1 #include "svm.h" 2 #include "libcflat.h" 3 #include "processor.h" 4 #include "desc.h" 5 #include "msr.h" 6 #include "vm.h" 7 #include "smp.h" 8 #include "types.h" 9 #include "alloc_page.h" 10 #include "isr.h" 11 #include "apic.h" 12 #include "delay.h" 13 #include "util.h" 14 #include "x86/usermode.h" 15 16 #define SVM_EXIT_MAX_DR_INTERCEPT 0x3f 17 18 #define LATENCY_RUNS 1000000 19 20 u64 tsc_start; 21 u64 tsc_end; 22 23 u64 vmrun_sum, vmexit_sum; 24 u64 vmsave_sum, vmload_sum; 25 u64 stgi_sum, clgi_sum; 26 u64 latvmrun_max; 27 u64 latvmrun_min; 28 u64 latvmexit_max; 29 u64 latvmexit_min; 30 u64 latvmload_max; 31 u64 latvmload_min; 32 u64 latvmsave_max; 33 u64 latvmsave_min; 34 u64 latstgi_max; 35 u64 latstgi_min; 36 u64 latclgi_max; 37 u64 latclgi_min; 38 u64 runs; 39 40 static void null_test(struct svm_test *test) 41 { 42 } 43 44 static bool null_check(struct svm_test *test) 45 { 46 return vmcb->control.exit_code == SVM_EXIT_VMMCALL; 47 } 48 49 static void prepare_no_vmrun_int(struct svm_test *test) 50 { 51 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMRUN); 52 } 53 54 static bool check_no_vmrun_int(struct svm_test *test) 55 { 56 return vmcb->control.exit_code == SVM_EXIT_ERR; 57 } 58 59 static void test_vmrun(struct svm_test *test) 60 { 61 asm volatile ("vmrun %0" : : "a"(virt_to_phys(vmcb))); 62 } 63 64 static bool check_vmrun(struct svm_test *test) 65 { 66 return vmcb->control.exit_code == SVM_EXIT_VMRUN; 67 } 68 69 static void prepare_rsm_intercept(struct svm_test *test) 70 { 71 default_prepare(test); 72 vmcb->control.intercept |= 1 << INTERCEPT_RSM; 73 vmcb->control.intercept_exceptions |= (1ULL << UD_VECTOR); 74 } 75 76 static void test_rsm_intercept(struct svm_test *test) 77 { 78 asm volatile ("rsm" : : : "memory"); 79 } 80 81 static bool check_rsm_intercept(struct svm_test *test) 82 { 83 return get_test_stage(test) == 2; 84 } 85 86 static bool finished_rsm_intercept(struct svm_test *test) 87 { 88 switch (get_test_stage(test)) { 89 case 0: 90 if (vmcb->control.exit_code != SVM_EXIT_RSM) { 91 report_fail("VMEXIT not due to rsm. Exit reason 0x%x", 92 vmcb->control.exit_code); 93 return true; 94 } 95 vmcb->control.intercept &= ~(1 << INTERCEPT_RSM); 96 inc_test_stage(test); 97 break; 98 99 case 1: 100 if (vmcb->control.exit_code != SVM_EXIT_EXCP_BASE + UD_VECTOR) { 101 report_fail("VMEXIT not due to #UD. Exit reason 0x%x", 102 vmcb->control.exit_code); 103 return true; 104 } 105 vmcb->save.rip += 2; 106 inc_test_stage(test); 107 break; 108 109 default: 110 return true; 111 } 112 return get_test_stage(test) == 2; 113 } 114 115 static void prepare_cr3_intercept(struct svm_test *test) 116 { 117 default_prepare(test); 118 vmcb->control.intercept_cr_read |= 1 << 3; 119 } 120 121 static void test_cr3_intercept(struct svm_test *test) 122 { 123 asm volatile ("mov %%cr3, %0" : "=r"(test->scratch) : : "memory"); 124 } 125 126 static bool check_cr3_intercept(struct svm_test *test) 127 { 128 return vmcb->control.exit_code == SVM_EXIT_READ_CR3; 129 } 130 131 static bool check_cr3_nointercept(struct svm_test *test) 132 { 133 return null_check(test) && test->scratch == read_cr3(); 134 } 135 136 static void corrupt_cr3_intercept_bypass(void *_test) 137 { 138 struct svm_test *test = _test; 139 extern volatile u32 mmio_insn; 140 141 while (!__sync_bool_compare_and_swap(&test->scratch, 1, 2)) 142 pause(); 143 pause(); 144 pause(); 145 pause(); 146 mmio_insn = 0x90d8200f; // mov %cr3, %rax; nop 147 } 148 149 static void prepare_cr3_intercept_bypass(struct svm_test *test) 150 { 151 default_prepare(test); 152 vmcb->control.intercept_cr_read |= 1 << 3; 153 on_cpu_async(1, corrupt_cr3_intercept_bypass, test); 154 } 155 156 static void test_cr3_intercept_bypass(struct svm_test *test) 157 { 158 ulong a = 0xa0000; 159 160 test->scratch = 1; 161 while (test->scratch != 2) 162 barrier(); 163 164 asm volatile ("mmio_insn: mov %0, (%0); nop" 165 : "+a"(a) : : "memory"); 166 test->scratch = a; 167 } 168 169 static void prepare_dr_intercept(struct svm_test *test) 170 { 171 default_prepare(test); 172 vmcb->control.intercept_dr_read = 0xff; 173 vmcb->control.intercept_dr_write = 0xff; 174 } 175 176 static void test_dr_intercept(struct svm_test *test) 177 { 178 unsigned int i, failcnt = 0; 179 180 /* Loop testing debug register reads */ 181 for (i = 0; i < 8; i++) { 182 183 switch (i) { 184 case 0: 185 asm volatile ("mov %%dr0, %0" : "=r"(test->scratch) : : "memory"); 186 break; 187 case 1: 188 asm volatile ("mov %%dr1, %0" : "=r"(test->scratch) : : "memory"); 189 break; 190 case 2: 191 asm volatile ("mov %%dr2, %0" : "=r"(test->scratch) : : "memory"); 192 break; 193 case 3: 194 asm volatile ("mov %%dr3, %0" : "=r"(test->scratch) : : "memory"); 195 break; 196 case 4: 197 asm volatile ("mov %%dr4, %0" : "=r"(test->scratch) : : "memory"); 198 break; 199 case 5: 200 asm volatile ("mov %%dr5, %0" : "=r"(test->scratch) : : "memory"); 201 break; 202 case 6: 203 asm volatile ("mov %%dr6, %0" : "=r"(test->scratch) : : "memory"); 204 break; 205 case 7: 206 asm volatile ("mov %%dr7, %0" : "=r"(test->scratch) : : "memory"); 207 break; 208 } 209 210 if (test->scratch != i) { 211 report_fail("dr%u read intercept", i); 212 failcnt++; 213 } 214 } 215 216 /* Loop testing debug register writes */ 217 for (i = 0; i < 8; i++) { 218 219 switch (i) { 220 case 0: 221 asm volatile ("mov %0, %%dr0" : : "r"(test->scratch) : "memory"); 222 break; 223 case 1: 224 asm volatile ("mov %0, %%dr1" : : "r"(test->scratch) : "memory"); 225 break; 226 case 2: 227 asm volatile ("mov %0, %%dr2" : : "r"(test->scratch) : "memory"); 228 break; 229 case 3: 230 asm volatile ("mov %0, %%dr3" : : "r"(test->scratch) : "memory"); 231 break; 232 case 4: 233 asm volatile ("mov %0, %%dr4" : : "r"(test->scratch) : "memory"); 234 break; 235 case 5: 236 asm volatile ("mov %0, %%dr5" : : "r"(test->scratch) : "memory"); 237 break; 238 case 6: 239 asm volatile ("mov %0, %%dr6" : : "r"(test->scratch) : "memory"); 240 break; 241 case 7: 242 asm volatile ("mov %0, %%dr7" : : "r"(test->scratch) : "memory"); 243 break; 244 } 245 246 if (test->scratch != i) { 247 report_fail("dr%u write intercept", i); 248 failcnt++; 249 } 250 } 251 252 test->scratch = failcnt; 253 } 254 255 static bool dr_intercept_finished(struct svm_test *test) 256 { 257 ulong n = (vmcb->control.exit_code - SVM_EXIT_READ_DR0); 258 259 /* Only expect DR intercepts */ 260 if (n > (SVM_EXIT_MAX_DR_INTERCEPT - SVM_EXIT_READ_DR0)) 261 return true; 262 263 /* 264 * Compute debug register number. 265 * Per Appendix C "SVM Intercept Exit Codes" of AMD64 Architecture 266 * Programmer's Manual Volume 2 - System Programming: 267 * http://support.amd.com/TechDocs/24593.pdf 268 * there are 16 VMEXIT codes each for DR read and write. 269 */ 270 test->scratch = (n % 16); 271 272 /* Jump over MOV instruction */ 273 vmcb->save.rip += 3; 274 275 return false; 276 } 277 278 static bool check_dr_intercept(struct svm_test *test) 279 { 280 return !test->scratch; 281 } 282 283 static bool next_rip_supported(void) 284 { 285 return this_cpu_has(X86_FEATURE_NRIPS); 286 } 287 288 static void prepare_next_rip(struct svm_test *test) 289 { 290 vmcb->control.intercept |= (1ULL << INTERCEPT_RDTSC); 291 } 292 293 294 static void test_next_rip(struct svm_test *test) 295 { 296 asm volatile ("rdtsc\n\t" 297 ".globl exp_next_rip\n\t" 298 "exp_next_rip:\n\t" ::: "eax", "edx"); 299 } 300 301 static bool check_next_rip(struct svm_test *test) 302 { 303 extern char exp_next_rip; 304 unsigned long address = (unsigned long)&exp_next_rip; 305 306 return address == vmcb->control.next_rip; 307 } 308 309 extern u8 *msr_bitmap; 310 311 static void prepare_msr_intercept(struct svm_test *test) 312 { 313 default_prepare(test); 314 vmcb->control.intercept |= (1ULL << INTERCEPT_MSR_PROT); 315 vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR); 316 memset(msr_bitmap, 0xff, MSR_BITMAP_SIZE); 317 } 318 319 static void test_msr_intercept(struct svm_test *test) 320 { 321 unsigned long msr_value = 0xef8056791234abcd; /* Arbitrary value */ 322 unsigned long msr_index; 323 324 for (msr_index = 0; msr_index <= 0xc0011fff; msr_index++) { 325 if (msr_index == 0xC0010131 /* MSR_SEV_STATUS */) { 326 /* 327 * Per section 15.34.10 "SEV_STATUS MSR" of AMD64 Architecture 328 * Programmer's Manual volume 2 - System Programming: 329 * http://support.amd.com/TechDocs/24593.pdf 330 * SEV_STATUS MSR (C001_0131) is a non-interceptable MSR. 331 */ 332 continue; 333 } 334 335 /* Skips gaps between supported MSR ranges */ 336 if (msr_index == 0x2000) 337 msr_index = 0xc0000000; 338 else if (msr_index == 0xc0002000) 339 msr_index = 0xc0010000; 340 341 test->scratch = -1; 342 343 rdmsr(msr_index); 344 345 /* Check that a read intercept occurred for MSR at msr_index */ 346 if (test->scratch != msr_index) 347 report_fail("MSR 0x%lx read intercept", msr_index); 348 349 /* 350 * Poor man approach to generate a value that 351 * seems arbitrary each time around the loop. 352 */ 353 msr_value += (msr_value << 1); 354 355 wrmsr(msr_index, msr_value); 356 357 /* Check that a write intercept occurred for MSR with msr_value */ 358 if (test->scratch != msr_value) 359 report_fail("MSR 0x%lx write intercept", msr_index); 360 } 361 362 test->scratch = -2; 363 } 364 365 static bool msr_intercept_finished(struct svm_test *test) 366 { 367 u32 exit_code = vmcb->control.exit_code; 368 u64 exit_info_1; 369 u8 *opcode; 370 371 if (exit_code == SVM_EXIT_MSR) { 372 exit_info_1 = vmcb->control.exit_info_1; 373 } else { 374 /* 375 * If #GP exception occurs instead, check that it was 376 * for RDMSR/WRMSR and set exit_info_1 accordingly. 377 */ 378 379 if (exit_code != (SVM_EXIT_EXCP_BASE + GP_VECTOR)) 380 return true; 381 382 opcode = (u8 *)vmcb->save.rip; 383 if (opcode[0] != 0x0f) 384 return true; 385 386 switch (opcode[1]) { 387 case 0x30: /* WRMSR */ 388 exit_info_1 = 1; 389 break; 390 case 0x32: /* RDMSR */ 391 exit_info_1 = 0; 392 break; 393 default: 394 return true; 395 } 396 397 /* 398 * Warn that #GP exception occured instead. 399 * RCX holds the MSR index. 400 */ 401 printf("%s 0x%lx #GP exception\n", 402 exit_info_1 ? "WRMSR" : "RDMSR", get_regs().rcx); 403 } 404 405 /* Jump over RDMSR/WRMSR instruction */ 406 vmcb->save.rip += 2; 407 408 /* 409 * Test whether the intercept was for RDMSR/WRMSR. 410 * For RDMSR, test->scratch is set to the MSR index; 411 * RCX holds the MSR index. 