vmx_tests.c 90 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458
  1. /*
  2. * All test cases of nested virtualization should be in this file
  3. *
  4. * Author : Arthur Chunqi Li <yzt356@gmail.com>
  5. */
  6. #include "vmx.h"
  7. #include "msr.h"
  8. #include "processor.h"
  9. #include "vm.h"
  10. #include "fwcfg.h"
  11. #include "isr.h"
  12. #include "desc.h"
  13. #include "apic.h"
  14. #include "types.h"
  15. #define NONCANONICAL 0xaaaaaaaaaaaaaaaaull
  16. #define VPID_CAP_INVVPID_TYPES_SHIFT 40
  17. u64 ia32_pat;
  18. u64 ia32_efer;
  19. void *io_bitmap_a, *io_bitmap_b;
  20. u16 ioport;
  21. unsigned long *pml4;
  22. u64 eptp;
  23. void *data_page1, *data_page2;
  24. void *pml_log;
  25. #define PML_INDEX 512
  26. static inline unsigned ffs(unsigned x)
  27. {
  28. int pos = -1;
  29. __asm__ __volatile__("bsf %1, %%eax; cmovnz %%eax, %0"
  30. : "+r"(pos) : "rm"(x) : "eax");
  31. return pos + 1;
  32. }
  33. static inline void vmcall()
  34. {
  35. asm volatile("vmcall");
  36. }
  37. void basic_guest_main()
  38. {
  39. report("Basic VMX test", 1);
  40. }
  41. int basic_exit_handler()
  42. {
  43. report("Basic VMX test", 0);
  44. print_vmexit_info();
  45. return VMX_TEST_EXIT;
  46. }
  47. void vmenter_main()
  48. {
  49. u64 rax;
  50. u64 rsp, resume_rsp;
  51. report("test vmlaunch", 1);
  52. asm volatile(
  53. "mov %%rsp, %0\n\t"
  54. "mov %3, %%rax\n\t"
  55. "vmcall\n\t"
  56. "mov %%rax, %1\n\t"
  57. "mov %%rsp, %2\n\t"
  58. : "=r"(rsp), "=r"(rax), "=r"(resume_rsp)
  59. : "g"(0xABCD));
  60. report("test vmresume", (rax == 0xFFFF) && (rsp == resume_rsp));
  61. }
  62. int vmenter_exit_handler()
  63. {
  64. u64 guest_rip;
  65. ulong reason;
  66. guest_rip = vmcs_read(GUEST_RIP);
  67. reason = vmcs_read(EXI_REASON) & 0xff;
  68. switch (reason) {
  69. case VMX_VMCALL:
  70. if (regs.rax != 0xABCD) {
  71. report("test vmresume", 0);
  72. return VMX_TEST_VMEXIT;
  73. }
  74. regs.rax = 0xFFFF;
  75. vmcs_write(GUEST_RIP, guest_rip + 3);
  76. return VMX_TEST_RESUME;
  77. default:
  78. report("test vmresume", 0);
  79. print_vmexit_info();
  80. }
  81. return VMX_TEST_VMEXIT;
  82. }
  83. u32 preempt_scale;
  84. volatile unsigned long long tsc_val;
  85. volatile u32 preempt_val;
  86. u64 saved_rip;
  87. int preemption_timer_init()
  88. {
  89. if (!(ctrl_pin_rev.clr & PIN_PREEMPT)) {
  90. printf("\tPreemption timer is not supported\n");
  91. return VMX_TEST_EXIT;
  92. }
  93. vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) | PIN_PREEMPT);
  94. preempt_val = 10000000;
  95. vmcs_write(PREEMPT_TIMER_VALUE, preempt_val);
  96. preempt_scale = rdmsr(MSR_IA32_VMX_MISC) & 0x1F;
  97. if (!(ctrl_exit_rev.clr & EXI_SAVE_PREEMPT))
  98. printf("\tSave preemption value is not supported\n");
  99. return VMX_TEST_START;
  100. }
  101. void preemption_timer_main()
  102. {
  103. tsc_val = rdtsc();
  104. if (ctrl_exit_rev.clr & EXI_SAVE_PREEMPT) {
  105. vmx_set_test_stage(0);
  106. vmcall();
  107. if (vmx_get_test_stage() == 1)
  108. vmcall();
  109. }
  110. vmx_set_test_stage(1);
  111. while (vmx_get_test_stage() == 1) {
  112. if (((rdtsc() - tsc_val) >> preempt_scale)
  113. > 10 * preempt_val) {
  114. vmx_set_test_stage(2);
  115. vmcall();
  116. }
  117. }
  118. tsc_val = rdtsc();
  119. asm volatile ("hlt");
  120. vmcall();
  121. vmx_set_test_stage(5);
  122. vmcall();
  123. }
  124. int preemption_timer_exit_handler()
  125. {
  126. bool guest_halted;
  127. u64 guest_rip;
  128. ulong reason;
  129. u32 insn_len;
  130. u32 ctrl_exit;
  131. guest_rip = vmcs_read(GUEST_RIP);
  132. reason = vmcs_read(EXI_REASON) & 0xff;
  133. insn_len = vmcs_read(EXI_INST_LEN);
  134. switch (reason) {
  135. case VMX_PREEMPT:
  136. switch (vmx_get_test_stage()) {
  137. case 1:
  138. case 2:
  139. report("busy-wait for preemption timer",
  140. ((rdtsc() - tsc_val) >> preempt_scale) >=
  141. preempt_val);
  142. vmx_set_test_stage(3);
  143. vmcs_write(PREEMPT_TIMER_VALUE, preempt_val);
  144. return VMX_TEST_RESUME;
  145. case 3:
  146. guest_halted =
  147. (vmcs_read(GUEST_ACTV_STATE) == ACTV_HLT);
  148. report("preemption timer during hlt",
  149. ((rdtsc() - tsc_val) >> preempt_scale) >=
  150. preempt_val && guest_halted);
  151. vmx_set_test_stage(4);
  152. vmcs_write(PIN_CONTROLS,
  153. vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT);
  154. vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE);
  155. return VMX_TEST_RESUME;
  156. case 4:
  157. report("preemption timer with 0 value",
  158. saved_rip == guest_rip);
  159. break;
  160. default:
  161. report("Invalid stage.", false);
  162. print_vmexit_info();
  163. break;
  164. }
  165. break;
  166. case VMX_VMCALL:
  167. vmcs_write(GUEST_RIP, guest_rip + insn_len);
  168. switch (vmx_get_test_stage()) {
  169. case 0:
  170. report("Keep preemption value",
  171. vmcs_read(PREEMPT_TIMER_VALUE) == preempt_val);
  172. vmx_set_test_stage(1);
  173. vmcs_write(PREEMPT_TIMER_VALUE, preempt_val);
  174. ctrl_exit = (vmcs_read(EXI_CONTROLS) |
  175. EXI_SAVE_PREEMPT) & ctrl_exit_rev.clr;
  176. vmcs_write(EXI_CONTROLS, ctrl_exit);
  177. return VMX_TEST_RESUME;
  178. case 1:
  179. report("Save preemption value",
  180. vmcs_read(PREEMPT_TIMER_VALUE) < preempt_val);
  181. return VMX_TEST_RESUME;
  182. case 2:
  183. report("busy-wait for preemption timer", 0);
  184. vmx_set_test_stage(3);
  185. vmcs_write(PREEMPT_TIMER_VALUE, preempt_val);
  186. return VMX_TEST_RESUME;
  187. case 3:
  188. report("preemption timer during hlt", 0);
  189. vmx_set_test_stage(4);
  190. /* fall through */
  191. case 4:
  192. vmcs_write(PIN_CONTROLS,
  193. vmcs_read(PIN_CONTROLS) | PIN_PREEMPT);
  194. vmcs_write(PREEMPT_TIMER_VALUE, 0);
  195. saved_rip = guest_rip + insn_len;
  196. return VMX_TEST_RESUME;
  197. case 5:
  198. report("preemption timer with 0 value (vmcall stage 5)", 0);
  199. break;
  200. default:
  201. // Should not reach here
  202. report("unexpected stage, %d", false,
  203. vmx_get_test_stage());
  204. print_vmexit_info();
  205. return VMX_TEST_VMEXIT;
  206. }
  207. break;
  208. default:
  209. report("Unknown exit reason, %ld", false, reason);
  210. print_vmexit_info();
  211. }
  212. vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_PREEMPT);
  213. return VMX_TEST_VMEXIT;
  214. }
  215. void msr_bmp_init()
  216. {
  217. void *msr_bitmap;
  218. u32 ctrl_cpu0;
  219. msr_bitmap = alloc_page();
  220. memset(msr_bitmap, 0x0, PAGE_SIZE);
  221. ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0);
  222. ctrl_cpu0 |= CPU_MSR_BITMAP;
  223. vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0);
  224. vmcs_write(MSR_BITMAP, (u64)msr_bitmap);
  225. }
  226. static int test_ctrl_pat_init()
  227. {
  228. u64 ctrl_ent;
  229. u64 ctrl_exi;
  230. msr_bmp_init();
  231. if (!(ctrl_exit_rev.clr & EXI_SAVE_PAT) &&
  232. !(ctrl_exit_rev.clr & EXI_LOAD_PAT) &&
  233. !(ctrl_enter_rev.clr & ENT_LOAD_PAT)) {
  234. printf("\tSave/load PAT is not supported\n");
  235. return 1;
  236. }
  237. ctrl_ent = vmcs_read(ENT_CONTROLS);
  238. ctrl_exi = vmcs_read(EXI_CONTROLS);
  239. ctrl_ent |= ctrl_enter_rev.clr & ENT_LOAD_PAT;
  240. ctrl_exi |= ctrl_exit_rev.clr & (EXI_SAVE_PAT | EXI_LOAD_PAT);
  241. vmcs_write(ENT_CONTROLS, ctrl_ent);
  242. vmcs_write(EXI_CONTROLS, ctrl_exi);
  243. ia32_pat = rdmsr(MSR_IA32_CR_PAT);
  244. vmcs_write(GUEST_PAT, 0x0);
  245. vmcs_write(HOST_PAT, ia32_pat);
  246. return VMX_TEST_START;
  247. }
  248. static void test_ctrl_pat_main()
  249. {
  250. u64 guest_ia32_pat;
  251. guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT);
  252. if (!(ctrl_enter_rev.clr & ENT_LOAD_PAT))
  253. printf("\tENT_LOAD_PAT is not supported.\n");
  254. else {
  255. if (guest_ia32_pat != 0) {
  256. report("Entry load PAT", 0);
  257. return;
  258. }
  259. }
  260. wrmsr(MSR_IA32_CR_PAT, 0x6);
  261. vmcall();
  262. guest_ia32_pat = rdmsr(MSR_IA32_CR_PAT);
  263. if (ctrl_enter_rev.clr & ENT_LOAD_PAT)
  264. report("Entry load PAT", guest_ia32_pat == ia32_pat);
  265. }
  266. static int test_ctrl_pat_exit_handler()
  267. {
  268. u64 guest_rip;
  269. ulong reason;
  270. u64 guest_pat;
  271. guest_rip = vmcs_read(GUEST_RIP);
  272. reason = vmcs_read(EXI_REASON) & 0xff;
  273. switch (reason) {
  274. case VMX_VMCALL:
  275. guest_pat = vmcs_read(GUEST_PAT);
  276. if (!(ctrl_exit_rev.clr & EXI_SAVE_PAT)) {
  277. printf("\tEXI_SAVE_PAT is not supported\n");
  278. vmcs_write(GUEST_PAT, 0x6);
  279. } else {
  280. report("Exit save PAT", guest_pat == 0x6);
  281. }
  282. if (!(ctrl_exit_rev.clr & EXI_LOAD_PAT))
  283. printf("\tEXI_LOAD_PAT is not supported\n");
  284. else
  285. report("Exit load PAT", rdmsr(MSR_IA32_CR_PAT) == ia32_pat);
  286. vmcs_write(GUEST_PAT, ia32_pat);
  287. vmcs_write(GUEST_RIP, guest_rip + 3);
  288. return VMX_TEST_RESUME;
  289. default:
  290. printf("ERROR : Undefined exit reason, reason = %ld.\n", reason);
  291. break;
  292. }
  293. return VMX_TEST_VMEXIT;
  294. }
  295. static int test_ctrl_efer_init()
  296. {
  297. u64 ctrl_ent;
  298. u64 ctrl_exi;
  299. msr_bmp_init();
  300. ctrl_ent = vmcs_read(ENT_CONTROLS) | ENT_LOAD_EFER;
  301. ctrl_exi = vmcs_read(EXI_CONTROLS) | EXI_SAVE_EFER | EXI_LOAD_EFER;
  302. vmcs_write(ENT_CONTROLS, ctrl_ent & ctrl_enter_rev.clr);
  303. vmcs_write(EXI_CONTROLS, ctrl_exi & ctrl_exit_rev.clr);
  304. ia32_efer = rdmsr(MSR_EFER);
  305. vmcs_write(GUEST_EFER, ia32_efer ^ EFER_NX);
  306. vmcs_write(HOST_EFER, ia32_efer ^ EFER_NX);
  307. return VMX_TEST_START;
  308. }
  309. static void test_ctrl_efer_main()
  310. {
  311. u64 guest_ia32_efer;
  312. guest_ia32_efer = rdmsr(MSR_EFER);
  313. if (!(ctrl_enter_rev.clr & ENT_LOAD_EFER))
  314. printf("\tENT_LOAD_EFER is not supported.\n");
  315. else {
  316. if (guest_ia32_efer != (ia32_efer ^ EFER_NX)) {
  317. report("Entry load EFER", 0);
  318. return;
  319. }
  320. }
  321. wrmsr(MSR_EFER, ia32_efer);
  322. vmcall();
  323. guest_ia32_efer = rdmsr(MSR_EFER);
  324. if (ctrl_enter_rev.clr & ENT_LOAD_EFER)
  325. report("Entry load EFER", guest_ia32_efer == ia32_efer);
  326. }
  327. static int test_ctrl_efer_exit_handler()
  328. {
  329. u64 guest_rip;
  330. ulong reason;
  331. u64 guest_efer;
  332. guest_rip = vmcs_read(GUEST_RIP);
  333. reason = vmcs_read(EXI_REASON) & 0xff;
  334. switch (reason) {
  335. case VMX_VMCALL:
  336. guest_efer = vmcs_read(GUEST_EFER);
  337. if (!(ctrl_exit_rev.clr & EXI_SAVE_EFER)) {
  338. printf("\tEXI_SAVE_EFER is not supported\n");
  339. vmcs_write(GUEST_EFER, ia32_efer);
  340. } else {
  341. report("Exit save EFER", guest_efer == ia32_efer);
  342. }
  343. if (!(ctrl_exit_rev.clr & EXI_LOAD_EFER)) {
  344. printf("\tEXI_LOAD_EFER is not supported\n");
  345. wrmsr(MSR_EFER, ia32_efer ^ EFER_NX);
  346. } else {
  347. report("Exit load EFER", rdmsr(MSR_EFER) == (ia32_efer ^ EFER_NX));
  348. }
  349. vmcs_write(GUEST_PAT, ia32_efer);
  350. vmcs_write(GUEST_RIP, guest_rip + 3);
  351. return VMX_TEST_RESUME;
  352. default:
  353. printf("ERROR : Undefined exit reason, reason = %ld.\n", reason);
  354. break;
  355. }
  356. return VMX_TEST_VMEXIT;
  357. }
  358. u32 guest_cr0, guest_cr4;
  359. static void cr_shadowing_main()
  360. {
  361. u32 cr0, cr4, tmp;
  362. // Test read through
  363. vmx_set_test_stage(0);
  364. guest_cr0 = read_cr0();
  365. if (vmx_get_test_stage() == 1)
  366. report("Read through CR0", 0);
  367. else
  368. vmcall();
  369. vmx_set_test_stage(1);
  370. guest_cr4 = read_cr4();
  371. if (vmx_get_test_stage() == 2)
  372. report("Read through CR4", 0);
  373. else
  374. vmcall();
  375. // Test write through
  376. guest_cr0 = guest_cr0 ^ (X86_CR0_TS | X86_CR0_MP);
  377. guest_cr4 = guest_cr4 ^ (X86_CR4_TSD | X86_CR4_DE);
  378. vmx_set_test_stage(2);
  379. write_cr0(guest_cr0);
  380. if (vmx_get_test_stage() == 3)
  381. report("Write throuth CR0", 0);
  382. else
  383. vmcall();
  384. vmx_set_test_stage(3);
  385. write_cr4(guest_cr4);
  386. if (vmx_get_test_stage() == 4)
  387. report("Write through CR4", 0);
  388. else
  389. vmcall();
  390. // Test read shadow
  391. vmx_set_test_stage(4);
  392. vmcall();
  393. cr0 = read_cr0();
  394. if (vmx_get_test_stage() != 5)
  395. report("Read shadowing CR0", cr0 == guest_cr0);
  396. vmx_set_test_stage(5);
  397. cr4 = read_cr4();
  398. if (vmx_get_test_stage() != 6)
  399. report("Read shadowing CR4", cr4 == guest_cr4);
  400. // Test write shadow (same value with shadow)
