1 #include "svm.h" 2 #include "libcflat.h" 3 #include "processor.h" 4 #include "desc.h" 5 #include "msr.h" 6 #include "vm.h" 7 #include "smp.h" 8 #include "types.h" 9 #include "alloc_page.h" 10 #include "isr.h" 11 #include "apic.h" 12 #include "delay.h" 13 #include "util.h" 14 #include "x86/usermode.h" 15 16 #define SVM_EXIT_MAX_DR_INTERCEPT 0x3f 17 18 #define LATENCY_RUNS 1000000 19 20 u64 tsc_start; 21 u64 tsc_end; 22 23 u64 vmrun_sum, vmexit_sum; 24 u64 vmsave_sum, vmload_sum; 25 u64 stgi_sum, clgi_sum; 26 u64 latvmrun_max; 27 u64 latvmrun_min; 28 u64 latvmexit_max; 29 u64 latvmexit_min; 30 u64 latvmload_max; 31 u64 latvmload_min; 32 u64 latvmsave_max; 33 u64 latvmsave_min; 34 u64 latstgi_max; 35 u64 latstgi_min; 36 u64 latclgi_max; 37 u64 latclgi_min; 38 u64 runs; 39 40 static void null_test(struct svm_test *test) 41 { 42 } 43 44 static bool null_check(struct svm_test *test) 45 { 46 return vmcb->control.exit_code == SVM_EXIT_VMMCALL; 47 } 48 49 static void prepare_no_vmrun_int(struct svm_test *test) 50 { 51 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMRUN); 52 } 53 54 static bool check_no_vmrun_int(struct svm_test *test) 55 { 56 return vmcb->control.exit_code == SVM_EXIT_ERR; 57 } 58 59 static void test_vmrun(struct svm_test *test) 60 { 61 asm volatile ("vmrun %0" : : "a"(virt_to_phys(vmcb))); 62 } 63 64 static bool check_vmrun(struct svm_test *test) 65 { 66 return vmcb->control.exit_code == SVM_EXIT_VMRUN; 67 } 68 69 static void prepare_rsm_intercept(struct svm_test *test) 70 { 71 default_prepare(test); 72 vmcb->control.intercept |= 1 << INTERCEPT_RSM; 73 vmcb->control.intercept_exceptions |= (1ULL << UD_VECTOR); 74 } 75 76 static void test_rsm_intercept(struct svm_test *test) 77 { 78 asm volatile ("rsm" : : : "memory"); 79 } 80 81 static bool check_rsm_intercept(struct svm_test *test) 82 { 83 return get_test_stage(test) == 2; 84 } 85 86 static bool finished_rsm_intercept(struct svm_test *test) 87 { 88 switch (get_test_stage(test)) { 89 case 0: 90 if (vmcb->control.exit_code != SVM_EXIT_RSM) { 91 report_fail("VMEXIT not due to rsm. Exit reason 0x%x", 92 vmcb->control.exit_code); 93 return true; 94 } 95 vmcb->control.intercept &= ~(1 << INTERCEPT_RSM); 96 inc_test_stage(test); 97 break; 98 99 case 1: 100 if (vmcb->control.exit_code != SVM_EXIT_EXCP_BASE + UD_VECTOR) { 101 report_fail("VMEXIT not due to #UD. Exit reason 0x%x", 102 vmcb->control.exit_code); 103 return true; 104 } 105 vmcb->save.rip += 2; 106 inc_test_stage(test); 107 break; 108 109 default: 110 return true; 111 } 112 return get_test_stage(test) == 2; 113 } 114 115 static void prepare_cr3_intercept(struct svm_test *test) 116 { 117 default_prepare(test); 118 vmcb->control.intercept_cr_read |= 1 << 3; 119 } 120 121 static void test_cr3_intercept(struct svm_test *test) 122 { 123 asm volatile ("mov %%cr3, %0" : "=r"(test->scratch) : : "memory"); 124 } 125 126 static bool check_cr3_intercept(struct svm_test *test) 127 { 128 return vmcb->control.exit_code == SVM_EXIT_READ_CR3; 129 } 130 131 static bool check_cr3_nointercept(struct svm_test *test) 132 { 133 return null_check(test) && test->scratch == read_cr3(); 134 } 135 136 static void corrupt_cr3_intercept_bypass(void *_test) 137 { 138 struct svm_test *test = _test; 139 extern volatile u32 mmio_insn; 140 141 while (!__sync_bool_compare_and_swap(&test->scratch, 1, 2)) 142 pause(); 143 pause(); 144 pause(); 145 pause(); 146 mmio_insn = 0x90d8200f; // mov %cr3, %rax; nop 147 } 148 149 static void prepare_cr3_intercept_bypass(struct svm_test *test) 150 { 151 default_prepare(test); 152 vmcb->control.intercept_cr_read |= 1 << 3; 153 on_cpu_async(1, corrupt_cr3_intercept_bypass, test); 154 } 155 156 static void test_cr3_intercept_bypass(struct svm_test *test) 157 { 158 ulong a = 0xa0000; 159 160 test->scratch = 1; 161 while (test->scratch != 2) 162 barrier(); 163 164 asm volatile ("mmio_insn: mov %0, (%0); nop" 165 : "+a"(a) : : "memory"); 166 test->scratch = a; 167 } 168 169 static void prepare_dr_intercept(struct svm_test *test) 170 { 171 default_prepare(test); 172 vmcb->control.intercept_dr_read = 0xff; 173 vmcb->control.intercept_dr_write = 0xff; 174 } 175 176 static void test_dr_intercept(struct svm_test *test) 177 { 178 unsigned int i, failcnt = 0; 179 180 /* Loop testing debug register reads */ 181 for (i = 0; i < 8; i++) { 182 183 switch (i) { 184 case 0: 185 asm volatile ("mov %%dr0, %0" : "=r"(test->scratch) : : "memory"); 186 break; 187 case 1: 188 asm volatile ("mov %%dr1, %0" : "=r"(test->scratch) : : "memory"); 189 break; 190 case 2: 191 asm volatile ("mov %%dr2, %0" : "=r"(test->scratch) : : "memory"); 192 break; 193 case 3: 194 asm volatile ("mov %%dr3, %0" : "=r"(test->scratch) : : "memory"); 195 break; 196 case 4: 197 asm volatile ("mov %%dr4, %0" : "=r"(test->scratch) : : "memory"); 198 break; 199 case 5: 200 asm volatile ("mov %%dr5, %0" : "=r"(test->scratch) : : "memory"); 201 break; 202 case 6: 203 asm volatile ("mov %%dr6, %0" : "=r"(test->scratch) : : "memory"); 204 break; 205 case 7: 206 asm volatile ("mov %%dr7, %0" : "=r"(test->scratch) : : "memory"); 207 break; 208 } 209 210 if (test->scratch != i) { 211 report_fail("dr%u read intercept", i); 212 failcnt++; 213 } 214 } 215 216 /* Loop testing debug register writes */ 217 for (i = 0; i < 8; i++) { 218 219 switch (i) { 220 case 0: 221 asm volatile ("mov %0, %%dr0" : : "r"(test->scratch) : "memory"); 222 break; 223 case 1: 224 asm volatile ("mov %0, %%dr1" : : "r"(test->scratch) : "memory"); 225 break; 226 case 2: 227 asm volatile ("mov %0, %%dr2" : : "r"(test->scratch) : "memory"); 228 break; 229 case 3: 230 asm volatile ("mov %0, %%dr3" : : "r"(test->scratch) : "memory"); 231 break; 232 case 4: 233 asm volatile ("mov %0, %%dr4" : : "r"(test->scratch) : "memory"); 234 break; 235 case 5: 236 asm volatile ("mov %0, %%dr5" : : "r"(test->scratch) : "memory"); 237 break; 238 case 6: 239 asm volatile ("mov %0, %%dr6" : : "r"(test->scratch) : "memory"); 240 break; 241 case 7: 242 asm volatile ("mov %0, %%dr7" : : "r"(test->scratch) : "memory"); 243 break; 244 } 245 246 if (test->scratch != i) { 247 report_fail("dr%u write intercept", i); 248 failcnt++; 249 } 250 } 251 252 test->scratch = failcnt; 253 } 254 255 static bool dr_intercept_finished(struct svm_test *test) 256 { 257 ulong n = (vmcb->control.exit_code - SVM_EXIT_READ_DR0); 258 259 /* Only expect DR intercepts */ 260 if (n > (SVM_EXIT_MAX_DR_INTERCEPT - SVM_EXIT_READ_DR0)) 261 return true; 262 263 /* 264 * Compute debug register number. 265 * Per Appendix C "SVM Intercept Exit Codes" of AMD64 Architecture 266 * Programmer's Manual Volume 2 - System Programming: 267 * http://support.amd.com/TechDocs/24593.pdf 268 * there are 16 VMEXIT codes each for DR read and write. 269 */ 270 test->scratch = (n % 16); 271 272 /* Jump over MOV instruction */ 273 vmcb->save.rip += 3; 274 275 return false; 276 } 277 278 static bool check_dr_intercept(struct svm_test *test) 279 { 280 return !test->scratch; 281 } 282 283 static bool next_rip_supported(void) 284 { 285 return this_cpu_has(X86_FEATURE_NRIPS); 286 } 287 288 static void prepare_next_rip(struct svm_test *test) 289 { 290 vmcb->control.intercept |= (1ULL << INTERCEPT_RDTSC); 291 } 292 293 294 static void test_next_rip(struct svm_test *test) 295 { 296 asm volatile ("rdtsc\n\t" 297 ".globl exp_next_rip\n\t" 298 "exp_next_rip:\n\t" ::: "eax", "edx"); 299 } 300 301 static bool check_next_rip(struct svm_test *test) 302 { 303 extern char exp_next_rip; 304 unsigned long address = (unsigned long)&exp_next_rip; 305 306 return address == vmcb->control.next_rip; 307 } 308 309 extern u8 *msr_bitmap; 310 311 static void prepare_msr_intercept(struct svm_test *test) 312 { 313 default_prepare(test); 314 vmcb->control.intercept |= (1ULL << INTERCEPT_MSR_PROT); 315 vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR); 316 memset(msr_bitmap, 0xff, MSR_BITMAP_SIZE); 317 } 318 319 static void test_msr_intercept(struct svm_test *test) 320 { 321 unsigned long msr_value = 0xef8056791234abcd; /* Arbitrary value */ 322 unsigned long msr_index; 323 324 for (msr_index = 0; msr_index <= 0xc0011fff; msr_index++) { 325 if (msr_index == 0xC0010131 /* MSR_SEV_STATUS */) { 326 /* 327 * Per section 15.34.10 "SEV_STATUS MSR" of AMD64 Architecture 328 * Programmer's Manual volume 2 - System Programming: 329 * http://support.amd.com/TechDocs/24593.pdf 330 * SEV_STATUS MSR (C001_0131) is a non-interceptable MSR. 331 */ 332 continue; 333 } 334 335 /* Skips gaps between supported MSR ranges */ 336 if (msr_index == 0x2000) 337 msr_index = 0xc0000000; 338 else if (msr_index == 0xc0002000) 339 msr_index = 0xc0010000; 340 341 test->scratch = -1; 342 343 rdmsr(msr_index); 344 345 /* Check that a read intercept occurred for MSR at msr_index */ 346 if (test->scratch != msr_index) 347 report_fail("MSR 0x%lx read intercept", msr_index); 348 349 /* 350 * Poor man approach to generate a value that 351 * seems arbitrary each time around the loop. 352 */ 353 msr_value += (msr_value << 1); 354 355 wrmsr(msr_index, msr_value); 356 357 /* Check that a write intercept occurred for MSR with msr_value */ 358 if (test->scratch != msr_value) 359 report_fail("MSR 0x%lx write intercept", msr_index); 360 } 361 362 test->scratch = -2; 363 } 364 365 static bool msr_intercept_finished(struct svm_test *test) 366 { 367 u32 exit_code = vmcb->control.exit_code; 368 u64 exit_info_1; 369 u8 *opcode; 370 371 if (exit_code == SVM_EXIT_MSR) { 372 exit_info_1 = vmcb->control.exit_info_1; 373 } else { 374 /* 375 * If #GP exception occurs instead, check that it was 376 * for RDMSR/WRMSR and set exit_info_1 accordingly. 377 */ 378 379 if (exit_code != (SVM_EXIT_EXCP_BASE + GP_VECTOR)) 380 return true; 381 382 opcode = (u8 *)vmcb->save.rip; 383 if (opcode[0] != 0x0f) 384 return true; 385 386 switch (opcode[1]) { 387 case 0x30: /* WRMSR */ 388 exit_info_1 = 1; 389 break; 390 case 0x32: /* RDMSR */ 391 exit_info_1 = 0; 392 break; 393 default: 394 return true; 395 } 396 397 /* 398 * Warn that #GP exception occured instead. 399 * RCX holds the MSR index. 400 */ 401 printf("%s 0x%lx #GP exception\n", 402 exit_info_1 ? "WRMSR" : "RDMSR", get_regs().rcx); 403 } 404 405 /* Jump over RDMSR/WRMSR instruction */ 406 vmcb->save.rip += 2; 407 408 /* 409 * Test whether the intercept was for RDMSR/WRMSR. 410 * For RDMSR, test->scratch is set to the MSR index; 411 * RCX holds the MSR index. 