Sadhukhan 2555*665f5677SKrish Sadhukhan /* 2556*665f5677SKrish Sadhukhan * Let guest finish execution 2557*665f5677SKrish Sadhukhan */ 2558*665f5677SKrish Sadhukhan vmcb->save.rip += 3; 2559*665f5677SKrish Sadhukhan report (__svm_vmrun(vmcb->save.rip) == SVM_EXIT_VMMCALL && 2560*665f5677SKrish Sadhukhan vmcb->save.rip == (u64)&guest_end, "Test EFLAGS.TF on VMRUN: guest execution completion"); 2561*665f5677SKrish Sadhukhan } 2562*665f5677SKrish Sadhukhan 2563916635a8SSean Christopherson static void __svm_npt_rsvd_bits_test(u64 *pxe, u64 rsvd_bits, u64 efer, 2564916635a8SSean Christopherson ulong cr4, u64 guest_efer, ulong guest_cr4) 2565916635a8SSean Christopherson { 2566916635a8SSean Christopherson u64 pxe_orig = *pxe; 2567916635a8SSean Christopherson int exit_reason; 2568916635a8SSean Christopherson u64 pfec; 2569916635a8SSean Christopherson 2570916635a8SSean Christopherson wrmsr(MSR_EFER, efer); 2571916635a8SSean Christopherson write_cr4(cr4); 2572916635a8SSean Christopherson 2573916635a8SSean Christopherson vmcb->save.efer = guest_efer; 2574916635a8SSean Christopherson vmcb->save.cr4 = guest_cr4; 2575916635a8SSean Christopherson 2576916635a8SSean Christopherson *pxe |= rsvd_bits; 2577916635a8SSean Christopherson 2578916635a8SSean Christopherson exit_reason = svm_vmrun(); 2579916635a8SSean Christopherson 2580916635a8SSean Christopherson report(exit_reason == SVM_EXIT_NPF, 2581916635a8SSean Christopherson "Wanted #NPF on rsvd bits = 0x%lx, got exit = 0x%x", rsvd_bits, exit_reason); 2582916635a8SSean Christopherson 2583916635a8SSean Christopherson if (pxe == npt_get_pdpe() || pxe == npt_get_pml4e()) { 2584916635a8SSean Christopherson /* 2585916635a8SSean Christopherson * The guest's page tables will blow up on a bad PDPE/PML4E, 2586916635a8SSean Christopherson * before starting the final walk of the guest page. 2587916635a8SSean Christopherson */ 2588916635a8SSean Christopherson pfec = 0x20000000full; 2589916635a8SSean Christopherson } else { 2590916635a8SSean Christopherson /* RSVD #NPF on final walk of guest page. */ 2591916635a8SSean Christopherson pfec = 0x10000000dULL; 2592916635a8SSean Christopherson 2593916635a8SSean Christopherson /* PFEC.FETCH=1 if NX=1 *or* SMEP=1. */ 2594916635a8SSean Christopherson if ((cr4 & X86_CR4_SMEP) || (efer & EFER_NX)) 2595916635a8SSean Christopherson pfec |= 0x10; 2596916635a8SSean Christopherson 2597916635a8SSean Christopherson } 2598916635a8SSean Christopherson 2599916635a8SSean Christopherson report(vmcb->control.exit_info_1 == pfec, 2600916635a8SSean Christopherson "Wanted PFEC = 0x%lx, got PFEC = %lx, PxE = 0x%lx. " 2601916635a8SSean Christopherson "host.NX = %u, host.SMEP = %u, guest.NX = %u, guest.SMEP = %u", 2602916635a8SSean Christopherson pfec, vmcb->control.exit_info_1, *pxe, 2603916635a8SSean Christopherson !!(efer & EFER_NX), !!(cr4 & X86_CR4_SMEP), 2604916635a8SSean Christopherson !!(guest_efer & EFER_NX), !!(guest_cr4 & X86_CR4_SMEP)); 2605916635a8SSean Christopherson 2606916635a8SSean Christopherson *pxe = pxe_orig; 2607916635a8SSean Christopherson } 2608916635a8SSean Christopherson 2609916635a8SSean Christopherson static void _svm_npt_rsvd_bits_test(u64 *pxe, u64 pxe_rsvd_bits, u64 efer, 2610916635a8SSean Christopherson ulong cr4, u64 guest_efer, ulong guest_cr4) 2611916635a8SSean Christopherson { 2612916635a8SSean Christopherson u64 rsvd_bits; 2613916635a8SSean Christopherson int i; 2614916635a8SSean Christopherson 2615916635a8SSean