xref: /kvm-unit-tests/x86/svm_tests.c (revision 5200c1f13247b8884339dac7aadd2fc82d8b834b)
1ad879127SKrish Sadhukhan #include "svm.h"
2ad879127SKrish Sadhukhan #include "libcflat.h"
3ad879127SKrish Sadhukhan #include "processor.h"
4ad879127SKrish Sadhukhan #include "desc.h"
5ad879127SKrish Sadhukhan #include "msr.h"
6ad879127SKrish Sadhukhan #include "vm.h"
7ad879127SKrish Sadhukhan #include "smp.h"
8ad879127SKrish Sadhukhan #include "types.h"
9ad879127SKrish Sadhukhan #include "alloc_page.h"
10ad879127SKrish Sadhukhan #include "isr.h"
11ad879127SKrish Sadhukhan #include "apic.h"
129da1f4d8SCathy Avery #include "delay.h"
138177dc62SManali Shukla #include "x86/usermode.h"
14ad879127SKrish Sadhukhan 
15ad879127SKrish Sadhukhan #define SVM_EXIT_MAX_DR_INTERCEPT 0x3f
16ad879127SKrish Sadhukhan 
17ad879127SKrish Sadhukhan #define LATENCY_RUNS 1000000
18ad879127SKrish Sadhukhan 
19ad879127SKrish Sadhukhan u64 tsc_start;
20ad879127SKrish Sadhukhan u64 tsc_end;
21ad879127SKrish Sadhukhan 
22ad879127SKrish Sadhukhan u64 vmrun_sum, vmexit_sum;
23ad879127SKrish Sadhukhan u64 vmsave_sum, vmload_sum;
24ad879127SKrish Sadhukhan u64 stgi_sum, clgi_sum;
25ad879127SKrish Sadhukhan u64 latvmrun_max;
26ad879127SKrish Sadhukhan u64 latvmrun_min;
27ad879127SKrish Sadhukhan u64 latvmexit_max;
28ad879127SKrish Sadhukhan u64 latvmexit_min;
29ad879127SKrish Sadhukhan u64 latvmload_max;
30ad879127SKrish Sadhukhan u64 latvmload_min;
31ad879127SKrish Sadhukhan u64 latvmsave_max;
32ad879127SKrish Sadhukhan u64 latvmsave_min;
33ad879127SKrish Sadhukhan u64 latstgi_max;
34ad879127SKrish Sadhukhan u64 latstgi_min;
35ad879127SKrish Sadhukhan u64 latclgi_max;
36ad879127SKrish Sadhukhan u64 latclgi_min;
37ad879127SKrish Sadhukhan u64 runs;
38ad879127SKrish Sadhukhan 
39ad879127SKrish Sadhukhan static void null_test(struct svm_test *test)
40ad879127SKrish Sadhukhan {
41ad879127SKrish Sadhukhan }
42ad879127SKrish Sadhukhan 
43ad879127SKrish Sadhukhan static bool null_check(struct svm_test *test)
44ad879127SKrish Sadhukhan {
45096cf7feSPaolo Bonzini 	return vmcb->control.exit_code == SVM_EXIT_VMMCALL;
46ad879127SKrish Sadhukhan }
47ad879127SKrish Sadhukhan 
48ad879127SKrish Sadhukhan static void prepare_no_vmrun_int(struct svm_test *test)
49ad879127SKrish Sadhukhan {
50096cf7feSPaolo Bonzini 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMRUN);
51ad879127SKrish Sadhukhan }
52ad879127SKrish Sadhukhan 
53ad879127SKrish Sadhukhan static bool check_no_vmrun_int(struct svm_test *test)
54ad879127SKrish Sadhukhan {
55096cf7feSPaolo Bonzini 	return vmcb->control.exit_code == SVM_EXIT_ERR;
56ad879127SKrish Sadhukhan }
57ad879127SKrish Sadhukhan 
58ad879127SKrish Sadhukhan static void test_vmrun(struct svm_test *test)
59ad879127SKrish Sadhukhan {
60096cf7feSPaolo Bonzini 	asm volatile ("vmrun %0" : : "a"(virt_to_phys(vmcb)));
61ad879127SKrish Sadhukhan }
62ad879127SKrish Sadhukhan 
63ad879127SKrish Sadhukhan static bool check_vmrun(struct svm_test *test)
64ad879127SKrish Sadhukhan {
65096cf7feSPaolo Bonzini 	return vmcb->control.exit_code == SVM_EXIT_VMRUN;
66ad879127SKrish Sadhukhan }
67ad879127SKrish Sadhukhan 
68401299a5SPaolo Bonzini static void prepare_rsm_intercept(struct svm_test *test)
69401299a5SPaolo Bonzini {
70401299a5SPaolo Bonzini 	default_prepare(test);
71401299a5SPaolo Bonzini 	vmcb->control.intercept |= 1 << INTERCEPT_RSM;
72401299a5SPaolo Bonzini 	vmcb->control.intercept_exceptions |= (1ULL << UD_VECTOR);
73401299a5SPaolo Bonzini }
74401299a5SPaolo Bonzini 
75401299a5SPaolo Bonzini static void test_rsm_intercept(struct svm_test *test)
76401299a5SPaolo Bonzini {
77401299a5SPaolo Bonzini 	asm volatile ("rsm" : : : "memory");
78401299a5SPaolo Bonzini }
79401299a5SPaolo Bonzini 
80401299a5SPaolo Bonzini static bool check_rsm_intercept(struct svm_test *test)
81401299a5SPaolo Bonzini {
82401299a5SPaolo Bonzini 	return get_test_stage(test) == 2;
83401299a5SPaolo Bonzini }
84401299a5SPaolo Bonzini 
85401299a5SPaolo Bonzini static bool finished_rsm_intercept(struct svm_test *test)
86401299a5SPaolo Bonzini {
87401299a5SPaolo Bonzini 	switch (get_test_stage(test)) {
88401299a5SPaolo Bonzini 	case 0:
89401299a5SPaolo Bonzini 		if (vmcb->control.exit_code != SVM_EXIT_RSM) {
90198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to rsm. Exit reason 0x%x",
91401299a5SPaolo Bonzini 				    vmcb->control.exit_code);