412 * For WRMSR, test->scratch is set to the MSR value; 413 * RDX holds the upper 32 bits of the MSR value, 414 * while RAX hold its lower 32 bits. 415 */ 416 if (exit_info_1) 417 test->scratch = 418 ((get_regs().rdx << 32) | (vmcb->save.rax & 0xffffffff)); 419 else 420 test->scratch = get_regs().rcx; 421 422 return false; 423 } 424 425 static bool check_msr_intercept(struct svm_test *test) 426 { 427 memset(msr_bitmap, 0, MSR_BITMAP_SIZE); 428 return (test->scratch == -2); 429 } 430 431 static void prepare_mode_switch(struct svm_test *test) 432 { 433 vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR) 434 | (1ULL << UD_VECTOR) 435 | (1ULL << DF_VECTOR) 436 | (1ULL << PF_VECTOR); 437 test->scratch = 0; 438 } 439 440 static void test_mode_switch(struct svm_test *test) 441 { 442 asm volatile(" cli\n" 443 " ljmp *1f\n" /* jump to 32-bit code segment */ 444 "1:\n" 445 " .long 2f\n" 446 " .long " xstr(KERNEL_CS32) "\n" 447 ".code32\n" 448 "2:\n" 449 " movl %%cr0, %%eax\n" 450 " btcl $31, %%eax\n" /* clear PG */ 451 " movl %%eax, %%cr0\n" 452 " movl $0xc0000080, %%ecx\n" /* EFER */ 453 " rdmsr\n" 454 " btcl $8, %%eax\n" /* clear LME */ 455 " wrmsr\n" 456 " movl %%cr4, %%eax\n" 457 " btcl $5, %%eax\n" /* clear PAE */ 458 " movl %%eax, %%cr4\n" 459 " movw %[ds16], %%ax\n" 460 " movw %%ax, %%ds\n" 461 " ljmpl %[cs16], $3f\n" /* jump to 16 bit protected-mode */ 462 ".code16\n" 463 "3:\n" 464 " movl %%cr0, %%eax\n" 465 " btcl $0, %%eax\n" /* clear PE */ 466 " movl %%eax, %%cr0\n" 467 " ljmpl $0, $4f\n" /* jump to real-mode */ 468 "4:\n" 469 " vmmcall\n" 470 " movl %%cr0, %%eax\n" 471 " btsl $0, %%eax\n" /* set PE */ 472 " movl %%eax, %%cr0\n" 473 " ljmpl %[cs32], $5f\n" /* back to protected mode */ 474 ".code32\n" 475 "5:\n" 476 " movl %%cr4, %%eax\n" 477 " btsl $5, %%eax\n" /* set PAE */ 478 " movl %%eax, %%cr4\n" 479 " movl $0xc0000080, %%ecx\n" /* EFER */ 480 " rdmsr\n" 481 " btsl $8, %%eax\n" /* set LME */ 482 " wrmsr\n" 483 " movl %%cr0, %%eax\n" 484 " btsl $31, %%eax\n" /* set PG */ 485 " movl %%eax, %%cr0\n" 486 " ljmpl %[cs64], $6f\n" /* back to long mode */ 487 ".code64\n\t" 488 "6:\n" 489 " vmmcall\n" 490 :: [cs16] "i"(KERNEL_CS16), [ds16] "i"(KERNEL_DS16), 491 [cs32] "i"(KERNEL_CS32), [cs64] "i"(KERNEL_CS64) 492 : "rax", "rbx", "rcx", "rdx", "memory"); 493 } 494 495 static bool mode_switch_finished(struct svm_test *test) 496 { 497 u64 cr0, cr4, efer; 498 499 cr0 = vmcb->save.cr0; 500 cr4 = vmcb->save.cr4; 501 efer = vmcb->save.efer; 502 503 /* Only expect VMMCALL intercepts */ 504 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) 505 return true; 506 507 /* Jump over VMMCALL instruction */ 508 vmcb->save.rip += 3; 509 510 /* Do sanity checks */ 511 switch (test->scratch) { 512 case 0: 513 /* Test should be in real mode now - check for this */ 514 if ((cr0 & 0x80000001) || /* CR0.PG, CR0.PE */ 515 (cr4 & 0x00000020) || /* CR4.PAE */ 516 (efer & 0x00000500)) /* EFER.LMA, EFER.LME */ 517 return true; 518 break; 519 case 2: 520 /* Test should be back in long-mode now - check for this */ 521 if (((cr0 & 0x80000001) != 0x80000001) || /* CR0.PG, CR0.PE */ 522 ((cr4 & 0x00000020) != 0x00000020) || /* CR4.PAE */ 523 ((efer & 0x00000500) != 0x00000500)) /* EFER.LMA, EFER.LME */ 524 return true; 525 break; 526 } 527 528 /* one step forward */ 529 test->scratch += 1; 530 531 return test->scratch == 2; 532 } 533 534 static bool check_mode_switch(struct svm_test *test) 535 { 536 return test->scratch == 2; 537 } 538 539 extern u8 *io_bitmap; 540 541 static void prepare_ioio(struct svm_test *test) 542 { 543 vmcb->control.intercept |= (1ULL << INTERCEPT_IOIO_PROT); 544 test->scratch = 0; 545 memset(io_bitmap, 0, 8192); 546 io_bitmap[8192] = 0xFF; 547 } 548 549 static void test_ioio(struct svm_test *test) 550 { 551 // stage 0, test IO pass 552 inb(0x5000); 553 outb(0x0, 0x5000); 554 if (get_test_stage(test) != 0) 555 goto fail; 556 557 // test IO width, in/out 558 io_bitmap[0] = 0xFF; 559 inc_test_stage(test); 560 inb(0x0); 561 if (get_test_stage(test) != 2) 562 goto fail; 563 564 outw(0x0, 0x0); 565 if (get_test_stage(test) != 3) 566 goto fail; 567 568 inl(0x0); 569 if (get_test_stage(test) != 4) 570 goto fail; 571 572 // test low/high IO port 573 io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8)); 574 inb(0x5000); 575 if (get_test_stage(test) != 5) 576 goto fail; 577 578 io_bitmap[0x9000 / 8] = (1 << (0x9000 % 8)); 579 inw(0x9000); 580 if (get_test_stage(test) != 6) 581 goto fail; 582 583 // test partial pass 584 io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8)); 585 inl(0x4FFF); 586 if (get_test_stage(test) != 7) 587 goto fail; 588 589 // test across pages 590 inc_test_stage(test); 591 inl(0x7FFF); 592 if (get_test_stage(test) != 8) 593 goto fail; 594 595 inc_test_stage(test); 596 io_bitmap[0x8000 / 8] = 1 << (0x8000 % 8); 597 inl(0x7FFF); 598 if (get_test_stage(test) != 10) 599 goto fail; 600 601 io_bitmap[0] = 0; 602 inl(0xFFFF); 603 if (get_test_stage(test) != 11) 604 goto fail; 605 606 io_bitmap[0] = 0xFF; 607 io_bitmap[8192] = 0; 608 inl(0xFFFF); 609 inc_test_stage(test); 610 if (get_test_stage(test) != 12) 611 goto fail; 612 613 return; 614 615 fail: 616 report_fail("stage %d", get_test_stage(test)); 617 test->scratch = -1; 618 } 619 620 static bool ioio_finished(struct svm_test *test) 621 { 622 unsigned port, size; 623 624 /* Only expect IOIO intercepts */ 625 if (vmcb->control.exit_code == SVM_EXIT_VMMCALL) 626 return true; 627 628 if (vmcb->control.exit_code != SVM_EXIT_IOIO) 629 return true; 630 631 /* one step forward */ 632 test->scratch += 1; 633 634 port = vmcb->control.exit_info_1 >> 16; 635 size = (vmcb->control.exit_info_1 >> SVM_IOIO_SIZE_SHIFT) & 7; 636 637 while (size--) { 638 io_bitmap[port / 8] &= ~(1 << (port & 7)); 639 port++; 640 } 641 642 return false; 643 } 644 645 static bool check_ioio(struct svm_test *test) 646 { 647 memset(io_bitmap, 0, 8193); 648 return test->scratch != -1; 649 } 650 651 static void prepare_asid_zero(struct svm_test *test) 652 { 653 vmcb->control.asid = 0; 654 } 655 656 static void test_asid_zero(struct svm_test *test) 657 { 658 asm volatile ("vmmcall\n\t"); 659 } 660 661 static bool check_asid_zero(struct svm_test *test) 662 { 663 return vmcb->control.exit_code == SVM_EXIT_ERR; 664 } 665 666 static void sel_cr0_bug_prepare(struct svm_test *test) 667 { 668 vmcb->control.intercept |= (1ULL << INTERCEPT_SELECTIVE_CR0); 669 } 670 671 static bool sel_cr0_bug_finished(struct svm_test *test) 672 { 673 return true; 674 } 675 676 static void sel_cr0_bug_test(struct svm_test *test) 677 { 678 unsigned long cr0; 679 680 /* read cr0, clear CD, and write back */ 681 cr0 = read_cr0(); 682 cr0 |= (1UL << 30); 683 write_cr0(cr0); 684 685 /* 686 * If we are here the test failed, not sure what to do now because we 687 * are not in guest-mode anymore so we can't trigger an intercept. 688 * Trigger a tripple-fault for now. 689 */ 690 report_fail("sel_cr0 test. Can not recover from this - exiting"); 691 exit(report_summary()); 692 } 693 694 static bool sel_cr0_bug_check(struct svm_test *test) 695 { 696 return vmcb->control.exit_code == SVM_EXIT_CR0_SEL_WRITE; 697 } 698 699 #define TSC_ADJUST_VALUE (1ll << 32) 700 #define TSC_OFFSET_VALUE (~0ull << 48) 701 static bool ok; 702 703 static bool tsc_adjust_supported(void) 704 { 705 return this_cpu_has(X86_FEATURE_TSC_ADJUST); 706 } 707 708 static void tsc_adjust_prepare(struct svm_test *test) 709 { 710 default_prepare(test); 711 vmcb->control.tsc_offset = TSC_OFFSET_VALUE; 712 713 wrmsr(MSR_IA32_TSC_ADJUST, -TSC_ADJUST_VALUE); 714 int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST); 715 ok = adjust == -TSC_ADJUST_VALUE; 716 } 717 718 static void tsc_adjust_test(struct svm_test *test) 719 { 720 int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST); 721 ok &= adjust == -TSC_ADJUST_VALUE; 722 723 uint64_t l1_tsc = rdtsc() - TSC_OFFSET_VALUE; 724 wrmsr(MSR_IA32_TSC, l1_tsc - TSC_ADJUST_VALUE); 725 726 adjust = rdmsr(MSR_IA32_TSC_ADJUST); 727 ok &= adjust <= -2 * TSC_ADJUST_VALUE; 728 729 uint64_t l1_tsc_end = rdtsc() - TSC_OFFSET_VALUE; 730 ok &= (l1_tsc_end + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE; 731 732 uint64_t l1_tsc_msr = rdmsr(MSR_IA32_TSC) - TSC_OFFSET_VALUE; 733 ok &= (l1_tsc_msr + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE; 734 } 735 736 static bool tsc_adjust_check(struct svm_test *test) 737 { 738 int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST); 739 740 wrmsr(MSR_IA32_TSC_ADJUST, 0); 741 return ok && adjust <= -2 * TSC_ADJUST_VALUE; 742 } 743 744 745 static u64 guest_tsc_delay_value; 746 /* number of bits to shift tsc right for stable result */ 747 #define TSC_SHIFT 24 748 #define TSC_SCALE_ITERATIONS 10 749 750 static void svm_tsc_scale_guest(struct svm_test *test) 751 { 752 u64 start_tsc = rdtsc(); 753 754 while (rdtsc() - start_tsc < guest_tsc_delay_value) 755 cpu_relax(); 756 } 757 758 static void svm_tsc_scale_run_testcase(u64 duration, 759 double tsc_scale, u64 tsc_offset) 760 { 761 u64 start_tsc, actual_duration; 762 763 guest_tsc_delay_value = (duration << TSC_SHIFT) * tsc_scale; 764 765 test_set_guest(svm_tsc_scale_guest); 766 vmcb->control.tsc_offset = tsc_offset; 767 wrmsr(MSR_AMD64_TSC_RATIO, (u64)(tsc_scale * (1ULL << 32))); 768 769 start_tsc = rdtsc(); 770 771 if (svm_vmrun() != SVM_EXIT_VMMCALL) 772 report_fail("unexpected vm exit code 0x%x", vmcb->control.exit_code); 773 774 actual_duration = (rdtsc() - start_tsc) >> TSC_SHIFT; 775 776 report(duration == actual_duration, "tsc delay (expected: %lu, actual: %lu)", 777 duration, actual_duration); 778 } 779 780 static void svm_tsc_scale_test(void) 781 { 782 int i; 783 784 if (!tsc_scale_supported()) { 785 report_skip("TSC scale not supported in the guest"); 786 return; 787 } 788 789 report(rdmsr(MSR_AMD64_TSC_RATIO) == TSC_RATIO_DEFAULT, 790 "initial TSC scale ratio"); 791 792 for (i = 0 ; i < TSC_SCALE_ITERATIONS; i++) { 793 794 double tsc_scale = (double)(rdrand() % 100 + 1) / 10; 795 int duration = rdrand() % 50 + 1; 796 u64 tsc_offset = rdrand(); 797 798 report_info("duration=%d, tsc_scale=%d, tsc_offset=%ld", 799 duration, (int)(tsc_scale * 100), tsc_offset); 800 801 svm_tsc_scale_run_testcase(duration, tsc_scale, tsc_offset); 802 } 803 804 svm_tsc_scale_run_testcase(50, 255, rdrand()); 805 svm_tsc_scale_run_testcase(50, 0.0001, rdrand()); 806 } 807 808 static void latency_prepare(struct svm_test *test) 809 { 810 default_prepare(test); 811 runs = LATENCY_RUNS; 812 latvmrun_min = latvmexit_min = -1ULL; 813 latvmrun_max = latvmexit_max = 0; 814 vmrun_sum = vmexit_sum = 0; 815 tsc_start = rdtsc(); 816 } 817 818 static void latency_test(struct svm_test *test) 819 { 820 u64 cycles; 821 822 start: 823 tsc_end = rdtsc(); 824 825 cycles = tsc_end - tsc_start; 826 827 if (cycles > latvmrun_max) 828 latvmrun_max = cycles; 829 830 if (cycles < latvmrun_min) 831 latvmrun_min = cycles; 832 833 vmrun_sum += cycles; 834 835 tsc_start = rdtsc(); 836 837 asm volatile ("vmmcall" : : : "memory"); 838 goto start; 839 } 840 841 static bool latency_finished(struct svm_test *test) 842 { 843 u64 cycles; 844 845 tsc_end = rdtsc(); 846 847 cycles = tsc_end - tsc_start; 848 849 if (cycles > latvmexit_max) 850 latvmexit_max = cycles; 851 852 if (cycles < latvmexit_min) 853 latvmexit_min = cycles; 854 855 vmexit_sum += cycles; 856 857 vmcb->save.rip += 3; 858 859 runs -= 1; 860 861 tsc_end = rdtsc(); 862 863 return runs == 0; 864 } 865 866 static bool latency_finished_clean(struct svm_test *test) 867 { 868 vmcb->control.clean = VMCB_CLEAN_ALL; 869 return latency_finished(test); 870 } 871 872 static bool latency_check(struct svm_test *test) 873 { 874 printf(" Latency VMRUN : max: %ld min: %ld avg: %ld\n", latvmrun_max, 875 latvmrun_min, vmrun_sum / LATENCY_RUNS); 876 printf(" Latency VMEXIT: max: %ld min: %ld avg: %ld\n", latvmexit_max, 877 latvmexit_min, vmexit_sum / LATENCY_RUNS); 878 return true; 879 } 880 881 static void lat_svm_insn_prepare(struct svm_test *test) 882 { 883 default_prepare(test); 884 runs = LATENCY_RUNS; 885 latvmload_min = latvmsave_min = latstgi_min = latclgi_min = -1ULL; 886 latvmload_max = latvmsave_max = latstgi_max = latclgi_max = 0; 887 vmload_sum = vmsave_sum = stgi_sum = clgi_sum; 888 } 889 890 static bool lat_svm_insn_finished(struct svm_test *test) 891 { 892 u64 vmcb_phys = virt_to_phys(vmcb); 893 u64 cycles; 894 895 for ( ; runs != 0; runs--) { 896 tsc_start = rdtsc(); 897 asm volatile("vmload %0\n\t" : : "a"(vmcb_phys) : "memory"); 898 cycles = rdtsc() - tsc_start; 899 if (cycles > latvmload_max) 900 latvmload_max = cycles; 901 if (cycles < latvmload_min) 902 latvmload_min = cycles; 903 vmload_sum += cycles; 904 905 tsc_start = rdtsc(); 906 asm volatile("vmsave %0\n\t" : : "a"(vmcb_phys) : "memory"); 907 cycles = rdtsc() - tsc_start; 908 if (cycles > latvmsave_max) 909 latvmsave_max = cycles; 910 if (cycles < latvmsave_min) 911 latvmsave_min = cycles; 912 vmsave_sum += cycles; 913 914 tsc_start = rdtsc(); 915 asm volatile("stgi\n\t"); 916 cycles = rdtsc() - tsc_start; 917 if (cycles > latstgi_max) 918 latstgi_max = cycles; 919 if (cycles < latstgi_min) 920 latstgi_min = cycles; 921 stgi_sum += cycles; 922 923 tsc_start = rdtsc(); 924 asm volatile("clgi\n\t"); 925 cycles = rdtsc() - tsc_start; 926 if (cycles > latclgi_max) 927 latclgi_max = cycles; 928 if (cycles < latclgi_min) 929 latclgi_min = cycles; 930 clgi_sum += cycles; 931 } 932 933 tsc_end = rdtsc(); 934 935 return true; 936 } 937 938 static bool lat_svm_insn_check(struct svm_test *test) 939 { 940 printf(" Latency VMLOAD: max: %ld min: %ld avg: %ld\n", latvmload_max, 941 latvmload_min, vmload_sum / LATENCY_RUNS); 942 printf(" Latency VMSAVE: max: %ld min: %ld avg: %ld\n", latvmsave_max, 943 latvmsave_min, vmsave_sum / LATENCY_RUNS); 944 printf(" Latency STGI: max: %ld min: %ld avg: %ld\n", latstgi_max, 945 latstgi_min, stgi_sum / LATENCY_RUNS); 946 printf(" Latency CLGI: max: %ld min: %ld avg: %ld\n", latclgi_max, 947 latclgi_min, clgi_sum / LATENCY_RUNS); 948 return true; 949 } 950 951 /* 952 * Report failures from SVM guest code, and on failure, set the stage to -1 and 953 * do VMMCALL to terminate the test (host side must treat -1 as "finished"). 