1 /* 2 * All test cases of nested virtualization should be in this file 3 * 4 * Author : Arthur Chunqi Li <yzt356@gmail.com> 5 */ 6 #include "vmx.h" 7 #include "msr.h" 8 #include "processor.h" 9 #include "vm.h" 10 #include "io.h" 11 #include "fwcfg.h" 12 13 u64 ia32_pat; 14 u64 ia32_efer; 15 volatile u32 stage; 16 void *io_bitmap_a, *io_bitmap_b; 17 u16 ioport; 18 19 unsigned long *pml4; 20 u64 eptp; 21 void *data_page1, *data_page2; 22 23 static inline void vmcall() 24 { 25 asm volatile("vmcall"); 26 } 27 28 static inline void set_stage(u32 s) 29 { 30 barrier(); 31 stage = s; 32 barrier(); 33 } 34 35 static inline u32 get_stage() 36 { 37 u32 s; 38 39 barrier(); 40 s = stage; 41 barrier(); 42 return s; 43 } 44 45 void basic_guest_main() 46 { 47 /* Here is a basic guest_main, print Hello World */ 48 printf("\tHello World, this is null_guest_main!\n"); 49 } 50 51 int basic_exit_handler() 52 { 53 u64 guest_rip; 54 ulong reason; 55 56 guest_rip = vmcs_read(GUEST_RIP); 57 reason = vmcs_read(EXI_REASON) & 0xff; 58 59 switch (reason) { 60 case VMX_VMCALL: 61 print_vmexit_info(); 62 vmcs_write(GUEST_RIP, guest_rip + 3); 63 return VMX_TEST_RESUME; 64 default: 65 break; 66 } 67 printf("ERROR : Unhandled vmx exit.\n"); 68 print_vmexit_info(); 69 return VMX_TEST_EXIT; 70 } 71 72 void vmenter_main() 73 { 74 u64 rax; 75 u64 rsp, resume_rsp; 76 77 report("test vmlaunch", 1); 78 79 asm volatile( 80 "mov %%rsp, %0\n\t" 81 "mov %3, %%rax\n\t" 82 "vmcall\n\t" 83 "mov %%rax, %1\n\t" 84 "mov %%rsp, %2\n\t" 85 : "=r"(rsp), "=r"(rax), "=r"(resume_rsp) 86 : "g"(0xABCD)); 87 report("test vmresume", (rax == 0xFFFF) && (rsp == resume_rsp)); 88 } 89 90 int vmenter_exit_handler() 91 { 92 u64 guest_rip; 93 ulong reason; 94 95 guest_rip = vmcs_read(GUEST_RIP); 96 reason = vmcs_read(EXI_REASON) & 0xff; 97 switch (reason) { 98 case VMX_VMCALL: 99 if (regs.rax != 0xABCD) { 100 report("test vmresume", 0); 101 return VMX_TEST_VMEXIT; 102 } 103 regs.rax = 0xFFFF; 104 vmcs_write(GUEST_RIP, guest_rip + 3); 105 return VMX_TEST_RESUME; 106 default: 107 report("test vmresume", 0); 108 print_vmexit_info(); 109 } 110 return VMX_TEST_VMEXIT; 111 } 112 113 u32 preempt_scale; 114 volatile unsigned long long tsc_val; 115 volatile u32 preempt_val; 116 117 int preemption_timer_init() 118 { 119 if (!(ctrl_pin_rev.clr & PIN_PREEMPT)) { 120 printf("\tPreemption timer is not supported\n"); 121 return VMX_TEST_EXIT; 122 } 123 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) | PIN_PREEMPT); 124 preempt_val = 10000000; 125 vmcs_write(PREEMPT_TIMER_VALUE, preempt_val); 126 preempt_scale = rdmsr(MSR_IA32_VMX_MISC) & 0x1F; 127 128 if (!(ctrl_exit_rev.clr & EXI_SAVE_PREEMPT)) 129 printf("\tSave preemption value is not supported\n"); 130 131 return VMX_TEST_START; 132 } 133 134 void preemption_timer_main() 135 { 136 tsc_val = rdtsc(); 137 if (ctrl_exit_rev.clr & EXI_SAVE_PREEMPT) { 138 set_stage(0); 139 vmcall(); 140 if (get_stage() == 1) 141 vmcall(); 142 } 143 while (1) { 144 if (((rdtsc() - tsc_val) >> preempt_scale) 145 > 10 * preempt_val) { 146 set_stage(2); 147 vmcall(); 148 } 149 } 150 } 151 152 int preemption_timer_exit_handler() 153 { 154 u64 guest_rip; 155 ulong reason; 156 u32 insn_len; 157 u32 ctrl_exit; 158 159 guest_rip = vmcs_read(GUEST_RIP); 160 reason = vmcs_read(EXI_REASON) & 0xff; 161 insn_len = vmcs_read(EXI_INST_LEN); 162 switch (reason) { 163 case VMX_PREEMPT: 164 if (((rdtsc() - tsc_val) >> preempt_scale) < preempt_val) 165 report("Preemption timer", 0); 166 else 167 report("Preemption timer", 1); 168 break; 169 case VMX_VMCALL: 170 switch (get_stage()) { 171 case 0: 172 if (vmcs_read(PREEMPT_TIMER_VALUE) != preempt_val) 173 report("Save preemption value", 0); 174 else { 175 set_stage(get_stage() + 1); 176 ctrl_exit = (vmcs_read(EXI_CONTROLS) | 177 EXI_SAVE_PREEMPT) & ctrl_exit_rev.clr; 178 vmcs_write(EXI_CONTROLS, ctrl_exit); 179 } 180 vmcs_write(GUEST_RIP, guest_rip + insn_len); 181 return VMX_TEST_RESUME; 182 case 1: 183 if (vmcs_read(PREEMPT_TIMER_VALUE) >= preempt_val) 