412 * For WRMSR, test->scratch is set to the MSR value; 413 * RDX holds the upper 32 bits of the MSR value, 414 * while RAX hold its lower 32 bits. 415 */ 416 if (exit_info_1) 417 test->scratch = 418 ((get_regs().rdx << 32) | (vmcb->save.rax & 0xffffffff)); 419 else 420 test->scratch = get_regs().rcx; 421 422 return false; 423 } 424 425 static bool check_msr_intercept(struct svm_test *test) 426 { 427 memset(msr_bitmap, 0, MSR_BITMAP_SIZE); 428 return (test->scratch == -2); 429 } 430 431 static void prepare_mode_switch(struct svm_test *test) 432 { 433 vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR) 434 | (1ULL << UD_VECTOR) 435 | (1ULL << DF_VECTOR) 436 | (1ULL << PF_VECTOR); 437 test->scratch = 0; 438 } 439 440 static void test_mode_switch(struct svm_test *test) 441 { 442 asm volatile(" cli\n" 443 " ljmp *1f\n" /* jump to 32-bit code segment */ 444 "1:\n" 445 " .long 2f\n" 446 " .long " xstr(KERNEL_CS32) "\n" 447 ".code32\n" 448 "2:\n" 449 " movl %%cr0, %%eax\n" 450 " btcl $31, %%eax\n" /* clear PG */ 451 " movl %%eax, %%cr0\n" 452 " movl $0xc0000080, %%ecx\n" /* EFER */ 453 " rdmsr\n" 454 " btcl $8, %%eax\n" /* clear LME */ 455 " wrmsr\n" 456 " movl %%cr4, %%eax\n" 457 " btcl $5, %%eax\n" /* clear PAE */ 458 " movl %%eax, %%cr4\n" 459 " movw %[ds16], %%ax\n" 460 " movw %%ax, %%ds\n" 461 " ljmpl %[cs16], $3f\n" /* jump to 16 bit protected-mode */ 462 ".code16\n" 463 "3:\n" 464 " movl %%cr0, %%eax\n" 465 " btcl $0, %%eax\n" /* clear PE */ 466 " movl %%eax, %%cr0\n" 467 " ljmpl $0, $4f\n" /* jump to real-mode */ 468 "4:\n" 469 " vmmcall\n" 470 " movl %%cr0, %%eax\n" 471 " btsl $0, %%eax\n" /* set PE */ 472 " movl %%eax, %%cr0\n" 473 " ljmpl %[cs32], $5f\n" /* back to protected mode */ 474 ".code32\n" 475 "5:\n" 476 " movl %%cr4, %%eax\n" 477 " btsl $5, %%eax\n" /* set PAE */ 478 " movl %%eax, %%cr4\n" 479 " movl $0xc0000080, %%ecx\n" /* EFER */ 480 " rdmsr\n" 481 " btsl $8, %%eax\n" /* set LME */ 482 " wrmsr\n" 483 " movl %%cr0, %%eax\n" 484 " btsl $31, %%eax\n" /* set PG */ 485 " movl %%eax, %%cr0\n" 486 " ljmpl %[cs64], $6f\n" /* back to long mode */ 487 ".code64\n\t" 488 "6:\n" 489 " vmmcall\n" 490 :: [cs16] "i"(KERNEL_CS16), [ds16] "i"(KERNEL_DS16), 491 [cs32] "i"(KERNEL_CS32), [cs64] "i"(KERNEL_CS64) 492 : "rax", "rbx", "rcx", "rdx", "memory"); 493 } 494 495 static bool mode_switch_finished(struct svm_test *test) 496 { 497 u64 cr0, cr4, efer; 498 499 cr0 = vmcb->save.cr0; 500 cr4 = vmcb->save.cr4; 501 efer = vmcb->save.efer; 502 503 /* Only expect VMMCALL intercepts */ 504 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) 505 return true; 506 507 /* Jump over VMMCALL instruction */ 508 vmcb->save.rip += 3; 509 510 /* Do sanity checks */ 511 switch (test->scratch) { 512 case 0: 513 /* Test should be in real mode now - check for this */ 514 if ((cr0 & 0x80000001) || /* CR0.PG, CR0.PE */ 515 (cr4 & 0x00000020) || /* CR4.PAE */ 516 (efer & 0x00000500)) /* EFER.LMA, EFER.LME */ 517 return true; 518 break; 519 case 2: 520 /* Test should be back in long-mode now - check for this */ 521 if (((cr0 & 0x80000001) != 0x80000001) || /* CR0.PG, CR0.PE */ 522 ((cr4 & 0x00000020) != 0x00000020) || /* CR4.PAE */ 523 ((efer & 0x00000500) != 0x00000500)) /* EFER.LMA, EFER.LME */ 524 return true; 525 break; 526 } 527 528 /* one step forward */ 529 test->scratch += 1; 530 531 return test->scratch == 2; 532 } 533 534 static bool check_mode_switch(struct svm_test *test) 535 { 536 return test->scratch == 2; 537 } 538 539 extern u8 *io_bitmap; 540 541 static void prepare_ioio(struct svm_test *test) 542 { 543 vmcb->control.intercept |= (1ULL << INTERCEPT_IOIO_PROT); 544 test->scratch = 0; 545 memset(io_bitmap, 0, 8192); 546 io_bitmap[8192] = 0xFF; 547 } 548 549 static void test_ioio(struct svm_test *test) 550 { 551 // stage 0, test IO pass 552 inb(0x5000); 553 outb(0x0, 0x5000); 554 if (get_test_stage(test) != 0) 555 goto fail; 556 557 // test IO width, in/out 558 io_bitmap[0] = 0xFF; 559 inc_test_stage(test); 560 inb(0x0); 561 if (get_test_stage(test) != 2) 562 goto fail; 563 564 outw(0x0, 0x0); 565 if (get_test_stage(test) != 3) 566 goto fail; 567 568 inl(0x0); 569 if (get_test_stage(test) != 4) 570 goto fail; 571 572 // test low/high IO port 573 io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8)); 574 inb(0x5000); 575 if (get_test_stage(test) != 5) 576 goto fail; 577 578 io_bitmap[0x9000 / 8] = (1 << (0x9000 % 8)); 579 inw(0x9000); 580 if (get_test_stage(test) != 6) 581 goto fail; 582 583 // test partial pass 584 io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8)); 585 inl(0x4FFF); 586 if (get_test_stage(test) != 7) 587 goto fail; 588 589 // test across pages 590 inc_test_stage(test); 591 inl(0x7FFF); 592 if (get_test_stage(test) != 8) 593 goto fail; 594 595 inc_test_stage(test); 596 io_bitmap[0x8000 / 8] = 1 << (0x8000 % 8); 597 inl(0x7FFF); 598 if (get_test_stage(test) != 10) 599 goto fail; 600 601 io_bitmap[0] = 0; 602 inl(0xFFFF); 603 if (get_test_stage(test) != 11) 604 goto fail; 605 606 io_bitmap[0] = 0xFF; 607 io_bitmap[8192] = 0; 608 inl(0xFFFF); 609 inc_test_stage(test); 610 if (get_test_stage(test) != 12) 611 goto fail; 612 613 return; 614 615 fail: 616 report_fail("stage %d", get_test_stage(test)); 617 test->scratch = -1; 618 } 619 620 static bool ioio_finished(struct svm_test *test) 621 { 622 unsigned port, size; 623 624 /* Only expect IOIO intercepts */ 625 if (vmcb->control.exit_code == SVM_EXIT_VMMCALL) 626 return true; 627 628 if (vmcb->control.exit_code != SVM_EXIT_IOIO) 629 return true; 630 631 /* one step forward */ 632 test->scratch += 1; 633 634 port = vmcb->control.exit_info_1 >> 16; 635 size = (vmcb->control.exit_info_1 >> SVM_IOIO_SIZE_SHIFT) & 7; 636 637 while (size--) { 638 io_bitmap[port / 8] &= ~(1 << (port & 7)); 639 port++; 640 } 641 642 return false; 643 } 644 645 static bool check_ioio(struct svm_test *test) 646 { 647 memset(io_bitmap, 0, 8193); 648 return test->scratch != -1; 649 } 650 651 static void prepare_asid_zero(struct svm_test *test) 652 { 653 vmcb->control.asid = 0; 654 } 655 656 static void test_asid_zero(struct svm_test *test) 657 { 658 asm volatile ("vmmcall\n\t"); 659 } 660 661 static bool check_asid_zero(struct svm_test *test) 662 { 663 return vmcb->control.exit_code == SVM_EXIT_ERR; 664 } 665 666 static void sel_cr0_bug_prepare(struct svm_test *test) 667 { 668 vmcb->control.intercept |= (1ULL << INTERCEPT_SELECTIVE_CR0); 669 } 670 671 static bool sel_cr0_bug_finished(struct svm_test *test) 672 { 673 return true; 674 } 675 676 static void sel_cr0_bug_test(struct svm_test *test) 677 { 678 unsigned long cr0; 679 680 /* read cr0, clear CD, and write back */ 681 cr0 = read_cr0(); 682 cr0 |= (1UL << 30); 683 write_cr0(cr0); 684 685 /* 686 * If we are here the test failed, not sure what to do now because we 687 * are not in guest-mode anymore so we can't trigger an intercept. 688 * Trigger a tripple-fault for now. 689 */ 690 report_fail("sel_cr0 test. Can not recover from this - exiting"); 691 exit(report_summary()); 692 } 693 694 static bool sel_cr0_bug_check(struct svm_test *test) 695 { 696 return vmcb->control.exit_code == SVM_EXIT_CR0_SEL_WRITE; 697 } 698 699 #define TSC_ADJUST_VALUE (1ll << 32) 700 #define TSC_OFFSET_VALUE (~0ull << 48) 701 static bool ok; 702 703 static bool tsc_adjust_supported(void) 704 { 705 return this_cpu_has(X86_FEATURE_TSC_ADJUST); 706 } 707 708 static void tsc_adjust_prepare(struct svm_test *test) 709 { 710 default_prepare(test); 711 vmcb->control.tsc_offset = TSC_OFFSET_VALUE; 712 713 wrmsr(MSR_IA32_TSC_ADJUST, -TSC_ADJUST_VALUE); 714 int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST); 715 ok = adjust == -TSC_ADJUST_VALUE; 716 } 717 718 static void tsc_adjust_test(struct svm_test *test) 719 { 720 int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST); 721 ok &= adjust == -TSC_ADJUST_VALUE; 722 723 uint64_t l1_tsc = rdtsc() - TSC_OFFSET_VALUE; 724 wrmsr(MSR_IA32_TSC, l1_tsc - TSC_ADJUST_VALUE); 725 726 adjust = rdmsr(MSR_IA32_TSC_ADJUST); 727 ok &= adjust <= -2 * TSC_ADJUST_VALUE; 728 729 uint64_t l1_tsc_end = rdtsc() - TSC_OFFSET_VALUE; 730 ok &= (l1_tsc_end + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE; 731 732 uint64_t l1_tsc_msr = rdmsr(MSR_IA32_TSC) - TSC_OFFSET_VALUE; 733 ok &= (l1_tsc_msr + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE; 734 } 735 736 static bool tsc_adjust_check(struct svm_test *test) 737 { 738 int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST); 739 740 wrmsr(MSR_IA32_TSC_ADJUST, 0); 741 return ok && adjust <= -2 * TSC_ADJUST_VALUE; 742 } 743 744 745 static u64 guest_tsc_delay_value; 746 /* number of bits to shift tsc right for stable result */ 747 #define TSC_SHIFT 24 748 #define TSC_SCALE_ITERATIONS 10 749 750 static void svm_tsc_scale_guest(struct svm_test *test) 751 { 752 u64 start_tsc = rdtsc(); 753 754 while (rdtsc() - start_tsc < guest_tsc_delay_value) 755 cpu_relax(); 756 } 757 758 static void svm_tsc_scale_run_testcase(u64 duration, 759 double tsc_scale, u64 tsc_offset) 760 { 761 u64 start_tsc, actual_duration; 762 763 guest_tsc_delay_value = (duration << TSC_SHIFT) * tsc_scale; 764 765 test_set_guest(svm_tsc_scale_guest); 766 vmcb->control.tsc_offset = tsc_offset; 767 wrmsr(MSR_AMD64_TSC_RATIO, (u64)(tsc_scale * (1ULL << 32))); 768 769 start_tsc = rdtsc(); 770 771 if (svm_vmrun() != SVM_EXIT_VMMCALL) 772 report_fail("unexpected vm exit code 0x%x", vmcb->control.exit_code); 773 774 actual_duration = (rdtsc() - start_tsc) >> TSC_SHIFT; 775 776 report(duration == actual_duration, "tsc delay (expected: %lu, actual: %lu)", 777 duration, actual_duration); 778 } 779 780 static void svm_tsc_scale_test(void) 781 { 782 int i; 783 784 if (!tsc_scale_supported()) { 785 report_skip("TSC scale not supported in the guest"); 786 return; 787 } 788 789 report(rdmsr(MSR_AMD64_TSC_RATIO) == TSC_RATIO_DEFAULT, 790 "initial TSC scale ratio"); 791 792 for (i = 0 ; i < TSC_SCALE_ITERATIONS; i++) { 793 794 double tsc_scale = (double)(rdrand() % 100 + 1) / 10; 795 int duration = rdrand() % 50 + 1; 796 u64 tsc_offset = rdrand(); 797 798 report_info("duration=%d, tsc_scale=%d, tsc_offset=%ld", 799 duration, (int)(tsc_scale * 100), tsc_offset); 800 801 svm_tsc_scale_run_testcase(duration, tsc_scale, tsc_offset); 802 } 803 804 svm_tsc_scale_run_testcase(50, 255, rdrand()); 805 svm_tsc_scale_run_testcase(50, 0.0001, rdrand()); 806 } 807 808 static void latency_prepare(struct svm_test *test) 809 { 810 default_prepare(test); 811 runs = LATENCY_RUNS; 812 latvmrun_min = latvmexit_min = -1ULL; 813 latvmrun_max = latvmexit_max = 0; 814 vmrun_sum = vmexit_sum = 0; 815 tsc_start = rdtsc(); 816 } 817 818 static void latency_test(struct svm_test *test) 819 { 820 u64 cycles; 821 822 start: 823 tsc_end = rdtsc(); 824 825 cycles = tsc_end - tsc_start; 826 827 if (cycles > latvmrun_max) 828 latvmrun_max = cycles; 829 830 if (cycles < latvmrun_min) 831 latvmrun_min = cycles; 832 833 vmrun_sum += cycles; 834 835 tsc_start = rdtsc(); 836 837 asm volatile ("vmmcall" : : : "memory"); 838 goto start; 839 } 840 841 static bool latency_finished(struct svm_test *test) 842 { 843 u64 cycles; 844 845 tsc_end = rdtsc(); 846 847 cycles = tsc_end - tsc_start; 848 849 if (cycles > latvmexit_max) 850 latvmexit_max = cycles; 851 852 if (cycles < latvmexit_min) 853 latvmexit_min = cycles; 854 855 vmexit_sum += cycles; 856 857 vmcb->save.rip += 3; 858 859 runs -= 1; 860 861 tsc_end = rdtsc(); 862 863 return runs == 0; 864 } 865 866 static bool latency_finished_clean(struct svm_test *test) 867 { 868 vmcb->control.clean = VMCB_CLEAN_ALL; 869 return latency_finished(test); 870 } 871 872 static bool latency_check(struct svm_test *test) 873 { 874 printf(" Latency VMRUN : max: %ld min: %ld avg: %ld\n", latvmrun_max, 875 latvmrun_min, vmrun_sum / LATENCY_RUNS); 876 printf(" Latency VMEXIT: max: %ld min: %ld avg: %ld\n", latvmexit_max, 877 latvmexit_min, vmexit_sum / LATENCY_RUNS); 878 return true; 879 } 880 881 static void lat_svm_insn_prepare(struct svm_test *test) 882 { 883 default_prepare(test); 884 runs = LATENCY_RUNS; 885 latvmload_min = latvmsave_min = latstgi_min = latclgi_min = -1ULL; 886 latvmload_max = latvmsave_max = latstgi_max = latclgi_max = 0; 887 vmload_sum = vmsave_sum = stgi_sum = clgi_sum; 888 } 889 890 static bool lat_svm_insn_finished(struct svm_test *test) 891 { 892 u64 vmcb_phys = virt_to_phys(vmcb); 893 u64 cycles; 894 895 for ( ; runs != 0; runs--) { 896 tsc_start = rdtsc(); 897 asm volatile("vmload %0\n\t" : : "a"(vmcb_phys) : "memory"); 898 cycles = rdtsc() - tsc_start; 899 if (cycles > latvmload_max) 900 latvmload_max = cycles; 901 if (cycles < latvmload_min) 902 latvmload_min = cycles; 903 vmload_sum += cycles; 904 905 tsc_start = rdtsc(); 906 asm volatile("vmsave %0\n\t" : : "a"(vmcb_phys) : "memory"); 907 cycles = rdtsc() - tsc_start; 908 if (cycles > latvmsave_max) 909 latvmsave_max = cycles; 910 if (cycles < latvmsave_min) 911 latvmsave_min = cycles; 912 vmsave_sum += cycles; 913 914 tsc_start = rdtsc(); 915 asm volatile("stgi\n\t"); 916 cycles = rdtsc() - tsc_start; 917 if (cycles > latstgi_max) 918 latstgi_max = cycles; 919 if (cycles < latstgi_min) 920 latstgi_min = cycles; 921 stgi_sum += cycles; 922 923 tsc_start = rdtsc(); 924 asm volatile("clgi\n\t"); 925 cycles = rdtsc() - tsc_start; 926 if (cycles > latclgi_max) 927 latclgi_max = cycles; 928 if (cycles < latclgi_min) 929 latclgi_min = cycles; 930 clgi_sum += cycles; 931 } 932 933 tsc_end = rdtsc(); 934 935 return true; 936 } 937 938 static bool lat_svm_insn_check(struct svm_test *test) 939 { 940 printf(" Latency VMLOAD: max: %ld min: %ld avg: %ld\n", latvmload_max, 941 latvmload_min, vmload_sum / LATENCY_RUNS); 942 printf(" Latency VMSAVE: max: %ld min: %ld avg: %ld\n", latvmsave_max, 943 latvmsave_min, vmsave_sum / LATENCY_RUNS); 944 printf(" Latency STGI: max: %ld min: %ld avg: %ld\n", latstgi_max, 945 latstgi_min, stgi_sum / LATENCY_RUNS); 946 printf(" Latency CLGI: max: %ld min: %ld avg: %ld\n", latclgi_max, 947 latclgi_min, clgi_sum / LATENCY_RUNS); 948 return true; 949 } 950 951 /* 952 * Report failures from SVM guest code, and on failure, set the stage to -1 and 953 * do VMMCALL to terminate the test (host side must treat -1 as "finished"). 