  401. vmx_set_test_stage(6);
  402. write_cr0(guest_cr0);
  403. if (vmx_get_test_stage() == 7)
  404. report("Write shadowing CR0 (same value with shadow)", 0);
  405. else
  406. vmcall();
  407. vmx_set_test_stage(7);
  408. write_cr4(guest_cr4);
  409. if (vmx_get_test_stage() == 8)
  410. report("Write shadowing CR4 (same value with shadow)", 0);
  411. else
  412. vmcall();
  413. // Test write shadow (different value)
  414. vmx_set_test_stage(8);
  415. tmp = guest_cr0 ^ X86_CR0_TS;
  416. asm volatile("mov %0, %%rsi\n\t"
  417. "mov %%rsi, %%cr0\n\t"
  418. ::"m"(tmp)
  419. :"rsi", "memory", "cc");
  420. report("Write shadowing different X86_CR0_TS", vmx_get_test_stage() == 9);
  421. vmx_set_test_stage(9);
  422. tmp = guest_cr0 ^ X86_CR0_MP;
  423. asm volatile("mov %0, %%rsi\n\t"
  424. "mov %%rsi, %%cr0\n\t"
  425. ::"m"(tmp)
  426. :"rsi", "memory", "cc");
  427. report("Write shadowing different X86_CR0_MP", vmx_get_test_stage() == 10);
  428. vmx_set_test_stage(10);
  429. tmp = guest_cr4 ^ X86_CR4_TSD;
  430. asm volatile("mov %0, %%rsi\n\t"
  431. "mov %%rsi, %%cr4\n\t"
  432. ::"m"(tmp)
  433. :"rsi", "memory", "cc");
  434. report("Write shadowing different X86_CR4_TSD", vmx_get_test_stage() == 11);
  435. vmx_set_test_stage(11);
  436. tmp = guest_cr4 ^ X86_CR4_DE;
  437. asm volatile("mov %0, %%rsi\n\t"
  438. "mov %%rsi, %%cr4\n\t"
  439. ::"m"(tmp)
  440. :"rsi", "memory", "cc");
  441. report("Write shadowing different X86_CR4_DE", vmx_get_test_stage() == 12);
  442. }
  443. static int cr_shadowing_exit_handler()
  444. {
  445. u64 guest_rip;
  446. ulong reason;
  447. u32 insn_len;
  448. u32 exit_qual;
  449. guest_rip = vmcs_read(GUEST_RIP);
  450. reason = vmcs_read(EXI_REASON) & 0xff;
  451. insn_len = vmcs_read(EXI_INST_LEN);
  452. exit_qual = vmcs_read(EXI_QUALIFICATION);
  453. switch (reason) {
  454. case VMX_VMCALL:
  455. switch (vmx_get_test_stage()) {
  456. case 0:
  457. report("Read through CR0", guest_cr0 == vmcs_read(GUEST_CR0));
  458. break;
  459. case 1:
  460. report("Read through CR4", guest_cr4 == vmcs_read(GUEST_CR4));
  461. break;
  462. case 2:
  463. report("Write through CR0", guest_cr0 == vmcs_read(GUEST_CR0));
  464. break;
  465. case 3:
  466. report("Write through CR4", guest_cr4 == vmcs_read(GUEST_CR4));
  467. break;
  468. case 4:
  469. guest_cr0 = vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP);
  470. guest_cr4 = vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE);
  471. vmcs_write(CR0_MASK, X86_CR0_TS | X86_CR0_MP);
  472. vmcs_write(CR0_READ_SHADOW, guest_cr0 & (X86_CR0_TS | X86_CR0_MP));
  473. vmcs_write(CR4_MASK, X86_CR4_TSD | X86_CR4_DE);
  474. vmcs_write(CR4_READ_SHADOW, guest_cr4 & (X86_CR4_TSD | X86_CR4_DE));
  475. break;
  476. case 6:
  477. report("Write shadowing CR0 (same value)",
  478. guest_cr0 == (vmcs_read(GUEST_CR0) ^ (X86_CR0_TS | X86_CR0_MP)));
  479. break;
  480. case 7:
  481. report("Write shadowing CR4 (same value)",
  482. guest_cr4 == (vmcs_read(GUEST_CR4) ^ (X86_CR4_TSD | X86_CR4_DE)));
  483. break;
  484. default:
  485. // Should not reach here
  486. report("unexpected stage, %d", false,
  487. vmx_get_test_stage());
  488. print_vmexit_info();
  489. return VMX_TEST_VMEXIT;
  490. }
  491. vmcs_write(GUEST_RIP, guest_rip + insn_len);
  492. return VMX_TEST_RESUME;
  493. case VMX_CR:
  494. switch (vmx_get_test_stage()) {
  495. case 4:
  496. report("Read shadowing CR0", 0);
  497. vmx_inc_test_stage();
  498. break;
  499. case 5:
  500. report("Read shadowing CR4", 0);
  501. vmx_inc_test_stage();
  502. break;
  503. case 6:
  504. report("Write shadowing CR0 (same value)", 0);
  505. vmx_inc_test_stage();
  506. break;
  507. case 7:
  508. report("Write shadowing CR4 (same value)", 0);
  509. vmx_inc_test_stage();
  510. break;
  511. case 8:
  512. case 9:
  513. // 0x600 encodes "mov %esi, %cr0"
  514. if (exit_qual == 0x600)
  515. vmx_inc_test_stage();
  516. break;
  517. case 10:
  518. case 11:
  519. // 0x604 encodes "mov %esi, %cr4"
  520. if (exit_qual == 0x604)
  521. vmx_inc_test_stage();
  522. break;
  523. default:
  524. // Should not reach here
  525. report("unexpected stage, %d", false,
  526. vmx_get_test_stage());
  527. print_vmexit_info();
  528. return VMX_TEST_VMEXIT;
  529. }
  530. vmcs_write(GUEST_RIP, guest_rip + insn_len);
  531. return VMX_TEST_RESUME;
  532. default:
  533. report("Unknown exit reason, %ld", false, reason);
  534. print_vmexit_info();
  535. }
  536. return VMX_TEST_VMEXIT;
  537. }
  538. static int iobmp_init()
  539. {
  540. u32 ctrl_cpu0;
  541. io_bitmap_a = alloc_page();
  542. io_bitmap_b = alloc_page();
  543. memset(io_bitmap_a, 0x0, PAGE_SIZE);
  544. memset(io_bitmap_b, 0x0, PAGE_SIZE);
  545. ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0);
  546. ctrl_cpu0 |= CPU_IO_BITMAP;
  547. ctrl_cpu0 &= (~CPU_IO);
  548. vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0);
  549. vmcs_write(IO_BITMAP_A, (u64)io_bitmap_a);
  550. vmcs_write(IO_BITMAP_B, (u64)io_bitmap_b);
  551. return VMX_TEST_START;
  552. }
  553. static void iobmp_main()
  554. {
  555. // stage 0, test IO pass
  556. vmx_set_test_stage(0);
  557. inb(0x5000);
  558. outb(0x0, 0x5000);
  559. report("I/O bitmap - I/O pass", vmx_get_test_stage() == 0);
  560. // test IO width, in/out
  561. ((u8 *)io_bitmap_a)[0] = 0xFF;
  562. vmx_set_test_stage(2);
  563. inb(0x0);
  564. report("I/O bitmap - trap in", vmx_get_test_stage() == 3);
  565. vmx_set_test_stage(3);
  566. outw(0x0, 0x0);
  567. report("I/O bitmap - trap out", vmx_get_test_stage() == 4);
  568. vmx_set_test_stage(4);
  569. inl(0x0);
  570. report("I/O bitmap - I/O width, long", vmx_get_test_stage() == 5);
  571. // test low/high IO port
  572. vmx_set_test_stage(5);
  573. ((u8 *)io_bitmap_a)[0x5000 / 8] = (1 << (0x5000 % 8));
  574. inb(0x5000);
  575. report("I/O bitmap - I/O port, low part", vmx_get_test_stage() == 6);
  576. vmx_set_test_stage(6);
  577. ((u8 *)io_bitmap_b)[0x1000 / 8] = (1 << (0x1000 % 8));
  578. inb(0x9000);
  579. report("I/O bitmap - I/O port, high part", vmx_get_test_stage() == 7);
  580. // test partial pass
  581. vmx_set_test_stage(7);
  582. inl(0x4FFF);
  583. report("I/O bitmap - partial pass", vmx_get_test_stage() == 8);
  584. // test overrun
  585. vmx_set_test_stage(8);
  586. memset(io_bitmap_a, 0x0, PAGE_SIZE);
  587. memset(io_bitmap_b, 0x0, PAGE_SIZE);
  588. inl(0xFFFF);
  589. report("I/O bitmap - overrun", vmx_get_test_stage() == 9);
  590. vmx_set_test_stage(9);
  591. vmcall();
  592. outb(0x0, 0x0);
  593. report("I/O bitmap - ignore unconditional exiting",
  594. vmx_get_test_stage() == 9);
  595. vmx_set_test_stage(10);
  596. vmcall();
  597. outb(0x0, 0x0);
  598. report("I/O bitmap - unconditional exiting",
  599. vmx_get_test_stage() == 11);
  600. }
  601. static int iobmp_exit_handler()
  602. {
  603. u64 guest_rip;
  604. ulong reason, exit_qual;
  605. u32 insn_len, ctrl_cpu0;
  606. guest_rip = vmcs_read(GUEST_RIP);
  607. reason = vmcs_read(EXI_REASON) & 0xff;
  608. exit_qual = vmcs_read(EXI_QUALIFICATION);
  609. insn_len = vmcs_read(EXI_INST_LEN);
  610. switch (reason) {
  611. case VMX_IO:
  612. switch (vmx_get_test_stage()) {
  613. case 0:
  614. case 1:
  615. vmx_inc_test_stage();
  616. break;
  617. case 2:
  618. report("I/O bitmap - I/O width, byte",
  619. (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_BYTE);
  620. report("I/O bitmap - I/O direction, in", exit_qual & VMX_IO_IN);
  621. vmx_inc_test_stage();
  622. break;
  623. case 3:
  624. report("I/O bitmap - I/O width, word",
  625. (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_WORD);
  626. report("I/O bitmap - I/O direction, out",
  627. !(exit_qual & VMX_IO_IN));
  628. vmx_inc_test_stage();
  629. break;
  630. case 4:
  631. report("I/O bitmap - I/O width, long",
  632. (exit_qual & VMX_IO_SIZE_MASK) == _VMX_IO_LONG);
  633. vmx_inc_test_stage();
  634. break;
  635. case 5:
  636. if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x5000)
  637. vmx_inc_test_stage();
  638. break;
  639. case 6:
  640. if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x9000)
  641. vmx_inc_test_stage();
  642. break;
  643. case 7:
  644. if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0x4FFF)
  645. vmx_inc_test_stage();
  646. break;
  647. case 8:
  648. if (((exit_qual & VMX_IO_PORT_MASK) >> VMX_IO_PORT_SHIFT) == 0xFFFF)
  649. vmx_inc_test_stage();
  650. break;
  651. case 9:
  652. case 10:
  653. ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0);
  654. vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0 & ~CPU_IO);
  655. vmx_inc_test_stage();
  656. break;
  657. default:
  658. // Should not reach here
  659. report("unexpected stage, %d", false,
  660. vmx_get_test_stage());
  661. print_vmexit_info();
  662. return VMX_TEST_VMEXIT;
  663. }
  664. vmcs_write(GUEST_RIP, guest_rip + insn_len);
  665. return VMX_TEST_RESUME;
  666. case VMX_VMCALL:
  667. switch (vmx_get_test_stage()) {
  668. case 9:
  669. ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0);
  670. ctrl_cpu0 |= CPU_IO | CPU_IO_BITMAP;
  671. vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0);
  672. break;
  673. case 10:
  674. ctrl_cpu0 = vmcs_read(CPU_EXEC_CTRL0);
  675. ctrl_cpu0 = (ctrl_cpu0 & ~CPU_IO_BITMAP) | CPU_IO;
  676. vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu0);
  677. break;
  678. default:
  679. // Should not reach here
  680. report("unexpected stage, %d", false,
  681. vmx_get_test_stage());
  682. print_vmexit_info();
  683. return VMX_TEST_VMEXIT;
  684. }
  685. vmcs_write(GUEST_RIP, guest_rip + insn_len);
  686. return VMX_TEST_RESUME;
  687. default:
  688. printf("guest_rip = %#lx\n", guest_rip);
  689. printf("\tERROR : Undefined exit reason, reason = %ld.\n", reason);
  690. break;
  691. }
  692. return VMX_TEST_VMEXIT;
  693. }
  694. #define INSN_CPU0 0
  695. #define INSN_CPU1 1
  696. #define INSN_ALWAYS_TRAP 2
  697. #define FIELD_EXIT_QUAL (1 << 0)
  698. #define FIELD_INSN_INFO (1 << 1)
  699. asm(
  700. "insn_hlt: hlt;ret\n\t"
  701. "insn_invlpg: invlpg 0x12345678;ret\n\t"
  702. "insn_mwait: xor %eax, %eax; xor %ecx, %ecx; mwait;ret\n\t"
  703. "insn_rdpmc: xor %ecx, %ecx; rdpmc;ret\n\t"
  704. "insn_rdtsc: rdtsc;ret\n\t"
  705. "insn_cr3_load: mov cr3,%rax; mov %rax,%cr3;ret\n\t"
  706. "insn_cr3_store: mov %cr3,%rax;ret\n\t"
  707. #ifdef __x86_64__
  708. "insn_cr8_load: mov %rax,%cr8;ret\n\t"
  709. "insn_cr8_store: mov %cr8,%rax;ret\n\t"
  710. #endif
  711. "insn_monitor: xor %eax, %eax; xor %ecx, %ecx; xor %edx, %edx; monitor;ret\n\t"
  712. "insn_pause: pause;ret\n\t"
  713. "insn_wbinvd: wbinvd;ret\n\t"
  714. "insn_cpuid: mov $10, %eax; cpuid;ret\n\t"
  715. "insn_invd: invd;ret\n\t"
  716. "insn_sgdt: sgdt gdt64_desc;ret\n\t"
  717. "insn_lgdt: lgdt gdt64_desc;ret\n\t"
  718. "insn_sidt: sidt idt_descr;ret\n\t"
  719. "insn_lidt: lidt idt_descr;ret\n\t"
  720. "insn_sldt: sldt %ax;ret\n\t"
  721. "insn_lldt: xor %eax, %eax; lldt %ax;ret\n\t"
  722. "insn_str: str %ax;ret\n\t"
  723. );
  724. extern void insn_hlt();
  725. extern void insn_invlpg();
  726. extern void insn_mwait();
  727. extern void insn_rdpmc();
  728. extern void insn_rdtsc();
  729. extern void insn_cr3_load();
  730. extern void insn_cr3_store();
  731. #ifdef __x86_64__
  732. extern void insn_cr8_load();
  733. extern void insn_cr8_store();
  734. #endif
  735. extern void insn_monitor();
  736. extern void insn_pause();
  737. extern void insn_wbinvd();
  738. extern void insn_sgdt();
  739. extern void insn_lgdt();
  740. extern void insn_sidt();
  741. extern void insn_lidt();
  742. extern void insn_sldt();
  743. extern void insn_lldt();
  744. extern void insn_str();
  745. extern void insn_cpuid();
  746. extern void insn_invd();
  747. u32 cur_insn;
  748. u64 cr3;
  749. struct insn_table {
  750. const char *name;
  751. u32 flag;
  752. void (*insn_func)();
  753. u32 type;
  754. u32 reason;
  755. ulong exit_qual;
  756. u32 insn_info;
  757. // Use FIELD_EXIT_QUAL and FIELD_INSN_INFO to define
  758. // which field need to be tested, reason is always tested
  759. u32 test_field;
  760. };
  761. /*
  762. * Add more test cases of instruction intercept here. Elements in this
  763. * table is:
  764. * name/control flag/insn function/type/exit reason/exit qulification/
  765. * instruction info/field to test
  766. * The last field defines which fields (exit_qual and insn_info) need to be
  767. * tested in exit handler. If set to 0, only "reason" is checked.
