1 #include "svm.h" 2 #include "libcflat.h" 3 #include "processor.h" 4 #include "desc.h" 5 #include "msr.h" 6 #include "vm.h" 7 #include "smp.h" 8 #include "alloc_page.h" 9 #include "isr.h" 10 #include "apic.h" 11 #include "delay.h" 12 #include "util.h" 13 #include "x86/usermode.h" 14 #include "vmalloc.h" 15 16 #define SVM_EXIT_MAX_DR_INTERCEPT 0x3f 17 18 #define LATENCY_RUNS 1000000 19 20 u64 tsc_start; 21 u64 tsc_end; 22 23 u64 vmrun_sum, vmexit_sum; 24 u64 vmsave_sum, vmload_sum; 25 u64 stgi_sum, clgi_sum; 26 u64 latvmrun_max; 27 u64 latvmrun_min; 28 u64 latvmexit_max; 29 u64 latvmexit_min; 30 u64 latvmload_max; 31 u64 latvmload_min; 32 u64 latvmsave_max; 33 u64 latvmsave_min; 34 u64 latstgi_max; 35 u64 latstgi_min; 36 u64 latclgi_max; 37 u64 latclgi_min; 38 u64 runs; 39 40 static void null_test(struct svm_test *test) 41 { 42 } 43 44 static bool null_check(struct svm_test *test) 45 { 46 return vmcb->control.exit_code == SVM_EXIT_VMMCALL; 47 } 48 49 static void prepare_no_vmrun_int(struct svm_test *test) 50 { 51 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMRUN); 52 } 53 54 static bool check_no_vmrun_int(struct svm_test *test) 55 { 56 return vmcb->control.exit_code == SVM_EXIT_ERR; 57 } 58 59 static void test_vmrun(struct svm_test *test) 60 { 61 asm volatile ("vmrun %0" : : "a"(virt_to_phys(vmcb))); 62 } 63 64 static bool check_vmrun(struct svm_test *test) 65 { 66 return vmcb->control.exit_code == SVM_EXIT_VMRUN; 67 } 68 69 static void prepare_rsm_intercept(struct svm_test *test) 70 { 71 default_prepare(test); 72 vmcb->control.intercept |= 1 << INTERCEPT_RSM; 73 vmcb->control.intercept_exceptions |= (1ULL << UD_VECTOR); 74 } 75 76 static void test_rsm_intercept(struct svm_test *test) 77 { 78 asm volatile ("rsm" : : : "memory"); 79 } 80 81 static bool check_rsm_intercept(struct svm_test *test) 82 { 83 return get_test_stage(test) == 2; 84 } 85 86 static bool finished_rsm_intercept(struct svm_test *test) 87 { 88 switch (get_test_stage(test)) { 89 case 0: 90 if (vmcb->control.exit_code != SVM_EXIT_RSM) { 91 report_fail("VMEXIT not due to rsm. Exit reason 0x%x", 92 vmcb->control.exit_code); 93 return true; 94 } 95 vmcb->control.intercept &= ~(1 << INTERCEPT_RSM); 96 inc_test_stage(test); 97 break; 98 99 case 1: 100 if (vmcb->control.exit_code != SVM_EXIT_EXCP_BASE + UD_VECTOR) { 101 report_fail("VMEXIT not due to #UD. Exit reason 0x%x", 102 vmcb->control.exit_code); 103 return true; 104 } 105 vmcb->save.rip += 2; 106 inc_test_stage(test); 107 break; 108 109 default: 110 return true; 111 } 112 return get_test_stage(test) == 2; 113 } 114 115 static void prepare_cr3_intercept(struct svm_test *test) 116 { 117 default_prepare(test); 118 vmcb->control.intercept_cr_read |= 1 << 3; 119 } 120 121 static void test_cr3_intercept(struct svm_test *test) 122 { 123 asm volatile ("mov %%cr3, %0" : "=r"(test->scratch) : : "memory"); 124 } 125 126 static bool check_cr3_intercept(struct svm_test *test) 127 { 128 return vmcb->control.exit_code == SVM_EXIT_READ_CR3; 129 } 130 131 static bool check_cr3_nointercept(struct svm_test *test) 132 { 133 return null_check(test) && test->scratch == read_cr3(); 134 } 135 136 static void corrupt_cr3_intercept_bypass(void *_test) 137 { 138 struct svm_test *test = _test; 139 extern volatile u32 mmio_insn; 140 141 while (!__sync_bool_compare_and_swap(&test->scratch, 1, 2)) 142 pause(); 143 pause(); 144 pause(); 145 pause(); 146 mmio_insn = 0x90d8200f; // mov %cr3, %rax; nop 147 } 148 149 static void prepare_cr3_intercept_bypass(struct svm_test *test) 150 { 151 default_prepare(test); 152 vmcb->control.intercept_cr_read |= 1 << 3; 153 on_cpu_async(1, corrupt_cr3_intercept_bypass, test); 154 } 155 156 static void test_cr3_intercept_bypass(struct svm_test *test) 157 { 158 ulong a = 0xa0000; 159 160 test->scratch = 1; 161 while (test->scratch != 2) 162 barrier(); 163 164 asm volatile ("mmio_insn: mov %0, (%0); nop" 165 : "+a"(a) : : "memory"); 166 test->scratch = a; 167 } 168 169 static void prepare_dr_intercept(struct svm_test *test) 170 { 171 default_prepare(test); 172 vmcb->control.intercept_dr_read = 0xff; 173 vmcb->control.intercept_dr_write = 0xff; 174 } 175 176 static void test_dr_intercept(struct svm_test *test) 177 { 178 unsigned int i, failcnt = 0; 179 180 /* Loop testing debug register reads */ 181 for (i = 0; i < 8; i++) { 182 183 switch (i) { 184 case 0: 185 asm volatile ("mov %%dr0, %0" : "=r"(test->scratch) : : "memory"); 186 break; 187 case 1: 188 asm volatile ("mov %%dr1, %0" : "=r"(test->scratch) : : "memory"); 189 break; 190 case 2: 191 asm volatile ("mov %%dr2, %0" : "=r"(test->scratch) : : "memory"); 192 break; 193 case 3: 194 asm volatile ("mov %%dr3, %0" : "=r"(test->scratch) : : "memory"); 195 break; 196 case 4: 197 asm volatile ("mov %%dr4, %0" : "=r"(test->scratch) : : "memory"); 198 break; 199 case 5: 200 asm volatile ("mov %%dr5, %0" : "=r"(test->scratch) : : "memory"); 201 break; 202 case 6: 203 asm volatile ("mov %%dr6, %0" : "=r"(test->scratch) : : "memory"); 204 break; 205 case 7: 206 asm volatile ("mov %%dr7, %0" : "=r"(test->scratch) : : "memory"); 207 break; 208 } 209 210 if (test->scratch != i) { 211 report_fail("dr%u read intercept", i); 212 failcnt++; 213 } 214 } 215 216 /* Loop testing debug register writes */ 217 for (i = 0; i < 8; i++) { 218 219 switch (i) { 220 case 0: 221 asm volatile ("mov %0, %%dr0" : : "r"(test->scratch) : "memory"); 222 break; 223 case 1: 224 asm volatile ("mov %0, %%dr1" : : "r"(test->scratch) : "memory"); 225 break; 226 case 2: 227 asm volatile ("mov %0, %%dr2" : : "r"(test->scratch) : "memory"); 228 break; 229 case 3: 230 asm volatile ("mov %0, %%dr3" : : "r"(test->scratch) : "memory"); 231 break; 232 case 4: 233 asm volatile ("mov %0, %%dr4" : : "r"(test->scratch) : "memory"); 234 break; 235 case 5: 236 asm volatile ("mov %0, %%dr5" : : "r"(test->scratch) : "memory"); 237 break; 238 case 6: 239 asm volatile ("mov %0, %%dr6" : : "r"(test->scratch) : "memory"); 240 break; 241 case 7: 242 asm volatile ("mov %0, %%dr7" : : "r"(test->scratch) : "memory"); 243 break; 244 } 245 246 if (test->scratch != i) { 247 report_fail("dr%u write intercept", i); 248 failcnt++; 249 } 250 } 251 252 test->scratch = failcnt; 253 } 254 255 static bool dr_intercept_finished(struct svm_test *test) 256 { 257 ulong n = (vmcb->control.exit_code - SVM_EXIT_READ_DR0); 258 259 /* Only expect DR intercepts */ 260 if (n > (SVM_EXIT_MAX_DR_INTERCEPT - SVM_EXIT_READ_DR0)) 261 return true; 262 263 /* 264 * Compute debug register number. 265 * Per Appendix C "SVM Intercept Exit Codes" of AMD64 Architecture 266 * Programmer's Manual Volume 2 - System Programming: 267 * http://support.amd.com/TechDocs/24593.pdf 268 * there are 16 VMEXIT codes each for DR read and write. 269 */ 270 test->scratch = (n % 16); 271 272 /* Jump over MOV instruction */ 273 vmcb->save.rip += 3; 274 275 return false; 276 } 277 278 static bool check_dr_intercept(struct svm_test *test) 279 { 280 return !test->scratch; 281 } 282 283 static bool next_rip_supported(void) 284 { 285 return this_cpu_has(X86_FEATURE_NRIPS); 286 } 287 288 static void prepare_next_rip(struct svm_test *test) 289 { 290 vmcb->control.intercept |= (1ULL << INTERCEPT_RDTSC); 291 } 292 293 294 static void test_next_rip(struct svm_test *test) 295 { 296 asm volatile ("rdtsc\n\t" 297 ".globl exp_next_rip\n\t" 298 "exp_next_rip:\n\t" ::: "eax", "edx"); 299 } 300 301 static bool check_next_rip(struct svm_test *test) 302 { 303 extern char exp_next_rip; 304 unsigned long address = (unsigned long)&exp_next_rip; 305 306 return address == vmcb->control.next_rip; 307 } 308 309 extern u8 *msr_bitmap; 310 311 static void prepare_msr_intercept(struct svm_test *test) 312 { 313 default_prepare(test); 314 vmcb->control.intercept |= (1ULL << INTERCEPT_MSR_PROT); 315 vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR); 316 memset(msr_bitmap, 0xff, MSR_BITMAP_SIZE); 317 } 318 319 static void test_msr_intercept(struct svm_test *test) 320 { 321 unsigned long msr_value = 0xef8056791234abcd; /* Arbitrary value */ 322 unsigned long msr_index; 323 324 for (msr_index = 0; msr_index <= 0xc0011fff; msr_index++) { 325 if (msr_index == 0xC0010131 /* MSR_SEV_STATUS */) { 326 /* 327 * Per section 15.34.10 "SEV_STATUS MSR" of AMD64 Architecture 328 * Programmer's Manual volume 2 - System Programming: 329 * http://support.amd.com/TechDocs/24593.pdf 330 * SEV_STATUS MSR (C001_0131) is a non-interceptable MSR. 331 */ 332 continue; 333 } 334 335 /* Skips gaps between supported MSR ranges */ 336 if (msr_index == 0x2000) 337 msr_index = 0xc0000000; 338 else if (msr_index == 0xc0002000) 339 msr_index = 0xc0010000; 340 341 test->scratch = -1; 342 343 rdmsr(msr_index); 344 345 /* Check that a read intercept occurred for MSR at msr_index */ 346 if (test->scratch != msr_index) 347 report_fail("MSR 0x%lx read intercept", msr_index); 348 349 /* 350 * Poor man approach to generate a value that 351 * seems arbitrary each time around the loop. 352 */ 353 msr_value += (msr_value << 1); 354 355 wrmsr(msr_index, msr_value); 356 357 /* Check that a write intercept occurred for MSR with msr_value */ 358 if (test->scratch != msr_value) 359 report_fail("MSR 0x%lx write intercept", msr_index); 360 } 361 362 test->scratch = -2; 363 } 364 365 static bool msr_intercept_finished(struct svm_test *test) 366 { 367 u32 exit_code = vmcb->control.exit_code; 368 u64 exit_info_1; 369 u8 *opcode; 370 371 if (exit_code == SVM_EXIT_MSR) { 372 exit_info_1 = vmcb->control.exit_info_1; 373 } else { 374 /* 375 * If #GP exception occurs instead, check that it was 376 * for RDMSR/WRMSR and set exit_info_1 accordingly. 377 */ 378 379 if (exit_code != (SVM_EXIT_EXCP_BASE + GP_VECTOR)) 380 return true; 381 382 opcode = (u8 *)vmcb->save.rip; 383 if (opcode[0] != 0x0f) 384 return true; 385 386 switch (opcode[1]) { 387 case 0x30: /* WRMSR */ 388 exit_info_1 = 1; 389 break; 390 case 0x32: /* RDMSR */ 391 exit_info_1 = 0; 392 break; 393 default: 394 return true; 395 } 396 397 /* 398 * Warn that #GP exception occurred instead. 399 * RCX holds the MSR index. 400 */ 401 printf("%s 0x%lx #GP exception\n", 402 exit_info_1 ? "WRMSR" : "RDMSR", get_regs().rcx); 403 } 404 405 /* Jump over RDMSR/WRMSR instruction */ 406 vmcb->save.rip += 2; 407 408 /* 409 * Test whether the intercept was for RDMSR/WRMSR. 410 * For RDMSR, test->scratch is set to the MSR index; 411 * RCX holds the MSR index. 