1 /* 2 * All test cases of nested virtualization should be in this file 3 * 4 * Author : Arthur Chunqi Li <yzt356@gmail.com> 5 */ 6 #include "vmx.h" 7 #include "msr.h" 8 #include "processor.h" 9 #include "vm.h" 10 #include "fwcfg.h" 11 #include "isr.h" 12 #include "desc.h" 13 #include "apic.h" 14 #include "types.h" 15 16 u64 ia32_pat; 17 u64 ia32_efer; 18 void *io_bitmap_a, *io_bitmap_b; 19 u16 ioport; 20 21 unsigned long *pml4; 22 u64 eptp; 23 void *data_page1, *data_page2; 24 25 static inline void vmcall() 26 { 27 asm volatile("vmcall"); 28 } 29 30 void basic_guest_main() 31 { 32 report("Basic VMX test", 1); 33 } 34 35 int basic_exit_handler() 36 { 37 report("Basic VMX test", 0); 38 print_vmexit_info(); 39 return VMX_TEST_EXIT; 40 } 41 42 void vmenter_main() 43 { 44 u64 rax; 45 u64 rsp, resume_rsp; 46 47 report("test vmlaunch", 1); 48 49 asm volatile( 50 "mov %%rsp, %0\n\t" 51 "mov %3, %%rax\n\t" 52 "vmcall\n\t" 53 "mov %%rax, %1\n\t" 54 "mov %%rsp, %2\n\t" 55 : "=r"(rsp), "=r"(rax), "=r"(resume_rsp) 56 : "g"(0xABCD)); 57 report("test vmresume", (rax == 0xFFFF) && (rsp == resume_rsp)); 58 } 59 60 int vmenter_exit_handler() 61 { 62 u64 guest_rip; 63 ulong reason; 64 65 guest_rip = vmcs_read(GUEST_RIP); 66 reason = vmcs_read(EXI_REASON) & 0xff; 67 switch (reason) { 68 case VMX_VMCALL: 69 if (regs.rax != 0xABCD) { 70 report("test vmresume", 0); 71 return VMX_TEST_VMEXIT; 72 } 73 regs.rax = 0xFFFF; 74 vmcs_write(GUEST_RIP, guest_rip + 3); 75 return VMX_TEST_RESUME; 76 default: 77 report("test vmresume", 0); 78 print_vmexit_info(); 79 } 80 return VMX_TEST_VMEXIT; 81 } 82 83 u32 preempt_scale; 84 volatile unsigned long long tsc_val; 85 volatile u32 preempt_val; 86 u64 saved_rip; 87 88 int preemption_timer_init() 89 { 90 if (!(ctrl_pin_rev.clr & PIN_PREEMPT)) { 91 printf("\tPreemption timer is not supported\n"); 92 return VMX_TEST_EXIT; 93 } 94 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) | PIN_PREEMPT); 95 preempt_val = 10000000; 96 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 97 preempt_scale = rdmsr(MSR_IA32_VMX_MISC) & 0x1F; 98 99 if (!(ctrl_exit_rev.clr & EXI_SAVE_PREEMPT)) 100 printf("\tSave preemption value is not supported\n"); 101 102 return VMX_TEST_START; 103 } 104 105 void preemption_timer_main() 106 { 107 tsc_val = rdtsc(); 108 if (ctrl_exit_rev.clr & EXI_SAVE_PREEMPT) { 109 vmx_set_test_stage(0); 110 vmcall(); 111 if (vmx_get_test_stage() == 1) 112 vmcall(); 113 } 114 vmx_set_test_stage(1); 115 while (vmx_get_test_stage() == 1) { 116 if (((rdtsc() - tsc_val) >> preempt_scale) 117 > 10 * preempt_val) { 118 vmx_set_test_stage(2); 119 vmcall(); 120 } 121 } 122 tsc_val = rdtsc(); 123 asm volatile ("hlt"); 124 vmcall(); 125 vmx_set_test_stage(5); 126 vmcall(); 127 } 128 129 int preemption_timer_exit_handler() 130 { 131 bool guest_halted; 132 u64 guest_rip; 133 ulong reason; 134 u32 insn_len; 135 u32 ctrl_exit; 136 137 guest_rip = vmcs_read(GUEST_RIP); 138 reason = vmcs_read(EXI_REASON) & 0xff; 139 insn_len = vmcs_read(EXI_INST_LEN); 140 switch (reason) { 141 case VMX_PREEMPT: 142 switch (vmx_get_test_stage()) { 143 case 1: 144 case 2: 145 report("busy-wait for preemption timer", 146 ((rdtsc() - tsc_val) >> preempt_scale) >= 147 preempt_val); 148 vmx_set_test_stage(3); 149 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 150 return VMX_TEST_RESUME; 151 case 3: 152 guest_halted = 153 (vmcs_read(GUEST_ACTV_STATE) == ACTV_HLT); 154 report("preemption timer during hlt", 155 ((rdtsc() - tsc_val) >> preempt_scale) >= 156 preempt_val && guest_halted); 157 vmx_set_test_stage(4); 158 vmcs_write(PIN_CONTROLS, 159 vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT); 160 vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE); 161 return VMX_TEST_RESUME; 162 case 4: 163 report("preemption timer with 0 value", 164 saved_rip == guest_rip); 165 break; 166 default: 167 printf("Invalid stage.\n"); 168 print_vmexit_info(); 169 break; 170 } 171 break; 172 case VMX_VMCALL: 173 vmcs_write(GUEST_RIP, guest_rip + insn_len); 174 switch (vmx_get_test_stage()) { 175 case 0: 176 report("Keep preemption value", 177 vmcs_read(PREEMPT_TIMER_VALUE) == preempt_val); 178 vmx_set_test_stage(1); 179 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 180 ctrl_exit = (vmcs_read(EXI_CONTROLS) | 181 EXI_SAVE_PREEMPT) & ctrl_exit_rev.clr; 182 vmcs_write(EXI_CONTROLS, ctrl_exit); 183 return VMX_TEST_RESUME; 184 case 1: 185 report("Save preemption value", 186 vmcs_read(PREEMPT_TIMER_VALUE) < preempt_val); 187 return VMX_TEST_RESUME; 188 case 2: 189 report("busy-wait for preemption timer", 0); 190 vmx_set_test_stage(3); 191 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 192 return VMX_TEST_RESUME; 193 case 3: 194 report("preemption timer during hlt", 0); 195 vmx_set_test_stage(4); 196 /* fall through */ 197 case 4: 198 vmcs_write(PIN_CONTROLS, 199 vmcs_read(PIN_CONTROLS) | PIN_PREEMPT); 200 vmcs_write(PREEMPT_TIMER_VALUE, 0); 201 saved_rip = guest_rip + insn_len; 202 return VMX_TEST_RESUME; 203 case 5: 204 report("preemption timer with 0 value (vmcall stage 5)", 0); 205 break; 206 default: 207 // Should not reach here 208 printf("ERROR : unexpected stage, %d\n", 209 vmx_get_test_stage()); 210 print_vmexit_info(); 211 return VMX_TEST_VMEXIT; 212 } 213 break; 214 default: 215 printf("Unknown exit reason, %ld\n", reason); 216 print_vmexit_info(); 217 } 218 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT); 219 return VMX_TEST_VMEXIT; 220 } 221 222 void msr_bmp_init() 223 { 224 void *msr_bitmap; 225 u32 ctrl_cpu0; 226 227 msr_bitmap = alloc_page(); 228 memset(msr_bitmap, 0x0, PAGE_SIZE); 229 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 230 ctrl_cpu0 |= CPU_MSR_BITMAP; 231 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 232 vmcs_write(MSR_BITMAP, (u64)msr_bitmap); 233 } 234 235 static int test_ctrl_pat_init() 236 { 237 u64 ctrl_ent; 238 u64 ctrl_exi; 239 240 msr_bmp_init(); 241 if (!(ctrl_exit_rev.clr & EXI_SAVE_PAT) && 242 !(ctrl_exit_rev.clr & EXI_LOAD_PAT) && 243 !(ctrl_enter_rev.clr & ENT_LOAD_PAT)) { 244 printf("\tSave/load PAT is not supported\n"); 245 return 1; 246 } 247 248 ctrl_ent = vmcs_read(ENT_CONTROLS); 249 ctrl_exi = vmcs_read(EXI_CONTROLS); 250 ctrl_ent |= ctrl_enter_rev.clr & ENT_LOAD_PAT; 251 ctrl_exi |= ctrl_exit_rev.clr & (EXI_SAVE_PAT | EXI_LOAD_PAT); 252 vmcs_write(ENT_CONTROLS, ctrl_ent); 253 vmcs_write(EXI_CONTROLS, ctrl_exi); 254 ia32_pat = rdmsr(MSR_IA32_CR_PAT); 255 vmcs_write(GUEST_PAT, 0x0); 256 vmcs_write(HOST_PAT, ia32_pat); 257 return VMX_TEST_START; 258 } 259 260 static void test_ctrl_pat_main() 261 { 262 u64 guest_ia32_pat; 263 264 guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT); 265 if (!(ctrl_enter_rev.clr & ENT_LOAD_PAT)) 266 printf("\tENT_LOAD_PAT is not supported.\n"); 267 else { 268 if (guest_ia32_pat != 0) { 269 report("Entry load PAT", 0); 270 return; 271 } 272 } 273 wrmsr(MSR_IA32_CR_PAT, 0x6); 274 vmcall(); 275 guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT); 276 if (ctrl_enter_rev.clr & ENT_LOAD_PAT) 277 report("Entry load PAT", guest_ia32_pat == ia32_pat); 278 } 279 280 static int test_ctrl_pat_exit_handler() 281 { 282 u64 guest_rip; 283 ulong reason; 284 u64 guest_pat; 285 286 guest_rip = vmcs_read(GUEST_RIP); 287 reason = vmcs_read(EXI_REASON) & 0xff; 288 switch (reason) { 289 case VMX_VMCALL: 290 guest_pat = vmcs_read(GUEST_PAT); 291 if (!(ctrl_exit_rev.clr & EXI_SAVE_PAT)) { 292 printf("\tEXI_SAVE_PAT is not supported\n"); 293 vmcs_write(GUEST_PAT, 0x6); 294 } else { 295 report("Exit save PAT", guest_pat == 0x6); 296 } 297 if (!(ctrl_exit_rev.clr & EXI_LOAD_PAT)) 298 printf("\tEXI_LOAD_PAT is not supported\n"); 299 else 300 report("Exit load PAT", rdmsr(MSR_IA32_CR_PAT) == ia32_pat); 301 vmcs_write(GUEST_PAT, ia32_pat); 302 vmcs_write(GUEST_RIP, guest_rip + 3); 303 return VMX_TEST_RESUME; 304 default: 305 printf("ERROR : Undefined exit reason, reason = %ld.\n", reason); 306 break; 307 } 308 return VMX_TEST_VMEXIT; 309 } 310 311 static int test_ctrl_efer_init() 312 { 313 u64 ctrl_ent; 314 u64 ctrl_exi; 315 316 msr_bmp_init(); 317 ctrl_ent = vmcs_read(ENT_CONTROLS) | ENT_LOAD_EFER; 318 ctrl_exi = vmcs_read(EXI_CONTROLS) | EXI_SAVE_EFER | EXI_LOAD_EFER; 319 vmcs_write(ENT_CONTROLS, ctrl_ent & ctrl_enter_rev.clr); 320 vmcs_write(EXI_CONTROLS, ctrl_exi & ctrl_exit_rev.clr); 321 ia32_efer = rdmsr(MSR_EFER); 322 vmcs_write(GUEST_EFER, ia32_efer ^ EFER_NX); 323 vmcs_write(HOST_EFER, ia32_efer ^ EFER_NX); 324 return VMX_TEST_START; 325 } 326 327 static void test_ctrl_efer_main() 328 { 329 u64 guest_ia32_efer; 330 331 guest_ia32_efer = rdmsr(MSR_EFER); 332 if (!(ctrl_enter_rev.clr & ENT_LOAD_EFER)) 333 printf("\tENT_LOAD_EFER is not supported.\n"); 334 else { 335 if (guest_ia32_efer != (ia32_efer ^ EFER_NX)) { 336 report("Entry load EFER", 0); 337 return; 338 } 339 } 340 wrmsr(MSR_EFER, ia32_efer); 341 vmcall(); 342 guest_ia32_efer = rdmsr(MSR_EFER); 343 if (ctrl_enter_rev.clr & ENT_LOAD_EFER) 344 report("Entry load EFER", guest_ia32_efer == ia32_efer); 345 } 346 347 static int test_ctrl_efer_exit_handler() 348 { 349 u64 guest_rip; 350 ulong reason; 351 u64 guest_efer; 352 353 guest_rip = vmcs_read(GUEST_RIP); 354 reason = vmcs_read(EXI_REASON) & 0xff; 355 switch (reason) { 356 case VMX_VMCALL: 357 guest_efer = vmcs_read(GUEST_EFER); 358 if (!(ctrl_exit_rev.clr & EXI_SAVE_EFER)) { 359 printf("\tEXI_SAVE_EFER is not supported\n"); 360 vmcs_write(GUEST_EFER, ia32_efer); 361 } else { 362 report("Exit save EFER", guest_efer == ia32_efer); 363 } 364 if (!(ctrl_exit_rev.clr & EXI_LOAD_EFER)) { 365 printf("\tEXI_LOAD_EFER is not supported\n"); 366 wrmsr(MSR_EFER, ia32_efer ^ EFER_NX); 367 } else { 368 report("Exit load EFER", rdmsr(MSR_EFER) == (ia32_efer ^ EFER_NX)); 369 } 370 vmcs_write(GUEST_PAT, ia32_efer); 371 vmcs_write(GUEST_RIP, guest_rip + 3); 372 return VMX_TEST_RESUME; 373 default: 374 printf("ERROR : Undefined exit reason, reason = %ld.