954 * TODO: fix the tests that don't play nice with a straight report, e.g. the 955 * V_TPR test fails if report() is invoked. 956 */ 957 #define report_svm_guest(cond, test, fmt, args...) \ 958 do { \ 959 if (!(cond)) { \ 960 report_fail(fmt, ##args); \ 961 set_test_stage(test, -1); \ 962 vmmcall(); \ 963 } \ 964 } while (0) 965 966 bool pending_event_ipi_fired; 967 bool pending_event_guest_run; 968 969 static void pending_event_ipi_isr(isr_regs_t *regs) 970 { 971 pending_event_ipi_fired = true; 972 eoi(); 973 } 974 975 static void pending_event_prepare(struct svm_test *test) 976 { 977 int ipi_vector = 0xf1; 978 979 default_prepare(test); 980 981 pending_event_ipi_fired = false; 982 983 handle_irq(ipi_vector, pending_event_ipi_isr); 984 985 pending_event_guest_run = false; 986 987 vmcb->control.intercept |= (1ULL << INTERCEPT_INTR); 988 vmcb->control.int_ctl |= V_INTR_MASKING_MASK; 989 990 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | 991 APIC_DM_FIXED | ipi_vector, 0); 992 993 set_test_stage(test, 0); 994 } 995 996 static void pending_event_test(struct svm_test *test) 997 { 998 pending_event_guest_run = true; 999 } 1000 1001 static bool pending_event_finished(struct svm_test *test) 1002 { 1003 switch (get_test_stage(test)) { 1004 case 0: 1005 if (vmcb->control.exit_code != SVM_EXIT_INTR) { 1006 report_fail("VMEXIT not due to pending interrupt. Exit reason 0x%x", 1007 vmcb->control.exit_code); 1008 return true; 1009 } 1010 1011 vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR); 1012 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 1013 1014 if (pending_event_guest_run) { 1015 report_fail("Guest ran before host received IPI\n"); 1016 return true; 1017 } 1018 1019 sti_nop_cli(); 1020 1021 if (!pending_event_ipi_fired) { 1022 report_fail("Pending interrupt not dispatched after IRQ enabled\n"); 1023 return true; 1024 } 1025 break; 1026 1027 case 1: 1028 if (!pending_event_guest_run) { 1029 report_fail("Guest did not resume when no interrupt\n"); 1030 return true; 1031 } 1032 break; 1033 } 1034 1035 inc_test_stage(test); 1036 1037 return get_test_stage(test) == 2; 1038 } 1039 1040 static bool pending_event_check(struct svm_test *test) 1041 { 1042 return get_test_stage(test) == 2; 1043 } 1044 1045 static void pending_event_cli_prepare(struct svm_test *test) 1046 { 1047 default_prepare(test); 1048 1049 pending_event_ipi_fired = false; 1050 1051 handle_irq(0xf1, pending_event_ipi_isr); 1052 1053 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | 1054 APIC_DM_FIXED | 0xf1, 0); 1055 1056 set_test_stage(test, 0); 1057 } 1058 1059 static void pending_event_cli_prepare_gif_clear(struct svm_test *test) 1060 { 1061 asm("cli"); 1062 } 1063 1064 static void pending_event_cli_test(struct svm_test *test) 1065 { 1066 report_svm_guest(!pending_event_ipi_fired, test, 1067 "IRQ should NOT be delivered while IRQs disabled"); 1068 1069 /* VINTR_MASKING is zero. This should cause the IPI to fire. */ 1070 sti_nop_cli(); 1071 1072 report_svm_guest(pending_event_ipi_fired, test, 1073 "IRQ should be delivered after enabling IRQs"); 1074 vmmcall(); 1075 1076 /* 1077 * Now VINTR_MASKING=1, but no interrupt is pending so 1078 * the VINTR interception should be clear in VMCB02. Check 1079 * that L0 did not leave a stale VINTR in the VMCB. 1080 */ 1081 sti_nop_cli(); 1082 } 1083 1084 static bool pending_event_cli_finished(struct svm_test *test) 1085 { 1086 report_svm_guest(vmcb->control.exit_code == SVM_EXIT_VMMCALL, test, 1087 "Wanted VMMCALL VM-Exit, got exit reason 0x%x", 1088 vmcb->control.exit_code); 1089 1090 switch (get_test_stage(test)) { 1091 case 0: 1092 vmcb->save.rip += 3; 1093 1094 pending_event_ipi_fired = false; 1095 1096 vmcb->control.int_ctl |= V_INTR_MASKING_MASK; 1097 1098 /* Now entering again with VINTR_MASKING=1. */ 1099 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | 1100 APIC_DM_FIXED | 0xf1, 0); 1101 1102 break; 1103 1104 case 1: 1105 if (pending_event_ipi_fired == true) { 1106 report_fail("Interrupt triggered by guest"); 1107 return true; 1108 } 1109 1110 sti_nop_cli(); 1111 1112 if (pending_event_ipi_fired != true) { 1113 report_fail("Interrupt not triggered by host"); 1114 return true; 1115 } 1116 1117 break; 1118 1119 default: 1120 return true; 1121 } 1122 1123 inc_test_stage(test); 1124 1125 return get_test_stage(test) == 2; 1126 } 1127 1128 static bool pending_event_cli_check(struct svm_test *test) 1129 { 1130 return get_test_stage(test) == 2; 1131 } 1132 1133 #define TIMER_VECTOR 222 1134 1135 static volatile bool timer_fired; 1136 1137 static void timer_isr(isr_regs_t *regs) 1138 { 1139 timer_fired = true; 1140 apic_write(APIC_EOI, 0); 1141 } 1142 1143 static void interrupt_prepare(struct svm_test *test) 1144 { 1145 default_prepare(test); 1146 handle_irq(TIMER_VECTOR, timer_isr); 1147 timer_fired = false; 1148 set_test_stage(test, 0); 1149 } 1150 1151 static void interrupt_test(struct svm_test *test) 1152 { 1153 long long start, loops; 1154 1155 apic_write(APIC_LVTT, TIMER_VECTOR); 1156 sti(); 1157 apic_write(APIC_TMICT, 1); //Timer Initial Count Register 0x380 one-shot 1158 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1159 asm volatile ("nop"); 1160 1161 report_svm_guest(timer_fired, test, 1162 "direct interrupt while running guest"); 1163 1164 apic_write(APIC_TMICT, 0); 1165 cli(); 1166 vmmcall(); 1167 1168 timer_fired = false; 1169 apic_write(APIC_TMICT, 1); 1170 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1171 asm volatile ("nop"); 1172 1173 report_svm_guest(timer_fired, test, 1174 "intercepted interrupt while running guest"); 1175 1176 sti(); 1177 apic_write(APIC_TMICT, 0); 1178 cli(); 1179 1180 timer_fired = false; 1181 start = rdtsc(); 1182 apic_write(APIC_TMICT, 1000000); 1183 safe_halt(); 1184 1185 report_svm_guest(timer_fired, test, "direct interrupt + hlt"); 1186 report(rdtsc() - start > 10000, "IRQ arrived after expected delay"); 1187 1188 apic_write(APIC_TMICT, 0); 1189 cli(); 1190 vmmcall(); 1191 1192 timer_fired = false; 1193 start = rdtsc(); 1194 apic_write(APIC_TMICT, 1000000); 1195 asm volatile ("hlt"); 1196 1197 report_svm_guest(timer_fired, test, "intercepted interrupt + hlt"); 1198 report(rdtsc() - start > 10000, "IRQ arrived after expected delay"); 1199 1200 apic_write(APIC_TMICT, 0); 1201 cli(); 1202 } 1203 1204 static bool interrupt_finished(struct svm_test *test) 1205 { 1206 switch (get_test_stage(test)) { 1207 case 0: 1208 case 2: 1209 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1210 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1211 vmcb->control.exit_code); 1212 return true; 1213 } 1214 vmcb->save.rip += 3; 1215 1216 vmcb->control.intercept |= (1ULL << INTERCEPT_INTR); 1217 vmcb->control.int_ctl |= V_INTR_MASKING_MASK; 1218 break; 1219 1220 case 1: 1221 case 3: 1222 if (vmcb->control.exit_code != SVM_EXIT_INTR) { 1223 report_fail("VMEXIT not due to intr intercept. Exit reason 0x%x", 1224 vmcb->control.exit_code); 1225 return true; 1226 } 1227 1228 sti_nop_cli(); 1229 1230 vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR); 1231 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 1232 break; 1233 1234 case 4: 1235 break; 1236 1237 default: 1238 return true; 1239 } 1240 1241 inc_test_stage(test); 1242 1243 return get_test_stage(test) == 5; 1244 } 1245 1246 static bool interrupt_check(struct svm_test *test) 1247 { 1248 return get_test_stage(test) == 5; 1249 } 1250 1251 static volatile bool nmi_fired; 1252 1253 static void nmi_handler(struct ex_regs *regs) 1254 { 1255 nmi_fired = true; 1256 } 1257 1258 static void nmi_prepare(struct svm_test *test) 1259 { 1260 default_prepare(test); 1261 nmi_fired = false; 1262 handle_exception(NMI_VECTOR, nmi_handler); 1263 set_test_stage(test, 0); 1264 } 1265 1266 static void nmi_test(struct svm_test *test) 1267 { 1268 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0); 1269 1270 report_svm_guest(nmi_fired, test, "direct NMI while running guest"); 1271 1272 vmmcall(); 1273 1274 nmi_fired = false; 1275 1276 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0); 1277 1278 report_svm_guest(nmi_fired, test, "intercepted pending NMI delivered to guest"); 1279 } 1280 1281 static bool nmi_finished(struct svm_test *test) 1282 { 1283 switch (get_test_stage(test)) { 1284 case 0: 1285 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1286 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1287 vmcb->control.exit_code); 1288 return true; 1289 } 1290 vmcb->save.rip += 3; 1291 1292 vmcb->control.intercept |= (1ULL << INTERCEPT_NMI); 1293 break; 1294 1295 case 1: 1296 if (vmcb->control.exit_code != SVM_EXIT_NMI) { 1297 report_fail("VMEXIT not due to NMI intercept. Exit reason 0x%x", 1298 vmcb->control.exit_code); 1299 return true; 1300 } 1301 1302 report_pass("NMI intercept while running guest"); 1303 break; 1304 1305 case 2: 1306 break; 1307 1308 default: 1309 return true; 1310 } 1311 1312 inc_test_stage(test); 1313 1314 return get_test_stage(test) == 3; 1315 } 1316 1317 static bool nmi_check(struct svm_test *test) 1318 { 1319 return get_test_stage(test) == 3; 1320 } 1321 1322 #define NMI_DELAY 100000000ULL 1323 1324 static void nmi_message_thread(void *_test) 1325 { 1326 struct svm_test *test = _test; 1327 1328 while (get_test_stage(test) != 1) 1329 pause(); 1330 1331 delay(NMI_DELAY); 1332 1333 apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]); 1334 1335 while (get_test_stage(test) != 2) 1336 pause(); 1337 1338 delay(NMI_DELAY); 1339 1340 apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]); 1341 } 1342 1343 static void nmi_hlt_test(struct svm_test *test) 1344 { 1345 long long start; 1346 1347 on_cpu_async(1, nmi_message_thread, test); 1348 1349 start = rdtsc(); 1350 1351 set_test_stage(test, 1); 1352 1353 asm volatile ("hlt"); 1354 1355 report_svm_guest(nmi_fired, test, "direct NMI + hlt"); 1356 report(rdtsc() - start > NMI_DELAY, "direct NMI after expected delay"); 1357 1358 nmi_fired = false; 1359 1360 vmmcall(); 1361 1362 start = rdtsc(); 1363 1364 set_test_stage(test, 2); 1365 1366 asm volatile ("hlt"); 1367 1368 report_svm_guest(nmi_fired, test, "intercepted NMI + hlt"); 1369 report(rdtsc() - start > NMI_DELAY, "intercepted NMI after expected delay"); 1370 1371 set_test_stage(test, 3); 1372 } 1373 1374 static bool nmi_hlt_finished(struct svm_test *test) 1375 { 1376 switch (get_test_stage(test)) { 1377 case 1: 1378 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1379 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1380 vmcb->control.exit_code); 1381 return true; 1382 } 1383 vmcb->save.rip += 3; 1384 1385 vmcb->control.intercept |= (1ULL << INTERCEPT_NMI); 1386 break; 1387 1388 case 2: 1389 if (vmcb->control.exit_code != SVM_EXIT_NMI) { 1390 report_fail("VMEXIT not due to NMI intercept. Exit reason 0x%x", 1391 vmcb->control.exit_code); 1392 return true; 1393 } 1394 1395 report_pass("NMI intercept while running guest"); 1396 break; 1397 1398 case 3: 1399 break; 1400 1401 default: 1402 return true; 1403 } 1404 1405 return get_test_stage(test) == 3; 1406 } 1407 1408 static bool nmi_hlt_check(struct svm_test *test) 1409 { 1410 return get_test_stage(test) == 3; 1411 } 1412 1413 static void vnmi_prepare(struct svm_test *test) 1414 { 1415 nmi_prepare(test); 1416 1417 /* 1418 * Disable NMI interception to start. Enabling vNMI without 1419 * intercepting "real" NMIs should result in an ERR VM-Exit. 1420 */ 1421 vmcb->control.intercept &= ~(1ULL << INTERCEPT_NMI); 1422 vmcb->control.int_ctl = V_NMI_ENABLE_MASK; 1423 vmcb->control.int_vector = NMI_VECTOR; 1424 } 1425 1426 static void vnmi_test(struct svm_test *test) 1427 { 1428 report_svm_guest(!nmi_fired, test, "No vNMI before injection"); 1429 vmmcall(); 1430 1431 report_svm_guest(nmi_fired, test, "vNMI delivered after injection"); 1432 vmmcall(); 1433 } 1434 1435 