Christopherson /* 2616916635a8SSean Christopherson * Test all combinations of guest/host EFER.NX and CR4.SMEP. If host 2617916635a8SSean Christopherson * EFER.NX=0, use NX as the reserved bit, otherwise use the passed in 2618916635a8SSean Christopherson * @pxe_rsvd_bits. 2619916635a8SSean Christopherson */ 2620916635a8SSean Christopherson for (i = 0; i < 16; i++) { 2621916635a8SSean Christopherson if (i & 1) { 2622916635a8SSean Christopherson rsvd_bits = pxe_rsvd_bits; 2623916635a8SSean Christopherson efer |= EFER_NX; 2624916635a8SSean Christopherson } else { 2625916635a8SSean Christopherson rsvd_bits = PT64_NX_MASK; 2626916635a8SSean Christopherson efer &= ~EFER_NX; 2627916635a8SSean Christopherson } 2628916635a8SSean Christopherson if (i & 2) 2629916635a8SSean Christopherson cr4 |= X86_CR4_SMEP; 2630916635a8SSean Christopherson else 2631916635a8SSean Christopherson cr4 &= ~X86_CR4_SMEP; 2632916635a8SSean Christopherson if (i & 4) 2633916635a8SSean Christopherson guest_efer |= EFER_NX; 2634916635a8SSean Christopherson else 2635916635a8SSean Christopherson guest_efer &= ~EFER_NX; 2636916635a8SSean Christopherson if (i & 8) 2637916635a8SSean Christopherson guest_cr4 |= X86_CR4_SMEP; 2638916635a8SSean Christopherson else 2639916635a8SSean Christopherson guest_cr4 &= ~X86_CR4_SMEP; 2640916635a8SSean Christopherson 2641916635a8SSean Christopherson __svm_npt_rsvd_bits_test(pxe, rsvd_bits, efer, cr4, 2642916635a8SSean Christopherson guest_efer, guest_cr4); 2643916635a8SSean Christopherson } 2644916635a8SSean Christopherson } 2645916635a8SSean Christopherson 2646916635a8SSean Christopherson static u64 get_random_bits(u64 hi, u64 low) 2647916635a8SSean Christopherson { 2648916635a8SSean Christopherson u64 rsvd_bits; 2649916635a8SSean Christopherson 2650916635a8SSean Christopherson do { 2651916635a8SSean Christopherson rsvd_bits = (rdtsc() << low) & GENMASK_ULL(hi, low); 2652916635a8SSean Christopherson } while (!rsvd_bits); 2653916635a8SSean Christopherson 2654916635a8SSean Christopherson return rsvd_bits; 2655916635a8SSean Christopherson } 2656916635a8SSean Christopherson 2657916635a8SSean Christopherson 2658916635a8SSean Christopherson static void svm_npt_rsvd_bits_test(void) 2659916635a8SSean Christopherson { 2660916635a8SSean Christopherson u64 saved_efer, host_efer, sg_efer, guest_efer; 2661916635a8SSean Christopherson ulong saved_cr4, host_cr4, sg_cr4, guest_cr4; 2662916635a8SSean Christopherson 2663916635a8SSean Christopherson if (!npt_supported()) { 2664916635a8SSean Christopherson report_skip("NPT not supported"); 2665916635a8SSean Christopherson return; 2666916635a8SSean Christopherson } 2667916635a8SSean Christopherson 2668916635a8SSean Christopherson saved_efer = host_efer = rdmsr(MSR_EFER); 2669916635a8SSean Christopherson saved_cr4 = host_cr4 = read_cr4(); 2670916635a8SSean Christopherson sg_efer = guest_efer = vmcb->save.efer; 2671916635a8SSean Christopherson sg_cr4 = guest_cr4 = vmcb->save.cr4; 2672916635a8SSean Christopherson 2673916635a8SSean Christopherson test_set_guest(basic_guest_main); 2674916635a8SSean Christopherson 2675916635a8SSean Christopherson /* 2676916635a8SSean Christopherson * 4k PTEs don't have reserved bits if MAXPHYADDR >= 52, just skip the 2677916635a8SSean Christopherson * sub-test. The NX test is still valid, but the extra bit of coverage 2678916635a8SSean Christopherson * isn't worth the extra complexity. 