1 /* 2 * All test cases of nested virtualization should be in this file 3 * 4 * Author : Arthur Chunqi Li <yzt356@gmail.com> 5 */ 6 #include "vmx.h" 7 #include "msr.h" 8 #include "processor.h" 9 #include "vm.h" 10 #include "fwcfg.h" 11 #include "isr.h" 12 #include "desc.h" 13 #include "apic.h" 14 #include "types.h" 15 16 u64 ia32_pat; 17 u64 ia32_efer; 18 void *io_bitmap_a, *io_bitmap_b; 19 u16 ioport; 20 21 unsigned long *pml4; 22 u64 eptp; 23 void *data_page1, *data_page2; 24 25 static inline void vmcall() 26 { 27 asm volatile("vmcall"); 28 } 29 30 void basic_guest_main() 31 { 32 } 33 34 int basic_exit_handler() 35 { 36 report("Basic VMX test", 0); 37 print_vmexit_info(); 38 return VMX_TEST_EXIT; 39 } 40 41 void vmenter_main() 42 { 43 u64 rax; 44 u64 rsp, resume_rsp; 45 46 report("test vmlaunch", 1); 47 48 asm volatile( 49 "mov %%rsp, %0\n\t" 50 "mov %3, %%rax\n\t" 51 "vmcall\n\t" 52 "mov %%rax, %1\n\t" 53 "mov %%rsp, %2\n\t" 54 : "=r"(rsp), "=r"(rax), "=r"(resume_rsp) 55 : "g"(0xABCD)); 56 report("test vmresume", (rax == 0xFFFF) && (rsp == resume_rsp)); 57 } 58 59 int vmenter_exit_handler() 60 { 61 u64 guest_rip; 62 ulong reason; 63 64 guest_rip = vmcs_read(GUEST_RIP); 65 reason = vmcs_read(EXI_REASON) & 0xff; 66 switch (reason) { 67 case VMX_VMCALL: 68 if (regs.rax != 0xABCD) { 69 report("test vmresume", 0); 70 return VMX_TEST_VMEXIT; 71 } 72 regs.rax = 0xFFFF; 73 vmcs_write(GUEST_RIP, guest_rip + 3); 74 return VMX_TEST_RESUME; 75 default: 76 report("test vmresume", 0); 77 print_vmexit_info(); 78 } 79 return VMX_TEST_VMEXIT; 80 } 81 82 u32 preempt_scale; 83 volatile unsigned long long tsc_val; 84 volatile u32 preempt_val; 85 u64 saved_rip; 86 87 int preemption_timer_init() 88 { 89 if (!(ctrl_pin_rev.clr & PIN_PREEMPT)) { 90 printf("\tPreemption timer is not supported\n"); 91 return VMX_TEST_EXIT; 92 } 93 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) | PIN_PREEMPT); 94 preempt_val = 10000000; 95 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 96 preempt_scale = rdmsr(MSR_IA32_VMX_MISC) & 0x1F; 97 98 if (!(ctrl_exit_rev.clr & EXI_SAVE_PREEMPT)) 99 printf("\tSave preemption value is not supported\n"); 100 101 return VMX_TEST_START; 102 } 103 104 void preemption_timer_main() 105 { 106 tsc_val = rdtsc(); 107 if (ctrl_exit_rev.clr & EXI_SAVE_PREEMPT) { 108 vmx_set_test_stage(0); 109 vmcall(); 110 if (vmx_get_test_stage() == 1) 111 vmcall(); 112 } 113 vmx_set_test_stage(1); 114 while (vmx_get_test_stage() == 1) { 115 if (((rdtsc() - tsc_val) >> preempt_scale) 116 > 10 * preempt_val) { 117 vmx_set_test_stage(2); 118 vmcall(); 119 } 120 } 121 tsc_val = rdtsc(); 122 asm volatile ("hlt"); 123 vmcall(); 124 vmx_set_test_stage(5); 125 vmcall(); 126 } 127 128 int preemption_timer_exit_handler() 129 { 130 bool guest_halted; 131 u64 guest_rip; 132 ulong reason; 133 u32 insn_len; 134 u32 ctrl_exit; 135 136 guest_rip = vmcs_read(GUEST_RIP); 137 reason = vmcs_read(EXI_REASON) & 0xff; 138 insn_len = vmcs_read(EXI_INST_LEN); 139 switch (reason) { 140 case VMX_PREEMPT: 141 switch (vmx_get_test_stage()) { 142 case 1: 143 case 2: 144 report("busy-wait for preemption timer", 145 ((rdtsc() - tsc_val) >> preempt_scale) >= 146 preempt_val); 147 vmx_set_test_stage(3); 148 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 149 return VMX_TEST_RESUME; 150 case 3: 151 guest_halted = 152 (vmcs_read(GUEST_ACTV_STATE) == ACTV_HLT); 153 report("preemption timer during hlt", 154 ((rdtsc() - tsc_val) >> preempt_scale) >= 155 preempt_val && guest_halted); 156 vmx_set_test_stage(4); 157 vmcs_write(PIN_CONTROLS, 158 vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT); 159 vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE); 160 return VMX_TEST_RESUME; 161 case 4: 162 report("preemption timer with 0 value", 163 saved_rip == guest_rip); 164 break; 165 default: 166 printf("Invalid stage.\n"); 167 print_vmexit_info(); 168 break; 169 } 170 break; 171 case VMX_VMCALL: 172 vmcs_write(GUEST_RIP, guest_rip + insn_len); 173 switch (vmx_get_test_stage()) { 174 case 0: 175 report("Keep preemption value", 176 vmcs_read(PREEMPT_TIMER_VALUE) == preempt_val); 177 vmx_set_test_stage(1); 178 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 179 ctrl_exit = (vmcs_read(EXI_CONTROLS) | 180 EXI_SAVE_PREEMPT) & ctrl_exit_rev.clr; 181 vmcs_write(EXI_CONTROLS, ctrl_exit); 182 return VMX_TEST_RESUME; 183 case 1: 184 report("Save preemption value", 185 vmcs_read(PREEMPT_TIMER_VALUE) < preempt_val); 186 return VMX_TEST_RESUME; 187 case 2: 188 report("busy-wait for preemption timer", 0); 189 vmx_set_test_stage(3); 190 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 191 return VMX_TEST_RESUME; 192 case 3: 193 report("preemption timer during hlt", 0); 194 vmx_set_test_stage(4); 195 /* fall through */ 196 case 4: 197 vmcs_write(PIN_CONTROLS, 198 vmcs_read(PIN_CONTROLS) | PIN_PREEMPT); 199 vmcs_write(PREEMPT_TIMER_VALUE, 0); 200 saved_rip = guest_rip + insn_len; 201 return VMX_TEST_RESUME; 202 case 5: 203 report("preemption timer with 0 value (vmcall stage 5)", 0); 204 break; 205 default: 206 // Should not reach here 207 printf("ERROR : unexpected stage, %d\n", 208 vmx_get_test_stage()); 209 print_vmexit_info(); 210 return VMX_TEST_VMEXIT; 211 } 212 break; 213 default: 214 printf("Unknown exit reason, %ld\n", reason); 215 print_vmexit_info(); 216 } 217 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT); 218 return VMX_TEST_VMEXIT; 219 } 220 221 void msr_bmp_init() 222 { 223 void *msr_bitmap; 224 u32 ctrl_cpu0; 225 226 msr_bitmap = alloc_page(); 227 memset(msr_bitmap, 0x0, PAGE_SIZE); 228 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 229 ctrl_cpu0 |= CPU_MSR_BITMAP; 230 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 231 vmcs_write(MSR_BITMAP, (u64)msr_bitmap); 232 } 233 234 static int test_ctrl_pat_init() 235 { 236 u64 ctrl_ent; 237 u64 ctrl_exi; 238 239 msr_bmp_init(); 240 if (!(ctrl_exit_rev.clr & EXI_SAVE_PAT) && 241 !(ctrl_exit_rev.clr & EXI_LOAD_PAT) && 242 !(ctrl_enter_rev.clr & ENT_LOAD_PAT)) { 243 printf("\tSave/load PAT is not supported\n"); 244 return 1; 245 } 246 247 ctrl_ent = vmcs_read(ENT_CONTROLS); 248 ctrl_exi = vmcs_read(EXI_CONTROLS); 249 ctrl_ent |= ctrl_enter_rev.clr & ENT_LOAD_PAT; 250 ctrl_exi |= ctrl_exit_rev.clr & (EXI_SAVE_PAT | EXI_LOAD_PAT); 251 vmcs_write(ENT_CONTROLS, ctrl_ent); 252 vmcs_write(EXI_CONTROLS, ctrl_exi); 253 ia32_pat = rdmsr(MSR_IA32_CR_PAT); 254 vmcs_write(GUEST_PAT, 0x0); 255 vmcs_write(HOST_PAT, ia32_pat); 256 return VMX_TEST_START; 257 } 258 259 static void test_ctrl_pat_main() 260 { 261 u64 guest_ia32_pat; 262 263 guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT); 264 if (!(ctrl_enter_rev.clr & ENT_LOAD_PAT)) 265 printf("\tENT_LOAD_PAT is not supported.