1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright © 2021 Amazon.com, Inc. or its affiliates.
4  */
5 
6 #include "test_util.h"
7 #include "kvm_util.h"
8 #include "processor.h"
9 
10 #include <stdint.h>
11 #include <time.h>
12 #include <sched.h>
13 #include <signal.h>
14 #include <pthread.h>
15 
16 #include <sys/eventfd.h>
17 
18 #define SHINFO_REGION_GVA	0xc0000000ULL
19 #define SHINFO_REGION_GPA	0xc0000000ULL
20 #define SHINFO_REGION_SLOT	10
21 
22 #define DUMMY_REGION_GPA	(SHINFO_REGION_GPA + (3 * PAGE_SIZE))
23 #define DUMMY_REGION_SLOT	11
24 
25 #define DUMMY_REGION_GPA_2	(SHINFO_REGION_GPA + (4 * PAGE_SIZE))
26 #define DUMMY_REGION_SLOT_2	12
27 
28 #define SHINFO_ADDR	(SHINFO_REGION_GPA)
29 #define VCPU_INFO_ADDR	(SHINFO_REGION_GPA + 0x40)
30 #define PVTIME_ADDR	(SHINFO_REGION_GPA + PAGE_SIZE)
31 #define RUNSTATE_ADDR	(SHINFO_REGION_GPA + PAGE_SIZE + PAGE_SIZE - 15)
32 
33 #define SHINFO_VADDR	(SHINFO_REGION_GVA)
34 #define VCPU_INFO_VADDR	(SHINFO_REGION_GVA + 0x40)
35 #define RUNSTATE_VADDR	(SHINFO_REGION_GVA + PAGE_SIZE + PAGE_SIZE - 15)
36 
37 #define EVTCHN_VECTOR	0x10
38 
39 #define EVTCHN_TEST1 15
40 #define EVTCHN_TEST2 66
41 #define EVTCHN_TIMER 13
42 
43 enum {
44 	TEST_INJECT_VECTOR = 0,
45 	TEST_RUNSTATE_runnable,
46 	TEST_RUNSTATE_blocked,
47 	TEST_RUNSTATE_offline,
48 	TEST_RUNSTATE_ADJUST,
49 	TEST_RUNSTATE_DATA,
50 	TEST_STEAL_TIME,
51 	TEST_EVTCHN_MASKED,
52 	TEST_EVTCHN_UNMASKED,
53 	TEST_EVTCHN_SLOWPATH,
54 	TEST_EVTCHN_SEND_IOCTL,
55 	TEST_EVTCHN_HCALL,
56 	TEST_EVTCHN_HCALL_SLOWPATH,
57 	TEST_EVTCHN_HCALL_EVENTFD,
58 	TEST_TIMER_SETUP,
59 	TEST_TIMER_WAIT,
60 	TEST_TIMER_RESTORE,
61 	TEST_POLL_READY,
62 	TEST_POLL_TIMEOUT,
63 	TEST_POLL_MASKED,
64 	TEST_POLL_WAKE,
65 	SET_VCPU_INFO,
66 	TEST_TIMER_PAST,
67 	TEST_LOCKING_SEND_RACE,
68 	TEST_LOCKING_POLL_RACE,
69 	TEST_LOCKING_POLL_TIMEOUT,
70 	TEST_DONE,
71 
72 	TEST_GUEST_SAW_IRQ,
73 };
74 
75 #define XEN_HYPERCALL_MSR	0x40000000
76 
77 #define MIN_STEAL_TIME		50000
78 
79 #define SHINFO_RACE_TIMEOUT	2	/* seconds */
80 
81 #define __HYPERVISOR_set_timer_op	15
82 #define __HYPERVISOR_sched_op		29
83 #define __HYPERVISOR_event_channel_op	32
84 
85 #define SCHEDOP_poll			3
86 
87 #define EVTCHNOP_send			4
88 
89 #define EVTCHNSTAT_interdomain		2
90 
91 struct evtchn_send {
92 	u32 port;
93 };
94 
95 struct sched_poll {
96 	u32 *ports;
97 	unsigned int nr_ports;
98 	u64 timeout;
99 };
100 
101 struct pvclock_vcpu_time_info {
102 	u32   version;
103 	u32   pad0;
104 	u64   tsc_timestamp;
105 	u64   system_time;
106 	u32   tsc_to_system_mul;
107 	s8    tsc_shift;
108 	u8    flags;
109 	u8    pad[2];
110 } __attribute__((__packed__)); /* 32 bytes */
111 
112 struct pvclock_wall_clock {
113 	u32   version;
114 	u32   sec;
115 	u32   nsec;
116 } __attribute__((__packed__));
117 
118 struct vcpu_runstate_info {
119 	uint32_t state;
120 	uint64_t state_entry_time;
121 	uint64_t time[5]; /* Extra field for overrun check */
122 };
123 
124 struct compat_vcpu_runstate_info {
125 	uint32_t state;
126 	uint64_t state_entry_time;
127 	uint64_t time[5];
128 } __attribute__((__packed__));
129 
130 struct arch_vcpu_info {
131 	unsigned long cr2;
132 	unsigned long pad; /* sizeof(vcpu_info_t) == 64 */
133 };
134 
135 struct vcpu_info {
136 	uint8_t evtchn_upcall_pending;
137 	uint8_t evtchn_upcall_mask;
138 	unsigned long evtchn_pending_sel;
139 	struct arch_vcpu_info arch;
140 	struct pvclock_vcpu_time_info time;
141 }; /* 64 bytes (x86) */
142 
143 struct shared_info {
144 	struct vcpu_info vcpu_info[32];
145 	unsigned long evtchn_pending[64];
146 	unsigned long evtchn_mask[64];