92401299a5SPaolo Bonzini 			return true;
93401299a5SPaolo Bonzini 		}
94401299a5SPaolo Bonzini 		vmcb->control.intercept &= ~(1 << INTERCEPT_RSM);
95401299a5SPaolo Bonzini 		inc_test_stage(test);
96401299a5SPaolo Bonzini 		break;
97401299a5SPaolo Bonzini 
98401299a5SPaolo Bonzini 	case 1:
99401299a5SPaolo Bonzini 		if (vmcb->control.exit_code != SVM_EXIT_EXCP_BASE + UD_VECTOR) {
100198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to #UD. Exit reason 0x%x",
101401299a5SPaolo Bonzini 				    vmcb->control.exit_code);
102401299a5SPaolo Bonzini 			return true;
103401299a5SPaolo Bonzini 		}
104401299a5SPaolo Bonzini 		vmcb->save.rip += 2;
105401299a5SPaolo Bonzini 		inc_test_stage(test);
106401299a5SPaolo Bonzini 		break;
107401299a5SPaolo Bonzini 
108401299a5SPaolo Bonzini 	default:
109401299a5SPaolo Bonzini 		return true;
110401299a5SPaolo Bonzini 	}
111401299a5SPaolo Bonzini 	return get_test_stage(test) == 2;
112401299a5SPaolo Bonzini }
113401299a5SPaolo Bonzini 
114ad879127SKrish Sadhukhan static void prepare_cr3_intercept(struct svm_test *test)
115ad879127SKrish Sadhukhan {
116ad879127SKrish Sadhukhan 	default_prepare(test);
117096cf7feSPaolo Bonzini 	vmcb->control.intercept_cr_read |= 1 << 3;
118ad879127SKrish Sadhukhan }
119ad879127SKrish Sadhukhan 
120ad879127SKrish Sadhukhan static void test_cr3_intercept(struct svm_test *test)
121ad879127SKrish Sadhukhan {
122ad879127SKrish Sadhukhan 	asm volatile ("mov %%cr3, %0" : "=r"(test->scratch) : : "memory");
123ad879127SKrish Sadhukhan }
124ad879127SKrish Sadhukhan 
125ad879127SKrish Sadhukhan static bool check_cr3_intercept(struct svm_test *test)
126ad879127SKrish Sadhukhan {
127096cf7feSPaolo Bonzini 	return vmcb->control.exit_code == SVM_EXIT_READ_CR3;
128ad879127SKrish Sadhukhan }
129ad879127SKrish Sadhukhan 
130ad879127SKrish Sadhukhan static bool check_cr3_nointercept(struct svm_test *test)
131ad879127SKrish Sadhukhan {
132ad879127SKrish Sadhukhan 	return null_check(test) && test->scratch == read_cr3();
133ad879127SKrish Sadhukhan }
134ad879127SKrish Sadhukhan 
135ad879127SKrish Sadhukhan static void corrupt_cr3_intercept_bypass(void *_test)
136ad879127SKrish Sadhukhan {
137ad879127SKrish Sadhukhan 	struct svm_test *test = _test;
138ad879127SKrish Sadhukhan 	extern volatile u32 mmio_insn;
139ad879127SKrish Sadhukhan 
140ad879127SKrish Sadhukhan 	while (!__sync_bool_compare_and_swap(&test->scratch, 1, 2))
141ad879127SKrish Sadhukhan 		pause();
142ad879127SKrish Sadhukhan 	pause();
143ad879127SKrish Sadhukhan 	pause();
144ad879127SKrish Sadhukhan 	pause();
145ad879127SKrish Sadhukhan 	mmio_insn = 0x90d8200f;  // mov %cr3, %rax; nop
146ad879127SKrish Sadhukhan }
147ad879127SKrish Sadhukhan 
148ad879127SKrish Sadhukhan static void prepare_cr3_intercept_bypass(struct svm_test *test)
149ad879127SKrish Sadhukhan {
150ad879127SKrish Sadhukhan 	default_prepare(test);
151096cf7feSPaolo Bonzini 	vmcb->control.intercept_cr_read |= 1 << 3;
152ad879127SKrish Sadhukhan 	on_cpu_async(1, corrupt_cr3_intercept_bypass, test);
153ad879127SKrish Sadhukhan }
154ad879127SKrish Sadhukhan 
155ad879127SKrish Sadhukhan static void test_cr3_intercept_bypass(struct svm_test *test)
156ad879127SKrish Sadhukhan {
157ad879127SKrish Sadhukhan 	ulong a = 0xa0000;
158ad879127SKrish Sadhukhan 
159ad879127SKrish Sadhukhan 	test->scratch = 1;
160ad879127SKrish Sadhukhan 	while (test->scratch != 2)
161ad879127SKrish Sadhukhan 		barrier();
162ad879127SKrish Sadhukhan 
163ad879127SKrish Sadhukhan 	asm volatile ("mmio_insn: mov %0, (%0); nop"
164ad879127SKrish Sadhukhan 		      : "+a"(a) : : "memory");
165ad879127SKrish Sadhukhan 	test->scratch = a;
166ad879127SKrish Sadhukhan }
167ad879127SKrish Sadhukhan 
168ad879127SKrish Sadhukhan static void prepare_dr_intercept(struct svm_test *test)
169ad879127SKrish Sadhukhan {
170ad879127SKrish Sadhukhan 	default_prepare(test);
171096cf7feSPaolo Bonzini 	vmcb->control.intercept_dr_read = 0xff;
172096cf7feSPaolo Bonzini 	vmcb->control.intercept_dr_write = 0xff;
173ad879127SKrish Sadhukhan }
174ad879127SKrish Sadhukhan 
175ad879127SKrish Sadhukhan static void test_dr_intercept(struct svm_test *test)
176ad879127SKrish Sadhukhan {
177ad879127SKrish Sadhukhan 	unsigned int i, failcnt = 0;
178ad879127SKrish Sadhukhan 
179ad879127SKrish Sadhukhan 	/* Loop testing debug register reads */
180ad879127SKrish Sadhukhan 	for (i = 0; i < 8; i++) {
