1 /* $NetBSD: h_mem_assist.c,v 1.20 2020/12/27 20:56:14 reinoud Exp $ */
2
3 /*
4 * Copyright (c) 2018-2020 Maxime Villard, m00nbsd.net
5 * All rights reserved.
6 *
7 * This code is part of the NVMM hypervisor.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
23 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
25 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
26 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 */
30
31 #include <stdio.h>
32 #include <stdlib.h>
33 #include <stdint.h>
34 #include <stdbool.h>
35 #include <unistd.h>
36 #include <string.h>
37 #include <err.h>
38 #include <errno.h>
39 #include <sys/types.h>
40 #include <sys/mman.h>
41 #include <machine/segments.h>
42 #include <machine/psl.h>
43 #include <machine/pte.h>
44 #include <x86/specialreg.h>
45
46 #include <nvmm.h>
47
48 #define PAGE_SIZE 4096
49
50 static uint8_t mmiobuf[PAGE_SIZE];
51 static uint8_t *instbuf;
52
53 /* -------------------------------------------------------------------------- */
54
55 static void
mem_callback(struct nvmm_mem * mem)56 mem_callback(struct nvmm_mem *mem)
57 {
58 size_t off;
59
60 if (mem->gpa < 0x1000 || mem->gpa + mem->size > 0x1000 + PAGE_SIZE) {
61 printf("Out of page\n");
62 exit(-1);
63 }
64
65 off = mem->gpa - 0x1000;
66
67 printf("-> gpa = %p\n", (void *)mem->gpa);
68
69 if (mem->write) {
70 memcpy(mmiobuf + off, mem->data, mem->size);
71 } else {
72 memcpy(mem->data, mmiobuf + off, mem->size);
73 }
74 }
75
76 static int
handle_memory(struct nvmm_machine * mach,struct nvmm_vcpu * vcpu)77 handle_memory(struct nvmm_machine *mach, struct nvmm_vcpu *vcpu)
78 {
79 int ret;
80
81 ret = nvmm_assist_mem(mach, vcpu);
82 if (ret == -1) {
83 err(errno, "nvmm_assist_mem");
84 }
85
86 return 0;
87 }
88
89 static void
run_machine(struct nvmm_machine * mach,struct nvmm_vcpu * vcpu)90 run_machine(struct nvmm_machine *mach, struct nvmm_vcpu *vcpu)
91 {
92 struct nvmm_vcpu_exit *exit = vcpu->exit;
93
94 while (1) {
95 if (nvmm_vcpu_run(mach, vcpu) == -1)
96 err(errno, "nvmm_vcpu_run");
97
98 switch (exit->reason) {
99 case NVMM_VCPU_EXIT_NONE:
100 break;
101
102 case NVMM_VCPU_EXIT_RDMSR:
103 /* Stop here. */
104 return;
105
106 case NVMM_VCPU_EXIT_MEMORY:
107 handle_memory(mach, vcpu);
108 break;
109
110 case NVMM_VCPU_EXIT_SHUTDOWN:
111 printf("Shutting down!\n");
112 return;
113
114 default:
115 printf("Invalid VMEXIT: 0x%lx\n", exit->reason);
116 return;
117 }
118 }
119 }
120
121 static struct nvmm_assist_callbacks callbacks = {
122 .io = NULL,
123 .mem = mem_callback
124 };
125
126 /* -------------------------------------------------------------------------- */
127
128 struct test {
129 const char *name;
130 uint8_t *code_begin;
131 uint8_t *code_end;
132 uint64_t wanted;
133 uint64_t off;
134 };
135
136 static void
run_test(struct nvmm_machine * mach,struct nvmm_vcpu * vcpu,const struct test * test)137 run_test(struct nvmm_machine *mach, struct nvmm_vcpu *vcpu,
138 const struct test *test)
139 {
140 uint64_t *res;