954 * TODO: fix the tests that don't play nice with a straight report, e.g. the 955 * V_TPR test fails if report() is invoked. 956 */ 957 #define report_svm_guest(cond, test, fmt, args...) \ 958 do { \ 959 if (!(cond)) { \ 960 report_fail(fmt, ##args); \ 961 set_test_stage(test, -1); \ 962 vmmcall(); \ 963 } \ 964 } while (0) 965 966 bool pending_event_ipi_fired; 967 bool pending_event_guest_run; 968 969 static void pending_event_ipi_isr(isr_regs_t *regs) 970 { 971 pending_event_ipi_fired = true; 972 eoi(); 973 } 974 975 static void pending_event_prepare(struct svm_test *test) 976 { 977 int ipi_vector = 0xf1; 978 979 default_prepare(test); 980 981 pending_event_ipi_fired = false; 982 983 handle_irq(ipi_vector, pending_event_ipi_isr); 984 985 pending_event_guest_run = false; 986 987 vmcb->control.intercept |= (1ULL << INTERCEPT_INTR); 988 vmcb->control.int_ctl |= V_INTR_MASKING_MASK; 989 990 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | 991 APIC_DM_FIXED | ipi_vector, 0); 992 993 set_test_stage(test, 0); 994 } 995 996 static void pending_event_test(struct svm_test *test) 997 { 998 pending_event_guest_run = true; 999 } 1000 1001 static bool pending_event_finished(struct svm_test *test) 1002 { 1003 switch (get_test_stage(test)) { 1004 case 0: 1005 if (vmcb->control.exit_code != SVM_EXIT_INTR) { 1006 report_fail("VMEXIT not due to pending interrupt. Exit reason 0x%x", 1007 vmcb->control.exit_code); 1008 return true; 1009 } 1010 1011 vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR); 1012 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 1013 1014 if (pending_event_guest_run) { 1015 report_fail("Guest ran before host received IPI\n"); 1016 return true; 1017 } 1018 1019 irq_enable(); 1020 asm volatile ("nop"); 1021 irq_disable(); 1022 1023 if (!pending_event_ipi_fired) { 1024 report_fail("Pending interrupt not dispatched after IRQ enabled\n"); 1025 return true; 1026 } 1027 break; 1028 1029 case 1: 1030 if (!pending_event_guest_run) { 1031 report_fail("Guest did not resume when no interrupt\n"); 1032 return true; 1033 } 1034 break; 1035 } 1036 1037 inc_test_stage(test); 1038 1039 return get_test_stage(test) == 2; 1040 } 1041 1042 static bool pending_event_check(struct svm_test *test) 1043 { 1044 return get_test_stage(test) == 2; 1045 } 1046 1047 static void pending_event_cli_prepare(struct svm_test *test) 1048 { 1049 default_prepare(test); 1050 1051 pending_event_ipi_fired = false; 1052 1053 handle_irq(0xf1, pending_event_ipi_isr); 1054 1055 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | 1056 APIC_DM_FIXED | 0xf1, 0); 1057 1058 set_test_stage(test, 0); 1059 } 1060 1061 static void pending_event_cli_prepare_gif_clear(struct svm_test *test) 1062 { 1063 asm("cli"); 1064 } 1065 1066 static void pending_event_cli_test(struct svm_test *test) 1067 { 1068 report_svm_guest(!pending_event_ipi_fired, test, 1069 "IRQ should NOT be delivered while IRQs disabled"); 1070 1071 /* VINTR_MASKING is zero. This should cause the IPI to fire. */ 1072 irq_enable(); 1073 asm volatile ("nop"); 1074 irq_disable(); 1075 1076 report_svm_guest(pending_event_ipi_fired, test, 1077 "IRQ should be delivered after enabling IRQs"); 1078 vmmcall(); 1079 1080 /* 1081 * Now VINTR_MASKING=1, but no interrupt is pending so 1082 * the VINTR interception should be clear in VMCB02. Check 1083 * that L0 did not leave a stale VINTR in the VMCB. 1084 */ 1085 irq_enable(); 1086 asm volatile ("nop"); 1087 irq_disable(); 1088 } 1089 1090 static bool pending_event_cli_finished(struct svm_test *test) 1091 { 1092 report_svm_guest(vmcb->control.exit_code == SVM_EXIT_VMMCALL, test, 1093 "Wanted VMMCALL VM-Exit, got exit reason 0x%x", 1094 vmcb->control.exit_code); 1095 1096 switch (get_test_stage(test)) { 1097 case 0: 1098 vmcb->save.rip += 3; 1099 1100 pending_event_ipi_fired = false; 1101 1102 vmcb->control.int_ctl |= V_INTR_MASKING_MASK; 1103 1104 /* Now entering again with VINTR_MASKING=1. */ 1105 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | 1106 APIC_DM_FIXED | 0xf1, 0); 1107 1108 break; 1109 1110 case 1: 1111 if (pending_event_ipi_fired == true) { 1112 report_fail("Interrupt triggered by guest"); 1113 return true; 1114 } 1115 1116 irq_enable(); 1117 asm volatile ("nop"); 1118 irq_disable(); 1119 1120 if (pending_event_ipi_fired != true) { 1121 report_fail("Interrupt not triggered by host"); 1122 return true; 1123 } 1124 1125 break; 1126 1127 default: 1128 return true; 1129 } 1130 1131 inc_test_stage(test); 1132 1133 return get_test_stage(test) == 2; 1134 } 1135 1136 static bool pending_event_cli_check(struct svm_test *test) 1137 { 1138 return get_test_stage(test) == 2; 1139 } 1140 1141 #define TIMER_VECTOR 222 1142 1143 static volatile bool timer_fired; 1144 1145 static void timer_isr(isr_regs_t *regs) 1146 { 1147 timer_fired = true; 1148 apic_write(APIC_EOI, 0); 1149 } 1150 1151 static void interrupt_prepare(struct svm_test *test) 1152 { 1153 default_prepare(test); 1154 handle_irq(TIMER_VECTOR, timer_isr); 1155 timer_fired = false; 1156 set_test_stage(test, 0); 1157 } 1158 1159 static void interrupt_test(struct svm_test *test) 1160 { 1161 long long start, loops; 1162 1163 apic_write(APIC_LVTT, TIMER_VECTOR); 1164 irq_enable(); 1165 apic_write(APIC_TMICT, 1); //Timer Initial Count Register 0x380 one-shot 1166 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1167 asm volatile ("nop"); 1168 1169 report_svm_guest(timer_fired, test, 1170 "direct interrupt while running guest"); 1171 1172 apic_write(APIC_TMICT, 0); 1173 irq_disable(); 1174 vmmcall(); 1175 1176 timer_fired = false; 1177 apic_write(APIC_TMICT, 1); 1178 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1179 asm volatile ("nop"); 1180 1181 report_svm_guest(timer_fired, test, 1182 "intercepted interrupt while running guest"); 1183 1184 irq_enable(); 1185 apic_write(APIC_TMICT, 0); 1186 irq_disable(); 1187 1188 timer_fired = false; 1189 start = rdtsc(); 1190 apic_write(APIC_TMICT, 1000000); 1191 safe_halt(); 1192 1193 report_svm_guest(timer_fired, test, "direct interrupt + hlt"); 1194 report(rdtsc() - start > 10000, "IRQ arrived after expected delay"); 1195 1196 apic_write(APIC_TMICT, 0); 1197 irq_disable(); 1198 vmmcall(); 1199 1200 timer_fired = false; 1201 start = rdtsc(); 1202 apic_write(APIC_TMICT, 1000000); 1203 asm volatile ("hlt"); 1204 1205 report_svm_guest(timer_fired, test, "intercepted interrupt + hlt"); 1206 report(rdtsc() - start > 10000, "IRQ arrived after expected delay"); 1207 1208 apic_write(APIC_TMICT, 0); 1209 irq_disable(); 1210 } 1211 1212 static bool interrupt_finished(struct svm_test *test) 1213 { 1214 switch (get_test_stage(test)) { 1215 case 0: 1216 case 2: 1217 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1218 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1219 vmcb->control.exit_code); 1220 return true; 1221 } 1222 vmcb->save.rip += 3; 1223 1224 vmcb->control.intercept |= (1ULL << INTERCEPT_INTR); 1225 vmcb->control.int_ctl |= V_INTR_MASKING_MASK; 1226 break; 1227 1228 case 1: 1229 case 3: 1230 if (vmcb->control.exit_code != SVM_EXIT_INTR) { 1231 report_fail("VMEXIT not due to intr intercept. Exit reason 0x%x", 1232 vmcb->control.exit_code); 1233 return true; 1234 } 1235 1236 irq_enable(); 1237 asm volatile ("nop"); 1238 irq_disable(); 1239 1240 vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR); 1241 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 1242 break; 1243 1244 case 4: 1245 break; 1246 1247 default: 1248 return true; 1249 } 1250 1251 inc_test_stage(test); 1252 1253 return get_test_stage(test) == 5; 1254 } 1255 1256 static bool interrupt_check(struct svm_test *test) 1257 { 1258 return get_test_stage(test) == 5; 1259 } 1260 1261 static volatile bool nmi_fired; 1262 1263 static void nmi_handler(struct ex_regs *regs) 1264 { 1265 nmi_fired = true; 1266 } 1267 1268 static void nmi_prepare(struct svm_test *test) 1269 { 1270 default_prepare(test); 1271 nmi_fired = false; 1272 handle_exception(NMI_VECTOR, nmi_handler); 1273 set_test_stage(test, 0); 1274 } 1275 1276 static void nmi_test(struct svm_test *test) 1277 { 1278 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0); 1279 1280 report_svm_guest(nmi_fired, test, "direct NMI while running guest"); 1281 1282 vmmcall(); 1283 1284 nmi_fired = false; 1285 1286 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0); 1287 1288 report_svm_guest(nmi_fired, test, "intercepted pending NMI delivered to guest"); 1289 } 1290 1291 static bool nmi_finished(struct svm_test *test) 1292 { 1293 switch (get_test_stage(test)) { 1294 case 0: 1295 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1296 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1297 vmcb->control.exit_code); 1298 return true; 1299 } 1300 vmcb->save.rip += 3; 1301 1302 vmcb->control.intercept |= (1ULL << INTERCEPT_NMI); 1303 break; 1304 1305 case 1: 1306 if (vmcb->control.exit_code != SVM_EXIT_NMI) { 1307 report_fail("VMEXIT not due to NMI intercept. Exit reason 0x%x", 1308 vmcb->control.exit_code); 1309 return true; 1310 } 1311 1312 report_pass("NMI intercept while running guest"); 1313 break; 1314 1315 case 2: 1316 break; 1317 1318 default: 1319 return true; 1320 } 1321 1322 inc_test_stage(test); 1323 1324 return get_test_stage(test) == 3; 1325 } 1326 1327 static bool nmi_check(struct svm_test *test) 1328 { 1329 return get_test_stage(test) == 3; 1330 } 1331 1332 #define NMI_DELAY 100000000ULL 1333 1334 static void nmi_message_thread(void *_test) 1335 { 1336 struct svm_test *test = _test; 1337 1338 while (get_test_stage(test) != 1) 1339 pause(); 1340 1341 delay(NMI_DELAY); 1342 1343 apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]); 1344 1345 while (get_test_stage(test) != 2) 1346 pause(); 1347 1348 delay(NMI_DELAY); 1349 1350 apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]); 1351 } 1352 1353 static void nmi_hlt_test(struct svm_test *test) 1354 { 1355 long long start; 1356 1357 on_cpu_async(1, nmi_message_thread, test); 1358 1359 start = rdtsc(); 1360 1361 set_test_stage(test, 1); 1362 1363 asm volatile ("hlt"); 1364 1365 report_svm_guest(nmi_fired, test, "direct NMI + hlt"); 1366 report(rdtsc() - start > NMI_DELAY, "direct NMI after expected delay"); 1367 1368 nmi_fired = false; 1369 1370 vmmcall(); 1371 1372 start = rdtsc(); 1373 1374 set_test_stage(test, 2); 1375 1376 asm volatile ("hlt"); 1377 1378 report_svm_guest(nmi_fired, test, "intercepted NMI + hlt"); 1379 report(rdtsc() - start > NMI_DELAY, "intercepted NMI after expected delay"); 1380 1381 set_test_stage(test, 3); 1382 } 1383 1384 static bool nmi_hlt_finished(struct svm_test *test) 1385 { 1386 switch (get_test_stage(test)) { 1387 case 1: 1388 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1389 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1390 vmcb->control.exit_code); 1391 return true; 1392 } 1393 vmcb->save.rip += 3; 1394 1395 vmcb->control.intercept |= (1ULL << INTERCEPT_NMI); 1396 break; 1397 1398 case 2: 1399 if (vmcb->control.exit_code != SVM_EXIT_NMI) { 1400 report_fail("VMEXIT not due to NMI intercept. Exit reason 0x%x", 1401 vmcb->control.exit_code); 1402 return true; 1403 } 1404 1405 report_pass("NMI intercept while running guest"); 1406 break; 1407 1408 case 3: 1409 break; 1410 1411 default: 1412 return true; 1413 } 1414 1415 return get_test_stage(test) == 3; 1416 } 1417 1418 static bool nmi_hlt_check(struct svm_test *test) 1419 { 1420 return get_test_stage(test) == 3; 1421 } 1422 1423 static void vnmi_prepare(struct svm_test *test) 1424 { 1425 nmi_prepare(test); 1426 1427 /* 1428 * Disable NMI interception to start. Enabling vNMI without 1429 * intercepting "real" NMIs should result in an ERR VM-Exit. 1430 */ 1431 vmcb->control.intercept &= ~(1ULL << INTERCEPT_NMI); 1432 vmcb->control.int_ctl = V_NMI_ENABLE_MASK; 1433 vmcb->control.int_vector = NMI_VECTOR; 1434 } 1435 1436 static void vnmi_test(struct svm_test *test) 1437 { 1438 report_svm_guest(!nmi_fired, test, "No vNMI before injection"); 1439 vmmcall(); 1440 1441 report_svm_guest(nmi_fired, test, "vNMI delivered after injection"); 1442 vmmcall(); 