  768. */
  769. static struct insn_table insn_table[] = {
  770. // Flags for Primary Processor-Based VM-Execution Controls
  771. {"HLT", CPU_HLT, insn_hlt, INSN_CPU0, 12, 0, 0, 0},
  772. {"INVLPG", CPU_INVLPG, insn_invlpg, INSN_CPU0, 14,
  773. 0x12345678, 0, FIELD_EXIT_QUAL},
  774. {"MWAIT", CPU_MWAIT, insn_mwait, INSN_CPU0, 36, 0, 0, 0},
  775. {"RDPMC", CPU_RDPMC, insn_rdpmc, INSN_CPU0, 15, 0, 0, 0},
  776. {"RDTSC", CPU_RDTSC, insn_rdtsc, INSN_CPU0, 16, 0, 0, 0},
  777. {"CR3 load", CPU_CR3_LOAD, insn_cr3_load, INSN_CPU0, 28, 0x3, 0,
  778. FIELD_EXIT_QUAL},
  779. {"CR3 store", CPU_CR3_STORE, insn_cr3_store, INSN_CPU0, 28, 0x13, 0,
  780. FIELD_EXIT_QUAL},
  781. #ifdef __x86_64__
  782. {"CR8 load", CPU_CR8_LOAD, insn_cr8_load, INSN_CPU0, 28, 0x8, 0,
  783. FIELD_EXIT_QUAL},
  784. {"CR8 store", CPU_CR8_STORE, insn_cr8_store, INSN_CPU0, 28, 0x18, 0,
  785. FIELD_EXIT_QUAL},
  786. #endif
  787. {"MONITOR", CPU_MONITOR, insn_monitor, INSN_CPU0, 39, 0, 0, 0},
  788. {"PAUSE", CPU_PAUSE, insn_pause, INSN_CPU0, 40, 0, 0, 0},
  789. // Flags for Secondary Processor-Based VM-Execution Controls
  790. {"WBINVD", CPU_WBINVD, insn_wbinvd, INSN_CPU1, 54, 0, 0, 0},
  791. {"DESC_TABLE (SGDT)", CPU_DESC_TABLE, insn_sgdt, INSN_CPU1, 46, 0, 0, 0},
  792. {"DESC_TABLE (LGDT)", CPU_DESC_TABLE, insn_lgdt, INSN_CPU1, 46, 0, 0, 0},
  793. {"DESC_TABLE (SIDT)", CPU_DESC_TABLE, insn_sidt, INSN_CPU1, 46, 0, 0, 0},
  794. {"DESC_TABLE (LIDT)", CPU_DESC_TABLE, insn_lidt, INSN_CPU1, 46, 0, 0, 0},
  795. {"DESC_TABLE (SLDT)", CPU_DESC_TABLE, insn_sldt, INSN_CPU1, 47, 0, 0, 0},
  796. {"DESC_TABLE (LLDT)", CPU_DESC_TABLE, insn_lldt, INSN_CPU1, 47, 0, 0, 0},
  797. {"DESC_TABLE (STR)", CPU_DESC_TABLE, insn_str, INSN_CPU1, 47, 0, 0, 0},
  798. /* LTR causes a #GP if done with a busy selector, so it is not tested. */
  799. // Instructions always trap
  800. {"CPUID", 0, insn_cpuid, INSN_ALWAYS_TRAP, 10, 0, 0, 0},
  801. {"INVD", 0, insn_invd, INSN_ALWAYS_TRAP, 13, 0, 0, 0},
  802. // Instructions never trap
  803. {NULL},
  804. };
  805. static int insn_intercept_init()
  806. {
  807. u32 ctrl_cpu;
  808. ctrl_cpu = ctrl_cpu_rev[0].set | CPU_SECONDARY;
  809. ctrl_cpu &= ctrl_cpu_rev[0].clr;
  810. vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu);
  811. vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu_rev[1].set);
  812. cr3 = read_cr3();
  813. return VMX_TEST_START;
  814. }
  815. static void insn_intercept_main()
  816. {
  817. for (cur_insn = 0; insn_table[cur_insn].name != NULL; cur_insn++) {
  818. vmx_set_test_stage(cur_insn * 2);
  819. if ((insn_table[cur_insn].type == INSN_CPU0 &&
  820. !(ctrl_cpu_rev[0].clr & insn_table[cur_insn].flag)) ||
  821. (insn_table[cur_insn].type == INSN_CPU1 &&
  822. !(ctrl_cpu_rev[1].clr & insn_table[cur_insn].flag))) {
  823. printf("\tCPU_CTRL%d.CPU_%s is not supported.\n",
  824. insn_table[cur_insn].type - INSN_CPU0,
  825. insn_table[cur_insn].name);
  826. continue;
  827. }
  828. if ((insn_table[cur_insn].type == INSN_CPU0 &&
  829. !(ctrl_cpu_rev[0].set & insn_table[cur_insn].flag)) ||
  830. (insn_table[cur_insn].type == INSN_CPU1 &&
  831. !(ctrl_cpu_rev[1].set & insn_table[cur_insn].flag))) {
  832. /* skip hlt, it stalls the guest and is tested below */
  833. if (insn_table[cur_insn].insn_func != insn_hlt)
  834. insn_table[cur_insn].insn_func();
  835. report("execute %s", vmx_get_test_stage() == cur_insn * 2,
  836. insn_table[cur_insn].name);
  837. } else if (insn_table[cur_insn].type != INSN_ALWAYS_TRAP)
  838. printf("\tCPU_CTRL%d.CPU_%s always traps.\n",
  839. insn_table[cur_insn].type - INSN_CPU0,
  840. insn_table[cur_insn].name);
  841. vmcall();
  842. insn_table[cur_insn].insn_func();
  843. report("intercept %s", vmx_get_test_stage() == cur_insn * 2 + 1,
  844. insn_table[cur_insn].name);
  845. vmx_set_test_stage(cur_insn * 2 + 1);
  846. vmcall();
  847. }
  848. }
  849. static int insn_intercept_exit_handler()
  850. {
  851. u64 guest_rip;
  852. u32 reason;
  853. ulong exit_qual;
  854. u32 insn_len;
  855. u32 insn_info;
  856. bool pass;
  857. guest_rip = vmcs_read(GUEST_RIP);
  858. reason = vmcs_read(EXI_REASON) & 0xff;
  859. exit_qual = vmcs_read(EXI_QUALIFICATION);
  860. insn_len = vmcs_read(EXI_INST_LEN);
  861. insn_info = vmcs_read(EXI_INST_INFO);
  862. if (reason == VMX_VMCALL) {
  863. u32 val = 0;
  864. if (insn_table[cur_insn].type == INSN_CPU0)
  865. val = vmcs_read(CPU_EXEC_CTRL0);
  866. else if (insn_table[cur_insn].type == INSN_CPU1)
  867. val = vmcs_read(CPU_EXEC_CTRL1);
  868. if (vmx_get_test_stage() & 1)
  869. val &= ~insn_table[cur_insn].flag;
  870. else
  871. val |= insn_table[cur_insn].flag;
  872. if (insn_table[cur_insn].type == INSN_CPU0)
  873. vmcs_write(CPU_EXEC_CTRL0, val | ctrl_cpu_rev[0].set);
  874. else if (insn_table[cur_insn].type == INSN_CPU1)
  875. vmcs_write(CPU_EXEC_CTRL1, val | ctrl_cpu_rev[1].set);
  876. } else {
  877. pass = (cur_insn * 2 == vmx_get_test_stage()) &&
  878. insn_table[cur_insn].reason == reason;
  879. if (insn_table[cur_insn].test_field & FIELD_EXIT_QUAL &&
  880. insn_table[cur_insn].exit_qual != exit_qual)
  881. pass = false;
  882. if (insn_table[cur_insn].test_field & FIELD_INSN_INFO &&
  883. insn_table[cur_insn].insn_info != insn_info)
  884. pass = false;
  885. if (pass)
  886. vmx_inc_test_stage();
  887. }
  888. vmcs_write(GUEST_RIP, guest_rip + insn_len);
  889. return VMX_TEST_RESUME;
  890. }
  891. /* Enables EPT and sets up the identity map. */
  892. static int setup_ept(bool enable_ad)
  893. {
  894. unsigned long end_of_memory;
  895. u32 ctrl_cpu[2];
  896. if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) ||
  897. !(ctrl_cpu_rev[1].clr & CPU_EPT)) {
  898. printf("\tEPT is not supported");
  899. return 1;
  900. }
  901. if (!(ept_vpid.val & EPT_CAP_UC) &&
  902. !(ept_vpid.val & EPT_CAP_WB)) {
  903. printf("\tEPT paging-structure memory type "
  904. "UC&WB are not supported\n");
  905. return 1;
  906. }
  907. if (ept_vpid.val & EPT_CAP_UC)
  908. eptp = EPT_MEM_TYPE_UC;
  909. else
  910. eptp = EPT_MEM_TYPE_WB;
  911. if (!(ept_vpid.val & EPT_CAP_PWL4)) {
  912. printf("\tPWL4 is not supported\n");
  913. return 1;
  914. }
  915. ctrl_cpu[0] = vmcs_read(CPU_EXEC_CTRL0);
  916. ctrl_cpu[1] = vmcs_read(CPU_EXEC_CTRL1);
  917. ctrl_cpu[0] = (ctrl_cpu[0] | CPU_SECONDARY)
  918. & ctrl_cpu_rev[0].clr;
  919. ctrl_cpu[1] = (ctrl_cpu[1] | CPU_EPT)
  920. & ctrl_cpu_rev[1].clr;
  921. vmcs_write(CPU_EXEC_CTRL0, ctrl_cpu[0]);
  922. vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu[1]);
  923. eptp |= (3 << EPTP_PG_WALK_LEN_SHIFT);
  924. pml4 = alloc_page();
  925. memset(pml4, 0, PAGE_SIZE);
  926. eptp |= virt_to_phys(pml4);
  927. if (enable_ad)
  928. eptp |= EPTP_AD_FLAG;
  929. vmcs_write(EPTP, eptp);
  930. end_of_memory = fwcfg_get_u64(FW_CFG_RAM_SIZE);
  931. if (end_of_memory < (1ul << 32))
  932. end_of_memory = (1ul << 32);
  933. /* Cannot use large EPT pages if we need to track EPT
  934. * accessed/dirty bits at 4K granularity.
  935. */
  936. setup_ept_range(pml4, 0, end_of_memory, 0,
  937. !enable_ad && ept_2m_supported(),
  938. EPT_WA | EPT_RA | EPT_EA);
  939. return 0;
  940. }
  941. static void ept_enable_ad_bits(void)
  942. {
  943. eptp |= EPTP_AD_FLAG;
  944. vmcs_write(EPTP, eptp);
  945. }
  946. static void ept_disable_ad_bits(void)
  947. {
  948. eptp &= ~EPTP_AD_FLAG;
  949. vmcs_write(EPTP, eptp);
  950. }
  951. static void ept_enable_ad_bits_or_skip_test(void)
  952. {
  953. if (!ept_ad_bits_supported())
  954. test_skip("EPT AD bits not supported.");
  955. ept_enable_ad_bits();
  956. }
  957. static int apic_version;
  958. static int ept_init_common(bool have_ad)
  959. {
  960. if (setup_ept(have_ad))
  961. return VMX_TEST_EXIT;
  962. data_page1 = alloc_page();
  963. data_page2 = alloc_page();
  964. memset(data_page1, 0x0, PAGE_SIZE);
  965. memset(data_page2, 0x0, PAGE_SIZE);
  966. *((u32 *)data_page1) = MAGIC_VAL_1;
  967. *((u32 *)data_page2) = MAGIC_VAL_2;
  968. install_ept(pml4, (unsigned long)data_page1, (unsigned long)data_page2,
  969. EPT_RA | EPT_WA | EPT_EA);
  970. apic_version = apic_read(APIC_LVR);
  971. return VMX_TEST_START;
  972. }
  973. static int ept_init()
  974. {
  975. return ept_init_common(false);
  976. }
  977. static void ept_common()
  978. {
  979. vmx_set_test_stage(0);
  980. if (*((u32 *)data_page2) != MAGIC_VAL_1 ||
  981. *((u32 *)data_page1) != MAGIC_VAL_1)
  982. report("EPT basic framework - read", 0);
  983. else {
  984. *((u32 *)data_page2) = MAGIC_VAL_3;
  985. vmcall();
  986. if (vmx_get_test_stage() == 1) {
  987. if (*((u32 *)data_page1) == MAGIC_VAL_3 &&
  988. *((u32 *)data_page2) == MAGIC_VAL_2)
  989. report("EPT basic framework", 1);
  990. else
  991. report("EPT basic framework - remap", 1);
  992. }
  993. }
  994. // Test EPT Misconfigurations
  995. vmx_set_test_stage(1);
  996. vmcall();
  997. *((u32 *)data_page1) = MAGIC_VAL_1;
  998. if (vmx_get_test_stage() != 2) {
  999. report("EPT misconfigurations", 0);
  1000. goto t1;
  1001. }
  1002. vmx_set_test_stage(2);
  1003. vmcall();
  1004. *((u32 *)data_page1) = MAGIC_VAL_1;
  1005. report("EPT misconfigurations", vmx_get_test_stage() == 3);
  1006. t1:
  1007. // Test EPT violation
  1008. vmx_set_test_stage(3);
  1009. vmcall();
  1010. *((u32 *)data_page1) = MAGIC_VAL_1;
  1011. report("EPT violation - page permission", vmx_get_test_stage() == 4);
  1012. // Violation caused by EPT paging structure
  1013. vmx_set_test_stage(4);
  1014. vmcall();
  1015. *((u32 *)data_page1) = MAGIC_VAL_2;
  1016. report("EPT violation - paging structure", vmx_get_test_stage() == 5);
  1017. }
  1018. static void ept_main()
  1019. {
  1020. ept_common();
  1021. // Test EPT access to L1 MMIO
  1022. vmx_set_test_stage(6);
  1023. report("EPT - MMIO access", *((u32 *)0xfee00030UL) == apic_version);
  1024. // Test invalid operand for INVEPT
  1025. vmcall();
  1026. report("EPT - unsupported INVEPT", vmx_get_test_stage() == 7);
  1027. }
  1028. bool invept_test(int type, u64 eptp)
  1029. {
  1030. bool ret, supported;
  1031. supported = ept_vpid.val & (EPT_CAP_INVEPT_SINGLE >> INVEPT_SINGLE << type);
  1032. ret = invept(type, eptp);
  1033. if (ret == !supported)
  1034. return false;
  1035. if (!supported)
  1036. printf("WARNING: unsupported invept passed!\n");
  1037. else
  1038. printf("WARNING: invept failed!\n");
  1039. return true;
  1040. }
  1041. static int pml_exit_handler(void)
  1042. {
  1043. u16 index, count;
  1044. ulong reason = vmcs_read(EXI_REASON) & 0xff;
  1045. u64 *pmlbuf = pml_log;
  1046. u64 guest_rip = vmcs_read(GUEST_RIP);;
  1047. u64 guest_cr3 = vmcs_read(GUEST_CR3);
  1048. u32 insn_len = vmcs_read(EXI_INST_LEN);
  1049. switch (reason) {
  1050. case VMX_VMCALL:
  1051. switch (vmx_get_test_stage()) {
  1052. case 0:
  1053. index = vmcs_read(GUEST_PML_INDEX);
  1054. for (count = index + 1; count < PML_INDEX; count++) {
  1055. if (pmlbuf[count] == (u64)data_page2) {
  1056. vmx_inc_test_stage();
  1057. clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page2);
  1058. break;
  1059. }
  1060. }
  1061. break;
  1062. case 1:
  1063. index = vmcs_read(GUEST_PML_INDEX);
  1064. /* Keep clearing the dirty bit till a overflow */
  1065. clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page2);
  1066. break;
  1067. default:
  1068. report("unexpected stage, %d.", false,
  1069. vmx_get_test_stage());
  1070. print_vmexit_info();
  1071. return VMX_TEST_VMEXIT;
  1072. }
  1073. vmcs_write(GUEST_RIP, guest_rip + insn_len);
  1074. return VMX_TEST_RESUME;
  1075. case VMX_PML_FULL:
  1076. vmx_inc_test_stage();
  1077. vmcs_write(GUEST_PML_INDEX, PML_INDEX - 1);
  1078. return VMX_TEST_RESUME;
  1079. default:
  1080. report("Unknown exit reason, %ld", false, reason);
  1081. print_vmexit_info();
  1082. }
  1083. return VMX_TEST_VMEXIT;
  1084. }
  1085. static int ept_exit_handler_common(bool have_ad)
  1086. {
  1087. u64 guest_rip;
  1088. u64 guest_cr3;
  1089. ulong reason;
  1090. u32 insn_len;
  1091. u32 exit_qual;
  1092. static unsigned long data_page1_pte, data_page1_pte_pte;
  1093. guest_rip = vmcs_read(GUEST_RIP);
  1094. guest_cr3 = vmcs_read(GUEST_CR3);
  1095. reason = vmcs_read(EXI_REASON) & 0xff;
  1096. insn_len = vmcs_read(EXI_INST_LEN);
  1097. exit_qual = vmcs_read(EXI_QUALIFICATION);
  1098. switch (reason) {
  1099. case VMX_VMCALL:
  1100. switch (vmx_get_test_stage()) {
  1101. case 0:
  1102. check_ept_ad(pml4, guest_cr3,
  1103. (unsigned long)data_page1,
  1104. have_ad ? EPT_ACCESS_FLAG : 0,
  1105. have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0);
  1106. check_ept_ad(pml4, guest_cr3,
  1107. (unsigned long)data_page2,
  1108. have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0,
  1109. have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0);
  1110. clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1);
  1111. clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page2);
  1112. if (have_ad)
  1113. ept_sync(INVEPT_SINGLE, eptp);;
  1114. if (*((u32 *)data_page1) == MAGIC_VAL_3 &&
  1115. *((u32 *)data_page2) == MAGIC_VAL_2) {
  1116. vmx_inc_test_stage();
  1117. install_ept(pml4, (unsigned long)data_page2,
  1118. (unsigned long)data_page2,
  1119. EPT_RA | EPT_WA | EPT_EA);
  1120. } else
  1121. report("EPT basic framework - write", 0);
  1122. break;
  1123. case 1:
  1124. install_ept(pml4, (unsigned long)data_page1,
  1125. (unsigned long)data_page1, EPT_WA);
  1126. ept_sync(INVEPT_SINGLE, eptp);
  1127. break;
  1128. case 2:
  1129. install_ept(pml4, (unsigned long)data_page1,
  1130. (unsigned long)data_page1,
  1131. EPT_RA | EPT_WA | EPT_EA |
  1132. (2 << EPT_MEM_TYPE_SHIFT));
  1133. ept_sync(INVEPT_SINGLE, eptp);
  1134. break;
  1135. case 3:
  1136. clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1);
  1137. TEST_ASSERT(get_ept_pte(pml4, (unsigned long)data_page1,
  1138. 1, &data_page1_pte));
  1139. set_ept_pte(pml4, (unsigned long)data_page1,
  1140. 1, data_page1_pte & ~EPT_PRESENT);