181ad879127SKrish Sadhukhan 
182ad879127SKrish Sadhukhan 		switch (i) {
183ad879127SKrish Sadhukhan 		case 0:
184ad879127SKrish Sadhukhan 			asm volatile ("mov %%dr0, %0" : "=r"(test->scratch) : : "memory");
185ad879127SKrish Sadhukhan 			break;
186ad879127SKrish Sadhukhan 		case 1:
187ad879127SKrish Sadhukhan 			asm volatile ("mov %%dr1, %0" : "=r"(test->scratch) : : "memory");
188ad879127SKrish Sadhukhan 			break;
189ad879127SKrish Sadhukhan 		case 2:
190ad879127SKrish Sadhukhan 			asm volatile ("mov %%dr2, %0" : "=r"(test->scratch) : : "memory");
191ad879127SKrish Sadhukhan 			break;
192ad879127SKrish Sadhukhan 		case 3:
193ad879127SKrish Sadhukhan 			asm volatile ("mov %%dr3, %0" : "=r"(test->scratch) : : "memory");
194ad879127SKrish Sadhukhan 			break;
195ad879127SKrish Sadhukhan 		case 4:
196ad879127SKrish Sadhukhan 			asm volatile ("mov %%dr4, %0" : "=r"(test->scratch) : : "memory");
197ad879127SKrish Sadhukhan 			break;
198ad879127SKrish Sadhukhan 		case 5:
199ad879127SKrish Sadhukhan 			asm volatile ("mov %%dr5, %0" : "=r"(test->scratch) : : "memory");
200ad879127SKrish Sadhukhan 			break;
201ad879127SKrish Sadhukhan 		case 6:
202ad879127SKrish Sadhukhan 			asm volatile ("mov %%dr6, %0" : "=r"(test->scratch) : : "memory");
203ad879127SKrish Sadhukhan 			break;
204ad879127SKrish Sadhukhan 		case 7:
205ad879127SKrish Sadhukhan 			asm volatile ("mov %%dr7, %0" : "=r"(test->scratch) : : "memory");
206ad879127SKrish Sadhukhan 			break;
207ad879127SKrish Sadhukhan 		}
208ad879127SKrish Sadhukhan 
209ad879127SKrish Sadhukhan 		if (test->scratch != i) {
210198dfd0eSJanis Schoetterl-Glausch 			report_fail("dr%u read intercept", i);
211ad879127SKrish Sadhukhan 			failcnt++;
212ad879127SKrish Sadhukhan 		}
213ad879127SKrish Sadhukhan 	}
214ad879127SKrish Sadhukhan 
215ad879127SKrish Sadhukhan 	/* Loop testing debug register writes */
216ad879127SKrish Sadhukhan 	for (i = 0; i < 8; i++) {
217ad879127SKrish Sadhukhan 
218ad879127SKrish Sadhukhan 		switch (i) {
219ad879127SKrish Sadhukhan 		case 0:
220ad879127SKrish Sadhukhan 			asm volatile ("mov %0, %%dr0" : : "r"(test->scratch) : "memory");
221ad879127SKrish Sadhukhan 			break;
222ad879127SKrish Sadhukhan 		case 1:
223ad879127SKrish Sadhukhan 			asm volatile ("mov %0, %%dr1" : : "r"(test->scratch) : "memory");
224ad879127SKrish Sadhukhan 			break;
225ad879127SKrish Sadhukhan 		case 2:
226ad879127SKrish Sadhukhan 			asm volatile ("mov %0, %%dr2" : : "r"(test->scratch) : "memory");
227ad879127SKrish Sadhukhan 			break;
228ad879127SKrish Sadhukhan 		case 3:
229ad879127SKrish Sadhukhan 			asm volatile ("mov %0, %%dr3" : : "r"(test->scratch) : "memory");
230ad879127SKrish Sadhukhan 			break;
231ad879127SKrish Sadhukhan 		case 4:
232ad879127SKrish Sadhukhan 			asm volatile ("mov %0, %%dr4" : : "r"(test->scratch) : "memory");
233ad879127SKrish Sadhukhan 			break;
234ad879127SKrish Sadhukhan 		case 5:
235ad879127SKrish Sadhukhan 			asm volatile ("mov %0, %%dr5" : : "r"(test->scratch) : "memory");
236ad879127SKrish Sadhukhan 			break;
237ad879127SKrish Sadhukhan 		case 6:
238ad879127SKrish Sadhukhan 			asm volatile ("mov %0, %%dr6" : : "r"(test->scratch) : "memory");
239ad879127SKrish Sadhukhan 			break;
240ad879127SKrish Sadhukhan 		case 7:
241ad879127SKrish Sadhukhan 			asm volatile ("mov %0, %%dr7" : : "r"(test->scratch) : "memory");
242ad879127SKrish Sadhukhan 			break;
243ad879127SKrish Sadhukhan 		}
244ad879127SKrish Sadhukhan 
245ad879127SKrish Sadhukhan 		if (test->scratch != i) {
246198dfd0eSJanis Schoetterl-Glausch 			report_fail("dr%u write intercept", i);
247ad879127SKrish Sadhukhan 			failcnt++;
248ad879127SKrish Sadhukhan 		}
249ad879127SKrish Sadhukhan 	}
250ad879127SKrish Sadhukhan 
251ad879127SKrish Sadhukhan 	test->scratch = failcnt;
252ad879127SKrish Sadhukhan }
253ad879127SKrish Sadhukhan 
254ad879127SKrish Sadhukhan static bool dr_intercept_finished(struct svm_test *test)
255ad879127SKrish Sadhukhan {
256096cf7feSPaolo Bonzini 	ulong n = (vmcb->control.exit_code - SVM_EXIT_READ_DR0);
257ad879127SKrish Sadhukhan 
258ad879127SKrish Sadhukhan 	/* Only expect DR intercepts */
259ad879127SKrish Sadhukhan 	if (n > (SVM_EXIT_MAX_DR_INTERCEPT - SVM_EXIT_READ_DR0))
260ad879127SKrish Sadhukhan 		return true;
261ad879127SKrish Sadhukhan 
262ad879127SKrish Sadhukhan 	/*
263ad879127SKrish Sadhukhan 	 * Compute debug register number.