\n"); 266 else { 267 if (guest_ia32_pat != 0) { 268 report("Entry load PAT", 0); 269 return; 270 } 271 } 272 wrmsr(MSR_IA32_CR_PAT, 0x6); 273 vmcall(); 274 guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT); 275 if (ctrl_enter_rev.clr & ENT_LOAD_PAT) 276 report("Entry load PAT", guest_ia32_pat == ia32_pat); 277 } 278 279 static int test_ctrl_pat_exit_handler() 280 { 281 u64 guest_rip; 282 ulong reason; 283 u64 guest_pat; 284 285 guest_rip = vmcs_read(GUEST_RIP); 286 reason = vmcs_read(EXI_REASON) & 0xff; 287 switch (reason) { 288 case VMX_VMCALL: 289 guest_pat = vmcs_read(GUEST_PAT); 290 if (!(ctrl_exit_rev.clr & EXI_SAVE_PAT)) { 291 printf("\tEXI_SAVE_PAT is not supported\n"); 292 vmcs_write(GUEST_PAT, 0x6); 293 } else { 294 report("Exit save PAT", guest_pat == 0x6); 295 } 296 if (!(ctrl_exit_rev.clr & EXI_LOAD_PAT)) 297 printf("\tEXI_LOAD_PAT is not supported\n"); 298 else 299 report("Exit load PAT", rdmsr(MSR_IA32_CR_PAT) == ia32_pat); 300 vmcs_write(GUEST_PAT, ia32_pat); 301 vmcs_write(GUEST_RIP, guest_rip + 3); 302 return VMX_TEST_RESUME; 303 default: 304 printf("ERROR : Undefined exit reason, reason = %ld.\n", reason); 305 break; 306 } 307 return VMX_TEST_VMEXIT; 308 } 309 310 static int test_ctrl_efer_init() 311 { 312 u64 ctrl_ent; 313 u64 ctrl_exi; 314 315 msr_bmp_init(); 316 ctrl_ent = vmcs_read(ENT_CONTROLS) | ENT_LOAD_EFER; 317 ctrl_exi = vmcs_read(EXI_CONTROLS) | EXI_SAVE_EFER | EXI_LOAD_EFER; 318 vmcs_write(ENT_CONTROLS, ctrl_ent & ctrl_enter_rev.clr); 319 vmcs_write(EXI_CONTROLS, ctrl_exi & ctrl_exit_rev.clr); 320 ia32_efer = rdmsr(MSR_EFER); 321 vmcs_write(GUEST_EFER, ia32_efer ^ EFER_NX); 322 vmcs_write(HOST_EFER, ia32_efer ^ EFER_NX); 323 return VMX_TEST_START; 324 } 325 326 static void test_ctrl_efer_main() 327 { 328 u64 guest_ia32_efer; 329 330 guest_ia32_efer = rdmsr(MSR_EFER); 331 if (!(ctrl_enter_rev.clr & ENT_LOAD_EFER)) 332 printf("\tENT_LOAD_EFER is not supported.\n"); 333 else { 334 if (guest_ia32_efer != (ia32_efer ^ EFER_NX)) { 335 report("Entry load EFER", 0); 336 return; 337 } 338 } 339 wrmsr(MSR_EFER, ia32_efer); 340 vmcall(); 341 guest_ia32_efer = rdmsr(MSR_EFER); 342 if (ctrl_enter_rev.clr & ENT_LOAD_EFER) 343 report("Entry load EFER", guest_ia32_efer == ia32_efer); 344 } 345 346 static int test_ctrl_efer_exit_handler() 347 { 348 u64 guest_rip; 349 ulong reason; 350 u64 guest_efer; 351 352 guest_rip = vmcs_read(GUEST_RIP); 353 reason = vmcs_read(EXI_REASON) & 0xff; 354 switch (reason) { 355 case VMX_VMCALL: 356 guest_efer = vmcs_read(GUEST_EFER); 357 if (!(ctrl_exit_rev.clr & EXI_SAVE_EFER)) { 358 printf("\tEXI_SAVE_EFER is not supported\n"); 359 vmcs_write(GUEST_EFER, ia32_efer); 360 } else { 361 report("Exit save EFER", guest_efer == ia32_efer); 362 } 363 if (!(ctrl_exit_rev.clr & EXI_LOAD_EFER)) { 364 printf("\tEXI_LOAD_EFER is not supported\n"); 365 wrmsr(MSR_EFER, ia32_efer ^ EFER_NX); 366 } else { 367 report("Exit load EFER", rdmsr(MSR_EFER) == (ia32_efer ^ EFER_NX)); 368 } 369 vmcs_write(GUEST_PAT, ia32_efer); 370 vmcs_write(GUEST_RIP, guest_rip + 3); 371 return VMX_TEST_RESUME; 372 default: 373 printf("ERROR : Undefined exit reason, reason = %ld.\n", reason); 374 break; 375 } 376 return VMX_TEST_VMEXIT; 377 } 378 379 u32 guest_cr0, guest_cr4; 380 381 static void cr_shadowing_main() 382 { 383 u32 cr0, cr4, tmp; 384 385 // Test read through 386 vmx_set_test_stage(0); 387 guest_cr0 = read_cr0(); 388 if (vmx_get_test_stage() == 1) 389 report("Read through CR0", 0); 390 else 391 vmcall(); 392 vmx_set_test_stage(1); 393 guest_cr4 = read_cr4(); 394 if (vmx_get_test_stage() == 2) 395 report("Read through CR4", 0); 396 else 397 vmcall(); 398 // Test write through 399 guest_cr0 = guest_cr0 ^ (X86_CR0_TS | X86_CR0_MP); 400 guest_cr4 = guest_cr4 ^ (X86_CR4_TSD | X86_CR4_DE); 401 vmx_set_test_stage(2); 402 write_cr0(guest_cr0); 403 if (vmx_get_test_stage() == 3) 404 report("Write throuth CR0", 0); 405 else 406 vmcall(); 407 vmx_set_test_stage(3); 408 write_cr4(guest_cr4); 409 if (vmx_get_test_stage() == 4) 410 report("Write through CR4", 0); 411 else 412 vmcall(); 413 // Test read shadow 414 vmx_set_test_stage(4); 415 vmcall(); 416 cr0 = read_cr0(); 417 if (vmx_get_test_stage() != 5) 418 report("Read shadowing CR0", cr0 == guest_cr0); 419 vmx_set_test_stage(5); 420 cr4 = read_cr4(); 421 if (vmx_get_test_stage() != 6) 422 report("Read shadowing CR4", cr4 == guest_cr4); 423 // Test write shadow (same value with shadow) 424 vmx_set_test_stage(6); 425 write_cr0(guest_cr0); 426 if (vmx_get_test_stage() == 7) 427 report("Write shadowing CR0 (same value with shadow)", 0); 428 else 429 vmcall(); 430 vmx_set_test_stage(7); 431 write_cr4(guest_cr4); 432 if (vmx_get_test_stage() == 8) 433 report("Write shadowing CR4 (same value with shadow)", 0); 434 else 435 vmcall(); 436 // Test write shadow (different value) 437 vmx_set_test_stage(8); 438 tmp = guest_cr0 ^ X86_CR0_TS; 439 asm volatile("mov %0, %%rsi\n\t" 440 "mov %%rsi, %%cr0\n\t" 441 ::"m"(tmp) 442 :"rsi", "memory", "cc"); 443 report("Write shadowing different X86_CR0_TS", vmx_get_test_stage() == 9); 444 vmx_set_test_stage(9); 445 tmp = guest_cr0 ^ X86_CR0_MP; 446 asm volatile("mov %0, %%rsi\n\t" 447 "mov %%rsi, %%cr0\n\t" 448 ::"m"(tmp) 449 :"rsi", "memory", "cc"); 450 report("Write shadowing different X86_CR0_MP", vmx_get_test_stage() == 10); 451 vmx_set_test_stage(10); 452 tmp = guest_cr4 ^ X86_CR4_TSD; 453 asm volatile("mov %0, %%rsi\n\t" 454 "mov %%rsi, %%cr4\n\t" 455 ::"m"(tmp) 456 :"rsi", "memory", "cc"); 457 report("Write shadowing different X86_CR4_TSD", vmx_get_test_stage() == 11); 458 vmx_set_test_stage(11); 459 tmp = guest_cr4 ^ X86_CR4_DE; 460 asm volatile("mov %0, %%rsi\n\t" 461 "mov %%rsi, %%cr4\n\t" 462 ::"m"(tmp) 463 :"rsi", "memory", "cc"); 464 report("Write shadowing different X86_CR4_DE", vmx_get_test_stage() == 12); 465 } 466 467 static int cr_shadowing_exit_handler() 468 { 469 u64 guest_rip; 470 ulong reason; 471 u32 insn_len; 472 u32 exit_qual; 473 474 guest_rip = vmcs_read(GUEST_RIP); 475 reason = vmcs_read(EXI_REASON) & 0xff; 476 insn_len = vmcs_read(EXI_INST_LEN); 477 exit_qual = vmcs_read(EXI_QUALIFICATION); 478 switch (reason) { 479 case VMX_VMCALL: 480 switch (vmx_get_test_stage()) { 481 case 0: 482 report("Read through CR0", guest_cr0 == vmcs_read(GUEST_CR0)); 483 break; 484 case 1: 485 report("Read through CR4", guest_cr4 == vmcs_read(GUEST_CR4)); 486 break; 487 case 2: 488 report("Write through CR0", guest_cr0 == vmcs_read(GUEST_CR0)); 489 break; 490 case 3: 491 report("Write through CR4", guest_cr4 == vmcs_read(GUEST_CR4)); 492 break; 493 case 4: 494 guest_cr0 = vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP); 495 guest_cr4 = vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE); 496 vmcs_write(CR0_MASK, X86_CR0_TS | X86_CR0_MP); 497 vmcs_write(CR0_READ_SHADOW, guest_cr0 & (X86_CR0_TS | X86_CR0_MP)); 498 vmcs_write(CR4_MASK, X86_CR4_TSD | X86_CR4_DE); 499 vmcs_write(CR4_READ_SHADOW, guest_cr4 & (X86_CR4_TSD | X86_CR4_DE)); 500 break; 501 case 6: 502 report("Write shadowing CR0 (same value)", 503 guest_cr0 == (vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP))); 504 break; 505 case 7: 506 report("Write shadowing CR4 (same value)", 507 guest_cr4 == (vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE))); 