12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458 |
- /*
- * All test cases of nested virtualization should be in this file
- *
- * Author : Arthur Chunqi Li <yzt356@gmail.com>
- */
- #include "vmx.h"
- #include "msr.h"
- #include "processor.h"
- #include "vm.h"
- #include "fwcfg.h"
- #include "isr.h"
- #include "desc.h"
- #include "apic.h"
- #include "types.h"
- #define NONCANONICAL 0xaaaaaaaaaaaaaaaaull
- #define VPID_CAP_INVVPID_TYPES_SHIFT 40
- u64 ia32_pat;
- u64 ia32_efer;
- void *io_bitmap_a, *io_bitmap_b;
- u16 ioport;
- unsigned long *pml4;
- u64 eptp;
- void *data_page1, *data_page2;
- void *pml_log;
- #define PML_INDEX 512
- static inline unsigned ffs(unsigned x)
- {
- int pos = -1;
- __asm__ __volatile__("bsf %1, %%eax; cmovnz %%eax, %0"
- : "+r"(pos) : "rm"(x) : "eax");
- return pos + 1;
- }
- static inline void vmcall()
- {
- asm volatile("vmcall");
- }
- void basic_guest_main()
- {
- report("Basic VMX test", 1);
- }
- int basic_exit_handler()
- {
- report("Basic VMX test", 0);
- print_vmexit_info();
- return VMX_TEST_EXIT;
- }
- void vmenter_main()
- {
- u64 rax;
- u64 rsp, resume_rsp;
- report("test vmlaunch", 1);
- asm volatile(
- "mov %%rsp, %0\n\t"
- "mov %3, %%rax\n\t"
- "vmcall\n\t"
- "mov %%rax, %1\n\t"
- "mov %%rsp, %2\n\t"
- : "=r"(rsp), "=r"(rax), "=r"(resume_rsp)
- : "g"(0xABCD));
- report("test vmresume", (rax == 0xFFFF) && (rsp == resume_rsp));
- }
- int vmenter_exit_handler()
- {
- u64 guest_rip;
- ulong reason;
- guest_rip = vmcs_read(GUEST_RIP);
- reason = vmcs_read(EXI_REASON) & 0xff;
- switch (reason) {
- case VMX_VMCALL:
- if (regs.rax != 0xABCD) {
- report("test vmresume", 0);
- return VMX_TEST_VMEXIT;
- }
- regs.rax = 0xFFFF;
- vmcs_write(GUEST_RIP, guest_rip + 3);
- return VMX_TEST_RESUME;
- default:
- report("test vmresume", 0);
- print_vmexit_info();
- }
- return VMX_TEST_VMEXIT;
- }
- u32 preempt_scale;
- volatile unsigned long long tsc_val;
- volatile u32 preempt_val;
- u64 saved_rip;
- int preemption_timer_init()
- {
- if (!(ctrl_pin_rev.clr & PIN_PREEMPT)) {
- printf("\tPreemption timer is not supported\n");
- return VMX_TEST_EXIT;
- }
- vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) | PIN_PREEMPT);
- preempt_val = 10000000;
- vmcs_write(PREEMPT_TIMER_VALUE, preempt_val);
- preempt_scale = rdmsr(MSR_IA32_VMX_MISC) & 0x1F;
- if (!(ctrl_exit_rev.clr & EXI_SAVE_PREEMPT))
- printf("\tSave preemption value is not supported\n");
- return VMX_TEST_START;
- }
- void preemption_timer_main()
- {
- tsc_val = rdtsc();
- if (ctrl_exit_rev.clr & EXI_SAVE_PREEMPT) {
- vmx_set_test_stage(0);
- vmcall();
- if (vmx_get_test_stage() == 1)
- vmcall();
- }
- vmx_set_test_stage(1);
- while (vmx_get_test_stage() == 1) {
- if (((rdtsc() - tsc_val) >> preempt_scale)
- > 10 * preempt_val) {
- vmx_set_test_stage(2);
- vmcall();
- }
- }
- tsc_val = rdtsc();
- asm volatile ("hlt");
- vmcall();
- vmx_set_test_stage(5);
- vmcall();
- }
- int preemption_timer_exit_handler()
- {
- bool guest_halted;
- u64 guest_rip;
- ulong reason;
- u32 insn_len;
- u32 ctrl_exit;
- guest_rip = vmcs_read(GUEST_RIP);
- reason = vmcs_read(EXI_REASON) & 0xff;
- insn_len = vmcs_read(EXI_INST_LEN);
- switch (reason) {
- case VMX_PREEMPT:
- switch (vmx_get_test_stage()) {
- case 1:
- case 2:
- report("busy-wait for preemption timer",
- ((rdtsc() - tsc_val) >> preempt_scale) >=
- preempt_val);
- vmx_set_test_stage(3);
- vmcs_write(PREEMPT_TIMER_VALUE, preempt_val);
- return VMX_TEST_RESUME;
- case 3:
- guest_halted =
- (vmcs_read(GUEST_ACTV_STATE) == ACTV_HLT);
- report("preemption timer during hlt",
- ((rdtsc() - tsc_val) >> preempt_scale) >=
- preempt_val && guest_halted);
- vmx_set_test_stage(4);
- vmcs_write(PIN_CONTROLS,
- vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT);
- vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE);
- return VMX_TEST_RESUME;
- case 4:
- report("preemption timer with 0 value",
- saved_rip == guest_rip);
- break;
- default:
- report("Invalid stage.", false);
- print_vmexit_info();
- break;
- }
- break;
- case VMX_VMCALL:
- vmcs_write(GUEST_RIP, guest_rip + insn_len);
- switch (vmx_get_test_stage()) {
- case 0:
- report("Keep preemption value",
- vmcs_read(PREEMPT_TIMER_VALUE) == preempt_val);
- vmx_set_test_stage(1);
- vmcs_write(PREEMPT_TIMER_VALUE, preempt_val);
- ctrl_exit = (vmcs_read(EXI_CONTROLS) |
- EXI_SAVE_PREEMPT) & ctrl_exit_rev.clr;
- vmcs_write(EXI_CONTROLS, ctrl_exit);
- return VMX_TEST_RESUME;
- case 1:
- report("Save preemption value",
- vmcs_read(PREEMPT_TIMER_VALUE) < preempt_val);
- return VMX_TEST_RESUME;
- case 2:
- report("busy-wait for preemption timer", 0);
- vmx_set_test_stage(3);
- vmcs_write(PREEMPT_TIMER_VALUE, preempt_val);
- return VMX_TEST_RESUME;
- case 3:
- report("preemption timer during hlt", 0);
- vmx_set_test_stage(4);
- /* fall through */
- case 4:
- vmcs_write(PIN_CONTROLS,
- vmcs_read(PIN_CONTROLS) | PIN_PREEMPT);
- vmcs_write(PREEMPT_TIMER_VALUE, 0);
- saved_rip = guest_rip + insn_len;
- return VMX_TEST_RESUME;
- case 5:
- report("preemption timer with 0 value (vmcall stage 5)", 0);
- break;
- default:
- // Should not reach here
- report("unexpected stage, %d", false,
- vmx_get_test_stage());
- print_vmexit_info();
- return VMX_TEST_VMEXIT;
- }
- break;
- default:
- report("Unknown exit reason, %ld", false, reason);
- print_vmexit_info();
- }
- vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT);
- return VMX_TEST_VMEXIT;
- }
- void msr_bmp_init()
- {
- void *msr_bitmap;
- u32 ctrl_cpu0;
- msr_bitmap = alloc_page();
- memset(msr_bitmap, 0x0, PAGE_SIZE);
- ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0);
- ctrl_cpu0 |= CPU_MSR_BITMAP;
- vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0);
- vmcs_write(MSR_BITMAP, (u64)msr_bitmap);
- }
- static int test_ctrl_pat_init()
- {
- u64 ctrl_ent;
- u64 ctrl_exi;
- msr_bmp_init();
- if (!(ctrl_exit_rev.clr & EXI_SAVE_PAT) &&
- !(ctrl_exit_rev.clr & EXI_LOAD_PAT) &&
- !(ctrl_enter_rev.clr & ENT_LOAD_PAT)) {
- printf("\tSave/load PAT is not supported\n");
- return 1;
- }
- ctrl_ent = vmcs_read(ENT_CONTROLS);
- ctrl_exi = vmcs_read(EXI_CONTROLS);
- ctrl_ent |= ctrl_enter_rev.clr & ENT_LOAD_PAT;
- ctrl_exi |= ctrl_exit_rev.clr & (EXI_SAVE_PAT | EXI_LOAD_PAT);
- vmcs_write(ENT_CONTROLS, ctrl_ent);
- vmcs_write(EXI_CONTROLS, ctrl_exi);
- ia32_pat = rdmsr(MSR_IA32_CR_PAT);
- vmcs_write(GUEST_PAT, 0x0);
- vmcs_write(HOST_PAT, ia32_pat);
- return VMX_TEST_START;
- }
- static void test_ctrl_pat_main()
- {
- u64 guest_ia32_pat;
- guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT);
- if (!(ctrl_enter_rev.clr & ENT_LOAD_PAT))
- printf("\tENT_LOAD_PAT is not supported.\n");
- else {
- if (guest_ia32_pat != 0) {
- report("Entry load PAT", 0);
- return;
- }
- }
- wrmsr(MSR_IA32_CR_PAT, 0x6);
- vmcall();
- guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT);
- if (ctrl_enter_rev.clr & ENT_LOAD_PAT)
- report("Entry load PAT", guest_ia32_pat == ia32_pat);
- }
- static int test_ctrl_pat_exit_handler()
- {
- u64 guest_rip;
- ulong reason;
- u64 guest_pat;
- guest_rip = vmcs_read(GUEST_RIP);
- reason = vmcs_read(EXI_REASON) & 0xff;
- switch (reason) {
- case VMX_VMCALL:
- guest_pat = vmcs_read(GUEST_PAT);
- if (!(ctrl_exit_rev.clr & EXI_SAVE_PAT)) {
- printf("\tEXI_SAVE_PAT is not supported\n");
- vmcs_write(GUEST_PAT, 0x6);
- } else {
- report("Exit save PAT", guest_pat == 0x6);
- }
- if (!(ctrl_exit_rev.clr & EXI_LOAD_PAT))
- printf("\tEXI_LOAD_PAT is not supported\n");
- else
- report("Exit load PAT", rdmsr(MSR_IA32_CR_PAT) == ia32_pat);
- vmcs_write(GUEST_PAT, ia32_pat);
- vmcs_write(GUEST_RIP, guest_rip + 3);
- return VMX_TEST_RESUME;
- default:
- printf("ERROR : Undefined exit reason, reason = %ld.\n", reason);
- break;
- }
- return VMX_TEST_VMEXIT;
- }
- static int test_ctrl_efer_init()
- {
- u64 ctrl_ent;
- u64 ctrl_exi;
- msr_bmp_init();
- ctrl_ent = vmcs_read(ENT_CONTROLS) | ENT_LOAD_EFER;
- ctrl_exi = vmcs_read(EXI_CONTROLS) | EXI_SAVE_EFER | EXI_LOAD_EFER;
- vmcs_write(ENT_CONTROLS, ctrl_ent & ctrl_enter_rev.clr);
- vmcs_write(EXI_CONTROLS, ctrl_exi & ctrl_exit_rev.clr);
- ia32_efer = rdmsr(MSR_EFER);
- vmcs_write(GUEST_EFER, ia32_efer ^ EFER_NX);
- vmcs_write(HOST_EFER, ia32_efer ^ EFER_NX);
- return VMX_TEST_START;
- }
- static void test_ctrl_efer_main()
- {
- u64 guest_ia32_efer;
- guest_ia32_efer = rdmsr(MSR_EFER);
- if (!(ctrl_enter_rev.clr & ENT_LOAD_EFER))
- printf("\tENT_LOAD_EFER is not supported.\n");
- else {
- if (guest_ia32_efer != (ia32_efer ^ EFER_NX)) {
- report("Entry load EFER", 0);
- return;
- }
- }
- wrmsr(MSR_EFER, ia32_efer);
- vmcall();
- guest_ia32_efer = rdmsr(MSR_EFER);
- if (ctrl_enter_rev.clr & ENT_LOAD_EFER)
- report("Entry load EFER", guest_ia32_efer == ia32_efer);
- }
- static int test_ctrl_efer_exit_handler()
- {
- u64 guest_rip;
- ulong reason;
- u64 guest_efer;
- guest_rip = vmcs_read(GUEST_RIP);
- reason = vmcs_read(EXI_REASON) & 0xff;
- switch (reason) {
- case VMX_VMCALL:
- guest_efer = vmcs_read(GUEST_EFER);
- if (!(ctrl_exit_rev.clr & EXI_SAVE_EFER)) {
- printf("\tEXI_SAVE_EFER is not supported\n");
- vmcs_write(GUEST_EFER, ia32_efer);
- } else {
- report("Exit save EFER", guest_efer == ia32_efer);
- }
- if (!(ctrl_exit_rev.clr & EXI_LOAD_EFER)) {
- printf("\tEXI_LOAD_EFER is not supported\n");
- wrmsr(MSR_EFER, ia32_efer ^ EFER_NX);
- } else {
- report("Exit load EFER", rdmsr(MSR_EFER) == (ia32_efer ^ EFER_NX));
- }
- vmcs_write(GUEST_PAT, ia32_efer);
- vmcs_write(GUEST_RIP, guest_rip + 3);
- return VMX_TEST_RESUME;
- default:
- printf("ERROR : Undefined exit reason, reason = %ld.\n", reason);
- break;
- }
- return VMX_TEST_VMEXIT;
- }
- u32 guest_cr0, guest_cr4;
- static void cr_shadowing_main()
- {
- u32 cr0, cr4, tmp;
- // Test read through
- vmx_set_test_stage(0);
- guest_cr0 = read_cr0();
- if (vmx_get_test_stage() == 1)
- report("Read through CR0", 0);
- else
- vmcall();
- vmx_set_test_stage(1);
- guest_cr4 = read_cr4();
- if (vmx_get_test_stage() == 2)
- report("Read through CR4", 0);
- else
- vmcall();
- // Test write through
- guest_cr0 = guest_cr0 ^ (X86_CR0_TS | X86_CR0_MP);
- guest_cr4 = guest_cr4 ^ (X86_CR4_TSD | X86_CR4_DE);
- vmx_set_test_stage(2);
- write_cr0(guest_cr0);
- if (vmx_get_test_stage() == 3)
- report("Write throuth CR0", 0);
- else
- vmcall();
- vmx_set_test_stage(3);
- write_cr4(guest_cr4);
- if (vmx_get_test_stage() == 4)
- report("Write through CR4", 0);
- else
- vmcall();
- // Test read shadow
- vmx_set_test_stage(4);
- vmcall();
- cr0 = read_cr0();
- if (vmx_get_test_stage() != 5)
- report("Read shadowing CR0", cr0 == guest_cr0);
- vmx_set_test_stage(5);
- cr4 = read_cr4();
- if (vmx_get_test_stage() != 6)
- report("Read shadowing CR4", cr4 == guest_cr4);
- // Test write shadow (same value with shadow)
- vmx_set_test_stage(6);
- write_cr0(guest_cr0);