147 	struct pvclock_wall_clock wc;
148 	uint32_t wc_sec_hi;
149 	/* arch_shared_info here */
150 };
151 
152 #define RUNSTATE_running  0
153 #define RUNSTATE_runnable 1
154 #define RUNSTATE_blocked  2
155 #define RUNSTATE_offline  3
156 
157 static const char *runstate_names[] = {
158 	"running",
159 	"runnable",
160 	"blocked",
161 	"offline"
162 };
163 
164 struct {
165 	struct kvm_irq_routing info;
166 	struct kvm_irq_routing_entry entries[2];
167 } irq_routes;
168 
169 static volatile bool guest_saw_irq;
170 
evtchn_handler(struct ex_regs * regs)171 static void evtchn_handler(struct ex_regs *regs)
172 {
173 	struct vcpu_info *vi = (void *)VCPU_INFO_VADDR;
174 
175 	vcpu_arch_put_guest(vi->evtchn_upcall_pending, 0);
176 	vcpu_arch_put_guest(vi->evtchn_pending_sel, 0);
177 	guest_saw_irq = true;
178 
179 	GUEST_SYNC(TEST_GUEST_SAW_IRQ);
180 }
181 
guest_wait_for_irq(void)182 static void guest_wait_for_irq(void)
183 {
184 	while (!guest_saw_irq)
185 		__asm__ __volatile__ ("rep nop" : : : "memory");
186 	guest_saw_irq = false;
187 }
188 
guest_code(void)189 static void guest_code(void)
190 {
191 	struct vcpu_runstate_info *rs = (void *)RUNSTATE_VADDR;
192 	int i;
193 
194 	sti_nop();
195 
196 	/* Trigger an interrupt injection */
197 	GUEST_SYNC(TEST_INJECT_VECTOR);
198 
199 	guest_wait_for_irq();
200 
201 	/* Test having the host set runstates manually */
202 	GUEST_SYNC(TEST_RUNSTATE_runnable);
203 	GUEST_ASSERT(rs->time[RUNSTATE_runnable] != 0);
204 	GUEST_ASSERT(rs->state == 0);
205 
206 	GUEST_SYNC(TEST_RUNSTATE_blocked);
207 	GUEST_ASSERT(rs->time[RUNSTATE_blocked] != 0);
208 	GUEST_ASSERT(rs->state == 0);
209 
210 	GUEST_SYNC(TEST_RUNSTATE_offline);
211 	GUEST_ASSERT(rs->time[RUNSTATE_offline] != 0);
212 	GUEST_ASSERT(rs->state == 0);
213 
214 	/* Test runstate time adjust */
215 	GUEST_SYNC(TEST_RUNSTATE_ADJUST);
216 	GUEST_ASSERT(rs->time[RUNSTATE_blocked] == 0x5a);
217 	GUEST_ASSERT(rs->time[RUNSTATE_offline] == 0x6b6b);
218 
219 	/* Test runstate time set */
220 	GUEST_SYNC(TEST_RUNSTATE_DATA);
221 	GUEST_ASSERT(rs->state_entry_time >= 0x8000);
222 	GUEST_ASSERT(rs->time[RUNSTATE_runnable] == 0);
223 	GUEST_ASSERT(rs->time[RUNSTATE_blocked] == 0x6b6b);
224 	GUEST_ASSERT(rs->time[RUNSTATE_offline] == 0x5a);
225 
226 	/* sched_yield() should result in some 'runnable' time */
227 	GUEST_SYNC(TEST_STEAL_TIME);
228 	GUEST_ASSERT(rs->time[RUNSTATE_runnable] >= MIN_STEAL_TIME);
229 
230 	/* Attempt to deliver a *masked* interrupt */
231 	GUEST_SYNC(TEST_EVTCHN_MASKED);
232 
233 	/* Wait until we see the bit set */
234 	struct shared_info *si = (void *)SHINFO_VADDR;
235 	while (!si->evtchn_pending[0])
236 		__asm__ __volatile__ ("rep nop" : : : "memory");
237 
238 	/* Now deliver an *unmasked* interrupt */
239 	GUEST_SYNC(TEST_EVTCHN_UNMASKED);
240 
241 	guest_wait_for_irq();
242 
243 	/* Change memslots and deliver an interrupt */
244 	GUEST_SYNC(TEST_EVTCHN_SLOWPATH);
245 
246 	guest_wait_for_irq();
247 
248 	/* Deliver event channel with KVM_XEN_HVM_EVTCHN_SEND */
249 	GUEST_SYNC(TEST_EVTCHN_SEND_IOCTL);
250 
251 	guest_wait_for_irq();
252 
253 	GUEST_SYNC(TEST_EVTCHN_HCALL);
254 
255 	/* Our turn. Deliver event channel (to ourselves) with
256 	 * EVTCHNOP_send hypercall. */
257 	struct evtchn_send s = { .port = 127 };
258 	xen_hypercall(__HYPERVISOR_event_channel_op, EVTCHNOP_send, &s);
259 
260 	guest_wait_for_irq();
261 
262 	GUEST_SYNC(TEST_EVTCHN_HCALL_SLOWPATH);
263 
264 	/*
265 	 * Same again, but this time the host has messed with memslots so it
266 	 * should take the slow path in kvm_xen_set_evtchn().