  1141. ept_sync(INVEPT_SINGLE, eptp);
  1142. break;
  1143. case 4:
  1144. TEST_ASSERT(get_ept_pte(pml4, (unsigned long)data_page1,
  1145. 2, &data_page1_pte));
  1146. data_page1_pte &= PAGE_MASK;
  1147. TEST_ASSERT(get_ept_pte(pml4, data_page1_pte,
  1148. 2, &data_page1_pte_pte));
  1149. set_ept_pte(pml4, data_page1_pte, 2,
  1150. data_page1_pte_pte & ~EPT_PRESENT);
  1151. ept_sync(INVEPT_SINGLE, eptp);
  1152. break;
  1153. case 6:
  1154. if (!invept_test(0, eptp))
  1155. vmx_inc_test_stage();
  1156. break;
  1157. // Should not reach here
  1158. default:
  1159. report("ERROR - unexpected stage, %d.", false,
  1160. vmx_get_test_stage());
  1161. print_vmexit_info();
  1162. return VMX_TEST_VMEXIT;
  1163. }
  1164. vmcs_write(GUEST_RIP, guest_rip + insn_len);
  1165. return VMX_TEST_RESUME;
  1166. case VMX_EPT_MISCONFIG:
  1167. switch (vmx_get_test_stage()) {
  1168. case 1:
  1169. case 2:
  1170. vmx_inc_test_stage();
  1171. install_ept(pml4, (unsigned long)data_page1,
  1172. (unsigned long)data_page1,
  1173. EPT_RA | EPT_WA | EPT_EA);
  1174. ept_sync(INVEPT_SINGLE, eptp);
  1175. break;
  1176. // Should not reach here
  1177. default:
  1178. report("ERROR - unexpected stage, %d.", false,
  1179. vmx_get_test_stage());
  1180. print_vmexit_info();
  1181. return VMX_TEST_VMEXIT;
  1182. }
  1183. return VMX_TEST_RESUME;
  1184. case VMX_EPT_VIOLATION:
  1185. switch(vmx_get_test_stage()) {
  1186. case 3:
  1187. check_ept_ad(pml4, guest_cr3, (unsigned long)data_page1, 0,
  1188. have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0);
  1189. clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1);
  1190. if (exit_qual == (EPT_VLT_WR | EPT_VLT_LADDR_VLD |
  1191. EPT_VLT_PADDR))
  1192. vmx_inc_test_stage();
  1193. set_ept_pte(pml4, (unsigned long)data_page1,
  1194. 1, data_page1_pte | (EPT_PRESENT));
  1195. ept_sync(INVEPT_SINGLE, eptp);
  1196. break;
  1197. case 4:
  1198. check_ept_ad(pml4, guest_cr3, (unsigned long)data_page1, 0,
  1199. have_ad ? EPT_ACCESS_FLAG | EPT_DIRTY_FLAG : 0);
  1200. clear_ept_ad(pml4, guest_cr3, (unsigned long)data_page1);
  1201. if (exit_qual == (EPT_VLT_RD |
  1202. (have_ad ? EPT_VLT_WR : 0) |
  1203. EPT_VLT_LADDR_VLD))
  1204. vmx_inc_test_stage();
  1205. set_ept_pte(pml4, data_page1_pte, 2,
  1206. data_page1_pte_pte | (EPT_PRESENT));
  1207. ept_sync(INVEPT_SINGLE, eptp);
  1208. break;
  1209. default:
  1210. // Should not reach here
  1211. report("ERROR : unexpected stage, %d", false,
  1212. vmx_get_test_stage());
  1213. print_vmexit_info();
  1214. return VMX_TEST_VMEXIT;
  1215. }
  1216. return VMX_TEST_RESUME;
  1217. default:
  1218. report("Unknown exit reason, %ld", false, reason);
  1219. print_vmexit_info();
  1220. }
  1221. return VMX_TEST_VMEXIT;
  1222. }
  1223. static int ept_exit_handler()
  1224. {
  1225. return ept_exit_handler_common(false);
  1226. }
  1227. static int eptad_init()
  1228. {
  1229. int r = ept_init_common(true);
  1230. if (r == VMX_TEST_EXIT)
  1231. return r;
  1232. if ((rdmsr(MSR_IA32_VMX_EPT_VPID_CAP) & EPT_CAP_AD_FLAG) == 0) {
  1233. printf("\tEPT A/D bits are not supported");
  1234. return VMX_TEST_EXIT;
  1235. }
  1236. return r;
  1237. }
  1238. static int pml_init()
  1239. {
  1240. u32 ctrl_cpu;
  1241. int r = eptad_init();
  1242. if (r == VMX_TEST_EXIT)
  1243. return r;
  1244. if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) ||
  1245. !(ctrl_cpu_rev[1].clr & CPU_PML)) {
  1246. printf("\tPML is not supported");
  1247. return VMX_TEST_EXIT;
  1248. }
  1249. pml_log = alloc_page();
  1250. memset(pml_log, 0x0, PAGE_SIZE);
  1251. vmcs_write(PMLADDR, (u64)pml_log);
  1252. vmcs_write(GUEST_PML_INDEX, PML_INDEX - 1);
  1253. ctrl_cpu = vmcs_read(CPU_EXEC_CTRL1) | CPU_PML;
  1254. vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu);
  1255. return VMX_TEST_START;
  1256. }
  1257. static void pml_main()
  1258. {
  1259. int count = 0;
  1260. vmx_set_test_stage(0);
  1261. *((u32 *)data_page2) = 0x1;
  1262. vmcall();
  1263. report("PML - Dirty GPA Logging", vmx_get_test_stage() == 1);
  1264. while (vmx_get_test_stage() == 1) {
  1265. vmcall();
  1266. *((u32 *)data_page2) = 0x1;
  1267. if (count++ > PML_INDEX)
  1268. break;
  1269. }
  1270. report("PML Full Event", vmx_get_test_stage() == 2);
  1271. }
  1272. static void eptad_main()
  1273. {
  1274. ept_common();
  1275. }
  1276. static int eptad_exit_handler()
  1277. {
  1278. return ept_exit_handler_common(true);
  1279. }
  1280. bool invvpid_test(int type, u16 vpid)
  1281. {
  1282. bool ret, supported;
  1283. supported = ept_vpid.val &
  1284. (VPID_CAP_INVVPID_ADDR >> INVVPID_ADDR << type);
  1285. ret = invvpid(type, vpid, 0);
  1286. if (ret == !supported)
  1287. return false;
  1288. if (!supported)
  1289. printf("WARNING: unsupported invvpid passed!\n");
  1290. else
  1291. printf("WARNING: invvpid failed!\n");
  1292. return true;
  1293. }
  1294. static int vpid_init()
  1295. {
  1296. u32 ctrl_cpu1;
  1297. if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) ||
  1298. !(ctrl_cpu_rev[1].clr & CPU_VPID)) {
  1299. printf("\tVPID is not supported");
  1300. return VMX_TEST_EXIT;
  1301. }
  1302. ctrl_cpu1 = vmcs_read(CPU_EXEC_CTRL1);
  1303. ctrl_cpu1 |= CPU_VPID;
  1304. vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu1);
  1305. return VMX_TEST_START;
  1306. }
  1307. static void vpid_main()
  1308. {
  1309. vmx_set_test_stage(0);
  1310. vmcall();
  1311. report("INVVPID SINGLE ADDRESS", vmx_get_test_stage() == 1);
  1312. vmx_set_test_stage(2);
  1313. vmcall();
  1314. report("INVVPID SINGLE", vmx_get_test_stage() == 3);
  1315. vmx_set_test_stage(4);
  1316. vmcall();
  1317. report("INVVPID ALL", vmx_get_test_stage() == 5);
  1318. }
  1319. static int vpid_exit_handler()
  1320. {
  1321. u64 guest_rip;
  1322. ulong reason;
  1323. u32 insn_len;
  1324. guest_rip = vmcs_read(GUEST_RIP);
  1325. reason = vmcs_read(EXI_REASON) & 0xff;
  1326. insn_len = vmcs_read(EXI_INST_LEN);
  1327. switch (reason) {
  1328. case VMX_VMCALL:
  1329. switch(vmx_get_test_stage()) {
  1330. case 0:
  1331. if (!invvpid_test(INVVPID_ADDR, 1))
  1332. vmx_inc_test_stage();
  1333. break;
  1334. case 2:
  1335. if (!invvpid_test(INVVPID_CONTEXT_GLOBAL, 1))
  1336. vmx_inc_test_stage();
  1337. break;
  1338. case 4:
  1339. if (!invvpid_test(INVVPID_ALL, 1))
  1340. vmx_inc_test_stage();
  1341. break;
  1342. default:
  1343. report("ERROR: unexpected stage, %d", false,
  1344. vmx_get_test_stage());
  1345. print_vmexit_info();
  1346. return VMX_TEST_VMEXIT;
  1347. }
  1348. vmcs_write(GUEST_RIP, guest_rip + insn_len);
  1349. return VMX_TEST_RESUME;
  1350. default:
  1351. report("Unknown exit reason, %ld", false, reason);
  1352. print_vmexit_info();
  1353. }
  1354. return VMX_TEST_VMEXIT;
  1355. }
  1356. #define TIMER_VECTOR 222
  1357. static volatile bool timer_fired;
  1358. static void timer_isr(isr_regs_t *regs)
  1359. {
  1360. timer_fired = true;
  1361. apic_write(APIC_EOI, 0);
  1362. }
  1363. static int interrupt_init(struct vmcs *vmcs)
  1364. {
  1365. msr_bmp_init();
  1366. vmcs_write(PIN_CONTROLS, vmcs_read(PIN_CONTROLS) & ~PIN_EXTINT);
  1367. handle_irq(TIMER_VECTOR, timer_isr);
  1368. return VMX_TEST_START;
  1369. }
  1370. static void interrupt_main(void)
  1371. {
  1372. long long start, loops;
  1373. vmx_set_test_stage(0);
  1374. apic_write(APIC_LVTT, TIMER_VECTOR);
  1375. irq_enable();
  1376. apic_write(APIC_TMICT, 1);
  1377. for (loops = 0; loops < 10000000 && !timer_fired; loops++)
  1378. asm volatile ("nop");
  1379. report("direct interrupt while running guest", timer_fired);
  1380. apic_write(APIC_TMICT, 0);
  1381. irq_disable();
  1382. vmcall();
  1383. timer_fired = false;
  1384. apic_write(APIC_TMICT, 1);
  1385. for (loops = 0; loops < 10000000 && !timer_fired; loops++)
  1386. asm volatile ("nop");
  1387. report("intercepted interrupt while running guest", timer_fired);
  1388. irq_enable();
  1389. apic_write(APIC_TMICT, 0);
  1390. irq_disable();
  1391. vmcall();
  1392. timer_fired = false;
  1393. start = rdtsc();
  1394. apic_write(APIC_TMICT, 1000000);
  1395. asm volatile ("sti; hlt");
  1396. report("direct interrupt + hlt",
  1397. rdtsc() - start > 1000000 && timer_fired);
  1398. apic_write(APIC_TMICT, 0);
  1399. irq_disable();
  1400. vmcall();
  1401. timer_fired = false;
  1402. start = rdtsc();
  1403. apic_write(APIC_TMICT, 1000000);
  1404. asm volatile ("sti; hlt");
  1405. report("intercepted interrupt + hlt",
  1406. rdtsc() - start > 10000 && timer_fired);
  1407. apic_write(APIC_TMICT, 0);
  1408. irq_disable();
  1409. vmcall();
  1410. timer_fired = false;
  1411. start = rdtsc();
  1412. apic_write(APIC_TMICT, 1000000);
  1413. irq_enable();
  1414. asm volatile ("nop");
  1415. vmcall();
  1416. report("direct interrupt + activity state hlt",
  1417. rdtsc() - start > 10000 && timer_fired);
  1418. apic_write(APIC_TMICT, 0);
  1419. irq_disable();
  1420. vmcall();
  1421. timer_fired = false;
  1422. start = rdtsc();
  1423. apic_write(APIC_TMICT, 1000000);
  1424. irq_enable();
  1425. asm volatile ("nop");
  1426. vmcall();
  1427. report("intercepted interrupt + activity state hlt",
  1428. rdtsc() - start > 10000 && timer_fired);
  1429. apic_write(APIC_TMICT, 0);
  1430. irq_disable();
  1431. vmx_set_test_stage(7);
  1432. vmcall();
  1433. timer_fired = false;
  1434. apic_write(APIC_TMICT, 1);
  1435. for (loops = 0; loops < 10000000 && !timer_fired; loops++)
  1436. asm volatile ("nop");
  1437. report("running a guest with interrupt acknowledgement set", timer_fired);
  1438. }
  1439. static int interrupt_exit_handler(void)
  1440. {
  1441. u64 guest_rip = vmcs_read(GUEST_RIP);
  1442. ulong reason = vmcs_read(EXI_REASON) & 0xff;
  1443. u32 insn_len = vmcs_read(EXI_INST_LEN);
  1444. switch (reason) {
  1445. case VMX_VMCALL:
  1446. switch (vmx_get_test_stage()) {
  1447. case 0:
  1448. case 2:
  1449. case 5:
  1450. vmcs_write(PIN_CONTROLS,
  1451. vmcs_read(PIN_CONTROLS) | PIN_EXTINT);
  1452. break;
  1453. case 7:
  1454. vmcs_write(EXI_CONTROLS, vmcs_read(EXI_CONTROLS) | EXI_INTA);
  1455. vmcs_write(PIN_CONTROLS,
  1456. vmcs_read(PIN_CONTROLS) | PIN_EXTINT);
  1457. break;
  1458. case 1:
  1459. case 3:
  1460. vmcs_write(PIN_CONTROLS,
  1461. vmcs_read(PIN_CONTROLS) & ~PIN_EXTINT);
  1462. break;
  1463. case 4:
  1464. case 6:
  1465. vmcs_write(GUEST_ACTV_STATE, ACTV_HLT);
  1466. break;
  1467. }
  1468. vmx_inc_test_stage();
  1469. vmcs_write(GUEST_RIP, guest_rip + insn_len);
  1470. return VMX_TEST_RESUME;
  1471. case VMX_EXTINT:
  1472. if (vmcs_read(EXI_CONTROLS) & EXI_INTA) {
  1473. int vector = vmcs_read(EXI_INTR_INFO) & 0xff;
  1474. handle_external_interrupt(vector);
  1475. } else {
  1476. irq_enable();
  1477. asm volatile ("nop");
  1478. irq_disable();
  1479. }
  1480. if (vmx_get_test_stage() >= 2)
  1481. vmcs_write(GUEST_ACTV_STATE, ACTV_ACTIVE);
  1482. return VMX_TEST_RESUME;
  1483. default:
  1484. report("Unknown exit reason, %ld", false, reason);
  1485. print_vmexit_info();
  1486. }
  1487. return VMX_TEST_VMEXIT;
  1488. }
  1489. static int dbgctls_init(struct vmcs *vmcs)
  1490. {
  1491. u64 dr7 = 0x402;
  1492. u64 zero = 0;
  1493. msr_bmp_init();
  1494. asm volatile(
  1495. "mov %0,%%dr0\n\t"
  1496. "mov %0,%%dr1\n\t"
  1497. "mov %0,%%dr2\n\t"
  1498. "mov %1,%%dr7\n\t"
  1499. : : "r" (zero), "r" (dr7));
  1500. wrmsr(MSR_IA32_DEBUGCTLMSR, 0x1);
  1501. vmcs_write(GUEST_DR7, 0x404);
  1502. vmcs_write(GUEST_DEBUGCTL, 0x2);
  1503. vmcs_write(ENT_CONTROLS, vmcs_read(ENT_CONTROLS) | ENT_LOAD_DBGCTLS);
  1504. vmcs_write(EXI_CONTROLS, vmcs_read(EXI_CONTROLS) | EXI_SAVE_DBGCTLS);
  1505. return VMX_TEST_START;
  1506. }
  1507. static void dbgctls_main(void)
  1508. {
  1509. u64 dr7, debugctl;
  1510. asm volatile("mov %%dr7,%0" : "=r" (dr7));
  1511. debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
  1512. /* Commented out: KVM does not support DEBUGCTL so far */
  1513. (void)debugctl;
  1514. report("Load debug controls", dr7 == 0x404 /* && debugctl == 0x2 */);
  1515. dr7 = 0x408;
  1516. asm volatile("mov %0,%%dr7" : : "r" (dr7));
  1517. wrmsr(MSR_IA32_DEBUGCTLMSR, 0x3);
  1518. vmx_set_test_stage(0);
  1519. vmcall();
  1520. report("Save debug controls", vmx_get_test_stage() == 1);
  1521. if (ctrl_enter_rev.set & ENT_LOAD_DBGCTLS ||
  1522. ctrl_exit_rev.set & EXI_SAVE_DBGCTLS) {
  1523. printf("\tDebug controls are always loaded/saved\n");
  1524. return;
  1525. }
  1526. vmx_set_test_stage(2);
  1527. vmcall();
  1528. asm volatile("mov %%dr7,%0" : "=r" (dr7));
  1529. debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
  1530. /* Commented out: KVM does not support DEBUGCTL so far */
  1531. (void)debugctl;
  1532. report("Guest=host debug controls", dr7 == 0x402 /* && debugctl == 0x1 */);
  1533. dr7 = 0x408;
  1534. asm volatile("mov %0,%%dr7" : : "r" (dr7));
  1535. wrmsr(MSR_IA32_DEBUGCTLMSR, 0x3);
  1536. vmx_set_test_stage(3);
  1537. vmcall();
  1538. report("Don't save debug controls", vmx_get_test_stage() == 4);
  1539. }
  1540. static int dbgctls_exit_handler(void)
  1541. {
  1542. unsigned int reason = vmcs_read(EXI_REASON) & 0xff;
  1543. u32 insn_len = vmcs_read(EXI_INST_LEN);
  1544. u64 guest_rip = vmcs_read(GUEST_RIP);
  1545. u64 dr7, debugctl;
  1546. asm volatile("mov %%dr7,%0" : "=r" (dr7));
  1547. debugctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
  1548. switch (reason) {
  1549. case VMX_VMCALL:
  1550. switch (vmx_get_test_stage()) {
  1551. case 0:
  1552. if (dr7 == 0x400 && debugctl == 0 &&
  1553. vmcs_read(GUEST_DR7) == 0x408 /* &&
  1554. Commented out: KVM does not support DEBUGCTL so far
  1555. vmcs_read(GUEST_DEBUGCTL) == 0x3 */)
  1556. vmx_inc_test_stage();
  1557. break;
  1558. case 2:
  1559. dr7 = 0x402;
  1560. asm volatile("mov %0,%%dr7" : : "r" (dr7));
  1561. wrmsr(MSR_IA32_DEBUGCTLMSR, 0x1);
  1562. vmcs_write(GUEST_DR7, 0x404);
  1563. vmcs_write(GUEST_DEBUGCTL, 0x2);
  1564. vmcs_write(ENT_CONTROLS,
