1 /* 2 * x86/vmx.c : Framework for testing nested virtualization 3 * This is a framework to test nested VMX for KVM, which 4 * started as a project of GSoC 2013. All test cases should 5 * be located in x86/vmx_tests.c and framework related 6 * functions should be in this file. 7 * 8 * How to write test cases? 9 * Add callbacks of test suite in variant "vmx_tests". You can 10 * write: 11 * 1. init function used for initializing test suite 12 * 2. main function for codes running in L2 guest, 13 * 3. exit_handler to handle vmexit of L2 to L1 14 * 4. syscall handler to handle L2 syscall vmexit 15 * 5. vmenter fail handler to handle direct failure of vmenter 16 * 6. guest_regs is loaded when vmenter and saved when 17 * vmexit, you can read and set it in exit_handler 18 * If no special function is needed for a test suite, use 19 * coressponding basic_* functions as callback. More handlers 20 * can be added to "vmx_tests", see details of "struct vmx_test" 21 * and function test_run(). 22 * 23 * Currently, vmx test framework only set up one VCPU and one 24 * concurrent guest test environment with same paging for L2 and 25 * L1. For usage of EPT, only 1:1 mapped paging is used from VFN 26 * to PFN. 27 * 28 * Author : Arthur Chunqi Li <yzt356@gmail.com> 29 */ 30 31 #include "libcflat.h" 32 #include "processor.h" 33 #include "alloc_page.h" 34 #include "vm.h" 35 #include "desc.h" 36 #include "vmx.h" 37 #include "msr.h" 38 #include "smp.h" 39 #include "apic.h" 40 41 u64 *vmxon_region; 42 struct vmcs *vmcs_root; 43 u32 vpid_cnt; 44 void *guest_stack, *guest_syscall_stack; 45 u32 ctrl_pin, ctrl_enter, ctrl_exit, ctrl_cpu[2]; 46 struct regs regs; 47 48 struct vmx_test *current; 49 50 #define MAX_TEST_TEARDOWN_STEPS 10 51 52 struct test_teardown_step { 53 test_teardown_func func; 54 void *data; 55 }; 56 57 static int teardown_count; 58 static struct test_teardown_step teardown_steps[MAX_TEST_TEARDOWN_STEPS]; 59 60 static test_guest_func v2_guest_main; 61 62 u64 hypercall_field; 63 bool launched; 64 static int matched; 65 static int guest_finished; 66 static int in_guest; 67 68 union vmx_basic basic; 69 union vmx_ctrl_msr ctrl_pin_rev; 70 union vmx_ctrl_msr ctrl_cpu_rev[2]; 71 union vmx_ctrl_msr ctrl_exit_rev; 72 union vmx_ctrl_msr ctrl_enter_rev; 73 union vmx_ept_vpid ept_vpid; 74 75 extern struct descriptor_table_ptr gdt64_desc; 76 extern struct descriptor_table_ptr idt_descr; 77 extern struct descriptor_table_ptr tss_descr; 78 extern void *vmx_return; 79 extern void *entry_sysenter; 80 extern void *guest_entry; 81 82 static volatile u32 stage; 83 84 static jmp_buf abort_target; 85 86 struct vmcs_field { 87 u64 mask; 88 u64 encoding; 89 }; 90 91 #define MASK(_bits) GENMASK_ULL((_bits) - 1, 0) 92 #define MASK_NATURAL MASK(sizeof(unsigned long) * 8) 93 94 static struct vmcs_field vmcs_fields[] = { 95 { MASK(16), VPID }, 96 { MASK(16), PINV }, 97 { MASK(16), EPTP_IDX }, 98 99 { MASK(16), GUEST_SEL_ES }, 100 { MASK(16), GUEST_SEL_CS }, 101 { MASK(16), GUEST_SEL_SS }, 102 { MASK(16), GUEST_SEL_DS }, 103 { MASK(16), GUEST_SEL_FS }, 104 { MASK(16), GUEST_SEL_GS }, 105 { MASK(16), GUEST_SEL_LDTR }, 106 { MASK(16), GUEST_SEL_TR }, 107 { MASK(16), GUEST_INT_STATUS }, 108 109 { MASK(16), HOST_SEL_ES }, 110 { MASK(16), HOST_SEL_CS }, 111 { MASK(16), HOST_SEL_SS }, 112 { MASK(16), HOST_SEL_DS }, 113 { MASK(16), HOST_SEL_FS }, 114 { MASK(16), HOST_SEL_GS }, 115 { MASK(16), HOST_SEL_TR }, 116 117 { MASK(64), IO_BITMAP_A }, 118 { MASK(64), IO_BITMAP_B }, 119 { MASK(64), MSR_BITMAP }, 120 { MASK(64), EXIT_MSR_ST_ADDR }, 121 { MASK(64), EXIT_MSR_LD_ADDR }, 122 { MASK(64), ENTER_MSR_LD_ADDR }, 123 { MASK(64), VMCS_EXEC_PTR }, 124 { MASK(64), TSC_OFFSET }, 125 { MASK(64), APIC_VIRT_ADDR }, 126 { MASK(64), APIC_ACCS_ADDR }, 127 { MASK(64), EPTP }, 128 129 { MASK(64), INFO_PHYS_ADDR }, 130 131 { MASK(64), VMCS_LINK_PTR }, 132 { MASK(64), GUEST_DEBUGCTL }, 133 { MASK(64), GUEST_EFER }, 134 { MASK(64), GUEST_PAT }, 135 { MASK(64), GUEST_PERF_GLOBAL_CTRL }, 136 { MASK(64), GUEST_PDPTE }, 137 138 { MASK(64), HOST_PAT }, 139 { MASK(64), HOST_EFER }, 140 { MASK(64), HOST_PERF_GLOBAL_CTRL }, 141 142 { MASK(32), PIN_CONTROLS }, 143 { MASK(32), CPU_EXEC_CTRL0 }, 144 { MASK(32), EXC_BITMAP }, 145 { MASK(32), PF_ERROR_MASK }, 146 { MASK(32), PF_ERROR_MATCH }, 147 { MASK(32), CR3_TARGET_COUNT }, 148 { MASK(32), EXI_CONTROLS }, 149 { MASK(32), EXI_MSR_ST_CNT }, 150 { MASK(32), EXI_MSR_LD_CNT }, 151 { MASK(32), ENT_CONTROLS }, 152 { MASK(32), ENT_MSR_LD_CNT }, 153 { MASK(32), ENT_INTR_INFO }, 154 { MASK(32), ENT_INTR_ERROR }, 155 { MASK(32), ENT_INST_LEN }, 156 { MASK(32), TPR_THRESHOLD }, 157 { MASK(32), CPU_EXEC_CTRL1 }, 158 159 { MASK(32), VMX_INST_ERROR }, 160 { MASK(32), EXI_REASON }, 161 { MASK(32), EXI_INTR_INFO }, 162 { MASK(32), EXI_INTR_ERROR }, 163 { MASK(32), IDT_VECT_INFO }, 164 { MASK(32), IDT_VECT_ERROR }, 165 { MASK(32), EXI_INST_LEN }, 166 { MASK(32), EXI_INST_INFO }, 167 168 { MASK(32), GUEST_LIMIT_ES }, 169 { MASK(32), GUEST_LIMIT_CS }, 170 { MASK(32), GUEST_LIMIT_SS }, 171 { MASK(32), GUEST_LIMIT_DS }, 172 { MASK(32), GUEST_LIMIT_FS }, 173 { MASK(32), GUEST_LIMIT_GS }, 174 { MASK(32), GUEST_LIMIT_LDTR }, 175 { MASK(32), GUEST_LIMIT_TR }, 176 { MASK(32), GUEST_LIMIT_GDTR }, 177 { MASK(32), GUEST_LIMIT_IDTR }, 178 { 0x1d0ff, GUEST_AR_ES }, 179 { 0x1f0ff, GUEST_AR_CS }, 180 { 0x1d0ff, GUEST_AR_SS }, 181 { 0x1d0ff, GUEST_AR_DS }, 182 { 0x1d0ff, GUEST_AR_FS }, 183 { 0x1d0ff, GUEST_AR_GS }, 184 { 0x1d0ff, GUEST_AR_LDTR }, 185 { 0x1d0ff, GUEST_AR_TR }, 186 { MASK(32), GUEST_INTR_STATE }, 187 { MASK(32), GUEST_ACTV_STATE }, 188 { MASK(32), GUEST_SMBASE }, 189 { MASK(32), GUEST_SYSENTER_CS }, 190 { MASK(32), PREEMPT_TIMER_VALUE }, 191 192 { MASK(32), HOST_SYSENTER_CS }, 193 194 { MASK_NATURAL, CR0_MASK }, 195 { MASK_NATURAL, CR4_MASK }, 196 { MASK_NATURAL, CR0_READ_SHADOW }, 197 { MASK_NATURAL, CR4_READ_SHADOW }, 198 { MASK_NATURAL, CR3_TARGET_0 }, 199 { MASK_NATURAL, CR3_TARGET_1 }, 200 { MASK_NATURAL, CR3_TARGET_2 }, 201 { MASK_NATURAL, CR3_TARGET_3 }, 202 203 { MASK_NATURAL, EXI_QUALIFICATION }, 204 { MASK_NATURAL, IO_RCX }, 205 { MASK_NATURAL, IO_RSI }, 206 { MASK_NATURAL, IO_RDI }, 207 { MASK_NATURAL, IO_RIP }, 208 { MASK_NATURAL, GUEST_LINEAR_ADDRESS }, 209 210 { MASK_NATURAL, GUEST_CR0 }, 211 { MASK_NATURAL, GUEST_CR3 }, 212 { MASK_NATURAL, GUEST_CR4 }, 213 { MASK_NATURAL, GUEST_BASE_ES }, 214 { MASK_NATURAL, GUEST_BASE_CS }, 215 { MASK_NATURAL, GUEST_BASE_SS }, 216 { MASK_NATURAL, GUEST_BASE_DS }, 217 { MASK_NATURAL, GUEST_BASE_FS }, 218 { MASK_NATURAL, GUEST_BASE_GS }, 219 { MASK_NATURAL, GUEST_BASE_LDTR }, 220 { MASK_NATURAL, GUEST_BASE_TR }, 221 { MASK_NATURAL, GUEST_BASE_GDTR }, 222 { MASK_NATURAL, GUEST_BASE_IDTR }, 223 { MASK_NATURAL, GUEST_DR7 }, 224 { MASK_NATURAL, GUEST_RSP }, 225 { MASK_NATURAL, GUEST_RIP }, 226 { MASK_NATURAL, GUEST_RFLAGS }, 227 { MASK_NATURAL, GUEST_PENDING_DEBUG }, 228 { MASK_NATURAL, GUEST_SYSENTER_ESP }, 229 { MASK_NATURAL, GUEST_SYSENTER_EIP }, 230 231 { MASK_NATURAL, HOST_CR0 }, 232 { MASK_NATURAL, HOST_CR3 }, 233 { MASK_NATURAL, HOST_CR4 }, 234 { MASK_NATURAL, HOST_BASE_FS }, 235 { MASK_NATURAL, HOST_BASE_GS }, 236 { MASK_NATURAL, HOST_BASE_TR }, 237 { MASK_NATURAL, HOST_BASE_GDTR }, 238 { MASK_NATURAL, HOST_BASE_IDTR }, 239 { MASK_NATURAL, HOST_SYSENTER_ESP }, 240 { MASK_NATURAL, HOST_SYSENTER_EIP }, 241 { MASK_NATURAL, HOST_RSP }, 242 { MASK_NATURAL, HOST_RIP }, 243 }; 244 245 enum vmcs_field_type { 246 VMCS_FIELD_TYPE_CONTROL = 0, 247 VMCS_FIELD_TYPE_READ_ONLY_DATA = 1, 248 VMCS_FIELD_TYPE_GUEST = 2, 249 VMCS_FIELD_TYPE_HOST = 3, 250 VMCS_FIELD_TYPES, 251 }; 252 253 static inline int vmcs_field_type(struct vmcs_field *f) 254 { 255 return (f->encoding >> VMCS_FIELD_TYPE_SHIFT) & 0x3; 256 } 257 258 static int vmcs_field_readonly(struct vmcs_field *f) 259 { 260 u64 ia32_vmx_misc; 261 262 ia32_vmx_misc = rdmsr(MSR_IA32_VMX_MISC); 263 return !