267 	 */
268 	xen_hypercall(__HYPERVISOR_event_channel_op, EVTCHNOP_send, &s);
269 
270 	guest_wait_for_irq();
271 
272 	GUEST_SYNC(TEST_EVTCHN_HCALL_EVENTFD);
273 
274 	/* Deliver "outbound" event channel to an eventfd which
275 	 * happens to be one of our own irqfds. */
276 	s.port = 197;
277 	xen_hypercall(__HYPERVISOR_event_channel_op, EVTCHNOP_send, &s);
278 
279 	guest_wait_for_irq();
280 
281 	GUEST_SYNC(TEST_TIMER_SETUP);
282 
283 	/* Set a timer 100ms in the future. */
284 	xen_hypercall(__HYPERVISOR_set_timer_op,
285 		      rs->state_entry_time + 100000000, NULL);
286 
287 	GUEST_SYNC(TEST_TIMER_WAIT);
288 
289 	/* Now wait for the timer */
290 	guest_wait_for_irq();
291 
292 	GUEST_SYNC(TEST_TIMER_RESTORE);
293 
294 	/* The host has 'restored' the timer. Just wait for it. */
295 	guest_wait_for_irq();
296 
297 	GUEST_SYNC(TEST_POLL_READY);
298 
299 	/* Poll for an event channel port which is already set */
300 	u32 ports[1] = { EVTCHN_TIMER };
301 	struct sched_poll p = {
302 		.ports = ports,
303 		.nr_ports = 1,
304 		.timeout = 0,
305 	};
306 
307 	xen_hypercall(__HYPERVISOR_sched_op, SCHEDOP_poll, &p);
308 
309 	GUEST_SYNC(TEST_POLL_TIMEOUT);
310 
311 	/* Poll for an unset port and wait for the timeout. */
312 	p.timeout = 100000000;
313 	xen_hypercall(__HYPERVISOR_sched_op, SCHEDOP_poll, &p);
314 
315 	GUEST_SYNC(TEST_POLL_MASKED);
316 
317 	/* A timer will wake the masked port we're waiting on, while we poll */
318 	p.timeout = 0;
319 	xen_hypercall(__HYPERVISOR_sched_op, SCHEDOP_poll, &p);
320 
321 	GUEST_SYNC(TEST_POLL_WAKE);
322 
323 	/* Set the vcpu_info to point at exactly the place it already is to
324 	 * make sure the attribute is functional. */
325 	GUEST_SYNC(SET_VCPU_INFO);
326 
327 	/* A timer wake an *unmasked* port which should wake us with an
328 	 * actual interrupt, while we're polling on a different port. */
329 	ports[0]++;
330 	p.timeout = 0;
331 	xen_hypercall(__HYPERVISOR_sched_op, SCHEDOP_poll, &p);
332 
333 	guest_wait_for_irq();
334 
335 	GUEST_SYNC(TEST_TIMER_PAST);
336 
337 	/* Timer should have fired already */
338 	guest_wait_for_irq();
339 
340 	GUEST_SYNC(TEST_LOCKING_SEND_RACE);
341 	/* Racing host ioctls */
342 
343 	guest_wait_for_irq();
344 
345 	GUEST_SYNC(TEST_LOCKING_POLL_RACE);
346 	/* Racing vmcall against host ioctl */
347 
348 	ports[0] = 0;
349 
350 	p = (struct sched_poll) {
351 		.ports = ports,
352 		.nr_ports = 1,
353 		.timeout = 0
354 	};
355 
356 wait_for_timer:
357 	/*
358 	 * Poll for a timer wake event while the worker thread is mucking with
359 	 * the shared info.  KVM XEN drops timer IRQs if the shared info is
360 	 * invalid when the timer expires.  Arbitrarily poll 100 times before
361 	 * giving up and asking the VMM to re-arm the timer.  100 polls should
362 	 * consume enough time to beat on KVM without taking too long if the
363 	 * timer IRQ is dropped due to an invalid event channel.
364 	 */
365 	for (i = 0; i < 100 && !guest_saw_irq; i++)
366 		__xen_hypercall(__HYPERVISOR_sched_op, SCHEDOP_poll, &p);
367 
368 	/*
369 	 * Re-send the timer IRQ if it was (likely) dropped due to the timer
370 	 * expiring while the event channel was invalid.
371 	 */
372 	if (!guest_saw_irq) {
373 		GUEST_SYNC(TEST_LOCKING_POLL_TIMEOUT);
374 		goto wait_for_timer;
375 	}
376 	guest_saw_irq = false;
377 
378 	GUEST_SYNC(TEST_DONE);
379 }
380 
381 static struct shared_info *shinfo;
382 static struct vcpu_info *vinfo;
383 static struct kvm_vcpu *vcpu;
384 
handle_alrm(int sig)385 static void handle_alrm(int sig)
386 {
387 	if (vinfo)
388 		printf("evtchn_upcall_pending 0x%x\n", vinfo->evtchn_upcall_pending);
389 	vcpu_dump(stdout, vcpu, 0);
390 	TEST_FAIL("IRQ delivery timed out");
391 }
392 
juggle_shinfo_state(void * arg)393 static void *juggle_shinfo_state(void *arg)
394 {
395 	struct kvm_vm *vm = (struct kvm_vm *)arg;
396 
397 	struct kvm_xen_hvm_attr cache_activate_gfn = {
398 		.type = KVM_XEN_ATTR_TYPE_SHARED_INFO,
399 		.u.shared_info.gfn = SHINFO_REGION_GPA / PAGE_SIZE
400 	};
401 
402 	struct kvm_xen_hvm_attr cache_deactivate_gfn = {
403 		.type = KVM_XEN_ATTR_TYPE_SHARED_INFO,
404 		.u.shared_info.gfn = KVM_XEN_INVALID_GFN
405 	};
406 
407 	struct kvm_xen_hvm_attr cache_activate_hva = {
408 		.type = KVM_XEN_ATTR_TYPE_SHARED_INFO_HVA,
409 		.u.shared_info.hva = (unsigned long)shinfo
410 	};
411 
412 	struct kvm_xen_hvm_attr cache_deactivate_hva = {
413 		.type = KVM_XEN_ATTR_TYPE_SHARED_INFO,
414 		.u.shared_info.hva = 0
415 	};
416 
417 	int xen_caps = kvm_check_cap(KVM_CAP_XEN_HVM);
418 
419 	for (;;) {
420 		__vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &cache_activate_gfn);
421 		pthread_testcancel();
422 		__vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &cache_deactivate_gfn);
423 
424 		if (xen_caps & KVM_XEN_HVM_CONFIG_SHARED_INFO_HVA) {
425 			__vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &cache_activate_hva);
426 			pthread_testcancel();
427 			__vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &cache_deactivate_hva);
428 		}
429 	}
430 
431 	return NULL;
432 }
433 
main(int argc,char * argv[])434 int main(int argc, char *argv[])
435 {
436 	struct kvm_xen_hvm_attr evt_reset;
437 	struct kvm_vm *vm;
438 	pthread_t thread;
439 	bool verbose;
440 	int ret;
441 
442 	verbose = argc > 1 && (!strncmp(argv[1], "-v", 3) ||
443 			       !strncmp(argv[1], "--verbose", 10));
444 
445 	int xen_caps = kvm_check_cap(KVM_CAP_XEN_HVM);
446 	TEST_REQUIRE(xen_caps & KVM_XEN_HVM_CONFIG_SHARED_INFO);
447 
448 	bool do_runstate_tests = !!(xen_caps & KVM_XEN_HVM_CONFIG_RUNSTATE);
449 	bool do_runstate_flag = !!(xen_caps & KVM_XEN_HVM_CONFIG_RUNSTATE_UPDATE_FLAG);
450 	bool do_eventfd_tests = !!(xen_caps & KVM_XEN_HVM_CONFIG_EVTCHN_2LEVEL);