141 size_t size;
142
143 size = (size_t)test->code_end - (size_t)test->code_begin;
144
145 memset(mmiobuf, 0, PAGE_SIZE);
146 memcpy(instbuf, test->code_begin, size);
147
148 run_machine(mach, vcpu);
149
150 res = (uint64_t *)(mmiobuf + test->off);
151 if (*res == test->wanted) {
152 printf("Test '%s' passed\n", test->name);
153 } else {
154 printf("Test '%s' failed, wanted 0x%lx, got 0x%lx\n", test->name,
155 test->wanted, *res);
156 }
157 }
158
159 /* -------------------------------------------------------------------------- */
160
161 extern uint8_t test1_begin, test1_end;
162 extern uint8_t test2_begin, test2_end;
163 extern uint8_t test3_begin, test3_end;
164 extern uint8_t test4_begin, test4_end;
165 extern uint8_t test5_begin, test5_end;
166 extern uint8_t test6_begin, test6_end;
167 extern uint8_t test7_begin, test7_end;
168 extern uint8_t test8_begin, test8_end;
169 extern uint8_t test9_begin, test9_end;
170 extern uint8_t test10_begin, test10_end;
171 extern uint8_t test11_begin, test11_end;
172 extern uint8_t test12_begin, test12_end;
173 extern uint8_t test13_begin, test13_end;
174 extern uint8_t test14_begin, test14_end;
175 extern uint8_t test_64bit_15_begin, test_64bit_15_end;
176 extern uint8_t test_64bit_16_begin, test_64bit_16_end;
177 extern uint8_t test17_begin, test17_end;
178
179 static const struct test tests64[] = {
180 { "64bit test1 - MOV", &test1_begin, &test1_end, 0x3004, 0 },
181 { "64bit test2 - OR", &test2_begin, &test2_end, 0x16FF, 0 },
182 { "64bit test3 - AND", &test3_begin, &test3_end, 0x1FC0, 0 },
183 { "64bit test4 - XOR", &test4_begin, &test4_end, 0x10CF, 0 },
184 { "64bit test5 - Address Sizes", &test5_begin, &test5_end, 0x1F00, 0 },
185 { "64bit test6 - DMO", &test6_begin, &test6_end, 0xFFAB, 0 },
186 { "64bit test7 - STOS", &test7_begin, &test7_end, 0x00123456, 0 },
187 { "64bit test8 - LODS", &test8_begin, &test8_end, 0x12345678, 0 },
188 { "64bit test9 - MOVS", &test9_begin, &test9_end, 0x12345678, 0 },
189 { "64bit test10 - MOVZXB", &test10_begin, &test10_end, 0x00000078, 0 },
190 { "64bit test11 - MOVZXW", &test11_begin, &test11_end, 0x00005678, 0 },
191 { "64bit test12 - CMP", &test12_begin, &test12_end, 0x00000001, 0 },
192 { "64bit test13 - SUB", &test13_begin, &test13_end, 0x0000000F0000A0FF, 0 },
193 { "64bit test14 - TEST", &test14_begin, &test14_end, 0x00000001, 0 },
194 { "64bit test15 - XCHG", &test_64bit_15_begin, &test_64bit_15_end, 0x123456, 0 },
195 { "64bit test16 - XCHG", &test_64bit_16_begin, &test_64bit_16_end,
196 0x123456, 0 },
197 { "64bit test17 - CMPS", &test17_begin, &test17_end, 0x00001, 0 },
198 { NULL, NULL, NULL, -1, 0 }
199 };
200
201 static void
init_seg(struct nvmm_x64_state_seg * seg,int type,int sel)202 init_seg(struct nvmm_x64_state_seg *seg, int type, int sel)
203 {
204 seg->selector = sel;
205 seg->attrib.type = type;
206 seg->attrib.s = (type & 0b10000) != 0;
207 seg->attrib.dpl = 0;
208 seg->attrib.p = 1;
209 seg->attrib.avl = 1;