264ad879127SKrish Sadhukhan 	 * Per Appendix C "SVM Intercept Exit Codes" of AMD64 Architecture
265ad879127SKrish Sadhukhan 	 * Programmer's Manual Volume 2 - System Programming:
266ad879127SKrish Sadhukhan 	 * http://support.amd.com/TechDocs/24593.pdf
267ad879127SKrish Sadhukhan 	 * there are 16 VMEXIT codes each for DR read and write.
268ad879127SKrish Sadhukhan 	 */
269ad879127SKrish Sadhukhan 	test->scratch = (n % 16);
270ad879127SKrish Sadhukhan 
271ad879127SKrish Sadhukhan 	/* Jump over MOV instruction */
272096cf7feSPaolo Bonzini 	vmcb->save.rip += 3;
273ad879127SKrish Sadhukhan 
274ad879127SKrish Sadhukhan 	return false;
275ad879127SKrish Sadhukhan }
276ad879127SKrish Sadhukhan 
277ad879127SKrish Sadhukhan static bool check_dr_intercept(struct svm_test *test)
278ad879127SKrish Sadhukhan {
279ad879127SKrish Sadhukhan 	return !test->scratch;
280ad879127SKrish Sadhukhan }
281ad879127SKrish Sadhukhan 
282ad879127SKrish Sadhukhan static bool next_rip_supported(void)
283ad879127SKrish Sadhukhan {
284ad879127SKrish Sadhukhan 	return this_cpu_has(X86_FEATURE_NRIPS);
285ad879127SKrish Sadhukhan }
286ad879127SKrish Sadhukhan 
287ad879127SKrish Sadhukhan static void prepare_next_rip(struct svm_test *test)
288ad879127SKrish Sadhukhan {
289096cf7feSPaolo Bonzini 	vmcb->control.intercept |= (1ULL << INTERCEPT_RDTSC);
290ad879127SKrish Sadhukhan }
291ad879127SKrish Sadhukhan 
292ad879127SKrish Sadhukhan 
293ad879127SKrish Sadhukhan static void test_next_rip(struct svm_test *test)
294ad879127SKrish Sadhukhan {
295ad879127SKrish Sadhukhan 	asm volatile ("rdtsc\n\t"
296ad879127SKrish Sadhukhan 		      ".globl exp_next_rip\n\t"
297ad879127SKrish Sadhukhan 		      "exp_next_rip:\n\t" ::: "eax", "edx");
298ad879127SKrish Sadhukhan }
299ad879127SKrish Sadhukhan 
300ad879127SKrish Sadhukhan static bool check_next_rip(struct svm_test *test)
301ad879127SKrish Sadhukhan {
302ad879127SKrish Sadhukhan 	extern char exp_next_rip;
303ad879127SKrish Sadhukhan 	unsigned long address = (unsigned long)&exp_next_rip;
304ad879127SKrish Sadhukhan 
305096cf7feSPaolo Bonzini 	return address == vmcb->control.next_rip;
306ad879127SKrish Sadhukhan }
307ad879127SKrish Sadhukhan 
308ad879127SKrish Sadhukhan extern u8 *msr_bitmap;
309ad879127SKrish Sadhukhan 
310ad879127SKrish Sadhukhan static void prepare_msr_intercept(struct svm_test *test)
311ad879127SKrish Sadhukhan {
312ad879127SKrish Sadhukhan 	default_prepare(test);
313096cf7feSPaolo Bonzini 	vmcb->control.intercept |= (1ULL << INTERCEPT_MSR_PROT);
314096cf7feSPaolo Bonzini 	vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR);
315ad879127SKrish Sadhukhan 	memset(msr_bitmap, 0xff, MSR_BITMAP_SIZE);
316ad879127SKrish Sadhukhan }
317ad879127SKrish Sadhukhan 
318ad879127SKrish Sadhukhan static void test_msr_intercept(struct svm_test *test)
319ad879127SKrish Sadhukhan {
320ad879127SKrish Sadhukhan 	unsigned long msr_value = 0xef8056791234abcd; /* Arbitrary value */
321ad879127SKrish Sadhukhan 	unsigned long msr_index;
322ad879127SKrish Sadhukhan 
323ad879127SKrish Sadhukhan 	for (msr_index = 0; msr_index <= 0xc0011fff; msr_index++) {
324ad879127SKrish Sadhukhan 		if (msr_index == 0xC0010131 /* MSR_SEV_STATUS */) {
325ad879127SKrish Sadhukhan 			/*
326ad879127SKrish Sadhukhan 			 * Per section 15.34.10 "SEV_STATUS MSR" of AMD64 Architecture
327ad879127SKrish Sadhukhan 			 * Programmer's Manual volume 2 - System Programming:
328ad879127SKrish Sadhukhan 			 * http://support.amd.com/TechDocs/24593.pdf
329ad879127SKrish Sadhukhan 			 * SEV_STATUS MSR (C001_0131) is a non-interceptable MSR.
330ad879127SKrish Sadhukhan 			 */
331ad879127SKrish Sadhukhan 			continue;
332ad879127SKrish Sadhukhan 		}
333ad879127SKrish Sadhukhan 
334ad879127SKrish Sadhukhan 		/* Skips gaps between supported MSR ranges */
335ad879127SKrish Sadhukhan 		if (msr_index == 0x2000)
336ad879127SKrish Sadhukhan 			msr_index = 0xc0000000;
337ad879127SKrish Sadhukhan 		else if (msr_index == 0xc0002000)
338ad879127SKrish Sadhukhan 			msr_index = 0xc0010000;
339ad879127SKrish Sadhukhan 
340ad879127SKrish Sadhukhan 		test->scratch = -1;
341ad879127SKrish Sadhukhan 
342ad879127SKrish Sadhukhan 		rdmsr(msr_index);
343ad879127SKrish Sadhukhan 
344ad879127SKrish Sadhukhan 		/* Check that a read intercept occurred for MSR at msr_index */
345ad879127SKrish Sadhukhan 		if (test->scratch != msr_index)
346198dfd0eSJanis Schoetterl-Glausch 			report_fail("MSR 0x%lx read intercept", msr_index);
347ad879127SKrish Sadhukhan 
348ad879127SKrish Sadhukhan 		/*
349ad879127SKrish Sadhukhan 		 * Poor man approach to generate a value that
350ad879127SKrish Sadhukhan 		 * seems arbitrary each time around the loop.