1443 } 1444 1445 static bool vnmi_finished(struct svm_test *test) 1446 { 1447 switch (get_test_stage(test)) { 1448 case 0: 1449 if (vmcb->control.exit_code != SVM_EXIT_ERR) { 1450 report_fail("Wanted ERR VM-Exit, got 0x%x", 1451 vmcb->control.exit_code); 1452 return true; 1453 } 1454 report(!nmi_fired, "vNMI enabled but NMI_INTERCEPT unset!"); 1455 vmcb->control.intercept |= (1ULL << INTERCEPT_NMI); 1456 vmcb->save.rip += 3; 1457 break; 1458 1459 case 1: 1460 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1461 report_fail("Wanted VMMCALL VM-Exit, got 0x%x", 1462 vmcb->control.exit_code); 1463 return true; 1464 } 1465 report(!nmi_fired, "vNMI with vector 2 not injected"); 1466 vmcb->control.int_ctl |= V_NMI_PENDING_MASK; 1467 vmcb->save.rip += 3; 1468 break; 1469 1470 case 2: 1471 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1472 report_fail("Wanted VMMCALL VM-Exit, got 0x%x", 1473 vmcb->control.exit_code); 1474 return true; 1475 } 1476 if (vmcb->control.int_ctl & V_NMI_BLOCKING_MASK) { 1477 report_fail("V_NMI_BLOCKING_MASK not cleared on VMEXIT"); 1478 return true; 1479 } 1480 report_pass("VNMI serviced"); 1481 vmcb->save.rip += 3; 1482 break; 1483 1484 default: 1485 return true; 1486 } 1487 1488 inc_test_stage(test); 1489 1490 return get_test_stage(test) == 3; 1491 } 1492 1493 static bool vnmi_check(struct svm_test *test) 1494 { 1495 return get_test_stage(test) == 3; 1496 } 1497 1498 static volatile int count_exc = 0; 1499 1500 static void my_isr(struct ex_regs *r) 1501 { 1502 count_exc++; 1503 } 1504 1505 static void exc_inject_prepare(struct svm_test *test) 1506 { 1507 default_prepare(test); 1508 handle_exception(DE_VECTOR, my_isr); 1509 handle_exception(NMI_VECTOR, my_isr); 1510 } 1511 1512 1513 static void exc_inject_test(struct svm_test *test) 1514 { 1515 asm volatile ("vmmcall\n\tvmmcall\n\t"); 1516 } 1517 1518 static bool exc_inject_finished(struct svm_test *test) 1519 { 1520 switch (get_test_stage(test)) { 1521 case 0: 1522 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1523 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1524 vmcb->control.exit_code); 1525 return true; 1526 } 1527 vmcb->save.rip += 3; 1528 vmcb->control.event_inj = NMI_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID; 1529 break; 1530 1531 case 1: 1532 if (vmcb->control.exit_code != SVM_EXIT_ERR) { 1533 report_fail("VMEXIT not due to error. Exit reason 0x%x", 1534 vmcb->control.exit_code); 1535 return true; 1536 } 1537 report(count_exc == 0, "exception with vector 2 not injected"); 1538 vmcb->control.event_inj = DE_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID; 1539 break; 1540 1541 case 2: 1542 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1543 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1544 vmcb->control.exit_code); 1545 return true; 1546 } 1547 vmcb->save.rip += 3; 1548 report(count_exc == 1, "divide overflow exception injected"); 1549 report(!(vmcb->control.event_inj & SVM_EVTINJ_VALID), "eventinj.VALID cleared"); 1550 break; 1551 1552 default: 1553 return true; 1554 } 1555 1556 inc_test_stage(test); 1557 1558 return get_test_stage(test) == 3; 1559 } 1560 1561 static bool exc_inject_check(struct svm_test *test) 1562 { 1563 return count_exc == 1 && get_test_stage(test) == 3; 1564 } 1565 1566 static volatile bool virq_fired; 1567 1568 static void virq_isr(isr_regs_t *regs) 1569 { 1570 virq_fired = true; 1571 } 1572 1573 static void virq_inject_prepare(struct svm_test *test) 1574 { 1575 handle_irq(0xf1, virq_isr); 1576 default_prepare(test); 1577 vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK | 1578 (0x0f << V_INTR_PRIO_SHIFT); // Set to the highest priority 1579 vmcb->control.int_vector = 0xf1; 1580 virq_fired = false; 1581 set_test_stage(test, 0); 1582 } 1583 1584 static void virq_inject_test(struct svm_test *test) 1585 { 1586 report_svm_guest(!virq_fired, test, "virtual IRQ blocked after L2 cli"); 1587 1588 irq_enable(); 1589 asm volatile ("nop"); 1590 irq_disable(); 1591 1592 report_svm_guest(virq_fired, test, "virtual IRQ fired after L2 sti"); 1593 1594 vmmcall(); 1595 1596 report_svm_guest(!virq_fired, test, "intercepted VINTR blocked after L2 cli"); 1597 1598 irq_enable(); 1599 asm volatile ("nop"); 1600 irq_disable(); 1601 1602 report_svm_guest(virq_fired, test, "intercepted VINTR fired after L2 sti"); 1603 1604 vmmcall(); 1605 1606 irq_enable(); 1607 asm volatile ("nop"); 1608 irq_disable(); 1609 1610 report_svm_guest(!virq_fired, test, 1611 "virtual IRQ blocked V_IRQ_PRIO less than V_TPR"); 1612 1613 vmmcall(); 1614 vmmcall(); 1615 } 1616 1617 static bool virq_inject_finished(struct svm_test *test) 1618 { 1619 vmcb->save.rip += 3; 1620 1621 switch (get_test_stage(test)) { 1622 case 0: 1623 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1624 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1625 vmcb->control.exit_code); 1626 return true; 1627 } 1628 if (vmcb->control.int_ctl & V_IRQ_MASK) { 1629 report_fail("V_IRQ not cleared on VMEXIT after firing"); 1630 return true; 1631 } 1632 virq_fired = false; 1633 vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR); 1634 vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK | 1635 (0x0f << V_INTR_PRIO_SHIFT); 1636 break; 1637 1638 case 1: 1639 if (vmcb->control.exit_code != SVM_EXIT_VINTR) { 1640 report_fail("VMEXIT not due to vintr. Exit reason 0x%x", 1641 vmcb->control.exit_code); 1642 return true; 1643 } 1644 if (virq_fired) { 1645 report_fail("V_IRQ fired before SVM_EXIT_VINTR"); 1646 return true; 1647 } 1648 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VINTR); 1649 break; 1650 1651 case 2: 1652 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1653 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1654 vmcb->control.exit_code); 1655 return true; 1656 } 1657 virq_fired = false; 1658 // Set irq to lower priority 1659 vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK | 1660 (0x08 << V_INTR_PRIO_SHIFT); 1661 // Raise guest TPR 1662 vmcb->control.int_ctl |= 0x0a & V_TPR_MASK; 1663 break; 1664 1665 case 3: 1666 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1667 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1668 vmcb->control.exit_code); 1669 return true; 1670 } 1671 vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR); 1672 break; 1673 1674 case 4: 1675 // INTERCEPT_VINTR should be ignored because V_INTR_PRIO < V_TPR 1676 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1677 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1678 vmcb->control.exit_code); 1679 return true; 1680 } 1681 break; 1682 1683 default: 1684 return true; 1685 } 1686 1687 inc_test_stage(test); 1688 1689 return get_test_stage(test) == 5; 1690 } 1691 1692 static bool virq_inject_check(struct svm_test *test) 1693 { 1694 return get_test_stage(test) == 5; 1695 } 1696 1697 /* 1698 * Detect nested guest RIP corruption as explained in kernel commit 1699 * b6162e82aef19fee9c32cb3fe9ac30d9116a8c73 1700 * 1701 * In the assembly loop below 'ins' is executed while IO instructions 1702 * are not intercepted; the instruction is emulated by L0. 1703 * 1704 * At the same time we are getting interrupts from the local APIC timer, 1705 * and we do intercept them in L1 1706 * 1707 * If the interrupt happens on the insb instruction, L0 will VMexit, emulate 1708 * the insb instruction and then it will inject the interrupt to L1 through 1709 * a nested VMexit. Due to a bug, it would leave pre-emulation values of RIP, 1710 * RAX and RSP in the VMCB. 1711 * 1712 * In our intercept handler we detect the bug by checking that RIP is that of 1713 * the insb instruction, but its memory operand has already been written. 1714 * This means that insb was already executed. 1715 */ 1716 1717 static volatile int isr_cnt = 0; 1718 static volatile uint8_t io_port_var = 0xAA; 1719 extern const char insb_instruction_label[]; 1720 1721 static void reg_corruption_isr(isr_regs_t *regs) 1722 { 1723 isr_cnt++; 1724 apic_write(APIC_EOI, 0); 1725 } 1726 1727 static void reg_corruption_prepare(struct svm_test *test) 1728 { 1729 default_prepare(test); 1730 set_test_stage(test, 0); 1731 1732 vmcb->control.int_ctl = V_INTR_MASKING_MASK; 1733 vmcb->control.intercept |= (1ULL << INTERCEPT_INTR); 1734 1735 handle_irq(TIMER_VECTOR, reg_corruption_isr); 1736 1737 /* set local APIC to inject external interrupts */ 1738 apic_write(APIC_TMICT, 0); 1739 apic_write(APIC_TDCR, 0); 1740 apic_write(APIC_LVTT, TIMER_VECTOR | APIC_LVT_TIMER_PERIODIC); 1741 apic_write(APIC_TMICT, 1000); 1742 } 1743 1744 static void reg_corruption_test(struct svm_test *test) 1745 { 1746 /* this is endless loop, which is interrupted by the timer interrupt */ 1747 asm volatile ( 1748 "1:\n\t" 1749 "movw $0x4d0, %%dx\n\t" // IO port 1750 "lea %[io_port_var], %%rdi\n\t" 1751 "movb $0xAA, %[io_port_var]\n\t" 1752 "insb_instruction_label:\n\t" 1753 "insb\n\t" 1754 "jmp 1b\n\t" 1755 1756 : [io_port_var] "=m" (io_port_var) 1757 : /* no inputs*/ 1758 : "rdx", "rdi" 1759 ); 1760 } 1761 1762 static bool reg_corruption_finished(struct svm_test *test) 1763 { 1764 if (isr_cnt == 10000) { 1765 report_pass("No RIP corruption detected after %d timer interrupts", 1766 isr_cnt); 1767 set_test_stage(test, 1); 1768 goto cleanup; 1769 } 1770 1771 if (vmcb->control.exit_code == SVM_EXIT_INTR) { 1772 1773 void* guest_rip = (void*)vmcb->save.rip; 1774 1775 irq_enable(); 1776 asm volatile ("nop"); 1777 irq_disable(); 1778 1779 if (guest_rip == insb_instruction_label && io_port_var != 0xAA) { 1780 report_fail("RIP corruption detected after %d timer interrupts", 1781 isr_cnt); 1782 goto cleanup; 1783 } 1784 1785 } 1786 return false; 1787 cleanup: 1788 apic_write(APIC_LVTT, APIC_LVT_TIMER_MASK); 1789 apic_write(APIC_TMICT, 0); 1790 return true; 1791 1792 } 1793 1794 static bool reg_corruption_check(struct svm_test *test) 1795 { 1796 return get_test_stage(test) == 1; 1797 } 1798 1799 static void get_tss_entry(void *data) 1800 { 1801 *((gdt_entry_t **)data) = get_tss_descr(); 1802 } 1803 1804 static int orig_cpu_count; 1805 1806 static void init_startup_prepare(struct svm_test *test) 1807 { 1808 gdt_entry_t *tss_entry; 1809 int i; 1810 1811 on_cpu(1, get_tss_entry, &tss_entry); 1812 1813 orig_cpu_count = atomic_read(&cpu_online_count); 1814 1815 apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_INIT | APIC_INT_ASSERT, 1816 id_map[1]); 1817 1818 delay(100000000ULL); 1819 1820 atomic_dec(&cpu_online_count); 1821 1822 tss_entry->type &= ~DESC_BUSY; 1823 1824 apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_STARTUP, id_map[1]); 1825 1826 for (i = 0; i < 5 && atomic_read(&cpu_online_count) < orig_cpu_count; i++) 1827 delay(100000000ULL); 1828 } 1829 1830 static bool init_startup_finished(struct svm_test *test) 1831 { 1832 return true; 1833 } 1834 1835 static bool init_startup_check(struct svm_test *test) 1836 { 1837 return atomic_read(&cpu_online_count) == orig_cpu_count; 1838 } 1839 1840 static volatile bool init_intercept; 1841 1842 static void init_intercept_prepare(struct svm_test *test) 1843 { 1844 init_intercept = false; 1845 vmcb->control.intercept |= (1ULL << INTERCEPT_INIT); 1846 } 1847 1848 static void init_intercept_test(struct svm_test *test) 1849 { 1850 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_INIT | APIC_INT_ASSERT, 0); 1851 } 1852 1853 static bool init_intercept_finished(struct svm_test *test) 1854 { 1855 vmcb->save.rip += 3; 1856 1857 if (vmcb->control.exit_code != SVM_EXIT_INIT) { 1858 report_fail("VMEXIT not due to init intercept. Exit reason 0x%x", 1859 vmcb->control.exit_code); 1860 1861 return true; 1862 } 1863 1864 init_intercept = true; 1865 1866 report_pass("INIT to vcpu intercepted"); 1867 1868 return true; 1869 } 1870 1871 static bool init_intercept_check(struct svm_test *test) 1872 { 1873 return init_intercept; 1874 } 1875 1876 /* 1877 * Setting host EFLAGS.TF causes a #DB trap after the VMRUN completes on the 1878 * host side (i.e., after the #VMEXIT from the guest). 