static bool vnmi_finished(struct svm_test *test) 1436 { 1437 switch (get_test_stage(test)) { 1438 case 0: 1439 if (vmcb->control.exit_code != SVM_EXIT_ERR) { 1440 report_fail("Wanted ERR VM-Exit, got 0x%x", 1441 vmcb->control.exit_code); 1442 return true; 1443 } 1444 report(!nmi_fired, "vNMI enabled but NMI_INTERCEPT unset!"); 1445 vmcb->control.intercept |= (1ULL << INTERCEPT_NMI); 1446 vmcb->save.rip += 3; 1447 break; 1448 1449 case 1: 1450 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1451 report_fail("Wanted VMMCALL VM-Exit, got 0x%x", 1452 vmcb->control.exit_code); 1453 return true; 1454 } 1455 report(!nmi_fired, "vNMI with vector 2 not injected"); 1456 vmcb->control.int_ctl |= V_NMI_PENDING_MASK; 1457 vmcb->save.rip += 3; 1458 break; 1459 1460 case 2: 1461 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1462 report_fail("Wanted VMMCALL VM-Exit, got 0x%x", 1463 vmcb->control.exit_code); 1464 return true; 1465 } 1466 if (vmcb->control.int_ctl & V_NMI_BLOCKING_MASK) { 1467 report_fail("V_NMI_BLOCKING_MASK not cleared on VMEXIT"); 1468 return true; 1469 } 1470 report_pass("VNMI serviced"); 1471 vmcb->save.rip += 3; 1472 break; 1473 1474 default: 1475 return true; 1476 } 1477 1478 inc_test_stage(test); 1479 1480 return get_test_stage(test) == 3; 1481 } 1482 1483 static bool vnmi_check(struct svm_test *test) 1484 { 1485 return get_test_stage(test) == 3; 1486 } 1487 1488 static volatile int count_exc = 0; 1489 1490 static void my_isr(struct ex_regs *r) 1491 { 1492 count_exc++; 1493 } 1494 1495 static void exc_inject_prepare(struct svm_test *test) 1496 { 1497 default_prepare(test); 1498 handle_exception(DE_VECTOR, my_isr); 1499 handle_exception(NMI_VECTOR, my_isr); 1500 } 1501 1502 1503 static void exc_inject_test(struct svm_test *test) 1504 { 1505 asm volatile ("vmmcall\n\tvmmcall\n\t"); 1506 } 1507 1508 static bool exc_inject_finished(struct svm_test *test) 1509 { 1510 switch (get_test_stage(test)) { 1511 case 0: 1512 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1513 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1514 vmcb->control.exit_code); 1515 return true; 1516 } 1517 vmcb->save.rip += 3; 1518 vmcb->control.event_inj = NMI_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID; 1519 break; 1520 1521 case 1: 1522 if (vmcb->control.exit_code != SVM_EXIT_ERR) { 1523 report_fail("VMEXIT not due to error. Exit reason 0x%x", 1524 vmcb->control.exit_code); 1525 return true; 1526 } 1527 report(count_exc == 0, "exception with vector 2 not injected"); 1528 vmcb->control.event_inj = DE_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID; 1529 break; 1530 1531 case 2: 1532 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1533 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1534 vmcb->control.exit_code); 1535 return true; 1536 } 1537 vmcb->save.rip += 3; 1538 report(count_exc == 1, "divide overflow exception injected"); 1539 report(!(vmcb->control.event_inj & SVM_EVTINJ_VALID), "eventinj.VALID cleared"); 1540 break; 1541 1542 default: 1543 return true; 1544 } 1545 1546 inc_test_stage(test); 1547 1548 return get_test_stage(test) == 3; 1549 } 1550 1551 static bool exc_inject_check(struct svm_test *test) 1552 { 1553 return count_exc == 1 && get_test_stage(test) == 3; 1554 } 1555 1556 static volatile bool virq_fired; 1557 1558 static void virq_isr(isr_regs_t *regs) 1559 { 1560 virq_fired = true; 1561 } 1562 1563 static void virq_inject_prepare(struct svm_test *test) 1564 { 1565 handle_irq(0xf1, virq_isr); 1566 default_prepare(test); 1567 vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK | 1568 (0x0f << V_INTR_PRIO_SHIFT); // Set to the highest priority 1569 vmcb->control.int_vector = 0xf1; 1570 virq_fired = false; 1571 set_test_stage(test, 0); 1572 } 1573 1574 static void virq_inject_test(struct svm_test *test) 1575 { 1576 report_svm_guest(!virq_fired, test, "virtual IRQ blocked after L2 cli"); 1577 1578 sti_nop_cli(); 1579 1580 report_svm_guest(virq_fired, test, "virtual IRQ fired after L2 sti"); 1581 1582 vmmcall(); 1583 1584 report_svm_guest(!virq_fired, test, "intercepted VINTR blocked after L2 cli"); 1585 1586 sti_nop_cli(); 1587 1588 report_svm_guest(virq_fired, test, "intercepted VINTR fired after L2 sti"); 1589 1590 vmmcall(); 1591 1592 sti_nop_cli(); 1593 1594 report_svm_guest(!virq_fired, test, 1595 "virtual IRQ blocked V_IRQ_PRIO less than V_TPR"); 1596 1597 vmmcall(); 1598 vmmcall(); 1599 } 1600 1601 static bool virq_inject_finished(struct svm_test *test) 1602 { 1603 vmcb->save.rip += 3; 1604 1605 switch (get_test_stage(test)) { 1606 case 0: 1607 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1608 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1609 vmcb->control.exit_code); 1610 return true; 1611 } 1612 if (vmcb->control.int_ctl & V_IRQ_MASK) { 1613 report_fail("V_IRQ not cleared on VMEXIT after firing"); 1614 return true; 1615 } 1616 virq_fired = false; 1617 vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR); 1618 vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK | 1619 (0x0f << V_INTR_PRIO_SHIFT); 1620 break; 1621 1622 case 1: 1623 if (vmcb->control.exit_code != SVM_EXIT_VINTR) { 1624 report_fail("VMEXIT not due to vintr. Exit reason 0x%x", 1625 vmcb->control.exit_code); 1626 return true; 1627 } 1628 if (virq_fired) { 1629 report_fail("V_IRQ fired before SVM_EXIT_VINTR"); 1630 return true; 1631 } 1632 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VINTR); 1633 break; 1634 1635 case 2: 1636 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1637 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1638 vmcb->control.exit_code); 1639 return true; 1640 } 1641 virq_fired = false; 1642 // Set irq to lower priority 1643 vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK | 1644 (0x08 << V_INTR_PRIO_SHIFT); 1645 // Raise guest TPR 1646 vmcb->control.int_ctl |= 0x0a & V_TPR_MASK; 1647 break; 1648 1649 case 3: 1650 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1651 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1652 vmcb->control.exit_code); 1653 return true; 1654 } 1655 vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR); 1656 break; 1657 1658 case 4: 1659 // INTERCEPT_VINTR should be ignored because V_INTR_PRIO < V_TPR 1660 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1661 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1662 vmcb->control.exit_code); 1663 return true; 1664 } 1665 break; 1666 1667 default: 1668 return true; 1669 } 1670 1671 inc_test_stage(test); 1672 1673 return get_test_stage(test) == 5; 1674 } 1675 1676 static bool virq_inject_check(struct svm_test *test) 1677 { 1678 return get_test_stage(test) == 5; 1679 } 1680 1681 /* 1682 * Detect nested guest RIP corruption as explained in kernel commit 1683 * b6162e82aef19fee9c32cb3fe9ac30d9116a8c73 1684 * 1685 * In the assembly loop below 'ins' is executed while IO instructions 1686 * are not intercepted; the instruction is emulated by L0. 1687 * 1688 * At the same time we are getting interrupts from the local APIC timer, 1689 * and we do intercept them in L1 1690 * 1691 * If the interrupt happens on the insb instruction, L0 will VMexit, emulate 1692 * the insb instruction and then it will inject the interrupt to L1 through 1693 * a nested VMexit. Due to a bug, it would leave pre-emulation values of RIP, 1694 * RAX and RSP in the VMCB. 1695 * 1696 * In our intercept handler we detect the bug by checking that RIP is that of 1697 * the insb instruction, but its memory operand has already been written. 1698 * This means that insb was already executed. 1699 */ 1700 1701 static volatile int isr_cnt = 0; 1702 static volatile uint8_t io_port_var = 0xAA; 1703 extern const char insb_instruction_label[]; 1704 1705 static void reg_corruption_isr(isr_regs_t *regs) 1706 { 1707 isr_cnt++; 1708 apic_write(APIC_EOI, 0); 1709 } 1710 1711 static void reg_corruption_prepare(struct svm_test *test) 1712 { 1713 default_prepare(test); 1714 set_test_stage(test, 0); 1715 1716 vmcb->control.int_ctl = V_INTR_MASKING_MASK; 1717 vmcb->control.intercept |= (1ULL << INTERCEPT_INTR); 1718 1719 handle_irq(TIMER_VECTOR, reg_corruption_isr); 1720 1721 /* set local APIC to inject external interrupts */ 1722 apic_write(APIC_TMICT, 0); 1723 apic_write(APIC_TDCR, 0); 1724 apic_write(APIC_LVTT, TIMER_VECTOR | APIC_LVT_TIMER_PERIODIC); 1725 apic_write(APIC_TMICT, 1000); 1726 } 1727 1728 static void reg_corruption_test(struct svm_test *test) 1729 { 1730 /* this is endless loop, which is interrupted by the timer interrupt */ 1731 asm volatile ( 1732 "1:\n\t" 1733 "movw $0x4d0, %%dx\n\t" // IO port 1734 "lea %[io_port_var], %%rdi\n\t" 1735 "movb $0xAA, %[io_port_var]\n\t" 1736 "insb_instruction_label:\n\t" 1737 "insb\n\t" 1738 "jmp 1b\n\t" 1739 1740 : [io_port_var] "=m" (io_port_var) 1741 : /* no inputs*/ 1742 : "rdx", "rdi" 1743 ); 1744 } 1745 1746 static bool reg_corruption_finished(struct svm_test *test) 1747 { 1748 if (isr_cnt == 10000) { 1749 report_pass("No RIP corruption detected after %d timer interrupts", 1750 isr_cnt); 1751 set_test_stage(test, 1); 1752 goto cleanup; 1753 } 1754 1755 if (vmcb->control.exit_code == SVM_EXIT_INTR) { 1756 1757 void* guest_rip = (void*)vmcb->save.rip; 1758 1759 sti_nop_cli(); 1760 1761 if (guest_rip == insb_instruction_label && io_port_var != 0xAA) { 1762 report_fail("RIP corruption detected after %d timer interrupts", 1763 isr_cnt); 1764 goto cleanup; 1765 } 1766 1767 } 1768 return false; 1769 cleanup: 1770 apic_write(APIC_LVTT, APIC_LVT_TIMER_MASK); 1771 apic_write(APIC_TMICT, 0); 1772 return true; 1773 1774 } 1775 1776 static bool reg_corruption_check(struct svm_test *test) 1777 { 1778 return get_test_stage(test) == 1; 1779 } 1780 1781 static void get_tss_entry(void *data) 1782 { 1783 *((gdt_entry_t **)data) = get_tss_descr(); 1784 } 1785 1786 static int orig_cpu_count; 1787 1788 static void init_startup_prepare(struct svm_test *test) 1789 { 1790 gdt_entry_t *tss_entry; 1791 int i; 1792 1793 on_cpu(1, get_tss_entry, &tss_entry); 1794 1795 orig_cpu_count = atomic_read(&cpu_online_count); 1796 1797 apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_INIT | APIC_INT_ASSERT, 1798 id_map[1]); 1799 1800 delay(100000000ULL); 1801 1802 atomic_dec(&cpu_online_count); 1803 1804 tss_entry->type &= ~DESC_BUSY; 1805 1806 apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_STARTUP, id_map[1]); 1807 1808 for (i = 0; i < 5 && atomic_read(&cpu_online_count) < orig_cpu_count; i++) 1809 delay(100000000ULL); 1810 } 1811 1812 static bool init_startup_finished(struct svm_test *test) 1813 { 1814 return true; 1815 } 1816 1817 static bool init_startup_check(struct svm_test *test) 1818 { 1819 return atomic_read(&cpu_online_count) == orig_cpu_count; 1820 } 1821 1822 static volatile bool init_intercept; 1823 1824 static void init_intercept_prepare(struct svm_test *test) 1825 { 1826 init_intercept = false; 1827 vmcb->control.intercept |= (1ULL << INTERCEPT_INIT); 1828 } 1829 1830 static void init_intercept_test(struct svm_test *test) 1831 { 1832 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_INIT | APIC_INT_ASSERT, 0); 1833 } 1834 1835 static bool init_intercept_finished(struct svm_test *test) 1836 { 1837 vmcb->save.rip += 3; 1838 1839 if (vmcb->control.exit_code != SVM_EXIT_INIT) { 1840 report_fail("VMEXIT not due to init intercept. Exit reason 0x%x", 1841 vmcb->control.exit_code); 1842 1843 return true; 1844 } 1845 1846 init_intercept = true; 1847 1848 report_pass("INIT to vcpu intercepted"); 1849 1850 return true; 1851 } 1852 1853 static bool init_intercept_check(struct svm_test *test) 1854 { 1855 return init_intercept; 1856 } 1857 1858 /* 1859 * Setting host EFLAGS.TF causes a #DB trap after the VMRUN completes on the 1860 * host side (i.e., after the #VMEXIT from the guest). 