1 /* 2 * All test cases of nested virtualization should be in this file 3 * 4 * Author : Arthur Chunqi Li <yzt356@gmail.com> 5 */ 6 #include "vmx.h" 7 #include "msr.h" 8 #include "processor.h" 9 #include "vm.h" 10 #include "fwcfg.h" 11 #include "isr.h" 12 #include "desc.h" 13 #include "apic.h" 14 #include "types.h" 15 16 u64 ia32_pat; 17 u64 ia32_efer; 18 void *io_bitmap_a, *io_bitmap_b; 19 u16 ioport; 20 21 unsigned long *pml4; 22 u64 eptp; 23 void *data_page1, *data_page2; 24 25 static inline void vmcall() 26 { 27 asm volatile("vmcall"); 28 } 29 30 void basic_guest_main() 31 { 32 report("Basic VMX test", 1); 33 } 34 35 int basic_exit_handler() 36 { 37 report("Basic VMX test", 0); 38 print_vmexit_info(); 39 return VMX_TEST_EXIT; 40 } 41 42 void vmenter_main() 43 { 44 u64 rax; 45 u64 rsp, resume_rsp; 46 47 report("test vmlaunch", 1); 48 49 asm volatile( 50 "mov %%rsp, %0\n\t" 51 "mov %3, %%rax\n\t" 52 "vmcall\n\t" 53 "mov %%rax, %1\n\t" 54 "mov %%rsp, %2\n\t" 55 : "=r"(rsp), "=r"(rax), "=r"(resume_rsp) 56 : "g"(0xABCD)); 57 report("test vmresume", (rax == 0xFFFF) && (rsp == resume_rsp)); 58 } 59 60 int vmenter_exit_handler() 61 { 62 u64 guest_rip; 63 ulong reason; 64 65 guest_rip = vmcs_read(GUEST_RIP); 66 reason = vmcs_read(EXI_REASON) & 0xff; 67 switch (reason) { 68 case VMX_VMCALL: 69 if (regs.rax != 0xABCD) { 70 report("test vmresume", 0); 71 return VMX_TEST_VMEXIT; 72 } 73 regs.rax = 0xFFFF; 74 vmcs_write(GUEST_RIP, guest_rip + 3); 75 return VMX_TEST_RESUME; 76 default: 77 report("test vmresume", 0); 78 print_vmexit_info(); 79 } 80 return VMX_TEST_VMEXIT; 81 } 82 83 u32 preempt_scale; 84 volatile unsigned long long tsc_val; 85 volatile u32 preempt_val; 86 u64 saved_rip; 87 88 int preemption_timer_init() 89 { 90 if (!(ctrl_pin_rev.clr & PIN_PREEMPT)) { 91 printf("\tPreemption timer is not supported\n"); 92 return VMX_TEST_EXIT; 93 } 94 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) | PIN_PREEMPT); 95 preempt_val = 10000000; 96 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 97 preempt_scale = rdmsr(MSR_IA32_VMX_MISC) & 0x1F; 98 99 if (!(ctrl_exit_rev.clr & EXI_SAVE_PREEMPT)) 100 printf("\tSave preemption value is not supported\n"); 101 102 return VMX_TEST_START; 103 } 104 105 void preemption_timer_main() 106 { 107 tsc_val = rdtsc(); 108 if (ctrl_exit_rev.clr & EXI_SAVE_PREEMPT) { 109 vmx_set_test_stage(0); 110 vmcall(); 111 if (vmx_get_test_stage() == 1) 112 vmcall(); 113 } 114 vmx_set_test_stage(1); 115 while (vmx_get_test_stage() == 1) { 116 if (((rdtsc() - tsc_val) >> preempt_scale) 117 > 10 * preempt_val) { 118 vmx_set_test_stage(2); 119 vmcall(); 120 } 121 } 122 tsc_val = rdtsc(); 123 asm volatile ("hlt"); 124 vmcall(); 125 vmx_set_test_stage(5); 126 vmcall(); 127 } 128 129 int preemption_timer_exit_handler() 130 { 131 bool guest_halted; 132 u64 guest_rip; 133 ulong reason; 134 u32 insn_len; 135 u32 ctrl_exit; 136 137 guest_rip = vmcs_read(GUEST_RIP); 138 reason = vmcs_read(EXI_REASON) & 0xff; 139 insn_len = vmcs_read(EXI_INST_LEN); 140 switch (reason) { 141 case VMX_PREEMPT: 142 switch (vmx_get_test_stage()) { 143 case 1: 144 case 2: 145 report("busy-wait for preemption timer", 146 ((rdtsc() - tsc_val) >> preempt_scale) >= 147 preempt_val); 148 vmx_set_test_stage(3); 149 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 150 return VMX_TEST_RESUME; 151 case 3: 152 guest_halted = 153 (vmcs_read(GUEST_ACTV_STATE) == ACTV_HLT); 154 report("preemption timer during hlt", 155 ((rdtsc() - tsc_val) >> preempt_scale) >= 156 preempt_val && guest_halted); 157 vmx_set_test_stage(4); 158 vmcs_write(PIN_CONTROLS, 159 vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT); 160 vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE); 161 return VMX_TEST_RESUME; 162 case 4: 163 report("preemption timer with 0 value", 164 saved_rip == guest_rip); 165 break; 166 default: 167 printf("Invalid stage.\n"); 168 print_vmexit_info(); 169 break; 170 } 171 break; 172 case VMX_VMCALL: 173 vmcs_write(GUEST_RIP, guest_rip + insn_len); 174 switch (vmx_get_test_stage()) { 175 case 0: 176 report("Keep preemption value", 177 vmcs_read(PREEMPT_TIMER_VALUE) == preempt_val); 178 vmx_set_test_stage(1); 179 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 180 ctrl_exit = (vmcs_read(EXI_CONTROLS) | 181 EXI_SAVE_PREEMPT) & ctrl_exit_rev.clr; 182 vmcs_write(EXI_CONTROLS, ctrl_exit); 183 return VMX_TEST_RESUME; 184 case 1: 185 report("Save preemption value", 186 vmcs_read(PREEMPT_TIMER_VALUE) < preempt_val); 187 return VMX_TEST_RESUME; 188 case 2: 189 report("busy-wait for preemption timer", 0); 190 vmx_set_test_stage(3); 191 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 192 return VMX_TEST_RESUME; 193 case 3: 194 report("preemption timer during hlt", 0); 195 vmx_set_test_stage(4); 196 /* fall through */ 197 case 4: 198 vmcs_write(PIN_CONTROLS, 199 vmcs_read(PIN_CONTROLS) | PIN_PREEMPT); 200 vmcs_write(PREEMPT_TIMER_VALUE, 0); 201 saved_rip = guest_rip + insn_len; 202 return VMX_TEST_RESUME; 203 case 5: 204 report("preemption timer with 0 value (vmcall stage 5)", 0); 205 break; 206 default: 207 // Should not reach here 208 printf("ERROR : unexpected stage, %d\n", 209 vmx_get_test_stage()); 210 print_vmexit_info(); 211 return VMX_TEST_VMEXIT; 212 } 213 break; 214 default: 215 printf("Unknown exit reason, %ld\n", reason); 216 print_vmexit_info(); 217 } 218 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT); 219 return VMX_TEST_VMEXIT; 220 } 221 222 void msr_bmp_init() 223 { 224 void *msr_bitmap; 225 u32 ctrl_cpu0; 226 227 msr_bitmap = alloc_page(); 228 memset(msr_bitmap, 0x0, PAGE_SIZE); 229 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 230 ctrl_cpu0 |= CPU_MSR_BITMAP; 231 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 232 vmcs_write(MSR_BITMAP, (u64)msr_bitmap); 233 } 234 235 static int test_ctrl_pat_init() 236 { 237 u64 ctrl_ent; 238 u64 ctrl_exi; 239 240 msr_bmp_init(); 241 if (!(ctrl_exit_rev.clr & EXI_SAVE_PAT) && 242 !(ctrl_exit_rev.clr & EXI_LOAD_PAT) && 243 !(ctrl_enter_rev.clr & ENT_LOAD_PAT)) { 244 printf("\tSave/load PAT is not supported\n"); 245 return 1; 246 } 247 248 ctrl_ent = vmcs_read(ENT_CONTROLS); 249 ctrl_exi = vmcs_read(EXI_CONTROLS); 250 ctrl_ent |= ctrl_enter_rev.clr & ENT_LOAD_PAT; 251 ctrl_exi |= ctrl_exit_rev.clr & (EXI_SAVE_PAT | EXI_LOAD_PAT); 252 vmcs_write(ENT_CONTROLS, ctrl_ent); 253 vmcs_write(EXI_CONTROLS, ctrl_exi); 254 ia32_pat = rdmsr(MSR_IA32_CR_PAT); 255 vmcs_write(GUEST_PAT, 0x0); 256 vmcs_write(HOST_PAT, ia32_pat); 257 return VMX_TEST_START; 258 } 259 260 static void test_ctrl_pat_main() 261 { 262 u64 guest_ia32_pat; 263 264 guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT); 265 if (!(ctrl_enter_rev.clr & ENT_LOAD_PAT)) 266 printf("\tENT_LOAD_PAT is not supported.\n"); 267 else { 268 if (guest_ia32_pat != 0) { 269 report("Entry load PAT", 0); 270 return; 271 } 272 } 273 wrmsr(MSR_IA32_CR_PAT, 0x6); 274 vmcall(); 275 guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT); 276 if (ctrl_enter_rev.clr & ENT_LOAD_PAT) 277 report("Entry load PAT", guest_ia32_pat == ia32_pat); 278 } 279 280 static int test_ctrl_pat_exit_handler() 281 { 282 u64 guest_rip; 283 ulong reason; 284 u64 guest_pat; 285 286 guest_rip = vmcs_read(GUEST_RIP); 287 reason = vmcs_read(EXI_REASON) & 0xff; 288 switch (reason) { 289 case VMX_VMCALL: 290 guest_pat = vmcs_read(GUEST_PAT); 291 if (!