451 	bool do_evtchn_tests = do_eventfd_tests && !!(xen_caps & KVM_XEN_HVM_CONFIG_EVTCHN_SEND);
452 	bool has_shinfo_hva = !!(xen_caps & KVM_XEN_HVM_CONFIG_SHARED_INFO_HVA);
453 
454 	vm = vm_create_with_one_vcpu(&vcpu, guest_code);
455 
456 	/* Map a region for the shared_info page */
457 	vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS,
458 				    SHINFO_REGION_GPA, SHINFO_REGION_SLOT, 3, 0);
459 	virt_map(vm, SHINFO_REGION_GVA, SHINFO_REGION_GPA, 3);
460 
461 	shinfo = addr_gpa2hva(vm, SHINFO_VADDR);
462 
463 	int zero_fd = open("/dev/zero", O_RDONLY);
464 	TEST_ASSERT(zero_fd != -1, "Failed to open /dev/zero");
465 
466 	struct kvm_xen_hvm_config hvmc = {
467 		.flags = KVM_XEN_HVM_CONFIG_INTERCEPT_HCALL,
468 		.msr = XEN_HYPERCALL_MSR,
469 	};
470 
471 	/* Let the kernel know that we *will* use it for sending all
472 	 * event channels, which lets it intercept SCHEDOP_poll */
473 	if (do_evtchn_tests)
474 		hvmc.flags |= KVM_XEN_HVM_CONFIG_EVTCHN_SEND;
475 
476 	vm_ioctl(vm, KVM_XEN_HVM_CONFIG, &hvmc);
477 
478 	struct kvm_xen_hvm_attr lm = {
479 		.type = KVM_XEN_ATTR_TYPE_LONG_MODE,
480 		.u.long_mode = 1,
481 	};
482 	vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &lm);
483 
484 	if (do_runstate_flag) {
485 		struct kvm_xen_hvm_attr ruf = {
486 			.type = KVM_XEN_ATTR_TYPE_RUNSTATE_UPDATE_FLAG,
487 			.u.runstate_update_flag = 1,
488 		};
489 		vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &ruf);
490 
491 		ruf.u.runstate_update_flag = 0;
492 		vm_ioctl(vm, KVM_XEN_HVM_GET_ATTR, &ruf);
493 		TEST_ASSERT(ruf.u.runstate_update_flag == 1,
494 			    "Failed to read back RUNSTATE_UPDATE_FLAG attr");
495 	}
496 
497 	struct kvm_xen_hvm_attr ha = {};
498 
499 	if (has_shinfo_hva) {
500 		ha.type = KVM_XEN_ATTR_TYPE_SHARED_INFO_HVA;
501 		ha.u.shared_info.hva = (unsigned long)shinfo;
502 	} else {
503 		ha.type = KVM_XEN_ATTR_TYPE_SHARED_INFO;
504 		ha.u.shared_info.gfn = SHINFO_ADDR / PAGE_SIZE;
505 	}
506 
507 	vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &ha);
508 
509 	/*
510 	 * Test what happens when the HVA of the shinfo page is remapped after
511 	 * the kernel has a reference to it. But make sure we copy the clock
512 	 * info over since that's only set at setup time, and we test it later.
513 	 */
514 	struct pvclock_wall_clock wc_copy = shinfo->wc;
515 	void *m = mmap(shinfo, PAGE_SIZE, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_PRIVATE, zero_fd, 0);
516 	TEST_ASSERT(m == shinfo, "Failed to map /dev/zero over shared info");
517 	shinfo->wc = wc_copy;
518 
519 	struct kvm_xen_vcpu_attr vi = {
520 		.type = KVM_XEN_VCPU_ATTR_TYPE_VCPU_INFO,
521 		.u.gpa = VCPU_INFO_ADDR,
522 	};
523 	vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &vi);
524 
525 	struct kvm_xen_vcpu_attr pvclock = {
526 		.type = KVM_XEN_VCPU_ATTR_TYPE_VCPU_TIME_INFO,
527 		.u.gpa = PVTIME_ADDR,
528 	};
529 	vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &pvclock);
530 
531 	struct kvm_xen_hvm_attr vec = {
532 		.type = KVM_XEN_ATTR_TYPE_UPCALL_VECTOR,
533 		.u.vector = EVTCHN_VECTOR,
534 	};
535 	vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &vec);
536 
537 	vm_install_exception_handler(vm, EVTCHN_VECTOR, evtchn_handler);
538 
539 	if (do_runstate_tests) {
540 		struct kvm_xen_vcpu_attr st = {
541 			.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADDR,
542 			.u.gpa = RUNSTATE_ADDR,
543 		};
544 		vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &st);
545 	}
546 
547 	int irq_fd[2] = { -1, -1 };
548 
549 	if (do_eventfd_tests) {
550 		irq_fd[0] = eventfd(0, 0);
551 		irq_fd[1] = eventfd(0, 0);
552 
553 		/* Unexpected, but not a KVM failure */
554 		if (irq_fd[0] == -1 || irq_fd[1] == -1)
555 			do_evtchn_tests = do_eventfd_tests = false;
556 	}
557 
558 	if (do_eventfd_tests) {
559 		irq_routes.info.nr = 2;
560 
561 		irq_routes.entries[0].gsi = 32;
562 		irq_routes.entries[0].type = KVM_IRQ_ROUTING_XEN_EVTCHN;
563 		irq_routes.entries[0].u.xen_evtchn.port = EVTCHN_TEST1;
564 		irq_routes.entries[0].u.xen_evtchn.vcpu = vcpu->id;
565 		irq_routes.entries[0].u.xen_evtchn.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
566 
567 		irq_routes.entries[1].gsi = 33;
568 		irq_routes.entries[1].type = KVM_IRQ_ROUTING_XEN_EVTCHN;
569 		irq_routes.entries[1].u.xen_evtchn.port = EVTCHN_TEST2;
570 		irq_routes.entries[1].u.xen_evtchn.vcpu = vcpu->id;
571 		irq_routes.entries[1].u.xen_evtchn.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
572 
573 		vm_ioctl(vm, KVM_SET_GSI_ROUTING, &irq_routes.info);
574 
575 		struct kvm_irqfd ifd = { };
576 
577 		ifd.fd = irq_fd[0];
578 		ifd.gsi = 32;
579 		vm_ioctl(vm, KVM_IRQFD, &ifd);
580 
581 		ifd.fd = irq_fd[1];
582 		ifd.gsi = 33;
583 		vm_ioctl(vm, KVM_IRQFD, &ifd);
584 
585 		struct sigaction sa = { };
586 		sa.sa_handler = handle_alrm;
587 		sigaction(SIGALRM, &sa, NULL);
588 	}
589 
590 	struct kvm_xen_vcpu_attr tmr = {
591 		.type = KVM_XEN_VCPU_ATTR_TYPE_TIMER,
592 		.u.timer.port = EVTCHN_TIMER,
593 		.u.timer.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL,
594 		.u.timer.expires_ns = 0
595 	};
596 
597 	if (do_evtchn_tests) {
598 		struct kvm_xen_hvm_attr inj = {
599 			.type = KVM_XEN_ATTR_TYPE_EVTCHN,
600 			.u.evtchn.send_port = 127,
601 			.u.evtchn.type = EVTCHNSTAT_interdomain,
602 			.u.evtchn.flags = 0,
603 			.u.evtchn.deliver.port.port = EVTCHN_TEST1,
604 			.u.evtchn.deliver.port.vcpu = vcpu->id + 1,
605 			.u.evtchn.deliver.port.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL,
606 		};
607 		vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &inj);
608 
609 		/* Test migration to a different vCPU */
610 		inj.u.evtchn.flags = KVM_XEN_EVTCHN_UPDATE;
611 		inj.u.evtchn.deliver.port.vcpu = vcpu->id;
