1 /* 2 * All test cases of nested virtualization should be in this file 3 * 4 * Author : Arthur Chunqi Li <yzt356@gmail.com> 5 */ 6 #include "vmx.h" 7 #include "msr.h" 8 #include "processor.h" 9 #include "vm.h" 10 #include "fwcfg.h" 11 #include "isr.h" 12 #include "desc.h" 13 #include "apic.h" 14 #include "types.h" 15 16 u64 ia32_pat; 17 u64 ia32_efer; 18 void *io_bitmap_a, *io_bitmap_b; 19 u16 ioport; 20 21 unsigned long *pml4; 22 u64 eptp; 23 void *data_page1, *data_page2; 24 25 static inline void vmcall() 26 { 27 asm volatile("vmcall"); 28 } 29 30 void basic_guest_main() 31 { 32 report("Basic VMX test", 1); 33 } 34 35 int basic_exit_handler() 36 { 37 report("Basic VMX test", 0); 38 print_vmexit_info(); 39 return VMX_TEST_EXIT; 40 } 41 42 void vmenter_main() 43 { 44 u64 rax; 45 u64 rsp, resume_rsp; 46 47 report("test vmlaunch", 1); 48 49 asm volatile( 50 "mov %%rsp, %0\n\t" 51 "mov %3, %%rax\n\t" 52 "vmcall\n\t" 53 "mov %%rax, %1\n\t" 54 "mov %%rsp, %2\n\t" 55 : "=r"(rsp), "=r"(rax), "=r"(resume_rsp) 56 : "g"(0xABCD)); 57 report("test vmresume", (rax == 0xFFFF) && (rsp == resume_rsp)); 58 } 59 60 int vmenter_exit_handler() 61 { 62 u64 guest_rip; 63 ulong reason; 64 65 guest_rip = vmcs_read(GUEST_RIP); 66 reason = vmcs_read(EXI_REASON) & 0xff; 67 switch (reason) { 68 case VMX_VMCALL: 69 if (regs.rax != 0xABCD) { 70 report("test vmresume", 0); 71 return VMX_TEST_VMEXIT; 72 } 73 regs.rax = 0xFFFF; 74 vmcs_write(GUEST_RIP, guest_rip + 3); 75 return VMX_TEST_RESUME; 76 default: 77 report("test vmresume", 0); 78 print_vmexit_info(); 79 } 80 return VMX_TEST_VMEXIT; 81 } 82 83 u32 preempt_scale; 84 volatile unsigned long long tsc_val; 85 volatile u32 preempt_val; 86 u64 saved_rip; 87 88 int preemption_timer_init() 89 { 90 if (!(ctrl_pin_rev.clr & PIN_PREEMPT)) { 91 printf("\tPreemption timer is not supported\n"); 92 return VMX_TEST_EXIT; 93 } 94 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) | PIN_PREEMPT); 95 preempt_val = 10000000; 96 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 97 preempt_scale = rdmsr(MSR_IA32_VMX_MISC) & 0x1F; 98 99 if (!(ctrl_exit_rev.clr & EXI_SAVE_PREEMPT)) 100 printf("\tSave preemption value is not supported\n"); 101 102 return VMX_TEST_START; 103 } 104 105 void preemption_timer_main() 106 { 107 tsc_val = rdtsc(); 108 if (ctrl_exit_rev.clr & EXI_SAVE_PREEMPT) { 109 vmx_set_test_stage(0); 110 vmcall(); 111 if (vmx_get_test_stage() == 1) 112 vmcall(); 113 } 114 vmx_set_test_stage(1); 115 while (vmx_get_test_stage() == 1) { 116 if (((rdtsc() - tsc_val) >> preempt_scale) 117 > 10 * preempt_val) { 118 vmx_set_test_stage(2); 119 vmcall(); 120 } 121 } 122 tsc_val = rdtsc(); 123 asm volatile ("hlt"); 124 vmcall(); 125 vmx_set_test_stage(5); 126 vmcall(); 127 } 128 129 int preemption_timer_exit_handler() 130 { 131 bool guest_halted; 132 u64 guest_rip; 133 ulong reason; 134 u32 insn_len; 135 u32 ctrl_exit; 136 137 guest_rip = vmcs_read(GUEST_RIP); 138 reason = vmcs_read(EXI_REASON) & 0xff; 139 insn_len = vmcs_read(EXI_INST_LEN); 140 switch (reason) { 141 case VMX_PREEMPT: 142 switch (vmx_get_test_stage()) { 143 case 1: 144 case 2: 145 report("busy-wait for preemption timer", 146 ((rdtsc() - tsc_val) >> preempt_scale) >= 147 preempt_val); 148 vmx_set_test_stage(3); 149 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 150 return VMX_TEST_RESUME; 151 case 3: 152 guest_halted = 153 (vmcs_read(GUEST_ACTV_STATE) == ACTV_HLT); 154 report("preemption timer during hlt", 155 ((rdtsc() - tsc_val) >> preempt_scale) >= 156 preempt_val && guest_halted); 157 vmx_set_test_stage(4); 158 vmcs_write(PIN_CONTROLS, 159 vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT); 160 vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE); 161 return VMX_TEST_RESUME; 162 case 4: 163 report("preemption timer with 0 value", 164 saved_rip == guest_rip); 165 break; 166 default: 167 printf("Invalid stage.\n"); 168 print_vmexit_info(); 169 break; 170 } 171 break; 172 case VMX_VMCALL: 173 vmcs_write(GUEST_RIP, guest_rip + insn_len); 174 switch (vmx_get_test_stage()) { 175 case 0: 176 report("Keep preemption value", 177 vmcs_read(PREEMPT_TIMER_VALUE) == preempt_val); 178 vmx_set_test_stage(1); 179 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 180 ctrl_exit = (vmcs_read(EXI_CONTROLS) | 181 EXI_SAVE_PREEMPT) & ctrl_exit_rev.clr; 182 vmcs_write(EXI_CONTROLS, ctrl_exit); 183 return VMX_TEST_RESUME; 184 case 1: 185 report("Save preemption value", 186 vmcs_read(PREEMPT_TIMER_VALUE) < preempt_val); 187 return VMX_TEST_RESUME; 188 case 2: 189 report("busy-wait for preemption timer", 0); 190 vmx_set_test_stage(3); 191 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 192 return VMX_TEST_RESUME; 193 case 3: 194 report("preemption timer during hlt", 0); 195 vmx_set_test_stage(4); 196 /* fall through */ 197 case 4: 198 vmcs_write(PIN_CONTROLS, 199 vmcs_read(PIN_CONTROLS) | PIN_PREEMPT); 200 vmcs_write(PREEMPT_TIMER_VALUE, 0); 201 saved_rip = guest_rip + insn_len; 202 return VMX_TEST_RESUME; 203 case 5: 204 report("preemption timer with 0 value (vmcall stage 5)", 0); 205 break; 206 default: 207 // Should not reach here 208 printf("ERROR : unexpected stage, %d\n", 209 vmx_get_test_stage()); 210 print_vmexit_info(); 211 return VMX_TEST_VMEXIT; 212 } 213 break; 214 default: 215 printf("Unknown exit reason, %ld\n", reason); 216 print_vmexit_info(); 217 } 218 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT); 219 return VMX_TEST_VMEXIT; 220 } 221 222 void msr_bmp_init() 223 { 224 void *msr_bitmap; 225 u32 ctrl_cpu0; 226 227 msr_bitmap = alloc_page(); 228 memset(msr_bitmap, 0x0, PAGE_SIZE); 229 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 230 ctrl_cpu0 |= CPU_MSR_BITMAP; 231 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 232 vmcs_write(MSR_BITMAP, (u64)msr_bitmap); 233 } 234 235 static int test_ctrl_pat_init() 236 { 237 u64 ctrl_ent; 238 u64 ctrl_exi; 239 240 msr_bmp_init(); 241 if (!(ctrl_exit_rev.clr & EXI_SAVE_PAT) && 242 !(ctrl_exit_rev.clr & EXI_LOAD_PAT) && 243 !(ctrl_enter_rev.clr & ENT_LOAD_PAT)) { 244 printf("\tSave/load PAT is not supported\n"); 245 return 1; 246 } 247 248 ctrl_ent = vmcs_read(ENT_CONTROLS); 249 ctrl_exi = vmcs_read(EXI_CONTROLS); 250 ctrl_ent |= ctrl_enter_rev.clr & ENT_LOAD_PAT; 251 ctrl_exi |= ctrl_exit_rev.clr & (EXI_SAVE_PAT | EXI_LOAD_PAT); 252 vmcs_write(ENT_CONTROLS, ctrl_ent); 253 vmcs_write(EXI_CONTROLS, ctrl_exi); 254 ia32_pat = rdmsr(MSR_IA32_CR_PAT); 255 vmcs_write(GUEST_PAT, 0x0); 256 vmcs_write(HOST_PAT, ia32_pat); 257 return VMX_TEST_START; 258 } 259 260 static void test_ctrl_pat_main() 261 { 262 u64 guest_ia32_pat; 263 264 guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT); 265 if (!(ctrl_enter_rev.clr & ENT_LOAD_PAT)) 266 printf("\tENT_LOAD_PAT is not supported.\n"); 267 else { 268 if (guest_ia32_pat != 0) { 269 report("Entry load PAT", 0); 270 return; 271 } 272 } 273 wrmsr(MSR_IA32_CR_PAT, 0x6); 274 vmcall(); 275 guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT); 276 if (ctrl_enter_rev.clr & ENT_LOAD_PAT) 277 report("Entry load PAT", guest_ia32_pat == ia32_pat); 278 } 279 280 static int test_ctrl_pat_exit_handler() 281 { 282 u64 guest_rip; 283 ulong reason; 284 u64 guest_pat; 285 286 guest_rip = vmcs_read(GUEST_RIP); 287 reason = vmcs_read(EXI_REASON) & 0xff; 288 switch (reason) { 289 case VMX_VMCALL: 290 guest_pat = vmcs_read(GUEST_PAT); 291 if (!