Handle monitor trap flag during instruction emulation

Test to verify that MTF VM-exits into host are synthesized when the 'monitor trap flag' processor-based VM-execution control is set under various conditions.

Expect an MTF VM-exit if instruction execution produces no events other than MTF. Should instruction execution produce a concurrent debug-trap and MTF event, expect an MTF VM-exit with the 'pending debug exceptions' VMCS field set. Expect an MTF VM-exit to follow event delivery should instruction execution generate a higher-priority event, such as a general-protection fault. Lastly, expect an MTF VM-exit to follow delivery of a debug-trap software exception (INT1/INT3/INTO/INT n).

Signed-off-by Oliver Upton <[email protected]>

Reviewed-by Jim Mattson <[email protected]>

---
 x86/vmx.h       |   1 +
 x86/vmx_tests.c | 157 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 158 insertions(+)

x86/vmx.h +1 -0

index 6214400f2b53..6adf0916564b 100644
@@ -399,6 +399,7 @@ enum Ctrl0 {
        CPU_NMI_WINDOW          = 1ul << 22,
        CPU_IO                  = 1ul << 24,
        CPU_IO_BITMAP           = 1ul << 25,
+       CPU_MTF                 = 1ul << 27,
        CPU_MSR_BITMAP          = 1ul << 28,
        CPU_MONITOR             = 1ul << 29,
        CPU_PAUSE               = 1ul << 30,

x86/vmx_tests.c +157 -1

index b31c360c5f3c..0e2c2f8a7d34 100644
@@ -4970,6 +4970,162 @@ static void test_vmx_preemption_timer(void)
        vmcs_write(EXI_CONTROLS, saved_exit);
 }
 
+extern unsigned char test_mtf1;
+extern unsigned char test_mtf2;
+extern unsigned char test_mtf3;
+
+__attribute__((noclone)) static void test_mtf_guest(void)
+{
+       asm ("vmcall;\n\t"
+            "out %al, $0x80;\n\t"
+            "test_mtf1:\n\t"
+            "vmcall;\n\t"
+            "out %al, $0x80;\n\t"
+            "test_mtf2:\n\t"
+            /*
+             * Prepare for the 'MOV CR3' test. Attempt to induce a
+             * general-protection fault by moving a non-canonical address into
+             * CR3. The 'MOV CR3' instruction does not take an imm64 operand,
+             * so we must MOV the desired value into a register first.
+             *
+             * MOV RAX is done before the VMCALL such that MTF is only enabled
+             * for the instruction under test.
+             */
+            "mov $0x8000000000000000, %rax;\n\t"
+            "vmcall;\n\t"
+            "mov %rax, %cr3;\n\t"
+            "test_mtf3:\n\t"
+            "vmcall;\n\t"
+            /*
+             * ICEBP/INT1 instruction. Though the instruction is now
+             * documented, don't rely on assemblers enumerating the
+             * instruction. Resort to hand assembly.
+             */
+            ".byte 0xf1;\n\t");
+}
+
+static void test_mtf_gp_handler(struct ex_regs *regs)
+{
+       regs->rip = (unsigned long) &test_mtf3;
+}
+
+static void test_mtf_db_handler(struct ex_regs *regs)
+{
+}
+
+static void enable_mtf(void)
+{
+       u32 ctrl0 = vmcs_read(CPU_EXEC_CTRL0);
+
+       vmcs_write(CPU_EXEC_CTRL0, ctrl0 | CPU_MTF);
+}
+
+static void disable_mtf(void)
+{
+       u32 ctrl0 = vmcs_read(CPU_EXEC_CTRL0);
+
+       vmcs_write(CPU_EXEC_CTRL0, ctrl0 & ~CPU_MTF);
+}
+
+static void enable_tf(void)
+{
+       unsigned long rflags = vmcs_read(GUEST_RFLAGS);
+
+       vmcs_write(GUEST_RFLAGS, rflags | X86_EFLAGS_TF);
+}
+
+static void disable_tf(void)
+{
+       unsigned long rflags = vmcs_read(GUEST_RFLAGS);
+
+       vmcs_write(GUEST_RFLAGS, rflags & ~X86_EFLAGS_TF);
+}
+
+static void report_mtf(const char *insn_name, unsigned long exp_rip)
+{
+       unsigned long rip = vmcs_read(GUEST_RIP);
+
+       assert_exit_reason(VMX_MTF);
+       report(rip == exp_rip, "MTF VM-exit after %s instruction. RIP: 0x%lx (expected 0x%lx)",
+              insn_name, rip, exp_rip);
+}
+
+static void vmx_mtf_test(void)
+{
+       unsigned long pending_dbg;
+       handler old_gp, old_db;
+
+       if (!(ctrl_cpu_rev[0].clr & CPU_MTF)) {
+               printf("CPU does not support the 'monitor trap flag' processor-based VM-execution control.\n");
+               return;
+       }
+
+       test_set_guest(test_mtf_guest);
+
+       /* Expect an MTF VM-exit after OUT instruction */
+       enter_guest();
+       skip_exit_vmcall();
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("OUT", (unsigned long) &test_mtf1);
+       disable_mtf();
+
+       /*
+        * Concurrent #DB trap and MTF on instruction boundary. Expect MTF
+        * VM-exit with populated 'pending debug exceptions' VMCS field.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       enable_mtf();
+       enable_tf();
+
+       enter_guest();
+       report_mtf("OUT", (unsigned long) &test_mtf2);
+       pending_dbg = vmcs_read(GUEST_PENDING_DEBUG);
+       report(pending_dbg & DR_STEP,
+              "'pending debug exceptions' field after MTF VM-exit: 0x%lx (expected 0x%lx)",
+              pending_dbg, (unsigned long) DR_STEP);
+
+       disable_mtf();
+       disable_tf();
+       vmcs_write(GUEST_PENDING_DEBUG, 0);
+
+       /*
+        * #GP exception takes priority over MTF. Expect MTF VM-exit with RIP
+        * advanced to first instruction of #GP handler.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       old_gp = handle_exception(GP_VECTOR, test_mtf_gp_handler);
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("MOV CR3", (unsigned long) get_idt_addr(&boot_idt[GP_VECTOR]));
+       disable_mtf();
+
+       /*
+        * Concurrent MTF and privileged software exception (i.e. ICEBP/INT1).
+        * MTF should follow the delivery of #DB trap, though the SDM doesn't
+        * provide clear indication of the relative priority.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       handle_exception(GP_VECTOR, old_gp);
+       old_db = handle_exception(DB_VECTOR, test_mtf_db_handler);
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("INT1", (unsigned long) get_idt_addr(&boot_idt[DB_VECTOR]));
+       disable_mtf();
+
+       enter_guest();
+       handle_exception(DB_VECTOR, old_db);
+}
+
 /*
  * Tests for VM-execution control fields
  */