- if (vmx_get_test_stage() == 7)
- report("Write shadowing CR0 (same value with shadow)", 0);
- else
- vmcall();
- vmx_set_test_stage(7);
- write_cr4(guest_cr4);
- if (vmx_get_test_stage() == 8)
- report("Write shadowing CR4 (same value with shadow)", 0);
- else
- vmcall();
- // Test write shadow (different value)
- vmx_set_test_stage(8);
- tmp = guest_cr0 ^ X86_CR0_TS;
- asm volatile("mov %0, %%rsi\n\t"
- "mov %%rsi, %%cr0\n\t"
- ::"m"(tmp)
- :"rsi", "memory", "cc");
- report("Write shadowing different X86_CR0_TS", vmx_get_test_stage() == 9);
- vmx_set_test_stage(9);
- tmp = guest_cr0 ^ X86_CR0_MP;
- asm volatile("mov %0, %%rsi\n\t"
- "mov %%rsi, %%cr0\n\t"
- ::"m"(tmp)
- :"rsi", "memory", "cc");
- report("Write shadowing different X86_CR0_MP", vmx_get_test_stage() == 10);
- vmx_set_test_stage(10);
- tmp = guest_cr4 ^ X86_CR4_TSD;
- asm volatile("mov %0, %%rsi\n\t"
- "mov %%rsi, %%cr4\n\t"
- ::"m"(tmp)
- :"rsi", "memory", "cc");
- report("Write shadowing different X86_CR4_TSD", vmx_get_test_stage() == 11);
- vmx_set_test_stage(11);
- tmp = guest_cr4 ^ X86_CR4_DE;
- asm volatile("mov %0, %%rsi\n\t"
- "mov %%rsi, %%cr4\n\t"
- ::"m"(tmp)
- :"rsi", "memory", "cc");
- report("Write shadowing different X86_CR4_DE", vmx_get_test_stage() == 12);
- }
- static int cr_shadowing_exit_handler()
- {
- u64 guest_rip;
- ulong reason;
- u32 insn_len;
- u32 exit_qual;
- guest_rip = vmcs_read(GUEST_RIP);
- reason = vmcs_read(EXI_REASON) & 0xff;
- insn_len = vmcs_read(EXI_INST_LEN);
- exit_qual = vmcs_read(EXI_QUALIFICATION);
- switch (reason) {
- case VMX_VMCALL:
- switch (vmx_get_test_stage()) {
- case 0:
- report("Read through CR0", guest_cr0 == vmcs_read(GUEST_CR0));
- break;
- case 1:
- report("Read through CR4", guest_cr4 == vmcs_read(GUEST_CR4));
- break;
- case 2:
- report("Write through CR0", guest_cr0 == vmcs_read(GUEST_CR0));
- break;
- case 3:
- report("Write through CR4", guest_cr4 == vmcs_read(GUEST_CR4));
- break;
- case 4:
- guest_cr0 = vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP);
- guest_cr4 = vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE);
- vmcs_write(CR0_MASK, X86_CR0_TS | X86_CR0_MP);
- vmcs_write(CR0_READ_SHADOW, guest_cr0 & (X86_CR0_TS | X86_CR0_MP));
- vmcs_write(CR4_MASK, X86_CR4_TSD | X86_CR4_DE);
- vmcs_write(CR4_READ_SHADOW, guest_cr4 & (X86_CR4_TSD | X86_CR4_DE));
- break;
- case 6:
- report("Write shadowing CR0 (same value)",
- guest_cr0 == (vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP)));
- break;
- case 7:
- report("Write shadowing CR4 (same value)",
- guest_cr4 == (vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE)));
- break;
- default:
- // Should not reach here
- report("unexpected stage, %d", false,
- vmx_get_test_stage());
- print_vmexit_info();
- return VMX_TEST_VMEXIT;
- }
- vmcs_write(GUEST_RIP, guest_rip + insn_len);
- return VMX_TEST_RESUME;
- case VMX_CR:
- switch (vmx_get_test_stage()) {
- case 4:
- report("Read shadowing CR0", 0);
- vmx_inc_test_stage();
- break;
- case 5:
- report("Read shadowing CR4", 0);
- vmx_inc_test_stage();
- break;
- case 6:
- report("Write shadowing CR0 (same value)", 0);
- vmx_inc_test_stage();
- break;
- case 7:
- report("Write shadowing CR4 (same value)", 0);
- vmx_inc_test_stage();
- break;
- case 8:
- case 9:
- // 0x600 encodes "mov %esi, %cr0"
- if (exit_qual == 0x600)
- vmx_inc_test_stage();
- break;
- case 10:
- case 11:
- // 0x604 encodes "mov %esi, %cr4"
- if (exit_qual == 0x604)
- vmx_inc_test_stage();
- break;
- default:
- // Should not reach here
- report("unexpected stage, %d", false,
- vmx_get_test_stage());
- print_vmexit_info();
- return VMX_TEST_VMEXIT;
- }
- vmcs_write(GUEST_RIP, guest_rip + insn_len);
- return VMX_TEST_RESUME;
- default:
- report("Unknown exit reason, %ld", false, reason);
- print_vmexit_info();
- }
- return VMX_TEST_VMEXIT;
- }
- static int iobmp_init()
- {
- u32 ctrl_cpu0;
- io_bitmap_a = alloc_page();
- io_bitmap_b = alloc_page();
- memset(io_bitmap_a, 0x0, PAGE_SIZE);
- memset(io_bitmap_b, 0x0, PAGE_SIZE);
- ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0);
- ctrl_cpu0 |= CPU_IO_BITMAP;
- ctrl_cpu0 &= (~CPU_IO);
- vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0);
- vmcs_write(IO_BITMAP_A, (u64)io_bitmap_a);
- vmcs_write(IO_BITMAP_B, (u64)io_bitmap_b);
- return VMX_TEST_START;
- }
- static void iobmp_main()
- {
- // stage 0, test IO pass
- vmx_set_test_stage(0);
- inb(0x5000);
- outb(0x0, 0x5000);
- report("I/O bitmap - I/O pass", vmx_get_test_stage() == 0);
- // test IO width, in/out
- ((u8 *)io_bitmap_a)[0] = 0xFF;
- vmx_set_test_stage(2);
- inb(0x0);
- report("I/O bitmap - trap in", vmx_get_test_stage() == 3);
- vmx_set_test_stage(3);
- outw(0x0, 0x0);
- report("I/O bitmap - trap out", vmx_get_test_stage() == 4);
- vmx_set_test_stage(4);
- inl(0x0);
- report("I/O bitmap - I/O width, long", vmx_get_test_stage() == 5);
- // test low/high IO port
- vmx_set_test_stage(5);
- ((u8 *)io_bitmap_a)[0x5000 / 8] = (1 << (0x5000 % 8));
- inb(0x5000);
- report("I/O bitmap - I/O port, low part", vmx_get_test_stage() == 6);
- vmx_set_test_stage(6);
- ((u8 *)io_bitmap_b)[0x1000 / 8] = (1 << (0x1000 % 8));
- inb(0x9000);
- report("I/O bitmap - I/O port, high part", vmx_get_test_stage() == 7);
- // test partial pass
- vmx_set_test_stage(7);
- inl(0x4FFF);
- report("I/O bitmap - partial pass", vmx_get_test_stage() == 8);
- // test overrun
- vmx_set_test_stage(8);
- memset(io_bitmap_a, 0x0, PAGE_SIZE);
- memset(io_bitmap_b, 0x0, PAGE_SIZE);
- inl(0xFFFF);
- report("I/O bitmap - overrun", vmx_get_test_stage() == 9);
- vmx_set_test_stage(9);
- vmcall();
- outb(0x0, 0x0);
- report("I/O bitmap - ignore unconditional exiting",
- vmx_get_test_stage() == 9);
- vmx_set_test_stage(10);
- vmcall();
- outb(0x0, 0x0);
- report("I/O bitmap - unconditional exiting",
- vmx_get_test_stage() == 11);
- }
- static int iobmp_exit_handler()
- {
- u64 guest_rip;
- ulong reason, exit_qual;
- u32 insn_len, ctrl_cpu0;
- guest_rip = vmcs_read(GUEST_RIP);
- reason = vmcs_read(EXI_REASON) & 0xff;
- exit_qual = vmcs_read(EXI_QUALIFICATION);
- insn_len = vmcs_read(EXI_INST_LEN);
- switch (reason) {
- case VMX_IO:
- switch (vmx_get_test_stage()) {
- case 0:
- case 1:
- vmx_inc_test_stage();
- break;
- case 2:
- report("I/O bitmap - I/O width, byte",
- (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_BYTE);
- report("I/O bitmap - I/O direction, in", exit_qual & VMX_IO_IN);
- vmx_inc_test_stage();
- break;
- case 3:
- report("I/O bitmap - I/O width, word",
- (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_WORD);
- report("I/O bitmap - I/O direction, out",
- !(exit_qual & VMX_IO_IN));
- vmx_inc_test_stage();
- break;
- case 4:
- report("I/O bitmap - I/O width, long",
- (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_LONG);
- vmx_inc_test_stage();
- break;
- case 5:
- if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x5000)
- vmx_inc_test_stage();
- break;
- case 6:
- if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x9000)
- vmx_inc_test_stage();
- break;
- case 7:
- if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x4FFF)
- vmx_inc_test_stage();
- break;
- case 8:
- if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0xFFFF)
- vmx_inc_test_stage();
- break;
- case 9:
- case 10:
- ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0);
- vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0 & ~CPU_IO);
- vmx_inc_test_stage();
- break;
- default:
- // Should not reach here
- report("unexpected stage, %d", false,
- vmx_get_test_stage());
- print_vmexit_info();
- return VMX_TEST_VMEXIT;
- }
- vmcs_write(GUEST_RIP, guest_rip + insn_len);
- return VMX_TEST_RESUME;
- case VMX_VMCALL:
- switch (vmx_get_test_stage()) {
- case 9:
- ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0);
- ctrl_cpu0 |= CPU_IO | CPU_IO_BITMAP;
- vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0);
- break;
- case 10:
- ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0);
- ctrl_cpu0 = (ctrl_cpu0 & ~CPU_IO_BITMAP) | CPU_IO;
- vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0);
- break;
- default:
- // Should not reach here
- report("unexpected stage, %d", false,
- vmx_get_test_stage());
- print_vmexit_info();
- return VMX_TEST_VMEXIT;
- }
- vmcs_write(GUEST_RIP, guest_rip + insn_len);
- return VMX_TEST_RESUME;
- default:
- printf("guest_rip = %#lx\n", guest_rip);
- printf("\tERROR : Undefined exit reason, reason = %ld.\n", reason);
- break;
- }
- return VMX_TEST_VMEXIT;
- }
- #define INSN_CPU0 0
- #define INSN_CPU1 1
- #define INSN_ALWAYS_TRAP 2
- #define FIELD_EXIT_QUAL (1 << 0)
- #define FIELD_INSN_INFO (1 << 1)
- asm(
- "insn_hlt: hlt;ret\n\t"
- "insn_invlpg: invlpg 0x12345678;ret\n\t"
- "insn_mwait: xor %eax, %eax; xor %ecx, %ecx; mwait;ret\n\t"
- "insn_rdpmc: xor %ecx, %ecx; rdpmc;ret\n\t"
- "insn_rdtsc: rdtsc;ret\n\t"
- "insn_cr3_load: mov cr3,%rax; mov %rax,%cr3;ret\n\t"
- "insn_cr3_store: mov %cr3,%rax;ret\n\t"
- #ifdef __x86_64__
- "insn_cr8_load: mov %rax,%cr8;ret\n\t"
- "insn_cr8_store: mov %cr8,%rax;ret\n\t"
- #endif
- "insn_monitor: xor %eax, %eax; xor %ecx, %ecx; xor %edx, %edx; monitor;ret\n\t"
- "insn_pause: pause;ret\n\t"
- "insn_wbinvd: wbinvd;ret\n\t"
- "insn_cpuid: mov $10, %eax; cpuid;ret\n\t"
- "insn_invd: invd;ret\n\t"
- "insn_sgdt: sgdt gdt64_desc;ret\n\t"
- "insn_lgdt: lgdt gdt64_desc;ret\n\t"
- "insn_sidt: sidt idt_descr;ret\n\t"
- "insn_lidt: lidt idt_descr;ret\n\t"
- "insn_sldt: sldt %ax;ret\n\t"
- "insn_lldt: xor %eax, %eax; lldt %ax;ret\n\t"
- "insn_str: str %ax;ret\n\t"
- );
- extern void insn_hlt();
- extern void insn_invlpg();
- extern void insn_mwait();
- extern void insn_rdpmc();
- extern void insn_rdtsc();
- extern void insn_cr3_load();
- extern void insn_cr3_store();
- #ifdef __x86_64__
- extern void insn_cr8_load();
- extern void insn_cr8_store();
- #endif
- extern void insn_monitor();
- extern void insn_pause();
- extern void insn_wbinvd();
- extern void insn_sgdt();
- extern void insn_lgdt();
- extern void insn_sidt();
- extern void insn_lidt();
- extern void insn_sldt();
- extern void insn_lldt();
- extern void insn_str();
- extern void insn_cpuid();
- extern void insn_invd();
- u32 cur_insn;
- u64 cr3;
- struct insn_table {
- const char *name;
- u32 flag;
- void (*insn_func)();
- u32 type;
- u32 reason;
- ulong exit_qual;
- u32 insn_info;
- // Use FIELD_EXIT_QUAL and FIELD_INSN_INFO to define
- // which field need to be tested, reason is always tested
- u32 test_field;
- };
- /*
- * Add more test cases of instruction intercept here. Elements in this
- * table is:
- * name/control flag/insn function/type/exit reason/exit qulification/
- * instruction info/field to test
- * The last field defines which fields (exit_qual and insn_info) need to be
- * tested in exit handler. If set to 0, only "reason" is checked.