(ctrl_exit_rev.clr & EXI_SAVE_PAT)) { 292 printf("\tEXI_SAVE_PAT is not supported\n"); 293 vmcs_write(GUEST_PAT, 0x6); 294 } else { 295 report("Exit save PAT", guest_pat == 0x6); 296 } 297 if (!(ctrl_exit_rev.clr & EXI_LOAD_PAT)) 298 printf("\tEXI_LOAD_PAT is not supported\n"); 299 else 300 report("Exit load PAT", rdmsr(MSR_IA32_CR_PAT) == ia32_pat); 301 vmcs_write(GUEST_PAT, ia32_pat); 302 vmcs_write(GUEST_RIP, guest_rip + 3); 303 return VMX_TEST_RESUME; 304 default: 305 printf("ERROR : Undefined exit reason, reason = %ld.\n", reason); 306 break; 307 } 308 return VMX_TEST_VMEXIT; 309 } 310 311 static int test_ctrl_efer_init() 312 { 313 u64 ctrl_ent; 314 u64 ctrl_exi; 315 316 msr_bmp_init(); 317 ctrl_ent = vmcs_read(ENT_CONTROLS) | ENT_LOAD_EFER; 318 ctrl_exi = vmcs_read(EXI_CONTROLS) | EXI_SAVE_EFER | EXI_LOAD_EFER; 319 vmcs_write(ENT_CONTROLS, ctrl_ent & ctrl_enter_rev.clr); 320 vmcs_write(EXI_CONTROLS, ctrl_exi & ctrl_exit_rev.clr); 321 ia32_efer = rdmsr(MSR_EFER); 322 vmcs_write(GUEST_EFER, ia32_efer ^ EFER_NX); 323 vmcs_write(HOST_EFER, ia32_efer ^ EFER_NX); 324 return VMX_TEST_START; 325 } 326 327 static void test_ctrl_efer_main() 328 { 329 u64 guest_ia32_efer; 330 331 guest_ia32_efer = rdmsr(MSR_EFER); 332 if (!(ctrl_enter_rev.clr & ENT_LOAD_EFER)) 333 printf("\tENT_LOAD_EFER is not supported.\n"); 334 else { 335 if (guest_ia32_efer != (ia32_efer ^ EFER_NX)) { 336 report("Entry load EFER", 0); 337 return; 338 } 339 } 340 wrmsr(MSR_EFER, ia32_efer); 341 vmcall(); 342 guest_ia32_efer = rdmsr(MSR_EFER); 343 if (ctrl_enter_rev.clr & ENT_LOAD_EFER) 344 report("Entry load EFER", guest_ia32_efer == ia32_efer); 345 } 346 347 static int test_ctrl_efer_exit_handler() 348 { 349 u64 guest_rip; 350 ulong reason; 351 u64 guest_efer; 352 353 guest_rip = vmcs_read(GUEST_RIP); 354 reason = vmcs_read(EXI_REASON) & 0xff; 355 switch (reason) { 356 case VMX_VMCALL: 357 guest_efer = vmcs_read(GUEST_EFER); 358 if (!(ctrl_exit_rev.clr & EXI_SAVE_EFER)) { 359 printf("\tEXI_SAVE_EFER is not supported\n"); 360 vmcs_write(GUEST_EFER, ia32_efer); 361 } else { 362 report("Exit save EFER", guest_efer == ia32_efer); 363 } 364 if (!(ctrl_exit_rev.clr & EXI_LOAD_EFER)) { 365 printf("\tEXI_LOAD_EFER is not supported\n"); 366 wrmsr(MSR_EFER, ia32_efer ^ EFER_NX); 367 } else { 368 report("Exit load EFER", rdmsr(MSR_EFER) == (ia32_efer ^ EFER_NX)); 369 } 370 vmcs_write(GUEST_PAT, ia32_efer); 371 vmcs_write(GUEST_RIP, guest_rip + 3); 372 return VMX_TEST_RESUME; 373 default: 374 printf("ERROR : Undefined exit reason, reason = %ld.\n", reason); 375 break; 376 } 377 return VMX_TEST_VMEXIT; 378 } 379 380 u32 guest_cr0, guest_cr4; 381 382 static void cr_shadowing_main() 383 { 384 u32 cr0, cr4, tmp; 385 386 // Test read through 387 vmx_set_test_stage(0); 388 guest_cr0 = read_cr0(); 389 if (vmx_get_test_stage() == 1) 390 report("Read through CR0", 0); 391 else 392 vmcall(); 393 vmx_set_test_stage(1); 394 guest_cr4 = read_cr4(); 395 if (vmx_get_test_stage() == 2) 396 report("Read through CR4", 0); 397 else 398 vmcall(); 399 // Test write through 400 guest_cr0 = guest_cr0 ^ (X86_CR0_TS | X86_CR0_MP); 401 guest_cr4 = guest_cr4 ^ (X86_CR4_TSD | X86_CR4_DE); 402 vmx_set_test_stage(2); 403 write_cr0(guest_cr0); 404 if (vmx_get_test_stage() == 3) 405 report("Write throuth CR0", 0); 406 else 407 vmcall(); 408 vmx_set_test_stage(3); 409 write_cr4(guest_cr4); 410 if (vmx_get_test_stage() == 4) 411 report("Write through CR4", 0); 412 else 413 vmcall(); 414 // Test read shadow 415 vmx_set_test_stage(4); 416 vmcall(); 417 cr0 = read_cr0(); 418 if (vmx_get_test_stage() != 5) 419 report("Read shadowing CR0", cr0 == guest_cr0); 420 vmx_set_test_stage(5); 421 cr4 = read_cr4(); 422 if (vmx_get_test_stage() != 6) 423 report("Read shadowing CR4", cr4 == guest_cr4); 424 // Test write shadow (same value with shadow) 425 vmx_set_test_stage(6); 426 write_cr0(guest_cr0); 427 if (vmx_get_test_stage() == 7) 428 report("Write shadowing CR0 (same value with shadow)", 0); 429 else 430 vmcall(); 431 vmx_set_test_stage(7); 432 write_cr4(guest_cr4); 433 if (vmx_get_test_stage() == 8) 434 report("Write shadowing CR4 (same value with shadow)", 0); 435 else 436 vmcall(); 437 // Test write shadow (different value) 438 vmx_set_test_stage(8); 439 tmp = guest_cr0 ^ X86_CR0_TS; 440 asm volatile("mov %0, %%rsi\n\t" 441 "mov %%rsi, %%cr0\n\t" 442 ::"m"(tmp) 443 :"rsi", "memory", "cc"); 444 report("Write shadowing different X86_CR0_TS", vmx_get_test_stage() == 9); 445 vmx_set_test_stage(9); 446 tmp = guest_cr0 ^ X86_CR0_MP; 447 asm volatile("mov %0, %%rsi\n\t" 448 "mov %%rsi, %%cr0\n\t" 449 ::"m"(tmp) 450 :"rsi", "memory", "cc"); 451 report("Write shadowing different X86_CR0_MP", vmx_get_test_stage() == 10); 452 vmx_set_test_stage(10); 453 tmp = guest_cr4 ^ X86_CR4_TSD; 454 asm volatile("mov %0, %%rsi\n\t" 455 "mov %%rsi, %%cr4\n\t" 456 ::"m"(tmp) 457 :"rsi", "memory", "cc"); 458 report("Write shadowing different X86_CR4_TSD", vmx_get_test_stage() == 11); 459 vmx_set_test_stage(11); 460 tmp = guest_cr4 ^ X86_CR4_DE; 461 asm volatile("mov %0, %%rsi\n\t" 462 "mov %%rsi, %%cr4\n\t" 463 ::"m"(tmp) 464 :"rsi", "memory", "cc"); 465 report("Write shadowing different X86_CR4_DE", vmx_get_test_stage() == 12); 466 } 467 468 static int cr_shadowing_exit_handler() 469 { 470 u64 guest_rip; 471 ulong reason; 472 u32 insn_len; 473 u32 exit_qual; 474 475 guest_rip = vmcs_read(GUEST_RIP); 476 reason = vmcs_read(EXI_REASON) & 0xff; 477 insn_len = vmcs_read(EXI_INST_LEN); 478 exit_qual = vmcs_read(EXI_QUALIFICATION); 479 switch (reason) { 480 case VMX_VMCALL: 481 switch (vmx_get_test_stage()) { 482 case 0: 483 report("Read through CR0", guest_cr0 == vmcs_read(GUEST_CR0)); 484 break; 485 case 1: 486 report("Read through CR4", guest_cr4 == vmcs_read(GUEST_CR4)); 487 break; 488 case 2: 489 report("Write through CR0", guest_cr0 == vmcs_read(GUEST_CR0)); 490 break; 491 case 3: 492 report("Write through CR4", guest_cr4 == vmcs_read(GUEST_CR4)); 493 break; 494 case 4: 495 guest_cr0 = vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP); 496 guest_cr4 = vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE); 497 vmcs_write(CR0_MASK, X86_CR0_TS | X86_CR0_MP); 498 vmcs_write(CR0_READ_SHADOW, guest_cr0 & (X86_CR0_TS | X86_CR0_MP)); 499 vmcs_write(CR4_MASK, X86_CR4_TSD | X86_CR4_DE); 500 vmcs_write(CR4_READ_SHADOW, guest_cr4 & (X86_CR4_TSD | X86_CR4_DE)); 501 break; 502 case 6: 503 report("Write shadowing CR0 (same value)", 504 guest_cr0 == (vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP))); 505 break; 506 case 7: 507 report("Write shadowing CR4 (same value)", 508 guest_cr4 == (vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE))); 509 break; 510 default: 511 // Should not reach here 512 printf("ERROR : unexpected stage, %d\n", 513 vmx_get_test_stage()); 514 print_vmexit_info(); 515 return VMX_TEST_VMEXIT; 516 } 517 vmcs_write(GUEST_RIP, guest_rip + insn_len); 518 return VMX_TEST_RESUME; 519 case VMX_CR: 520 switch (vmx_get_test_stage()) { 521 case 4: 522 report("Read shadowing CR0", 0); 523 vmx_inc_test_stage(); 524 break; 525 case 5: 526 report("Read shadowing CR4", 0); 527 vmx_inc_test_stage(); 528 break; 529 case 6: 530 report("Write shadowing CR0 (same value)", 0); 531 vmx_inc_test_stage(); 532 break; 533 case 7: 534 report("Write shadowing CR4 (same