@@ -9505,5 +9661,6 @@ struct vmx_test vmx_tests[] = {
        TEST(atomic_switch_max_msrs_test),
        TEST(atomic_switch_overflow_msrs_test),
        TEST(rdtsc_vmexit_diff_test),
+       TEST(vmx_mtf_test),
        { NULL, NULL, NULL, NULL, NULL, {0} },
 };
--

2.25.0.341.g760bfbb309-goog

Quoted 203 lines · Oliver Upton

Test to verify that MTF VM-exits into host are synthesized when the 'monitor trap flag' processor-based VM-execution control is set under various conditions.

Expect an MTF VM-exit if instruction execution produces no events other than MTF. Should instruction execution produce a concurrent debug-trap and MTF event, expect an MTF VM-exit with the 'pending debug exceptions' VMCS field set. Expect an MTF VM-exit to follow event delivery should instruction execution generate a higher-priority event, such as a general-protection fault. Lastly, expect an MTF VM-exit to follow delivery of a debug-trap software exception (INT1/INT3/INTO/INT n).

Signed-off-by Oliver Upton <[email protected]>

Reviewed-by Jim Mattson <[email protected]>

---
 x86/vmx.h       |   1 +
 x86/vmx_tests.c | 157 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 158 insertions(+)

x86/vmx.h +1 -0

index 6214400f2b53..6adf0916564b 100644
@@ -399,6 +399,7 @@ enum Ctrl0 {
        CPU_NMI_WINDOW          = 1ul << 22,
        CPU_IO                  = 1ul << 24,
        CPU_IO_BITMAP           = 1ul << 25,
+       CPU_MTF                 = 1ul << 27,
        CPU_MSR_BITMAP          = 1ul << 28,
        CPU_MONITOR             = 1ul << 29,
        CPU_PAUSE               = 1ul << 30,

x86/vmx_tests.c +156 -0

index b31c360c5f3c..0e2c2f8a7d34 100644
@@ -4970,6 +4970,162 @@ static void test_vmx_preemption_timer(void)
        vmcs_write(EXI_CONTROLS, saved_exit);
 }
 
+extern unsigned char test_mtf1;
+extern unsigned char test_mtf2;
+extern unsigned char test_mtf3;
+
+__attribute__((noclone)) static void test_mtf_guest(void)
+{
+       asm ("vmcall;\n\t"
+            "out %al, $0x80;\n\t"
+            "test_mtf1:\n\t"
+            "vmcall;\n\t"
+            "out %al, $0x80;\n\t"
+            "test_mtf2:\n\t"
+            /*
+             * Prepare for the 'MOV CR3' test. Attempt to induce a
+             * general-protection fault by moving a non-canonical address into
+             * CR3. The 'MOV CR3' instruction does not take an imm64 operand,
+             * so we must MOV the desired value into a register first.
+             *
+             * MOV RAX is done before the VMCALL such that MTF is only enabled
+             * for the instruction under test.
+             */
+            "mov $0x8000000000000000, %rax;\n\t"
+            "vmcall;\n\t"
+            "mov %rax, %cr3;\n\t"
+            "test_mtf3:\n\t"
+            "vmcall;\n\t"
+            /*
+             * ICEBP/INT1 instruction. Though the instruction is now
+             * documented, don't rely on assemblers enumerating the
+             * instruction. Resort to hand assembly.
+             */
+            ".byte 0xf1;\n\t");
+}
+
+static void test_mtf_gp_handler(struct ex_regs *regs)
+{
+       regs->rip = (unsigned long) &test_mtf3;
+}
+
+static void test_mtf_db_handler(struct ex_regs *regs)
+{
+}
+
+static void enable_mtf(void)
+{
+       u32 ctrl0 = vmcs_read(CPU_EXEC_CTRL0);
+
+       vmcs_write(CPU_EXEC_CTRL0, ctrl0 | CPU_MTF);
+}
+
+static void disable_mtf(void)
+{
+       u32 ctrl0 = vmcs_read(CPU_EXEC_CTRL0);
+
+       vmcs_write(CPU_EXEC_CTRL0, ctrl0 & ~CPU_MTF);
+}
+
+static void enable_tf(void)
+{
+       unsigned long rflags = vmcs_read(GUEST_RFLAGS);
+
+       vmcs_write(GUEST_RFLAGS, rflags | X86_EFLAGS_TF);
+}
+
+static void disable_tf(void)
+{
+       unsigned long rflags = vmcs_read(GUEST_RFLAGS);
+
+       vmcs_write(GUEST_RFLAGS, rflags & ~X86_EFLAGS_TF);
+}
+
+static void report_mtf(const char *insn_name, unsigned long exp_rip)
+{
+       unsigned long rip = vmcs_read(GUEST_RIP);
+
+       assert_exit_reason(VMX_MTF);
+       report(rip == exp_rip, "MTF VM-exit after %s instruction. RIP: 0x%lx (expected 0x%lx)",
+              insn_name, rip, exp_rip);
+}
+
+static void vmx_mtf_test(void)
+{
+       unsigned long pending_dbg;
+       handler old_gp, old_db;
+
+       if (!(ctrl_cpu_rev[0].clr & CPU_MTF)) {
+               printf("CPU does not support the 'monitor trap flag' processor-based VM-execution control.\n");
+               return;
+       }
+
+       test_set_guest(test_mtf_guest);
+
+       /* Expect an MTF VM-exit after OUT instruction */
+       enter_guest();
+       skip_exit_vmcall();
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("OUT", (unsigned long) &test_mtf1);
+       disable_mtf();
+
+       /*
+        * Concurrent #DB trap and MTF on instruction boundary. Expect MTF
+        * VM-exit with populated 'pending debug exceptions' VMCS field.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       enable_mtf();
+       enable_tf();
+
+       enter_guest();
+       report_mtf("OUT", (unsigned long) &test_mtf2);
+       pending_dbg = vmcs_read(GUEST_PENDING_DEBUG);
+       report(pending_dbg & DR_STEP,
+              "'pending debug exceptions' field after MTF VM-exit: 0x%lx (expected 0x%lx)",
+              pending_dbg, (unsigned long) DR_STEP);
+
+       disable_mtf();
+       disable_tf();
+       vmcs_write(GUEST_PENDING_DEBUG, 0);
+
+       /*
+        * #GP exception takes priority over MTF. Expect MTF VM-exit with RIP
+        * advanced to first instruction of #GP handler.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       old_gp = handle_exception(GP_VECTOR, test_mtf_gp_handler);
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("MOV CR3", (unsigned long) get_idt_addr(&boot_idt[GP_VECTOR]));
+       disable_mtf();
+
+       /*
+        * Concurrent MTF and privileged software exception (i.e. ICEBP/INT1).
+        * MTF should follow the delivery of #DB trap, though the SDM doesn't
+        * provide clear indication of the relative priority.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       handle_exception(GP_VECTOR, old_gp);
+       old_db = handle_exception(DB_VECTOR, test_mtf_db_handler);
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("INT1", (unsigned long) get_idt_addr(&boot_idt[DB_VECTOR]));
+       disable_mtf();
+
+       enter_guest();
+       handle_exception(DB_VECTOR, old_db);
+}
+
 /*
  * Tests for VM-execution control fields
  */