  1565. vmcs_read(ENT_CONTROLS) & ~ENT_LOAD_DBGCTLS);
  1566. vmcs_write(EXI_CONTROLS,
  1567. vmcs_read(EXI_CONTROLS) & ~EXI_SAVE_DBGCTLS);
  1568. break;
  1569. case 3:
  1570. if (dr7 == 0x400 && debugctl == 0 &&
  1571. vmcs_read(GUEST_DR7) == 0x404 /* &&
  1572. Commented out: KVM does not support DEBUGCTL so far
  1573. vmcs_read(GUEST_DEBUGCTL) == 0x2 */)
  1574. vmx_inc_test_stage();
  1575. break;
  1576. }
  1577. vmcs_write(GUEST_RIP, guest_rip + insn_len);
  1578. return VMX_TEST_RESUME;
  1579. default:
  1580. report("Unknown exit reason, %d", false, reason);
  1581. print_vmexit_info();
  1582. }
  1583. return VMX_TEST_VMEXIT;
  1584. }
  1585. struct vmx_msr_entry {
  1586. u32 index;
  1587. u32 reserved;
  1588. u64 value;
  1589. } __attribute__((packed));
  1590. #define MSR_MAGIC 0x31415926
  1591. struct vmx_msr_entry *exit_msr_store, *entry_msr_load, *exit_msr_load;
  1592. static int msr_switch_init(struct vmcs *vmcs)
  1593. {
  1594. msr_bmp_init();
  1595. exit_msr_store = alloc_page();
  1596. exit_msr_load = alloc_page();
  1597. entry_msr_load = alloc_page();
  1598. memset(exit_msr_store, 0, PAGE_SIZE);
  1599. memset(exit_msr_load, 0, PAGE_SIZE);
  1600. memset(entry_msr_load, 0, PAGE_SIZE);
  1601. entry_msr_load[0].index = MSR_KERNEL_GS_BASE;
  1602. entry_msr_load[0].value = MSR_MAGIC;
  1603. vmx_set_test_stage(1);
  1604. vmcs_write(ENT_MSR_LD_CNT, 1);
  1605. vmcs_write(ENTER_MSR_LD_ADDR, (u64)entry_msr_load);
  1606. vmcs_write(EXI_MSR_ST_CNT, 1);
  1607. vmcs_write(EXIT_MSR_ST_ADDR, (u64)exit_msr_store);
  1608. vmcs_write(EXI_MSR_LD_CNT, 1);
  1609. vmcs_write(EXIT_MSR_LD_ADDR, (u64)exit_msr_load);
  1610. return VMX_TEST_START;
  1611. }
  1612. static void msr_switch_main()
  1613. {
  1614. if (vmx_get_test_stage() == 1) {
  1615. report("VM entry MSR load",
  1616. rdmsr(MSR_KERNEL_GS_BASE) == MSR_MAGIC);
  1617. vmx_set_test_stage(2);
  1618. wrmsr(MSR_KERNEL_GS_BASE, MSR_MAGIC + 1);
  1619. exit_msr_store[0].index = MSR_KERNEL_GS_BASE;
  1620. exit_msr_load[0].index = MSR_KERNEL_GS_BASE;
  1621. exit_msr_load[0].value = MSR_MAGIC + 2;
  1622. }
  1623. vmcall();
  1624. }
  1625. static int msr_switch_exit_handler()
  1626. {
  1627. ulong reason;
  1628. reason = vmcs_read(EXI_REASON);
  1629. if (reason == VMX_VMCALL && vmx_get_test_stage() == 2) {
  1630. report("VM exit MSR store",
  1631. exit_msr_store[0].value == MSR_MAGIC + 1);
  1632. report("VM exit MSR load",
  1633. rdmsr(MSR_KERNEL_GS_BASE) == MSR_MAGIC + 2);
  1634. vmx_set_test_stage(3);
  1635. entry_msr_load[0].index = MSR_FS_BASE;
  1636. return VMX_TEST_RESUME;
  1637. }
  1638. printf("ERROR %s: unexpected stage=%u or reason=%lu\n",
  1639. __func__, vmx_get_test_stage(), reason);
  1640. return VMX_TEST_EXIT;
  1641. }
  1642. static int msr_switch_entry_failure(struct vmentry_failure *failure)
  1643. {
  1644. ulong reason;
  1645. if (failure->early) {
  1646. printf("ERROR %s: early exit\n", __func__);
  1647. return VMX_TEST_EXIT;
  1648. }
  1649. reason = vmcs_read(EXI_REASON);
  1650. if (reason == (VMX_ENTRY_FAILURE | VMX_FAIL_MSR) &&
  1651. vmx_get_test_stage() == 3) {
  1652. report("VM entry MSR load: try to load FS_BASE",
  1653. vmcs_read(EXI_QUALIFICATION) == 1);
  1654. return VMX_TEST_VMEXIT;
  1655. }
  1656. printf("ERROR %s: unexpected stage=%u or reason=%lu\n",
  1657. __func__, vmx_get_test_stage(), reason);
  1658. return VMX_TEST_EXIT;
  1659. }
  1660. static int vmmcall_init(struct vmcs *vmcs )
  1661. {
  1662. vmcs_write(EXC_BITMAP, 1 << UD_VECTOR);
  1663. return VMX_TEST_START;
  1664. }
  1665. static void vmmcall_main(void)
  1666. {
  1667. asm volatile(
  1668. "mov $0xABCD, %%rax\n\t"
  1669. "vmmcall\n\t"
  1670. ::: "rax");
  1671. report("VMMCALL", 0);
  1672. }
  1673. static int vmmcall_exit_handler()
  1674. {
  1675. ulong reason;
  1676. reason = vmcs_read(EXI_REASON);
  1677. switch (reason) {
  1678. case VMX_VMCALL:
  1679. printf("here\n");
  1680. report("VMMCALL triggers #UD", 0);
  1681. break;
  1682. case VMX_EXC_NMI:
  1683. report("VMMCALL triggers #UD",
  1684. (vmcs_read(EXI_INTR_INFO) & 0xff) == UD_VECTOR);
  1685. break;
  1686. default:
  1687. report("Unknown exit reason, %ld", false, reason);
  1688. print_vmexit_info();
  1689. }
  1690. return VMX_TEST_VMEXIT;
  1691. }
  1692. static int disable_rdtscp_init(struct vmcs *vmcs)
  1693. {
  1694. u32 ctrl_cpu1;
  1695. if (ctrl_cpu_rev[0].clr & CPU_SECONDARY) {
  1696. ctrl_cpu1 = vmcs_read(CPU_EXEC_CTRL1);
  1697. ctrl_cpu1 &= ~CPU_RDTSCP;
  1698. vmcs_write(CPU_EXEC_CTRL1, ctrl_cpu1);
  1699. }
  1700. return VMX_TEST_START;
  1701. }
  1702. static void disable_rdtscp_ud_handler(struct ex_regs *regs)
  1703. {
  1704. switch (vmx_get_test_stage()) {
  1705. case 0:
  1706. report("RDTSCP triggers #UD", true);
  1707. vmx_inc_test_stage();
  1708. regs->rip += 3;
  1709. break;
  1710. case 2:
  1711. report("RDPID triggers #UD", true);
  1712. vmx_inc_test_stage();
  1713. regs->rip += 4;
  1714. break;
  1715. }
  1716. return;
  1717. }
  1718. static void disable_rdtscp_main(void)
  1719. {
  1720. /* Test that #UD is properly injected in L2. */
  1721. handle_exception(UD_VECTOR, disable_rdtscp_ud_handler);
  1722. vmx_set_test_stage(0);
  1723. asm volatile("rdtscp" : : : "eax", "ecx", "edx");
  1724. vmcall();
  1725. asm volatile(".byte 0xf3, 0x0f, 0xc7, 0xf8" : : : "eax");
  1726. vmcall();
  1727. }
  1728. static int disable_rdtscp_exit_handler(void)
  1729. {
  1730. unsigned int reason = vmcs_read(EXI_REASON) & 0xff;
  1731. switch (reason) {
  1732. case VMX_VMCALL:
  1733. switch (vmx_get_test_stage()) {
  1734. case 0:
  1735. report("RDTSCP triggers #UD", false);
  1736. vmx_inc_test_stage();
  1737. /* fallthrough */
  1738. case 1:
  1739. vmx_inc_test_stage();
  1740. vmcs_write(GUEST_RIP, vmcs_read(GUEST_RIP) + 3);
  1741. return VMX_TEST_RESUME;
  1742. case 2:
  1743. report("RDPID triggers #UD", false);
  1744. break;
  1745. }
  1746. break;
  1747. default:
  1748. report("Unknown exit reason, %d", false, reason);
  1749. print_vmexit_info();
  1750. }
  1751. return VMX_TEST_VMEXIT;
  1752. }
  1753. int int3_init()
  1754. {
  1755. vmcs_write(EXC_BITMAP, ~0u);
  1756. return VMX_TEST_START;
  1757. }
  1758. void int3_guest_main()
  1759. {
  1760. asm volatile ("int3");
  1761. }
  1762. int int3_exit_handler()
  1763. {
  1764. u32 reason = vmcs_read(EXI_REASON);
  1765. u32 intr_info = vmcs_read(EXI_INTR_INFO);
  1766. report("L1 intercepts #BP", reason == VMX_EXC_NMI &&
  1767. (intr_info & INTR_INFO_VALID_MASK) &&
  1768. (intr_info & INTR_INFO_VECTOR_MASK) == BP_VECTOR &&
  1769. ((intr_info & INTR_INFO_INTR_TYPE_MASK) >>
  1770. INTR_INFO_INTR_TYPE_SHIFT) == VMX_INTR_TYPE_SOFT_EXCEPTION);
  1771. return VMX_TEST_VMEXIT;
  1772. }
  1773. int into_init()
  1774. {
  1775. vmcs_write(EXC_BITMAP, ~0u);
  1776. return VMX_TEST_START;
  1777. }
  1778. void into_guest_main()
  1779. {
  1780. struct far_pointer32 fp = {
  1781. .offset = (uintptr_t)&&into,
  1782. .selector = KERNEL_CS32,
  1783. };
  1784. register uintptr_t rsp asm("rsp");
  1785. if (fp.offset != (uintptr_t)&&into) {
  1786. printf("Code address too high.\n");
  1787. return;
  1788. }
  1789. if ((u32)rsp != rsp) {
  1790. printf("Stack address too high.\n");
  1791. return;
  1792. }
  1793. asm goto ("lcall *%0" : : "m" (fp) : "rax" : into);
  1794. return;
  1795. into:
  1796. asm volatile (".code32;"
  1797. "movl $0x7fffffff, %eax;"
  1798. "addl %eax, %eax;"
  1799. "into;"
  1800. "lret;"
  1801. ".code64");
  1802. __builtin_unreachable();
  1803. }
  1804. int into_exit_handler()
  1805. {
  1806. u32 reason = vmcs_read(EXI_REASON);
  1807. u32 intr_info = vmcs_read(EXI_INTR_INFO);
  1808. report("L1 intercepts #OF", reason == VMX_EXC_NMI &&
  1809. (intr_info & INTR_INFO_VALID_MASK) &&
  1810. (intr_info & INTR_INFO_VECTOR_MASK) == OF_VECTOR &&
  1811. ((intr_info & INTR_INFO_INTR_TYPE_MASK) >>
  1812. INTR_INFO_INTR_TYPE_SHIFT) == VMX_INTR_TYPE_SOFT_EXCEPTION);
  1813. return VMX_TEST_VMEXIT;
  1814. }
  1815. static void exit_monitor_from_l2_main(void)
  1816. {
  1817. printf("Calling exit(0) from l2...\n");
  1818. exit(0);
  1819. }
  1820. static int exit_monitor_from_l2_handler(void)
  1821. {
  1822. report("The guest should have killed the VMM", false);
  1823. return VMX_TEST_EXIT;
  1824. }
  1825. static void assert_exit_reason(u64 expected)
  1826. {
  1827. u64 actual = vmcs_read(EXI_REASON);
  1828. TEST_ASSERT_EQ_MSG(expected, actual, "Expected %s, got %s.",
  1829. exit_reason_description(expected),
  1830. exit_reason_description(actual));
  1831. }
  1832. static void skip_exit_vmcall()
  1833. {
  1834. u64 guest_rip = vmcs_read(GUEST_RIP);
  1835. u32 insn_len = vmcs_read(EXI_INST_LEN);
  1836. assert_exit_reason(VMX_VMCALL);
  1837. vmcs_write(GUEST_RIP, guest_rip + insn_len);
  1838. }
  1839. static void v2_null_test_guest(void)
  1840. {
  1841. }
  1842. static void v2_null_test(void)
  1843. {
  1844. test_set_guest(v2_null_test_guest);
  1845. enter_guest();
  1846. report(__func__, 1);
  1847. }
  1848. static void v2_multiple_entries_test_guest(void)
  1849. {
  1850. vmx_set_test_stage(1);
  1851. vmcall();
  1852. vmx_set_test_stage(2);
  1853. }
  1854. static void v2_multiple_entries_test(void)
  1855. {
  1856. test_set_guest(v2_multiple_entries_test_guest);
  1857. enter_guest();
  1858. TEST_ASSERT_EQ(vmx_get_test_stage(), 1);
  1859. skip_exit_vmcall();
  1860. enter_guest();
  1861. TEST_ASSERT_EQ(vmx_get_test_stage(), 2);
  1862. report(__func__, 1);
  1863. }
  1864. static int fixture_test_data = 1;
  1865. static void fixture_test_teardown(void *data)
  1866. {
  1867. *((int *) data) = 1;
  1868. }
  1869. static void fixture_test_guest(void)
  1870. {
  1871. fixture_test_data++;
  1872. }
  1873. static void fixture_test_setup(void)
  1874. {
  1875. TEST_ASSERT_EQ_MSG(1, fixture_test_data,
  1876. "fixture_test_teardown didn't run?!");
  1877. fixture_test_data = 2;
  1878. test_add_teardown(fixture_test_teardown, &fixture_test_data);
  1879. test_set_guest(fixture_test_guest);
  1880. }
  1881. static void fixture_test_case1(void)
  1882. {
  1883. fixture_test_setup();
  1884. TEST_ASSERT_EQ(2, fixture_test_data);
  1885. enter_guest();
  1886. TEST_ASSERT_EQ(3, fixture_test_data);
  1887. report(__func__, 1);
  1888. }
  1889. static void fixture_test_case2(void)
  1890. {
  1891. fixture_test_setup();
  1892. TEST_ASSERT_EQ(2, fixture_test_data);
  1893. enter_guest();
  1894. TEST_ASSERT_EQ(3, fixture_test_data);
  1895. report(__func__, 1);
  1896. }
  1897. enum ept_access_op {
  1898. OP_READ,
  1899. OP_WRITE,
  1900. OP_EXEC,
  1901. OP_FLUSH_TLB,
  1902. OP_EXIT,
  1903. };
  1904. static struct ept_access_test_data {
  1905. unsigned long gpa;
  1906. unsigned long *gva;
  1907. unsigned long hpa;
  1908. unsigned long *hva;
  1909. enum ept_access_op op;
  1910. } ept_access_test_data;
  1911. extern unsigned char ret42_start;
  1912. extern unsigned char ret42_end;
  1913. /* Returns 42. */
  1914. asm(
  1915. ".align 64\n"
  1916. "ret42_start:\n"
  1917. "mov $42, %eax\n"
  1918. "ret\n"
  1919. "ret42_end:\n"
  1920. );
  1921. static void
  1922. diagnose_ept_violation_qual(u64 expected, u64 actual)
  1923. {
  1924. #define DIAGNOSE(flag) \
  1925. do { \
  1926. if ((expected & flag) != (actual & flag)) \
  1927. printf(#flag " %sexpected\n", \
  1928. (expected & flag) ? "" : "un"); \
  1929. } while (0)
  1930. DIAGNOSE(EPT_VLT_RD);
  1931. DIAGNOSE(EPT_VLT_WR);
  1932. DIAGNOSE(EPT_VLT_FETCH);
  1933. DIAGNOSE(EPT_VLT_PERM_RD);
  1934. DIAGNOSE(EPT_VLT_PERM_WR);
  1935. DIAGNOSE(EPT_VLT_PERM_EX);
  1936. DIAGNOSE(EPT_VLT_LADDR_VLD);
  1937. DIAGNOSE(EPT_VLT_PADDR);
  1938. #undef DIAGNOSE
  1939. }
  1940. static void do_ept_access_op(enum ept_access_op op)
  1941. {
  1942. ept_access_test_data.op = op;
  1943. enter_guest();
  1944. }
  1945. /*
  1946. * Force the guest to flush its TLB (i.e., flush gva -> gpa mappings). Only
  1947. * needed by tests that modify guest PTEs.
  1948. */
  1949. static void ept_access_test_guest_flush_tlb(void)
  1950. {
  1951. do_ept_access_op(OP_FLUSH_TLB);
  1952. skip_exit_vmcall();
  1953. }
  1954. /*
  1955. * Modifies the EPT entry at @level in the mapping of @gpa. First clears the
  1956. * bits in @clear then sets the bits in @set. @mkhuge transforms the entry into
  1957. * a huge page.
  1958. */
  1959. static unsigned long ept_twiddle(unsigned long gpa, bool mkhuge, int level,
  1960. unsigned long clear, unsigned long set)
  1961. {
  1962. struct ept_access_test_data *data = &ept_access_test_data;
  1963. unsigned long orig_pte;
  1964. unsigned long pte;
  1965. /* Screw with the mapping at the requested level. */
  1966. TEST_ASSERT(get_ept_pte(pml4, gpa, level, &orig_pte));
  1967. pte = orig_pte;
  1968. if (mkhuge)
  1969. pte = (orig_pte & ~EPT_ADDR_MASK) | data->hpa | EPT_LARGE_PAGE;
  1970. else
  1971. pte = orig_pte;
  1972. pte = (pte & ~clear) | set;
  1973. set_ept_pte(pml4, gpa, level, pte);
  1974. ept_sync(INVEPT_SINGLE, eptp);
  1975. return orig_pte;
  1976. }
  1977. static void ept_untwiddle(unsigned long gpa, int level, unsigned long orig_pte)
  1978. {
  1979. set_ept_pte(pml4, gpa, level, orig_pte);
  1980. }
  1981. static void do_ept_violation(bool leaf, enum ept_access_op op,
  1982. u64 expected_qual, u64 expected_paddr)
  1983. {
  1984. u64 qual;
  1985. /* Try the access and observe the violation. */
  1986. do_ept_access_op(op);
  1987. assert_exit_reason(VMX_EPT_VIOLATION);
  1988. qual = vmcs_read(EXI_QUALIFICATION);
  1989. diagnose_ept_violation_qual(expected_qual, qual);
  1990. TEST_EXPECT_EQ(expected_qual, qual);
  1991. #if 0
  1992. /* Disable for now otherwise every test will fail */
  1993. TEST_EXPECT_EQ(vmcs_read(GUEST_LINEAR_ADDRESS),
  1994. (unsigned long) (
  1995. op == OP_EXEC ? data->gva + 1 : data->gva));
  1996. #endif
  1997. /*
  1998. * TODO: tests that probe expected_paddr in pages other than the one at
  1999. * the beginning of the 1g region.