612 		vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &inj);
613 
614 		inj.u.evtchn.send_port = 197;
615 		inj.u.evtchn.deliver.eventfd.port = 0;
616 		inj.u.evtchn.deliver.eventfd.fd = irq_fd[1];
617 		inj.u.evtchn.flags = 0;
618 		vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &inj);
619 
620 		vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
621 	}
622 	vinfo = addr_gpa2hva(vm, VCPU_INFO_VADDR);
623 	vinfo->evtchn_upcall_pending = 0;
624 
625 	struct vcpu_runstate_info *rs = addr_gpa2hva(vm, RUNSTATE_ADDR);
626 	rs->state = 0x5a;
627 
628 	bool evtchn_irq_expected = false;
629 
630 	for (;;) {
631 		struct ucall uc;
632 
633 		vcpu_run(vcpu);
634 		TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_IO);
635 
636 		switch (get_ucall(vcpu, &uc)) {
637 		case UCALL_ABORT:
638 			REPORT_GUEST_ASSERT(uc);
639 			/* NOT REACHED */
640 		case UCALL_SYNC: {
641 			struct kvm_xen_vcpu_attr rst;
642 			long rundelay;
643 
644 			if (do_runstate_tests)
645 				TEST_ASSERT(rs->state_entry_time == rs->time[0] +
646 					    rs->time[1] + rs->time[2] + rs->time[3],
647 					    "runstate times don't add up");
648 
649 			switch (uc.args[1]) {
650 			case TEST_INJECT_VECTOR:
651 				if (verbose)
652 					printf("Delivering evtchn upcall\n");
653 				evtchn_irq_expected = true;
654 				vinfo->evtchn_upcall_pending = 1;
655 				break;
656 
657 			case TEST_RUNSTATE_runnable...TEST_RUNSTATE_offline:
658 				TEST_ASSERT(!evtchn_irq_expected, "Event channel IRQ not seen");
659 				if (!do_runstate_tests)
660 					goto done;
661 				if (verbose)
662 					printf("Testing runstate %s\n", runstate_names[uc.args[1]]);
663 				rst.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_CURRENT;
664 				rst.u.runstate.state = uc.args[1] + RUNSTATE_runnable -
665 					TEST_RUNSTATE_runnable;
666 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &rst);
667 				break;
668 
669 			case TEST_RUNSTATE_ADJUST:
670 				if (verbose)
671 					printf("Testing RUNSTATE_ADJUST\n");
672 				rst.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADJUST;
673 				memset(&rst.u, 0, sizeof(rst.u));
674 				rst.u.runstate.state = (uint64_t)-1;
675 				rst.u.runstate.time_blocked =
676 					0x5a - rs->time[RUNSTATE_blocked];
677 				rst.u.runstate.time_offline =
678 					0x6b6b - rs->time[RUNSTATE_offline];
679 				rst.u.runstate.time_runnable = -rst.u.runstate.time_blocked -
680 					rst.u.runstate.time_offline;
681 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &rst);
682 				break;
683 
684 			case TEST_RUNSTATE_DATA:
685 				if (verbose)
686 					printf("Testing RUNSTATE_DATA\n");
687 				rst.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_DATA;
688 				memset(&rst.u, 0, sizeof(rst.u));
689 				rst.u.runstate.state = RUNSTATE_running;
690 				rst.u.runstate.state_entry_time = 0x6b6b + 0x5a;
691 				rst.u.runstate.time_blocked = 0x6b6b;
692 				rst.u.runstate.time_offline = 0x5a;
693 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &rst);
694 				break;
695 
696 			case TEST_STEAL_TIME:
697 				if (verbose)
698 					printf("Testing steal time\n");
699 				/* Yield until scheduler delay exceeds target */
700 				rundelay = get_run_delay() + MIN_STEAL_TIME;
701 				do {
702 					sched_yield();
703 				} while (get_run_delay() < rundelay);
704 				break;
705 
706 			case TEST_EVTCHN_MASKED:
707 				if (!do_eventfd_tests)
708 					goto done;
709 				if (verbose)
710 					printf("Testing masked event channel\n");
711 				shinfo->evtchn_mask[0] = 1UL << EVTCHN_TEST1;
712 				eventfd_write(irq_fd[0], 1UL);
713 				alarm(1);
714 				break;
715 
716 			case TEST_EVTCHN_UNMASKED:
717 				if (verbose)
718 					printf("Testing unmasked event channel\n");
719 				/* Unmask that, but deliver the other one */
720 				shinfo->evtchn_pending[0] = 0;
721 				shinfo->evtchn_mask[0] = 0;
722 				eventfd_write(irq_fd[1], 1UL);
723 				evtchn_irq_expected = true;
724 				alarm(1);
725 				break;
726 
727 			case TEST_EVTCHN_SLOWPATH:
728 				TEST_ASSERT(!evtchn_irq_expected,
729 					    "Expected event channel IRQ but it didn't happen");
730 				shinfo->evtchn_pending[1] = 0;
731 				if (verbose)
732 					printf("Testing event channel after memslot change\n");
733 				vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS,
734 							    DUMMY_REGION_GPA, DUMMY_REGION_SLOT, 1, 0);
735 				eventfd_write(irq_fd[0], 1UL);
736 				evtchn_irq_expected = true;
737 				alarm(1);
738 				break;
739 
740 			case TEST_EVTCHN_SEND_IOCTL:
741 				TEST_ASSERT(!evtchn_irq_expected,
742 					    "Expected event channel IRQ but it didn't happen");
743 				if (!do_evtchn_tests)
744 					goto done;
745 
746 				shinfo->evtchn_pending[0] = 0;
747 				if (verbose)
748 					printf("Testing injection with KVM_XEN_HVM_EVTCHN_SEND\n");
749 
750 				struct kvm_irq_routing_xen_evtchn e;
751 				e.port = EVTCHN_TEST2;
752 				e.vcpu = vcpu->id;
753 				e.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
754 
755 				vm_ioctl(vm, KVM_XEN_HVM_EVTCHN_SEND, &e);
756 				evtchn_irq_expected = true;
757 				alarm(1);
758 				break;
759 
760 			case TEST_EVTCHN_HCALL:
761 				TEST_ASSERT(!evtchn_irq_expected,
762 					    "Expected event channel IRQ but it didn't happen");
763 				shinfo->evtchn_pending[1] = 0;
764 
765 				if (verbose)
766 					printf("Testing guest EVTCHNOP_send direct to evtchn\n");
767 				evtchn_irq_expected = true;
768 				alarm(1);
769 				break;
770 
771 			case TEST_EVTCHN_HCALL_SLOWPATH:
772 				TEST_ASSERT(!evtchn_irq_expected,
773 					    "Expected event channel IRQ but it didn't happen");
774 				shinfo->evtchn_pending[0] = 0;
775 
776 				if (verbose)
777 					printf("Testing guest EVTCHNOP_send direct to evtchn after memslot change\n");