508 break; 509 default: 510 // Should not reach here 511 printf("ERROR : unexpected stage, %d\n", 512 vmx_get_test_stage()); 513 print_vmexit_info(); 514 return VMX_TEST_VMEXIT; 515 } 516 vmcs_write(GUEST_RIP, guest_rip + insn_len); 517 return VMX_TEST_RESUME; 518 case VMX_CR: 519 switch (vmx_get_test_stage()) { 520 case 4: 521 report("Read shadowing CR0", 0); 522 vmx_inc_test_stage(); 523 break; 524 case 5: 525 report("Read shadowing CR4", 0); 526 vmx_inc_test_stage(); 527 break; 528 case 6: 529 report("Write shadowing CR0 (same value)", 0); 530 vmx_inc_test_stage(); 531 break; 532 case 7: 533 report("Write shadowing CR4 (same value)", 0); 534 vmx_inc_test_stage(); 535 break; 536 case 8: 537 case 9: 538 // 0x600 encodes "mov %esi, %cr0" 539 if (exit_qual == 0x600) 540 vmx_inc_test_stage(); 541 break; 542 case 10: 543 case 11: 544 // 0x604 encodes "mov %esi, %cr4" 545 if (exit_qual == 0x604) 546 vmx_inc_test_stage(); 547 break; 548 default: 549 // Should not reach here 550 printf("ERROR : unexpected stage, %d\n", 551 vmx_get_test_stage()); 552 print_vmexit_info(); 553 return VMX_TEST_VMEXIT; 554 } 555 vmcs_write(GUEST_RIP, guest_rip + insn_len); 556 return VMX_TEST_RESUME; 557 default: 558 printf("Unknown exit reason, %ld\n", reason); 559 print_vmexit_info(); 560 } 561 return VMX_TEST_VMEXIT; 562 } 563 564 static int iobmp_init() 565 { 566 u32 ctrl_cpu0; 567 568 io_bitmap_a = alloc_page(); 569 io_bitmap_b = alloc_page(); 570 memset(io_bitmap_a, 0x0, PAGE_SIZE); 571 memset(io_bitmap_b, 0x0, PAGE_SIZE); 572 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 573 ctrl_cpu0 |= CPU_IO_BITMAP; 574 ctrl_cpu0 &= (~CPU_IO); 575 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 576 vmcs_write(IO_BITMAP_A, (u64)io_bitmap_a); 577 vmcs_write(IO_BITMAP_B, (u64)io_bitmap_b); 578 return VMX_TEST_START; 579 } 580 581 static void iobmp_main() 582 { 583 // stage 0, test IO pass 584 vmx_set_test_stage(0); 585 inb(0x5000); 586 outb(0x0, 0x5000); 587 report("I/O bitmap - I/O pass", vmx_get_test_stage() == 0); 588 // test IO width, in/out 589 ((u8 *)io_bitmap_a)[0] = 0xFF; 590 vmx_set_test_stage(2); 591 inb(0x0); 592 report("I/O bitmap - trap in", vmx_get_test_stage() == 3); 593 vmx_set_test_stage(3); 594 outw(0x0, 0x0); 595 report("I/O bitmap - trap out", vmx_get_test_stage() == 4); 596 vmx_set_test_stage(4); 597 inl(0x0); 598 report("I/O bitmap - I/O width, long", vmx_get_test_stage() == 5); 599 // test low/high IO port 600 vmx_set_test_stage(5); 601 ((u8 *)io_bitmap_a)[0x5000 / 8] = (1 << (0x5000 % 8)); 602 inb(0x5000); 603 report("I/O bitmap - I/O port, low part", vmx_get_test_stage() == 6); 604 vmx_set_test_stage(6); 605 ((u8 *)io_bitmap_b)[0x1000 / 8] = (1 << (0x1000 % 8)); 606 inb(0x9000); 607 report("I/O bitmap - I/O port, high part", vmx_get_test_stage() == 7); 608 // test partial pass 609 vmx_set_test_stage(7); 610 inl(0x4FFF); 611 report("I/O bitmap - partial pass", vmx_get_test_stage() == 8); 612 // test overrun 613 vmx_set_test_stage(8); 614 memset(io_bitmap_a, 0x0, PAGE_SIZE); 615 memset(io_bitmap_b, 0x0, PAGE_SIZE); 616 inl(0xFFFF); 617 report("I/O bitmap - overrun", vmx_get_test_stage() == 9); 618 vmx_set_test_stage(9); 619 vmcall(); 620 outb(0x0, 0x0); 621 report("I/O bitmap - ignore unconditional exiting", 622 vmx_get_test_stage() == 9); 623 vmx_set_test_stage(10); 624 vmcall(); 625 outb(0x0, 0x0); 626 report("I/O bitmap - unconditional exiting", 627 vmx_get_test_stage() == 11); 628 } 629 630 static int iobmp_exit_handler() 631 { 632 u64 guest_rip; 633 ulong reason, exit_qual; 634 u32 insn_len, ctrl_cpu0; 635 636 guest_rip = vmcs_read(GUEST_RIP); 637 reason = vmcs_read(EXI_REASON) & 0xff; 638 exit_qual = vmcs_read(EXI_QUALIFICATION); 639 insn_len = vmcs_read(EXI_INST_LEN); 640 switch (reason) { 641 case VMX_IO: 642 switch (vmx_get_test_stage()) { 643 case 0: 644 case 1: 645 vmx_inc_test_stage(); 646 break; 647 case 2: 648 report("I/O bitmap - I/O width, byte", 649 (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_BYTE); 650 report("I/O bitmap - I/O direction, in", exit_qual & VMX_IO_IN); 651 vmx_inc_test_stage(); 652 break; 653 case 3: 654 report("I/O bitmap - I/O width, word", 655 (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_WORD); 656 report("I/O bitmap - I/O direction, out", 657 !(exit_qual & VMX_IO_IN)); 658 vmx_inc_test_stage(); 659 break; 660 case 4: 661 report("I/O bitmap - I/O width, long", 662 (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_LONG); 663 vmx_inc_test_stage(); 664 break; 665 case 5: 666 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x5000) 667 vmx_inc_test_stage(); 668 break; 669 case 6: 670 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x9000) 671 vmx_inc_test_stage(); 672 break; 673 case 7: 674 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x4FFF) 675 vmx_inc_test_stage(); 676 break; 677 case 8: 678 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0xFFFF) 679 vmx_inc_test_stage(); 680 break; 681 case 9: 682 case 10: 683 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 684 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0 & ~CPU_IO); 685 vmx_inc_test_stage(); 686 break; 687 default: 688 // Should not reach here 689 printf("ERROR : unexpected stage, %d\n", 690 vmx_get_test_stage()); 691 print_vmexit_info(); 692 return VMX_TEST_VMEXIT; 693 } 694 vmcs_write(GUEST_RIP, guest_rip + insn_len); 695 return VMX_TEST_RESUME; 696 case VMX_VMCALL: 697 switch (vmx_get_test_stage()) { 698 case 9: 699 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 700 ctrl_cpu0 |= CPU_IO | CPU_IO_BITMAP; 701 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 702 break; 703 case 10: 704 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 705 ctrl_cpu0 = (ctrl_cpu0 & ~CPU_IO_BITMAP) | CPU_IO; 706 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 707 break; 708 default: 709 // Should not reach here 710 printf("ERROR : unexpected stage, %d\n", 711 vmx_get_test_stage()); 712 print_vmexit_info(); 713 return VMX_TEST_VMEXIT; 714 } 715 vmcs_write(GUEST_RIP, guest_rip + insn_len); 716 return VMX_TEST_RESUME; 717 default: 718 printf("guest_rip = 0x%lx\n", guest_rip); 719 printf("\tERROR : Undefined exit reason, reason = %ld.