  2000. */
  2001. TEST_EXPECT_EQ(vmcs_read(INFO_PHYS_ADDR), expected_paddr);
  2002. }
  2003. static void
  2004. ept_violation_at_level_mkhuge(bool mkhuge, int level, unsigned long clear,
  2005. unsigned long set, enum ept_access_op op,
  2006. u64 expected_qual)
  2007. {
  2008. struct ept_access_test_data *data = &ept_access_test_data;
  2009. unsigned long orig_pte;
  2010. orig_pte = ept_twiddle(data->gpa, mkhuge, level, clear, set);
  2011. do_ept_violation(level == 1 || mkhuge, op, expected_qual,
  2012. op == OP_EXEC ? data->gpa + sizeof(unsigned long) :
  2013. data->gpa);
  2014. /* Fix the violation and resume the op loop. */
  2015. ept_untwiddle(data->gpa, level, orig_pte);
  2016. enter_guest();
  2017. skip_exit_vmcall();
  2018. }
  2019. static void
  2020. ept_violation_at_level(int level, unsigned long clear, unsigned long set,
  2021. enum ept_access_op op, u64 expected_qual)
  2022. {
  2023. ept_violation_at_level_mkhuge(false, level, clear, set, op,
  2024. expected_qual);
  2025. if (ept_huge_pages_supported(level))
  2026. ept_violation_at_level_mkhuge(true, level, clear, set, op,
  2027. expected_qual);
  2028. }
  2029. static void ept_violation(unsigned long clear, unsigned long set,
  2030. enum ept_access_op op, u64 expected_qual)
  2031. {
  2032. ept_violation_at_level(1, clear, set, op, expected_qual);
  2033. ept_violation_at_level(2, clear, set, op, expected_qual);
  2034. ept_violation_at_level(3, clear, set, op, expected_qual);
  2035. ept_violation_at_level(4, clear, set, op, expected_qual);
  2036. }
  2037. static void ept_access_violation(unsigned long access, enum ept_access_op op,
  2038. u64 expected_qual)
  2039. {
  2040. ept_violation(EPT_PRESENT, access, op,
  2041. expected_qual | EPT_VLT_LADDR_VLD | EPT_VLT_PADDR);
  2042. }
  2043. /*
  2044. * For translations that don't involve a GVA, that is physical address (paddr)
  2045. * accesses, EPT violations don't set the flag EPT_VLT_PADDR. For a typical
  2046. * guest memory access, the hardware does GVA -> GPA -> HPA. However, certain
  2047. * translations don't involve GVAs, such as when the hardware does the guest
  2048. * page table walk. For example, in translating GVA_1 -> GPA_1, the guest MMU
  2049. * might try to set an A bit on a guest PTE. If the GPA_2 that the PTE resides
  2050. * on isn't present in the EPT, then the EPT violation will be for GPA_2 and
  2051. * the EPT_VLT_PADDR bit will be clear in the exit qualification.
  2052. *
  2053. * Note that paddr violations can also be triggered by loading PAE page tables
  2054. * with wonky addresses. We don't test that yet.
  2055. *
  2056. * This function modifies the EPT entry that maps the GPA that the guest page
  2057. * table entry mapping ept_access_data.gva resides on.
  2058. *
  2059. * @ept_access EPT permissions to set. Other permissions are cleared.
  2060. *
  2061. * @pte_ad Set the A/D bits on the guest PTE accordingly.
  2062. *
  2063. * @op Guest operation to perform with ept_access_data.gva.
  2064. *
  2065. * @expect_violation
  2066. * Is a violation expected during the paddr access?
  2067. *
  2068. * @expected_qual Expected qualification for the EPT violation.
  2069. * EPT_VLT_PADDR should be clear.
  2070. */
  2071. static void ept_access_paddr(unsigned long ept_access, unsigned long pte_ad,
  2072. enum ept_access_op op, bool expect_violation,
  2073. u64 expected_qual)
  2074. {
  2075. struct ept_access_test_data *data = &ept_access_test_data;
  2076. unsigned long *ptep;
  2077. unsigned long gpa;
  2078. unsigned long orig_epte;
  2079. /* Modify the guest PTE mapping data->gva according to @pte_ad. */
  2080. ptep = get_pte_level(current_page_table(), data->gva, /*level=*/1);
  2081. TEST_ASSERT(ptep);
  2082. TEST_ASSERT_EQ(*ptep & PT_ADDR_MASK, data->gpa);
  2083. *ptep = (*ptep & ~PT_AD_MASK) | pte_ad;
  2084. ept_access_test_guest_flush_tlb();
  2085. /*
  2086. * Now modify the access bits on the EPT entry for the GPA that the
  2087. * guest PTE resides on. Note that by modifying a single EPT entry,
  2088. * we're potentially affecting 512 guest PTEs. However, we've carefully
  2089. * constructed our test such that those other 511 PTEs aren't used by
  2090. * the guest: data->gva is at the beginning of a 1G huge page, thus the
  2091. * PTE we're modifying is at the beginning of a 4K page and the
  2092. * following 511 entires are also under our control (and not touched by
  2093. * the guest).
  2094. */
  2095. gpa = virt_to_phys(ptep);
  2096. TEST_ASSERT_EQ(gpa & ~PAGE_MASK, 0);
  2097. /*
  2098. * Make sure the guest page table page is mapped with a 4K EPT entry,
  2099. * otherwise our level=1 twiddling below will fail. We use the
  2100. * identity map (gpa = gpa) since page tables are shared with the host.
  2101. */
  2102. install_ept(pml4, gpa, gpa, EPT_PRESENT);
  2103. orig_epte = ept_twiddle(gpa, /*mkhuge=*/0, /*level=*/1,
  2104. /*clear=*/EPT_PRESENT, /*set=*/ept_access);
  2105. if (expect_violation) {
  2106. do_ept_violation(/*leaf=*/true, op,
  2107. expected_qual | EPT_VLT_LADDR_VLD, gpa);
  2108. ept_untwiddle(gpa, /*level=*/1, orig_epte);
  2109. do_ept_access_op(op);
  2110. } else {
  2111. do_ept_access_op(op);
  2112. ept_untwiddle(gpa, /*level=*/1, orig_epte);
  2113. }
  2114. TEST_ASSERT(*ptep & PT_ACCESSED_MASK);
  2115. if ((pte_ad & PT_DIRTY_MASK) || op == OP_WRITE)
  2116. TEST_ASSERT(*ptep & PT_DIRTY_MASK);
  2117. skip_exit_vmcall();
  2118. }
  2119. static void ept_access_allowed_paddr(unsigned long ept_access,
  2120. unsigned long pte_ad,
  2121. enum ept_access_op op)
  2122. {
  2123. ept_access_paddr(ept_access, pte_ad, op, /*expect_violation=*/false,
  2124. /*expected_qual=*/-1);
  2125. }
  2126. static void ept_access_violation_paddr(unsigned long ept_access,
  2127. unsigned long pte_ad,
  2128. enum ept_access_op op,
  2129. u64 expected_qual)
  2130. {
  2131. ept_access_paddr(ept_access, pte_ad, op, /*expect_violation=*/true,
  2132. expected_qual);
  2133. }
  2134. static void ept_allowed_at_level_mkhuge(bool mkhuge, int level,
  2135. unsigned long clear,
  2136. unsigned long set,
  2137. enum ept_access_op op)
  2138. {
  2139. struct ept_access_test_data *data = &ept_access_test_data;
  2140. unsigned long orig_pte;
  2141. orig_pte = ept_twiddle(data->gpa, mkhuge, level, clear, set);
  2142. /* No violation. Should proceed to vmcall. */
  2143. do_ept_access_op(op);
  2144. skip_exit_vmcall();
  2145. ept_untwiddle(data->gpa, level, orig_pte);
  2146. }
  2147. static void ept_allowed_at_level(int level, unsigned long clear,
  2148. unsigned long set, enum ept_access_op op)
  2149. {
  2150. ept_allowed_at_level_mkhuge(false, level, clear, set, op);
  2151. if (ept_huge_pages_supported(level))
  2152. ept_allowed_at_level_mkhuge(true, level, clear, set, op);
  2153. }
  2154. static void ept_allowed(unsigned long clear, unsigned long set,
  2155. enum ept_access_op op)
  2156. {
  2157. ept_allowed_at_level(1, clear, set, op);
  2158. ept_allowed_at_level(2, clear, set, op);
  2159. ept_allowed_at_level(3, clear, set, op);
  2160. ept_allowed_at_level(4, clear, set, op);
  2161. }
  2162. static void ept_ignored_bit(int bit)
  2163. {
  2164. /* Set the bit. */
  2165. ept_allowed(0, 1ul << bit, OP_READ);
  2166. ept_allowed(0, 1ul << bit, OP_WRITE);
  2167. ept_allowed(0, 1ul << bit, OP_EXEC);
  2168. /* Clear the bit. */
  2169. ept_allowed(1ul << bit, 0, OP_READ);
  2170. ept_allowed(1ul << bit, 0, OP_WRITE);
  2171. ept_allowed(1ul << bit, 0, OP_EXEC);
  2172. }
  2173. static void ept_access_allowed(unsigned long access, enum ept_access_op op)
  2174. {
  2175. ept_allowed(EPT_PRESENT, access, op);
  2176. }
  2177. static void ept_misconfig_at_level_mkhuge_op(bool mkhuge, int level,
  2178. unsigned long clear,
  2179. unsigned long set,
  2180. enum ept_access_op op)
  2181. {
  2182. struct ept_access_test_data *data = &ept_access_test_data;
  2183. unsigned long orig_pte;
  2184. orig_pte = ept_twiddle(data->gpa, mkhuge, level, clear, set);
  2185. do_ept_access_op(op);
  2186. assert_exit_reason(VMX_EPT_MISCONFIG);
  2187. /* Intel 27.2.1, "For all other VM exits, this field is cleared." */
  2188. #if 0
  2189. /* broken: */
  2190. TEST_EXPECT_EQ_MSG(vmcs_read(EXI_QUALIFICATION), 0);
  2191. #endif
  2192. #if 0
  2193. /*
  2194. * broken:
  2195. * According to description of exit qual for EPT violation,
  2196. * EPT_VLT_LADDR_VLD indicates if GUEST_LINEAR_ADDRESS is valid.
  2197. * However, I can't find anything that says GUEST_LINEAR_ADDRESS ought
  2198. * to be set for msiconfig.
  2199. */
  2200. TEST_EXPECT_EQ(vmcs_read(GUEST_LINEAR_ADDRESS),
  2201. (unsigned long) (
  2202. op == OP_EXEC ? data->gva + 1 : data->gva));
  2203. #endif
  2204. /* Fix the violation and resume the op loop. */
  2205. ept_untwiddle(data->gpa, level, orig_pte);
  2206. enter_guest();
  2207. skip_exit_vmcall();
  2208. }
  2209. static void ept_misconfig_at_level_mkhuge(bool mkhuge, int level,
  2210. unsigned long clear,
  2211. unsigned long set)
  2212. {
  2213. /* The op shouldn't matter (read, write, exec), so try them all! */
  2214. ept_misconfig_at_level_mkhuge_op(mkhuge, level, clear, set, OP_READ);
  2215. ept_misconfig_at_level_mkhuge_op(mkhuge, level, clear, set, OP_WRITE);
  2216. ept_misconfig_at_level_mkhuge_op(mkhuge, level, clear, set, OP_EXEC);
  2217. }
  2218. static void ept_misconfig_at_level(int level, unsigned long clear,
  2219. unsigned long set)
  2220. {
  2221. ept_misconfig_at_level_mkhuge(false, level, clear, set);
  2222. if (ept_huge_pages_supported(level))
  2223. ept_misconfig_at_level_mkhuge(true, level, clear, set);
  2224. }
  2225. static void ept_misconfig(unsigned long clear, unsigned long set)
  2226. {
  2227. ept_misconfig_at_level(1, clear, set);
  2228. ept_misconfig_at_level(2, clear, set);
  2229. ept_misconfig_at_level(3, clear, set);
  2230. ept_misconfig_at_level(4, clear, set);
  2231. }
  2232. static void ept_access_misconfig(unsigned long access)
  2233. {
  2234. ept_misconfig(EPT_PRESENT, access);
  2235. }
  2236. static void ept_reserved_bit_at_level_nohuge(int level, int bit)
  2237. {
  2238. /* Setting the bit causes a misconfig. */
  2239. ept_misconfig_at_level_mkhuge(false, level, 0, 1ul << bit);
  2240. /* Making the entry non-present turns reserved bits into ignored. */
  2241. ept_violation_at_level(level, EPT_PRESENT, 1ul << bit, OP_READ,
  2242. EPT_VLT_RD | EPT_VLT_LADDR_VLD | EPT_VLT_PADDR);
  2243. }
  2244. static void ept_reserved_bit_at_level_huge(int level, int bit)
  2245. {
  2246. /* Setting the bit causes a misconfig. */
  2247. ept_misconfig_at_level_mkhuge(true, level, 0, 1ul << bit);
  2248. /* Making the entry non-present turns reserved bits into ignored. */
  2249. ept_violation_at_level(level, EPT_PRESENT, 1ul << bit, OP_READ,
  2250. EPT_VLT_RD | EPT_VLT_LADDR_VLD | EPT_VLT_PADDR);
  2251. }
  2252. static void ept_reserved_bit_at_level(int level, int bit)
  2253. {
  2254. /* Setting the bit causes a misconfig. */
  2255. ept_misconfig_at_level(level, 0, 1ul << bit);
  2256. /* Making the entry non-present turns reserved bits into ignored. */
  2257. ept_violation_at_level(level, EPT_PRESENT, 1ul << bit, OP_READ,
  2258. EPT_VLT_RD | EPT_VLT_LADDR_VLD | EPT_VLT_PADDR);
  2259. }
  2260. static void ept_reserved_bit(int bit)
  2261. {
  2262. ept_reserved_bit_at_level(1, bit);
  2263. ept_reserved_bit_at_level(2, bit);
  2264. ept_reserved_bit_at_level(3, bit);
  2265. ept_reserved_bit_at_level(4, bit);
  2266. }
  2267. #define PAGE_2M_ORDER 9
  2268. #define PAGE_1G_ORDER 18
  2269. static void *get_1g_page(void)
  2270. {
  2271. static void *alloc;
  2272. if (!alloc)
  2273. alloc = alloc_pages(PAGE_1G_ORDER);
  2274. return alloc;
  2275. }
  2276. static void ept_access_test_teardown(void *unused)
  2277. {
  2278. /* Exit the guest cleanly. */
  2279. do_ept_access_op(OP_EXIT);
  2280. }
  2281. static void ept_access_test_guest(void)
  2282. {
  2283. struct ept_access_test_data *data = &ept_access_test_data;
  2284. int (*code)(void) = (int (*)(void)) &data->gva[1];
  2285. while (true) {
  2286. switch (data->op) {
  2287. case OP_READ:
  2288. TEST_ASSERT_EQ(*data->gva, MAGIC_VAL_1);
  2289. break;
  2290. case OP_WRITE:
  2291. *data->gva = MAGIC_VAL_2;
  2292. TEST_ASSERT_EQ(*data->gva, MAGIC_VAL_2);
  2293. *data->gva = MAGIC_VAL_1;
  2294. break;
  2295. case OP_EXEC:
  2296. TEST_ASSERT_EQ(42, code());
  2297. break;
  2298. case OP_FLUSH_TLB:
  2299. write_cr3(read_cr3());
  2300. break;
  2301. case OP_EXIT:
  2302. return;
  2303. default:
  2304. TEST_ASSERT_MSG(false, "Unknown op %d", data->op);
  2305. }
  2306. vmcall();
  2307. }
  2308. }
  2309. static void ept_access_test_setup(void)
  2310. {
  2311. struct ept_access_test_data *data = &ept_access_test_data;
  2312. unsigned long npages = 1ul << PAGE_1G_ORDER;
  2313. unsigned long size = npages * PAGE_SIZE;
  2314. unsigned long *page_table = current_page_table();
  2315. unsigned long pte;
  2316. if (setup_ept(false))
  2317. test_skip("EPT not supported");
  2318. test_set_guest(ept_access_test_guest);
  2319. test_add_teardown(ept_access_test_teardown, NULL);
  2320. data->hva = get_1g_page();
  2321. TEST_ASSERT(data->hva);
  2322. data->hpa = virt_to_phys(data->hva);
  2323. data->gpa = 1ul << 40;
  2324. data->gva = (void *) ALIGN((unsigned long) alloc_vpages(npages * 2),
  2325. size);
  2326. TEST_ASSERT(!any_present_pages(page_table, data->gva, size));
  2327. install_pages(page_table, data->gpa, size, data->gva);
  2328. /*
  2329. * Make sure nothing's mapped here so the tests that screw with the
  2330. * pml4 entry don't inadvertently break something.