412 * For WRMSR, test->scratch is set to the MSR value; 413 * RDX holds the upper 32 bits of the MSR value, 414 * while RAX hold its lower 32 bits. 415 */ 416 if (exit_info_1) 417 test->scratch = 418 ((get_regs().rdx << 32) | (vmcb->save.rax & 0xffffffff)); 419 else 420 test->scratch = get_regs().rcx; 421 422 return false; 423 } 424 425 static bool check_msr_intercept(struct svm_test *test) 426 { 427 memset(msr_bitmap, 0, MSR_BITMAP_SIZE); 428 return (test->scratch == -2); 429 } 430 431 static void prepare_mode_switch(struct svm_test *test) 432 { 433 vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR) 434 | (1ULL << UD_VECTOR) 435 | (1ULL << DF_VECTOR) 436 | (1ULL << PF_VECTOR); 437 test->scratch = 0; 438 } 439 440 static void test_mode_switch(struct svm_test *test) 441 { 442 asm volatile(" cli\n" 443 " ljmp *1f\n" /* jump to 32-bit code segment */ 444 "1:\n" 445 " .long 2f\n" 446 " .long " xstr(KERNEL_CS32) "\n" 447 ".code32\n" 448 "2:\n" 449 " movl %%cr0, %%eax\n" 450 " btcl $31, %%eax\n" /* clear PG */ 451 " movl %%eax, %%cr0\n" 452 " movl $0xc0000080, %%ecx\n" /* EFER */ 453 " rdmsr\n" 454 " btcl $8, %%eax\n" /* clear LME */ 455 " wrmsr\n" 456 " movl %%cr4, %%eax\n" 457 " btcl $5, %%eax\n" /* clear PAE */ 458 " movl %%eax, %%cr4\n" 459 " movw %[ds16], %%ax\n" 460 " movw %%ax, %%ds\n" 461 " ljmpl %[cs16], $3f\n" /* jump to 16 bit protected-mode */ 462 ".code16\n" 463 "3:\n" 464 " movl %%cr0, %%eax\n" 465 " btcl $0, %%eax\n" /* clear PE */ 466 " movl %%eax, %%cr0\n" 467 " ljmpl $0, $4f\n" /* jump to real-mode */ 468 "4:\n" 469 " vmmcall\n" 470 " movl %%cr0, %%eax\n" 471 " btsl $0, %%eax\n" /* set PE */ 472 " movl %%eax, %%cr0\n" 473 " ljmpl %[cs32], $5f\n" /* back to protected mode */ 474 ".code32\n" 475 "5:\n" 476 " movl %%cr4, %%eax\n" 477 " btsl $5, %%eax\n" /* set PAE */ 478 " movl %%eax, %%cr4\n" 479 " movl $0xc0000080, %%ecx\n" /* EFER */ 480 " rdmsr\n" 481 " btsl $8, %%eax\n" /* set LME */ 482 " wrmsr\n" 483 " movl %%cr0, %%eax\n" 484 " btsl $31, %%eax\n" /* set PG */ 485 " movl %%eax, %%cr0\n" 486 " ljmpl %[cs64], $6f\n" /* back to long mode */ 487 ".code64\n\t" 488 "6:\n" 489 " vmmcall\n" 490 :: [cs16] "i"(KERNEL_CS16), [ds16] "i"(KERNEL_DS16), 491 [cs32] "i"(KERNEL_CS32), [cs64] "i"(KERNEL_CS64) 492 : "rax", "rbx", "rcx", "rdx", "memory"); 493 } 494 495 static bool mode_switch_finished(struct svm_test *test) 496 { 497 u64 cr0, cr4, efer; 498 499 cr0 = vmcb->save.cr0; 500 cr4 = vmcb->save.cr4; 501 efer = vmcb->save.efer; 502 503 /* Only expect VMMCALL intercepts */ 504 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) 505 return true; 506 507 /* Jump over VMMCALL instruction */ 508 vmcb->save.rip += 3; 509 510 /* Do sanity checks */ 511 switch (test->scratch) { 512 case 0: 513 /* Test should be in real mode now - check for this */ 514 if ((cr0 & 0x80000001) || /* CR0.PG, CR0.PE */ 515 (cr4 & 0x00000020) || /* CR4.PAE */ 516 (efer & 0x00000500)) /* EFER.LMA, EFER.LME */ 517 return true; 518 break; 519 case 2: 520 /* Test should be back in long-mode now - check for this */ 521 if (((cr0 & 0x80000001) != 0x80000001) || /* CR0.PG, CR0.PE */ 522 ((cr4 & 0x00000020) != 0x00000020) || /* CR4.PAE */ 523 ((efer & 0x00000500) != 0x00000500)) /* EFER.LMA, EFER.LME */ 524 return true; 525 break; 526 } 527 528 /* one step forward */ 529 test->scratch += 1; 530 531 return test->scratch == 2; 532 } 533 534 static bool check_mode_switch(struct svm_test *test) 535 { 536 return test->scratch == 2; 537 } 538 539 extern u8 *io_bitmap; 540 541 static void prepare_ioio(struct svm_test *test) 542 { 543 vmcb->control.intercept |= (1ULL << INTERCEPT_IOIO_PROT); 544 test->scratch = 0; 545 memset(io_bitmap, 0, 8192); 546 io_bitmap[8192] = 0xFF; 547 } 548 549 static void test_ioio(struct svm_test *test) 550 { 551 // stage 0, test IO pass 552 inb(0x5000); 553 outb(0x0, 0x5000); 554 if (get_test_stage(test) != 0) 555 goto fail; 556 557 // test IO width, in/out 558 io_bitmap[0] = 0xFF; 559 inc_test_stage(test); 560 inb(0x0); 561 if (get_test_stage(test) != 2) 562 goto fail; 563 564 outw(0x0, 0x0); 565 if (get_test_stage(test) != 3) 566 goto fail; 567 568 inl(0x0); 569 if (get_test_stage(test) != 4) 570 goto fail; 571 572 // test low/high IO port 573 io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8)); 574 inb(0x5000); 575 if (get_test_stage(test) != 5) 576 goto fail; 577 578 io_bitmap[0x9000 / 8] = (1 << (0x9000 % 8)); 579 inw(0x9000); 580 if (get_test_stage(test) != 6) 581 goto fail; 582 583 // test partial pass 584 io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8)); 585 inl(0x4FFF); 586 if (get_test_stage(test) != 7) 587 goto fail; 588 589 // test across pages 590 inc_test_stage(test); 591 inl(0x7FFF); 592 if (get_test_stage(test) != 8) 593 goto fail; 594 595 inc_test_stage(test); 596 io_bitmap[0x8000 / 8] = 1 << (0x8000 % 8); 597 inl(0x7FFF); 598 if (get_test_stage(test) != 10) 599 goto fail; 600 601 io_bitmap[0] = 0; 602 inl(0xFFFF); 603 if (get_test_stage(test) != 11) 604 goto fail; 605 606 io_bitmap[0] = 0xFF; 607 io_bitmap[8192] = 0; 608 inl(0xFFFF); 609 inc_test_stage(test); 610 if (get_test_stage(test) != 12) 611 goto fail; 612 613 return; 614 615 fail: 616 report_fail("stage %d", get_test_stage(test)); 617 test->scratch = -1; 618 } 619 620 static bool ioio_finished(struct svm_test *test) 621 { 622 unsigned port, size; 623 624 /* Only expect IOIO intercepts */ 625 if (vmcb->control.exit_code == SVM_EXIT_VMMCALL) 626 return true; 627 628 if (vmcb->control.exit_code != SVM_EXIT_IOIO) 629 return true; 630 631 /* one step forward */ 632 test->scratch += 1; 633 634 port = vmcb->control.exit_info_1 >> 16; 635 size = (vmcb->control.exit_info_1 >> SVM_IOIO_SIZE_SHIFT) & 7; 636 637 while (size--) { 638 io_bitmap[port / 8] &= ~(1 << (port & 7)); 639 port++; 640 } 641 642 return false; 643 } 644 645 static bool check_ioio(struct svm_test *test) 646 { 647 memset(io_bitmap, 0, 8193); 648 return test->scratch != -1; 649 } 650 651 static void prepare_asid_zero(struct svm_test *test) 652 { 653 vmcb->control.asid = 0; 654 } 655 656 static void test_asid_zero(struct svm_test *test) 657 { 658 asm volatile ("vmmcall\n\t"); 659 } 660 661 static bool check_asid_zero(struct svm_test *test) 662 { 663 return vmcb->control.exit_code == SVM_EXIT_ERR; 664 } 665 666 static void sel_cr0_bug_prepare(struct svm_test *test) 667 { 668 vmcb->control.intercept |= (1ULL << INTERCEPT_SELECTIVE_CR0); 669 } 670 671 static bool sel_cr0_bug_finished(struct svm_test *test) 672 { 673 return true; 674 } 675 676 static void sel_cr0_bug_test(struct svm_test *test) 677 { 678 unsigned long cr0; 679 680 /* read cr0, clear CD, and write back */ 681 cr0 = read_cr0(); 682 cr0 |= (1UL << 30); 683 write_cr0(cr0); 684 685 /* 686 * If we are here the test failed, not sure what to do now because we 687 * are not in guest-mode anymore so we can't trigger an intercept. 688 * Trigger a tripple-fault for now. 689 */ 690 report_fail("sel_cr0 test. Can not recover from this - exiting"); 691 exit(report_summary()); 692 } 693 694 static bool sel_cr0_bug_check(struct svm_test *test) 695 { 696 return vmcb->control.exit_code == SVM_EXIT_CR0_SEL_WRITE; 697 } 698 699 #define TSC_ADJUST_VALUE (1ll << 32) 700 #define TSC_OFFSET_VALUE (~0ull << 48) 701 static bool ok; 702 703 static bool tsc_adjust_supported(void) 704 { 705 return this_cpu_has(X86_FEATURE_TSC_ADJUST); 706 } 707 708 static void tsc_adjust_prepare(struct svm_test *test) 709 { 710 default_prepare(test); 711 vmcb->control.tsc_offset = TSC_OFFSET_VALUE; 712 713 wrmsr(MSR_IA32_TSC_ADJUST, -TSC_ADJUST_VALUE); 714 int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST); 715 ok = adjust == -TSC_ADJUST_VALUE; 716 } 717 718 static void tsc_adjust_test(struct svm_test *test) 719 { 720 int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST); 721 ok &= adjust == -TSC_ADJUST_VALUE; 722 723 uint64_t l1_tsc = rdtsc() - TSC_OFFSET_VALUE; 724 wrmsr(MSR_IA32_TSC, l1_tsc - TSC_ADJUST_VALUE); 725 726 adjust = rdmsr(MSR_IA32_TSC_ADJUST); 727 ok &= adjust <= -2 * TSC_ADJUST_VALUE; 728 729 uint64_t l1_tsc_end = rdtsc() - TSC_OFFSET_VALUE; 730 ok &= (l1_tsc_end + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE; 731 732 uint64_t l1_tsc_msr = rdmsr(MSR_IA32_TSC) - TSC_OFFSET_VALUE; 733 ok &= (l1_tsc_msr + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE; 734 } 735 736 static bool tsc_adjust_check(struct svm_test *test) 737 { 738 int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST); 739 740 wrmsr(MSR_IA32_TSC_ADJUST, 0); 741 return ok && adjust <= -2 * TSC_ADJUST_VALUE; 742 } 743 744 745 static u64 guest_tsc_delay_value; 746 /* number of bits to shift tsc right for stable result */ 747 #define TSC_SHIFT 24 748 #define TSC_SCALE_ITERATIONS 10 749 750 static void svm_tsc_scale_guest(struct svm_test *test) 751 { 752 u64 start_tsc = rdtsc(); 753 754 while (rdtsc() - start_tsc < guest_tsc_delay_value) 755 cpu_relax(); 756 } 757 758 static void svm_tsc_scale_run_testcase(u64 duration, 759 double tsc_scale, u64 tsc_offset) 760 { 761 u64 start_tsc, actual_duration; 762 763 guest_tsc_delay_value = (duration << TSC_SHIFT) * tsc_scale; 764 765 test_set_guest(svm_tsc_scale_guest); 766 vmcb->control.tsc_offset = tsc_offset; 767 wrmsr(MSR_AMD64_TSC_RATIO, (u64)(tsc_scale * (1ULL << 32))); 768 769 start_tsc = rdtsc(); 770 771 if (svm_vmrun() != SVM_EXIT_VMMCALL) 772 report_fail("unexpected vm exit code 0x%x", vmcb->control.exit_code); 773 774 actual_duration = (rdtsc() - start_tsc) >> TSC_SHIFT; 775 776 report(duration == actual_duration, "tsc delay (expected: %lu, actual: %lu)", 777 duration, actual_duration); 778 } 779 780 static void svm_tsc_scale_test(void) 781 { 782 int i; 783 784 if (!tsc_scale_supported()) { 785 report_skip("TSC scale not supported in the guest"); 786 return; 787 } 788 789 report(rdmsr(MSR_AMD64_TSC_RATIO) == TSC_RATIO_DEFAULT, 790 "initial TSC scale ratio"); 791 792 for (i = 0 ; i < TSC_SCALE_ITERATIONS; i++) { 793 794 double tsc_scale = (double)(rdrand() % 100 + 1) / 10; 795 int duration = rdrand() % 50 + 1; 796 u64 tsc_offset = rdrand(); 797 798 report_info("duration=%d, tsc_scale=%d, tsc_offset=%ld", 799 duration, (int)(tsc_scale * 100), tsc_offset); 800 801 svm_tsc_scale_run_testcase(duration, tsc_scale, tsc_offset); 802 } 803 804 svm_tsc_scale_run_testcase(50, 255, rdrand()); 805 svm_tsc_scale_run_testcase(50, 0.0001, rdrand()); 806 } 807 808 static void latency_prepare(struct svm_test *test) 809 { 810 default_prepare(test); 811 runs = LATENCY_RUNS; 812 latvmrun_min = latvmexit_min = -1ULL; 813 latvmrun_max = latvmexit_max = 0; 814 vmrun_sum = vmexit_sum = 0; 815 tsc_start = rdtsc(); 816 } 817 818 static void latency_test(struct svm_test *test) 819 { 820 u64 cycles; 821 822 start: 823 tsc_end = rdtsc(); 824 825 cycles = tsc_end - tsc_start; 826 827 if (cycles > latvmrun_max) 828 latvmrun_max = cycles; 829 830 if (cycles < latvmrun_min) 831 latvmrun_min = cycles; 832 833 vmrun_sum += cycles; 834 835 tsc_start = rdtsc(); 836 837 asm volatile ("vmmcall" : : : "memory"); 838 goto start; 839 } 840 841 static bool latency_finished(struct svm_test *test) 842 { 843 u64 cycles; 844 845 tsc_end = rdtsc(); 846 847 cycles = tsc_end - tsc_start; 848 849 if (cycles > latvmexit_max) 850 latvmexit_max = cycles; 851 852 if (cycles < latvmexit_min) 853 latvmexit_min = cycles; 854 855 vmexit_sum += cycles; 856 857 vmcb->save.rip += 3; 858 859 runs -= 1; 860 861 tsc_end = rdtsc(); 862 863 return runs == 0; 864 } 865 866 static bool latency_finished_clean(struct svm_test *test) 867 { 868 vmcb->control.clean = VMCB_CLEAN_ALL; 869 return latency_finished(test); 870 } 871 872 static bool latency_check(struct svm_test *test) 873 { 874 printf(" Latency VMRUN : max: %ld min: %ld avg: %ld\n", latvmrun_max, 875 latvmrun_min, vmrun_sum / LATENCY_RUNS); 876 printf(" Latency VMEXIT: max: %ld min: %ld avg: %ld\n", latvmexit_max, 877 latvmexit_min, vmexit_sum / LATENCY_RUNS); 878 return true; 879 } 880 881 static void lat_svm_insn_prepare(struct svm_test *test) 882 { 883 default_prepare(test); 884 runs = LATENCY_RUNS; 885 latvmload_min = latvmsave_min = latstgi_min = latclgi_min = -1ULL; 886 latvmload_max = latvmsave_max = latstgi_max = latclgi_max = 0; 887 vmload_sum = vmsave_sum = stgi_sum = clgi_sum; 888 } 889 890 static bool lat_svm_insn_finished(struct svm_test *test) 891 { 892 u64 vmcb_phys = virt_to_phys(vmcb); 893 u64 cycles; 894 895 for ( ; runs != 0; runs--) { 896 tsc_start = rdtsc(); 897 asm volatile("vmload %0\n\t" : : "a"(vmcb_phys) : "memory"); 898 cycles = rdtsc() - tsc_start; 899 if (cycles > latvmload_max) 900 latvmload_max = cycles; 901 if (cycles < latvmload_min) 902 latvmload_min = cycles; 903 vmload_sum += cycles; 904 905 tsc_start = rdtsc(); 906 asm volatile("vmsave %0\n\t" : : "a"(vmcb_phys) : "memory"); 907 cycles = rdtsc() - tsc_start; 908 if (cycles > latvmsave_max) 909 latvmsave_max = cycles; 910 if (cycles < latvmsave_min) 911 latvmsave_min = cycles; 912 vmsave_sum += cycles; 913 914 tsc_start = rdtsc(); 915 asm volatile("stgi\n\t"); 916 cycles = rdtsc() - tsc_start; 917 if (cycles > latstgi_max) 918 latstgi_max = cycles; 919 if (cycles < latstgi_min) 920 latstgi_min = cycles; 921 stgi_sum += cycles; 922 923 tsc_start = rdtsc(); 924 asm volatile("clgi\n\t"); 925 cycles = rdtsc() - tsc_start; 926 if (cycles > latclgi_max) 927 latclgi_max = cycles; 928 if (cycles < latclgi_min) 929 latclgi_min = cycles; 930 clgi_sum += cycles; 931 } 932 933 tsc_end = rdtsc(); 934 935 return true; 936 } 937 938 static bool lat_svm_insn_check(struct svm_test *test) 939 { 940 printf(" Latency VMLOAD: max: %ld min: %ld avg: %ld\n", latvmload_max, 941 latvmload_min, vmload_sum / LATENCY_RUNS); 942 printf(" Latency VMSAVE: max: %ld min: %ld avg: %ld\n", latvmsave_max, 943 latvmsave_min, vmsave_sum / LATENCY_RUNS); 944 printf(" Latency STGI: max: %ld min: %ld avg: %ld\n", latstgi_max, 945 latstgi_min, stgi_sum / LATENCY_RUNS); 946 printf(" Latency CLGI: max: %ld min: %ld avg: %ld\n", latclgi_max, 947 latclgi_min, clgi_sum / LATENCY_RUNS); 948 return true; 949 } 950 951 /* 952 * Report failures from SVM guest code, and on failure, set the stage to -1 and 953 * do VMMCALL to terminate the test (host side must treat -1 as "finished"). 