210 seg->attrib.l = 1;
211 seg->attrib.def = 0;
212 seg->attrib.g = 1;
213 seg->limit = 0x0000FFFF;
214 seg->base = 0x00000000;
215 }
216
217 static void
reset_machine64(struct nvmm_machine * mach,struct nvmm_vcpu * vcpu)218 reset_machine64(struct nvmm_machine *mach, struct nvmm_vcpu *vcpu)
219 {
220 struct nvmm_x64_state *state = vcpu->state;
221
222 if (nvmm_vcpu_getstate(mach, vcpu, NVMM_X64_STATE_ALL) == -1)
223 err(errno, "nvmm_vcpu_getstate");
224
225 memset(state, 0, sizeof(*state));
226
227 /* Default. */
228 state->gprs[NVMM_X64_GPR_RFLAGS] = PSL_MBO;
229 init_seg(&state->segs[NVMM_X64_SEG_CS], SDT_MEMERA, GSEL(GCODE_SEL, SEL_KPL));
230 init_seg(&state->segs[NVMM_X64_SEG_SS], SDT_MEMRWA, GSEL(GDATA_SEL, SEL_KPL));
231 init_seg(&state->segs[NVMM_X64_SEG_DS], SDT_MEMRWA, GSEL(GDATA_SEL, SEL_KPL));
232 init_seg(&state->segs[NVMM_X64_SEG_ES], SDT_MEMRWA, GSEL(GDATA_SEL, SEL_KPL));
233 init_seg(&state->segs[NVMM_X64_SEG_FS], SDT_MEMRWA, GSEL(GDATA_SEL, SEL_KPL));
234 init_seg(&state->segs[NVMM_X64_SEG_GS], SDT_MEMRWA, GSEL(GDATA_SEL, SEL_KPL));
235
236 /* Blank. */
237 init_seg(&state->segs[NVMM_X64_SEG_GDT], 0, 0);
238 init_seg(&state->segs[NVMM_X64_SEG_IDT], 0, 0);
239 init_seg(&state->segs[NVMM_X64_SEG_LDT], SDT_SYSLDT, 0);
240 init_seg(&state->segs[NVMM_X64_SEG_TR], SDT_SYS386BSY, 0);
241
242 /* Protected mode enabled. */
243 state->crs[NVMM_X64_CR_CR0] = CR0_PG|CR0_PE|CR0_NE|CR0_TS|CR0_MP|CR0_WP|CR0_AM;
244
245 /* 64bit mode enabled. */
246 state->crs[NVMM_X64_CR_CR4] = CR4_PAE;
247 state->msrs[NVMM_X64_MSR_EFER] = EFER_LME | EFER_SCE | EFER_LMA;
248
249 /* Stolen from x86/pmap.c */
250 #define PATENTRY(n, type) (type << ((n) * 8))
251 #define PAT_UC 0x0ULL
252 #define PAT_WC 0x1ULL
253 #define PAT_WT 0x4ULL
254 #define PAT_WP 0x5ULL
255 #define PAT_WB 0x6ULL
256 #define PAT_UCMINUS 0x7ULL
257 state->msrs[NVMM_X64_MSR_PAT] =
258 PATENTRY(0, PAT_WB) | PATENTRY(1, PAT_WT) |
259 PATENTRY(2, PAT_UCMINUS) | PATENTRY(3, PAT_UC) |
260 PATENTRY(4, PAT_WB) | PATENTRY(5, PAT_WT) |
261 PATENTRY(6, PAT_UCMINUS) | PATENTRY(7, PAT_UC);
262
263 /* Page tables. */
264 state->crs[NVMM_X64_CR_CR3] = 0x3000;
265
266 state->gprs[NVMM_X64_GPR_RIP] = 0x2000;
267
268 if (nvmm_vcpu_setstate(mach, vcpu, NVMM_X64_STATE_ALL) == -1)
269 err(errno, "nvmm_vcpu_setstate");
270 }
271
272 static void
map_pages64(struct nvmm_machine * mach)273 map_pages64(struct nvmm_machine *mach)
274 {
275 pt_entry_t *L4, *L3, *L2, *L1;
276 int ret;
277
278 instbuf = mmap(NULL, PAGE_SIZE, PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE,
279 -1, 0);
280 if (instbuf == MAP_FAILED)
281 err(errno, "mmap");
282
283 if (nvmm_hva_map(mach, (uintptr_t)instbuf, PAGE_SIZE) == -1)
284 err(errno, "nvmm_hva_map");
285 ret = nvmm_gpa_map(mach, (uintptr_t)instbuf, 0x2000, PAGE_SIZE,
286 PROT_READ|PROT_EXEC);
287 if (ret == -1)
288 err(errno, "nvmm_gpa_map");
289
290 L4 = mmap(NULL, PAGE_SIZE, PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE,
291 -1, 0);
292 if (L4 == MAP_FAILED)