- */
- static struct insn_table insn_table[] = {
- // Flags for Primary Processor-Based VM-Execution Controls
- {"HLT", CPU_HLT, insn_hlt, INSN_CPU0, 12, 0, 0, 0},
- {"INVLPG", CPU_INVLPG, insn_invlpg, INSN_CPU0, 14,
- 0x12345678, 0, FIELD_EXIT_QUAL},
- {"MWAIT", CPU_MWAIT, insn_mwait, INSN_CPU0, 36, 0, 0, 0},
- {"RDPMC", CPU_RDPMC, insn_rdpmc, INSN_CPU0, 15, 0, 0, 0},
- {"RDTSC", CPU_RDTSC, insn_rdtsc, INSN_CPU0, 16, 0, 0, 0},
- {"CR3 load", CPU_CR3_LOAD, insn_cr3_load, INSN_CPU0, 28, 0x3, 0,
- FIELD_EXIT_QUAL},
- {"CR3 store", CPU_CR3_STORE, insn_cr3_store, INSN_CPU0, 28, 0x13, 0,
- FIELD_EXIT_QUAL},
- #ifdef __x86_64__
- {"CR8 load", CPU_CR8_LOAD, insn_cr8_load, INSN_CPU0, 28, 0x8, 0,
- FIELD_EXIT_QUAL},
- {"CR8 store", CPU_CR8_STORE, insn_cr8_store, INSN_CPU0, 28, 0x18, 0,
- FIELD_EXIT_QUAL},
- #endif
- {"MONITOR", CPU_MONITOR, insn_monitor, INSN_CPU0, 39, 0, 0, 0},
- {"PAUSE", CPU_PAUSE, insn_pause, INSN_CPU0, 40, 0, 0, 0},
- // Flags for Secondary Processor-Based VM-Execution Controls
- {"WBINVD", CPU_WBINVD, insn_wbinvd, INSN_CPU1, 54, 0, 0, 0},
- {"DESC_TABLE (SGDT)", CPU_DESC_TABLE, insn_sgdt, INSN_CPU1, 46, 0, 0, 0},
- {"DESC_TABLE (LGDT)", CPU_DESC_TABLE, insn_lgdt, INSN_CPU1, 46, 0, 0, 0},
- {"DESC_TABLE (SIDT)", CPU_DESC_TABLE, insn_sidt, INSN_CPU1, 46, 0, 0, 0},
- {"DESC_TABLE (LIDT)", CPU_DESC_TABLE, insn_lidt, INSN_CPU1, 46, 0, 0, 0},
- {"DESC_TABLE (SLDT)", CPU_DESC_TABLE, insn_sldt, INSN_CPU1, 47, 0, 0, 0},
- {"DESC_TABLE (LLDT)", CPU_DESC_TABLE, insn_lldt, INSN_CPU1, 47, 0, 0, 0},
- {"DESC_TABLE (STR)", CPU_DESC_TABLE, insn_str, INSN_CPU1, 47, 0, 0, 0},
- /* LTR causes a #GP if done with a busy selector, so it is not tested. */
- // Instructions always trap
- {"CPUID", 0, insn_cpuid, INSN_ALWAYS_TRAP, 10, 0, 0, 0},
- {"INVD", 0, insn_invd, INSN_ALWAYS_TRAP, 13, 0, 0, 0},
- // Instructions never trap
- {NULL},
- };
- static int insn_intercept_init()
- {
- u32 ctrl_cpu;
- ctrl_cpu = ctrl_cpu_rev[0].set | CPU_SECONDARY;
- ctrl_cpu &= ctrl_cpu_rev[0].clr;
- vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu);
- vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu_rev[1].set);
- cr3 = read_cr3();
- return VMX_TEST_START;
- }
- static void insn_intercept_main()
- {
- for (cur_insn = 0; insn_table[cur_insn].name != NULL; cur_insn++) {
- vmx_set_test_stage(cur_insn * 2);
- if ((insn_table[cur_insn].type == INSN_CPU0 &&
- !(ctrl_cpu_rev[0].clr & insn_table[cur_insn].flag)) ||
- (insn_table[cur_insn].type == INSN_CPU1 &&
- !(ctrl_cpu_rev[1].clr & insn_table[cur_insn].flag))) {
- printf("\tCPU_CTRL%d.CPU_%s is not supported.\n",
- insn_table[cur_insn].type - INSN_CPU0,
- insn_table[cur_insn].name);
- continue;
- }
- if ((insn_table[cur_insn].type == INSN_CPU0 &&
- !(ctrl_cpu_rev[0].set & insn_table[cur_insn].flag)) ||
- (insn_table[cur_insn].type == INSN_CPU1 &&
- !(ctrl_cpu_rev[1].set & insn_table[cur_insn].flag))) {
- /* skip hlt, it stalls the guest and is tested below */
- if (insn_table[cur_insn].insn_func != insn_hlt)
- insn_table[cur_insn].insn_func();
- report("execute %s", vmx_get_test_stage() == cur_insn * 2,
- insn_table[cur_insn].name);
- } else if (insn_table[cur_insn].type != INSN_ALWAYS_TRAP)
- printf("\tCPU_CTRL%d.CPU_%s always traps.\n",
- insn_table[cur_insn].type - INSN_CPU0,
- insn_table[cur_insn].name);
- vmcall();
- insn_table[cur_insn].insn_func();
- report("intercept %s", vmx_get_test_stage() == cur_insn * 2 + 1,
- insn_table[cur_insn].name);
- vmx_set_test_stage(cur_insn * 2 + 1);
- vmcall();
- }
- }
- static int insn_intercept_exit_handler()
- {
- u64 guest_rip;
- u32 reason;
- ulong exit_qual;
- u32 insn_len;
- u32 insn_info;
- bool pass;
- guest_rip = vmcs_read(GUEST_RIP);
- reason = vmcs_read(EXI_REASON) & 0xff;
- exit_qual = vmcs_read(EXI_QUALIFICATION);
- insn_len = vmcs_read(EXI_INST_LEN);
- insn_info = vmcs_read(EXI_INST_INFO);
- if (reason == VMX_VMCALL) {
- u32 val = 0;
- if (insn_table[cur_insn].type == INSN_CPU0)
- val = vmcs_read(CPU_EXEC_CTRL0);
- else if (insn_table[cur_insn].type == INSN_CPU1)
- val = vmcs_read(CPU_EXEC_CTRL1);
- if (vmx_get_test_stage() & 1)
- val &= ~insn_table[cur_insn].flag;
- else
- val |= insn_table[cur_insn].flag;
- if (insn_table[cur_insn].type == INSN_CPU0)
- vmcs_write(CPU_EXEC_CTRL0, val | ctrl_cpu_rev[0].set);
- else if (insn_table[cur_insn].type == INSN_CPU1)
- vmcs_write(CPU_EXEC_CTRL1, val | ctrl_cpu_rev[1].set);
- } else {
- pass = (cur_insn * 2 == vmx_get_test_stage()) &&
- insn_table[cur_insn].reason == reason;
- if (insn_table[cur_insn].test_field & FIELD_EXIT_QUAL &&
- insn_table[cur_insn].exit_qual != exit_qual)
- pass = false;
- if (insn_table[cur_insn].test_field & FIELD_INSN_INFO &&
- insn_table[cur_insn].insn_info != insn_info)
- pass = false;
- if (pass)
- vmx_inc_test_stage();
- }
- vmcs_write(GUEST_RIP, guest_rip + insn_len);
- return VMX_TEST_RESUME;
- }
- /* Enables EPT and sets up the identity map. */
- static int setup_ept(bool enable_ad)
- {
- unsigned long end_of_memory;
- u32 ctrl_cpu[2];
- if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) ||
- !(ctrl_cpu_rev[1].clr & CPU_EPT)) {
- printf("\tEPT is not supported");
- return 1;
- }
- if (!(ept_vpid.val & EPT_CAP_UC) &&
- !(ept_vpid.val & EPT_CAP_WB)) {
- printf("\tEPT paging-structure memory type "
- "UC&WB are not supported\n");
- return 1;
- }
- if (ept_vpid.val & EPT_CAP_UC)
- eptp = EPT_MEM_TYPE_UC;
- else
- eptp = EPT_MEM_TYPE_WB;
- if (!(ept_vpid.val & EPT_CAP_PWL4)) {
- printf("\tPWL4 is not supported\n");
- return 1;
- }
- ctrl_cpu[0] = vmcs_read(CPU_EXEC_CTRL0);
- ctrl_cpu[1] = vmcs_read(CPU_EXEC_CTRL1);
- ctrl_cpu[0] = (ctrl_cpu[0] | CPU_SECONDARY)
- & ctrl_cpu_rev[0].clr;
- ctrl_cpu[1] = (ctrl_cpu[1] | CPU_EPT)
- & ctrl_cpu_rev[1].clr;
- vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu[0]);
- vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu[1]);
- eptp |= (3 << EPTP_PG_WALK_LEN_SHIFT);
- pml4 = alloc_page();
- memset(pml4, 0, PAGE_SIZE);
- eptp |= virt_to_phys(pml4);
- if (enable_ad)
- eptp |= EPTP_AD_FLAG;
- vmcs_write(EPTP, eptp);
- end_of_memory = fwcfg_get_u64(FW_CFG_RAM_SIZE);
- if (end_of_memory < (1ul << 32))
- end_of_memory = (1ul << 32);
- /* Cannot use large EPT pages if we need to track EPT
- * accessed/dirty bits at 4K granularity.
- */
- setup_ept_range(pml4, 0, end_of_memory, 0,
- !enable_ad && ept_2m_supported(),
- EPT_WA | EPT_RA | EPT_EA);
- return 0;
- }
- static void ept_enable_ad_bits(void)
- {
- eptp |= EPTP_AD_FLAG;
- vmcs_write(EPTP, eptp);
- }
- static void ept_disable_ad_bits(void)
- {
- eptp &= ~EPTP_AD_FLAG;
- vmcs_write(EPTP, eptp);
- }
- static void ept_enable_ad_bits_or_skip_test(void)
- {
- if (!ept_ad_bits_supported())
- test_skip("EPT AD bits not supported.");
- ept_enable_ad_bits();
- }
- static int apic_version;
- static int ept_init_common(bool have_ad)
- {
- if (setup_ept(have_ad))
- return VMX_TEST_EXIT;
- data_page1 = alloc_page();
- data_page2 = alloc_page();
- memset(data_page1, 0x0, PAGE_SIZE);
- memset(data_page2, 0x0, PAGE_SIZE);
- *((u32 *)data_page1) = MAGIC_VAL_1;
- *((u32 *)data_page2) = MAGIC_VAL_2;
- install_ept(pml4, (unsigned long)data_page1, (unsigned long)data_page2,
- EPT_RA | EPT_WA | EPT_EA);
- apic_version = apic_read(APIC_LVR);
- return VMX_TEST_START;
- }
- static int ept_init()
- {
- return ept_init_common(false);
- }
- static void ept_common()
- {
- vmx_set_test_stage(0);
- if (*((u32 *)data_page2) != MAGIC_VAL_1 ||
- *((u32 *)data_page1) != MAGIC_VAL_1)
- report("EPT basic framework - read", 0);
- else {
- *((u32 *)data_page2) = MAGIC_VAL_3;
- vmcall();
- if (vmx_get_test_stage() == 1) {
- if (*((u32 *)data_page1) == MAGIC_VAL_3 &&
- *((u32 *)data_page2) == MAGIC_VAL_2)
- report("EPT basic framework", 1);
- else
- report("EPT basic framework - remap", 1);
- }
- }
- // Test EPT Misconfigurations
- vmx_set_test_stage(1);
- vmcall();
- *((u32 *)data_page1) = MAGIC_VAL_1;
- if (vmx_get_test_stage() != 2) {
- report("EPT misconfigurations", 0);
- goto t1;
- }
- vmx_set_test_stage(2);
- vmcall();
- *((u32 *)data_page1) = MAGIC_VAL_1;
- report("EPT misconfigurations", vmx_get_test_stage() == 3);
- t1:
- // Test EPT violation
- vmx_set_test_stage(3);
- vmcall();
- *((u32 *)data_page1) = MAGIC_VAL_1;
- report("EPT violation - page permission", vmx_get_test_stage() == 4);
- // Violation caused by EPT paging structure
- vmx_set_test_stage(4);
- vmcall();
- *((u32 *)data_page1) = MAGIC_VAL_2;
- report("EPT violation - paging structure", vmx_get_test_stage() == 5);
- }
- static void ept_main()
- {
- ept_common();
- // Test EPT access to L1 MMIO
- vmx_set_test_stage(6);
- report("EPT - MMIO access", *((u32 *)0xfee00030UL) == apic_version);
- // Test invalid operand for INVEPT
- vmcall();
- report("EPT - unsupported INVEPT", vmx_get_test_stage() == 7);
- }
- bool invept_test(int type, u64 eptp)
- {
- bool ret, supported;
- supported = ept_vpid.val & (EPT_CAP_INVEPT_SINGLE >> INVEPT_SINGLE << type);
- ret = invept(type, eptp);
- if (ret == !supported)
- return false;
- if (!supported)
- printf("WARNING: unsupported invept passed!\n");
- else
- printf("WARNING: invept failed!\n");
- return true;
- }
- static int pml_exit_handler(void)
- {
- u16 index, count;
- ulong reason = vmcs_read(EXI_REASON) & 0xff;
- u64 *pmlbuf = pml_log;
- u64 guest_rip = vmcs_read(GUEST_RIP);;
- u64 guest_cr3 = vmcs_read(GUEST_CR3);
- u32 insn_len = vmcs_read(EXI_INST_LEN);
- switch (reason) {
- case VMX_VMCALL:
- switch (vmx_get_test_stage()) {
- case 0:
- index = vmcs_read(GUEST_PML_INDEX);
- for (count = index + 1; count < PML_INDEX; count++) {
- if (pmlbuf[count] == (u64)data_page2) {
- vmx_inc_test_stage();
- clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page2);
- break;
- }
- }
- break;
- case 1:
- index = vmcs_read(GUEST_PML_INDEX);
- /* Keep clearing the dirty bit till a overflow */
- clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page2);
- break;
- default:
- report("unexpected stage, %d.", false,
- vmx_get_test_stage());
- print_vmexit_info();
- return VMX_TEST_VMEXIT;
- }
- vmcs_write(GUEST_RIP, guest_rip + insn_len);
- return VMX_TEST_RESUME;
- case VMX_PML_FULL:
- vmx_inc_test_stage();
- vmcs_write(GUEST_PML_INDEX, PML_INDEX - 1);
- return VMX_TEST_RESUME;
- default:
- report("Unknown exit reason, %ld", false, reason);
- print_vmexit_info();
- }
- return VMX_TEST_VMEXIT;
- }
- static int ept_exit_handler_common(bool have_ad)
- {
- u64 guest_rip;
- u64 guest_cr3;
- ulong reason;
- u32 insn_len;
- u32 exit_qual;
- static unsigned long data_page1_pte, data_page1_pte_pte;
- guest_rip = vmcs_read(GUEST_RIP);
- guest_cr3 = vmcs_read(GUEST_CR3);
- reason = vmcs_read(EXI_REASON) & 0xff;
- insn_len = vmcs_read(EXI_INST_LEN);
- exit_qual = vmcs_read(EXI_QUALIFICATION);
- switch (reason) {
- case VMX_VMCALL:
- switch (vmx_get_test_stage()) {
- case 0:
- check_ept_ad(pml4, guest_cr3,
- (unsigned long)data_page1,
- have_ad ? EPT_ACCESS_FLAG : 0,
- have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0);
- check_ept_ad(pml4, guest_cr3,
- (unsigned long)data_page2,
- have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0,
- have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0);
- clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1);
- clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page2);
- if (have_ad)
- ept_sync(INVEPT_SINGLE, eptp);;
- if (*((u32 *)data_page1) == MAGIC_VAL_3 &&
- *((u32 *)data_page2) == MAGIC_VAL_2) {
- vmx_inc_test_stage();
- install_ept(pml4, (unsigned long)data_page2,
- (unsigned long)data_page2,
- EPT_RA | EPT_WA | EPT_EA);
- } else
- report("EPT basic framework - write", 0);
- break;
- case 1:
- install_ept(pml4, (unsigned long)data_page1,
- (unsigned long)data_page1, EPT_WA);
- ept_sync(INVEPT_SINGLE, eptp);
- break;
- case 2:
- install_ept(pml4, (unsigned long)data_page1,