954 * TODO: fix the tests that don't play nice with a straight report, e.g. the 955 * V_TPR test fails if report() is invoked. 956 */ 957 #define report_svm_guest(cond, test, fmt, args...) \ 958 do { \ 959 if (!(cond)) { \ 960 report_fail(fmt, ##args); \ 961 set_test_stage(test, -1); \ 962 vmmcall(); \ 963 } \ 964 } while (0) 965 966 bool pending_event_ipi_fired; 967 bool pending_event_guest_run; 968 969 static void pending_event_ipi_isr(isr_regs_t *regs) 970 { 971 pending_event_ipi_fired = true; 972 eoi(); 973 } 974 975 static void pending_event_prepare(struct svm_test *test) 976 { 977 int ipi_vector = 0xf1; 978 979 default_prepare(test); 980 981 pending_event_ipi_fired = false; 982 983 handle_irq(ipi_vector, pending_event_ipi_isr); 984 985 pending_event_guest_run = false; 986 987 vmcb->control.intercept |= (1ULL << INTERCEPT_INTR); 988 vmcb->control.int_ctl |= V_INTR_MASKING_MASK; 989 990 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | 991 APIC_DM_FIXED | ipi_vector, 0); 992 993 set_test_stage(test, 0); 994 } 995 996 static void pending_event_test(struct svm_test *test) 997 { 998 pending_event_guest_run = true; 999 } 1000 1001 static bool pending_event_finished(struct svm_test *test) 1002 { 1003 switch (get_test_stage(test)) { 1004 case 0: 1005 if (vmcb->control.exit_code != SVM_EXIT_INTR) { 1006 report_fail("VMEXIT not due to pending interrupt. Exit reason 0x%x", 1007 vmcb->control.exit_code); 1008 return true; 1009 } 1010 1011 vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR); 1012 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 1013 1014 if (pending_event_guest_run) { 1015 report_fail("Guest ran before host received IPI\n"); 1016 return true; 1017 } 1018 1019 sti_nop_cli(); 1020 1021 if (!pending_event_ipi_fired) { 1022 report_fail("Pending interrupt not dispatched after IRQ enabled\n"); 1023 return true; 1024 } 1025 break; 1026 1027 case 1: 1028 if (!pending_event_guest_run) { 1029 report_fail("Guest did not resume when no interrupt\n"); 1030 return true; 1031 } 1032 break; 1033 } 1034 1035 inc_test_stage(test); 1036 1037 return get_test_stage(test) == 2; 1038 } 1039 1040 static bool pending_event_check(struct svm_test *test) 1041 { 1042 return get_test_stage(test) == 2; 1043 } 1044 1045 static void pending_event_cli_prepare(struct svm_test *test) 1046 { 1047 default_prepare(test); 1048 1049 pending_event_ipi_fired = false; 1050 1051 handle_irq(0xf1, pending_event_ipi_isr); 1052 1053 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | 1054 APIC_DM_FIXED | 0xf1, 0); 1055 1056 set_test_stage(test, 0); 1057 } 1058 1059 static void pending_event_cli_prepare_gif_clear(struct svm_test *test) 1060 { 1061 asm("cli"); 1062 } 1063 1064 static void pending_event_cli_test(struct svm_test *test) 1065 { 1066 report_svm_guest(!pending_event_ipi_fired, test, 1067 "IRQ should NOT be delivered while IRQs disabled"); 1068 1069 /* VINTR_MASKING is zero. This should cause the IPI to fire. */ 1070 sti_nop_cli(); 1071 1072 report_svm_guest(pending_event_ipi_fired, test, 1073 "IRQ should be delivered after enabling IRQs"); 1074 vmmcall(); 1075 1076 /* 1077 * Now VINTR_MASKING=1, but no interrupt is pending so 1078 * the VINTR interception should be clear in VMCB02. Check 1079 * that L0 did not leave a stale VINTR in the VMCB. 1080 */ 1081 sti_nop_cli(); 1082 } 1083 1084 static bool pending_event_cli_finished(struct svm_test *test) 1085 { 1086 report_svm_guest(vmcb->control.exit_code == SVM_EXIT_VMMCALL, test, 1087 "Wanted VMMCALL VM-Exit, got exit reason 0x%x", 1088 vmcb->control.exit_code); 1089 1090 switch (get_test_stage(test)) { 1091 case 0: 1092 vmcb->save.rip += 3; 1093 1094 pending_event_ipi_fired = false; 1095 1096 vmcb->control.int_ctl |= V_INTR_MASKING_MASK; 1097 1098 /* Now entering again with VINTR_MASKING=1. */ 1099 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | 1100 APIC_DM_FIXED | 0xf1, 0); 1101 1102 break; 1103 1104 case 1: 1105 if (pending_event_ipi_fired == true) { 1106 report_fail("Interrupt triggered by guest"); 1107 return true; 1108 } 1109 1110 sti_nop_cli(); 1111 1112 if (pending_event_ipi_fired != true) { 1113 report_fail("Interrupt not triggered by host"); 1114 return true; 1115 } 1116 1117 break; 1118 1119 default: 1120 return true; 1121 } 1122 1123 inc_test_stage(test); 1124 1125 return get_test_stage(test) == 2; 1126 } 1127 1128 static bool pending_event_cli_check(struct svm_test *test) 1129 { 1130 return get_test_stage(test) == 2; 1131 } 1132 1133 #define TIMER_VECTOR 222 1134 1135 static volatile bool timer_fired; 1136 1137 static void timer_isr(isr_regs_t *regs) 1138 { 1139 timer_fired = true; 1140 apic_write(APIC_EOI, 0); 1141 } 1142 1143 static void interrupt_prepare(struct svm_test *test) 1144 { 1145 default_prepare(test); 1146 handle_irq(TIMER_VECTOR, timer_isr); 1147 timer_fired = false; 1148 set_test_stage(test, 0); 1149 } 1150 1151 static void interrupt_test(struct svm_test *test) 1152 { 1153 long long start, loops; 1154 1155 apic_setup_timer(TIMER_VECTOR, APIC_LVT_TIMER_PERIODIC); 1156 sti(); 1157 apic_start_timer(1); 1158 1159 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1160 asm volatile ("nop"); 1161 1162 report_svm_guest(timer_fired, test, 1163 "direct interrupt while running guest"); 1164 1165 apic_stop_timer(); 1166 cli(); 1167 vmmcall(); 1168 1169 timer_fired = false; 1170 apic_start_timer(1); 1171 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1172 asm volatile ("nop"); 1173 1174 report_svm_guest(timer_fired, test, 1175 "intercepted interrupt while running guest"); 1176 1177 sti(); 1178 apic_stop_timer(); 1179 cli(); 1180 1181 timer_fired = false; 1182 start = rdtsc(); 1183 apic_start_timer(1000000); 1184 safe_halt(); 1185 1186 report_svm_guest(timer_fired, test, "direct interrupt + hlt"); 1187 report(rdtsc() - start > 10000, "IRQ arrived after expected delay"); 1188 1189 apic_stop_timer(); 1190 cli(); 1191 vmmcall(); 1192 1193 timer_fired = false; 1194 start = rdtsc(); 1195 apic_start_timer(1000000); 1196 asm volatile ("hlt"); 1197 1198 report_svm_guest(timer_fired, test, "intercepted interrupt + hlt"); 1199 report(rdtsc() - start > 10000, "IRQ arrived after expected delay"); 1200 1201 apic_cleanup_timer(); 1202 } 1203 1204 static bool interrupt_finished(struct svm_test *test) 1205 { 1206 switch (get_test_stage(test)) { 1207 case 0: 1208 case 2: 1209 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1210 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1211 vmcb->control.exit_code); 1212 return true; 1213 } 1214 vmcb->save.rip += 3; 1215 1216 vmcb->control.intercept |= (1ULL << INTERCEPT_INTR); 1217 vmcb->control.int_ctl |= V_INTR_MASKING_MASK; 1218 break; 1219 1220 case 1: 1221 case 3: 1222 if (vmcb->control.exit_code != SVM_EXIT_INTR) { 1223 report_fail("VMEXIT not due to intr intercept. Exit reason 0x%x", 1224 vmcb->control.exit_code); 1225 return true; 1226 } 1227 1228 sti_nop_cli(); 1229 1230 vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR); 1231 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 1232 break; 1233 1234 case 4: 1235 break; 1236 1237 default: 1238 return true; 1239 } 1240 1241 inc_test_stage(test); 1242 1243 return get_test_stage(test) == 5; 1244 } 1245 1246 static bool interrupt_check(struct svm_test *test) 1247 { 1248 return get_test_stage(test) == 5; 1249 } 1250 1251 static volatile bool nmi_fired; 1252 1253 static void nmi_handler(struct ex_regs *regs) 1254 { 1255 nmi_fired = true; 1256 } 1257 1258 static void nmi_prepare(struct svm_test *test) 1259 { 1260 default_prepare(test); 1261 nmi_fired = false; 1262 handle_exception(NMI_VECTOR, nmi_handler); 1263 set_test_stage(test, 0); 1264 } 1265 1266 static void nmi_test(struct svm_test *test) 1267 { 1268 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0); 1269 1270 report_svm_guest(nmi_fired, test, "direct NMI while running guest"); 1271 1272 vmmcall(); 1273 1274 nmi_fired = false; 1275 1276 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0); 1277 1278 report_svm_guest(nmi_fired, test, "intercepted pending NMI delivered to guest"); 1279 } 1280 1281 static bool nmi_finished(struct svm_test *test) 1282 { 1283 switch (get_test_stage(test)) { 1284 case 0: 1285 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1286 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1287 vmcb->control.exit_code); 1288 return true; 1289 } 1290 vmcb->save.rip += 3; 1291 1292 vmcb->control.intercept |= (1ULL << INTERCEPT_NMI); 1293 break; 1294 1295 case 1: 1296 if (vmcb->control.exit_code != SVM_EXIT_NMI) { 1297 report_fail("VMEXIT not due to NMI intercept. Exit reason 0x%x", 1298 vmcb->control.exit_code); 1299 return true; 1300 } 1301 1302 report_pass("NMI intercept while running guest"); 1303 break; 1304 1305 case 2: 1306 break; 1307 1308 default: 1309 return true; 1310 } 1311 1312 inc_test_stage(test); 1313 1314 return get_test_stage(test) == 3; 1315 } 1316 1317 static bool nmi_check(struct svm_test *test) 1318 { 1319 return get_test_stage(test) == 3; 1320 } 1321 1322 #define NMI_DELAY 100000000ULL 1323 1324 static void nmi_message_thread(void *_test) 1325 { 1326 struct svm_test *test = _test; 1327 1328 while (get_test_stage(test) != 1) 1329 pause(); 1330 1331 delay(NMI_DELAY); 1332 1333 apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]); 1334 1335 while (get_test_stage(test) != 2) 1336 pause(); 1337 1338 delay(NMI_DELAY); 1339 1340 apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]); 1341 } 1342 1343 static void nmi_hlt_test(struct svm_test *test) 1344 { 1345 long long start; 1346 1347 on_cpu_async(1, nmi_message_thread, test); 1348 1349 start = rdtsc(); 1350 1351 set_test_stage(test, 1); 1352 1353 asm volatile ("hlt"); 1354 1355 report_svm_guest(nmi_fired, test, "direct NMI + hlt"); 1356 report(rdtsc() - start > NMI_DELAY, "direct NMI after expected delay"); 1357 1358 nmi_fired = false; 1359 1360 vmmcall(); 1361 1362 start = rdtsc(); 1363 1364 set_test_stage(test, 2); 1365 1366 asm volatile ("hlt"); 1367 1368 report_svm_guest(nmi_fired, test, "intercepted NMI + hlt"); 1369 report(rdtsc() - start > NMI_DELAY, "intercepted NMI after expected delay"); 1370 1371 set_test_stage(test, 3); 1372 } 1373 1374 static bool nmi_hlt_finished(struct svm_test *test) 1375 { 1376 switch (get_test_stage(test)) { 1377 case 1: 1378 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1379 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1380 vmcb->control.exit_code); 1381 return true; 1382 } 1383 vmcb->save.rip += 3; 1384 1385 vmcb->control.intercept |= (1ULL << INTERCEPT_NMI); 1386 break; 1387 1388 case 2: 1389 if (vmcb->control.exit_code != SVM_EXIT_NMI) { 1390 report_fail("VMEXIT not due to NMI intercept. Exit reason 0x%x", 1391 vmcb->control.exit_code); 1392 return true; 1393 } 1394 1395 report_pass("NMI intercept while running guest"); 1396 break; 1397 1398 case 3: 1399 break; 1400 1401 default: 1402 return true; 1403 } 1404 1405 return get_test_stage(test) == 3; 1406 } 1407 1408 static bool nmi_hlt_check(struct svm_test *test) 1409 { 1410 return get_test_stage(test) == 3; 1411 } 1412 1413 static void vnmi_prepare(struct svm_test *test) 1414 { 1415 nmi_prepare(test); 1416 1417 /* 1418 * Disable NMI interception to start. Enabling vNMI without 1419 * intercepting "real" NMIs should result in an ERR VM-Exit. 1420 */ 1421 vmcb->control.intercept &= ~(1ULL << INTERCEPT_NMI); 1422 vmcb->control.int_ctl = V_NMI_ENABLE_MASK; 1423 vmcb->control.int_vector = NMI_VECTOR; 1424 } 1425 1426 static void vnmi_test(struct svm_test *test) 1427 { 1428 report_svm_guest(!nmi_fired, test, "No vNMI before injection"); 1429 vmmcall(); 1430 1431 report_svm_guest(nmi_fired, test, "vNMI delivered after injection"); 1432 vmmcall(); 1433 } 1434 1435 static bool vnmi_finished(struct svm_test *test) 1436 { 1437 switch (get_test_stage(test)) { 1438 case 0: 1439 if (vmcb->control.exit_code != SVM_EXIT_ERR) { 1440 report_fail("Wanted ERR VM-Exit, got 0x%x", 1441 