\n", reason); 375 break; 376 } 377 return VMX_TEST_VMEXIT; 378 } 379 380 u32 guest_cr0, guest_cr4; 381 382 static void cr_shadowing_main() 383 { 384 u32 cr0, cr4, tmp; 385 386 // Test read through 387 vmx_set_test_stage(0); 388 guest_cr0 = read_cr0(); 389 if (vmx_get_test_stage() == 1) 390 report("Read through CR0", 0); 391 else 392 vmcall(); 393 vmx_set_test_stage(1); 394 guest_cr4 = read_cr4(); 395 if (vmx_get_test_stage() == 2) 396 report("Read through CR4", 0); 397 else 398 vmcall(); 399 // Test write through 400 guest_cr0 = guest_cr0 ^ (X86_CR0_TS | X86_CR0_MP); 401 guest_cr4 = guest_cr4 ^ (X86_CR4_TSD | X86_CR4_DE); 402 vmx_set_test_stage(2); 403 write_cr0(guest_cr0); 404 if (vmx_get_test_stage() == 3) 405 report("Write throuth CR0", 0); 406 else 407 vmcall(); 408 vmx_set_test_stage(3); 409 write_cr4(guest_cr4); 410 if (vmx_get_test_stage() == 4) 411 report("Write through CR4", 0); 412 else 413 vmcall(); 414 // Test read shadow 415 vmx_set_test_stage(4); 416 vmcall(); 417 cr0 = read_cr0(); 418 if (vmx_get_test_stage() != 5) 419 report("Read shadowing CR0", cr0 == guest_cr0); 420 vmx_set_test_stage(5); 421 cr4 = read_cr4(); 422 if (vmx_get_test_stage() != 6) 423 report("Read shadowing CR4", cr4 == guest_cr4); 424 // Test write shadow (same value with shadow) 425 vmx_set_test_stage(6); 426 write_cr0(guest_cr0); 427 if (vmx_get_test_stage() == 7) 428 report("Write shadowing CR0 (same value with shadow)", 0); 429 else 430 vmcall(); 431 vmx_set_test_stage(7); 432 write_cr4(guest_cr4); 433 if (vmx_get_test_stage() == 8) 434 report("Write shadowing CR4 (same value with shadow)", 0); 435 else 436 vmcall(); 437 // Test write shadow (different value) 438 vmx_set_test_stage(8); 439 tmp = guest_cr0 ^ X86_CR0_TS; 440 asm volatile("mov %0, %%rsi\n\t" 441 "mov %%rsi, %%cr0\n\t" 442 ::"m"(tmp) 443 :"rsi", "memory", "cc"); 444 report("Write shadowing different X86_CR0_TS", vmx_get_test_stage() == 9); 445 vmx_set_test_stage(9); 446 tmp = guest_cr0 ^ X86_CR0_MP; 447 asm volatile("mov %0, %%rsi\n\t" 448 "mov %%rsi, %%cr0\n\t" 449 ::"m"(tmp) 450 :"rsi", "memory", "cc"); 451 report("Write shadowing different X86_CR0_MP", vmx_get_test_stage() == 10); 452 vmx_set_test_stage(10); 453 tmp = guest_cr4 ^ X86_CR4_TSD; 454 asm volatile("mov %0, %%rsi\n\t" 455 "mov %%rsi, %%cr4\n\t" 456 ::"m"(tmp) 457 :"rsi", "memory", "cc"); 458 report("Write shadowing different X86_CR4_TSD", vmx_get_test_stage() == 11); 459 vmx_set_test_stage(11); 460 tmp = guest_cr4 ^ X86_CR4_DE; 461 asm volatile("mov %0, %%rsi\n\t" 462 "mov %%rsi, %%cr4\n\t" 463 ::"m"(tmp) 464 :"rsi", "memory", "cc"); 465 report("Write shadowing different X86_CR4_DE", vmx_get_test_stage() == 12); 466 } 467 468 static int cr_shadowing_exit_handler() 469 { 470 u64 guest_rip; 471 ulong reason; 472 u32 insn_len; 473 u32 exit_qual; 474 475 guest_rip = vmcs_read(GUEST_RIP); 476 reason = vmcs_read(EXI_REASON) & 0xff; 477 insn_len = vmcs_read(EXI_INST_LEN); 478 exit_qual = vmcs_read(EXI_QUALIFICATION); 479 switch (reason) { 480 case VMX_VMCALL: 481 switch (vmx_get_test_stage()) { 482 case 0: 483 report("Read through CR0", guest_cr0 == vmcs_read(GUEST_CR0)); 484 break; 485 case 1: 486 report("Read through CR4", guest_cr4 == vmcs_read(GUEST_CR4)); 487 break; 488 case 2: 489 report("Write through CR0", guest_cr0 == vmcs_read(GUEST_CR0)); 490 break; 491 case 3: 492 report("Write through CR4", guest_cr4 == vmcs_read(GUEST_CR4)); 493 break; 494 case 4: 495 guest_cr0 = vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP); 496 guest_cr4 = vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE); 497 vmcs_write(CR0_MASK, X86_CR0_TS | X86_CR0_MP); 498 vmcs_write(CR0_READ_SHADOW, guest_cr0 & (X86_CR0_TS | X86_CR0_MP)); 499 vmcs_write(CR4_MASK, X86_CR4_TSD | X86_CR4_DE); 500 vmcs_write(CR4_READ_SHADOW, guest_cr4 & (X86_CR4_TSD | X86_CR4_DE)); 501 break; 502 case 6: 503 report("Write shadowing CR0 (same value)", 504 guest_cr0 == (vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP))); 505 break; 506 case 7: 507 report("Write shadowing CR4 (same value)", 508 guest_cr4 == (vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE))); 509 break; 510 default: 511 // Should not reach here 512 printf("ERROR : unexpected stage, %d\n", 513 vmx_get_test_stage()); 514 print_vmexit_info(); 515 return VMX_TEST_VMEXIT; 516 } 517 vmcs_write(GUEST_RIP, guest_rip + insn_len); 518 return VMX_TEST_RESUME; 519 case VMX_CR: 520 switch (vmx_get_test_stage()) { 521 case 4: 522 report("Read shadowing CR0", 0); 523 vmx_inc_test_stage(); 524 break; 525 case 5: 526 report("Read shadowing CR4", 0); 527 vmx_inc_test_stage(); 528 break; 529 case 6: 530 report("Write shadowing CR0 (same value)", 0); 531 vmx_inc_test_stage(); 532 break; 533 case 7: 534 report("Write shadowing CR4 (same value)", 0); 535 vmx_inc_test_stage(); 536 break; 537 case 8: 538 case 9: 539 // 0x600 encodes "mov %esi, %cr0" 540 if (exit_qual == 0x600) 541 vmx_inc_test_stage(); 542 break; 543 case 10: 544 case 11: 545 // 0x604 encodes "mov %esi, %cr4" 546 if (exit_qual == 0x604) 547 vmx_inc_test_stage(); 548 break; 549 default: 550 // Should not reach here 551 printf("ERROR : unexpected stage, %d\n", 552 vmx_get_test_stage()); 553 print_vmexit_info(); 554 return VMX_TEST_VMEXIT; 555 } 556 vmcs_write(GUEST_RIP, guest_rip + insn_len); 557 return VMX_TEST_RESUME; 558 default: 559 printf("Unknown exit reason, %ld\n", reason); 560 print_vmexit_info(); 561 } 562 return VMX_TEST_VMEXIT; 563 } 564 565 static int iobmp_init() 566 { 567 u32 ctrl_cpu0; 568 569 io_bitmap_a = alloc_page(); 570 io_bitmap_b = alloc_page(); 571 memset(io_bitmap_a, 0x0, PAGE_SIZE); 572 memset(io_bitmap_b, 0x0, PAGE_SIZE); 573 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 574 ctrl_cpu0 |= CPU_IO_BITMAP; 575 ctrl_cpu0 &= (~CPU_IO); 576 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 577 vmcs_write(IO_BITMAP_A, (u64)io_bitmap_a); 578 vmcs_write(IO_BITMAP_B, (u64)io_bitmap_b); 579 return VMX_TEST_START; 580 } 581 582 static void iobmp_main() 583 { 584 // stage 0, test IO pass 585 vmx_set_test_stage(0); 586 inb(0x5000); 587 outb(0x0, 0x5000); 588 report("I/O bitmap - I/O pass", vmx_get_test_stage() == 0); 589 // test IO width, in/out 590 ((u8 *)io_bitmap_a)[0] = 0xFF; 591 vmx_set_test_stage(2); 592 inb(0x0); 593 report("I/O bitmap - trap in", vmx_get_test_stage() == 3); 594 vmx_set_test_stage(3); 595 outw(0x0, 0x0); 596 report("I/O bitmap - trap out", vmx_get_test_stage() == 4); 597 vmx_set_test_stage(4); 598 inl(0x0); 599 report("I/O bitmap - I/O width, long", vmx_get_test_stage() == 5); 600 // test low/high IO port 601 vmx_set_test_stage(5); 602 ((u8 *)io_bitmap_a)[0x5000 / 8] = (1 << (0x5000 % 8)); 603 inb(0x5000); 604 report("I/O bitmap - I/O port, low part", vmx_get_test_stage() == 6); 605 vmx_set_test_stage(6); 606 ((u8 *)io_bitmap_b)[0x1000 / 8] = (1 << (0x1000 % 8)); 607 inb(0x9000); 608 report("I/O bitmap - I/O port, high part", vmx_get_test_stage() == 7); 609 // test partial pass 610 vmx_set_test_stage(7); 611 inl(0x4FFF); 612 report("I/O bitmap - partial pass", vmx_get_test_stage() == 8); 613 // test overrun 614 vmx_set_test_stage(8); 615 memset(io_bitmap_a, 0x0, PAGE_SIZE); 616 memset(io_bitmap_b, 0x0, PAGE_SIZE); 617 inl(0xFFFF); 618 report("I/O bitmap - overrun", vmx_get_test_stage() == 9); 619 vmx_set_test_stage(9); 620 vmcall(); 621 outb(0x0, 0x0); 622 report("I/O bitmap - ignore unconditional exiting", 623 vmx_get_test_stage() == 9); 624 vmx_set_test_stage(10); 625 vmcall(); 626 outb(0x0, 0x0); 627 report("I/O bitmap - unconditional exiting", 628 vmx_get_test_stage() == 11); 629 } 630 631 static int iobmp_exit_handler() 632 { 633 u64 guest_rip; 634 ulong reason, exit_qual; 635 u32 insn_len, ctrl_cpu0; 636 637 guest_rip = vmcs_read(GUEST_RIP); 638 reason = vmcs_read(EXI_REASON) & 0xff; 639 exit_qual = vmcs_read(EXI_QUALIFICATION); 640 insn_len = vmcs_read(EXI_INST_LEN); 641 switch (reason) { 642 case VMX_IO: 643 switch (vmx_get_test_stage()) { 644 case 0: 645 case 1: 646 vmx_inc_test_stage(); 647 break; 648 case 2: 649 report("I/O bitmap - I/O width, byte", 650 (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_BYTE); 651 report("I/O bitmap - I/O direction, in", exit_qual & VMX_IO_IN); 652 vmx_inc_test_stage(); 653 break; 654 case 3: 655 report("I/O bitmap - I/O width, word", 656 (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_WORD); 657 report("I/O bitmap - I/O direction, out", 658 !(exit_qual & VMX_IO_IN)); 659 vmx_inc_test_stage(); 660 break; 661 case 4: 662 report("I/O bitmap - I/O width, long", 663 (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_LONG); 664 vmx_inc_test_stage(); 665 break; 666 case 5: 667 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x5000) 668 vmx_inc_test_stage(); 669 break; 670 case 6: 671 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x9000) 672 vmx_inc_test_stage(); 673 break; 674 case 7: 675 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x4FFF) 676 vmx_inc_test_stage(); 677 break; 678 case 8: 679 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0xFFFF) 680 vmx_inc_test_stage(); 681 break; 682 case 9: 683 case 10: 684 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 685 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0 & ~CPU_IO); 686 vmx_inc_test_stage(); 687 break; 688 default: 689 // Should not reach here 690 printf("ERROR : unexpected stage, %d\n", 691 vmx_get_test_stage()); 692 print_vmexit_info(); 693 return VMX_TEST_VMEXIT; 694 } 695 vmcs_write(GUEST_RIP, guest_rip + insn_len); 696 return VMX_TEST_RESUME; 697 case VMX_VMCALL: 698 switch (vmx_get_test_stage()) { 699 case 9: 700 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 701 ctrl_cpu0 |= CPU_IO | CPU_IO_BITMAP; 702 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 703 break; 704 case 10: 705 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 706 ctrl_cpu0 = (ctrl_cpu0 & ~CPU_IO_BITMAP) | CPU_IO; 707 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 708 break; 709 default: 710 // Should not reach here 711 printf("ERROR : unexpected stage, %d\n", 712 vmx_get_test_stage()); 713 print_vmexit_info(); 714 return VMX_TEST_VMEXIT; 715 } 716 vmcs_write(GUEST_RIP, guest_rip + insn_len); 717 return VMX_TEST_RESUME; 718 default: 719 printf("guest_rip = 0x%lx\n", guest_rip); 720 printf("\tERROR : Undefined exit reason, reason = %ld.\n", reason); 721 break; 722 } 723 return VMX_TEST_VMEXIT; 724 } 725 726 #define INSN_CPU0 0 727 #define INSN_CPU1 1 728 #define INSN_ALWAYS_TRAP 2 729 730 #define FIELD_EXIT_QUAL (1 << 0) 731 #define FIELD_INSN_INFO (1 << 1) 732 733 asm( 734 "insn_hlt: hlt;ret\n\t" 735 "insn_invlpg: invlpg 0x12345678;ret\n\t" 736 "insn_mwait: xor %eax, %eax; xor %ecx, %ecx; mwait;ret\n\t" 737 "insn_rdpmc: xor %ecx, %ecx; rdpmc;ret\n\t" 738 "insn_rdtsc: rdtsc;ret\n\t" 739 "insn_cr3_load: mov cr3,%rax; mov %rax,%cr3;ret\n\t" 740 "insn_cr3_store: mov %cr3,%rax;ret\n\t" 741 #ifdef __x86_64__ 742 "insn_cr8_load: mov %rax,%cr8;ret\n\t" 743 "insn_cr8_store: mov %cr8,%rax;ret\n\t" 744 #endif 745 "insn_monitor: xor %eax, %eax; xor %ecx, %ecx; xor %edx, %edx; monitor;ret\n\t" 746 "insn_pause: pause;ret\n\t" 747 "insn_wbinvd: wbinvd;ret\n\t" 748 "insn_cpuid: mov $10, %eax; cpuid;ret\n\t" 749 "insn_invd: invd;ret\n\t" 750 "insn_sgdt: sgdt gdt64_desc;ret\n\t" 751 "insn_lgdt: lgdt gdt64_desc;ret\n\t" 752 "insn_sidt: sidt idt_descr;ret\n\t" 753 "insn_lidt: lidt idt_descr;ret\n\t" 754 "insn_sldt: sldt %ax;ret\n\t" 755 "insn_lldt: xor %eax, %eax; lldt %ax;ret\n\t" 756 "insn_str: str %ax;ret\n\t" 757 ); 758 extern void insn_hlt(); 759 extern void insn_invlpg(); 760 extern void insn_mwait(); 761 extern void insn_rdpmc(); 762 extern void insn_rdtsc(); 763 extern void insn_cr3_load(); 764 extern void insn_cr3_store(); 765 #ifdef __x86_64__ 766 extern void insn_cr8_load(); 767 extern void insn_cr8_store(); 768 #endif 769 extern void insn_monitor(); 770 extern void insn_pause(); 771 extern void insn_wbinvd(); 772 extern void insn_sgdt(); 773 extern void insn_lgdt(); 774 extern void insn_sidt(); 775 extern void insn_lidt(); 776 extern void insn_sldt(); 777 extern void insn_lldt(); 778 extern void insn_str(); 779 extern void insn_cpuid(); 780 extern void insn_invd(); 781 782 u32 cur_insn; 783 u64 cr3; 784 785 struct insn_table { 786 const char *name; 787 u32 flag; 788 void (*insn_func)(); 789 u32 type; 790 u32 reason; 791 ulong exit_qual; 792 u32 insn_info; 793 // Use FIELD_EXIT_QUAL and FIELD_INSN_INFO to define 794 // which field need to be tested, reason is always tested 795 u32 test_field; 796 }; 797 798 /* 799 * Add more test cases of instruction intercept here. Elements in this 800 * table is: 801 * name/control flag/insn function/type/exit reason/exit qulification/ 802 * instruction info/field to test 803 * The last field defines which fields (exit_qual and insn_info) need to be 804 * tested in exit handler. If set to 0, only "reason" is checked. 