1879 * 1880 * Setting host EFLAGS.RF suppresses any potential instruction breakpoint 1881 * match on the VMRUN and completion of the VMRUN instruction clears the 1882 * host EFLAGS.RF bit. 1883 * 1884 * [AMD APM] 1885 */ 1886 static volatile u8 host_rflags_guest_main_flag = 0; 1887 static volatile u8 host_rflags_db_handler_flag = 0; 1888 static volatile bool host_rflags_ss_on_vmrun = false; 1889 static volatile bool host_rflags_vmrun_reached = false; 1890 static volatile bool host_rflags_set_tf = false; 1891 static volatile bool host_rflags_set_rf = false; 1892 static u64 rip_detected; 1893 1894 extern u64 *vmrun_rip; 1895 1896 static void host_rflags_db_handler(struct ex_regs *r) 1897 { 1898 if (host_rflags_ss_on_vmrun) { 1899 if (host_rflags_vmrun_reached) { 1900 if (!host_rflags_set_rf) { 1901 r->rflags &= ~X86_EFLAGS_TF; 1902 rip_detected = r->rip; 1903 } else { 1904 r->rflags |= X86_EFLAGS_RF; 1905 ++host_rflags_db_handler_flag; 1906 } 1907 } else { 1908 if (r->rip == (u64)&vmrun_rip) { 1909 host_rflags_vmrun_reached = true; 1910 1911 if (host_rflags_set_rf) { 1912 host_rflags_guest_main_flag = 0; 1913 rip_detected = r->rip; 1914 r->rflags &= ~X86_EFLAGS_TF; 1915 1916 /* Trigger #DB via debug registers */ 1917 write_dr0((void *)&vmrun_rip); 1918 write_dr7(0x403); 1919 } 1920 } 1921 } 1922 } else { 1923 r->rflags &= ~X86_EFLAGS_TF; 1924 } 1925 } 1926 1927 static void host_rflags_prepare(struct svm_test *test) 1928 { 1929 default_prepare(test); 1930 handle_exception(DB_VECTOR, host_rflags_db_handler); 1931 set_test_stage(test, 0); 1932 } 1933 1934 static void host_rflags_prepare_gif_clear(struct svm_test *test) 1935 { 1936 if (host_rflags_set_tf) 1937 write_rflags(read_rflags() | X86_EFLAGS_TF); 1938 } 1939 1940 static void host_rflags_test(struct svm_test *test) 1941 { 1942 while (1) { 1943 if (get_test_stage(test) > 0) { 1944 if ((host_rflags_set_tf && !host_rflags_ss_on_vmrun && !host_rflags_db_handler_flag) || 1945 (host_rflags_set_rf && host_rflags_db_handler_flag == 1)) 1946 host_rflags_guest_main_flag = 1; 1947 } 1948 1949 if (get_test_stage(test) == 4) 1950 break; 1951 vmmcall(); 1952 } 1953 } 1954 1955 static bool host_rflags_finished(struct svm_test *test) 1956 { 1957 switch (get_test_stage(test)) { 1958 case 0: 1959 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1960 report_fail("Unexpected VMEXIT. Exit reason 0x%x", 1961 vmcb->control.exit_code); 1962 return true; 1963 } 1964 vmcb->save.rip += 3; 1965 /* 1966 * Setting host EFLAGS.TF not immediately before VMRUN, causes 1967 * #DB trap before first guest instruction is executed 1968 */ 1969 host_rflags_set_tf = true; 1970 break; 1971 case 1: 1972 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL || 1973 host_rflags_guest_main_flag != 1) { 1974 report_fail("Unexpected VMEXIT or #DB handler" 1975 " invoked before guest main. Exit reason 0x%x", 1976 vmcb->control.exit_code); 1977 return true; 1978 } 1979 vmcb->save.rip += 3; 1980 /* 1981 * Setting host EFLAGS.TF immediately before VMRUN, causes #DB 1982 * trap after VMRUN completes on the host side (i.e., after 1983 * VMEXIT from guest). 1984 */ 1985 host_rflags_ss_on_vmrun = true; 1986 break; 1987 case 2: 1988 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL || 1989 rip_detected != (u64)&vmrun_rip + 3) { 1990 report_fail("Unexpected VMEXIT or RIP mismatch." 1991 " Exit reason 0x%x, RIP actual: %lx, RIP expected: " 1992 "%lx", vmcb->control.exit_code, 1993 (u64)&vmrun_rip + 3, rip_detected); 1994 return true; 1995 } 1996 host_rflags_set_rf = true; 1997 host_rflags_guest_main_flag = 0; 1998 host_rflags_vmrun_reached = false; 1999 vmcb->save.rip += 3; 2000 break; 2001 case 3: 2002 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL || 2003 rip_detected != (u64)&vmrun_rip || 2004 host_rflags_guest_main_flag != 1 || 2005 host_rflags_db_handler_flag > 1 || 2006 read_rflags() & X86_EFLAGS_RF) { 2007 report_fail("Unexpected VMEXIT or RIP mismatch or " 2008 "EFLAGS.RF not cleared." 2009 " Exit reason 0x%x, RIP actual: %lx, RIP expected: " 2010 "%lx", vmcb->control.exit_code, 2011 (u64)&vmrun_rip, rip_detected); 2012 return true; 2013 } 2014 host_rflags_set_tf = false; 2015 host_rflags_set_rf = false; 2016 vmcb->save.rip += 3; 2017 break; 2018 default: 2019 return true; 2020 } 2021 inc_test_stage(test); 2022 return get_test_stage(test) == 5; 2023 } 2024 2025 static bool host_rflags_check(struct svm_test *test) 2026 { 2027 return get_test_stage(test) == 4; 2028 } 2029 2030 #define TEST(name) { #name, .v2 = name } 2031 2032 /* 2033 * v2 tests 2034 */ 2035 2036 /* 2037 * Ensure that kvm recalculates the L1 guest's CPUID.01H:ECX.OSXSAVE 2038 * after VM-exit from an L2 guest that sets CR4.OSXSAVE to a different 2039 * value than in L1. 2040 */ 2041 2042 static void svm_cr4_osxsave_test_guest(struct svm_test *test) 2043 { 2044 write_cr4(read_cr4() & ~X86_CR4_OSXSAVE); 2045 } 2046 2047 static void svm_cr4_osxsave_test(void) 2048 { 2049 if (!this_cpu_has(X86_FEATURE_XSAVE)) { 2050 report_skip("XSAVE not detected"); 2051 return; 2052 } 2053 2054 if (!(read_cr4() & X86_CR4_OSXSAVE)) { 2055 unsigned long cr4 = read_cr4() | X86_CR4_OSXSAVE; 2056 2057 write_cr4(cr4); 2058 vmcb->save.cr4 = cr4; 2059 } 2060 2061 report(this_cpu_has(X86_FEATURE_OSXSAVE), "CPUID.01H:ECX.XSAVE set before VMRUN"); 2062 2063 test_set_guest(svm_cr4_osxsave_test_guest); 2064 report(svm_vmrun() == SVM_EXIT_VMMCALL, 2065 "svm_cr4_osxsave_test_guest finished with VMMCALL"); 2066 2067 report(this_cpu_has(X86_FEATURE_OSXSAVE), "CPUID.01H:ECX.XSAVE set after VMRUN"); 2068 } 2069 2070 static void basic_guest_main(struct svm_test *test) 2071 { 2072 } 2073 2074 2075 #define SVM_TEST_REG_RESERVED_BITS(start, end, inc, str_name, reg, val, \ 2076 resv_mask) \ 2077 { \ 2078 u64 tmp, mask; \ 2079 int i; \ 2080 \ 2081 for (i = start; i <= end; i = i + inc) { \ 2082 mask = 1ull << i; \ 2083 if (!(mask & resv_mask)) \ 2084 continue; \ 2085 tmp = val | mask; \ 2086 reg = tmp; \ 2087 report(svm_vmrun() == SVM_EXIT_ERR, "Test %s %d:%d: %lx", \ 2088 str_name, end, start, tmp); \ 2089 } \ 2090 } 2091 2092 #define SVM_TEST_CR_RESERVED_BITS(start, end, inc, cr, val, resv_mask, \ 2093 exit_code, test_name) \ 2094 { \ 2095 u64 tmp, mask; \ 2096 u32 r; \ 2097 int i; \ 2098 \ 2099 for (i = start; i <= end; i = i + inc) { \ 2100 mask = 1ull << i; \ 2101 if (!(mask & resv_mask)) \ 2102 continue; \ 2103 tmp = val | mask; \ 2104 switch (cr) { \ 2105 case 0: \ 2106 vmcb->save.cr0 = tmp; \ 2107 break; \ 2108 case 3: \ 2109 vmcb->save.cr3 = tmp; \ 2110 break; \ 2111 case 4: \ 2112 vmcb->save.cr4 = tmp; \ 2113 } \ 2114 r = svm_vmrun(); \ 2115 report(r == exit_code, "Test CR%d %s%d:%d: %lx, wanted exit 0x%x, got 0x%x", \ 2116 cr, test_name, end, start, tmp, exit_code, r); \ 2117 } \ 2118 } 2119 2120 static void test_efer(void) 2121 { 2122 /* 2123 * Un-setting EFER.SVME is illegal 2124 */ 2125 u64 efer_saved = vmcb->save.efer; 2126 u64 efer = efer_saved; 2127 2128 report (svm_vmrun() == SVM_EXIT_VMMCALL, "EFER.SVME: %lx", efer); 2129 efer &= ~EFER_SVME; 2130 vmcb->save.efer = efer; 2131 report (svm_vmrun() == SVM_EXIT_ERR, "EFER.SVME: %lx", efer); 2132 vmcb->save.efer = efer_saved; 2133 2134 /* 2135 * EFER MBZ bits: 63:16, 9 2136 */ 2137 efer_saved = vmcb->save.efer; 2138 2139 SVM_TEST_REG_RESERVED_BITS(8, 9, 1, "EFER", vmcb->save.efer, 2140 efer_saved, SVM_EFER_RESERVED_MASK); 2141 SVM_TEST_REG_RESERVED_BITS(16, 63, 4, "EFER", vmcb->save.efer, 2142 efer_saved, SVM_EFER_RESERVED_MASK); 2143 2144 /* 2145 * EFER.LME and CR0.PG are both set and CR4.PAE is zero. 2146 */ 2147 u64 cr0_saved = vmcb->save.cr0; 2148 u64 cr0; 2149 u64 cr4_saved = vmcb->save.cr4; 2150 u64 cr4; 2151 2152 efer = efer_saved | EFER_LME; 2153 vmcb->save.efer = efer; 2154 cr0 = cr0_saved | X86_CR0_PG | X86_CR0_PE; 2155 vmcb->save.cr0 = cr0; 2156 cr4 = cr4_saved & ~X86_CR4_PAE; 2157 vmcb->save.cr4 = cr4; 2158 report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), " 2159 "CR0.PG=1 (%lx) and CR4.PAE=0 (%lx)", efer, cr0, cr4); 2160 2161 /* 2162 * EFER.LME and CR0.PG are both set and CR0.PE is zero. 2163 * CR4.PAE needs to be set as we otherwise cannot 2164 * determine if CR4.PAE=0 or CR0.PE=0 triggered the 2165 * SVM_EXIT_ERR. 2166 */ 2167 cr4 = cr4_saved | X86_CR4_PAE; 2168 vmcb->save.cr4 = cr4; 2169 cr0 &= ~X86_CR0_PE; 2170 vmcb->save.cr0 = cr0; 2171 report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), " 2172 "CR0.PG=1 and CR0.PE=0 (%lx)", efer, cr0); 2173 2174 /* 2175 * EFER.LME, CR0.PG, CR4.PAE, CS.L, and CS.D are all non-zero. 2176 */ 2177 u32 cs_attrib_saved = vmcb->save.cs.attrib; 2178 u32 cs_attrib; 2179 2180 cr0 |= X86_CR0_PE; 2181 vmcb->save.cr0 = cr0; 2182 cs_attrib = cs_attrib_saved | SVM_SELECTOR_L_MASK | 2183 SVM_SELECTOR_DB_MASK; 2184 vmcb->save.cs.attrib = cs_attrib; 2185 report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), " 2186 "CR0.PG=1 (%lx), CR4.PAE=1 (%lx), CS.L=1 and CS.D=1 (%x)", 2187 efer, cr0, cr4, cs_attrib); 2188 2189 vmcb->save.cr0 = cr0_saved; 2190 vmcb->save.cr4 = cr4_saved; 2191 vmcb->save.efer = efer_saved; 2192 vmcb->save.cs.attrib = cs_attrib_saved; 2193 } 2194 2195 static void test_cr0(void) 2196 { 2197 /* 2198 * Un-setting CR0.CD and setting CR0.NW is illegal combination 2199 */ 2200 u64 cr0_saved = vmcb->save.cr0; 2201 u64 cr0 = cr0_saved; 2202 2203 cr0 |= X86_CR0_CD; 2204 cr0 &= ~X86_CR0_NW; 2205 vmcb->save.cr0 = cr0; 2206 report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=0: %lx", 2207 cr0); 2208 cr0 |= X86_CR0_NW; 2209 vmcb->save.cr0 = cr0; 2210 report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=1: %lx", 2211 cr0); 2212 cr0 &= ~X86_CR0_NW; 2213 cr0 &= ~X86_CR0_CD; 2214 vmcb->save.cr0 = cr0; 2215 report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=0,NW=0: %lx", 2216 cr0); 2217 cr0 |= X86_CR0_NW; 2218 vmcb->save.cr0 = cr0; 2219 report (svm_vmrun() == SVM_EXIT_ERR, "Test CR0 CD=0,NW=1: %lx", 2220 cr0); 2221 vmcb->save.cr0 = cr0_saved; 2222 2223 /* 2224 * CR0[63:32] are not zero 2225 */ 2226 cr0 = cr0_saved; 2227 2228 SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "CR0", vmcb->save.cr0, cr0_saved, 2229 SVM_CR0_RESERVED_MASK); 2230 vmcb->save.cr0 = cr0_saved; 2231 } 2232 2233 static void test_cr3(void) 2234 { 2235 /* 2236 * CR3 MBZ bits based on different modes: 2237 * [63:52] - long mode 2238 */ 2239 u64 cr3_saved = vmcb->save.cr3; 2240 2241 SVM_TEST_CR_RESERVED_BITS(0, 63, 1, 3, cr3_saved, 2242 SVM_CR3_LONG_MBZ_MASK, SVM_EXIT_ERR, ""); 2243 2244 vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_MBZ_MASK; 2245 report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx", 2246 vmcb->save.cr3); 2247 2248 /* 2249 * CR3 non-MBZ reserved bits based on different modes: 2250 * [11:5] [2:0] - long mode (PCIDE=0) 2251 * [2:0] - PAE legacy mode 2252 */ 2253 u64 cr4_saved = vmcb->save.cr4; 2254 u64 *pdpe = npt_get_pml4e(); 2255 2256 /* 2257 * Long mode 2258 */ 2259 if (this_cpu_has(X86_FEATURE_PCID)) { 2260 vmcb->save.cr4 = cr4_saved | X86_CR4_PCIDE; 2261 SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved, 2262 SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_VMMCALL, "(PCIDE=1) "); 2263 2264 vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_RESERVED_MASK; 2265 report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx", 2266 vmcb->save.cr3); 2267 } 2268 2269 vmcb->save.cr4 = cr4_saved & ~X86_CR4_PCIDE; 2270 2271 if (!npt_supported()) 2272 goto skip_npt_only; 2273 2274 /* Clear P (Present) bit in NPT in order to trigger #NPF */ 2275 pdpe[0] &= ~1ULL; 2276 2277 SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved, 2278 SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_NPF, "(PCIDE=0) "); 2279 2280 pdpe[0] |= 1ULL; 2281 vmcb->save.cr3 = cr3_saved; 2282 2283 /* 2284 * PAE legacy 2285 */ 2286 pdpe[0] &= ~1ULL; 2287 vmcb->save.cr4 = cr4_saved | X86_CR4_PAE; 2288 SVM_TEST_CR_RESERVED_BITS(0, 2, 1, 3, cr3_saved, 2289 SVM_CR3_PAE_LEGACY_RESERVED_MASK, SVM_EXIT_NPF, "(PAE) "); 2290 2291 pdpe[0] |= 1ULL; 2292 2293 skip_npt_only: 2294 vmcb->save.cr3 = cr3_saved; 2295 vmcb->save.cr4 = cr4_saved; 2296 } 2297 2298 /* Test CR4 MBZ bits based on legacy or long modes */ 2299 static void test_cr4(void) 2300 { 2301 u64 cr4_saved = vmcb->save.cr4; 2302 u64 efer_saved = vmcb->save.efer; 2303 u64 efer = efer_saved; 2304 2305 efer &= ~EFER_LME; 2306 vmcb->save.efer = efer; 2307 SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved, 2308 SVM_CR4_LEGACY_RESERVED_MASK, SVM_EXIT_ERR, ""); 2309 2310 efer |= EFER_LME; 2311 vmcb->save.efer = efer; 2312 SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved, 2313 SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR, ""); 2314 SVM_TEST_CR_RESERVED_BITS(32, 63, 4, 4, cr4_saved, 2315 SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR, ""); 2316 2317 vmcb->save.cr4 = cr4_saved; 2318 vmcb->save.efer = efer_saved; 2319 } 2320 2321 static void test_dr(void) 2322 { 2323 /* 2324 * DR6[63:32] and DR7[63:32] are MBZ 2325 */ 2326 u64 dr_saved = vmcb->save.dr6; 2327 2328 SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR6", vmcb->save.dr6, dr_saved, 2329 SVM_DR6_RESERVED_MASK); 2330 vmcb->save.dr6 = dr_saved; 2331 2332 dr_saved = vmcb->save.dr7; 2333 SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR7", vmcb->save.dr7, dr_saved, 2334 SVM_DR7_RESERVED_MASK); 2335 2336 vmcb->save.dr7 = dr_saved; 2337 } 2338 2339 /* TODO: verify if high 32-bits are sign- or zero-extended on bare metal */ 2340 #define TEST_BITMAP_ADDR(save_intercept, type, addr, exit_code, \ 2341 msg) { \ 2342 vmcb->control.intercept = saved_intercept | 1ULL << type; \ 2343 if (type == INTERCEPT_MSR_PROT) \ 2344 vmcb->control.msrpm_base_pa = addr; \ 2345 else \ 2346 vmcb->control.iopm_base_pa = addr; \ 2347 report(svm_vmrun() == exit_code, \ 2348 "Test %s address: %lx", msg, addr); \ 2349 } 2350 2351 /* 2352 * If the MSR or IOIO intercept table extends to a physical address that 2353 * is greater than or equal to the maximum supported physical address, the 2354 * guest state is illegal. 