vmcb->control.exit_code); 1442 return true; 1443 } 1444 report(!nmi_fired, "vNMI enabled but NMI_INTERCEPT unset!"); 1445 vmcb->control.intercept |= (1ULL << INTERCEPT_NMI); 1446 vmcb->save.rip += 3; 1447 break; 1448 1449 case 1: 1450 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1451 report_fail("Wanted VMMCALL VM-Exit, got 0x%x", 1452 vmcb->control.exit_code); 1453 return true; 1454 } 1455 report(!nmi_fired, "vNMI with vector 2 not injected"); 1456 vmcb->control.int_ctl |= V_NMI_PENDING_MASK; 1457 vmcb->save.rip += 3; 1458 break; 1459 1460 case 2: 1461 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1462 report_fail("Wanted VMMCALL VM-Exit, got 0x%x", 1463 vmcb->control.exit_code); 1464 return true; 1465 } 1466 if (vmcb->control.int_ctl & V_NMI_BLOCKING_MASK) { 1467 report_fail("V_NMI_BLOCKING_MASK not cleared on VMEXIT"); 1468 return true; 1469 } 1470 report_pass("VNMI serviced"); 1471 vmcb->save.rip += 3; 1472 break; 1473 1474 default: 1475 return true; 1476 } 1477 1478 inc_test_stage(test); 1479 1480 return get_test_stage(test) == 3; 1481 } 1482 1483 static bool vnmi_check(struct svm_test *test) 1484 { 1485 return get_test_stage(test) == 3; 1486 } 1487 1488 static volatile int count_exc = 0; 1489 1490 static void my_isr(struct ex_regs *r) 1491 { 1492 count_exc++; 1493 } 1494 1495 static void exc_inject_prepare(struct svm_test *test) 1496 { 1497 default_prepare(test); 1498 handle_exception(DE_VECTOR, my_isr); 1499 handle_exception(NMI_VECTOR, my_isr); 1500 } 1501 1502 1503 static void exc_inject_test(struct svm_test *test) 1504 { 1505 asm volatile ("vmmcall\n\tvmmcall\n\t"); 1506 } 1507 1508 static bool exc_inject_finished(struct svm_test *test) 1509 { 1510 switch (get_test_stage(test)) { 1511 case 0: 1512 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1513 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1514 vmcb->control.exit_code); 1515 return true; 1516 } 1517 vmcb->save.rip += 3; 1518 vmcb->control.event_inj = NMI_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID; 1519 break; 1520 1521 case 1: 1522 if (vmcb->control.exit_code != SVM_EXIT_ERR) { 1523 report_fail("VMEXIT not due to error. Exit reason 0x%x", 1524 vmcb->control.exit_code); 1525 return true; 1526 } 1527 report(count_exc == 0, "exception with vector 2 not injected"); 1528 vmcb->control.event_inj = DE_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID; 1529 break; 1530 1531 case 2: 1532 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1533 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1534 vmcb->control.exit_code); 1535 return true; 1536 } 1537 vmcb->save.rip += 3; 1538 report(count_exc == 1, "divide overflow exception injected"); 1539 report(!(vmcb->control.event_inj & SVM_EVTINJ_VALID), "eventinj.VALID cleared"); 1540 break; 1541 1542 default: 1543 return true; 1544 } 1545 1546 inc_test_stage(test); 1547 1548 return get_test_stage(test) == 3; 1549 } 1550 1551 static bool exc_inject_check(struct svm_test *test) 1552 { 1553 return count_exc == 1 && get_test_stage(test) == 3; 1554 } 1555 1556 static volatile bool virq_fired; 1557 1558 static void virq_isr(isr_regs_t *regs) 1559 { 1560 virq_fired = true; 1561 } 1562 1563 static void virq_inject_prepare(struct svm_test *test) 1564 { 1565 handle_irq(0xf1, virq_isr); 1566 default_prepare(test); 1567 vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK | 1568 (0x0f << V_INTR_PRIO_SHIFT); // Set to the highest priority 1569 vmcb->control.int_vector = 0xf1; 1570 virq_fired = false; 1571 set_test_stage(test, 0); 1572 } 1573 1574 static void virq_inject_test(struct svm_test *test) 1575 { 1576 report_svm_guest(!virq_fired, test, "virtual IRQ blocked after L2 cli"); 1577 1578 sti_nop_cli(); 1579 1580 report_svm_guest(virq_fired, test, "virtual IRQ fired after L2 sti"); 1581 1582 vmmcall(); 1583 1584 report_svm_guest(!virq_fired, test, "intercepted VINTR blocked after L2 cli"); 1585 1586 sti_nop_cli(); 1587 1588 report_svm_guest(virq_fired, test, "intercepted VINTR fired after L2 sti"); 1589 1590 vmmcall(); 1591 1592 sti_nop_cli(); 1593 1594 report_svm_guest(!virq_fired, test, 1595 "virtual IRQ blocked V_IRQ_PRIO less than V_TPR"); 1596 1597 vmmcall(); 1598 vmmcall(); 1599 } 1600 1601 static bool virq_inject_finished(struct svm_test *test) 1602 { 1603 vmcb->save.rip += 3; 1604 1605 switch (get_test_stage(test)) { 1606 case 0: 1607 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1608 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1609 vmcb->control.exit_code); 1610 return true; 1611 } 1612 if (vmcb->control.int_ctl & V_IRQ_MASK) { 1613 report_fail("V_IRQ not cleared on VMEXIT after firing"); 1614 return true; 1615 } 1616 virq_fired = false; 1617 vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR); 1618 vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK | 1619 (0x0f << V_INTR_PRIO_SHIFT); 1620 break; 1621 1622 case 1: 1623 if (vmcb->control.exit_code != SVM_EXIT_VINTR) { 1624 report_fail("VMEXIT not due to vintr. Exit reason 0x%x", 1625 vmcb->control.exit_code); 1626 return true; 1627 } 1628 if (virq_fired) { 1629 report_fail("V_IRQ fired before SVM_EXIT_VINTR"); 1630 return true; 1631 } 1632 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VINTR); 1633 break; 1634 1635 case 2: 1636 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1637 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1638 vmcb->control.exit_code); 1639 return true; 1640 } 1641 virq_fired = false; 1642 // Set irq to lower priority 1643 vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK | 1644 (0x08 << V_INTR_PRIO_SHIFT); 1645 // Raise guest TPR 1646 vmcb->control.int_ctl |= 0x0a & V_TPR_MASK; 1647 break; 1648 1649 case 3: 1650 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1651 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1652 vmcb->control.exit_code); 1653 return true; 1654 } 1655 vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR); 1656 break; 1657 1658 case 4: 1659 // INTERCEPT_VINTR should be ignored because V_INTR_PRIO < V_TPR 1660 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1661 report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x", 1662 vmcb->control.exit_code); 1663 return true; 1664 } 1665 break; 1666 1667 default: 1668 return true; 1669 } 1670 1671 inc_test_stage(test); 1672 1673 return get_test_stage(test) == 5; 1674 } 1675 1676 static bool virq_inject_check(struct svm_test *test) 1677 { 1678 return get_test_stage(test) == 5; 1679 } 1680 1681 /* 1682 * Detect nested guest RIP corruption as explained in kernel commit 1683 * b6162e82aef19fee9c32cb3fe9ac30d9116a8c73 1684 * 1685 * In the assembly loop below 'ins' is executed while IO instructions 1686 * are not intercepted; the instruction is emulated by L0. 1687 * 1688 * At the same time we are getting interrupts from the local APIC timer, 1689 * and we do intercept them in L1 1690 * 1691 * If the interrupt happens on the insb instruction, L0 will VMexit, emulate 1692 * the insb instruction and then it will inject the interrupt to L1 through 1693 * a nested VMexit. Due to a bug, it would leave pre-emulation values of RIP, 1694 * RAX and RSP in the VMCB. 1695 * 1696 * In our intercept handler we detect the bug by checking that RIP is that of 1697 * the insb instruction, but its memory operand has already been written. 1698 * This means that insb was already executed. 1699 */ 1700 1701 static volatile int isr_cnt = 0; 1702 static volatile uint8_t io_port_var = 0xAA; 1703 extern const char insb_instruction_label[]; 1704 1705 static void reg_corruption_isr(isr_regs_t *regs) 1706 { 1707 isr_cnt++; 1708 apic_write(APIC_EOI, 0); 1709 } 1710 1711 static void reg_corruption_prepare(struct svm_test *test) 1712 { 1713 default_prepare(test); 1714 set_test_stage(test, 0); 1715 1716 vmcb->control.int_ctl = V_INTR_MASKING_MASK; 1717 vmcb->control.intercept |= (1ULL << INTERCEPT_INTR); 1718 1719 handle_irq(TIMER_VECTOR, reg_corruption_isr); 1720 1721 /* set local APIC to inject external interrupts */ 1722 apic_setup_timer(TIMER_VECTOR, APIC_LVT_TIMER_PERIODIC); 1723 apic_start_timer(1000); 1724 } 1725 1726 static void reg_corruption_test(struct svm_test *test) 1727 { 1728 /* this is endless loop, which is interrupted by the timer interrupt */ 1729 asm volatile ( 1730 "1:\n\t" 1731 "movw $0x4d0, %%dx\n\t" // IO port 1732 "lea %[io_port_var], %%rdi\n\t" 1733 "movb $0xAA, %[io_port_var]\n\t" 1734 "insb_instruction_label:\n\t" 1735 "insb\n\t" 1736 "jmp 1b\n\t" 1737 1738 : [io_port_var] "=m" (io_port_var) 1739 : /* no inputs*/ 1740 : "rdx", "rdi" 1741 ); 1742 } 1743 1744 static bool reg_corruption_finished(struct svm_test *test) 1745 { 1746 if (isr_cnt == 10000) { 1747 report_pass("No RIP corruption detected after %d timer interrupts", 1748 isr_cnt); 1749 set_test_stage(test, 1); 1750 goto cleanup; 1751 } 1752 1753 if (vmcb->control.exit_code == SVM_EXIT_INTR) { 1754 1755 void* guest_rip = (void*)vmcb->save.rip; 1756 1757 sti_nop_cli(); 1758 1759 if (guest_rip == insb_instruction_label && io_port_var != 0xAA) { 1760 report_fail("RIP corruption detected after %d timer interrupts", 1761 isr_cnt); 1762 goto cleanup; 1763 } 1764 1765 } 1766 return false; 1767 cleanup: 1768 apic_cleanup_timer(); 1769 return true; 1770 1771 } 1772 1773 static bool reg_corruption_check(struct svm_test *test) 1774 { 1775 return get_test_stage(test) == 1; 1776 } 1777 1778 static void get_tss_entry(void *data) 1779 { 1780 *((gdt_entry_t **)data) = get_tss_descr(); 1781 } 1782 1783 static int orig_cpu_count; 1784 1785 static void init_startup_prepare(struct svm_test *test) 1786 { 1787 gdt_entry_t *tss_entry; 1788 int i; 1789 1790 on_cpu(1, get_tss_entry, &tss_entry); 1791 1792 orig_cpu_count = atomic_read(&cpu_online_count); 1793 1794 apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_INIT | APIC_INT_ASSERT, 1795 id_map[1]); 1796 1797 delay(100000000ULL); 1798 1799 atomic_dec(&cpu_online_count); 1800 1801 tss_entry->type &= ~DESC_BUSY; 1802 1803 apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_STARTUP, id_map[1]); 1804 1805 for (i = 0; i < 5 && atomic_read(&cpu_online_count) < orig_cpu_count; i++) 1806 delay(100000000ULL); 1807 } 1808 1809 static bool init_startup_finished(struct svm_test *test) 1810 { 1811 return true; 1812 } 1813 1814 static bool init_startup_check(struct svm_test *test) 1815 { 1816 return atomic_read(&cpu_online_count) == orig_cpu_count; 1817 } 1818 1819 static volatile bool init_intercept; 1820 1821 static void init_intercept_prepare(struct svm_test *test) 1822 { 1823 init_intercept = false; 1824 vmcb->control.intercept |= (1ULL << INTERCEPT_INIT); 1825 } 1826 1827 static void init_intercept_test(struct svm_test *test) 1828 { 1829 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_INIT | APIC_INT_ASSERT, 0); 1830 } 1831 1832 static bool init_intercept_finished(struct svm_test *test) 1833 { 1834 vmcb->save.rip += 3; 1835 1836 if (vmcb->control.exit_code != SVM_EXIT_INIT) { 1837 report_fail("VMEXIT not due to init intercept. Exit reason 0x%x", 1838 vmcb->control.exit_code); 1839 1840 return true; 1841 } 1842 1843 init_intercept = true; 1844 1845 report_pass("INIT to vcpu intercepted"); 1846 1847 return true; 1848 } 1849 1850 static bool init_intercept_check(struct svm_test *test) 1851 { 1852 return init_intercept; 1853 } 1854 1855 /* 1856 * Setting host EFLAGS.TF causes a #DB trap after the VMRUN completes on the 1857 * host side (i.e., after the #VMEXIT from the guest). 