351ad879127SKrish Sadhukhan 		 */
352ad879127SKrish Sadhukhan 		msr_value += (msr_value << 1);
353ad879127SKrish Sadhukhan 
354ad879127SKrish Sadhukhan 		wrmsr(msr_index, msr_value);
355ad879127SKrish Sadhukhan 
356ad879127SKrish Sadhukhan 		/* Check that a write intercept occurred for MSR with msr_value */
357ad879127SKrish Sadhukhan 		if (test->scratch != msr_value)
358198dfd0eSJanis Schoetterl-Glausch 			report_fail("MSR 0x%lx write intercept", msr_index);
359ad879127SKrish Sadhukhan 	}
360ad879127SKrish Sadhukhan 
361ad879127SKrish Sadhukhan 	test->scratch = -2;
362ad879127SKrish Sadhukhan }
363ad879127SKrish Sadhukhan 
364ad879127SKrish Sadhukhan static bool msr_intercept_finished(struct svm_test *test)
365ad879127SKrish Sadhukhan {
366096cf7feSPaolo Bonzini 	u32 exit_code = vmcb->control.exit_code;
367ad879127SKrish Sadhukhan 	u64 exit_info_1;
368ad879127SKrish Sadhukhan 	u8 *opcode;
369ad879127SKrish Sadhukhan 
370ad879127SKrish Sadhukhan 	if (exit_code == SVM_EXIT_MSR) {
371096cf7feSPaolo Bonzini 		exit_info_1 = vmcb->control.exit_info_1;
372ad879127SKrish Sadhukhan 	} else {
373ad879127SKrish Sadhukhan 		/*
374ad879127SKrish Sadhukhan 		 * If #GP exception occurs instead, check that it was
375ad879127SKrish Sadhukhan 		 * for RDMSR/WRMSR and set exit_info_1 accordingly.
376ad879127SKrish Sadhukhan 		 */
377ad879127SKrish Sadhukhan 
378ad879127SKrish Sadhukhan 		if (exit_code != (SVM_EXIT_EXCP_BASE + GP_VECTOR))
379ad879127SKrish Sadhukhan 			return true;
380ad879127SKrish Sadhukhan 
381096cf7feSPaolo Bonzini 		opcode = (u8 *)vmcb->save.rip;
382ad879127SKrish Sadhukhan 		if (opcode[0] != 0x0f)
383ad879127SKrish Sadhukhan 			return true;
384ad879127SKrish Sadhukhan 
385ad879127SKrish Sadhukhan 		switch (opcode[1]) {
386ad879127SKrish Sadhukhan 		case 0x30: /* WRMSR */
387ad879127SKrish Sadhukhan 			exit_info_1 = 1;
388ad879127SKrish Sadhukhan 			break;
389ad879127SKrish Sadhukhan 		case 0x32: /* RDMSR */
390ad879127SKrish Sadhukhan 			exit_info_1 = 0;
391ad879127SKrish Sadhukhan 			break;
392ad879127SKrish Sadhukhan 		default:
393ad879127SKrish Sadhukhan 			return true;
394ad879127SKrish Sadhukhan 		}
395ad879127SKrish Sadhukhan 
396ad879127SKrish Sadhukhan 		/*
3973f27d772SManali Shukla 		 * Warn that #GP exception occured instead.
398ad879127SKrish Sadhukhan 		 * RCX holds the MSR index.
399ad879127SKrish Sadhukhan 		 */
400ad879127SKrish Sadhukhan 		printf("%s 0x%lx #GP exception\n",
401ad879127SKrish Sadhukhan 		       exit_info_1 ? "WRMSR" : "RDMSR", get_regs().rcx);
402ad879127SKrish Sadhukhan 	}
403ad879127SKrish Sadhukhan 
404ad879127SKrish Sadhukhan 	/* Jump over RDMSR/WRMSR instruction */
405096cf7feSPaolo Bonzini 	vmcb->save.rip += 2;
406ad879127SKrish Sadhukhan 
407ad879127SKrish Sadhukhan 	/*
408ad879127SKrish Sadhukhan 	 * Test whether the intercept was for RDMSR/WRMSR.
409ad879127SKrish Sadhukhan 	 * For RDMSR, test->scratch is set to the MSR index;
410ad879127SKrish Sadhukhan 	 *      RCX holds the MSR index.
411ad879127SKrish Sadhukhan 	 * For WRMSR, test->scratch is set to the MSR value;
412ad879127SKrish Sadhukhan 	 *      RDX holds the upper 32 bits of the MSR value,
413ad879127SKrish Sadhukhan 	 *      while RAX hold its lower 32 bits.