2679916635a8SSean Christopherson */ 2680916635a8SSean Christopherson if (cpuid_maxphyaddr() >= 52) 2681916635a8SSean Christopherson goto skip_pte_test; 2682916635a8SSean Christopherson 2683916635a8SSean Christopherson _svm_npt_rsvd_bits_test(npt_get_pte((u64)basic_guest_main), 2684916635a8SSean Christopherson get_random_bits(51, cpuid_maxphyaddr()), 2685916635a8SSean Christopherson host_efer, host_cr4, guest_efer, guest_cr4); 2686916635a8SSean Christopherson 2687916635a8SSean Christopherson skip_pte_test: 2688916635a8SSean Christopherson _svm_npt_rsvd_bits_test(npt_get_pde((u64)basic_guest_main), 2689916635a8SSean Christopherson get_random_bits(20, 13) | PT_PAGE_SIZE_MASK, 2690916635a8SSean Christopherson host_efer, host_cr4, guest_efer, guest_cr4); 2691916635a8SSean Christopherson 2692916635a8SSean Christopherson _svm_npt_rsvd_bits_test(npt_get_pdpe(), 2693916635a8SSean Christopherson PT_PAGE_SIZE_MASK | 2694916635a8SSean Christopherson (this_cpu_has(X86_FEATURE_GBPAGES) ? get_random_bits(29, 13) : 0), 2695916635a8SSean Christopherson host_efer, host_cr4, guest_efer, guest_cr4); 2696916635a8SSean Christopherson 2697916635a8SSean Christopherson _svm_npt_rsvd_bits_test(npt_get_pml4e(), BIT_ULL(8), 2698916635a8SSean Christopherson host_efer, host_cr4, guest_efer, guest_cr4); 2699916635a8SSean Christopherson 2700916635a8SSean Christopherson wrmsr(MSR_EFER, saved_efer); 2701916635a8SSean Christopherson write_cr4(saved_cr4); 2702916635a8SSean Christopherson vmcb->save.efer = sg_efer; 2703916635a8SSean Christopherson vmcb->save.cr4 = sg_cr4; 2704916635a8SSean Christopherson } 27057a57ef5dSMaxim Levitsky 27067a57ef5dSMaxim Levitsky static bool volatile svm_errata_reproduced = false; 27077a57ef5dSMaxim Levitsky static unsigned long volatile physical = 0; 27087a57ef5dSMaxim Levitsky 27097a57ef5dSMaxim Levitsky 27107a57ef5dSMaxim Levitsky /* 27117a57ef5dSMaxim Levitsky * 27127a57ef5dSMaxim Levitsky * Test the following errata: 27137a57ef5dSMaxim Levitsky * If the VMRUN/VMSAVE/VMLOAD are attempted by the nested guest, 27147a57ef5dSMaxim Levitsky * the CPU would first check the EAX against host reserved memory 27157a57ef5dSMaxim Levitsky * regions (so far only SMM_ADDR/SMM_MASK are known to cause it), 27167a57ef5dSMaxim Levitsky * and only then signal #VMexit 27177a57ef5dSMaxim Levitsky * 27187a57ef5dSMaxim Levitsky * Try to reproduce this by trying vmsave on each possible 4K aligned memory 27197a57ef5dSMaxim Levitsky * address in the low 4G where the SMM area has to reside. 27207a57ef5dSMaxim Levitsky */ 27217a57ef5dSMaxim Levitsky 27227a57ef5dSMaxim Levitsky static void gp_isr(struct ex_regs *r) 27237a57ef5dSMaxim Levitsky { 27247a57ef5dSMaxim Levitsky svm_errata_reproduced = true; 27257a57ef5dSMaxim Levitsky /* skip over the vmsave instruction*/ 27267a57ef5dSMaxim Levitsky r->rip += 3; 27277a57ef5dSMaxim Levitsky } 27287a57ef5dSMaxim Levitsky 27297a57ef5dSMaxim Levitsky static void svm_vmrun_errata_test(void) 27307a57ef5dSMaxim Levitsky { 27317a57ef5dSMaxim Levitsky unsigned long *last_page = NULL; 27327a57ef5dSMaxim Levitsky 27337a57ef5dSMaxim Levitsky handle_exception(GP_VECTOR, gp_isr); 27347a57ef5dSMaxim Levitsky 27357a57ef5dSMaxim Levitsky while (!svm_errata_reproduced) { 27367a57ef5dSMaxim Levitsky 27377a57ef5dSMaxim Levitsky unsigned long *page = alloc_pages(1); 27387a57ef5dSMaxim Levitsky 27397a57ef5dSMaxim Levitsky if (!page) { 27407a57ef5dSMaxim Levitsky report(true, "All guest memory tested, no bug found");; 27417a57ef5dSMaxim