| /* msr tests */ |
| |
| #include "libcflat.h" |
| #include "processor.h" |
| #include "msr.h" |
| #include "desc.h" |
| #include "fwcfg.h" |
| |
| static void test_syscall_lazy_load(void) |
| { |
| extern void syscall_target(void); |
| u16 cs = read_cs(), ss = read_ss(); |
| ulong tmp; |
| |
| wrmsr(MSR_EFER, rdmsr(MSR_EFER) | EFER_SCE); |
| wrmsr(MSR_LSTAR, (ulong)syscall_target); |
| wrmsr(MSR_STAR, (uint64_t)cs << 32); |
| asm volatile("pushf; syscall; syscall_target: popf" : "=c"(tmp) : : "r11"); |
| write_ss(ss); |
| // will crash horribly if broken |
| report_pass("MSR_*STAR eager loading"); |
| } |
| |
| /* |
| * test handling of TF in syscall/sysret: #DB is raised if TF |
| * is 1 at the *end* of syscall/sysret. |
| * |
| * This uses 32-bit syscall/sysret because KVM emulates it on Intel processors. |
| * However, the same bug happens with 64-bit syscall/sysret if two vCPUs |
| * "race" to force the emulation of syscall/sysret. |
| */ |
| |
| static uint16_t code_segment_upon_db; |
| static void handle_db(struct ex_regs *regs) |
| { |
| code_segment_upon_db = regs->cs; |
| regs->rflags &= ~(1 << 8); |
| } |
| |
| /* expects desired ring 3 flags in rax */ |
| asm("syscall32_target:\n" |
| " cmpl $0, code_segment_upon_db(%rip)\n" |
| " jne back_to_test\n" |
| " mov %eax,%r11d\n" |
| " sysretl\n"); |
| |
| /* 32-bit, ring-3 part of test_syscall_tf */ |
| asm(" .code32\n" |
| "syscall_tf_user32:\n" |
| " pushf\n" |
| " pop %eax\n" |
| " or $(1<<8),%eax\n" |
| " push %eax\n" |
| " popf\n" |
| " syscall\n" /* singlestep trap taken after syscall */ |
| " syscall\n" /* jumps back to test_syscall_tf's body */ |
| " .code64\n"); |
| |
| static void test_syscall_tf(void) |
| { |
| extern void syscall32_target(void); |
| extern void syscall_tf_user32(void); |
| ulong rax; |
| ulong rcx; |
| |
| wrmsr(MSR_EFER, rdmsr(MSR_EFER) | EFER_SCE); |
| wrmsr(MSR_CSTAR, (ulong)syscall32_target); |
| wrmsr(MSR_STAR, ((uint64_t)USER_CS32 << 48) | ((uint64_t)KERNEL_CS64 << 32)); |
| wrmsr(MSR_SYSCALL_MASK, X86_EFLAGS_TF|X86_EFLAGS_DF|X86_EFLAGS_IF|X86_EFLAGS_NT); |
| handle_exception(DB_VECTOR, handle_db); |
| |
| /* good: |
| * sysret to syscall_tf_user32 |
| * popf sets TF (singlestep starts on the next instruction) |
| * syscall to syscall32_target -> TF cleared and no singlestep |
| * sysretl sets TF |
| * handle_db sets code_segment_upon_db to USER_CS32 and clears TF |
| * syscall to syscall32_target |
| * syscall32_target jumps to back_to_test |
| * |
| * bad: |
| * sysret to syscall_tf_user32 |
| * popf sets TF (singlestep starts on the next instruction) |
| * syscall to syscall32_target, TF cleared and wrong singlestep exception |
| * handle_db sets code_segment_upon_db to KERNEL_CS64 |
| * syscall32_target jumps to back_to_test |
| */ |
| rax = (ulong)&tss[0].rsp0; |
| rcx = (ulong)syscall_tf_user32; |
| asm volatile(" push %%rbp\n" |
| " mov %%rsp, (%%rax)\n" // stack pointer for exception handler |
| " pushf; pop %%rax\n" // expected by syscall32_target |
| " sysret\n" |
| "back_to_test:\n" |
| " pop %%rbp" |
| : [sysret_target] "+c"(rcx), [sp0] "+a" (rax) : |
| : "rbx", "rdx", "rsi", "rdi", "r8", "r9", "r10", "r11", |
| "r12", "r13", "r14", "r15", "memory"); |
| if (code_segment_upon_db != USER_CS32) { |
| printf("wrong CS (%#04x)!\n", code_segment_upon_db); |
| } |
| report(code_segment_upon_db == USER_CS32, "syscall TF handling"); |
| } |
| |
| int main(int ac, char **av) |
| { |
| test_syscall_lazy_load(); |
| |
| if (!no_test_device || !is_intel()) |
| test_syscall_tf(); |
| else |
| report_skip("syscall TF handling"); |
| |
| return report_summary(); |
| } |