value)", 0); 535 vmx_inc_test_stage(); 536 break; 537 case 8: 538 case 9: 539 // 0x600 encodes "mov %esi, %cr0" 540 if (exit_qual == 0x600) 541 vmx_inc_test_stage(); 542 break; 543 case 10: 544 case 11: 545 // 0x604 encodes "mov %esi, %cr4" 546 if (exit_qual == 0x604) 547 vmx_inc_test_stage(); 548 break; 549 default: 550 // Should not reach here 551 printf("ERROR : unexpected stage, %d\n", 552 vmx_get_test_stage()); 553 print_vmexit_info(); 554 return VMX_TEST_VMEXIT; 555 } 556 vmcs_write(GUEST_RIP, guest_rip + insn_len); 557 return VMX_TEST_RESUME; 558 default: 559 printf("Unknown exit reason, %ld\n", reason); 560 print_vmexit_info(); 561 } 562 return VMX_TEST_VMEXIT; 563 } 564 565 static int iobmp_init() 566 { 567 u32 ctrl_cpu0; 568 569 io_bitmap_a = alloc_page(); 570 io_bitmap_b = alloc_page(); 571 memset(io_bitmap_a, 0x0, PAGE_SIZE); 572 memset(io_bitmap_b, 0x0, PAGE_SIZE); 573 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 574 ctrl_cpu0 |= CPU_IO_BITMAP; 575 ctrl_cpu0 &= (~CPU_IO); 576 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 577 vmcs_write(IO_BITMAP_A, (u64)io_bitmap_a); 578 vmcs_write(IO_BITMAP_B, (u64)io_bitmap_b); 579 return VMX_TEST_START; 580 } 581 582 static void iobmp_main() 583 { 584 // stage 0, test IO pass 585 vmx_set_test_stage(0); 586 inb(0x5000); 587 outb(0x0, 0x5000); 588 report("I/O bitmap - I/O pass", vmx_get_test_stage() == 0); 589 // test IO width, in/out 590 ((u8 *)io_bitmap_a)[0] = 0xFF; 591 vmx_set_test_stage(2); 592 inb(0x0); 593 report("I/O bitmap - trap in", vmx_get_test_stage() == 3); 594 vmx_set_test_stage(3); 595 outw(0x0, 0x0); 596 report("I/O bitmap - trap out", vmx_get_test_stage() == 4); 597 vmx_set_test_stage(4); 598 inl(0x0); 599 report("I/O bitmap - I/O width, long", vmx_get_test_stage() == 5); 600 // test low/high IO port 601 vmx_set_test_stage(5); 602 ((u8 *)io_bitmap_a)[0x5000 / 8] = (1 << (0x5000 % 8)); 603 inb(0x5000); 604 report("I/O bitmap - I/O port, low part", vmx_get_test_stage() == 6); 605 vmx_set_test_stage(6); 606 ((u8 *)io_bitmap_b)[0x1000 / 8] = (1 << (0x1000 % 8)); 607 inb(0x9000); 608 report("I/O bitmap - I/O port, high part", vmx_get_test_stage() == 7); 609 // test partial pass 610 vmx_set_test_stage(7); 611 inl(0x4FFF); 612 report("I/O bitmap - partial pass", vmx_get_test_stage() == 8); 613 // test overrun 614 vmx_set_test_stage(8); 615 memset(io_bitmap_a, 0x0, PAGE_SIZE); 616 memset(io_bitmap_b, 0x0, PAGE_SIZE); 617 inl(0xFFFF); 618 report("I/O bitmap - overrun", vmx_get_test_stage() == 9); 619 vmx_set_test_stage(9); 620 vmcall(); 621 outb(0x0, 0x0); 622 report("I/O bitmap - ignore unconditional exiting", 623 vmx_get_test_stage() == 9); 624 vmx_set_test_stage(10); 625 vmcall(); 626 outb(0x0, 0x0); 627 report("I/O bitmap - unconditional exiting", 628 vmx_get_test_stage() == 11); 629 } 630 631 static int iobmp_exit_handler() 632 { 633 u64 guest_rip; 634 ulong reason, exit_qual; 635 u32 insn_len, ctrl_cpu0; 636 637 guest_rip = vmcs_read(GUEST_RIP); 638 reason = vmcs_read(EXI_REASON) & 0xff; 639 exit_qual = vmcs_read(EXI_QUALIFICATION); 640 insn_len = vmcs_read(EXI_INST_LEN); 641 switch (reason) { 642 case VMX_IO: 643 switch (vmx_get_test_stage()) { 644 case 0: 645 case 1: 646 vmx_inc_test_stage(); 647 break; 648 case 2: 649 report("I/O bitmap - I/O width, byte", 650 (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_BYTE); 651 report("I/O bitmap - I/O direction, in", exit_qual & VMX_IO_IN); 652 vmx_inc_test_stage(); 653 break; 654 case 3: 655 report("I/O bitmap - I/O width, word", 656 (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_WORD); 657 report("I/O bitmap - I/O direction, out", 658 !(exit_qual & VMX_IO_IN)); 659 vmx_inc_test_stage(); 660 break; 661 case 4: 662 report("I/O bitmap - I/O width, long", 663 (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_LONG); 664 vmx_inc_test_stage(); 665 break; 666 case 5: 667 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x5000) 668 vmx_inc_test_stage(); 669 break; 670 case 6: 671 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x9000) 672 vmx_inc_test_stage(); 673 break; 674 case 7: 675 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x4FFF) 676 vmx_inc_test_stage(); 677 break; 678 case 8: 679 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0xFFFF) 680 vmx_inc_test_stage(); 681 break; 682 case 9: 683 case 10: 684 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 685 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0 & ~CPU_IO); 686 vmx_inc_test_stage(); 687 break; 688 default: 689 // Should not reach here 690 printf("ERROR : unexpected stage, %d\n", 691 vmx_get_test_stage()); 692 print_vmexit_info(); 693 return VMX_TEST_VMEXIT; 694 } 695 vmcs_write(GUEST_RIP, guest_rip + insn_len); 696 return VMX_TEST_RESUME; 697 case VMX_VMCALL: 698 switch (vmx_get_test_stage()) { 699 case 9: 700 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 701 ctrl_cpu0 |= CPU_IO | CPU_IO_BITMAP; 702 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 703 break; 704 case 10: 705 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 706 ctrl_cpu0 = (ctrl_cpu0 & ~CPU_IO_BITMAP) | CPU_IO; 707 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 708 break; 709 default: 710 // Should not reach here 711 printf("ERROR : unexpected stage, %d\n", 712 vmx_get_test_stage()); 713 print_vmexit_info(); 714 return VMX_TEST_VMEXIT; 715 } 716 vmcs_write(GUEST_RIP, guest_rip + insn_len); 717 return VMX_TEST_RESUME; 718 default: 719 printf("guest_rip = 0x%lx\n", guest_rip); 720 printf("\tERROR : Undefined exit reason, reason = %ld.\n", reason); 721 break; 722 } 723 return VMX_TEST_VMEXIT; 724 } 725 726 #define INSN_CPU0 0 727 #define INSN_CPU1 1 728 #define INSN_ALWAYS_TRAP 2 729 730 #define FIELD_EXIT_QUAL (1 << 0) 731 #define FIELD_INSN_INFO (1 << 1) 732 733 asm( 734 "insn_hlt: hlt;ret\n\t" 735 "insn_invlpg: invlpg 0x12345678;ret\n\t" 736 "insn_mwait: xor %eax, %eax; xor %ecx, %ecx; mwait;ret\n\t" 737 "insn_rdpmc: xor %ecx, %ecx; rdpmc;ret\n\t" 738 "insn_rdtsc: rdtsc;ret\n\t" 739 "insn_cr3_load: mov cr3,%rax; mov %rax,%cr3;ret\n\t" 740 "insn_cr3_store: mov %cr3,%rax;ret\n\t" 741 #ifdef __x86_64__ 742 "insn_cr8_load: mov %rax,%cr8;ret\n\t" 743 "insn_cr8_store: mov %cr8,%rax;ret\n\t" 744 #endif 745 "insn_monitor: xor %eax, %eax; xor %ecx, %ecx; xor %edx, %edx; monitor;ret\n\t" 746 "insn_pause: pause;ret\n\t" 747 "insn_wbinvd: wbinvd;ret\n\t" 748 "insn_cpuid: mov $10, %eax; cpuid;ret\n\t" 749 "insn_invd: invd;ret\n\t" 750 "insn_sgdt: sgdt gdt64_desc;ret\n\t" 751 "insn_lgdt: lgdt gdt64_desc;ret\n\t" 752 "insn_sidt: sidt idt_descr;ret\n\t" 753 "insn_lidt: lidt idt_descr;ret\n\t" 754 "insn_sldt: sldt %ax;ret\n\t" 755 "insn_lldt: xor %eax, %eax; lldt %ax;ret\n\t" 756 "insn_str: str %ax;ret\n\t" 757 ); 758 extern void insn_hlt(); 759 extern void insn_invlpg(); 760 extern void insn_mwait(); 761 extern void insn_rdpmc(); 762 extern void insn_rdtsc(); 763 extern void insn_cr3_load(); 764 extern void insn_cr3_store(); 765 #ifdef __x86_64__ 766 extern void insn_cr8_load(); 767 extern void insn_cr8_store(); 768 #endif 769 extern void insn_monitor(); 770 extern void insn_pause(); 771 extern void insn_wbinvd(); 772 extern void insn_sgdt(); 773 extern void insn_lgdt(); 774 extern void insn_sidt(); 775 extern void insn_lidt(); 776 extern void insn_sldt(); 777 extern void insn_lldt(); 778 extern void insn_str(); 779 extern void insn_cpuid(); 780 extern void insn_invd(); 781 782 u32 cur_insn; 783 u64 cr3; 784 785 struct insn_table { 786 const char *name; 787 u32 flag; 788 void (*insn_func)(); 789 u32 type; 790 u32 reason; 791 ulong exit_qual; 792 u32 insn_info; 793 // Use FIELD_EXIT_QUAL and FIELD_INSN_INFO to define 794 // which field need to be tested, reason is always tested 795 u32 test_field; 796 }; 797 798 /* 799 * Add more test cases of instruction intercept here. Elements in this 800 * table is: 801 * name/control flag/insn function/type/exit reason/exit qulification/ 802 * instruction info/field to test 803 * The last field defines which fields (exit_qual and insn_info) need to be 804 * tested in exit handler. If set to 0, only "reason" is checked. 