1 /* 2 * All test cases of nested virtualization should be in this file 3 * 4 * Author : Arthur Chunqi Li <yzt356@gmail.com> 5 */ 6 #include "vmx.h" 7 #include "msr.h" 8 #include "processor.h" 9 #include "vm.h" 10 #include "io.h" 11 #include "fwcfg.h" 12 #include "isr.h" 13 #include "apic.h" 14 15 u64 ia32_pat; 16 u64 ia32_efer; 17 void *io_bitmap_a, *io_bitmap_b; 18 u16 ioport; 19 20 unsigned long *pml4; 21 u64 eptp; 22 void *data_page1, *data_page2; 23 24 static inline void vmcall() 25 { 26 asm volatile("vmcall"); 27 } 28 29 void basic_guest_main() 30 { 31 } 32 33 int basic_exit_handler() 34 { 35 report("Basic VMX test", 0); 36 print_vmexit_info(); 37 return VMX_TEST_EXIT; 38 } 39 40 void vmenter_main() 41 { 42 u64 rax; 43 u64 rsp, resume_rsp; 44 45 report("test vmlaunch", 1); 46 47 asm volatile( 48 "mov %%rsp, %0\n\t" 49 "mov %3, %%rax\n\t" 50 "vmcall\n\t" 51 "mov %%rax, %1\n\t" 52 "mov %%rsp, %2\n\t" 53 : "=r"(rsp), "=r"(rax), "=r"(resume_rsp) 54 : "g"(0xABCD)); 55 report("test vmresume", (rax == 0xFFFF) && (rsp == resume_rsp)); 56 } 57 58 int vmenter_exit_handler() 59 { 60 u64 guest_rip; 61 ulong reason; 62 63 guest_rip = vmcs_read(GUEST_RIP); 64 reason = vmcs_read(EXI_REASON) & 0xff; 65 switch (reason) { 66 case VMX_VMCALL: 67 if (regs.rax != 0xABCD) { 68 report("test vmresume", 0); 69 return VMX_TEST_VMEXIT; 70 } 71 regs.rax = 0xFFFF; 72 vmcs_write(GUEST_RIP, guest_rip + 3); 73 return VMX_TEST_RESUME; 74 default: 75 report("test vmresume", 0); 76 print_vmexit_info(); 77 } 78 return VMX_TEST_VMEXIT; 79 } 80 81 u32 preempt_scale; 82 volatile unsigned long long tsc_val; 83 volatile u32 preempt_val; 84 u64 saved_rip; 85 86 int preemption_timer_init() 87 { 88 if (!(ctrl_pin_rev.clr & PIN_PREEMPT)) { 89 printf("\tPreemption timer is not supported\n"); 90 return VMX_TEST_EXIT; 91 } 92 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) | PIN_PREEMPT); 93 preempt_val = 10000000; 94 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 95 preempt_scale = rdmsr(MSR_IA32_VMX_MISC) & 0x1F; 96 97 if (!(ctrl_exit_rev.clr & EXI_SAVE_PREEMPT)) 98 printf("\tSave preemption value is not supported\n"); 99 100 return VMX_TEST_START; 101 } 102 103 void preemption_timer_main() 104 { 105 tsc_val = rdtsc(); 106 if (ctrl_exit_rev.clr & EXI_SAVE_PREEMPT) { 107 vmx_set_test_stage(0); 108 vmcall(); 109 if (vmx_get_test_stage() == 1) 110 vmcall(); 111 } 112 vmx_set_test_stage(1); 113 while (vmx_get_test_stage() == 1) { 114 if (((rdtsc() - tsc_val) >> preempt_scale) 115 > 10 * preempt_val) { 116 vmx_set_test_stage(2); 117 vmcall(); 118 } 119 } 120 tsc_val = rdtsc(); 121 asm volatile ("hlt"); 122 vmcall(); 123 vmx_set_test_stage(5); 124 vmcall(); 125 } 126 127 int preemption_timer_exit_handler() 128 { 129 bool guest_halted; 130 u64 guest_rip; 131 ulong reason; 132 u32 insn_len; 133 u32 ctrl_exit; 134 135 guest_rip = vmcs_read(GUEST_RIP); 136 reason = vmcs_read(EXI_REASON) & 0xff; 137 insn_len = vmcs_read(EXI_INST_LEN); 138 switch (reason) { 139 case VMX_PREEMPT: 140 switch (vmx_get_test_stage()) { 141 case 1: 142 case 2: 143 report("busy-wait for preemption timer", 144 ((rdtsc() - tsc_val) >> preempt_scale) >= 145 preempt_val); 146 vmx_set_test_stage(3); 147 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 148 return VMX_TEST_RESUME; 149 case 3: 150 guest_halted = 151 (vmcs_read(GUEST_ACTV_STATE) == ACTV_HLT); 152 report("preemption timer during hlt", 153 ((rdtsc() - tsc_val) >> preempt_scale) >= 154 preempt_val && guest_halted); 155 vmx_set_test_stage(4); 156 vmcs_write(PIN_CONTROLS, 157 vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT); 158 vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE); 159 return VMX_TEST_RESUME; 160 case 4: 161 report("preemption timer with 0 value", 162 saved_rip == guest_rip); 163 break; 164 default: 165 printf("Invalid stage.\n"); 166 print_vmexit_info(); 167 break; 168 } 169 break; 170 case VMX_VMCALL: 171 vmcs_write(GUEST_RIP, guest_rip + insn_len); 172 switch (vmx_get_test_stage()) { 173 case 0: 174 report("Keep preemption value", 175 vmcs_read(PREEMPT_TIMER_VALUE) == preempt_val); 176 vmx_set_test_stage(1); 177 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 178 ctrl_exit = (vmcs_read(EXI_CONTROLS) | 179 EXI_SAVE_PREEMPT) & ctrl_exit_rev.clr; 180 vmcs_write(EXI_CONTROLS, ctrl_exit); 181 return VMX_TEST_RESUME; 182 case 1: 183 report("Save preemption value", 184 vmcs_read(PREEMPT_TIMER_VALUE) < preempt_val); 185 return VMX_TEST_RESUME; 186 case 2: 187 report("busy-wait for preemption timer", 0); 188 vmx_set_test_stage(3); 189 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 190 return VMX_TEST_RESUME; 191 case 3: 192 report("preemption timer during hlt", 0); 193 vmx_set_test_stage(4); 194 /* fall through */ 195 case 4: 196 vmcs_write(PIN_CONTROLS, 197 vmcs_read(PIN_CONTROLS) | PIN_PREEMPT); 198 vmcs_write(PREEMPT_TIMER_VALUE, 0); 199 saved_rip = guest_rip + insn_len; 200 return VMX_TEST_RESUME; 201 case 5: 202 report("preemption timer with 0 value (vmcall stage 5)", 0); 203 break; 204 default: 205 // Should not reach here 206 printf("ERROR : unexpected stage, %d\n", 207 vmx_get_test_stage()); 208 print_vmexit_info(); 209 return VMX_TEST_VMEXIT; 210 } 211 break; 212 default: 213 printf("Unknown exit reason, %d\n", reason); 214 print_vmexit_info(); 215 } 216 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT); 217 return VMX_TEST_VMEXIT; 218 } 219 220 void msr_bmp_init() 221 { 222 void *msr_bitmap; 223 u32 ctrl_cpu0; 224 225 msr_bitmap = alloc_page(); 226 memset(msr_bitmap, 0x0, PAGE_SIZE); 227 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 228 ctrl_cpu0 |= CPU_MSR_BITMAP; 229 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 230 vmcs_write(MSR_BITMAP, (u64)msr_bitmap); 231 } 232 233 static int test_ctrl_pat_init() 234 { 235 u64 ctrl_ent; 236 u64 ctrl_exi; 237 238 msr_bmp_init(); 239 ctrl_ent = vmcs_read(ENT_CONTROLS); 240 ctrl_exi = vmcs_read(EXI_CONTROLS); 241 vmcs_write(ENT_CONTROLS, ctrl_ent | ENT_LOAD_PAT); 242 vmcs_write(EXI_CONTROLS, ctrl_exi | (EXI_SAVE_PAT | EXI_LOAD_PAT)); 243 ia32_pat = rdmsr(MSR_IA32_CR_PAT); 244 vmcs_write(GUEST_PAT, 0x0); 245 vmcs_write(HOST_PAT, ia32_pat); 246 return VMX_TEST_START; 247 } 248 249 static void test_ctrl_pat_main() 250 { 251 u64 guest_ia32_pat; 252 253 guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT); 254 if (!