xref: /kvm-unit-tests/x86/vmx.c (revision 06846df56370af39fb4c9cfd71c032197133929b)
1 /*
2  * x86/vmx.c : Framework for testing nested virtualization
3  *	This is a framework to test nested VMX for KVM, which
4  * 	started as a project of GSoC 2013. All test cases should
5  *	be located in x86/vmx_tests.c and framework related
6  *	functions should be in this file.
7  *
8  * How to write test cases?
9  *	Add callbacks of test suite in variant "vmx_tests". You can
10  *	write:
11  *		1. init function used for initializing test suite
12  *		2. main function for codes running in L2 guest,
13  *		3. exit_handler to handle vmexit of L2 to L1
14  *		4. syscall handler to handle L2 syscall vmexit
15  *		5. vmenter fail handler to handle direct failure of vmenter
16  *		6. guest_regs is loaded when vmenter and saved when
17  *			vmexit, you can read and set it in exit_handler
18  *	If no special function is needed for a test suite, use
19  *	coressponding basic_* functions as callback. More handlers
20  *	can be added to "vmx_tests", see details of "struct vmx_test"
21  *	and function test_run().
22  *
23  * Currently, vmx test framework only set up one VCPU and one
24  * concurrent guest test environment with same paging for L2 and
25  * L1. For usage of EPT, only 1:1 mapped paging is used from VFN
26  * to PFN.
27  *
28  * Author : Arthur Chunqi Li <yzt356@gmail.com>
29  */
30 
31 #include "libcflat.h"
32 #include "processor.h"
33 #include "alloc_page.h"
34 #include "vm.h"
35 #include "desc.h"
36 #include "vmx.h"
37 #include "msr.h"
38 #include "smp.h"
39 
40 u64 *vmxon_region;
41 struct vmcs *vmcs_root;
42 u32 vpid_cnt;
43 void *guest_stack, *guest_syscall_stack;
44 u32 ctrl_pin, ctrl_enter, ctrl_exit, ctrl_cpu[2];
45 struct regs regs;
46 
47 struct vmx_test *current;
48 
49 #define MAX_TEST_TEARDOWN_STEPS 10
50 
51 struct test_teardown_step {
52 	test_teardown_func func;
53 	void *data;
54 };
55 
56 static int teardown_count;
57 static struct test_teardown_step teardown_steps[MAX_TEST_TEARDOWN_STEPS];
58 
59 static test_guest_func v2_guest_main;
60 
61 u64 hypercall_field;
62 bool launched;
63 static int matched;
64 static int guest_finished;
65 static int in_guest;
66 
67 union vmx_basic basic;
68 union vmx_ctrl_msr ctrl_pin_rev;
69 union vmx_ctrl_msr ctrl_cpu_rev[2];
70 union vmx_ctrl_msr ctrl_exit_rev;
71 union vmx_ctrl_msr ctrl_enter_rev;
72 union vmx_ept_vpid  ept_vpid;
73 
74 extern struct descriptor_table_ptr gdt64_desc;
75 extern struct descriptor_table_ptr idt_descr;
76 extern struct descriptor_table_ptr tss_descr;
77 extern void *vmx_return;
78 extern void *entry_sysenter;
79 extern void *guest_entry;
80 
81 static volatile u32 stage;
82 
83 static jmp_buf abort_target;
84 
85 struct vmcs_field {
86 	u64 mask;
87 	u64 encoding;
88 };
89 
90 #define MASK(_bits) GENMASK_ULL((_bits) - 1, 0)
91 #define MASK_NATURAL MASK(sizeof(unsigned long) * 8)
92 
93 static struct vmcs_field vmcs_fields[] = {
94 	{ MASK(16), VPID },
95 	{ MASK(16), PINV },
96 	{ MASK(16), EPTP_IDX },
97 
98 	{ MASK(16), GUEST_SEL_ES },
99 	{ MASK(16), GUEST_SEL_CS },
100 	{ MASK(16), GUEST_SEL_SS },
101 	{ MASK(16), GUEST_SEL_DS },
102 	{ MASK(16), GUEST_SEL_FS },
103 	{ MASK(16), GUEST_SEL_GS },
104 	{ MASK(16), GUEST_SEL_LDTR },
105 	{ MASK(16), GUEST_SEL_TR },
106 	{ MASK(16), GUEST_INT_STATUS },
107 
108 	{ MASK(16), HOST_SEL_ES },
109 	{ MASK(16), HOST_SEL_CS },
110 	{ MASK(16), HOST_SEL_SS },
111 	{ MASK(16), HOST_SEL_DS },
112 	{ MASK(16), HOST_SEL_FS },
113 	{ MASK(16), HOST_SEL_GS },
114 	{ MASK(16), HOST_SEL_TR },
115 
116 	{ MASK(64), IO_BITMAP_A },
117 	{ MASK(64), IO_BITMAP_B },
118 	{ MASK(64), MSR_BITMAP },
119 	{ MASK(64), EXIT_MSR_ST_ADDR },
120 	{ MASK(64), EXIT_MSR_LD_ADDR },
121 	{ MASK(64), ENTER_MSR_LD_ADDR },
122 	{ MASK(64), VMCS_EXEC_PTR },
123 	{ MASK(64), TSC_OFFSET },
124 	{ MASK(64), APIC_VIRT_ADDR },
125 	{ MASK(64), APIC_ACCS_ADDR },
126 	{ MASK(64), EPTP },
127 
128 	{ MASK(64), INFO_PHYS_ADDR },
129 
130 	{ MASK(64), VMCS_LINK_PTR },
131 	{ MASK(64), GUEST_DEBUGCTL },
132 	{ MASK(64), GUEST_EFER },
133 	{ MASK(64), GUEST_PAT },
134 	{ MASK(64), GUEST_PERF_GLOBAL_CTRL },
135 	{ MASK(64), GUEST_PDPTE },
136 
137 	{ MASK(64), HOST_PAT },
138 	{ MASK(64), HOST_EFER },
139 	{ MASK(64), HOST_PERF_GLOBAL_CTRL },
140 
141 	{ MASK(32), PIN_CONTROLS },
142 	{ MASK(32), CPU_EXEC_CTRL0 },
143 	{ MASK(32), EXC_BITMAP },
144 	{ MASK(32), PF_ERROR_MASK },
145 	{ MASK(32), PF_ERROR_MATCH },
146 	{ MASK(32), CR3_TARGET_COUNT },
147 	{ MASK(32), EXI_CONTROLS },
148 	{ MASK(32), EXI_MSR_ST_CNT },
149 	{ MASK(32), EXI_MSR_LD_CNT },
150 	{ MASK(32), ENT_CONTROLS },
151 	{ MASK(32), ENT_MSR_LD_CNT },
152 	{ MASK(32), ENT_INTR_INFO },
153 	{ MASK(32), ENT_INTR_ERROR },
154 	{ MASK(32), ENT_INST_LEN },
155 	{ MASK(32), TPR_THRESHOLD },
156 	{ MASK(32), CPU_EXEC_CTRL1 },
157 
158 	{ MASK(32), VMX_INST_ERROR },
159 	{ MASK(32), EXI_REASON },
160 	{ MASK(32), EXI_INTR_INFO },
161 	{ MASK(32), EXI_INTR_ERROR },
162 	{ MASK(32), IDT_VECT_INFO },
163 	{ MASK(32), IDT_VECT_ERROR },
164 	{ MASK(32), EXI_INST_LEN },
165 	{ MASK(32), EXI_INST_INFO },
166 
167 	{ MASK(32), GUEST_LIMIT_ES },
168 	{ MASK(32), GUEST_LIMIT_CS },
169 	{ MASK(32), GUEST_LIMIT_SS },
170 	{ MASK(32), GUEST_LIMIT_DS },
171 	{ MASK(32), GUEST_LIMIT_FS },
172 	{ MASK(32), GUEST_LIMIT_GS },
173 	{ MASK(32), GUEST_LIMIT_LDTR },
174 	{ MASK(32), GUEST_LIMIT_TR },
175 	{ MASK(32), GUEST_LIMIT_GDTR },
176 	{ MASK(32), GUEST_LIMIT_IDTR },
177 	{ 0x1d0ff, GUEST_AR_ES },
178 	{ 0x1f0ff, GUEST_AR_CS },
179 	{ 0x1d0ff, GUEST_AR_SS },
180 	{ 0x1d0ff, GUEST_AR_DS },
181 	{ 0x1d0ff, GUEST_AR_FS },
182 	{ 0x1d0ff, GUEST_AR_GS },
183 	{ 0x1d0ff, GUEST_AR_LDTR },
184 	{ 0x1d0ff, GUEST_AR_TR },
185 	{ MASK(32), GUEST_INTR_STATE },
186 	{ MASK(32), GUEST_ACTV_STATE },
187 	{ MASK(32), GUEST_SMBASE },
188 	{ MASK(32), GUEST_SYSENTER_CS },
189 	{ MASK(32), PREEMPT_TIMER_VALUE },
190 
191 	{ MASK(32), HOST_SYSENTER_CS },
192 
193 	{ MASK_NATURAL, CR0_MASK },
194 	{ MASK_NATURAL, CR4_MASK },
195 	{ MASK_NATURAL, CR0_READ_SHADOW },
196 	{ MASK_NATURAL, CR4_READ_SHADOW },
197 	{ MASK_NATURAL, CR3_TARGET_0 },
198 	{ MASK_NATURAL, CR3_TARGET_1 },
199 	{ MASK_NATURAL, CR3_TARGET_2 },
200 	{ MASK_NATURAL, CR3_TARGET_3 },
201 
202 	{ MASK_NATURAL, EXI_QUALIFICATION },
203 	{ MASK_NATURAL, IO_RCX },
204 	{ MASK_NATURAL, IO_RSI },
205 	{ MASK_NATURAL, IO_RDI },
206 	{ MASK_NATURAL, IO_RIP },
207 	{ MASK_NATURAL, GUEST_LINEAR_ADDRESS },
208 
209 	{ MASK_NATURAL, GUEST_CR0 },
210 	{ MASK_NATURAL, GUEST_CR3 },
211 	{ MASK_NATURAL, GUEST_CR4 },
212 	{ MASK_NATURAL, GUEST_BASE_ES },
213 	{ MASK_NATURAL, GUEST_BASE_CS },
214 	{ MASK_NATURAL, GUEST_BASE_SS },
215 	{ MASK_NATURAL, GUEST_BASE_DS },
216 	{ MASK_NATURAL, GUEST_BASE_FS },
217 	{ MASK_NATURAL, GUEST_BASE_GS },
218 	{ MASK_NATURAL, GUEST_BASE_LDTR },
219 	{ MASK_NATURAL, GUEST_BASE_TR },
220 	{ MASK_NATURAL, GUEST_BASE_GDTR },
221 	{ MASK_NATURAL, GUEST_BASE_IDTR },
222 	{ MASK_NATURAL, GUEST_DR7 },
223 	{ MASK_NATURAL, GUEST_RSP },
224 	{ MASK_NATURAL, GUEST_RIP },
225 	{ MASK_NATURAL, GUEST_RFLAGS },
226 	{ MASK_NATURAL, GUEST_PENDING_DEBUG },