(ctrl_exit_rev.clr & EXI_SAVE_PAT)) { 292 printf("\tEXI_SAVE_PAT is not supported\n"); 293 vmcs_write(GUEST_PAT, 0x6); 294 } else { 295 report("Exit save PAT", guest_pat == 0x6); 296 } 297 if (!(ctrl_exit_rev.clr & EXI_LOAD_PAT)) 298 printf("\tEXI_LOAD_PAT is not supported\n"); 299 else 300 report("Exit load PAT", rdmsr(MSR_IA32_CR_PAT) == ia32_pat); 301 vmcs_write(GUEST_PAT, ia32_pat); 302 vmcs_write(GUEST_RIP, guest_rip + 3); 303 return VMX_TEST_RESUME; 304 default: 305 printf("ERROR : Undefined exit reason, reason = %ld.\n", reason); 306 break; 307 } 308 return VMX_TEST_VMEXIT; 309 } 310 311 static int test_ctrl_efer_init() 312 { 313 u64 ctrl_ent; 314 u64 ctrl_exi; 315 316 msr_bmp_init(); 317 ctrl_ent = vmcs_read(ENT_CONTROLS) | ENT_LOAD_EFER; 318 ctrl_exi = vmcs_read(EXI_CONTROLS) | EXI_SAVE_EFER | EXI_LOAD_EFER; 319 vmcs_write(ENT_CONTROLS, ctrl_ent & ctrl_enter_rev.clr); 320 vmcs_write(EXI_CONTROLS, ctrl_exi & ctrl_exit_rev.clr); 321 ia32_efer = rdmsr(MSR_EFER); 322 vmcs_write(GUEST_EFER, ia32_efer ^ EFER_NX); 323 vmcs_write(HOST_EFER, ia32_efer ^ EFER_NX); 324 return VMX_TEST_START; 325 } 326 327 static void test_ctrl_efer_main() 328 { 329 u64 guest_ia32_efer; 330 331 guest_ia32_efer = rdmsr(MSR_EFER); 332 if (!(ctrl_enter_rev.clr & ENT_LOAD_EFER)) 333 printf("\tENT_LOAD_EFER is not supported.\n"); 334 else { 335 if (guest_ia32_efer != (ia32_efer ^ EFER_NX)) { 336 report("Entry load EFER", 0); 337 return; 338 } 339 } 340 wrmsr(MSR_EFER, ia32_efer); 341 vmcall(); 342 guest_ia32_efer = rdmsr(MSR_EFER); 343 if (ctrl_enter_rev.clr & ENT_LOAD_EFER) 344 report("Entry load EFER", guest_ia32_efer == ia32_efer); 345 } 346 347 static int test_ctrl_efer_exit_handler() 348 { 349 u64 guest_rip; 350 ulong reason; 351 u64 guest_efer; 352 353 guest_rip = vmcs_read(GUEST_RIP); 354 reason = vmcs_read(EXI_REASON) & 0xff; 355 switch (reason) { 356 case VMX_VMCALL: 357 guest_efer = vmcs_read(GUEST_EFER); 358 if (!(ctrl_exit_rev.clr & EXI_SAVE_EFER)) { 359 printf("\tEXI_SAVE_EFER is not supported\n"); 360 vmcs_write(GUEST_EFER, ia32_efer); 361 } else { 362 report("Exit save EFER", guest_efer == ia32_efer); 363 } 364 if (!(ctrl_exit_rev.clr & EXI_LOAD_EFER)) { 365 printf("\tEXI_LOAD_EFER is not supported\n"); 366 wrmsr(MSR_EFER, ia32_efer ^ EFER_NX); 367 } else { 368 report("Exit load EFER", rdmsr(MSR_EFER) == (ia32_efer ^ EFER_NX)); 369 } 370 vmcs_write(GUEST_PAT, ia32_efer); 371 vmcs_write(GUEST_RIP, guest_rip + 3); 372 return VMX_TEST_RESUME; 373 default: 374 printf("ERROR : Undefined exit reason, reason = %ld.\n", reason); 375 break; 376 } 377 return VMX_TEST_VMEXIT; 378 } 379 380 u32 guest_cr0, guest_cr4; 381 382 static void cr_shadowing_main() 383 { 384 u32 cr0, cr4, tmp; 385 386 // Test read through 387 vmx_set_test_stage(0); 388 guest_cr0 = read_cr0(); 389 if (vmx_get_test_stage() == 1) 390 report("Read through CR0", 0); 391 else 392 vmcall(); 393 vmx_set_test_stage(1); 394 guest_cr4 = read_cr4(); 395 if (vmx_get_test_stage() == 2) 396 report("Read through CR4", 0); 397 else 398 vmcall(); 399 // Test write through 400 guest_cr0 = guest_cr0 ^ (X86_CR0_TS | X86_CR0_MP); 401 guest_cr4 = guest_cr4 ^ (X86_CR4_TSD | X86_CR4_DE); 402 vmx_set_test_stage(2); 403 write_cr0(guest_cr0); 404 if (vmx_get_test_stage() == 3) 405 report("Write throuth CR0", 0); 406 else 407 vmcall(); 408 vmx_set_test_stage(3); 409 write_cr4(guest_cr4); 410 if (vmx_get_test_stage() == 4) 411 report("Write through CR4", 0); 412 else 413 vmcall(); 414 // Test read shadow 415 vmx_set_test_stage(4); 416 vmcall(); 417 cr0 = read_cr0(); 418 if (vmx_get_test_stage() != 5) 419 report("Read shadowing CR0", cr0 == guest_cr0); 420 vmx_set_test_stage(5); 421 cr4 = read_cr4(); 422 if (vmx_get_test_stage() != 6) 423 report("Read shadowing CR4", cr4 == guest_cr4); 424 // Test write shadow (same value with shadow) 425 vmx_set_test_stage(6); 426 write_cr0(guest_cr0); 427 if (vmx_get_test_stage() == 7) 428 report("Write shadowing CR0 (same value with shadow)", 0); 429 else 430 vmcall(); 431 vmx_set_test_stage(7); 432 write_cr4(guest_cr4); 433 if (vmx_get_test_stage() == 8) 434 report("Write shadowing CR4 (same value with shadow)", 0); 435 else 436 vmcall(); 437 // Test write shadow (different value) 438 vmx_set_test_stage(8); 439 tmp = guest_cr0 ^ X86_CR0_TS; 440 asm volatile("mov %0, %%rsi\n\t" 441 "mov %%rsi, %%cr0\n\t" 442 ::"m"(tmp) 443 :"rsi", "memory", "cc"); 444 report("Write shadowing different X86_CR0_TS", vmx_get_test_stage() == 9); 445 vmx_set_test_stage(9); 446 tmp = guest_cr0 ^ X86_CR0_MP; 447 asm volatile("mov %0, %%rsi\n\t" 448 "mov %%rsi, %%cr0\n\t" 449 ::"m"(tmp) 450 :"rsi", "memory", "cc"); 451 report("Write shadowing different X86_CR0_MP", vmx_get_test_stage() == 10); 452 vmx_set_test_stage(10); 453 tmp = guest_cr4 ^ X86_CR4_TSD; 454 asm volatile("mov %0, %%rsi\n\t" 455 "mov %%rsi, %%cr4\n\t" 456 ::"m"(tmp) 457 :"rsi", "memory", "cc"); 458 report("Write shadowing different X86_CR4_TSD", vmx_get_test_stage() == 11); 459 vmx_set_test_stage(11); 460 tmp = guest_cr4 ^ X86_CR4_DE; 461 asm volatile("mov %0, %%rsi\n\t" 462 "mov %%rsi, %%cr4\n\t" 463 ::"m"(tmp) 464 :"rsi", "memory", "cc"); 465 report("Write shadowing different X86_CR4_DE", vmx_get_test_stage() == 12); 466 } 467 468 static int cr_shadowing_exit_handler() 469 { 470 u64 guest_rip; 471 ulong reason; 472 u32 insn_len; 473 u32 exit_qual; 474 475 guest_rip = vmcs_read(GUEST_RIP); 476 reason = vmcs_read(EXI_REASON) & 0xff; 477 insn_len = vmcs_read(EXI_INST_LEN); 478 exit_qual = vmcs_read(EXI_QUALIFICATION); 479 switch (reason) { 480 case VMX_VMCALL: 481 switch (vmx_get_test_stage()) { 482 case 0: 483 report("Read through CR0", guest_cr0 == vmcs_read(GUEST_CR0)); 484 break; 485 case 1: 486 report("Read through CR4", guest_cr4 == vmcs_read(GUEST_CR4)); 487 break; 488 case 2: 489 report("Write through CR0", guest_cr0 == vmcs_read(GUEST_CR0)); 490 break; 491 case 3: 492 report("Write through CR4", guest_cr4 == vmcs_read(GUEST_CR4)); 493 break; 494 case 4: 495 guest_cr0 = vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP); 496 guest_cr4 = vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE); 497 vmcs_write(CR0_MASK, X86_CR0_TS | X86_CR0_MP); 498 vmcs_write(CR0_READ_SHADOW, guest_cr0 & (X86_CR0_TS | X86_CR0_MP)); 499 vmcs_write(CR4_MASK, X86_CR4_TSD | X86_CR4_DE); 500 vmcs_write(CR4_READ_SHADOW, guest_cr4 & (X86_CR4_TSD | X86_CR4_DE)); 501 break; 502 case 6: 503 report("Write shadowing CR0 (same value)", 504 guest_cr0 == (vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP))); 505 break; 506 case 7: 507 report("Write shadowing CR4 (same value)", 508 guest_cr4 == (vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE))); 509 break; 510 default: 511 // Should not reach here 512 printf("ERROR : unexpected stage, %d\n", 513 vmx_get_test_stage()); 514 print_vmexit_info(); 515 return VMX_TEST_VMEXIT; 516 } 517 vmcs_write(GUEST_RIP, guest_rip + insn_len); 518 return VMX_TEST_RESUME; 519 case VMX_CR: 520 switch (vmx_get_test_stage()) { 521 case 4: 522 report("Read shadowing CR0", 0); 523 vmx_inc_test_stage(); 524 break; 525 case 5: 526 report("Read shadowing CR4", 0); 527 vmx_inc_test_stage(); 528 break; 529 case 6: 530 report("Write shadowing CR0 (same value)", 0); 531 vmx_inc_test_stage(); 532 break; 533 case 7: 534 report("Write shadowing