2355 * 2356 * The VMRUN instruction ignores the lower 12 bits of the address specified 2357 * in the VMCB. 2358 * 2359 * MSRPM spans 2 contiguous 4KB pages while IOPM spans 2 contiguous 4KB 2360 * pages + 1 byte. 2361 * 2362 * [APM vol 2] 2363 * 2364 * Note: Unallocated MSRPM addresses conforming to consistency checks, generate 2365 * #NPF. 2366 */ 2367 static void test_msrpm_iopm_bitmap_addrs(void) 2368 { 2369 u64 saved_intercept = vmcb->control.intercept; 2370 u64 addr_beyond_limit = 1ull << cpuid_maxphyaddr(); 2371 u64 addr = virt_to_phys(msr_bitmap) & (~((1ull << 12) - 1)); 2372 2373 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, 2374 addr_beyond_limit - 2 * PAGE_SIZE, SVM_EXIT_ERR, 2375 "MSRPM"); 2376 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, 2377 addr_beyond_limit - 2 * PAGE_SIZE + 1, SVM_EXIT_ERR, 2378 "MSRPM"); 2379 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, 2380 addr_beyond_limit - PAGE_SIZE, SVM_EXIT_ERR, 2381 "MSRPM"); 2382 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, addr, 2383 SVM_EXIT_VMMCALL, "MSRPM"); 2384 addr |= (1ull << 12) - 1; 2385 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, addr, 2386 SVM_EXIT_VMMCALL, "MSRPM"); 2387 2388 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2389 addr_beyond_limit - 4 * PAGE_SIZE, SVM_EXIT_VMMCALL, 2390 "IOPM"); 2391 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2392 addr_beyond_limit - 3 * PAGE_SIZE, SVM_EXIT_VMMCALL, 2393 "IOPM"); 2394 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2395 addr_beyond_limit - 2 * PAGE_SIZE - 2, SVM_EXIT_VMMCALL, 2396 "IOPM"); 2397 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2398 addr_beyond_limit - 2 * PAGE_SIZE, SVM_EXIT_ERR, 2399 "IOPM"); 2400 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2401 addr_beyond_limit - PAGE_SIZE, SVM_EXIT_ERR, 2402 "IOPM"); 2403 addr = virt_to_phys(io_bitmap) & (~((1ull << 11) - 1)); 2404 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, addr, 2405 SVM_EXIT_VMMCALL, "IOPM"); 2406 addr |= (1ull << 12) - 1; 2407 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, addr, 2408 SVM_EXIT_VMMCALL, "IOPM"); 2409 2410 vmcb->control.intercept = saved_intercept; 2411 } 2412 2413 /* 2414 * Unlike VMSAVE, VMRUN seems not to update the value of noncanonical 2415 * segment bases in the VMCB. However, VMENTRY succeeds as documented. 2416 */ 2417 #define TEST_CANONICAL_VMRUN(seg_base, msg) \ 2418 saved_addr = seg_base; \ 2419 seg_base = (seg_base & ((1ul << addr_limit) - 1)) | noncanonical_mask; \ 2420 return_value = svm_vmrun(); \ 2421 report(return_value == SVM_EXIT_VMMCALL, \ 2422 "Successful VMRUN with noncanonical %s.base", msg); \ 2423 seg_base = saved_addr; 2424 2425 2426 #define TEST_CANONICAL_VMLOAD(seg_base, msg) \ 2427 saved_addr = seg_base; \ 2428 seg_base = (seg_base & ((1ul << addr_limit) - 1)) | noncanonical_mask; \ 2429 asm volatile ("vmload %0" : : "a"(vmcb_phys) : "memory"); \ 2430 asm volatile ("vmsave %0" : : "a"(vmcb_phys) : "memory"); \ 2431 report(is_canonical(seg_base), \ 2432 "Test %s.base for canonical form: %lx", msg, seg_base); \ 2433 seg_base = saved_addr; 2434 2435 static void test_canonicalization(void) 2436 { 2437 u64 saved_addr; 2438 u64 return_value; 2439 u64 addr_limit; 2440 u64 vmcb_phys = virt_to_phys(vmcb); 2441 2442 addr_limit = (this_cpu_has(X86_FEATURE_LA57)) ? 57 : 48; 2443 u64 noncanonical_mask = NONCANONICAL & ~((1ul << addr_limit) - 1); 2444 2445 TEST_CANONICAL_VMLOAD(vmcb->save.fs.base, "FS"); 2446 TEST_CANONICAL_VMLOAD(vmcb->save.gs.base, "GS"); 2447 TEST_CANONICAL_VMLOAD(vmcb->save.ldtr.base, "LDTR"); 2448 TEST_CANONICAL_VMLOAD(vmcb->save.tr.base, "TR"); 2449 TEST_CANONICAL_VMLOAD(vmcb->save.kernel_gs_base, "KERNEL GS"); 2450 TEST_CANONICAL_VMRUN(vmcb->save.es.base, "ES"); 2451 TEST_CANONICAL_VMRUN(vmcb->save.cs.base, "CS"); 2452 TEST_CANONICAL_VMRUN(vmcb->save.ss.base, "SS"); 2453 TEST_CANONICAL_VMRUN(vmcb->save.ds.base, "DS"); 2454 TEST_CANONICAL_VMRUN(vmcb->save.gdtr.base, "GDTR"); 2455 TEST_CANONICAL_VMRUN(vmcb->save.idtr.base, "IDTR"); 2456 } 2457 2458 /* 2459 * When VMRUN loads a guest value of 1 in EFLAGS.TF, that value does not 2460 * cause a trace trap between the VMRUN and the first guest instruction, but 2461 * rather after completion of the first guest instruction. 2462 * 2463 * [APM vol 2] 2464 */ 2465 u64 guest_rflags_test_trap_rip; 2466 2467 static void guest_rflags_test_db_handler(struct ex_regs *r) 2468 { 2469 guest_rflags_test_trap_rip = r->rip; 2470 r->rflags &= ~X86_EFLAGS_TF; 2471 } 2472 2473 static void svm_guest_state_test(void) 2474 { 2475 test_set_guest(basic_guest_main); 2476 test_efer(); 2477 test_cr0(); 2478 test_cr3(); 2479 test_cr4(); 2480 test_dr(); 2481 test_msrpm_iopm_bitmap_addrs(); 2482 test_canonicalization(); 2483 } 2484 2485 extern void guest_rflags_test_guest(struct svm_test *test); 2486 extern u64 *insn2; 2487 extern u64 *guest_end; 2488 2489 asm("guest_rflags_test_guest:\n\t" 2490 "push %rbp\n\t" 2491 ".global insn2\n\t" 2492 "insn2:\n\t" 2493 "mov %rsp,%rbp\n\t" 2494 "vmmcall\n\t" 2495 "vmmcall\n\t" 2496 ".global guest_end\n\t" 2497 "guest_end:\n\t" 2498 "vmmcall\n\t" 2499 "pop %rbp\n\t" 2500 "ret"); 2501 2502 static void svm_test_singlestep(void) 2503 { 2504 handle_exception(DB_VECTOR, guest_rflags_test_db_handler); 2505 2506 /* 2507 * Trap expected after completion of first guest instruction 2508 */ 2509 vmcb->save.rflags |= X86_EFLAGS_TF; 2510 report (__svm_vmrun((u64)guest_rflags_test_guest) == SVM_EXIT_VMMCALL && 2511 guest_rflags_test_trap_rip == (u64)&insn2, 2512 "Test EFLAGS.TF on VMRUN: trap expected after completion of first guest instruction"); 2513 /* 2514 * No trap expected 2515 */ 2516 guest_rflags_test_trap_rip = 0; 2517 vmcb->save.rip += 3; 2518 vmcb->save.rflags |= X86_EFLAGS_TF; 2519 report (__svm_vmrun(vmcb->save.rip) == SVM_EXIT_VMMCALL && 2520 guest_rflags_test_trap_rip == 0, "Test EFLAGS.TF on VMRUN: trap not expected"); 2521 2522 /* 2523 * Let guest finish execution 2524 */ 2525 vmcb->save.rip += 3; 2526 report (__svm_vmrun(vmcb->save.rip) == SVM_EXIT_VMMCALL && 2527 vmcb->save.rip == (u64)&guest_end, "Test EFLAGS.TF on VMRUN: guest execution completion"); 2528 } 2529 2530 static bool volatile svm_errata_reproduced = false; 2531 static unsigned long volatile physical = 0; 2532 2533 2534 /* 2535 * 2536 * Test the following errata: 2537 * If the VMRUN/VMSAVE/VMLOAD are attempted by the nested guest, 2538 * the CPU would first check the EAX against host reserved memory 2539 * regions (so far only SMM_ADDR/SMM_MASK are known to cause it), 2540 * and only then signal #VMexit 2541 * 2542 * Try to reproduce this by trying vmsave on each possible 4K aligned memory 2543 * address in the low 4G where the SMM area has to reside. 2544 */ 2545 2546 static void gp_isr(struct ex_regs *r) 2547 { 2548 svm_errata_reproduced = true; 2549 /* skip over the vmsave instruction*/ 2550 r->rip += 3; 2551 } 2552 2553 static void svm_vmrun_errata_test(void) 2554 { 2555 unsigned long *last_page = NULL; 2556 2557 handle_exception(GP_VECTOR, gp_isr); 2558 2559 while (!svm_errata_reproduced) { 2560 2561 unsigned long *page = alloc_pages(1); 2562 2563 if (!page) { 2564 report_pass("All guest memory tested, no bug found"); 2565 break; 2566 } 2567 2568 physical = virt_to_phys(page); 2569 2570 asm volatile ( 2571 "mov %[_physical], %%rax\n\t" 2572 "vmsave %%rax\n\t" 2573 2574 : [_physical] "=m" (physical) 2575 : /* no inputs*/ 2576 : "rax" /*clobbers*/ 2577 ); 2578 2579 if (svm_errata_reproduced) { 2580 report_fail("Got #GP exception - svm errata reproduced at 0x%lx", 2581 physical); 2582 break; 2583 } 2584 2585 *page = (unsigned long)last_page; 2586 last_page = page; 2587 } 2588 2589 while (last_page) { 2590 unsigned long *page = last_page; 2591 last_page = (unsigned long *)*last_page; 2592 free_pages_by_order(page, 1); 2593 } 2594 } 2595 2596 static void vmload_vmsave_guest_main(struct svm_test *test) 2597 { 2598 u64 vmcb_phys = virt_to_phys(vmcb); 2599 2600 asm volatile ("vmload %0" : : "a"(vmcb_phys)); 2601 asm volatile ("vmsave %0" : : "a"(vmcb_phys)); 2602 } 2603 2604 static void svm_vmload_vmsave(void) 2605 { 2606 u32 intercept_saved = vmcb->control.intercept; 2607 2608 test_set_guest(vmload_vmsave_guest_main); 2609 2610 /* 2611 * Disabling intercept for VMLOAD and VMSAVE doesn't cause 2612 * respective #VMEXIT to host 2613 */ 2614 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD); 2615 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE); 2616 svm_vmrun(); 2617 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 2618 "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 2619 2620 /* 2621 * Enabling intercept for VMLOAD and VMSAVE causes respective 2622 * #VMEXIT to host 2623 */ 2624 vmcb->control.intercept |= (1ULL << INTERCEPT_VMLOAD); 2625 svm_vmrun(); 2626 report(vmcb->control.exit_code == SVM_EXIT_VMLOAD, "Test " 2627 "VMLOAD/VMSAVE intercept: Expected VMLOAD #VMEXIT"); 2628 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD); 2629 vmcb->control.intercept |= (1ULL << INTERCEPT_VMSAVE); 2630 svm_vmrun(); 2631 report(vmcb->control.exit_code == SVM_EXIT_VMSAVE, "Test " 2632 "VMLOAD/VMSAVE intercept: Expected VMSAVE #VMEXIT"); 2633 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE); 2634 svm_vmrun(); 2635 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 2636 "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 2637 2638 vmcb->control.intercept |= (1ULL << INTERCEPT_VMLOAD); 2639 svm_vmrun(); 2640 report(vmcb->control.exit_code == SVM_EXIT_VMLOAD, "Test " 2641 "VMLOAD/VMSAVE intercept: Expected VMLOAD #VMEXIT"); 2642 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD); 2643 svm_vmrun(); 2644 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 2645 "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 2646 2647 vmcb->control.intercept |= (1ULL << INTERCEPT_VMSAVE); 2648 svm_vmrun(); 2649 report(vmcb->control.exit_code == SVM_EXIT_VMSAVE, "Test " 2650 "VMLOAD/VMSAVE intercept: Expected VMSAVE #VMEXIT"); 2651 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE); 2652 svm_vmrun(); 2653 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 2654 "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 2655 2656 vmcb->control.intercept = intercept_saved; 2657 } 2658 2659 static void prepare_vgif_enabled(struct svm_test *test) 2660 { 2661 default_prepare(test); 2662 } 2663 2664 static void test_vgif(struct svm_test *test) 2665 { 2666 asm volatile ("vmmcall\n\tstgi\n\tvmmcall\n\tclgi\n\tvmmcall\n\t"); 2667 } 2668 2669 static bool vgif_finished(struct svm_test *test) 2670 { 2671 switch (get_test_stage(test)) 2672 { 2673 case 0: 2674 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2675 report_fail("VMEXIT not due to vmmcall."); 2676 return true; 2677 } 2678 vmcb->control.int_ctl |= V_GIF_ENABLED_MASK; 2679 vmcb->save.rip += 3; 2680 inc_test_stage(test); 2681 break; 2682 case 1: 2683 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2684 report_fail("VMEXIT not due to vmmcall."); 2685 return true; 2686 } 2687 if (!