\n", reason); 720 break; 721 } 722 return VMX_TEST_VMEXIT; 723 } 724 725 #define INSN_CPU0 0 726 #define INSN_CPU1 1 727 #define INSN_ALWAYS_TRAP 2 728 729 #define FIELD_EXIT_QUAL (1 << 0) 730 #define FIELD_INSN_INFO (1 << 1) 731 732 asm( 733 "insn_hlt: hlt;ret\n\t" 734 "insn_invlpg: invlpg 0x12345678;ret\n\t" 735 "insn_mwait: xor %eax, %eax; xor %ecx, %ecx; mwait;ret\n\t" 736 "insn_rdpmc: xor %ecx, %ecx; rdpmc;ret\n\t" 737 "insn_rdtsc: rdtsc;ret\n\t" 738 "insn_cr3_load: mov cr3,%rax; mov %rax,%cr3;ret\n\t" 739 "insn_cr3_store: mov %cr3,%rax;ret\n\t" 740 #ifdef __x86_64__ 741 "insn_cr8_load: mov %rax,%cr8;ret\n\t" 742 "insn_cr8_store: mov %cr8,%rax;ret\n\t" 743 #endif 744 "insn_monitor: xor %eax, %eax; xor %ecx, %ecx; xor %edx, %edx; monitor;ret\n\t" 745 "insn_pause: pause;ret\n\t" 746 "insn_wbinvd: wbinvd;ret\n\t" 747 "insn_cpuid: mov $10, %eax; cpuid;ret\n\t" 748 "insn_invd: invd;ret\n\t" 749 "insn_sgdt: sgdt gdt64_desc;ret\n\t" 750 "insn_lgdt: lgdt gdt64_desc;ret\n\t" 751 "insn_sidt: sidt idt_descr;ret\n\t" 752 "insn_lidt: lidt idt_descr;ret\n\t" 753 "insn_sldt: sldt %ax;ret\n\t" 754 "insn_lldt: xor %eax, %eax; lldt %ax;ret\n\t" 755 "insn_str: str %ax;ret\n\t" 756 ); 757 extern void insn_hlt(); 758 extern void insn_invlpg(); 759 extern void insn_mwait(); 760 extern void insn_rdpmc(); 761 extern void insn_rdtsc(); 762 extern void insn_cr3_load(); 763 extern void insn_cr3_store(); 764 #ifdef __x86_64__ 765 extern void insn_cr8_load(); 766 extern void insn_cr8_store(); 767 #endif 768 extern void insn_monitor(); 769 extern void insn_pause(); 770 extern void insn_wbinvd(); 771 extern void insn_sgdt(); 772 extern void insn_lgdt(); 773 extern void insn_sidt(); 774 extern void insn_lidt(); 775 extern void insn_sldt(); 776 extern void insn_lldt(); 777 extern void insn_str(); 778 extern void insn_cpuid(); 779 extern void insn_invd(); 780 781 u32 cur_insn; 782 u64 cr3; 783 784 struct insn_table { 785 const char *name; 786 u32 flag; 787 void (*insn_func)(); 788 u32 type; 789 u32 reason; 790 ulong exit_qual; 791 u32 insn_info; 792 // Use FIELD_EXIT_QUAL and FIELD_INSN_INFO to define 793 // which field need to be tested, reason is always tested 794 u32 test_field; 795 }; 796 797 /* 798 * Add more test cases of instruction intercept here. Elements in this 799 * table is: 800 * name/control flag/insn function/type/exit reason/exit qulification/ 801 * instruction info/field to test 802 * The last field defines which fields (exit_qual and insn_info) need to be 803 * tested in exit handler. If set to 0, only "reason" is checked. 804 */ 805 static struct insn_table insn_table[] = { 806 // Flags for Primary Processor-Based VM-Execution Controls 807 {"HLT", CPU_HLT, insn_hlt, INSN_CPU0, 12, 0, 0, 0}, 808 {"INVLPG", CPU_INVLPG, insn_invlpg, INSN_CPU0, 14, 809 0x12345678, 0, FIELD_EXIT_QUAL}, 810 {"MWAIT", CPU_MWAIT, insn_mwait, INSN_CPU0, 36, 0, 0, 0}, 811 {"RDPMC", CPU_RDPMC, insn_rdpmc, INSN_CPU0, 15, 0, 0, 0}, 812 {"RDTSC", CPU_RDTSC, insn_rdtsc, INSN_CPU0, 16, 0, 0, 0}, 813 {"CR3 load", CPU_CR3_LOAD, insn_cr3_load, INSN_CPU0, 28, 0x3, 0, 814 FIELD_EXIT_QUAL}, 815 {"CR3 store", CPU_CR3_STORE, insn_cr3_store, INSN_CPU0, 28, 0x13, 0, 816 FIELD_EXIT_QUAL}, 817 #ifdef __x86_64__ 818 {"CR8 load", CPU_CR8_LOAD, insn_cr8_load, INSN_CPU0, 28, 0x8, 0, 819 FIELD_EXIT_QUAL}, 820 {"CR8 store", CPU_CR8_STORE, insn_cr8_store, INSN_CPU0, 28, 0x18, 0, 821 FIELD_EXIT_QUAL}, 822 #endif 823 {"MONITOR", CPU_MONITOR, insn_monitor, INSN_CPU0, 39, 0, 0, 0}, 824 {"PAUSE", CPU_PAUSE, insn_pause, INSN_CPU0, 40, 0, 0, 0}, 825 // Flags for Secondary Processor-Based VM-Execution Controls 826 {"WBINVD", CPU_WBINVD, insn_wbinvd, INSN_CPU1, 54, 0, 0, 0}, 827 {"DESC_TABLE (SGDT)", CPU_DESC_TABLE, insn_sgdt, INSN_CPU1, 46, 0, 0, 0}, 828 {"DESC_TABLE (LGDT)", CPU_DESC_TABLE, insn_lgdt, INSN_CPU1, 46, 0, 0, 0}, 829 {"DESC_TABLE (SIDT)", CPU_DESC_TABLE, insn_sidt, INSN_CPU1, 46, 0, 0, 0}, 830 {"DESC_TABLE (LIDT)", CPU_DESC_TABLE, insn_lidt, INSN_CPU1, 46, 0, 0, 0}, 831 {"DESC_TABLE (SLDT)", CPU_DESC_TABLE, insn_sldt, INSN_CPU1, 47, 0, 0, 0}, 832 {"DESC_TABLE (LLDT)", CPU_DESC_TABLE, insn_lldt, INSN_CPU1, 47, 0, 0, 0}, 833 {"DESC_TABLE (STR)", CPU_DESC_TABLE, insn_str, INSN_CPU1, 47, 0, 0, 0}, 834 /* LTR causes a #GP if done with a busy selector, so it is not tested. */ 835 // Instructions always trap 836 {"CPUID", 0, insn_cpuid, INSN_ALWAYS_TRAP, 10, 0, 0, 0}, 837 {"INVD", 0, insn_invd, INSN_ALWAYS_TRAP, 13, 0, 0, 0}, 838 // Instructions never trap 839 {NULL}, 840 }; 841 842 static int insn_intercept_init() 843 { 844 u32 ctrl_cpu; 845 846 ctrl_cpu = ctrl_cpu_rev[0].set | CPU_SECONDARY; 847 ctrl_cpu &= ctrl_cpu_rev[0].clr; 848 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu); 849 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu_rev[1].set); 850 cr3 = read_cr3(); 851 return VMX_TEST_START; 852 } 853 854 static void insn_intercept_main() 855 { 856 for (cur_insn = 0; insn_table[cur_insn].name != NULL; cur_insn++) { 857 vmx_set_test_stage(cur_insn * 2); 858 if ((insn_table[cur_insn].type == INSN_CPU0 && 859 !(ctrl_cpu_rev[0].clr & insn_table[cur_insn].flag)) || 860 (insn_table[cur_insn].type == INSN_CPU1 && 861 !(ctrl_cpu_rev[1].clr & insn_table[cur_insn].flag))) { 862 printf("\tCPU_CTRL%d.CPU_%s is not supported.\n", 863 insn_table[cur_insn].type - INSN_CPU0, 864 insn_table[cur_insn].name); 865 continue; 866 } 867 868 if ((insn_table[cur_insn].type == INSN_CPU0 && 869 !(ctrl_cpu_rev[0].set & insn_table[cur_insn].flag)) || 870 (insn_table[cur_insn].type == INSN_CPU1 && 871 !(ctrl_cpu_rev[1].set & insn_table[cur_insn].flag))) { 872 /* skip hlt, it stalls the guest and is tested below */ 873 if (insn_table[cur_insn].insn_func != insn_hlt) 874 insn_table[cur_insn].insn_func(); 875 report("execute %s", vmx_get_test_stage() == cur_insn * 2, 876 insn_table[cur_insn].name); 877 } else if (insn_table[cur_insn].type != INSN_ALWAYS_TRAP) 878 printf("\tCPU_CTRL%d.CPU_%s always traps.\n", 879 insn_table[cur_insn].type - INSN_CPU0, 880 insn_table[cur_insn].name); 881 882 vmcall(); 883 884 insn_table[cur_insn].insn_func(); 885 report("intercept %s", vmx_get_test_stage() == cur_insn * 2 + 1, 886 insn_table[cur_insn].name); 887 888 vmx_set_test_stage(cur_insn * 2 + 1); 889 vmcall(); 890 } 891 } 892 893 static int insn_intercept_exit_handler() 894 { 895 u64 guest_rip; 896 u32 reason; 897 ulong exit_qual; 898 u32 insn_len; 899 u32 insn_info; 900 bool pass; 901 902 guest_rip = vmcs_read(GUEST_RIP); 903 reason = vmcs_read(EXI_REASON) & 0xff; 904 exit_qual = vmcs_read(EXI_QUALIFICATION); 905 insn_len = vmcs_read(EXI_INST_LEN); 906 insn_info = vmcs_read(EXI_INST_INFO); 907 908 if (reason == VMX_VMCALL) { 909 u32 val = 0; 910 911 if (insn_table[cur_insn].type == INSN_CPU0) 912 val = vmcs_read(CPU_EXEC_CTRL0); 913 else if (insn_table[cur_insn].type == INSN_CPU1) 914 val = vmcs_read(CPU_EXEC_CTRL1); 915 916 if (vmx_get_test_stage() & 1) 917 val &= ~insn_table[cur_insn].flag; 918 else 919 val |= insn_table[cur_insn].flag; 920 921 if (insn_table[cur_insn].type == INSN_CPU0) 922 vmcs_write(CPU_EXEC_CTRL0, val | ctrl_cpu_rev[0].set); 923 else if (insn_table[cur_insn].type == INSN_CPU1) 924 vmcs_write(CPU_EXEC_CTRL1, val | ctrl_cpu_rev[1].set); 925 } else { 926 pass = (cur_insn * 2 == vmx_get_test_stage()) && 927 insn_table[cur_insn].reason == reason; 928 if (insn_table[cur_insn].test_field & FIELD_EXIT_QUAL && 929 insn_table[cur_insn].exit_qual != exit_qual) 930 pass = false; 931 if (insn_table[cur_insn].test_field & FIELD_INSN_INFO && 932 insn_table[cur_insn].insn_info != insn_info) 933 pass = false; 934 if (pass) 935 vmx_inc_test_stage(); 936 } 937 vmcs_write(GUEST_RIP, guest_rip + insn_len); 938 return VMX_TEST_RESUME; 939 } 940 941 942 static int setup_ept(bool enable_ad) 943 { 944 int support_2m; 945 unsigned long end_of_memory; 946 u32 ctrl_cpu[2]; 947 948 if (!