414ad879127SKrish Sadhukhan 	 */
415ad879127SKrish Sadhukhan 	if (exit_info_1)
416ad879127SKrish Sadhukhan 		test->scratch =
417096cf7feSPaolo Bonzini 			((get_regs().rdx << 32) | (vmcb->save.rax & 0xffffffff));
418ad879127SKrish Sadhukhan 	else
419ad879127SKrish Sadhukhan 		test->scratch = get_regs().rcx;
420ad879127SKrish Sadhukhan 
421ad879127SKrish Sadhukhan 	return false;
422ad879127SKrish Sadhukhan }
423ad879127SKrish Sadhukhan 
424ad879127SKrish Sadhukhan static bool check_msr_intercept(struct svm_test *test)
425ad879127SKrish Sadhukhan {
426ad879127SKrish Sadhukhan 	memset(msr_bitmap, 0, MSR_BITMAP_SIZE);
427ad879127SKrish Sadhukhan 	return (test->scratch == -2);
428ad879127SKrish Sadhukhan }
429ad879127SKrish Sadhukhan 
430ad879127SKrish Sadhukhan static void prepare_mode_switch(struct svm_test *test)
431ad879127SKrish Sadhukhan {
432096cf7feSPaolo Bonzini 	vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR)
433ad879127SKrish Sadhukhan 		|  (1ULL << UD_VECTOR)
434ad879127SKrish Sadhukhan 		|  (1ULL << DF_VECTOR)
435ad879127SKrish Sadhukhan 		|  (1ULL << PF_VECTOR);
436ad879127SKrish Sadhukhan 	test->scratch = 0;
437ad879127SKrish Sadhukhan }
438ad879127SKrish Sadhukhan 
439ad879127SKrish Sadhukhan static void test_mode_switch(struct svm_test *test)
440ad879127SKrish Sadhukhan {
441ad879127SKrish Sadhukhan 	asm volatile("	cli\n"
442ad879127SKrish Sadhukhan 		     "	ljmp *1f\n" /* jump to 32-bit code segment */
443ad879127SKrish Sadhukhan 		     "1:\n"
444ad879127SKrish Sadhukhan 		     "	.long 2f\n"
445ad879127SKrish Sadhukhan 		     "	.long " xstr(KERNEL_CS32) "\n"
446ad879127SKrish Sadhukhan 		     ".code32\n"
447ad879127SKrish Sadhukhan 		     "2:\n"
448ad879127SKrish Sadhukhan 		     "	movl %%cr0, %%eax\n"
449ad879127SKrish Sadhukhan 		     "	btcl  $31, %%eax\n" /* clear PG */
450ad879127SKrish Sadhukhan 		     "	movl %%eax, %%cr0\n"
451ad879127SKrish Sadhukhan 		     "	movl $0xc0000080, %%ecx\n" /* EFER */
452ad879127SKrish Sadhukhan 		     "	rdmsr\n"
453ad879127SKrish Sadhukhan 		     "	btcl $8, %%eax\n" /* clear LME */
454ad879127SKrish Sadhukhan 		     "	wrmsr\n"
455ad879127SKrish Sadhukhan 		     "	movl %%cr4, %%eax\n"
456ad879127SKrish Sadhukhan 		     "	btcl $5, %%eax\n" /* clear PAE */
457ad879127SKrish Sadhukhan 		     "	movl %%eax, %%cr4\n"
458ad879127SKrish Sadhukhan 		     "	movw %[ds16], %%ax\n"
459ad879127SKrish Sadhukhan 		     "	movw %%ax, %%ds\n"
460ad879127SKrish Sadhukhan 		     "	ljmpl %[cs16], $3f\n" /* jump to 16 bit protected-mode */
461ad879127SKrish Sadhukhan 		     ".code16\n"
462ad879127SKrish Sadhukhan 		     "3:\n"
463ad879127SKrish Sadhukhan 		     "	movl %%cr0, %%eax\n"
464ad879127SKrish Sadhukhan 		     "	btcl $0, %%eax\n" /* clear PE  */
465ad879127SKrish Sadhukhan 		     "	movl %%eax, %%cr0\n"
466ad879127SKrish Sadhukhan 		     "	ljmpl $0, $4f\n"   /* jump to real-mode */
467ad879127SKrish Sadhukhan 		     "4:\n"
468ad879127SKrish Sadhukhan 		     "	vmmcall\n"
469ad879127SKrish Sadhukhan 		     "	movl %%cr0, %%eax\n"
470ad879127SKrish Sadhukhan 		     "	btsl $0, %%eax\n" /* set PE  */
471ad879127SKrish Sadhukhan 		     "	movl %%eax, %%cr0\n"
472ad879127SKrish Sadhukhan 		     "	ljmpl %[cs32], $5f\n" /* back to protected mode */
473ad879127SKrish Sadhukhan 		     ".code32\n"
474ad879127SKrish Sadhukhan 		     "5:\n"
475ad879127SKrish Sadhukhan 		     "	movl %%cr4, %%eax\n"
476ad879127SKrish Sadhukhan 		     "	btsl $5, %%eax\n" /* set PAE */
477ad879127SKrish Sadhukhan 		     "	movl %%eax, %%cr4\n"
478ad879127SKrish Sadhukhan 		     "	movl $0xc0000080, %%ecx\n" /* EFER */
479ad879127SKrish Sadhukhan 		     "	rdmsr\n"
480ad879127SKrish Sadhukhan 		     "	btsl $8, %%eax\n" /* set LME */
481ad879127SKrish Sadhukhan 		     "	wrmsr\n"
482ad879127SKrish Sadhukhan 		     "	movl %%cr0, %%eax\n"
483ad879127SKrish Sadhukhan 		     "	btsl  $31, %%eax\n" /* set PG */
484ad879127SKrish Sadhukhan 		     "	movl %%eax, %%cr0\n"
485ad879127SKrish Sadhukhan 		     "	ljmpl %[cs64], $6f\n"    /* back to long mode */
486ad879127SKrish Sadhukhan 		     ".code64\n\t"
487ad879127SKrish Sadhukhan 		     "6:\n"
488ad879127SKrish Sadhukhan 		     "	vmmcall\n"
489ad879127SKrish Sadhukhan 		     :: [cs16] "i"(KERNEL_CS16), [ds16] "i"(KERNEL_DS16),
490ad879127SKrish Sadhukhan 		      [cs32] "i"(KERNEL_CS32), [cs64] "i"(KERNEL_CS64)
491ad879127SKrish Sadhukhan 		     : "rax", "rbx", "rcx", "rdx", "memory");
492ad879127SKrish Sadhukhan }
493ad879127SKrish Sadhukhan 