778 				vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS,
779 							    DUMMY_REGION_GPA_2, DUMMY_REGION_SLOT_2, 1, 0);
780 				evtchn_irq_expected = true;
781 				alarm(1);
782 				break;
783 
784 			case TEST_EVTCHN_HCALL_EVENTFD:
785 				TEST_ASSERT(!evtchn_irq_expected,
786 					    "Expected event channel IRQ but it didn't happen");
787 				shinfo->evtchn_pending[0] = 0;
788 
789 				if (verbose)
790 					printf("Testing guest EVTCHNOP_send to eventfd\n");
791 				evtchn_irq_expected = true;
792 				alarm(1);
793 				break;
794 
795 			case TEST_TIMER_SETUP:
796 				TEST_ASSERT(!evtchn_irq_expected,
797 					    "Expected event channel IRQ but it didn't happen");
798 				shinfo->evtchn_pending[1] = 0;
799 
800 				if (verbose)
801 					printf("Testing guest oneshot timer\n");
802 				break;
803 
804 			case TEST_TIMER_WAIT:
805 				memset(&tmr, 0, sizeof(tmr));
806 				tmr.type = KVM_XEN_VCPU_ATTR_TYPE_TIMER;
807 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr);
808 				TEST_ASSERT(tmr.u.timer.port == EVTCHN_TIMER,
809 					    "Timer port not returned");
810 				TEST_ASSERT(tmr.u.timer.priority == KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL,
811 					    "Timer priority not returned");
812 				TEST_ASSERT(tmr.u.timer.expires_ns > rs->state_entry_time,
813 					    "Timer expiry not returned");
814 				evtchn_irq_expected = true;
815 				alarm(1);
816 				break;
817 
818 			case TEST_TIMER_RESTORE:
819 				TEST_ASSERT(!evtchn_irq_expected,
820 					    "Expected event channel IRQ but it didn't happen");
821 				shinfo->evtchn_pending[0] = 0;
822 
823 				if (verbose)
824 					printf("Testing restored oneshot timer\n");
825 
826 				tmr.u.timer.expires_ns = rs->state_entry_time + 100000000;
827 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
828 				evtchn_irq_expected = true;
829 				alarm(1);
830 				break;
831 
832 			case TEST_POLL_READY:
833 				TEST_ASSERT(!evtchn_irq_expected,
834 					    "Expected event channel IRQ but it didn't happen");
835 
836 				if (verbose)
837 					printf("Testing SCHEDOP_poll with already pending event\n");
838 				shinfo->evtchn_pending[0] = shinfo->evtchn_mask[0] = 1UL << EVTCHN_TIMER;
839 				alarm(1);
840 				break;
841 
842 			case TEST_POLL_TIMEOUT:
843 				if (verbose)
844 					printf("Testing SCHEDOP_poll timeout\n");
845 				shinfo->evtchn_pending[0] = 0;
846 				alarm(1);
847 				break;
848 
849 			case TEST_POLL_MASKED:
850 				if (verbose)
851 					printf("Testing SCHEDOP_poll wake on masked event\n");
852 
853 				tmr.u.timer.expires_ns = rs->state_entry_time + 100000000;
854 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
855 				alarm(1);
856 				break;
857 
858 			case TEST_POLL_WAKE:
859 				shinfo->evtchn_pending[0] = shinfo->evtchn_mask[0] = 0;
860 				if (verbose)
861 					printf("Testing SCHEDOP_poll wake on unmasked event\n");
862 
863 				evtchn_irq_expected = true;
864 				tmr.u.timer.expires_ns = rs->state_entry_time + 100000000;
865 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
866 
867 				/* Read it back and check the pending time is reported correctly */
868 				tmr.u.timer.expires_ns = 0;
869 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr);
870 				TEST_ASSERT(tmr.u.timer.expires_ns == rs->state_entry_time + 100000000,
871 					    "Timer not reported pending");
872 				alarm(1);
873 				break;
874 
875 			case SET_VCPU_INFO:
876 				if (has_shinfo_hva) {
877 					struct kvm_xen_vcpu_attr vih = {
878 						.type = KVM_XEN_VCPU_ATTR_TYPE_VCPU_INFO_HVA,
879 						.u.hva = (unsigned long)vinfo
880 					};
881 					vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &vih);
882 				}
883 				break;
884 
885 			case TEST_TIMER_PAST:
886 				TEST_ASSERT(!evtchn_irq_expected,
887 					    "Expected event channel IRQ but it didn't happen");
888 				/* Read timer and check it is no longer pending */
889 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr);
890 				TEST_ASSERT(!tmr.u.timer.expires_ns, "Timer still reported pending");
891 
892 				shinfo->evtchn_pending[0] = 0;
893 				if (verbose)
894 					printf("Testing timer in the past\n");
895 
896 				evtchn_irq_expected = true;
897 				tmr.u.timer.expires_ns = rs->state_entry_time - 100000000ULL;
898 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
899 				alarm(1);
900 				break;
901 
902 			case TEST_LOCKING_SEND_RACE:
903 				TEST_ASSERT(!evtchn_irq_expected,
904 					    "Expected event channel IRQ but it didn't happen");
905 				alarm(0);
906 
907 				if (verbose)
908 					printf("Testing shinfo lock corruption (KVM_XEN_HVM_EVTCHN_SEND)\n");
909 
910 				ret = pthread_create(&thread, NULL, &juggle_shinfo_state, (void *)vm);
911 				TEST_ASSERT(ret == 0, "pthread_create() failed: %s", strerror(ret));
912 
913 				struct kvm_irq_routing_xen_evtchn uxe = {
914 					.port = 1,
915 					.vcpu = vcpu->id,
916 					.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL
917 				};
918 
919 				evtchn_irq_expected = true;
920 				for (time_t t = time(NULL) + SHINFO_RACE_TIMEOUT; time(NULL) < t;)
921 					__vm_ioctl(vm, KVM_XEN_HVM_EVTCHN_SEND, &uxe);
922 				break;
923 
924 			case TEST_LOCKING_POLL_RACE:
925 				TEST_ASSERT(!evtchn_irq_expected,
926 					    "Expected event channel IRQ but it didn't happen");
927 
928 				if (verbose)
929 					printf("Testing shinfo lock corruption (SCHEDOP_poll)\n");
930 
931 				shinfo->evtchn_pending[0] = 1;
932 
933 				evtchn_irq_expected = true;
934 				tmr.u.timer.expires_ns = rs->state_entry_time +
935 							 SHINFO_RACE_TIMEOUT * 1000000000ULL;
936 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
937 				break;
938 
939 			case TEST_LOCKING_POLL_TIMEOUT:
940 				/*
941 				 * Optional and possibly repeated sync point.