184 report("Save preemption value", 0); 185 else 186 report("Save preemption value", 1); 187 vmcs_write(GUEST_RIP, guest_rip + insn_len); 188 return VMX_TEST_RESUME; 189 case 2: 190 report("Preemption timer", 0); 191 break; 192 default: 193 // Should not reach here 194 printf("ERROR : unexpected stage, %d\n", get_stage()); 195 print_vmexit_info(); 196 return VMX_TEST_VMEXIT; 197 } 198 break; 199 default: 200 printf("Unknown exit reason, %d\n", reason); 201 print_vmexit_info(); 202 } 203 vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT); 204 return VMX_TEST_VMEXIT; 205 } 206 207 void msr_bmp_init() 208 { 209 void *msr_bitmap; 210 u32 ctrl_cpu0; 211 212 msr_bitmap = alloc_page(); 213 memset(msr_bitmap, 0x0, PAGE_SIZE); 214 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 215 ctrl_cpu0 |= CPU_MSR_BITMAP; 216 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 217 vmcs_write(MSR_BITMAP, (u64)msr_bitmap); 218 } 219 220 static int test_ctrl_pat_init() 221 { 222 u64 ctrl_ent; 223 u64 ctrl_exi; 224 225 msr_bmp_init(); 226 ctrl_ent = vmcs_read(ENT_CONTROLS); 227 ctrl_exi = vmcs_read(EXI_CONTROLS); 228 vmcs_write(ENT_CONTROLS, ctrl_ent | ENT_LOAD_PAT); 229 vmcs_write(EXI_CONTROLS, ctrl_exi | (EXI_SAVE_PAT | EXI_LOAD_PAT)); 230 ia32_pat = rdmsr(MSR_IA32_CR_PAT); 231 vmcs_write(GUEST_PAT, 0x0); 232 vmcs_write(HOST_PAT, ia32_pat); 233 return VMX_TEST_START; 234 } 235 236 static void test_ctrl_pat_main() 237 { 238 u64 guest_ia32_pat; 239 240 guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT); 241 if (!(ctrl_enter_rev.clr & ENT_LOAD_PAT)) 242 printf("\tENT_LOAD_PAT is not supported.\n"); 243 else { 244 if (guest_ia32_pat != 0) { 245 report("Entry load PAT", 0); 246 return; 247 } 248 } 249 wrmsr(MSR_IA32_CR_PAT, 0x6); 250 vmcall(); 251 guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT); 252 if (ctrl_enter_rev.clr & ENT_LOAD_PAT) { 253 if (guest_ia32_pat != ia32_pat) { 254 report("Entry load PAT", 0); 255 return; 256 } 257 report("Entry load PAT", 1); 258 } 259 } 260 261 static int test_ctrl_pat_exit_handler() 262 { 263 u64 guest_rip; 264 ulong reason; 265 u64 guest_pat; 266 267 guest_rip = vmcs_read(GUEST_RIP); 268 reason = vmcs_read(EXI_REASON) & 0xff; 269 switch (reason) { 270 case VMX_VMCALL: 271 guest_pat = vmcs_read(GUEST_PAT); 272 if (!(ctrl_exit_rev.clr & EXI_SAVE_PAT)) { 273 printf("\tEXI_SAVE_PAT is not supported\n"); 274 vmcs_write(GUEST_PAT, 0x6); 275 } else { 276 if (guest_pat == 0x6) 277 report("Exit save PAT", 1); 278 else 279 report("Exit save PAT", 0); 280 } 281 if (!(ctrl_exit_rev.clr & EXI_LOAD_PAT)) 282 printf("\tEXI_LOAD_PAT is not supported\n"); 283 else { 284 if (rdmsr(MSR_IA32_CR_PAT) == ia32_pat) 285 report("Exit load PAT", 1); 286 else 287 report("Exit load PAT", 0); 288 } 289 vmcs_write(GUEST_PAT, ia32_pat); 290 vmcs_write(GUEST_RIP, guest_rip + 3); 291 return VMX_TEST_RESUME; 292 default: 293 printf("ERROR : Undefined exit reason, reason = %d.\n", reason); 294 break; 295 } 296 return VMX_TEST_VMEXIT; 297 } 298 299 static int test_ctrl_efer_init() 300 { 301 u64 ctrl_ent; 302 u64 ctrl_exi; 303 304 msr_bmp_init(); 305 ctrl_ent = vmcs_read(ENT_CONTROLS) | ENT_LOAD_EFER; 306 ctrl_exi = vmcs_read(EXI_CONTROLS) | EXI_SAVE_EFER | EXI_LOAD_EFER; 307 vmcs_write(ENT_CONTROLS, ctrl_ent & ctrl_enter_rev.clr); 308 vmcs_write(EXI_CONTROLS, ctrl_exi & ctrl_exit_rev.clr); 309 ia32_efer = rdmsr(MSR_EFER); 310 vmcs_write(GUEST_EFER, ia32_efer ^ EFER_NX); 311 vmcs_write(HOST_EFER, ia32_efer ^ EFER_NX); 312 return VMX_TEST_START; 313 } 314 315 static void test_ctrl_efer_main() 316 { 317 u64 guest_ia32_efer; 318 319 guest_ia32_efer = rdmsr(MSR_EFER); 320 if (!(ctrl_enter_rev.clr & ENT_LOAD_EFER)) 321 printf("\tENT_LOAD_EFER is not supported.