1861 * 1862 * Setting host EFLAGS.RF suppresses any potential instruction breakpoint 1863 * match on the VMRUN and completion of the VMRUN instruction clears the 1864 * host EFLAGS.RF bit. 1865 * 1866 * [AMD APM] 1867 */ 1868 static volatile u8 host_rflags_guest_main_flag = 0; 1869 static volatile u8 host_rflags_db_handler_flag = 0; 1870 static volatile bool host_rflags_ss_on_vmrun = false; 1871 static volatile bool host_rflags_vmrun_reached = false; 1872 static volatile bool host_rflags_set_tf = false; 1873 static volatile bool host_rflags_set_rf = false; 1874 static u64 rip_detected; 1875 1876 extern u64 *vmrun_rip; 1877 1878 static void host_rflags_db_handler(struct ex_regs *r) 1879 { 1880 if (host_rflags_ss_on_vmrun) { 1881 if (host_rflags_vmrun_reached) { 1882 if (!host_rflags_set_rf) { 1883 r->rflags &= ~X86_EFLAGS_TF; 1884 rip_detected = r->rip; 1885 } else { 1886 r->rflags |= X86_EFLAGS_RF; 1887 ++host_rflags_db_handler_flag; 1888 } 1889 } else { 1890 if (r->rip == (u64)&vmrun_rip) { 1891 host_rflags_vmrun_reached = true; 1892 1893 if (host_rflags_set_rf) { 1894 host_rflags_guest_main_flag = 0; 1895 rip_detected = r->rip; 1896 r->rflags &= ~X86_EFLAGS_TF; 1897 1898 /* Trigger #DB via debug registers */ 1899 write_dr0((void *)&vmrun_rip); 1900 write_dr7(0x403); 1901 } 1902 } 1903 } 1904 } else { 1905 r->rflags &= ~X86_EFLAGS_TF; 1906 } 1907 } 1908 1909 static void host_rflags_prepare(struct svm_test *test) 1910 { 1911 default_prepare(test); 1912 handle_exception(DB_VECTOR, host_rflags_db_handler); 1913 set_test_stage(test, 0); 1914 } 1915 1916 static void host_rflags_prepare_gif_clear(struct svm_test *test) 1917 { 1918 if (host_rflags_set_tf) 1919 write_rflags(read_rflags() | X86_EFLAGS_TF); 1920 } 1921 1922 static void host_rflags_test(struct svm_test *test) 1923 { 1924 while (1) { 1925 if (get_test_stage(test) > 0) { 1926 if ((host_rflags_set_tf && !host_rflags_ss_on_vmrun && !host_rflags_db_handler_flag) || 1927 (host_rflags_set_rf && host_rflags_db_handler_flag == 1)) 1928 host_rflags_guest_main_flag = 1; 1929 } 1930 1931 if (get_test_stage(test) == 4) 1932 break; 1933 vmmcall(); 1934 } 1935 } 1936 1937 static bool host_rflags_finished(struct svm_test *test) 1938 { 1939 switch (get_test_stage(test)) { 1940 case 0: 1941 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1942 report_fail("Unexpected VMEXIT. Exit reason 0x%x", 1943 vmcb->control.exit_code); 1944 return true; 1945 } 1946 vmcb->save.rip += 3; 1947 /* 1948 * Setting host EFLAGS.TF not immediately before VMRUN, causes 1949 * #DB trap before first guest instruction is executed 1950 */ 1951 host_rflags_set_tf = true; 1952 break; 1953 case 1: 1954 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL || 1955 host_rflags_guest_main_flag != 1) { 1956 report_fail("Unexpected VMEXIT or #DB handler" 1957 " invoked before guest main. Exit reason 0x%x", 1958 vmcb->control.exit_code); 1959 return true; 1960 } 1961 vmcb->save.rip += 3; 1962 /* 1963 * Setting host EFLAGS.TF immediately before VMRUN, causes #DB 1964 * trap after VMRUN completes on the host side (i.e., after 1965 * VMEXIT from guest). 1966 */ 1967 host_rflags_ss_on_vmrun = true; 1968 break; 1969 case 2: 1970 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL || 1971 rip_detected != (u64)&vmrun_rip + 3) { 1972 report_fail("Unexpected VMEXIT or RIP mismatch." 1973 " Exit reason 0x%x, RIP actual: %lx, RIP expected: " 1974 "%lx", vmcb->control.exit_code, 1975 (u64)&vmrun_rip + 3, rip_detected); 1976 return true; 1977 } 1978 host_rflags_set_rf = true; 1979 host_rflags_guest_main_flag = 0; 1980 host_rflags_vmrun_reached = false; 1981 vmcb->save.rip += 3; 1982 break; 1983 case 3: 1984 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL || 1985 rip_detected != (u64)&vmrun_rip || 1986 host_rflags_guest_main_flag != 1 || 1987 host_rflags_db_handler_flag > 1 || 1988 read_rflags() & X86_EFLAGS_RF) { 1989 report_fail("Unexpected VMEXIT or RIP mismatch or " 1990 "EFLAGS.RF not cleared." 1991 " Exit reason 0x%x, RIP actual: %lx, RIP expected: " 1992 "%lx", vmcb->control.exit_code, 1993 (u64)&vmrun_rip, rip_detected); 1994 return true; 1995 } 1996 host_rflags_set_tf = false; 1997 host_rflags_set_rf = false; 1998 vmcb->save.rip += 3; 1999 break; 2000 default: 2001 return true; 2002 } 2003 inc_test_stage(test); 2004 return get_test_stage(test) == 5; 2005 } 2006 2007 static bool host_rflags_check(struct svm_test *test) 2008 { 2009 return get_test_stage(test) == 4; 2010 } 2011 2012 #define TEST(name) { #name, .v2 = name } 2013 2014 /* 2015 * v2 tests 2016 */ 2017 2018 /* 2019 * Ensure that kvm recalculates the L1 guest's CPUID.01H:ECX.OSXSAVE 2020 * after VM-exit from an L2 guest that sets CR4.OSXSAVE to a different 2021 * value than in L1. 2022 */ 2023 2024 static void svm_cr4_osxsave_test_guest(struct svm_test *test) 2025 { 2026 write_cr4(read_cr4() & ~X86_CR4_OSXSAVE); 2027 } 2028 2029 static void svm_cr4_osxsave_test(void) 2030 { 2031 if (!this_cpu_has(X86_FEATURE_XSAVE)) { 2032 report_skip("XSAVE not detected"); 2033 return; 2034 } 2035 2036 if (!(read_cr4() & X86_CR4_OSXSAVE)) { 2037 unsigned long cr4 = read_cr4() | X86_CR4_OSXSAVE; 2038 2039 write_cr4(cr4); 2040 vmcb->save.cr4 = cr4; 2041 } 2042 2043 report(this_cpu_has(X86_FEATURE_OSXSAVE), "CPUID.01H:ECX.XSAVE set before VMRUN"); 2044 2045 test_set_guest(svm_cr4_osxsave_test_guest); 2046 report(svm_vmrun() == SVM_EXIT_VMMCALL, 2047 "svm_cr4_osxsave_test_guest finished with VMMCALL"); 2048 2049 report(this_cpu_has(X86_FEATURE_OSXSAVE), "CPUID.01H:ECX.XSAVE set after VMRUN"); 2050 } 2051 2052 static void basic_guest_main(struct svm_test *test) 2053 { 2054 } 2055 2056 2057 #define SVM_TEST_REG_RESERVED_BITS(start, end, inc, str_name, reg, val, \ 2058 resv_mask) \ 2059 { \ 2060 u64 tmp, mask; \ 2061 int i; \ 2062 \ 2063 for (i = start; i <= end; i = i + inc) { \ 2064 mask = 1ull << i; \ 2065 if (!(mask & resv_mask)) \ 2066 continue; \ 2067 tmp = val | mask; \ 2068 reg = tmp; \ 2069 report(svm_vmrun() == SVM_EXIT_ERR, "Test %s %d:%d: %lx", \ 2070 str_name, end, start, tmp); \ 2071 } \ 2072 } 2073 2074 #define SVM_TEST_CR_RESERVED_BITS(start, end, inc, cr, val, resv_mask, \ 2075 exit_code, test_name) \ 2076 { \ 2077 u64 tmp, mask; \ 2078 u32 r; \ 2079 int i; \ 2080 \ 2081 for (i = start; i <= end; i = i + inc) { \ 2082 mask = 1ull << i; \ 2083 if (!(mask & resv_mask)) \ 2084 continue; \ 2085 tmp = val | mask; \ 2086 switch (cr) { \ 2087 case 0: \ 2088 vmcb->save.cr0 = tmp; \ 2089 break; \ 2090 case 3: \ 2091 vmcb->save.cr3 = tmp; \ 2092 break; \ 2093 case 4: \ 2094 vmcb->save.cr4 = tmp; \ 2095 } \ 2096 r = svm_vmrun(); \ 2097 report(r == exit_code, "Test CR%d %s%d:%d: %lx, wanted exit 0x%x, got 0x%x", \ 2098 cr, test_name, end, start, tmp, exit_code, r); \ 2099 } \ 2100 } 2101 2102 static void test_efer(void) 2103 { 2104 /* 2105 * Un-setting EFER.SVME is illegal 2106 */ 2107 u64 efer_saved = vmcb->save.efer; 2108 u64 efer = efer_saved; 2109 2110 report (svm_vmrun() == SVM_EXIT_VMMCALL, "EFER.SVME: %lx", efer); 2111 efer &= ~EFER_SVME; 2112 vmcb->save.efer = efer; 2113 report (svm_vmrun() == SVM_EXIT_ERR, "EFER.SVME: %lx", efer); 2114 vmcb->save.efer = efer_saved; 2115 2116 /* 2117 * EFER MBZ bits: 63:16, 9 2118 */ 2119 efer_saved = vmcb->save.efer; 2120 2121 SVM_TEST_REG_RESERVED_BITS(8, 9, 1, "EFER", vmcb->save.efer, 2122 efer_saved, SVM_EFER_RESERVED_MASK); 2123 SVM_TEST_REG_RESERVED_BITS(16, 63, 4, "EFER", vmcb->save.efer, 2124 efer_saved, SVM_EFER_RESERVED_MASK); 2125 2126 /* 2127 * EFER.LME and CR0.PG are both set and CR4.PAE is zero. 2128 */ 2129 u64 cr0_saved = vmcb->save.cr0; 2130 u64 cr0; 2131 u64 cr4_saved = vmcb->save.cr4; 2132 u64 cr4; 2133 2134 efer = efer_saved | EFER_LME; 2135 vmcb->save.efer = efer; 2136 cr0 = cr0_saved | X86_CR0_PG | X86_CR0_PE; 2137 vmcb->save.cr0 = cr0; 2138 cr4 = cr4_saved & ~X86_CR4_PAE; 2139 vmcb->save.cr4 = cr4; 2140 report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), " 2141 "CR0.PG=1 (%lx) and CR4.PAE=0 (%lx)", efer, cr0, cr4); 2142 2143 /* 2144 * EFER.LME and CR0.PG are both set and CR0.PE is zero. 2145 * CR4.PAE needs to be set as we otherwise cannot 2146 * determine if CR4.PAE=0 or CR0.PE=0 triggered the 2147 * SVM_EXIT_ERR. 2148 */ 2149 cr4 = cr4_saved | X86_CR4_PAE; 2150 vmcb->save.cr4 = cr4; 2151 cr0 &= ~X86_CR0_PE; 2152 vmcb->save.cr0 = cr0; 2153 report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), " 2154 "CR0.PG=1 and CR0.PE=0 (%lx)", efer, cr0); 2155 2156 /* 2157 * EFER.LME, CR0.PG, CR4.PAE, CS.L, and CS.D are all non-zero. 2158 */ 2159 u32 cs_attrib_saved = vmcb->save.cs.attrib; 2160 u32 cs_attrib; 2161 2162 cr0 |= X86_CR0_PE; 2163 vmcb->save.cr0 = cr0; 2164 cs_attrib = cs_attrib_saved | SVM_SELECTOR_L_MASK | 2165 SVM_SELECTOR_DB_MASK; 2166 vmcb->save.cs.attrib = cs_attrib; 2167 report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), " 2168 "CR0.PG=1 (%lx), CR4.PAE=1 (%lx), CS.L=1 and CS.D=1 (%x)", 2169 efer, cr0, cr4, cs_attrib); 2170 2171 vmcb->save.cr0 = cr0_saved; 2172 vmcb->save.cr4 = cr4_saved; 2173 vmcb->save.efer = efer_saved; 2174 vmcb->save.cs.attrib = cs_attrib_saved; 2175 } 2176 2177 static void test_cr0(void) 2178 { 2179 /* 2180 * Un-setting CR0.CD and setting CR0.NW is illegal combination 2181 */ 2182 u64 cr0_saved = vmcb->save.cr0; 2183 u64 cr0 = cr0_saved; 2184 2185 cr0 |= X86_CR0_CD; 2186 cr0 &= ~X86_CR0_NW; 2187 vmcb->save.cr0 = cr0; 2188 report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=0: %lx", 2189 cr0); 2190 cr0 |= X86_CR0_NW; 2191 vmcb->save.cr0 = cr0; 2192 report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=1: %lx", 2193 cr0); 2194 cr0 &= ~X86_CR0_NW; 2195 cr0 &= ~X86_CR0_CD; 2196 vmcb->save.cr0 = cr0; 2197 report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=0,NW=0: %lx", 2198 cr0); 2199 cr0 |= X86_CR0_NW; 2200 vmcb->save.cr0 = cr0; 2201 report (svm_vmrun() == SVM_EXIT_ERR, "Test CR0 CD=0,NW=1: %lx", 2202 cr0); 2203 vmcb->save.cr0 = cr0_saved; 2204 2205 /* 2206 * CR0[63:32] are not zero 2207 */ 2208 cr0 = cr0_saved; 2209 2210 SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "CR0", vmcb->save.cr0, cr0_saved, 2211 SVM_CR0_RESERVED_MASK); 2212 vmcb->save.cr0 = cr0_saved; 2213 } 2214 2215 static void test_cr3(void) 2216 { 2217 /* 2218 * CR3 MBZ bits based on different modes: 2219 * [63:52] - long mode 2220 */ 2221 u64 cr3_saved = vmcb->save.cr3; 2222 2223 SVM_TEST_CR_RESERVED_BITS(0, 63, 1, 3, cr3_saved, 2224 SVM_CR3_LONG_MBZ_MASK, SVM_EXIT_ERR, ""); 2225 2226 vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_MBZ_MASK; 2227 report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx", 2228 vmcb->save.cr3); 2229 2230 /* 2231 * CR3 non-MBZ reserved bits based on different modes: 2232 * [11:5] [2:0] - long mode (PCIDE=0) 2233 * [2:0] - PAE legacy mode 2234 */ 2235 u64 cr4_saved = vmcb->save.cr4; 2236 u64 *pdpe = npt_get_pml4e(); 2237 2238 /* 2239 * Long mode 2240 */ 2241 if (this_cpu_has(X86_FEATURE_PCID)) { 2242 vmcb->save.cr4 = cr4_saved | X86_CR4_PCIDE; 2243 SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved, 2244 SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_VMMCALL, "(PCIDE=1) "); 2245 2246 vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_RESERVED_MASK; 2247 report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx", 2248 vmcb->save.cr3); 2249 } 2250 2251 vmcb->save.cr4 = cr4_saved & ~X86_CR4_PCIDE; 2252 2253 if (!npt_supported()) 2254 goto skip_npt_only; 2255 2256 /* Clear P (Present) bit in NPT in order to trigger #NPF */ 2257 pdpe[0] &= ~1ULL; 2258 2259 SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved, 2260 SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_NPF, "(PCIDE=0) "); 2261 2262 pdpe[0] |= 1ULL; 2263 vmcb->save.cr3 = cr3_saved; 2264 2265 /* 2266 * PAE legacy 2267 */ 2268 pdpe[0] &= ~1ULL; 2269 vmcb->save.cr4 = cr4_saved | X86_CR4_PAE; 2270 SVM_TEST_CR_RESERVED_BITS(0, 2, 1, 3, cr3_saved, 2271 SVM_CR3_PAE_LEGACY_RESERVED_MASK, SVM_EXIT_NPF, "(PAE) "); 2272 2273 pdpe[0] |= 1ULL; 2274 2275 skip_npt_only: 2276 vmcb->save.cr3 = cr3_saved; 2277 vmcb->save.cr4 = cr4_saved; 2278 } 2279 2280 /* Test CR4 MBZ bits based on legacy or long modes */ 2281 static void test_cr4(void) 2282 { 2283 u64 cr4_saved = vmcb->save.cr4; 2284 u64 efer_saved = vmcb->save.efer; 2285 u64 efer = efer_saved; 2286 2287 efer &= ~EFER_LME; 2288 vmcb->save.efer = efer; 2289 SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved, 2290 SVM_CR4_LEGACY_RESERVED_MASK, SVM_EXIT_ERR, ""); 2291 2292 efer |= EFER_LME; 2293 vmcb->save.efer = efer; 2294 SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved, 2295 SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR, ""); 2296 SVM_TEST_CR_RESERVED_BITS(32, 63, 4, 4, cr4_saved, 2297 SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR, ""); 2298 2299 vmcb->save.cr4 = cr4_saved; 2300 vmcb->save.efer = efer_saved; 2301 } 2302 2303 static void test_dr(void) 2304 { 2305 /* 2306 * DR6[63:32] and DR7[63:32] are MBZ 2307 */ 2308 u64 dr_saved = vmcb->save.dr6; 2309 2310 SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR6", vmcb->save.dr6, dr_saved, 2311 SVM_DR6_RESERVED_MASK); 2312 vmcb->save.dr6 = dr_saved; 2313 2314 dr_saved = vmcb->save.dr7; 2315 SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR7", vmcb->save.dr7, dr_saved, 2316 SVM_DR7_RESERVED_MASK); 2317 2318 vmcb->save.dr7 = dr_saved; 2319 } 2320 2321 /* TODO: verify if high 32-bits are sign- or zero-extended on bare metal */ 2322 #define TEST_BITMAP_ADDR(save_intercept, type, addr, exit_code, \ 2323 msg) { \ 2324 vmcb->control.intercept = saved_intercept | 1ULL << type; \ 2325 if (type == INTERCEPT_MSR_PROT) \ 2326 vmcb->control.msrpm_base_pa = addr; \ 2327 else \ 2328 vmcb->control.iopm_base_pa = addr; \ 2329 report(svm_vmrun() == exit_code, \ 2330 "Test %s address: %lx", msg, addr); \ 2331 } 2332 2333 /* 2334 * If the MSR or IOIO intercept table extends to a physical address that 2335 * is greater than or equal to the maximum supported physical address, the 2336 * guest state is illegal. 