  2331. */
  2332. TEST_ASSERT(get_ept_pte(pml4, data->gpa, 4, &pte) && pte == 0);
  2333. TEST_ASSERT(get_ept_pte(pml4, data->gpa + size - 1, 4, &pte) && pte == 0);
  2334. install_ept(pml4, data->hpa, data->gpa, EPT_PRESENT);
  2335. data->hva[0] = MAGIC_VAL_1;
  2336. memcpy(&data->hva[1], &ret42_start, &ret42_end - &ret42_start);
  2337. }
  2338. static void ept_access_test_not_present(void)
  2339. {
  2340. ept_access_test_setup();
  2341. /* --- */
  2342. ept_access_violation(0, OP_READ, EPT_VLT_RD);
  2343. ept_access_violation(0, OP_WRITE, EPT_VLT_WR);
  2344. ept_access_violation(0, OP_EXEC, EPT_VLT_FETCH);
  2345. }
  2346. static void ept_access_test_read_only(void)
  2347. {
  2348. ept_access_test_setup();
  2349. /* r-- */
  2350. ept_access_allowed(EPT_RA, OP_READ);
  2351. ept_access_violation(EPT_RA, OP_WRITE, EPT_VLT_WR | EPT_VLT_PERM_RD);
  2352. ept_access_violation(EPT_RA, OP_EXEC, EPT_VLT_FETCH | EPT_VLT_PERM_RD);
  2353. }
  2354. static void ept_access_test_write_only(void)
  2355. {
  2356. ept_access_test_setup();
  2357. /* -w- */
  2358. ept_access_misconfig(EPT_WA);
  2359. }
  2360. static void ept_access_test_read_write(void)
  2361. {
  2362. ept_access_test_setup();
  2363. /* rw- */
  2364. ept_access_allowed(EPT_RA | EPT_WA, OP_READ);
  2365. ept_access_allowed(EPT_RA | EPT_WA, OP_WRITE);
  2366. ept_access_violation(EPT_RA | EPT_WA, OP_EXEC,
  2367. EPT_VLT_FETCH | EPT_VLT_PERM_RD | EPT_VLT_PERM_WR);
  2368. }
  2369. static void ept_access_test_execute_only(void)
  2370. {
  2371. ept_access_test_setup();
  2372. /* --x */
  2373. if (ept_execute_only_supported()) {
  2374. ept_access_violation(EPT_EA, OP_READ,
  2375. EPT_VLT_RD | EPT_VLT_PERM_EX);
  2376. ept_access_violation(EPT_EA, OP_WRITE,
  2377. EPT_VLT_WR | EPT_VLT_PERM_EX);
  2378. ept_access_allowed(EPT_EA, OP_EXEC);
  2379. } else {
  2380. ept_access_misconfig(EPT_EA);
  2381. }
  2382. }
  2383. static void ept_access_test_read_execute(void)
  2384. {
  2385. ept_access_test_setup();
  2386. /* r-x */
  2387. ept_access_allowed(EPT_RA | EPT_EA, OP_READ);
  2388. ept_access_violation(EPT_RA | EPT_EA, OP_WRITE,
  2389. EPT_VLT_WR | EPT_VLT_PERM_RD | EPT_VLT_PERM_EX);
  2390. ept_access_allowed(EPT_RA | EPT_EA, OP_EXEC);
  2391. }
  2392. static void ept_access_test_write_execute(void)
  2393. {
  2394. ept_access_test_setup();
  2395. /* -wx */
  2396. ept_access_misconfig(EPT_WA | EPT_EA);
  2397. }
  2398. static void ept_access_test_read_write_execute(void)
  2399. {
  2400. ept_access_test_setup();
  2401. /* rwx */
  2402. ept_access_allowed(EPT_RA | EPT_WA | EPT_EA, OP_READ);
  2403. ept_access_allowed(EPT_RA | EPT_WA | EPT_EA, OP_WRITE);
  2404. ept_access_allowed(EPT_RA | EPT_WA | EPT_EA, OP_EXEC);
  2405. }
  2406. static void ept_access_test_reserved_bits(void)
  2407. {
  2408. int i;
  2409. int maxphyaddr;
  2410. ept_access_test_setup();
  2411. /* Reserved bits above maxphyaddr. */
  2412. maxphyaddr = cpuid_maxphyaddr();
  2413. for (i = maxphyaddr; i <= 51; i++) {
  2414. report_prefix_pushf("reserved_bit=%d", i);
  2415. ept_reserved_bit(i);
  2416. report_prefix_pop();
  2417. }
  2418. /* Level-specific reserved bits. */
  2419. ept_reserved_bit_at_level_nohuge(2, 3);
  2420. ept_reserved_bit_at_level_nohuge(2, 4);
  2421. ept_reserved_bit_at_level_nohuge(2, 5);
  2422. ept_reserved_bit_at_level_nohuge(2, 6);
  2423. /* 2M alignment. */
  2424. for (i = 12; i < 20; i++) {
  2425. report_prefix_pushf("reserved_bit=%d", i);
  2426. ept_reserved_bit_at_level_huge(2, i);
  2427. report_prefix_pop();
  2428. }
  2429. ept_reserved_bit_at_level_nohuge(3, 3);
  2430. ept_reserved_bit_at_level_nohuge(3, 4);
  2431. ept_reserved_bit_at_level_nohuge(3, 5);
  2432. ept_reserved_bit_at_level_nohuge(3, 6);
  2433. /* 1G alignment. */
  2434. for (i = 12; i < 29; i++) {
  2435. report_prefix_pushf("reserved_bit=%d", i);
  2436. ept_reserved_bit_at_level_huge(3, i);
  2437. report_prefix_pop();
  2438. }
  2439. ept_reserved_bit_at_level(4, 3);
  2440. ept_reserved_bit_at_level(4, 4);
  2441. ept_reserved_bit_at_level(4, 5);
  2442. ept_reserved_bit_at_level(4, 6);
  2443. ept_reserved_bit_at_level(4, 7);
  2444. }
  2445. static void ept_access_test_ignored_bits(void)
  2446. {
  2447. ept_access_test_setup();
  2448. /*
  2449. * Bits ignored at every level. Bits 8 and 9 (A and D) are ignored as
  2450. * far as translation is concerned even if AD bits are enabled in the
  2451. * EPTP. Bit 63 is ignored because "EPT-violation #VE" VM-execution
  2452. * control is 0.
  2453. */
  2454. ept_ignored_bit(8);
  2455. ept_ignored_bit(9);
  2456. ept_ignored_bit(10);
  2457. ept_ignored_bit(11);
  2458. ept_ignored_bit(52);
  2459. ept_ignored_bit(53);
  2460. ept_ignored_bit(54);
  2461. ept_ignored_bit(55);
  2462. ept_ignored_bit(56);
  2463. ept_ignored_bit(57);
  2464. ept_ignored_bit(58);
  2465. ept_ignored_bit(59);
  2466. ept_ignored_bit(60);
  2467. ept_ignored_bit(61);
  2468. ept_ignored_bit(62);
  2469. ept_ignored_bit(63);
  2470. }
  2471. static void ept_access_test_paddr_not_present_ad_disabled(void)
  2472. {
  2473. ept_access_test_setup();
  2474. ept_disable_ad_bits();
  2475. ept_access_violation_paddr(0, PT_AD_MASK, OP_READ, EPT_VLT_RD);
  2476. ept_access_violation_paddr(0, PT_AD_MASK, OP_WRITE, EPT_VLT_RD);
  2477. ept_access_violation_paddr(0, PT_AD_MASK, OP_EXEC, EPT_VLT_RD);
  2478. }
  2479. static void ept_access_test_paddr_not_present_ad_enabled(void)
  2480. {
  2481. u64 qual = EPT_VLT_RD | EPT_VLT_WR;
  2482. ept_access_test_setup();
  2483. ept_enable_ad_bits_or_skip_test();
  2484. ept_access_violation_paddr(0, PT_AD_MASK, OP_READ, qual);
  2485. ept_access_violation_paddr(0, PT_AD_MASK, OP_WRITE, qual);
  2486. ept_access_violation_paddr(0, PT_AD_MASK, OP_EXEC, qual);
  2487. }
  2488. static void ept_access_test_paddr_read_only_ad_disabled(void)
  2489. {
  2490. /*
  2491. * When EPT AD bits are disabled, all accesses to guest paging
  2492. * structures are reported separately as a read and (after
  2493. * translation of the GPA to host physical address) a read+write
  2494. * if the A/D bits have to be set.
  2495. */
  2496. u64 qual = EPT_VLT_WR | EPT_VLT_RD | EPT_VLT_PERM_RD;
  2497. ept_access_test_setup();
  2498. ept_disable_ad_bits();
  2499. /* Can't update A bit, so all accesses fail. */
  2500. ept_access_violation_paddr(EPT_RA, 0, OP_READ, qual);
  2501. ept_access_violation_paddr(EPT_RA, 0, OP_WRITE, qual);
  2502. ept_access_violation_paddr(EPT_RA, 0, OP_EXEC, qual);
  2503. /* AD bits disabled, so only writes try to update the D bit. */
  2504. ept_access_allowed_paddr(EPT_RA, PT_ACCESSED_MASK, OP_READ);
  2505. ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_WRITE, qual);
  2506. ept_access_allowed_paddr(EPT_RA, PT_ACCESSED_MASK, OP_EXEC);
  2507. /* Both A and D already set, so read-only is OK. */
  2508. ept_access_allowed_paddr(EPT_RA, PT_AD_MASK, OP_READ);
  2509. ept_access_allowed_paddr(EPT_RA, PT_AD_MASK, OP_WRITE);
  2510. ept_access_allowed_paddr(EPT_RA, PT_AD_MASK, OP_EXEC);
  2511. }
  2512. static void ept_access_test_paddr_read_only_ad_enabled(void)
  2513. {
  2514. /*
  2515. * When EPT AD bits are enabled, all accesses to guest paging
  2516. * structures are considered writes as far as EPT translation
  2517. * is concerned.
  2518. */
  2519. u64 qual = EPT_VLT_WR | EPT_VLT_RD | EPT_VLT_PERM_RD;
  2520. ept_access_test_setup();
  2521. ept_enable_ad_bits_or_skip_test();
  2522. ept_access_violation_paddr(EPT_RA, 0, OP_READ, qual);
  2523. ept_access_violation_paddr(EPT_RA, 0, OP_WRITE, qual);
  2524. ept_access_violation_paddr(EPT_RA, 0, OP_EXEC, qual);
  2525. ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_READ, qual);
  2526. ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_WRITE, qual);
  2527. ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_EXEC, qual);
  2528. ept_access_violation_paddr(EPT_RA, PT_AD_MASK, OP_READ, qual);
  2529. ept_access_violation_paddr(EPT_RA, PT_AD_MASK, OP_WRITE, qual);
  2530. ept_access_violation_paddr(EPT_RA, PT_AD_MASK, OP_EXEC, qual);
  2531. }
  2532. static void ept_access_test_paddr_read_write(void)
  2533. {
  2534. ept_access_test_setup();
  2535. /* Read-write access to paging structure. */
  2536. ept_access_allowed_paddr(EPT_RA | EPT_WA, 0, OP_READ);
  2537. ept_access_allowed_paddr(EPT_RA | EPT_WA, 0, OP_WRITE);
  2538. ept_access_allowed_paddr(EPT_RA | EPT_WA, 0, OP_EXEC);
  2539. }
  2540. static void ept_access_test_paddr_read_write_execute(void)
  2541. {
  2542. ept_access_test_setup();
  2543. /* RWX access to paging structure. */
  2544. ept_access_allowed_paddr(EPT_PRESENT, 0, OP_READ);
  2545. ept_access_allowed_paddr(EPT_PRESENT, 0, OP_WRITE);
  2546. ept_access_allowed_paddr(EPT_PRESENT, 0, OP_EXEC);
  2547. }
  2548. static void ept_access_test_paddr_read_execute_ad_disabled(void)
  2549. {
  2550. /*
  2551. * When EPT AD bits are disabled, all accesses to guest paging
  2552. * structures are reported separately as a read and (after
  2553. * translation of the GPA to host physical address) a read+write
  2554. * if the A/D bits have to be set.
  2555. */
  2556. u64 qual = EPT_VLT_WR | EPT_VLT_RD | EPT_VLT_PERM_RD | EPT_VLT_PERM_EX;
  2557. ept_access_test_setup();
  2558. ept_disable_ad_bits();
  2559. /* Can't update A bit, so all accesses fail. */
  2560. ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_READ, qual);
  2561. ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_WRITE, qual);
  2562. ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_EXEC, qual);
  2563. /* AD bits disabled, so only writes try to update the D bit. */
  2564. ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_READ);
  2565. ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_WRITE, qual);
  2566. ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_EXEC);
  2567. /* Both A and D already set, so read-only is OK. */
  2568. ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_READ);
  2569. ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_WRITE);
  2570. ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_EXEC);
  2571. }
  2572. static void ept_access_test_paddr_read_execute_ad_enabled(void)
  2573. {
  2574. /*
  2575. * When EPT AD bits are enabled, all accesses to guest paging
  2576. * structures are considered writes as far as EPT translation
  2577. * is concerned.
  2578. */
  2579. u64 qual = EPT_VLT_WR | EPT_VLT_RD | EPT_VLT_PERM_RD | EPT_VLT_PERM_EX;
  2580. ept_access_test_setup();
  2581. ept_enable_ad_bits_or_skip_test();
  2582. ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_READ, qual);
  2583. ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_WRITE, qual);
  2584. ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_EXEC, qual);
  2585. ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_READ, qual);
  2586. ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_WRITE, qual);
  2587. ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_EXEC, qual);
  2588. ept_access_violation_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_READ, qual);
  2589. ept_access_violation_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_WRITE, qual);
  2590. ept_access_violation_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_EXEC, qual);
  2591. }
  2592. static void ept_access_test_paddr_not_present_page_fault(void)
  2593. {
  2594. ept_access_test_setup();
  2595. /*
  2596. * TODO: test no EPT violation as long as guest PF occurs. e.g., GPA is
  2597. * page is read-only in EPT but GVA is also mapped read only in PT.
  2598. * Thus guest page fault before host takes EPT violation for trying to
  2599. * update A bit.
  2600. */
  2601. }
  2602. static void ept_access_test_force_2m_page(void)
  2603. {
  2604. ept_access_test_setup();
  2605. TEST_ASSERT_EQ(ept_2m_supported(), true);
  2606. ept_allowed_at_level_mkhuge(true, 2, 0, 0, OP_READ);
  2607. ept_violation_at_level_mkhuge(true, 2, EPT_PRESENT, EPT_RA, OP_WRITE,
  2608. EPT_VLT_WR | EPT_VLT_PERM_RD |
  2609. EPT_VLT_LADDR_VLD | EPT_VLT_PADDR);
  2610. ept_misconfig_at_level_mkhuge(true, 2, EPT_PRESENT, EPT_WA);
  2611. }
  2612. static bool invvpid_valid(u64 type, u64 vpid, u64 gla)
  2613. {
  2614. u64 msr = rdmsr(MSR_IA32_VMX_EPT_VPID_CAP);
  2615. TEST_ASSERT(msr & VPID_CAP_INVVPID);
  2616. if (type < INVVPID_ADDR || type > INVVPID_CONTEXT_LOCAL)
  2617. return false;
  2618. if (!(msr & (1ull << (type + VPID_CAP_INVVPID_TYPES_SHIFT))))
  2619. return false;
  2620. if (vpid >> 16)
  2621. return false;
  2622. if (type != INVVPID_ALL && !vpid)
  2623. return false;
  2624. if (type == INVVPID_ADDR && !is_canonical(gla))
  2625. return false;
  2626. return true;
  2627. }
  2628. static void try_invvpid(u64 type, u64 vpid, u64 gla)
  2629. {
  2630. int rc;
  2631. bool valid = invvpid_valid(type, vpid, gla);
  2632. u64 expected = valid ? VMXERR_UNSUPPORTED_VMCS_COMPONENT
  2633. : VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID;
  2634. /*
  2635. * Set VMX_INST_ERROR to VMXERR_UNVALID_VMCS_COMPONENT, so
  2636. * that we can tell if it is updated by INVVPID.
  2637. */
  2638. vmcs_read(~0);
  2639. rc = invvpid(type, vpid, gla);
  2640. report("INVVPID type %ld VPID %lx GLA %lx %s",
  2641. !rc == valid, type, vpid, gla,
  2642. valid ? "passes" : "fails");
  2643. report("After %s INVVPID, VMX_INST_ERR is %ld (actual %ld)",
  2644. vmcs_read(VMX_INST_ERROR) == expected,
  2645. rc ? "failed" : "successful",
  2646. expected, vmcs_read(VMX_INST_ERROR));
  2647. }
  2648. static void ds_invvpid(void *data)
  2649. {
  2650. u64 msr = rdmsr(MSR_IA32_VMX_EPT_VPID_CAP);
  2651. u64 type = ffs(msr >> VPID_CAP_INVVPID_TYPES_SHIFT) - 1;
  2652. TEST_ASSERT(type >= INVVPID_ADDR && type <= INVVPID_CONTEXT_LOCAL);
  2653. asm volatile("invvpid %0, %1"
  2654. :
  2655. : "m"(*(struct invvpid_operand *)data),
  2656. "r"(type));
  2657. }
  2658. /*
  2659. * The SS override is ignored in 64-bit mode, so we use an addressing
  2660. * mode with %rsp as the base register to generate an implicit SS
  2661. * reference.
  2662. */
  2663. static void ss_invvpid(void *data)
  2664. {
  2665. u64 msr = rdmsr(MSR_IA32_VMX_EPT_VPID_CAP);
  2666. u64 type = ffs(msr >> VPID_CAP_INVVPID_TYPES_SHIFT) - 1;
  2667. TEST_ASSERT(type >= INVVPID_ADDR && type <= INVVPID_CONTEXT_LOCAL);
  2668. asm volatile("sub %%rsp,%0; invvpid (%%rsp,%0,1), %1"
  2669. : "+r"(data)
  2670. : "r"(type));
  2671. }
  2672. static void invvpid_test_gp(void)
  2673. {
  2674. bool fault;
  2675. fault = test_for_exception(GP_VECTOR, &ds_invvpid,
  2676. (void *)NONCANONICAL);
  2677. report("INVVPID with non-canonical DS operand raises #GP", fault);
  2678. }
  2679. static void invvpid_test_ss(void)
  2680. {
  2681. bool fault;
  2682. fault = test_for_exception(SS_VECTOR, &ss_invvpid,
  2683. (void *)NONCANONICAL);
  2684. report("INVVPID with non-canonical SS operand raises #SS", fault);
  2685. }
  2686. static void invvpid_test_pf(void)
  2687. {
  2688. void *vpage = alloc_vpage();
  2689. bool fault;
  2690. fault = test_for_exception(PF_VECTOR, &ds_invvpid, vpage);
  2691. report("INVVPID with unmapped operand raises #PF", fault);
  2692. }
  2693. static void try_compat_invvpid(void *unused)
  2694. {
  2695. struct far_pointer32 fp = {
  2696. .offset = (uintptr_t)&&invvpid,
  2697. .selector = KERNEL_CS32,
  2698. };
  2699. register uintptr_t rsp asm("rsp");
  2700. TEST_ASSERT_MSG(fp.offset == (uintptr_t)&&invvpid,
  2701. "Code address too high.");
  2702. TEST_ASSERT_MSG(rsp == (u32)rsp, "Stack address too high.");
  2703. asm goto ("lcall *%0" : : "m" (fp) : "rax" : invvpid);
  2704. return;
  2705. invvpid:
  2706. asm volatile (".code32;"
  2707. "invvpid (%eax), %eax;"
  2708. "lret;"
  2709. ".code64");
  2710. __builtin_unreachable();
  2711. }
  2712. static void invvpid_test_compatibility_mode(void)
  2713. {
  2714. bool fault;
  2715. fault = test_for_exception(UD_VECTOR, &try_compat_invvpid, NULL);
  2716. report("Compatibility mode INVVPID raises #UD", fault);
  2717. }
  2718. static void invvpid_test_not_in_vmx_operation(void)
  2719. {
  2720. bool fault;
  2721. TEST_ASSERT(!vmx_off());
  2722. fault = test_for_exception(UD_VECTOR, &ds_invvpid, NULL);
  2723. report("INVVPID outside of VMX operation raises #UD", fault);
  2724. TEST_ASSERT(!vmx_on());
  2725. }
  2726. /*
  2727. * This does not test real-address mode, virtual-8086 mode, protected mode,
  2728. * or CPL > 0.