Levitsky break; 27427a57ef5dSMaxim Levitsky } 27437a57ef5dSMaxim Levitsky 27447a57ef5dSMaxim Levitsky physical = virt_to_phys(page); 27457a57ef5dSMaxim Levitsky 27467a57ef5dSMaxim Levitsky asm volatile ( 27477a57ef5dSMaxim Levitsky "mov %[_physical], %%rax\n\t" 27487a57ef5dSMaxim Levitsky "vmsave %%rax\n\t" 27497a57ef5dSMaxim Levitsky 27507a57ef5dSMaxim Levitsky : [_physical] "=m" (physical) 27517a57ef5dSMaxim Levitsky : /* no inputs*/ 27527a57ef5dSMaxim Levitsky : "rax" /*clobbers*/ 27537a57ef5dSMaxim Levitsky ); 27547a57ef5dSMaxim Levitsky 27557a57ef5dSMaxim Levitsky if (svm_errata_reproduced) { 27567a57ef5dSMaxim Levitsky report(false, "Got #GP exception - svm errata reproduced at 0x%lx", 27577a57ef5dSMaxim Levitsky physical); 27587a57ef5dSMaxim Levitsky break; 27597a57ef5dSMaxim Levitsky } 27607a57ef5dSMaxim Levitsky 27617a57ef5dSMaxim Levitsky *page = (unsigned long)last_page; 27627a57ef5dSMaxim Levitsky last_page = page; 27637a57ef5dSMaxim Levitsky } 27647a57ef5dSMaxim Levitsky 27657a57ef5dSMaxim Levitsky while (last_page) { 27667a57ef5dSMaxim Levitsky unsigned long *page = last_page; 27677a57ef5dSMaxim Levitsky last_page = (unsigned long *)*last_page; 27687a57ef5dSMaxim Levitsky free_pages_by_order(page, 1); 27697a57ef5dSMaxim Levitsky } 27707a57ef5dSMaxim Levitsky } 27717a57ef5dSMaxim Levitsky 27720b6f6cedSKrish Sadhukhan static void vmload_vmsave_guest_main(struct svm_test *test) 27730b6f6cedSKrish Sadhukhan { 27740b6f6cedSKrish Sadhukhan u64 vmcb_phys = virt_to_phys(vmcb); 27750b6f6cedSKrish Sadhukhan 27760b6f6cedSKrish Sadhukhan asm volatile ("vmload %0" : : "a"(vmcb_phys)); 27770b6f6cedSKrish Sadhukhan asm volatile ("vmsave %0" : : "a"(vmcb_phys)); 27780b6f6cedSKrish Sadhukhan } 27790b6f6cedSKrish Sadhukhan 27800b6f6cedSKrish Sadhukhan static void svm_vmload_vmsave(void) 27810b6f6cedSKrish Sadhukhan { 27820b6f6cedSKrish Sadhukhan u32 intercept_saved = vmcb->control.intercept; 27830b6f6cedSKrish Sadhukhan 27840b6f6cedSKrish Sadhukhan test_set_guest(vmload_vmsave_guest_main); 27850b6f6cedSKrish Sadhukhan 27860b6f6cedSKrish Sadhukhan /* 27870b6f6cedSKrish Sadhukhan * Disabling intercept for VMLOAD and VMSAVE doesn't cause 27880b6f6cedSKrish Sadhukhan * respective #VMEXIT to host 27890b6f6cedSKrish Sadhukhan */ 27900b6f6cedSKrish Sadhukhan vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD); 27910b6f6cedSKrish Sadhukhan vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE); 27920b6f6cedSKrish Sadhukhan svm_vmrun(); 27930b6f6cedSKrish Sadhukhan report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 27940b6f6cedSKrish Sadhukhan "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 27950b6f6cedSKrish Sadhukhan 27960b6f6cedSKrish Sadhukhan /* 27970b6f6cedSKrish Sadhukhan * Enabling intercept for VMLOAD and VMSAVE causes respective 27980b6f6cedSKrish Sadhukhan * #VMEXIT to host 27990b6f6cedSKrish Sadhukhan */ 28000b6f6cedSKrish Sadhukhan vmcb->control.intercept |= (1ULL << INTERCEPT_VMLOAD); 28010b6f6cedSKrish Sadhukhan svm_vmrun(); 28020b6f6cedSKrish Sadhukhan report(vmcb->control.exit_code == SVM_EXIT_VMLOAD, "Test " 28030b6f6cedSKrish Sadhukhan "VMLOAD/VMSAVE intercept: Expected VMLOAD #VMEXIT"); 28040b6f6cedSKrish Sadhukhan vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD); 28050b6f6cedSKrish Sadhukhan vmcb->control.intercept |= (1ULL << INTERCEPT_VMSAVE); 28060b6f6cedSKrish Sadhukhan svm_vmrun(); 28070b6f6cedSKrish Sadhukhan report(vmcb->control.exit_code == SVM_EXIT_VMSAVE, "Test " 28080b6f6cedSKrish Sadhukhan "VMLOAD/VMSAVE intercept: Expected VMSAVE #VMEXIT"); 28090b6f6cedSKrish Sadhukhan vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE); 28100b6f6cedSKrish Sadhukhan svm_vmrun(); 28110b6f6cedSKrish Sadhukhan report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 28120b6f6cedSKrish Sadhukhan "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 28130b6f6cedSKrish Sadhukhan 28140b6f6cedSKrish Sadhukhan vmcb->control.intercept |= (1ULL << INTERCEPT_VMLOAD); 28150b6f6cedSKrish Sadhukhan svm_vmrun(); 28160b6f6cedSKrish Sadhukhan report(vmcb->control.exit_code == SVM_EXIT_VMLOAD, "Test " 28170b6f6cedSKrish Sadhukhan "VMLOAD/VMSAVE intercept: Expected VMLOAD #VMEXIT"); 28180b6f6cedSKrish Sadhukhan vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD); 28190b6f6cedSKrish Sadhukhan svm_vmrun(); 28200b6f6cedSKrish Sadhukhan report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 28210b6f6cedSKrish Sadhukhan "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 28220b6f6cedSKrish Sadhukhan 28230b6f6cedSKrish Sadhukhan vmcb->control.intercept |= (1ULL << INTERCEPT_VMSAVE); 28240b6f6cedSKrish Sadhukhan svm_vmrun(); 28250b6f6cedSKrish Sadhukhan report(vmcb->control.exit_code == SVM_EXIT_VMSAVE, "Test " 28260b6f6cedSKrish Sadhukhan "VMLOAD/VMSAVE intercept: Expected VMSAVE #VMEXIT"); 28270b6f6cedSKrish Sadhukhan vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE); 28280b6f6cedSKrish Sadhukhan svm_vmrun(); 28290b6f6cedSKrish Sadhukhan report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 28300b6f6cedSKrish Sadhukhan "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 28310b6f6cedSKrish Sadhukhan 28320b6f6cedSKrish Sadhukhan vmcb->control.intercept = intercept_saved; 28330b6f6cedSKrish Sadhukhan } 28340b6f6cedSKrish Sadhukhan 2835f6972bd6SLara Lazier static void prepare_vgif_enabled(struct svm_test *test) 2836f6972bd6SLara Lazier { 2837f6972bd6SLara Lazier default_prepare(test); 2838f6972bd6SLara Lazier } 2839f6972bd6SLara Lazier 2840f6972bd6SLara Lazier static void test_vgif(struct svm_test *test) 2841f6972bd6SLara Lazier { 2842f6972bd6SLara Lazier asm volatile ("vmmcall\n\tstgi\n\tvmmcall\n\tclgi\n\tvmmcall\n\t"); 2843f6972bd6SLara Lazier 2844f6972bd6SLara Lazier } 2845f6972bd6SLara Lazier 2846f6972bd6SLara Lazier static bool vgif_finished(struct svm_test *test) 2847f6972bd6SLara Lazier { 2848f6972bd6SLara Lazier switch (get_test_stage(test)) 2849f6972bd6SLara Lazier { 2850f6972bd6SLara Lazier case 0: 2851f6972bd6SLara Lazier if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2852f6972bd6SLara Lazier report(false, "VMEXIT not due to vmmcall."); 2853f6972bd6SLara Lazier return true; 2854f6972bd6SLara Lazier } 2855f6972bd6SLara Lazier vmcb->control.int_ctl |= V_GIF_ENABLED_MASK; 2856f6972bd6SLara Lazier vmcb->save.rip += 3; 2857f6972bd6SLara Lazier inc_test_stage(test); 2858f6972bd6SLara Lazier break; 2859f6972bd6SLara Lazier case 1: 2860f6972bd6SLara Lazier if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2861f6972bd6SLara Lazier report(false, "VMEXIT not due to vmmcall."); 2862f6972bd6SLara Lazier return true; 2863f6972bd6SLara Lazier } 2864f6972bd6SLara Lazier if (!