293 err(errno, "mmap");
294 L3 = mmap(NULL, PAGE_SIZE, PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE,
295 -1, 0);
296 if (L3 == MAP_FAILED)
297 err(errno, "mmap");
298 L2 = mmap(NULL, PAGE_SIZE, PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE,
299 -1, 0);
300 if (L2 == MAP_FAILED)
301 err(errno, "mmap");
302 L1 = mmap(NULL, PAGE_SIZE, PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE,
303 -1, 0);
304 if (L1 == MAP_FAILED)
305 err(errno, "mmap");
306
307 if (nvmm_hva_map(mach, (uintptr_t)L4, PAGE_SIZE) == -1)
308 err(errno, "nvmm_hva_map");
309 if (nvmm_hva_map(mach, (uintptr_t)L3, PAGE_SIZE) == -1)
310 err(errno, "nvmm_hva_map");
311 if (nvmm_hva_map(mach, (uintptr_t)L2, PAGE_SIZE) == -1)
312 err(errno, "nvmm_hva_map");
313 if (nvmm_hva_map(mach, (uintptr_t)L1, PAGE_SIZE) == -1)
314 err(errno, "nvmm_hva_map");
315
316 ret = nvmm_gpa_map(mach, (uintptr_t)L4, 0x3000, PAGE_SIZE,
317 PROT_READ|PROT_WRITE);
318 if (ret == -1)
319 err(errno, "nvmm_gpa_map");
320 ret = nvmm_gpa_map(mach, (uintptr_t)L3, 0x4000, PAGE_SIZE,
321 PROT_READ|PROT_WRITE);
322 if (ret == -1)
323 err(errno, "nvmm_gpa_map");
324 ret = nvmm_gpa_map(mach, (uintptr_t)L2, 0x5000, PAGE_SIZE,
325 PROT_READ|PROT_WRITE);
326 if (ret == -1)
327 err(errno, "nvmm_gpa_map");
328 ret = nvmm_gpa_map(mach, (uintptr_t)L1, 0x6000, PAGE_SIZE,
329 PROT_READ|PROT_WRITE);
330 if (ret == -1)
331 err(errno, "nvmm_gpa_map");
332
333 memset(L4, 0, PAGE_SIZE);
334 memset(L3, 0, PAGE_SIZE);
335 memset(L2, 0, PAGE_SIZE);
336 memset(L1, 0, PAGE_SIZE);
337
338 L4[0] = PTE_P | PTE_W | 0x4000;
339 L3[0] = PTE_P | PTE_W | 0x5000;
340 L2[0] = PTE_P | PTE_W | 0x6000;
341 L1[0x2000 / PAGE_SIZE] = PTE_P | PTE_W | 0x2000;
342 L1[0x1000 / PAGE_SIZE] = PTE_P | PTE_W | 0x1000;
343 }
344
345 /*
346 * 0x1000: MMIO address, unmapped
347 * 0x2000: Instructions, mapped
348 * 0x3000: L4
349 * 0x4000: L3
350 * 0x5000: L2
351 * 0x6000: L1
352 */
353 static void
test_vm64(void)354 test_vm64(void)
355 {
356 struct nvmm_machine mach;
357 struct nvmm_vcpu vcpu;
358 size_t i;
359
360 if (nvmm_machine_create(&mach) == -1)
361 err(errno, "nvmm_machine_create");
362 if (nvmm_vcpu_create(&mach, 0, &vcpu) == -1)
363 err(errno, "nvmm_vcpu_create");
364 nvmm_vcpu_configure(&mach, &vcpu, NVMM_VCPU_CONF_CALLBACKS, &callbacks);
365 map_pages64(&mach);
366
367 for (i = 0; tests64[i].name != NULL; i++) {
368 reset_machine64(&mach, &vcpu);
369 run_test(&mach, &vcpu, &tests64[i]);
370 }
371
372 if (nvmm_vcpu_destroy(&mach, &vcpu) == -1)
373 err(errno, "nvmm_vcpu_destroy");
374 if (nvmm_machine_destroy(&mach) == -1)
375 err(errno, "nvmm_machine_destroy");
376 }
377
378 /* -------------------------------------------------------------------------- */
379
380 extern uint8_t test_16bit_1_begin, test_16bit_1_end;
381 extern uint8_t test_16bit_2_begin, test_16bit_2_end;
382 extern uint8_t test_16bit_3_begin, test_16bit_3_end;
383 extern uint8_t test_16bit_4_begin, test_16bit_4_end;