805 */ 806 static struct insn_table insn_table[] = { 807 // Flags for Primary Processor-Based VM-Execution Controls 808 {"HLT", CPU_HLT, insn_hlt, INSN_CPU0, 12, 0, 0, 0}, 809 {"INVLPG", CPU_INVLPG, insn_invlpg, INSN_CPU0, 14, 810 0x12345678, 0, FIELD_EXIT_QUAL}, 811 {"MWAIT", CPU_MWAIT, insn_mwait, INSN_CPU0, 36, 0, 0, 0}, 812 {"RDPMC", CPU_RDPMC, insn_rdpmc, INSN_CPU0, 15, 0, 0, 0}, 813 {"RDTSC", CPU_RDTSC, insn_rdtsc, INSN_CPU0, 16, 0, 0, 0}, 814 {"CR3 load", CPU_CR3_LOAD, insn_cr3_load, INSN_CPU0, 28, 0x3, 0, 815 FIELD_EXIT_QUAL}, 816 {"CR3 store", CPU_CR3_STORE, insn_cr3_store, INSN_CPU0, 28, 0x13, 0, 817 FIELD_EXIT_QUAL}, 818 #ifdef __x86_64__ 819 {"CR8 load", CPU_CR8_LOAD, insn_cr8_load, INSN_CPU0, 28, 0x8, 0, 820 FIELD_EXIT_QUAL}, 821 {"CR8 store", CPU_CR8_STORE, insn_cr8_store, INSN_CPU0, 28, 0x18, 0, 822 FIELD_EXIT_QUAL}, 823 #endif 824 {"MONITOR", CPU_MONITOR, insn_monitor, INSN_CPU0, 39, 0, 0, 0}, 825 {"PAUSE", CPU_PAUSE, insn_pause, INSN_CPU0, 40, 0, 0, 0}, 826 // Flags for Secondary Processor-Based VM-Execution Controls 827 {"WBINVD", CPU_WBINVD, insn_wbinvd, INSN_CPU1, 54, 0, 0, 0}, 828 {"DESC_TABLE (SGDT)", CPU_DESC_TABLE, insn_sgdt, INSN_CPU1, 46, 0, 0, 0}, 829 {"DESC_TABLE (LGDT)", CPU_DESC_TABLE, insn_lgdt, INSN_CPU1, 46, 0, 0, 0}, 830 {"DESC_TABLE (SIDT)", CPU_DESC_TABLE, insn_sidt, INSN_CPU1, 46, 0, 0, 0}, 831 {"DESC_TABLE (LIDT)", CPU_DESC_TABLE, insn_lidt, INSN_CPU1, 46, 0, 0, 0}, 832 {"DESC_TABLE (SLDT)", CPU_DESC_TABLE, insn_sldt, INSN_CPU1, 47, 0, 0, 0}, 833 {"DESC_TABLE (LLDT)", CPU_DESC_TABLE, insn_lldt, INSN_CPU1, 47, 0, 0, 0}, 834 {"DESC_TABLE (STR)", CPU_DESC_TABLE, insn_str, INSN_CPU1, 47, 0, 0, 0}, 835 /* LTR causes a #GP if done with a busy selector, so it is not tested. */ 836 // Instructions always trap 837 {"CPUID", 0, insn_cpuid, INSN_ALWAYS_TRAP, 10, 0, 0, 0}, 838 {"INVD", 0, insn_invd, INSN_ALWAYS_TRAP, 13, 0, 0, 0}, 839 // Instructions never trap 840 {NULL}, 841 }; 842 843 static int insn_intercept_init() 844 { 845 u32 ctrl_cpu; 846 847 ctrl_cpu = ctrl_cpu_rev[0].set | CPU_SECONDARY; 848 ctrl_cpu &= ctrl_cpu_rev[0].clr; 849 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu); 850 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu_rev[1].set); 851 cr3 = read_cr3(); 852 return VMX_TEST_START; 853 } 854 855 static void insn_intercept_main() 856 { 857 for (cur_insn = 0; insn_table[cur_insn].name != NULL; cur_insn++) { 858 vmx_set_test_stage(cur_insn * 2); 859 if ((insn_table[cur_insn].type == INSN_CPU0 && 860 !(ctrl_cpu_rev[0].clr & insn_table[cur_insn].flag)) || 861 (insn_table[cur_insn].type == INSN_CPU1 && 862 !(ctrl_cpu_rev[1].clr & insn_table[cur_insn].flag))) { 863 printf("\tCPU_CTRL%d.CPU_%s is not supported.\n", 864 insn_table[cur_insn].type - INSN_CPU0, 865 insn_table[cur_insn].name); 866 continue; 867 } 868 869 if ((insn_table[cur_insn].type == INSN_CPU0 && 870 !(ctrl_cpu_rev[0].set & insn_table[cur_insn].flag)) || 871 (insn_table[cur_insn].type == INSN_CPU1 && 872 !(ctrl_cpu_rev[1].set & insn_table[cur_insn].flag))) { 873 /* skip hlt, it stalls the guest and is tested below */ 874 if (insn_table[cur_insn].insn_func != insn_hlt) 875 insn_table[cur_insn].insn_func(); 876 report("execute %s", vmx_get_test_stage() == cur_insn * 2, 877 insn_table[cur_insn].name); 878 } else if (insn_table[cur_insn].type != INSN_ALWAYS_TRAP) 879 printf("\tCPU_CTRL%d.CPU_%s always traps.\n", 880 insn_table[cur_insn].type - INSN_CPU0, 881 insn_table[cur_insn].name); 882 883 vmcall(); 884 885 insn_table[cur_insn].insn_func(); 886 report("intercept %s", vmx_get_test_stage() == cur_insn * 2 + 1, 887 insn_table[cur_insn].name); 888 889 vmx_set_test_stage(cur_insn * 2 + 1); 890 vmcall(); 891 } 892 } 893 894 static int insn_intercept_exit_handler() 895 { 896 u64 guest_rip; 897 u32 reason; 898 ulong exit_qual; 899 u32 insn_len; 900 u32 insn_info; 901 bool pass; 902 903 guest_rip = vmcs_read(GUEST_RIP); 904 reason = vmcs_read(EXI_REASON) & 0xff; 905 exit_qual = vmcs_read(EXI_QUALIFICATION); 906 insn_len = vmcs_read(EXI_INST_LEN); 907 insn_info = vmcs_read(EXI_INST_INFO); 908 909 if (reason == VMX_VMCALL) { 910 u32 val = 0; 911 912 if (insn_table[cur_insn].type == INSN_CPU0) 913 val = vmcs_read(CPU_EXEC_CTRL0); 914 else if (insn_table[cur_insn].type == INSN_CPU1) 915 val = vmcs_read(CPU_EXEC_CTRL1); 916 917 if (vmx_get_test_stage() & 1) 918 val &= ~insn_table[cur_insn].flag; 919 else 920 val |= insn_table[cur_insn].flag; 921 922 if (insn_table[cur_insn].type == INSN_CPU0) 923 vmcs_write(CPU_EXEC_CTRL0, val | ctrl_cpu_rev[0].set); 924 else if (insn_table[cur_insn].type == INSN_CPU1) 925 vmcs_write(CPU_EXEC_CTRL1, val | ctrl_cpu_rev[1].set); 926 } else { 927 pass = (cur_insn * 2 == vmx_get_test_stage()) && 928 insn_table[cur_insn].reason == reason; 929 if (insn_table[cur_insn].test_field & FIELD_EXIT_QUAL && 930 insn_table[cur_insn].exit_qual != exit_qual) 931 pass = false; 932 if (insn_table[cur_insn].test_field & FIELD_INSN_INFO && 933 insn_table[cur_insn].insn_info != insn_info) 934 pass = false; 935 if (pass) 936 vmx_inc_test_stage(); 937 } 938 vmcs_write(GUEST_RIP, guest_rip + insn_len); 939 return VMX_TEST_RESUME; 940 } 941 942 943 /* Enables EPT and sets up the identity map. */ 944 static int setup_ept(bool enable_ad) 945 { 946 int support_2m; 947 unsigned long end_of_memory; 948 u32 ctrl_cpu[2]; 949 950 if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) || 951 !(ctrl_cpu_rev[1].clr & CPU_EPT)) { 952 printf("\tEPT is not supported"); 953 return 1; 954 } 955 956 957 if (!(ept_vpid.val & EPT_CAP_UC) && 958 !(ept_vpid.val & EPT_CAP_WB)) { 959 printf("\tEPT paging-structure memory type " 960 "UC&WB are not supported\n"); 961 return 1; 962 } 963 if (ept_vpid.val & EPT_CAP_UC) 964 eptp = EPT_MEM_TYPE_UC; 965 else 966 eptp = EPT_MEM_TYPE_WB; 967 if (!(ept_vpid.val & EPT_CAP_PWL4)) { 968 printf("\tPWL4 is not supported\n"); 969 return 1; 970 } 971 ctrl_cpu[0] = vmcs_read(CPU_EXEC_CTRL0); 972 ctrl_cpu[1] = vmcs_read(CPU_EXEC_CTRL1); 973 ctrl_cpu[0] = (ctrl_cpu[0] | CPU_SECONDARY) 974 & ctrl_cpu_rev[0].clr; 975 ctrl_cpu[1] = (ctrl_cpu[1] | CPU_EPT) 976 & ctrl_cpu_rev[1].clr; 977 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu[0]); 978 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu[1]); 979 eptp |= (3 << EPTP_PG_WALK_LEN_SHIFT); 980 pml4 = alloc_page(); 981 memset(pml4, 0, PAGE_SIZE); 982 eptp |= virt_to_phys(pml4); 983 if (enable_ad) 984 eptp |= EPTP_AD_FLAG; 985 vmcs_write(EPTP, eptp); 986 support_2m = !!