227 	{ MASK_NATURAL, GUEST_SYSENTER_ESP },
228 	{ MASK_NATURAL, GUEST_SYSENTER_EIP },
229 
230 	{ MASK_NATURAL, HOST_CR0 },
231 	{ MASK_NATURAL, HOST_CR3 },
232 	{ MASK_NATURAL, HOST_CR4 },
233 	{ MASK_NATURAL, HOST_BASE_FS },
234 	{ MASK_NATURAL, HOST_BASE_GS },
235 	{ MASK_NATURAL, HOST_BASE_TR },
236 	{ MASK_NATURAL, HOST_BASE_GDTR },
237 	{ MASK_NATURAL, HOST_BASE_IDTR },
238 	{ MASK_NATURAL, HOST_SYSENTER_ESP },
239 	{ MASK_NATURAL, HOST_SYSENTER_EIP },
240 	{ MASK_NATURAL, HOST_RSP },
241 	{ MASK_NATURAL, HOST_RIP },
242 };
243 
244 enum vmcs_field_type {
245 	VMCS_FIELD_TYPE_CONTROL = 0,
246 	VMCS_FIELD_TYPE_READ_ONLY_DATA = 1,
247 	VMCS_FIELD_TYPE_GUEST = 2,
248 	VMCS_FIELD_TYPE_HOST = 3,
249 	VMCS_FIELD_TYPES,
250 };
251 
252 static inline int vmcs_field_type(struct vmcs_field *f)
253 {
254 	return (f->encoding >> VMCS_FIELD_TYPE_SHIFT) & 0x3;
255 }
256 
257 static int vmcs_field_readonly(struct vmcs_field *f)
258 {
259 	u64 ia32_vmx_misc;
260 
261 	ia32_vmx_misc = rdmsr(MSR_IA32_VMX_MISC);
262 	return !(ia32_vmx_misc & MSR_IA32_VMX_MISC_VMWRITE_SHADOW_RO_FIELDS) &&
263 		(vmcs_field_type(f) == VMCS_FIELD_TYPE_READ_ONLY_DATA);
264 }
265 
266 static inline u64 vmcs_field_value(struct vmcs_field *f, u8 cookie)
267 {
268 	u64 value;
269 
270 	/* Incorporate the cookie and the field encoding into the value. */
271 	value = cookie;
272 	value |= (f->encoding << 8);
273 	value |= 0xdeadbeefull << 32;
274 
275 	return value & f->mask;
276 }
277 
278 static void set_vmcs_field(struct vmcs_field *f, u8 cookie)
279 {
280 	vmcs_write(f->encoding, vmcs_field_value(f, cookie));
281 }
282 
283 static bool check_vmcs_field(struct vmcs_field *f, u8 cookie)
284 {
285 	u64 expected;
286 	u64 actual;
287 	int ret;
288 
289 	if (f->encoding == VMX_INST_ERROR) {
290 		printf("Skipping volatile field %lx\n", f->encoding);
291 		return true;
292 	}
293 
294 	if (vmcs_field_readonly(f)) {
295 		printf("Skipping read-only field %lx\n", f->encoding);
296 		return true;
297 	}
298 
299 	ret = vmcs_read_checking(f->encoding, &actual);
300 	assert(!(ret & X86_EFLAGS_CF));
301 	/* Skip VMCS fields that aren't recognized by the CPU */
302 	if (ret & X86_EFLAGS_ZF)
303 		return true;
304 
305 	expected = vmcs_field_value(f, cookie);
306 	actual &= f->mask;
307 
308 	if (expected == actual)
309 		return true;
310 
311 	printf("FAIL: VMWRITE/VMREAD %lx (expected: %lx, actual: %lx)\n",
312 	       f->encoding, (unsigned long) expected, (unsigned long) actual);
313 
314 	return false;
315 }
316 
317 static void set_all_vmcs_fields(u8 cookie)
318 {
319 	int i;
320 
321 	for (i = 0; i < ARRAY_SIZE(vmcs_fields); i++)
322 		set_vmcs_field(&vmcs_fields[i], cookie);
323 }
324 
325 static bool check_all_vmcs_fields(u8 cookie)
326 {
327 	bool pass = true;
328 	int i;
329 
330 	for (i = 0; i < ARRAY_SIZE(vmcs_fields); i++) {
331 		if (!check_vmcs_field(&vmcs_fields[i], cookie))
332 			pass = false;
333 	}
334 
335 	return pass;
336 }
337 
338 static void test_vmwrite_vmread(void)
339 {
340 	struct vmcs *vmcs = alloc_page();
341 
342 	memset(vmcs, 0, PAGE_SIZE);
343 	vmcs->hdr.revision_id = basic.revision;
344 	assert(!vmcs_clear(vmcs));
345 	assert(!make_vmcs_current(vmcs));
346 
347 	set_all_vmcs_fields(0x42);
348 	report("VMWRITE/VMREAD", check_all_vmcs_fields(0x42));
349 
350 	assert(!vmcs_clear(vmcs));
351 	free_page(vmcs);
352 }
353 
354 static void test_vmcs_high(void)
355 {
356 	struct vmcs *vmcs = alloc_page();
357 
358 	memset(vmcs, 0, PAGE_SIZE);
359 	vmcs->hdr.revision_id = basic.revision;
360 	assert(!vmcs_clear(vmcs));
361 	assert(!make_vmcs_current(vmcs));
362 
363 	vmcs_write(TSC_OFFSET, 0x0123456789ABCDEFull);
364 	report("VMREAD TSC_OFFSET after VMWRITE TSC_OFFSET",
365 	       vmcs_read(TSC_OFFSET) == 0x0123456789ABCDEFull);
366 	report("VMREAD TSC_OFFSET_HI after VMWRITE TSC_OFFSET",
367 	       vmcs_read(TSC_OFFSET_HI) == 0x01234567ull);
368 	vmcs_write(TSC_OFFSET_HI, 0x76543210ul);
369 	report("VMREAD TSC_OFFSET_HI after VMWRITE TSC_OFFSET_HI",
370 	       vmcs_read(TSC_OFFSET_HI) == 0x76543210ul);
371 	report("VMREAD TSC_OFFSET after VMWRITE TSC_OFFSET_HI",
372 	       vmcs_read(TSC_OFFSET) == 0x7654321089ABCDEFull);
373 
374 	assert(!vmcs_clear(vmcs));
375 	free_page(vmcs);
376 }
377 
378 static void test_vmcs_lifecycle(void)
379 {
380 	struct vmcs *vmcs[2] = {};
381 	int i;
382 
383 	for (i = 0; i < ARRAY_SIZE(vmcs); i++) {
384 		vmcs[i] = alloc_page();
385 		memset(vmcs[i], 0, PAGE_SIZE);
386 		vmcs[i]->hdr.revision_id = basic.revision;
387 	}
388 
389 #define VMPTRLD(_i) do { \
390 	assert(_i < ARRAY_SIZE(vmcs)); \
391 	assert(!make_vmcs_current(vmcs[_i])); \
392 	printf("VMPTRLD VMCS%d\n", (_i)); \
393 } while (0)
394 
395 #define VMCLEAR(_i) do { \
396 	assert(_i < ARRAY_SIZE(vmcs)); \
397 	assert(!vmcs_clear(vmcs[_i])); \
398 	printf("VMCLEAR VMCS%d\n", (_i)); \
399 } while (0)
400 
401 	VMCLEAR(0);
402 	VMPTRLD(0);
403 	set_all_vmcs_fields(0);
404 	report("current:VMCS0 active:[VMCS0]", check_all_vmcs_fields(0));
405 
406 	VMCLEAR(0);
407 	VMPTRLD(0);
408 	report("current:VMCS0 active:[VMCS0]", check_all_vmcs_fields(0));
409 
410 	VMCLEAR(1);
411 	report("current:VMCS0 active:[VMCS0]", check_all_vmcs_fields(0));
412 
413 	VMPTRLD(1);
414 	set_all_vmcs_fields(1);
415 	report("current:VMCS1 active:[VMCS0,VCMS1]", check_all_vmcs_fields(1));
416 
417 	VMPTRLD(0);
418 	report("current:VMCS0 active:[VMCS0,VCMS1]", check_all_vmcs_fields(0));
419 	VMPTRLD(1);
420 	report("current:VMCS1 active:[VMCS0,VCMS1]", check_all_vmcs_fields(1));
421 	VMPTRLD(1);
422 	report("current:VMCS1 active:[VMCS0,VCMS1]", check_all_vmcs_fields(1));
423 
424 	VMCLEAR(0);
425 	report("current:VMCS1 active:[VCMS1]", check_all_vmcs_fields(1));
426 
427 	/* VMPTRLD should not erase VMWRITEs to the current VMCS */
428 	set_all_vmcs_fields(2);
429 	VMPTRLD(1);
430 	report("current:VMCS1 active:[VCMS1]", check_all_vmcs_fields(2));
431 
432 	for (i = 0; i < ARRAY_SIZE(vmcs); i++) {
433 		VMCLEAR(i);
434 		free_page(vmcs[i]);
435 	}
436 
437 #undef VMPTRLD
438 #undef VMCLEAR
439 }
440 
441 void vmx_set_test_stage(u32 s)
442 {
443 	barrier();
444 	stage = s;
445 	barrier();
446 }
447 
448 u32 vmx_get_test_stage(void)
449 {
450 	u32 s;
451 
452 	barrier();
453 	s = stage;
454 	barrier();
455 	return s;
456 }
457 
458 void vmx_inc_test_stage(void)
459 {
460 	barrier();
461 	stage++;
462 	barrier();
463 }
464 
465 /* entry_sysenter */
466 asm(
467 	".align	4, 0x90\n\t"
468 	".globl	entry_sysenter\n\t"
469 	"entry_sysenter:\n\t"
470 	SAVE_GPR
471 	"	and	$0xf, %rax\n\t"
472 	"	mov	%rax, %rdi\n\t"
473 	"	call	syscall_handler\n\t"
474 	LOAD_GPR
475 	"	vmresume\n\t"
476 );
477 
478 static void __attribute__((__used__)) syscall_handler(u64 syscall_no)
479 {
480 	if (current->syscall_handler)
481 		current->syscall_handler(syscall_no);
482 }
483 
484 static const char * const exit_reason_descriptions[] = {
485 	[VMX_EXC_NMI]		= "VMX_EXC_NMI",
486 	[VMX_EXTINT]		= "VMX_EXTINT",
487 	[VMX_TRIPLE_FAULT]	= "VMX_TRIPLE_FAULT",
488 	[VMX_INIT]		= "VMX_INIT",
489 	[VMX_SIPI]		= "VMX_SIPI",
490 	[VMX_SMI_IO]		= "VMX_SMI_IO",
491 	[VMX_SMI_OTHER]		= "VMX_SMI_OTHER",
