xref: /kvm-unit-tests/x86/taskswitch2.c (revision 67961d185ad2860dd35ac2e3c17a8644c18da8b3)
1d21b4f12SGleb Natapov #include "libcflat.h"
2d21b4f12SGleb Natapov #include "desc.h"
3d21b4f12SGleb Natapov #include "apic-defs.h"
4d21b4f12SGleb Natapov #include "apic.h"
5d21b4f12SGleb Natapov #include "processor.h"
6ce71ddc7SGleb Natapov #include "vm.h"
7d21b4f12SGleb Natapov 
8*67961d18SPaolo Bonzini #define MAIN_TSS_SEL (FIRST_SPARE_SEL + 0)
9*67961d18SPaolo Bonzini #define VM86_TSS_SEL (FIRST_SPARE_SEL + 8)
10b01c8823SKevin Wolf 
11d21b4f12SGleb Natapov static volatile int test_count;
12d21b4f12SGleb Natapov static volatile unsigned int test_divider;
13d21b4f12SGleb Natapov 
14ce71ddc7SGleb Natapov static char *fault_addr;
15ce71ddc7SGleb Natapov static ulong fault_phys;
16ce71ddc7SGleb Natapov 
17d21b4f12SGleb Natapov static inline void io_delay(void)
18d21b4f12SGleb Natapov {
19d21b4f12SGleb Natapov }
20d21b4f12SGleb Natapov 
21d21b4f12SGleb Natapov static void nmi_tss(void)
22d21b4f12SGleb Natapov {
23d21b4f12SGleb Natapov start:
24d21b4f12SGleb Natapov 	printf("NMI task is running\n");
25d21b4f12SGleb Natapov 	print_current_tss_info();
26d21b4f12SGleb Natapov 	test_count++;
27d21b4f12SGleb Natapov 	asm volatile ("iret");
28d21b4f12SGleb Natapov 	goto start;
29d21b4f12SGleb Natapov }
30d21b4f12SGleb Natapov 
31d21b4f12SGleb Natapov static void de_tss(void)
32d21b4f12SGleb Natapov {
33d21b4f12SGleb Natapov start:
34d21b4f12SGleb Natapov 	printf("DE task is running\n");
35d21b4f12SGleb Natapov 	print_current_tss_info();
36d21b4f12SGleb Natapov 	test_divider = 10;
37d21b4f12SGleb Natapov 	test_count++;
38d21b4f12SGleb Natapov 	asm volatile ("iret");
39d21b4f12SGleb Natapov 	goto start;
40d21b4f12SGleb Natapov }
41d21b4f12SGleb Natapov 
42d21b4f12SGleb Natapov static void of_tss(void)
43d21b4f12SGleb Natapov {
44d21b4f12SGleb Natapov start:
45d21b4f12SGleb Natapov 	printf("OF task is running\n");
46d21b4f12SGleb Natapov 	print_current_tss_info();
47d21b4f12SGleb Natapov 	test_count++;
48d21b4f12SGleb Natapov 	asm volatile ("iret");
49d21b4f12SGleb Natapov 	goto start;
50d21b4f12SGleb Natapov }
51d21b4f12SGleb Natapov 
52d21b4f12SGleb Natapov static void bp_tss(void)
53d21b4f12SGleb Natapov {
54d21b4f12SGleb Natapov start:
55d21b4f12SGleb Natapov 	printf("BP task is running\n");
56d21b4f12SGleb Natapov 	print_current_tss_info();
57d21b4f12SGleb Natapov 	test_count++;
58d21b4f12SGleb Natapov 	asm volatile ("iret");
59d21b4f12SGleb Natapov 	goto start;
60d21b4f12SGleb Natapov }
61d21b4f12SGleb Natapov 
62ce71ddc7SGleb Natapov void do_pf_tss(ulong *error_code)
63ce71ddc7SGleb Natapov {
64ce71ddc7SGleb Natapov 	printf("PF task is running %x %x\n", error_code, *(ulong*)error_code);
65ce71ddc7SGleb Natapov 	print_current_tss_info();
66ce71ddc7SGleb Natapov 	if (*(ulong*)error_code == 0x2) /* write access, not present */
67ce71ddc7SGleb Natapov 		test_count++;
68ce71ddc7SGleb Natapov 	install_pte(phys_to_virt(read_cr3()), 1, fault_addr,
69ce71ddc7SGleb Natapov 		    fault_phys | PTE_PRESENT | PTE_WRITE, 0);
70ce71ddc7SGleb Natapov }
71ce71ddc7SGleb Natapov 
72ce71ddc7SGleb Natapov extern void pf_tss(void);
73ce71ddc7SGleb Natapov 