- (unsigned long)data_page1,
- EPT_RA | EPT_WA | EPT_EA |
- (2 << EPT_MEM_TYPE_SHIFT));
- ept_sync(INVEPT_SINGLE, eptp);
- break;
- case 3:
- clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1);
- TEST_ASSERT(get_ept_pte(pml4, (unsigned long)data_page1,
- 1, &data_page1_pte));
- set_ept_pte(pml4, (unsigned long)data_page1,
- 1, data_page1_pte & ~EPT_PRESENT);
- ept_sync(INVEPT_SINGLE, eptp);
- break;
- case 4:
- TEST_ASSERT(get_ept_pte(pml4, (unsigned long)data_page1,
- 2, &data_page1_pte));
- data_page1_pte &= PAGE_MASK;
- TEST_ASSERT(get_ept_pte(pml4, data_page1_pte,
- 2, &data_page1_pte_pte));
- set_ept_pte(pml4, data_page1_pte, 2,
- data_page1_pte_pte & ~EPT_PRESENT);
- ept_sync(INVEPT_SINGLE, eptp);
- break;
- case 6:
- if (!invept_test(0, eptp))
- vmx_inc_test_stage();
- break;
- // Should not reach here
- default:
- report("ERROR - unexpected stage, %d.", false,
- vmx_get_test_stage());
- print_vmexit_info();
- return VMX_TEST_VMEXIT;
- }
- vmcs_write(GUEST_RIP, guest_rip + insn_len);
- return VMX_TEST_RESUME;
- case VMX_EPT_MISCONFIG:
- switch (vmx_get_test_stage()) {
- case 1:
- case 2:
- vmx_inc_test_stage();
- install_ept(pml4, (unsigned long)data_page1,
- (unsigned long)data_page1,
- EPT_RA | EPT_WA | EPT_EA);
- ept_sync(INVEPT_SINGLE, eptp);
- break;
- // Should not reach here
- default:
- report("ERROR - unexpected stage, %d.", false,
- vmx_get_test_stage());
- print_vmexit_info();
- return VMX_TEST_VMEXIT;
- }
- return VMX_TEST_RESUME;
- case VMX_EPT_VIOLATION:
- switch(vmx_get_test_stage()) {
- case 3:
- check_ept_ad(pml4, guest_cr3, (unsigned long)data_page1, 0,
- have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0);
- clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1);
- if (exit_qual == (EPT_VLT_WR | EPT_VLT_LADDR_VLD |
- EPT_VLT_PADDR))
- vmx_inc_test_stage();
- set_ept_pte(pml4, (unsigned long)data_page1,
- 1, data_page1_pte | (EPT_PRESENT));
- ept_sync(INVEPT_SINGLE, eptp);
- break;
- case 4:
- check_ept_ad(pml4, guest_cr3, (unsigned long)data_page1, 0,
- have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0);
- clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1);
- if (exit_qual == (EPT_VLT_RD |
- (have_ad ? EPT_VLT_WR : 0) |
- EPT_VLT_LADDR_VLD))
- vmx_inc_test_stage();
- set_ept_pte(pml4, data_page1_pte, 2,
- data_page1_pte_pte | (EPT_PRESENT));
- ept_sync(INVEPT_SINGLE, eptp);
- break;
- default:
- // Should not reach here
- report("ERROR : unexpected stage, %d", false,
- vmx_get_test_stage());
- print_vmexit_info();
- return VMX_TEST_VMEXIT;
- }
- return VMX_TEST_RESUME;
- default:
- report("Unknown exit reason, %ld", false, reason);
- print_vmexit_info();
- }
- return VMX_TEST_VMEXIT;
- }
- static int ept_exit_handler()
- {
- return ept_exit_handler_common(false);
- }
- static int eptad_init()
- {
- int r = ept_init_common(true);
- if (r == VMX_TEST_EXIT)
- return r;
- if ((rdmsr(MSR_IA32_VMX_EPT_VPID_CAP) & EPT_CAP_AD_FLAG) == 0) {
- printf("\tEPT A/D bits are not supported");
- return VMX_TEST_EXIT;
- }
- return r;
- }
- static int pml_init()
- {
- u32 ctrl_cpu;
- int r = eptad_init();
- if (r == VMX_TEST_EXIT)
- return r;
- if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) ||
- !(ctrl_cpu_rev[1].clr & CPU_PML)) {
- printf("\tPML is not supported");
- return VMX_TEST_EXIT;
- }
- pml_log = alloc_page();
- memset(pml_log, 0x0, PAGE_SIZE);
- vmcs_write(PMLADDR, (u64)pml_log);
- vmcs_write(GUEST_PML_INDEX, PML_INDEX - 1);
- ctrl_cpu = vmcs_read(CPU_EXEC_CTRL1) | CPU_PML;
- vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu);
- return VMX_TEST_START;
- }
- static void pml_main()
- {
- int count = 0;
- vmx_set_test_stage(0);
- *((u32 *)data_page2) = 0x1;
- vmcall();
- report("PML - Dirty GPA Logging", vmx_get_test_stage() == 1);
- while (vmx_get_test_stage() == 1) {
- vmcall();
- *((u32 *)data_page2) = 0x1;
- if (count++ > PML_INDEX)
- break;
- }
- report("PML Full Event", vmx_get_test_stage() == 2);
- }
- static void eptad_main()
- {
- ept_common();
- }
- static int eptad_exit_handler()
- {
- return ept_exit_handler_common(true);
- }
- bool invvpid_test(int type, u16 vpid)
- {
- bool ret, supported;
- supported = ept_vpid.val &
- (VPID_CAP_INVVPID_ADDR >> INVVPID_ADDR << type);
- ret = invvpid(type, vpid, 0);
- if (ret == !supported)
- return false;
- if (!supported)
- printf("WARNING: unsupported invvpid passed!\n");
- else
- printf("WARNING: invvpid failed!\n");
- return true;
- }
- static int vpid_init()
- {
- u32 ctrl_cpu1;
- if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) ||
- !(ctrl_cpu_rev[1].clr & CPU_VPID)) {
- printf("\tVPID is not supported");
- return VMX_TEST_EXIT;
- }
- ctrl_cpu1 = vmcs_read(CPU_EXEC_CTRL1);
- ctrl_cpu1 |= CPU_VPID;
- vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu1);
- return VMX_TEST_START;
- }
- static void vpid_main()
- {
- vmx_set_test_stage(0);
- vmcall();
- report("INVVPID SINGLE ADDRESS", vmx_get_test_stage() == 1);
- vmx_set_test_stage(2);
- vmcall();
- report("INVVPID SINGLE", vmx_get_test_stage() == 3);
- vmx_set_test_stage(4);
- vmcall();
- report("INVVPID ALL", vmx_get_test_stage() == 5);
- }
- static int vpid_exit_handler()
- {
- u64 guest_rip;
- ulong reason;
- u32 insn_len;
- guest_rip = vmcs_read(GUEST_RIP);
- reason = vmcs_read(EXI_REASON) & 0xff;
- insn_len = vmcs_read(EXI_INST_LEN);
- switch (reason) {
- case VMX_VMCALL:
- switch(vmx_get_test_stage()) {
- case 0:
- if (!invvpid_test(INVVPID_ADDR, 1))
- vmx_inc_test_stage();
- break;
- case 2:
- if (!invvpid_test(INVVPID_CONTEXT_GLOBAL, 1))
- vmx_inc_test_stage();
- break;
- case 4:
- if (!invvpid_test(INVVPID_ALL, 1))
- vmx_inc_test_stage();
- break;
- default:
- report("ERROR: unexpected stage, %d", false,
- vmx_get_test_stage());
- print_vmexit_info();
- return VMX_TEST_VMEXIT;
- }
- vmcs_write(GUEST_RIP, guest_rip + insn_len);
- return VMX_TEST_RESUME;
- default:
- report("Unknown exit reason, %ld", false, reason);
- print_vmexit_info();
- }
- return VMX_TEST_VMEXIT;
- }
- #define TIMER_VECTOR 222
- static volatile bool timer_fired;
- static void timer_isr(isr_regs_t *regs)
- {
- timer_fired = true;
- apic_write(APIC_EOI, 0);
- }
- static int interrupt_init(struct vmcs *vmcs)
- {
- msr_bmp_init();
- vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_EXTINT);
- handle_irq(TIMER_VECTOR, timer_isr);
- return VMX_TEST_START;
- }
- static void interrupt_main(void)
- {
- long long start, loops;
- vmx_set_test_stage(0);
- apic_write(APIC_LVTT, TIMER_VECTOR);
- irq_enable();
- apic_write(APIC_TMICT, 1);
- for (loops = 0; loops < 10000000 && !timer_fired; loops++)
- asm volatile ("nop");
- report("direct interrupt while running guest", timer_fired);
- apic_write(APIC_TMICT, 0);
- irq_disable();
- vmcall();
- timer_fired = false;
- apic_write(APIC_TMICT, 1);
- for (loops = 0; loops < 10000000 && !timer_fired; loops++)
- asm volatile ("nop");
- report("intercepted interrupt while running guest", timer_fired);
- irq_enable();
- apic_write(APIC_TMICT, 0);
- irq_disable();
- vmcall();
- timer_fired = false;
- start = rdtsc();
- apic_write(APIC_TMICT, 1000000);
- asm volatile ("sti; hlt");
- report("direct interrupt + hlt",
- rdtsc() - start > 1000000 && timer_fired);
- apic_write(APIC_TMICT, 0);
- irq_disable();
- vmcall();
- timer_fired = false;
- start = rdtsc();
- apic_write(APIC_TMICT, 1000000);
- asm volatile ("sti; hlt");
- report("intercepted interrupt + hlt",
- rdtsc() - start > 10000 && timer_fired);
- apic_write(APIC_TMICT, 0);
- irq_disable();
- vmcall();
- timer_fired = false;
- start = rdtsc();
- apic_write(APIC_TMICT, 1000000);
- irq_enable();
- asm volatile ("nop");
- vmcall();
- report("direct interrupt + activity state hlt",
- rdtsc() - start > 10000 && timer_fired);
- apic_write(APIC_TMICT, 0);
- irq_disable();
- vmcall();
- timer_fired = false;
- start = rdtsc();
- apic_write(APIC_TMICT, 1000000);
- irq_enable();
- asm volatile ("nop");
- vmcall();
- report("intercepted interrupt + activity state hlt",
- rdtsc() - start > 10000 && timer_fired);
- apic_write(APIC_TMICT, 0);
- irq_disable();
- vmx_set_test_stage(7);
- vmcall();
- timer_fired = false;
- apic_write(APIC_TMICT, 1);
- for (loops = 0; loops < 10000000 && !timer_fired; loops++)
- asm volatile ("nop");
- report("running a guest with interrupt acknowledgement set", timer_fired);
- }
- static int interrupt_exit_handler(void)
- {
- u64 guest_rip = vmcs_read(GUEST_RIP);
- ulong reason = vmcs_read(EXI_REASON) & 0xff;
- u32 insn_len = vmcs_read(EXI_INST_LEN);
- switch (reason) {
- case VMX_VMCALL:
- switch (vmx_get_test_stage()) {
- case 0:
- case 2:
- case 5:
- vmcs_write(PIN_CONTROLS,
- vmcs_read(PIN_CONTROLS) | PIN_EXTINT);
- break;
- case 7:
- vmcs_write(EXI_CONTROLS, vmcs_read(EXI_CONTROLS) | EXI_INTA);
- vmcs_write(PIN_CONTROLS,
- vmcs_read(PIN_CONTROLS) | PIN_EXTINT);
- break;
- case 1:
- case 3:
- vmcs_write(PIN_CONTROLS,
- vmcs_read(PIN_CONTROLS) & ~PIN_EXTINT);
- break;
- case 4:
- case 6:
- vmcs_write(GUEST_ACTV_STATE, ACTV_HLT);
- break;
- }
- vmx_inc_test_stage();
- vmcs_write(GUEST_RIP, guest_rip + insn_len);
- return VMX_TEST_RESUME;
- case VMX_EXTINT:
- if (vmcs_read(EXI_CONTROLS) & EXI_INTA) {
- int vector = vmcs_read(EXI_INTR_INFO) & 0xff;
- handle_external_interrupt(vector);
- } else {
- irq_enable();
- asm volatile ("nop");
- irq_disable();
- }
- if (vmx_get_test_stage() >= 2)
- vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE);
- return VMX_TEST_RESUME;
- default:
- report("Unknown exit reason, %ld", false, reason);
- print_vmexit_info();
- }
- return VMX_TEST_VMEXIT;
- }
- static int dbgctls_init(struct vmcs *vmcs)
- {
- u64 dr7 = 0x402;
- u64 zero = 0;
- msr_bmp_init();
- asm volatile(
- "mov %0,%%dr0\n\t"
- "mov %0,%%dr1\n\t"
- "mov %0,%%dr2\n\t"
- "mov %1,%%dr7\n\t"
- : : "r" (zero), "r" (dr7));
- wrmsr(MSR_IA32_DEBUGCTLMSR, 0x1);
- vmcs_write(GUEST_DR7, 0x404);
- vmcs_write(GUEST_DEBUGCTL, 0x2);
- vmcs_write(ENT_CONTROLS, vmcs_read(ENT_CONTROLS) | ENT_LOAD_DBGCTLS);
- vmcs_write(EXI_CONTROLS, vmcs_read(EXI_CONTROLS) | EXI_SAVE_DBGCTLS);
- return VMX_TEST_START;
- }
- static void dbgctls_main(void)
- {
- u64 dr7, debugctl;
- asm volatile("mov %%dr7,%0" : "=r" (dr7));
- debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
- /* Commented out: KVM does not support DEBUGCTL so far */
- (void)debugctl;
- report("Load debug controls", dr7 == 0x404 /* && debugctl == 0x2 */);
- dr7 = 0x408;
- asm volatile("mov %0,%%dr7" : : "r" (dr7));
- wrmsr(MSR_IA32_DEBUGCTLMSR, 0x3);
- vmx_set_test_stage(0);
- vmcall();
- report("Save debug controls", vmx_get_test_stage() == 1);
- if (ctrl_enter_rev.set & ENT_LOAD_DBGCTLS ||
- ctrl_exit_rev.set & EXI_SAVE_DBGCTLS) {
- printf("\tDebug controls are always loaded/saved\n");
- return;
- }
- vmx_set_test_stage(2);
- vmcall();
- asm volatile("mov %%dr7,%0" : "=r" (dr7));
- debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
- /* Commented out: KVM does not support DEBUGCTL so far */
- (void)debugctl;
- report("Guest=host debug controls", dr7 == 0x402 /* && debugctl == 0x1 */);
- dr7 = 0x408;
- asm volatile("mov %0,%%dr7" : : "r" (dr7));
- wrmsr(MSR_IA32_DEBUGCTLMSR, 0x3);
- vmx_set_test_stage(3);
- vmcall();
- report("Don't save debug controls", vmx_get_test_stage() == 4);
- }
- static int dbgctls_exit_handler(void)
- {
- unsigned int reason = vmcs_read(EXI_REASON) & 0xff;
- u32 insn_len = vmcs_read(EXI_INST_LEN);
- u64 guest_rip = vmcs_read(GUEST_RIP);
- u64 dr7, debugctl;
- asm volatile("mov %%dr7,%0" : "=r" (dr7));
- debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
- switch (reason) {
- case VMX_VMCALL:
- switch (vmx_get_test_stage()) {
- case 0:
- if (dr7 == 0x400 && debugctl == 0 &&
- vmcs_read(GUEST_DR7) == 0x408 /* &&
- Commented out: KVM does not support DEBUGCTL so far
- vmcs_read(GUEST_DEBUGCTL) == 0x3 */)