(ctrl_enter_rev.clr & ENT_LOAD_PAT)) 255 printf("\tENT_LOAD_PAT is not supported.\n"); 256 else { 257 if (guest_ia32_pat != 0) { 258 report("Entry load PAT", 0); 259 return; 260 } 261 } 262 wrmsr(MSR_IA32_CR_PAT, 0x6); 263 vmcall(); 264 guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT); 265 if (ctrl_enter_rev.clr & ENT_LOAD_PAT) { 266 if (guest_ia32_pat != ia32_pat) { 267 report("Entry load PAT", 0); 268 return; 269 } 270 report("Entry load PAT", 1); 271 } 272 } 273 274 static int test_ctrl_pat_exit_handler() 275 { 276 u64 guest_rip; 277 ulong reason; 278 u64 guest_pat; 279 280 guest_rip = vmcs_read(GUEST_RIP); 281 reason = vmcs_read(EXI_REASON) & 0xff; 282 switch (reason) { 283 case VMX_VMCALL: 284 guest_pat = vmcs_read(GUEST_PAT); 285 if (!(ctrl_exit_rev.clr & EXI_SAVE_PAT)) { 286 printf("\tEXI_SAVE_PAT is not supported\n"); 287 vmcs_write(GUEST_PAT, 0x6); 288 } else { 289 if (guest_pat == 0x6) 290 report("Exit save PAT", 1); 291 else 292 report("Exit save PAT", 0); 293 } 294 if (!(ctrl_exit_rev.clr & EXI_LOAD_PAT)) 295 printf("\tEXI_LOAD_PAT is not supported\n"); 296 else { 297 if (rdmsr(MSR_IA32_CR_PAT) == ia32_pat) 298 report("Exit load PAT", 1); 299 else 300 report("Exit load PAT", 0); 301 } 302 vmcs_write(GUEST_PAT, ia32_pat); 303 vmcs_write(GUEST_RIP, guest_rip + 3); 304 return VMX_TEST_RESUME; 305 default: 306 printf("ERROR : Undefined exit reason, reason = %d.\n", reason); 307 break; 308 } 309 return VMX_TEST_VMEXIT; 310 } 311 312 static int test_ctrl_efer_init() 313 { 314 u64 ctrl_ent; 315 u64 ctrl_exi; 316 317 msr_bmp_init(); 318 ctrl_ent = vmcs_read(ENT_CONTROLS) | ENT_LOAD_EFER; 319 ctrl_exi = vmcs_read(EXI_CONTROLS) | EXI_SAVE_EFER | EXI_LOAD_EFER; 320 vmcs_write(ENT_CONTROLS, ctrl_ent & ctrl_enter_rev.clr); 321 vmcs_write(EXI_CONTROLS, ctrl_exi & ctrl_exit_rev.clr); 322 ia32_efer = rdmsr(MSR_EFER); 323 vmcs_write(GUEST_EFER, ia32_efer ^ EFER_NX); 324 vmcs_write(HOST_EFER, ia32_efer ^ EFER_NX); 325 return VMX_TEST_START; 326 } 327 328 static void test_ctrl_efer_main() 329 { 330 u64 guest_ia32_efer; 331 332 guest_ia32_efer = rdmsr(MSR_EFER); 333 if (!(ctrl_enter_rev.clr & ENT_LOAD_EFER)) 334 printf("\tENT_LOAD_EFER is not supported.\n"); 335 else { 336 if (guest_ia32_efer != (ia32_efer ^ EFER_NX)) { 337 report("Entry load EFER", 0); 338 return; 339 } 340 } 341 wrmsr(MSR_EFER, ia32_efer); 342 vmcall(); 343 guest_ia32_efer = rdmsr(MSR_EFER); 344 if (ctrl_enter_rev.clr & ENT_LOAD_EFER) { 345 if (guest_ia32_efer != ia32_efer) { 346 report("Entry load EFER", 0); 347 return; 348 } 349 report("Entry load EFER", 1); 350 } 351 } 352 353 static int test_ctrl_efer_exit_handler() 354 { 355 u64 guest_rip; 356 ulong reason; 357 u64 guest_efer; 358 359 guest_rip = vmcs_read(GUEST_RIP); 360 reason = vmcs_read(EXI_REASON) & 0xff; 361 switch (reason) { 362 case VMX_VMCALL: 363 guest_efer = vmcs_read(GUEST_EFER); 364 if (!(ctrl_exit_rev.clr & EXI_SAVE_EFER)) { 365 printf("\tEXI_SAVE_EFER is not supported\n"); 366 vmcs_write(GUEST_EFER, ia32_efer); 367 } else { 368 if (guest_efer == ia32_efer) 369 report("Exit save EFER", 1); 370 else 371 report("Exit save EFER", 0); 372 } 373 if (!(ctrl_exit_rev.clr & EXI_LOAD_EFER)) { 374 printf("\tEXI_LOAD_EFER is not supported\n"); 375 wrmsr(MSR_EFER, ia32_efer ^ EFER_NX); 376 } else { 377 if (rdmsr(MSR_EFER) == (ia32_efer ^ EFER_NX)) 378 report("Exit load EFER", 1); 379 else 380 report("Exit load EFER", 0); 381 } 382 vmcs_write(GUEST_PAT, ia32_efer); 383 vmcs_write(GUEST_RIP, guest_rip + 3); 384 return VMX_TEST_RESUME; 385 default: 386 printf("ERROR : Undefined exit reason, reason = %d.\n", reason); 387 break; 388 } 389 return VMX_TEST_VMEXIT; 390 } 391 392 u32 guest_cr0, guest_cr4; 393 394 static void cr_shadowing_main() 395 { 396 u32 cr0, cr4, tmp; 397 398 // Test read through 399 vmx_set_test_stage(0); 400 guest_cr0 = read_cr0(); 401 if (vmx_get_test_stage() == 1) 402 report("Read through CR0", 0); 403 else 404 vmcall(); 405 vmx_set_test_stage(1); 406 guest_cr4 = read_cr4(); 407 if (vmx_get_test_stage() == 2) 408 report("Read through CR4", 0); 409 else 410 vmcall(); 411 // Test write through 412 guest_cr0 = guest_cr0 ^ (X86_CR0_TS | X86_CR0_MP); 413 guest_cr4 = guest_cr4 ^ (X86_CR4_TSD | X86_CR4_DE); 414 vmx_set_test_stage(2); 415 write_cr0(guest_cr0); 416 if (vmx_get_test_stage() == 3) 417 report("Write throuth CR0", 0); 418 else 419 vmcall(); 420 vmx_set_test_stage(3); 421 write_cr4(guest_cr4); 422 if (vmx_get_test_stage() == 4) 423 report("Write through CR4", 0); 424 else 425 vmcall(); 426 // Test read shadow 427 vmx_set_test_stage(4); 428 vmcall(); 429 cr0 = read_cr0(); 430 if (vmx_get_test_stage() != 5) { 431 if (cr0 == guest_cr0) 432 report("Read shadowing CR0", 1); 433 else 434 report("Read shadowing CR0", 0); 435 } 436 vmx_set_test_stage(5); 437 cr4 = read_cr4(); 438 if (vmx_get_test_stage() != 6) { 439 if (cr4 == guest_cr4) 440 report("Read shadowing CR4", 1); 441 else 442 report("Read shadowing CR4", 0); 443 } 444 // Test write shadow (same value with shadow) 445 vmx_set_test_stage(6); 446 write_cr0(guest_cr0); 447 if (vmx_get_test_stage() == 7) 448 report("Write shadowing CR0 (same value with shadow)", 0); 449 else 450 vmcall(); 451 vmx_set_test_stage(7); 452 write_cr4(guest_cr4); 453 if (vmx_get_test_stage() == 8) 454 report("Write shadowing CR4 (same value with shadow)", 0); 455 else 456 vmcall(); 457 // Test write shadow (different value) 458 vmx_set_test_stage(8); 459 tmp = guest_cr0 ^ X86_CR0_TS; 460 asm volatile("mov %0, %%rsi\n\t" 461 "mov %%rsi, %%cr0\n\t" 462 ::"m"(tmp) 463 :"rsi", "memory", "cc"); 464 if (vmx_get_test_stage() != 9) 465 report("Write shadowing different X86_CR0_TS", 0); 466 else 467 report("Write shadowing different X86_CR0_TS", 1); 468 vmx_set_test_stage(9); 469 tmp = guest_cr0 ^ X86_CR0_MP; 470 asm volatile("mov %0, %%rsi\n\t" 471 "mov %%rsi, %%cr0\n\t" 472 ::"m"(tmp) 473 :"rsi", "memory", "cc"); 474 if (vmx_get_test_stage() != 10) 475 report("Write shadowing different X86_CR0_MP", 0); 476 else 477 report("Write shadowing different X86_CR0_MP", 1); 478 vmx_set_test_stage(10); 479 tmp = guest_cr4 ^ X86_CR4_TSD; 480 asm volatile("mov %0, %%rsi\n\t" 481 "mov %%rsi, %%cr4\n\t" 482 ::"m"(tmp) 483 :"rsi", "memory", "cc"); 484 if (vmx_get_test_stage() != 11) 485 report("Write shadowing different X86_CR4_TSD", 0); 486 else 487 report("Write shadowing different X86_CR4_TSD", 1); 488 vmx_set_test_stage(11); 489 tmp = guest_cr4 ^ X86_CR4_DE; 490 asm volatile("mov %0, %%rsi\n\t" 491 "mov %%rsi, %%cr4\n\t" 492 ::"m"(tmp) 493 :"rsi", "memory", "cc"); 494 if (vmx_get_test_stage() != 12) 495 report("Write shadowing different X86_CR4_DE", 0); 496 else 497 report("Write shadowing different X86_CR4_DE", 1); 498 } 499 500 static int cr_shadowing_exit_handler() 501 { 502 u64 guest_rip; 503 ulong reason; 504 u32 insn_len; 505 u32 exit_qual; 506 507 guest_rip = vmcs_read(GUEST_RIP); 508 reason = vmcs_read(EXI_REASON) & 0xff; 509 insn_len = vmcs_read(EXI_INST_LEN); 510 exit_qual = vmcs_read(EXI_QUALIFICATION); 511 switch (reason) { 512 case VMX_VMCALL: 513 switch (vmx_get_test_stage()) { 514 case 0: 515 if (guest_cr0 == vmcs_read(GUEST_CR0)) 516 report("Read through CR0", 1); 517 else 518 report("Read through CR0", 0); 519 break; 520 case 1: 521 if (guest_cr4 == vmcs_read(GUEST_CR4)) 522 report("Read through CR4", 1); 523 else 524 report("Read through CR4", 0); 525 break; 526 case 2: 527 if (guest_cr0 == vmcs_read(GUEST_CR0)) 528 report("Write through CR0", 1); 529 else 530 report("Write through CR0", 0); 531 break; 532 case 3: 533 if (guest_cr4 == vmcs_read(GUEST_CR4)) 534 report("Write through CR4", 1); 535 else 536 report("Write through CR4", 0); 537 break; 538 case 4: 539 guest_cr0 = vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP); 540 guest_cr4 = vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE); 541 vmcs_write(CR0_MASK, X86_CR0_TS | X86_CR0_MP); 542 vmcs_write(CR0_READ_SHADOW, guest_cr0 & (X86_CR0_TS | X86_CR0_MP)); 543 vmcs_write(CR4_MASK, X86_CR4_TSD | X86_CR4_DE); 544 vmcs_write(CR4_READ_SHADOW, guest_cr4 & (X86_CR4_TSD | X86_CR4_DE)); 545 break; 546 case 6: 547 if (guest_cr0 == (vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP))) 548 report("Write shadowing CR0 (same value)", 1); 549 else 550 report("Write shadowing CR0 (same value)", 0); 551 break; 552 case 7: 553 if (guest_cr4 == (vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE))) 554 report("Write shadowing CR4 (same value)", 1); 555 else 556 report("Write shadowing CR4 (same value)", 0); 557 break; 558 default: 559 // Should not reach here 560 printf("ERROR : unexpected stage, %d\n", 561 vmx_get_test_stage()); 562 print_vmexit_info(); 563 return VMX_TEST_VMEXIT; 564 } 565 vmcs_write(GUEST_RIP, guest_rip + insn_len); 566 return VMX_TEST_RESUME; 567 case VMX_CR: 568 switch (vmx_get_test_stage()) { 569 case 4: 570 report("Read shadowing CR0", 0); 571 vmx_inc_test_stage(); 572 break; 573 case 5: 574 report("Read shadowing CR4", 0); 575 vmx_inc_test_stage(); 576 break; 577 case 6: 578 report("Write shadowing CR0 (same value)", 0); 579 vmx_inc_test_stage(); 580 break; 581 case 7: 582 report("Write shadowing CR4 (same value)", 0); 583 vmx_inc_test_stage(); 584 break; 585 case 8: 586 case 9: 587 // 0x600 encodes "mov %esi, %cr0" 588 if (exit_qual == 0x600) 589 vmx_inc_test_stage(); 590 break; 591 case 10: 592 case 11: 593 // 0x604 encodes "mov %esi, %cr4" 594 if (exit_qual == 0x604) 595 vmx_inc_test_stage(); 596 break; 597 default: 598 // Should not reach here 599 printf("ERROR : unexpected stage, %d\n", 600 vmx_get_test_stage()); 601 print_vmexit_info(); 602 return VMX_TEST_VMEXIT; 603 } 604 vmcs_write(GUEST_RIP, guest_rip + insn_len); 605 return VMX_TEST_RESUME; 606 default: 607 printf("Unknown exit reason, %d\n", reason); 608 print_vmexit_info(); 609 } 610 return VMX_TEST_VMEXIT; 611 } 612 613 static int iobmp_init() 614 { 615 u32 ctrl_cpu0; 616 617 io_bitmap_a = alloc_page(); 618 io_bitmap_a = alloc_page(); 619 memset(io_bitmap_a, 0x0, PAGE_SIZE); 620 memset(io_bitmap_b, 0x0, PAGE_SIZE); 621 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 622 ctrl_cpu0 |= CPU_IO_BITMAP; 623 ctrl_cpu0 &= (~CPU_IO); 624 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 625 vmcs_write(IO_BITMAP_A, (u64)io_bitmap_a); 626 vmcs_write(IO_BITMAP_B, (u64)io_bitmap_b); 627 return VMX_TEST_START; 628 } 629 630 static void iobmp_main() 631 { 632 // stage 0, test