805 */ 806 static struct insn_table insn_table[] = { 807 // Flags for Primary Processor-Based VM-Execution Controls 808 {"HLT", CPU_HLT, insn_hlt, INSN_CPU0, 12, 0, 0, 0}, 809 {"INVLPG", CPU_INVLPG, insn_invlpg, INSN_CPU0, 14, 810 0x12345678, 0, FIELD_EXIT_QUAL}, 811 {"MWAIT", CPU_MWAIT, insn_mwait, INSN_CPU0, 36, 0, 0, 0}, 812 {"RDPMC", CPU_RDPMC, insn_rdpmc, INSN_CPU0, 15, 0, 0, 0}, 813 {"RDTSC", CPU_RDTSC, insn_rdtsc, INSN_CPU0, 16, 0, 0, 0}, 814 {"CR3 load", CPU_CR3_LOAD, insn_cr3_load, INSN_CPU0, 28, 0x3, 0, 815 FIELD_EXIT_QUAL}, 816 {"CR3 store", CPU_CR3_STORE, insn_cr3_store, INSN_CPU0, 28, 0x13, 0, 817 FIELD_EXIT_QUAL}, 818 #ifdef __x86_64__ 819 {"CR8 load", CPU_CR8_LOAD, insn_cr8_load, INSN_CPU0, 28, 0x8, 0, 820 FIELD_EXIT_QUAL}, 821 {"CR8 store", CPU_CR8_STORE, insn_cr8_store, INSN_CPU0, 28, 0x18, 0, 822 FIELD_EXIT_QUAL}, 823 #endif 824 {"MONITOR", CPU_MONITOR, insn_monitor, INSN_CPU0, 39, 0, 0, 0}, 825 {"PAUSE", CPU_PAUSE, insn_pause, INSN_CPU0, 40, 0, 0, 0}, 826 // Flags for Secondary Processor-Based VM-Execution Controls 827 {"WBINVD", CPU_WBINVD, insn_wbinvd, INSN_CPU1, 54, 0, 0, 0}, 828 {"DESC_TABLE (SGDT)", CPU_DESC_TABLE, insn_sgdt, INSN_CPU1, 46, 0, 0, 0}, 829 {"DESC_TABLE (LGDT)", CPU_DESC_TABLE, insn_lgdt, INSN_CPU1, 46, 0, 0, 0}, 830 {"DESC_TABLE (SIDT)", CPU_DESC_TABLE, insn_sidt, INSN_CPU1, 46, 0, 0, 0}, 831 {"DESC_TABLE (LIDT)", CPU_DESC_TABLE, insn_lidt, INSN_CPU1, 46, 0, 0, 0}, 832 {"DESC_TABLE (SLDT)", CPU_DESC_TABLE, insn_sldt, INSN_CPU1, 47, 0, 0, 0}, 833 {"DESC_TABLE (LLDT)", CPU_DESC_TABLE, insn_lldt, INSN_CPU1, 47, 0, 0, 0}, 834 {"DESC_TABLE (STR)", CPU_DESC_TABLE, insn_str, INSN_CPU1, 47, 0, 0, 0}, 835 /* LTR causes a #GP if done with a busy selector, so it is not tested. */ 836 // Instructions always trap 837 {"CPUID", 0, insn_cpuid, INSN_ALWAYS_TRAP, 10, 0, 0, 0}, 838 {"INVD", 0, insn_invd, INSN_ALWAYS_TRAP, 13, 0, 0, 0}, 839 // Instructions never trap 840 {NULL}, 841 }; 842 843 static int insn_intercept_init() 844 { 845 u32 ctrl_cpu; 846 847 ctrl_cpu = ctrl_cpu_rev[0].set | CPU_SECONDARY; 848 ctrl_cpu &= ctrl_cpu_rev[0].clr; 849 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu); 850 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu_rev[1].set); 851 cr3 = read_cr3(); 852 return VMX_TEST_START; 853 } 854 855 static void insn_intercept_main() 856 { 857 for (cur_insn = 0; insn_table[cur_insn].name != NULL; cur_insn++) { 858 vmx_set_test_stage(cur_insn * 2); 859 if ((insn_table[cur_insn].type == INSN_CPU0 && 860 !(ctrl_cpu_rev[0].clr & insn_table[cur_insn].flag)) || 861 (insn_table[cur_insn].type == INSN_CPU1 && 862 !(ctrl_cpu_rev[1].clr & insn_table[cur_insn].flag))) { 863 printf("\tCPU_CTRL%d.CPU_%s is not supported.\n", 864 insn_table[cur_insn].type - INSN_CPU0, 865 insn_table[cur_insn].name); 866 continue; 867 } 868 869 if ((insn_table[cur_insn].type == INSN_CPU0 && 870 !(ctrl_cpu_rev[0].set & insn_table[cur_insn].flag)) || 871 (insn_table[cur_insn].type == INSN_CPU1 && 872 !(ctrl_cpu_rev[1].set & insn_table[cur_insn].flag))) { 873 /* skip hlt, it stalls the guest and is tested below */ 874 if (insn_table[cur_insn].insn_func != insn_hlt) 875 insn_table[cur_insn].insn_func(); 876 report("execute %s", vmx_get_test_stage() == cur_insn * 2, 877 insn_table[cur_insn].name); 878 } else if (insn_table[cur_insn].type != INSN_ALWAYS_TRAP) 879 printf("\tCPU_CTRL%d.CPU_%s always traps.\n", 880 insn_table[cur_insn].type - INSN_CPU0, 881 insn_table[cur_insn].name); 882 883 vmcall(); 884 885 insn_table[cur_insn].insn_func(); 886 report("intercept %s", vmx_get_test_stage() == cur_insn * 2 + 1, 887 insn_table[cur_insn].name); 888 889 vmx_set_test_stage(cur_insn * 2 + 1); 890 vmcall(); 891 } 892 } 893 894 static int insn_intercept_exit_handler() 895 { 896 u64 guest_rip; 897 u32 reason; 898 ulong exit_qual; 899 u32 insn_len; 900 u32 insn_info; 901 bool pass; 902 903 guest_rip = vmcs_read(GUEST_RIP); 904 reason = vmcs_read(EXI_REASON) & 0xff; 905 exit_qual = vmcs_read(EXI_QUALIFICATION); 906 insn_len = vmcs_read(EXI_INST_LEN); 907 insn_info = vmcs_read(EXI_INST_INFO); 908 909 if (reason == VMX_VMCALL) { 910 u32 val = 0; 911 912 if (insn_table[cur_insn].type == INSN_CPU0) 913 val = vmcs_read(CPU_EXEC_CTRL0); 914 else if (insn_table[cur_insn].type == INSN_CPU1) 915 val = vmcs_read(CPU_EXEC_CTRL1); 916 917 if (vmx_get_test_stage() & 1) 918 val &= ~insn_table[cur_insn].flag; 919 else 920 val |= insn_table[cur_insn].flag; 921 922 if (insn_table[cur_insn].type == INSN_CPU0) 923 vmcs_write(CPU_EXEC_CTRL0, val | ctrl_cpu_rev[0].set); 924 else if (insn_table[cur_insn].type == INSN_CPU1) 925 vmcs_write(CPU_EXEC_CTRL1, val | ctrl_cpu_rev[1].set); 926 } else { 927 pass = (cur_insn * 2 == vmx_get_test_stage()) && 928 insn_table[cur_insn].reason == reason; 929 if (insn_table[cur_insn].test_field & FIELD_EXIT_QUAL && 930 insn_table[cur_insn].exit_qual != exit_qual) 931 pass = false; 932 if (insn_table[cur_insn].test_field & FIELD_INSN_INFO && 933 insn_table[cur_insn].insn_info != insn_info) 934 pass = false; 935 if (pass) 936 vmx_inc_test_stage(); 937 } 938 vmcs_write(GUEST_RIP, guest_rip + insn_len); 939 return VMX_TEST_RESUME; 940 } 941 942 943 /* Enables EPT and sets up the identity map. */ 944 static int setup_ept(bool enable_ad) 945 { 946 unsigned long end_of_memory; 947 u32 ctrl_cpu[2]; 948 949 if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) || 950 !(ctrl_cpu_rev[1].clr & CPU_EPT)) { 951 printf("\tEPT is not supported"); 952 return 1; 953 } 954 955 956 if (!(ept_vpid.val & EPT_CAP_UC) && 957 !(ept_vpid.val & EPT_CAP_WB)) { 958 printf("\tEPT paging-structure memory type " 959 "UC&WB are not supported\n"); 960 return 1; 961 } 962 if (ept_vpid.val & EPT_CAP_UC) 963 eptp = EPT_MEM_TYPE_UC; 964 else 965 eptp = EPT_MEM_TYPE_WB; 966 if (!(ept_vpid.val & EPT_CAP_PWL4)) { 967 printf("\tPWL4 is not supported\n"); 968 return 1; 969 } 970 ctrl_cpu[0] = vmcs_read(CPU_EXEC_CTRL0); 971 ctrl_cpu[1] = vmcs_read(CPU_EXEC_CTRL1); 972 ctrl_cpu[0] = (ctrl_cpu[0] | CPU_SECONDARY) 973 & ctrl_cpu_rev[0].clr; 974 ctrl_cpu[1] = (ctrl_cpu[1] | CPU_EPT) 975 & ctrl_cpu_rev[1].clr; 976 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu[0]); 977 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu[1]); 978 eptp |= (3 << EPTP_PG_WALK_LEN_SHIFT); 979 pml4 = alloc_page(); 980 memset(pml4, 0, PAGE_SIZE); 981 eptp |= virt_to_phys(pml4); 982 if (enable_ad) 983 eptp |= EPTP_AD_FLAG; 984 vmcs_write(EPTP, eptp); 985 end_of_memory = fwcfg_get_u64(FW_CFG_RAM_SIZE); 986 if (end_of_memory < (1ul << 32)) 987 end_of_memory = (1ul << 32); 988 /* Cannot use large EPT pages if we need to track EPT 989 * accessed/dirty bits at 4K granularity. 990 */ 991 setup_ept_range(pml4, 0, end_of_memory, 0, 992 !enable_ad && ept_2m_supported(), 993 EPT_WA | EPT_RA | EPT_EA); 994 return 0; 995 } 996 997 static void ept_enable_ad_bits(void) 998 { 999 eptp |= EPTP_AD_FLAG; 1000 vmcs_write(EPTP, eptp); 1001 } 1002 1003 static void ept_disable_ad_bits(void) 1004 { 1005 eptp &= ~EPTP_AD_FLAG; 1006 vmcs_write(EPTP, eptp); 1007 } 1008 1009 static void ept_enable_ad_bits_or_skip_test(void) 1010 { 1011 if (!ept_ad_bits_supported()) 1012 test_skip("EPT AD bits not supported."); 1013 ept_enable_ad_bits(); 1014 } 1015 1016 static int apic_version; 1017 1018 static int ept_init_common(bool have_ad) 1019 { 1020 if (setup_ept(have_ad)) 1021 return VMX_TEST_EXIT; 1022 data_page1 = alloc_page(); 1023 data_page2 = alloc_page(); 1024 memset(data_page1, 0x0, PAGE_SIZE); 1025 memset(data_page2, 0x0, PAGE_SIZE); 1026 *((u32 *)data_page1) = MAGIC_VAL_1; 1027 *((u32 *)data_page2) = MAGIC_VAL_2; 1028 install_ept(pml4, (unsigned long)data_page1, (unsigned long)data_page2, 1029 EPT_RA | EPT_WA | EPT_EA); 1030 1031 apic_version = *((u32 *)0xfee00030UL); 1032 return VMX_TEST_START; 1033 } 1034 1035 static int ept_init() 1036 { 1037 return ept_init_common(false); 1038 } 1039 1040 static void ept_common() 1041 { 1042 vmx_set_test_stage(0); 1043 if (*((u32 *)data_page2) != MAGIC_VAL_1 || 1044 *((u32 *)data_page1) != MAGIC_VAL_1) 1045 report("EPT basic framework - read", 0); 1046 else { 1047 *((u32 *)data_page2) = MAGIC_VAL_3; 1048 vmcall(); 1049 if (vmx_get_test_stage() == 1) { 1050 if (*((u32 *)data_page1) == MAGIC_VAL_3 && 1051 *((u32 *)data_page2) == MAGIC_VAL_2) 1052 report("EPT basic framework", 1); 1053 else 1054 report("EPT basic framework - remap", 1); 1055 } 1056 } 1057 // Test EPT Misconfigurations 1058 vmx_set_test_stage(1); 1059 vmcall(); 1060 *((u32 *)data_page1) = MAGIC_VAL_1; 1061 if (vmx_get_test_stage() != 2) { 1062 report("EPT misconfigurations", 0); 1063 goto t1; 1064 } 1065 vmx_set_test_stage(2); 1066 vmcall(); 1067 *((u32 *)data_page1) = MAGIC_VAL_1; 1068 report("EPT misconfigurations", vmx_get_test_stage() == 3); 1069 t1: 1070 // Test EPT violation 1071 vmx_set_test_stage(3); 1072 vmcall(); 1073 *((u32 *)data_page1) = MAGIC_VAL_1; 1074 report("EPT violation - page permission", vmx_get_test_stage() == 4); 1075 // Violation caused by EPT paging structure 1076 vmx_set_test_stage(4); 1077 vmcall(); 1078 *((u32 *)data_page1) = MAGIC_VAL_2; 1079 report("EPT violation - paging structure", vmx_get_test_stage() == 5); 1080 } 1081 1082 static void ept_main() 1083 { 1084 ept_common(); 1085 1086 // Test EPT access to L1 MMIO 1087 vmx_set_test_stage(6); 1088 report("EPT - MMIO access", *((u32 *)0xfee00030UL) == apic_version); 1089 1090 // Test invalid operand for INVEPT 1091 vmcall(); 1092 report("EPT - unsupported INVEPT", vmx_get_test_stage() == 7); 1093 } 1094 1095 bool invept_test(int type, u64 eptp) 1096 { 1097 bool ret, supported; 1098 1099 supported = ept_vpid.val & (EPT_CAP_INVEPT_SINGLE >> INVEPT_SINGLE << type); 1100 ret = invept(type, eptp); 1101 1102 if (ret == !supported) 1103 return false; 1104 1105 if (!supported) 1106 printf("WARNING: unsupported invept passed!\n"); 1107 else 1108 printf("WARNING: invept failed!