492 	[VMX_INTR_WINDOW]	= "VMX_INTR_WINDOW",
493 	[VMX_NMI_WINDOW]	= "VMX_NMI_WINDOW",
494 	[VMX_TASK_SWITCH]	= "VMX_TASK_SWITCH",
495 	[VMX_CPUID]		= "VMX_CPUID",
496 	[VMX_GETSEC]		= "VMX_GETSEC",
497 	[VMX_HLT]		= "VMX_HLT",
498 	[VMX_INVD]		= "VMX_INVD",
499 	[VMX_INVLPG]		= "VMX_INVLPG",
500 	[VMX_RDPMC]		= "VMX_RDPMC",
501 	[VMX_RDTSC]		= "VMX_RDTSC",
502 	[VMX_RSM]		= "VMX_RSM",
503 	[VMX_VMCALL]		= "VMX_VMCALL",
504 	[VMX_VMCLEAR]		= "VMX_VMCLEAR",
505 	[VMX_VMLAUNCH]		= "VMX_VMLAUNCH",
506 	[VMX_VMPTRLD]		= "VMX_VMPTRLD",
507 	[VMX_VMPTRST]		= "VMX_VMPTRST",
508 	[VMX_VMREAD]		= "VMX_VMREAD",
509 	[VMX_VMRESUME]		= "VMX_VMRESUME",
510 	[VMX_VMWRITE]		= "VMX_VMWRITE",
511 	[VMX_VMXOFF]		= "VMX_VMXOFF",
512 	[VMX_VMXON]		= "VMX_VMXON",
513 	[VMX_CR]		= "VMX_CR",
514 	[VMX_DR]		= "VMX_DR",
515 	[VMX_IO]		= "VMX_IO",
516 	[VMX_RDMSR]		= "VMX_RDMSR",
517 	[VMX_WRMSR]		= "VMX_WRMSR",
518 	[VMX_FAIL_STATE]	= "VMX_FAIL_STATE",
519 	[VMX_FAIL_MSR]		= "VMX_FAIL_MSR",
520 	[VMX_MWAIT]		= "VMX_MWAIT",
521 	[VMX_MTF]		= "VMX_MTF",
522 	[VMX_MONITOR]		= "VMX_MONITOR",
523 	[VMX_PAUSE]		= "VMX_PAUSE",
524 	[VMX_FAIL_MCHECK]	= "VMX_FAIL_MCHECK",
525 	[VMX_TPR_THRESHOLD]	= "VMX_TPR_THRESHOLD",
526 	[VMX_APIC_ACCESS]	= "VMX_APIC_ACCESS",
527 	[VMX_EOI_INDUCED]	= "VMX_EOI_INDUCED",
528 	[VMX_GDTR_IDTR]		= "VMX_GDTR_IDTR",
529 	[VMX_LDTR_TR]		= "VMX_LDTR_TR",
530 	[VMX_EPT_VIOLATION]	= "VMX_EPT_VIOLATION",
531 	[VMX_EPT_MISCONFIG]	= "VMX_EPT_MISCONFIG",
532 	[VMX_INVEPT]		= "VMX_INVEPT",
533 	[VMX_PREEMPT]		= "VMX_PREEMPT",
534 	[VMX_INVVPID]		= "VMX_INVVPID",
535 	[VMX_WBINVD]		= "VMX_WBINVD",
536 	[VMX_XSETBV]		= "VMX_XSETBV",
537 	[VMX_APIC_WRITE]	= "VMX_APIC_WRITE",
538 	[VMX_RDRAND]		= "VMX_RDRAND",
539 	[VMX_INVPCID]		= "VMX_INVPCID",
540 	[VMX_VMFUNC]		= "VMX_VMFUNC",
541 	[VMX_RDSEED]		= "VMX_RDSEED",
542 	[VMX_PML_FULL]		= "VMX_PML_FULL",
543 	[VMX_XSAVES]		= "VMX_XSAVES",
544 	[VMX_XRSTORS]		= "VMX_XRSTORS",
545 };
546 
547 const char *exit_reason_description(u64 reason)
548 {
549 	if (reason >= ARRAY_SIZE(exit_reason_descriptions))
550 		return "(unknown)";
551 	return exit_reason_descriptions[reason] ? : "(unused)";
552 }
553 
554 void print_vmexit_info()
555 {
556 	u64 guest_rip, guest_rsp;
557 	ulong reason = vmcs_read(EXI_REASON) & 0xff;
558 	ulong exit_qual = vmcs_read(EXI_QUALIFICATION);
559 	guest_rip = vmcs_read(GUEST_RIP);
560 	guest_rsp = vmcs_read(GUEST_RSP);
561 	printf("VMEXIT info:\n");
562 	printf("\tvmexit reason = %ld\n", reason);
563 	printf("\texit qualification = %#lx\n", exit_qual);
564 	printf("\tBit 31 of reason = %lx\n", (vmcs_read(EXI_REASON) >> 31) & 1);
565 	printf("\tguest_rip = %#lx\n", guest_rip);
566 	printf("\tRAX=%#lx    RBX=%#lx    RCX=%#lx    RDX=%#lx\n",
567 		regs.rax, regs.rbx, regs.rcx, regs.rdx);
568 	printf("\tRSP=%#lx    RBP=%#lx    RSI=%#lx    RDI=%#lx\n",
569 		guest_rsp, regs.rbp, regs.rsi, regs.rdi);
570 	printf("\tR8 =%#lx    R9 =%#lx    R10=%#lx    R11=%#lx\n",
571 		regs.r8, regs.r9, regs.r10, regs.r11);
572 	printf("\tR12=%#lx    R13=%#lx    R14=%#lx    R15=%#lx\n",
573 		regs.r12, regs.r13, regs.r14, regs.r15);
574 }
575 
576 void
577 print_vmentry_failure_info(struct vmentry_failure *failure) {
578 	if (failure->early) {
579 		printf("Early %s failure: ", failure->instr);
580 		switch (failure->flags & VMX_ENTRY_FLAGS) {
581 		case X86_EFLAGS_CF:
582 			printf("current-VMCS pointer is not valid.\n");
583 			break;
584 		case X86_EFLAGS_ZF:
585 			printf("error number is %ld. See Intel 30.4.\n",
586 			       vmcs_read(VMX_INST_ERROR));
587 			break;
588 		default:
589 			printf("unexpected flags %lx!\n", failure->flags);
590 		}
591 	} else {
592 		u64 reason = vmcs_read(EXI_REASON);
593 		u64 qual = vmcs_read(EXI_QUALIFICATION);
594 
595 		printf("Non-early %s failure (reason=%#lx, qual=%#lx): ",
596 			failure->instr, reason, qual);
597 
598 		switch (reason & 0xff) {
599 		case VMX_FAIL_STATE:
600 			printf("invalid guest state\n");
601 			break;
602 		case VMX_FAIL_MSR:
603 			printf("MSR loading\n");
604 			break;
605 		case VMX_FAIL_MCHECK:
606 			printf("machine-check event\n");
607 			break;
608 		default:
609 			printf("unexpected basic exit reason %ld\n",
610 			       reason & 0xff);
611 		}
612 
613 		if (!(reason & VMX_ENTRY_FAILURE))
614 			printf("\tVMX_ENTRY_FAILURE BIT NOT SET!\n");
615 
616 		if (reason & 0x7fff0000)
617 			printf("\tRESERVED BITS SET!\n");
618 	}
619 }
620 
621 /*
622  * VMCLEAR should ensures all VMCS state is flushed to the VMCS
623  * region in memory.
624  */
625 static void test_vmclear_flushing(void)
626 {
627 	struct vmcs *vmcs[3] = {};
628 	int i;
629 
630 	for (i = 0; i < ARRAY_SIZE(vmcs); i++) {
631 		vmcs[i] = alloc_page();
632 		memset(vmcs[i], 0, PAGE_SIZE);
633 	}
634 
635 	vmcs[0]->hdr.revision_id = basic.revision;
636 	assert(!vmcs_clear(vmcs[0]));
637 	assert(!make_vmcs_current(vmcs[0]));
638 	set_all_vmcs_fields(0x86);
639 
640 	assert(!vmcs_clear(vmcs[0]));
641 	memcpy(vmcs[1], vmcs[0], basic.size);
642 	assert(!make_vmcs_current(vmcs[1]));
643 	report("test vmclear flush (current VMCS)", check_all_vmcs_fields(0x86));
644 
645 	set_all_vmcs_fields(0x87);
646 	assert(!make_vmcs_current(vmcs[0]));
647 	assert(!vmcs_clear(vmcs[1]));
648 	memcpy(vmcs[2], vmcs[1], basic.size);
649 	assert(!make_vmcs_current(vmcs[2]));
650 	report("test vmclear flush (!current VMCS)", check_all_vmcs_fields(0x87));
651 
652 	for (i = 0; i < ARRAY_SIZE(vmcs); i++) {
653 		assert(!vmcs_clear(vmcs[i]));
654 		free_page(vmcs[i]);
655 	}
656 }
657 
658 static void test_vmclear(void)
659 {
660 	struct vmcs *tmp_root;
661 	int width = cpuid_maxphyaddr();
662 
663 	/*
664 	 * Note- The tests below do not necessarily have a
665 	 * valid VMCS, but that's ok since the invalid vmcs
666 	 * is only used for a specific test and is discarded
667 	 * without touching its contents
668 	 */
669 
670 	/* Unaligned page access */
671 	tmp_root = (struct vmcs *)((intptr_t)vmcs_root + 1);
672 	report("test vmclear with unaligned vmcs",
673 	       vmcs_clear(tmp_root) == 1);
674 
675 	/* gpa bits beyond physical address width are set*/
676 	tmp_root = (struct vmcs *)((intptr_t)vmcs_root |
677 				   ((u64)1 << (width+1)));
678 	report("test vmclear with vmcs address bits set beyond physical address width",
679 	       vmcs_clear(tmp_root) == 1);
680 
681 	/* Pass VMXON region */
682 	tmp_root = (struct vmcs *)vmxon_region;
683 	report("test vmclear with vmxon region",
684 	       vmcs_clear(tmp_root) == 1);
685 
686 	/* Valid VMCS */
687 	report("test vmclear with valid vmcs region", vmcs_clear(vmcs_root) == 0);
688 
689 	test_vmclear_flushing();
690 }
691 
692 static void __attribute__((__used__)) guest_main(void)
693 {
694 	if (current->v2)
695 		v2_guest_main();
696 	else
697 		current->guest_main();
698 }
699 
700 /* guest_entry */
701 asm(
702 	".align	4, 0x90\n\t"
703 	".globl	entry_guest\n\t"
704 	"guest_entry:\n\t"
705 	"	call guest_main\n\t"
706 	"	mov $1, %edi\n\t"
707 	"	call hypercall\n\t"
708 );
709 
710 /* EPT paging structure related functions */
711 /* split_large_ept_entry: Split a 2M/1G large page into 512 smaller PTEs.