1858 * 1859 * Setting host EFLAGS.RF suppresses any potential instruction breakpoint 1860 * match on the VMRUN and completion of the VMRUN instruction clears the 1861 * host EFLAGS.RF bit. 1862 * 1863 * [AMD APM] 1864 */ 1865 static volatile u8 host_rflags_guest_main_flag = 0; 1866 static volatile u8 host_rflags_db_handler_flag = 0; 1867 static volatile bool host_rflags_ss_on_vmrun = false; 1868 static volatile bool host_rflags_vmrun_reached = false; 1869 static volatile bool host_rflags_set_tf = false; 1870 static volatile bool host_rflags_set_rf = false; 1871 static u64 rip_detected; 1872 1873 extern u64 *vmrun_rip; 1874 1875 static void host_rflags_db_handler(struct ex_regs *r) 1876 { 1877 if (host_rflags_ss_on_vmrun) { 1878 if (host_rflags_vmrun_reached) { 1879 if (!host_rflags_set_rf) { 1880 r->rflags &= ~X86_EFLAGS_TF; 1881 rip_detected = r->rip; 1882 } else { 1883 r->rflags |= X86_EFLAGS_RF; 1884 ++host_rflags_db_handler_flag; 1885 } 1886 } else { 1887 if (r->rip == (u64)&vmrun_rip) { 1888 host_rflags_vmrun_reached = true; 1889 1890 if (host_rflags_set_rf) { 1891 host_rflags_guest_main_flag = 0; 1892 rip_detected = r->rip; 1893 r->rflags &= ~X86_EFLAGS_TF; 1894 1895 /* Trigger #DB via debug registers */ 1896 write_dr0((void *)&vmrun_rip); 1897 write_dr7(0x403); 1898 } 1899 } 1900 } 1901 } else { 1902 r->rflags &= ~X86_EFLAGS_TF; 1903 } 1904 } 1905 1906 static void host_rflags_prepare(struct svm_test *test) 1907 { 1908 default_prepare(test); 1909 handle_exception(DB_VECTOR, host_rflags_db_handler); 1910 set_test_stage(test, 0); 1911 } 1912 1913 static void host_rflags_prepare_gif_clear(struct svm_test *test) 1914 { 1915 if (host_rflags_set_tf) 1916 write_rflags(read_rflags() | X86_EFLAGS_TF); 1917 } 1918 1919 static void host_rflags_test(struct svm_test *test) 1920 { 1921 while (1) { 1922 if (get_test_stage(test) > 0) { 1923 if ((host_rflags_set_tf && !host_rflags_ss_on_vmrun && !host_rflags_db_handler_flag) || 1924 (host_rflags_set_rf && host_rflags_db_handler_flag == 1)) 1925 host_rflags_guest_main_flag = 1; 1926 } 1927 1928 if (get_test_stage(test) == 4) 1929 break; 1930 vmmcall(); 1931 } 1932 } 1933 1934 static bool host_rflags_finished(struct svm_test *test) 1935 { 1936 switch (get_test_stage(test)) { 1937 case 0: 1938 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 1939 report_fail("Unexpected VMEXIT. Exit reason 0x%x", 1940 vmcb->control.exit_code); 1941 return true; 1942 } 1943 vmcb->save.rip += 3; 1944 /* 1945 * Setting host EFLAGS.TF not immediately before VMRUN, causes 1946 * #DB trap before first guest instruction is executed 1947 */ 1948 host_rflags_set_tf = true; 1949 break; 1950 case 1: 1951 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL || 1952 host_rflags_guest_main_flag != 1) { 1953 report_fail("Unexpected VMEXIT or #DB handler" 1954 " invoked before guest main. Exit reason 0x%x", 1955 vmcb->control.exit_code); 1956 return true; 1957 } 1958 vmcb->save.rip += 3; 1959 /* 1960 * Setting host EFLAGS.TF immediately before VMRUN, causes #DB 1961 * trap after VMRUN completes on the host side (i.e., after 1962 * VMEXIT from guest). 1963 */ 1964 host_rflags_ss_on_vmrun = true; 1965 break; 1966 case 2: 1967 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL || 1968 rip_detected != (u64)&vmrun_rip + 3) { 1969 report_fail("Unexpected VMEXIT or RIP mismatch." 1970 " Exit reason 0x%x, RIP actual: %lx, RIP expected: " 1971 "%lx", vmcb->control.exit_code, 1972 (u64)&vmrun_rip + 3, rip_detected); 1973 return true; 1974 } 1975 host_rflags_set_rf = true; 1976 host_rflags_guest_main_flag = 0; 1977 host_rflags_vmrun_reached = false; 1978 vmcb->save.rip += 3; 1979 break; 1980 case 3: 1981 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL || 1982 rip_detected != (u64)&vmrun_rip || 1983 host_rflags_guest_main_flag != 1 || 1984 host_rflags_db_handler_flag > 1 || 1985 read_rflags() & X86_EFLAGS_RF) { 1986 report_fail("Unexpected VMEXIT or RIP mismatch or " 1987 "EFLAGS.RF not cleared." 1988 " Exit reason 0x%x, RIP actual: %lx, RIP expected: " 1989 "%lx", vmcb->control.exit_code, 1990 (u64)&vmrun_rip, rip_detected); 1991 return true; 1992 } 1993 host_rflags_set_tf = false; 1994 host_rflags_set_rf = false; 1995 vmcb->save.rip += 3; 1996 break; 1997 default: 1998 return true; 1999 } 2000 inc_test_stage(test); 2001 return get_test_stage(test) == 5; 2002 } 2003 2004 static bool host_rflags_check(struct svm_test *test) 2005 { 2006 return get_test_stage(test) == 4; 2007 } 2008 2009 #define TEST(name) { #name, .v2 = name } 2010 2011 /* 2012 * v2 tests 2013 */ 2014 2015 /* 2016 * Ensure that kvm recalculates the L1 guest's CPUID.01H:ECX.OSXSAVE 2017 * after VM-exit from an L2 guest that sets CR4.OSXSAVE to a different 2018 * value than in L1. 2019 */ 2020 2021 static void svm_cr4_osxsave_test_guest(struct svm_test *test) 2022 { 2023 write_cr4(read_cr4() & ~X86_CR4_OSXSAVE); 2024 } 2025 2026 static void svm_cr4_osxsave_test(void) 2027 { 2028 if (!this_cpu_has(X86_FEATURE_XSAVE)) { 2029 report_skip("XSAVE not detected"); 2030 return; 2031 } 2032 2033 if (!(read_cr4() & X86_CR4_OSXSAVE)) { 2034 unsigned long cr4 = read_cr4() | X86_CR4_OSXSAVE; 2035 2036 write_cr4(cr4); 2037 vmcb->save.cr4 = cr4; 2038 } 2039 2040 report(this_cpu_has(X86_FEATURE_OSXSAVE), "CPUID.01H:ECX.XSAVE set before VMRUN"); 2041 2042 test_set_guest(svm_cr4_osxsave_test_guest); 2043 report(svm_vmrun() == SVM_EXIT_VMMCALL, 2044 "svm_cr4_osxsave_test_guest finished with VMMCALL"); 2045 2046 report(this_cpu_has(X86_FEATURE_OSXSAVE), "CPUID.01H:ECX.XSAVE set after VMRUN"); 2047 } 2048 2049 static void basic_guest_main(struct svm_test *test) 2050 { 2051 } 2052 2053 2054 #define SVM_TEST_REG_RESERVED_BITS(start, end, inc, str_name, reg, val, \ 2055 resv_mask) \ 2056 { \ 2057 u64 tmp, mask; \ 2058 int i; \ 2059 \ 2060 for (i = start; i <= end; i = i + inc) { \ 2061 mask = 1ull << i; \ 2062 if (!(mask & resv_mask)) \ 2063 continue; \ 2064 tmp = val | mask; \ 2065 reg = tmp; \ 2066 report(svm_vmrun() == SVM_EXIT_ERR, "Test %s %d:%d: %lx", \ 2067 str_name, end, start, tmp); \ 2068 } \ 2069 } 2070 2071 #define SVM_TEST_CR_RESERVED_BITS(start, end, inc, cr, val, resv_mask, \ 2072 exit_code, test_name) \ 2073 { \ 2074 u64 tmp, mask; \ 2075 u32 r; \ 2076 int i; \ 2077 \ 2078 for (i = start; i <= end; i = i + inc) { \ 2079 mask = 1ull << i; \ 2080 if (!(mask & resv_mask)) \ 2081 continue; \ 2082 tmp = val | mask; \ 2083 switch (cr) { \ 2084 case 0: \ 2085 vmcb->save.cr0 = tmp; \ 2086 break; \ 2087 case 3: \ 2088 vmcb->save.cr3 = tmp; \ 2089 break; \ 2090 case 4: \ 2091 vmcb->save.cr4 = tmp; \ 2092 } \ 2093 r = svm_vmrun(); \ 2094 report(r == exit_code, "Test CR%d %s%d:%d: %lx, wanted exit 0x%x, got 0x%x", \ 2095 cr, test_name, end, start, tmp, exit_code, r); \ 2096 } \ 2097 } 2098 2099 static void test_efer(void) 2100 { 2101 /* 2102 * Un-setting EFER.SVME is illegal 2103 */ 2104 u64 efer_saved = vmcb->save.efer; 2105 u64 efer = efer_saved; 2106 2107 report (svm_vmrun() == SVM_EXIT_VMMCALL, "EFER.SVME: %lx", efer); 2108 efer &= ~EFER_SVME; 2109 vmcb->save.efer = efer; 2110 report (svm_vmrun() == SVM_EXIT_ERR, "EFER.SVME: %lx", efer); 2111 vmcb->save.efer = efer_saved; 2112 2113 /* 2114 * EFER MBZ bits: 63:16, 9 2115 */ 2116 efer_saved = vmcb->save.efer; 2117 2118 SVM_TEST_REG_RESERVED_BITS(8, 9, 1, "EFER", vmcb->save.efer, 2119 efer_saved, SVM_EFER_RESERVED_MASK); 2120 SVM_TEST_REG_RESERVED_BITS(16, 63, 4, "EFER", vmcb->save.efer, 2121 efer_saved, SVM_EFER_RESERVED_MASK); 2122 2123 /* 2124 * EFER.LME and CR0.PG are both set and CR4.PAE is zero. 2125 */ 2126 u64 cr0_saved = vmcb->save.cr0; 2127 u64 cr0; 2128 u64 cr4_saved = vmcb->save.cr4; 2129 u64 cr4; 2130 2131 efer = efer_saved | EFER_LME; 2132 vmcb->save.efer = efer; 2133 cr0 = cr0_saved | X86_CR0_PG | X86_CR0_PE; 2134 vmcb->save.cr0 = cr0; 2135 cr4 = cr4_saved & ~X86_CR4_PAE; 2136 vmcb->save.cr4 = cr4; 2137 report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), " 2138 "CR0.PG=1 (%lx) and CR4.PAE=0 (%lx)", efer, cr0, cr4); 2139 2140 /* 2141 * EFER.LME and CR0.PG are both set and CR0.PE is zero. 2142 * CR4.PAE needs to be set as we otherwise cannot 2143 * determine if CR4.PAE=0 or CR0.PE=0 triggered the 2144 * SVM_EXIT_ERR. 2145 */ 2146 cr4 = cr4_saved | X86_CR4_PAE; 2147 vmcb->save.cr4 = cr4; 2148 cr0 &= ~X86_CR0_PE; 2149 vmcb->save.cr0 = cr0; 2150 report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), " 2151 "CR0.PG=1 and CR0.PE=0 (%lx)", efer, cr0); 2152 2153 /* 2154 * EFER.LME, CR0.PG, CR4.PAE, CS.L, and CS.D are all non-zero. 2155 */ 2156 u32 cs_attrib_saved = vmcb->save.cs.attrib; 2157 u32 cs_attrib; 2158 2159 cr0 |= X86_CR0_PE; 2160 vmcb->save.cr0 = cr0; 2161 cs_attrib = cs_attrib_saved | SVM_SELECTOR_L_MASK | 2162 SVM_SELECTOR_DB_MASK; 2163 vmcb->save.cs.attrib = cs_attrib; 2164 report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), " 2165 "CR0.PG=1 (%lx), CR4.PAE=1 (%lx), CS.L=1 and CS.D=1 (%x)", 2166 efer, cr0, cr4, cs_attrib); 2167 2168 vmcb->save.cr0 = cr0_saved; 2169 vmcb->save.cr4 = cr4_saved; 2170 vmcb->save.efer = efer_saved; 2171 vmcb->save.cs.attrib = cs_attrib_saved; 2172 } 2173 2174 static void test_cr0(void) 2175 { 2176 /* 2177 * Un-setting CR0.CD and setting CR0.NW is illegal combination 2178 */ 2179 u64 cr0_saved = vmcb->save.cr0; 2180 u64 cr0 = cr0_saved; 2181 2182 cr0 |= X86_CR0_CD; 2183 cr0 &= ~X86_CR0_NW; 2184 vmcb->save.cr0 = cr0; 2185 report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=0: %lx", 2186 cr0); 2187 cr0 |= X86_CR0_NW; 2188 vmcb->save.cr0 = cr0; 2189 report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=1: %lx", 2190 cr0); 2191 cr0 &= ~X86_CR0_NW; 2192 cr0 &= ~X86_CR0_CD; 2193 vmcb->save.cr0 = cr0; 2194 report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=0,NW=0: %lx", 2195 cr0); 2196 cr0 |= X86_CR0_NW; 2197 vmcb->save.cr0 = cr0; 2198 report (svm_vmrun() == SVM_EXIT_ERR, "Test CR0 CD=0,NW=1: %lx", 2199 cr0); 2200 vmcb->save.cr0 = cr0_saved; 2201 2202 /* 2203 * CR0[63:32] are not zero 2204 */ 2205 cr0 = cr0_saved; 2206 2207 SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "CR0", vmcb->save.cr0, cr0_saved, 2208 SVM_CR0_RESERVED_MASK); 2209 vmcb->save.cr0 = cr0_saved; 2210 } 2211 2212 static void test_cr3(void) 2213 { 2214 /* 2215 * CR3 MBZ bits based on different modes: 2216 * [63:52] - long mode 2217 */ 2218 u64 cr3_saved = vmcb->save.cr3; 2219 2220 SVM_TEST_CR_RESERVED_BITS(0, 63, 1, 3, cr3_saved, 2221 SVM_CR3_LONG_MBZ_MASK, SVM_EXIT_ERR, ""); 2222 2223 vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_MBZ_MASK; 2224 report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx", 2225 vmcb->save.cr3); 2226 2227 /* 2228 * CR3 non-MBZ reserved bits based on different modes: 2229 * [11:5] [2:0] - long mode (PCIDE=0) 2230 * [2:0] - PAE legacy mode 2231 */ 2232 u64 cr4_saved = vmcb->save.cr4; 2233 u64 *pdpe = npt_get_pml4e(); 2234 2235 /* 2236 * Long mode 2237 */ 2238 if (this_cpu_has(X86_FEATURE_PCID)) { 2239 vmcb->save.cr4 = cr4_saved | X86_CR4_PCIDE; 2240 SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved, 2241 SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_VMMCALL, "(PCIDE=1) "); 2242 2243 vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_RESERVED_MASK; 2244 report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx", 2245 vmcb->save.cr3); 2246 } 2247 2248 vmcb->save.cr4 = cr4_saved & ~X86_CR4_PCIDE; 2249 2250 if (!npt_supported()) 2251 goto skip_npt_only; 2252 2253 /* Clear P (Present) bit in NPT in order to trigger #NPF */ 2254 pdpe[0] &= ~1ULL; 2255 2256 SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved, 2257 SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_NPF, "(PCIDE=0) "); 2258 2259 pdpe[0] |= 1ULL; 2260 vmcb->save.cr3 = cr3_saved; 2261 2262 /* 2263 * PAE legacy 2264 */ 2265 pdpe[0] &= ~1ULL; 2266 vmcb->save.cr4 = cr4_saved | X86_CR4_PAE; 2267 SVM_TEST_CR_RESERVED_BITS(0, 2, 1, 3, cr3_saved, 2268 SVM_CR3_PAE_LEGACY_RESERVED_MASK, SVM_EXIT_NPF, "(PAE) "); 2269 2270 pdpe[0] |= 1ULL; 2271 2272 skip_npt_only: 2273 vmcb->save.cr3 = cr3_saved; 2274 vmcb->save.cr4 = cr4_saved; 2275 } 2276 2277 /* Test CR4 MBZ bits based on legacy or long modes */ 2278 static void test_cr4(void) 2279 { 2280 u64 cr4_saved = vmcb->save.cr4; 2281 u64 efer_saved = vmcb->save.efer; 2282 u64 efer = efer_saved; 2283 2284 efer &= ~EFER_LME; 2285 vmcb->save.efer = efer; 2286 SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved, 2287 SVM_CR4_LEGACY_RESERVED_MASK, SVM_EXIT_ERR, ""); 2288 2289 efer |= EFER_LME; 2290 vmcb->save.efer = efer; 2291 SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved, 2292 SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR, ""); 2293 SVM_TEST_CR_RESERVED_BITS(32, 63, 4, 4, cr4_saved, 2294 SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR, ""); 2295 2296 vmcb->save.cr4 = cr4_saved; 2297 vmcb->save.efer = efer_saved; 2298 } 2299 2300 static void test_dr(void) 2301 { 2302 /* 2303 * DR6[63:32] and DR7[63:32] are MBZ 2304 */ 2305 u64 dr_saved = vmcb->save.dr6; 2306 2307 SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR6", vmcb->save.dr6, dr_saved, 2308 SVM_DR6_RESERVED_MASK); 2309 vmcb->save.dr6 = dr_saved; 2310 2311 dr_saved = vmcb->save.dr7; 2312 SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR7", vmcb->save.dr7, dr_saved, 2313 SVM_DR7_RESERVED_MASK); 2314 2315 vmcb->save.dr7 = dr_saved; 2316 } 2317 2318 /* TODO: verify if high 32-bits are sign- or zero-extended on bare metal */ 2319 #define TEST_BITMAP_ADDR(save_intercept, type, addr, exit_code, \ 2320 msg) { \ 2321 vmcb->control.intercept = saved_intercept | 1ULL << type; \ 2322 if (type == INTERCEPT_MSR_PROT) \ 2323 vmcb->control.msrpm_base_pa = addr; \ 2324 else \ 2325 vmcb->control.iopm_base_pa = addr; \ 2326 report(svm_vmrun() == exit_code, \ 2327 "Test %s address: %lx", msg, addr); \ 2328 } 2329 2330 /* 2331 * If the MSR or IOIO intercept table extends to a physical address that 2332 * is greater than or equal to the maximum supported physical address, the 2333 * guest state is illegal. 