IO pass 633 vmx_set_test_stage(0); 634 inb(0x5000); 635 outb(0x0, 0x5000); 636 if (vmx_get_test_stage() != 0) 637 report("I/O bitmap - I/O pass", 0); 638 else 639 report("I/O bitmap - I/O pass", 1); 640 // test IO width, in/out 641 ((u8 *)io_bitmap_a)[0] = 0xFF; 642 vmx_set_test_stage(2); 643 inb(0x0); 644 if (vmx_get_test_stage() != 3) 645 report("I/O bitmap - trap in", 0); 646 else 647 report("I/O bitmap - trap in", 1); 648 vmx_set_test_stage(3); 649 outw(0x0, 0x0); 650 if (vmx_get_test_stage() != 4) 651 report("I/O bitmap - trap out", 0); 652 else 653 report("I/O bitmap - trap out", 1); 654 vmx_set_test_stage(4); 655 inl(0x0); 656 if (vmx_get_test_stage() != 5) 657 report("I/O bitmap - I/O width, long", 0); 658 // test low/high IO port 659 vmx_set_test_stage(5); 660 ((u8 *)io_bitmap_a)[0x5000 / 8] = (1 << (0x5000 % 8)); 661 inb(0x5000); 662 if (vmx_get_test_stage() == 6) 663 report("I/O bitmap - I/O port, low part", 1); 664 else 665 report("I/O bitmap - I/O port, low part", 0); 666 vmx_set_test_stage(6); 667 ((u8 *)io_bitmap_b)[0x1000 / 8] = (1 << (0x1000 % 8)); 668 inb(0x9000); 669 if (vmx_get_test_stage() == 7) 670 report("I/O bitmap - I/O port, high part", 1); 671 else 672 report("I/O bitmap - I/O port, high part", 0); 673 // test partial pass 674 vmx_set_test_stage(7); 675 inl(0x4FFF); 676 if (vmx_get_test_stage() == 8) 677 report("I/O bitmap - partial pass", 1); 678 else 679 report("I/O bitmap - partial pass", 0); 680 // test overrun 681 vmx_set_test_stage(8); 682 memset(io_bitmap_a, 0x0, PAGE_SIZE); 683 memset(io_bitmap_b, 0x0, PAGE_SIZE); 684 inl(0xFFFF); 685 if (vmx_get_test_stage() == 9) 686 report("I/O bitmap - overrun", 1); 687 else 688 report("I/O bitmap - overrun", 0); 689 vmx_set_test_stage(9); 690 vmcall(); 691 outb(0x0, 0x0); 692 report("I/O bitmap - ignore unconditional exiting", 693 vmx_get_test_stage() == 9); 694 vmx_set_test_stage(10); 695 vmcall(); 696 outb(0x0, 0x0); 697 report("I/O bitmap - unconditional exiting", 698 vmx_get_test_stage() == 11); 699 } 700 701 static int iobmp_exit_handler() 702 { 703 u64 guest_rip; 704 ulong reason, exit_qual; 705 u32 insn_len, ctrl_cpu0; 706 707 guest_rip = vmcs_read(GUEST_RIP); 708 reason = vmcs_read(EXI_REASON) & 0xff; 709 exit_qual = vmcs_read(EXI_QUALIFICATION); 710 insn_len = vmcs_read(EXI_INST_LEN); 711 switch (reason) { 712 case VMX_IO: 713 switch (vmx_get_test_stage()) { 714 case 0: 715 case 1: 716 vmx_inc_test_stage(); 717 break; 718 case 2: 719 if ((exit_qual & VMX_IO_SIZE_MASK) != _VMX_IO_BYTE) 720 report("I/O bitmap - I/O width, byte", 0); 721 else 722 report("I/O bitmap - I/O width, byte", 1); 723 if (!(exit_qual & VMX_IO_IN)) 724 report("I/O bitmap - I/O direction, in", 0); 725 else 726 report("I/O bitmap - I/O direction, in", 1); 727 vmx_inc_test_stage(); 728 break; 729 case 3: 730 if ((exit_qual & VMX_IO_SIZE_MASK) != _VMX_IO_WORD) 731 report("I/O bitmap - I/O width, word", 0); 732 else 733 report("I/O bitmap - I/O width, word", 1); 734 if (!(exit_qual & VMX_IO_IN)) 735 report("I/O bitmap - I/O direction, out", 1); 736 else 737 report("I/O bitmap - I/O direction, out", 0); 738 vmx_inc_test_stage(); 739 break; 740 case 4: 741 if ((exit_qual & VMX_IO_SIZE_MASK) != _VMX_IO_LONG) 742 report("I/O bitmap - I/O width, long", 0); 743 else 744 report("I/O bitmap - I/O width, long", 1); 745 vmx_inc_test_stage(); 746 break; 747 case 5: 748 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x5000) 749 vmx_inc_test_stage(); 750 break; 751 case 6: 752 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x9000) 753 vmx_inc_test_stage(); 754 break; 755 case 7: 756 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x4FFF) 757 vmx_inc_test_stage(); 758 break; 759 case 8: 760 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0xFFFF) 761 vmx_inc_test_stage(); 762 break; 763 case 9: 764 case 10: 765 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 766 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0 & ~CPU_IO); 767 vmx_inc_test_stage(); 768 break; 769 default: 770 // Should not reach here 771 printf("ERROR : unexpected stage, %d\n", 772 vmx_get_test_stage()); 773 print_vmexit_info(); 774 return VMX_TEST_VMEXIT; 775 } 776 vmcs_write(GUEST_RIP, guest_rip + insn_len); 777 return VMX_TEST_RESUME; 778 case VMX_VMCALL: 779 switch (vmx_get_test_stage()) { 780 case 9: 781 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 782 ctrl_cpu0 |= CPU_IO | CPU_IO_BITMAP; 783 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 784 break; 785 case 10: 786 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 787 ctrl_cpu0 = (ctrl_cpu0 & ~CPU_IO_BITMAP) | CPU_IO; 788 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 789 break; 790 default: 791 // Should not reach here 792 printf("ERROR : unexpected stage, %d\n", 793 vmx_get_test_stage()); 794 print_vmexit_info(); 795 return VMX_TEST_VMEXIT; 796 } 797 vmcs_write(GUEST_RIP, guest_rip + insn_len); 798 return VMX_TEST_RESUME; 799 default: 800 printf("guest_rip = 0x%llx\n", guest_rip); 801 printf("\tERROR : Undefined exit reason, reason = %d.