CR4 (same value)", 0); 535 vmx_inc_test_stage(); 536 break; 537 case 8: 538 case 9: 539 // 0x600 encodes "mov %esi, %cr0" 540 if (exit_qual == 0x600) 541 vmx_inc_test_stage(); 542 break; 543 case 10: 544 case 11: 545 // 0x604 encodes "mov %esi, %cr4" 546 if (exit_qual == 0x604) 547 vmx_inc_test_stage(); 548 break; 549 default: 550 // Should not reach here 551 printf("ERROR : unexpected stage, %d\n", 552 vmx_get_test_stage()); 553 print_vmexit_info(); 554 return VMX_TEST_VMEXIT; 555 } 556 vmcs_write(GUEST_RIP, guest_rip + insn_len); 557 return VMX_TEST_RESUME; 558 default: 559 printf("Unknown exit reason, %ld\n", reason); 560 print_vmexit_info(); 561 } 562 return VMX_TEST_VMEXIT; 563 } 564 565 static int iobmp_init() 566 { 567 u32 ctrl_cpu0; 568 569 io_bitmap_a = alloc_page(); 570 io_bitmap_b = alloc_page(); 571 memset(io_bitmap_a, 0x0, PAGE_SIZE); 572 memset(io_bitmap_b, 0x0, PAGE_SIZE); 573 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 574 ctrl_cpu0 |= CPU_IO_BITMAP; 575 ctrl_cpu0 &= (~CPU_IO); 576 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 577 vmcs_write(IO_BITMAP_A, (u64)io_bitmap_a); 578 vmcs_write(IO_BITMAP_B, (u64)io_bitmap_b); 579 return VMX_TEST_START; 580 } 581 582 static void iobmp_main() 583 { 584 // stage 0, test IO pass 585 vmx_set_test_stage(0); 586 inb(0x5000); 587 outb(0x0, 0x5000); 588 report("I/O bitmap - I/O pass", vmx_get_test_stage() == 0); 589 // test IO width, in/out 590 ((u8 *)io_bitmap_a)[0] = 0xFF; 591 vmx_set_test_stage(2); 592 inb(0x0); 593 report("I/O bitmap - trap in", vmx_get_test_stage() == 3); 594 vmx_set_test_stage(3); 595 outw(0x0, 0x0); 596 report("I/O bitmap - trap out", vmx_get_test_stage() == 4); 597 vmx_set_test_stage(4); 598 inl(0x0); 599 report("I/O bitmap - I/O width, long", vmx_get_test_stage() == 5); 600 // test low/high IO port 601 vmx_set_test_stage(5); 602 ((u8 *)io_bitmap_a)[0x5000 / 8] = (1 << (0x5000 % 8)); 603 inb(0x5000); 604 report("I/O bitmap - I/O port, low part", vmx_get_test_stage() == 6); 605 vmx_set_test_stage(6); 606 ((u8 *)io_bitmap_b)[0x1000 / 8] = (1 << (0x1000 % 8)); 607 inb(0x9000); 608 report("I/O bitmap - I/O port, high part", vmx_get_test_stage() == 7); 609 // test partial pass 610 vmx_set_test_stage(7); 611 inl(0x4FFF); 612 report("I/O bitmap - partial pass", vmx_get_test_stage() == 8); 613 // test overrun 614 vmx_set_test_stage(8); 615 memset(io_bitmap_a, 0x0, PAGE_SIZE); 616 memset(io_bitmap_b, 0x0, PAGE_SIZE); 617 inl(0xFFFF); 618 report("I/O bitmap - overrun", vmx_get_test_stage() == 9); 619 vmx_set_test_stage(9); 620 vmcall(); 621 outb(0x0, 0x0); 622 report("I/O bitmap - ignore unconditional exiting", 623 vmx_get_test_stage() == 9); 624 vmx_set_test_stage(10); 625 vmcall(); 626 outb(0x0, 0x0); 627 report("I/O bitmap - unconditional exiting", 628 vmx_get_test_stage() == 11); 629 } 630 631 static int iobmp_exit_handler() 632 { 633 u64 guest_rip; 634 ulong reason, exit_qual; 635 u32 insn_len, ctrl_cpu0; 636 637 guest_rip = vmcs_read(GUEST_RIP); 638 reason = vmcs_read(EXI_REASON) & 0xff; 639 exit_qual = vmcs_read(EXI_QUALIFICATION); 640 insn_len = vmcs_read(EXI_INST_LEN); 641 switch (reason) { 642 case VMX_IO: 643 switch (vmx_get_test_stage()) { 644 case 0: 645 case 1: 646 vmx_inc_test_stage(); 647 break; 648 case 2: 649 report("I/O bitmap - I/O width, byte", 650 (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_BYTE); 651 report("I/O bitmap - I/O direction, in", exit_qual & VMX_IO_IN); 652 vmx_inc_test_stage(); 653 break; 654 case 3: 655 report("I/O bitmap - I/O width, word", 656 (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_WORD); 657 report("I/O bitmap - I/O direction, out", 658 !(exit_qual & VMX_IO_IN)); 659 vmx_inc_test_stage(); 660 break; 661 case 4: 662 report("I/O bitmap - I/O width, long", 663 (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_LONG); 664 vmx_inc_test_stage(); 665 break; 666 case 5: 667 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x5000) 668 vmx_inc_test_stage(); 669 break; 670 case 6: 671 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x9000) 672 vmx_inc_test_stage(); 673 break; 674 case 7: 675 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x4FFF) 676 vmx_inc_test_stage(); 677 break; 678 case 8: 679 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0xFFFF) 680 vmx_inc_test_stage(); 681 break; 682 case 9: 683 case 10: 684 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 685 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0 & ~CPU_IO); 686 vmx_inc_test_stage(); 687 break; 688 default: 689 // Should not reach here 690 printf("ERROR : unexpected stage, %d\n", 691 vmx_get_test_stage()); 692 print_vmexit_info(); 693 return VMX_TEST_VMEXIT; 694 } 695 vmcs_write(GUEST_RIP, guest_rip + insn_len); 696 return VMX_TEST_RESUME; 697 case VMX_VMCALL: 698 switch (vmx_get_test_stage()) { 699 case 9: 700 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 701 ctrl_cpu0 |= CPU_IO | CPU_IO_BITMAP; 702 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 703 break; 704 case 10: 705 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 706 ctrl_cpu0 = (ctrl_cpu0 & ~CPU_IO_BITMAP) | CPU_IO; 707 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 708 break; 709 default: 710 // Should not reach here 711 printf("ERROR : unexpected stage, %d\n", 712 vmx_get_test_stage()); 713 print_vmexit_info(); 714 return VMX_TEST_VMEXIT; 715 } 716 vmcs_write(GUEST_RIP, guest_rip + insn_len); 717 return VMX_TEST_RESUME; 718 default: 719 printf("guest_rip = 0x%lx\n", guest_rip); 720 printf("\tERROR : Undefined exit reason, reason = %ld.\n", reason); 721 break; 722 } 723 return VMX_TEST_VMEXIT; 724 } 725 726 #define INSN_CPU0 0 727 #define INSN_CPU1 1 728 #define INSN_ALWAYS_TRAP 2 729 730 #define FIELD_EXIT_QUAL (1 << 0) 731 #define FIELD_INSN_INFO (1 << 1) 732 733 asm( 734 "insn_hlt: hlt;ret\n\t" 735 "insn_invlpg: invlpg 0x12345678;ret\n\t" 736 "insn_mwait: xor %eax, %eax; xor %ecx, %ecx; mwait;ret\n\t" 737 "insn_rdpmc: xor %ecx, %ecx; rdpmc;ret\n\t" 738 "insn_rdtsc: rdtsc;ret\n\t" 739 "insn_cr3_load: mov cr3,%rax; mov %rax,%cr3;ret\n\t" 740 "insn_cr3_store: mov %cr3,%rax;ret\n\t" 741 #ifdef __x86_64__ 742 "insn_cr8_load: mov %rax,%cr8;ret\n\t" 743 "insn_cr8_store: mov %cr8,%rax;ret\n\t" 744 #endif 745 "insn_monitor: xor %eax, %eax; xor %ecx, %ecx; xor %edx, %edx; monitor;ret\n\t" 746 "insn_pause: pause;ret\n\t" 747 "insn_wbinvd: wbinvd;ret\n\t" 748 "insn_cpuid: mov $10, %eax; cpuid;ret\n\t" 749 "insn_invd: invd;ret\n\t" 750 "insn_sgdt: sgdt gdt64_desc;ret\n\t" 751 "insn_lgdt: lgdt gdt64_desc;ret\n\t" 752 "insn_sidt: sidt idt_descr;ret\n\t" 753 "insn_lidt: lidt idt_descr;ret\n\t" 754 "insn_sldt: sldt %ax;ret\n\t" 755 "insn_lldt: xor %eax, %eax; lldt %ax;ret\n\t" 756 "insn_str: str %ax;ret\n\t" 757 ); 758 extern void insn_hlt(); 759 extern void insn_invlpg(); 760 extern void insn_mwait(); 761 extern void insn_rdpmc(); 762 extern void insn_rdtsc(); 763 extern void insn_cr3_load(); 764 extern void insn_cr3_store(); 765 #ifdef __x86_64__ 766 extern void insn_cr8_load(); 767 extern void insn_cr8_store(); 768 #endif 769 extern void insn_monitor(); 770 extern void insn_pause(); 771 extern void insn_wbinvd(); 772 extern void insn_sgdt(); 773 extern void insn_lgdt(); 774 extern void insn_sidt(); 775 extern void insn_lidt(); 776 extern void insn_sldt(); 777 extern void insn_lldt(); 778 extern void insn_str(); 779 extern void insn_cpuid(); 780 extern void insn_invd(); 781 782 u32 cur_insn; 783 u64 cr3; 784 785 struct insn_table { 786 const char *name; 787 u32 flag; 788 void (*insn_func)(); 789 u32 type; 790 u32 reason; 791 ulong exit_qual; 792 u32 insn_info; 793 // Use FIELD_EXIT_QUAL and FIELD_INSN_INFO to define 794 // which field need to be tested, reason is always tested 795 u32 test_field; 796 }; 797 798 /* 799 * Add more test cases of instruction intercept here. Elements in this 800 * table is: 801 * name/control flag/insn function/type/exit reason/exit qulification/ 802 * instruction info/field to test 803 * The last field defines which fields (exit_qual and insn_info) need to be 804 * tested in exit handler. If set to 0, only "reason" is checked. 