942 				 * Injecting the timer IRQ may fail if the
943 				 * shinfo is invalid when the timer expires.
944 				 * If the timer has expired but the IRQ hasn't
945 				 * been delivered, rearm the timer and retry.
946 				 */
947 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr);
948 
949 				/* Resume the guest if the timer is still pending. */
950 				if (tmr.u.timer.expires_ns)
951 					break;
952 
953 				/* All done if the IRQ was delivered. */
954 				if (!evtchn_irq_expected)
955 					break;
956 
957 				tmr.u.timer.expires_ns = rs->state_entry_time +
958 							 SHINFO_RACE_TIMEOUT * 1000000000ULL;
959 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
960 				break;
961 			case TEST_DONE:
962 				TEST_ASSERT(!evtchn_irq_expected,
963 					    "Expected event channel IRQ but it didn't happen");
964 
965 				ret = pthread_cancel(thread);
966 				TEST_ASSERT(ret == 0, "pthread_cancel() failed: %s", strerror(ret));
967 
968 				ret = pthread_join(thread, 0);
969 				TEST_ASSERT(ret == 0, "pthread_join() failed: %s", strerror(ret));
970 				goto done;
971 
972 			case TEST_GUEST_SAW_IRQ:
973 				TEST_ASSERT(evtchn_irq_expected, "Unexpected event channel IRQ");
974 				evtchn_irq_expected = false;
975 				break;
976 			}
977 			break;
978 		}
979 		case UCALL_DONE:
980 			goto done;
981 		default:
982 			TEST_FAIL("Unknown ucall 0x%lx.", uc.cmd);
983 		}
984 	}
985 
986  done:
987 	evt_reset.type = KVM_XEN_ATTR_TYPE_EVTCHN;
988 	evt_reset.u.evtchn.flags = KVM_XEN_EVTCHN_RESET;
989 	vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &evt_reset);
990 
991 	alarm(0);
992 
993 	/*
994 	 * Just a *really* basic check that things are being put in the
995 	 * right place. The actual calculations are much the same for
996 	 * Xen as they are for the KVM variants, so no need to check.
997 	 */
998 	struct pvclock_wall_clock *wc;
999 	struct pvclock_vcpu_time_info *ti, *ti2;
1000 	struct kvm_clock_data kcdata;
1001 	long long delta;
1002 
1003 	wc = addr_gpa2hva(vm, SHINFO_REGION_GPA + 0xc00);
1004 	ti = addr_gpa2hva(vm, SHINFO_REGION_GPA + 0x40 + 0x20);
1005 	ti2 = addr_gpa2hva(vm, PVTIME_ADDR);
1006 
1007 	if (verbose) {
1008 		printf("Wall clock (v %d) %d.%09d\n", wc->version, wc->sec, wc->nsec);
1009 		printf("Time info 1: v %u tsc %" PRIu64 " time %" PRIu64 " mul %u shift %u flags %x\n",
1010 		       ti->version, ti->tsc_timestamp, ti->system_time, ti->tsc_to_system_mul,
1011 		       ti->tsc_shift, ti->flags);
1012 		printf("Time info 2: v %u tsc %" PRIu64 " time %" PRIu64 " mul %u shift %u flags %x\n",
1013 		       ti2->version, ti2->tsc_timestamp, ti2->system_time, ti2->tsc_to_system_mul,
1014 		       ti2->tsc_shift, ti2->flags);
1015 	}
1016 
1017 	TEST_ASSERT(wc->version && !(wc->version & 1),
1018 		    "Bad wallclock version %x", wc->version);
1019 
1020 	vm_ioctl(vm, KVM_GET_CLOCK, &kcdata);
1021 
1022 	if (kcdata.flags & KVM_CLOCK_REALTIME) {
1023 		if (verbose) {
1024 			printf("KVM_GET_CLOCK clock: %lld.%09lld\n",
1025 			       kcdata.clock / NSEC_PER_SEC, kcdata.clock % NSEC_PER_SEC);
1026 			printf("KVM_GET_CLOCK realtime: %lld.%09lld\n",
1027 			       kcdata.realtime / NSEC_PER_SEC, kcdata.realtime % NSEC_PER_SEC);
1028 		}
1029 
1030 		delta = (wc->sec * NSEC_PER_SEC + wc->nsec) - (kcdata.realtime - kcdata.clock);
1031 
1032 		/*
1033 		 * KVM_GET_CLOCK gives CLOCK_REALTIME which jumps on leap seconds updates but
1034 		 * unfortunately KVM doesn't currently offer a CLOCK_TAI alternative. Accept 1s
1035 		 * delta as testing clock accuracy is not the goal here. The test just needs to
1036 		 * check that the value in shinfo is somewhat sane.