(ia32_vmx_misc & MSR_IA32_VMX_MISC_VMWRITE_SHADOW_RO_FIELDS) && 264 (vmcs_field_type(f) == VMCS_FIELD_TYPE_READ_ONLY_DATA); 265 } 266 267 static inline u64 vmcs_field_value(struct vmcs_field *f, u8 cookie) 268 { 269 u64 value; 270 271 /* Incorporate the cookie and the field encoding into the value. */ 272 value = cookie; 273 value |= (f->encoding << 8); 274 value |= 0xdeadbeefull << 32; 275 276 return value & f->mask; 277 } 278 279 static void set_vmcs_field(struct vmcs_field *f, u8 cookie) 280 { 281 vmcs_write(f->encoding, vmcs_field_value(f, cookie)); 282 } 283 284 static bool check_vmcs_field(struct vmcs_field *f, u8 cookie) 285 { 286 u64 expected; 287 u64 actual; 288 int ret; 289 290 if (f->encoding == VMX_INST_ERROR) { 291 printf("Skipping volatile field %lx\n", f->encoding); 292 return true; 293 } 294 295 if (vmcs_field_readonly(f)) { 296 printf("Skipping read-only field %lx\n", f->encoding); 297 return true; 298 } 299 300 ret = vmcs_read_checking(f->encoding, &actual); 301 assert(!(ret & X86_EFLAGS_CF)); 302 /* Skip VMCS fields that aren't recognized by the CPU */ 303 if (ret & X86_EFLAGS_ZF) 304 return true; 305 306 expected = vmcs_field_value(f, cookie); 307 actual &= f->mask; 308 309 if (expected == actual) 310 return true; 311 312 printf("FAIL: VMWRITE/VMREAD %lx (expected: %lx, actual: %lx)\n", 313 f->encoding, (unsigned long) expected, (unsigned long) actual); 314 315 return false; 316 } 317 318 static void set_all_vmcs_fields(u8 cookie) 319 { 320 int i; 321 322 for (i = 0; i < ARRAY_SIZE(vmcs_fields); i++) 323 set_vmcs_field(&vmcs_fields[i], cookie); 324 } 325 326 static bool check_all_vmcs_fields(u8 cookie) 327 { 328 bool pass = true; 329 int i; 330 331 for (i = 0; i < ARRAY_SIZE(vmcs_fields); i++) { 332 if (!check_vmcs_field(&vmcs_fields[i], cookie)) 333 pass = false; 334 } 335 336 return pass; 337 } 338 339 static void test_vmwrite_vmread(void) 340 { 341 struct vmcs *vmcs = alloc_page(); 342 343 memset(vmcs, 0, PAGE_SIZE); 344 vmcs->hdr.revision_id = basic.revision; 345 assert(!vmcs_clear(vmcs)); 346 assert(!make_vmcs_current(vmcs)); 347 348 set_all_vmcs_fields(0x42); 349 report("VMWRITE/VMREAD", check_all_vmcs_fields(0x42)); 350 351 assert(!vmcs_clear(vmcs)); 352 free_page(vmcs); 353 } 354 355 static void test_vmcs_high(void) 356 { 357 struct vmcs *vmcs = alloc_page(); 358 359 memset(vmcs, 0, PAGE_SIZE); 360 vmcs->hdr.revision_id = basic.revision; 361 assert(!vmcs_clear(vmcs)); 362 assert(!make_vmcs_current(vmcs)); 363 364 vmcs_write(TSC_OFFSET, 0x0123456789ABCDEFull); 365 report("VMREAD TSC_OFFSET after VMWRITE TSC_OFFSET", 366 vmcs_read(TSC_OFFSET) == 0x0123456789ABCDEFull); 367 report("VMREAD TSC_OFFSET_HI after VMWRITE TSC_OFFSET", 368 vmcs_read(TSC_OFFSET_HI) == 0x01234567ull); 369 vmcs_write(TSC_OFFSET_HI, 0x76543210ul); 370 report("VMREAD TSC_OFFSET_HI after VMWRITE TSC_OFFSET_HI", 371 vmcs_read(TSC_OFFSET_HI) == 0x76543210ul); 372 report("VMREAD TSC_OFFSET after VMWRITE TSC_OFFSET_HI", 373 vmcs_read(TSC_OFFSET) == 0x7654321089ABCDEFull); 374 375 assert(!vmcs_clear(vmcs)); 376 free_page(vmcs); 377 } 378 379 static void test_vmcs_lifecycle(void) 380 { 381 struct vmcs *vmcs[2] = {}; 382 int i; 383 384 for (i = 0; i < ARRAY_SIZE(vmcs); i++) { 385 vmcs[i] = alloc_page(); 386 memset(vmcs[i], 0, PAGE_SIZE); 387 vmcs[i]->hdr.revision_id = basic.revision; 388 } 389 390 #define VMPTRLD(_i) do { \ 391 assert(_i < ARRAY_SIZE(vmcs)); \ 392 assert(!make_vmcs_current(vmcs[_i])); \ 393 printf("VMPTRLD VMCS%d\n", (_i)); \ 394 } while (0) 395 396 #define VMCLEAR(_i) do { \ 397 assert(_i < ARRAY_SIZE(vmcs)); \ 398 assert(!vmcs_clear(vmcs[_i])); \ 399 printf("VMCLEAR VMCS%d\n", (_i)); \ 400 } while (0) 401 402 VMCLEAR(0); 403 VMPTRLD(0); 404 set_all_vmcs_fields(0); 405 report("current:VMCS0 active:[VMCS0]", check_all_vmcs_fields(0)); 406 407 VMCLEAR(0); 408 VMPTRLD(0); 409 report("current:VMCS0 active:[VMCS0]", check_all_vmcs_fields(0)); 410 411 VMCLEAR(1); 412 report("current:VMCS0 active:[VMCS0]", check_all_vmcs_fields(0)); 413 414 VMPTRLD(1); 415 set_all_vmcs_fields(1); 416 report("current:VMCS1 active:[VMCS0,VCMS1]", check_all_vmcs_fields(1)); 417 418 VMPTRLD(0); 419 report("current:VMCS0 active:[VMCS0,VCMS1]", check_all_vmcs_fields(0)); 420 VMPTRLD(1); 421 report("current:VMCS1 active:[VMCS0,VCMS1]", check_all_vmcs_fields(1)); 422 VMPTRLD(1); 423 report("current:VMCS1 active:[VMCS0,VCMS1]", check_all_vmcs_fields(1)); 424 425 VMCLEAR(0); 426 report("current:VMCS1 active:[VCMS1]", check_all_vmcs_fields(1)); 427 428 /* VMPTRLD should not erase VMWRITEs to the current VMCS */ 429 set_all_vmcs_fields(2); 430 VMPTRLD(1); 431 report("current:VMCS1 active:[VCMS1]", check_all_vmcs_fields(2)); 432 433 for (i = 0; i < ARRAY_SIZE(vmcs); i++) { 434 VMCLEAR(i); 435 free_page(vmcs[i]); 436 } 437 438 #undef VMPTRLD 439 #undef VMCLEAR 440 } 441 442 void vmx_set_test_stage(u32 s) 443 { 444 barrier(); 445 stage = s; 446 barrier(); 447 } 448 449 u32 vmx_get_test_stage(void) 450 { 451 u32 s; 452 453 barrier(); 454 s = stage; 455 barrier(); 456 return s; 457 } 458 459 void vmx_inc_test_stage(void) 460 { 461 barrier(); 462 stage++; 463 barrier(); 464 } 465 466 /* entry_sysenter */ 467 asm( 468 ".align 4, 0x90\n\t" 469 ".globl entry_sysenter\n\t" 470 "entry_sysenter:\n\t" 471 SAVE_GPR 472 " and $0xf, %rax\n\t" 473 " mov %rax, %rdi\n\t" 474 " call syscall_handler\n\t" 475 LOAD_GPR 476 " vmresume\n\t" 477 ); 478 479 static void __attribute__((__used__)) syscall_handler(u64 syscall_no) 480 { 481 if (current->syscall_handler) 482 current->syscall_handler(syscall_no); 483 } 484 485 static const char * const exit_reason_descriptions[] = { 486 [VMX_EXC_NMI] = "VMX_EXC_NMI", 487 [VMX_EXTINT] = "VMX_EXTINT", 488 [VMX_TRIPLE_FAULT] = "VMX_TRIPLE_FAULT", 489 [VMX_INIT] = "VMX_INIT", 490 [VMX_SIPI] = "VMX_SIPI", 491 [VMX_SMI_IO] = "VMX_SMI_IO", 492 [VMX_SMI_OTHER] = "VMX_SMI_OTHER", 493 [VMX_INTR_WINDOW] = "VMX_INTR_WINDOW", 494 [VMX_NMI_WINDOW] = "VMX_NMI_WINDOW", 495 [VMX_TASK_SWITCH] = "VMX_TASK_SWITCH", 496 [VMX_CPUID] = "VMX_CPUID", 497 [VMX_GETSEC] = "VMX_GETSEC", 498 [VMX_HLT] = "VMX_HLT", 499 [VMX_INVD] = "VMX_INVD", 500 [VMX_INVLPG] = "VMX_INVLPG", 501 [VMX_RDPMC] = "VMX_RDPMC", 502 [VMX_RDTSC] = "VMX_RDTSC", 503 [VMX_RSM] = "VMX_RSM", 504 [VMX_VMCALL] = "VMX_VMCALL", 505 [VMX_VMCLEAR] = "VMX_VMCLEAR", 506 [VMX_VMLAUNCH] = "VMX_VMLAUNCH", 507 [VMX_VMPTRLD] = "VMX_VMPTRLD", 508 [VMX_VMPTRST] = "VMX_VMPTRST", 509 [VMX_VMREAD] = "VMX_VMREAD", 510 [VMX_VMRESUME] = "VMX_VMRESUME", 511 [VMX_VMWRITE] = "VMX_VMWRITE", 512 [VMX_VMXOFF] = "VMX_VMXOFF", 513 [VMX_VMXON] = "VMX_VMXON", 514 [VMX_CR] = "VMX_CR", 515 [VMX_DR] = "VMX_DR", 516 [VMX_IO] = "VMX_IO", 517 [VMX_RDMSR] = "VMX_RDMSR", 518 [VMX_WRMSR] = "VMX_WRMSR", 519 [VMX_FAIL_STATE] = "VMX_FAIL_STATE", 520 [VMX_FAIL_MSR] = "VMX_FAIL_MSR", 521 [VMX_MWAIT] = "VMX_MWAIT", 522 [VMX_MTF] = "VMX_MTF", 523 [VMX_MONITOR] = "VMX_MONITOR", 524 [VMX_PAUSE] = "VMX_PAUSE", 525 [VMX_FAIL_MCHECK] = "VMX_FAIL_MCHECK", 526 [VMX_TPR_THRESHOLD] = "VMX_TPR_THRESHOLD", 527 [VMX_APIC_ACCESS] = "VMX_APIC_ACCESS", 528 [VMX_EOI_INDUCED] = "VMX_EOI_INDUCED", 529 [VMX_GDTR_IDTR] = "VMX_GDTR_IDTR", 530 [VMX_LDTR_TR] = "VMX_LDTR_TR", 531 [VMX_EPT_VIOLATION] = "VMX_EPT_VIOLATION", 532 [VMX_EPT_MISCONFIG] = "VMX_EPT_MISCONFIG", 533 [VMX_INVEPT] = "VMX_INVEPT", 534 [VMX_PREEMPT] = "VMX_PREEMPT", 535 [VMX_INVVPID] = "VMX_INVVPID", 536 [VMX_WBINVD] = "VMX_WBINVD", 537 [VMX_XSETBV] = "VMX_XSETBV", 538 [VMX_APIC_WRITE] = "VMX_APIC_WRITE", 539 [VMX_RDRAND] = "VMX_RDRAND", 540 [VMX_INVPCID] = "VMX_INVPCID", 541 [VMX_VMFUNC] = "VMX_VMFUNC", 542 [VMX_RDSEED] = "VMX_RDSEED", 543 [VMX_PML_FULL] = "VMX_PML_FULL", 544 [VMX_XSAVES] = "VMX_XSAVES", 545 [VMX_XRSTORS] = "VMX_XRSTORS", 546 }; 547 548 const char *exit_reason_description(u64 reason) 549 { 550 if (reason >= ARRAY_SIZE(exit_reason_descriptions)) 551 return "(unknown)"; 552 return exit_reason_descriptions[reason] ? : "(unused)"; 553 } 554 555 void print_vmexit_info() 556 { 557 u64 guest_rip, guest_rsp; 558 ulong reason = vmcs_read(EXI_REASON) & 0xff; 559 ulong exit_qual = vmcs_read(EXI_QUALIFICATION); 560 guest_rip = vmcs_read(GUEST_RIP); 561 guest_rsp = vmcs_read(GUEST_RSP); 562 printf("VMEXIT info:\n"); 563 printf("\tvmexit reason = %ld\n", reason); 564 printf("\texit qualification = %#lx\n", exit_qual); 565 printf("\tBit 31 of reason = %lx\n", (vmcs_read(EXI_REASON) >> 31) & 1); 566 printf("\tguest_rip = %#lx\n", guest_rip); 567 printf("\tRAX=%#lx RBX=%#lx RCX=%#lx RDX=%#lx\n", 568 regs.rax, regs.rbx, regs.rcx, regs.rdx); 569 printf("\tRSP=%#lx RBP=%#lx RSI=%#lx RDI=%#lx\n", 570 guest_rsp, regs.rbp, regs.rsi, regs.rdi); 571 printf("\tR8 =%#lx R9 =%#lx R10=%#lx R11=%#lx\n", 572 regs.r8, regs.r9, regs.r10, regs.r11); 573 printf("\tR12=%#lx R13=%#lx R14=%#lx R15=%#lx\n", 574 regs.r12, regs.r13, regs.r14, regs.r15); 575 } 576 577 void 578 print_vmentry_failure_info(struct vmentry_failure *failure) { 579 if (failure->early) { 580 printf("Early %s failure: ", failure->instr); 581 switch (failure->flags & VMX_ENTRY_FLAGS) { 582 case X86_EFLAGS_CF: 583 printf("current-VMCS pointer is not valid.\n"); 584 break; 585 case X86_EFLAGS_ZF: 586 printf("error number is %ld. See Intel 30.4.\n", 587 vmcs_read(VMX_INST_ERROR)); 588 break; 589 default: 590 printf("unexpected flags %lx!\n", failure->flags); 591 } 592 } else { 593 u64 reason = vmcs_read(EXI_REASON); 594 u64 qual = vmcs_read(EXI_QUALIFICATION); 595 596 printf("Non-early %s failure (reason=%#lx, qual=%#lx): ", 597 failure->instr, reason, qual); 598 599 switch (reason & 0xff) { 600 case VMX_FAIL_STATE: 601 printf("invalid guest state\n"); 602 break; 603 case VMX_FAIL_MSR: 604 printf("MSR loading\n"); 605 break; 606 case VMX_FAIL_MCHECK: 607 printf("machine-check event\n"); 608 break; 609 default: 610 printf("unexpected basic exit reason %ld\n", 611 reason & 0xff); 612 } 613 614 if (!(reason & VMX_ENTRY_FAILURE)) 615 printf("\tVMX_ENTRY_FAILURE BIT NOT SET!\n"); 616 617 if (reason & 0x7fff0000) 618 printf("\tRESERVED BITS SET!\n"); 619 } 620 } 621 622 /* 623 * VMCLEAR should ensures all VMCS state is flushed to the VMCS 624 * region in memory. 625 */ 626 static void test_vmclear_flushing(void) 627 { 628 struct vmcs *vmcs[3] = {}; 629 int i; 630 631 for (i = 0; i < ARRAY_SIZE(vmcs); i++) { 632 vmcs[i] = alloc_page(); 633 memset(vmcs[i], 0, PAGE_SIZE); 634 } 635 636 vmcs[0]->hdr.revision_id = basic.revision; 637 assert(!vmcs_clear(vmcs[0])); 638 assert(!make_vmcs_current(vmcs[0])); 639 set_all_vmcs_fields(0x86); 640 641 assert(!vmcs_clear(vmcs[0])); 642 memcpy(vmcs[1], vmcs[0], basic.size); 643 assert(!make_vmcs_current(vmcs[1])); 644 report("test vmclear flush (current VMCS)", check_all_vmcs_fields(0x86)); 645 646 set_all_vmcs_fields(0x87); 647 assert(!make_vmcs_current(vmcs[0])); 648 assert(!vmcs_clear(vmcs[1])); 649 memcpy(vmcs[2], vmcs[1], basic.size); 650 assert(!make_vmcs_current(vmcs[2])); 651 report("test vmclear flush (!current VMCS)", check_all_vmcs_fields(0x87)); 652 653 for (i = 0; i < ARRAY_SIZE(vmcs); i++) { 654 assert(!vmcs_clear(vmcs[i])); 655 free_page(vmcs[i]); 656 } 657 } 658 659 static void test_vmclear(void) 660 { 661 struct vmcs *tmp_root; 662 int width = cpuid_maxphyaddr(); 663 664 /* 665 * Note- The tests below do not necessarily have a 666 * valid VMCS, but that's ok since the invalid vmcs 667 * is only used for a specific test and is discarded 668 * without touching its contents 669 */ 670 671 /* Unaligned page access */ 672 tmp_root = (struct vmcs *)((intptr_t)vmcs_root + 1); 673 report("test vmclear with unaligned vmcs", 674 vmcs_clear(tmp_root) == 1); 675 676 /* gpa bits beyond physical address width are set*/ 677 tmp_root = (struct vmcs *)((intptr_t)vmcs_root | 678 ((u64)1 << (width+1))); 679 report("test vmclear with vmcs address bits set beyond physical address width", 680 vmcs_clear(tmp_root) == 1); 681 682 /* Pass VMXON region */ 683 tmp_root = (struct vmcs *)vmxon_region; 684 report("test vmclear with vmxon region", 685 vmcs_clear(tmp_root) == 1); 686 687 /* Valid VMCS */ 688 report("test vmclear with valid vmcs region", vmcs_clear(vmcs_root) == 0); 689 690 test_vmclear_flushing(); 691 } 692 693 static void __attribute__((__used__)) guest_main(void) 694 { 695 if (current->v2) 696 v2_guest_main(); 697 else 698 current->guest_main(); 699 } 700 701 /* guest_entry */ 702 asm( 703 ".align 4, 0x90\n\t" 704 ".globl entry_guest\n\t" 705 "guest_entry:\n\t" 706 " call guest_main\n\t" 707 " mov $1, %edi\n\t" 708 " call hypercall\n\t" 709 ); 710 711 /* EPT paging structure related functions */ 712 /* split_large_ept_entry: Split a 2M/1G large page into 512 smaller PTEs. 713 @ptep : large page table entry to split 714 @level : level of ptep (2 or 3) 715 */ 716 static void split_large_ept_entry(unsigned long *ptep, int level) 717 { 718 unsigned long *new_pt; 719 unsigned long gpa; 720 unsigned long pte; 721 unsigned long prototype; 722 int i; 723 724 pte = *ptep; 725 assert(pte & EPT_PRESENT); 726 assert(pte & EPT_LARGE_PAGE); 727 assert(level == 2 || level == 3); 728 729 new_pt = alloc_page(); 730 assert(new_pt); 731 memset(new_pt, 0, PAGE_SIZE); 732 733 prototype = pte & ~EPT_ADDR_MASK; 734 if (level == 2) 735 prototype &= ~EPT_LARGE_PAGE; 736 737 gpa = pte & EPT_ADDR_MASK; 738 for (i = 0; i < EPT_PGDIR_ENTRIES; i++) { 739 new_pt[i] = prototype | gpa; 740 gpa += 1ul << EPT_LEVEL_SHIFT(level - 1); 741 } 742 743 pte &= ~EPT_LARGE_PAGE; 744 pte &= ~EPT_ADDR_MASK; 745 pte |= virt_to_phys(new_pt); 746 747 *ptep = pte; 748 } 749 750 /* install_ept_entry : Install a page to a given level in EPT 751 @pml4 : addr of pml4 table 752 @pte_level : level of PTE to set 753 @guest_addr : physical address of guest 754 @pte : pte value to set 755 @pt_page : address of page table, NULL for a new page 756 */ 757 void install_ept_entry(unsigned long *pml4, 758 int pte_level, 759 unsigned long guest_addr, 760 unsigned long pte, 761 unsigned long *pt_page) 762 { 763 int level; 764 unsigned long *pt = pml4; 765 unsigned offset; 766 767 /* EPT only uses 48 bits of GPA. */ 768 assert(guest_addr < (1ul << 48)); 769 770 for (level = EPT_PAGE_LEVEL; level > pte_level; --level) { 771 offset = (guest_addr >> EPT_LEVEL_SHIFT(level)) 772 & EPT_PGDIR_MASK; 773 if (!(pt[offset] & (EPT_PRESENT))) { 774 unsigned long *new_pt = pt_page; 775 if (!new_pt) 776 new_pt = alloc_page(); 777 else 778 pt_page = 0; 779 memset(new_pt, 0, PAGE_SIZE); 780 pt[offset] = virt_to_phys(new_pt) 781 | EPT_RA | EPT_WA | EPT_EA; 782 } else if (pt[offset] & EPT_LARGE_PAGE) 783 split_large_ept_entry(&pt[offset], level); 784 pt = phys_to_virt(pt[offset] & EPT_ADDR_MASK); 785 } 786 offset = (guest_addr >> EPT_LEVEL_SHIFT(level)) & EPT_PGDIR_MASK; 787 pt[offset] = pte; 788 } 789 790 /* Map a page, @perm is the permission of the page */ 791 void install_ept(unsigned long *pml4, 792 unsigned long phys, 793 unsigned long guest_addr, 794 u64 perm) 795 { 796 install_ept_entry(pml4, 1, guest_addr, (phys & PAGE_MASK) | perm, 0); 797 } 798 799 /* Map a 1G-size page */ 800 void install_1g_ept(unsigned long *pml4, 801 unsigned long phys, 802 unsigned long guest_addr, 803 u64 perm) 804 { 805 install_ept_entry(pml4, 3, guest_addr, 806 (phys & PAGE_MASK) | perm | EPT_LARGE_PAGE, 0); 807 } 808 809 /* Map a 2M-size page */ 810 void install_2m_ept(unsigned long *pml4, 811 unsigned long phys, 812 unsigned long guest_addr, 813 u64 perm) 814 { 815 install_ept_entry(pml4, 2, guest_addr, 816 (phys & PAGE_MASK) | perm | EPT_LARGE_PAGE, 0); 817 } 818 819 /* setup_ept_range : Setup a range of 1:1 mapped page to EPT paging structure. 820 @start : start address of guest page 821 @len : length of address to be mapped 822 @map_1g : whether 1G page map is used 823 @map_2m : whether 2M page map is used 824 @perm : permission for every page 825 */ 826 void setup_ept_range(unsigned long *pml4, unsigned long start, 827 unsigned long len, int map_1g, int map_2m, u64 perm) 828 { 829 u64 phys = start; 830 u64 max = (u64)len + (u64)start; 831 832 if (map_1g) { 833 while (phys + PAGE_SIZE_1G <= max) { 834 install_1g_ept(pml4, phys, phys, perm); 835 phys += PAGE_SIZE_1G; 836 } 837 } 838 if (map_2m) { 839 while (phys + PAGE_SIZE_2M <= max) { 840 install_2m_ept(pml4, phys, phys, perm); 841 phys += PAGE_SIZE_2M; 842 } 843 } 844 while (phys + PAGE_SIZE <= max) { 845 install_ept(pml4, phys, phys, perm); 846 phys += PAGE_SIZE; 847 } 848 } 849 850 /* get_ept_pte : Get the PTE of a given level in EPT, 851 @level == 1 means get the latest level*/ 852 bool get_ept_pte(unsigned long *pml4, unsigned long guest_addr, int level, 853 unsigned long *pte) 854 { 855 int l; 856 unsigned long *pt = pml4, iter_pte; 857 unsigned offset; 858 859 assert(level >= 1 && level <= 4); 860 861 for (l = EPT_PAGE_LEVEL; ; --l) { 862 offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK; 863 iter_pte = pt[offset]; 864 if (l == level) 865 break; 866 if (l < 4 && (iter_pte & EPT_LARGE_PAGE)) 867 return false; 868 if (!(iter_pte & (EPT_PRESENT))) 869 return false; 870 pt = (unsigned long *)(iter_pte & EPT_ADDR_MASK); 871 } 872 offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK; 873 if (pte) 874 *pte = pt[offset]; 875 return true; 876 } 877 878 static void clear_ept_ad_pte(unsigned long *pml4, unsigned long guest_addr) 879 { 880 int l; 881 unsigned long *pt = pml4; 882 u64 pte; 883 unsigned offset; 884 885 for (l = EPT_PAGE_LEVEL; ; --l) { 886 offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK; 887 pt[offset] &= ~(EPT_ACCESS_FLAG|EPT_DIRTY_FLAG); 888 pte = pt[offset]; 889 if (l == 1 || (l < 4 && (pte & EPT_LARGE_PAGE))) 890 break; 891 pt = (unsigned long *)(pte & EPT_ADDR_MASK); 892 } 893 } 894 895 /* clear_ept_ad : Clear EPT A/D bits for the page table walk and the 896 final GPA of a guest address. */ 897 void clear_ept_ad(unsigned long *pml4, u64 guest_cr3, 898 unsigned long guest_addr) 899 { 900 int l; 901 unsigned long *pt = (unsigned long *)guest_cr3, gpa; 902 u64 pte, offset_in_page; 903 unsigned offset; 904 905 for (l = EPT_PAGE_LEVEL; ; --l) { 906 offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK; 907 908 clear_ept_ad_pte(pml4, (u64) &pt[offset]); 909 pte = pt[offset]; 910 if (l == 1 || (l < 4 && (pte & PT_PAGE_SIZE_MASK))) 911 break; 912 if (!(pte & PT_PRESENT_MASK)) 913 return; 914 pt = (unsigned long *)(pte & PT_ADDR_MASK); 915 } 916 917 offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK; 918 offset_in_page = guest_addr & ((1 << EPT_LEVEL_SHIFT(l)) - 1); 919 gpa = (pt[offset] & PT_ADDR_MASK) | (guest_addr & offset_in_page); 920 clear_ept_ad_pte(pml4, gpa); 921 } 922 923 /* check_ept_ad : Check the content of EPT A/D bits for the page table 924 walk and the final GPA of a guest address. */ 925 void check_ept_ad(unsigned long *pml4, u64 guest_cr3, 926 unsigned long guest_addr, int expected_gpa_ad, 927 int expected_pt_ad) 928 { 929 int l; 930 unsigned long *pt = (unsigned long *)guest_cr3, gpa; 931 u64 ept_pte, pte, offset_in_page; 932 unsigned offset; 933 bool bad_pt_ad = false; 934 935 for (l = EPT_PAGE_LEVEL; ; --l) { 936 offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK; 937 938 if (!get_ept_pte(pml4, (u64) &pt[offset], 1, &ept_pte)) { 939 printf("EPT - guest level %d page table is not mapped.\n", l); 940 return; 941 } 942 943 if (!bad_pt_ad) { 944 bad_pt_ad |= (ept_pte & (EPT_ACCESS_FLAG|EPT_DIRTY_FLAG)) != expected_pt_ad; 945 if (bad_pt_ad) 946 report("EPT - guest level %d page table A=%d/D=%d", 947 false, l, 948 !!(expected_pt_ad & EPT_ACCESS_FLAG), 949 !!(expected_pt_ad & EPT_DIRTY_FLAG)); 950 } 951 952 pte = pt[offset]; 953 if (l == 1 || (l < 4 && (pte & PT_PAGE_SIZE_MASK))) 954 break; 955 if (!(pte & PT_PRESENT_MASK)) 956 return; 957 pt = (unsigned long *)(pte & PT_ADDR_MASK); 958 } 959 960 if (!bad_pt_ad) 961 report("EPT - guest page table structures A=%d/D=%d", 962 true, 963 !!(expected_pt_ad & EPT_ACCESS_FLAG), 964 !!