\n", reason); 802 break; 803 } 804 return VMX_TEST_VMEXIT; 805 } 806 807 #define INSN_CPU0 0 808 #define INSN_CPU1 1 809 #define INSN_ALWAYS_TRAP 2 810 811 #define FIELD_EXIT_QUAL (1 << 0) 812 #define FIELD_INSN_INFO (1 << 1) 813 814 asm( 815 "insn_hlt: hlt;ret\n\t" 816 "insn_invlpg: invlpg 0x12345678;ret\n\t" 817 "insn_mwait: mwait;ret\n\t" 818 "insn_rdpmc: rdpmc;ret\n\t" 819 "insn_rdtsc: rdtsc;ret\n\t" 820 "insn_cr3_load: mov cr3,%rax; mov %rax,%cr3;ret\n\t" 821 "insn_cr3_store: mov %cr3,%rax;ret\n\t" 822 #ifdef __x86_64__ 823 "insn_cr8_load: mov %rax,%cr8;ret\n\t" 824 "insn_cr8_store: mov %cr8,%rax;ret\n\t" 825 #endif 826 "insn_monitor: monitor;ret\n\t" 827 "insn_pause: pause;ret\n\t" 828 "insn_wbinvd: wbinvd;ret\n\t" 829 "insn_cpuid: cpuid;ret\n\t" 830 "insn_invd: invd;ret\n\t" 831 ); 832 extern void insn_hlt(); 833 extern void insn_invlpg(); 834 extern void insn_mwait(); 835 extern void insn_rdpmc(); 836 extern void insn_rdtsc(); 837 extern void insn_cr3_load(); 838 extern void insn_cr3_store(); 839 #ifdef __x86_64__ 840 extern void insn_cr8_load(); 841 extern void insn_cr8_store(); 842 #endif 843 extern void insn_monitor(); 844 extern void insn_pause(); 845 extern void insn_wbinvd(); 846 extern void insn_cpuid(); 847 extern void insn_invd(); 848 849 u32 cur_insn; 850 u64 cr3; 851 852 struct insn_table { 853 const char *name; 854 u32 flag; 855 void (*insn_func)(); 856 u32 type; 857 u32 reason; 858 ulong exit_qual; 859 u32 insn_info; 860 // Use FIELD_EXIT_QUAL and FIELD_INSN_INFO to define 861 // which field need to be tested, reason is always tested 862 u32 test_field; 863 }; 864 865 /* 866 * Add more test cases of instruction intercept here. Elements in this 867 * table is: 868 * name/control flag/insn function/type/exit reason/exit qulification/ 869 * instruction info/field to test 870 * The last field defines which fields (exit_qual and insn_info) need to be 871 * tested in exit handler. If set to 0, only "reason" is checked. 872 */ 873 static struct insn_table insn_table[] = { 874 // Flags for Primary Processor-Based VM-Execution Controls 875 {"HLT", CPU_HLT, insn_hlt, INSN_CPU0, 12, 0, 0, 0}, 876 {"INVLPG", CPU_INVLPG, insn_invlpg, INSN_CPU0, 14, 877 0x12345678, 0, FIELD_EXIT_QUAL}, 878 {"MWAIT", CPU_MWAIT, insn_mwait, INSN_CPU0, 36, 0, 0, 0}, 879 {"RDPMC", CPU_RDPMC, insn_rdpmc, INSN_CPU0, 15, 0, 0, 0}, 880 {"RDTSC", CPU_RDTSC, insn_rdtsc, INSN_CPU0, 16, 0, 0, 0}, 881 {"CR3 load", CPU_CR3_LOAD, insn_cr3_load, INSN_CPU0, 28, 0x3, 0, 882 FIELD_EXIT_QUAL}, 883 {"CR3 store", CPU_CR3_STORE, insn_cr3_store, INSN_CPU0, 28, 0x13, 0, 884 FIELD_EXIT_QUAL}, 885 #ifdef __x86_64__ 886 {"CR8 load", CPU_CR8_LOAD, insn_cr8_load, INSN_CPU0, 28, 0x8, 0, 887 FIELD_EXIT_QUAL}, 888 {"CR8 store", CPU_CR8_STORE, insn_cr8_store, INSN_CPU0, 28, 0x18, 0, 889 FIELD_EXIT_QUAL}, 890 #endif 891 {"MONITOR", CPU_MONITOR, insn_monitor, INSN_CPU0, 39, 0, 0, 0}, 892 {"PAUSE", CPU_PAUSE, insn_pause, INSN_CPU0, 40, 0, 0, 0}, 893 // Flags for Secondary Processor-Based VM-Execution Controls 894 {"WBINVD", CPU_WBINVD, insn_wbinvd, INSN_CPU1, 54, 0, 0, 0}, 895 // Instructions always trap 896 {"CPUID", 0, insn_cpuid, INSN_ALWAYS_TRAP, 10, 0, 0, 0}, 897 {"INVD", 0, insn_invd, INSN_ALWAYS_TRAP, 13, 0, 0, 0}, 898 // Instructions never trap 899 {NULL}, 900 }; 901 902 static int insn_intercept_init() 903 { 904 u32 ctrl_cpu; 905 906 ctrl_cpu = ctrl_cpu_rev[0].set | CPU_SECONDARY; 907 ctrl_cpu &= ctrl_cpu_rev[0].clr; 908 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu); 909 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu_rev[1].set); 910 cr3 = read_cr3(); 911 return VMX_TEST_START; 912 } 913 914 static void insn_intercept_main() 915 { 916 char msg[80]; 917 918 for (cur_insn = 0; insn_table[cur_insn].name != NULL; cur_insn++) { 919 vmx_set_test_stage(cur_insn * 2); 920 if ((insn_table[cur_insn].type == INSN_CPU0 && 921 !(ctrl_cpu_rev[0].clr & insn_table[cur_insn].flag)) || 922 (insn_table[cur_insn].type == INSN_CPU1 && 923 !(ctrl_cpu_rev[1].clr & insn_table[cur_insn].flag))) { 924 printf("\tCPU_CTRL%d.CPU_%s is not supported.\n", 925 insn_table[cur_insn].type - INSN_CPU0, 926 insn_table[cur_insn].name); 927 continue; 928 } 929 930 if ((insn_table[cur_insn].type == INSN_CPU0 && 931 !(ctrl_cpu_rev[0].set & insn_table[cur_insn].flag)) || 932 (insn_table[cur_insn].type == INSN_CPU1 && 933 !(ctrl_cpu_rev[1].set & insn_table[cur_insn].flag))) { 934 /* skip hlt, it stalls the guest and is tested below */ 935 if (insn_table[cur_insn].insn_func != insn_hlt) 936 insn_table[cur_insn].insn_func(); 937 snprintf(msg, sizeof(msg), "execute %s", 938 insn_table[cur_insn].name); 939 report(msg, vmx_get_test_stage() == cur_insn * 2); 940 } else if (insn_table[cur_insn].type != INSN_ALWAYS_TRAP) 941 printf("\tCPU_CTRL%d.CPU_%s always traps.\n", 942 insn_table[cur_insn].type - INSN_CPU0, 943 insn_table[cur_insn].name); 944 945 vmcall(); 946 947 insn_table[cur_insn].insn_func(); 948 snprintf(msg, sizeof(msg), "intercept %s", 949 insn_table[cur_insn].name); 950 report(msg, vmx_get_test_stage() == cur_insn * 2 + 1); 951 952 vmx_set_test_stage(cur_insn * 2 + 1); 953 vmcall(); 954 } 955 } 956 957 static int insn_intercept_exit_handler() 958 { 959 u64 guest_rip; 960 u32 reason; 961 ulong exit_qual; 962 u32 insn_len; 963 u32 insn_info; 964 bool pass; 965 966 guest_rip = vmcs_read(GUEST_RIP); 967 reason = vmcs_read(EXI_REASON) & 0xff; 968 exit_qual = vmcs_read(EXI_QUALIFICATION); 969 insn_len = vmcs_read(EXI_INST_LEN); 970 insn_info = vmcs_read(EXI_INST_INFO); 971 972 if (reason == VMX_VMCALL) { 973 u32 val = 0; 974 975 if (insn_table[cur_insn].type == INSN_CPU0) 976 val = vmcs_read(CPU_EXEC_CTRL0); 977 else if (insn_table[cur_insn].type == INSN_CPU1) 978 val = vmcs_read(CPU_EXEC_CTRL1); 979 980 if (vmx_get_test_stage() & 1) 981 val &= ~insn_table[cur_insn].flag; 982 else 983 val |= insn_table[cur_insn].flag; 984 985 if (insn_table[cur_insn].type == INSN_CPU0) 986 vmcs_write(CPU_EXEC_CTRL0, val | ctrl_cpu_rev[0].set); 987 else if (insn_table[cur_insn].type == INSN_CPU1) 988 vmcs_write(CPU_EXEC_CTRL1, val | ctrl_cpu_rev[1].set); 989 } else { 990 pass = (cur_insn * 2 == vmx_get_test_stage()) && 991 insn_table[cur_insn].reason == reason; 992 if (insn_table[cur_insn].test_field & FIELD_EXIT_QUAL && 993 insn_table[cur_insn].exit_qual != exit_qual) 994 pass = false; 995 if (insn_table[cur_insn].test_field & FIELD_INSN_INFO && 996 insn_table[cur_insn].insn_info != insn_info) 997 pass = false; 998 if (pass) 999 vmx_inc_test_stage(); 1000 } 1001 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1002 return VMX_TEST_RESUME; 1003 } 1004 1005 1006 static int setup_ept() 1007 { 1008 int support_2m; 1009 unsigned long end_of_memory; 1010 1011 if (!