  2729. */
  2730. static void invvpid_test_v2(void)
  2731. {
  2732. u64 msr;
  2733. int i;
  2734. unsigned types = 0;
  2735. unsigned type;
  2736. if (!(ctrl_cpu_rev[0].clr & CPU_SECONDARY) ||
  2737. !(ctrl_cpu_rev[1].clr & CPU_VPID))
  2738. test_skip("VPID not supported");
  2739. msr = rdmsr(MSR_IA32_VMX_EPT_VPID_CAP);
  2740. if (!(msr & VPID_CAP_INVVPID))
  2741. test_skip("INVVPID not supported.\n");
  2742. if (msr & VPID_CAP_INVVPID_ADDR)
  2743. types |= 1u << INVVPID_ADDR;
  2744. if (msr & VPID_CAP_INVVPID_CXTGLB)
  2745. types |= 1u << INVVPID_CONTEXT_GLOBAL;
  2746. if (msr & VPID_CAP_INVVPID_ALL)
  2747. types |= 1u << INVVPID_ALL;
  2748. if (msr & VPID_CAP_INVVPID_CXTLOC)
  2749. types |= 1u << INVVPID_CONTEXT_LOCAL;
  2750. if (!types)
  2751. test_skip("No INVVPID types supported.\n");
  2752. for (i = -127; i < 128; i++)
  2753. try_invvpid(i, 0xffff, 0);
  2754. /*
  2755. * VPID must not be more than 16 bits.
  2756. */
  2757. for (i = 0; i < 64; i++)
  2758. for (type = 0; type < 4; type++)
  2759. if (types & (1u << type))
  2760. try_invvpid(type, 1ul << i, 0);
  2761. /*
  2762. * VPID must not be zero, except for "all contexts."
  2763. */
  2764. for (type = 0; type < 4; type++)
  2765. if (types & (1u << type))
  2766. try_invvpid(type, 0, 0);
  2767. /*
  2768. * The gla operand is only validated for single-address INVVPID.
  2769. */
  2770. if (types & (1u << INVVPID_ADDR))
  2771. try_invvpid(INVVPID_ADDR, 0xffff, NONCANONICAL);
  2772. invvpid_test_gp();
  2773. invvpid_test_ss();
  2774. invvpid_test_pf();
  2775. invvpid_test_compatibility_mode();
  2776. invvpid_test_not_in_vmx_operation();
  2777. }
  2778. /*
  2779. * Test for early VMLAUNCH failure. Returns true if VMLAUNCH makes it
  2780. * at least as far as the guest-state checks. Returns false if the
  2781. * VMLAUNCH fails early and execution falls through to the next
  2782. * instruction.
  2783. */
  2784. static bool vmlaunch_succeeds(void)
  2785. {
  2786. /*
  2787. * Indirectly set VMX_INST_ERR to 12 ("VMREAD/VMWRITE from/to
  2788. * unsupported VMCS component"). The caller can then check
  2789. * to see if a failed VM-entry sets VMX_INST_ERR as expected.
  2790. */
  2791. vmcs_write(~0u, 0);
  2792. vmcs_write(HOST_RIP, (uintptr_t)&&success);
  2793. __asm__ __volatile__ goto ("vmwrite %%rsp, %0; vmlaunch"
  2794. :
  2795. : "r" ((u64)HOST_RSP)
  2796. : "cc", "memory"
  2797. : success);
  2798. return false;
  2799. success:
  2800. TEST_ASSERT(vmcs_read(EXI_REASON) ==
  2801. (VMX_FAIL_STATE | VMX_ENTRY_FAILURE));
  2802. return true;
  2803. }
  2804. /*
  2805. * Try to launch the current VMCS.
  2806. */
  2807. static void test_vmx_controls(bool controls_valid)
  2808. {
  2809. bool success = vmlaunch_succeeds();
  2810. u32 vmx_inst_err;
  2811. report("vmlaunch %s", success == controls_valid,
  2812. controls_valid ? "succeeds" : "fails");
  2813. if (!controls_valid) {
  2814. vmx_inst_err = vmcs_read(VMX_INST_ERROR);
  2815. report("VMX inst error is %d (actual %d)",
  2816. vmx_inst_err == VMXERR_ENTRY_INVALID_CONTROL_FIELD,
  2817. VMXERR_ENTRY_INVALID_CONTROL_FIELD, vmx_inst_err);
  2818. }
  2819. }
  2820. /*
  2821. * Test a particular address setting for a physical page reference in
  2822. * the VMCS.
  2823. */
  2824. static void test_vmcs_page_addr(const char *name,
  2825. enum Encoding encoding,
  2826. bool ignored,
  2827. u64 addr)
  2828. {
  2829. report_prefix_pushf("%s = %lx", name, addr);
  2830. vmcs_write(encoding, addr);
  2831. test_vmx_controls(ignored || (IS_ALIGNED(addr, PAGE_SIZE) &&
  2832. addr < (1ul << cpuid_maxphyaddr())));
  2833. report_prefix_pop();
  2834. }
  2835. /*
  2836. * Test interesting values for a physical page reference in the VMCS.
  2837. */
  2838. static void test_vmcs_page_values(const char *name,
  2839. enum Encoding encoding,
  2840. bool ignored)
  2841. {
  2842. unsigned i;
  2843. u64 orig_val = vmcs_read(encoding);
  2844. for (i = 0; i < 64; i++)
  2845. test_vmcs_page_addr(name, encoding, ignored, 1ul << i);
  2846. test_vmcs_page_addr(name, encoding, ignored, PAGE_SIZE - 1);
  2847. test_vmcs_page_addr(name, encoding, ignored, PAGE_SIZE);
  2848. test_vmcs_page_addr(name, encoding, ignored,
  2849. (1ul << cpuid_maxphyaddr()) - PAGE_SIZE);
  2850. test_vmcs_page_addr(name, encoding, ignored, -1ul);
  2851. vmcs_write(encoding, orig_val);
  2852. }
  2853. /*
  2854. * Test a physical page reference in the VMCS, when the corresponding
  2855. * feature is enabled and when the corresponding feature is disabled.
  2856. */
  2857. static void test_vmcs_page_reference(u32 control_bit, enum Encoding field,
  2858. const char *field_name,
  2859. const char *control_name)
  2860. {
  2861. u32 primary = vmcs_read(CPU_EXEC_CTRL0);
  2862. u64 page_addr;
  2863. if (!(ctrl_cpu_rev[0].clr & control_bit))
  2864. return;
  2865. page_addr = vmcs_read(field);
  2866. report_prefix_pushf("%s enabled", control_name);
  2867. vmcs_write(CPU_EXEC_CTRL0, primary | control_bit);
  2868. test_vmcs_page_values(field_name, field, false);
  2869. report_prefix_pop();
  2870. report_prefix_pushf("%s disabled", control_name);
  2871. vmcs_write(CPU_EXEC_CTRL0, primary & ~control_bit);
  2872. test_vmcs_page_values(field_name, field, true);
  2873. report_prefix_pop();
  2874. vmcs_write(field, page_addr);
  2875. vmcs_write(CPU_EXEC_CTRL0, primary);
  2876. }
  2877. /*
  2878. * If the "use I/O bitmaps" VM-execution control is 1, bits 11:0 of
  2879. * each I/O-bitmap address must be 0. Neither address should set any
  2880. * bits beyond the processor's physical-address width.
  2881. * [Intel SDM]
  2882. */
  2883. static void test_io_bitmaps(void)
  2884. {
  2885. test_vmcs_page_reference(CPU_IO_BITMAP, IO_BITMAP_A,
  2886. "I/O bitmap A", "Use I/O bitmaps");
  2887. test_vmcs_page_reference(CPU_IO_BITMAP, IO_BITMAP_B,
  2888. "I/O bitmap B", "Use I/O bitmaps");
  2889. }
  2890. /*
  2891. * If the "use MSR bitmaps" VM-execution control is 1, bits 11:0 of
  2892. * the MSR-bitmap address must be 0. The address should not set any
  2893. * bits beyond the processor's physical-address width.
  2894. * [Intel SDM]
  2895. */
  2896. static void test_msr_bitmap(void)
  2897. {
  2898. test_vmcs_page_reference(CPU_MSR_BITMAP, MSR_BITMAP,
  2899. "MSR bitmap", "Use MSR bitmaps");
  2900. }
  2901. static void vmx_controls_test(void)
  2902. {
  2903. /*
  2904. * Bit 1 of the guest's RFLAGS must be 1, or VM-entry will
  2905. * fail due to invalid guest state, should we make it that
  2906. * far.
  2907. */
  2908. vmcs_write(GUEST_RFLAGS, 0);
  2909. test_io_bitmaps();
  2910. test_msr_bitmap();
  2911. }
  2912. static bool valid_vmcs_for_vmentry(void)
  2913. {
  2914. struct vmcs *current_vmcs = NULL;
  2915. if (vmcs_save(&current_vmcs))
  2916. return false;
  2917. return current_vmcs && !(current_vmcs->revision_id >> 31);
  2918. }
  2919. static void try_vmentry_in_movss_shadow(void)
  2920. {
  2921. u32 vm_inst_err;
  2922. u32 flags;
  2923. bool early_failure = false;
  2924. u32 expected_flags = X86_EFLAGS_FIXED;
  2925. bool valid_vmcs = valid_vmcs_for_vmentry();
  2926. expected_flags |= valid_vmcs ? X86_EFLAGS_ZF : X86_EFLAGS_CF;
  2927. /*
  2928. * Indirectly set VM_INST_ERR to 12 ("VMREAD/VMWRITE from/to
  2929. * unsupported VMCS component").
  2930. */
  2931. vmcs_write(~0u, 0);
  2932. __asm__ __volatile__ ("mov %[host_rsp], %%edx;"
  2933. "vmwrite %%rsp, %%rdx;"
  2934. "mov 0f, %%rax;"
  2935. "mov %[host_rip], %%edx;"
  2936. "vmwrite %%rax, %%rdx;"
  2937. "mov $-1, %%ah;"
  2938. "sahf;"
  2939. "mov %%ss, %%ax;"
  2940. "mov %%ax, %%ss;"
  2941. "vmlaunch;"
  2942. "mov $1, %[early_failure];"
  2943. "0: lahf;"
  2944. "movzbl %%ah, %[flags]"
  2945. : [early_failure] "+r" (early_failure),
  2946. [flags] "=&a" (flags)
  2947. : [host_rsp] "i" (HOST_RSP),
  2948. [host_rip] "i" (HOST_RIP)
  2949. : "rdx", "cc", "memory");
  2950. vm_inst_err = vmcs_read(VMX_INST_ERROR);
  2951. report("Early VM-entry failure", early_failure);
  2952. report("RFLAGS[8:0] is %x (actual %x)", flags == expected_flags,
  2953. expected_flags, flags);
  2954. if (valid_vmcs)
  2955. report("VM-instruction error is %d (actual %d)",
  2956. vm_inst_err == VMXERR_ENTRY_EVENTS_BLOCKED_BY_MOV_SS,
  2957. VMXERR_ENTRY_EVENTS_BLOCKED_BY_MOV_SS, vm_inst_err);
  2958. }
  2959. static void vmentry_movss_shadow_test(void)
  2960. {
  2961. struct vmcs *orig_vmcs;
  2962. TEST_ASSERT(!vmcs_save(&orig_vmcs));
  2963. /*
  2964. * Set the launched flag on the current VMCS to verify the correct
  2965. * error priority, below.
  2966. */
  2967. test_set_guest(v2_null_test_guest);
  2968. enter_guest();
  2969. /*
  2970. * With bit 1 of the guest's RFLAGS clear, VM-entry should
  2971. * fail due to invalid guest state (if we make it that far).
  2972. */
  2973. vmcs_write(GUEST_RFLAGS, 0);
  2974. /*
  2975. * "VM entry with events blocked by MOV SS" takes precedence over
  2976. * "VMLAUNCH with non-clear VMCS."
  2977. */
  2978. report_prefix_push("valid current-VMCS");
  2979. try_vmentry_in_movss_shadow();
  2980. report_prefix_pop();
  2981. /*
  2982. * VMfailInvalid takes precedence over "VM entry with events
  2983. * blocked by MOV SS."
  2984. */
  2985. TEST_ASSERT(!vmcs_clear(orig_vmcs));
  2986. report_prefix_push("no current-VMCS");
  2987. try_vmentry_in_movss_shadow();
  2988. report_prefix_pop();
  2989. TEST_ASSERT(!make_vmcs_current(orig_vmcs));
  2990. vmcs_write(GUEST_RFLAGS, X86_EFLAGS_FIXED);
  2991. }
  2992. #define TEST(name) { #name, .v2 = name }
  2993. /* name/init/guest_main/exit_handler/syscall_handler/guest_regs */
  2994. struct vmx_test vmx_tests[] = {
  2995. { "null", NULL, basic_guest_main, basic_exit_handler, NULL, {0} },
  2996. { "vmenter", NULL, vmenter_main, vmenter_exit_handler, NULL, {0} },
  2997. { "preemption timer", preemption_timer_init, preemption_timer_main,
  2998. preemption_timer_exit_handler, NULL, {0} },
  2999. { "control field PAT", test_ctrl_pat_init, test_ctrl_pat_main,
  3000. test_ctrl_pat_exit_handler, NULL, {0} },
  3001. { "control field EFER", test_ctrl_efer_init, test_ctrl_efer_main,
  3002. test_ctrl_efer_exit_handler, NULL, {0} },
  3003. { "CR shadowing", NULL, cr_shadowing_main,
  3004. cr_shadowing_exit_handler, NULL, {0} },
  3005. { "I/O bitmap", iobmp_init, iobmp_main, iobmp_exit_handler,
  3006. NULL, {0} },
  3007. { "instruction intercept", insn_intercept_init, insn_intercept_main,
  3008. insn_intercept_exit_handler, NULL, {0} },
  3009. { "EPT A/D disabled", ept_init, ept_main, ept_exit_handler, NULL, {0} },
  3010. { "EPT A/D enabled", eptad_init, eptad_main, eptad_exit_handler, NULL, {0} },
  3011. { "PML", pml_init, pml_main, pml_exit_handler, NULL, {0} },
  3012. { "VPID", vpid_init, vpid_main, vpid_exit_handler, NULL, {0} },
  3013. { "interrupt", interrupt_init, interrupt_main,
  3014. interrupt_exit_handler, NULL, {0} },
  3015. { "debug controls", dbgctls_init, dbgctls_main, dbgctls_exit_handler,
  3016. NULL, {0} },
  3017. { "MSR switch", msr_switch_init, msr_switch_main,
  3018. msr_switch_exit_handler, NULL, {0}, msr_switch_entry_failure },
  3019. { "vmmcall", vmmcall_init, vmmcall_main, vmmcall_exit_handler, NULL, {0} },
  3020. { "disable RDTSCP", disable_rdtscp_init, disable_rdtscp_main,
  3021. disable_rdtscp_exit_handler, NULL, {0} },
  3022. { "int3", int3_init, int3_guest_main, int3_exit_handler, NULL, {0} },
  3023. { "into", into_init, into_guest_main, into_exit_handler, NULL, {0} },
  3024. { "exit_monitor_from_l2_test", NULL, exit_monitor_from_l2_main,
  3025. exit_monitor_from_l2_handler, NULL, {0} },
  3026. /* Basic V2 tests. */
  3027. TEST(v2_null_test),
  3028. TEST(v2_multiple_entries_test),
  3029. TEST(fixture_test_case1),
  3030. TEST(fixture_test_case2),
  3031. /* EPT access tests. */
  3032. TEST(ept_access_test_not_present),
  3033. TEST(ept_access_test_read_only),
  3034. TEST(ept_access_test_write_only),
  3035. TEST(ept_access_test_read_write),
  3036. TEST(ept_access_test_execute_only),
  3037. TEST(ept_access_test_read_execute),
  3038. TEST(ept_access_test_write_execute),
  3039. TEST(ept_access_test_read_write_execute),
  3040. TEST(ept_access_test_reserved_bits),
  3041. TEST(ept_access_test_ignored_bits),
  3042. TEST(ept_access_test_paddr_not_present_ad_disabled),
  3043. TEST(ept_access_test_paddr_not_present_ad_enabled),
  3044. TEST(ept_access_test_paddr_read_only_ad_disabled),
  3045. TEST(ept_access_test_paddr_read_only_ad_enabled),
  3046. TEST(ept_access_test_paddr_read_write),
  3047. TEST(ept_access_test_paddr_read_write_execute),
  3048. TEST(ept_access_test_paddr_read_execute_ad_disabled),
  3049. TEST(ept_access_test_paddr_read_execute_ad_enabled),
  3050. TEST(ept_access_test_paddr_not_present_page_fault),
  3051. TEST(ept_access_test_force_2m_page),
  3052. /* Opcode tests. */
  3053. TEST(invvpid_test_v2),
  3054. /* VM-entry tests */
  3055. TEST(vmx_controls_test),
  3056. TEST(vmentry_movss_shadow_test),
  3057. { NULL, NULL, NULL, NULL, NULL, {0} },
  3058. };