2337 * 2338 * The VMRUN instruction ignores the lower 12 bits of the address specified 2339 * in the VMCB. 2340 * 2341 * MSRPM spans 2 contiguous 4KB pages while IOPM spans 2 contiguous 4KB 2342 * pages + 1 byte. 2343 * 2344 * [APM vol 2] 2345 * 2346 * Note: Unallocated MSRPM addresses conforming to consistency checks, generate 2347 * #NPF. 2348 */ 2349 static void test_msrpm_iopm_bitmap_addrs(void) 2350 { 2351 u64 saved_intercept = vmcb->control.intercept; 2352 u64 addr_beyond_limit = 1ull << cpuid_maxphyaddr(); 2353 u64 addr = virt_to_phys(msr_bitmap) & (~((1ull << 12) - 1)); 2354 2355 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, 2356 addr_beyond_limit - 2 * PAGE_SIZE, SVM_EXIT_ERR, 2357 "MSRPM"); 2358 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, 2359 addr_beyond_limit - 2 * PAGE_SIZE + 1, SVM_EXIT_ERR, 2360 "MSRPM"); 2361 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, 2362 addr_beyond_limit - PAGE_SIZE, SVM_EXIT_ERR, 2363 "MSRPM"); 2364 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, addr, 2365 SVM_EXIT_VMMCALL, "MSRPM"); 2366 addr |= (1ull << 12) - 1; 2367 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, addr, 2368 SVM_EXIT_VMMCALL, "MSRPM"); 2369 2370 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2371 addr_beyond_limit - 4 * PAGE_SIZE, SVM_EXIT_VMMCALL, 2372 "IOPM"); 2373 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2374 addr_beyond_limit - 3 * PAGE_SIZE, SVM_EXIT_VMMCALL, 2375 "IOPM"); 2376 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2377 addr_beyond_limit - 2 * PAGE_SIZE - 2, SVM_EXIT_VMMCALL, 2378 "IOPM"); 2379 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2380 addr_beyond_limit - 2 * PAGE_SIZE, SVM_EXIT_ERR, 2381 "IOPM"); 2382 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2383 addr_beyond_limit - PAGE_SIZE, SVM_EXIT_ERR, 2384 "IOPM"); 2385 addr = virt_to_phys(io_bitmap) & (~((1ull << 11) - 1)); 2386 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, addr, 2387 SVM_EXIT_VMMCALL, "IOPM"); 2388 addr |= (1ull << 12) - 1; 2389 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, addr, 2390 SVM_EXIT_VMMCALL, "IOPM"); 2391 2392 vmcb->control.intercept = saved_intercept; 2393 } 2394 2395 /* 2396 * Unlike VMSAVE, VMRUN seems not to update the value of noncanonical 2397 * segment bases in the VMCB. However, VMENTRY succeeds as documented. 2398 */ 2399 #define TEST_CANONICAL_VMRUN(seg_base, msg) \ 2400 saved_addr = seg_base; \ 2401 seg_base = (seg_base & ((1ul << addr_limit) - 1)) | noncanonical_mask; \ 2402 return_value = svm_vmrun(); \ 2403 report(return_value == SVM_EXIT_VMMCALL, \ 2404 "Successful VMRUN with noncanonical %s.base", msg); \ 2405 seg_base = saved_addr; 2406 2407 2408 #define TEST_CANONICAL_VMLOAD(seg_base, msg) \ 2409 saved_addr = seg_base; \ 2410 seg_base = (seg_base & ((1ul << addr_limit) - 1)) | noncanonical_mask; \ 2411 asm volatile ("vmload %0" : : "a"(vmcb_phys) : "memory"); \ 2412 asm volatile ("vmsave %0" : : "a"(vmcb_phys) : "memory"); \ 2413 report(is_canonical(seg_base), \ 2414 "Test %s.base for canonical form: %lx", msg, seg_base); \ 2415 seg_base = saved_addr; 2416 2417 static void test_canonicalization(void) 2418 { 2419 u64 saved_addr; 2420 u64 return_value; 2421 u64 addr_limit; 2422 u64 vmcb_phys = virt_to_phys(vmcb); 2423 2424 addr_limit = (this_cpu_has(X86_FEATURE_LA57)) ? 57 : 48; 2425 u64 noncanonical_mask = NONCANONICAL & ~((1ul << addr_limit) - 1); 2426 2427 TEST_CANONICAL_VMLOAD(vmcb->save.fs.base, "FS"); 2428 TEST_CANONICAL_VMLOAD(vmcb->save.gs.base, "GS"); 2429 TEST_CANONICAL_VMLOAD(vmcb->save.ldtr.base, "LDTR"); 2430 TEST_CANONICAL_VMLOAD(vmcb->save.tr.base, "TR"); 2431 TEST_CANONICAL_VMLOAD(vmcb->save.kernel_gs_base, "KERNEL GS"); 2432 TEST_CANONICAL_VMRUN(vmcb->save.es.base, "ES"); 2433 TEST_CANONICAL_VMRUN(vmcb->save.cs.base, "CS"); 2434 TEST_CANONICAL_VMRUN(vmcb->save.ss.base, "SS"); 2435 TEST_CANONICAL_VMRUN(vmcb->save.ds.base, "DS"); 2436 TEST_CANONICAL_VMRUN(vmcb->save.gdtr.base, "GDTR"); 2437 TEST_CANONICAL_VMRUN(vmcb->save.idtr.base, "IDTR"); 2438 } 2439 2440 /* 2441 * When VMRUN loads a guest value of 1 in EFLAGS.TF, that value does not 2442 * cause a trace trap between the VMRUN and the first guest instruction, but 2443 * rather after completion of the first guest instruction. 2444 * 2445 * [APM vol 2] 2446 */ 2447 u64 guest_rflags_test_trap_rip; 2448 2449 static void guest_rflags_test_db_handler(struct ex_regs *r) 2450 { 2451 guest_rflags_test_trap_rip = r->rip; 2452 r->rflags &= ~X86_EFLAGS_TF; 2453 } 2454 2455 static void svm_guest_state_test(void) 2456 { 2457 test_set_guest(basic_guest_main); 2458 test_efer(); 2459 test_cr0(); 2460 test_cr3(); 2461 test_cr4(); 2462 test_dr(); 2463 test_msrpm_iopm_bitmap_addrs(); 2464 test_canonicalization(); 2465 } 2466 2467 extern void guest_rflags_test_guest(struct svm_test *test); 2468 extern u64 *insn2; 2469 extern u64 *guest_end; 2470 2471 asm("guest_rflags_test_guest:\n\t" 2472 "push %rbp\n\t" 2473 ".global insn2\n\t" 2474 "insn2:\n\t" 2475 "mov %rsp,%rbp\n\t" 2476 "vmmcall\n\t" 2477 "vmmcall\n\t" 2478 ".global guest_end\n\t" 2479 "guest_end:\n\t" 2480 "vmmcall\n\t" 2481 "pop %rbp\n\t" 2482 "ret"); 2483 2484 static void svm_test_singlestep(void) 2485 { 2486 handle_exception(DB_VECTOR, guest_rflags_test_db_handler); 2487 2488 /* 2489 * Trap expected after completion of first guest instruction 2490 */ 2491 vmcb->save.rflags |= X86_EFLAGS_TF; 2492 report (__svm_vmrun((u64)guest_rflags_test_guest) == SVM_EXIT_VMMCALL && 2493 guest_rflags_test_trap_rip == (u64)&insn2, 2494 "Test EFLAGS.TF on VMRUN: trap expected after completion of first guest instruction"); 2495 /* 2496 * No trap expected 2497 */ 2498 guest_rflags_test_trap_rip = 0; 2499 vmcb->save.rip += 3; 2500 vmcb->save.rflags |= X86_EFLAGS_TF; 2501 report (__svm_vmrun(vmcb->save.rip) == SVM_EXIT_VMMCALL && 2502 guest_rflags_test_trap_rip == 0, "Test EFLAGS.TF on VMRUN: trap not expected"); 2503 2504 /* 2505 * Let guest finish execution 2506 */ 2507 vmcb->save.rip += 3; 2508 report (__svm_vmrun(vmcb->save.rip) == SVM_EXIT_VMMCALL && 2509 vmcb->save.rip == (u64)&guest_end, "Test EFLAGS.TF on VMRUN: guest execution completion"); 2510 } 2511 2512 static bool volatile svm_errata_reproduced = false; 2513 static unsigned long volatile physical = 0; 2514 2515 2516 /* 2517 * 2518 * Test the following errata: 2519 * If the VMRUN/VMSAVE/VMLOAD are attempted by the nested guest, 2520 * the CPU would first check the EAX against host reserved memory 2521 * regions (so far only SMM_ADDR/SMM_MASK are known to cause it), 2522 * and only then signal #VMexit 2523 * 2524 * Try to reproduce this by trying vmsave on each possible 4K aligned memory 2525 * address in the low 4G where the SMM area has to reside. 2526 */ 2527 2528 static void gp_isr(struct ex_regs *r) 2529 { 2530 svm_errata_reproduced = true; 2531 /* skip over the vmsave instruction*/ 2532 r->rip += 3; 2533 } 2534 2535 static void svm_vmrun_errata_test(void) 2536 { 2537 unsigned long *last_page = NULL; 2538 2539 handle_exception(GP_VECTOR, gp_isr); 2540 2541 while (!svm_errata_reproduced) { 2542 2543 unsigned long *page = alloc_pages(1); 2544 2545 if (!page) { 2546 report_pass("All guest memory tested, no bug found"); 2547 break; 2548 } 2549 2550 physical = virt_to_phys(page); 2551 2552 asm volatile ( 2553 "mov %[_physical], %%rax\n\t" 2554 "vmsave %%rax\n\t" 2555 2556 : [_physical] "=m" (physical) 2557 : /* no inputs*/ 2558 : "rax" /*clobbers*/ 2559 ); 2560 2561 if (svm_errata_reproduced) { 2562 report_fail("Got #GP exception - svm errata reproduced at 0x%lx", 2563 physical); 2564 break; 2565 } 2566 2567 *page = (unsigned long)last_page; 2568 last_page = page; 2569 } 2570 2571 while (last_page) { 2572 unsigned long *page = last_page; 2573 last_page = (unsigned long *)*last_page; 2574 free_pages_by_order(page, 1); 2575 } 2576 } 2577 2578 static void vmload_vmsave_guest_main(struct svm_test *test) 2579 { 2580 u64 vmcb_phys = virt_to_phys(vmcb); 2581 2582 asm volatile ("vmload %0" : : "a"(vmcb_phys)); 2583 asm volatile ("vmsave %0" : : "a"(vmcb_phys)); 2584 } 2585 2586 static void svm_vmload_vmsave(void) 2587 { 2588 u32 intercept_saved = vmcb->control.intercept; 2589 2590 test_set_guest(vmload_vmsave_guest_main); 2591 2592 /* 2593 * Disabling intercept for VMLOAD and VMSAVE doesn't cause 2594 * respective #VMEXIT to host 2595 */ 2596 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD); 2597 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE); 2598 svm_vmrun(); 2599 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 2600 "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 2601 2602 /* 2603 * Enabling intercept for VMLOAD and VMSAVE causes respective 2604 * #VMEXIT to host 2605 */ 2606 vmcb->control.intercept |= (1ULL << INTERCEPT_VMLOAD); 2607 svm_vmrun(); 2608 report(vmcb->control.exit_code == SVM_EXIT_VMLOAD, "Test " 2609 "VMLOAD/VMSAVE intercept: Expected VMLOAD #VMEXIT"); 2610 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD); 2611 vmcb->control.intercept |= (1ULL << INTERCEPT_VMSAVE); 2612 svm_vmrun(); 2613 report(vmcb->control.exit_code == SVM_EXIT_VMSAVE, "Test " 2614 "VMLOAD/VMSAVE intercept: Expected VMSAVE #VMEXIT"); 2615 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE); 2616 svm_vmrun(); 2617 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 2618 "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 2619 2620 vmcb->control.intercept |= (1ULL << INTERCEPT_VMLOAD); 2621 svm_vmrun(); 2622 report(vmcb->control.exit_code == SVM_EXIT_VMLOAD, "Test " 2623 "VMLOAD/VMSAVE intercept: Expected VMLOAD #VMEXIT"); 2624 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD); 2625 svm_vmrun(); 2626 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 2627 "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 2628 2629 vmcb->control.intercept |= (1ULL << INTERCEPT_VMSAVE); 2630 svm_vmrun(); 2631 report(vmcb->control.exit_code == SVM_EXIT_VMSAVE, "Test " 2632 "VMLOAD/VMSAVE intercept: Expected VMSAVE #VMEXIT"); 2633 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE); 2634 svm_vmrun(); 2635 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 2636 "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 2637 2638 vmcb->control.intercept = intercept_saved; 2639 } 2640 2641 static void prepare_vgif_enabled(struct svm_test *test) 2642 { 2643 default_prepare(test); 2644 } 2645 2646 static void test_vgif(struct svm_test *test) 2647 { 2648 asm volatile ("vmmcall\n\tstgi\n\tvmmcall\n\tclgi\n\tvmmcall\n\t"); 2649 } 2650 2651 static bool vgif_finished(struct svm_test *test) 2652 { 2653 switch (get_test_stage(test)) 2654 { 2655 case 0: 2656 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2657 report_fail("VMEXIT not due to vmmcall."); 2658 return true; 2659 } 2660 vmcb->control.int_ctl |= V_GIF_ENABLED_MASK; 2661 vmcb->save.rip += 3; 2662 inc_test_stage(test); 2663 break; 2664 case 1: 2665 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2666 report_fail("VMEXIT not due to vmmcall."); 2667 return true; 2668 } 2669 if (!