1037 		 */
1038 		TEST_ASSERT(llabs(delta) < NSEC_PER_SEC,
1039 			    "Guest's epoch from shinfo %d.%09d differs from KVM_GET_CLOCK %lld.%lld",
1040 			    wc->sec, wc->nsec, (kcdata.realtime - kcdata.clock) / NSEC_PER_SEC,
1041 			    (kcdata.realtime - kcdata.clock) % NSEC_PER_SEC);
1042 	} else {
1043 		pr_info("Missing KVM_CLOCK_REALTIME, skipping shinfo epoch sanity check\n");
1044 	}
1045 
1046 	TEST_ASSERT(ti->version && !(ti->version & 1),
1047 		    "Bad time_info version %x", ti->version);
1048 	TEST_ASSERT(ti2->version && !(ti2->version & 1),
1049 		    "Bad time_info version %x", ti->version);
1050 
1051 	if (do_runstate_tests) {
1052 		/*
1053 		 * Fetch runstate and check sanity. Strictly speaking in the
1054 		 * general case we might not expect the numbers to be identical
1055 		 * but in this case we know we aren't running the vCPU any more.
1056 		 */
1057 		struct kvm_xen_vcpu_attr rst = {
1058 			.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_DATA,
1059 		};
1060 		vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &rst);
1061 
1062 		if (verbose) {
1063 			printf("Runstate: %s(%d), entry %" PRIu64 " ns\n",
1064 			       rs->state <= RUNSTATE_offline ? runstate_names[rs->state] : "unknown",
1065 			       rs->state, rs->state_entry_time);
1066 			for (int i = RUNSTATE_running; i <= RUNSTATE_offline; i++) {
1067 				printf("State %s: %" PRIu64 " ns\n",
1068 				       runstate_names[i], rs->time[i]);
1069 			}
1070 		}
1071 
1072 		/*
1073 		 * Exercise runstate info at all points across the page boundary, in
1074 		 * 32-bit and 64-bit mode. In particular, test the case where it is
1075 		 * configured in 32-bit mode and then switched to 64-bit mode while
1076 		 * active, which takes it onto the second page.
1077 		 */
1078 		unsigned long runstate_addr;
1079 		struct compat_vcpu_runstate_info *crs;
1080 		for (runstate_addr = SHINFO_REGION_GPA + PAGE_SIZE + PAGE_SIZE - sizeof(*rs) - 4;
1081 		     runstate_addr < SHINFO_REGION_GPA + PAGE_SIZE + PAGE_SIZE + 4; runstate_addr++) {
1082 
1083 			rs = addr_gpa2hva(vm, runstate_addr);
1084 			crs = (void *)rs;
1085 
1086 			memset(rs, 0xa5, sizeof(*rs));
1087 
1088 			/* Set to compatibility mode */
1089 			lm.u.long_mode = 0;
1090 			vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &lm);
1091 
1092 			/* Set runstate to new address (kernel will write it) */
1093 			struct kvm_xen_vcpu_attr st = {
1094 				.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADDR,
1095 				.u.gpa = runstate_addr,
1096 			};
1097 			vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &st);
1098 
1099 			if (verbose)
1100 				printf("Compatibility runstate at %08lx\n", runstate_addr);
1101 
1102 			TEST_ASSERT(crs->state == rst.u.runstate.state, "Runstate mismatch");
1103 			TEST_ASSERT(crs->state_entry_time == rst.u.runstate.state_entry_time,
1104 				    "State entry time mismatch");
1105 			TEST_ASSERT(crs->time[RUNSTATE_running] == rst.u.runstate.time_running,
1106 				    "Running time mismatch");
1107 			TEST_ASSERT(crs->time[RUNSTATE_runnable] == rst.u.runstate.time_runnable,
1108 				    "Runnable time mismatch");
1109 			TEST_ASSERT(crs->time[RUNSTATE_blocked] == rst.u.runstate.time_blocked,
1110 				    "Blocked time mismatch");
1111 			TEST_ASSERT(crs->time[RUNSTATE_offline] == rst.u.runstate.time_offline,
1112 				    "Offline time mismatch");
1113 			TEST_ASSERT(crs->time[RUNSTATE_offline + 1] == 0xa5a5a5a5a5a5a5a5ULL,
1114 				    "Structure overrun");
1115 			TEST_ASSERT(crs->state_entry_time == crs->time[0] +
1116 				    crs->time[1] + crs->time[2] + crs->time[3],
1117 				    "runstate times don't add up");
1118 
1119 
1120 			/* Now switch to 64-bit mode */
1121 			lm.u.long_mode = 1;
1122 			vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &lm);
1123 
1124 			memset(rs, 0xa5, sizeof(*rs));
1125 
1126 			/* Don't change the address, just trigger a write */
1127 			struct kvm_xen_vcpu_attr adj = {
1128 				.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADJUST,
1129 				.u.runstate.state = (uint64_t)-1
1130 			};
1131 			vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &adj);
1132 
1133 			if (verbose)
1134 				printf("64-bit runstate at %08lx\n", runstate_addr);
1135 
1136 			TEST_ASSERT(rs->state == rst.u.runstate.state, "Runstate mismatch");
1137 			TEST_ASSERT(rs->state_entry_time == rst.u.runstate.state_entry_time,
1138 				    "State entry time mismatch");
1139 			TEST_ASSERT(rs->time[RUNSTATE_running] == rst.u.runstate.time_running,
1140 				    "Running time mismatch");
1141 			TEST_ASSERT(rs->time[RUNSTATE_runnable] == rst.u.runstate.time_runnable,
1142 				    "Runnable time mismatch");
1143 			TEST_ASSERT(rs->time[RUNSTATE_blocked] == rst.u.runstate.time_blocked,
1144 				    "Blocked time mismatch");
1145 			TEST_ASSERT(rs->time[RUNSTATE_offline] == rst.u.runstate.time_offline,
1146 				    "Offline time mismatch");
1147 			TEST_ASSERT(rs->time[RUNSTATE_offline + 1] == 0xa5a5a5a5a5a5a5a5ULL,
1148 				    "Structure overrun");
1149 
1150 			TEST_ASSERT(rs->state_entry_time == rs->time[0] +
1151 				    rs->time[1] + rs->time[2] + rs->time[3],
1152 				    "runstate times don't add up");
1153 		}
1154 	}
1155 
1156 	kvm_vm_free(vm);
1157 	return 0;
1158 }
1159