74ce71ddc7SGleb Natapov asm (
75ce71ddc7SGleb Natapov 	"pf_tss: \n\t"
76ce71ddc7SGleb Natapov 	"push %esp \n\t"
77ce71ddc7SGleb Natapov 	"call do_pf_tss \n\t"
78ce71ddc7SGleb Natapov 	"add $4, %esp \n\t"
79ce71ddc7SGleb Natapov 	"iret\n\t"
80ce71ddc7SGleb Natapov 	"jmp pf_tss\n\t"
81ce71ddc7SGleb Natapov     );
82ce71ddc7SGleb Natapov 
83d21b4f12SGleb Natapov static void jmp_tss(void)
84d21b4f12SGleb Natapov {
85d21b4f12SGleb Natapov start:
86d21b4f12SGleb Natapov 	printf("JMP to task succeeded\n");
87d21b4f12SGleb Natapov 	print_current_tss_info();
88d21b4f12SGleb Natapov 	test_count++;
89d21b4f12SGleb Natapov 	asm volatile ("ljmp $" xstr(TSS_MAIN) ", $0");
90d21b4f12SGleb Natapov 	goto start;
91d21b4f12SGleb Natapov }
92d21b4f12SGleb Natapov 
93d21b4f12SGleb Natapov static void irq_tss(void)
94d21b4f12SGleb Natapov {
95d21b4f12SGleb Natapov start:
96d21b4f12SGleb Natapov 	printf("IRQ task is running\n");
97d21b4f12SGleb Natapov 	print_current_tss_info();
98d21b4f12SGleb Natapov 	test_count++;
99d21b4f12SGleb Natapov 	asm volatile ("iret");
100d21b4f12SGleb Natapov 	test_count++;
101d21b4f12SGleb Natapov 	printf("IRQ task restarts after iret.\n");
102d21b4f12SGleb Natapov 	goto start;
103d21b4f12SGleb Natapov }
104d21b4f12SGleb Natapov 
105b01c8823SKevin Wolf void test_kernel_mode_int()
106d21b4f12SGleb Natapov {
107d21b4f12SGleb Natapov 	unsigned int res;
108d21b4f12SGleb Natapov 
109d21b4f12SGleb Natapov 	/* test that int $2 triggers task gate */
110d21b4f12SGleb Natapov 	test_count = 0;
111d21b4f12SGleb Natapov 	set_intr_task_gate(2, nmi_tss);
112d21b4f12SGleb Natapov 	printf("Triggering nmi 2\n");
113d21b4f12SGleb Natapov 	asm volatile ("int $2");
114d21b4f12SGleb Natapov 	printf("Return from nmi %d\n", test_count);
115d21b4f12SGleb Natapov 	report("NMI int $2", test_count == 1);
116d21b4f12SGleb Natapov 
117d21b4f12SGleb Natapov 	/* test that external NMI triggers task gate */
118d21b4f12SGleb Natapov 	test_count = 0;
119d21b4f12SGleb Natapov 	set_intr_task_gate(2, nmi_tss);
120d21b4f12SGleb Natapov 	printf("Triggering nmi through APIC\n");
121d21b4f12SGleb Natapov 	apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0);
122d21b4f12SGleb Natapov 	io_delay();
123d21b4f12SGleb Natapov 	printf("Return from APIC nmi\n");
124d21b4f12SGleb Natapov 	report("NMI external", test_count == 1);
125d21b4f12SGleb Natapov 
126d21b4f12SGleb Natapov 	/* test that external interrupt triggesr task gate */
127d21b4f12SGleb Natapov 	test_count = 0;
128d21b4f12SGleb Natapov 	printf("Trigger IRQ from APIC\n");
129d21b4f12SGleb Natapov 	set_intr_task_gate(0xf0, irq_tss);
130d21b4f12SGleb Natapov 	irq_enable();
131d21b4f12SGleb Natapov 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | APIC_INT_ASSERT | 0xf0, 0);
132d21b4f12SGleb Natapov 	io_delay();
133d21b4f12SGleb Natapov 	irq_disable();
134d21b4f12SGleb Natapov 	printf("Return from APIC IRQ\n");
135d21b4f12SGleb Natapov 	report("IRQ external", test_count == 1);
136d21b4f12SGleb Natapov 
137d21b4f12SGleb Natapov 	/* test that HW exception triggesr task gate */
138d21b4f12SGleb Natapov 	set_intr_task_gate(0, de_tss);
139d21b4f12SGleb Natapov 	printf("Try to devide by 0\n");