(vmcb->control.int_ctl & V_GIF_MASK)) { 2670 report_fail("Failed to set VGIF when executing STGI."); 2671 vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK; 2672 return true; 2673 } 2674 report_pass("STGI set VGIF bit."); 2675 vmcb->save.rip += 3; 2676 inc_test_stage(test); 2677 break; 2678 case 2: 2679 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2680 report_fail("VMEXIT not due to vmmcall."); 2681 return true; 2682 } 2683 if (vmcb->control.int_ctl & V_GIF_MASK) { 2684 report_fail("Failed to clear VGIF when executing CLGI."); 2685 vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK; 2686 return true; 2687 } 2688 report_pass("CLGI cleared VGIF bit."); 2689 vmcb->save.rip += 3; 2690 inc_test_stage(test); 2691 vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK; 2692 break; 2693 default: 2694 return true; 2695 break; 2696 } 2697 2698 return get_test_stage(test) == 3; 2699 } 2700 2701 static bool vgif_check(struct svm_test *test) 2702 { 2703 return get_test_stage(test) == 3; 2704 } 2705 2706 2707 static int pause_test_counter; 2708 static int wait_counter; 2709 2710 static void pause_filter_test_guest_main(struct svm_test *test) 2711 { 2712 int i; 2713 for (i = 0 ; i < pause_test_counter ; i++) 2714 pause(); 2715 2716 if (!wait_counter) 2717 return; 2718 2719 for (i = 0; i < wait_counter; i++) 2720 ; 2721 2722 for (i = 0 ; i < pause_test_counter ; i++) 2723 pause(); 2724 2725 } 2726 2727 static void pause_filter_run_test(int pause_iterations, int filter_value, int wait_iterations, int threshold) 2728 { 2729 test_set_guest(pause_filter_test_guest_main); 2730 2731 pause_test_counter = pause_iterations; 2732 wait_counter = wait_iterations; 2733 2734 vmcb->control.pause_filter_count = filter_value; 2735 vmcb->control.pause_filter_thresh = threshold; 2736 svm_vmrun(); 2737 2738 if (filter_value <= pause_iterations || wait_iterations < threshold) 2739 report(vmcb->control.exit_code == SVM_EXIT_PAUSE, "expected PAUSE vmexit"); 2740 else 2741 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "no expected PAUSE vmexit"); 2742 } 2743 2744 static void pause_filter_test(void) 2745 { 2746 if (!pause_filter_supported()) { 2747 report_skip("PAUSE filter not supported in the guest"); 2748 return; 2749 } 2750 2751 vmcb->control.intercept |= (1 << INTERCEPT_PAUSE); 2752 2753 // filter count more that pause count - no VMexit 2754 pause_filter_run_test(10, 9, 0, 0); 2755 2756 // filter count smaller pause count - no VMexit 2757 pause_filter_run_test(20, 21, 0, 0); 2758 2759 2760 if (pause_threshold_supported()) { 2761 // filter count smaller pause count - no VMexit + large enough threshold 2762 // so that filter counter resets 2763 pause_filter_run_test(20, 21, 1000, 10); 2764 2765 // filter count smaller pause count - no VMexit + small threshold 2766 // so that filter doesn't reset 2767 pause_filter_run_test(20, 21, 10, 1000); 2768 } else { 2769 report_skip("PAUSE threshold not supported in the guest"); 2770 return; 2771 } 2772 } 2773 2774 /* If CR0.TS and CR0.EM are cleared in L2, no #NM is generated. */ 2775 static void svm_no_nm_test(void) 2776 { 2777 write_cr0(read_cr0() & ~X86_CR0_TS); 2778 test_set_guest((test_guest_func)fnop); 2779 2780 vmcb->save.cr0 = vmcb->save.cr0 & ~(X86_CR0_TS | X86_CR0_EM); 2781 report(svm_vmrun() == SVM_EXIT_VMMCALL, 2782 "fnop with CR0.TS and CR0.EM unset no #NM excpetion"); 2783 } 2784 2785 static u64 amd_get_lbr_rip(u32 msr) 2786 { 2787 return rdmsr(msr) & ~AMD_LBR_RECORD_MISPREDICT; 2788 } 2789 2790 #define HOST_CHECK_LBR(from_expected, to_expected) \ 2791 do { \ 2792 TEST_EXPECT_EQ((u64)from_expected, amd_get_lbr_rip(MSR_IA32_LASTBRANCHFROMIP)); \ 2793 TEST_EXPECT_EQ((u64)to_expected, amd_get_lbr_rip(MSR_IA32_LASTBRANCHTOIP)); \ 2794 } while (0) 2795 2796 /* 2797 * FIXME: Do something other than generate an exception to communicate failure. 2798 * Debugging without expected vs. actual is an absolute nightmare. 2799 */ 2800 #define GUEST_CHECK_LBR(from_expected, to_expected) \ 2801 do { \ 2802 if ((u64)(from_expected) != amd_get_lbr_rip(MSR_IA32_LASTBRANCHFROMIP)) \ 2803 asm volatile("ud2"); \ 2804 if ((u64)(to_expected) != amd_get_lbr_rip(MSR_IA32_LASTBRANCHTOIP)) \ 2805 asm volatile("ud2"); \ 2806 } while (0) 2807 2808 #define REPORT_GUEST_LBR_ERROR(vmcb) \ 2809 report(false, "LBR guest test failed. Exit reason 0x%x, RIP = %lx, from = %lx, to = %lx, ex from = %lx, ex to = %lx", \ 2810 vmcb->control.exit_code, vmcb->save.rip, \ 2811 vmcb->save.br_from, vmcb->save.br_to, \ 2812 vmcb->save.last_excp_from, vmcb->save.last_excp_to) 2813 2814 #define DO_BRANCH(branch_name) \ 2815 asm volatile ( \ 2816 # branch_name "_from:" \ 2817 "jmp " # branch_name "_to\n" \ 2818 "nop\n" \ 2819 "nop\n" \ 2820 # branch_name "_to:" \ 2821 "nop\n" \ 2822 ) 2823 2824 2825 extern u64 guest_branch0_from, guest_branch0_to; 2826 extern u64 guest_branch2_from, guest_branch2_to; 2827 2828 extern u64 host_branch0_from, host_branch0_to; 2829 extern u64 host_branch2_from, host_branch2_to; 2830 extern u64 host_branch3_from, host_branch3_to; 2831 extern u64 host_branch4_from, host_branch4_to; 2832 2833 u64 dbgctl; 2834 2835 static void svm_lbrv_test_guest1(void) 2836 { 2837 /* 2838 * This guest expects the LBR to be already enabled when it starts, 2839 * it does a branch, and then disables the LBR and then checks. 2840 */ 2841 2842 DO_BRANCH(guest_branch0); 2843 2844 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2845 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2846 2847 if (dbgctl != DEBUGCTLMSR_LBR) 2848 asm volatile("ud2\n"); 2849 if (rdmsr(MSR_IA32_DEBUGCTLMSR) != 0) 2850 asm volatile("ud2\n"); 2851 2852 GUEST_CHECK_LBR(&guest_branch0_from, &guest_branch0_to); 2853 asm volatile ("vmmcall\n"); 2854 } 2855 2856 static void svm_lbrv_test_guest2(void) 2857 { 2858 /* 2859 * This guest expects the LBR to be disabled when it starts, 2860 * enables it, does a branch, disables it and then checks. 2861 */ 2862 2863 DO_BRANCH(guest_branch1); 2864 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2865 2866 if (dbgctl != 0) 2867 asm volatile("ud2\n"); 2868 2869 GUEST_CHECK_LBR(&host_branch2_from, &host_branch2_to); 2870 2871 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2872 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2873 DO_BRANCH(guest_branch2); 2874 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2875 2876 if (dbgctl != DEBUGCTLMSR_LBR) 2877 asm volatile("ud2\n"); 2878 GUEST_CHECK_LBR(&guest_branch2_from, &guest_branch2_to); 2879 2880 asm volatile ("vmmcall\n"); 2881 } 2882 2883 static void svm_lbrv_test0(void) 2884 { 2885 report(true, "Basic LBR test"); 2886 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2887 DO_BRANCH(host_branch0); 2888 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2889 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2890 2891 TEST_EXPECT_EQ(dbgctl, DEBUGCTLMSR_LBR); 2892 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2893 TEST_EXPECT_EQ(dbgctl, 0); 2894 2895 HOST_CHECK_LBR(&host_branch0_from, &host_branch0_to); 2896 } 2897 2898 static void svm_lbrv_test1(void) 2899 { 2900 report(true, "Test that without LBRV enabled, guest LBR state does 'leak' to the host(1)"); 2901 2902 svm_setup_vmrun((u64)svm_lbrv_test_guest1); 2903 vmcb->control.virt_ext = 0; 2904 2905 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2906 DO_BRANCH(host_branch1); 2907 SVM_BARE_VMRUN; 2908 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2909 2910 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2911 REPORT_GUEST_LBR_ERROR(vmcb); 2912 return; 2913 } 2914 2915 TEST_EXPECT_EQ(dbgctl, 0); 2916 HOST_CHECK_LBR(&guest_branch0_from, &guest_branch0_to); 2917 } 2918 2919 static void svm_lbrv_test2(void) 2920 { 2921 report(true, "Test that without LBRV enabled, guest LBR state does 'leak' to the host(2)"); 2922 2923 svm_setup_vmrun((u64)svm_lbrv_test_guest2); 2924 vmcb->control.virt_ext = 0; 2925 2926 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2927 DO_BRANCH(host_branch2); 2928 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2929 SVM_BARE_VMRUN; 2930 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2931 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2932 2933 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2934 REPORT_GUEST_LBR_ERROR(vmcb); 2935 return; 2936 } 2937 2938 TEST_EXPECT_EQ(dbgctl, 0); 2939 HOST_CHECK_LBR(&guest_branch2_from, &guest_branch2_to); 2940 } 2941 2942 static void svm_lbrv_nested_test1(void) 2943 { 2944 if (!lbrv_supported()) { 2945 report_skip("LBRV not supported in the guest"); 2946 return; 2947 } 2948 2949 report(true, "Test that with LBRV enabled, guest LBR state doesn't leak (1)"); 2950 svm_setup_vmrun((u64)svm_lbrv_test_guest1); 2951 vmcb->control.virt_ext = LBR_CTL_ENABLE_MASK; 2952 vmcb->save.dbgctl = DEBUGCTLMSR_LBR; 2953 2954 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2955 DO_BRANCH(host_branch3); 2956 SVM_BARE_VMRUN; 2957 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2958 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2959 2960 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2961 REPORT_GUEST_LBR_ERROR(vmcb); 2962 return; 2963 } 2964 2965 if (vmcb->save.dbgctl != 0) { 2966 report(false, "unexpected virtual guest MSR_IA32_DEBUGCTLMSR value 0x%lx", vmcb->save.dbgctl); 2967 return; 2968 } 2969 2970 TEST_EXPECT_EQ(dbgctl, DEBUGCTLMSR_LBR); 2971 HOST_CHECK_LBR(&host_branch3_from, &host_branch3_to); 2972 } 2973 2974 static void svm_lbrv_nested_test2(void) 2975 { 2976 if (!lbrv_supported()) { 2977 report_skip("LBRV not supported in the guest"); 2978 return; 2979 } 2980 2981 report(true, "Test that with LBRV enabled, guest LBR state doesn't leak (2)"); 2982 svm_setup_vmrun((u64)svm_lbrv_test_guest2); 2983 vmcb->control.virt_ext = LBR_CTL_ENABLE_MASK; 2984 2985 vmcb->save.dbgctl = 0; 2986 vmcb->save.br_from = (u64)&host_branch2_from; 2987 vmcb->save.br_to = (u64)&host_branch2_to; 2988 2989 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2990 DO_BRANCH(host_branch4); 2991 SVM_BARE_VMRUN; 2992 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2993 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2994 2995 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2996 REPORT_GUEST_LBR_ERROR(vmcb); 2997 return; 2998 } 2999 3000 TEST_EXPECT_EQ(dbgctl, DEBUGCTLMSR_LBR); 3001 HOST_CHECK_LBR(&host_branch4_from, &host_branch4_to); 3002 } 3003 3004 3005 // test that a nested guest which does enable INTR interception 3006 // but doesn't enable virtual interrupt masking works 3007 3008 static volatile int dummy_isr_recevied; 3009 static void dummy_isr(isr_regs_t *regs) 3010 { 3011 dummy_isr_recevied++; 3012 eoi(); 3013 } 3014 3015 3016 static volatile int nmi_recevied; 3017 static void dummy_nmi_handler(struct ex_regs *regs) 3018 { 3019 nmi_recevied++; 3020 } 3021 3022 3023 static void svm_intr_intercept_mix_run_guest(volatile int *counter, int expected_vmexit) 3024 { 3025 if (counter) 3026 *counter = 0; 3027 3028 sti(); // host IF value should not matter 3029 clgi(); // vmrun will set back GI to 1 3030 3031 svm_vmrun(); 3032 3033 if (counter) 3034 report(!