@@ -9505,5 +9661,6 @@ struct vmx_test vmx_tests[] = {
        TEST(atomic_switch_max_msrs_test),
        TEST(atomic_switch_overflow_msrs_test),
        TEST(rdtsc_vmexit_diff_test),

Quoted 6 lines

x86/vmx_tests.c +1 -1

+       TEST(vmx_mtf_test),
        { NULL, NULL, NULL, NULL, NULL, {0} },
 };
--

2.25.0.341.g760bfbb309-goog

Friendly ping :) (Just on this patch, 1-4 have already been applied)

Quoted 204 lines · Oliver Upton

Quoted 203 lines · Oliver Upton

Test to verify that MTF VM-exits into host are synthesized when the 'monitor trap flag' processor-based VM-execution control is set under various conditions.

Expect an MTF VM-exit if instruction execution produces no events other than MTF. Should instruction execution produce a concurrent debug-trap and MTF event, expect an MTF VM-exit with the 'pending debug exceptions' VMCS field set. Expect an MTF VM-exit to follow event delivery should instruction execution generate a higher-priority event, such as a general-protection fault. Lastly, expect an MTF VM-exit to follow delivery of a debug-trap software exception (INT1/INT3/INTO/INT n).

Signed-off-by Oliver Upton <[email protected]>

Reviewed-by Jim Mattson <[email protected]>

---
 x86/vmx.h       |   1 +
 x86/vmx_tests.c | 157 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 158 insertions(+)

x86/vmx.h +1 -0

index 6214400f2b53..6adf0916564b 100644
@@ -399,6 +399,7 @@ enum Ctrl0 {
        CPU_NMI_WINDOW          = 1ul << 22,
        CPU_IO                  = 1ul << 24,
        CPU_IO_BITMAP           = 1ul << 25,
+       CPU_MTF                 = 1ul << 27,
        CPU_MSR_BITMAP          = 1ul << 28,
        CPU_MONITOR             = 1ul << 29,
        CPU_PAUSE               = 1ul << 30,

x86/vmx_tests.c +156 -0

index b31c360c5f3c..0e2c2f8a7d34 100644
@@ -4970,6 +4970,162 @@ static void test_vmx_preemption_timer(void)
        vmcs_write(EXI_CONTROLS, saved_exit);
 }
 