- vmx_inc_test_stage();
- break;
- case 2:
- dr7 = 0x402;
- asm volatile("mov %0,%%dr7" : : "r" (dr7));
- wrmsr(MSR_IA32_DEBUGCTLMSR, 0x1);
- vmcs_write(GUEST_DR7, 0x404);
- vmcs_write(GUEST_DEBUGCTL, 0x2);
- vmcs_write(ENT_CONTROLS,
- vmcs_read(ENT_CONTROLS) & ~ENT_LOAD_DBGCTLS);
- vmcs_write(EXI_CONTROLS,
- vmcs_read(EXI_CONTROLS) & ~EXI_SAVE_DBGCTLS);
- break;
- case 3:
- if (dr7 == 0x400 && debugctl == 0 &&
- vmcs_read(GUEST_DR7) == 0x404 /* &&
- Commented out: KVM does not support DEBUGCTL so far
- vmcs_read(GUEST_DEBUGCTL) == 0x2 */)
- vmx_inc_test_stage();
- break;
- }
- vmcs_write(GUEST_RIP, guest_rip + insn_len);
- return VMX_TEST_RESUME;
- default:
- report("Unknown exit reason, %d", false, reason);
- print_vmexit_info();
- }
- return VMX_TEST_VMEXIT;
- }
- struct vmx_msr_entry {
- u32 index;
- u32 reserved;
- u64 value;
- } __attribute__((packed));
- #define MSR_MAGIC 0x31415926
- struct vmx_msr_entry *exit_msr_store, *entry_msr_load, *exit_msr_load;
- static int msr_switch_init(struct vmcs *vmcs)
- {
- msr_bmp_init();
- exit_msr_store = alloc_page();
- exit_msr_load = alloc_page();
- entry_msr_load = alloc_page();
- memset(exit_msr_store, 0, PAGE_SIZE);
- memset(exit_msr_load, 0, PAGE_SIZE);
- memset(entry_msr_load, 0, PAGE_SIZE);
- entry_msr_load[0].index = MSR_KERNEL_GS_BASE;
- entry_msr_load[0].value = MSR_MAGIC;
- vmx_set_test_stage(1);
- vmcs_write(ENT_MSR_LD_CNT, 1);
- vmcs_write(ENTER_MSR_LD_ADDR, (u64)entry_msr_load);
- vmcs_write(EXI_MSR_ST_CNT, 1);
- vmcs_write(EXIT_MSR_ST_ADDR, (u64)exit_msr_store);
- vmcs_write(EXI_MSR_LD_CNT, 1);
- vmcs_write(EXIT_MSR_LD_ADDR, (u64)exit_msr_load);
- return VMX_TEST_START;
- }
- static void msr_switch_main()
- {
- if (vmx_get_test_stage() == 1) {
- report("VM entry MSR load",
- rdmsr(MSR_KERNEL_GS_BASE) == MSR_MAGIC);
- vmx_set_test_stage(2);
- wrmsr(MSR_KERNEL_GS_BASE, MSR_MAGIC + 1);
- exit_msr_store[0].index = MSR_KERNEL_GS_BASE;
- exit_msr_load[0].index = MSR_KERNEL_GS_BASE;
- exit_msr_load[0].value = MSR_MAGIC + 2;
- }
- vmcall();
- }
- static int msr_switch_exit_handler()
- {
- ulong reason;
- reason = vmcs_read(EXI_REASON);
- if (reason == VMX_VMCALL && vmx_get_test_stage() == 2) {
- report("VM exit MSR store",
- exit_msr_store[0].value == MSR_MAGIC + 1);
- report("VM exit MSR load",
- rdmsr(MSR_KERNEL_GS_BASE) == MSR_MAGIC + 2);
- vmx_set_test_stage(3);
- entry_msr_load[0].index = MSR_FS_BASE;
- return VMX_TEST_RESUME;
- }
- printf("ERROR %s: unexpected stage=%u or reason=%lu\n",
- __func__, vmx_get_test_stage(), reason);
- return VMX_TEST_EXIT;
- }
- static int msr_switch_entry_failure(struct vmentry_failure *failure)
- {
- ulong reason;
- if (failure->early) {
- printf("ERROR %s: early exit\n", __func__);
- return VMX_TEST_EXIT;
- }
- reason = vmcs_read(EXI_REASON);
- if (reason == (VMX_ENTRY_FAILURE | VMX_FAIL_MSR) &&
- vmx_get_test_stage() == 3) {
- report("VM entry MSR load: try to load FS_BASE",
- vmcs_read(EXI_QUALIFICATION) == 1);
- return VMX_TEST_VMEXIT;
- }
- printf("ERROR %s: unexpected stage=%u or reason=%lu\n",
- __func__, vmx_get_test_stage(), reason);
- return VMX_TEST_EXIT;
- }
- static int vmmcall_init(struct vmcs *vmcs )
- {
- vmcs_write(EXC_BITMAP, 1 << UD_VECTOR);
- return VMX_TEST_START;
- }
- static void vmmcall_main(void)
- {
- asm volatile(
- "mov $0xABCD, %%rax\n\t"
- "vmmcall\n\t"
- ::: "rax");
- report("VMMCALL", 0);
- }
- static int vmmcall_exit_handler()
- {
- ulong reason;
- reason = vmcs_read(EXI_REASON);
- switch (reason) {
- case VMX_VMCALL:
- printf("here\n");
- report("VMMCALL triggers #UD", 0);
- break;
- case VMX_EXC_NMI:
- report("VMMCALL triggers #UD",
- (vmcs_read(EXI_INTR_INFO) & 0xff) == UD_VECTOR);
- break;
- default:
- report("Unknown exit reason, %ld", false, reason);
- print_vmexit_info();
- }
- return VMX_TEST_VMEXIT;
- }
- static int disable_rdtscp_init(struct vmcs *vmcs)
- {
- u32 ctrl_cpu1;
- if (ctrl_cpu_rev[0].clr & CPU_SECONDARY) {
- ctrl_cpu1 = vmcs_read(CPU_EXEC_CTRL1);
- ctrl_cpu1 &= ~CPU_RDTSCP;
- vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu1);
- }
- return VMX_TEST_START;
- }
- static void disable_rdtscp_ud_handler(struct ex_regs *regs)
- {
- switch (vmx_get_test_stage()) {
- case 0:
- report("RDTSCP triggers #UD", true);
- vmx_inc_test_stage();
- regs->rip += 3;
- break;
- case 2:
- report("RDPID triggers #UD", true);
- vmx_inc_test_stage();
- regs->rip += 4;
- break;
- }
- return;
- }
- static void disable_rdtscp_main(void)
- {
- /* Test that #UD is properly injected in L2. */
- handle_exception(UD_VECTOR, disable_rdtscp_ud_handler);
- vmx_set_test_stage(0);
- asm volatile("rdtscp" : : : "eax", "ecx", "edx");
- vmcall();
- asm volatile(".byte 0xf3, 0x0f, 0xc7, 0xf8" : : : "eax");
- vmcall();
- }
- static int disable_rdtscp_exit_handler(void)
- {
- unsigned int reason = vmcs_read(EXI_REASON) & 0xff;
- switch (reason) {
- case VMX_VMCALL:
- switch (vmx_get_test_stage()) {
- case 0:
- report("RDTSCP triggers #UD", false);
- vmx_inc_test_stage();
- /* fallthrough */
- case 1:
- vmx_inc_test_stage();
- vmcs_write(GUEST_RIP, vmcs_read(GUEST_RIP) + 3);
- return VMX_TEST_RESUME;
- case 2:
- report("RDPID triggers #UD", false);
- break;
- }
- break;
- default:
- report("Unknown exit reason, %d", false, reason);
- print_vmexit_info();
- }
- return VMX_TEST_VMEXIT;
- }
- int int3_init()
- {
- vmcs_write(EXC_BITMAP, ~0u);
- return VMX_TEST_START;
- }
- void int3_guest_main()
- {
- asm volatile ("int3");
- }
- int int3_exit_handler()
- {
- u32 reason = vmcs_read(EXI_REASON);
- u32 intr_info = vmcs_read(EXI_INTR_INFO);
- report("L1 intercepts #BP", reason == VMX_EXC_NMI &&
- (intr_info & INTR_INFO_VALID_MASK) &&
- (intr_info & INTR_INFO_VECTOR_MASK) == BP_VECTOR &&
- ((intr_info & INTR_INFO_INTR_TYPE_MASK) >>
- INTR_INFO_INTR_TYPE_SHIFT) == VMX_INTR_TYPE_SOFT_EXCEPTION);
- return VMX_TEST_VMEXIT;
- }
- int into_init()
- {
- vmcs_write(EXC_BITMAP, ~0u);
- return VMX_TEST_START;
- }
- void into_guest_main()
- {
- struct far_pointer32 fp = {
- .offset = (uintptr_t)&&into,
- .selector = KERNEL_CS32,
- };
- register uintptr_t rsp asm("rsp");
- if (fp.offset != (uintptr_t)&&into) {
- printf("Code address too high.\n");
- return;
- }
- if ((u32)rsp != rsp) {
- printf("Stack address too high.\n");
- return;
- }
- asm goto ("lcall *%0" : : "m" (fp) : "rax" : into);
- return;
- into:
- asm volatile (".code32;"
- "movl $0x7fffffff, %eax;"
- "addl %eax, %eax;"
- "into;"
- "lret;"
- ".code64");
- __builtin_unreachable();
- }
- int into_exit_handler()
- {
- u32 reason = vmcs_read(EXI_REASON);
- u32 intr_info = vmcs_read(EXI_INTR_INFO);
- report("L1 intercepts #OF", reason == VMX_EXC_NMI &&
- (intr_info & INTR_INFO_VALID_MASK) &&
- (intr_info & INTR_INFO_VECTOR_MASK) == OF_VECTOR &&
- ((intr_info & INTR_INFO_INTR_TYPE_MASK) >>
- INTR_INFO_INTR_TYPE_SHIFT) == VMX_INTR_TYPE_SOFT_EXCEPTION);
- return VMX_TEST_VMEXIT;
- }
- static void exit_monitor_from_l2_main(void)
- {
- printf("Calling exit(0) from l2...\n");
- exit(0);
- }
- static int exit_monitor_from_l2_handler(void)
- {
- report("The guest should have killed the VMM", false);
- return VMX_TEST_EXIT;
- }
- static void assert_exit_reason(u64 expected)
- {
- u64 actual = vmcs_read(EXI_REASON);
- TEST_ASSERT_EQ_MSG(expected, actual, "Expected %s, got %s.",
- exit_reason_description(expected),
- exit_reason_description(actual));
- }
- static void skip_exit_vmcall()
- {
- u64 guest_rip = vmcs_read(GUEST_RIP);
- u32 insn_len = vmcs_read(EXI_INST_LEN);
- assert_exit_reason(VMX_VMCALL);
- vmcs_write(GUEST_RIP, guest_rip + insn_len);
- }
- static void v2_null_test_guest(void)
- {
- }
- static void v2_null_test(void)
- {
- test_set_guest(v2_null_test_guest);
- enter_guest();
- report(__func__, 1);
- }
- static void v2_multiple_entries_test_guest(void)
- {
- vmx_set_test_stage(1);
- vmcall();
- vmx_set_test_stage(2);
- }
- static void v2_multiple_entries_test(void)
- {
- test_set_guest(v2_multiple_entries_test_guest);
- enter_guest();
- TEST_ASSERT_EQ(vmx_get_test_stage(), 1);
- skip_exit_vmcall();
- enter_guest();
- TEST_ASSERT_EQ(vmx_get_test_stage(), 2);
- report(__func__, 1);
- }
- static int fixture_test_data = 1;
- static void fixture_test_teardown(void *data)
- {
- *((int *) data) = 1;
- }
- static void fixture_test_guest(void)
- {
- fixture_test_data++;
- }
- static void fixture_test_setup(void)
- {
- TEST_ASSERT_EQ_MSG(1, fixture_test_data,
- "fixture_test_teardown didn't run?!");
- fixture_test_data = 2;
- test_add_teardown(fixture_test_teardown, &fixture_test_data);
- test_set_guest(fixture_test_guest);
- }
- static void fixture_test_case1(void)
- {
- fixture_test_setup();
- TEST_ASSERT_EQ(2, fixture_test_data);
- enter_guest();
- TEST_ASSERT_EQ(3, fixture_test_data);
- report(__func__, 1);
- }
- static void fixture_test_case2(void)
- {
- fixture_test_setup();
- TEST_ASSERT_EQ(2, fixture_test_data);
- enter_guest();
- TEST_ASSERT_EQ(3, fixture_test_data);
- report(__func__, 1);
- }
- enum ept_access_op {
- OP_READ,
- OP_WRITE,
- OP_EXEC,
- OP_FLUSH_TLB,
- OP_EXIT,
- };
- static struct ept_access_test_data {
- unsigned long gpa;
- unsigned long *gva;
- unsigned long hpa;
- unsigned long *hva;
- enum ept_access_op op;
- } ept_access_test_data;
- extern unsigned char ret42_start;
- extern unsigned char ret42_end;
- /* Returns 42. */
- asm(
- ".align 64\n"
- "ret42_start:\n"
- "mov $42, %eax\n"
- "ret\n"
- "ret42_end:\n"
- );
- static void
- diagnose_ept_violation_qual(u64 expected, u64 actual)
- {
- #define DIAGNOSE(flag) \
- do { \
- if ((expected & flag) != (actual & flag)) \
- printf(#flag " %sexpected\n", \
- (expected & flag) ? "" : "un"); \
- } while (0)
- DIAGNOSE(EPT_VLT_RD);
- DIAGNOSE(EPT_VLT_WR);
- DIAGNOSE(EPT_VLT_FETCH);
- DIAGNOSE(EPT_VLT_PERM_RD);
- DIAGNOSE(EPT_VLT_PERM_WR);
- DIAGNOSE(EPT_VLT_PERM_EX);
- DIAGNOSE(EPT_VLT_LADDR_VLD);
- DIAGNOSE(EPT_VLT_PADDR);
- #undef DIAGNOSE
- }
- static void do_ept_access_op(enum ept_access_op op)
- {
- ept_access_test_data.op = op;
- enter_guest();
- }
- /*
- * Force the guest to flush its TLB (i.e., flush gva -> gpa mappings). Only
- * needed by tests that modify guest PTEs.
- */
- static void ept_access_test_guest_flush_tlb(void)
- {
- do_ept_access_op(OP_FLUSH_TLB);
- skip_exit_vmcall();
- }
- /*
- * Modifies the EPT entry at @level in the mapping of @gpa. First clears the
- * bits in @clear then sets the bits in @set. @mkhuge transforms the entry into
- * a huge page.
- */
- static unsigned long ept_twiddle(unsigned long gpa, bool mkhuge, int level,
- unsigned long clear, unsigned long set)
- {
- struct ept_access_test_data *data = &ept_access_test_data;
- unsigned long orig_pte;
- unsigned long pte;
- /* Screw with the mapping at the requested level. */
- TEST_ASSERT(get_ept_pte(pml4, gpa, level, &orig_pte));
- pte = orig_pte;
- if (mkhuge)
- pte = (orig_pte & ~EPT_ADDR_MASK) | data->hpa | EPT_LARGE_PAGE;
- else
- pte = orig_pte;
- pte = (pte & ~clear) | set;
- set_ept_pte(pml4, gpa, level, pte);
- ept_sync(INVEPT_SINGLE, eptp);
- return orig_pte;
- }
- static void ept_untwiddle(unsigned long gpa, int level, unsigned long orig_pte)
- {
- set_ept_pte(pml4, gpa, level, orig_pte);
- }
- static void do_ept_violation(bool leaf, enum ept_access_op op,
- u64 expected_qual, u64 expected_paddr)
- {
- u64 qual;
- /* Try the access and observe the violation. */
- do_ept_access_op(op);
- assert_exit_reason(VMX_EPT_VIOLATION);
- qual = vmcs_read(EXI_QUALIFICATION);
- diagnose_ept_violation_qual(expected_qual, qual);
- TEST_EXPECT_EQ(expected_qual, qual);
- #if 0
- /* Disable for now otherwise every test will fail */
- TEST_EXPECT_EQ(vmcs_read(GUEST_LINEAR_ADDRESS),
- (unsigned long) (
- op == OP_EXEC ? data->gva + 1 : data->gva));
- #endif
- /*
- * TODO: tests that probe expected_paddr in pages other than the one at
- * the beginning of the 1g region.