(vmcb->control.int_ctl & V_GIF_MASK)) { 2865f6972bd6SLara Lazier report(false, "Failed to set VGIF when executing STGI."); 2866f6972bd6SLara Lazier vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK; 2867f6972bd6SLara Lazier return true; 2868f6972bd6SLara Lazier } 2869f6972bd6SLara Lazier report(true, "STGI set VGIF bit."); 2870f6972bd6SLara Lazier vmcb->save.rip += 3; 2871f6972bd6SLara Lazier inc_test_stage(test); 2872f6972bd6SLara Lazier break; 2873f6972bd6SLara Lazier case 2: 2874f6972bd6SLara Lazier if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2875f6972bd6SLara Lazier report(false, "VMEXIT not due to vmmcall."); 2876f6972bd6SLara Lazier return true; 2877f6972bd6SLara Lazier } 2878f6972bd6SLara Lazier if (vmcb->control.int_ctl & V_GIF_MASK) { 2879f6972bd6SLara Lazier report(false, "Failed to clear VGIF when executing CLGI."); 2880f6972bd6SLara Lazier vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK; 2881f6972bd6SLara Lazier return true; 2882f6972bd6SLara Lazier } 2883f6972bd6SLara Lazier report(true, "CLGI cleared VGIF bit."); 2884f6972bd6SLara Lazier vmcb->save.rip += 3; 2885f6972bd6SLara Lazier inc_test_stage(test); 2886f6972bd6SLara Lazier vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK; 2887f6972bd6SLara Lazier break; 2888f6972bd6SLara Lazier default: 2889f6972bd6SLara Lazier return true; 2890f6972bd6SLara Lazier break; 2891f6972bd6SLara Lazier } 2892f6972bd6SLara Lazier 2893f6972bd6SLara Lazier return get_test_stage(test) == 3; 2894f6972bd6SLara Lazier } 2895f6972bd6SLara Lazier 2896f6972bd6SLara Lazier static bool vgif_check(struct svm_test *test) 2897f6972bd6SLara Lazier { 2898f6972bd6SLara Lazier return get_test_stage(test) == 3; 2899f6972bd6SLara Lazier } 2900f6972bd6SLara Lazier 2901f6972bd6SLara Lazier 2902ad879127SKrish Sadhukhan struct svm_test svm_tests[] = { 2903ad879127SKrish Sadhukhan { "null", default_supported, default_prepare, 2904ad879127SKrish Sadhukhan default_prepare_gif_clear, null_test, 2905ad879127SKrish Sadhukhan default_finished, null_check }, 2906ad879127SKrish Sadhukhan { "vmrun", default_supported, default_prepare, 2907ad879127SKrish Sadhukhan default_prepare_gif_clear, test_vmrun, 2908ad879127SKrish Sadhukhan default_finished, check_vmrun }, 2909ad879127SKrish Sadhukhan { "ioio", default_supported, prepare_ioio, 2910ad879127SKrish Sadhukhan default_prepare_gif_clear, test_ioio, 2911ad879127SKrish Sadhukhan ioio_finished, check_ioio }, 2912ad879127SKrish Sadhukhan { "vmrun intercept check", default_supported, prepare_no_vmrun_int, 2913ad879127SKrish Sadhukhan default_prepare_gif_clear, null_test, default_finished, 2914ad879127SKrish Sadhukhan check_no_vmrun_int }, 2915401299a5SPaolo Bonzini { "rsm", default_supported, 2916401299a5SPaolo Bonzini prepare_rsm_intercept, default_prepare_gif_clear, 2917401299a5SPaolo Bonzini test_rsm_intercept, finished_rsm_intercept, check_rsm_intercept }, 2918ad879127SKrish Sadhukhan { "cr3 read intercept", default_supported, 2919ad879127SKrish Sadhukhan prepare_cr3_intercept, default_prepare_gif_clear, 2920ad879127SKrish Sadhukhan test_cr3_intercept, default_finished, check_cr3_intercept }, 2921ad879127SKrish Sadhukhan { "cr3 read nointercept", default_supported, default_prepare, 2922ad879127SKrish Sadhukhan default_prepare_gif_clear, test_cr3_intercept, default_finished, 2923ad879127SKrish Sadhukhan check_cr3_nointercept }, 2924ad879127SKrish Sadhukhan { "cr3 read intercept emulate", smp_supported, 2925ad879127SKrish Sadhukhan prepare_cr3_intercept_bypass, default_prepare_gif_clear, 2926ad879127SKrish Sadhukhan test_cr3_intercept_bypass, default_finished, check_cr3_intercept }, 2927ad879127SKrish Sadhukhan { "dr intercept