+extern unsigned char test_mtf1;
+extern unsigned char test_mtf2;
+extern unsigned char test_mtf3;
+
+__attribute__((noclone)) static void test_mtf_guest(void)
+{
+       asm ("vmcall;\n\t"
+            "out %al, $0x80;\n\t"
+            "test_mtf1:\n\t"
+            "vmcall;\n\t"
+            "out %al, $0x80;\n\t"
+            "test_mtf2:\n\t"
+            /*
+             * Prepare for the 'MOV CR3' test. Attempt to induce a
+             * general-protection fault by moving a non-canonical address into
+             * CR3. The 'MOV CR3' instruction does not take an imm64 operand,
+             * so we must MOV the desired value into a register first.
+             *
+             * MOV RAX is done before the VMCALL such that MTF is only enabled
+             * for the instruction under test.
+             */
+            "mov $0x8000000000000000, %rax;\n\t"
+            "vmcall;\n\t"
+            "mov %rax, %cr3;\n\t"
+            "test_mtf3:\n\t"
+            "vmcall;\n\t"
+            /*
+             * ICEBP/INT1 instruction. Though the instruction is now
+             * documented, don't rely on assemblers enumerating the
+             * instruction. Resort to hand assembly.
+             */
+            ".byte 0xf1;\n\t");
+}
+
+static void test_mtf_gp_handler(struct ex_regs *regs)
+{
+       regs->rip = (unsigned long) &test_mtf3;
+}
+
+static void test_mtf_db_handler(struct ex_regs *regs)
+{
+}
+
+static void enable_mtf(void)
+{
+       u32 ctrl0 = vmcs_read(CPU_EXEC_CTRL0);
+
+       vmcs_write(CPU_EXEC_CTRL0, ctrl0 | CPU_MTF);
+}
+
+static void disable_mtf(void)
+{
+       u32 ctrl0 = vmcs_read(CPU_EXEC_CTRL0);
+
+       vmcs_write(CPU_EXEC_CTRL0, ctrl0 & ~CPU_MTF);
+}
+
+static void enable_tf(void)
+{
+       unsigned long rflags = vmcs_read(GUEST_RFLAGS);
+
+       vmcs_write(GUEST_RFLAGS, rflags | X86_EFLAGS_TF);
+}
+
+static void disable_tf(void)
+{
+       unsigned long rflags = vmcs_read(GUEST_RFLAGS);
+
+       vmcs_write(GUEST_RFLAGS, rflags & ~X86_EFLAGS_TF);
+}
+
+static void report_mtf(const char *insn_name, unsigned long exp_rip)
+{
+       unsigned long rip = vmcs_read(GUEST_RIP);
+
+       assert_exit_reason(VMX_MTF);
+       report(rip == exp_rip, "MTF VM-exit after %s instruction. RIP: 0x%lx (expected 0x%lx)",
+              insn_name, rip, exp_rip);
+}
+
+static void vmx_mtf_test(void)
+{
+       unsigned long pending_dbg;
+       handler old_gp, old_db;
+
+       if (!(ctrl_cpu_rev[0].clr & CPU_MTF)) {
+               printf("CPU does not support the 'monitor trap flag' processor-based VM-execution control.\n");
+               return;
+       }
+
+       test_set_guest(test_mtf_guest);
+
+       /* Expect an MTF VM-exit after OUT instruction */
+       enter_guest();
+       skip_exit_vmcall();
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("OUT", (unsigned long) &test_mtf1);
+       disable_mtf();
+
+       /*
+        * Concurrent #DB trap and MTF on instruction boundary. Expect MTF
+        * VM-exit with populated 'pending debug exceptions' VMCS field.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       enable_mtf();
+       enable_tf();
+
+       enter_guest();
+       report_mtf("OUT", (unsigned long) &test_mtf2);
+       pending_dbg = vmcs_read(GUEST_PENDING_DEBUG);
+       report(pending_dbg & DR_STEP,
+              "'pending debug exceptions' field after MTF VM-exit: 0x%lx (expected 0x%lx)",
+              pending_dbg, (unsigned long) DR_STEP);
+
+       disable_mtf();
+       disable_tf();
+       vmcs_write(GUEST_PENDING_DEBUG, 0);
+
+       /*
+        * #GP exception takes priority over MTF. Expect MTF VM-exit with RIP
+        * advanced to first instruction of #GP handler.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       old_gp = handle_exception(GP_VECTOR, test_mtf_gp_handler);
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("MOV CR3", (unsigned long) get_idt_addr(&boot_idt[GP_VECTOR]));
+       disable_mtf();
+
+       /*
+        * Concurrent MTF and privileged software exception (i.e. ICEBP/INT1).
+        * MTF should follow the delivery of #DB trap, though the SDM doesn't
+        * provide clear indication of the relative priority.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       handle_exception(GP_VECTOR, old_gp);
+       old_db = handle_exception(DB_VECTOR, test_mtf_db_handler);
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("INT1", (unsigned long) get_idt_addr(&boot_idt[DB_VECTOR]));
+       disable_mtf();
+
+       enter_guest();
+       handle_exception(DB_VECTOR, old_db);
+}
+
 /*
  * Tests for VM-execution control fields
  */

@@ -9505,5 +9661,6 @@ struct vmx_test vmx_tests[] = {
        TEST(atomic_switch_max_msrs_test),
        TEST(atomic_switch_overflow_msrs_test),
        TEST(rdtsc_vmexit_diff_test),

Quoted 8 lines

Quoted 6 lines

x86/vmx_tests.c +1 -1

+       TEST(vmx_mtf_test),
        { NULL, NULL, NULL, NULL, NULL, {0} },
 };
--

2.25.0.341.g760bfbb309-goog

Friendly ping :) (Just on this patch, 1-4 have already been applied)

Done, thanks. I only had to push, since I had applied it already to test the KVM changes.

Paolo

Quoted 206 lines · Oliver Upton

Test to verify that MTF VM-exits into host are synthesized when the 'monitor trap flag' processor-based VM-execution control is set under various conditions.

Expect an MTF VM-exit if instruction execution produces no events other than MTF. Should instruction execution produce a concurrent debug-trap and MTF event, expect an MTF VM-exit with the 'pending debug exceptions' VMCS field set. Expect an MTF VM-exit to follow event delivery should instruction execution generate a higher-priority event, such as a general-protection fault. Lastly, expect an MTF VM-exit to follow delivery of a debug-trap software exception (INT1/INT3/INTO/INT n).