\n"); 1109 1110 return true; 1111 } 1112 1113 static int ept_exit_handler_common(bool have_ad) 1114 { 1115 u64 guest_rip; 1116 u64 guest_cr3; 1117 ulong reason; 1118 u32 insn_len; 1119 u32 exit_qual; 1120 static unsigned long data_page1_pte, data_page1_pte_pte; 1121 1122 guest_rip = vmcs_read(GUEST_RIP); 1123 guest_cr3 = vmcs_read(GUEST_CR3); 1124 reason = vmcs_read(EXI_REASON) & 0xff; 1125 insn_len = vmcs_read(EXI_INST_LEN); 1126 exit_qual = vmcs_read(EXI_QUALIFICATION); 1127 switch (reason) { 1128 case VMX_VMCALL: 1129 switch (vmx_get_test_stage()) { 1130 case 0: 1131 check_ept_ad(pml4, guest_cr3, 1132 (unsigned long)data_page1, 1133 have_ad ? EPT_ACCESS_FLAG : 0, 1134 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1135 check_ept_ad(pml4, guest_cr3, 1136 (unsigned long)data_page2, 1137 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0, 1138 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1139 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1140 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page2); 1141 if (have_ad) 1142 ept_sync(INVEPT_SINGLE, eptp);; 1143 if (*((u32 *)data_page1) == MAGIC_VAL_3 && 1144 *((u32 *)data_page2) == MAGIC_VAL_2) { 1145 vmx_inc_test_stage(); 1146 install_ept(pml4, (unsigned long)data_page2, 1147 (unsigned long)data_page2, 1148 EPT_RA | EPT_WA | EPT_EA); 1149 } else 1150 report("EPT basic framework - write", 0); 1151 break; 1152 case 1: 1153 install_ept(pml4, (unsigned long)data_page1, 1154 (unsigned long)data_page1, EPT_WA); 1155 ept_sync(INVEPT_SINGLE, eptp); 1156 break; 1157 case 2: 1158 install_ept(pml4, (unsigned long)data_page1, 1159 (unsigned long)data_page1, 1160 EPT_RA | EPT_WA | EPT_EA | 1161 (2 << EPT_MEM_TYPE_SHIFT)); 1162 ept_sync(INVEPT_SINGLE, eptp); 1163 break; 1164 case 3: 1165 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1166 data_page1_pte = get_ept_pte(pml4, 1167 (unsigned long)data_page1, 1); 1168 set_ept_pte(pml4, (unsigned long)data_page1, 1169 1, data_page1_pte & ~EPT_PRESENT); 1170 ept_sync(INVEPT_SINGLE, eptp); 1171 break; 1172 case 4: 1173 data_page1_pte = get_ept_pte(pml4, 1174 (unsigned long)data_page1, 2); 1175 data_page1_pte &= PAGE_MASK; 1176 data_page1_pte_pte = get_ept_pte(pml4, data_page1_pte, 2); 1177 set_ept_pte(pml4, data_page1_pte, 2, 1178 data_page1_pte_pte & ~EPT_PRESENT); 1179 ept_sync(INVEPT_SINGLE, eptp); 1180 break; 1181 case 6: 1182 if (!invept_test(0, eptp)) 1183 vmx_inc_test_stage(); 1184 break; 1185 // Should not reach here 1186 default: 1187 printf("ERROR - unexpected stage, %d.\n", 1188 vmx_get_test_stage()); 1189 print_vmexit_info(); 1190 return VMX_TEST_VMEXIT; 1191 } 1192 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1193 return VMX_TEST_RESUME; 1194 case VMX_EPT_MISCONFIG: 1195 switch (vmx_get_test_stage()) { 1196 case 1: 1197 case 2: 1198 vmx_inc_test_stage(); 1199 install_ept(pml4, (unsigned long)data_page1, 1200 (unsigned long)data_page1, 1201 EPT_RA | EPT_WA | EPT_EA); 1202 ept_sync(INVEPT_SINGLE, eptp); 1203 break; 1204 // Should not reach here 1205 default: 1206 printf("ERROR - unexpected stage, %d.\n", 1207 vmx_get_test_stage()); 1208 print_vmexit_info(); 1209 return VMX_TEST_VMEXIT; 1210 } 1211 return VMX_TEST_RESUME; 1212 case VMX_EPT_VIOLATION: 1213 switch(vmx_get_test_stage()) { 1214 case 3: 1215 check_ept_ad(pml4, guest_cr3, (unsigned long)data_page1, 0, 1216 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1217 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1218 if (exit_qual == (EPT_VLT_WR | EPT_VLT_LADDR_VLD | 1219 EPT_VLT_PADDR)) 1220 vmx_inc_test_stage(); 1221 set_ept_pte(pml4, (unsigned long)data_page1, 1222 1, data_page1_pte | (EPT_PRESENT)); 1223 ept_sync(INVEPT_SINGLE, eptp); 1224 break; 1225 case 4: 1226 check_ept_ad(pml4, guest_cr3, (unsigned long)data_page1, 0, 1227 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1228 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1229 if (exit_qual == (EPT_VLT_RD | 1230 (have_ad ? EPT_VLT_WR : 0) | 1231 EPT_VLT_LADDR_VLD)) 1232 vmx_inc_test_stage(); 1233 set_ept_pte(pml4, data_page1_pte, 2, 1234 data_page1_pte_pte | (EPT_PRESENT)); 1235 ept_sync(INVEPT_SINGLE, eptp); 1236 break; 1237 default: 1238 // Should not reach here 1239 printf("ERROR : unexpected stage, %d\n", 1240 vmx_get_test_stage()); 1241 print_vmexit_info(); 1242 return VMX_TEST_VMEXIT; 1243 } 1244 return VMX_TEST_RESUME; 1245 default: 1246 printf("Unknown exit reason, %ld\n", reason); 1247 print_vmexit_info(); 1248 } 1249 return VMX_TEST_VMEXIT; 1250 } 1251 1252 static int ept_exit_handler() 1253 { 1254 return ept_exit_handler_common(false); 1255 } 1256 1257 static int eptad_init() 1258 { 1259 int r = ept_init_common(true); 1260 1261 if (r == VMX_TEST_EXIT) 1262 return r; 1263 1264 if ((rdmsr(MSR_IA32_VMX_EPT_VPID_CAP) & EPT_CAP_AD_FLAG) == 0) { 1265 printf("\tEPT A/D bits are not supported"); 1266 return VMX_TEST_EXIT; 1267 } 1268 1269 return r; 1270 } 1271 1272 static void eptad_main() 1273 { 1274 ept_common(); 1275 } 1276 1277 static int eptad_exit_handler() 1278 { 1279 return ept_exit_handler_common(true); 1280 } 1281 1282 bool invvpid_test(int type, u16 vpid) 1283 { 1284 bool ret, supported; 1285 1286 supported = ept_vpid.val & (VPID_CAP_INVVPID_SINGLE >> INVVPID_SINGLE << type); 1287 ret = invvpid(type, vpid, 0); 1288 1289 if (ret == !supported) 1290 return false; 1291 1292 if (!supported) 1293 printf("WARNING: unsupported invvpid passed!\n"); 1294 else 1295 printf("WARNING: invvpid failed!\n"); 1296 1297 return true; 1298 } 1299 1300 static int vpid_init() 1301 { 1302 u32 ctrl_cpu1; 1303 1304 if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) || 1305 !(ctrl_cpu_rev[1].clr & CPU_VPID)) { 1306 printf("\tVPID is not supported"); 1307 return VMX_TEST_EXIT; 1308 } 1309 1310 ctrl_cpu1 = vmcs_read(CPU_EXEC_CTRL1); 1311 ctrl_cpu1 |= CPU_VPID; 1312 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu1); 1313 return VMX_TEST_START; 1314 } 1315 1316 static void vpid_main() 1317 { 1318 vmx_set_test_stage(0); 1319 vmcall(); 1320 report("INVVPID SINGLE ADDRESS", vmx_get_test_stage() == 1); 1321 vmx_set_test_stage(2); 1322 vmcall(); 1323 report("INVVPID SINGLE", vmx_get_test_stage() == 3); 1324 vmx_set_test_stage(4); 1325 vmcall(); 1326 report("INVVPID ALL", vmx_get_test_stage() == 5); 1327 } 1328 1329 static int vpid_exit_handler() 1330 { 1331 u64 guest_rip; 1332 ulong reason; 1333 u32 insn_len; 1334 1335 guest_rip = vmcs_read(GUEST_RIP); 1336 reason = vmcs_read(EXI_REASON) & 0xff; 1337 insn_len = vmcs_read(EXI_INST_LEN); 1338 1339 switch (reason) { 1340 case VMX_VMCALL: 1341 switch(vmx_get_test_stage()) { 1342 case 0: 1343 if (!invvpid_test(INVVPID_SINGLE_ADDRESS, 1)) 1344 vmx_inc_test_stage(); 1345 break; 1346 case 2: 1347 if (!invvpid_test(INVVPID_SINGLE, 1)) 1348 vmx_inc_test_stage(); 1349 break; 1350 case 4: 1351 if (!invvpid_test(INVVPID_ALL, 1)) 1352 vmx_inc_test_stage(); 1353 break; 1354 default: 1355 printf("ERROR: unexpected stage, %d\n", 1356 vmx_get_test_stage()); 1357 print_vmexit_info(); 1358 return VMX_TEST_VMEXIT; 1359 } 1360 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1361 return VMX_TEST_RESUME; 1362 default: 1363 printf("Unknown exit reason, %ld\n", reason); 1364 print_vmexit_info(); 1365 } 1366 return VMX_TEST_VMEXIT; 1367 } 1368 1369 #define TIMER_VECTOR 222 1370 1371 static volatile bool timer_fired; 1372 1373 static void timer_isr(isr_regs_t *regs) 1374 { 1375 timer_fired = true; 1376 apic_write(APIC_EOI, 0); 1377 } 1378 1379 static int interrupt_init(struct vmcs *vmcs) 1380 { 1381 msr_bmp_init(); 1382 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_EXTINT); 1383 handle_irq(TIMER_VECTOR, timer_isr); 1384 return VMX_TEST_START; 1385 } 1386 1387 static void interrupt_main(void) 1388 { 1389 long long start, loops; 1390 1391 vmx_set_test_stage(0); 1392 1393 apic_write(APIC_LVTT, TIMER_VECTOR); 1394 irq_enable(); 1395 1396 apic_write(APIC_TMICT, 1); 1397 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1398 asm volatile ("nop"); 1399 report("direct interrupt while running guest", timer_fired); 1400 1401 apic_write(APIC_TMICT, 0); 1402 irq_disable(); 1403 vmcall(); 1404 timer_fired = false; 1405 apic_write(APIC_TMICT, 1); 1406 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1407 asm volatile ("nop"); 1408 report("intercepted interrupt while running guest", timer_fired); 1409 1410 irq_enable(); 1411 apic_write(APIC_TMICT, 0); 1412 irq_disable(); 1413 vmcall(); 1414 timer_fired = false; 1415 start = rdtsc(); 1416 apic_write(APIC_TMICT, 1000000); 1417 1418 asm volatile ("sti; hlt"); 1419 1420 report("direct interrupt + hlt", 1421 rdtsc() - start > 1000000 && timer_fired); 1422 1423 apic_write(APIC_TMICT, 0); 1424 irq_disable(); 1425 vmcall(); 1426 timer_fired = false; 1427 start = rdtsc(); 1428 apic_write(APIC_TMICT, 1000000); 1429 1430 asm volatile ("sti; hlt"); 1431 1432 report("intercepted interrupt + hlt", 1433 rdtsc() - start > 10000 && timer_fired); 1434 1435 apic_write(APIC_TMICT, 0); 1436 irq_disable(); 1437 vmcall(); 1438 timer_fired = false; 1439 start = rdtsc(); 1440 apic_write(APIC_TMICT, 1000000); 1441 1442 irq_enable(); 1443 asm volatile ("nop"); 1444 vmcall(); 1445 1446 report("direct interrupt + activity state hlt", 1447 rdtsc() - start > 10000 && timer_fired); 1448 1449 apic_write(APIC_TMICT, 0); 1450 irq_disable(); 1451 vmcall(); 1452 timer_fired = false; 1453 start = rdtsc(); 1454 apic_write(APIC_TMICT, 1000000); 1455 1456 irq_enable(); 1457 asm volatile ("nop"); 1458 vmcall(); 1459 1460 report("intercepted interrupt + activity state hlt", 1461 rdtsc() - start > 10000 && timer_fired); 1462 1463 apic_write(APIC_TMICT, 0); 1464 irq_disable(); 1465 vmx_set_test_stage(7); 1466 vmcall(); 1467 timer_fired = false; 1468 apic_write(APIC_TMICT, 1); 1469 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1470 asm volatile ("nop"); 1471 report("running a guest with interrupt acknowledgement set", timer_fired); 1472 } 1473 1474 static int interrupt_exit_handler(void) 1475 { 1476 u64 guest_rip = vmcs_read(GUEST_RIP); 1477 ulong reason = vmcs_read(EXI_REASON) & 0xff; 1478 u32 insn_len = vmcs_read(EXI_INST_LEN); 1479 1480 switch (reason) { 1481 case VMX_VMCALL: 1482 switch (vmx_get_test_stage()) { 1483 case 0: 1484 case 2: 1485 case 5: 1486 vmcs_write(PIN_CONTROLS, 1487 vmcs_read(PIN_CONTROLS) | PIN_EXTINT); 1488 break; 1489 case 7: 1490 vmcs_write(EXI_CONTROLS, vmcs_read(EXI_CONTROLS) | EXI_INTA); 1491 vmcs_write(PIN_CONTROLS, 1492 vmcs_read(PIN_CONTROLS) | PIN_EXTINT); 1493 break; 1494 case 1: 1495 case 3: 1496 vmcs_write(PIN_CONTROLS, 1497 vmcs_read(PIN_CONTROLS) & ~PIN_EXTINT); 1498 break; 1499 case 4: 1500 case 6: 1501 vmcs_write(GUEST_ACTV_STATE, ACTV_HLT); 1502 break; 1503 } 1504 vmx_inc_test_stage(); 1505 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1506 return VMX_TEST_RESUME; 1507 case VMX_EXTINT: 1508 if (vmcs_read(EXI_CONTROLS) & EXI_INTA) { 1509 int vector = vmcs_read(EXI_INTR_INFO) & 0xff; 1510 handle_external_interrupt(vector); 1511 } else { 1512 irq_enable(); 1513 asm volatile ("nop"); 1514 