check", default_supported, prepare_dr_intercept, 2928ad879127SKrish Sadhukhan default_prepare_gif_clear, test_dr_intercept, dr_intercept_finished, 2929ad879127SKrish Sadhukhan check_dr_intercept }, 2930ad879127SKrish Sadhukhan { "next_rip", next_rip_supported, prepare_next_rip, 2931ad879127SKrish Sadhukhan default_prepare_gif_clear, test_next_rip, 2932ad879127SKrish Sadhukhan default_finished, check_next_rip }, 2933ad879127SKrish Sadhukhan { "msr intercept check", default_supported, prepare_msr_intercept, 2934ad879127SKrish Sadhukhan default_prepare_gif_clear, test_msr_intercept, 2935ad879127SKrish Sadhukhan msr_intercept_finished, check_msr_intercept }, 2936ad879127SKrish Sadhukhan { "mode_switch", default_supported, prepare_mode_switch, 2937ad879127SKrish Sadhukhan default_prepare_gif_clear, test_mode_switch, 2938ad879127SKrish Sadhukhan mode_switch_finished, check_mode_switch }, 2939ad879127SKrish Sadhukhan { "asid_zero", default_supported, prepare_asid_zero, 2940ad879127SKrish Sadhukhan default_prepare_gif_clear, test_asid_zero, 2941ad879127SKrish Sadhukhan default_finished, check_asid_zero }, 2942ad879127SKrish Sadhukhan { "sel_cr0_bug", default_supported, sel_cr0_bug_prepare, 2943ad879127SKrish Sadhukhan default_prepare_gif_clear, sel_cr0_bug_test, 2944ad879127SKrish Sadhukhan sel_cr0_bug_finished, sel_cr0_bug_check }, 2945ad879127SKrish Sadhukhan { "npt_nx", npt_supported, npt_nx_prepare, 2946ad879127SKrish Sadhukhan default_prepare_gif_clear, null_test, 2947ad879127SKrish Sadhukhan default_finished, npt_nx_check }, 29486faca2a5SKrish Sadhukhan { "npt_np", npt_supported, npt_np_prepare, 29496faca2a5SKrish Sadhukhan default_prepare_gif_clear, npt_np_test, 29506faca2a5SKrish Sadhukhan default_finished, npt_np_check }, 2951ad879127SKrish Sadhukhan { "npt_us", npt_supported, npt_us_prepare, 2952ad879127SKrish Sadhukhan default_prepare_gif_clear, npt_us_test, 2953ad879127SKrish Sadhukhan default_finished, npt_us_check }, 2954ad879127SKrish Sadhukhan { "npt_rw", npt_supported, npt_rw_prepare, 2955ad879127SKrish Sadhukhan default_prepare_gif_clear, npt_rw_test, 2956ad879127SKrish Sadhukhan default_finished, npt_rw_check }, 2957ad879127SKrish Sadhukhan { "npt_rw_pfwalk", npt_supported, npt_rw_pfwalk_prepare, 2958ad879127SKrish Sadhukhan default_prepare_gif_clear, null_test, 2959ad879127SKrish Sadhukhan default_finished, npt_rw_pfwalk_check }, 2960ad879127SKrish Sadhukhan { "npt_l1mmio", npt_supported, npt_l1mmio_prepare, 2961ad879127SKrish Sadhukhan default_prepare_gif_clear, npt_l1mmio_test, 2962ad879127SKrish Sadhukhan default_finished, npt_l1mmio_check }, 2963ad879127SKrish Sadhukhan { "npt_rw_l1mmio", npt_supported, npt_rw_l1mmio_prepare, 2964ad879127SKrish Sadhukhan default_prepare_gif_clear, npt_rw_l1mmio_test, 2965ad879127SKrish Sadhukhan default_finished, npt_rw_l1mmio_check }, 296610a65fc4SNadav Amit { "tsc_adjust", tsc_adjust_supported, tsc_adjust_prepare, 2967ad879127SKrish Sadhukhan default_prepare_gif_clear, tsc_adjust_test, 2968ad879127SKrish Sadhukhan default_finished, tsc_adjust_check }, 2969ad879127SKrish Sadhukhan { "latency_run_exit", default_supported, latency_prepare, 2970ad879127SKrish Sadhukhan default_prepare_gif_clear, latency_test, 2971ad879127SKrish Sadhukhan latency_finished, latency_check }, 2972f7fa53dcSPaolo Bonzini { "latency_run_exit_clean", default_supported, latency_prepare, 2973f7fa53dcSPaolo Bonzini default_prepare_gif_clear, latency_test, 2974f7fa53dcSPaolo