494ad879127SKrish Sadhukhan static bool mode_switch_finished(struct svm_test *test)
495ad879127SKrish Sadhukhan {
496ad879127SKrish Sadhukhan 	u64 cr0, cr4, efer;
497ad879127SKrish Sadhukhan 
498096cf7feSPaolo Bonzini 	cr0  = vmcb->save.cr0;
499096cf7feSPaolo Bonzini 	cr4  = vmcb->save.cr4;
500096cf7feSPaolo Bonzini 	efer = vmcb->save.efer;
501ad879127SKrish Sadhukhan 
502ad879127SKrish Sadhukhan 	/* Only expect VMMCALL intercepts */
503096cf7feSPaolo Bonzini 	if (vmcb->control.exit_code != SVM_EXIT_VMMCALL)
504ad879127SKrish Sadhukhan 		return true;
505ad879127SKrish Sadhukhan 
506ad879127SKrish Sadhukhan 	/* Jump over VMMCALL instruction */
507096cf7feSPaolo Bonzini 	vmcb->save.rip += 3;
508ad879127SKrish Sadhukhan 
509ad879127SKrish Sadhukhan 	/* Do sanity checks */
510ad879127SKrish Sadhukhan 	switch (test->scratch) {
511ad879127SKrish Sadhukhan 	case 0:
512ad879127SKrish Sadhukhan 		/* Test should be in real mode now - check for this */
513ad879127SKrish Sadhukhan 		if ((cr0  & 0x80000001) || /* CR0.PG, CR0.PE */
514ad879127SKrish Sadhukhan 		    (cr4  & 0x00000020) || /* CR4.PAE */
515ad879127SKrish Sadhukhan 		    (efer & 0x00000500))   /* EFER.LMA, EFER.LME */
516ad879127SKrish Sadhukhan 			return true;
517ad879127SKrish Sadhukhan 		break;
518ad879127SKrish Sadhukhan 	case 2:
519ad879127SKrish Sadhukhan 		/* Test should be back in long-mode now - check for this */
520ad879127SKrish Sadhukhan 		if (((cr0  & 0x80000001) != 0x80000001) || /* CR0.PG, CR0.PE */
521ad879127SKrish Sadhukhan 		    ((cr4  & 0x00000020) != 0x00000020) || /* CR4.PAE */
522ad879127SKrish Sadhukhan 		    ((efer & 0x00000500) != 0x00000500))   /* EFER.LMA, EFER.LME */
523ad879127SKrish Sadhukhan 			return true;
524ad879127SKrish Sadhukhan 		break;
525ad879127SKrish Sadhukhan 	}
526ad879127SKrish Sadhukhan 
527ad879127SKrish Sadhukhan 	/* one step forward */
528ad879127SKrish Sadhukhan 	test->scratch += 1;
529ad879127SKrish Sadhukhan 
530ad879127SKrish Sadhukhan 	return test->scratch == 2;
531ad879127SKrish Sadhukhan }
532ad879127SKrish Sadhukhan 
533ad879127SKrish Sadhukhan static bool check_mode_switch(struct svm_test *test)
534ad879127SKrish Sadhukhan {
535ad879127SKrish Sadhukhan 	return test->scratch == 2;
536ad879127SKrish Sadhukhan }
537ad879127SKrish Sadhukhan 
538ad879127SKrish Sadhukhan extern u8 *io_bitmap;
539ad879127SKrish Sadhukhan 
540ad879127SKrish Sadhukhan static void prepare_ioio(struct svm_test *test)
541ad879127SKrish Sadhukhan {
542096cf7feSPaolo Bonzini 	vmcb->control.intercept |= (1ULL << INTERCEPT_IOIO_PROT);
543ad879127SKrish Sadhukhan 	test->scratch = 0;
544ad879127SKrish Sadhukhan 	memset(io_bitmap, 0, 8192);
545ad879127SKrish Sadhukhan 	io_bitmap[8192] = 0xFF;
546ad879127SKrish Sadhukhan }
547ad879127SKrish Sadhukhan 
548ad879127SKrish Sadhukhan static void test_ioio(struct svm_test *test)
549ad879127SKrish Sadhukhan {
550ad879127SKrish Sadhukhan 	// stage 0, test IO pass
551ad879127SKrish Sadhukhan 	inb(0x5000);
552ad879127SKrish Sadhukhan 	outb(0x0, 0x5000);
553ad879127SKrish Sadhukhan 	if (get_test_stage(test) != 0)
554ad879127SKrish Sadhukhan 		goto fail;
555ad879127SKrish Sadhukhan 
556ad879127SKrish Sadhukhan 	// test IO width, in/out
557ad879127SKrish Sadhukhan 	io_bitmap[0] = 0xFF;
558ad879127SKrish Sadhukhan 	inc_test_stage(test);
559ad879127SKrish Sadhukhan 	inb(0x0);
560ad879127SKrish Sadhukhan 	if (get_test_stage(test) != 2)
561ad879127SKrish Sadhukhan 		goto fail;
562ad879127SKrish Sadhukhan 
563ad879127SKrish Sadhukhan 	outw(0x0, 0x0);
564ad879127SKrish Sadhukhan 	if (get_test_stage(test) != 3)
565ad879127SKrish Sadhukhan 		goto fail;
566ad879127SKrish Sadhukhan 
567ad879127SKrish Sadhukhan 	inl(0x0);
568ad879127SKrish Sadhukhan 	if (get_test_stage(test) != 4)
569ad879127SKrish Sadhukhan 		goto fail;
570ad879127SKrish Sadhukhan 
571ad879127SKrish Sadhukhan 	// test low/high IO port
572ad879127SKrish Sadhukhan 	io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8));
573ad879127SKrish Sadhukhan 	inb(0x5000);
574ad879127SKrish Sadhukhan 	if (get_test_stage(test) != 5)
575ad879127SKrish Sadhukhan 		goto fail;
576ad879127SKrish Sadhukhan 
577ad879127SKrish Sadhukhan 	io_bitmap[0x9000 / 8] = (1 << (0x9000 % 8));
578ad879127SKrish Sadhukhan 	inw(0x9000);
579ad879127SKrish Sadhukhan 	if (get_test_stage(test) != 6)
580ad879127SKrish Sadhukhan 		goto fail;
581ad879127SKrish Sadhukhan 
582ad879127SKrish Sadhukhan 	// test partial pass
583ad879127SKrish Sadhukhan 	io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8));