712 		@ptep : large page table entry to split
713 		@level : level of ptep (2 or 3)
714  */
715 static void split_large_ept_entry(unsigned long *ptep, int level)
716 {
717 	unsigned long *new_pt;
718 	unsigned long gpa;
719 	unsigned long pte;
720 	unsigned long prototype;
721 	int i;
722 
723 	pte = *ptep;
724 	assert(pte & EPT_PRESENT);
725 	assert(pte & EPT_LARGE_PAGE);
726 	assert(level == 2 || level == 3);
727 
728 	new_pt = alloc_page();
729 	assert(new_pt);
730 	memset(new_pt, 0, PAGE_SIZE);
731 
732 	prototype = pte & ~EPT_ADDR_MASK;
733 	if (level == 2)
734 		prototype &= ~EPT_LARGE_PAGE;
735 
736 	gpa = pte & EPT_ADDR_MASK;
737 	for (i = 0; i < EPT_PGDIR_ENTRIES; i++) {
738 		new_pt[i] = prototype | gpa;
739 		gpa += 1ul << EPT_LEVEL_SHIFT(level - 1);
740 	}
741 
742 	pte &= ~EPT_LARGE_PAGE;
743 	pte &= ~EPT_ADDR_MASK;
744 	pte |= virt_to_phys(new_pt);
745 
746 	*ptep = pte;
747 }
748 
749 /* install_ept_entry : Install a page to a given level in EPT
750 		@pml4 : addr of pml4 table
751 		@pte_level : level of PTE to set
752 		@guest_addr : physical address of guest
753 		@pte : pte value to set
754 		@pt_page : address of page table, NULL for a new page
755  */
756 void install_ept_entry(unsigned long *pml4,
757 		int pte_level,
758 		unsigned long guest_addr,
759 		unsigned long pte,
760 		unsigned long *pt_page)
761 {
762 	int level;
763 	unsigned long *pt = pml4;
764 	unsigned offset;
765 
766 	/* EPT only uses 48 bits of GPA. */
767 	assert(guest_addr < (1ul << 48));
768 
769 	for (level = EPT_PAGE_LEVEL; level > pte_level; --level) {
770 		offset = (guest_addr >> EPT_LEVEL_SHIFT(level))
771 				& EPT_PGDIR_MASK;
772 		if (!(pt[offset] & (EPT_PRESENT))) {
773 			unsigned long *new_pt = pt_page;
774 			if (!new_pt)
775 				new_pt = alloc_page();
776 			else
777 				pt_page = 0;
778 			memset(new_pt, 0, PAGE_SIZE);
779 			pt[offset] = virt_to_phys(new_pt)
780 					| EPT_RA | EPT_WA | EPT_EA;
781 		} else if (pt[offset] & EPT_LARGE_PAGE)
782 			split_large_ept_entry(&pt[offset], level);
783 		pt = phys_to_virt(pt[offset] & EPT_ADDR_MASK);
784 	}
785 	offset = (guest_addr >> EPT_LEVEL_SHIFT(level)) & EPT_PGDIR_MASK;
786 	pt[offset] = pte;
787 }
788 
789 /* Map a page, @perm is the permission of the page */
790 void install_ept(unsigned long *pml4,
791 		unsigned long phys,
792 		unsigned long guest_addr,
793 		u64 perm)
794 {
795 	install_ept_entry(pml4, 1, guest_addr, (phys & PAGE_MASK) | perm, 0);
796 }
797 
798 /* Map a 1G-size page */
799 void install_1g_ept(unsigned long *pml4,
800 		unsigned long phys,
801 		unsigned long guest_addr,
802 		u64 perm)
803 {
804 	install_ept_entry(pml4, 3, guest_addr,
805 			(phys & PAGE_MASK) | perm | EPT_LARGE_PAGE, 0);
806 }
807 
808 /* Map a 2M-size page */
809 void install_2m_ept(unsigned long *pml4,
810 		unsigned long phys,
811 		unsigned long guest_addr,
812 		u64 perm)
813 {
814 	install_ept_entry(pml4, 2, guest_addr,
815 			(phys & PAGE_MASK) | perm | EPT_LARGE_PAGE, 0);
816 }
817 
818 /* setup_ept_range : Setup a range of 1:1 mapped page to EPT paging structure.
819 		@start : start address of guest page
820 		@len : length of address to be mapped
821 		@map_1g : whether 1G page map is used
822 		@map_2m : whether 2M page map is used
823 		@perm : permission for every page
824  */
825 void setup_ept_range(unsigned long *pml4, unsigned long start,
826 		     unsigned long len, int map_1g, int map_2m, u64 perm)
827 {
828 	u64 phys = start;
829 	u64 max = (u64)len + (u64)start;
830 
831 	if (map_1g) {
832 		while (phys + PAGE_SIZE_1G <= max) {
833 			install_1g_ept(pml4, phys, phys, perm);
834 			phys += PAGE_SIZE_1G;
835 		}
836 	}
837 	if (map_2m) {
838 		while (phys + PAGE_SIZE_2M <= max) {
839 			install_2m_ept(pml4, phys, phys, perm);
840 			phys += PAGE_SIZE_2M;
841 		}
842 	}
843 	while (phys + PAGE_SIZE <= max) {
844 		install_ept(pml4, phys, phys, perm);
845 		phys += PAGE_SIZE;
846 	}
847 }
848 
849 /* get_ept_pte : Get the PTE of a given level in EPT,
850     @level == 1 means get the latest level*/
851 bool get_ept_pte(unsigned long *pml4, unsigned long guest_addr, int level,
852 		unsigned long *pte)
853 {
854 	int l;
855 	unsigned long *pt = pml4, iter_pte;
856 	unsigned offset;
857 
858 	assert(level >= 1 && level <= 4);
859 
860 	for (l = EPT_PAGE_LEVEL; ; --l) {
861 		offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK;
862 		iter_pte = pt[offset];
863 		if (l == level)
864 			break;
865 		if (l < 4 && (iter_pte & EPT_LARGE_PAGE))
866 			return false;
867 		if (!(iter_pte & (EPT_PRESENT)))
868 			return false;
869 		pt = (unsigned long *)(iter_pte & EPT_ADDR_MASK);
870 	}
871 	offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK;
872 	if (pte)
873 		*pte = pt[offset];
874 	return true;
875 }
876 
877 static void clear_ept_ad_pte(unsigned long *pml4, unsigned long guest_addr)
878 {
879 	int l;
880 	unsigned long *pt = pml4;
881 	u64 pte;
882 	unsigned offset;
883 
884 	for (l = EPT_PAGE_LEVEL; ; --l) {
885 		offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK;
886 		pt[offset] &= ~(EPT_ACCESS_FLAG|EPT_DIRTY_FLAG);
887 		pte = pt[offset];
888 		if (l == 1 || (l < 4 && (pte & EPT_LARGE_PAGE)))
889 			break;
890 		pt = (unsigned long *)(pte & EPT_ADDR_MASK);
891 	}
892 }
893 
894 /* clear_ept_ad : Clear EPT A/D bits for the page table walk and the
895    final GPA of a guest address.  */
896 void clear_ept_ad(unsigned long *pml4, u64 guest_cr3,
897 		  unsigned long guest_addr)
898 {
899 	int l;
900 	unsigned long *pt = (unsigned long *)guest_cr3, gpa;
901 	u64 pte, offset_in_page;
902 	unsigned offset;
903 
904 	for (l = EPT_PAGE_LEVEL; ; --l) {
905 		offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK;
906 
907 		clear_ept_ad_pte(pml4, (u64) &pt[offset]);
908 		pte = pt[offset];
909 		if (l == 1 || (l < 4 && (pte & PT_PAGE_SIZE_MASK)))
910 			break;
911 		if (!(pte & PT_PRESENT_MASK))
912 			return;
913 		pt = (unsigned long *)(pte & PT_ADDR_MASK);
914 	}
915 
916 	offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK;
917 	offset_in_page = guest_addr & ((1 << EPT_LEVEL_SHIFT(l)) - 1);
918 	gpa = (pt[offset] & PT_ADDR_MASK) | (guest_addr & offset_in_page);
919 	clear_ept_ad_pte(pml4, gpa);
920 }
921 
922 /* check_ept_ad : Check the content of EPT A/D bits for the page table
923    walk and the final GPA of a guest address.  */
924 void check_ept_ad(unsigned long *pml4, u64 guest_cr3,
925 		  unsigned long guest_addr, int expected_gpa_ad,
926 		  int expected_pt_ad)
927 {
928 	int l;
929 	unsigned long *pt = (unsigned long *)guest_cr3, gpa;
930 	u64 ept_pte, pte, offset_in_page;
931 	unsigned offset;
932 	bool bad_pt_ad = false;
933 
934 	for (l = EPT_PAGE_LEVEL; ; --l) {
935 		offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK;
936 
937 		if (!get_ept_pte(pml4, (u64) &pt[offset], 1, &ept_pte)) {