805 */ 806 static struct insn_table insn_table[] = { 807 // Flags for Primary Processor-Based VM-Execution Controls 808 {"HLT", CPU_HLT, insn_hlt, INSN_CPU0, 12, 0, 0, 0}, 809 {"INVLPG", CPU_INVLPG, insn_invlpg, INSN_CPU0, 14, 810 0x12345678, 0, FIELD_EXIT_QUAL}, 811 {"MWAIT", CPU_MWAIT, insn_mwait, INSN_CPU0, 36, 0, 0, 0}, 812 {"RDPMC", CPU_RDPMC, insn_rdpmc, INSN_CPU0, 15, 0, 0, 0}, 813 {"RDTSC", CPU_RDTSC, insn_rdtsc, INSN_CPU0, 16, 0, 0, 0}, 814 {"CR3 load", CPU_CR3_LOAD, insn_cr3_load, INSN_CPU0, 28, 0x3, 0, 815 FIELD_EXIT_QUAL}, 816 {"CR3 store", CPU_CR3_STORE, insn_cr3_store, INSN_CPU0, 28, 0x13, 0, 817 FIELD_EXIT_QUAL}, 818 #ifdef __x86_64__ 819 {"CR8 load", CPU_CR8_LOAD, insn_cr8_load, INSN_CPU0, 28, 0x8, 0, 820 FIELD_EXIT_QUAL}, 821 {"CR8 store", CPU_CR8_STORE, insn_cr8_store, INSN_CPU0, 28, 0x18, 0, 822 FIELD_EXIT_QUAL}, 823 #endif 824 {"MONITOR", CPU_MONITOR, insn_monitor, INSN_CPU0, 39, 0, 0, 0}, 825 {"PAUSE", CPU_PAUSE, insn_pause, INSN_CPU0, 40, 0, 0, 0}, 826 // Flags for Secondary Processor-Based VM-Execution Controls 827 {"WBINVD", CPU_WBINVD, insn_wbinvd, INSN_CPU1, 54, 0, 0, 0}, 828 {"DESC_TABLE (SGDT)", CPU_DESC_TABLE, insn_sgdt, INSN_CPU1, 46, 0, 0, 0}, 829 {"DESC_TABLE (LGDT)", CPU_DESC_TABLE, insn_lgdt, INSN_CPU1, 46, 0, 0, 0}, 830 {"DESC_TABLE (SIDT)", CPU_DESC_TABLE, insn_sidt, INSN_CPU1, 46, 0, 0, 0}, 831 {"DESC_TABLE (LIDT)", CPU_DESC_TABLE, insn_lidt, INSN_CPU1, 46, 0, 0, 0}, 832 {"DESC_TABLE (SLDT)", CPU_DESC_TABLE, insn_sldt, INSN_CPU1, 47, 0, 0, 0}, 833 {"DESC_TABLE (LLDT)", CPU_DESC_TABLE, insn_lldt, INSN_CPU1, 47, 0, 0, 0}, 834 {"DESC_TABLE (STR)", CPU_DESC_TABLE, insn_str, INSN_CPU1, 47, 0, 0, 0}, 835 /* LTR causes a #GP if done with a busy selector, so it is not tested. */ 836 // Instructions always trap 837 {"CPUID", 0, insn_cpuid, INSN_ALWAYS_TRAP, 10, 0, 0, 0}, 838 {"INVD", 0, insn_invd, INSN_ALWAYS_TRAP, 13, 0, 0, 0}, 839 // Instructions never trap 840 {NULL}, 841 }; 842 843 static int insn_intercept_init() 844 { 845 u32 ctrl_cpu; 846 847 ctrl_cpu = ctrl_cpu_rev[0].set | CPU_SECONDARY; 848 ctrl_cpu &= ctrl_cpu_rev[0].clr; 849 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu); 850 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu_rev[1].set); 851 cr3 = read_cr3(); 852 return VMX_TEST_START; 853 } 854 855 static void insn_intercept_main() 856 { 857 for (cur_insn = 0; insn_table[cur_insn].name != NULL; cur_insn++) { 858 vmx_set_test_stage(cur_insn * 2); 859 if ((insn_table[cur_insn].type == INSN_CPU0 && 860 !(ctrl_cpu_rev[0].clr & insn_table[cur_insn].flag)) || 861 (insn_table[cur_insn].type == INSN_CPU1 && 862 !(ctrl_cpu_rev[1].clr & insn_table[cur_insn].flag))) { 863 printf("\tCPU_CTRL%d.CPU_%s is not supported.\n", 864 insn_table[cur_insn].type - INSN_CPU0, 865 insn_table[cur_insn].name); 866 continue; 867 } 868 869 if ((insn_table[cur_insn].type == INSN_CPU0 && 870 !(ctrl_cpu_rev[0].set & insn_table[cur_insn].flag)) || 871 (insn_table[cur_insn].type == INSN_CPU1 && 872 !(ctrl_cpu_rev[1].set & insn_table[cur_insn].flag))) { 873 /* skip hlt, it stalls the guest and is tested below */ 874 if (insn_table[cur_insn].insn_func != insn_hlt) 875 insn_table[cur_insn].insn_func(); 876 report("execute %s", vmx_get_test_stage() == cur_insn * 2, 877 insn_table[cur_insn].name); 878 } else if (insn_table[cur_insn].type != INSN_ALWAYS_TRAP) 879 printf("\tCPU_CTRL%d.CPU_%s always traps.\n", 880 insn_table[cur_insn].type - INSN_CPU0, 881 insn_table[cur_insn].name); 882 883 vmcall(); 884 885 insn_table[cur_insn].insn_func(); 886 report("intercept %s", vmx_get_test_stage() == cur_insn * 2 + 1, 887 insn_table[cur_insn].name); 888 889 vmx_set_test_stage(cur_insn * 2 + 1); 890 vmcall(); 891 } 892 } 893 894 static int insn_intercept_exit_handler() 895 { 896 u64 guest_rip; 897 u32 reason; 898 ulong exit_qual; 899 u32 insn_len; 900 u32 insn_info; 901 bool pass; 902 903 guest_rip = vmcs_read(GUEST_RIP); 904 reason = vmcs_read(EXI_REASON) & 0xff; 905 exit_qual = vmcs_read(EXI_QUALIFICATION); 906 insn_len = vmcs_read(EXI_INST_LEN); 907 insn_info = vmcs_read(EXI_INST_INFO); 908 909 if (reason == VMX_VMCALL) { 910 u32 val = 0; 911 912 if (insn_table[cur_insn].type == INSN_CPU0) 913 val = vmcs_read(CPU_EXEC_CTRL0); 914 else if (insn_table[cur_insn].type == INSN_CPU1) 915 val = vmcs_read(CPU_EXEC_CTRL1); 916 917 if (vmx_get_test_stage() & 1) 918 val &= ~insn_table[cur_insn].flag; 919 else 920 val |= insn_table[cur_insn].flag; 921 922 if (insn_table[cur_insn].type == INSN_CPU0) 923 vmcs_write(CPU_EXEC_CTRL0, val | ctrl_cpu_rev[0].set); 924 else if (insn_table[cur_insn].type == INSN_CPU1) 925 vmcs_write(CPU_EXEC_CTRL1, val | ctrl_cpu_rev[1].set); 926 } else { 927 pass = (cur_insn * 2 == vmx_get_test_stage()) && 928 insn_table[cur_insn].reason == reason; 929 if (insn_table[cur_insn].test_field & FIELD_EXIT_QUAL && 930 insn_table[cur_insn].exit_qual != exit_qual) 931 pass = false; 932 if (insn_table[cur_insn].test_field & FIELD_INSN_INFO && 933 insn_table[cur_insn].insn_info != insn_info) 934 pass = false; 935 if (pass) 936 vmx_inc_test_stage(); 937 } 938 vmcs_write(GUEST_RIP, guest_rip + insn_len); 939 return VMX_TEST_RESUME; 940 } 941 942 943 static int setup_ept(bool enable_ad) 944 { 945 int support_2m; 946 unsigned long end_of_memory; 947 u32 ctrl_cpu[2]; 948 949 if (!(ept_vpid.val & EPT_CAP_UC) && 950 !(ept_vpid.val & EPT_CAP_WB)) { 951 printf("\tEPT paging-structure memory type " 952 "UC&WB are not supported\n"); 953 return 1; 954 } 955 if (ept_vpid.val & EPT_CAP_UC) 956 eptp = EPT_MEM_TYPE_UC; 957 else 958 eptp = EPT_MEM_TYPE_WB; 959 if (!(ept_vpid.val & EPT_CAP_PWL4)) { 960 printf("\tPWL4 is not supported\n"); 961 return 1; 962 } 963 ctrl_cpu[0] = vmcs_read(CPU_EXEC_CTRL0); 964 ctrl_cpu[1] = vmcs_read(CPU_EXEC_CTRL1); 965 ctrl_cpu[0] = (ctrl_cpu[0] | CPU_SECONDARY) 966 & ctrl_cpu_rev[0].clr; 967 ctrl_cpu[1] = (ctrl_cpu[1] | CPU_EPT) 968 & ctrl_cpu_rev[1].clr; 969 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu[0]); 970 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu[1]); 971 eptp |= (3 << EPTP_PG_WALK_LEN_SHIFT); 972 pml4 = alloc_page(); 973 memset(pml4, 0, PAGE_SIZE); 974 eptp |= virt_to_phys(pml4); 975 if (enable_ad) 976 eptp |= EPTP_AD_FLAG; 977 vmcs_write(EPTP, eptp); 978 support_2m = !!(ept_vpid.val & EPT_CAP_2M_PAGE); 979 end_of_memory = fwcfg_get_u64(FW_CFG_RAM_SIZE); 980 if (end_of_memory < (1ul << 32)) 981 end_of_memory = (1ul << 32); 982 /* Cannot use large EPT pages if we need to track EPT 983 * accessed/dirty bits at 4K granularity. 