(ept_vpid.val & EPT_CAP_UC) && 949 !(ept_vpid.val & EPT_CAP_WB)) { 950 printf("\tEPT paging-structure memory type " 951 "UC&WB are not supported\n"); 952 return 1; 953 } 954 if (ept_vpid.val & EPT_CAP_UC) 955 eptp = EPT_MEM_TYPE_UC; 956 else 957 eptp = EPT_MEM_TYPE_WB; 958 if (!(ept_vpid.val & EPT_CAP_PWL4)) { 959 printf("\tPWL4 is not supported\n"); 960 return 1; 961 } 962 ctrl_cpu[0] = vmcs_read(CPU_EXEC_CTRL0); 963 ctrl_cpu[1] = vmcs_read(CPU_EXEC_CTRL1); 964 ctrl_cpu[0] = (ctrl_cpu[0] | CPU_SECONDARY) 965 & ctrl_cpu_rev[0].clr; 966 ctrl_cpu[1] = (ctrl_cpu[1] | CPU_EPT) 967 & ctrl_cpu_rev[1].clr; 968 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu[0]); 969 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu[1]); 970 eptp |= (3 << EPTP_PG_WALK_LEN_SHIFT); 971 pml4 = alloc_page(); 972 memset(pml4, 0, PAGE_SIZE); 973 eptp |= virt_to_phys(pml4); 974 if (enable_ad) 975 eptp |= EPTP_AD_FLAG; 976 vmcs_write(EPTP, eptp); 977 support_2m = !!(ept_vpid.val & EPT_CAP_2M_PAGE); 978 end_of_memory = fwcfg_get_u64(FW_CFG_RAM_SIZE); 979 if (end_of_memory < (1ul << 32)) 980 end_of_memory = (1ul << 32); 981 /* Cannot use large EPT pages if we need to track EPT 982 * accessed/dirty bits at 4K granularity. 983 */ 984 setup_ept_range(pml4, 0, end_of_memory, 985 0, !enable_ad && support_2m, 986 EPT_WA | EPT_RA | EPT_EA); 987 return 0; 988 } 989 990 static int apic_version; 991 992 static int ept_init_common(bool have_ad) 993 { 994 if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) || 995 !(ctrl_cpu_rev[1].clr & CPU_EPT)) { 996 printf("\tEPT is not supported"); 997 return VMX_TEST_EXIT; 998 } 999 1000 if (setup_ept(have_ad)) 1001 return VMX_TEST_EXIT; 1002 data_page1 = alloc_page(); 1003 data_page2 = alloc_page(); 1004 memset(data_page1, 0x0, PAGE_SIZE); 1005 memset(data_page2, 0x0, PAGE_SIZE); 1006 *((u32 *)data_page1) = MAGIC_VAL_1; 1007 *((u32 *)data_page2) = MAGIC_VAL_2; 1008 install_ept(pml4, (unsigned long)data_page1, (unsigned long)data_page2, 1009 EPT_RA | EPT_WA | EPT_EA); 1010 1011 apic_version = *((u32 *)0xfee00030UL); 1012 return VMX_TEST_START; 1013 } 1014 1015 static int ept_init() 1016 { 1017 return ept_init_common(false); 1018 } 1019 1020 static void ept_common() 1021 { 1022 vmx_set_test_stage(0); 1023 if (*((u32 *)data_page2) != MAGIC_VAL_1 || 1024 *((u32 *)data_page1) != MAGIC_VAL_1) 1025 report("EPT basic framework - read", 0); 1026 else { 1027 *((u32 *)data_page2) = MAGIC_VAL_3; 1028 vmcall(); 1029 if (vmx_get_test_stage() == 1) { 1030 if (*((u32 *)data_page1) == MAGIC_VAL_3 && 1031 *((u32 *)data_page2) == MAGIC_VAL_2) 1032 report("EPT basic framework", 1); 1033 else 1034 report("EPT basic framework - remap", 1); 1035 } 1036 } 1037 // Test EPT Misconfigurations 1038 vmx_set_test_stage(1); 1039 vmcall(); 1040 *((u32 *)data_page1) = MAGIC_VAL_1; 1041 if (vmx_get_test_stage() != 2) { 1042 report("EPT misconfigurations", 0); 1043 goto t1; 1044 } 1045 vmx_set_test_stage(2); 1046 vmcall(); 1047 *((u32 *)data_page1) = MAGIC_VAL_1; 1048 report("EPT misconfigurations", vmx_get_test_stage() == 3); 1049 t1: 1050 // Test EPT violation 1051 vmx_set_test_stage(3); 1052 vmcall(); 1053 *((u32 *)data_page1) = MAGIC_VAL_1; 1054 report("EPT violation - page permission", vmx_get_test_stage() == 4); 1055 // Violation caused by EPT paging structure 1056 vmx_set_test_stage(4); 1057 vmcall(); 1058 *((u32 *)data_page1) = MAGIC_VAL_2; 1059 report("EPT violation - paging structure", vmx_get_test_stage() == 5); 1060 } 1061 1062 static void ept_main() 1063 { 1064 ept_common(); 1065 1066 // Test EPT access to L1 MMIO 1067 vmx_set_test_stage(6); 1068 report("EPT - MMIO access", *((u32 *)0xfee00030UL) == apic_version); 1069 1070 // Test invalid operand for INVEPT 1071 vmcall(); 1072 report("EPT - unsupported INVEPT", vmx_get_test_stage() == 7); 1073 } 1074 1075 bool invept_test(int type, u64 eptp) 1076 { 1077 bool ret, supported; 1078 1079 supported = ept_vpid.val & (EPT_CAP_INVEPT_SINGLE >> INVEPT_SINGLE << type); 1080 ret = invept(type, eptp); 1081 1082 if (ret == !supported) 1083 return false; 1084 1085 if (!supported) 1086 printf("WARNING: unsupported invept passed!\n"); 1087 else 1088 printf("WARNING: invept failed!\n"); 1089 1090 return true; 1091 } 1092 1093 static int ept_exit_handler_common(bool have_ad) 1094 { 1095 u64 guest_rip; 1096 u64 guest_cr3; 1097 ulong reason; 1098 u32 insn_len; 1099 u32 exit_qual; 1100 static unsigned long data_page1_pte, data_page1_pte_pte; 1101 1102 guest_rip = vmcs_read(GUEST_RIP); 1103 guest_cr3 = vmcs_read(GUEST_CR3); 1104 reason = vmcs_read(EXI_REASON) & 0xff; 1105 insn_len = vmcs_read(EXI_INST_LEN); 1106 exit_qual = vmcs_read(EXI_QUALIFICATION); 1107 switch (reason) { 1108 case VMX_VMCALL: 1109 switch (vmx_get_test_stage()) { 1110 case 0: 1111 check_ept_ad(pml4, guest_cr3, 1112 (unsigned long)data_page1, 1113 have_ad ? EPT_ACCESS_FLAG : 0, 1114 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1115 check_ept_ad(pml4, guest_cr3, 1116 (unsigned long)data_page2, 1117 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0, 1118 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1119 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1120 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page2); 1121 if (have_ad) 1122 ept_sync(INVEPT_SINGLE, eptp);; 1123 if (*((u32 *)data_page1) == MAGIC_VAL_3 && 1124 *((u32 *)data_page2) == MAGIC_VAL_2) { 1125 vmx_inc_test_stage(); 1126 install_ept(pml4, (unsigned long)data_page2, 1127 (unsigned long)data_page2, 1128 EPT_RA | EPT_WA | EPT_EA); 1129 } else 1130 report("EPT basic framework - write", 0); 1131 break; 1132 case 1: 1133 install_ept(pml4, (unsigned long)data_page1, 1134 (unsigned long)data_page1, EPT_WA); 1135 ept_sync(INVEPT_SINGLE, eptp); 1136 break; 1137 case 2: 1138 install_ept(pml4, (unsigned long)data_page1, 1139 (unsigned long)data_page1, 1140 EPT_RA | EPT_WA | EPT_EA | 1141 (2 << EPT_MEM_TYPE_SHIFT)); 1142 ept_sync(INVEPT_SINGLE, eptp); 1143 break; 1144 case 3: 1145 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1146 data_page1_pte = get_ept_pte(pml4, 1147 (unsigned long)data_page1, 1); 1148 set_ept_pte(pml4, (unsigned long)data_page1, 1149 1, data_page1_pte & ~EPT_PRESENT); 1150 ept_sync(INVEPT_SINGLE, eptp); 1151 break; 1152 case 4: 1153 data_page1_pte = get_ept_pte(pml4, 1154 (unsigned long)data_page1, 2); 1155 data_page1_pte &= PAGE_MASK; 1156 data_page1_pte_pte = get_ept_pte(pml4, data_page1_pte, 2); 1157 set_ept_pte(pml4, data_page1_pte, 2, 1158 data_page1_pte_pte & ~EPT_PRESENT); 1159 ept_sync(INVEPT_SINGLE, eptp); 1160 break; 1161 case 6: 1162 if (!invept_test(0, eptp)) 1163 vmx_inc_test_stage(); 1164 break; 1165 // Should not reach here 1166 default: 1167 printf("ERROR - unexpected stage, %d.