(ept_vpid.val & EPT_CAP_2M_PAGE); 987 end_of_memory = fwcfg_get_u64(FW_CFG_RAM_SIZE); 988 if (end_of_memory < (1ul << 32)) 989 end_of_memory = (1ul << 32); 990 /* Cannot use large EPT pages if we need to track EPT 991 * accessed/dirty bits at 4K granularity. 992 */ 993 setup_ept_range(pml4, 0, end_of_memory, 994 0, !enable_ad && support_2m, 995 EPT_WA | EPT_RA | EPT_EA); 996 return 0; 997 } 998 999 static int apic_version; 1000 1001 static int ept_init_common(bool have_ad) 1002 { 1003 if (setup_ept(have_ad)) 1004 return VMX_TEST_EXIT; 1005 data_page1 = alloc_page(); 1006 data_page2 = alloc_page(); 1007 memset(data_page1, 0x0, PAGE_SIZE); 1008 memset(data_page2, 0x0, PAGE_SIZE); 1009 *((u32 *)data_page1) = MAGIC_VAL_1; 1010 *((u32 *)data_page2) = MAGIC_VAL_2; 1011 install_ept(pml4, (unsigned long)data_page1, (unsigned long)data_page2, 1012 EPT_RA | EPT_WA | EPT_EA); 1013 1014 apic_version = *((u32 *)0xfee00030UL); 1015 return VMX_TEST_START; 1016 } 1017 1018 static int ept_init() 1019 { 1020 return ept_init_common(false); 1021 } 1022 1023 static void ept_common() 1024 { 1025 vmx_set_test_stage(0); 1026 if (*((u32 *)data_page2) != MAGIC_VAL_1 || 1027 *((u32 *)data_page1) != MAGIC_VAL_1) 1028 report("EPT basic framework - read", 0); 1029 else { 1030 *((u32 *)data_page2) = MAGIC_VAL_3; 1031 vmcall(); 1032 if (vmx_get_test_stage() == 1) { 1033 if (*((u32 *)data_page1) == MAGIC_VAL_3 && 1034 *((u32 *)data_page2) == MAGIC_VAL_2) 1035 report("EPT basic framework", 1); 1036 else 1037 report("EPT basic framework - remap", 1); 1038 } 1039 } 1040 // Test EPT Misconfigurations 1041 vmx_set_test_stage(1); 1042 vmcall(); 1043 *((u32 *)data_page1) = MAGIC_VAL_1; 1044 if (vmx_get_test_stage() != 2) { 1045 report("EPT misconfigurations", 0); 1046 goto t1; 1047 } 1048 vmx_set_test_stage(2); 1049 vmcall(); 1050 *((u32 *)data_page1) = MAGIC_VAL_1; 1051 report("EPT misconfigurations", vmx_get_test_stage() == 3); 1052 t1: 1053 // Test EPT violation 1054 vmx_set_test_stage(3); 1055 vmcall(); 1056 *((u32 *)data_page1) = MAGIC_VAL_1; 1057 report("EPT violation - page permission", vmx_get_test_stage() == 4); 1058 // Violation caused by EPT paging structure 1059 vmx_set_test_stage(4); 1060 vmcall(); 1061 *((u32 *)data_page1) = MAGIC_VAL_2; 1062 report("EPT violation - paging structure", vmx_get_test_stage() == 5); 1063 } 1064 1065 static void ept_main() 1066 { 1067 ept_common(); 1068 1069 // Test EPT access to L1 MMIO 1070 vmx_set_test_stage(6); 1071 report("EPT - MMIO access", *((u32 *)0xfee00030UL) == apic_version); 1072 1073 // Test invalid operand for INVEPT 1074 vmcall(); 1075 report("EPT - unsupported INVEPT", vmx_get_test_stage() == 7); 1076 } 1077 1078 bool invept_test(int type, u64 eptp) 1079 { 1080 bool ret, supported; 1081 1082 supported = ept_vpid.val & (EPT_CAP_INVEPT_SINGLE >> INVEPT_SINGLE << type); 1083 ret = invept(type, eptp); 1084 1085 if (ret == !supported) 1086 return false; 1087 1088 if (!supported) 1089 printf("WARNING: unsupported invept passed!\n"); 1090 else 1091 printf("WARNING: invept failed!\n"); 1092 1093 return true; 1094 } 1095 1096 static int ept_exit_handler_common(bool have_ad) 1097 { 1098 u64 guest_rip; 1099 u64 guest_cr3; 1100 ulong reason; 1101 u32 insn_len; 1102 u32 exit_qual; 1103 static unsigned long data_page1_pte, data_page1_pte_pte; 1104 1105 guest_rip = vmcs_read(GUEST_RIP); 1106 guest_cr3 = vmcs_read(GUEST_CR3); 1107 reason = vmcs_read(EXI_REASON) & 0xff; 1108 insn_len = vmcs_read(EXI_INST_LEN); 1109 exit_qual = vmcs_read(EXI_QUALIFICATION); 1110 switch (reason) { 1111 case VMX_VMCALL: 1112 switch (vmx_get_test_stage()) { 1113 case 0: 1114 check_ept_ad(pml4, guest_cr3, 1115 (unsigned long)data_page1, 1116 have_ad ? EPT_ACCESS_FLAG : 0, 1117 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1118 check_ept_ad(pml4, guest_cr3, 1119 (unsigned long)data_page2, 1120 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0, 1121 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1122 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1123 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page2); 1124 if (have_ad) 1125 ept_sync(INVEPT_SINGLE, eptp);; 1126 if (*((u32 *)data_page1) == MAGIC_VAL_3 && 1127 *((u32 *)data_page2) == MAGIC_VAL_2) { 1128 vmx_inc_test_stage(); 1129 install_ept(pml4, (unsigned long)data_page2, 1130 (unsigned long)data_page2, 1131 EPT_RA | EPT_WA | EPT_EA); 1132 } else 1133 report("EPT basic framework - write", 0); 1134 break; 1135 case 1: 1136 install_ept(pml4, (unsigned long)data_page1, 1137 (unsigned long)data_page1, EPT_WA); 1138 ept_sync(INVEPT_SINGLE, eptp); 1139 break; 1140 case 2: 1141 install_ept(pml4, (unsigned long)data_page1, 1142 (unsigned long)data_page1, 1143 EPT_RA | EPT_WA | EPT_EA | 1144 (2 << EPT_MEM_TYPE_SHIFT)); 1145 ept_sync(INVEPT_SINGLE, eptp); 1146 break; 1147 case 3: 1148 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1149 data_page1_pte = get_ept_pte(pml4, 1150 (unsigned long)data_page1, 1); 1151 set_ept_pte(pml4, (unsigned long)data_page1, 1152 1, data_page1_pte & ~EPT_PRESENT); 1153 ept_sync(INVEPT_SINGLE, eptp); 1154 break; 1155 case 4: 1156 data_page1_pte = get_ept_pte(pml4, 1157 (unsigned long)data_page1, 2); 1158 data_page1_pte &= PAGE_MASK; 1159 data_page1_pte_pte = get_ept_pte(pml4, data_page1_pte, 2); 1160 set_ept_pte(pml4, data_page1_pte, 2, 1161 data_page1_pte_pte & ~EPT_PRESENT); 1162 ept_sync(INVEPT_SINGLE, eptp); 1163 break; 1164 case 6: 1165 if (!invept_test(0, eptp)) 1166 vmx_inc_test_stage(); 1167 break; 1168 // Should not reach here 1169 default: 1170 printf("ERROR - unexpected stage, %d.\n", 1171 vmx_get_test_stage()); 1172 print_vmexit_info(); 1173 return VMX_TEST_VMEXIT; 1174 } 1175 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1176 return VMX_TEST_RESUME; 1177 case VMX_EPT_MISCONFIG: 1178 switch (vmx_get_test_stage()) { 1179 case 1: 1180 case 2: 1181 vmx_inc_test_stage(); 1182 install_ept(pml4, (unsigned long)data_page1, 1183 (unsigned long)data_page1, 1184 EPT_RA | EPT_WA | EPT_EA); 1185 ept_sync(INVEPT_SINGLE, eptp); 1186 break; 1187 // Should not reach here 1188 default: 1189 printf("ERROR - unexpected stage, %d.\n", 1190 vmx_get_test_stage()); 1191 print_vmexit_info(); 1192 return VMX_TEST_VMEXIT; 1193 } 1194 return VMX_TEST_RESUME; 1195 case VMX_EPT_VIOLATION: 1196 switch(vmx_get_test_stage()) { 1197 case 3: 1198 check_ept_ad(pml4, guest_cr3, (unsigned long)data_page1, 0, 1199 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1200 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1201 if (exit_qual == (EPT_VLT_WR | EPT_VLT_LADDR_VLD | 1202 EPT_VLT_PADDR)) 1203 vmx_inc_test_stage(); 1204 set_ept_pte(pml4, (unsigned long)data_page1, 1205 1, data_page1_pte | (EPT_PRESENT)); 1206 ept_sync(INVEPT_SINGLE, eptp); 1207 break; 1208 case 4: 1209 check_ept_ad(pml4, guest_cr3, (unsigned long)data_page1, 0, 1210 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1211 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1212 if (exit_qual == (EPT_VLT_RD | 1213 (have_ad ? EPT_VLT_WR : 0) | 1214 EPT_VLT_LADDR_VLD)) 1215 vmx_inc_test_stage(); 1216 set_ept_pte(pml4, data_page1_pte, 2, 1217 data_page1_pte_pte | (EPT_PRESENT)); 1218 ept_sync(INVEPT_SINGLE, eptp); 1219 break; 1220 default: 1221 // Should not reach here 1222 printf("ERROR : unexpected stage, %d\n", 1223 vmx_get_test_stage()); 1224 print_vmexit_info(); 1225 return VMX_TEST_VMEXIT; 1226 } 1227 return VMX_TEST_RESUME; 1228 default: 1229 printf("Unknown exit reason, %ld\n", reason); 1230 print_vmexit_info(); 1231 } 1232 return VMX_TEST_VMEXIT; 1233 } 1234 1235 static int ept_exit_handler() 1236 { 1237 return ept_exit_handler_common(false); 1238 } 1239 1240 static int eptad_init() 1241 { 1242 int r = ept_init_common(true); 1243 1244 if (r == VMX_TEST_EXIT) 1245 return r; 1246 1247 if ((rdmsr(MSR_IA32_VMX_EPT_VPID_CAP) & EPT_CAP_AD_FLAG) == 0) { 1248 printf("\tEPT A/D bits are not supported"); 1249 return VMX_TEST_EXIT; 1250 } 1251 1252 return r; 1253 } 1254 1255 static void eptad_main() 1256 { 1257 ept_common(); 1258 } 1259 1260 static int eptad_exit_handler() 1261 { 1262 return ept_exit_handler_common(true); 1263 } 1264 1265 bool invvpid_test(int type, u16 vpid) 1266 { 1267 bool ret, supported; 1268 1269 supported = ept_vpid.val & (VPID_CAP_INVVPID_SINGLE >> INVVPID_SINGLE << type); 1270 ret = invvpid(type, vpid, 0); 1271 1272 if (ret == !supported) 1273 return false; 1274 1275 if (!supported) 1276 printf("WARNING: unsupported invvpid passed!