984 */ 985 setup_ept_range(pml4, 0, end_of_memory, 986 0, !enable_ad && support_2m, 987 EPT_WA | EPT_RA | EPT_EA); 988 return 0; 989 } 990 991 static int apic_version; 992 993 static int ept_init_common(bool have_ad) 994 { 995 if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) || 996 !(ctrl_cpu_rev[1].clr & CPU_EPT)) { 997 printf("\tEPT is not supported"); 998 return VMX_TEST_EXIT; 999 } 1000 1001 if (setup_ept(have_ad)) 1002 return VMX_TEST_EXIT; 1003 data_page1 = alloc_page(); 1004 data_page2 = alloc_page(); 1005 memset(data_page1, 0x0, PAGE_SIZE); 1006 memset(data_page2, 0x0, PAGE_SIZE); 1007 *((u32 *)data_page1) = MAGIC_VAL_1; 1008 *((u32 *)data_page2) = MAGIC_VAL_2; 1009 install_ept(pml4, (unsigned long)data_page1, (unsigned long)data_page2, 1010 EPT_RA | EPT_WA | EPT_EA); 1011 1012 apic_version = *((u32 *)0xfee00030UL); 1013 return VMX_TEST_START; 1014 } 1015 1016 static int ept_init() 1017 { 1018 return ept_init_common(false); 1019 } 1020 1021 static void ept_common() 1022 { 1023 vmx_set_test_stage(0); 1024 if (*((u32 *)data_page2) != MAGIC_VAL_1 || 1025 *((u32 *)data_page1) != MAGIC_VAL_1) 1026 report("EPT basic framework - read", 0); 1027 else { 1028 *((u32 *)data_page2) = MAGIC_VAL_3; 1029 vmcall(); 1030 if (vmx_get_test_stage() == 1) { 1031 if (*((u32 *)data_page1) == MAGIC_VAL_3 && 1032 *((u32 *)data_page2) == MAGIC_VAL_2) 1033 report("EPT basic framework", 1); 1034 else 1035 report("EPT basic framework - remap", 1); 1036 } 1037 } 1038 // Test EPT Misconfigurations 1039 vmx_set_test_stage(1); 1040 vmcall(); 1041 *((u32 *)data_page1) = MAGIC_VAL_1; 1042 if (vmx_get_test_stage() != 2) { 1043 report("EPT misconfigurations", 0); 1044 goto t1; 1045 } 1046 vmx_set_test_stage(2); 1047 vmcall(); 1048 *((u32 *)data_page1) = MAGIC_VAL_1; 1049 report("EPT misconfigurations", vmx_get_test_stage() == 3); 1050 t1: 1051 // Test EPT violation 1052 vmx_set_test_stage(3); 1053 vmcall(); 1054 *((u32 *)data_page1) = MAGIC_VAL_1; 1055 report("EPT violation - page permission", vmx_get_test_stage() == 4); 1056 // Violation caused by EPT paging structure 1057 vmx_set_test_stage(4); 1058 vmcall(); 1059 *((u32 *)data_page1) = MAGIC_VAL_2; 1060 report("EPT violation - paging structure", vmx_get_test_stage() == 5); 1061 } 1062 1063 static void ept_main() 1064 { 1065 ept_common(); 1066 1067 // Test EPT access to L1 MMIO 1068 vmx_set_test_stage(6); 1069 report("EPT - MMIO access", *((u32 *)0xfee00030UL) == apic_version); 1070 1071 // Test invalid operand for INVEPT 1072 vmcall(); 1073 report("EPT - unsupported INVEPT", vmx_get_test_stage() == 7); 1074 } 1075 1076 bool invept_test(int type, u64 eptp) 1077 { 1078 bool ret, supported; 1079 1080 supported = ept_vpid.val & (EPT_CAP_INVEPT_SINGLE >> INVEPT_SINGLE << type); 1081 ret = invept(type, eptp); 1082 1083 if (ret == !supported) 1084 return false; 1085 1086 if (!supported) 1087 printf("WARNING: unsupported invept passed!\n"); 1088 else 1089 printf("WARNING: invept failed!\n"); 1090 1091 return true; 1092 } 1093 1094 static int ept_exit_handler_common(bool have_ad) 1095 { 1096 u64 guest_rip; 1097 u64 guest_cr3; 1098 ulong reason; 1099 u32 insn_len; 1100 u32 exit_qual; 1101 static unsigned long data_page1_pte, data_page1_pte_pte; 1102 1103 guest_rip = vmcs_read(GUEST_RIP); 1104 guest_cr3 = vmcs_read(GUEST_CR3); 1105 reason = vmcs_read(EXI_REASON) & 0xff; 1106 insn_len = vmcs_read(EXI_INST_LEN); 1107 exit_qual = vmcs_read(EXI_QUALIFICATION); 1108 switch (reason) { 1109 case VMX_VMCALL: 1110 switch (vmx_get_test_stage()) { 1111 case 0: 1112 check_ept_ad(pml4, guest_cr3, 1113 (unsigned long)data_page1, 1114 have_ad ? EPT_ACCESS_FLAG : 0, 1115 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1116 check_ept_ad(pml4, guest_cr3, 1117 (unsigned long)data_page2, 1118 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0, 1119 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1120 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1121 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page2); 1122 if (have_ad) 1123 ept_sync(INVEPT_SINGLE, eptp);; 1124 if (*((u32 *)data_page1) == MAGIC_VAL_3 && 1125 *((u32 *)data_page2) == MAGIC_VAL_2) { 1126 vmx_inc_test_stage(); 1127 install_ept(pml4, (unsigned long)data_page2, 1128 (unsigned long)data_page2, 1129 EPT_RA | EPT_WA | EPT_EA); 1130 } else 1131 report("EPT basic framework - write", 0); 1132 break; 1133 case 1: 1134 install_ept(pml4, (unsigned long)data_page1, 1135 (unsigned long)data_page1, EPT_WA); 1136 ept_sync(INVEPT_SINGLE, eptp); 1137 break; 1138 case 2: 1139 install_ept(pml4, (unsigned long)data_page1, 1140 (unsigned long)data_page1, 1141 EPT_RA | EPT_WA | EPT_EA | 1142 (2 << EPT_MEM_TYPE_SHIFT)); 1143 ept_sync(INVEPT_SINGLE, eptp); 1144 break; 1145 case 3: 1146 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1147 data_page1_pte = get_ept_pte(pml4, 1148 (unsigned long)data_page1, 1); 1149 set_ept_pte(pml4, (unsigned long)data_page1, 1150 1, data_page1_pte & ~EPT_PRESENT); 1151 ept_sync(INVEPT_SINGLE, eptp); 1152 break; 1153 case 4: 1154 data_page1_pte = get_ept_pte(pml4, 1155 (unsigned long)data_page1, 2); 1156 data_page1_pte &= PAGE_MASK; 1157 data_page1_pte_pte = get_ept_pte(pml4, data_page1_pte, 2); 1158 set_ept_pte(pml4, data_page1_pte, 2, 1159 data_page1_pte_pte & ~EPT_PRESENT); 1160 ept_sync(INVEPT_SINGLE, eptp); 1161 break; 1162 case 6: 1163 if (!invept_test(0, eptp)) 1164 vmx_inc_test_stage(); 1165 break; 1166 // Should not reach here 1167 default: 1168 printf("ERROR - unexpected stage, %d.\n", 1169 vmx_get_test_stage()); 1170 print_vmexit_info(); 1171 return VMX_TEST_VMEXIT; 1172 } 1173 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1174 return VMX_TEST_RESUME; 1175 case VMX_EPT_MISCONFIG: 1176 switch (vmx_get_test_stage()) { 1177 case 1: 1178 case 2: 1179 vmx_inc_test_stage(); 1180 install_ept(pml4, (unsigned long)data_page1, 1181 (unsigned long)data_page1, 1182 EPT_RA | EPT_WA | EPT_EA); 1183 ept_sync(INVEPT_SINGLE, eptp); 1184 break; 1185 // Should not reach here 1186 default: 1187 printf("ERROR - unexpected stage, %d.\n", 1188 vmx_get_test_stage()); 1189 print_vmexit_info(); 1190 return VMX_TEST_VMEXIT; 1191 } 1192 return VMX_TEST_RESUME; 1193 case VMX_EPT_VIOLATION: 1194 switch(vmx_get_test_stage()) { 1195 case 3: 1196 check_ept_ad(pml4, guest_cr3, (unsigned long)data_page1, 0, 1197 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1198 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1199 if (exit_qual == (EPT_VLT_WR | EPT_VLT_LADDR_VLD | 1200 EPT_VLT_PADDR)) 1201 vmx_inc_test_stage(); 1202 set_ept_pte(pml4, (unsigned long)data_page1, 1203 1, data_page1_pte | (EPT_PRESENT)); 1204 ept_sync(INVEPT_SINGLE, eptp); 1205 break; 1206 case 4: 1207 check_ept_ad(pml4, guest_cr3, (unsigned long)data_page1, 0, 1208 have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0); 1209 clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1); 1210 if (exit_qual == (EPT_VLT_RD | 1211 (have_ad ? EPT_VLT_WR : 0) | 1212 EPT_VLT_LADDR_VLD)) 1213 vmx_inc_test_stage(); 1214 set_ept_pte(pml4, data_page1_pte, 2, 1215 data_page1_pte_pte | (EPT_PRESENT)); 1216 ept_sync(INVEPT_SINGLE, eptp); 1217 break; 1218 default: 1219 // Should not reach here 1220 printf("ERROR : unexpected stage, %d\n", 1221 vmx_get_test_stage()); 1222 print_vmexit_info(); 1223 return VMX_TEST_VMEXIT; 1224 } 1225 return VMX_TEST_RESUME; 1226 default: 1227 printf("Unknown exit reason, %ld\n", reason); 1228 print_vmexit_info(); 1229 } 1230 return VMX_TEST_VMEXIT; 1231 } 1232 1233 static int ept_exit_handler() 1234 { 1235 return ept_exit_handler_common(false); 1236 } 1237 1238 static int eptad_init() 1239 { 1240 int r = ept_init_common(true); 1241 1242 if (r == VMX_TEST_EXIT) 1243 return r; 1244 1245 if ((rdmsr(MSR_IA32_VMX_EPT_VPID_CAP) & EPT_CAP_AD_FLAG) == 0) { 1246 printf("\tEPT A/D bits are not supported"); 1247 return VMX_TEST_EXIT; 1248 } 1249 1250 return r; 1251 } 1252 1253 static void eptad_main() 1254 { 1255 ept_common(); 1256 } 1257 1258 static int eptad_exit_handler() 1259 { 1260 return ept_exit_handler_common(true); 1261 } 1262 1263 bool invvpid_test(int type, u16 vpid) 1264 { 1265 bool ret, supported; 1266 1267 supported = ept_vpid.val & (VPID_CAP_INVVPID_SINGLE >> INVVPID_SINGLE << type); 1268 ret = invvpid(type, vpid, 0); 1269 1270 if (ret == !supported) 1271 return false; 1272 1273 if (!supported) 1274 printf("WARNING: unsupported invvpid passed!