(expected_pt_ad & EPT_DIRTY_FLAG)); 965 966 offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK; 967 offset_in_page = guest_addr & ((1 << EPT_LEVEL_SHIFT(l)) - 1); 968 gpa = (pt[offset] & PT_ADDR_MASK) | (guest_addr & offset_in_page); 969 970 if (!get_ept_pte(pml4, gpa, 1, &ept_pte)) { 971 report("EPT - guest physical address is not mapped", false); 972 return; 973 } 974 report("EPT - guest physical address A=%d/D=%d", 975 (ept_pte & (EPT_ACCESS_FLAG|EPT_DIRTY_FLAG)) == expected_gpa_ad, 976 !!(expected_gpa_ad & EPT_ACCESS_FLAG), 977 !!(expected_gpa_ad & EPT_DIRTY_FLAG)); 978 } 979 980 981 void ept_sync(int type, u64 eptp) 982 { 983 switch (type) { 984 case INVEPT_SINGLE: 985 if (ept_vpid.val & EPT_CAP_INVEPT_SINGLE) { 986 invept(INVEPT_SINGLE, eptp); 987 break; 988 } 989 /* else fall through */ 990 case INVEPT_GLOBAL: 991 if (ept_vpid.val & EPT_CAP_INVEPT_ALL) { 992 invept(INVEPT_GLOBAL, eptp); 993 break; 994 } 995 /* else fall through */ 996 default: 997 printf("WARNING: invept is not supported!\n"); 998 } 999 } 1000 1001 void set_ept_pte(unsigned long *pml4, unsigned long guest_addr, 1002 int level, u64 pte_val) 1003 { 1004 int l; 1005 unsigned long *pt = pml4; 1006 unsigned offset; 1007 1008 assert(level >= 1 && level <= 4); 1009 1010 for (l = EPT_PAGE_LEVEL; ; --l) { 1011 offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK; 1012 if (l == level) 1013 break; 1014 assert(pt[offset] & EPT_PRESENT); 1015 pt = (unsigned long *)(pt[offset] & EPT_ADDR_MASK); 1016 } 1017 offset = (guest_addr >> EPT_LEVEL_SHIFT(l)) & EPT_PGDIR_MASK; 1018 pt[offset] = pte_val; 1019 } 1020 1021 bool ept_2m_supported(void) 1022 { 1023 return ept_vpid.val & EPT_CAP_2M_PAGE; 1024 } 1025 1026 bool ept_1g_supported(void) 1027 { 1028 return ept_vpid.val & EPT_CAP_1G_PAGE; 1029 } 1030 1031 bool ept_huge_pages_supported(int level) 1032 { 1033 if (level == 2) 1034 return ept_2m_supported(); 1035 else if (level == 3) 1036 return ept_1g_supported(); 1037 else 1038 return false; 1039 } 1040 1041 bool ept_execute_only_supported(void) 1042 { 1043 return ept_vpid.val & EPT_CAP_WT; 1044 } 1045 1046 bool ept_ad_bits_supported(void) 1047 { 1048 return ept_vpid.val & EPT_CAP_AD_FLAG; 1049 } 1050 1051 void vpid_sync(int type, u16 vpid) 1052 { 1053 switch(type) { 1054 case INVVPID_CONTEXT_GLOBAL: 1055 if (ept_vpid.val & VPID_CAP_INVVPID_CXTGLB) { 1056 invvpid(INVVPID_CONTEXT_GLOBAL, vpid, 0); 1057 break; 1058 } 1059 case INVVPID_ALL: 1060 if (ept_vpid.val & VPID_CAP_INVVPID_ALL) { 1061 invvpid(INVVPID_ALL, vpid, 0); 1062 break; 1063 } 1064 default: 1065 printf("WARNING: invvpid is not supported\n"); 1066 } 1067 } 1068 1069 static void init_vmcs_ctrl(void) 1070 { 1071 /* 26.2 CHECKS ON VMX CONTROLS AND HOST-STATE AREA */ 1072 /* 26.2.1.1 */ 1073 vmcs_write(PIN_CONTROLS, ctrl_pin); 1074 /* Disable VMEXIT of IO instruction */ 1075 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu[0]); 1076 if (ctrl_cpu_rev[0].set & CPU_SECONDARY) { 1077 ctrl_cpu[1] = (ctrl_cpu[1] | ctrl_cpu_rev[1].set) & 1078 ctrl_cpu_rev[1].clr; 1079 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu[1]); 1080 } 1081 vmcs_write(CR3_TARGET_COUNT, 0); 1082 vmcs_write(VPID, ++vpid_cnt); 1083 } 1084 1085 static void init_vmcs_host(void) 1086 { 1087 /* 26.2 CHECKS ON VMX CONTROLS AND HOST-STATE AREA */ 1088 /* 26.2.1.2 */ 1089 vmcs_write(HOST_EFER, rdmsr(MSR_EFER)); 1090 1091 /* 26.2.1.3 */ 1092 vmcs_write(ENT_CONTROLS, ctrl_enter); 1093 vmcs_write(EXI_CONTROLS, ctrl_exit); 1094 1095 /* 26.2.2 */ 1096 vmcs_write(HOST_CR0, read_cr0()); 1097 vmcs_write(HOST_CR3, read_cr3()); 1098 vmcs_write(HOST_CR4, read_cr4()); 1099 vmcs_write(HOST_SYSENTER_EIP, (u64)(&entry_sysenter)); 1100 vmcs_write(HOST_SYSENTER_CS, KERNEL_CS); 1101 1102 /* 26.2.3 */ 1103 vmcs_write(HOST_SEL_CS, KERNEL_CS); 1104 vmcs_write(HOST_SEL_SS, KERNEL_DS); 1105 vmcs_write(HOST_SEL_DS, KERNEL_DS); 1106 vmcs_write(HOST_SEL_ES, KERNEL_DS); 1107 vmcs_write(HOST_SEL_FS, KERNEL_DS); 1108 vmcs_write(HOST_SEL_GS, KERNEL_DS); 1109 vmcs_write(HOST_SEL_TR, TSS_MAIN); 1110 vmcs_write(HOST_BASE_TR, tss_descr.base); 1111 vmcs_write(HOST_BASE_GDTR, gdt64_desc.base); 1112 vmcs_write(HOST_BASE_IDTR, idt_descr.base); 1113 vmcs_write(HOST_BASE_FS, 0); 1114 vmcs_write(HOST_BASE_GS, 0); 1115 1116 /* Set other vmcs area */ 1117 vmcs_write(PF_ERROR_MASK, 0); 1118 vmcs_write(PF_ERROR_MATCH, 0); 1119 vmcs_write(VMCS_LINK_PTR, ~0ul); 1120 vmcs_write(VMCS_LINK_PTR_HI, ~0ul); 1121 vmcs_write(HOST_RIP, (u64)(&vmx_return)); 1122 } 1123 1124 static void init_vmcs_guest(void) 1125 { 1126 /* 26.3 CHECKING AND LOADING GUEST STATE */ 1127 ulong guest_cr0, guest_cr4, guest_cr3; 1128 /* 26.3.1.1 */ 1129 guest_cr0 = read_cr0(); 1130 guest_cr4 = read_cr4(); 1131 guest_cr3 = read_cr3(); 1132 if (ctrl_enter & ENT_GUEST_64) { 1133 guest_cr0 |= X86_CR0_PG; 1134 guest_cr4 |= X86_CR4_PAE; 1135 } 1136 if ((ctrl_enter & ENT_GUEST_64) == 0) 1137 guest_cr4 &= (~X86_CR4_PCIDE); 1138 if (guest_cr0 & X86_CR0_PG) 1139 guest_cr0 |= X86_CR0_PE; 1140 vmcs_write(GUEST_CR0, guest_cr0); 1141 vmcs_write(GUEST_CR3, guest_cr3); 1142 vmcs_write(GUEST_CR4, guest_cr4); 1143 vmcs_write(GUEST_SYSENTER_CS, KERNEL_CS); 1144 vmcs_write(GUEST_SYSENTER_ESP, 1145 (u64)(guest_syscall_stack + PAGE_SIZE - 1)); 1146 vmcs_write(GUEST_SYSENTER_EIP, (u64)(&entry_sysenter)); 1147 vmcs_write(GUEST_DR7, 0); 1148 vmcs_write(GUEST_EFER, rdmsr(MSR_EFER)); 1149 1150 /* 26.3.1.2 */ 1151 vmcs_write(GUEST_SEL_CS, KERNEL_CS); 1152 vmcs_write(GUEST_SEL_SS, KERNEL_DS); 1153 vmcs_write(GUEST_SEL_DS, KERNEL_DS); 1154 vmcs_write(GUEST_SEL_ES, KERNEL_DS); 1155 vmcs_write(GUEST_SEL_FS, KERNEL_DS); 1156 vmcs_write(GUEST_SEL_GS, KERNEL_DS); 1157 vmcs_write(GUEST_SEL_TR, TSS_MAIN); 1158 vmcs_write(GUEST_SEL_LDTR, 0); 1159 1160 vmcs_write(GUEST_BASE_CS, 0); 1161 vmcs_write(GUEST_BASE_ES, 0); 1162 vmcs_write(GUEST_BASE_SS, 0); 1163 vmcs_write(GUEST_BASE_DS, 0); 1164 vmcs_write(GUEST_BASE_FS, 0); 1165 vmcs_write(GUEST_BASE_GS, 0); 1166 vmcs_write(GUEST_BASE_TR, tss_descr.base); 1167 vmcs_write(GUEST_BASE_LDTR, 0); 1168 1169 vmcs_write(GUEST_LIMIT_CS, 0xFFFFFFFF); 1170 vmcs_write(GUEST_LIMIT_DS, 0xFFFFFFFF); 1171 vmcs_write(GUEST_LIMIT_ES, 0xFFFFFFFF); 1172 vmcs_write(GUEST_LIMIT_SS, 0xFFFFFFFF); 1173 vmcs_write(GUEST_LIMIT_FS, 0xFFFFFFFF); 1174 vmcs_write(GUEST_LIMIT_GS, 0xFFFFFFFF); 1175 vmcs_write(GUEST_LIMIT_LDTR, 0xffff); 1176 vmcs_write(GUEST_LIMIT_TR, tss_descr.limit); 1177 1178 vmcs_write(GUEST_AR_CS, 0xa09b); 1179 vmcs_write(GUEST_AR_DS, 0xc093); 1180 vmcs_write(GUEST_AR_ES, 0xc093); 1181 vmcs_write(GUEST_AR_FS, 0xc093); 1182 vmcs_write(GUEST_AR_GS, 0xc093); 1183 vmcs_write(GUEST_AR_SS, 0xc093); 1184 vmcs_write(GUEST_AR_LDTR, 0x82); 1185 vmcs_write(GUEST_AR_TR, 0x8b); 1186 1187 /* 26.3.1.3 */ 1188 vmcs_write(GUEST_BASE_GDTR, gdt64_desc.base); 1189 vmcs_write(GUEST_BASE_IDTR, idt_descr.base); 1190 vmcs_write(GUEST_LIMIT_GDTR, gdt64_desc.limit); 1191 vmcs_write(GUEST_LIMIT_IDTR, idt_descr.limit); 1192 1193 /* 26.3.1.4 */ 1194 vmcs_write(GUEST_RIP, (u64)(&guest_entry)); 1195 vmcs_write(GUEST_RSP, (u64)(guest_stack + PAGE_SIZE - 1)); 1196 vmcs_write(GUEST_RFLAGS, 0x2); 1197 1198 /* 26.3.1.5 */ 1199 vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE); 1200 vmcs_write(GUEST_INTR_STATE, 0); 1201 } 1202 1203 static int init_vmcs(struct vmcs **vmcs) 1204 { 1205 *vmcs = alloc_page(); 1206 memset(*vmcs, 0, PAGE_SIZE); 1207 (*vmcs)->hdr.revision_id = basic.revision; 1208 /* vmclear first to init vmcs */ 1209 if (vmcs_clear(*vmcs)) { 1210 printf("%s : vmcs_clear error\n", __func__); 1211 return 1; 1212 } 1213 1214 if (make_vmcs_current(*vmcs)) { 1215 printf("%s : make_vmcs_current error\n", __func__); 1216 return 1; 1217 } 1218 1219 /* All settings to pin/exit/enter/cpu 1220 control fields should be placed here */ 1221 ctrl_pin |= PIN_EXTINT | PIN_NMI | PIN_VIRT_NMI; 1222 ctrl_exit = EXI_LOAD_EFER | EXI_HOST_64; 1223 ctrl_enter = (ENT_LOAD_EFER | ENT_GUEST_64); 1224 /* DIsable IO instruction VMEXIT now */ 1225 ctrl_cpu[0] &= (~(CPU_IO | CPU_IO_BITMAP)); 1226 ctrl_cpu[1] = 0; 1227 1228 ctrl_pin = (ctrl_pin | ctrl_pin_rev.set) & ctrl_pin_rev.clr; 1229 ctrl_enter = (ctrl_enter | ctrl_enter_rev.set) & ctrl_enter_rev.clr; 1230 ctrl_exit = (ctrl_exit | ctrl_exit_rev.set) & ctrl_exit_rev.clr; 1231 ctrl_cpu[0] = (ctrl_cpu[0] | ctrl_cpu_rev[0].set) & ctrl_cpu_rev[0].clr; 1232 1233 init_vmcs_ctrl(); 1234 init_vmcs_host(); 1235 init_vmcs_guest(); 1236 return 0; 1237 } 1238 1239 static void init_vmx(void) 1240 { 1241 ulong fix_cr0_set, fix_cr0_clr; 1242 ulong fix_cr4_set, fix_cr4_clr; 1243 1244 vmxon_region = alloc_page(); 1245 memset(vmxon_region, 0, PAGE_SIZE); 1246 1247 fix_cr0_set = rdmsr(MSR_IA32_VMX_CR0_FIXED0); 1248 fix_cr0_clr = rdmsr(MSR_IA32_VMX_CR0_FIXED1); 1249 fix_cr4_set = rdmsr(MSR_IA32_VMX_CR4_FIXED0); 1250 fix_cr4_clr = rdmsr(MSR_IA32_VMX_CR4_FIXED1); 1251 basic.val = rdmsr(MSR_IA32_VMX_BASIC); 1252 ctrl_pin_rev.val = rdmsr(basic.ctrl ? MSR_IA32_VMX_TRUE_PIN 1253 : MSR_IA32_VMX_PINBASED_CTLS); 1254 ctrl_exit_rev.val = rdmsr(basic.ctrl ? MSR_IA32_VMX_TRUE_EXIT 1255 : MSR_IA32_VMX_EXIT_CTLS); 1256 ctrl_enter_rev.val = rdmsr(basic.ctrl ? MSR_IA32_VMX_TRUE_ENTRY 1257 : MSR_IA32_VMX_ENTRY_CTLS); 1258 ctrl_cpu_rev[0].val = rdmsr(basic.ctrl ? MSR_IA32_VMX_TRUE_PROC 1259 : MSR_IA32_VMX_PROCBASED_CTLS); 1260 if ((ctrl_cpu_rev[0].clr & CPU_SECONDARY) != 0) 1261 ctrl_cpu_rev[1].val = rdmsr(MSR_IA32_VMX_PROCBASED_CTLS2); 1262 else 1263 ctrl_cpu_rev[1].val = 0; 1264 if ((ctrl_cpu_rev[1].clr & (CPU_EPT | CPU_VPID)) != 0) 1265 ept_vpid.val = rdmsr(MSR_IA32_VMX_EPT_VPID_CAP); 1266 else 1267 ept_vpid.val = 0; 1268 1269 write_cr0((read_cr0() & fix_cr0_clr) | fix_cr0_set); 1270 write_cr4((read_cr4() & fix_cr4_clr) | fix_cr4_set | X86_CR4_VMXE); 1271 1272 *vmxon_region = basic.revision; 1273 1274 guest_stack = alloc_page(); 1275 memset(guest_stack, 0, PAGE_SIZE); 1276 guest_syscall_stack = alloc_page(); 1277 memset(guest_syscall_stack, 0, PAGE_SIZE); 1278 } 1279 1280 static void do_vmxon_off(void *data) 1281 { 1282 vmx_on(); 1283 vmx_off(); 1284 } 1285 1286 static void do_write_feature_control(void *data) 1287 { 1288 wrmsr(MSR_IA32_FEATURE_CONTROL, 0); 1289 } 1290 1291 static int test_vmx_feature_control(void) 1292 { 1293 u64 ia32_feature_control; 1294 bool vmx_enabled; 1295 1296 ia32_feature_control = rdmsr(MSR_IA32_FEATURE_CONTROL); 1297 vmx_enabled = ((ia32_feature_control & 0x5) == 0x5); 1298 if ((ia32_feature_control & 0x5) == 0x5) { 1299 printf("VMX enabled and locked by BIOS\n"); 1300 return 0; 1301 } else if (ia32_feature_control & 0x1) { 1302 printf("ERROR: VMX locked out by BIOS!?\n"); 1303 return 1; 1304 } 1305 1306 wrmsr(MSR_IA32_FEATURE_CONTROL, 0); 1307 report("test vmxon with FEATURE_CONTROL cleared", 1308 test_for_exception(GP_VECTOR, &do_vmxon_off, NULL)); 1309 1310 wrmsr(MSR_IA32_FEATURE_CONTROL, 0x4); 1311 report("test vmxon without FEATURE_CONTROL lock", 1312 test_for_exception(GP_VECTOR, &do_vmxon_off, NULL)); 1313 1314 wrmsr(MSR_IA32_FEATURE_CONTROL, 0x5); 1315 vmx_enabled = ((rdmsr(MSR_IA32_FEATURE_CONTROL) & 0x5) == 0x5); 1316 report("test enable VMX in FEATURE_CONTROL", vmx_enabled); 1317 1318 report("test FEATURE_CONTROL lock bit", 1319 test_for_exception(GP_VECTOR, &do_write_feature_control, NULL)); 1320 1321 return !vmx_enabled; 1322 } 1323 1324 static int test_vmxon(void) 1325 { 1326 int ret, ret1; 1327 u64 *tmp_region = vmxon_region; 1328 int width = cpuid_maxphyaddr(); 1329 1330 /* Unaligned page access */ 1331 vmxon_region = (u64 *)((intptr_t)vmxon_region + 1); 1332 ret1 = vmx_on(); 1333 report("test vmxon with unaligned vmxon region", ret1); 1334 if (!ret1) { 1335 ret = 1; 1336 goto out; 1337 } 1338 1339 /* gpa bits beyond physical address width are set*/ 1340 vmxon_region = (u64 *)((intptr_t)tmp_region | ((u64)1 << (width+1))); 1341 ret1 = vmx_on(); 1342 report("test vmxon with bits set beyond physical address width", ret1); 1343 if (!ret1) { 1344 ret = 1; 1345 goto out; 1346 } 1347 1348 /* invalid revision indentifier */ 1349 vmxon_region = tmp_region; 1350 *vmxon_region = 0xba9da9; 1351 ret1 = vmx_on(); 1352 report("test vmxon with invalid revision identifier", ret1); 1353 if (!ret1) { 1354 ret = 1; 1355 goto out; 1356 } 1357 1358 /* and finally a valid region */ 1359 *vmxon_region = basic.revision; 1360 ret = vmx_on(); 1361 report("test vmxon with valid vmxon region", !ret); 1362 1363 out: 1364 return ret; 1365 } 1366 1367 static void test_vmptrld(void) 1368 { 1369 struct vmcs *vmcs, *tmp_root; 1370 int width = cpuid_maxphyaddr(); 1371 1372 vmcs = alloc_page(); 1373 vmcs->hdr.revision_id = basic.revision; 1374 1375 /* Unaligned page access */ 1376 tmp_root = (struct vmcs *)((intptr_t)vmcs + 1); 1377 report("test vmptrld with unaligned vmcs", 1378 make_vmcs_current(tmp_root) == 1); 1379 1380 /* gpa bits beyond physical address width are set*/ 1381 tmp_root = (struct vmcs *)((intptr_t)vmcs | 1382 ((u64)1 << (width+1))); 1383 report("test vmptrld with vmcs address bits set beyond physical address width", 1384 make_vmcs_current(tmp_root) == 1); 1385 1386 /* Pass VMXON region */ 1387 assert(!vmcs_clear(vmcs)); 1388 assert(!make_vmcs_current(vmcs)); 1389 tmp_root = (struct vmcs *)vmxon_region; 1390 report("test vmptrld with vmxon region", 1391 make_vmcs_current(tmp_root) == 1); 1392 report("test vmptrld with vmxon region vm-instruction error", 1393 vmcs_read(VMX_INST_ERROR) == VMXERR_VMPTRLD_VMXON_POINTER); 1394 1395 report("test vmptrld with valid vmcs region", make_vmcs_current(vmcs) == 0); 1396 } 1397 1398 static void test_vmptrst(void) 1399 { 1400 int ret; 1401 struct vmcs *vmcs1, *vmcs2; 1402 1403 vmcs1 = alloc_page(); 1404 memset(vmcs1, 0, PAGE_SIZE); 1405 init_vmcs(&vmcs1); 1406 ret = vmcs_save(&vmcs2); 1407 report("test vmptrst", (!ret) && (vmcs1 == vmcs2)); 1408 } 1409 1410 struct vmx_ctl_msr { 1411 const char *name; 1412 u32 index, true_index; 1413 u32 default1; 1414 } vmx_ctl_msr[] = { 1415 { "MSR_IA32_VMX_PINBASED_CTLS", MSR_IA32_VMX_PINBASED_CTLS, 1416 MSR_IA32_VMX_TRUE_PIN, 0x16 }, 1417 { "MSR_IA32_VMX_PROCBASED_CTLS", MSR_IA32_VMX_PROCBASED_CTLS, 1418 MSR_IA32_VMX_TRUE_PROC, 0x401e172 }, 1419 { "MSR_IA32_VMX_PROCBASED_CTLS2", MSR_IA32_VMX_PROCBASED_CTLS2, 1420 MSR_IA32_VMX_PROCBASED_CTLS2, 0 }, 1421 { "MSR_IA32_VMX_EXIT_CTLS", MSR_IA32_VMX_EXIT_CTLS, 1422 MSR_IA32_VMX_TRUE_EXIT, 0x36dff }, 1423 { "MSR_IA32_VMX_ENTRY_CTLS", MSR_IA32_VMX_ENTRY_CTLS, 1424 MSR_IA32_VMX_TRUE_ENTRY, 0x11ff }, 1425 }; 1426 1427 static void test_vmx_caps(void) 1428 { 1429 u64 val, default1, fixed0, fixed1; 1430 union vmx_ctrl_msr ctrl, true_ctrl; 1431 unsigned int n; 1432 bool ok; 1433 1434 printf("\nTest suite: VMX capability reporting\n"); 1435 1436 report("MSR_IA32_VMX_BASIC", 1437 (basic.revision & (1ul << 31)) == 0 && 1438 basic.size > 0 && basic.size <= 4096 && 1439 (basic.type == 0 || basic.type == 6) && 1440 basic.reserved1 == 0 && basic.reserved2 == 0); 1441 1442 val = rdmsr(MSR_IA32_VMX_MISC); 1443 report("MSR_IA32_VMX_MISC", 1444 (!