(ept_vpid.val & EPT_CAP_UC) && 1012 !(ept_vpid.val & EPT_CAP_WB)) { 1013 printf("\tEPT paging-structure memory type " 1014 "UC&WB are not supported\n"); 1015 return 1; 1016 } 1017 if (ept_vpid.val & EPT_CAP_UC) 1018 eptp = EPT_MEM_TYPE_UC; 1019 else 1020 eptp = EPT_MEM_TYPE_WB; 1021 if (!(ept_vpid.val & EPT_CAP_PWL4)) { 1022 printf("\tPWL4 is not supported\n"); 1023 return 1; 1024 } 1025 eptp |= (3 << EPTP_PG_WALK_LEN_SHIFT); 1026 pml4 = alloc_page(); 1027 memset(pml4, 0, PAGE_SIZE); 1028 eptp |= virt_to_phys(pml4); 1029 vmcs_write(EPTP, eptp); 1030 support_2m = !!(ept_vpid.val & EPT_CAP_2M_PAGE); 1031 end_of_memory = fwcfg_get_u64(FW_CFG_RAM_SIZE); 1032 if (end_of_memory < (1ul << 32)) 1033 end_of_memory = (1ul << 32); 1034 setup_ept_range(pml4, 0, end_of_memory, 0, support_2m, 1035 EPT_WA | EPT_RA | EPT_EA); 1036 return 0; 1037 } 1038 1039 static int apic_version; 1040 1041 static int ept_init() 1042 { 1043 unsigned long base_addr1, base_addr2; 1044 u32 ctrl_cpu[2]; 1045 1046 if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) || 1047 !(ctrl_cpu_rev[1].clr & CPU_EPT)) { 1048 printf("\tEPT is not supported"); 1049 return VMX_TEST_EXIT; 1050 } 1051 1052 ctrl_cpu[0] = vmcs_read(CPU_EXEC_CTRL0); 1053 ctrl_cpu[1] = vmcs_read(CPU_EXEC_CTRL1); 1054 ctrl_cpu[0] = (ctrl_cpu[0] | CPU_SECONDARY) 1055 & ctrl_cpu_rev[0].clr; 1056 ctrl_cpu[1] = (ctrl_cpu[1] | CPU_EPT) 1057 & ctrl_cpu_rev[1].clr; 1058 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu[0]); 1059 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu[1]); 1060 if (setup_ept()) 1061 return VMX_TEST_EXIT; 1062 data_page1 = alloc_page(); 1063 data_page2 = alloc_page(); 1064 memset(data_page1, 0x0, PAGE_SIZE); 1065 memset(data_page2, 0x0, PAGE_SIZE); 1066 *((u32 *)data_page1) = MAGIC_VAL_1; 1067 *((u32 *)data_page2) = MAGIC_VAL_2; 1068 base_addr1 = (unsigned long)data_page1 & PAGE_MASK_2M; 1069 base_addr2 = (unsigned long)data_page2 & PAGE_MASK_2M; 1070 setup_ept_range(pml4, base_addr1, base_addr1 + PAGE_SIZE_2M, 0, 0, 1071 EPT_WA | EPT_RA | EPT_EA); 1072 setup_ept_range(pml4, base_addr2, base_addr2 + PAGE_SIZE_2M, 0, 0, 1073 EPT_WA | EPT_RA | EPT_EA); 1074 install_ept(pml4, (unsigned long)data_page1, (unsigned long)data_page2, 1075 EPT_RA | EPT_WA | EPT_EA); 1076 1077 apic_version = *((u32 *)0xfee00030UL); 1078 return VMX_TEST_START; 1079 } 1080 1081 static void ept_main() 1082 { 1083 vmx_set_test_stage(0); 1084 if (*((u32 *)data_page2) != MAGIC_VAL_1 || 1085 *((u32 *)data_page1) != MAGIC_VAL_1) 1086 report("EPT basic framework - read", 0); 1087 else { 1088 *((u32 *)data_page2) = MAGIC_VAL_3; 1089 vmcall(); 1090 if (vmx_get_test_stage() == 1) { 1091 if (*((u32 *)data_page1) == MAGIC_VAL_3 && 1092 *((u32 *)data_page2) == MAGIC_VAL_2) 1093 report("EPT basic framework", 1); 1094 else 1095 report("EPT basic framework - remap", 1); 1096 } 1097 } 1098 // Test EPT Misconfigurations 1099 vmx_set_test_stage(1); 1100 vmcall(); 1101 *((u32 *)data_page1) = MAGIC_VAL_1; 1102 if (vmx_get_test_stage() != 2) { 1103 report("EPT misconfigurations", 0); 1104 goto t1; 1105 } 1106 vmx_set_test_stage(2); 1107 vmcall(); 1108 *((u32 *)data_page1) = MAGIC_VAL_1; 1109 if (vmx_get_test_stage() != 3) { 1110 report("EPT misconfigurations", 0); 1111 goto t1; 1112 } 1113 report("EPT misconfigurations", 1); 1114 t1: 1115 // Test EPT violation 1116 vmx_set_test_stage(3); 1117 vmcall(); 1118 *((u32 *)data_page1) = MAGIC_VAL_1; 1119 if (vmx_get_test_stage() == 4) 1120 report("EPT violation - page permission", 1); 1121 else 1122 report("EPT violation - page permission", 0); 1123 // Violation caused by EPT paging structure 1124 vmx_set_test_stage(4); 1125 vmcall(); 1126 *((u32 *)data_page1) = MAGIC_VAL_2; 1127 if (vmx_get_test_stage() == 5) 1128 report("EPT violation - paging structure", 1); 1129 else 1130 report("EPT violation - paging structure", 0); 1131 1132 // Test EPT access to L1 MMIO 1133 vmx_set_test_stage(6); 1134 report("EPT - MMIO access", *((u32 *)0xfee00030UL) == apic_version); 1135 } 1136 1137 static int ept_exit_handler() 1138 { 1139 u64 guest_rip; 1140 ulong reason; 1141 u32 insn_len; 1142 u32 exit_qual; 1143 static unsigned long data_page1_pte, data_page1_pte_pte; 1144 1145 guest_rip = vmcs_read(GUEST_RIP); 1146 reason = vmcs_read(EXI_REASON) & 0xff; 1147 insn_len = vmcs_read(EXI_INST_LEN); 1148 exit_qual = vmcs_read(EXI_QUALIFICATION); 1149 switch (reason) { 1150 case VMX_VMCALL: 1151 switch (vmx_get_test_stage()) { 1152 case 0: 1153 if (*((u32 *)data_page1) == MAGIC_VAL_3 && 1154 *((u32 *)data_page2) == MAGIC_VAL_2) { 1155 vmx_inc_test_stage(); 1156 install_ept(pml4, (unsigned long)data_page2, 1157 (unsigned long)data_page2, 1158 EPT_RA | EPT_WA | EPT_EA); 1159 } else 1160 report("EPT basic framework - write\n", 0); 1161 break; 1162 case 1: 1163 install_ept(pml4, (unsigned long)data_page1, 1164 (unsigned long)data_page1, EPT_WA); 1165 ept_sync(INVEPT_SINGLE, eptp); 1166 break; 1167 case 2: 1168 install_ept(pml4, (unsigned long)data_page1, 1169 (unsigned long)data_page1, 1170 EPT_RA | EPT_WA | EPT_EA | 1171 (2 << EPT_MEM_TYPE_SHIFT)); 1172 ept_sync(INVEPT_SINGLE, eptp); 1173 break; 1174 case 3: 1175 data_page1_pte = get_ept_pte(pml4, 1176 (unsigned long)data_page1, 1); 1177 set_ept_pte(pml4, (unsigned long)data_page1, 1178 1, data_page1_pte & (~EPT_PRESENT)); 1179 ept_sync(INVEPT_SINGLE, eptp); 1180 break; 1181 case 4: 1182 data_page1_pte = get_ept_pte(pml4, 1183 (unsigned long)data_page1, 2); 1184 data_page1_pte &= PAGE_MASK; 1185 data_page1_pte_pte = get_ept_pte(pml4, data_page1_pte, 2); 1186 set_ept_pte(pml4, data_page1_pte, 2, 1187 data_page1_pte_pte & (~EPT_PRESENT)); 1188 ept_sync(INVEPT_SINGLE, eptp); 1189 break; 1190 // Should not reach here 1191 default: 1192 printf("ERROR - unexpected stage, %d.