938 			printf("EPT - guest level %d page table is not mapped.\n", l);
939 			return;
940 		}
941 
942 		if (!bad_pt_ad) {
943 			bad_pt_ad |= (ept_pte & (EPT_ACCESS_FLAG|EPT_DIRTY_FLAG)) != expected_pt_ad;
944 			if (bad_pt_ad)
945 				report("EPT - guest level %d page table A=%d/D=%d",
946 				       false, l,
947 				       !!(expected_pt_ad & EPT_ACCESS_FLAG),
948 				       !!(expected_pt_ad & EPT_DIRTY_FLAG));
949 		}
950 
951 		pte = pt[offset];
952 		if (l == 1 || (l < 4 && (pte & PT_PAGE_SIZE_MASK)))
953 			break;
954 		if (!(pte & PT_PRESENT_MASK))
955 			return;
956 		pt = (unsigned long *)(pte & PT_ADDR_MASK);
957 	}
958 
959 	if (!bad_pt_ad)
960 		report("EPT - guest page table structures A=%d/D=%d",
961 		       true,
962 		       !!(expected_pt_ad & EPT_ACCESS_FLAG),
963 		       !!(expected_pt_ad & EPT_DIRTY_FLAG));
964 
965 	offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK;
966 	offset_in_page = guest_addr & ((1 << EPT_LEVEL_SHIFT(l)) - 1);
967 	gpa = (pt[offset] & PT_ADDR_MASK) | (guest_addr & offset_in_page);
968 
969 	if (!get_ept_pte(pml4, gpa, 1, &ept_pte)) {
970 		report("EPT - guest physical address is not mapped", false);
971 		return;
972 	}
973 	report("EPT - guest physical address A=%d/D=%d",
974 	       (ept_pte & (EPT_ACCESS_FLAG|EPT_DIRTY_FLAG)) == expected_gpa_ad,
975 	       !!(expected_gpa_ad & EPT_ACCESS_FLAG),
976 	       !!(expected_gpa_ad & EPT_DIRTY_FLAG));
977 }
978 
979 
980 void ept_sync(int type, u64 eptp)
981 {
982 	switch (type) {
983 	case INVEPT_SINGLE:
984 		if (ept_vpid.val & EPT_CAP_INVEPT_SINGLE) {
985 			invept(INVEPT_SINGLE, eptp);
986 			break;
987 		}
988 		/* else fall through */
989 	case INVEPT_GLOBAL:
990 		if (ept_vpid.val & EPT_CAP_INVEPT_ALL) {
991 			invept(INVEPT_GLOBAL, eptp);
992 			break;
993 		}
994 		/* else fall through */
995 	default:
996 		printf("WARNING: invept is not supported!\n");
997 	}
998 }
999 
1000 void set_ept_pte(unsigned long *pml4, unsigned long guest_addr,
1001 		 int level, u64 pte_val)
1002 {
1003 	int l;
1004 	unsigned long *pt = pml4;
1005 	unsigned offset;
1006 
1007 	assert(level >= 1 && level <= 4);
1008 
1009 	for (l = EPT_PAGE_LEVEL; ; --l) {
1010 		offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK;
1011 		if (l == level)
1012 			break;
1013 		assert(pt[offset] & EPT_PRESENT);
1014 		pt = (unsigned long *)(pt[offset] & EPT_ADDR_MASK);
1015 	}
1016 	offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK;
1017 	pt[offset] = pte_val;
1018 }
1019 
1020 bool ept_2m_supported(void)
1021 {
1022 	return ept_vpid.val & EPT_CAP_2M_PAGE;
1023 }
1024 
1025 bool ept_1g_supported(void)
1026 {
1027 	return ept_vpid.val & EPT_CAP_1G_PAGE;
1028 }
1029 
1030 bool ept_huge_pages_supported(int level)
1031 {
1032 	if (level == 2)
1033 		return ept_2m_supported();
1034 	else if (level == 3)
1035 		return ept_1g_supported();
1036 	else
1037 		return false;
1038 }
1039 
1040 bool ept_execute_only_supported(void)
1041 {
1042 	return ept_vpid.val & EPT_CAP_WT;
1043 }
1044 
1045 bool ept_ad_bits_supported(void)
1046 {
1047 	return ept_vpid.val & EPT_CAP_AD_FLAG;
1048 }
1049 
1050 void vpid_sync(int type, u16 vpid)
1051 {
1052 	switch(type) {
1053 	case INVVPID_CONTEXT_GLOBAL:
1054 		if (ept_vpid.val & VPID_CAP_INVVPID_CXTGLB) {
1055 			invvpid(INVVPID_CONTEXT_GLOBAL, vpid, 0);
1056 			break;
1057 		}
1058 	case INVVPID_ALL:
1059 		if (ept_vpid.val & VPID_CAP_INVVPID_ALL) {
1060 			invvpid(INVVPID_ALL, vpid, 0);
1061 			break;
1062 		}
1063 	default:
1064 		printf("WARNING: invvpid is not supported\n");
1065 	}
1066 }
1067 
1068 static void init_vmcs_ctrl(void)
1069 {
1070 	/* 26.2 CHECKS ON VMX CONTROLS AND HOST-STATE AREA */
1071 	/* 26.2.1.1 */
1072 	vmcs_write(PIN_CONTROLS, ctrl_pin);
1073 	/* Disable VMEXIT of IO instruction */
1074 	vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu[0]);
1075 	if (ctrl_cpu_rev[0].set & CPU_SECONDARY) {
1076 		ctrl_cpu[1] = (ctrl_cpu[1] | ctrl_cpu_rev[1].set) &
1077 			ctrl_cpu_rev[1].clr;
1078 		vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu[1]);
1079 	}
1080 	vmcs_write(CR3_TARGET_COUNT, 0);
1081 	vmcs_write(VPID, ++vpid_cnt);
1082 }
1083 
1084 static void init_vmcs_host(void)
1085 {
1086 	/* 26.2 CHECKS ON VMX CONTROLS AND HOST-STATE AREA */
1087 	/* 26.2.1.2 */
1088 	vmcs_write(HOST_EFER, rdmsr(MSR_EFER));
1089 
1090 	/* 26.2.1.3 */
1091 	vmcs_write(ENT_CONTROLS, ctrl_enter);
1092 	vmcs_write(EXI_CONTROLS, ctrl_exit);
1093 
1094 	/* 26.2.2 */
1095 	vmcs_write(HOST_CR0, read_cr0());
1096 	vmcs_write(HOST_CR3, read_cr3());
1097 	vmcs_write(HOST_CR4, read_cr4());
1098 	vmcs_write(HOST_SYSENTER_EIP, (u64)(&entry_sysenter));
1099 	vmcs_write(HOST_SYSENTER_CS,  KERNEL_CS);
1100 
1101 	/* 26.2.3 */
1102 	vmcs_write(HOST_SEL_CS, KERNEL_CS);
1103 	vmcs_write(HOST_SEL_SS, KERNEL_DS);
1104 	vmcs_write(HOST_SEL_DS, KERNEL_DS);
1105 	vmcs_write(HOST_SEL_ES, KERNEL_DS);
1106 	vmcs_write(HOST_SEL_FS, KERNEL_DS);
1107 	vmcs_write(HOST_SEL_GS, KERNEL_DS);
1108 	vmcs_write(HOST_SEL_TR, TSS_MAIN);
1109 	vmcs_write(HOST_BASE_TR, tss_descr.base);
1110 	vmcs_write(HOST_BASE_GDTR, gdt64_desc.base);
1111 	vmcs_write(HOST_BASE_IDTR, idt_descr.base);
1112 	vmcs_write(HOST_BASE_FS, 0);
1113 	vmcs_write(HOST_BASE_GS, 0);
1114 
1115 	/* Set other vmcs area */
1116 	vmcs_write(PF_ERROR_MASK, 0);
1117 	vmcs_write(PF_ERROR_MATCH, 0);
1118 	vmcs_write(VMCS_LINK_PTR, ~0ul);
1119 	vmcs_write(VMCS_LINK_PTR_HI, ~0ul);
1120 	vmcs_write(HOST_RIP, (u64)(&vmx_return));
1121 }
1122 
1123 static void init_vmcs_guest(void)
1124 {
1125 	/* 26.3 CHECKING AND LOADING GUEST STATE */
1126 	ulong guest_cr0, guest_cr4, guest_cr3;
1127 	/* 26.3.1.1 */
1128 	guest_cr0 = read_cr0();
1129 	guest_cr4 = read_cr4();
1130 	guest_cr3 = read_cr3();
1131 	if (ctrl_enter & ENT_GUEST_64) {
1132 		guest_cr0 |= X86_CR0_PG;
1133 		guest_cr4 |= X86_CR4_PAE;
1134 	}
1135 	if ((ctrl_enter & ENT_GUEST_64) == 0)
1136 		guest_cr4 &= (~X86_CR4_PCIDE);
1137 	if (guest_cr0 & X86_CR0_PG)
1138 		guest_cr0 |= X86_CR0_PE;
1139 	vmcs_write(GUEST_CR0, guest_cr0);
1140 	vmcs_write(GUEST_CR3, guest_cr3);
1141 	vmcs_write(GUEST_CR4, guest_cr4);
1142 	vmcs_write(GUEST_SYSENTER_CS,  KERNEL_CS);
1143 	vmcs_write(GUEST_SYSENTER_ESP,
1144 		(u64)(guest_syscall_stack + PAGE_SIZE - 1));
1145 	vmcs_write(GUEST_SYSENTER_EIP, (u64)(&entry_sysenter));
1146 	vmcs_write(GUEST_DR7, 0);
1147 	vmcs_write(GUEST_EFER, rdmsr(MSR_EFER));
1148 
1149 	/* 26.3.1.2 */
1150 	vmcs_write(GUEST_SEL_CS, KERNEL_CS);
1151 	vmcs_write(GUEST_SEL_SS, KERNEL_DS);
1152 	vmcs_write(GUEST_SEL_DS, KERNEL_DS);
1153 	vmcs_write(GUEST_SEL_ES, KERNEL_DS);
1154 	vmcs_write(GUEST_SEL_FS, KERNEL_DS);
1155 	vmcs_write(GUEST_SEL_GS, KERNEL_DS);
1156 	vmcs_write(GUEST_SEL_TR, TSS_MAIN);
1157 	vmcs_write(GUEST_SEL_LDTR, 0);
1158 