(vmcb->control.int_ctl & V_GIF_MASK)) { 2688 report_fail("Failed to set VGIF when executing STGI."); 2689 vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK; 2690 return true; 2691 } 2692 report_pass("STGI set VGIF bit."); 2693 vmcb->save.rip += 3; 2694 inc_test_stage(test); 2695 break; 2696 case 2: 2697 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2698 report_fail("VMEXIT not due to vmmcall."); 2699 return true; 2700 } 2701 if (vmcb->control.int_ctl & V_GIF_MASK) { 2702 report_fail("Failed to clear VGIF when executing CLGI."); 2703 vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK; 2704 return true; 2705 } 2706 report_pass("CLGI cleared VGIF bit."); 2707 vmcb->save.rip += 3; 2708 inc_test_stage(test); 2709 vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK; 2710 break; 2711 default: 2712 return true; 2713 break; 2714 } 2715 2716 return get_test_stage(test) == 3; 2717 } 2718 2719 static bool vgif_check(struct svm_test *test) 2720 { 2721 return get_test_stage(test) == 3; 2722 } 2723 2724 2725 static int pause_test_counter; 2726 static int wait_counter; 2727 2728 static void pause_filter_test_guest_main(struct svm_test *test) 2729 { 2730 int i; 2731 for (i = 0 ; i < pause_test_counter ; i++) 2732 pause(); 2733 2734 if (!wait_counter) 2735 return; 2736 2737 for (i = 0; i < wait_counter; i++) 2738 ; 2739 2740 for (i = 0 ; i < pause_test_counter ; i++) 2741 pause(); 2742 2743 } 2744 2745 static void pause_filter_run_test(int pause_iterations, int filter_value, int wait_iterations, int threshold) 2746 { 2747 test_set_guest(pause_filter_test_guest_main); 2748 2749 pause_test_counter = pause_iterations; 2750 wait_counter = wait_iterations; 2751 2752 vmcb->control.pause_filter_count = filter_value; 2753 vmcb->control.pause_filter_thresh = threshold; 2754 svm_vmrun(); 2755 2756 if (filter_value <= pause_iterations || wait_iterations < threshold) 2757 report(vmcb->control.exit_code == SVM_EXIT_PAUSE, "expected PAUSE vmexit"); 2758 else 2759 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "no expected PAUSE vmexit"); 2760 } 2761 2762 static void pause_filter_test(void) 2763 { 2764 if (!pause_filter_supported()) { 2765 report_skip("PAUSE filter not supported in the guest"); 2766 return; 2767 } 2768 2769 vmcb->control.intercept |= (1 << INTERCEPT_PAUSE); 2770 2771 // filter count more that pause count - no VMexit 2772 pause_filter_run_test(10, 9, 0, 0); 2773 2774 // filter count smaller pause count - no VMexit 2775 pause_filter_run_test(20, 21, 0, 0); 2776 2777 2778 if (pause_threshold_supported()) { 2779 // filter count smaller pause count - no VMexit + large enough threshold 2780 // so that filter counter resets 2781 pause_filter_run_test(20, 21, 1000, 10); 2782 2783 // filter count smaller pause count - no VMexit + small threshold 2784 // so that filter doesn't reset 2785 pause_filter_run_test(20, 21, 10, 1000); 2786 } else { 2787 report_skip("PAUSE threshold not supported in the guest"); 2788 return; 2789 } 2790 } 2791 2792 /* If CR0.TS and CR0.EM are cleared in L2, no #NM is generated. */ 2793 static void svm_no_nm_test(void) 2794 { 2795 write_cr0(read_cr0() & ~X86_CR0_TS); 2796 test_set_guest((test_guest_func)fnop); 2797 2798 vmcb->save.cr0 = vmcb->save.cr0 & ~(X86_CR0_TS | X86_CR0_EM); 2799 report(svm_vmrun() == SVM_EXIT_VMMCALL, 2800 "fnop with CR0.TS and CR0.EM unset no #NM excpetion"); 2801 } 2802 2803 static u64 amd_get_lbr_rip(u32 msr) 2804 { 2805 return rdmsr(msr) & ~AMD_LBR_RECORD_MISPREDICT; 2806 } 2807 2808 #define HOST_CHECK_LBR(from_expected, to_expected) \ 2809 do { \ 2810 TEST_EXPECT_EQ((u64)from_expected, amd_get_lbr_rip(MSR_IA32_LASTBRANCHFROMIP)); \ 2811 TEST_EXPECT_EQ((u64)to_expected, amd_get_lbr_rip(MSR_IA32_LASTBRANCHTOIP)); \ 2812 } while (0) 2813 2814 /* 2815 * FIXME: Do something other than generate an exception to communicate failure. 2816 * Debugging without expected vs. actual is an absolute nightmare. 2817 */ 2818 #define GUEST_CHECK_LBR(from_expected, to_expected) \ 2819 do { \ 2820 if ((u64)(from_expected) != amd_get_lbr_rip(MSR_IA32_LASTBRANCHFROMIP)) \ 2821 asm volatile("ud2"); \ 2822 if ((u64)(to_expected) != amd_get_lbr_rip(MSR_IA32_LASTBRANCHTOIP)) \ 2823 asm volatile("ud2"); \ 2824 } while (0) 2825 2826 #define REPORT_GUEST_LBR_ERROR(vmcb) \ 2827 report(false, "LBR guest test failed. Exit reason 0x%x, RIP = %lx, from = %lx, to = %lx, ex from = %lx, ex to = %lx", \ 2828 vmcb->control.exit_code, vmcb->save.rip, \ 2829 vmcb->save.br_from, vmcb->save.br_to, \ 2830 vmcb->save.last_excp_from, vmcb->save.last_excp_to) 2831 2832 #define DO_BRANCH(branch_name) \ 2833 asm volatile ( \ 2834 # branch_name "_from:" \ 2835 "jmp " # branch_name "_to\n" \ 2836 "nop\n" \ 2837 "nop\n" \ 2838 # branch_name "_to:" \ 2839 "nop\n" \ 2840 ) 2841 2842 2843 extern u64 guest_branch0_from, guest_branch0_to; 2844 extern u64 guest_branch2_from, guest_branch2_to; 2845 2846 extern u64 host_branch0_from, host_branch0_to; 2847 extern u64 host_branch2_from, host_branch2_to; 2848 extern u64 host_branch3_from, host_branch3_to; 2849 extern u64 host_branch4_from, host_branch4_to; 2850 2851 u64 dbgctl; 2852 2853 static void svm_lbrv_test_guest1(void) 2854 { 2855 /* 2856 * This guest expects the LBR to be already enabled when it starts, 2857 * it does a branch, and then disables the LBR and then checks. 2858 */ 2859 2860 DO_BRANCH(guest_branch0); 2861 2862 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2863 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2864 2865 if (dbgctl != DEBUGCTLMSR_LBR) 2866 asm volatile("ud2\n"); 2867 if (rdmsr(MSR_IA32_DEBUGCTLMSR) != 0) 2868 asm volatile("ud2\n"); 2869 2870 GUEST_CHECK_LBR(&guest_branch0_from, &guest_branch0_to); 2871 asm volatile ("vmmcall\n"); 2872 } 2873 2874 static void svm_lbrv_test_guest2(void) 2875 { 2876 /* 2877 * This guest expects the LBR to be disabled when it starts, 2878 * enables it, does a branch, disables it and then checks. 2879 */ 2880 2881 DO_BRANCH(guest_branch1); 2882 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2883 2884 if (dbgctl != 0) 2885 asm volatile("ud2\n"); 2886 2887 GUEST_CHECK_LBR(&host_branch2_from, &host_branch2_to); 2888 2889 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2890 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2891 DO_BRANCH(guest_branch2); 2892 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2893 2894 if (dbgctl != DEBUGCTLMSR_LBR) 2895 asm volatile("ud2\n"); 2896 GUEST_CHECK_LBR(&guest_branch2_from, &guest_branch2_to); 2897 2898 asm volatile ("vmmcall\n"); 2899 } 2900 2901 static void svm_lbrv_test0(void) 2902 { 2903 report(true, "Basic LBR test"); 2904 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2905 DO_BRANCH(host_branch0); 2906 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2907 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2908 2909 TEST_EXPECT_EQ(dbgctl, DEBUGCTLMSR_LBR); 2910 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2911 TEST_EXPECT_EQ(dbgctl, 0); 2912 2913 HOST_CHECK_LBR(&host_branch0_from, &host_branch0_to); 2914 } 2915 2916 static void svm_lbrv_test1(void) 2917 { 2918 report(true, "Test that without LBRV enabled, guest LBR state does 'leak' to the host(1)"); 2919 2920 svm_setup_vmrun((u64)svm_lbrv_test_guest1); 2921 vmcb->control.virt_ext = 0; 2922 2923 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2924 DO_BRANCH(host_branch1); 2925 SVM_BARE_VMRUN; 2926 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2927 2928 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2929 REPORT_GUEST_LBR_ERROR(vmcb); 2930 return; 2931 } 2932 2933 TEST_EXPECT_EQ(dbgctl, 0); 2934 HOST_CHECK_LBR(&guest_branch0_from, &guest_branch0_to); 2935 } 2936 2937 static void svm_lbrv_test2(void) 2938 { 2939 report(true, "Test that without LBRV enabled, guest LBR state does 'leak' to the host(2)"); 2940 2941 svm_setup_vmrun((u64)svm_lbrv_test_guest2); 2942 vmcb->control.virt_ext = 0; 2943 2944 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2945 DO_BRANCH(host_branch2); 2946 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2947 SVM_BARE_VMRUN; 2948 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2949 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2950 2951 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2952 REPORT_GUEST_LBR_ERROR(vmcb); 2953 return; 2954 } 2955 2956 TEST_EXPECT_EQ(dbgctl, 0); 2957 HOST_CHECK_LBR(&guest_branch2_from, &guest_branch2_to); 2958 } 2959 2960 static void svm_lbrv_nested_test1(void) 2961 { 2962 if (!lbrv_supported()) { 2963 report_skip("LBRV not supported in the guest"); 2964 return; 2965 } 2966 2967 report(true, "Test that with LBRV enabled, guest LBR state doesn't leak (1)"); 2968 svm_setup_vmrun((u64)svm_lbrv_test_guest1); 2969 vmcb->control.virt_ext = LBR_CTL_ENABLE_MASK; 2970 vmcb->save.dbgctl = DEBUGCTLMSR_LBR; 2971 2972 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2973 DO_BRANCH(host_branch3); 2974 SVM_BARE_VMRUN; 2975 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2976 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2977 2978 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2979 REPORT_GUEST_LBR_ERROR(vmcb); 2980 return; 2981 } 2982 2983 if (vmcb->save.dbgctl != 0) { 2984 report(false, "unexpected virtual guest MSR_IA32_DEBUGCTLMSR value 0x%lx", vmcb->save.dbgctl); 2985 return; 2986 } 2987 2988 TEST_EXPECT_EQ(dbgctl, DEBUGCTLMSR_LBR); 2989 HOST_CHECK_LBR(&host_branch3_from, &host_branch3_to); 2990 } 2991 2992 static void svm_lbrv_nested_test2(void) 2993 { 2994 if (!lbrv_supported()) { 2995 report_skip("LBRV not supported in the guest"); 2996 return; 2997 } 2998 2999 report(true, "Test that with LBRV enabled, guest LBR state doesn't leak (2)"); 3000 svm_setup_vmrun((u64)svm_lbrv_test_guest2); 3001 vmcb->control.virt_ext = LBR_CTL_ENABLE_MASK; 3002 3003 vmcb->save.dbgctl = 0; 3004 vmcb->save.br_from = (u64)&host_branch2_from; 3005 vmcb->save.br_to = (u64)&host_branch2_to; 3006 3007 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 3008 DO_BRANCH(host_branch4); 3009 SVM_BARE_VMRUN; 3010 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 3011 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 3012 3013 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 3014 REPORT_GUEST_LBR_ERROR(vmcb); 3015 return; 3016 } 3017 3018 TEST_EXPECT_EQ(dbgctl, DEBUGCTLMSR_LBR); 3019 HOST_CHECK_LBR(&host_branch4_from, &host_branch4_to); 3020 } 3021 3022 3023 // test that a nested guest which does enable INTR interception 3024 // but doesn't enable virtual interrupt masking works 3025 3026 static volatile int dummy_isr_recevied; 3027 static void dummy_isr(isr_regs_t *regs) 3028 { 3029 dummy_isr_recevied++; 3030 eoi(); 3031 } 3032 3033 3034 static volatile int nmi_recevied; 3035 static void dummy_nmi_handler(struct ex_regs *regs) 3036 { 3037 nmi_recevied++; 3038 } 3039 3040 3041 static void svm_intr_intercept_mix_run_guest(volatile int *counter, int expected_vmexit) 3042 { 3043 if (counter) 3044 *counter = 0; 3045 3046 sti(); // host IF value should not matter 3047 clgi(); // vmrun will set back GI to 1 3048 3049 svm_vmrun(); 3050 3051 if (counter) 3052 report(!