\n"); 1275 else 1276 printf("WARNING: invvpid failed!\n"); 1277 1278 return true; 1279 } 1280 1281 static int vpid_init() 1282 { 1283 u32 ctrl_cpu1; 1284 1285 if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) || 1286 !(ctrl_cpu_rev[1].clr & CPU_VPID)) { 1287 printf("\tVPID is not supported"); 1288 return VMX_TEST_EXIT; 1289 } 1290 1291 ctrl_cpu1 = vmcs_read(CPU_EXEC_CTRL1); 1292 ctrl_cpu1 |= CPU_VPID; 1293 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu1); 1294 return VMX_TEST_START; 1295 } 1296 1297 static void vpid_main() 1298 { 1299 vmx_set_test_stage(0); 1300 vmcall(); 1301 report("INVVPID SINGLE ADDRESS", vmx_get_test_stage() == 1); 1302 vmx_set_test_stage(2); 1303 vmcall(); 1304 report("INVVPID SINGLE", vmx_get_test_stage() == 3); 1305 vmx_set_test_stage(4); 1306 vmcall(); 1307 report("INVVPID ALL", vmx_get_test_stage() == 5); 1308 } 1309 1310 static int vpid_exit_handler() 1311 { 1312 u64 guest_rip; 1313 ulong reason; 1314 u32 insn_len; 1315 1316 guest_rip = vmcs_read(GUEST_RIP); 1317 reason = vmcs_read(EXI_REASON) & 0xff; 1318 insn_len = vmcs_read(EXI_INST_LEN); 1319 1320 switch (reason) { 1321 case VMX_VMCALL: 1322 switch(vmx_get_test_stage()) { 1323 case 0: 1324 if (!invvpid_test(INVVPID_SINGLE_ADDRESS, 1)) 1325 vmx_inc_test_stage(); 1326 break; 1327 case 2: 1328 if (!invvpid_test(INVVPID_SINGLE, 1)) 1329 vmx_inc_test_stage(); 1330 break; 1331 case 4: 1332 if (!invvpid_test(INVVPID_ALL, 1)) 1333 vmx_inc_test_stage(); 1334 break; 1335 default: 1336 printf("ERROR: unexpected stage, %d\n", 1337 vmx_get_test_stage()); 1338 print_vmexit_info(); 1339 return VMX_TEST_VMEXIT; 1340 } 1341 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1342 return VMX_TEST_RESUME; 1343 default: 1344 printf("Unknown exit reason, %ld\n", reason); 1345 print_vmexit_info(); 1346 } 1347 return VMX_TEST_VMEXIT; 1348 } 1349 1350 #define TIMER_VECTOR 222 1351 1352 static volatile bool timer_fired; 1353 1354 static void timer_isr(isr_regs_t *regs) 1355 { 1356 timer_fired = true; 1357 apic_write(APIC_EOI, 0); 1358 } 1359 1360 static int interrupt_init(struct vmcs *vmcs) 1361 { 1362 msr_bmp_init(); 1363 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_EXTINT); 1364 handle_irq(TIMER_VECTOR, timer_isr); 1365 return VMX_TEST_START; 1366 } 1367 1368 static void interrupt_main(void) 1369 { 1370 long long start, loops; 1371 1372 vmx_set_test_stage(0); 1373 1374 apic_write(APIC_LVTT, TIMER_VECTOR); 1375 irq_enable(); 1376 1377 apic_write(APIC_TMICT, 1); 1378 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1379 asm volatile ("nop"); 1380 report("direct interrupt while running guest", timer_fired); 1381 1382 apic_write(APIC_TMICT, 0); 1383 irq_disable(); 1384 vmcall(); 1385 timer_fired = false; 1386 apic_write(APIC_TMICT, 1); 1387 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1388 asm volatile ("nop"); 1389 report("intercepted interrupt while running guest", timer_fired); 1390 1391 irq_enable(); 1392 apic_write(APIC_TMICT, 0); 1393 irq_disable(); 1394 vmcall(); 1395 timer_fired = false; 1396 start = rdtsc(); 1397 apic_write(APIC_TMICT, 1000000); 1398 1399 asm volatile ("sti; hlt"); 1400 1401 report("direct interrupt + hlt", 1402 rdtsc() - start > 1000000 && timer_fired); 1403 1404 apic_write(APIC_TMICT, 0); 1405 irq_disable(); 1406 vmcall(); 1407 timer_fired = false; 1408 start = rdtsc(); 1409 apic_write(APIC_TMICT, 1000000); 1410 1411 asm volatile ("sti; hlt"); 1412 1413 report("intercepted interrupt + hlt", 1414 rdtsc() - start > 10000 && timer_fired); 1415 1416 apic_write(APIC_TMICT, 0); 1417 irq_disable(); 1418 vmcall(); 1419 timer_fired = false; 1420 start = rdtsc(); 1421 apic_write(APIC_TMICT, 1000000); 1422 1423 irq_enable(); 1424 asm volatile ("nop"); 1425 vmcall(); 1426 1427 report("direct interrupt + activity state hlt", 1428 rdtsc() - start > 10000 && timer_fired); 1429 1430 apic_write(APIC_TMICT, 0); 1431 irq_disable(); 1432 vmcall(); 1433 timer_fired = false; 1434 start = rdtsc(); 1435 apic_write(APIC_TMICT, 1000000); 1436 1437 irq_enable(); 1438 asm volatile ("nop"); 1439 vmcall(); 1440 1441 report("intercepted interrupt + activity state hlt", 1442 rdtsc() - start > 10000 && timer_fired); 1443 1444 apic_write(APIC_TMICT, 0); 1445 irq_disable(); 1446 vmx_set_test_stage(7); 1447 vmcall(); 1448 timer_fired = false; 1449 apic_write(APIC_TMICT, 1); 1450 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1451 asm volatile ("nop"); 1452 report("running a guest with interrupt acknowledgement set", timer_fired); 1453 } 1454 1455 static int interrupt_exit_handler(void) 1456 { 1457 u64 guest_rip = vmcs_read(GUEST_RIP); 1458 ulong reason = vmcs_read(EXI_REASON) & 0xff; 1459 u32 insn_len = vmcs_read(EXI_INST_LEN); 1460 1461 switch (reason) { 1462 case VMX_VMCALL: 1463 switch (vmx_get_test_stage()) { 1464 case 0: 1465 case 2: 1466 case 5: 1467 vmcs_write(PIN_CONTROLS, 1468 vmcs_read(PIN_CONTROLS) | PIN_EXTINT); 1469 break; 1470 case 7: 1471 vmcs_write(EXI_CONTROLS, vmcs_read(EXI_CONTROLS) | EXI_INTA); 1472 vmcs_write(PIN_CONTROLS, 1473 vmcs_read(PIN_CONTROLS) | PIN_EXTINT); 1474 break; 1475 case 1: 1476 case 3: 1477 vmcs_write(PIN_CONTROLS, 1478 vmcs_read(PIN_CONTROLS) & ~PIN_EXTINT); 1479 break; 1480 case 4: 1481 case 6: 1482 vmcs_write(GUEST_ACTV_STATE, ACTV_HLT); 1483 break; 1484 } 1485 vmx_inc_test_stage(); 1486 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1487 return VMX_TEST_RESUME; 1488 case VMX_EXTINT: 1489 if (vmcs_read(EXI_CONTROLS) & EXI_INTA) { 1490 int vector = vmcs_read(EXI_INTR_INFO) & 0xff; 1491 handle_external_interrupt(vector); 1492 } else { 1493 irq_enable(); 1494 asm volatile ("nop"); 1495 irq_disable(); 1496 } 1497 if (vmx_get_test_stage() >= 2) 1498 vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE); 1499 return VMX_TEST_RESUME; 1500 default: 1501 printf("Unknown exit reason, %ld\n", reason); 1502 print_vmexit_info(); 1503 } 1504 1505 return VMX_TEST_VMEXIT; 1506 } 1507 1508 static int dbgctls_init(struct vmcs *vmcs) 1509 { 1510 u64 dr7 = 0x402; 1511 u64 zero = 0; 1512 1513 msr_bmp_init(); 1514 asm volatile( 1515 "mov %0,%%dr0\n\t" 1516 "mov %0,%%dr1\n\t" 1517 "mov %0,%%dr2\n\t" 1518 "mov %1,%%dr7\n\t" 1519 : : "r" (zero), "r" (dr7)); 1520 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x1); 1521 vmcs_write(GUEST_DR7, 0x404); 1522 