1159 	vmcs_write(GUEST_BASE_CS, 0);
1160 	vmcs_write(GUEST_BASE_ES, 0);
1161 	vmcs_write(GUEST_BASE_SS, 0);
1162 	vmcs_write(GUEST_BASE_DS, 0);
1163 	vmcs_write(GUEST_BASE_FS, 0);
1164 	vmcs_write(GUEST_BASE_GS, 0);
1165 	vmcs_write(GUEST_BASE_TR, tss_descr.base);
1166 	vmcs_write(GUEST_BASE_LDTR, 0);
1167 
1168 	vmcs_write(GUEST_LIMIT_CS, 0xFFFFFFFF);
1169 	vmcs_write(GUEST_LIMIT_DS, 0xFFFFFFFF);
1170 	vmcs_write(GUEST_LIMIT_ES, 0xFFFFFFFF);
1171 	vmcs_write(GUEST_LIMIT_SS, 0xFFFFFFFF);
1172 	vmcs_write(GUEST_LIMIT_FS, 0xFFFFFFFF);
1173 	vmcs_write(GUEST_LIMIT_GS, 0xFFFFFFFF);
1174 	vmcs_write(GUEST_LIMIT_LDTR, 0xffff);
1175 	vmcs_write(GUEST_LIMIT_TR, tss_descr.limit);
1176 
1177 	vmcs_write(GUEST_AR_CS, 0xa09b);
1178 	vmcs_write(GUEST_AR_DS, 0xc093);
1179 	vmcs_write(GUEST_AR_ES, 0xc093);
1180 	vmcs_write(GUEST_AR_FS, 0xc093);
1181 	vmcs_write(GUEST_AR_GS, 0xc093);
1182 	vmcs_write(GUEST_AR_SS, 0xc093);
1183 	vmcs_write(GUEST_AR_LDTR, 0x82);
1184 	vmcs_write(GUEST_AR_TR, 0x8b);
1185 
1186 	/* 26.3.1.3 */
1187 	vmcs_write(GUEST_BASE_GDTR, gdt64_desc.base);
1188 	vmcs_write(GUEST_BASE_IDTR, idt_descr.base);
1189 	vmcs_write(GUEST_LIMIT_GDTR, gdt64_desc.limit);
1190 	vmcs_write(GUEST_LIMIT_IDTR, idt_descr.limit);
1191 
1192 	/* 26.3.1.4 */
1193 	vmcs_write(GUEST_RIP, (u64)(&guest_entry));
1194 	vmcs_write(GUEST_RSP, (u64)(guest_stack + PAGE_SIZE - 1));
1195 	vmcs_write(GUEST_RFLAGS, 0x2);
1196 
1197 	/* 26.3.1.5 */
1198 	vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE);
1199 	vmcs_write(GUEST_INTR_STATE, 0);
1200 }
1201 
1202 static int init_vmcs(struct vmcs **vmcs)
1203 {
1204 	*vmcs = alloc_page();
1205 	memset(*vmcs, 0, PAGE_SIZE);
1206 	(*vmcs)->hdr.revision_id = basic.revision;
1207 	/* vmclear first to init vmcs */
1208 	if (vmcs_clear(*vmcs)) {
1209 		printf("%s : vmcs_clear error\n", __func__);
1210 		return 1;
1211 	}
1212 
1213 	if (make_vmcs_current(*vmcs)) {
1214 		printf("%s : make_vmcs_current error\n", __func__);
1215 		return 1;
1216 	}
1217 
1218 	/* All settings to pin/exit/enter/cpu
1219 	   control fields should be placed here */
1220 	ctrl_pin |= PIN_EXTINT | PIN_NMI | PIN_VIRT_NMI;
1221 	ctrl_exit = EXI_LOAD_EFER | EXI_HOST_64;
1222 	ctrl_enter = (ENT_LOAD_EFER | ENT_GUEST_64);
1223 	/* DIsable IO instruction VMEXIT now */
1224 	ctrl_cpu[0] &= (~(CPU_IO | CPU_IO_BITMAP));
1225 	ctrl_cpu[1] = 0;
1226 
1227 	ctrl_pin = (ctrl_pin | ctrl_pin_rev.set) & ctrl_pin_rev.clr;
1228 	ctrl_enter = (ctrl_enter | ctrl_enter_rev.set) & ctrl_enter_rev.clr;
1229 	ctrl_exit = (ctrl_exit | ctrl_exit_rev.set) & ctrl_exit_rev.clr;
1230 	ctrl_cpu[0] = (ctrl_cpu[0] | ctrl_cpu_rev[0].set) & ctrl_cpu_rev[0].clr;
1231 
1232 	init_vmcs_ctrl();
1233 	init_vmcs_host();
1234 	init_vmcs_guest();
1235 	return 0;
1236 }
1237 
1238 static void init_vmx(void)
1239 {
1240 	ulong fix_cr0_set, fix_cr0_clr;
1241 	ulong fix_cr4_set, fix_cr4_clr;
1242 
1243 	vmxon_region = alloc_page();
1244 	memset(vmxon_region, 0, PAGE_SIZE);
1245 
1246 	fix_cr0_set =  rdmsr(MSR_IA32_VMX_CR0_FIXED0);
1247 	fix_cr0_clr =  rdmsr(MSR_IA32_VMX_CR0_FIXED1);
1248 	fix_cr4_set =  rdmsr(MSR_IA32_VMX_CR4_FIXED0);
1249 	fix_cr4_clr = rdmsr(MSR_IA32_VMX_CR4_FIXED1);
1250 	basic.val = rdmsr(MSR_IA32_VMX_BASIC);
1251 	ctrl_pin_rev.val = rdmsr(basic.ctrl ? MSR_IA32_VMX_TRUE_PIN
1252 			: MSR_IA32_VMX_PINBASED_CTLS);
1253 	ctrl_exit_rev.val = rdmsr(basic.ctrl ? MSR_IA32_VMX_TRUE_EXIT
1254 			: MSR_IA32_VMX_EXIT_CTLS);
1255 	ctrl_enter_rev.val = rdmsr(basic.ctrl ? MSR_IA32_VMX_TRUE_ENTRY
1256 			: MSR_IA32_VMX_ENTRY_CTLS);
1257 	ctrl_cpu_rev[0].val = rdmsr(basic.ctrl ? MSR_IA32_VMX_TRUE_PROC
1258 			: MSR_IA32_VMX_PROCBASED_CTLS);
1259 	if ((ctrl_cpu_rev[0].clr & CPU_SECONDARY) != 0)
1260 		ctrl_cpu_rev[1].val = rdmsr(MSR_IA32_VMX_PROCBASED_CTLS2);
1261 	else
1262 		ctrl_cpu_rev[1].val = 0;
1263 	if ((ctrl_cpu_rev[1].clr & (CPU_EPT | CPU_VPID)) != 0)
1264 		ept_vpid.val = rdmsr(MSR_IA32_VMX_EPT_VPID_CAP);
1265 	else
1266 		ept_vpid.val = 0;
1267 
1268 	write_cr0((read_cr0() & fix_cr0_clr) | fix_cr0_set);
1269 	write_cr4((read_cr4() & fix_cr4_clr) | fix_cr4_set | X86_CR4_VMXE);
1270 
1271 	*vmxon_region = basic.revision;
1272 
1273 	guest_stack = alloc_page();
1274 	memset(guest_stack, 0, PAGE_SIZE);
1275 	guest_syscall_stack = alloc_page();
1276 	memset(guest_syscall_stack, 0, PAGE_SIZE);
1277 }
1278 
1279 static void do_vmxon_off(void *data)
1280 {
1281 	vmx_on();
1282 	vmx_off();
1283 }
1284 
1285 static void do_write_feature_control(void *data)
1286 {
1287 	wrmsr(MSR_IA32_FEATURE_CONTROL, 0);
1288 }
1289 
1290 static int test_vmx_feature_control(void)
1291 {
1292 	u64 ia32_feature_control;
1293 	bool vmx_enabled;
1294 
1295 	ia32_feature_control = rdmsr(MSR_IA32_FEATURE_CONTROL);
1296 	vmx_enabled = ((ia32_feature_control & 0x5) == 0x5);
1297 	if ((ia32_feature_control & 0x5) == 0x5) {
1298 		printf("VMX enabled and locked by BIOS\n");
1299 		return 0;
1300 	} else if (ia32_feature_control & 0x1) {
1301 		printf("ERROR: VMX locked out by BIOS!?\n");
1302 		return 1;
1303 	}
1304 
1305 	wrmsr(MSR_IA32_FEATURE_CONTROL, 0);
1306 	report("test vmxon with FEATURE_CONTROL cleared",
1307 	       test_for_exception(GP_VECTOR, &do_vmxon_off, NULL));
1308 
1309 	wrmsr(MSR_IA32_FEATURE_CONTROL, 0x4);
1310 	report("test vmxon without FEATURE_CONTROL lock",
1311 	       test_for_exception(GP_VECTOR, &do_vmxon_off, NULL));
1312 
1313 	wrmsr(MSR_IA32_FEATURE_CONTROL, 0x5);
1314 	vmx_enabled = ((rdmsr(MSR_IA32_FEATURE_CONTROL) & 0x5) == 0x5);
1315 	report("test enable VMX in FEATURE_CONTROL", vmx_enabled);
1316 
1317 	report("test FEATURE_CONTROL lock bit",
1318 	       test_for_exception(GP_VECTOR, &do_write_feature_control, NULL));
1319 
1320 	return !vmx_enabled;
1321 }
1322 
1323 static int test_vmxon(void)
1324 {
1325 	int ret, ret1;
1326 	u64 *tmp_region = vmxon_region;
1327 	int width = cpuid_maxphyaddr();
1328 
1329 	/* Unaligned page access */
1330 	vmxon_region = (u64 *)((intptr_t)vmxon_region + 1);
1331 	ret1 = vmx_on();
1332 	report("test vmxon with unaligned vmxon region", ret1);
1333 	if (!ret1) {
1334 		ret = 1;
1335 		goto out;
1336 	}
1337 
1338 	/* gpa bits beyond physical address width are set*/
1339 	vmxon_region = (u64 *)((intptr_t)tmp_region | ((u64)1 << (width+1)));
1340 	ret1 = vmx_on();
1341 	report("test vmxon with bits set beyond physical address width", ret1);
1342 	if (!ret1) {
1343 		ret = 1;
1344 		goto out;
1345 	}
1346 
1347 	/* invalid revision indentifier */
1348 	vmxon_region = tmp_region;
1349 	*vmxon_region = 0xba9da9;
1350 	ret1 = vmx_on();
1351 	report("test vmxon with invalid revision identifier", ret1);
1352 	if (!ret1) {
1353 		ret = 1;
1354 		goto out;
1355 	}
1356 
1357 	/* and finally a valid region */
1358 	*vmxon_region = basic.revision;
1359 	ret = vmx_on();
1360 	report("test vmxon with valid vmxon region", !ret);