- */
- TEST_EXPECT_EQ(vmcs_read(INFO_PHYS_ADDR), expected_paddr);
- }
- static void
- ept_violation_at_level_mkhuge(bool mkhuge, int level, unsigned long clear,
- unsigned long set, enum ept_access_op op,
- u64 expected_qual)
- {
- struct ept_access_test_data *data = &ept_access_test_data;
- unsigned long orig_pte;
- orig_pte = ept_twiddle(data->gpa, mkhuge, level, clear, set);
- do_ept_violation(level == 1 || mkhuge, op, expected_qual,
- op == OP_EXEC ? data->gpa + sizeof(unsigned long) :
- data->gpa);
- /* Fix the violation and resume the op loop. */
- ept_untwiddle(data->gpa, level, orig_pte);
- enter_guest();
- skip_exit_vmcall();
- }
- static void
- ept_violation_at_level(int level, unsigned long clear, unsigned long set,
- enum ept_access_op op, u64 expected_qual)
- {
- ept_violation_at_level_mkhuge(false, level, clear, set, op,
- expected_qual);
- if (ept_huge_pages_supported(level))
- ept_violation_at_level_mkhuge(true, level, clear, set, op,
- expected_qual);
- }
- static void ept_violation(unsigned long clear, unsigned long set,
- enum ept_access_op op, u64 expected_qual)
- {
- ept_violation_at_level(1, clear, set, op, expected_qual);
- ept_violation_at_level(2, clear, set, op, expected_qual);
- ept_violation_at_level(3, clear, set, op, expected_qual);
- ept_violation_at_level(4, clear, set, op, expected_qual);
- }
- static void ept_access_violation(unsigned long access, enum ept_access_op op,
- u64 expected_qual)
- {
- ept_violation(EPT_PRESENT, access, op,
- expected_qual | EPT_VLT_LADDR_VLD | EPT_VLT_PADDR);
- }
- /*
- * For translations that don't involve a GVA, that is physical address (paddr)
- * accesses, EPT violations don't set the flag EPT_VLT_PADDR. For a typical
- * guest memory access, the hardware does GVA -> GPA -> HPA. However, certain
- * translations don't involve GVAs, such as when the hardware does the guest
- * page table walk. For example, in translating GVA_1 -> GPA_1, the guest MMU
- * might try to set an A bit on a guest PTE. If the GPA_2 that the PTE resides
- * on isn't present in the EPT, then the EPT violation will be for GPA_2 and
- * the EPT_VLT_PADDR bit will be clear in the exit qualification.
- *
- * Note that paddr violations can also be triggered by loading PAE page tables
- * with wonky addresses. We don't test that yet.
- *
- * This function modifies the EPT entry that maps the GPA that the guest page
- * table entry mapping ept_access_data.gva resides on.
- *
- * @ept_access EPT permissions to set. Other permissions are cleared.
- *
- * @pte_ad Set the A/D bits on the guest PTE accordingly.
- *
- * @op Guest operation to perform with ept_access_data.gva.
- *
- * @expect_violation
- * Is a violation expected during the paddr access?
- *
- * @expected_qual Expected qualification for the EPT violation.
- * EPT_VLT_PADDR should be clear.
- */
- static void ept_access_paddr(unsigned long ept_access, unsigned long pte_ad,
- enum ept_access_op op, bool expect_violation,
- u64 expected_qual)
- {
- struct ept_access_test_data *data = &ept_access_test_data;
- unsigned long *ptep;
- unsigned long gpa;
- unsigned long orig_epte;
- /* Modify the guest PTE mapping data->gva according to @pte_ad. */
- ptep = get_pte_level(current_page_table(), data->gva, /*level=*/1);
- TEST_ASSERT(ptep);
- TEST_ASSERT_EQ(*ptep & PT_ADDR_MASK, data->gpa);
- *ptep = (*ptep & ~PT_AD_MASK) | pte_ad;
- ept_access_test_guest_flush_tlb();
- /*
- * Now modify the access bits on the EPT entry for the GPA that the
- * guest PTE resides on. Note that by modifying a single EPT entry,
- * we're potentially affecting 512 guest PTEs. However, we've carefully
- * constructed our test such that those other 511 PTEs aren't used by
- * the guest: data->gva is at the beginning of a 1G huge page, thus the
- * PTE we're modifying is at the beginning of a 4K page and the
- * following 511 entires are also under our control (and not touched by
- * the guest).
- */
- gpa = virt_to_phys(ptep);
- TEST_ASSERT_EQ(gpa & ~PAGE_MASK, 0);
- /*
- * Make sure the guest page table page is mapped with a 4K EPT entry,
- * otherwise our level=1 twiddling below will fail. We use the
- * identity map (gpa = gpa) since page tables are shared with the host.
- */
- install_ept(pml4, gpa, gpa, EPT_PRESENT);
- orig_epte = ept_twiddle(gpa, /*mkhuge=*/0, /*level=*/1,
- /*clear=*/EPT_PRESENT, /*set=*/ept_access);
- if (expect_violation) {
- do_ept_violation(/*leaf=*/true, op,
- expected_qual | EPT_VLT_LADDR_VLD, gpa);
- ept_untwiddle(gpa, /*level=*/1, orig_epte);
- do_ept_access_op(op);
- } else {
- do_ept_access_op(op);
- ept_untwiddle(gpa, /*level=*/1, orig_epte);
- }
- TEST_ASSERT(*ptep & PT_ACCESSED_MASK);
- if ((pte_ad & PT_DIRTY_MASK) || op == OP_WRITE)
- TEST_ASSERT(*ptep & PT_DIRTY_MASK);
- skip_exit_vmcall();
- }
- static void ept_access_allowed_paddr(unsigned long ept_access,
- unsigned long pte_ad,
- enum ept_access_op op)
- {
- ept_access_paddr(ept_access, pte_ad, op, /*expect_violation=*/false,
- /*expected_qual=*/-1);
- }
- static void ept_access_violation_paddr(unsigned long ept_access,
- unsigned long pte_ad,
- enum ept_access_op op,
- u64 expected_qual)
- {
- ept_access_paddr(ept_access, pte_ad, op, /*expect_violation=*/true,
- expected_qual);
- }
- static void ept_allowed_at_level_mkhuge(bool mkhuge, int level,
- unsigned long clear,
- unsigned long set,
- enum ept_access_op op)
- {
- struct ept_access_test_data *data = &ept_access_test_data;
- unsigned long orig_pte;
- orig_pte = ept_twiddle(data->gpa, mkhuge, level, clear, set);
- /* No violation. Should proceed to vmcall. */
- do_ept_access_op(op);
- skip_exit_vmcall();
- ept_untwiddle(data->gpa, level, orig_pte);
- }
- static void ept_allowed_at_level(int level, unsigned long clear,
- unsigned long set, enum ept_access_op op)
- {
- ept_allowed_at_level_mkhuge(false, level, clear, set, op);
- if (ept_huge_pages_supported(level))
- ept_allowed_at_level_mkhuge(true, level, clear, set, op);
- }
- static void ept_allowed(unsigned long clear, unsigned long set,
- enum ept_access_op op)
- {
- ept_allowed_at_level(1, clear, set, op);
- ept_allowed_at_level(2, clear, set, op);
- ept_allowed_at_level(3, clear, set, op);
- ept_allowed_at_level(4, clear, set, op);
- }
- static void ept_ignored_bit(int bit)
- {
- /* Set the bit. */
- ept_allowed(0, 1ul << bit, OP_READ);
- ept_allowed(0, 1ul << bit, OP_WRITE);
- ept_allowed(0, 1ul << bit, OP_EXEC);
- /* Clear the bit. */
- ept_allowed(1ul << bit, 0, OP_READ);
- ept_allowed(1ul << bit, 0, OP_WRITE);
- ept_allowed(1ul << bit, 0, OP_EXEC);
- }
- static void ept_access_allowed(unsigned long access, enum ept_access_op op)
- {
- ept_allowed(EPT_PRESENT, access, op);
- }
- static void ept_misconfig_at_level_mkhuge_op(bool mkhuge, int level,
- unsigned long clear,
- unsigned long set,
- enum ept_access_op op)
- {
- struct ept_access_test_data *data = &ept_access_test_data;
- unsigned long orig_pte;
- orig_pte = ept_twiddle(data->gpa, mkhuge, level, clear, set);
- do_ept_access_op(op);
- assert_exit_reason(VMX_EPT_MISCONFIG);
- /* Intel 27.2.1, "For all other VM exits, this field is cleared." */
- #if 0
- /* broken: */
- TEST_EXPECT_EQ_MSG(vmcs_read(EXI_QUALIFICATION), 0);
- #endif
- #if 0
- /*
- * broken:
- * According to description of exit qual for EPT violation,
- * EPT_VLT_LADDR_VLD indicates if GUEST_LINEAR_ADDRESS is valid.
- * However, I can't find anything that says GUEST_LINEAR_ADDRESS ought
- * to be set for msiconfig.
- */
- TEST_EXPECT_EQ(vmcs_read(GUEST_LINEAR_ADDRESS),
- (unsigned long) (
- op == OP_EXEC ? data->gva + 1 : data->gva));
- #endif
- /* Fix the violation and resume the op loop. */
- ept_untwiddle(data->gpa, level, orig_pte);
- enter_guest();
- skip_exit_vmcall();
- }
- static void ept_misconfig_at_level_mkhuge(bool mkhuge, int level,
- unsigned long clear,
- unsigned long set)
- {
- /* The op shouldn't matter (read, write, exec), so try them all! */
- ept_misconfig_at_level_mkhuge_op(mkhuge, level, clear, set, OP_READ);
- ept_misconfig_at_level_mkhuge_op(mkhuge, level, clear, set, OP_WRITE);
- ept_misconfig_at_level_mkhuge_op(mkhuge, level, clear, set, OP_EXEC);
- }
- static void ept_misconfig_at_level(int level, unsigned long clear,
- unsigned long set)
- {
- ept_misconfig_at_level_mkhuge(false, level, clear, set);
- if (ept_huge_pages_supported(level))
- ept_misconfig_at_level_mkhuge(true, level, clear, set);
- }
- static void ept_misconfig(unsigned long clear, unsigned long set)
- {
- ept_misconfig_at_level(1, clear, set);
- ept_misconfig_at_level(2, clear, set);
- ept_misconfig_at_level(3, clear, set);
- ept_misconfig_at_level(4, clear, set);
- }
- static void ept_access_misconfig(unsigned long access)
- {
- ept_misconfig(EPT_PRESENT, access);
- }
- static void ept_reserved_bit_at_level_nohuge(int level, int bit)
- {
- /* Setting the bit causes a misconfig. */
- ept_misconfig_at_level_mkhuge(false, level, 0, 1ul << bit);
- /* Making the entry non-present turns reserved bits into ignored. */
- ept_violation_at_level(level, EPT_PRESENT, 1ul << bit, OP_READ,
- EPT_VLT_RD | EPT_VLT_LADDR_VLD | EPT_VLT_PADDR);
- }
- static void ept_reserved_bit_at_level_huge(int level, int bit)
- {
- /* Setting the bit causes a misconfig. */
- ept_misconfig_at_level_mkhuge(true, level, 0, 1ul << bit);
- /* Making the entry non-present turns reserved bits into ignored. */
- ept_violation_at_level(level, EPT_PRESENT, 1ul << bit, OP_READ,
- EPT_VLT_RD | EPT_VLT_LADDR_VLD | EPT_VLT_PADDR);
- }
- static void ept_reserved_bit_at_level(int level, int bit)
- {
- /* Setting the bit causes a misconfig. */
- ept_misconfig_at_level(level, 0, 1ul << bit);
- /* Making the entry non-present turns reserved bits into ignored. */
- ept_violation_at_level(level, EPT_PRESENT, 1ul << bit, OP_READ,
- EPT_VLT_RD | EPT_VLT_LADDR_VLD | EPT_VLT_PADDR);
- }
- static void ept_reserved_bit(int bit)
- {
- ept_reserved_bit_at_level(1, bit);
- ept_reserved_bit_at_level(2, bit);
- ept_reserved_bit_at_level(3, bit);
- ept_reserved_bit_at_level(4, bit);
- }
- #define PAGE_2M_ORDER 9
- #define PAGE_1G_ORDER 18
- static void *get_1g_page(void)
- {
- static void *alloc;
- if (!alloc)
- alloc = alloc_pages(PAGE_1G_ORDER);
- return alloc;
- }
- static void ept_access_test_teardown(void *unused)
- {
- /* Exit the guest cleanly. */
- do_ept_access_op(OP_EXIT);
- }
- static void ept_access_test_guest(void)
- {
- struct ept_access_test_data *data = &ept_access_test_data;
- int (*code)(void) = (int (*)(void)) &data->gva[1];
- while (true) {
- switch (data->op) {
- case OP_READ:
- TEST_ASSERT_EQ(*data->gva, MAGIC_VAL_1);
- break;
- case OP_WRITE:
- *data->gva = MAGIC_VAL_2;
- TEST_ASSERT_EQ(*data->gva, MAGIC_VAL_2);
- *data->gva = MAGIC_VAL_1;
- break;
- case OP_EXEC:
- TEST_ASSERT_EQ(42, code());
- break;
- case OP_FLUSH_TLB:
- write_cr3(read_cr3());
- break;
- case OP_EXIT:
- return;
- default:
- TEST_ASSERT_MSG(false, "Unknown op %d", data->op);
- }
- vmcall();
- }
- }
- static void ept_access_test_setup(void)
- {
- struct ept_access_test_data *data = &ept_access_test_data;
- unsigned long npages = 1ul << PAGE_1G_ORDER;
- unsigned long size = npages * PAGE_SIZE;
- unsigned long *page_table = current_page_table();
- unsigned long pte;
- if (setup_ept(false))
- test_skip("EPT not supported");
- test_set_guest(ept_access_test_guest);
- test_add_teardown(ept_access_test_teardown, NULL);
- data->hva = get_1g_page();
- TEST_ASSERT(data->hva);
- data->hpa = virt_to_phys(data->hva);
- data->gpa = 1ul << 40;
- data->gva = (void *) ALIGN((unsigned long) alloc_vpages(npages * 2),
- size);
- TEST_ASSERT(!any_present_pages(page_table, data->gva, size));
- install_pages(page_table, data->gpa, size, data->gva);
- /*
- * Make sure nothing's mapped here so the tests that screw with the
- * pml4 entry don't inadvertently break something.