Signed-off-by Oliver Upton <[email protected]>

Reviewed-by Jim Mattson <[email protected]>

---
  x86/vmx.h       |   1 +
  x86/vmx_tests.c | 157 ++++++++++++++++++++++++++++++++++++++++++++++++
  2 files changed, 158 insertions(+)

x86/vmx.h +1 -0

index 6214400f2b53..6adf0916564b 100644
@@ -399,6 +399,7 @@ enum Ctrl0 {
         CPU_NMI_WINDOW          = 1ul << 22,
         CPU_IO                  = 1ul << 24,
         CPU_IO_BITMAP           = 1ul << 25,
+       CPU_MTF                 = 1ul << 27,
         CPU_MSR_BITMAP          = 1ul << 28,
         CPU_MONITOR             = 1ul << 29,
         CPU_PAUSE               = 1ul << 30,

x86/vmx_tests.c +157 -1

index b31c360c5f3c..0e2c2f8a7d34 100644
@@ -4970,6 +4970,162 @@ static void test_vmx_preemption_timer(void)
         vmcs_write(EXI_CONTROLS, saved_exit);
  }
 
+extern unsigned char test_mtf1;
+extern unsigned char test_mtf2;
+extern unsigned char test_mtf3;
+
+__attribute__((noclone)) static void test_mtf_guest(void)
+{
+       asm ("vmcall;\n\t"
+            "out %al, $0x80;\n\t"
+            "test_mtf1:\n\t"
+            "vmcall;\n\t"
+            "out %al, $0x80;\n\t"
+            "test_mtf2:\n\t"
+            /*
+             * Prepare for the 'MOV CR3' test. Attempt to induce a
+             * general-protection fault by moving a non-canonical address into
+             * CR3. The 'MOV CR3' instruction does not take an imm64 operand,
+             * so we must MOV the desired value into a register first.
+             *
+             * MOV RAX is done before the VMCALL such that MTF is only enabled
+             * for the instruction under test.
+             */
+            "mov $0x8000000000000000, %rax;\n\t"
+            "vmcall;\n\t"
+            "mov %rax, %cr3;\n\t"
+            "test_mtf3:\n\t"
+            "vmcall;\n\t"
+            /*
+             * ICEBP/INT1 instruction. Though the instruction is now
+             * documented, don't rely on assemblers enumerating the
+             * instruction. Resort to hand assembly.
+             */
+            ".byte 0xf1;\n\t");
+}
+
+static void test_mtf_gp_handler(struct ex_regs *regs)
+{
+       regs->rip = (unsigned long) &test_mtf3;
+}
+
+static void test_mtf_db_handler(struct ex_regs *regs)
+{
+}
+
+static void enable_mtf(void)
+{
+       u32 ctrl0 = vmcs_read(CPU_EXEC_CTRL0);
+
+       vmcs_write(CPU_EXEC_CTRL0, ctrl0 | CPU_MTF);
+}
+
+static void disable_mtf(void)
+{
+       u32 ctrl0 = vmcs_read(CPU_EXEC_CTRL0);
+
+       vmcs_write(CPU_EXEC_CTRL0, ctrl0 & ~CPU_MTF);
+}
+
+static void enable_tf(void)
+{
+       unsigned long rflags = vmcs_read(GUEST_RFLAGS);
+
+       vmcs_write(GUEST_RFLAGS, rflags | X86_EFLAGS_TF);
+}
+
+static void disable_tf(void)
+{
+       unsigned long rflags = vmcs_read(GUEST_RFLAGS);
+
+       vmcs_write(GUEST_RFLAGS, rflags & ~X86_EFLAGS_TF);
+}
+
+static void report_mtf(const char *insn_name, unsigned long exp_rip)
+{
+       unsigned long rip = vmcs_read(GUEST_RIP);
+
+       assert_exit_reason(VMX_MTF);
+       report(rip == exp_rip, "MTF VM-exit after %s instruction. RIP: 0x%lx (expected 0x%lx)",
+              insn_name, rip, exp_rip);
+}
+
+static void vmx_mtf_test(void)
+{
+       unsigned long pending_dbg;
+       handler old_gp, old_db;
+
+       if (!(ctrl_cpu_rev[0].clr & CPU_MTF)) {
+               printf("CPU does not support the 'monitor trap flag' processor-based VM-execution control.\n");
+               return;
+       }
+
+       test_set_guest(test_mtf_guest);
+
+       /* Expect an MTF VM-exit after OUT instruction */
+       enter_guest();
+       skip_exit_vmcall();
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("OUT", (unsigned long) &test_mtf1);
+       disable_mtf();
+
+       /*
+        * Concurrent #DB trap and MTF on instruction boundary. Expect MTF
+        * VM-exit with populated 'pending debug exceptions' VMCS field.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       enable_mtf();
+       enable_tf();
+
+       enter_guest();
+       report_mtf("OUT", (unsigned long) &test_mtf2);
+       pending_dbg = vmcs_read(GUEST_PENDING_DEBUG);
+       report(pending_dbg & DR_STEP,
+              "'pending debug exceptions' field after MTF VM-exit: 0x%lx (expected 0x%lx)",
+              pending_dbg, (unsigned long) DR_STEP);
+
+       disable_mtf();
+       disable_tf();
+       vmcs_write(GUEST_PENDING_DEBUG, 0);
+
+       /*
+        * #GP exception takes priority over MTF. Expect MTF VM-exit with RIP
+        * advanced to first instruction of #GP handler.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       old_gp = handle_exception(GP_VECTOR, test_mtf_gp_handler);
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("MOV CR3", (unsigned long) get_idt_addr(&boot_idt[GP_VECTOR]));
+       disable_mtf();
+
+       /*
+        * Concurrent MTF and privileged software exception (i.e. ICEBP/INT1).
+        * MTF should follow the delivery of #DB trap, though the SDM doesn't
+        * provide clear indication of the relative priority.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       handle_exception(GP_VECTOR, old_gp);
+       old_db = handle_exception(DB_VECTOR, test_mtf_db_handler);
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("INT1", (unsigned long) get_idt_addr(&boot_idt[DB_VECTOR]));
+       disable_mtf();
+
+       enter_guest();
+       handle_exception(DB_VECTOR, old_db);
+}
+
  /*
   * Tests for VM-execution control fields
   */

@@ -9505,5 +9661,6 @@ struct vmx_test vmx_tests[] = {
         TEST(atomic_switch_max_msrs_test),
         TEST(atomic_switch_overflow_msrs_test),
         TEST(rdtsc_vmexit_diff_test),
+       TEST(vmx_mtf_test),
         { NULL, NULL, NULL, NULL, NULL, {0} },
  };
--

Quoted 2 lines

2.25.0.341.g760bfbb309-goog

Friendly ping :) (Just on this patch, 1-4 have already been applied)

--
Thanks,
Oliver

Quoted 211 lines · Oliver Upton

Quoted 206 lines · Oliver Upton

Test to verify that MTF VM-exits into host are synthesized when the 'monitor trap flag' processor-based VM-execution control is set under various conditions.