1361 
1362 out:
1363 	return ret;
1364 }
1365 
1366 static void test_vmptrld(void)
1367 {
1368 	struct vmcs *vmcs, *tmp_root;
1369 	int width = cpuid_maxphyaddr();
1370 
1371 	vmcs = alloc_page();
1372 	vmcs->hdr.revision_id = basic.revision;
1373 
1374 	/* Unaligned page access */
1375 	tmp_root = (struct vmcs *)((intptr_t)vmcs + 1);
1376 	report("test vmptrld with unaligned vmcs",
1377 	       make_vmcs_current(tmp_root) == 1);
1378 
1379 	/* gpa bits beyond physical address width are set*/
1380 	tmp_root = (struct vmcs *)((intptr_t)vmcs |
1381 				   ((u64)1 << (width+1)));
1382 	report("test vmptrld with vmcs address bits set beyond physical address width",
1383 	       make_vmcs_current(tmp_root) == 1);
1384 
1385 	/* Pass VMXON region */
1386 	make_vmcs_current(vmcs);
1387 	tmp_root = (struct vmcs *)vmxon_region;
1388 	report("test vmptrld with vmxon region",
1389 	       make_vmcs_current(tmp_root) == 1);
1390 	report("test vmptrld with vmxon region vm-instruction error",
1391 	       vmcs_read(VMX_INST_ERROR) == VMXERR_VMPTRLD_VMXON_POINTER);
1392 
1393 	report("test vmptrld with valid vmcs region", make_vmcs_current(vmcs) == 0);
1394 }
1395 
1396 static void test_vmptrst(void)
1397 {
1398 	int ret;
1399 	struct vmcs *vmcs1, *vmcs2;
1400 
1401 	vmcs1 = alloc_page();
1402 	memset(vmcs1, 0, PAGE_SIZE);
1403 	init_vmcs(&vmcs1);
1404 	ret = vmcs_save(&vmcs2);
1405 	report("test vmptrst", (!ret) && (vmcs1 == vmcs2));
1406 }
1407 
1408 struct vmx_ctl_msr {
1409 	const char *name;
1410 	u32 index, true_index;
1411 	u32 default1;
1412 } vmx_ctl_msr[] = {
1413 	{ "MSR_IA32_VMX_PINBASED_CTLS", MSR_IA32_VMX_PINBASED_CTLS,
1414 	  MSR_IA32_VMX_TRUE_PIN, 0x16 },
1415 	{ "MSR_IA32_VMX_PROCBASED_CTLS", MSR_IA32_VMX_PROCBASED_CTLS,
1416 	  MSR_IA32_VMX_TRUE_PROC, 0x401e172 },
1417 	{ "MSR_IA32_VMX_PROCBASED_CTLS2", MSR_IA32_VMX_PROCBASED_CTLS2,
1418 	  MSR_IA32_VMX_PROCBASED_CTLS2, 0 },
1419 	{ "MSR_IA32_VMX_EXIT_CTLS", MSR_IA32_VMX_EXIT_CTLS,
1420 	  MSR_IA32_VMX_TRUE_EXIT, 0x36dff },
1421 	{ "MSR_IA32_VMX_ENTRY_CTLS", MSR_IA32_VMX_ENTRY_CTLS,
1422 	  MSR_IA32_VMX_TRUE_ENTRY, 0x11ff },
1423 };
1424 
1425 static void test_vmx_caps(void)
1426 {
1427 	u64 val, default1, fixed0, fixed1;
1428 	union vmx_ctrl_msr ctrl, true_ctrl;
1429 	unsigned int n;
1430 	bool ok;
1431 
1432 	printf("\nTest suite: VMX capability reporting\n");
1433 
1434 	report("MSR_IA32_VMX_BASIC",
1435 	       (basic.revision & (1ul << 31)) == 0 &&
1436 	       basic.size > 0 && basic.size <= 4096 &&
1437 	       (basic.type == 0 || basic.type == 6) &&
1438 	       basic.reserved1 == 0 && basic.reserved2 == 0);
1439 
1440 	val = rdmsr(MSR_IA32_VMX_MISC);
1441 	report("MSR_IA32_VMX_MISC",
1442 	       (!(ctrl_cpu_rev[1].clr & CPU_URG) || val & (1ul << 5)) &&
1443 	       ((val >> 16) & 0x1ff) <= 256 &&
1444 	       (val & 0xc0007e00) == 0);
1445 
1446 	for (n = 0; n < ARRAY_SIZE(vmx_ctl_msr); n++) {
1447 		ctrl.val = rdmsr(vmx_ctl_msr[n].index);
1448 		default1 = vmx_ctl_msr[n].default1;
1449 		ok = (ctrl.set & default1) == default1;
1450 		ok = ok && (ctrl.set & ~ctrl.clr) == 0;
1451 		if (ok && basic.ctrl) {
1452 			true_ctrl.val = rdmsr(vmx_ctl_msr[n].true_index);
1453 			ok = ctrl.clr == true_ctrl.clr;
1454 			ok = ok && ctrl.set == (true_ctrl.set | default1);
1455 		}
1456 		report("%s", ok, vmx_ctl_msr[n].name);
1457 	}
1458 
1459 	fixed0 = rdmsr(MSR_IA32_VMX_CR0_FIXED0);
1460 	fixed1 = rdmsr(MSR_IA32_VMX_CR0_FIXED1);
1461 	report("MSR_IA32_VMX_IA32_VMX_CR0_FIXED0/1",
1462 	       ((fixed0 ^ fixed1) & ~fixed1) == 0);
1463 
1464 	fixed0 = rdmsr(MSR_IA32_VMX_CR4_FIXED0);
1465 	fixed1 = rdmsr(MSR_IA32_VMX_CR4_FIXED1);
1466 	report("MSR_IA32_VMX_IA32_VMX_CR4_FIXED0/1",
1467 	       ((fixed0 ^ fixed1) & ~fixed1) == 0);
1468 
1469 	val = rdmsr(MSR_IA32_VMX_VMCS_ENUM);
1470 	report("MSR_IA32_VMX_VMCS_ENUM",
1471 	       (val & 0x3e) >= 0x2a &&
1472 	       (val & 0xfffffffffffffc01Ull) == 0);
1473 
1474 	val = rdmsr(MSR_IA32_VMX_EPT_VPID_CAP);
1475 	report("MSR_IA32_VMX_EPT_VPID_CAP",
1476 	       (val & 0xfffff07ef98cbebeUll) == 0);
1477 }
1478 
1479 /* This function can only be called in guest */
1480 static void __attribute__((__used__)) hypercall(u32 hypercall_no)
1481 {
1482 	u64 val = 0;
1483 	val = (hypercall_no & HYPERCALL_MASK) | HYPERCALL_BIT;
1484 	hypercall_field = val;
1485 	asm volatile("vmcall\n\t");
1486 }
1487 
1488 static bool is_hypercall(void)
1489 {
1490 	ulong reason, hyper_bit;
1491 
1492 	reason = vmcs_read(EXI_REASON) & 0xff;
1493 	hyper_bit = hypercall_field & HYPERCALL_BIT;
1494 	if (reason == VMX_VMCALL && hyper_bit)
1495 		return true;
1496 	return false;
1497 }
1498 
1499 static int handle_hypercall(void)
1500 {
1501 	ulong hypercall_no;
1502 
1503 	hypercall_no = hypercall_field & HYPERCALL_MASK;
1504 	hypercall_field = 0;
1505 	switch (hypercall_no) {
1506 	case HYPERCALL_VMEXIT:
1507 		return VMX_TEST_VMEXIT;
1508 	case HYPERCALL_VMABORT:
1509 		return VMX_TEST_VMABORT;
1510 	case HYPERCALL_VMSKIP:
1511 		return VMX_TEST_VMSKIP;
1512 	default:
1513 		printf("ERROR : Invalid hypercall number : %ld\n", hypercall_no);
1514 	}
1515 	return VMX_TEST_EXIT;
1516 }
1517 
1518 static void continue_abort(void)
1519 {
1520 	assert(!in_guest);
1521 	printf("Host was here when guest aborted:\n");
1522 	dump_stack();
1523 	longjmp(abort_target, 1);
1524 	abort();
1525 }
1526 
1527 void __abort_test(void)
1528 {
1529 	if (in_guest)
1530 		hypercall(HYPERCALL_VMABORT);
1531 	else
1532 		longjmp(abort_target, 1);
1533 	abort();
1534 }
1535 
1536 static void continue_skip(void)
1537 {
1538 	assert(!in_guest);
1539 	longjmp(abort_target, 1);
1540 	abort();
1541 }
1542 
1543 void test_skip(const char *msg)
1544 {
1545 	printf("%s skipping test: %s\n", in_guest ? "Guest" : "Host", msg);
1546 	if (in_guest)
1547 		hypercall(HYPERCALL_VMABORT);
1548 	else
1549 		longjmp(abort_target, 1);
1550 	abort();
1551 }
1552 
1553 static int exit_handler(void)
1554 {
1555 	int ret;
1556 
1557 	current->exits++;
1558 	regs.rflags = vmcs_read(GUEST_RFLAGS);
1559 	if (is_hypercall())
1560 		ret = handle_hypercall();
1561 	else
1562 		ret = current->exit_handler();
1563 	vmcs_write(GUEST_RFLAGS, regs.rflags);
1564 
1565 	return ret;
1566 }
1567 
1568 /*
1569  * Called if vmlaunch or vmresume fails.
1570  *	@early    - failure due to "VMX controls and host-state area" (26.2)
1571  *	@vmlaunch - was this a vmlaunch or vmresume
1572  *	@rflags   - host rflags
1573  */
1574 static int
1575 entry_failure_handler(struct vmentry_failure *failure)
1576 {
1577 	if (current->entry_failure_handler)
1578 		return current->entry_failure_handler(failure);
1579 	else
1580 		return VMX_TEST_EXIT;
1581 }
1582 
1583 /*
1584  * Tries to enter the guest. Returns true iff entry succeeded. Otherwise,
1585  * populates @failure.