2334 * 2335 * The VMRUN instruction ignores the lower 12 bits of the address specified 2336 * in the VMCB. 2337 * 2338 * MSRPM spans 2 contiguous 4KB pages while IOPM spans 2 contiguous 4KB 2339 * pages + 1 byte. 2340 * 2341 * [APM vol 2] 2342 * 2343 * Note: Unallocated MSRPM addresses conforming to consistency checks, generate 2344 * #NPF. 2345 */ 2346 static void test_msrpm_iopm_bitmap_addrs(void) 2347 { 2348 u64 saved_intercept = vmcb->control.intercept; 2349 u64 addr_beyond_limit = 1ull << cpuid_maxphyaddr(); 2350 u64 addr = virt_to_phys(msr_bitmap) & (~((1ull << 12) - 1)); 2351 2352 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, 2353 addr_beyond_limit - 2 * PAGE_SIZE, SVM_EXIT_ERR, 2354 "MSRPM"); 2355 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, 2356 addr_beyond_limit - 2 * PAGE_SIZE + 1, SVM_EXIT_ERR, 2357 "MSRPM"); 2358 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, 2359 addr_beyond_limit - PAGE_SIZE, SVM_EXIT_ERR, 2360 "MSRPM"); 2361 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, addr, 2362 SVM_EXIT_VMMCALL, "MSRPM"); 2363 addr |= (1ull << 12) - 1; 2364 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, addr, 2365 SVM_EXIT_VMMCALL, "MSRPM"); 2366 2367 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2368 addr_beyond_limit - 4 * PAGE_SIZE, SVM_EXIT_VMMCALL, 2369 "IOPM"); 2370 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2371 addr_beyond_limit - 3 * PAGE_SIZE, SVM_EXIT_VMMCALL, 2372 "IOPM"); 2373 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2374 addr_beyond_limit - 2 * PAGE_SIZE - 2, SVM_EXIT_VMMCALL, 2375 "IOPM"); 2376 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2377 addr_beyond_limit - 2 * PAGE_SIZE, SVM_EXIT_ERR, 2378 "IOPM"); 2379 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, 2380 addr_beyond_limit - PAGE_SIZE, SVM_EXIT_ERR, 2381 "IOPM"); 2382 addr = virt_to_phys(io_bitmap) & (~((1ull << 11) - 1)); 2383 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, addr, 2384 SVM_EXIT_VMMCALL, "IOPM"); 2385 addr |= (1ull << 12) - 1; 2386 TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, addr, 2387 SVM_EXIT_VMMCALL, "IOPM"); 2388 2389 vmcb->control.intercept = saved_intercept; 2390 } 2391 2392 /* 2393 * Unlike VMSAVE, VMRUN seems not to update the value of noncanonical 2394 * segment bases in the VMCB. However, VMENTRY succeeds as documented. 2395 */ 2396 #define TEST_CANONICAL_VMRUN(seg_base, msg) \ 2397 saved_addr = seg_base; \ 2398 seg_base = (seg_base & ((1ul << addr_limit) - 1)) | noncanonical_mask; \ 2399 return_value = svm_vmrun(); \ 2400 report(return_value == SVM_EXIT_VMMCALL, \ 2401 "Successful VMRUN with noncanonical %s.base", msg); \ 2402 seg_base = saved_addr; 2403 2404 2405 #define TEST_CANONICAL_VMLOAD(seg_base, msg) \ 2406 saved_addr = seg_base; \ 2407 seg_base = (seg_base & ((1ul << addr_limit) - 1)) | noncanonical_mask; \ 2408 asm volatile ("vmload %0" : : "a"(vmcb_phys) : "memory"); \ 2409 asm volatile ("vmsave %0" : : "a"(vmcb_phys) : "memory"); \ 2410 report(is_canonical(seg_base), \ 2411 "Test %s.base for canonical form: %lx", msg, seg_base); \ 2412 seg_base = saved_addr; 2413 2414 static void test_canonicalization(void) 2415 { 2416 u64 saved_addr; 2417 u64 return_value; 2418 u64 addr_limit; 2419 u64 vmcb_phys = virt_to_phys(vmcb); 2420 2421 addr_limit = (this_cpu_has(X86_FEATURE_LA57)) ? 57 : 48; 2422 u64 noncanonical_mask = NONCANONICAL & ~((1ul << addr_limit) - 1); 2423 2424 TEST_CANONICAL_VMLOAD(vmcb->save.fs.base, "FS"); 2425 TEST_CANONICAL_VMLOAD(vmcb->save.gs.base, "GS"); 2426 TEST_CANONICAL_VMLOAD(vmcb->save.ldtr.base, "LDTR"); 2427 TEST_CANONICAL_VMLOAD(vmcb->save.tr.base, "TR"); 2428 TEST_CANONICAL_VMLOAD(vmcb->save.kernel_gs_base, "KERNEL GS"); 2429 TEST_CANONICAL_VMRUN(vmcb->save.es.base, "ES"); 2430 TEST_CANONICAL_VMRUN(vmcb->save.cs.base, "CS"); 2431 TEST_CANONICAL_VMRUN(vmcb->save.ss.base, "SS"); 2432 TEST_CANONICAL_VMRUN(vmcb->save.ds.base, "DS"); 2433 TEST_CANONICAL_VMRUN(vmcb->save.gdtr.base, "GDTR"); 2434 TEST_CANONICAL_VMRUN(vmcb->save.idtr.base, "IDTR"); 2435 } 2436 2437 /* 2438 * When VMRUN loads a guest value of 1 in EFLAGS.TF, that value does not 2439 * cause a trace trap between the VMRUN and the first guest instruction, but 2440 * rather after completion of the first guest instruction. 2441 * 2442 * [APM vol 2] 2443 */ 2444 u64 guest_rflags_test_trap_rip; 2445 2446 static void guest_rflags_test_db_handler(struct ex_regs *r) 2447 { 2448 guest_rflags_test_trap_rip = r->rip; 2449 r->rflags &= ~X86_EFLAGS_TF; 2450 } 2451 2452 static void svm_guest_state_test(void) 2453 { 2454 test_set_guest(basic_guest_main); 2455 test_efer(); 2456 test_cr0(); 2457 test_cr3(); 2458 test_cr4(); 2459 test_dr(); 2460 test_msrpm_iopm_bitmap_addrs(); 2461 test_canonicalization(); 2462 } 2463 2464 extern void guest_rflags_test_guest(struct svm_test *test); 2465 extern u64 *insn2; 2466 extern u64 *guest_end; 2467 2468 asm("guest_rflags_test_guest:\n\t" 2469 "push %rbp\n\t" 2470 ".global insn2\n\t" 2471 "insn2:\n\t" 2472 "mov %rsp,%rbp\n\t" 2473 "vmmcall\n\t" 2474 "vmmcall\n\t" 2475 ".global guest_end\n\t" 2476 "guest_end:\n\t" 2477 "vmmcall\n\t" 2478 "pop %rbp\n\t" 2479 "ret"); 2480 2481 static void svm_test_singlestep(void) 2482 { 2483 handle_exception(DB_VECTOR, guest_rflags_test_db_handler); 2484 2485 /* 2486 * Trap expected after completion of first guest instruction 2487 */ 2488 vmcb->save.rflags |= X86_EFLAGS_TF; 2489 report (__svm_vmrun((u64)guest_rflags_test_guest) == SVM_EXIT_VMMCALL && 2490 guest_rflags_test_trap_rip == (u64)&insn2, 2491 "Test EFLAGS.TF on VMRUN: trap expected after completion of first guest instruction"); 2492 /* 2493 * No trap expected 2494 */ 2495 guest_rflags_test_trap_rip = 0; 2496 vmcb->save.rip += 3; 2497 vmcb->save.rflags |= X86_EFLAGS_TF; 2498 report (__svm_vmrun(vmcb->save.rip) == SVM_EXIT_VMMCALL && 2499 guest_rflags_test_trap_rip == 0, "Test EFLAGS.TF on VMRUN: trap not expected"); 2500 2501 /* 2502 * Let guest finish execution 2503 */ 2504 vmcb->save.rip += 3; 2505 report (__svm_vmrun(vmcb->save.rip) == SVM_EXIT_VMMCALL && 2506 vmcb->save.rip == (u64)&guest_end, "Test EFLAGS.TF on VMRUN: guest execution completion"); 2507 } 2508 2509 static bool volatile svm_errata_reproduced = false; 2510 static unsigned long volatile physical = 0; 2511 2512 2513 /* 2514 * 2515 * Test the following errata: 2516 * If the VMRUN/VMSAVE/VMLOAD are attempted by the nested guest, 2517 * the CPU would first check the EAX against host reserved memory 2518 * regions (so far only SMM_ADDR/SMM_MASK are known to cause it), 2519 * and only then signal #VMexit 2520 * 2521 * Try to reproduce this by trying vmsave on each possible 4K aligned memory 2522 * address in the low 4G where the SMM area has to reside. 2523 */ 2524 2525 static void gp_isr(struct ex_regs *r) 2526 { 2527 svm_errata_reproduced = true; 2528 /* skip over the vmsave instruction*/ 2529 r->rip += 3; 2530 } 2531 2532 static void svm_vmrun_errata_test(void) 2533 { 2534 unsigned long *last_page = NULL; 2535 2536 handle_exception(GP_VECTOR, gp_isr); 2537 2538 while (!svm_errata_reproduced) { 2539 2540 unsigned long *page = alloc_pages(1); 2541 2542 if (!page) { 2543 report_pass("All guest memory tested, no bug found"); 2544 break; 2545 } 2546 2547 physical = virt_to_phys(page); 2548 2549 asm volatile ( 2550 "mov %[_physical], %%rax\n\t" 2551 "vmsave %%rax\n\t" 2552 2553 : [_physical] "=m" (physical) 2554 : /* no inputs*/ 2555 : "rax" /*clobbers*/ 2556 ); 2557 2558 if (svm_errata_reproduced) { 2559 report_fail("Got #GP exception - svm errata reproduced at 0x%lx", 2560 physical); 2561 break; 2562 } 2563 2564 *page = (unsigned long)last_page; 2565 last_page = page; 2566 } 2567 2568 while (last_page) { 2569 unsigned long *page = last_page; 2570 last_page = (unsigned long *)*last_page; 2571 free_pages_by_order(page, 1); 2572 } 2573 } 2574 2575 static void vmload_vmsave_guest_main(struct svm_test *test) 2576 { 2577 u64 vmcb_phys = virt_to_phys(vmcb); 2578 2579 asm volatile ("vmload %0" : : "a"(vmcb_phys)); 2580 asm volatile ("vmsave %0" : : "a"(vmcb_phys)); 2581 } 2582 2583 static void svm_vmload_vmsave(void) 2584 { 2585 u32 intercept_saved = vmcb->control.intercept; 2586 2587 test_set_guest(vmload_vmsave_guest_main); 2588 2589 /* 2590 * Disabling intercept for VMLOAD and VMSAVE doesn't cause 2591 * respective #VMEXIT to host 2592 */ 2593 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD); 2594 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE); 2595 svm_vmrun(); 2596 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 2597 "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 2598 2599 /* 2600 * Enabling intercept for VMLOAD and VMSAVE causes respective 2601 * #VMEXIT to host 2602 */ 2603 vmcb->control.intercept |= (1ULL << INTERCEPT_VMLOAD); 2604 svm_vmrun(); 2605 report(vmcb->control.exit_code == SVM_EXIT_VMLOAD, "Test " 2606 "VMLOAD/VMSAVE intercept: Expected VMLOAD #VMEXIT"); 2607 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD); 2608 vmcb->control.intercept |= (1ULL << INTERCEPT_VMSAVE); 2609 svm_vmrun(); 2610 report(vmcb->control.exit_code == SVM_EXIT_VMSAVE, "Test " 2611 "VMLOAD/VMSAVE intercept: Expected VMSAVE #VMEXIT"); 2612 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE); 2613 svm_vmrun(); 2614 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 2615 "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 2616 2617 vmcb->control.intercept |= (1ULL << INTERCEPT_VMLOAD); 2618 svm_vmrun(); 2619 report(vmcb->control.exit_code == SVM_EXIT_VMLOAD, "Test " 2620 "VMLOAD/VMSAVE intercept: Expected VMLOAD #VMEXIT"); 2621 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD); 2622 svm_vmrun(); 2623 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 2624 "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 2625 2626 vmcb->control.intercept |= (1ULL << INTERCEPT_VMSAVE); 2627 svm_vmrun(); 2628 report(vmcb->control.exit_code == SVM_EXIT_VMSAVE, "Test " 2629 "VMLOAD/VMSAVE intercept: Expected VMSAVE #VMEXIT"); 2630 vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE); 2631 svm_vmrun(); 2632 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test " 2633 "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT"); 2634 2635 vmcb->control.intercept = intercept_saved; 2636 } 2637 2638 static void prepare_vgif_enabled(struct svm_test *test) 2639 { 2640 default_prepare(test); 2641 } 2642 2643 static void test_vgif(struct svm_test *test) 2644 { 2645 asm volatile ("vmmcall\n\tstgi\n\tvmmcall\n\tclgi\n\tvmmcall\n\t"); 2646 } 2647 2648 static bool vgif_finished(struct svm_test *test) 2649 { 2650 switch (get_test_stage(test)) 2651 { 2652 case 0: 2653 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2654 report_fail("VMEXIT not due to vmmcall."); 2655 return true; 2656 } 2657 vmcb->control.int_ctl |= V_GIF_ENABLED_MASK; 2658 vmcb->save.rip += 3; 2659 inc_test_stage(test); 2660 break; 2661 case 1: 2662 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2663 report_fail("VMEXIT not due to vmmcall."); 2664 return true; 2665 } 2666 if (!