Expect an MTF VM-exit if instruction execution produces no events other than MTF. Should instruction execution produce a concurrent debug-trap and MTF event, expect an MTF VM-exit with the 'pending debug exceptions' VMCS field set. Expect an MTF VM-exit to follow event delivery should instruction execution generate a higher-priority event, such as a general-protection fault. Lastly, expect an MTF VM-exit to follow delivery of a debug-trap software exception (INT1/INT3/INTO/INT n).

Signed-off-by Oliver Upton <[email protected]>

Reviewed-by Jim Mattson <[email protected]>

---
  x86/vmx.h       |   1 +
  x86/vmx_tests.c | 157 ++++++++++++++++++++++++++++++++++++++++++++++++
  2 files changed, 158 insertions(+)

x86/vmx.h +1 -0

index 6214400f2b53..6adf0916564b 100644
@@ -399,6 +399,7 @@ enum Ctrl0 {
         CPU_NMI_WINDOW          = 1ul << 22,
         CPU_IO                  = 1ul << 24,
         CPU_IO_BITMAP           = 1ul << 25,
+       CPU_MTF                 = 1ul << 27,
         CPU_MSR_BITMAP          = 1ul << 28,
         CPU_MONITOR             = 1ul << 29,
         CPU_PAUSE               = 1ul << 30,

x86/vmx_tests.c +157 -1

index b31c360c5f3c..0e2c2f8a7d34 100644
@@ -4970,6 +4970,162 @@ static void test_vmx_preemption_timer(void)
         vmcs_write(EXI_CONTROLS, saved_exit);
  }
 
+extern unsigned char test_mtf1;
+extern unsigned char test_mtf2;
+extern unsigned char test_mtf3;
+
+__attribute__((noclone)) static void test_mtf_guest(void)
+{
+       asm ("vmcall;\n\t"
+            "out %al, $0x80;\n\t"
+            "test_mtf1:\n\t"
+            "vmcall;\n\t"
+            "out %al, $0x80;\n\t"
+            "test_mtf2:\n\t"
+            /*
+             * Prepare for the 'MOV CR3' test. Attempt to induce a
+             * general-protection fault by moving a non-canonical address into
+             * CR3. The 'MOV CR3' instruction does not take an imm64 operand,
+             * so we must MOV the desired value into a register first.
+             *
+             * MOV RAX is done before the VMCALL such that MTF is only enabled
+             * for the instruction under test.
+             */
+            "mov $0x8000000000000000, %rax;\n\t"
+            "vmcall;\n\t"
+            "mov %rax, %cr3;\n\t"
+            "test_mtf3:\n\t"
+            "vmcall;\n\t"
+            /*
+             * ICEBP/INT1 instruction. Though the instruction is now
+             * documented, don't rely on assemblers enumerating the
+             * instruction. Resort to hand assembly.
+             */
+            ".byte 0xf1;\n\t");
+}
+
+static void test_mtf_gp_handler(struct ex_regs *regs)
+{
+       regs->rip = (unsigned long) &test_mtf3;
+}
+
+static void test_mtf_db_handler(struct ex_regs *regs)
+{
+}
+
+static void enable_mtf(void)
+{
+       u32 ctrl0 = vmcs_read(CPU_EXEC_CTRL0);
+
+       vmcs_write(CPU_EXEC_CTRL0, ctrl0 | CPU_MTF);
+}
+
+static void disable_mtf(void)
+{
+       u32 ctrl0 = vmcs_read(CPU_EXEC_CTRL0);
+
+       vmcs_write(CPU_EXEC_CTRL0, ctrl0 & ~CPU_MTF);
+}
+
+static void enable_tf(void)
+{
+       unsigned long rflags = vmcs_read(GUEST_RFLAGS);
+
+       vmcs_write(GUEST_RFLAGS, rflags | X86_EFLAGS_TF);
+}
+
+static void disable_tf(void)
+{
+       unsigned long rflags = vmcs_read(GUEST_RFLAGS);
+
+       vmcs_write(GUEST_RFLAGS, rflags & ~X86_EFLAGS_TF);
+}
+
+static void report_mtf(const char *insn_name, unsigned long exp_rip)
+{
+       unsigned long rip = vmcs_read(GUEST_RIP);
+
+       assert_exit_reason(VMX_MTF);
+       report(rip == exp_rip, "MTF VM-exit after %s instruction. RIP: 0x%lx (expected 0x%lx)",
+              insn_name, rip, exp_rip);
+}
+
+static void vmx_mtf_test(void)
+{
+       unsigned long pending_dbg;
+       handler old_gp, old_db;
+
+       if (!(ctrl_cpu_rev[0].clr & CPU_MTF)) {
+               printf("CPU does not support the 'monitor trap flag' processor-based VM-execution control.\n");
+               return;
+       }
+
+       test_set_guest(test_mtf_guest);
+
+       /* Expect an MTF VM-exit after OUT instruction */
+       enter_guest();
+       skip_exit_vmcall();
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("OUT", (unsigned long) &test_mtf1);
+       disable_mtf();
+
+       /*
+        * Concurrent #DB trap and MTF on instruction boundary. Expect MTF
+        * VM-exit with populated 'pending debug exceptions' VMCS field.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       enable_mtf();
+       enable_tf();
+
+       enter_guest();
+       report_mtf("OUT", (unsigned long) &test_mtf2);
+       pending_dbg = vmcs_read(GUEST_PENDING_DEBUG);
+       report(pending_dbg & DR_STEP,
+              "'pending debug exceptions' field after MTF VM-exit: 0x%lx (expected 0x%lx)",
+              pending_dbg, (unsigned long) DR_STEP);
+
+       disable_mtf();
+       disable_tf();
+       vmcs_write(GUEST_PENDING_DEBUG, 0);
+
+       /*
+        * #GP exception takes priority over MTF. Expect MTF VM-exit with RIP
+        * advanced to first instruction of #GP handler.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       old_gp = handle_exception(GP_VECTOR, test_mtf_gp_handler);
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("MOV CR3", (unsigned long) get_idt_addr(&boot_idt[GP_VECTOR]));
+       disable_mtf();
+
+       /*
+        * Concurrent MTF and privileged software exception (i.e. ICEBP/INT1).
+        * MTF should follow the delivery of #DB trap, though the SDM doesn't
+        * provide clear indication of the relative priority.
+        */
+       enter_guest();
+       skip_exit_vmcall();
+
+       handle_exception(GP_VECTOR, old_gp);
+       old_db = handle_exception(DB_VECTOR, test_mtf_db_handler);
+
+       enable_mtf();
+       enter_guest();
+       report_mtf("INT1", (unsigned long) get_idt_addr(&boot_idt[DB_VECTOR]));
+       disable_mtf();
+
+       enter_guest();
+       handle_exception(DB_VECTOR, old_db);
+}
+
  /*
   * Tests for VM-execution control fields
   */