- */
- TEST_ASSERT(get_ept_pte(pml4, data->gpa, 4, &pte) && pte == 0);
- TEST_ASSERT(get_ept_pte(pml4, data->gpa + size - 1, 4, &pte) && pte == 0);
- install_ept(pml4, data->hpa, data->gpa, EPT_PRESENT);
- data->hva[0] = MAGIC_VAL_1;
- memcpy(&data->hva[1], &ret42_start, &ret42_end - &ret42_start);
- }
- static void ept_access_test_not_present(void)
- {
- ept_access_test_setup();
- /* --- */
- ept_access_violation(0, OP_READ, EPT_VLT_RD);
- ept_access_violation(0, OP_WRITE, EPT_VLT_WR);
- ept_access_violation(0, OP_EXEC, EPT_VLT_FETCH);
- }
- static void ept_access_test_read_only(void)
- {
- ept_access_test_setup();
- /* r-- */
- ept_access_allowed(EPT_RA, OP_READ);
- ept_access_violation(EPT_RA, OP_WRITE, EPT_VLT_WR | EPT_VLT_PERM_RD);
- ept_access_violation(EPT_RA, OP_EXEC, EPT_VLT_FETCH | EPT_VLT_PERM_RD);
- }
- static void ept_access_test_write_only(void)
- {
- ept_access_test_setup();
- /* -w- */
- ept_access_misconfig(EPT_WA);
- }
- static void ept_access_test_read_write(void)
- {
- ept_access_test_setup();
- /* rw- */
- ept_access_allowed(EPT_RA | EPT_WA, OP_READ);
- ept_access_allowed(EPT_RA | EPT_WA, OP_WRITE);
- ept_access_violation(EPT_RA | EPT_WA, OP_EXEC,
- EPT_VLT_FETCH | EPT_VLT_PERM_RD | EPT_VLT_PERM_WR);
- }
- static void ept_access_test_execute_only(void)
- {
- ept_access_test_setup();
- /* --x */
- if (ept_execute_only_supported()) {
- ept_access_violation(EPT_EA, OP_READ,
- EPT_VLT_RD | EPT_VLT_PERM_EX);
- ept_access_violation(EPT_EA, OP_WRITE,
- EPT_VLT_WR | EPT_VLT_PERM_EX);
- ept_access_allowed(EPT_EA, OP_EXEC);
- } else {
- ept_access_misconfig(EPT_EA);
- }
- }
- static void ept_access_test_read_execute(void)
- {
- ept_access_test_setup();
- /* r-x */
- ept_access_allowed(EPT_RA | EPT_EA, OP_READ);
- ept_access_violation(EPT_RA | EPT_EA, OP_WRITE,
- EPT_VLT_WR | EPT_VLT_PERM_RD | EPT_VLT_PERM_EX);
- ept_access_allowed(EPT_RA | EPT_EA, OP_EXEC);
- }
- static void ept_access_test_write_execute(void)
- {
- ept_access_test_setup();
- /* -wx */
- ept_access_misconfig(EPT_WA | EPT_EA);
- }
- static void ept_access_test_read_write_execute(void)
- {
- ept_access_test_setup();
- /* rwx */
- ept_access_allowed(EPT_RA | EPT_WA | EPT_EA, OP_READ);
- ept_access_allowed(EPT_RA | EPT_WA | EPT_EA, OP_WRITE);
- ept_access_allowed(EPT_RA | EPT_WA | EPT_EA, OP_EXEC);
- }
- static void ept_access_test_reserved_bits(void)
- {
- int i;
- int maxphyaddr;
- ept_access_test_setup();
- /* Reserved bits above maxphyaddr. */
- maxphyaddr = cpuid_maxphyaddr();
- for (i = maxphyaddr; i <= 51; i++) {
- report_prefix_pushf("reserved_bit=%d", i);
- ept_reserved_bit(i);
- report_prefix_pop();
- }
- /* Level-specific reserved bits. */
- ept_reserved_bit_at_level_nohuge(2, 3);
- ept_reserved_bit_at_level_nohuge(2, 4);
- ept_reserved_bit_at_level_nohuge(2, 5);
- ept_reserved_bit_at_level_nohuge(2, 6);
- /* 2M alignment. */
- for (i = 12; i < 20; i++) {
- report_prefix_pushf("reserved_bit=%d", i);
- ept_reserved_bit_at_level_huge(2, i);
- report_prefix_pop();
- }
- ept_reserved_bit_at_level_nohuge(3, 3);
- ept_reserved_bit_at_level_nohuge(3, 4);
- ept_reserved_bit_at_level_nohuge(3, 5);
- ept_reserved_bit_at_level_nohuge(3, 6);
- /* 1G alignment. */
- for (i = 12; i < 29; i++) {
- report_prefix_pushf("reserved_bit=%d", i);
- ept_reserved_bit_at_level_huge(3, i);
- report_prefix_pop();
- }
- ept_reserved_bit_at_level(4, 3);
- ept_reserved_bit_at_level(4, 4);
- ept_reserved_bit_at_level(4, 5);
- ept_reserved_bit_at_level(4, 6);
- ept_reserved_bit_at_level(4, 7);
- }
- static void ept_access_test_ignored_bits(void)
- {
- ept_access_test_setup();
- /*
- * Bits ignored at every level. Bits 8 and 9 (A and D) are ignored as
- * far as translation is concerned even if AD bits are enabled in the
- * EPTP. Bit 63 is ignored because "EPT-violation #VE" VM-execution
- * control is 0.
- */
- ept_ignored_bit(8);
- ept_ignored_bit(9);
- ept_ignored_bit(10);
- ept_ignored_bit(11);
- ept_ignored_bit(52);
- ept_ignored_bit(53);
- ept_ignored_bit(54);
- ept_ignored_bit(55);
- ept_ignored_bit(56);
- ept_ignored_bit(57);
- ept_ignored_bit(58);
- ept_ignored_bit(59);
- ept_ignored_bit(60);
- ept_ignored_bit(61);
- ept_ignored_bit(62);
- ept_ignored_bit(63);
- }
- static void ept_access_test_paddr_not_present_ad_disabled(void)
- {
- ept_access_test_setup();
- ept_disable_ad_bits();
- ept_access_violation_paddr(0, PT_AD_MASK, OP_READ, EPT_VLT_RD);
- ept_access_violation_paddr(0, PT_AD_MASK, OP_WRITE, EPT_VLT_RD);
- ept_access_violation_paddr(0, PT_AD_MASK, OP_EXEC, EPT_VLT_RD);
- }
- static void ept_access_test_paddr_not_present_ad_enabled(void)
- {
- u64 qual = EPT_VLT_RD | EPT_VLT_WR;
- ept_access_test_setup();
- ept_enable_ad_bits_or_skip_test();
- ept_access_violation_paddr(0, PT_AD_MASK, OP_READ, qual);
- ept_access_violation_paddr(0, PT_AD_MASK, OP_WRITE, qual);
- ept_access_violation_paddr(0, PT_AD_MASK, OP_EXEC, qual);
- }
- static void ept_access_test_paddr_read_only_ad_disabled(void)
- {
- /*
- * When EPT AD bits are disabled, all accesses to guest paging
- * structures are reported separately as a read and (after
- * translation of the GPA to host physical address) a read+write
- * if the A/D bits have to be set.
- */
- u64 qual = EPT_VLT_WR | EPT_VLT_RD | EPT_VLT_PERM_RD;
- ept_access_test_setup();
- ept_disable_ad_bits();
- /* Can't update A bit, so all accesses fail. */
- ept_access_violation_paddr(EPT_RA, 0, OP_READ, qual);
- ept_access_violation_paddr(EPT_RA, 0, OP_WRITE, qual);
- ept_access_violation_paddr(EPT_RA, 0, OP_EXEC, qual);
- /* AD bits disabled, so only writes try to update the D bit. */
- ept_access_allowed_paddr(EPT_RA, PT_ACCESSED_MASK, OP_READ);
- ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_WRITE, qual);
- ept_access_allowed_paddr(EPT_RA, PT_ACCESSED_MASK, OP_EXEC);
- /* Both A and D already set, so read-only is OK. */
- ept_access_allowed_paddr(EPT_RA, PT_AD_MASK, OP_READ);
- ept_access_allowed_paddr(EPT_RA, PT_AD_MASK, OP_WRITE);
- ept_access_allowed_paddr(EPT_RA, PT_AD_MASK, OP_EXEC);
- }
- static void ept_access_test_paddr_read_only_ad_enabled(void)
- {
- /*
- * When EPT AD bits are enabled, all accesses to guest paging
- * structures are considered writes as far as EPT translation
- * is concerned.
- */
- u64 qual = EPT_VLT_WR | EPT_VLT_RD | EPT_VLT_PERM_RD;
- ept_access_test_setup();
- ept_enable_ad_bits_or_skip_test();
- ept_access_violation_paddr(EPT_RA, 0, OP_READ, qual);
- ept_access_violation_paddr(EPT_RA, 0, OP_WRITE, qual);
- ept_access_violation_paddr(EPT_RA, 0, OP_EXEC, qual);
- ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_READ, qual);
- ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_WRITE, qual);
- ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_EXEC, qual);
- ept_access_violation_paddr(EPT_RA, PT_AD_MASK, OP_READ, qual);
- ept_access_violation_paddr(EPT_RA, PT_AD_MASK, OP_WRITE, qual);
- ept_access_violation_paddr(EPT_RA, PT_AD_MASK, OP_EXEC, qual);
- }
- static void ept_access_test_paddr_read_write(void)
- {
- ept_access_test_setup();
- /* Read-write access to paging structure. */
- ept_access_allowed_paddr(EPT_RA | EPT_WA, 0, OP_READ);
- ept_access_allowed_paddr(EPT_RA | EPT_WA, 0, OP_WRITE);
- ept_access_allowed_paddr(EPT_RA | EPT_WA, 0, OP_EXEC);
- }
- static void ept_access_test_paddr_read_write_execute(void)
- {
- ept_access_test_setup();
- /* RWX access to paging structure. */
- ept_access_allowed_paddr(EPT_PRESENT, 0, OP_READ);
- ept_access_allowed_paddr(EPT_PRESENT, 0, OP_WRITE);
- ept_access_allowed_paddr(EPT_PRESENT, 0, OP_EXEC);
- }
- static void ept_access_test_paddr_read_execute_ad_disabled(void)
- {
- /*
- * When EPT AD bits are disabled, all accesses to guest paging
- * structures are reported separately as a read and (after
- * translation of the GPA to host physical address) a read+write
- * if the A/D bits have to be set.
- */
- u64 qual = EPT_VLT_WR | EPT_VLT_RD | EPT_VLT_PERM_RD | EPT_VLT_PERM_EX;
- ept_access_test_setup();
- ept_disable_ad_bits();
- /* Can't update A bit, so all accesses fail. */
- ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_READ, qual);
- ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_WRITE, qual);
- ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_EXEC, qual);
- /* AD bits disabled, so only writes try to update the D bit. */
- ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_READ);
- ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_WRITE, qual);
- ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_EXEC);
- /* Both A and D already set, so read-only is OK. */
- ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_READ);
- ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_WRITE);
- ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_EXEC);
- }
- static void ept_access_test_paddr_read_execute_ad_enabled(void)
- {
- /*
- * When EPT AD bits are enabled, all accesses to guest paging
- * structures are considered writes as far as EPT translation
- * is concerned.
- */
- u64 qual = EPT_VLT_WR | EPT_VLT_RD | EPT_VLT_PERM_RD | EPT_VLT_PERM_EX;
- ept_access_test_setup();
- ept_enable_ad_bits_or_skip_test();
- ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_READ, qual);
- ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_WRITE, qual);
- ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_EXEC, qual);
- ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_READ, qual);
- ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_WRITE, qual);
- ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_EXEC, qual);
- ept_access_violation_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_READ, qual);
- ept_access_violation_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_WRITE, qual);
- ept_access_violation_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_EXEC, qual);
- }
- static void ept_access_test_paddr_not_present_page_fault(void)
- {
- ept_access_test_setup();
- /*
- * TODO: test no EPT violation as long as guest PF occurs. e.g., GPA is
- * page is read-only in EPT but GVA is also mapped read only in PT.
- * Thus guest page fault before host takes EPT violation for trying to
- * update A bit.
- */
- }
- static void ept_access_test_force_2m_page(void)
- {
- ept_access_test_setup();
- TEST_ASSERT_EQ(ept_2m_supported(), true);
- ept_allowed_at_level_mkhuge(true, 2, 0, 0, OP_READ);
- ept_violation_at_level_mkhuge(true, 2, EPT_PRESENT, EPT_RA, OP_WRITE,
- EPT_VLT_WR | EPT_VLT_PERM_RD |
- EPT_VLT_LADDR_VLD | EPT_VLT_PADDR);
- ept_misconfig_at_level_mkhuge(true, 2, EPT_PRESENT, EPT_WA);
- }
- static bool invvpid_valid(u64 type, u64 vpid, u64 gla)
- {
- u64 msr = rdmsr(MSR_IA32_VMX_EPT_VPID_CAP);
- TEST_ASSERT(msr & VPID_CAP_INVVPID);
- if (type < INVVPID_ADDR || type > INVVPID_CONTEXT_LOCAL)
- return false;
- if (!(msr & (1ull << (type + VPID_CAP_INVVPID_TYPES_SHIFT))))
- return false;
- if (vpid >> 16)
- return false;
- if (type != INVVPID_ALL && !vpid)
- return false;
- if (type == INVVPID_ADDR && !is_canonical(gla))
- return false;
- return true;
- }
- static void try_invvpid(u64 type, u64 vpid, u64 gla)
- {
- int rc;
- bool valid = invvpid_valid(type, vpid, gla);
- u64 expected = valid ? VMXERR_UNSUPPORTED_VMCS_COMPONENT
- : VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID;
- /*
- * Set VMX_INST_ERROR to VMXERR_UNVALID_VMCS_COMPONENT, so
- * that we can tell if it is updated by INVVPID.
- */
- vmcs_read(~0);
- rc = invvpid(type, vpid, gla);
- report("INVVPID type %ld VPID %lx GLA %lx %s",
- !rc == valid, type, vpid, gla,
- valid ? "passes" : "fails");
- report("After %s INVVPID, VMX_INST_ERR is %ld (actual %ld)",
- vmcs_read(VMX_INST_ERROR) == expected,
- rc ? "failed" : "successful",
- expected, vmcs_read(VMX_INST_ERROR));
- }
- static void ds_invvpid(void *data)
- {
- u64 msr = rdmsr(MSR_IA32_VMX_EPT_VPID_CAP);
- u64 type = ffs(msr >> VPID_CAP_INVVPID_TYPES_SHIFT) - 1;
- TEST_ASSERT(type >= INVVPID_ADDR && type <= INVVPID_CONTEXT_LOCAL);
- asm volatile("invvpid %0, %1"
- :
- : "m"(*(struct invvpid_operand *)data),
- "r"(type));
- }
- /*
- * The SS override is ignored in 64-bit mode, so we use an addressing
- * mode with %rsp as the base register to generate an implicit SS
- * reference.
- */
- static void ss_invvpid(void *data)
- {
- u64 msr = rdmsr(MSR_IA32_VMX_EPT_VPID_CAP);
- u64 type = ffs(msr >> VPID_CAP_INVVPID_TYPES_SHIFT) - 1;
- TEST_ASSERT(type >= INVVPID_ADDR && type <= INVVPID_CONTEXT_LOCAL);
- asm volatile("sub %%rsp,%0; invvpid (%%rsp,%0,1), %1"
- : "+r"(data)
- : "r"(type));
- }
- static void invvpid_test_gp(void)
- {
- bool fault;
- fault = test_for_exception(GP_VECTOR, &ds_invvpid,
- (void *)NONCANONICAL);
- report("INVVPID with non-canonical DS operand raises #GP", fault);
- }
- static void invvpid_test_ss(void)
- {
- bool fault;
- fault = test_for_exception(SS_VECTOR, &ss_invvpid,
- (void *)NONCANONICAL);
- report("INVVPID with non-canonical SS operand raises #SS", fault);
- }
- static void invvpid_test_pf(void)
- {
- void *vpage = alloc_vpage();
- bool fault;
- fault = test_for_exception(PF_VECTOR, &ds_invvpid, vpage);
- report("INVVPID with unmapped operand raises #PF", fault);
- }
- static void try_compat_invvpid(void *unused)
- {
- struct far_pointer32 fp = {
- .offset = (uintptr_t)&&invvpid,
- .selector = KERNEL_CS32,
- };
- register uintptr_t rsp asm("rsp");
- TEST_ASSERT_MSG(fp.offset == (uintptr_t)&&invvpid,
- "Code address too high.");
- TEST_ASSERT_MSG(rsp == (u32)rsp, "Stack address too high.");
- asm goto ("lcall *%0" : : "m" (fp) : "rax" : invvpid);
- return;
- invvpid:
- asm volatile (".code32;"
- "invvpid (%eax), %eax;"
- "lret;"
- ".code64");
- __builtin_unreachable();
- }
- static void invvpid_test_compatibility_mode(void)
- {
- bool fault;
- fault = test_for_exception(UD_VECTOR, &try_compat_invvpid, NULL);
- report("Compatibility mode INVVPID raises #UD", fault);
- }
- static void invvpid_test_not_in_vmx_operation(void)
- {
- bool fault;
- TEST_ASSERT(!vmx_off());
- fault = test_for_exception(UD_VECTOR, &ds_invvpid, NULL);
- report("INVVPID outside of VMX operation raises #UD", fault);
- TEST_ASSERT(!vmx_on());
- }
- /*
- * This does not test real-address mode, virtual-8086 mode, protected mode,
- * or CPL > 0.