\n"); 322 else { 323 if (guest_ia32_efer != (ia32_efer ^ EFER_NX)) { 324 report("Entry load EFER", 0); 325 return; 326 } 327 } 328 wrmsr(MSR_EFER, ia32_efer); 329 vmcall(); 330 guest_ia32_efer = rdmsr(MSR_EFER); 331 if (ctrl_enter_rev.clr & ENT_LOAD_EFER) { 332 if (guest_ia32_efer != ia32_efer) { 333 report("Entry load EFER", 0); 334 return; 335 } 336 report("Entry load EFER", 1); 337 } 338 } 339 340 static int test_ctrl_efer_exit_handler() 341 { 342 u64 guest_rip; 343 ulong reason; 344 u64 guest_efer; 345 346 guest_rip = vmcs_read(GUEST_RIP); 347 reason = vmcs_read(EXI_REASON) & 0xff; 348 switch (reason) { 349 case VMX_VMCALL: 350 guest_efer = vmcs_read(GUEST_EFER); 351 if (!(ctrl_exit_rev.clr & EXI_SAVE_EFER)) { 352 printf("\tEXI_SAVE_EFER is not supported\n"); 353 vmcs_write(GUEST_EFER, ia32_efer); 354 } else { 355 if (guest_efer == ia32_efer) 356 report("Exit save EFER", 1); 357 else 358 report("Exit save EFER", 0); 359 } 360 if (!(ctrl_exit_rev.clr & EXI_LOAD_EFER)) { 361 printf("\tEXI_LOAD_EFER is not supported\n"); 362 wrmsr(MSR_EFER, ia32_efer ^ EFER_NX); 363 } else { 364 if (rdmsr(MSR_EFER) == (ia32_efer ^ EFER_NX)) 365 report("Exit load EFER", 1); 366 else 367 report("Exit load EFER", 0); 368 } 369 vmcs_write(GUEST_PAT, ia32_efer); 370 vmcs_write(GUEST_RIP, guest_rip + 3); 371 return VMX_TEST_RESUME; 372 default: 373 printf("ERROR : Undefined exit reason, reason = %d.\n", reason); 374 break; 375 } 376 return VMX_TEST_VMEXIT; 377 } 378 379 u32 guest_cr0, guest_cr4; 380 381 static void cr_shadowing_main() 382 { 383 u32 cr0, cr4, tmp; 384 385 // Test read through 386 set_stage(0); 387 guest_cr0 = read_cr0(); 388 if (stage == 1) 389 report("Read through CR0", 0); 390 else 391 vmcall(); 392 set_stage(1); 393 guest_cr4 = read_cr4(); 394 if (stage == 2) 395 report("Read through CR4", 0); 396 else 397 vmcall(); 398 // Test write through 399 guest_cr0 = guest_cr0 ^ (X86_CR0_TS | X86_CR0_MP); 400 guest_cr4 = guest_cr4 ^ (X86_CR4_TSD | X86_CR4_DE); 401 set_stage(2); 402 write_cr0(guest_cr0); 403 if (stage == 3) 404 report("Write throuth CR0", 0); 405 else 406 vmcall(); 407 set_stage(3); 408 write_cr4(guest_cr4); 409 if (stage == 4) 410 report("Write through CR4", 0); 411 else 412 vmcall(); 413 // Test read shadow 414 set_stage(4); 415 vmcall(); 416 cr0 = read_cr0(); 417 if (stage != 5) { 418 if (cr0 == guest_cr0) 419 report("Read shadowing CR0", 1); 420 else 421 report("Read shadowing CR0", 0); 422 } 423 set_stage(5); 424 cr4 = read_cr4(); 425 if (stage != 6) { 426 if (cr4 == guest_cr4) 427 report("Read shadowing CR4", 1); 428 else 429 report("Read shadowing CR4", 0); 430 } 431 // Test write shadow (same value with shadow) 432 set_stage(6); 433 write_cr0(guest_cr0); 434 if (stage == 7) 435 report("Write shadowing CR0 (same value with shadow)", 0); 436 else 437 vmcall(); 438 set_stage(7); 439 write_cr4(guest_cr4); 440 if (stage == 8) 441 report("Write shadowing CR4 (same value with shadow)", 0); 442 else 443 vmcall(); 444 // Test write shadow (different value) 445 set_stage(8); 446 tmp = guest_cr0 ^ X86_CR0_TS; 447 asm volatile("mov %0, %%rsi\n\t" 448 "mov %%rsi, %%cr0\n\t" 449 ::"m"(tmp) 450 :"rsi", "memory", "cc"); 451 if (stage != 9) 452 report("Write shadowing different X86_CR0_TS", 0); 453 else 454 report("Write shadowing different X86_CR0_TS", 1); 455 set_stage(9); 456 tmp = guest_cr0 ^ X86_CR0_MP; 457 asm volatile("mov %0, %%rsi\n\t" 458 "mov %%rsi, %%cr0\n\t" 459 ::"m"(tmp) 460 :"rsi", "memory", "cc"); 461 if (stage != 10) 462 report("Write shadowing different X86_CR0_MP", 0); 463 else 464 report("Write shadowing different X86_CR0_MP", 1); 465 set_stage(10); 466 tmp = guest_cr4 ^ X86_CR4_TSD; 467 asm volatile("mov %0, %%rsi\n\t" 468 "mov %%rsi, %%cr4\n\t" 469 ::"m"(tmp) 470 :"rsi", "memory", "cc"); 471 if (stage != 11) 472 report("Write shadowing different X86_CR4_TSD", 0); 473 else 474 report("Write shadowing different X86_CR4_TSD", 1); 475 set_stage(11); 476 tmp = guest_cr4 ^ X86_CR4_DE; 477 asm volatile("mov %0, %%rsi\n\t" 478 "mov %%rsi, %%cr4\n\t" 479 ::"m"(tmp) 480 :"rsi", "memory", "cc"); 481 if (stage != 12) 482 report("Write shadowing different X86_CR4_DE", 0); 483 else 484 report("Write shadowing different X86_CR4_DE", 1); 485 } 486 487 static int cr_shadowing_exit_handler() 488 { 489 u64 guest_rip; 