vmcs_write(GUEST_DEBUGCTL, 0x2); 1523 1524 vmcs_write(ENT_CONTROLS, vmcs_read(ENT_CONTROLS) | ENT_LOAD_DBGCTLS); 1525 vmcs_write(EXI_CONTROLS, vmcs_read(EXI_CONTROLS) | EXI_SAVE_DBGCTLS); 1526 1527 return VMX_TEST_START; 1528 } 1529 1530 static void dbgctls_main(void) 1531 { 1532 u64 dr7, debugctl; 1533 1534 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1535 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1536 /* Commented out: KVM does not support DEBUGCTL so far */ 1537 (void)debugctl; 1538 report("Load debug controls", dr7 == 0x404 /* && debugctl == 0x2 */); 1539 1540 dr7 = 0x408; 1541 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1542 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x3); 1543 1544 vmx_set_test_stage(0); 1545 vmcall(); 1546 report("Save debug controls", vmx_get_test_stage() == 1); 1547 1548 if (ctrl_enter_rev.set & ENT_LOAD_DBGCTLS || 1549 ctrl_exit_rev.set & EXI_SAVE_DBGCTLS) { 1550 printf("\tDebug controls are always loaded/saved\n"); 1551 return; 1552 } 1553 vmx_set_test_stage(2); 1554 vmcall(); 1555 1556 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1557 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1558 /* Commented out: KVM does not support DEBUGCTL so far */ 1559 (void)debugctl; 1560 report("Guest=host debug controls", dr7 == 0x402 /* && debugctl == 0x1 */); 1561 1562 dr7 = 0x408; 1563 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1564 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x3); 1565 1566 vmx_set_test_stage(3); 1567 vmcall(); 1568 report("Don't save debug controls", vmx_get_test_stage() == 4); 1569 } 1570 1571 static int dbgctls_exit_handler(void) 1572 { 1573 unsigned int reason = vmcs_read(EXI_REASON) & 0xff; 1574 u32 insn_len = vmcs_read(EXI_INST_LEN); 1575 u64 guest_rip = vmcs_read(GUEST_RIP); 1576 u64 dr7, debugctl; 1577 1578 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1579 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1580 1581 switch (reason) { 1582 case VMX_VMCALL: 1583 switch (vmx_get_test_stage()) { 1584 case 0: 1585 if (dr7 == 0x400 && debugctl == 0 && 1586 vmcs_read(GUEST_DR7) == 0x408 /* && 1587 Commented out: KVM does not support DEBUGCTL so far 1588 vmcs_read(GUEST_DEBUGCTL) == 0x3 */) 1589 vmx_inc_test_stage(); 1590 break; 1591 case 2: 1592 dr7 = 0x402; 1593 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1594 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x1); 1595 vmcs_write(GUEST_DR7, 0x404); 1596 vmcs_write(GUEST_DEBUGCTL, 0x2); 1597 1598 vmcs_write(ENT_CONTROLS, 1599 vmcs_read(ENT_CONTROLS) & ~ENT_LOAD_DBGCTLS); 1600 vmcs_write(EXI_CONTROLS, 1601 vmcs_read(EXI_CONTROLS) & ~EXI_SAVE_DBGCTLS); 1602 break; 1603 case 3: 1604 if (dr7 == 0x400 && debugctl == 0 && 1605 vmcs_read(GUEST_DR7) == 0x404 /* && 1606 Commented out: KVM does not support DEBUGCTL so far 1607 vmcs_read(GUEST_DEBUGCTL) == 0x2 */) 1608 vmx_inc_test_stage(); 1609 break; 1610 } 1611 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1612 return VMX_TEST_RESUME; 1613 default: 1614 printf("Unknown exit reason, %d\n", reason); 1615 print_vmexit_info(); 1616 } 1617 return VMX_TEST_VMEXIT; 1618 } 1619 1620 struct vmx_msr_entry { 1621 u32 index; 1622 u32 reserved; 1623 u64 value; 1624 } __attribute__((packed)); 1625 1626 #define MSR_MAGIC 0x31415926 1627 struct vmx_msr_entry *exit_msr_store, *entry_msr_load, *exit_msr_load; 1628 1629 static int msr_switch_init(struct vmcs *vmcs) 1630 { 1631 msr_bmp_init(); 1632 exit_msr_store = alloc_page(); 1633 exit_msr_load = alloc_page(); 1634 entry_msr_load = alloc_page(); 1635 memset(exit_msr_store, 0, PAGE_SIZE); 1636 memset(exit_msr_load, 0, PAGE_SIZE); 1637 memset(entry_msr_load, 0, PAGE_SIZE); 1638 entry_msr_load[0].index = MSR_KERNEL_GS_BASE; 1639 entry_msr_load[0].value = MSR_MAGIC; 1640 1641 vmx_set_test_stage(1); 1642 vmcs_write(ENT_MSR_LD_CNT, 1); 1643 vmcs_write(ENTER_MSR_LD_ADDR, (u64)entry_msr_load); 1644 vmcs_write(EXI_MSR_ST_CNT, 1); 1645 vmcs_write(EXIT_MSR_ST_ADDR, (u64)exit_msr_store); 1646 vmcs_write(EXI_MSR_LD_CNT, 1); 1647 vmcs_write(EXIT_MSR_LD_ADDR, (u64)exit_msr_load); 1648 return VMX_TEST_START; 1649 } 1650 1651 static void msr_switch_main() 1652 { 1653 if (vmx_get_test_stage() == 1) { 1654 report("VM entry MSR load", 1655 rdmsr(MSR_KERNEL_GS_BASE) == MSR_MAGIC); 1656 vmx_set_test_stage(2); 1657 wrmsr(MSR_KERNEL_GS_BASE, MSR_MAGIC + 1); 1658 exit_msr_store[0].index = MSR_KERNEL_GS_BASE; 1659 exit_msr_load[0].index = MSR_KERNEL_GS_BASE; 1660 exit_msr_load[0].value = MSR_MAGIC + 2; 1661 } 1662 vmcall(); 1663 } 1664 1665 static int msr_switch_exit_handler() 1666 { 1667 ulong reason; 1668 1669 reason = vmcs_read(EXI_REASON); 1670 if (reason == VMX_VMCALL && vmx_get_test_stage() == 2) { 1671 report("VM exit MSR store", 1672 exit_msr_store[0].value == MSR_MAGIC + 1); 1673 report("VM exit MSR load", 1674 rdmsr(MSR_KERNEL_GS_BASE) == MSR_MAGIC + 2); 1675 vmx_set_test_stage(3); 1676 entry_msr_load[0].index = MSR_FS_BASE; 1677 return VMX_TEST_RESUME; 1678 } 1679 printf("ERROR %s: unexpected stage=%u or reason=%lu\n", 1680 __func__, vmx_get_test_stage(), reason); 1681 return VMX_TEST_EXIT; 1682 } 1683 1684 static int msr_switch_entry_failure(struct vmentry_failure *failure) 1685 { 1686 ulong reason; 1687 1688 if (failure->early) { 1689 printf("ERROR %s: early exit\n", __func__); 1690 return VMX_TEST_EXIT; 1691 } 1692 1693 reason = vmcs_read(EXI_REASON); 1694 if (reason == (VMX_ENTRY_FAILURE | VMX_FAIL_MSR) && 1695 vmx_get_test_stage() == 3) { 1696 report("VM entry MSR load: try to load FS_BASE", 1697 vmcs_read(EXI_QUALIFICATION) == 1); 1698 return VMX_TEST_VMEXIT; 1699 } 1700 printf("ERROR %s: unexpected stage=%u or reason=%lu\n", 1701 __func__, vmx_get_test_stage(), reason); 1702 return VMX_TEST_EXIT; 1703 } 1704 1705 static int vmmcall_init(struct vmcs *vmcs ) 1706 { 1707 vmcs_write(EXC_BITMAP, 1 << UD_VECTOR); 1708 return VMX_TEST_START; 1709 } 1710 1711 static void vmmcall_main(void) 1712 { 1713 asm volatile( 1714 "mov $0xABCD, %%rax\n\t" 1715 "vmmcall\n\t" 1716 ::: "rax"); 1717 1718 report("VMMCALL", 0); 1719 } 1720 1721 static int vmmcall_exit_handler() 1722 { 1723 ulong reason; 1724 1725 reason = vmcs_read(EXI_REASON); 1726 switch (reason) { 1727 case VMX_VMCALL: 1728 printf("here\n"); 1729 report("VMMCALL triggers #UD", 0); 1730 break; 1731 case VMX_EXC_NMI: 1732 report("VMMCALL triggers #UD", 1733 (vmcs_read(EXI_INTR_INFO) & 0xff) == UD_VECTOR); 1734 break; 1735 default: 1736 printf("Unknown exit reason, %ld\n", reason); 1737 print_vmexit_info(); 1738 } 1739 1740 return VMX_TEST_VMEXIT; 1741 } 1742 1743 static int disable_rdtscp_init(struct vmcs *vmcs) 1744 { 1745 u32 ctrl_cpu1; 1746 1747 if (ctrl_cpu_rev[0].clr & CPU_SECONDARY) { 1748 ctrl_cpu1 = vmcs_read(CPU_EXEC_CTRL1); 1749 ctrl_cpu1 &= ~CPU_RDTSCP; 1750 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu1); 1751 } 1752 1753 return VMX_TEST_START; 1754 } 1755 1756 static void disable_rdtscp_ud_handler(struct ex_regs *regs) 1757 { 1758 switch (vmx_get_test_stage()) { 1759 case 0: 1760 report("RDTSCP triggers #UD", true); 1761 vmx_inc_test_stage(); 1762 regs->rip += 3; 1763 break; 1764 case 2: 1765 report("RDPID triggers #UD", true); 1766 vmx_inc_test_stage(); 1767 regs->rip += 4; 1768 break; 1769 } 1770 return; 1771 1772 } 1773 1774 static void disable_rdtscp_main(void) 1775 { 1776 /* Test that #UD is properly injected in L2. */ 1777 handle_exception(UD_VECTOR, disable_rdtscp_ud_handler); 1778 1779 vmx_set_test_stage(0); 1780 asm volatile("rdtscp" : : : "eax", "ecx", "edx"); 1781 vmcall(); 1782 asm volatile(".byte 0xf3, 0x0f, 0xc7, 0xf8" : : : "eax"); 1783 vmcall(); 1784 } 1785 1786 static int disable_rdtscp_exit_handler(void) 1787 { 1788 unsigned int reason = vmcs_read(EXI_REASON) & 0xff; 1789 1790 switch (reason) { 1791 case VMX_VMCALL: 1792 switch (vmx_get_test_stage()) { 1793 case 0: 1794 report("RDTSCP triggers #UD", false); 1795 vmx_inc_test_stage(); 1796 /* fallthrough */ 1797 case 1: 1798 vmx_inc_test_stage(); 1799 vmcs_write(GUEST_RIP, vmcs_read(GUEST_RIP) + 3); 1800 return VMX_TEST_RESUME; 1801 case 2: 1802 report("RDPID triggers #UD", false); 1803 break; 1804 } 1805 break; 1806 1807 default: 1808 printf("Unknown exit reason, %d\n", reason); 1809 print_vmexit_info(); 1810 } 1811 return VMX_TEST_VMEXIT; 1812 } 1813 1814 int int3_init() 1815 { 1816 vmcs_write(EXC_BITMAP, ~0u); 1817 return VMX_TEST_START; 1818 } 1819 1820 void int3_guest_main() 1821 { 1822 asm volatile ("int3"); 1823 } 1824 1825 int int3_exit_handler() 1826 { 1827 u32 reason = vmcs_read(EXI_REASON); 1828 u32 intr_info = vmcs_read(EXI_INTR_INFO); 1829 1830 report("L1 intercepts #BP", reason == VMX_EXC_NMI && 1831 (intr_info & INTR_INFO_VALID_MASK) && 1832 (intr_info & INTR_INFO_VECTOR_MASK) == BP_VECTOR && 1833 ((intr_info & INTR_INFO_INTR_TYPE_MASK) >> 1834 INTR_INFO_INTR_TYPE_SHIFT) == VMX_INTR_TYPE_SOFT_EXCEPTION); 1835 1836 return VMX_TEST_VMEXIT; 1837 } 1838 1839 int into_init() 1840 { 1841 vmcs_write(EXC_BITMAP, ~0u); 1842 return VMX_TEST_START; 1843 } 1844 1845 void into_guest_main() 1846 { 1847 struct far_pointer32 fp = { 1848 .offset = (uintptr_t)&&into, 1849 .selector = KERNEL_CS32, 1850 }; 1851 register uintptr_t rsp asm("rsp"); 1852 1853 if (fp.offset != (uintptr_t)&&into) { 1854 printf("Code address too high.\n"); 1855 return; 1856 } 1857 if ((u32)rsp != rsp) { 1858 printf("Stack address too high.\n"); 1859 return; 1860 } 1861 1862 asm goto ("lcall *%0" : : "m" (fp) : "rax" : into); 1863 return; 1864 into: 1865 asm volatile (".code32;" 1866 "movl $0x7fffffff, %eax;" 1867 "addl %eax, %eax;" 1868 "into;" 1869 "lret;" 1870 ".code64"); 1871 __builtin_unreachable(); 1872 } 1873 1874 int into_exit_handler() 1875 { 1876 u32 reason = vmcs_read(EXI_REASON); 1877 u32 intr_info = vmcs_read(EXI_INTR_INFO); 1878 1879 report("L1 intercepts #OF", reason == VMX_EXC_NMI && 1880 (intr_info & INTR_INFO_VALID_MASK) && 1881 (intr_info & INTR_INFO_VECTOR_MASK) == OF_VECTOR && 1882 ((intr_info & INTR_INFO_INTR_TYPE_MASK) >> 1883 INTR_INFO_INTR_TYPE_SHIFT) == VMX_INTR_TYPE_SOFT_EXCEPTION); 1884 1885 return VMX_TEST_VMEXIT; 1886 } 1887 1888 static void exit_monitor_from_l2_main(void) 1889 { 1890 printf("Calling exit(0) from l2...\n"); 1891 exit(0); 1892 } 1893 1894 static int exit_monitor_from_l2_handler(void) 1895 { 1896 report("The guest should have killed the VMM", false); 1897 return VMX_TEST_EXIT; 1898 } 1899 1900 static void assert_exit_reason(u64 expected) 1901 { 1902 u64 actual = vmcs_read(EXI_REASON); 1903 1904 TEST_ASSERT_EQ_MSG(expected, actual, "Expected %s, got %s.", 1905 exit_reason_description(expected), 1906 exit_reason_description(actual)); 1907 } 1908 1909 static void skip_exit_vmcall() 1910 { 1911 u64 guest_rip = vmcs_read(GUEST_RIP); 1912 u32 insn_len = vmcs_read(EXI_INST_LEN); 1913 1914 assert_exit_reason(VMX_VMCALL); 1915 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1916 } 1917 1918 static void v2_null_test_guest(void) 1919 { 1920 } 1921 1922 static void v2_null_test(void) 1923 { 1924 test_set_guest(v2_null_test_guest); 1925 enter_guest(); 1926 report(__func__, 1); 1927 } 1928 1929 static void v2_multiple_entries_test_guest(void) 1930 { 1931 vmx_set_test_stage(1); 1932 vmcall(); 1933 vmx_set_test_stage(2); 1934 } 1935 1936 static void v2_multiple_entries_test(void) 1937 { 1938 test_set_guest(v2_multiple_entries_test_guest); 1939 enter_guest(); 1940 TEST_ASSERT_EQ(vmx_get_test_stage(), 1); 1941 skip_exit_vmcall(); 1942 enter_guest(); 1943 TEST_ASSERT_EQ(vmx_get_test_stage(), 2); 1944 report(__func__, 1); 1945 } 1946 1947 static int fixture_test_data = 1; 1948 1949 static void fixture_test_teardown(void *data) 1950 { 1951 *((int *) data) = 1; 1952 } 1953 1954 static void fixture_test_guest(void) 1955 { 1956 fixture_test_data++; 1957 } 1958 1959 1960 static void fixture_test_setup(void) 1961 { 1962 TEST_ASSERT_EQ_MSG(1, fixture_test_data, 1963 "fixture_test_teardown didn't run?!"); 1964 fixture_test_data = 2; 1965 test_add_teardown(fixture_test_teardown, &fixture_test_data); 1966 test_set_guest(fixture_test_guest); 1967 } 1968 1969 static void fixture_test_case1(void) 1970 { 1971 fixture_test_setup(); 1972 TEST_ASSERT_EQ(2, fixture_test_data); 1973 enter_guest(); 1974 TEST_ASSERT_EQ(3, fixture_test_data); 1975 report(__func__, 1); 1976 } 1977 1978 static void fixture_test_case2(void) 1979 { 1980 fixture_test_setup(); 1981 TEST_ASSERT_EQ(2, fixture_test_data); 1982 enter_guest(); 1983 TEST_ASSERT_EQ(3, fixture_test_data); 1984 report(__func__, 1); 1985 } 1986 1987 #define TEST(name) { #name, .v2 = name } 1988 1989 /* name/init/guest_main/exit_handler/syscall_handler/guest_regs */ 1990 struct vmx_test vmx_tests[] = { 1991 { "null", NULL, basic_guest_main, basic_exit_handler, NULL, {0} }, 1992 { "vmenter", NULL, vmenter_main, vmenter_exit_handler, NULL, {0} }, 1993 { "preemption timer", preemption_timer_init, preemption_timer_main, 1994 preemption_timer_exit_handler, NULL, {0} }, 1995 { "control field PAT", test_ctrl_pat_init, test_ctrl_pat_main, 1996 test_ctrl_pat_exit_handler, NULL, {0} }, 1997 { "control field EFER", test_ctrl_efer_init, test_ctrl_efer_main, 1998 test_ctrl_efer_exit_handler, NULL, {0} }, 1999 { "CR shadowing", NULL, cr_shadowing_main, 2000 cr_shadowing_exit_handler, NULL, {0} }, 2001 { "I/O bitmap", iobmp_init, iobmp_main, iobmp_exit_handler, 2002 NULL, {0} }, 2003 { "instruction intercept", insn_intercept_init, insn_intercept_main, 2004 insn_intercept_exit_handler, NULL, {0} }, 2005 { "EPT A/D disabled", ept_init, ept_main, ept_exit_handler, NULL, {0} }, 2006 { "EPT A/D enabled", eptad_init, eptad_main, eptad_exit_handler, NULL, {0} }, 2007 { "VPID", vpid_init, vpid_main, vpid_exit_handler, NULL, {0} }, 2008 { "interrupt", interrupt_init, interrupt_main, 2009 interrupt_exit_handler, NULL, {0} }, 2010 { "debug controls", dbgctls_init, dbgctls_main, dbgctls_exit_handler, 2011 NULL, {0} }, 2012 { "MSR switch", msr_switch_init, msr_switch_main, 2013 msr_switch_exit_handler, NULL, {0}, msr_switch_entry_failure }, 2014 { "vmmcall", vmmcall_init, vmmcall_main, vmmcall_exit_handler, NULL, {0} }, 2015 { "disable RDTSCP", disable_rdtscp_init, disable_rdtscp_main, 2016 disable_rdtscp_exit_handler, NULL, {0} }, 2017 { "int3", int3_init, int3_guest_main, int3_exit_handler, NULL, {0} }, 2018 { "into", into_init, into_guest_main, into_exit_handler, NULL, {0} }, 2019 { "exit_monitor_from_l2_test", NULL, exit_monitor_from_l2_main, 2020 exit_monitor_from_l2_handler, NULL, {0} }, 2021 /* Basic V2 tests. */ 2022 TEST(v2_null_test), 2023 TEST(v2_multiple_entries_test), 2024 TEST(fixture_test_case1), 2025 TEST(fixture_test_case2), 2026 { NULL, NULL, NULL, NULL, NULL, {0} }, 2027 }; 2028