\n", 1168 vmx_get_test_stage()); 1169 print_vmexit_info(); 1170 return VMX_TEST_VMEXIT; 1171 } 1172 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1173 return VMX_TEST_RESUME; 1174 case VMX_EPT_MISCONFIG: 1175 switch (vmx_get_test_stage()) { 1176 case 1: 1177 case 2: 1178 vmx_inc_test_stage(); 1179 install_ept(pml4, (unsigned long)data_page1, 1180 (unsigned long)data_page1, 1181 EPT_RA | EPT_WA | EPT_EA); 1182 ept_sync(INVEPT_SINGLE, eptp); 1183 break; 1184 // Should not reach here 1185 default: 1186 printf("ERROR - unexpected stage, %d.\n", 1187 vmx_get_test_stage()); 1188 print_vmexit_info(); 1189 return VMX_TEST_VMEXIT; 1190 } 1191 return VMX_TEST_RESUME; 1192 case VMX_EPT_VIOLATION: 1193 switch(vmx_get_test_stage()) { 1194 case 3: 1195 check_ept_ad(pml4, guest_cr3, (unsigned long)data_page1, 0, 1196 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1197 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1198 if (exit_qual == (EPT_VLT_WR | EPT_VLT_LADDR_VLD | 1199 EPT_VLT_PADDR)) 1200 vmx_inc_test_stage(); 1201 set_ept_pte(pml4, (unsigned long)data_page1, 1202 1, data_page1_pte | (EPT_PRESENT)); 1203 ept_sync(INVEPT_SINGLE, eptp); 1204 break; 1205 case 4: 1206 check_ept_ad(pml4, guest_cr3, (unsigned long)data_page1, 0, 1207 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1208 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1209 if (exit_qual == (EPT_VLT_RD | 1210 (have_ad ? EPT_VLT_WR : 0) | 1211 EPT_VLT_LADDR_VLD)) 1212 vmx_inc_test_stage(); 1213 set_ept_pte(pml4, data_page1_pte, 2, 1214 data_page1_pte_pte | (EPT_PRESENT)); 1215 ept_sync(INVEPT_SINGLE, eptp); 1216 break; 1217 default: 1218 // Should not reach here 1219 printf("ERROR : unexpected stage, %d\n", 1220 vmx_get_test_stage()); 1221 print_vmexit_info(); 1222 return VMX_TEST_VMEXIT; 1223 } 1224 return VMX_TEST_RESUME; 1225 default: 1226 printf("Unknown exit reason, %ld\n", reason); 1227 print_vmexit_info(); 1228 } 1229 return VMX_TEST_VMEXIT; 1230 } 1231 1232 static int ept_exit_handler() 1233 { 1234 return ept_exit_handler_common(false); 1235 } 1236 1237 static int eptad_init() 1238 { 1239 int r = ept_init_common(true); 1240 1241 if (r == VMX_TEST_EXIT) 1242 return r; 1243 1244 if ((rdmsr(MSR_IA32_VMX_EPT_VPID_CAP) & EPT_CAP_AD_FLAG) == 0) { 1245 printf("\tEPT A/D bits are not supported"); 1246 return VMX_TEST_EXIT; 1247 } 1248 1249 return r; 1250 } 1251 1252 static void eptad_main() 1253 { 1254 ept_common(); 1255 } 1256 1257 static int eptad_exit_handler() 1258 { 1259 return ept_exit_handler_common(true); 1260 } 1261 1262 bool invvpid_test(int type, u16 vpid) 1263 { 1264 bool ret, supported; 1265 1266 supported = ept_vpid.val & (VPID_CAP_INVVPID_SINGLE >> INVVPID_SINGLE << type); 1267 ret = invvpid(type, vpid, 0); 1268 1269 if (ret == !supported) 1270 return false; 1271 1272 if (!supported) 1273 printf("WARNING: unsupported invvpid passed!\n"); 1274 else 1275 printf("WARNING: invvpid failed!\n"); 1276 1277 return true; 1278 } 1279 1280 static int vpid_init() 1281 { 1282 u32 ctrl_cpu1; 1283 1284 if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) || 1285 !(ctrl_cpu_rev[1].clr & CPU_VPID)) { 1286 printf("\tVPID is not supported"); 1287 return VMX_TEST_EXIT; 1288 } 1289 1290 ctrl_cpu1 = vmcs_read(CPU_EXEC_CTRL1); 1291 ctrl_cpu1 |= CPU_VPID; 1292 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu1); 1293 return VMX_TEST_START; 1294 } 1295 1296 static void vpid_main() 1297 { 1298 vmx_set_test_stage(0); 1299 vmcall(); 1300 report("INVVPID SINGLE ADDRESS", vmx_get_test_stage() == 1); 1301 vmx_set_test_stage(2); 1302 vmcall(); 1303 report("INVVPID SINGLE", vmx_get_test_stage() == 3); 1304 vmx_set_test_stage(4); 1305 vmcall(); 1306 report("INVVPID ALL", vmx_get_test_stage() == 5); 1307 } 1308 1309 static int vpid_exit_handler() 1310 { 1311 u64 guest_rip; 1312 ulong reason; 1313 u32 insn_len; 1314 1315 guest_rip = vmcs_read(GUEST_RIP); 1316 reason = vmcs_read(EXI_REASON) & 0xff; 1317 insn_len = vmcs_read(EXI_INST_LEN); 1318 1319 switch (reason) { 1320 case VMX_VMCALL: 1321 switch(vmx_get_test_stage()) { 1322 case 0: 1323 if (!invvpid_test(INVVPID_SINGLE_ADDRESS, 1)) 1324 vmx_inc_test_stage(); 1325 break; 1326 case 2: 1327 if (!invvpid_test(INVVPID_SINGLE, 1)) 1328 vmx_inc_test_stage(); 1329 break; 1330 case 4: 1331 if (!invvpid_test(INVVPID_ALL, 1)) 1332 vmx_inc_test_stage(); 1333 break; 1334 default: 1335 printf("ERROR: unexpected stage, %d\n", 1336 vmx_get_test_stage()); 1337 print_vmexit_info(); 1338 return VMX_TEST_VMEXIT; 1339 } 1340 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1341 return VMX_TEST_RESUME; 1342 default: 1343 printf("Unknown exit reason, %ld\n", reason); 1344 print_vmexit_info(); 1345 } 1346 return VMX_TEST_VMEXIT; 1347 } 1348 1349 #define TIMER_VECTOR 222 1350 1351 static volatile bool timer_fired; 1352 1353 static void timer_isr(isr_regs_t *regs) 1354 { 1355 timer_fired = true; 1356 apic_write(APIC_EOI, 0); 1357 } 1358 1359 static int interrupt_init(struct vmcs *vmcs) 1360 { 1361 msr_bmp_init(); 1362 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_EXTINT); 1363 handle_irq(TIMER_VECTOR, timer_isr); 1364 return VMX_TEST_START; 1365 } 1366 1367 static void interrupt_main(void) 1368 { 1369 long long start, loops; 1370 1371 vmx_set_test_stage(0); 1372 1373 apic_write(APIC_LVTT, TIMER_VECTOR); 1374 irq_enable(); 1375 1376 apic_write(APIC_TMICT, 1); 1377 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1378 asm volatile ("nop"); 1379 report("direct interrupt while running guest", timer_fired); 1380 1381 apic_write(APIC_TMICT, 0); 1382 irq_disable(); 1383 vmcall(); 1384 timer_fired = false; 1385 apic_write(APIC_TMICT, 1); 1386 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1387 asm volatile ("nop"); 1388 report("intercepted interrupt while running guest", timer_fired); 1389 1390 irq_enable(); 1391 apic_write(APIC_TMICT, 0); 1392 irq_disable(); 1393 vmcall(); 1394 timer_fired = false; 1395 start = rdtsc(); 1396 apic_write(APIC_TMICT, 1000000); 1397 1398 asm volatile ("sti; hlt"); 1399 1400 report("direct interrupt + hlt", 1401 rdtsc() - start > 1000000 && timer_fired); 1402 1403 apic_write(APIC_TMICT, 0); 1404 irq_disable(); 1405 vmcall(); 1406 timer_fired = false; 1407 start = rdtsc(); 1408 apic_write(APIC_TMICT, 1000000); 1409 1410 asm volatile ("sti; hlt"); 1411 1412 report("intercepted interrupt + hlt", 1413 rdtsc() - start > 10000 && timer_fired); 1414 1415 apic_write(APIC_TMICT, 0); 1416 irq_disable(); 1417 vmcall(); 1418 timer_fired = false; 1419 start = rdtsc(); 1420 apic_write(APIC_TMICT, 1000000); 1421 1422 irq_enable(); 1423 asm volatile ("nop"); 1424 vmcall(); 1425 1426 report("direct interrupt + activity state hlt", 1427 rdtsc() - start > 10000 && timer_fired); 1428 1429 apic_write(APIC_TMICT, 0); 1430 irq_disable(); 1431 vmcall(); 1432 timer_fired = false; 1433 start = rdtsc(); 1434 apic_write(APIC_TMICT, 1000000); 1435 1436 irq_enable(); 1437 asm volatile ("nop"); 1438 vmcall(); 1439 1440 report("intercepted interrupt + activity state hlt", 1441 rdtsc() - start > 10000 && timer_fired); 1442 1443 apic_write(APIC_TMICT, 0); 1444 irq_disable(); 1445 vmx_set_test_stage(7); 1446 