\n", 1193 vmx_get_test_stage()); 1194 print_vmexit_info(); 1195 return VMX_TEST_VMEXIT; 1196 } 1197 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1198 return VMX_TEST_RESUME; 1199 case VMX_EPT_MISCONFIG: 1200 switch (vmx_get_test_stage()) { 1201 case 1: 1202 case 2: 1203 vmx_inc_test_stage(); 1204 install_ept(pml4, (unsigned long)data_page1, 1205 (unsigned long)data_page1, 1206 EPT_RA | EPT_WA | EPT_EA); 1207 ept_sync(INVEPT_SINGLE, eptp); 1208 break; 1209 // Should not reach here 1210 default: 1211 printf("ERROR - unexpected stage, %d.\n", 1212 vmx_get_test_stage()); 1213 print_vmexit_info(); 1214 return VMX_TEST_VMEXIT; 1215 } 1216 return VMX_TEST_RESUME; 1217 case VMX_EPT_VIOLATION: 1218 switch(vmx_get_test_stage()) { 1219 case 3: 1220 if (exit_qual == (EPT_VLT_WR | EPT_VLT_LADDR_VLD | 1221 EPT_VLT_PADDR)) 1222 vmx_inc_test_stage(); 1223 set_ept_pte(pml4, (unsigned long)data_page1, 1224 1, data_page1_pte | (EPT_PRESENT)); 1225 ept_sync(INVEPT_SINGLE, eptp); 1226 break; 1227 case 4: 1228 if (exit_qual == (EPT_VLT_RD | EPT_VLT_LADDR_VLD)) 1229 vmx_inc_test_stage(); 1230 set_ept_pte(pml4, data_page1_pte, 2, 1231 data_page1_pte_pte | (EPT_PRESENT)); 1232 ept_sync(INVEPT_SINGLE, eptp); 1233 break; 1234 default: 1235 // Should not reach here 1236 printf("ERROR : unexpected stage, %d\n", 1237 vmx_get_test_stage()); 1238 print_vmexit_info(); 1239 return VMX_TEST_VMEXIT; 1240 } 1241 return VMX_TEST_RESUME; 1242 default: 1243 printf("Unknown exit reason, %d\n", reason); 1244 print_vmexit_info(); 1245 } 1246 return VMX_TEST_VMEXIT; 1247 } 1248 1249 #define TIMER_VECTOR 222 1250 1251 static volatile bool timer_fired; 1252 1253 static void timer_isr(isr_regs_t *regs) 1254 { 1255 timer_fired = true; 1256 apic_write(APIC_EOI, 0); 1257 } 1258 1259 static int interrupt_init(struct vmcs *vmcs) 1260 { 1261 msr_bmp_init(); 1262 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_EXTINT); 1263 handle_irq(TIMER_VECTOR, timer_isr); 1264 return VMX_TEST_START; 1265 } 1266 1267 static void interrupt_main(void) 1268 { 1269 long long start, loops; 1270 1271 vmx_set_test_stage(0); 1272 1273 apic_write(APIC_LVTT, TIMER_VECTOR); 1274 irq_enable(); 1275 1276 apic_write(APIC_TMICT, 1); 1277 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1278 asm volatile ("nop"); 1279 report("direct interrupt while running guest", timer_fired); 1280 1281 apic_write(APIC_TMICT, 0); 1282 irq_disable(); 1283 vmcall(); 1284 timer_fired = false; 1285 apic_write(APIC_TMICT, 1); 1286 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1287 asm volatile ("nop"); 1288 report("intercepted interrupt while running guest", timer_fired); 1289 1290 irq_enable(); 1291 apic_write(APIC_TMICT, 0); 1292 irq_disable(); 1293 vmcall(); 1294 timer_fired = false; 1295 start = rdtsc(); 1296 apic_write(APIC_TMICT, 1000000); 1297 1298 asm volatile ("sti; hlt"); 1299 1300 report("direct interrupt + hlt", 1301 rdtsc() - start > 1000000 && timer_fired); 1302 1303 apic_write(APIC_TMICT, 0); 1304 irq_disable(); 1305 vmcall(); 1306 timer_fired = false; 1307 start = rdtsc(); 1308 apic_write(APIC_TMICT, 1000000); 1309 1310 asm volatile ("sti; hlt"); 1311 1312 report("intercepted interrupt + hlt", 1313 rdtsc() - start > 10000 && timer_fired); 1314 1315 apic_write(APIC_TMICT, 0); 1316 irq_disable(); 1317 vmcall(); 1318 timer_fired = false; 1319 start = rdtsc(); 1320 apic_write(APIC_TMICT, 1000000); 1321 1322 irq_enable(); 1323 asm volatile ("nop"); 1324 vmcall(); 1325 1326 report("direct interrupt + activity state hlt", 1327 rdtsc() - start > 10000 && timer_fired); 1328 1329 apic_write(APIC_TMICT, 0); 1330 irq_disable(); 1331 vmcall(); 1332 timer_fired = false; 1333 start = rdtsc(); 1334 apic_write(APIC_TMICT, 1000000); 1335 1336 irq_enable(); 1337 asm volatile ("nop"); 1338 vmcall(); 1339 1340 report("intercepted interrupt + activity state hlt", 1341 rdtsc() - start > 10000 && timer_fired); 1342 1343 apic_write(APIC_TMICT, 0); 1344 irq_disable(); 1345 vmx_set_test_stage(7); 1346 vmcall(); 1347 timer_fired = false; 1348 apic_write(APIC_TMICT, 1); 1349 for (loops = 0; loops < 10000000 && !timer_fired; loops++) 1350 asm volatile ("nop"); 1351 report("running a guest with interrupt acknowledgement set", timer_fired); 1352 } 1353 1354 static int interrupt_exit_handler(void) 1355 { 1356 u64 guest_rip = vmcs_read(GUEST_RIP); 1357 ulong reason = vmcs_read(EXI_REASON) & 0xff; 1358 u32 insn_len = vmcs_read(EXI_INST_LEN); 1359 1360 switch (reason) { 1361 case VMX_VMCALL: 1362 switch (vmx_get_test_stage()) { 1363 case 0: 1364 case 2: 1365 case 5: 1366 vmcs_write(PIN_CONTROLS, 1367 vmcs_read(PIN_CONTROLS) | PIN_EXTINT); 1368 break; 1369 case 7: 1370 vmcs_write(EXI_CONTROLS, vmcs_read(EXI_CONTROLS) | EXI_INTA); 1371 vmcs_write(PIN_CONTROLS, 1372 vmcs_read(PIN_CONTROLS) | PIN_EXTINT); 1373 