irq_disable(); 1515 } 1516 if (vmx_get_test_stage() >= 2) 1517 vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE); 1518 return VMX_TEST_RESUME; 1519 default: 1520 printf("Unknown exit reason, %ld\n", reason); 1521 print_vmexit_info(); 1522 } 1523 1524 return VMX_TEST_VMEXIT; 1525 } 1526 1527 static int dbgctls_init(struct vmcs *vmcs) 1528 { 1529 u64 dr7 = 0x402; 1530 u64 zero = 0; 1531 1532 msr_bmp_init(); 1533 asm volatile( 1534 "mov %0,%%dr0\n\t" 1535 "mov %0,%%dr1\n\t" 1536 "mov %0,%%dr2\n\t" 1537 "mov %1,%%dr7\n\t" 1538 : : "r" (zero), "r" (dr7)); 1539 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x1); 1540 vmcs_write(GUEST_DR7, 0x404); 1541 vmcs_write(GUEST_DEBUGCTL, 0x2); 1542 1543 vmcs_write(ENT_CONTROLS, vmcs_read(ENT_CONTROLS) | ENT_LOAD_DBGCTLS); 1544 vmcs_write(EXI_CONTROLS, vmcs_read(EXI_CONTROLS) | EXI_SAVE_DBGCTLS); 1545 1546 return VMX_TEST_START; 1547 } 1548 1549 static void dbgctls_main(void) 1550 { 1551 u64 dr7, debugctl; 1552 1553 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1554 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1555 /* Commented out: KVM does not support DEBUGCTL so far */ 1556 (void)debugctl; 1557 report("Load debug controls", dr7 == 0x404 /* && debugctl == 0x2 */); 1558 1559 dr7 = 0x408; 1560 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1561 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x3); 1562 1563 vmx_set_test_stage(0); 1564 vmcall(); 1565 report("Save debug controls", vmx_get_test_stage() == 1); 1566 1567 if (ctrl_enter_rev.set & ENT_LOAD_DBGCTLS || 1568 ctrl_exit_rev.set & EXI_SAVE_DBGCTLS) { 1569 printf("\tDebug controls are always loaded/saved\n"); 1570 return; 1571 } 1572 vmx_set_test_stage(2); 1573 vmcall(); 1574 1575 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1576 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1577 /* Commented out: KVM does not support DEBUGCTL so far */ 1578 (void)debugctl; 1579 report("Guest=host debug controls", dr7 == 0x402 /* && debugctl == 0x1 */); 1580 1581 dr7 = 0x408; 1582 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1583 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x3); 1584 1585 vmx_set_test_stage(3); 1586 vmcall(); 1587 report("Don't save debug controls", vmx_get_test_stage() == 4); 1588 } 1589 1590 static int dbgctls_exit_handler(void) 1591 { 1592 unsigned int reason = vmcs_read(EXI_REASON) & 0xff; 1593 u32 insn_len = vmcs_read(EXI_INST_LEN); 1594 u64 guest_rip = vmcs_read(GUEST_RIP); 1595 u64 dr7, debugctl; 1596 1597 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1598 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1599 1600 switch (reason) { 1601 case VMX_VMCALL: 1602 switch (vmx_get_test_stage()) { 1603 case 0: 1604 if (dr7 == 0x400 && debugctl == 0 && 1605 vmcs_read(GUEST_DR7) == 0x408 /* && 1606 Commented out: KVM does not support DEBUGCTL so far 1607 vmcs_read(GUEST_DEBUGCTL) == 0x3 */) 1608 vmx_inc_test_stage(); 1609 break; 1610 case 2: 1611 dr7 = 0x402; 1612 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1613 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x1); 1614 vmcs_write(GUEST_DR7, 0x404); 1615 vmcs_write(GUEST_DEBUGCTL, 0x2); 1616 1617 vmcs_write(ENT_CONTROLS, 1618 vmcs_read(ENT_CONTROLS) & ~ENT_LOAD_DBGCTLS); 1619 vmcs_write(EXI_CONTROLS, 1620 vmcs_read(EXI_CONTROLS) & ~EXI_SAVE_DBGCTLS); 1621 break; 1622 case 3: 1623 if (dr7 == 0x400 && debugctl == 0 && 1624 vmcs_read(GUEST_DR7) == 0x404 /* && 1625 Commented out: KVM does not support DEBUGCTL so far 1626 vmcs_read(GUEST_DEBUGCTL) == 0x2 */) 1627 vmx_inc_test_stage(); 1628 break; 1629 } 1630 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1631 return VMX_TEST_RESUME; 1632 default: 1633 printf("Unknown exit reason, %d\n", reason); 1634 print_vmexit_info(); 1635 } 1636 return VMX_TEST_VMEXIT; 1637 } 1638 1639 struct vmx_msr_entry { 1640 u32 index; 1641 u32 reserved; 1642 u64 value; 1643 } __attribute__((packed)); 1644 1645 #define MSR_MAGIC 0x31415926 1646 struct vmx_msr_entry *exit_msr_store, *entry_msr_load, *exit_msr_load; 1647 1648 static int msr_switch_init(struct vmcs *vmcs) 1649 { 1650 msr_bmp_init(); 1651 exit_msr_store = alloc_page(); 1652 exit_msr_load = alloc_page(); 1653 entry_msr_load = alloc_page(); 1654 memset(exit_msr_store, 0, PAGE_SIZE); 1655 memset(exit_msr_load, 0, PAGE_SIZE); 1656 memset(entry_msr_load, 0, PAGE_SIZE); 1657 entry_msr_load[0].index = MSR_KERNEL_GS_BASE; 1658 entry_msr_load[0].value = MSR_MAGIC; 1659 1660 vmx_set_test_stage(1); 1661 vmcs_write(ENT_MSR_LD_CNT, 1); 1662 vmcs_write(ENTER_MSR_LD_ADDR, (u64)entry_msr_load); 1663 vmcs_write(EXI_MSR_ST_CNT, 1); 1664 vmcs_write(EXIT_MSR_ST_ADDR, (u64)exit_msr_store); 1665 vmcs_write(EXI_MSR_LD_CNT, 1); 1666 vmcs_write(EXIT_MSR_LD_ADDR, (u64)exit_msr_load); 1667 return VMX_TEST_START; 1668 } 1669 1670 static void msr_switch_main() 1671 { 1672 if (vmx_get_test_stage() == 1) { 1673 report("VM entry MSR load", 1674 rdmsr(MSR_KERNEL_GS_BASE) == MSR_MAGIC); 1675 vmx_set_test_stage(2); 1676 wrmsr(MSR_KERNEL_GS_BASE, MSR_MAGIC + 1); 1677 exit_msr_store[0].index = MSR_KERNEL_GS_BASE; 1678 exit_msr_load[0].index = MSR_KERNEL_GS_BASE; 1679 exit_msr_load[0].value = MSR_MAGIC + 2; 1680 } 1681 vmcall(); 1682 } 1683 1684 static int msr_switch_exit_handler() 1685 { 1686 ulong reason; 1687 1688 reason = vmcs_read(EXI_REASON); 1689 if (reason == VMX_VMCALL && vmx_get_test_stage() == 2) { 1690 report("VM exit MSR store", 1691 exit_msr_store[0].value == MSR_MAGIC + 1); 1692 report("VM exit MSR load", 1693 rdmsr(MSR_KERNEL_GS_BASE) == MSR_MAGIC + 2); 1694 vmx_set_test_stage(3); 1695 entry_msr_load[0].index = MSR_FS_BASE; 1696 return VMX_TEST_RESUME; 1697 } 1698 printf("ERROR %s: unexpected stage=%u or reason=%lu\n", 1699 __func__, vmx_get_test_stage(), reason); 1700 return VMX_TEST_EXIT; 1701 } 1702 1703 static int msr_switch_entry_failure(struct vmentry_failure *failure) 1704 { 1705 ulong reason; 1706 1707 if (failure->early) { 1708 printf("ERROR %s: early exit\n", __func__); 1709 return VMX_TEST_EXIT; 1710 } 1711 1712 reason = vmcs_read(EXI_REASON); 1713 if (reason == (VMX_ENTRY_FAILURE | VMX_FAIL_MSR) && 1714 vmx_get_test_stage() == 3) { 1715 report("VM entry MSR load: try to load FS_BASE", 1716 vmcs_read(EXI_QUALIFICATION) == 1); 1717 return VMX_TEST_VMEXIT; 1718 } 1719 printf("ERROR %s: unexpected stage=%u or reason=%lu\n", 1720 __func__, vmx_get_test_stage(), reason); 1721 return VMX_TEST_EXIT; 1722 } 1723 1724 static int vmmcall_init(struct vmcs *vmcs ) 1725 { 1726 vmcs_write(EXC_BITMAP, 1 << UD_VECTOR); 1727 return VMX_TEST_START; 1728 } 1729 1730 static void vmmcall_main(void) 1731 { 1732 asm volatile( 1733 "mov $0xABCD, %%rax\n\t" 1734 "vmmcall\n\t" 1735 ::: "rax"); 1736 1737 report("VMMCALL", 0); 1738 } 1739 1740 static int vmmcall_exit_handler() 1741 { 1742 ulong reason; 1743 1744 reason = vmcs_read(EXI_REASON); 1745 switch (reason) { 1746 case VMX_VMCALL: 1747 printf("here\n"); 1748 report("VMMCALL triggers #UD", 0); 1749 break; 1750 case VMX_EXC_NMI: 1751 report("VMMCALL triggers #UD", 1752 (vmcs_read(EXI_INTR_INFO) & 0xff) == UD_VECTOR); 1753 break; 1754 default: 1755 printf("Unknown exit reason, %ld\n", reason); 1756 print_vmexit_info(); 1757 } 1758 1759 return VMX_TEST_VMEXIT; 1760 } 1761 1762 static int disable_rdtscp_init(struct vmcs *vmcs) 1763 { 1764 u32 ctrl_cpu1; 1765 1766 if (ctrl_cpu_rev[0].clr & CPU_SECONDARY) { 1767 ctrl_cpu1 = vmcs_read(CPU_EXEC_CTRL1); 1768 ctrl_cpu1 &= ~CPU_RDTSCP; 1769 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu1); 1770 } 1771 1772 return VMX_TEST_START; 1773 } 1774 1775 static void disable_rdtscp_ud_handler(struct ex_regs *regs) 1776 { 1777 switch (vmx_get_test_stage()) { 1778 case 0: 1779 report("RDTSCP triggers #UD", true); 1780 vmx_inc_test_stage(); 1781 regs->rip += 3; 1782 break; 1783 case 2: 1784 report("RDPID triggers #UD", true); 1785 vmx_inc_test_stage(); 1786 regs->rip += 4; 1787 break; 1788 } 1789 return; 1790 1791 } 1792 1793 static void disable_rdtscp_main(void) 1794 { 1795 /* Test that #UD is properly injected in L2. */ 1796 handle_exception(UD_VECTOR, disable_rdtscp_ud_handler); 1797 1798 vmx_set_test_stage(0); 1799 asm volatile("rdtscp" : : : "eax", "ecx", "edx"); 1800 vmcall(); 1801 asm volatile(".byte 0xf3, 0x0f, 0xc7, 0xf8" : : : "eax"); 1802 vmcall(); 1803 } 1804 1805 static int disable_rdtscp_exit_handler(void) 1806 { 1807 unsigned int reason = vmcs_read(EXI_REASON) & 0xff; 1808 1809 switch (reason) { 1810 case VMX_VMCALL: 1811 switch (vmx_get_test_stage()) { 1812 case 0: 1813 report("RDTSCP triggers #UD", false); 1814 vmx_inc_test_stage(); 1815 /* fallthrough */ 1816 case 1: 1817 vmx_inc_test_stage(); 1818 vmcs_write(GUEST_RIP, vmcs_read(GUEST_RIP) + 3); 1819 return VMX_TEST_RESUME; 1820 case 2: 1821 report("RDPID triggers #UD", false); 1822 break; 1823 } 1824 break; 1825 1826 default: 1827 printf("Unknown exit reason, %d\n", reason); 1828 print_vmexit_info(); 1829 } 1830 return VMX_TEST_VMEXIT; 1831 } 1832 1833 int int3_init() 1834 { 1835 vmcs_write(EXC_BITMAP, ~0u); 1836 return VMX_TEST_START; 1837 } 1838 1839 void int3_guest_main() 1840 { 1841 asm volatile ("int3"); 1842 } 1843 1844 int int3_exit_handler() 1845 { 1846 u32 reason = vmcs_read(EXI_REASON); 1847 u32 intr_info = vmcs_read(EXI_INTR_INFO); 1848 1849 report("L1 intercepts #BP", reason == VMX_EXC_NMI && 1850 (intr_info & INTR_INFO_VALID_MASK) && 1851 (intr_info & INTR_INFO_VECTOR_MASK) == BP_VECTOR && 1852 ((intr_info & INTR_INFO_INTR_TYPE_MASK) >> 1853 INTR_INFO_INTR_TYPE_SHIFT) == VMX_INTR_TYPE_SOFT_EXCEPTION); 1854 1855 return VMX_TEST_VMEXIT; 1856 } 1857 1858 int into_init() 1859 { 1860 vmcs_write(EXC_BITMAP, ~0u); 1861 return VMX_TEST_START; 1862 } 1863 1864 void into_guest_main() 1865 { 1866 struct far_pointer32 fp = { 1867 .offset = (uintptr_t)&&into, 1868 .selector = KERNEL_CS32, 1869 }; 1870 register uintptr_t rsp asm("rsp"); 1871 1872 if (fp.offset != (uintptr_t)&&into) { 1873 printf("Code address too high.\n"); 1874 return; 1875 } 1876 if ((u32)rsp != rsp) { 1877 printf("Stack address too high.\n"); 1878 return; 1879 } 1880 1881 asm goto ("lcall *%0" : : "m" (fp) : "rax" : into); 1882 return; 1883 into: 1884 asm volatile (".code32;" 1885 "movl $0x7fffffff, %eax;" 1886 "addl %eax, %eax;" 1887 "into;" 1888 "lret;" 1889 ".code64"); 1890 __builtin_unreachable(); 1891 } 1892 1893 int into_exit_handler() 1894 { 1895 u32 reason = vmcs_read(EXI_REASON); 1896 u32 intr_info = vmcs_read(EXI_INTR_INFO); 1897 1898 report("L1 intercepts #OF", reason == VMX_EXC_NMI && 1899 (intr_info & INTR_INFO_VALID_MASK) && 1900 (intr_info & INTR_INFO_VECTOR_MASK) == OF_VECTOR && 1901 ((intr_info & INTR_INFO_INTR_TYPE_MASK) >> 1902 INTR_INFO_INTR_TYPE_SHIFT) == VMX_INTR_TYPE_SOFT_EXCEPTION); 1903 1904 return VMX_TEST_VMEXIT; 1905 } 1906 1907 static void exit_monitor_from_l2_main(void) 1908 { 1909 printf("Calling exit(0) from l2...