490 ulong reason; 491 u32 insn_len; 492 u32 exit_qual; 493 494 guest_rip = vmcs_read(GUEST_RIP); 495 reason = vmcs_read(EXI_REASON) & 0xff; 496 insn_len = vmcs_read(EXI_INST_LEN); 497 exit_qual = vmcs_read(EXI_QUALIFICATION); 498 switch (reason) { 499 case VMX_VMCALL: 500 switch (get_stage()) { 501 case 0: 502 if (guest_cr0 == vmcs_read(GUEST_CR0)) 503 report("Read through CR0", 1); 504 else 505 report("Read through CR0", 0); 506 break; 507 case 1: 508 if (guest_cr4 == vmcs_read(GUEST_CR4)) 509 report("Read through CR4", 1); 510 else 511 report("Read through CR4", 0); 512 break; 513 case 2: 514 if (guest_cr0 == vmcs_read(GUEST_CR0)) 515 report("Write through CR0", 1); 516 else 517 report("Write through CR0", 0); 518 break; 519 case 3: 520 if (guest_cr4 == vmcs_read(GUEST_CR4)) 521 report("Write through CR4", 1); 522 else 523 report("Write through CR4", 0); 524 break; 525 case 4: 526 guest_cr0 = vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP); 527 guest_cr4 = vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE); 528 vmcs_write(CR0_MASK, X86_CR0_TS | X86_CR0_MP); 529 vmcs_write(CR0_READ_SHADOW, guest_cr0 & (X86_CR0_TS | X86_CR0_MP)); 530 vmcs_write(CR4_MASK, X86_CR4_TSD | X86_CR4_DE); 531 vmcs_write(CR4_READ_SHADOW, guest_cr4 & (X86_CR4_TSD | X86_CR4_DE)); 532 break; 533 case 6: 534 if (guest_cr0 == (vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP))) 535 report("Write shadowing CR0 (same value)", 1); 536 else 537 report("Write shadowing CR0 (same value)", 0); 538 break; 539 case 7: 540 if (guest_cr4 == (vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE))) 541 report("Write shadowing CR4 (same value)", 1); 542 else 543 report("Write shadowing CR4 (same value)", 0); 544 break; 545 default: 546 // Should not reach here 547 printf("ERROR : unexpected stage, %d\n", get_stage()); 548 print_vmexit_info(); 549 return VMX_TEST_VMEXIT; 550 } 551 vmcs_write(GUEST_RIP, guest_rip + insn_len); 552 return VMX_TEST_RESUME; 553 case VMX_CR: 554 switch (get_stage()) { 555 case 4: 556 report("Read shadowing CR0", 0); 557 set_stage(stage + 1); 558 break; 559 case 5: 560 report("Read shadowing CR4", 0); 561 set_stage(stage + 1); 562 break; 563 case 6: 564 report("Write shadowing CR0 (same value)", 0); 565 set_stage(stage + 1); 566 break; 567 case 7: 568 report("Write shadowing CR4 (same value)", 0); 569 set_stage(stage + 1); 570 break; 571 case 8: 572 case 9: 573 // 0x600 encodes "mov %esi, %cr0" 574 if (exit_qual == 0x600) 575 set_stage(stage + 1); 576 break; 577 case 10: 578 case 11: 579 // 0x604 encodes "mov %esi, %cr4" 580 if (exit_qual == 0x604) 581 set_stage(stage + 1); 582 break; 583 default: 584 // Should not reach here 585 printf("ERROR : unexpected stage, %d\n", get_stage()); 586 print_vmexit_info(); 587 return VMX_TEST_VMEXIT; 588 } 589 vmcs_write(GUEST_RIP, guest_rip + insn_len); 590 return VMX_TEST_RESUME; 591 default: 592 printf("Unknown exit reason, %d\n", reason); 593 print_vmexit_info(); 594 } 595 return VMX_TEST_VMEXIT; 596 } 597 598 static int iobmp_init() 599 { 600 u32 ctrl_cpu0; 601 602 io_bitmap_a = alloc_page(); 603 io_bitmap_a = alloc_page(); 604 memset(io_bitmap_a, 0x0, PAGE_SIZE); 605 memset(io_bitmap_b, 0x0, PAGE_SIZE); 606 ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0); 607 ctrl_cpu0 |= CPU_IO_BITMAP; 608 ctrl_cpu0 &= (~CPU_IO); 609 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0); 610 vmcs_write(IO_BITMAP_A, (u64)io_bitmap_a); 611 vmcs_write(IO_BITMAP_B, (u64)io_bitmap_b); 612 return VMX_TEST_START; 613 } 614 615 static void iobmp_main() 616 { 617 // stage 0, test IO pass 618 set_stage(0); 619 inb(0x5000); 620 outb(0x0, 0x5000); 621 if (stage != 0) 622 report("I/O bitmap - I/O pass", 0); 623 else 624 report("I/O bitmap - I/O pass", 1); 625 // test IO width, in/out 626 ((u8 *)io_bitmap_a)[0] = 0xFF; 627 set_stage(2); 628 inb(0x0); 629 if (stage != 3) 630 report("I/O bitmap - trap in", 0); 631 else 632 report("I/O bitmap - trap in", 1); 633 set_stage(3); 634 outw(0x0, 0x0); 635 if (stage != 4) 636 report("I/O bitmap - trap out", 0); 637 else 638 report("I/O bitmap - trap out", 1); 639 set_stage(4); 640 inl(0x0); 641 if (stage != 5) 642 report("I/O bitmap - I/O width, long", 0); 643 // test low/high IO port 644 set_stage(5); 645 ((u8 *)io_bitmap_a)[0x5000 / 8] = (1 << (0x5000 % 8)); 646 inb(0x5000); 647 if (stage == 6) 648 report("I/O bitmap - I/O port, low part", 1); 649 else 650 report("I/O bitmap - I/O port, low part", 0); 651 set_stage(6); 652 ((u8 *)io_bitmap_b)[0x1000 / 8] = (1 << (0x1000 % 8)); 653 inb(0x9000); 654 if (stage == 7) 655 report("I/O bitmap - I/O port, high part", 1); 656 else 657 report("I/O bitmap - I/O port, high part", 0); 658 // test partial pass 659 set_stage(7); 660 inl(0x4FFF); 661 if (stage == 8) 662 report("I/O bitmap - partial pass", 1); 663 else 664 report("I/O bitmap - partial pass", 0); 665 // test overrun 666 set_stage(8); 667 memset(io_bitmap_a, 0x0, PAGE_SIZE); 668 memset(io_bitmap_b, 0x0, PAGE_SIZE); 669 inl(0xFFFF); 670 if (stage == 9) 671 report("I/O bitmap - overrun", 1); 672 else 673 report("I/O bitmap - overrun", 0); 674 } 675 676 static int iobmp_exit_handler() 677 { 678 u64 guest_rip; 679 ulong reason, exit_qual; 680 u32 insn_len; 681 682 guest_rip = vmcs_read(GUEST_RIP); 683 reason = vmcs_read(EXI_REASON) & 0xff; 684 exit_qual = vmcs_read(EXI_QUALIFICATION); 685 insn_len = vmcs_read(EXI_INST_LEN); 686 switch (reason) { 687 case VMX_IO: 688 switch (get_stage()) { 689 case 0: 690 case 1: 691 set_stage(stage + 1); 692 break; 693 case 2: 694 if ((exit_qual & VMX_IO_SIZE_MASK) != _VMX_IO_BYTE) 695 report("I/O bitmap - I/O width, byte", 0); 696 else 697 report("I/O bitmap - I/O width, byte", 1); 698 if (!(exit_qual & VMX_IO_IN)) 699 report("I/O bitmap - I/O direction, in", 0); 700 else 701 report("I/O bitmap - I/O direction, in", 1); 702 set_stage(stage + 1); 703 break; 704 case 3: 705 if ((exit_qual & VMX_IO_SIZE_MASK) != _VMX_IO_WORD) 706 report("I/O bitmap - I/O width, word", 0); 707 else 708 report("I/O bitmap - I/O width, word", 1); 709 if (!(exit_qual & VMX_IO_IN)) 710 report("I/O bitmap - I/O direction, out", 1); 711 else 712 report("I/O bitmap - I/O direction, out", 0); 713 set_stage(stage + 1); 714 break; 715 case 4: 716 if ((exit_qual & VMX_IO_SIZE_MASK) != _VMX_IO_LONG) 717 report("I/O bitmap - I/O width, long", 0); 718 else 719 report("I/O bitmap - I/O width, long", 1); 720 set_stage(stage + 1); 721 break; 722 case 5: 723 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x5000) 724 set_stage(stage + 1); 725 break; 726 case 6: 727 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x9000) 728 set_stage(stage + 1); 729 break; 730 case 7: 731 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x4FFF) 732 set_stage(stage + 1); 733 break; 734 case 8: 735 if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0xFFFF) 736 set_stage(stage + 1); 737 break; 738 default: 739 // Should not reach here 740 printf("ERROR : unexpected stage, %d\n", get_stage()); 741 print_vmexit_info(); 742 return VMX_TEST_VMEXIT; 743 } 744 vmcs_write(GUEST_RIP, guest_rip + insn_len); 745 return VMX_TEST_RESUME; 746 default: 747 printf("guest_rip = 0x%llx\n", guest_rip); 748 printf("\tERROR : Undefined exit reason, reason = %d.\n", reason); 749 break; 750 } 751 return VMX_TEST_VMEXIT; 752 } 753 754 #define INSN_CPU0 0 755 #define INSN_CPU1 1 756 #define INSN_ALWAYS_TRAP 2 757 #define INSN_NEVER_TRAP 3 758 759 #define FIELD_EXIT_QUAL 0 760 #define FIELD_INSN_INFO 1 761 762 asm( 763 "insn_hlt: hlt;ret\n\t" 764 "insn_invlpg: invlpg 0x12345678;ret\n\t" 765 "insn_mwait: mwait;ret\n\t" 766 "insn_rdpmc: rdpmc;ret\n\t" 767 "insn_rdtsc: rdtsc;ret\n\t" 768 "insn_monitor: monitor;ret\n\t" 769 "insn_pause: pause;ret\n\t" 770 "insn_wbinvd: wbinvd;ret\n\t" 771 "insn_cpuid: cpuid;ret\n\t" 772 "insn_invd: invd;ret\n\t" 773 ); 774 extern void insn_hlt(); 775 extern void insn_invlpg(); 776 extern void insn_mwait(); 777 extern void insn_rdpmc(); 778 extern void insn_rdtsc(); 779 extern void insn_monitor(); 780 extern