384 extern uint8_t test_16bit_5_begin, test_16bit_5_end;
385 extern uint8_t test_16bit_6_begin, test_16bit_6_end;
386
387 static const struct test tests16[] = {
388 { "16bit test1 - MOV single", &test_16bit_1_begin, &test_16bit_1_end,
389 0x023, 0x10f1 - 0x1000 },
390 { "16bit test2 - MOV dual", &test_16bit_2_begin, &test_16bit_2_end,
391 0x123, 0x10f3 - 0x1000 },
392 { "16bit test3 - MOV dual+disp", &test_16bit_3_begin, &test_16bit_3_end,
393 0x678, 0x10f1 - 0x1000 },
394 { "16bit test4 - Mixed", &test_16bit_4_begin, &test_16bit_4_end,
395 0x1011, 0x10f6 - 0x1000 },
396 { "16bit test5 - disp16-only", &test_16bit_5_begin, &test_16bit_5_end,
397 0x12, 0x1234 - 0x1000 },
398 { "16bit test6 - XCHG", &test_16bit_6_begin, &test_16bit_6_end,
399 0x1234, 0x1234 - 0x1000 },
400 { NULL, NULL, NULL, -1, -1 }
401 };
402
403 static void
reset_machine16(struct nvmm_machine * mach,struct nvmm_vcpu * vcpu)404 reset_machine16(struct nvmm_machine *mach, struct nvmm_vcpu *vcpu)
405 {
406 struct nvmm_x64_state *state = vcpu->state;
407
408 if (nvmm_vcpu_getstate(mach, vcpu, NVMM_X64_STATE_ALL) == -1)
409 err(errno, "nvmm_vcpu_getstate");
410
411 state->segs[NVMM_X64_SEG_CS].base = 0;
412 state->segs[NVMM_X64_SEG_CS].limit = 0x2FFF;
413 state->gprs[NVMM_X64_GPR_RIP] = 0x2000;
414
415 if (nvmm_vcpu_setstate(mach, vcpu, NVMM_X64_STATE_ALL) == -1)
416 err(errno, "nvmm_vcpu_setstate");
417 }
418
419 static void
map_pages16(struct nvmm_machine * mach)420 map_pages16(struct nvmm_machine *mach)
421 {
422 int ret;
423
424 instbuf = mmap(NULL, PAGE_SIZE, PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE,
425 -1, 0);
426 if (instbuf == MAP_FAILED)
427 err(errno, "mmap");
428
429 if (nvmm_hva_map(mach, (uintptr_t)instbuf, PAGE_SIZE) == -1)
430 err(errno, "nvmm_hva_map");
431 ret = nvmm_gpa_map(mach, (uintptr_t)instbuf, 0x2000, PAGE_SIZE,
432 PROT_READ|PROT_EXEC);
433 if (ret == -1)
434 err(errno, "nvmm_gpa_map");
435 }
436
437 /*
438 * 0x1000: MMIO address, unmapped
439 * 0x2000: Instructions, mapped
440 */
441 static void
test_vm16(void)442 test_vm16(void)
443 {
444 struct nvmm_machine mach;
445 struct nvmm_vcpu vcpu;
446 size_t i;
447
448 if (nvmm_machine_create(&mach) == -1)
449 err(errno, "nvmm_machine_create");
450 if (nvmm_vcpu_create(&mach, 0, &vcpu) == -1)
451 err(errno, "nvmm_vcpu_create");
452 nvmm_vcpu_configure(&mach, &vcpu, NVMM_VCPU_CONF_CALLBACKS, &callbacks);
453 map_pages16(&mach);
454
455 for (i = 0; tests16[i].name != NULL; i++) {
456 reset_machine16(&mach, &vcpu);
457 run_test(&mach, &vcpu, &tests16[i]);
458 }
459
460 if (nvmm_vcpu_destroy(&mach, &vcpu) == -1)
461 err(errno, "nvmm_vcpu_destroy");
462 if (nvmm_machine_destroy(&mach) == -1)
463 err(errno, "nvmm_machine_destroy");
464 }
465
466 /* -------------------------------------------------------------------------- */
467
main(int argc,char * argv[])468 int main(int argc, char *argv[])
469 {
470 if (nvmm_init() == -1)
471 err(errno, "nvmm_init");
472 test_vm64();
473 test_vm16();
474 return 0;
475 }
476