1586  */
1587 static bool vmx_enter_guest(struct vmentry_failure *failure)
1588 {
1589 	failure->early = 0;
1590 
1591 	in_guest = 1;
1592 	asm volatile (
1593 		"mov %[HOST_RSP], %%rdi\n\t"
1594 		"vmwrite %%rsp, %%rdi\n\t"
1595 		LOAD_GPR_C
1596 		"cmpb $0, %[launched]\n\t"
1597 		"jne 1f\n\t"
1598 		"vmlaunch\n\t"
1599 		"jmp 2f\n\t"
1600 		"1: "
1601 		"vmresume\n\t"
1602 		"2: "
1603 		SAVE_GPR_C
1604 		"pushf\n\t"
1605 		"pop %%rdi\n\t"
1606 		"mov %%rdi, %[failure_flags]\n\t"
1607 		"movl $1, %[failure_flags]\n\t"
1608 		"jmp 3f\n\t"
1609 		"vmx_return:\n\t"
1610 		SAVE_GPR_C
1611 		"3: \n\t"
1612 		: [failure_early]"+m"(failure->early),
1613 		  [failure_flags]"=m"(failure->flags)
1614 		: [launched]"m"(launched), [HOST_RSP]"i"(HOST_RSP)
1615 		: "rdi", "memory", "cc"
1616 	);
1617 	in_guest = 0;
1618 
1619 	failure->vmlaunch = !launched;
1620 	failure->instr = launched ? "vmresume" : "vmlaunch";
1621 
1622 	return !failure->early && !(vmcs_read(EXI_REASON) & VMX_ENTRY_FAILURE);
1623 }
1624 
1625 static int vmx_run(void)
1626 {
1627 	while (1) {
1628 		u32 ret;
1629 		bool entered;
1630 		struct vmentry_failure failure;
1631 
1632 		entered = vmx_enter_guest(&failure);
1633 
1634 		if (entered) {
1635 			/*
1636 			 * VMCS isn't in "launched" state if there's been any
1637 			 * entry failure (early or otherwise).
1638 			 */
1639 			launched = 1;
1640 			ret = exit_handler();
1641 		} else {
1642 			ret = entry_failure_handler(&failure);
1643 		}
1644 
1645 		switch (ret) {
1646 		case VMX_TEST_RESUME:
1647 			continue;
1648 		case VMX_TEST_VMEXIT:
1649 			guest_finished = 1;
1650 			return 0;
1651 		case VMX_TEST_EXIT:
1652 			break;
1653 		default:
1654 			printf("ERROR : Invalid %s_handler return val %d.\n",
1655 			       entered ? "exit" : "entry_failure",
1656 			       ret);
1657 			break;
1658 		}
1659 
1660 		if (entered)
1661 			print_vmexit_info();
1662 		else
1663 			print_vmentry_failure_info(&failure);
1664 		abort();
1665 	}
1666 }
1667 
1668 static void run_teardown_step(struct test_teardown_step *step)
1669 {
1670 	step->func(step->data);
1671 }
1672 
1673 static int test_run(struct vmx_test *test)
1674 {
1675 	int r;
1676 
1677 	/* Validate V2 interface. */
1678 	if (test->v2) {
1679 		int ret = 0;
1680 		if (test->init || test->guest_main || test->exit_handler ||
1681 		    test->syscall_handler) {
1682 			report("V2 test cannot specify V1 callbacks.", 0);
1683 			ret = 1;
1684 		}
1685 		if (ret)
1686 			return ret;
1687 	}
1688 
1689 	if (test->name == NULL)
1690 		test->name = "(no name)";
1691 	if (vmx_on()) {
1692 		printf("%s : vmxon failed.\n", __func__);
1693 		return 1;
1694 	}
1695 
1696 	init_vmcs(&(test->vmcs));
1697 	/* Directly call test->init is ok here, init_vmcs has done
1698 	   vmcs init, vmclear and vmptrld*/
1699 	if (test->init && test->init(test->vmcs) != VMX_TEST_START)
1700 		goto out;
1701 	teardown_count = 0;
1702 	v2_guest_main = NULL;
1703 	test->exits = 0;
1704 	current = test;
1705 	regs = test->guest_regs;
1706 	vmcs_write(GUEST_RFLAGS, regs.rflags | 0x2);
1707 	launched = 0;
1708 	guest_finished = 0;
1709 	printf("\nTest suite: %s\n", test->name);
1710 
1711 	r = setjmp(abort_target);
1712 	if (r) {
1713 		assert(!in_guest);
1714 		goto out;
1715 	}
1716 
1717 
1718 	if (test->v2)
1719 		test->v2();
1720 	else
1721 		vmx_run();
1722 
1723 	while (teardown_count > 0)
1724 		run_teardown_step(&teardown_steps[--teardown_count]);
1725 
1726 	if (launched && !guest_finished)
1727 		report("Guest didn't run to completion.", 0);
1728 
1729 out:
1730 	if (vmx_off()) {
1731 		printf("%s : vmxoff failed.\n", __func__);
1732 		return 1;
1733 	}
1734 	return 0;
1735 }
1736 
1737 /*
1738  * Add a teardown step. Executed after the test's main function returns.
1739  * Teardown steps executed in reverse order.
1740  */
1741 void test_add_teardown(test_teardown_func func, void *data)
1742 {
1743 	struct test_teardown_step *step;
1744 
1745 	TEST_ASSERT_MSG(teardown_count < MAX_TEST_TEARDOWN_STEPS,
1746 			"There are already %d teardown steps.",
1747 			teardown_count);
1748 	step = &teardown_steps[teardown_count++];
1749 	step->func = func;
1750 	step->data = data;
1751 }
1752 
1753 /*
1754  * Set the target of the first enter_guest call. Can only be called once per
1755  * test. Must be called before first enter_guest call.
1756  */
1757 void test_set_guest(test_guest_func func)
1758 {
1759 	assert(current->v2);
1760 	TEST_ASSERT_MSG(!v2_guest_main, "Already set guest func.");
1761 	v2_guest_main = func;
1762 }
1763 
1764 /*
1765  * Enters the guest (or launches it for the first time). Error to call once the
1766  * guest has returned (i.e., run past the end of its guest() function). Also
1767  * aborts if guest entry fails.
1768  */
1769 void enter_guest(void)
1770 {
1771 	struct vmentry_failure failure;
1772 
1773 	TEST_ASSERT_MSG(v2_guest_main,
1774 			"Never called test_set_guest_func!");
1775 
1776 	TEST_ASSERT_MSG(!guest_finished,
1777 			"Called enter_guest() after guest returned.");
1778 
1779 	if (!vmx_enter_guest(&failure)) {
1780 		print_vmentry_failure_info(&failure);
1781 		abort();
1782 	}
1783 
1784 	launched = 1;
1785 
1786 	if (is_hypercall()) {
1787 		int ret;
1788 
1789 		ret = handle_hypercall();
1790 		switch (ret) {
1791 		case VMX_TEST_VMEXIT:
1792 			guest_finished = 1;
1793 			break;
1794 		case VMX_TEST_VMABORT:
1795 			continue_abort();
1796 			break;
1797 		case VMX_TEST_VMSKIP:
1798 			continue_skip();
1799 			break;
1800 		default:
1801 			printf("ERROR : Invalid handle_hypercall return %d.\n",
1802 			       ret);
1803 			abort();
1804 		}
1805 	}
1806 }
1807 
1808 extern struct vmx_test vmx_tests[];
1809 
1810 static bool
1811 test_wanted(const char *name, const char *filters[], int filter_count)
1812 {
1813 	int i;
1814 	bool positive = false;
1815 	bool match = false;
1816 	char clean_name[strlen(name) + 1];
1817 	char *c;
1818 	const char *n;
1819 
1820 	/* Replace spaces with underscores. */
1821 	n = name;
1822 	c = &clean_name[0];
1823 	do *c++ = (*n == ' ') ? '_' : *n;
1824 	while (*n++);
1825 
1826 	for (i = 0; i < filter_count; i++) {
1827 		const char *filter = filters[i];
1828 
1829 		if (filter[0] == '-') {
1830 			if (simple_glob(clean_name, filter + 1))
1831 				return false;
1832 		} else {
1833 			positive = true;
1834 			match |= simple_glob(clean_name, filter);
1835 		}
1836 	}
1837 
1838 	if (!positive || match) {
1839 		matched++;
1840 		return true;
1841 	} else {
1842 		return false;
1843 	}
1844 }
1845 
1846 int main(int argc, const char *argv[])
1847 {
1848 	int i = 0;
1849 
1850 	setup_vm();
1851 	smp_init();
1852 	hypercall_field = 0;
1853 
1854 	argv++;
1855 	argc--;
1856 
1857 	if (!(cpuid(1).c & (1 << 5))) {
1858 		printf("WARNING: vmx not supported, add '-cpu host'\n");
1859 		goto exit;
1860 	}
1861 	init_vmx();
1862 	if (test_wanted("test_vmx_feature_control", argv, argc)) {
1863 		/* Sets MSR_IA32_FEATURE_CONTROL to 0x5 */
1864 		if (test_vmx_feature_control() != 0)
1865 			goto exit;
1866 	} else {
1867 		if ((rdmsr(MSR_IA32_FEATURE_CONTROL) & 0x5) != 0x5)
1868 			wrmsr(MSR_IA32_FEATURE_CONTROL, 0x5);
1869 	}
1870 
1871 	if (test_wanted("test_vmxon", argv, argc)) {
1872 		/* Enables VMX */
1873 		if (test_vmxon() != 0)
1874 			goto exit;
1875 	} else {
1876 		if (vmx_on()) {
1877 			report("vmxon", 0);
1878 			goto exit;
1879 		}
1880 	}
1881 
1882 	if (test_wanted("test_vmptrld", argv, argc))
1883 		test_vmptrld();
1884 	if (test_wanted("test_vmclear", argv, argc))
1885 		test_vmclear();
1886 	if (test_wanted("test_vmptrst", argv, argc))
1887 		test_vmptrst();
1888 	if (test_wanted("test_vmwrite_vmread", argv, argc))
1889 		test_vmwrite_vmread();
1890 	if (test_wanted("test_vmcs_high", argv, argc))
1891 		test_vmcs_high();
1892 	if (test_wanted("test_vmcs_lifecycle", argv, argc))
1893 		test_vmcs_lifecycle();
1894 	if (test_wanted("test_vmx_caps", argv, argc))
1895 		test_vmx_caps();
1896 
1897 	/* Balance vmxon from test_vmxon. */
1898 	vmx_off();
1899 
1900 	for (; vmx_tests[i].name != NULL; i++) {
1901 		if (!test_wanted(vmx_tests[i].name, argv, argc))
1902 			continue;
1903 		if (test_run(&vmx_tests[i]))
1904 			goto exit;
1905 	}
1906 
1907 	if (!matched)
1908 		report("command line didn't match any tests!", matched);
1909 
1910 exit:
1911 	return report_summary();
1912 }
1913