vmcall(); 1447 timer_fired = false; 1448 apic_write(APIC_TMICT, 1); 1449 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1450 asm volatile ("nop"); 1451 report("running a guest with interrupt acknowledgement set", timer_fired); 1452 } 1453 1454 static int interrupt_exit_handler(void) 1455 { 1456 u64 guest_rip = vmcs_read(GUEST_RIP); 1457 ulong reason = vmcs_read(EXI_REASON) & 0xff; 1458 u32 insn_len = vmcs_read(EXI_INST_LEN); 1459 1460 switch (reason) { 1461 case VMX_VMCALL: 1462 switch (vmx_get_test_stage()) { 1463 case 0: 1464 case 2: 1465 case 5: 1466 vmcs_write(PIN_CONTROLS, 1467 vmcs_read(PIN_CONTROLS) | PIN_EXTINT); 1468 break; 1469 case 7: 1470 vmcs_write(EXI_CONTROLS, vmcs_read(EXI_CONTROLS) | EXI_INTA); 1471 vmcs_write(PIN_CONTROLS, 1472 vmcs_read(PIN_CONTROLS) | PIN_EXTINT); 1473 break; 1474 case 1: 1475 case 3: 1476 vmcs_write(PIN_CONTROLS, 1477 vmcs_read(PIN_CONTROLS) & ~PIN_EXTINT); 1478 break; 1479 case 4: 1480 case 6: 1481 vmcs_write(GUEST_ACTV_STATE, ACTV_HLT); 1482 break; 1483 } 1484 vmx_inc_test_stage(); 1485 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1486 return VMX_TEST_RESUME; 1487 case VMX_EXTINT: 1488 if (vmcs_read(EXI_CONTROLS) & EXI_INTA) { 1489 int vector = vmcs_read(EXI_INTR_INFO) & 0xff; 1490 handle_external_interrupt(vector); 1491 } else { 1492 irq_enable(); 1493 asm volatile ("nop"); 1494 irq_disable(); 1495 } 1496 if (vmx_get_test_stage() >= 2) 1497 vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE); 1498 return VMX_TEST_RESUME; 1499 default: 1500 printf("Unknown exit reason, %ld\n", reason); 1501 print_vmexit_info(); 1502 } 1503 1504 return VMX_TEST_VMEXIT; 1505 } 1506 1507 static int dbgctls_init(struct vmcs *vmcs) 1508 { 1509 u64 dr7 = 0x402; 1510 u64 zero = 0; 1511 1512 msr_bmp_init(); 1513 asm volatile( 1514 "mov %0,%%dr0\n\t" 1515 "mov %0,%%dr1\n\t" 1516 "mov %0,%%dr2\n\t" 1517 "mov %1,%%dr7\n\t" 1518 : : "r" (zero), "r" (dr7)); 1519 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x1); 1520 vmcs_write(GUEST_DR7, 0x404); 1521 vmcs_write(GUEST_DEBUGCTL, 0x2); 1522 1523 vmcs_write(ENT_CONTROLS, vmcs_read(ENT_CONTROLS) | ENT_LOAD_DBGCTLS); 1524 vmcs_write(EXI_CONTROLS, vmcs_read(EXI_CONTROLS) | EXI_SAVE_DBGCTLS); 1525 1526 return VMX_TEST_START; 1527 } 1528 1529 static void dbgctls_main(void) 1530 { 1531 u64 dr7, debugctl; 1532 1533 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1534 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1535 /* Commented out: KVM does not support DEBUGCTL so far */ 1536 (void)debugctl; 1537 report("Load debug controls", dr7 == 0x404 /* && debugctl == 0x2 */); 1538 1539 dr7 = 0x408; 1540 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1541 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x3); 1542 1543 vmx_set_test_stage(0); 1544 vmcall(); 1545 report("Save debug controls", vmx_get_test_stage() == 1); 1546 1547 if (ctrl_enter_rev.set & ENT_LOAD_DBGCTLS || 1548 ctrl_exit_rev.set & EXI_SAVE_DBGCTLS) { 1549 printf("\tDebug controls are always loaded/saved\n"); 1550 return; 1551 } 1552 vmx_set_test_stage(2); 1553 vmcall(); 1554 1555 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1556 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1557 /* Commented out: KVM does not support DEBUGCTL so far */ 1558 (void)debugctl; 1559 report("Guest=host debug controls", dr7 == 0x402 /* && debugctl == 0x1 */); 1560 1561 dr7 = 0x408; 1562 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1563 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x3); 1564 1565 vmx_set_test_stage(3); 1566 vmcall(); 1567 report("Don't save debug controls", vmx_get_test_stage() == 4); 1568 } 1569 1570 static int dbgctls_exit_handler(void) 1571 { 1572 unsigned int reason = vmcs_read(EXI_REASON) & 0xff; 1573 u32 insn_len = vmcs_read(EXI_INST_LEN); 1574 u64 guest_rip = vmcs_read(GUEST_RIP); 1575 u64 dr7, debugctl; 1576 1577 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1578 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1579 1580 switch (reason) { 1581 case VMX_VMCALL: 1582 switch (vmx_get_test_stage()) { 1583 case 0: 1584 if (dr7 == 0x400 && debugctl == 0 && 1585 vmcs_read(GUEST_DR7) == 0x408 /* && 1586 Commented out: KVM does not support DEBUGCTL so far 1587 vmcs_read(GUEST_DEBUGCTL) == 0x3 */) 1588 vmx_inc_test_stage(); 1589 break; 1590 case 2: 1591 dr7 = 0x402; 1592 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1593 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x1); 1594 vmcs_write(GUEST_DR7, 0x404); 1595 vmcs_write(GUEST_DEBUGCTL, 0x2); 1596 1597 vmcs_write(ENT_CONTROLS, 1598 vmcs_read(ENT_CONTROLS) & ~ENT_LOAD_DBGCTLS); 1599 vmcs_write(EXI_CONTROLS, 1600 vmcs_read(EXI_CONTROLS) & ~EXI_SAVE_DBGCTLS); 1601 break; 1602 case 3: 1603 if (dr7 == 0x400 && debugctl == 0 && 1604 vmcs_read(GUEST_DR7) == 0x404 /* && 1605 Commented out: KVM does not support DEBUGCTL so far 1606 vmcs_read(GUEST_DEBUGCTL) == 0x2 */) 1607 vmx_inc_test_stage(); 1608 break; 1609 } 1610 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1611 return VMX_TEST_RESUME; 1612 default: 1613 printf("Unknown exit reason, %d\n", reason); 1614 print_vmexit_info(); 1615 } 1616 return VMX_TEST_VMEXIT; 1617 } 1618 1619 struct vmx_msr_entry { 1620 u32 index; 1621 u32 reserved; 1622 u64 value; 1623 } __attribute__((packed)); 1624 1625 #define MSR_MAGIC 0x31415926 1626 struct vmx_msr_entry *exit_msr_store, *entry_msr_load, *exit_msr_load; 1627 1628 static int msr_switch_init(struct vmcs *vmcs) 1629 { 1630 msr_bmp_init(); 1631 exit_msr_store = alloc_page(); 1632 exit_msr_load = alloc_page(); 1633 entry_msr_load = alloc_page(); 1634 memset(exit_msr_store, 0, PAGE_SIZE); 1635 memset(exit_msr_load, 0, PAGE_SIZE); 1636 memset(entry_msr_load, 0, PAGE_SIZE); 1637 entry_msr_load[0].index = MSR_KERNEL_GS_BASE; 1638 entry_msr_load[0].value = MSR_MAGIC; 1639 1640 vmx_set_test_stage(1); 1641 vmcs_write(ENT_MSR_LD_CNT, 1); 1642 vmcs_write(ENTER_MSR_LD_ADDR, (u64)entry_msr_load); 1643 vmcs_write(EXI_MSR_ST_CNT, 1); 1644 vmcs_write(EXIT_MSR_ST_ADDR, (u64)exit_msr_store); 1645 vmcs_write(EXI_MSR_LD_CNT, 1); 1646 vmcs_write(EXIT_MSR_LD_ADDR, (u64)exit_msr_load); 1647 return VMX_TEST_START; 1648 } 1649 1650 static void msr_switch_main() 1651 { 1652 if (vmx_get_test_stage() == 1) { 1653 report("VM entry MSR load", 1654 rdmsr(MSR_KERNEL_GS_BASE) == MSR_MAGIC); 1655 vmx_set_test_stage(2); 1656 wrmsr(MSR_KERNEL_GS_BASE, MSR_MAGIC + 1); 1657 exit_msr_store[0].index = MSR_KERNEL_GS_BASE; 1658 exit_msr_load[0].index = MSR_KERNEL_GS_BASE; 1659 exit_msr_load[0].value = MSR_MAGIC + 2; 1660 } 1661 vmcall(); 1662 } 1663 1664 static int msr_switch_exit_handler() 1665 { 1666 ulong reason; 1667 1668 reason = vmcs_read(EXI_REASON); 1669 if (reason == VMX_VMCALL && vmx_get_test_stage() == 2) { 1670 report("VM exit MSR store", 1671 exit_msr_store[0].value == MSR_MAGIC + 1); 1672 report("VM exit MSR load", 1673 rdmsr(MSR_KERNEL_GS_BASE) == MSR_MAGIC + 2); 1674 vmx_set_test_stage(3); 1675 entry_msr_load[0].index = MSR_FS_BASE; 1676 