@@ -9505,5 +9661,6 @@ struct vmx_test vmx_tests[] = {
         TEST(atomic_switch_max_msrs_test),
         TEST(atomic_switch_overflow_msrs_test),
         TEST(rdtsc_vmexit_diff_test),
+       TEST(vmx_mtf_test),
         { NULL, NULL, NULL, NULL, NULL, {0} },
  };
--

Quoted 2 lines

2.25.0.341.g760bfbb309-goog

Friendly ping :) (Just on this patch, 1-4 have already been applied)

Quoted 3 lines

--
Thanks,
Oliver

I know Paolo has already applied this patch. Wanted to send out the comments anyway as I was reviewing it...

1. The commit header should have "nVMX" instead of "VMX". That's
important for searching git history.

2. It would be better for readability if the commit message lists
the test scenarios as numbered items or bullet points instead of putting them all in the same paragraph.

3. Section 25.5.2 in the SDM has more scenarios for MTF VM-exits,
but the test covers only a few scenarios like #DB, #GP etc.

v1: http://lore.kernel.org/r/[email protected]
v2: http://lore.kernel.org/r/[email protected]

v1 => v2:
- Don't split the #DB delivery by vendors. Unconditionally injecting #DB payloads into the 'pending debug exceptions' field will cause KVM to get stuck in a loop. Per the SDM, when hardware injects an event resulting from this field's value, it is checked against the exception interception bitmap.
- Address Sean's comments by injecting the VM-exit into L1 from vmx_check_nested_events().
- Added fix for nested INIT VM-exits + 'pending debug exceptions' field as it was noticed in implementing v2.
- Drop Peter + Jim's Reviewed-by tags, as the patch set has changed since v1.

v2 => v3:
- Merge the check/set_pending_dbg helpers into a single helper, vmx_update_pending_dbg(). Add clarifying comment to this helper.
- Rewrite commit message, descriptive comment for change in 3/5 to explicitly describe the reason for mutating payload delivery behavior.
- Undo the changes to kvm_vcpu_do_singlestep(). Instead, add a new hook to call for 'full' instruction emulation + 'fast' emulation.

KVM already provides guests the ability to use the 'monitor trap flag' VM-execution control. Support for this flag is provided by the fact that KVM unconditionally forwards MTF VM-exits to the guest (if requested), as KVM doesn't utilize MTF. While this provides support during hardware instruction execution, it is insufficient for instruction emulation.

Should L0 emulate an instruction on the behalf of L2, L0 should also synthesize an MTF VM-exit into L1, should control be set.

The first patch corrects a nuanced difference between the definition of a #DB exception payload field and DR6 register. Mask off bit 12 which is defined in the 'pending debug exceptions' field when applying to DR6, since the payload field is said to be compatible with the aforementioned VMCS field.

The second patch sets the 'pending debug exceptions' VMCS field when delivering an INIT signal VM-exit to L1, as described in the SDM. This patch also introduces helpers for setting the 'pending debug exceptions' VMCS field.

The third patch massages KVM's handling of exception payloads with regard to API compatibility. Rather than immediately delivering the payload w/o opt-in, instead defer the payload + inject before completing a KVM_GET_VCPU_EVENTS. This maintains API compatibility whilst correcting #DB behavior with regard to higher priority VM-exit events.

Fourth patch introduces MTF implementation for emulated instructions. Identify if an MTF is due on an instruction boundary from kvm_vcpu_do_singlestep(), however only deliver this VM-exit from vmx_check_nested_events() to respect the relative prioritization to other VM-exits. Since this augments the nested state, introduce a new flag for (de)serialization.

Last patch adds tests to kvm-unit-tests to assert the correctness of MTF under several conditions (concurrent #DB trap, #DB fault, etc). These tests pass under virtualization with this series as well as on bare-metal.

Based on commit 2c2787938512 ("KVM: selftests: Stop memslot creation in KVM internal memslot region").