break; 1374 case 1: 1375 case 3: 1376 vmcs_write(PIN_CONTROLS, 1377 vmcs_read(PIN_CONTROLS) & ~PIN_EXTINT); 1378 break; 1379 case 4: 1380 case 6: 1381 vmcs_write(GUEST_ACTV_STATE, ACTV_HLT); 1382 break; 1383 } 1384 vmx_inc_test_stage(); 1385 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1386 return VMX_TEST_RESUME; 1387 case VMX_EXTINT: 1388 if (vmcs_read(EXI_CONTROLS) & EXI_INTA) { 1389 int vector = vmcs_read(EXI_INTR_INFO) & 0xff; 1390 handle_external_interrupt(vector); 1391 } else { 1392 irq_enable(); 1393 asm volatile ("nop"); 1394 irq_disable(); 1395 } 1396 if (vmx_get_test_stage() >= 2) { 1397 vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE); 1398 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1399 } 1400 return VMX_TEST_RESUME; 1401 default: 1402 printf("Unknown exit reason, %d\n", reason); 1403 print_vmexit_info(); 1404 } 1405 1406 return VMX_TEST_VMEXIT; 1407 } 1408 1409 static int dbgctls_init(struct vmcs *vmcs) 1410 { 1411 u64 dr7 = 0x402; 1412 u64 zero = 0; 1413 1414 msr_bmp_init(); 1415 asm volatile( 1416 "mov %0,%%dr0\n\t" 1417 "mov %0,%%dr1\n\t" 1418 "mov %0,%%dr2\n\t" 1419 "mov %1,%%dr7\n\t" 1420 : : "r" (zero), "r" (dr7)); 1421 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x1); 1422 vmcs_write(GUEST_DR7, 0x404); 1423 vmcs_write(GUEST_DEBUGCTL, 0x2); 1424 1425 vmcs_write(ENT_CONTROLS, vmcs_read(ENT_CONTROLS) | ENT_LOAD_DBGCTLS); 1426 vmcs_write(EXI_CONTROLS, vmcs_read(EXI_CONTROLS) | EXI_SAVE_DBGCTLS); 1427 1428 return VMX_TEST_START; 1429 } 1430 1431 static void dbgctls_main(void) 1432 { 1433 u64 dr7, debugctl; 1434 1435 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1436 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1437 /* Commented out: KVM does not support DEBUGCTL so far */ 1438 report("Load debug controls", dr7 == 0x404 /* && debugctl == 0x2 */); 1439 1440 dr7 = 0x408; 1441 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1442 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x3); 1443 1444 vmx_set_test_stage(0); 1445 vmcall(); 1446 report("Save debug controls", vmx_get_test_stage() == 1); 1447 1448 if (ctrl_enter_rev.set & ENT_LOAD_DBGCTLS || 1449 ctrl_exit_rev.set & EXI_SAVE_DBGCTLS) { 1450 printf("\tDebug controls are always loaded/saved\n"); 1451 return; 1452 } 1453 vmx_set_test_stage(2); 1454 vmcall(); 1455 1456 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1457 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1458 /* Commented out: KVM does not support DEBUGCTL so far */ 1459 report("Guest=host debug controls", dr7 == 0x402 /* && debugctl == 0x1 */); 1460 1461 dr7 = 0x408; 1462 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1463 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x3); 1464 1465 vmx_set_test_stage(3); 1466 vmcall(); 1467 report("Don't save debug controls", vmx_get_test_stage() == 4); 1468 } 1469 1470 static int dbgctls_exit_handler(void) 1471 { 1472 unsigned int reason = vmcs_read(EXI_REASON) & 0xff; 1473 u32 insn_len = vmcs_read(EXI_INST_LEN); 1474 u64 guest_rip = vmcs_read(GUEST_RIP); 1475 u64 dr7, debugctl; 1476 1477 asm volatile("mov %%dr7,%0" : "=r" (dr7)); 1478 debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR); 1479 1480 switch (reason) { 1481 case VMX_VMCALL: 1482 switch (vmx_get_test_stage()) { 1483 case 0: 1484 if (dr7 == 0x400 && debugctl == 0 && 1485 vmcs_read(GUEST_DR7) == 0x408 /* && 1486 Commented out: KVM does not support DEBUGCTL so far 1487 vmcs_read(GUEST_DEBUGCTL) == 0x3 */) 1488 vmx_inc_test_stage(); 1489 break; 1490 case 2: 1491 dr7 = 0x402; 1492 asm volatile("mov %0,%%dr7" : : "r" (dr7)); 1493 wrmsr(MSR_IA32_DEBUGCTLMSR, 0x1); 1494 vmcs_write(GUEST_DR7, 0x404); 1495 vmcs_write(GUEST_DEBUGCTL, 0x2); 1496 1497 vmcs_write(ENT_CONTROLS, 1498 vmcs_read(ENT_CONTROLS) & ~ENT_LOAD_DBGCTLS); 1499 vmcs_write(EXI_CONTROLS, 1500 vmcs_read(EXI_CONTROLS) & ~EXI_SAVE_DBGCTLS); 1501 break; 1502 case 3: 1503 if (dr7 == 0x400 && debugctl == 0 && 1504 vmcs_read(GUEST_DR7) == 0x404 /* && 1505 Commented out: KVM does not support DEBUGCTL so far 1506 vmcs_read(GUEST_DEBUGCTL) == 0x2 */) 1507 vmx_inc_test_stage(); 1508 break; 1509 } 1510 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1511 return VMX_TEST_RESUME; 1512 default: 1513 printf("Unknown exit reason, %d\n", reason); 1514 print_vmexit_info(); 1515 } 1516 return VMX_TEST_VMEXIT; 1517 } 1518 1519 /* name/init/guest_main/exit_handler/syscall_handler/guest_regs */ 1520 struct vmx_test vmx_tests[] = { 1521 { "null", NULL, basic_guest_main, basic_exit_handler, NULL, {0} }, 1522 { "vmenter", NULL, vmenter_main, vmenter_exit_handler, NULL, {0} }, 1523 { "preemption timer", preemption_timer_init, preemption_timer_main, 1524 preemption_timer_exit_handler, NULL, {0} }, 1525 { "control field PAT", test_ctrl_pat_init, test_ctrl_pat_main, 1526 test_ctrl_pat_exit_handler, NULL, {0} }, 1527 { "control field EFER", test_ctrl_efer_init, test_ctrl_efer_main, 1528 test_ctrl_efer_exit_handler, NULL, {0} }, 1529 { "CR shadowing", NULL, cr_shadowing_main, 1530 cr_shadowing_exit_handler, NULL, {0} }, 1531 { "I/O bitmap", iobmp_init, iobmp_main, iobmp_exit_handler, 1532 NULL, {0} }, 1533 { "instruction intercept", insn_intercept_init, insn_intercept_main, 1534 insn_intercept_exit_handler, NULL, {0} }, 1535 { "EPT framework", ept_init, ept_main, ept_exit_handler, NULL, {0} }, 1536 { "interrupt", interrupt_init, interrupt_main, 1537 interrupt_exit_handler, NULL, {0} }, 1538 { "debug controls", dbgctls_init, dbgctls_main, dbgctls_exit_handler, 1539 NULL, {0} }, 1540 { NULL, NULL, NULL, NULL, NULL, {0} }, 1541 }; 1542