140d21b4f12SGleb Natapov 	asm volatile ("divl %3": "=a"(res)
141d21b4f12SGleb Natapov 		      : "d"(0), "a"(1500), "m"(test_divider));
142d21b4f12SGleb Natapov 	printf("Result is %d\n", res);
143d21b4f12SGleb Natapov 	report("DE exeption", res == 150);
144d21b4f12SGleb Natapov 
145d21b4f12SGleb Natapov 	/* test if call HW exeption DE by int $0 triggers task gate */
146d21b4f12SGleb Natapov 	test_count = 0;
147d21b4f12SGleb Natapov 	set_intr_task_gate(0, de_tss);
148d21b4f12SGleb Natapov 	printf("Call int 0\n");
149d21b4f12SGleb Natapov 	asm volatile ("int $0");
150d21b4f12SGleb Natapov 	printf("Return from int 0\n");
151d21b4f12SGleb Natapov 	report("int $0", test_count == 1);
152d21b4f12SGleb Natapov 
153d21b4f12SGleb Natapov 	/* test if HW exception OF triggers task gate */
154d21b4f12SGleb Natapov 	test_count = 0;
155d21b4f12SGleb Natapov 	set_intr_task_gate(4, of_tss);
156d21b4f12SGleb Natapov 	printf("Call into\n");
157d21b4f12SGleb Natapov 	asm volatile ("addb $127, %b0\ninto"::"a"(127));
158d21b4f12SGleb Natapov 	printf("Return from into\n");
159d21b4f12SGleb Natapov 	report("OF exeption", test_count);
160d21b4f12SGleb Natapov 
161d21b4f12SGleb Natapov 	/* test if HW exception BP triggers task gate */
162d21b4f12SGleb Natapov 	test_count = 0;
163d21b4f12SGleb Natapov 	set_intr_task_gate(3, bp_tss);
164d21b4f12SGleb Natapov 	printf("Call int 3\n");
165d21b4f12SGleb Natapov 	asm volatile ("int $3");
166d21b4f12SGleb Natapov 	printf("Return from int 3\n");
167d21b4f12SGleb Natapov 	report("BP exeption", test_count == 1);
168d21b4f12SGleb Natapov 
169ce71ddc7SGleb Natapov 	/*
170ce71ddc7SGleb Natapov 	 * test that PF triggers task gate and error code is placed on
171ce71ddc7SGleb Natapov 	 * exception task's stack
172ce71ddc7SGleb Natapov 	 */
173ce71ddc7SGleb Natapov 	fault_addr = alloc_vpage();
174ce71ddc7SGleb Natapov 	fault_phys = (ulong)virt_to_phys(alloc_page());
175ce71ddc7SGleb Natapov 	test_count = 0;
176ce71ddc7SGleb Natapov 	set_intr_task_gate(14, pf_tss);
177ce71ddc7SGleb Natapov 	printf("Access unmapped page\n");
178ce71ddc7SGleb Natapov 	*fault_addr = 0;
179ce71ddc7SGleb Natapov 	printf("Return from pf tss\n");
180ce71ddc7SGleb Natapov 	report("PF exeption", test_count == 1);
181ce71ddc7SGleb Natapov 
182d21b4f12SGleb Natapov 	/* test that calling a task by lcall works */
183d21b4f12SGleb Natapov 	test_count = 0;
184d21b4f12SGleb Natapov 	set_intr_task_gate(0, irq_tss);
185d21b4f12SGleb Natapov 	printf("Calling task by lcall\n");
186d21b4f12SGleb Natapov 	/* hlt opcode is 0xf4 I use destination IP 0xf4f4f4f4 to catch
187d21b4f12SGleb Natapov 	   incorrect instruction length calculation */
188d21b4f12SGleb Natapov 	asm volatile("lcall $" xstr(TSS_INTR) ", $0xf4f4f4f4");
189d21b4f12SGleb Natapov 	printf("Return from call\n");
190d21b4f12SGleb Natapov 	report("lcall", test_count == 1);
191d21b4f12SGleb Natapov 
192d21b4f12SGleb Natapov 	/* call the same task again and check that it restarted after iret */
193d21b4f12SGleb Natapov 	test_count = 0;
194d21b4f12SGleb Natapov 	asm volatile("lcall $" xstr(TSS_INTR) ", $0xf4f4f4f4");
195d21b4f12SGleb Natapov 	report("lcall2", test_count == 2);