*counter, "No interrupt expected"); 3053 3054 stgi(); 3055 3056 if (counter) 3057 report(*counter == 1, "Interrupt is expected"); 3058 3059 report (vmcb->control.exit_code == expected_vmexit, "Test expected VM exit"); 3060 report(vmcb->save.rflags & X86_EFLAGS_IF, "Guest should have EFLAGS.IF set now"); 3061 cli(); 3062 } 3063 3064 3065 // subtest: test that enabling EFLAGS.IF is enought to trigger an interrupt 3066 static void svm_intr_intercept_mix_if_guest(struct svm_test *test) 3067 { 3068 asm volatile("nop;nop;nop;nop"); 3069 report(!dummy_isr_recevied, "No interrupt expected"); 3070 sti(); 3071 asm volatile("nop"); 3072 report(0, "must not reach here"); 3073 } 3074 3075 static void svm_intr_intercept_mix_if(void) 3076 { 3077 // make a physical interrupt to be pending 3078 handle_irq(0x55, dummy_isr); 3079 3080 vmcb->control.intercept |= (1 << INTERCEPT_INTR); 3081 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3082 vmcb->save.rflags &= ~X86_EFLAGS_IF; 3083 3084 test_set_guest(svm_intr_intercept_mix_if_guest); 3085 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0); 3086 svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR); 3087 } 3088 3089 3090 // subtest: test that a clever guest can trigger an interrupt by setting GIF 3091 // if GIF is not intercepted 3092 static void svm_intr_intercept_mix_gif_guest(struct svm_test *test) 3093 { 3094 3095 asm volatile("nop;nop;nop;nop"); 3096 report(!dummy_isr_recevied, "No interrupt expected"); 3097 3098 // clear GIF and enable IF 3099 // that should still not cause VM exit 3100 clgi(); 3101 sti(); 3102 asm volatile("nop"); 3103 report(!dummy_isr_recevied, "No interrupt expected"); 3104 3105 stgi(); 3106 asm volatile("nop"); 3107 report(0, "must not reach here"); 3108 } 3109 3110 static void svm_intr_intercept_mix_gif(void) 3111 { 3112 handle_irq(0x55, dummy_isr); 3113 3114 vmcb->control.intercept |= (1 << INTERCEPT_INTR); 3115 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3116 vmcb->save.rflags &= ~X86_EFLAGS_IF; 3117 3118 test_set_guest(svm_intr_intercept_mix_gif_guest); 3119 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0); 3120 svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR); 3121 } 3122 3123 // subtest: test that a clever guest can trigger an interrupt by setting GIF 3124 // if GIF is not intercepted and interrupt comes after guest 3125 // started running 3126 static void svm_intr_intercept_mix_gif_guest2(struct svm_test *test) 3127 { 3128 asm volatile("nop;nop;nop;nop"); 3129 report(!dummy_isr_recevied, "No interrupt expected"); 3130 3131 clgi(); 3132 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0); 3133 report(!dummy_isr_recevied, "No interrupt expected"); 3134 3135 stgi(); 3136 asm volatile("nop"); 3137 report(0, "must not reach here"); 3138 } 3139 3140 static void svm_intr_intercept_mix_gif2(void) 3141 { 3142 handle_irq(0x55, dummy_isr); 3143 3144 vmcb->control.intercept |= (1 << INTERCEPT_INTR); 3145 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3146 vmcb->save.rflags |= X86_EFLAGS_IF; 3147 3148 test_set_guest(svm_intr_intercept_mix_gif_guest2); 3149 svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR); 3150 } 3151 3152 3153 // subtest: test that pending NMI will be handled when guest enables GIF 3154 static void svm_intr_intercept_mix_nmi_guest(struct svm_test *test) 3155 { 3156 asm volatile("nop;nop;nop;nop"); 3157 report(!nmi_recevied, "No NMI expected"); 3158 cli(); // should have no effect 3159 3160 clgi(); 3161 asm volatile("nop"); 3162 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI, 0); 3163 sti(); // should have no effect 3164 asm volatile("nop"); 3165 report(!nmi_recevied, "No NMI expected"); 3166 3167 stgi(); 3168 asm volatile("nop"); 3169 report(0, "must not reach here"); 3170 } 3171 3172 static void svm_intr_intercept_mix_nmi(void) 3173 { 3174 handle_exception(2, dummy_nmi_handler); 3175 3176 vmcb->control.intercept |= (1 << INTERCEPT_NMI); 3177 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3178 vmcb->save.rflags |= X86_EFLAGS_IF; 3179 3180 test_set_guest(svm_intr_intercept_mix_nmi_guest); 3181 svm_intr_intercept_mix_run_guest(&nmi_recevied, SVM_EXIT_NMI); 3182 } 3183 3184 // test that pending SMI will be handled when guest enables GIF 3185 // TODO: can't really count #SMIs so just test that guest doesn't hang 3186 // and VMexits on SMI 3187 static void svm_intr_intercept_mix_smi_guest(struct svm_test *test) 3188 { 3189 asm volatile("nop;nop;nop;nop"); 3190 3191 clgi(); 3192 asm volatile("nop"); 3193 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_SMI, 0); 3194 sti(); // should have no effect 3195 asm volatile("nop"); 3196 stgi(); 3197 asm volatile("nop"); 3198 report(0, "must not reach here"); 3199 } 3200 3201 static void svm_intr_intercept_mix_smi(void) 3202 { 3203 vmcb->control.intercept |= (1 << INTERCEPT_SMI); 3204 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3205 test_set_guest(svm_intr_intercept_mix_smi_guest); 3206 svm_intr_intercept_mix_run_guest(NULL, SVM_EXIT_SMI); 3207 } 3208 3209 static void svm_l2_ac_test(void) 3210 { 3211 bool hit_ac = false; 3212 3213 write_cr0(read_cr0() | X86_CR0_AM); 3214 write_rflags(read_rflags() | X86_EFLAGS_AC); 3215 3216 run_in_user(generate_usermode_ac, AC_VECTOR, 0, 0, 0, 0, &hit_ac); 3217 report(hit_ac, "Usermode #AC handled in L2"); 3218 vmmcall(); 3219 } 3220 3221 struct svm_exception_test { 3222 u8 vector; 3223 void (*guest_code)(void); 3224 }; 3225 3226 struct svm_exception_test svm_exception_tests[] = { 3227 { GP_VECTOR, generate_non_canonical_gp }, 3228 { UD_VECTOR, generate_ud }, 3229 { DE_VECTOR, generate_de }, 3230 { DB_VECTOR, generate_single_step_db }, 3231 { BP_VECTOR, generate_bp }, 3232 { AC_VECTOR, svm_l2_ac_test }, 3233 { OF_VECTOR, generate_of }, 3234 { NM_VECTOR, generate_cr0_ts_nm }, 3235 { NM_VECTOR, generate_cr0_em_nm }, 3236 }; 3237 3238 static u8 svm_exception_test_vector; 3239 3240 static void svm_exception_handler(struct ex_regs *regs) 3241 { 3242 report(regs->vector == svm_exception_test_vector, 3243 "Handling %s in L2's exception handler", 3244 exception_mnemonic(svm_exception_test_vector)); 3245 vmmcall(); 3246 } 3247 3248 static void handle_exception_in_l2(u8 vector) 3249 { 3250 handler old_handler = handle_exception(vector, svm_exception_handler); 3251 svm_exception_test_vector = vector; 3252 3253 report(svm_vmrun() == SVM_EXIT_VMMCALL, 3254 "%s handled by L2", exception_mnemonic(vector)); 3255 3256 handle_exception(vector, old_handler); 3257 } 3258 3259 static void handle_exception_in_l1(u32 vector) 3260 { 3261 u32 old_ie = vmcb->control.intercept_exceptions; 3262 3263 vmcb->control.intercept_exceptions |= (1ULL << vector); 3264 3265 report(svm_vmrun() == (SVM_EXIT_EXCP_BASE + vector), 3266 "%s handled by L1", exception_mnemonic(vector)); 3267 3268 vmcb->control.intercept_exceptions = old_ie; 3269 } 3270 3271 static void svm_exception_test(void) 3272 { 3273 struct svm_exception_test *t; 3274 int i; 3275 3276 for (i = 0; i < ARRAY_SIZE(svm_exception_tests); i++) { 3277 t = &svm_exception_tests[i]; 3278 test_set_guest((test_guest_func)t->guest_code); 3279 3280 handle_exception_in_l2(t->vector); 3281 vmcb_ident(vmcb); 3282 3283 handle_exception_in_l1(t->vector); 3284 vmcb_ident(vmcb); 3285 } 3286 } 3287 3288 struct svm_test svm_tests[] = { 3289 { "null", default_supported, default_prepare, 3290 default_prepare_gif_clear, null_test, 3291 default_finished, null_check }, 3292 { "vmrun", default_supported, default_prepare, 3293 default_prepare_gif_clear, test_vmrun, 3294 default_finished, check_vmrun }, 3295 { "ioio", default_supported, prepare_ioio, 3296 default_prepare_gif_clear, test_ioio, 3297 ioio_finished, check_ioio }, 3298 { "vmrun intercept check", default_supported, prepare_no_vmrun_int, 3299 default_prepare_gif_clear, null_test, default_finished, 3300 check_no_vmrun_int }, 3301 { "rsm", default_supported, 3302 prepare_rsm_intercept, default_prepare_gif_clear, 3303 test_rsm_intercept, finished_rsm_intercept, check_rsm_intercept }, 3304 { "cr3 read intercept", default_supported, 3305 prepare_cr3_intercept, default_prepare_gif_clear, 3306 test_cr3_intercept, default_finished, check_cr3_intercept }, 3307 { "cr3 read nointercept", default_supported, default_prepare, 3308 default_prepare_gif_clear, test_cr3_intercept, default_finished, 3309 check_cr3_nointercept }, 3310 { "cr3 read intercept emulate", smp_supported, 3311 prepare_cr3_intercept_bypass, default_prepare_gif_clear, 3312 test_cr3_intercept_bypass, default_finished, check_cr3_intercept }, 3313 { "dr intercept check", default_supported, prepare_dr_intercept, 3314 default_prepare_gif_clear, test_dr_intercept, dr_intercept_finished, 3315 check_dr_intercept }, 3316 { "next_rip", next_rip_supported, prepare_next_rip, 3317 default_prepare_gif_clear, test_next_rip, 3318 default_finished, check_next_rip }, 3319 { "msr intercept check", default_supported, prepare_msr_intercept, 3320 default_prepare_gif_clear, test_msr_intercept, 3321 msr_intercept_finished, check_msr_intercept }, 3322 { "mode_switch", default_supported, prepare_mode_switch, 3323 default_prepare_gif_clear, test_mode_switch, 3324 mode_switch_finished, check_mode_switch }, 3325 { "asid_zero", default_supported, prepare_asid_zero, 3326 default_prepare_gif_clear, test_asid_zero, 3327 default_finished, check_asid_zero }, 3328 { "sel_cr0_bug", default_supported, sel_cr0_bug_prepare, 3329 default_prepare_gif_clear, sel_cr0_bug_test, 3330 sel_cr0_bug_finished, sel_cr0_bug_check }, 3331 { "tsc_adjust", tsc_adjust_supported, tsc_adjust_prepare, 3332 default_prepare_gif_clear, tsc_adjust_test, 3333 default_finished, tsc_adjust_check }, 3334 { "latency_run_exit", default_supported, latency_prepare, 3335 default_prepare_gif_clear, latency_test, 3336 latency_finished, latency_check }, 3337 { "latency_run_exit_clean", default_supported, latency_prepare, 3338 default_prepare_gif_clear, latency_test, 3339 latency_finished_clean, latency_check }, 3340 { "latency_svm_insn", default_supported, lat_svm_insn_prepare, 3341 default_prepare_gif_clear, null_test, 3342 lat_svm_insn_finished, lat_svm_insn_check }, 3343 { "exc_inject", default_supported, exc_inject_prepare, 3344 default_prepare_gif_clear, exc_inject_test, 3345 exc_inject_finished, exc_inject_check }, 3346 { "pending_event", default_supported, pending_event_prepare, 3347 default_prepare_gif_clear, 3348 pending_event_test, pending_event_finished, pending_event_check }, 3349 { "pending_event_cli", default_supported, pending_event_cli_prepare, 3350 pending_event_cli_prepare_gif_clear, 3351 pending_event_cli_test, pending_event_cli_finished, 3352 pending_event_cli_check }, 3353 { "interrupt", default_supported, interrupt_prepare, 3354 default_prepare_gif_clear, interrupt_test, 3355 interrupt_finished, interrupt_check }, 3356 { "nmi", default_supported, nmi_prepare, 3357 default_prepare_gif_clear, nmi_test, 3358 nmi_finished, nmi_check }, 3359 { "nmi_hlt", smp_supported, nmi_prepare, 3360 default_prepare_gif_clear, nmi_hlt_test, 3361 nmi_hlt_finished, nmi_hlt_check }, 3362 { "vnmi", vnmi_supported, vnmi_prepare, 3363 default_prepare_gif_clear, vnmi_test, 3364 vnmi_finished, vnmi_check }, 3365 { "virq_inject", default_supported, virq_inject_prepare, 3366 default_prepare_gif_clear, virq_inject_test, 3367 virq_inject_finished, virq_inject_check }, 3368 { "reg_corruption", default_supported, reg_corruption_prepare, 3369 default_prepare_gif_clear, reg_corruption_test, 3370 reg_corruption_finished, reg_corruption_check }, 3371 { "svm_init_startup_test", smp_supported, init_startup_prepare, 3372 default_prepare_gif_clear, null_test, 3373 init_startup_finished, init_startup_check }, 3374 { "svm_init_intercept_test", smp_supported, init_intercept_prepare, 3375 default_prepare_gif_clear, init_intercept_test, 3376 init_intercept_finished, init_intercept_check, .on_vcpu = 2 }, 3377 { "host_rflags", default_supported, host_rflags_prepare, 3378 host_rflags_prepare_gif_clear, host_rflags_test, 3379 host_rflags_finished, host_rflags_check }, 3380 { "vgif", vgif_supported, prepare_vgif_enabled, 3381 default_prepare_gif_clear, test_vgif, vgif_finished, 3382 vgif_check }, 3383 TEST(svm_cr4_osxsave_test), 3384 TEST(svm_guest_state_test), 3385 TEST(svm_vmrun_errata_test), 3386 TEST(svm_vmload_vmsave), 3387 TEST(svm_test_singlestep), 3388 TEST(svm_no_nm_test), 3389 TEST(svm_exception_test), 3390 TEST(svm_lbrv_test0), 3391 TEST(svm_lbrv_test1), 3392 TEST(svm_lbrv_test2), 3393 TEST(svm_lbrv_nested_test1), 3394 TEST(svm_lbrv_nested_test2), 3395 TEST(svm_intr_intercept_mix_if), 3396 TEST(svm_intr_intercept_mix_gif), 3397 TEST(svm_intr_intercept_mix_gif2), 3398 TEST(svm_intr_intercept_mix_nmi), 3399 TEST(svm_intr_intercept_mix_smi), 3400 TEST(svm_tsc_scale_test), 3401 TEST(pause_filter_test), 3402 { NULL, NULL, NULL, NULL, NULL, NULL, NULL } 3403 }; 3404 3405 int main(int ac, char **av) 3406 { 3407 setup_vm(); 3408 return run_svm_tests(ac, av, svm_tests); 3409 } 3410