\n"); 1910 exit(0); 1911 } 1912 1913 static int exit_monitor_from_l2_handler(void) 1914 { 1915 report("The guest should have killed the VMM", false); 1916 return VMX_TEST_EXIT; 1917 } 1918 1919 static void assert_exit_reason(u64 expected) 1920 { 1921 u64 actual = vmcs_read(EXI_REASON); 1922 1923 TEST_ASSERT_EQ_MSG(expected, actual, "Expected %s, got %s.", 1924 exit_reason_description(expected), 1925 exit_reason_description(actual)); 1926 } 1927 1928 static void skip_exit_vmcall() 1929 { 1930 u64 guest_rip = vmcs_read(GUEST_RIP); 1931 u32 insn_len = vmcs_read(EXI_INST_LEN); 1932 1933 assert_exit_reason(VMX_VMCALL); 1934 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1935 } 1936 1937 static void v2_null_test_guest(void) 1938 { 1939 } 1940 1941 static void v2_null_test(void) 1942 { 1943 test_set_guest(v2_null_test_guest); 1944 enter_guest(); 1945 report(__func__, 1); 1946 } 1947 1948 static void v2_multiple_entries_test_guest(void) 1949 { 1950 vmx_set_test_stage(1); 1951 vmcall(); 1952 vmx_set_test_stage(2); 1953 } 1954 1955 static void v2_multiple_entries_test(void) 1956 { 1957 test_set_guest(v2_multiple_entries_test_guest); 1958 enter_guest(); 1959 TEST_ASSERT_EQ(vmx_get_test_stage(), 1); 1960 skip_exit_vmcall(); 1961 enter_guest(); 1962 TEST_ASSERT_EQ(vmx_get_test_stage(), 2); 1963 report(__func__, 1); 1964 } 1965 1966 static int fixture_test_data = 1; 1967 1968 static void fixture_test_teardown(void *data) 1969 { 1970 *((int *) data) = 1; 1971 } 1972 1973 static void fixture_test_guest(void) 1974 { 1975 fixture_test_data++; 1976 } 1977 1978 1979 static void fixture_test_setup(void) 1980 { 1981 TEST_ASSERT_EQ_MSG(1, fixture_test_data, 1982 "fixture_test_teardown didn't run?!"); 1983 fixture_test_data = 2; 1984 test_add_teardown(fixture_test_teardown, &fixture_test_data); 1985 test_set_guest(fixture_test_guest); 1986 } 1987 1988 static void fixture_test_case1(void) 1989 { 1990 fixture_test_setup(); 1991 TEST_ASSERT_EQ(2, fixture_test_data); 1992 enter_guest(); 1993 TEST_ASSERT_EQ(3, fixture_test_data); 1994 report(__func__, 1); 1995 } 1996 1997 static void fixture_test_case2(void) 1998 { 1999 fixture_test_setup(); 2000 TEST_ASSERT_EQ(2, fixture_test_data); 2001 enter_guest(); 2002 TEST_ASSERT_EQ(3, fixture_test_data); 2003 report(__func__, 1); 2004 } 2005 2006 enum ept_access_op { 2007 OP_READ, 2008 OP_WRITE, 2009 OP_EXEC, 2010 OP_FLUSH_TLB, 2011 OP_EXIT, 2012 }; 2013 2014 static struct ept_access_test_data { 2015 unsigned long gpa; 2016 unsigned long *gva; 2017 unsigned long hpa; 2018 unsigned long *hva; 2019 enum ept_access_op op; 2020 } ept_access_test_data; 2021 2022 extern unsigned char ret42_start; 2023 extern unsigned char ret42_end; 2024 2025 /* Returns 42. */ 2026 asm( 2027 ".align 64\n" 2028 "ret42_start:\n" 2029 "mov $42, %eax\n" 2030 "ret\n" 2031 "ret42_end:\n" 2032 ); 2033 2034 static void 2035 diagnose_ept_violation_qual(u64 expected, u64 actual) 2036 { 2037 2038 #define DIAGNOSE(flag) \ 2039 do { \ 2040 if ((expected & flag) != (actual & flag)) \ 2041 printf(#flag " %sexpected\n", \ 2042 (expected & flag) ? "" : "un"); \ 2043 } while (0) 2044 2045 DIAGNOSE(EPT_VLT_RD); 2046 DIAGNOSE(EPT_VLT_WR); 2047 DIAGNOSE(EPT_VLT_FETCH); 2048 DIAGNOSE(EPT_VLT_PERM_RD); 2049 DIAGNOSE(EPT_VLT_PERM_WR); 2050 DIAGNOSE(EPT_VLT_PERM_EX); 2051 DIAGNOSE(EPT_VLT_LADDR_VLD); 2052 DIAGNOSE(EPT_VLT_PADDR); 2053 2054 #undef DIAGNOSE 2055 } 2056 2057 static void do_ept_access_op(enum ept_access_op op) 2058 { 2059 ept_access_test_data.op = op; 2060 enter_guest(); 2061 } 2062 2063 /* 2064 * Force the guest to flush its TLB (i.e., flush gva -> gpa mappings). Only 2065 * needed by tests that modify guest PTEs. 2066 */ 2067 static void ept_access_test_guest_flush_tlb(void) 2068 { 2069 do_ept_access_op(OP_FLUSH_TLB); 2070 skip_exit_vmcall(); 2071 } 2072 2073 /* 2074 * Modifies the EPT entry at @level in the mapping of @gpa. First clears the 2075 * bits in @clear then sets the bits in @set. @mkhuge transforms the entry into 2076 * a huge page. 2077 */ 2078 static unsigned long ept_twiddle(unsigned long gpa, bool mkhuge, int level, 2079 unsigned long clear, unsigned long set) 2080 { 2081 struct ept_access_test_data *data = &ept_access_test_data; 2082 unsigned long orig_pte; 2083 unsigned long pte; 2084 2085 /* Screw with the mapping at the requested level. */ 2086 orig_pte = get_ept_pte(pml4, gpa, level); 2087 TEST_ASSERT(orig_pte != -1); 2088 pte = orig_pte; 2089 if (mkhuge) 2090 pte = (orig_pte & ~EPT_ADDR_MASK) | data->hpa | EPT_LARGE_PAGE; 2091 else 2092 pte = orig_pte; 2093 pte = (pte & ~clear) | set; 2094 set_ept_pte(pml4, gpa, level, pte); 2095 ept_sync(INVEPT_SINGLE, eptp); 2096 2097 return orig_pte; 2098 } 2099 2100 static void ept_untwiddle(unsigned long gpa, int level, unsigned long orig_pte) 2101 { 2102 set_ept_pte(pml4, gpa, level, orig_pte); 2103 } 2104 2105 static void do_ept_violation(bool leaf, enum ept_access_op op, 2106 u64 expected_qual, u64 expected_paddr) 2107 { 2108 u64 qual; 2109 2110 /* Try the access and observe the violation. */ 2111 do_ept_access_op(op); 2112 2113 assert_exit_reason(VMX_EPT_VIOLATION); 2114 2115 qual = vmcs_read(EXI_QUALIFICATION); 2116 2117 diagnose_ept_violation_qual(expected_qual, qual); 2118 TEST_EXPECT_EQ(expected_qual, qual); 2119 2120 #if 0 2121 /* Disable for now otherwise every test will fail */ 2122 TEST_EXPECT_EQ(vmcs_read(GUEST_LINEAR_ADDRESS), 2123 (unsigned long) ( 2124 op == OP_EXEC ? data->gva + 1 : data->gva)); 2125 #endif 2126 /* 2127 * TODO: tests that probe expected_paddr in pages other than the one at 2128 * the beginning of the 1g region. 2129 */ 2130 TEST_EXPECT_EQ(vmcs_read(INFO_PHYS_ADDR), expected_paddr); 2131 } 2132 2133 static void 2134 ept_violation_at_level_mkhuge(bool mkhuge, int level, unsigned long clear, 2135 unsigned long set, enum ept_access_op op, 2136 u64 expected_qual) 2137 { 2138 struct ept_access_test_data *data = &ept_access_test_data; 2139 unsigned long orig_pte; 2140 2141 orig_pte = ept_twiddle(data->gpa, mkhuge, level, clear, set); 2142 2143 do_ept_violation(level == 1 || mkhuge, op, expected_qual, 2144 op == OP_EXEC ? data->gpa + sizeof(unsigned long) : 2145 data->gpa); 2146 2147 /* Fix the violation and resume the op loop. */ 2148 ept_untwiddle(data->gpa, level, orig_pte); 2149 enter_guest(); 2150 skip_exit_vmcall(); 2151 } 2152 2153 static void 2154 ept_violation_at_level(int level, unsigned long clear, unsigned long set, 2155 enum ept_access_op op, u64 expected_qual) 2156 { 2157 ept_violation_at_level_mkhuge(false, level, clear, set, op, 2158 expected_qual); 2159 if (ept_huge_pages_supported(level)) 2160 ept_violation_at_level_mkhuge(true, level, clear, set, op, 2161 expected_qual); 2162 } 2163 2164 static void ept_violation(unsigned long clear, unsigned long set, 2165 enum ept_access_op op, u64 expected_qual) 2166 { 2167 ept_violation_at_level(1, clear, set, op, expected_qual); 2168 ept_violation_at_level(2, clear, set, op, expected_qual); 2169 ept_violation_at_level(3, clear, set, op, expected_qual); 2170 ept_violation_at_level(4, clear, set, op, expected_qual); 2171 } 2172 2173 static void ept_access_violation(unsigned long access, enum ept_access_op op, 2174 u64 expected_qual) 2175 { 2176 ept_violation(EPT_PRESENT, access, op, 2177 expected_qual | EPT_VLT_LADDR_VLD | EPT_VLT_PADDR); 2178 } 2179 2180 /* 2181 * For translations that don't involve a GVA, that is physical address (paddr) 2182 * accesses, EPT violations don't set the flag EPT_VLT_PADDR. For a typical 2183 * guest memory access, the hardware does GVA -> GPA -> HPA. However, certain 2184 * translations don't involve GVAs, such as when the hardware does the guest 2185 * page table walk. For example, in translating GVA_1 -> GPA_1, the guest MMU 2186 * might try to set an A bit on a guest PTE. If the GPA_2 that the PTE resides 2187 * on isn't present in the EPT, then the EPT violation will be for GPA_2 and 2188 * the EPT_VLT_PADDR bit will be clear in the exit qualification. 2189 * 2190 * Note that paddr violations can also be triggered by loading PAE page tables 2191 * with wonky addresses. We don't test that yet. 2192 * 2193 * This function modifies the EPT entry that maps the GPA that the guest page 2194 * table entry mapping ept_access_data.gva resides on. 2195 * 2196 * @ept_access EPT permissions to set. Other permissions are cleared. 2197 * 2198 * @pte_ad Set the A/D bits on the guest PTE accordingly. 2199 * 2200 * @op Guest operation to perform with ept_access_data.gva. 2201 * 2202 * @expect_violation 2203 * Is a violation expected during the paddr access? 2204 * 2205 * @expected_qual Expected qualification for the EPT violation. 2206 * EPT_VLT_PADDR should be clear. 2207 */ 2208 static void ept_access_paddr(unsigned long ept_access, unsigned long pte_ad, 2209 enum ept_access_op op, bool expect_violation, 2210 u64 expected_qual) 2211 { 2212 struct ept_access_test_data *data = &ept_access_test_data; 2213 unsigned long *ptep; 2214 unsigned long gpa; 2215 unsigned long orig_epte; 2216 2217 /* Modify the guest PTE mapping data->gva according to @pte_ad. */ 2218 ptep = get_pte_level(current_page_table(), data->gva, /*level=*/1); 2219 TEST_ASSERT(ptep); 2220 TEST_ASSERT_EQ(*ptep & PT_ADDR_MASK, data->gpa); 2221 *ptep = (*ptep & ~PT_AD_MASK) | pte_ad; 2222 ept_access_test_guest_flush_tlb(); 2223 2224 /* 2225 * Now modify the access bits on the EPT entry for the GPA that the 2226 * guest PTE resides on. Note that by modifying a single EPT entry, 2227 * we're potentially affecting 512 guest PTEs. However, we've carefully 2228 * constructed our test such that those other 511 PTEs aren't used by 2229 * the guest: data->gva is at the beginning of a 1G huge page, thus the 2230 * PTE we're modifying is at the beginning of a 4K page and the 2231 * following 511 entires are also under our control (and not touched by 2232 * the guest). 