- */
- static void invvpid_test_v2(void)
- {
- u64 msr;
- int i;
- unsigned types = 0;
- unsigned type;
- if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) ||
- !(ctrl_cpu_rev[1].clr & CPU_VPID))
- test_skip("VPID not supported");
- msr = rdmsr(MSR_IA32_VMX_EPT_VPID_CAP);
- if (!(msr & VPID_CAP_INVVPID))
- test_skip("INVVPID not supported.\n");
- if (msr & VPID_CAP_INVVPID_ADDR)
- types |= 1u << INVVPID_ADDR;
- if (msr & VPID_CAP_INVVPID_CXTGLB)
- types |= 1u << INVVPID_CONTEXT_GLOBAL;
- if (msr & VPID_CAP_INVVPID_ALL)
- types |= 1u << INVVPID_ALL;
- if (msr & VPID_CAP_INVVPID_CXTLOC)
- types |= 1u << INVVPID_CONTEXT_LOCAL;
- if (!types)
- test_skip("No INVVPID types supported.\n");
- for (i = -127; i < 128; i++)
- try_invvpid(i, 0xffff, 0);
- /*
- * VPID must not be more than 16 bits.
- */
- for (i = 0; i < 64; i++)
- for (type = 0; type < 4; type++)
- if (types & (1u << type))
- try_invvpid(type, 1ul << i, 0);
- /*
- * VPID must not be zero, except for "all contexts."
- */
- for (type = 0; type < 4; type++)
- if (types & (1u << type))
- try_invvpid(type, 0, 0);
- /*
- * The gla operand is only validated for single-address INVVPID.
- */
- if (types & (1u << INVVPID_ADDR))
- try_invvpid(INVVPID_ADDR, 0xffff, NONCANONICAL);
- invvpid_test_gp();
- invvpid_test_ss();
- invvpid_test_pf();
- invvpid_test_compatibility_mode();
- invvpid_test_not_in_vmx_operation();
- }
- /*
- * Test for early VMLAUNCH failure. Returns true if VMLAUNCH makes it
- * at least as far as the guest-state checks. Returns false if the
- * VMLAUNCH fails early and execution falls through to the next
- * instruction.
- */
- static bool vmlaunch_succeeds(void)
- {
- /*
- * Indirectly set VMX_INST_ERR to 12 ("VMREAD/VMWRITE from/to
- * unsupported VMCS component"). The caller can then check
- * to see if a failed VM-entry sets VMX_INST_ERR as expected.
- */
- vmcs_write(~0u, 0);
- vmcs_write(HOST_RIP, (uintptr_t)&&success);
- __asm__ __volatile__ goto ("vmwrite %%rsp, %0; vmlaunch"
- :
- : "r" ((u64)HOST_RSP)
- : "cc", "memory"
- : success);
- return false;
- success:
- TEST_ASSERT(vmcs_read(EXI_REASON) ==
- (VMX_FAIL_STATE | VMX_ENTRY_FAILURE));
- return true;
- }
- /*
- * Try to launch the current VMCS.
- */
- static void test_vmx_controls(bool controls_valid)
- {
- bool success = vmlaunch_succeeds();
- u32 vmx_inst_err;
- report("vmlaunch %s", success == controls_valid,
- controls_valid ? "succeeds" : "fails");
- if (!controls_valid) {
- vmx_inst_err = vmcs_read(VMX_INST_ERROR);
- report("VMX inst error is %d (actual %d)",
- vmx_inst_err == VMXERR_ENTRY_INVALID_CONTROL_FIELD,
- VMXERR_ENTRY_INVALID_CONTROL_FIELD, vmx_inst_err);
- }
- }
- /*
- * Test a particular address setting for a physical page reference in
- * the VMCS.
- */
- static void test_vmcs_page_addr(const char *name,
- enum Encoding encoding,
- bool ignored,
- u64 addr)
- {
- report_prefix_pushf("%s = %lx", name, addr);
- vmcs_write(encoding, addr);
- test_vmx_controls(ignored || (IS_ALIGNED(addr, PAGE_SIZE) &&
- addr < (1ul << cpuid_maxphyaddr())));
- report_prefix_pop();
- }
- /*
- * Test interesting values for a physical page reference in the VMCS.
- */
- static void test_vmcs_page_values(const char *name,
- enum Encoding encoding,
- bool ignored)
- {
- unsigned i;
- u64 orig_val = vmcs_read(encoding);
- for (i = 0; i < 64; i++)
- test_vmcs_page_addr(name, encoding, ignored, 1ul << i);
- test_vmcs_page_addr(name, encoding, ignored, PAGE_SIZE - 1);
- test_vmcs_page_addr(name, encoding, ignored, PAGE_SIZE);
- test_vmcs_page_addr(name, encoding, ignored,
- (1ul << cpuid_maxphyaddr()) - PAGE_SIZE);
- test_vmcs_page_addr(name, encoding, ignored, -1ul);
- vmcs_write(encoding, orig_val);
- }
- /*
- * Test a physical page reference in the VMCS, when the corresponding
- * feature is enabled and when the corresponding feature is disabled.
- */
- static void test_vmcs_page_reference(u32 control_bit, enum Encoding field,
- const char *field_name,
- const char *control_name)
- {
- u32 primary = vmcs_read(CPU_EXEC_CTRL0);
- u64 page_addr;
- if (!(ctrl_cpu_rev[0].clr & control_bit))
- return;
- page_addr = vmcs_read(field);
- report_prefix_pushf("%s enabled", control_name);
- vmcs_write(CPU_EXEC_CTRL0, primary | control_bit);
- test_vmcs_page_values(field_name, field, false);
- report_prefix_pop();
- report_prefix_pushf("%s disabled", control_name);
- vmcs_write(CPU_EXEC_CTRL0, primary & ~control_bit);
- test_vmcs_page_values(field_name, field, true);
- report_prefix_pop();
- vmcs_write(field, page_addr);
- vmcs_write(CPU_EXEC_CTRL0, primary);
- }
- /*
- * If the "use I/O bitmaps" VM-execution control is 1, bits 11:0 of
- * each I/O-bitmap address must be 0. Neither address should set any
- * bits beyond the processor's physical-address width.
- * [Intel SDM]
- */
- static void test_io_bitmaps(void)
- {
- test_vmcs_page_reference(CPU_IO_BITMAP, IO_BITMAP_A,
- "I/O bitmap A", "Use I/O bitmaps");
- test_vmcs_page_reference(CPU_IO_BITMAP, IO_BITMAP_B,
- "I/O bitmap B", "Use I/O bitmaps");
- }
- /*
- * If the "use MSR bitmaps" VM-execution control is 1, bits 11:0 of
- * the MSR-bitmap address must be 0. The address should not set any
- * bits beyond the processor's physical-address width.
- * [Intel SDM]
- */
- static void test_msr_bitmap(void)
- {
- test_vmcs_page_reference(CPU_MSR_BITMAP, MSR_BITMAP,
- "MSR bitmap", "Use MSR bitmaps");
- }
- static void vmx_controls_test(void)
- {
- /*
- * Bit 1 of the guest's RFLAGS must be 1, or VM-entry will
- * fail due to invalid guest state, should we make it that
- * far.
- */
- vmcs_write(GUEST_RFLAGS, 0);
- test_io_bitmaps();
- test_msr_bitmap();
- }
- static bool valid_vmcs_for_vmentry(void)
- {
- struct vmcs *current_vmcs = NULL;
- if (vmcs_save(¤t_vmcs))
- return false;
- return current_vmcs && !(current_vmcs->revision_id >> 31);
- }
- static void try_vmentry_in_movss_shadow(void)
- {
- u32 vm_inst_err;
- u32 flags;
- bool early_failure = false;
- u32 expected_flags = X86_EFLAGS_FIXED;
- bool valid_vmcs = valid_vmcs_for_vmentry();
- expected_flags |= valid_vmcs ? X86_EFLAGS_ZF : X86_EFLAGS_CF;
- /*
- * Indirectly set VM_INST_ERR to 12 ("VMREAD/VMWRITE from/to
- * unsupported VMCS component").
- */
- vmcs_write(~0u, 0);
- __asm__ __volatile__ ("mov %[host_rsp], %%edx;"
- "vmwrite %%rsp, %%rdx;"
- "mov 0f, %%rax;"
- "mov %[host_rip], %%edx;"
- "vmwrite %%rax, %%rdx;"
- "mov $-1, %%ah;"
- "sahf;"
- "mov %%ss, %%ax;"
- "mov %%ax, %%ss;"
- "vmlaunch;"
- "mov $1, %[early_failure];"
- "0: lahf;"
- "movzbl %%ah, %[flags]"
- : [early_failure] "+r" (early_failure),
- [flags] "=&a" (flags)
- : [host_rsp] "i" (HOST_RSP),
- [host_rip] "i" (HOST_RIP)
- : "rdx", "cc", "memory");
- vm_inst_err = vmcs_read(VMX_INST_ERROR);
- report("Early VM-entry failure", early_failure);
- report("RFLAGS[8:0] is %x (actual %x)", flags == expected_flags,
- expected_flags, flags);
- if (valid_vmcs)
- report("VM-instruction error is %d (actual %d)",
- vm_inst_err == VMXERR_ENTRY_EVENTS_BLOCKED_BY_MOV_SS,
- VMXERR_ENTRY_EVENTS_BLOCKED_BY_MOV_SS, vm_inst_err);
- }
- static void vmentry_movss_shadow_test(void)
- {
- struct vmcs *orig_vmcs;
- TEST_ASSERT(!vmcs_save(&orig_vmcs));
- /*
- * Set the launched flag on the current VMCS to verify the correct
- * error priority, below.
- */
- test_set_guest(v2_null_test_guest);
- enter_guest();
- /*
- * With bit 1 of the guest's RFLAGS clear, VM-entry should
- * fail due to invalid guest state (if we make it that far).
- */
- vmcs_write(GUEST_RFLAGS, 0);
- /*
- * "VM entry with events blocked by MOV SS" takes precedence over
- * "VMLAUNCH with non-clear VMCS."
- */
- report_prefix_push("valid current-VMCS");
- try_vmentry_in_movss_shadow();
- report_prefix_pop();
- /*
- * VMfailInvalid takes precedence over "VM entry with events
- * blocked by MOV SS."
- */
- TEST_ASSERT(!vmcs_clear(orig_vmcs));
- report_prefix_push("no current-VMCS");
- try_vmentry_in_movss_shadow();
- report_prefix_pop();
- TEST_ASSERT(!make_vmcs_current(orig_vmcs));
- vmcs_write(GUEST_RFLAGS, X86_EFLAGS_FIXED);
- }
- #define TEST(name) { #name, .v2 = name }
- /* name/init/guest_main/exit_handler/syscall_handler/guest_regs */
- struct vmx_test vmx_tests[] = {
- { "null", NULL, basic_guest_main, basic_exit_handler, NULL, {0} },
- { "vmenter", NULL, vmenter_main, vmenter_exit_handler, NULL, {0} },
- { "preemption timer", preemption_timer_init, preemption_timer_main,
- preemption_timer_exit_handler, NULL, {0} },
- { "control field PAT", test_ctrl_pat_init, test_ctrl_pat_main,
- test_ctrl_pat_exit_handler, NULL, {0} },
- { "control field EFER", test_ctrl_efer_init, test_ctrl_efer_main,
- test_ctrl_efer_exit_handler, NULL, {0} },
- { "CR shadowing", NULL, cr_shadowing_main,
- cr_shadowing_exit_handler, NULL, {0} },
- { "I/O bitmap", iobmp_init, iobmp_main, iobmp_exit_handler,
- NULL, {0} },
- { "instruction intercept", insn_intercept_init, insn_intercept_main,
- insn_intercept_exit_handler, NULL, {0} },
- { "EPT A/D disabled", ept_init, ept_main, ept_exit_handler, NULL, {0} },
- { "EPT A/D enabled", eptad_init, eptad_main, eptad_exit_handler, NULL, {0} },
- { "PML", pml_init, pml_main, pml_exit_handler, NULL, {0} },
- { "VPID", vpid_init, vpid_main, vpid_exit_handler, NULL, {0} },
- { "interrupt", interrupt_init, interrupt_main,
- interrupt_exit_handler, NULL, {0} },
- { "debug controls", dbgctls_init, dbgctls_main, dbgctls_exit_handler,
- NULL, {0} },
- { "MSR switch", msr_switch_init, msr_switch_main,
- msr_switch_exit_handler, NULL, {0}, msr_switch_entry_failure },
- { "vmmcall", vmmcall_init, vmmcall_main, vmmcall_exit_handler, NULL, {0} },
- { "disable RDTSCP", disable_rdtscp_init, disable_rdtscp_main,
- disable_rdtscp_exit_handler, NULL, {0} },
- { "int3", int3_init, int3_guest_main, int3_exit_handler, NULL, {0} },
- { "into", into_init, into_guest_main, into_exit_handler, NULL, {0} },
- { "exit_monitor_from_l2_test", NULL, exit_monitor_from_l2_main,
- exit_monitor_from_l2_handler, NULL, {0} },
- /* Basic V2 tests. */
- TEST(v2_null_test),
- TEST(v2_multiple_entries_test),
- TEST(fixture_test_case1),
- TEST(fixture_test_case2),
- /* EPT access tests. */
- TEST(ept_access_test_not_present),
- TEST(ept_access_test_read_only),
- TEST(ept_access_test_write_only),
- TEST(ept_access_test_read_write),
- TEST(ept_access_test_execute_only),
- TEST(ept_access_test_read_execute),
- TEST(ept_access_test_write_execute),
- TEST(ept_access_test_read_write_execute),
- TEST(ept_access_test_reserved_bits),
- TEST(ept_access_test_ignored_bits),
- TEST(ept_access_test_paddr_not_present_ad_disabled),
- TEST(ept_access_test_paddr_not_present_ad_enabled),
- TEST(ept_access_test_paddr_read_only_ad_disabled),
- TEST(ept_access_test_paddr_read_only_ad_enabled),
- TEST(ept_access_test_paddr_read_write),
- TEST(ept_access_test_paddr_read_write_execute),
- TEST(ept_access_test_paddr_read_execute_ad_disabled),
- TEST(ept_access_test_paddr_read_execute_ad_enabled),
- TEST(ept_access_test_paddr_not_present_page_fault),
- TEST(ept_access_test_force_2m_page),
- /* Opcode tests. */
- TEST(invvpid_test_v2),
- /* VM-entry tests */
- TEST(vmx_controls_test),
- TEST(vmentry_movss_shadow_test),
- { NULL, NULL, NULL, NULL, NULL, {0} },
- };
|