(vmcb->control.int_ctl & V_GIF_MASK)) { 2667 report_fail("Failed to set VGIF when executing STGI."); 2668 vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK; 2669 return true; 2670 } 2671 report_pass("STGI set VGIF bit."); 2672 vmcb->save.rip += 3; 2673 inc_test_stage(test); 2674 break; 2675 case 2: 2676 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2677 report_fail("VMEXIT not due to vmmcall."); 2678 return true; 2679 } 2680 if (vmcb->control.int_ctl & V_GIF_MASK) { 2681 report_fail("Failed to clear VGIF when executing CLGI."); 2682 vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK; 2683 return true; 2684 } 2685 report_pass("CLGI cleared VGIF bit."); 2686 vmcb->save.rip += 3; 2687 inc_test_stage(test); 2688 vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK; 2689 break; 2690 default: 2691 return true; 2692 break; 2693 } 2694 2695 return get_test_stage(test) == 3; 2696 } 2697 2698 static bool vgif_check(struct svm_test *test) 2699 { 2700 return get_test_stage(test) == 3; 2701 } 2702 2703 2704 static int pause_test_counter; 2705 static int wait_counter; 2706 2707 static void pause_filter_test_guest_main(struct svm_test *test) 2708 { 2709 int i; 2710 for (i = 0 ; i < pause_test_counter ; i++) 2711 pause(); 2712 2713 if (!wait_counter) 2714 return; 2715 2716 for (i = 0; i < wait_counter; i++) 2717 ; 2718 2719 for (i = 0 ; i < pause_test_counter ; i++) 2720 pause(); 2721 2722 } 2723 2724 static void pause_filter_run_test(int pause_iterations, int filter_value, int wait_iterations, int threshold) 2725 { 2726 test_set_guest(pause_filter_test_guest_main); 2727 2728 pause_test_counter = pause_iterations; 2729 wait_counter = wait_iterations; 2730 2731 vmcb->control.pause_filter_count = filter_value; 2732 vmcb->control.pause_filter_thresh = threshold; 2733 svm_vmrun(); 2734 2735 if (filter_value <= pause_iterations || wait_iterations < threshold) 2736 report(vmcb->control.exit_code == SVM_EXIT_PAUSE, "expected PAUSE vmexit"); 2737 else 2738 report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "no expected PAUSE vmexit"); 2739 } 2740 2741 static void pause_filter_test(void) 2742 { 2743 if (!pause_filter_supported()) { 2744 report_skip("PAUSE filter not supported in the guest"); 2745 return; 2746 } 2747 2748 vmcb->control.intercept |= (1 << INTERCEPT_PAUSE); 2749 2750 // filter count more that pause count - no VMexit 2751 pause_filter_run_test(10, 9, 0, 0); 2752 2753 // filter count smaller pause count - no VMexit 2754 pause_filter_run_test(20, 21, 0, 0); 2755 2756 2757 if (pause_threshold_supported()) { 2758 // filter count smaller pause count - no VMexit + large enough threshold 2759 // so that filter counter resets 2760 pause_filter_run_test(20, 21, 1000, 10); 2761 2762 // filter count smaller pause count - no VMexit + small threshold 2763 // so that filter doesn't reset 2764 pause_filter_run_test(20, 21, 10, 1000); 2765 } else { 2766 report_skip("PAUSE threshold not supported in the guest"); 2767 return; 2768 } 2769 } 2770 2771 /* If CR0.TS and CR0.EM are cleared in L2, no #NM is generated. */ 2772 static void svm_no_nm_test(void) 2773 { 2774 write_cr0(read_cr0() & ~X86_CR0_TS); 2775 test_set_guest((test_guest_func)fnop); 2776 2777 vmcb->save.cr0 = vmcb->save.cr0 & ~(X86_CR0_TS | X86_CR0_EM); 2778 report(svm_vmrun() == SVM_EXIT_VMMCALL, 2779 "fnop with CR0.TS and CR0.EM unset no #NM exception"); 2780 } 2781 2782 static u64 amd_get_lbr_rip(u32 msr) 2783 { 2784 return rdmsr(msr) & ~AMD_LBR_RECORD_MISPREDICT; 2785 } 2786 2787 #define HOST_CHECK_LBR(from_expected, to_expected) \ 2788 do { \ 2789 TEST_EXPECT_EQ((u64)from_expected, amd_get_lbr_rip(MSR_IA32_LASTBRANCHFROMIP)); \ 2790 TEST_EXPECT_EQ((u64)to_expected, amd_get_lbr_rip(MSR_IA32_LASTBRANCHTOIP)); \ 2791 } while (0) 2792 2793 /* 2794 * FIXME: Do something other than generate an exception to communicate failure. 2795 * Debugging without expected vs. actual is an absolute nightmare. 2796 */ 2797 #define GUEST_CHECK_LBR(from_expected, to_expected) \ 2798 do { \ 2799 if ((u64)(from_expected) != amd_get_lbr_rip(MSR_IA32_LASTBRANCHFROMIP)) \ 2800 asm volatile("ud2"); \ 2801 if ((u64)(to_expected) != amd_get_lbr_rip(MSR_IA32_LASTBRANCHTOIP)) \ 2802 asm volatile("ud2"); \ 2803 } while (0) 2804 2805 #define REPORT_GUEST_LBR_ERROR(vmcb) \ 2806 report(false, "LBR guest test failed. Exit reason 0x%x, RIP = %lx, from = %lx, to = %lx, ex from = %lx, ex to = %lx", \ 2807 vmcb->control.exit_code, vmcb->save.rip, \ 2808 vmcb->save.br_from, vmcb->save.br_to, \ 2809 vmcb->save.last_excp_from, vmcb->save.last_excp_to) 2810 2811 #define DO_BRANCH(branch_name) \ 2812 asm volatile ( \ 2813 # branch_name "_from:" \ 2814 "jmp " # branch_name "_to\n" \ 2815 "nop\n" \ 2816 "nop\n" \ 2817 # branch_name "_to:" \ 2818 "nop\n" \ 2819 ) 2820 2821 2822 extern u64 guest_branch0_from, guest_branch0_to; 2823 extern u64 guest_branch2_from, guest_branch2_to; 2824 2825 extern u64 host_branch0_from, host_branch0_to; 2826 extern u64 host_branch2_from, host_branch2_to; 2827 extern u64 host_branch3_from, host_branch3_to; 2828 extern u64 host_branch4_from, host_branch4_to; 2829 2830 u64 dbgctl; 2831 2832 static void svm_lbrv_test_guest1(void) 2833 { 2834 /* 2835 * This guest expects the LBR to be already enabled when it starts, 2836 * it does a branch, and then disables the LBR and then checks. 2837 */ 2838 2839 DO_BRANCH(guest_branch0); 2840 2841 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2842 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2843 2844 if (dbgctl != DEBUGCTLMSR_LBR) 2845 asm volatile("ud2\n"); 2846 if (rdmsr(MSR_IA32_DEBUGCTLMSR) != 0) 2847 asm volatile("ud2\n"); 2848 2849 GUEST_CHECK_LBR(&guest_branch0_from, &guest_branch0_to); 2850 asm volatile ("vmmcall\n"); 2851 } 2852 2853 static void svm_lbrv_test_guest2(void) 2854 { 2855 /* 2856 * This guest expects the LBR to be disabled when it starts, 2857 * enables it, does a branch, disables it and then checks. 2858 */ 2859 2860 DO_BRANCH(guest_branch1); 2861 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2862 2863 if (dbgctl != 0) 2864 asm volatile("ud2\n"); 2865 2866 GUEST_CHECK_LBR(&host_branch2_from, &host_branch2_to); 2867 2868 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2869 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2870 DO_BRANCH(guest_branch2); 2871 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2872 2873 if (dbgctl != DEBUGCTLMSR_LBR) 2874 asm volatile("ud2\n"); 2875 GUEST_CHECK_LBR(&guest_branch2_from, &guest_branch2_to); 2876 2877 asm volatile ("vmmcall\n"); 2878 } 2879 2880 static void svm_lbrv_test0(void) 2881 { 2882 report(true, "Basic LBR test"); 2883 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2884 DO_BRANCH(host_branch0); 2885 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2886 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2887 2888 TEST_EXPECT_EQ(dbgctl, DEBUGCTLMSR_LBR); 2889 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2890 TEST_EXPECT_EQ(dbgctl, 0); 2891 2892 HOST_CHECK_LBR(&host_branch0_from, &host_branch0_to); 2893 } 2894 2895 static void svm_lbrv_test1(void) 2896 { 2897 report(true, "Test that without LBRV enabled, guest LBR state does 'leak' to the host(1)"); 2898 2899 svm_setup_vmrun((u64)svm_lbrv_test_guest1); 2900 vmcb->control.virt_ext = 0; 2901 2902 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2903 DO_BRANCH(host_branch1); 2904 SVM_BARE_VMRUN; 2905 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2906 2907 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2908 REPORT_GUEST_LBR_ERROR(vmcb); 2909 return; 2910 } 2911 2912 TEST_EXPECT_EQ(dbgctl, 0); 2913 HOST_CHECK_LBR(&guest_branch0_from, &guest_branch0_to); 2914 } 2915 2916 static void svm_lbrv_test2(void) 2917 { 2918 report(true, "Test that without LBRV enabled, guest LBR state does 'leak' to the host(2)"); 2919 2920 svm_setup_vmrun((u64)svm_lbrv_test_guest2); 2921 vmcb->control.virt_ext = 0; 2922 2923 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2924 DO_BRANCH(host_branch2); 2925 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2926 SVM_BARE_VMRUN; 2927 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2928 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2929 2930 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2931 REPORT_GUEST_LBR_ERROR(vmcb); 2932 return; 2933 } 2934 2935 TEST_EXPECT_EQ(dbgctl, 0); 2936 HOST_CHECK_LBR(&guest_branch2_from, &guest_branch2_to); 2937 } 2938 2939 static void svm_lbrv_nested_test1(void) 2940 { 2941 if (!lbrv_supported()) { 2942 report_skip("LBRV not supported in the guest"); 2943 return; 2944 } 2945 2946 report(true, "Test that with LBRV enabled, guest LBR state doesn't leak (1)"); 2947 svm_setup_vmrun((u64)svm_lbrv_test_guest1); 2948 vmcb->control.virt_ext = LBR_CTL_ENABLE_MASK; 2949 vmcb->save.dbgctl = DEBUGCTLMSR_LBR; 2950 2951 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2952 DO_BRANCH(host_branch3); 2953 SVM_BARE_VMRUN; 2954 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2955 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2956 2957 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2958 REPORT_GUEST_LBR_ERROR(vmcb); 2959 return; 2960 } 2961 2962 if (vmcb->save.dbgctl != 0) { 2963 report(false, "unexpected virtual guest MSR_IA32_DEBUGCTLMSR value 0x%lx", vmcb->save.dbgctl); 2964 return; 2965 } 2966 2967 TEST_EXPECT_EQ(dbgctl, DEBUGCTLMSR_LBR); 2968 HOST_CHECK_LBR(&host_branch3_from, &host_branch3_to); 2969 } 2970 2971 static void svm_lbrv_nested_test2(void) 2972 { 2973 if (!lbrv_supported()) { 2974 report_skip("LBRV not supported in the guest"); 2975 return; 2976 } 2977 2978 report(true, "Test that with LBRV enabled, guest LBR state doesn't leak (2)"); 2979 svm_setup_vmrun((u64)svm_lbrv_test_guest2); 2980 vmcb->control.virt_ext = LBR_CTL_ENABLE_MASK; 2981 2982 vmcb->save.dbgctl = 0; 2983 vmcb->save.br_from = (u64)&host_branch2_from; 2984 vmcb->save.br_to = (u64)&host_branch2_to; 2985 2986 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); 2987 DO_BRANCH(host_branch4); 2988 SVM_BARE_VMRUN; 2989 dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 2990 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); 2991 2992 if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) { 2993 REPORT_GUEST_LBR_ERROR(vmcb); 2994 return; 2995 } 2996 2997 TEST_EXPECT_EQ(dbgctl, DEBUGCTLMSR_LBR); 2998 HOST_CHECK_LBR(&host_branch4_from, &host_branch4_to); 2999 } 3000 3001 3002 // test that a nested guest which does enable INTR interception 3003 // but doesn't enable virtual interrupt masking works 3004 3005 static volatile int dummy_isr_recevied; 3006 static void dummy_isr(isr_regs_t *regs) 3007 { 3008 dummy_isr_recevied++; 3009 eoi(); 3010 } 3011 3012 3013 static volatile int nmi_recevied; 3014 static void dummy_nmi_handler(struct ex_regs *regs) 3015 { 3016 nmi_recevied++; 3017 } 3018 3019 3020 static void svm_intr_intercept_mix_run_guest(volatile int *counter, int expected_vmexit) 3021 { 3022 if (counter) 3023 *counter = 0; 3024 3025 sti(); // host IF value should not matter 3026 clgi(); // vmrun will set back GI to 1 3027 3028 svm_vmrun(); 3029 3030 if (counter) 3031 report(!