*counter, "No interrupt expected"); 3035 3036 stgi(); 3037 3038 if (counter) 3039 report(*counter == 1, "Interrupt is expected"); 3040 3041 report (vmcb->control.exit_code == expected_vmexit, "Test expected VM exit"); 3042 report(vmcb->save.rflags & X86_EFLAGS_IF, "Guest should have EFLAGS.IF set now"); 3043 cli(); 3044 } 3045 3046 3047 // subtest: test that enabling EFLAGS.IF is enough to trigger an interrupt 3048 static void svm_intr_intercept_mix_if_guest(struct svm_test *test) 3049 { 3050 asm volatile("nop;nop;nop;nop"); 3051 report(!dummy_isr_recevied, "No interrupt expected"); 3052 sti_nop(); 3053 report(0, "must not reach here"); 3054 } 3055 3056 static void svm_intr_intercept_mix_if(void) 3057 { 3058 // make a physical interrupt to be pending 3059 handle_irq(0x55, dummy_isr); 3060 3061 vmcb->control.intercept |= (1 << INTERCEPT_INTR); 3062 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3063 vmcb->save.rflags &= ~X86_EFLAGS_IF; 3064 3065 test_set_guest(svm_intr_intercept_mix_if_guest); 3066 cli(); 3067 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0); 3068 svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR); 3069 } 3070 3071 3072 // subtest: test that a clever guest can trigger an interrupt by setting GIF 3073 // if GIF is not intercepted 3074 static void svm_intr_intercept_mix_gif_guest(struct svm_test *test) 3075 { 3076 3077 asm volatile("nop;nop;nop;nop"); 3078 report(!dummy_isr_recevied, "No interrupt expected"); 3079 3080 // clear GIF and enable IF 3081 // that should still not cause VM exit 3082 clgi(); 3083 sti_nop(); 3084 report(!dummy_isr_recevied, "No interrupt expected"); 3085 3086 stgi(); 3087 report(0, "must not reach here"); 3088 } 3089 3090 static void svm_intr_intercept_mix_gif(void) 3091 { 3092 handle_irq(0x55, dummy_isr); 3093 3094 vmcb->control.intercept |= (1 << INTERCEPT_INTR); 3095 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3096 vmcb->save.rflags &= ~X86_EFLAGS_IF; 3097 3098 test_set_guest(svm_intr_intercept_mix_gif_guest); 3099 cli(); 3100 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0); 3101 svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR); 3102 } 3103 3104 // subtest: test that a clever guest can trigger an interrupt by setting GIF 3105 // if GIF is not intercepted and interrupt comes after guest 3106 // started running 3107 static void svm_intr_intercept_mix_gif_guest2(struct svm_test *test) 3108 { 3109 asm volatile("nop;nop;nop;nop"); 3110 report(!dummy_isr_recevied, "No interrupt expected"); 3111 3112 clgi(); 3113 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0); 3114 report(!dummy_isr_recevied, "No interrupt expected"); 3115 3116 stgi(); 3117 report(0, "must not reach here"); 3118 } 3119 3120 static void svm_intr_intercept_mix_gif2(void) 3121 { 3122 handle_irq(0x55, dummy_isr); 3123 3124 vmcb->control.intercept |= (1 << INTERCEPT_INTR); 3125 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3126 vmcb->save.rflags |= X86_EFLAGS_IF; 3127 3128 test_set_guest(svm_intr_intercept_mix_gif_guest2); 3129 svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR); 3130 } 3131 3132 3133 // subtest: test that pending NMI will be handled when guest enables GIF 3134 static void svm_intr_intercept_mix_nmi_guest(struct svm_test *test) 3135 { 3136 asm volatile("nop;nop;nop;nop"); 3137 report(!nmi_recevied, "No NMI expected"); 3138 cli(); // should have no effect 3139 3140 clgi(); 3141 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI, 0); 3142 sti_nop(); // should have no effect 3143 report(!nmi_recevied, "No NMI expected"); 3144 3145 stgi(); 3146 report(0, "must not reach here"); 3147 } 3148 3149 static void svm_intr_intercept_mix_nmi(void) 3150 { 3151 handle_exception(2, dummy_nmi_handler); 3152 3153 vmcb->control.intercept |= (1 << INTERCEPT_NMI); 3154 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3155 vmcb->save.rflags |= X86_EFLAGS_IF; 3156 3157 test_set_guest(svm_intr_intercept_mix_nmi_guest); 3158 svm_intr_intercept_mix_run_guest(&nmi_recevied, SVM_EXIT_NMI); 3159 } 3160 3161 // test that pending SMI will be handled when guest enables GIF 3162 // TODO: can't really count #SMIs so just test that guest doesn't hang 3163 // and VMexits on SMI 3164 static void svm_intr_intercept_mix_smi_guest(struct svm_test *test) 3165 { 3166 asm volatile("nop;nop;nop;nop"); 3167 3168 clgi(); 3169 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_SMI, 0); 3170 sti_nop(); // should have no effect 3171 stgi(); 3172 report(0, "must not reach here"); 3173 } 3174 3175 static void svm_intr_intercept_mix_smi(void) 3176 { 3177 vmcb->control.intercept |= (1 << INTERCEPT_SMI); 3178 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3179 test_set_guest(svm_intr_intercept_mix_smi_guest); 3180 svm_intr_intercept_mix_run_guest(NULL, SVM_EXIT_SMI); 3181 } 3182 3183 static void svm_l2_ac_test(void) 3184 { 3185 bool hit_ac = false; 3186 3187 write_cr0(read_cr0() | X86_CR0_AM); 3188 write_rflags(read_rflags() | X86_EFLAGS_AC); 3189 3190 run_in_user(generate_usermode_ac, AC_VECTOR, 0, 0, 0, 0, &hit_ac); 3191 report(hit_ac, "Usermode #AC handled in L2"); 3192 vmmcall(); 3193 } 3194 3195 struct svm_exception_test { 3196 u8 vector; 3197 void (*guest_code)(void); 3198 }; 3199 3200 struct svm_exception_test svm_exception_tests[] = { 3201 { GP_VECTOR, generate_non_canonical_gp }, 3202 { UD_VECTOR, generate_ud }, 3203 { DE_VECTOR, generate_de }, 3204 { DB_VECTOR, generate_single_step_db }, 3205 { BP_VECTOR, generate_bp }, 3206 { AC_VECTOR, svm_l2_ac_test }, 3207 { OF_VECTOR, generate_of }, 3208 { NM_VECTOR, generate_cr0_ts_nm }, 3209 { NM_VECTOR, generate_cr0_em_nm }, 3210 }; 3211 3212 static u8 svm_exception_test_vector; 3213 3214 static void svm_exception_handler(struct ex_regs *regs) 3215 { 3216 report(regs->vector == svm_exception_test_vector, 3217 "Handling %s in L2's exception handler", 3218 exception_mnemonic(svm_exception_test_vector)); 3219 vmmcall(); 3220 } 3221 3222 static void handle_exception_in_l2(u8 vector) 3223 { 3224 handler old_handler = handle_exception(vector, svm_exception_handler); 3225 svm_exception_test_vector = vector; 3226 3227 report(svm_vmrun() == SVM_EXIT_VMMCALL, 3228 "%s handled by L2", exception_mnemonic(vector)); 3229 3230 handle_exception(vector, old_handler); 3231 } 3232 3233 static void handle_exception_in_l1(u32 vector) 3234 { 3235 u32 old_ie = vmcb->control.intercept_exceptions; 3236 3237 vmcb->control.intercept_exceptions |= (1ULL << vector); 3238 3239 report(svm_vmrun() == (SVM_EXIT_EXCP_BASE + vector), 3240 "%s handled by L1", exception_mnemonic(vector)); 3241 3242 vmcb->control.intercept_exceptions = old_ie; 3243 } 3244 3245 static void svm_exception_test(void) 3246 { 3247 struct svm_exception_test *t; 3248 int i; 3249 3250 for (i = 0; i < ARRAY_SIZE(svm_exception_tests); i++) { 3251 t = &svm_exception_tests[i]; 3252 test_set_guest((test_guest_func)t->guest_code); 3253 3254 handle_exception_in_l2(t->vector); 3255 vmcb_ident(vmcb); 3256 3257 handle_exception_in_l1(t->vector); 3258 vmcb_ident(vmcb); 3259 } 3260 } 3261 3262 struct svm_test svm_tests[] = { 3263 { "null", default_supported, default_prepare, 3264 default_prepare_gif_clear, null_test, 3265 default_finished, null_check }, 3266 { "vmrun", default_supported, default_prepare, 3267 default_prepare_gif_clear, test_vmrun, 3268 default_finished, check_vmrun }, 3269 { "ioio", default_supported, prepare_ioio, 3270 default_prepare_gif_clear, test_ioio, 3271 ioio_finished, check_ioio }, 3272 { "vmrun intercept check", default_supported, prepare_no_vmrun_int, 3273 default_prepare_gif_clear, null_test, default_finished, 3274 check_no_vmrun_int }, 3275 { "rsm", default_supported, 3276 prepare_rsm_intercept, default_prepare_gif_clear, 3277 test_rsm_intercept, finished_rsm_intercept, check_rsm_intercept }, 3278 { "cr3 read intercept", default_supported, 3279 prepare_cr3_intercept, default_prepare_gif_clear, 3280 test_cr3_intercept, default_finished, check_cr3_intercept }, 3281 { "cr3 read nointercept", default_supported, default_prepare, 3282 default_prepare_gif_clear, test_cr3_intercept, default_finished, 3283 check_cr3_nointercept }, 3284 { "cr3 read intercept emulate", smp_supported, 3285 prepare_cr3_intercept_bypass, default_prepare_gif_clear, 3286 test_cr3_intercept_bypass, default_finished, check_cr3_intercept }, 3287 { "dr intercept check", default_supported, prepare_dr_intercept, 3288 default_prepare_gif_clear, test_dr_intercept, dr_intercept_finished, 3289 check_dr_intercept }, 3290 { "next_rip", next_rip_supported, prepare_next_rip, 3291 default_prepare_gif_clear, test_next_rip, 3292 default_finished, check_next_rip }, 3293 { "msr intercept check", default_supported, prepare_msr_intercept, 3294 default_prepare_gif_clear, test_msr_intercept, 3295 msr_intercept_finished, check_msr_intercept }, 3296 { "mode_switch", default_supported, prepare_mode_switch, 3297 default_prepare_gif_clear, test_mode_switch, 3298 mode_switch_finished, check_mode_switch }, 3299 { "asid_zero", default_supported, prepare_asid_zero, 3300 default_prepare_gif_clear, test_asid_zero, 3301 default_finished, check_asid_zero }, 3302 { "sel_cr0_bug", default_supported, sel_cr0_bug_prepare, 3303 default_prepare_gif_clear, sel_cr0_bug_test, 3304 sel_cr0_bug_finished, sel_cr0_bug_check }, 3305 { "tsc_adjust", tsc_adjust_supported, tsc_adjust_prepare, 3306 default_prepare_gif_clear, tsc_adjust_test, 3307 default_finished, tsc_adjust_check }, 3308 { "latency_run_exit", default_supported, latency_prepare, 3309 default_prepare_gif_clear, latency_test, 3310 latency_finished, latency_check }, 3311 { "latency_run_exit_clean", default_supported, latency_prepare, 3312 default_prepare_gif_clear, latency_test, 3313 latency_finished_clean, latency_check }, 3314 { "latency_svm_insn", default_supported, lat_svm_insn_prepare, 3315 default_prepare_gif_clear, null_test, 3316 lat_svm_insn_finished, lat_svm_insn_check }, 3317 { "exc_inject", default_supported, exc_inject_prepare, 3318 default_prepare_gif_clear, exc_inject_test, 3319 exc_inject_finished, exc_inject_check }, 3320 { "pending_event", default_supported, pending_event_prepare, 3321 default_prepare_gif_clear, 3322 pending_event_test, pending_event_finished, pending_event_check }, 3323 { "pending_event_cli", default_supported, pending_event_cli_prepare, 3324 pending_event_cli_prepare_gif_clear, 3325 pending_event_cli_test, pending_event_cli_finished, 3326 pending_event_cli_check }, 3327 { "interrupt", default_supported, interrupt_prepare, 3328 default_prepare_gif_clear, interrupt_test, 3329 interrupt_finished, interrupt_check }, 3330 { "nmi", default_supported, nmi_prepare, 3331 default_prepare_gif_clear, nmi_test, 3332 nmi_finished, nmi_check }, 3333 { "nmi_hlt", smp_supported, nmi_prepare, 3334 default_prepare_gif_clear, nmi_hlt_test, 3335 nmi_hlt_finished, nmi_hlt_check }, 3336 { "vnmi", vnmi_supported, vnmi_prepare, 3337 default_prepare_gif_clear, vnmi_test, 3338 vnmi_finished, vnmi_check }, 3339 { "virq_inject", default_supported, virq_inject_prepare, 3340 default_prepare_gif_clear, virq_inject_test, 3341 virq_inject_finished, virq_inject_check }, 3342 { "reg_corruption", default_supported, reg_corruption_prepare, 3343 default_prepare_gif_clear, reg_corruption_test, 3344 reg_corruption_finished, reg_corruption_check }, 3345 { "svm_init_startup_test", smp_supported, init_startup_prepare, 3346 default_prepare_gif_clear, null_test, 3347 init_startup_finished, init_startup_check }, 3348 { "svm_init_intercept_test", smp_supported, init_intercept_prepare, 3349 default_prepare_gif_clear, init_intercept_test, 3350 init_intercept_finished, init_intercept_check, .on_vcpu = 2 }, 3351 { "host_rflags", default_supported, host_rflags_prepare, 3352 host_rflags_prepare_gif_clear, host_rflags_test, 3353 host_rflags_finished, host_rflags_check }, 3354 { "vgif", vgif_supported, prepare_vgif_enabled, 3355 default_prepare_gif_clear, test_vgif, vgif_finished, 3356 vgif_check }, 3357 TEST(svm_cr4_osxsave_test), 3358 TEST(svm_guest_state_test), 3359 TEST(svm_vmrun_errata_test), 3360 TEST(svm_vmload_vmsave), 3361 TEST(svm_test_singlestep), 3362 TEST(svm_no_nm_test), 3363 TEST(svm_exception_test), 3364 TEST(svm_lbrv_test0), 3365 TEST(svm_lbrv_test1), 3366 TEST(svm_lbrv_test2), 3367 TEST(svm_lbrv_nested_test1), 3368 TEST(svm_lbrv_nested_test2), 3369 TEST(svm_intr_intercept_mix_if), 3370 TEST(svm_intr_intercept_mix_gif), 3371 TEST(svm_intr_intercept_mix_gif2), 3372 TEST(svm_intr_intercept_mix_nmi), 3373 TEST(svm_intr_intercept_mix_smi), 3374 TEST(svm_tsc_scale_test), 3375 TEST(pause_filter_test), 3376 { NULL, NULL, NULL, NULL, NULL, NULL, NULL } 3377 }; 3378 3379 int main(int ac, char **av) 3380 { 3381 setup_vm(); 3382 return run_svm_tests(ac, av, svm_tests); 3383 } 3384