Bonzini latency_finished_clean, latency_check }, 2975ad879127SKrish Sadhukhan { "latency_svm_insn", default_supported, lat_svm_insn_prepare, 2976ad879127SKrish Sadhukhan default_prepare_gif_clear, null_test, 2977ad879127SKrish Sadhukhan lat_svm_insn_finished, lat_svm_insn_check }, 29784b4fb247SPaolo Bonzini { "exc_inject", default_supported, exc_inject_prepare, 29794b4fb247SPaolo Bonzini default_prepare_gif_clear, exc_inject_test, 29804b4fb247SPaolo Bonzini exc_inject_finished, exc_inject_check }, 2981ad879127SKrish Sadhukhan { "pending_event", default_supported, pending_event_prepare, 2982ad879127SKrish Sadhukhan default_prepare_gif_clear, 2983ad879127SKrish Sadhukhan pending_event_test, pending_event_finished, pending_event_check }, 298485dc2aceSPaolo Bonzini { "pending_event_cli", default_supported, pending_event_cli_prepare, 298585dc2aceSPaolo Bonzini pending_event_cli_prepare_gif_clear, 298685dc2aceSPaolo Bonzini pending_event_cli_test, pending_event_cli_finished, 298785dc2aceSPaolo Bonzini pending_event_cli_check }, 298885dc2aceSPaolo Bonzini { "interrupt", default_supported, interrupt_prepare, 298985dc2aceSPaolo Bonzini default_prepare_gif_clear, interrupt_test, 299085dc2aceSPaolo Bonzini interrupt_finished, interrupt_check }, 2991d4db486bSCathy Avery { "nmi", default_supported, nmi_prepare, 2992d4db486bSCathy Avery default_prepare_gif_clear, nmi_test, 2993d4db486bSCathy Avery nmi_finished, nmi_check }, 29949da1f4d8SCathy Avery { "nmi_hlt", smp_supported, nmi_prepare, 29959da1f4d8SCathy Avery default_prepare_gif_clear, nmi_hlt_test, 29969da1f4d8SCathy Avery nmi_hlt_finished, nmi_hlt_check }, 29979c838954SCathy Avery { "virq_inject", default_supported, virq_inject_prepare, 29989c838954SCathy Avery default_prepare_gif_clear, virq_inject_test, 29999c838954SCathy Avery virq_inject_finished, virq_inject_check }, 3000da338a31SMaxim Levitsky { "reg_corruption", default_supported, reg_corruption_prepare, 3001da338a31SMaxim Levitsky default_prepare_gif_clear, reg_corruption_test, 3002da338a31SMaxim Levitsky reg_corruption_finished, reg_corruption_check }, 30034770e9c8SCathy Avery { "svm_init_startup_test", smp_supported, init_startup_prepare, 30044770e9c8SCathy Avery default_prepare_gif_clear, null_test, 30054770e9c8SCathy Avery init_startup_finished, init_startup_check }, 3006d5da6dfeSCathy Avery { "svm_init_intercept_test", smp_supported, init_intercept_prepare, 3007d5da6dfeSCathy Avery default_prepare_gif_clear, init_intercept_test, 3008d5da6dfeSCathy Avery init_intercept_finished, init_intercept_check, .on_vcpu = 2 }, 30097839b0ecSKrish Sadhukhan { "host_rflags", default_supported, host_rflags_prepare, 30107839b0ecSKrish Sadhukhan host_rflags_prepare_gif_clear, host_rflags_test, 30117839b0ecSKrish Sadhukhan host_rflags_finished, host_rflags_check }, 3012f6972bd6SLara Lazier { "vgif", vgif_supported, prepare_vgif_enabled, 3013f6972bd6SLara Lazier default_prepare_gif_clear, test_vgif, vgif_finished, 3014f6972bd6SLara Lazier vgif_check }, 3015f32183f5SJim Mattson TEST(svm_cr4_osxsave_test), 3016ba29942cSKrish Sadhukhan TEST(svm_guest_state_test), 3017916635a8SSean Christopherson TEST(svm_npt_rsvd_bits_test), 30187a57ef5dSMaxim Levitsky TEST(svm_vmrun_errata_test), 30190b6f6cedSKrish Sadhukhan TEST(svm_vmload_vmsave), 3020*665f5677SKrish Sadhukhan TEST(svm_test_singlestep), 3021ad879127SKrish Sadhukhan { NULL, NULL, NULL, NULL, NULL, NULL, NULL } 3022ad879127SKrish Sadhukhan }; 3023