void insn_pause(); 781 extern void insn_wbinvd(); 782 extern void insn_cpuid(); 783 extern void insn_invd(); 784 785 u32 cur_insn; 786 787 struct insn_table { 788 const char *name; 789 u32 flag; 790 void (*insn_func)(); 791 u32 type; 792 u32 reason; 793 ulong exit_qual; 794 u32 insn_info; 795 // Use FIELD_EXIT_QUAL and FIELD_INSN_INFO to efines 796 // which field need to be tested, reason is always tested 797 u32 test_field; 798 }; 799 800 /* 801 * Add more test cases of instruction intercept here. Elements in this 802 * table is: 803 * name/control flag/insn function/type/exit reason/exit qulification/ 804 * instruction info/field to test 805 * The last field defines which fields (exit_qual and insn_info) need to be 806 * tested in exit handler. If set to 0, only "reason" is checked. 807 */ 808 static struct insn_table insn_table[] = { 809 // Flags for Primary Processor-Based VM-Execution Controls 810 {"HLT", CPU_HLT, insn_hlt, INSN_CPU0, 12, 0, 0, 0}, 811 {"INVLPG", CPU_INVLPG, insn_invlpg, INSN_CPU0, 14, 812 0x12345678, 0, FIELD_EXIT_QUAL}, 813 {"MWAIT", CPU_MWAIT, insn_mwait, INSN_CPU0, 36, 0, 0, 0}, 814 {"RDPMC", CPU_RDPMC, insn_rdpmc, INSN_CPU0, 15, 0, 0, 0}, 815 {"RDTSC", CPU_RDTSC, insn_rdtsc, INSN_CPU0, 16, 0, 0, 0}, 816 {"MONITOR", CPU_MONITOR, insn_monitor, INSN_CPU0, 39, 0, 0, 0}, 817 {"PAUSE", CPU_PAUSE, insn_pause, INSN_CPU0, 40, 0, 0, 0}, 818 // Flags for Secondary Processor-Based VM-Execution Controls 819 {"WBINVD", CPU_WBINVD, insn_wbinvd, INSN_CPU1, 54, 0, 0, 0}, 820 // Instructions always trap 821 {"CPUID", 0, insn_cpuid, INSN_ALWAYS_TRAP, 10, 0, 0, 0}, 822 {"INVD", 0, insn_invd, INSN_ALWAYS_TRAP, 13, 0, 0, 0}, 823 // Instructions never trap 824 {NULL}, 825 }; 826 827 static int insn_intercept_init() 828 { 829 u32 ctrl_cpu[2]; 830 831 ctrl_cpu[0] = vmcs_read(CPU_EXEC_CTRL0); 832 ctrl_cpu[0] |= CPU_HLT | CPU_INVLPG | CPU_MWAIT | CPU_RDPMC | CPU_RDTSC | 833 CPU_MONITOR | CPU_PAUSE | CPU_SECONDARY; 834 ctrl_cpu[0] &= ctrl_cpu_rev[0].clr; 835 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu[0]); 836 ctrl_cpu[1] = vmcs_read(CPU_EXEC_CTRL1); 837 ctrl_cpu[1] |= CPU_WBINVD | CPU_RDRAND; 838 ctrl_cpu[1] &= ctrl_cpu_rev[1].clr; 839 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu[1]); 840 return VMX_TEST_START; 841 } 842 843 static void insn_intercept_main() 844 { 845 cur_insn = 0; 846 while(insn_table[cur_insn].name != NULL) { 847 set_stage(cur_insn); 848 if ((insn_table[cur_insn].type == INSN_CPU0 849 && !(ctrl_cpu_rev[0].clr & insn_table[cur_insn].flag)) 850 || (insn_table[cur_insn].type == INSN_CPU1 851 && !(ctrl_cpu_rev[1].clr & insn_table[cur_insn].flag))) { 852 printf("\tCPU_CTRL1.CPU_%s is not supported.\n", 853 insn_table[cur_insn].name); 854 continue; 855 } 856 insn_table[cur_insn].insn_func(); 857 switch (insn_table[cur_insn].type) { 858 case INSN_CPU0: 859 case INSN_CPU1: 860 case INSN_ALWAYS_TRAP: 861 if (stage != cur_insn + 1) 862 report(insn_table[cur_insn].name, 0); 863 else 864 report(insn_table[cur_insn].name, 1); 865 break; 866 case INSN_NEVER_TRAP: 867 if (stage == cur_insn + 1) 868 report(insn_table[cur_insn].name, 0); 869 else 870 report(insn_table[cur_insn].name, 1); 871 break; 872 } 873 cur_insn ++; 874 } 875 } 876 877 static int insn_intercept_exit_handler() 878 { 879 u64 guest_rip; 880 u32 reason; 881 ulong exit_qual; 882 u32 insn_len; 883 u32 insn_info; 884 bool pass; 885 886 guest_rip = vmcs_read(GUEST_RIP); 887 reason = vmcs_read(EXI_REASON) & 0xff; 888 exit_qual = vmcs_read(EXI_QUALIFICATION); 889 insn_len = vmcs_read(EXI_INST_LEN); 890 insn_info = vmcs_read(EXI_INST_INFO); 891 pass = (cur_insn == get_stage()) && 892 insn_table[cur_insn].reason == reason; 893 if (insn_table[cur_insn].test_field & FIELD_EXIT_QUAL) 894 pass = pass && insn_table[cur_insn].exit_qual == exit_qual; 895 if (insn_table[cur_insn].test_field & FIELD_INSN_INFO) 896 pass = pass && insn_table[cur_insn].insn_info == insn_info; 897 if (pass) 898 set_stage(stage + 1); 899 vmcs_write(GUEST_RIP, guest_rip + insn_len); 900 return VMX_TEST_RESUME; 901 } 902 903 904 static int setup_ept() 905 { 906 int support_2m; 907 unsigned long end_of_memory; 908 909 if (!