2233 */ 2234 gpa = virt_to_phys(ptep); 2235 TEST_ASSERT_EQ(gpa & ~PAGE_MASK, 0); 2236 /* 2237 * Make sure the guest page table page is mapped with a 4K EPT entry, 2238 * otherwise our level=1 twiddling below will fail. We use the 2239 * identity map (gpa = gpa) since page tables are shared with the host. 2240 */ 2241 install_ept(pml4, gpa, gpa, EPT_PRESENT); 2242 orig_epte = ept_twiddle(gpa, /*mkhuge=*/0, /*level=*/1, 2243 /*clear=*/EPT_PRESENT, /*set=*/ept_access); 2244 2245 if (expect_violation) { 2246 do_ept_violation(/*leaf=*/true, op, 2247 expected_qual | EPT_VLT_LADDR_VLD, gpa); 2248 ept_untwiddle(gpa, /*level=*/1, orig_epte); 2249 do_ept_access_op(op); 2250 } else { 2251 do_ept_access_op(op); 2252 ept_untwiddle(gpa, /*level=*/1, orig_epte); 2253 } 2254 2255 TEST_ASSERT(*ptep & PT_ACCESSED_MASK); 2256 if ((pte_ad & PT_DIRTY_MASK) || op == OP_WRITE) 2257 TEST_ASSERT(*ptep & PT_DIRTY_MASK); 2258 2259 skip_exit_vmcall(); 2260 } 2261 2262 static void ept_access_allowed_paddr(unsigned long ept_access, 2263 unsigned long pte_ad, 2264 enum ept_access_op op) 2265 { 2266 ept_access_paddr(ept_access, pte_ad, op, /*expect_violation=*/false, 2267 /*expected_qual=*/-1); 2268 } 2269 2270 static void ept_access_violation_paddr(unsigned long ept_access, 2271 unsigned long pte_ad, 2272 enum ept_access_op op, 2273 u64 expected_qual) 2274 { 2275 ept_access_paddr(ept_access, pte_ad, op, /*expect_violation=*/true, 2276 expected_qual); 2277 } 2278 2279 2280 static void ept_allowed_at_level_mkhuge(bool mkhuge, int level, 2281 unsigned long clear, 2282 unsigned long set, 2283 enum ept_access_op op) 2284 { 2285 struct ept_access_test_data *data = &ept_access_test_data; 2286 unsigned long orig_pte; 2287 2288 orig_pte = ept_twiddle(data->gpa, mkhuge, level, clear, set); 2289 2290 /* No violation. Should proceed to vmcall. */ 2291 do_ept_access_op(op); 2292 skip_exit_vmcall(); 2293 2294 ept_untwiddle(data->gpa, level, orig_pte); 2295 } 2296 2297 static void ept_allowed_at_level(int level, unsigned long clear, 2298 unsigned long set, enum ept_access_op op) 2299 { 2300 ept_allowed_at_level_mkhuge(false, level, clear, set, op); 2301 if (ept_huge_pages_supported(level)) 2302 ept_allowed_at_level_mkhuge(true, level, clear, set, op); 2303 } 2304 2305 static void ept_allowed(unsigned long clear, unsigned long set, 2306 enum ept_access_op op) 2307 { 2308 ept_allowed_at_level(1, clear, set, op); 2309 ept_allowed_at_level(2, clear, set, op); 2310 ept_allowed_at_level(3, clear, set, op); 2311 ept_allowed_at_level(4, clear, set, op); 2312 } 2313 2314 static void ept_ignored_bit(int bit) 2315 { 2316 /* Set the bit. */ 2317 ept_allowed(0, 1ul << bit, OP_READ); 2318 ept_allowed(0, 1ul << bit, OP_WRITE); 2319 ept_allowed(0, 1ul << bit, OP_EXEC); 2320 2321 /* Clear the bit. */ 2322 ept_allowed(1ul << bit, 0, OP_READ); 2323 ept_allowed(1ul << bit, 0, OP_WRITE); 2324 ept_allowed(1ul << bit, 0, OP_EXEC); 2325 } 2326 2327 static void ept_access_allowed(unsigned long access, enum ept_access_op op) 2328 { 2329 ept_allowed(EPT_PRESENT, access, op); 2330 } 2331 2332 2333 static void ept_misconfig_at_level_mkhuge_op(bool mkhuge, int level, 2334 unsigned long clear, 2335 unsigned long set, 2336 enum ept_access_op op) 2337 { 2338 struct ept_access_test_data *data = &ept_access_test_data; 2339 unsigned long orig_pte; 2340 2341 orig_pte = ept_twiddle(data->gpa, mkhuge, level, clear, set); 2342 2343 do_ept_access_op(op); 2344 assert_exit_reason(VMX_EPT_MISCONFIG); 2345 2346 /* Intel 27.2.1, "For all other VM exits, this field is cleared." */ 2347 #if 0 2348 /* broken: */ 2349 TEST_EXPECT_EQ_MSG(vmcs_read(EXI_QUALIFICATION), 0); 2350 #endif 2351 #if 0 2352 /* 2353 * broken: 2354 * According to description of exit qual for EPT violation, 2355 * EPT_VLT_LADDR_VLD indicates if GUEST_LINEAR_ADDRESS is valid. 2356 * However, I can't find anything that says GUEST_LINEAR_ADDRESS ought 2357 * to be set for msiconfig. 2358 */ 2359 TEST_EXPECT_EQ(vmcs_read(GUEST_LINEAR_ADDRESS), 2360 (unsigned long) ( 2361 op == OP_EXEC ? data->gva + 1 : data->gva)); 2362 #endif 2363 2364 /* Fix the violation and resume the op loop. */ 2365 ept_untwiddle(data->gpa, level, orig_pte); 2366 enter_guest(); 2367 skip_exit_vmcall(); 2368 } 2369 2370 static void ept_misconfig_at_level_mkhuge(bool mkhuge, int level, 2371 unsigned long clear, 2372 unsigned long set) 2373 { 2374 /* The op shouldn't matter (read, write, exec), so try them all! */ 2375 ept_misconfig_at_level_mkhuge_op(mkhuge, level, clear, set, OP_READ); 2376 ept_misconfig_at_level_mkhuge_op(mkhuge, level, clear, set, OP_WRITE); 2377 ept_misconfig_at_level_mkhuge_op(mkhuge, level, clear, set, OP_EXEC); 2378 } 2379 2380 static void ept_misconfig_at_level(int level, unsigned long clear, 2381 unsigned long set) 2382 { 2383 ept_misconfig_at_level_mkhuge(false, level, clear, set); 2384 if (ept_huge_pages_supported(level)) 2385 ept_misconfig_at_level_mkhuge(true, level, clear, set); 2386 } 2387 2388 static void ept_misconfig(unsigned long clear, unsigned long set) 2389 { 2390 ept_misconfig_at_level(1, clear, set); 2391 ept_misconfig_at_level(2, clear, set); 2392 ept_misconfig_at_level(3, clear, set); 2393 ept_misconfig_at_level(4, clear, set); 2394 } 2395 2396 static void ept_access_misconfig(unsigned long access) 2397 { 2398 ept_misconfig(EPT_PRESENT, access); 2399 } 2400 2401 static void ept_reserved_bit_at_level_nohuge(int level, int bit) 2402 { 2403 /* Setting the bit causes a misconfig. */ 2404 ept_misconfig_at_level_mkhuge(false, level, 0, 1ul << bit); 2405 2406 /* Making the entry non-present turns reserved bits into ignored. */ 2407 ept_violation_at_level(level, EPT_PRESENT, 1ul << bit, OP_READ, 2408 EPT_VLT_RD | EPT_VLT_LADDR_VLD | EPT_VLT_PADDR); 2409 } 2410 2411 static void ept_reserved_bit_at_level_huge(int level, int bit) 2412 { 2413 /* Setting the bit causes a misconfig. */ 2414 ept_misconfig_at_level_mkhuge(true, level, 0, 1ul << bit); 2415 2416 /* Making the entry non-present turns reserved bits into ignored. */ 2417 ept_violation_at_level(level, EPT_PRESENT, 1ul << bit, OP_READ, 2418 EPT_VLT_RD | EPT_VLT_LADDR_VLD | EPT_VLT_PADDR); 2419 } 2420 2421 static void ept_reserved_bit_at_level(int level, int bit) 2422 { 2423 /* Setting the bit causes a misconfig. */ 2424 ept_misconfig_at_level(level, 0, 1ul << bit); 2425 2426 /* Making the entry non-present turns reserved bits into ignored. */ 2427 ept_violation_at_level(level, EPT_PRESENT, 1ul << bit, OP_READ, 2428 EPT_VLT_RD | EPT_VLT_LADDR_VLD | EPT_VLT_PADDR); 2429 } 2430 2431 static void ept_reserved_bit(int bit) 2432 { 2433 ept_reserved_bit_at_level(1, bit); 2434 ept_reserved_bit_at_level(2, bit); 2435 ept_reserved_bit_at_level(3, bit); 2436 ept_reserved_bit_at_level(4, bit); 2437 } 2438 2439 #define PAGE_2M_ORDER 9 2440 #define PAGE_1G_ORDER 18 2441 2442 static void *get_1g_page(void) 2443 { 2444 static void *alloc; 2445 2446 if (!alloc) 2447 alloc = alloc_pages(PAGE_1G_ORDER); 2448 return alloc; 2449 } 2450 2451 static void ept_access_test_teardown(void *unused) 2452 { 2453 /* Exit the guest cleanly. */ 2454 do_ept_access_op(OP_EXIT); 2455 } 2456 2457 static void ept_access_test_guest(void) 2458 { 2459 struct ept_access_test_data *data = &ept_access_test_data; 2460 int (*code)(void) = (int (*)(void)) &data->gva[1]; 2461 2462 while (true) { 2463 switch (data->op) { 2464 case OP_READ: 2465 TEST_ASSERT_EQ(*data->gva, MAGIC_VAL_1); 2466 break; 2467 case OP_WRITE: 2468 *data->gva = MAGIC_VAL_2; 2469 TEST_ASSERT_EQ(*data->gva, MAGIC_VAL_2); 2470 *data->gva = MAGIC_VAL_1; 2471 break; 2472 case OP_EXEC: 2473 TEST_ASSERT_EQ(42, code()); 2474 break; 2475 case OP_FLUSH_TLB: 2476 write_cr3(read_cr3()); 2477 break; 2478 case OP_EXIT: 2479 return; 2480 default: 2481 TEST_ASSERT_MSG(false, "Unknown op %d", data->op); 2482 } 2483 vmcall(); 2484 } 2485 } 2486 2487 static void ept_access_test_setup(void) 2488 { 2489 struct ept_access_test_data *data = &ept_access_test_data; 2490 unsigned long npages = 1ul << PAGE_1G_ORDER; 2491 unsigned long size = npages * PAGE_SIZE; 2492 unsigned long *page_table = current_page_table(); 2493 2494 if (setup_ept(false)) 2495 test_skip("EPT not supported"); 2496 2497 test_set_guest(ept_access_test_guest); 2498 test_add_teardown(ept_access_test_teardown, NULL); 2499 2500 data->hva = get_1g_page(); 2501 TEST_ASSERT(data->hva); 2502 data->hpa = virt_to_phys(data->hva); 2503 2504 data->gpa = 1ul << 40; 2505 data->gva = (void *) ALIGN((unsigned long) alloc_vpages(npages * 2), 2506 size); 2507 TEST_ASSERT(!any_present_pages(page_table, data->gva, size)); 2508 install_pages(page_table, data->gpa, size, data->gva); 2509 2510 /* 2511 * Make sure nothing's mapped here so the tests that screw with the 2512 * pml4 entry don't inadvertently break something. 2513 */ 2514 TEST_ASSERT_EQ(get_ept_pte(pml4, data->gpa, 4), -1); 2515 TEST_ASSERT_EQ(get_ept_pte(pml4, data->gpa + size - 1, 4), -1); 2516 install_ept(pml4, data->hpa, data->gpa, EPT_PRESENT); 2517 2518 data->hva[0] = MAGIC_VAL_1; 2519 memcpy(&data->hva[1], &ret42_start, &ret42_end - &ret42_start); 2520 } 2521 2522 static void ept_access_test_not_present(void) 2523 { 2524 ept_access_test_setup(); 2525 /* --- */ 2526 ept_access_violation(0, OP_READ, EPT_VLT_RD); 2527 ept_access_violation(0, OP_WRITE, EPT_VLT_WR); 2528 ept_access_violation(0, OP_EXEC, EPT_VLT_FETCH); 2529 } 2530 2531 static void ept_access_test_read_only(void) 2532 { 2533 ept_access_test_setup(); 2534 2535 /* r-- */ 2536 ept_access_allowed(EPT_RA, OP_READ); 2537 ept_access_violation(EPT_RA, OP_WRITE, EPT_VLT_WR | EPT_VLT_PERM_RD); 2538 ept_access_violation(EPT_RA, OP_EXEC, EPT_VLT_FETCH | EPT_VLT_PERM_RD); 2539 } 2540 2541 static void ept_access_test_write_only(void) 2542 { 2543 ept_access_test_setup(); 2544 /* -w- */ 2545 ept_access_misconfig(EPT_WA); 2546 } 2547 2548 static void ept_access_test_read_write(void) 2549 { 2550 ept_access_test_setup(); 2551 /* rw- */ 2552 ept_access_allowed(EPT_RA | EPT_WA, OP_READ); 2553 ept_access_allowed(EPT_RA | EPT_WA, OP_WRITE); 2554 ept_access_violation(EPT_RA | EPT_WA, OP_EXEC, 2555 EPT_VLT_FETCH | EPT_VLT_PERM_RD | EPT_VLT_PERM_WR); 2556 } 2557 2558 2559 static void ept_access_test_execute_only(void) 2560 { 2561 ept_access_test_setup(); 2562 /* --x */ 2563 if (ept_execute_only_supported()) { 2564 ept_access_violation(EPT_EA, OP_READ, 2565 EPT_VLT_RD | EPT_VLT_PERM_EX); 2566 ept_access_violation(EPT_EA, OP_WRITE, 2567 EPT_VLT_WR | EPT_VLT_PERM_EX); 2568 ept_access_allowed(EPT_EA, OP_EXEC); 2569 } else { 2570 ept_access_misconfig(EPT_EA); 2571 } 2572 } 2573 2574 static void ept_access_test_read_execute(void) 2575 { 2576 ept_access_test_setup(); 2577 /* r-x */ 2578 ept_access_allowed(EPT_RA | EPT_EA, OP_READ); 2579 ept_access_violation(EPT_RA | EPT_EA, OP_WRITE, 2580 EPT_VLT_WR | EPT_VLT_PERM_RD | EPT_VLT_PERM_EX); 2581 ept_access_allowed(EPT_RA | EPT_EA, OP_EXEC); 2582 } 2583 2584 static void ept_access_test_write_execute(void) 2585 { 2586 ept_access_test_setup(); 2587 /* -wx */ 2588 ept_access_misconfig(EPT_WA | EPT_EA); 2589 } 2590 2591 static void ept_access_test_read_write_execute(void) 2592 { 2593 ept_access_test_setup(); 2594 /* rwx */ 2595 ept_access_allowed(EPT_RA | EPT_WA | EPT_EA, OP_READ); 2596 ept_access_allowed(EPT_RA | EPT_WA | EPT_EA, OP_WRITE); 2597 ept_access_allowed(EPT_RA | EPT_WA | EPT_EA, OP_EXEC); 2598 } 2599 2600 static void ept_access_test_reserved_bits(void) 2601 { 2602 int i; 2603 int maxphyaddr; 2604 2605 ept_access_test_setup(); 2606 2607 /* Reserved bits above maxphyaddr. */ 2608 maxphyaddr = cpuid_maxphyaddr(); 2609 for (i = maxphyaddr; i <= 51; i++) { 2610 report_prefix_pushf("reserved_bit=%d", i); 2611 ept_reserved_bit(i); 2612 report_prefix_pop(); 2613 } 2614 2615 /* Level-specific reserved bits. */ 2616 ept_reserved_bit_at_level_nohuge(2, 3); 2617 ept_reserved_bit_at_level_nohuge(2, 4); 2618 ept_reserved_bit_at_level_nohuge(2, 5); 2619 ept_reserved_bit_at_level_nohuge(2, 6); 2620 /* 2M alignment. */ 2621 for (i = 12; i < 20; i++) { 2622 report_prefix_pushf("reserved_bit=%d", i); 2623 ept_reserved_bit_at_level_huge(2, i); 2624 report_prefix_pop(); 2625 } 2626 ept_reserved_bit_at_level_nohuge(3, 3); 2627 ept_reserved_bit_at_level_nohuge(3, 4); 2628 ept_reserved_bit_at_level_nohuge(3, 5); 2629 ept_reserved_bit_at_level_nohuge(3, 6); 2630 /* 1G alignment. */ 2631 for (i = 12; i < 29; i++) { 2632 report_prefix_pushf("reserved_bit=%d", i); 2633 ept_reserved_bit_at_level_huge(3, i); 2634 report_prefix_pop(); 2635 } 2636 ept_reserved_bit_at_level(4, 3); 2637 ept_reserved_bit_at_level(4, 4); 2638 ept_reserved_bit_at_level(4, 5); 2639 ept_reserved_bit_at_level(4, 6); 2640 ept_reserved_bit_at_level(4, 7); 2641 } 2642 2643 static void ept_access_test_ignored_bits(void) 2644 { 2645 ept_access_test_setup(); 2646 /* 2647 * Bits ignored at every level. Bits 8 and 9 (A and D) are ignored as 2648 * far as translation is concerned even if AD bits are enabled in the 2649 * EPTP. Bit 63 is ignored because "EPT-violation #VE" VM-execution 2650 * control is 0. 