return VMX_TEST_RESUME; 1677 } 1678 printf("ERROR %s: unexpected stage=%u or reason=%lu\n", 1679 __func__, vmx_get_test_stage(), reason); 1680 return VMX_TEST_EXIT; 1681 } 1682 1683 static int msr_switch_entry_failure(struct vmentry_failure *failure) 1684 { 1685 ulong reason; 1686 1687 if (failure->early) { 1688 printf("ERROR %s: early exit\n", __func__); 1689 return VMX_TEST_EXIT; 1690 } 1691 1692 reason = vmcs_read(EXI_REASON); 1693 if (reason == (VMX_ENTRY_FAILURE | VMX_FAIL_MSR) && 1694 vmx_get_test_stage() == 3) { 1695 report("VM entry MSR load: try to load FS_BASE", 1696 vmcs_read(EXI_QUALIFICATION) == 1); 1697 return VMX_TEST_VMEXIT; 1698 } 1699 printf("ERROR %s: unexpected stage=%u or reason=%lu\n", 1700 __func__, vmx_get_test_stage(), reason); 1701 return VMX_TEST_EXIT; 1702 } 1703 1704 static int vmmcall_init(struct vmcs *vmcs ) 1705 { 1706 vmcs_write(EXC_BITMAP, 1 << UD_VECTOR); 1707 return VMX_TEST_START; 1708 } 1709 1710 static void vmmcall_main(void) 1711 { 1712 asm volatile( 1713 "mov $0xABCD, %%rax\n\t" 1714 "vmmcall\n\t" 1715 ::: "rax"); 1716 1717 report("VMMCALL", 0); 1718 } 1719 1720 static int vmmcall_exit_handler() 1721 { 1722 ulong reason; 1723 1724 reason = vmcs_read(EXI_REASON); 1725 switch (reason) { 1726 case VMX_VMCALL: 1727 printf("here\n"); 1728 report("VMMCALL triggers #UD", 0); 1729 break; 1730 case VMX_EXC_NMI: 1731 report("VMMCALL triggers #UD", 1732 (vmcs_read(EXI_INTR_INFO) & 0xff) == UD_VECTOR); 1733 break; 1734 default: 1735 printf("Unknown exit reason, %ld\n", reason); 1736 print_vmexit_info(); 1737 } 1738 1739 return VMX_TEST_VMEXIT; 1740 } 1741 1742 static int disable_rdtscp_init(struct vmcs *vmcs) 1743 { 1744 u32 ctrl_cpu1; 1745 1746 if (ctrl_cpu_rev[0].clr & CPU_SECONDARY) { 1747 ctrl_cpu1 = vmcs_read(CPU_EXEC_CTRL1); 1748 ctrl_cpu1 &= ~CPU_RDTSCP; 1749 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu1); 1750 } 1751 1752 return VMX_TEST_START; 1753 } 1754 1755 static void disable_rdtscp_ud_handler(struct ex_regs *regs) 1756 { 1757 switch (vmx_get_test_stage()) { 1758 case 0: 1759 report("RDTSCP triggers #UD", true); 1760 vmx_inc_test_stage(); 1761 regs->rip += 3; 1762 break; 1763 case 2: 1764 report("RDPID triggers #UD", true); 1765 vmx_inc_test_stage(); 1766 regs->rip += 4; 1767 break; 1768 } 1769 return; 1770 1771 } 1772 1773 static void disable_rdtscp_main(void) 1774 { 1775 /* Test that #UD is properly injected in L2. */ 1776 handle_exception(UD_VECTOR, disable_rdtscp_ud_handler); 1777 1778 vmx_set_test_stage(0); 1779 asm volatile("rdtscp" : : : "eax", "ecx", "edx"); 1780 vmcall(); 1781 asm volatile(".byte 0xf3, 0x0f, 0xc7, 0xf8" : : : "eax"); 1782 vmcall(); 1783 } 1784 1785 static int disable_rdtscp_exit_handler(void) 1786 { 1787 unsigned int reason = vmcs_read(EXI_REASON) & 0xff; 1788 1789 switch (reason) { 1790 case VMX_VMCALL: 1791 switch (vmx_get_test_stage()) { 1792 case 0: 1793 report("RDTSCP triggers #UD", false); 1794 vmx_inc_test_stage(); 1795 /* fallthrough */ 1796 case 1: 1797 vmx_inc_test_stage(); 1798 vmcs_write(GUEST_RIP, vmcs_read(GUEST_RIP) + 3); 1799 return VMX_TEST_RESUME; 1800 case 2: 1801 report("RDPID triggers #UD", false); 1802 break; 1803 } 1804 break; 1805 1806 default: 1807 printf("Unknown exit reason, %d\n", reason); 1808 print_vmexit_info(); 1809 } 1810 return VMX_TEST_VMEXIT; 1811 } 1812 1813 int int3_init() 1814 { 1815 vmcs_write(EXC_BITMAP, ~0u); 1816 return VMX_TEST_START; 1817 } 1818 1819 void int3_guest_main() 1820 { 1821 asm volatile ("int3"); 1822 } 1823 1824 int int3_exit_handler() 1825 { 1826 u32 reason = vmcs_read(EXI_REASON); 1827 u32 intr_info = vmcs_read(EXI_INTR_INFO); 1828 1829 report("L1 intercepts #BP", reason == VMX_EXC_NMI && 1830 (intr_info & INTR_INFO_VALID_MASK) && 1831 (intr_info & INTR_INFO_VECTOR_MASK) == BP_VECTOR && 1832 ((intr_info & INTR_INFO_INTR_TYPE_MASK) >> 1833 INTR_INFO_INTR_TYPE_SHIFT) == VMX_INTR_TYPE_SOFT_EXCEPTION); 1834 1835 return VMX_TEST_VMEXIT; 1836 } 1837 1838 int into_init() 1839 { 1840 vmcs_write(EXC_BITMAP, ~0u); 1841 return VMX_TEST_START; 1842 } 1843 1844 void into_guest_main() 1845 { 1846 struct far_pointer32 fp = { 1847 .offset = (uintptr_t)&&into, 1848 .selector = KERNEL_CS32, 1849 }; 1850 register uintptr_t rsp asm("rsp"); 1851 1852 if (fp.offset != (uintptr_t)&&into) { 1853 printf("Code address too high.\n"); 1854 return; 1855 } 1856 if ((u32)rsp != rsp) { 1857 printf("Stack address too high.\n"); 1858 return; 1859 } 1860 1861 asm goto ("lcall *%0" : : "m" (fp) : "rax" : into); 1862 return; 1863 into: 1864 asm volatile (".code32;" 1865 "movl $0x7fffffff, %eax;" 1866 "addl %eax, %eax;" 1867 "into;" 1868 "lret;" 1869 ".code64"); 1870 __builtin_unreachable(); 1871 } 1872 1873 int into_exit_handler() 1874 { 1875 u32 reason = vmcs_read(EXI_REASON); 1876 u32 intr_info = vmcs_read(EXI_INTR_INFO); 1877 1878 report("L1 intercepts #OF", reason == VMX_EXC_NMI && 1879 (intr_info & INTR_INFO_VALID_MASK) && 1880 (intr_info & INTR_INFO_VECTOR_MASK) == OF_VECTOR && 1881 ((intr_info & INTR_INFO_INTR_TYPE_MASK) >> 1882 INTR_INFO_INTR_TYPE_SHIFT) == VMX_INTR_TYPE_SOFT_EXCEPTION); 1883 1884 return VMX_TEST_VMEXIT; 1885 } 1886 1887 /* name/init/guest_main/exit_handler/syscall_handler/guest_regs */ 1888 struct vmx_test vmx_tests[] = { 1889 { "null", NULL, basic_guest_main, basic_exit_handler, NULL, {0} }, 1890 { "vmenter", NULL, vmenter_main, vmenter_exit_handler, NULL, {0} }, 1891 { "preemption timer", preemption_timer_init, preemption_timer_main, 1892 preemption_timer_exit_handler, NULL, {0} }, 1893 { "control field PAT", test_ctrl_pat_init, test_ctrl_pat_main, 1894 test_ctrl_pat_exit_handler, NULL, {0} }, 1895 { "control field EFER", test_ctrl_efer_init, test_ctrl_efer_main, 1896 test_ctrl_efer_exit_handler, NULL, {0} }, 1897 { "CR shadowing", NULL, cr_shadowing_main, 1898 cr_shadowing_exit_handler, NULL, {0} }, 1899 { "I/O bitmap", iobmp_init, iobmp_main, iobmp_exit_handler, 1900 NULL, {0} }, 1901 { "instruction intercept", insn_intercept_init, insn_intercept_main, 1902 insn_intercept_exit_handler, NULL, {0} }, 1903 { "EPT A/D disabled", ept_init, ept_main, ept_exit_handler, NULL, {0} }, 1904 { "EPT A/D enabled", eptad_init, eptad_main, eptad_exit_handler, NULL, {0} }, 1905 { "VPID", vpid_init, vpid_main, vpid_exit_handler, NULL, {0} }, 1906 { "interrupt", interrupt_init, interrupt_main, 1907 interrupt_exit_handler, NULL, {0} }, 1908 { "debug controls", dbgctls_init, dbgctls_main, dbgctls_exit_handler, 1909 NULL, {0} }, 1910 { "MSR switch", msr_switch_init, msr_switch_main, 1911 msr_switch_exit_handler, NULL, {0}, msr_switch_entry_failure }, 1912 { "vmmcall", vmmcall_init, vmmcall_main, vmmcall_exit_handler, NULL, {0} }, 1913 { "disable RDTSCP", disable_rdtscp_init, disable_rdtscp_main, 1914 disable_rdtscp_exit_handler, NULL, {0} }, 1915 { "int3", int3_init, int3_guest_main, int3_exit_handler, NULL, {0} }, 1916 { "into", into_init, into_guest_main, into_exit_handler, NULL, {0} }, 1917 { NULL, NULL, NULL, NULL, NULL, {0} }, 1918 }; 1919