\n"); 1277 else 1278 printf("WARNING: invvpid failed!\n"); 1279 1280 return true; 1281 } 1282 1283 static int vpid_init() 1284 { 1285 u32 ctrl_cpu1; 1286 1287 if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) || 1288 !(ctrl_cpu_rev[1].clr & CPU_VPID)) { 1289 printf("\tVPID is not supported"); 1290 return VMX_TEST_EXIT; 1291 } 1292 1293 ctrl_cpu1 = vmcs_read(CPU_EXEC_CTRL1); 1294 ctrl_cpu1 |= CPU_VPID; 1295 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu1); 1296 return VMX_TEST_START; 1297 } 1298 1299 static void vpid_main() 1300 { 1301 vmx_set_test_stage(0); 1302 vmcall(); 1303 report("INVVPID SINGLE ADDRESS", vmx_get_test_stage() == 1); 1304 vmx_set_test_stage(2); 1305 vmcall(); 1306 report("INVVPID SINGLE", vmx_get_test_stage() == 3); 1307 vmx_set_test_stage(4); 1308 vmcall(); 1309 report("INVVPID ALL", vmx_get_test_stage() == 5); 1310 } 1311 1312 static int vpid_exit_handler() 1313 { 1314 u64 guest_rip; 1315 ulong reason; 1316 u32 insn_len; 1317 1318 guest_rip = vmcs_read(GUEST_RIP); 1319 reason = vmcs_read(EXI_REASON) & 0xff; 1320 insn_len = vmcs_read(EXI_INST_LEN); 1321 1322 switch (reason) { 1323 case VMX_VMCALL: 1324 switch(vmx_get_test_stage()) { 1325 case 0: 1326 if (!invvpid_test(INVVPID_SINGLE_ADDRESS, 1)) 1327 vmx_inc_test_stage(); 1328 break; 1329 case 2: 1330 if (!invvpid_test(INVVPID_SINGLE, 1)) 1331 vmx_inc_test_stage(); 1332 break; 1333 case 4: 1334 if (!invvpid_test(INVVPID_ALL, 1)) 1335 vmx_inc_test_stage(); 1336 break; 1337 default: 1338 printf("ERROR: unexpected stage, %d\n", 1339 vmx_get_test_stage()); 1340 print_vmexit_info(); 1341 return VMX_TEST_VMEXIT; 1342 } 1343 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1344 return VMX_TEST_RESUME; 1345 default: 1346 printf("Unknown exit reason, %ld\n", reason); 1347 print_vmexit_info(); 1348 } 1349 return VMX_TEST_VMEXIT; 1350 } 1351 1352 #define TIMER_VECTOR 222 1353 1354 static volatile bool timer_fired; 1355 1356 static void timer_isr(isr_regs_t *regs) 1357 { 1358 timer_fired = true; 1359 apic_write(APIC_EOI, 0); 1360 } 1361 1362 static int interrupt_init(struct vmcs *vmcs) 1363 { 1364 msr_bmp_init(); 1365 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_EXTINT); 1366 handle_irq(TIMER_VECTOR, timer_isr); 1367 return VMX_TEST_START; 1368 } 1369 1370 static void interrupt_main(void) 1371 { 1372 long long start, loops; 1373 1374 vmx_set_test_stage(0); 1375 1376 apic_write(APIC_LVTT, TIMER_VECTOR); 1377 irq_enable(); 1378 1379 apic_write(APIC_TMICT, 1); 1380 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1381 asm volatile ("nop"); 1382 report("direct interrupt while running guest", timer_fired); 1383 1384 apic_write(APIC_TMICT, 0); 1385 irq_disable(); 1386 vmcall(); 1387 timer_fired = false; 1388 apic_write(APIC_TMICT, 1); 1389 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1390 asm volatile ("nop"); 1391 report("intercepted interrupt while running guest", timer_fired); 1392 1393 irq_enable(); 1394 apic_write(APIC_TMICT, 0); 1395 irq_disable(); 1396 vmcall(); 1397 timer_fired = false; 1398 start = rdtsc(); 1399 apic_write(APIC_TMICT, 1000000); 1400 1401 asm volatile ("sti; hlt"); 1402 1403 report("direct interrupt + hlt", 1404 rdtsc() - start > 1000000 && timer_fired); 1405 1406 apic_write(APIC_TMICT, 0); 1407 irq_disable(); 1408 vmcall(); 1409 timer_fired = false; 1410 start = rdtsc(); 1411 apic_write(APIC_TMICT, 1000000); 1412 1413 asm volatile ("sti; hlt"); 1414 1415 report("intercepted interrupt + hlt", 1416 rdtsc() - start > 10000 && timer_fired); 1417 1418 apic_write(APIC_TMICT, 0); 1419 irq_disable(); 1420 vmcall(); 1421 timer_fired = false; 1422 start = rdtsc(); 1423 apic_write(APIC_TMICT, 1000000); 1424 1425 irq_enable(); 1426 asm volatile ("nop"); 1427 vmcall(); 1428 1429 report("direct interrupt + activity state hlt", 1430 rdtsc() - start > 10000 && timer_fired); 1431 1432 apic_write(APIC_TMICT, 0); 1433 irq_disable(); 1434 vmcall(); 1435 timer_fired = false; 1436 start = rdtsc(); 1437 apic_write(APIC_TMICT, 1000000); 1438 1439 irq_enable(); 1440 asm volatile ("nop"); 1441 vmcall(); 1442 1443 report("intercepted interrupt + activity state hlt", 1444 rdtsc() - start > 10000 && timer_fired); 1445 1446 apic_write(APIC_TMICT, 0); 1447 irq_disable(); 1448 vmx_set_test_stage(7); 1449 vmcall(); 1450 timer_fired = false; 1451 apic_write(APIC_TMICT, 1); 1452 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1453 asm volatile ("nop"); 1454 report("running a guest with interrupt acknowledgement set", timer_fired); 1455 } 1456 1457 static int interrupt_exit_handler(void) 1458 { 1459 u64 guest_rip = vmcs_read(GUEST_RIP); 1460 ulong reason = vmcs_read(EXI_REASON) & 0xff; 1461 u32 insn_len = vmcs_read(EXI_INST_LEN); 1462 1463 switch (reason) { 1464 case VMX_VMCALL: 1465 switch (vmx_get_test_stage()) { 1466 case 0: 1467 case 2: 1468 case 5: 1469 vmcs_write(PIN_CONTROLS, 1470 vmcs_read(PIN_CONTROLS) | PIN_EXTINT); 1471 break; 1472 case 7: 1473 vmcs_write(EXI_CONTROLS, vmcs_read(EXI_CONTROLS) | EXI_INTA); 1474 vmcs_write(PIN_CONTROLS, 1475 vmcs_read(PIN_CONTROLS) | PIN_EXTINT); 1476 break; 1477 case 1: 1478 case 3: 1479 vmcs_write(PIN_CONTROLS, 1480 vmcs_read(PIN_CONTROLS) & ~PIN_EXTINT); 1481 break; 1482 case 4: 1483 case 6: 1484 vmcs_write(GUEST_ACTV_STATE, ACTV_HLT); 1485 break; 1486 } 1487 vmx_inc_test_stage(); 1488 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1489 return VMX_TEST_RESUME; 1490 case VMX_EXTINT: 1491 if (vmcs_read(EXI_CONTROLS) & EXI_INTA) { 1492 int vector = vmcs_read(EXI_INTR_INFO) & 0xff; 1493 handle_external_interrupt(vector); 1494 } else { 1495 irq_enable(); 1496 asm volatile ("nop"); 1497 irq_disable(); 1498 } 1499 if (vmx_get_test_stage() >= 2) 1500 vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE); 1501 return VMX_TEST_RESUME; 1502 default: 1503 printf("Unknown exit reason, %ld\n", reason); 1504 print_vmexit_info(); 1505 } 1506 1507 return VMX_TEST_VMEXIT; 1508 } 1509 1510 static int dbgctls_init(struct vmcs *vmcs) 1511 { 1512 u64 dr7 = 0x402; 1513 u64 zero = 0; 1514 1515 msr_bmp_init(); 1516 asm volatile( 1517 "mov %0,%%dr0\n\t" 1518 "mov %0,%%dr1\n\t" 1519 "mov %0,%%dr2\n\t" 1520 "mov %1,%%dr7\n\t" 1521 : : "r" (zero), "r" (dr7)); 1522 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x1); 1523 vmcs_write(GUEST_DR7, 0x404); 