2651 */ 2652 ept_ignored_bit(8); 2653 ept_ignored_bit(9); 2654 ept_ignored_bit(10); 2655 ept_ignored_bit(11); 2656 ept_ignored_bit(52); 2657 ept_ignored_bit(53); 2658 ept_ignored_bit(54); 2659 ept_ignored_bit(55); 2660 ept_ignored_bit(56); 2661 ept_ignored_bit(57); 2662 ept_ignored_bit(58); 2663 ept_ignored_bit(59); 2664 ept_ignored_bit(60); 2665 ept_ignored_bit(61); 2666 ept_ignored_bit(62); 2667 ept_ignored_bit(63); 2668 } 2669 2670 static void ept_access_test_paddr_not_present_ad_disabled(void) 2671 { 2672 ept_access_test_setup(); 2673 ept_disable_ad_bits(); 2674 2675 ept_access_violation_paddr(0, PT_AD_MASK, OP_READ, EPT_VLT_RD); 2676 ept_access_violation_paddr(0, PT_AD_MASK, OP_WRITE, EPT_VLT_RD); 2677 ept_access_violation_paddr(0, PT_AD_MASK, OP_EXEC, EPT_VLT_RD); 2678 } 2679 2680 static void ept_access_test_paddr_not_present_ad_enabled(void) 2681 { 2682 u64 qual = EPT_VLT_RD | EPT_VLT_WR; 2683 2684 ept_access_test_setup(); 2685 ept_enable_ad_bits_or_skip_test(); 2686 2687 ept_access_violation_paddr(0, PT_AD_MASK, OP_READ, qual); 2688 ept_access_violation_paddr(0, PT_AD_MASK, OP_WRITE, qual); 2689 ept_access_violation_paddr(0, PT_AD_MASK, OP_EXEC, qual); 2690 } 2691 2692 static void ept_access_test_paddr_read_only_ad_disabled(void) 2693 { 2694 /* 2695 * When EPT AD bits are disabled, all accesses to guest paging 2696 * structures are reported separately as a read and (after 2697 * translation of the GPA to host physical address) a read+write 2698 * if the A/D bits have to be set. 2699 */ 2700 u64 qual = EPT_VLT_WR | EPT_VLT_RD | EPT_VLT_PERM_RD; 2701 2702 ept_access_test_setup(); 2703 ept_disable_ad_bits(); 2704 2705 /* Can't update A bit, so all accesses fail. */ 2706 ept_access_violation_paddr(EPT_RA, 0, OP_READ, qual); 2707 ept_access_violation_paddr(EPT_RA, 0, OP_WRITE, qual); 2708 ept_access_violation_paddr(EPT_RA, 0, OP_EXEC, qual); 2709 /* AD bits disabled, so only writes try to update the D bit. */ 2710 ept_access_allowed_paddr(EPT_RA, PT_ACCESSED_MASK, OP_READ); 2711 ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_WRITE, qual); 2712 ept_access_allowed_paddr(EPT_RA, PT_ACCESSED_MASK, OP_EXEC); 2713 /* Both A and D already set, so read-only is OK. */ 2714 ept_access_allowed_paddr(EPT_RA, PT_AD_MASK, OP_READ); 2715 ept_access_allowed_paddr(EPT_RA, PT_AD_MASK, OP_WRITE); 2716 ept_access_allowed_paddr(EPT_RA, PT_AD_MASK, OP_EXEC); 2717 } 2718 2719 static void ept_access_test_paddr_read_only_ad_enabled(void) 2720 { 2721 /* 2722 * When EPT AD bits are enabled, all accesses to guest paging 2723 * structures are considered writes as far as EPT translation 2724 * is concerned. 2725 */ 2726 u64 qual = EPT_VLT_WR | EPT_VLT_RD | EPT_VLT_PERM_RD; 2727 2728 ept_access_test_setup(); 2729 ept_enable_ad_bits_or_skip_test(); 2730 2731 ept_access_violation_paddr(EPT_RA, 0, OP_READ, qual); 2732 ept_access_violation_paddr(EPT_RA, 0, OP_WRITE, qual); 2733 ept_access_violation_paddr(EPT_RA, 0, OP_EXEC, qual); 2734 ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_READ, qual); 2735 ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_WRITE, qual); 2736 ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_EXEC, qual); 2737 ept_access_violation_paddr(EPT_RA, PT_AD_MASK, OP_READ, qual); 2738 ept_access_violation_paddr(EPT_RA, PT_AD_MASK, OP_WRITE, qual); 2739 ept_access_violation_paddr(EPT_RA, PT_AD_MASK, OP_EXEC, qual); 2740 } 2741 2742 static void ept_access_test_paddr_read_write(void) 2743 { 2744 ept_access_test_setup(); 2745 /* Read-write access to paging structure. */ 2746 ept_access_allowed_paddr(EPT_RA | EPT_WA, 0, OP_READ); 2747 ept_access_allowed_paddr(EPT_RA | EPT_WA, 0, OP_WRITE); 2748 ept_access_allowed_paddr(EPT_RA | EPT_WA, 0, OP_EXEC); 2749 } 2750 2751 static void ept_access_test_paddr_read_write_execute(void) 2752 { 2753 ept_access_test_setup(); 2754 /* RWX access to paging structure. */ 2755 ept_access_allowed_paddr(EPT_PRESENT, 0, OP_READ); 2756 ept_access_allowed_paddr(EPT_PRESENT, 0, OP_WRITE); 2757 ept_access_allowed_paddr(EPT_PRESENT, 0, OP_EXEC); 2758 } 2759 2760 static void ept_access_test_paddr_read_execute_ad_disabled(void) 2761 { 2762 /* 2763 * When EPT AD bits are disabled, all accesses to guest paging 2764 * structures are reported separately as a read and (after 2765 * translation of the GPA to host physical address) a read+write 2766 * if the A/D bits have to be set. 2767 */ 2768 u64 qual = EPT_VLT_WR | EPT_VLT_RD | EPT_VLT_PERM_RD | EPT_VLT_PERM_EX; 2769 2770 ept_access_test_setup(); 2771 ept_disable_ad_bits(); 2772 2773 /* Can't update A bit, so all accesses fail. */ 2774 ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_READ, qual); 2775 ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_WRITE, qual); 2776 ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_EXEC, qual); 2777 /* AD bits disabled, so only writes try to update the D bit. */ 2778 ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_READ); 2779 ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_WRITE, qual); 2780 ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_EXEC); 2781 /* Both A and D already set, so read-only is OK. */ 2782 ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_READ); 2783 ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_WRITE); 2784 ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_EXEC); 2785 } 2786 2787 static void ept_access_test_paddr_read_execute_ad_enabled(void) 2788 { 2789 /* 2790 * When EPT AD bits are enabled, all accesses to guest paging 2791 * structures are considered writes as far as EPT translation 2792 * is concerned. 2793 */ 2794 u64 qual = EPT_VLT_WR | EPT_VLT_RD | EPT_VLT_PERM_RD | EPT_VLT_PERM_EX; 2795 2796 ept_access_test_setup(); 2797 ept_enable_ad_bits_or_skip_test(); 2798 2799 ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_READ, qual); 2800 ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_WRITE, qual); 2801 ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_EXEC, qual); 2802 ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_READ, qual); 2803 ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_WRITE, qual); 2804 ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_EXEC, qual); 2805 ept_access_violation_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_READ, qual); 2806 ept_access_violation_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_WRITE, qual); 2807 ept_access_violation_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_EXEC, qual); 2808 } 2809 2810 static void ept_access_test_paddr_not_present_page_fault(void) 2811 { 2812 ept_access_test_setup(); 2813 /* 2814 * TODO: test no EPT violation as long as guest PF occurs. e.g., GPA is 2815 * page is read-only in EPT but GVA is also mapped read only in PT. 2816 * Thus guest page fault before host takes EPT violation for trying to 2817 * update A bit. 2818 */ 2819 } 2820 2821 #define TEST(name) { #name, .v2 = name } 2822 2823 /* name/init/guest_main/exit_handler/syscall_handler/guest_regs */ 2824 struct vmx_test vmx_tests[] = { 2825 { "null", NULL, basic_guest_main, basic_exit_handler, NULL, {0} }, 2826 { "vmenter", NULL, vmenter_main, vmenter_exit_handler, NULL, {0} }, 2827 { "preemption timer", preemption_timer_init, preemption_timer_main, 2828 preemption_timer_exit_handler, NULL, {0} }, 2829 { "control field PAT", test_ctrl_pat_init, test_ctrl_pat_main, 2830 test_ctrl_pat_exit_handler, NULL, {0} }, 2831 { "control field EFER", test_ctrl_efer_init, test_ctrl_efer_main, 2832 test_ctrl_efer_exit_handler, NULL, {0} }, 2833 { "CR shadowing", NULL, cr_shadowing_main, 2834 cr_shadowing_exit_handler, NULL, {0} }, 2835 { "I/O bitmap", iobmp_init, iobmp_main, iobmp_exit_handler, 2836 NULL, {0} }, 2837 { "instruction intercept", insn_intercept_init, insn_intercept_main, 2838 insn_intercept_exit_handler, NULL, {0} }, 2839 { "EPT A/D disabled", ept_init, ept_main, ept_exit_handler, NULL, {0} }, 2840 { "EPT A/D enabled", eptad_init, eptad_main, eptad_exit_handler, NULL, {0} }, 2841 { "VPID", vpid_init, vpid_main, vpid_exit_handler, NULL, {0} }, 2842 { "interrupt", interrupt_init, interrupt_main, 2843 interrupt_exit_handler, NULL, {0} }, 2844 { "debug controls", dbgctls_init, dbgctls_main, dbgctls_exit_handler, 2845 NULL, {0} }, 2846 { "MSR switch", msr_switch_init, msr_switch_main, 2847 msr_switch_exit_handler, NULL, {0}, msr_switch_entry_failure }, 2848 { "vmmcall", vmmcall_init, vmmcall_main, vmmcall_exit_handler, NULL, {0} }, 2849 { "disable RDTSCP", disable_rdtscp_init, disable_rdtscp_main, 2850 disable_rdtscp_exit_handler, NULL, {0} }, 2851 { "int3", int3_init, int3_guest_main, int3_exit_handler, NULL, {0} }, 2852 { "into", into_init, into_guest_main, into_exit_handler, NULL, {0} }, 2853 { "exit_monitor_from_l2_test", NULL, exit_monitor_from_l2_main, 2854 exit_monitor_from_l2_handler, NULL, {0} }, 2855 /* Basic V2 tests. */ 2856 TEST(v2_null_test), 2857 TEST(v2_multiple_entries_test), 2858 TEST(fixture_test_case1), 2859 TEST(fixture_test_case2), 2860 /* EPT access tests. */ 2861 TEST(ept_access_test_not_present), 2862 TEST(ept_access_test_read_only), 2863 TEST(ept_access_test_write_only), 2864 TEST(ept_access_test_read_write), 2865 TEST(ept_access_test_execute_only), 2866 TEST(ept_access_test_read_execute), 2867 TEST(ept_access_test_write_execute), 2868 TEST(ept_access_test_read_write_execute), 2869 TEST(ept_access_test_reserved_bits), 2870 TEST(ept_access_test_ignored_bits), 2871 TEST(ept_access_test_paddr_not_present_ad_disabled), 2872 TEST(ept_access_test_paddr_not_present_ad_enabled), 2873 TEST(ept_access_test_paddr_read_only_ad_disabled), 2874 TEST(ept_access_test_paddr_read_only_ad_enabled), 2875 TEST(ept_access_test_paddr_read_write), 2876 TEST(ept_access_test_paddr_read_write_execute), 2877 TEST(ept_access_test_paddr_read_execute_ad_disabled), 2878 TEST(ept_access_test_paddr_read_execute_ad_enabled), 2879 TEST(ept_access_test_paddr_not_present_page_fault), 2880 { NULL, NULL, NULL, NULL, NULL, {0} }, 2881 }; 2882