*counter, "No interrupt expected"); 3032 3033 stgi(); 3034 3035 if (counter) 3036 report(*counter == 1, "Interrupt is expected"); 3037 3038 report (vmcb->control.exit_code == expected_vmexit, "Test expected VM exit"); 3039 report(vmcb->save.rflags & X86_EFLAGS_IF, "Guest should have EFLAGS.IF set now"); 3040 cli(); 3041 } 3042 3043 3044 // subtest: test that enabling EFLAGS.IF is enough to trigger an interrupt 3045 static void svm_intr_intercept_mix_if_guest(struct svm_test *test) 3046 { 3047 asm volatile("nop;nop;nop;nop"); 3048 report(!dummy_isr_recevied, "No interrupt expected"); 3049 sti_nop(); 3050 report(0, "must not reach here"); 3051 } 3052 3053 static void svm_intr_intercept_mix_if(void) 3054 { 3055 // make a physical interrupt to be pending 3056 handle_irq(0x55, dummy_isr); 3057 3058 vmcb->control.intercept |= (1 << INTERCEPT_INTR); 3059 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3060 vmcb->save.rflags &= ~X86_EFLAGS_IF; 3061 3062 test_set_guest(svm_intr_intercept_mix_if_guest); 3063 cli(); 3064 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0); 3065 svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR); 3066 } 3067 3068 3069 // subtest: test that a clever guest can trigger an interrupt by setting GIF 3070 // if GIF is not intercepted 3071 static void svm_intr_intercept_mix_gif_guest(struct svm_test *test) 3072 { 3073 3074 asm volatile("nop;nop;nop;nop"); 3075 report(!dummy_isr_recevied, "No interrupt expected"); 3076 3077 // clear GIF and enable IF 3078 // that should still not cause VM exit 3079 clgi(); 3080 sti_nop(); 3081 report(!dummy_isr_recevied, "No interrupt expected"); 3082 3083 stgi(); 3084 report(0, "must not reach here"); 3085 } 3086 3087 static void svm_intr_intercept_mix_gif(void) 3088 { 3089 handle_irq(0x55, dummy_isr); 3090 3091 vmcb->control.intercept |= (1 << INTERCEPT_INTR); 3092 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3093 vmcb->save.rflags &= ~X86_EFLAGS_IF; 3094 3095 test_set_guest(svm_intr_intercept_mix_gif_guest); 3096 cli(); 3097 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0); 3098 svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR); 3099 } 3100 3101 // subtest: test that a clever guest can trigger an interrupt by setting GIF 3102 // if GIF is not intercepted and interrupt comes after guest 3103 // started running 3104 static void svm_intr_intercept_mix_gif_guest2(struct svm_test *test) 3105 { 3106 asm volatile("nop;nop;nop;nop"); 3107 report(!dummy_isr_recevied, "No interrupt expected"); 3108 3109 clgi(); 3110 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0); 3111 report(!dummy_isr_recevied, "No interrupt expected"); 3112 3113 stgi(); 3114 report(0, "must not reach here"); 3115 } 3116 3117 static void svm_intr_intercept_mix_gif2(void) 3118 { 3119 handle_irq(0x55, dummy_isr); 3120 3121 vmcb->control.intercept |= (1 << INTERCEPT_INTR); 3122 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3123 vmcb->save.rflags |= X86_EFLAGS_IF; 3124 3125 test_set_guest(svm_intr_intercept_mix_gif_guest2); 3126 svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR); 3127 } 3128 3129 3130 // subtest: test that pending NMI will be handled when guest enables GIF 3131 static void svm_intr_intercept_mix_nmi_guest(struct svm_test *test) 3132 { 3133 asm volatile("nop;nop;nop;nop"); 3134 report(!nmi_recevied, "No NMI expected"); 3135 cli(); // should have no effect 3136 3137 clgi(); 3138 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI, 0); 3139 sti_nop(); // should have no effect 3140 report(!nmi_recevied, "No NMI expected"); 3141 3142 stgi(); 3143 report(0, "must not reach here"); 3144 } 3145 3146 static void svm_intr_intercept_mix_nmi(void) 3147 { 3148 handle_exception(2, dummy_nmi_handler); 3149 3150 vmcb->control.intercept |= (1 << INTERCEPT_NMI); 3151 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3152 vmcb->save.rflags |= X86_EFLAGS_IF; 3153 3154 test_set_guest(svm_intr_intercept_mix_nmi_guest); 3155 svm_intr_intercept_mix_run_guest(&nmi_recevied, SVM_EXIT_NMI); 3156 } 3157 3158 // test that pending SMI will be handled when guest enables GIF 3159 // TODO: can't really count #SMIs so just test that guest doesn't hang 3160 // and VMexits on SMI 3161 static void svm_intr_intercept_mix_smi_guest(struct svm_test *test) 3162 { 3163 asm volatile("nop;nop;nop;nop"); 3164 3165 clgi(); 3166 apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_SMI, 0); 3167 sti_nop(); // should have no effect 3168 stgi(); 3169 report(0, "must not reach here"); 3170 } 3171 3172 static void svm_intr_intercept_mix_smi(void) 3173 { 3174 vmcb->control.intercept |= (1 << INTERCEPT_SMI); 3175 vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK; 3176 test_set_guest(svm_intr_intercept_mix_smi_guest); 3177 svm_intr_intercept_mix_run_guest(NULL, SVM_EXIT_SMI); 3178 } 3179 3180 static void svm_l2_ac_test(void) 3181 { 3182 bool hit_ac = false; 3183 3184 write_cr0(read_cr0() | X86_CR0_AM); 3185 write_rflags(read_rflags() | X86_EFLAGS_AC); 3186 3187 run_in_user(generate_usermode_ac, AC_VECTOR, 0, 0, 0, 0, &hit_ac); 3188 report(hit_ac, "Usermode #AC handled in L2"); 3189 vmmcall(); 3190 } 3191 3192 struct svm_exception_test { 3193 u8 vector; 3194 void (*guest_code)(void); 3195 }; 3196 3197 struct svm_exception_test svm_exception_tests[] = { 3198 { GP_VECTOR, generate_non_canonical_gp }, 3199 { UD_VECTOR, generate_ud }, 3200 { DE_VECTOR, generate_de }, 3201 { DB_VECTOR, generate_single_step_db }, 3202 { BP_VECTOR, generate_bp }, 3203 { AC_VECTOR, svm_l2_ac_test }, 3204 { OF_VECTOR, generate_of }, 3205 { NM_VECTOR, generate_cr0_ts_nm }, 3206 { NM_VECTOR, generate_cr0_em_nm }, 3207 }; 3208 3209 static u8 svm_exception_test_vector; 3210 3211 static void svm_exception_handler(struct ex_regs *regs) 3212 { 3213 report(regs->vector == svm_exception_test_vector, 3214 "Handling %s in L2's exception handler", 3215 exception_mnemonic(svm_exception_test_vector)); 3216 vmmcall(); 3217 } 3218 3219 static void handle_exception_in_l2(u8 vector) 3220 { 3221 handler old_handler = handle_exception(vector, svm_exception_handler); 3222 svm_exception_test_vector = vector; 3223 3224 report(svm_vmrun() == SVM_EXIT_VMMCALL, 3225 "%s handled by L2", exception_mnemonic(vector)); 3226 3227 handle_exception(vector, old_handler); 3228 } 3229 3230 static void handle_exception_in_l1(u32 vector) 3231 { 3232 u32 old_ie = vmcb->control.intercept_exceptions; 3233 3234 vmcb->control.intercept_exceptions |= (1ULL << vector); 3235 3236 report(svm_vmrun() == (SVM_EXIT_EXCP_BASE + vector), 3237 "%s handled by L1", exception_mnemonic(vector)); 3238 3239 vmcb->control.intercept_exceptions = old_ie; 3240 } 3241 3242 static void svm_exception_test(void) 3243 { 3244 struct svm_exception_test *t; 3245 int i; 3246 3247 for (i = 0; i < ARRAY_SIZE(svm_exception_tests); i++) { 3248 t = &svm_exception_tests[i]; 3249 test_set_guest((test_guest_func)t->guest_code); 3250 3251 handle_exception_in_l2(t->vector); 3252 vmcb_ident(vmcb); 3253 3254 handle_exception_in_l1(t->vector); 3255 vmcb_ident(vmcb); 3256 } 3257 } 3258 3259 static void shutdown_intercept_test_guest(struct svm_test *test) 3260 { 3261 asm volatile ("ud2"); 3262 report_fail("should not reach here\n"); 3263 3264 } 3265 3266 static void svm_shutdown_intercept_test(void) 3267 { 3268 test_set_guest(shutdown_intercept_test_guest); 3269 vmcb->save.idtr.base = (u64)alloc_vpage(); 3270 vmcb->control.intercept |= (1ULL << INTERCEPT_SHUTDOWN); 3271 svm_vmrun(); 3272 report(vmcb->control.exit_code == SVM_EXIT_SHUTDOWN, "shutdown test passed"); 3273 } 3274 3275 struct svm_test svm_tests[] = { 3276 { "null", default_supported, default_prepare, 3277 default_prepare_gif_clear, null_test, 3278 default_finished, null_check }, 3279 { "vmrun", default_supported, default_prepare, 3280 default_prepare_gif_clear, test_vmrun, 3281 default_finished, check_vmrun }, 3282 { "ioio", default_supported, prepare_ioio, 3283 default_prepare_gif_clear, test_ioio, 3284 ioio_finished, check_ioio }, 3285 { "vmrun intercept check", default_supported, prepare_no_vmrun_int, 3286 default_prepare_gif_clear, null_test, default_finished, 3287 check_no_vmrun_int }, 3288 { "rsm", default_supported, 3289 prepare_rsm_intercept, default_prepare_gif_clear, 3290 test_rsm_intercept, finished_rsm_intercept, check_rsm_intercept }, 3291 { "cr3 read intercept", default_supported, 3292 prepare_cr3_intercept, default_prepare_gif_clear, 3293 test_cr3_intercept, default_finished, check_cr3_intercept }, 3294 { "cr3 read nointercept", default_supported, default_prepare, 3295 default_prepare_gif_clear, test_cr3_intercept, default_finished, 3296 check_cr3_nointercept }, 3297 { "cr3 read intercept emulate", smp_supported, 3298 prepare_cr3_intercept_bypass, default_prepare_gif_clear, 3299 test_cr3_intercept_bypass, default_finished, check_cr3_intercept }, 3300 { "dr intercept check", default_supported, prepare_dr_intercept, 3301 default_prepare_gif_clear, test_dr_intercept, dr_intercept_finished, 3302 check_dr_intercept }, 3303 { "next_rip", next_rip_supported, prepare_next_rip, 3304 default_prepare_gif_clear, test_next_rip, 3305 default_finished, check_next_rip }, 3306 { "msr intercept check", default_supported, prepare_msr_intercept, 3307 default_prepare_gif_clear, test_msr_intercept, 3308 msr_intercept_finished, check_msr_intercept }, 3309 { "mode_switch", default_supported, prepare_mode_switch, 3310 default_prepare_gif_clear, test_mode_switch, 3311 mode_switch_finished, check_mode_switch }, 3312 { "asid_zero", default_supported, prepare_asid_zero, 3313 default_prepare_gif_clear, test_asid_zero, 3314 default_finished, check_asid_zero }, 3315 { "sel_cr0_bug", default_supported, sel_cr0_bug_prepare, 3316 default_prepare_gif_clear, sel_cr0_bug_test, 3317 sel_cr0_bug_finished, sel_cr0_bug_check }, 3318 { "tsc_adjust", tsc_adjust_supported, tsc_adjust_prepare, 3319 default_prepare_gif_clear, tsc_adjust_test, 3320 default_finished, tsc_adjust_check }, 3321 { "latency_run_exit", default_supported, latency_prepare, 3322 default_prepare_gif_clear, latency_test, 3323 latency_finished, latency_check }, 3324 { "latency_run_exit_clean", default_supported, latency_prepare, 3325 default_prepare_gif_clear, latency_test, 3326 latency_finished_clean, latency_check }, 3327 { "latency_svm_insn", default_supported, lat_svm_insn_prepare, 3328 default_prepare_gif_clear, null_test, 3329 lat_svm_insn_finished, lat_svm_insn_check }, 3330 { "exc_inject", default_supported, exc_inject_prepare, 3331 default_prepare_gif_clear, exc_inject_test, 3332 exc_inject_finished, exc_inject_check }, 3333 { "pending_event", default_supported, pending_event_prepare, 3334 default_prepare_gif_clear, 3335 pending_event_test, pending_event_finished, pending_event_check }, 3336 { "pending_event_cli", default_supported, pending_event_cli_prepare, 3337 pending_event_cli_prepare_gif_clear, 3338 pending_event_cli_test, pending_event_cli_finished, 3339 pending_event_cli_check }, 3340 { "interrupt", default_supported, interrupt_prepare, 3341 default_prepare_gif_clear, interrupt_test, 3342 interrupt_finished, interrupt_check }, 3343 { "nmi", default_supported, nmi_prepare, 3344 default_prepare_gif_clear, nmi_test, 3345 nmi_finished, nmi_check }, 3346 { "nmi_hlt", smp_supported, nmi_prepare, 3347 default_prepare_gif_clear, nmi_hlt_test, 3348 nmi_hlt_finished, nmi_hlt_check }, 3349 { "vnmi", vnmi_supported, vnmi_prepare, 3350 default_prepare_gif_clear, vnmi_test, 3351 vnmi_finished, vnmi_check }, 3352 { "virq_inject", default_supported, virq_inject_prepare, 3353 default_prepare_gif_clear, virq_inject_test, 3354 virq_inject_finished, virq_inject_check }, 3355 { "reg_corruption", default_supported, reg_corruption_prepare, 3356 default_prepare_gif_clear, reg_corruption_test, 3357 reg_corruption_finished, reg_corruption_check }, 3358 { "svm_init_startup_test", smp_supported, init_startup_prepare, 3359 default_prepare_gif_clear, null_test, 3360 init_startup_finished, init_startup_check }, 3361 { "svm_init_intercept_test", smp_supported, init_intercept_prepare, 3362 default_prepare_gif_clear, init_intercept_test, 3363 init_intercept_finished, init_intercept_check, .on_vcpu = 2 }, 3364 { "host_rflags", default_supported, host_rflags_prepare, 3365 host_rflags_prepare_gif_clear, host_rflags_test, 3366 host_rflags_finished, host_rflags_check }, 3367 { "vgif", vgif_supported, prepare_vgif_enabled, 3368 default_prepare_gif_clear, test_vgif, vgif_finished, 3369 vgif_check }, 3370 TEST(svm_cr4_osxsave_test), 3371 TEST(svm_guest_state_test), 3372 TEST(svm_vmrun_errata_test), 3373 TEST(svm_vmload_vmsave), 3374 TEST(svm_test_singlestep), 3375 TEST(svm_no_nm_test), 3376 TEST(svm_exception_test), 3377 TEST(svm_lbrv_test0), 3378 TEST(svm_lbrv_test1), 3379 TEST(svm_lbrv_test2), 3380 TEST(svm_lbrv_nested_test1), 3381 TEST(svm_lbrv_nested_test2), 3382 TEST(svm_intr_intercept_mix_if), 3383 TEST(svm_intr_intercept_mix_gif), 3384 TEST(svm_intr_intercept_mix_gif2), 3385 TEST(svm_intr_intercept_mix_nmi), 3386 TEST(svm_intr_intercept_mix_smi), 3387 TEST(svm_tsc_scale_test), 3388 TEST(pause_filter_test), 3389 TEST(svm_shutdown_intercept_test), 3390 { NULL, NULL, NULL, NULL, NULL, NULL, NULL } 3391 }; 3392 3393 int main(int ac, char **av) 3394 { 3395 setup_vm(); 3396 return run_svm_tests(ac, av, svm_tests); 3397 } 3398