Oliver Upton (4):
KVM: x86: Mask off reserved bit from #DB exception payload
KVM: nVMX: Handle pending #DB when injecting INIT VM-exit
KVM: x86: Deliver exception payload on KVM_GET_VCPU_EVENTS
KVM: nVMX: Emulate MTF when performing instruction emulation

 arch/x86/include/asm/kvm_host.h |  1 +
 arch/x86/include/uapi/asm/kvm.h |  1 +
 arch/x86/kvm/svm.c              |  1 +
 arch/x86/kvm/vmx/nested.c       | 54 ++++++++++++++++++++++++++++++++-
 arch/x86/kvm/vmx/nested.h       |  5 +++
 arch/x86/kvm/vmx/vmx.c          | 37 +++++++++++++++++++++-
 arch/x86/kvm/vmx/vmx.h          |  3 ++
 arch/x86/kvm/x86.c              | 39 ++++++++++++++++--------
 8 files changed, 126 insertions(+), 15 deletions(-)

Quoted 73 lines · Oliver Upton

v1: http://lore.kernel.org/r/[email protected]
v2: http://lore.kernel.org/r/[email protected]

v1 => v2:
- Don't split the #DB delivery by vendors. Unconditionally injecting #DB payloads into the 'pending debug exceptions' field will cause KVM to get stuck in a loop. Per the SDM, when hardware injects an event resulting from this field's value, it is checked against the exception interception bitmap.
- Address Sean's comments by injecting the VM-exit into L1 from vmx_check_nested_events().
- Added fix for nested INIT VM-exits + 'pending debug exceptions' field as it was noticed in implementing v2.
- Drop Peter + Jim's Reviewed-by tags, as the patch set has changed since v1.

v2 => v3:
- Merge the check/set_pending_dbg helpers into a single helper, vmx_update_pending_dbg(). Add clarifying comment to this helper.
- Rewrite commit message, descriptive comment for change in 3/5 to explicitly describe the reason for mutating payload delivery behavior.
- Undo the changes to kvm_vcpu_do_singlestep(). Instead, add a new hook to call for 'full' instruction emulation + 'fast' emulation.

KVM already provides guests the ability to use the 'monitor trap flag' VM-execution control. Support for this flag is provided by the fact that KVM unconditionally forwards MTF VM-exits to the guest (if requested), as KVM doesn't utilize MTF. While this provides support during hardware instruction execution, it is insufficient for instruction emulation.

Should L0 emulate an instruction on the behalf of L2, L0 should also synthesize an MTF VM-exit into L1, should control be set.

The first patch corrects a nuanced difference between the definition of a #DB exception payload field and DR6 register. Mask off bit 12 which is defined in the 'pending debug exceptions' field when applying to DR6, since the payload field is said to be compatible with the aforementioned VMCS field.

The second patch sets the 'pending debug exceptions' VMCS field when delivering an INIT signal VM-exit to L1, as described in the SDM. This patch also introduces helpers for setting the 'pending debug exceptions' VMCS field.

The third patch massages KVM's handling of exception payloads with regard to API compatibility. Rather than immediately delivering the payload w/o opt-in, instead defer the payload + inject before completing a KVM_GET_VCPU_EVENTS. This maintains API compatibility whilst correcting #DB behavior with regard to higher priority VM-exit events.

Fourth patch introduces MTF implementation for emulated instructions. Identify if an MTF is due on an instruction boundary from kvm_vcpu_do_singlestep(), however only deliver this VM-exit from vmx_check_nested_events() to respect the relative prioritization to other VM-exits. Since this augments the nested state, introduce a new flag for (de)serialization.

Last patch adds tests to kvm-unit-tests to assert the correctness of MTF under several conditions (concurrent #DB trap, #DB fault, etc). These tests pass under virtualization with this series as well as on bare-metal.

Based on commit 2c2787938512 ("KVM: selftests: Stop memslot creation in KVM internal memslot region").

Oliver Upton (4):
KVM: x86: Mask off reserved bit from #DB exception payload
KVM: nVMX: Handle pending #DB when injecting INIT VM-exit
KVM: x86: Deliver exception payload on KVM_GET_VCPU_EVENTS
KVM: nVMX: Emulate MTF when performing instruction emulation

Quoted 10 lines

 arch/x86/include/asm/kvm_host.h |  1 +
 arch/x86/include/uapi/asm/kvm.h |  1 +
 arch/x86/kvm/svm.c              |  1 +
 arch/x86/kvm/vmx/nested.c       | 54 ++++++++++++++++++++++++++++++++-
 arch/x86/kvm/vmx/nested.h       |  5 +++
 arch/x86/kvm/vmx/vmx.c          | 37 +++++++++++++++++++++-
 arch/x86/kvm/vmx/vmx.h          |  3 ++
 arch/x86/kvm/x86.c              | 39 ++++++++++++++++--------
 8 files changed, 126 insertions(+), 15 deletions(-)

Queued (for 5.6-rc2), thanks.

Paolo

Are there any strong opinions about how the newly introduced nested state should be handled across live migrations? When applying this patch set internally I realized live migration would be busted in the case of a kernel rollback (i.e. a kernel with this patchset emits the nested state, kernel w/o receives it + refuses).

Easy fix is to only turn on the feature once it is rollback-proof, but I wonder if there is any room for improvement on this topic..

Quoted 5 lines · Oliver Upton

Are there any strong opinions about how the newly introduced nested state should be handled across live migrations? When applying this patch set internally I realized live migration would be busted in the case of a kernel rollback (i.e. a kernel with this patchset emits the nested state, kernel w/o receives it + refuses).

Only if you use MTF + emulation. In this case it's a pure bugfix so it's okay to break backwards migration. If it's really a new feature, it should support KVM_ENABLE_CAP to enable it.

Paolo

Quoted 2 lines

Easy fix is to only turn on the feature once it is rollback-proof, but I wonder if there is any room for improvement on this topic..