(ctrl_cpu_rev[1].clr & CPU_URG) || val & (1ul << 5)) && 1445 ((val >> 16) & 0x1ff) <= 256 && 1446 (val & 0xc0007e00) == 0); 1447 1448 for (n = 0; n < ARRAY_SIZE(vmx_ctl_msr); n++) { 1449 ctrl.val = rdmsr(vmx_ctl_msr[n].index); 1450 default1 = vmx_ctl_msr[n].default1; 1451 ok = (ctrl.set & default1) == default1; 1452 ok = ok && (ctrl.set & ~ctrl.clr) == 0; 1453 if (ok && basic.ctrl) { 1454 true_ctrl.val = rdmsr(vmx_ctl_msr[n].true_index); 1455 ok = ctrl.clr == true_ctrl.clr; 1456 ok = ok && ctrl.set == (true_ctrl.set | default1); 1457 } 1458 report("%s", ok, vmx_ctl_msr[n].name); 1459 } 1460 1461 fixed0 = rdmsr(MSR_IA32_VMX_CR0_FIXED0); 1462 fixed1 = rdmsr(MSR_IA32_VMX_CR0_FIXED1); 1463 report("MSR_IA32_VMX_IA32_VMX_CR0_FIXED0/1", 1464 ((fixed0 ^ fixed1) & ~fixed1) == 0); 1465 1466 fixed0 = rdmsr(MSR_IA32_VMX_CR4_FIXED0); 1467 fixed1 = rdmsr(MSR_IA32_VMX_CR4_FIXED1); 1468 report("MSR_IA32_VMX_IA32_VMX_CR4_FIXED0/1", 1469 ((fixed0 ^ fixed1) & ~fixed1) == 0); 1470 1471 val = rdmsr(MSR_IA32_VMX_VMCS_ENUM); 1472 report("MSR_IA32_VMX_VMCS_ENUM", 1473 (val & 0x3e) >= 0x2a && 1474 (val & 0xfffffffffffffc01Ull) == 0); 1475 1476 val = rdmsr(MSR_IA32_VMX_EPT_VPID_CAP); 1477 report("MSR_IA32_VMX_EPT_VPID_CAP", 1478 (val & 0xfffff07ef98cbebeUll) == 0); 1479 } 1480 1481 /* This function can only be called in guest */ 1482 static void __attribute__((__used__)) hypercall(u32 hypercall_no) 1483 { 1484 u64 val = 0; 1485 val = (hypercall_no & HYPERCALL_MASK) | HYPERCALL_BIT; 1486 hypercall_field = val; 1487 asm volatile("vmcall\n\t"); 1488 } 1489 1490 static bool is_hypercall(void) 1491 { 1492 ulong reason, hyper_bit; 1493 1494 reason = vmcs_read(EXI_REASON) & 0xff; 1495 hyper_bit = hypercall_field & HYPERCALL_BIT; 1496 if (reason == VMX_VMCALL && hyper_bit) 1497 return true; 1498 return false; 1499 } 1500 1501 static int handle_hypercall(void) 1502 { 1503 ulong hypercall_no; 1504 1505 hypercall_no = hypercall_field & HYPERCALL_MASK; 1506 hypercall_field = 0; 1507 switch (hypercall_no) { 1508 case HYPERCALL_VMEXIT: 1509 return VMX_TEST_VMEXIT; 1510 case HYPERCALL_VMABORT: 1511 return VMX_TEST_VMABORT; 1512 case HYPERCALL_VMSKIP: 1513 return VMX_TEST_VMSKIP; 1514 default: 1515 printf("ERROR : Invalid hypercall number : %ld\n", hypercall_no); 1516 } 1517 return VMX_TEST_EXIT; 1518 } 1519 1520 static void continue_abort(void) 1521 { 1522 assert(!in_guest); 1523 printf("Host was here when guest aborted:\n"); 1524 dump_stack(); 1525 longjmp(abort_target, 1); 1526 abort(); 1527 } 1528 1529 void __abort_test(void) 1530 { 1531 if (in_guest) 1532 hypercall(HYPERCALL_VMABORT); 1533 else 1534 longjmp(abort_target, 1); 1535 abort(); 1536 } 1537 1538 static void continue_skip(void) 1539 { 1540 assert(!in_guest); 1541 longjmp(abort_target, 1); 1542 abort(); 1543 } 1544 1545 void test_skip(const char *msg) 1546 { 1547 printf("%s skipping test: %s\n", in_guest ? "Guest" : "Host", msg); 1548 if (in_guest) 1549 hypercall(HYPERCALL_VMABORT); 1550 else 1551 longjmp(abort_target, 1); 1552 abort(); 1553 } 1554 1555 static int exit_handler(void) 1556 { 1557 int ret; 1558 1559 current->exits++; 1560 regs.rflags = vmcs_read(GUEST_RFLAGS); 1561 if (is_hypercall()) 1562 ret = handle_hypercall(); 1563 else 1564 ret = current->exit_handler(); 1565 vmcs_write(GUEST_RFLAGS, regs.rflags); 1566 1567 return ret; 1568 } 1569 1570 /* 1571 * Called if vmlaunch or vmresume fails. 1572 * @early - failure due to "VMX controls and host-state area" (26.2) 1573 * @vmlaunch - was this a vmlaunch or vmresume 1574 * @rflags - host rflags 1575 */ 1576 static int 1577 entry_failure_handler(struct vmentry_failure *failure) 1578 { 1579 if (current->entry_failure_handler) 1580 return current->entry_failure_handler(failure); 1581 else 1582 return VMX_TEST_EXIT; 1583 } 1584 1585 /* 1586 * Tries to enter the guest. Returns true iff entry succeeded. Otherwise, 1587 * populates @failure. 1588 */ 1589 static bool vmx_enter_guest(struct vmentry_failure *failure) 1590 { 1591 failure->early = 0; 1592 1593 in_guest = 1; 1594 asm volatile ( 1595 "mov %[HOST_RSP], %%rdi\n\t" 1596 "vmwrite %%rsp, %%rdi\n\t" 1597 LOAD_GPR_C 1598 "cmpb $0, %[launched]\n\t" 1599 "jne 1f\n\t" 1600 "vmlaunch\n\t" 1601 "jmp 2f\n\t" 1602 "1: " 1603 "vmresume\n\t" 1604 "2: " 1605 SAVE_GPR_C 1606 "pushf\n\t" 1607 "pop %%rdi\n\t" 1608 "mov %%rdi, %[failure_flags]\n\t" 1609 "movl $1, %[failure_early]\n\t" 1610 "jmp 3f\n\t" 1611 "vmx_return:\n\t" 1612 SAVE_GPR_C 1613 "3: \n\t" 1614 : [failure_early]"+m"(failure->early), 1615 [failure_flags]"=m"(failure->flags) 1616 : [launched]"m"(launched), [HOST_RSP]"i"(HOST_RSP) 1617 : "rdi", "memory", "cc" 1618 ); 1619 in_guest = 0; 1620 1621 failure->vmlaunch = !launched; 1622 failure->instr = launched ? "vmresume" : "vmlaunch"; 1623 1624 return !failure->early && !(vmcs_read(EXI_REASON) & VMX_ENTRY_FAILURE); 1625 } 1626 1627 static int vmx_run(void) 1628 { 1629 while (1) { 1630 u32 ret; 1631 bool entered; 1632 struct vmentry_failure failure; 1633 1634 entered = vmx_enter_guest(&failure); 1635 1636 if (entered) { 1637 /* 1638 * VMCS isn't in "launched" state if there's been any 1639 * entry failure (early or otherwise). 1640 */ 1641 launched = 1; 1642 ret = exit_handler(); 1643 } else { 1644 ret = entry_failure_handler(&failure); 1645 } 1646 1647 switch (ret) { 1648 case VMX_TEST_RESUME: 1649 continue; 1650 case VMX_TEST_VMEXIT: 1651 guest_finished = 1; 1652 return 0; 1653 case VMX_TEST_EXIT: 1654 break; 1655 default: 1656 printf("ERROR : Invalid %s_handler return val %d.\n", 1657 entered ? "exit" : "entry_failure", 1658 ret); 1659 break; 1660 } 1661 1662 if (entered) 1663 print_vmexit_info(); 1664 else 1665 print_vmentry_failure_info(&failure); 1666 abort(); 1667 } 1668 } 1669 1670 static void run_teardown_step(struct test_teardown_step *step) 1671 { 1672 step->func(step->data); 1673 } 1674 1675 static int test_run(struct vmx_test *test) 1676 { 1677 int r; 1678 1679 /* Validate V2 interface. */ 1680 if (test->v2) { 1681 int ret = 0; 1682 if (test->init || test->guest_main || test->exit_handler || 1683 test->syscall_handler) { 1684 report("V2 test cannot specify V1 callbacks.", 0); 1685 ret = 1; 1686 } 1687 if (ret) 1688 return ret; 1689 } 1690 1691 if (test->name == NULL) 1692 test->name = "(no name)"; 1693 if (vmx_on()) { 1694 printf("%s : vmxon failed.