1524 vmcs_write(GUEST_DEBUGCTL, 0x2); 1525 1526 vmcs_write(ENT_CONTROLS, vmcs_read(ENT_CONTROLS) | ENT_LOAD_DBGCTLS); 1527 vmcs_write(EXI_CONTROLS, vmcs_read(EXI_CONTROLS) | EXI_SAVE_DBGCTLS); 1528 1529 return VMX_TEST_START; 1530 } 1531 1532 static void dbgctls_main(void) 1533 { 1534 u64 dr7, debugctl; 1535 1536 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1537 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1538 /* Commented out: KVM does not support DEBUGCTL so far */ 1539 (void)debugctl; 1540 report("Load debug controls", dr7 == 0x404 /* && debugctl == 0x2 */); 1541 1542 dr7 = 0x408; 1543 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1544 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x3); 1545 1546 vmx_set_test_stage(0); 1547 vmcall(); 1548 report("Save debug controls", vmx_get_test_stage() == 1); 1549 1550 if (ctrl_enter_rev.set & ENT_LOAD_DBGCTLS || 1551 ctrl_exit_rev.set & EXI_SAVE_DBGCTLS) { 1552 printf("\tDebug controls are always loaded/saved\n"); 1553 return; 1554 } 1555 vmx_set_test_stage(2); 1556 vmcall(); 1557 1558 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1559 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1560 /* Commented out: KVM does not support DEBUGCTL so far */ 1561 (void)debugctl; 1562 report("Guest=host debug controls", dr7 == 0x402 /* && debugctl == 0x1 */); 1563 1564 dr7 = 0x408; 1565 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1566 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x3); 1567 1568 vmx_set_test_stage(3); 1569 vmcall(); 1570 report("Don't save debug controls", vmx_get_test_stage() == 4); 1571 } 1572 1573 static int dbgctls_exit_handler(void) 1574 { 1575 unsigned int reason = vmcs_read(EXI_REASON) & 0xff; 1576 u32 insn_len = vmcs_read(EXI_INST_LEN); 1577 u64 guest_rip = vmcs_read(GUEST_RIP); 1578 u64 dr7, debugctl; 1579 1580 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1581 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1582 1583 switch (reason) { 1584 case VMX_VMCALL: 1585 switch (vmx_get_test_stage()) { 1586 case 0: 1587 if (dr7 == 0x400 && debugctl == 0 && 1588 vmcs_read(GUEST_DR7) == 0x408 /* && 1589 Commented out: KVM does not support DEBUGCTL so far 1590 vmcs_read(GUEST_DEBUGCTL) == 0x3 */) 1591 vmx_inc_test_stage(); 1592 break; 1593 case 2: 1594 dr7 = 0x402; 1595 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1596 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x1); 1597 vmcs_write(GUEST_DR7, 0x404); 1598 vmcs_write(GUEST_DEBUGCTL, 0x2); 1599 1600 vmcs_write(ENT_CONTROLS, 1601 vmcs_read(ENT_CONTROLS) & ~ENT_LOAD_DBGCTLS); 1602 vmcs_write(EXI_CONTROLS, 1603 vmcs_read(EXI_CONTROLS) & ~EXI_SAVE_DBGCTLS); 1604 break; 1605 case 3: 1606 if (dr7 == 0x400 && debugctl == 0 && 1607 vmcs_read(GUEST_DR7) == 0x404 /* && 1608 Commented out: KVM does not support DEBUGCTL so far 1609 vmcs_read(GUEST_DEBUGCTL) == 0x2 */) 1610 vmx_inc_test_stage(); 1611 break; 1612 } 1613 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1614 return VMX_TEST_RESUME; 1615 default: 1616 printf("Unknown exit reason, %d\n", reason); 1617 print_vmexit_info(); 1618 } 1619 return VMX_TEST_VMEXIT; 1620 } 1621 1622 struct vmx_msr_entry { 1623 u32 index; 1624 u32 reserved; 1625 u64 value; 1626 } __attribute__((packed)); 1627 1628 #define MSR_MAGIC 0x31415926 1629 struct vmx_msr_entry *exit_msr_store, *entry_msr_load, *exit_msr_load; 1630 1631 static int msr_switch_init(struct vmcs *vmcs) 1632 { 1633 msr_bmp_init(); 1634 exit_msr_store = alloc_page(); 1635 exit_msr_load = alloc_page(); 1636 entry_msr_load = alloc_page(); 1637 memset(exit_msr_store, 0, PAGE_SIZE); 1638 memset(exit_msr_load, 0, PAGE_SIZE); 1639 memset(entry_msr_load, 0, PAGE_SIZE); 1640 entry_msr_load[0].index = MSR_KERNEL_GS_BASE; 1641 entry_msr_load[0].value = MSR_MAGIC; 1642 1643 vmx_set_test_stage(1); 1644 vmcs_write(ENT_MSR_LD_CNT, 1); 1645 vmcs_write(ENTER_MSR_LD_ADDR, (u64)entry_msr_load); 1646 vmcs_write(EXI_MSR_ST_CNT, 1); 1647 vmcs_write(EXIT_MSR_ST_ADDR, (u64)exit_msr_store); 1648 vmcs_write(EXI_MSR_LD_CNT, 1); 1649 vmcs_write(EXIT_MSR_LD_ADDR, (u64)exit_msr_load); 1650 return VMX_TEST_START; 1651 } 1652 1653 static void msr_switch_main() 1654 { 1655 if (vmx_get_test_stage() == 1) { 1656 report("VM entry MSR load", 1657 rdmsr(MSR_KERNEL_GS_BASE) == MSR_MAGIC); 1658 vmx_set_test_stage(2); 1659 wrmsr(MSR_KERNEL_GS_BASE, MSR_MAGIC + 1); 1660 exit_msr_store[0].index = MSR_KERNEL_GS_BASE; 1661 exit_msr_load[0].index = MSR_KERNEL_GS_BASE; 1662 exit_msr_load[0].value = MSR_MAGIC + 2; 1663 } 1664 vmcall(); 1665 } 1666 1667 static int msr_switch_exit_handler() 1668 { 1669 ulong reason; 1670 1671 reason = vmcs_read(EXI_REASON); 1672 if (reason == VMX_VMCALL && vmx_get_test_stage() == 2) { 1673 report("VM exit MSR store", 1674 exit_msr_store[0].value == MSR_MAGIC + 1); 1675 report("VM exit MSR load", 1676 rdmsr(MSR_KERNEL_GS_BASE) == MSR_MAGIC + 2); 1677 vmx_set_test_stage(3); 1678 entry_msr_load[0].index = MSR_FS_BASE; 1679 return VMX_TEST_RESUME; 1680 } 1681 printf("ERROR %s: unexpected stage=%u or reason=%lu\n", 1682 __func__, vmx_get_test_stage(), reason); 1683 return VMX_TEST_EXIT; 1684 } 1685 1686 static int msr_switch_entry_failure(struct vmentry_failure *failure) 1687 { 1688 ulong reason; 1689 1690 if (failure->early) { 1691 printf("ERROR %s: early exit\n", __func__); 1692 return VMX_TEST_EXIT; 1693 } 1694 1695 reason = vmcs_read(EXI_REASON); 1696 if (reason == (VMX_ENTRY_FAILURE | VMX_FAIL_MSR) && 1697 vmx_get_test_stage() == 3) { 1698 report("VM entry MSR load: try to load FS_BASE", 1699 vmcs_read(EXI_QUALIFICATION) == 1); 1700 return VMX_TEST_VMEXIT; 1701 } 1702 printf("ERROR %s: unexpected stage=%u or reason=%lu\n", 1703 __func__, vmx_get_test_stage(), reason); 1704 return VMX_TEST_EXIT; 1705 } 1706 1707 static int vmmcall_init(struct vmcs *vmcs ) 1708 { 1709 vmcs_write(EXC_BITMAP, 1 << UD_VECTOR); 1710 return VMX_TEST_START; 1711 } 1712 1713 static void vmmcall_main(void) 1714 { 1715 asm volatile( 1716 "mov $0xABCD, %%rax\n\t" 1717 "vmmcall\n\t" 1718 ::: "rax"); 1719 1720 report("VMMCALL", 0); 1721 } 1722 1723 static int vmmcall_exit_handler() 1724 { 1725 ulong reason; 1726 1727 reason = vmcs_read(EXI_REASON); 1728 switch (reason) { 1729 case VMX_VMCALL: 1730 printf("here\n"); 1731 report("VMMCALL triggers #UD", 0); 1732 break; 1733 case VMX_EXC_NMI: 1734 report("VMMCALL triggers #UD", 1735 (vmcs_read(EXI_INTR_INFO) & 0xff) == UD_VECTOR); 1736 break; 1737 default: 1738 printf("Unknown exit reason, %ld\n", reason); 1739 print_vmexit_info(); 1740 } 1741 1742 return VMX_TEST_VMEXIT; 1743 } 1744 1745 static int disable_rdtscp_init(struct vmcs *vmcs) 1746 { 1747 u32 ctrl_cpu1; 1748 1749 if (ctrl_cpu_rev[0].clr & CPU_SECONDARY) { 1750 ctrl_cpu1 = vmcs_read(CPU_EXEC_CTRL1); 1751 ctrl_cpu1 &= ~CPU_RDTSCP; 1752 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu1); 1753 } 1754 1755 return VMX_TEST_START; 1756 } 1757 1758 static void disable_rdtscp_ud_handler(struct ex_regs *regs) 1759 { 1760 switch (vmx_get_test_stage()) { 1761 case 0: 1762 report("RDTSCP triggers #UD", true); 1763 vmx_inc_test_stage(); 1764 regs->rip += 3; 1765 break; 1766 case 2: 1767 report("RDPID triggers #UD", true); 1768 vmx_inc_test_stage(); 1769 regs->rip += 4; 1770 break; 1771 } 1772 return; 1773 1774 } 1775 1776 static void disable_rdtscp_main(void) 1777 { 1778 /* Test that #UD is properly injected in L2. */ 1779 handle_exception(UD_VECTOR, disable_rdtscp_ud_handler); 1780 1781 vmx_set_test_stage(0); 1782 asm volatile("rdtscp" : : : "eax", "ecx", "edx"); 1783 vmcall(); 1784 asm volatile(".byte 0xf3, 0x0f, 0xc7, 0xf8" : : : "eax"); 1785 vmcall(); 1786 } 1787 1788 static int disable_rdtscp_exit_handler(void) 1789 { 1790 unsigned int reason = vmcs_read(EXI_REASON) & 0xff; 1791 1792 switch (reason) { 1793 case VMX_VMCALL: 1794 switch (vmx_get_test_stage()) { 1795 case 0: 1796 report("RDTSCP triggers #UD", false); 1797 vmx_inc_test_stage(); 1798 /* fallthrough */ 1799 case 1: 1800 vmx_inc_test_stage(); 1801 vmcs_write(GUEST_RIP, vmcs_read(GUEST_RIP) + 3); 1802 return VMX_TEST_RESUME; 1803 case 2: 1804 report("RDPID triggers #UD", false); 1805 break; 1806 } 1807 break; 1808 1809 default: 1810 printf("Unknown exit reason, %d\n", reason); 1811 print_vmexit_info(); 1812 } 1813 return VMX_TEST_VMEXIT; 1814 } 1815 1816 int int3_init() 1817 { 1818 vmcs_write(EXC_BITMAP, ~0u); 1819 return VMX_TEST_START; 1820 } 1821 1822 void int3_guest_main() 1823 { 1824 asm volatile ("int3"); 1825 } 1826 1827 int int3_exit_handler() 1828 { 1829 u32 reason = vmcs_read(EXI_REASON); 1830 u32 intr_info = vmcs_read(EXI_INTR_INFO); 1831 1832 report("L1 intercepts #BP", reason == VMX_EXC_NMI && 1833 (intr_info & INTR_INFO_VALID_MASK) && 1834 (intr_info & INTR_INFO_VECTOR_MASK) == BP_VECTOR && 1835 ((intr_info & INTR_INFO_INTR_TYPE_MASK) >> 1836 INTR_INFO_INTR_TYPE_SHIFT) == VMX_INTR_TYPE_SOFT_EXCEPTION); 1837 1838 return VMX_TEST_VMEXIT; 1839 } 1840 1841 int into_init() 1842 { 1843 vmcs_write(EXC_BITMAP, ~0u); 1844 return VMX_TEST_START; 1845 } 1846 1847 void into_guest_main() 1848 { 1849 struct far_pointer32 fp = { 1850 .offset = (uintptr_t)&&into, 1851 .selector = KERNEL_CS32, 1852 }; 1853 register uintptr_t rsp asm("rsp"); 1854 1855 if (fp.offset != (uintptr_t)&&into) { 1856 printf("Code address too high.\n"); 1857 return; 1858 } 1859 if ((u32)rsp != rsp) { 1860 printf("Stack address too high.\n"); 1861 return; 1862 } 1863 1864 asm goto ("lcall *%0" : : "m" (fp) : "rax" : into); 1865 return; 1866 into: 1867 asm volatile (".code32;" 1868 "movl $0x7fffffff, %eax;" 1869 "addl %eax, %eax;" 1870 "into;" 1871 "lret;" 1872 ".code64"); 1873 __builtin_unreachable(); 1874 } 1875 1876 int into_exit_handler() 1877 { 1878 u32 reason = vmcs_read(EXI_REASON); 1879 u32 intr_info = vmcs_read(EXI_INTR_INFO); 1880 1881 report("L1 intercepts #OF", reason == VMX_EXC_NMI && 1882 (intr_info & INTR_INFO_VALID_MASK) && 1883 (intr_info & INTR_INFO_VECTOR_MASK) == OF_VECTOR && 1884 ((intr_info & INTR_INFO_INTR_TYPE_MASK) >> 1885 INTR_INFO_INTR_TYPE_SHIFT) == VMX_INTR_TYPE_SOFT_EXCEPTION); 1886 1887 return VMX_TEST_VMEXIT; 1888 } 1889 1890 static void exit_monitor_from_l2_main(void) 1891 { 1892 printf("Calling exit(0) from l2...\n"); 1893 exit(0); 1894 } 1895 1896 static int exit_monitor_from_l2_handler(void) 1897 { 1898 report("The guest should have killed the VMM", false); 1899 return VMX_TEST_EXIT; 1900 } 1901 1902 static void assert_exit_reason(u64 expected) 1903 { 1904 u64 actual = vmcs_read(EXI_REASON); 1905 1906 TEST_ASSERT_EQ_MSG(expected, actual, "Expected %s, got %s.", 1907 exit_reason_description(expected), 1908 exit_reason_description(actual)); 1909 } 1910 1911 static void skip_exit_vmcall() 1912 { 1913 u64 guest_rip = vmcs_read(GUEST_RIP); 1914 u32 insn_len = vmcs_read(EXI_INST_LEN); 1915 1916 assert_exit_reason(VMX_VMCALL); 1917 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1918 } 1919 1920 static void v2_null_test_guest(void) 1921 { 1922 } 1923 1924 static void v2_null_test(void) 1925 { 1926 test_set_guest(v2_null_test_guest); 1927 enter_guest(); 1928 report(__func__, 1); 1929 } 1930 1931 static void v2_multiple_entries_test_guest(void) 1932 { 1933 vmx_set_test_stage(1); 1934 vmcall(); 1935 vmx_set_test_stage(2); 1936 } 1937 1938 static void v2_multiple_entries_test(void) 1939 { 1940 test_set_guest(v2_multiple_entries_test_guest); 1941 enter_guest(); 1942 TEST_ASSERT_EQ(vmx_get_test_stage(), 1); 1943 skip_exit_vmcall(); 1944 enter_guest(); 1945 TEST_ASSERT_EQ(vmx_get_test_stage(), 2); 1946 report(__func__, 1); 1947 } 1948 1949 static int fixture_test_data = 1; 1950 1951 static void fixture_test_teardown(void *data) 1952 { 1953 *((int *) data) = 1; 1954 } 1955 1956 static void fixture_test_guest(void) 1957 { 1958 fixture_test_data++; 1959 } 1960 1961 1962 static void fixture_test_setup(void) 1963 { 1964 TEST_ASSERT_EQ_MSG(1, fixture_test_data, 1965 "fixture_test_teardown didn't run?!"); 1966 fixture_test_data = 2; 1967 test_add_teardown(fixture_test_teardown, &fixture_test_data); 1968 test_set_guest(fixture_test_guest); 1969 } 1970 1971 static void fixture_test_case1(void) 1972 { 1973 fixture_test_setup(); 1974 TEST_ASSERT_EQ(2, fixture_test_data); 1975 enter_guest(); 1976 TEST_ASSERT_EQ(3, fixture_test_data); 1977 report(__func__, 1); 1978 } 1979 1980 static void fixture_test_case2(void) 1981 { 1982 fixture_test_setup(); 1983 TEST_ASSERT_EQ(2, fixture_test_data); 1984 enter_guest(); 1985 TEST_ASSERT_EQ(3, fixture_test_data); 1986 report(__func__, 1); 1987 } 1988 1989 #define TEST(name) { #name, .v2 = name } 1990 1991 /* name/init/guest_main/exit_handler/syscall_handler/guest_regs */ 1992 struct vmx_test vmx_tests[] = { 1993 { "null", NULL, basic_guest_main, basic_exit_handler, NULL, {0} }, 1994 { "vmenter", NULL, vmenter_main, vmenter_exit_handler, NULL, {0} }, 1995 { "preemption timer", preemption_timer_init, preemption_timer_main, 1996 preemption_timer_exit_handler, NULL, {0} }, 1997 { "control field PAT", test_ctrl_pat_init, test_ctrl_pat_main, 1998 test_ctrl_pat_exit_handler, NULL, {0} }, 1999 { "control field EFER", test_ctrl_efer_init, test_ctrl_efer_main, 2000 test_ctrl_efer_exit_handler, NULL, {0} }, 2001 { "CR shadowing", NULL, cr_shadowing_main, 2002 cr_shadowing_exit_handler, NULL, {0} }, 2003 { "I/O bitmap", iobmp_init, iobmp_main, iobmp_exit_handler, 2004 NULL, {0} }, 2005 { "instruction intercept", insn_intercept_init, insn_intercept_main, 2006 insn_intercept_exit_handler, NULL, {0} }, 2007 { "EPT A/D disabled", ept_init, ept_main, ept_exit_handler, NULL, {0} }, 2008 { "EPT A/D enabled", eptad_init, eptad_main, eptad_exit_handler, NULL, {0} }, 2009 { "VPID", vpid_init, vpid_main, vpid_exit_handler, NULL, {0} }, 2010 { "interrupt", interrupt_init, interrupt_main, 2011 interrupt_exit_handler, NULL, {0} }, 2012 { "debug controls", dbgctls_init, dbgctls_main, dbgctls_exit_handler, 2013 NULL, {0} }, 2014 { "MSR switch", msr_switch_init, msr_switch_main, 2015 msr_switch_exit_handler, NULL, {0}, msr_switch_entry_failure }, 2016 { "vmmcall", vmmcall_init, vmmcall_main, vmmcall_exit_handler, NULL, {0} }, 2017 { "disable RDTSCP", disable_rdtscp_init, disable_rdtscp_main, 2018 disable_rdtscp_exit_handler, NULL, {0} }, 2019 { "int3", int3_init, int3_guest_main, int3_exit_handler, NULL, {0} }, 2020 { "into", into_init, into_guest_main, into_exit_handler, NULL, {0} }, 2021 { "exit_monitor_from_l2_test", NULL, exit_monitor_from_l2_main, 2022 exit_monitor_from_l2_handler, NULL, {0} }, 2023 /* Basic V2 tests. */ 2024 TEST(v2_null_test), 2025 TEST(v2_multiple_entries_test), 2026 TEST(fixture_test_case1), 2027 TEST(fixture_test_case2), 2028 { NULL, NULL, NULL, NULL, NULL, {0} }, 2029 }; 2030