(ept_vpid.val & EPT_CAP_UC) && 910 !(ept_vpid.val & EPT_CAP_WB)) { 911 printf("\tEPT paging-structure memory type " 912 "UC&WB are not supported\n"); 913 return 1; 914 } 915 if (ept_vpid.val & EPT_CAP_UC) 916 eptp = EPT_MEM_TYPE_UC; 917 else 918 eptp = EPT_MEM_TYPE_WB; 919 if (!(ept_vpid.val & EPT_CAP_PWL4)) { 920 printf("\tPWL4 is not supported\n"); 921 return 1; 922 } 923 eptp |= (3 << EPTP_PG_WALK_LEN_SHIFT); 924 pml4 = alloc_page(); 925 memset(pml4, 0, PAGE_SIZE); 926 eptp |= virt_to_phys(pml4); 927 vmcs_write(EPTP, eptp); 928 support_2m = !!(ept_vpid.val & EPT_CAP_2M_PAGE); 929 end_of_memory = fwcfg_get_u64(FW_CFG_RAM_SIZE); 930 if (end_of_memory < (1ul << 32)) 931 end_of_memory = (1ul << 32); 932 setup_ept_range(pml4, 0, end_of_memory, 0, support_2m, 933 EPT_WA | EPT_RA | EPT_EA); 934 return 0; 935 } 936 937 static int ept_init() 938 { 939 unsigned long base_addr1, base_addr2; 940 u32 ctrl_cpu[2]; 941 942 if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) || 943 !(ctrl_cpu_rev[1].clr & CPU_EPT)) { 944 printf("\tEPT is not supported"); 945 return VMX_TEST_EXIT; 946 } 947 948 ctrl_cpu[0] = vmcs_read(CPU_EXEC_CTRL0); 949 ctrl_cpu[1] = vmcs_read(CPU_EXEC_CTRL1); 950 ctrl_cpu[0] = (ctrl_cpu[0] | CPU_SECONDARY) 951 & ctrl_cpu_rev[0].clr; 952 ctrl_cpu[1] = (ctrl_cpu[1] | CPU_EPT) 953 & ctrl_cpu_rev[1].clr; 954 vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu[0]); 955 vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu[1]); 956 if (setup_ept()) 957 return VMX_TEST_EXIT; 958 data_page1 = alloc_page(); 959 data_page2 = alloc_page(); 960 memset(data_page1, 0x0, PAGE_SIZE); 961 memset(data_page2, 0x0, PAGE_SIZE); 962 *((u32 *)data_page1) = MAGIC_VAL_1; 963 *((u32 *)data_page2) = MAGIC_VAL_2; 964 base_addr1 = (unsigned long)data_page1 & PAGE_MASK_2M; 965 base_addr2 = (unsigned long)data_page2 & PAGE_MASK_2M; 966 setup_ept_range(pml4, base_addr1, base_addr1 + PAGE_SIZE_2M, 0, 0, 967 EPT_WA | EPT_RA | EPT_EA); 968 setup_ept_range(pml4, base_addr2, base_addr2 + PAGE_SIZE_2M, 0, 0, 969 EPT_WA | EPT_RA | EPT_EA); 970 install_ept(pml4, (unsigned long)data_page1, (unsigned long)data_page2, 971 EPT_RA | EPT_WA | EPT_EA); 972 return VMX_TEST_START; 973 } 974 975 static void ept_main() 976 { 977 set_stage(0); 978 if (*((u32 *)data_page2) != MAGIC_VAL_1 || 979 *((u32 *)data_page1) != MAGIC_VAL_1) 980 report("EPT basic framework - read", 0); 981 else { 982 *((u32 *)data_page2) = MAGIC_VAL_3; 983 vmcall(); 984 if (get_stage() == 1) { 985 if (*((u32 *)data_page1) == MAGIC_VAL_3 && 986 *((u32 *)data_page2) == MAGIC_VAL_2) 987 report("EPT basic framework", 1); 988 else 989 report("EPT basic framework - remap", 1); 990 } 991 } 992 // Test EPT Misconfigurations 993 set_stage(1); 994 vmcall(); 995 *((u32 *)data_page1) = MAGIC_VAL_1; 996 if (get_stage() != 2) { 997 report("EPT misconfigurations", 0); 998 goto t1; 999 } 1000 set_stage(2); 1001 vmcall(); 1002 *((u32 *)data_page1) = MAGIC_VAL_1; 1003 if (get_stage() != 3) { 1004 report("EPT misconfigurations", 0); 1005 goto t1; 1006 } 1007 report("EPT misconfigurations", 1); 1008 t1: 1009 // Test EPT violation 1010 set_stage(3); 1011 vmcall(); 1012 *((u32 *)data_page1) = MAGIC_VAL_1; 1013 if (get_stage() == 4) 1014 report("EPT violation - page permission", 1); 1015 else 1016 report("EPT violation - page permission", 0); 1017 // Violation caused by EPT paging structure 1018 set_stage(4); 1019 vmcall(); 1020 *((u32 *)data_page1) = MAGIC_VAL_2; 1021 if (get_stage() == 5) 1022 report("EPT violation - paging structure", 1); 1023 else 1024 report("EPT violation - paging structure", 0); 1025 } 1026 1027 static int ept_exit_handler() 1028 { 1029 u64 guest_rip; 1030 ulong reason; 1031 u32 insn_len; 1032 u32 exit_qual; 1033 static unsigned long data_page1_pte, data_page1_pte_pte; 1034 1035 guest_rip = vmcs_read(GUEST_RIP); 1036 reason = vmcs_read(EXI_REASON) & 0xff; 1037 insn_len = vmcs_read(EXI_INST_LEN); 1038 exit_qual = vmcs_read(EXI_QUALIFICATION); 1039 switch (reason) { 1040 case VMX_VMCALL: 1041 switch (get_stage()) { 1042 case 0: 1043 if (*((u32 *)data_page1) == MAGIC_VAL_3 && 1044 *((u32 *)data_page2) == MAGIC_VAL_2) { 1045 set_stage(get_stage() + 1); 1046 install_ept(pml4, (unsigned long)data_page2, 1047 (unsigned long)data_page2, 1048 EPT_RA | EPT_WA | EPT_EA); 1049 } else 1050 report("EPT basic framework - write\n", 0); 1051 break; 1052 case 1: 1053 install_ept(pml4, (unsigned long)data_page1, 1054 (unsigned long)data_page1, EPT_WA); 1055 invept(INVEPT_SINGLE, eptp); 1056 break; 1057 case 2: 1058 install_ept(pml4, (unsigned long)data_page1, 1059 (unsigned long)data_page1, 1060 EPT_RA | EPT_WA | EPT_EA | 1061 (2 << EPT_MEM_TYPE_SHIFT)); 1062 invept(INVEPT_SINGLE, eptp); 1063 break; 1064 case 3: 1065 data_page1_pte = get_ept_pte(pml4, 1066 (unsigned long)data_page1, 1); 1067 set_ept_pte(pml4, (unsigned long)data_page1, 1068 1, data_page1_pte & (~EPT_PRESENT)); 1069 invept(INVEPT_SINGLE, eptp); 1070 break; 1071 case 4: 1072 data_page1_pte = get_ept_pte(pml4, 1073 (unsigned long)data_page1, 2); 1074 data_page1_pte &= PAGE_MASK; 1075 data_page1_pte_pte = get_ept_pte(pml4, data_page1_pte, 2); 1076 set_ept_pte(pml4, data_page1_pte, 2, 1077 data_page1_pte_pte & (~EPT_PRESENT)); 1078 invept(INVEPT_SINGLE, eptp); 1079 break; 1080 // Should not reach here 1081 default: 1082 printf("ERROR - unexpected stage, %d.\n", get_stage()); 1083 print_vmexit_info(); 1084 return VMX_TEST_VMEXIT; 1085 } 1086 vmcs_write(GUEST_RIP, guest_rip + insn_len); 1087 return VMX_TEST_RESUME; 1088 case VMX_EPT_MISCONFIG: 1089 switch (get_stage()) { 1090 case 1: 1091 case 2: 1092 set_stage(get_stage() + 1); 1093 install_ept(pml4, (unsigned long)data_page1, 1094 (unsigned long)data_page1, 1095 EPT_RA | EPT_WA | EPT_EA); 1096 invept(INVEPT_SINGLE, eptp); 1097 break; 1098 // Should not reach here 1099 default: 1100 printf("ERROR - unexpected stage, %d.\n", get_stage()); 1101 print_vmexit_info(); 1102 return VMX_TEST_VMEXIT; 1103 } 1104 return VMX_TEST_RESUME; 1105 case VMX_EPT_VIOLATION: 1106 switch(get_stage()) { 1107 case 3: 1108 if (exit_qual == (EPT_VLT_WR | EPT_VLT_LADDR_VLD | 1109 EPT_VLT_PADDR)) 1110 set_stage(get_stage() + 1); 1111 set_ept_pte(pml4, (unsigned long)data_page1, 1112 1, data_page1_pte | (EPT_PRESENT)); 1113 invept(INVEPT_SINGLE, eptp); 1114 break; 1115 case 4: 1116 if (exit_qual == (EPT_VLT_RD | EPT_VLT_LADDR_VLD)) 1117 set_stage(get_stage() + 1); 1118 set_ept_pte(pml4, data_page1_pte, 2, 1119 data_page1_pte_pte | (EPT_PRESENT)); 1120 invept(INVEPT_SINGLE, eptp); 1121 break; 1122 default: 1123 // Should not reach here 1124 printf("ERROR : unexpected stage, %d\n", get_stage()); 1125 print_vmexit_info(); 1126 return VMX_TEST_VMEXIT; 1127 } 1128 return VMX_TEST_RESUME; 1129 default: 1130 printf("Unknown exit reason, %d\n", reason); 1131 print_vmexit_info(); 1132 } 1133 return VMX_TEST_VMEXIT; 1134 } 1135 1136 /* name/init/guest_main/exit_handler/syscall_handler/guest_regs */ 1137 struct vmx_test vmx_tests[] = { 1138 { "null", NULL, basic_guest_main, basic_exit_handler, NULL, {0} }, 1139 { "vmenter", NULL, vmenter_main, vmenter_exit_handler, NULL, {0} }, 1140 { "preemption timer", preemption_timer_init, preemption_timer_main, 1141 preemption_timer_exit_handler, NULL, {0} }, 1142 { "control field PAT", test_ctrl_pat_init, test_ctrl_pat_main, 1143 test_ctrl_pat_exit_handler, NULL, {0} }, 1144 { "control field EFER", test_ctrl_efer_init, test_ctrl_efer_main, 1145 test_ctrl_efer_exit_handler, NULL, {0} }, 1146 { "CR shadowing", NULL, cr_shadowing_main, 1147 cr_shadowing_exit_handler, NULL, {0} }, 1148 { "I/O bitmap", iobmp_init, iobmp_main, iobmp_exit_handler, 1149 NULL, {0} }, 1150 { "instruction intercept", insn_intercept_init, insn_intercept_main, 1151 insn_intercept_exit_handler, NULL, {0} }, 1152 { "EPT framework", ept_init, ept_main, ept_exit_handler, NULL, {0} }, 1153 { NULL, NULL, NULL, NULL, NULL, {0} }, 1154 }; 1155