\n", __func__); 1695 return 1; 1696 } 1697 1698 init_vmcs(&(test->vmcs)); 1699 /* Directly call test->init is ok here, init_vmcs has done 1700 vmcs init, vmclear and vmptrld*/ 1701 if (test->init && test->init(test->vmcs) != VMX_TEST_START) 1702 goto out; 1703 teardown_count = 0; 1704 v2_guest_main = NULL; 1705 test->exits = 0; 1706 current = test; 1707 regs = test->guest_regs; 1708 vmcs_write(GUEST_RFLAGS, regs.rflags | 0x2); 1709 launched = 0; 1710 guest_finished = 0; 1711 printf("\nTest suite: %s\n", test->name); 1712 1713 r = setjmp(abort_target); 1714 if (r) { 1715 assert(!in_guest); 1716 goto out; 1717 } 1718 1719 1720 if (test->v2) 1721 test->v2(); 1722 else 1723 vmx_run(); 1724 1725 while (teardown_count > 0) 1726 run_teardown_step(&teardown_steps[--teardown_count]); 1727 1728 if (launched && !guest_finished) 1729 report("Guest didn't run to completion.", 0); 1730 1731 out: 1732 if (vmx_off()) { 1733 printf("%s : vmxoff failed.\n", __func__); 1734 return 1; 1735 } 1736 return 0; 1737 } 1738 1739 /* 1740 * Add a teardown step. Executed after the test's main function returns. 1741 * Teardown steps executed in reverse order. 1742 */ 1743 void test_add_teardown(test_teardown_func func, void *data) 1744 { 1745 struct test_teardown_step *step; 1746 1747 TEST_ASSERT_MSG(teardown_count < MAX_TEST_TEARDOWN_STEPS, 1748 "There are already %d teardown steps.", 1749 teardown_count); 1750 step = &teardown_steps[teardown_count++]; 1751 step->func = func; 1752 step->data = data; 1753 } 1754 1755 /* 1756 * Set the target of the first enter_guest call. Can only be called once per 1757 * test. Must be called before first enter_guest call. 1758 */ 1759 void test_set_guest(test_guest_func func) 1760 { 1761 assert(current->v2); 1762 TEST_ASSERT_MSG(!v2_guest_main, "Already set guest func."); 1763 v2_guest_main = func; 1764 } 1765 1766 static void check_for_guest_termination(void) 1767 { 1768 if (is_hypercall()) { 1769 int ret; 1770 1771 ret = handle_hypercall(); 1772 switch (ret) { 1773 case VMX_TEST_VMEXIT: 1774 guest_finished = 1; 1775 break; 1776 case VMX_TEST_VMABORT: 1777 continue_abort(); 1778 break; 1779 case VMX_TEST_VMSKIP: 1780 continue_skip(); 1781 break; 1782 default: 1783 printf("ERROR : Invalid handle_hypercall return %d.\n", 1784 ret); 1785 abort(); 1786 } 1787 } 1788 } 1789 1790 /* 1791 * Enters the guest (or launches it for the first time). Error to call once the 1792 * guest has returned (i.e., run past the end of its guest() function). Also 1793 * aborts if guest entry fails. 1794 */ 1795 void enter_guest(void) 1796 { 1797 struct vmentry_failure failure; 1798 1799 TEST_ASSERT_MSG(v2_guest_main, 1800 "Never called test_set_guest_func!"); 1801 1802 TEST_ASSERT_MSG(!guest_finished, 1803 "Called enter_guest() after guest returned."); 1804 1805 if (!vmx_enter_guest(&failure)) { 1806 print_vmentry_failure_info(&failure); 1807 abort(); 1808 } 1809 1810 launched = 1; 1811 1812 check_for_guest_termination(); 1813 } 1814 1815 void enter_guest_with_bad_controls(void) 1816 { 1817 struct vmentry_failure failure; 1818 bool ok; 1819 1820 TEST_ASSERT_MSG(v2_guest_main, 1821 "Never called test_set_guest_func!"); 1822 1823 TEST_ASSERT_MSG(!guest_finished, 1824 "Called enter_guest() after guest returned."); 1825 1826 ok = vmx_enter_guest(&failure); 1827 report_xfail("vmlaunch fails, as expected", 1828 true, ok); 1829 report("failure occurred early", failure.early); 1830 report("FLAGS set correctly", 1831 (failure.flags & VMX_ENTRY_FLAGS) == X86_EFLAGS_ZF); 1832 report("VM-Inst Error # is %d (VM entry with invalid control field(s))", 1833 vmcs_read(VMX_INST_ERROR) == VMXERR_ENTRY_INVALID_CONTROL_FIELD, 1834 VMXERR_ENTRY_INVALID_CONTROL_FIELD); 1835 1836 /* 1837 * This if statement shouldn't fire, as the entire premise of this 1838 * function is that VM entry is expected to fail, rather than succeed 1839 * and execute to termination. However, if the VM entry does 1840 * unexpectedly succeed, it's nice to check whether the guest has 1841 * terminated, to reduce the number of error messages. 1842 */ 1843 if (ok) 1844 check_for_guest_termination(); 1845 } 1846 1847 extern struct vmx_test vmx_tests[]; 1848 1849 static bool 1850 test_wanted(const char *name, const char *filters[], int filter_count) 1851 { 1852 int i; 1853 bool positive = false; 1854 bool match = false; 1855 char clean_name[strlen(name) + 1]; 1856 char *c; 1857 const char *n; 1858 1859 /* Replace spaces with underscores. */ 1860 n = name; 1861 c = &clean_name[0]; 1862 do *c++ = (*n == ' ') ? '_' : *n; 1863 while (*n++); 1864 1865 for (i = 0; i < filter_count; i++) { 1866 const char *filter = filters[i]; 1867 1868 if (filter[0] == '-') { 1869 if (simple_glob(clean_name, filter + 1)) 1870 return false; 1871 } else { 1872 positive = true; 1873 match |= simple_glob(clean_name, filter); 1874 } 1875 } 1876 1877 if (!positive || match) { 1878 matched++; 1879 return true; 1880 } else { 1881 return false; 1882 } 1883 } 1884 1885 int main(int argc, const char *argv[]) 1886 { 1887 int i = 0; 1888 1889 setup_vm(); 1890 smp_init(); 1891 hypercall_field = 0; 1892 1893 /* We want xAPIC mode to test MMIO passthrough from L1 (us) to L2. */ 1894 reset_apic(); 1895 1896 argv++; 1897 argc--; 1898 1899 if (!(cpuid(1).c & (1 << 5))) { 1900 printf("WARNING: vmx not supported, add '-cpu host'\n"); 1901 goto exit; 1902 } 1903 init_vmx(); 1904 if (test_wanted("test_vmx_feature_control", argv, argc)) { 1905 /* Sets MSR_IA32_FEATURE_CONTROL to 0x5 */ 1906 if (test_vmx_feature_control() != 0) 1907 goto exit; 1908 } else { 1909 if ((rdmsr(MSR_IA32_FEATURE_CONTROL) & 0x5) != 0x5) 1910 wrmsr(MSR_IA32_FEATURE_CONTROL, 0x5); 1911 } 1912 1913 if (test_wanted("test_vmxon", argv, argc)) { 1914 /* Enables VMX */ 1915 if (test_vmxon() != 0) 1916 goto exit; 1917 } else { 1918 if (vmx_on()) { 1919 report("vmxon", 0); 1920 goto exit; 1921 } 1922 } 1923 1924 if (test_wanted("test_vmptrld", argv, argc)) 1925 test_vmptrld(); 1926 if (test_wanted("test_vmclear", argv, argc)) 1927 test_vmclear(); 1928 if (test_wanted("test_vmptrst", argv, argc)) 1929 test_vmptrst(); 1930 if (test_wanted("test_vmwrite_vmread", argv, argc)) 1931 test_vmwrite_vmread(); 1932 if (test_wanted("test_vmcs_high", argv, argc)) 1933 test_vmcs_high(); 1934 if (test_wanted("test_vmcs_lifecycle", argv, argc)) 1935 test_vmcs_lifecycle(); 1936 if (test_wanted("test_vmx_caps", argv, argc)) 1937 test_vmx_caps(); 1938 1939 /* Balance vmxon from test_vmxon. */ 1940 vmx_off(); 1941 1942 for (; vmx_tests[i].name != NULL; i++) { 1943 if (!test_wanted(vmx_tests[i].name, argv, argc)) 1944 continue; 1945 if (test_run(&vmx_tests[i])) 1946 goto exit; 1947 } 1948 1949 if (!matched) 1950 report("command line didn't match any tests!", matched); 1951 1952 exit: 1953 return report_summary(); 1954 } 1955