196d21b4f12SGleb Natapov 
197d21b4f12SGleb Natapov 	/* test that calling a task by ljmp works */
198d21b4f12SGleb Natapov 	test_count = 0;
199d21b4f12SGleb Natapov 	set_intr_task_gate(0, jmp_tss);
200d21b4f12SGleb Natapov 	printf("Jumping to a task by ljmp\n");
201d21b4f12SGleb Natapov 	asm volatile ("ljmp $" xstr(TSS_INTR) ", $0xf4f4f4f4");
202d21b4f12SGleb Natapov 	printf("Jump back succeeded\n");
203d21b4f12SGleb Natapov 	report("ljmp", test_count == 1);
204b01c8823SKevin Wolf }
205b01c8823SKevin Wolf 
206b01c8823SKevin Wolf void test_vm86_switch(void)
207b01c8823SKevin Wolf {
208b01c8823SKevin Wolf     static tss32_t main_tss;
209b01c8823SKevin Wolf     static tss32_t vm86_tss;
210b01c8823SKevin Wolf 
211b01c8823SKevin Wolf     u8 *vm86_start;
212b01c8823SKevin Wolf 
213b01c8823SKevin Wolf     /* Write a 'ud2' instruction somewhere below 1 MB */
214b01c8823SKevin Wolf     vm86_start = (void*) 0x42000;
215b01c8823SKevin Wolf     vm86_start[0] = 0x0f;
216b01c8823SKevin Wolf     vm86_start[1] = 0x0b;
217b01c8823SKevin Wolf 
218b01c8823SKevin Wolf     /* Main TSS */
219*67961d18SPaolo Bonzini     set_gdt_entry(MAIN_TSS_SEL, (u32)&main_tss, sizeof(tss32_t) - 1, 0x89, 0);
220*67961d18SPaolo Bonzini     ltr(MAIN_TSS_SEL);
221b01c8823SKevin Wolf     main_tss = (tss32_t) {
222*67961d18SPaolo Bonzini         .prev   = VM86_TSS_SEL,
223b01c8823SKevin Wolf         .cr3    = read_cr3(),
224b01c8823SKevin Wolf     };
225b01c8823SKevin Wolf 
226b01c8823SKevin Wolf     /* VM86 TSS (marked as busy, so we can iret to it) */
227*67961d18SPaolo Bonzini     set_gdt_entry(VM86_TSS_SEL, (u32)&vm86_tss, sizeof(tss32_t) - 1, 0x8b, 0);
228b01c8823SKevin Wolf     vm86_tss = (tss32_t) {
229b01c8823SKevin Wolf         .eflags = 0x20002,
230b01c8823SKevin Wolf         .cr3    = read_cr3(),
231b01c8823SKevin Wolf         .eip    = (u32) vm86_start & 0x0f,
232b01c8823SKevin Wolf         .cs     = (u32) vm86_start >> 4,
233b01c8823SKevin Wolf         .ds     = 0x1234,
234b01c8823SKevin Wolf         .es     = 0x2345,
235b01c8823SKevin Wolf     };
236b01c8823SKevin Wolf 
237b01c8823SKevin Wolf     /* Setup task gate to main TSS for #UD */
238*67961d18SPaolo Bonzini     set_idt_task_gate(6, MAIN_TSS_SEL);
239b01c8823SKevin Wolf 
240b01c8823SKevin Wolf     /* Jump into VM86 task with iret, #UD lets it come back immediately */
241b01c8823SKevin Wolf     printf("Switch to VM86 task and back\n");
242b01c8823SKevin Wolf     asm volatile(
243b01c8823SKevin Wolf         "pushf\n"
244b01c8823SKevin Wolf         "orw $0x4000, (%esp)\n"
245b01c8823SKevin Wolf         "popf\n"
246b01c8823SKevin Wolf         "iret\n"
247b01c8823SKevin Wolf     );
248b01c8823SKevin Wolf     report("VM86", 1);
249b01c8823SKevin Wolf }
250b01c8823SKevin Wolf 
251b01c8823SKevin Wolf int main()
252b01c8823SKevin Wolf {
253b01c8823SKevin Wolf 	setup_vm();
254b01c8823SKevin Wolf 	setup_idt();
255b01c8823SKevin Wolf 	setup_gdt();
256b01c8823SKevin Wolf 	setup_tss32();
257b01c8823SKevin Wolf 
258b01c8823SKevin Wolf 	test_kernel_mode_int();
259b01c8823SKevin Wolf 	test_vm86_switch();
260d21b4f12SGleb Natapov 
261f3cdd159SJan Kiszka 	return report_summary();
262d21b4f12SGleb Natapov }
263