584ad879127SKrish Sadhukhan 	inl(0x4FFF);
585ad879127SKrish Sadhukhan 	if (get_test_stage(test) != 7)
586ad879127SKrish Sadhukhan 		goto fail;
587ad879127SKrish Sadhukhan 
588ad879127SKrish Sadhukhan 	// test across pages
589ad879127SKrish Sadhukhan 	inc_test_stage(test);
590ad879127SKrish Sadhukhan 	inl(0x7FFF);
591ad879127SKrish Sadhukhan 	if (get_test_stage(test) != 8)
592ad879127SKrish Sadhukhan 		goto fail;
593ad879127SKrish Sadhukhan 
594ad879127SKrish Sadhukhan 	inc_test_stage(test);
595ad879127SKrish Sadhukhan 	io_bitmap[0x8000 / 8] = 1 << (0x8000 % 8);
596ad879127SKrish Sadhukhan 	inl(0x7FFF);
597ad879127SKrish Sadhukhan 	if (get_test_stage(test) != 10)
598ad879127SKrish Sadhukhan 		goto fail;
599ad879127SKrish Sadhukhan 
600ad879127SKrish Sadhukhan 	io_bitmap[0] = 0;
601ad879127SKrish Sadhukhan 	inl(0xFFFF);
602ad879127SKrish Sadhukhan 	if (get_test_stage(test) != 11)
603ad879127SKrish Sadhukhan 		goto fail;
604ad879127SKrish Sadhukhan 
605ad879127SKrish Sadhukhan 	io_bitmap[0] = 0xFF;
606ad879127SKrish Sadhukhan 	io_bitmap[8192] = 0;
607ad879127SKrish Sadhukhan 	inl(0xFFFF);
608ad879127SKrish Sadhukhan 	inc_test_stage(test);
609ad879127SKrish Sadhukhan 	if (get_test_stage(test) != 12)
610ad879127SKrish Sadhukhan 		goto fail;
611ad879127SKrish Sadhukhan 
612ad879127SKrish Sadhukhan 	return;
613ad879127SKrish Sadhukhan 
614ad879127SKrish Sadhukhan fail:
615198dfd0eSJanis Schoetterl-Glausch 	report_fail("stage %d", get_test_stage(test));
616ad879127SKrish Sadhukhan 	test->scratch = -1;
617ad879127SKrish Sadhukhan }
618ad879127SKrish Sadhukhan 
619ad879127SKrish Sadhukhan static bool ioio_finished(struct svm_test *test)
620ad879127SKrish Sadhukhan {
621ad879127SKrish Sadhukhan 	unsigned port, size;
622ad879127SKrish Sadhukhan 
623ad879127SKrish Sadhukhan 	/* Only expect IOIO intercepts */
624096cf7feSPaolo Bonzini 	if (vmcb->control.exit_code == SVM_EXIT_VMMCALL)
625ad879127SKrish Sadhukhan 		return true;
626ad879127SKrish Sadhukhan 
627096cf7feSPaolo Bonzini 	if (vmcb->control.exit_code != SVM_EXIT_IOIO)
628ad879127SKrish Sadhukhan 		return true;
629ad879127SKrish Sadhukhan 
630ad879127SKrish Sadhukhan 	/* one step forward */
631ad879127SKrish Sadhukhan 	test->scratch += 1;
632ad879127SKrish Sadhukhan 
633096cf7feSPaolo Bonzini 	port = vmcb->control.exit_info_1 >> 16;
634096cf7feSPaolo Bonzini 	size = (vmcb->control.exit_info_1 >> SVM_IOIO_SIZE_SHIFT) & 7;
635ad879127SKrish Sadhukhan 
636ad879127SKrish Sadhukhan 	while (size--) {
637ad879127SKrish Sadhukhan 		io_bitmap[port / 8] &= ~(1 << (port & 7));
638ad879127SKrish Sadhukhan 		port++;
639ad879127SKrish Sadhukhan 	}
640ad879127SKrish Sadhukhan 
641ad879127SKrish Sadhukhan 	return false;
642ad879127SKrish Sadhukhan }
643ad879127SKrish Sadhukhan 
644ad879127SKrish Sadhukhan static bool check_ioio(struct svm_test *test)
645ad879127SKrish Sadhukhan {
646ad879127SKrish Sadhukhan 	memset(io_bitmap, 0, 8193);
647ad879127SKrish Sadhukhan 	return test->scratch != -1;
648ad879127SKrish Sadhukhan }
649ad879127SKrish Sadhukhan 
650ad879127SKrish Sadhukhan static void prepare_asid_zero(struct svm_test *test)
651ad879127SKrish Sadhukhan {
652096cf7feSPaolo Bonzini 	vmcb->control.asid = 0;
653ad879127SKrish Sadhukhan }
654ad879127SKrish Sadhukhan 
655ad879127SKrish Sadhukhan static void test_asid_zero(struct svm_test *test)
656ad879127SKrish Sadhukhan {
657ad879127SKrish Sadhukhan 	asm volatile ("vmmcall\n\t");
658ad879127SKrish Sadhukhan }
659ad879127SKrish Sadhukhan 
660ad879127SKrish Sadhukhan static bool check_asid_zero(struct svm_test *test)
661ad879127SKrish Sadhukhan {
662096cf7feSPaolo Bonzini 	return vmcb->control.exit_code == SVM_EXIT_ERR;
663ad879127SKrish Sadhukhan }
664ad879127SKrish Sadhukhan 
665ad879127SKrish Sadhukhan static void sel_cr0_bug_prepare(struct svm_test *test)
666ad879127SKrish Sadhukhan {
667096cf7feSPaolo Bonzini 	vmcb->control.intercept |= (1ULL << INTERCEPT_SELECTIVE_CR0);
668ad879127SKrish Sadhukhan }
669ad879127SKrish Sadhukhan 
670ad879127SKrish Sadhukhan static bool sel_cr0_bug_finished(struct svm_test *test)
671ad879127SKrish Sadhukhan {
672ad879127SKrish Sadhukhan 	return true;
673ad879127SKrish Sadhukhan }
674ad879127SKrish Sadhukhan 
675ad879127SKrish Sadhukhan static void sel_cr0_bug_test(struct svm_test *test)
676ad879127SKrish Sadhukhan {
677ad879127SKrish Sadhukhan 	unsigned long cr0;
678ad879127SKrish Sadhukhan 
679ad879127SKrish Sadhukhan 	/* read cr0, clear CD, and write back */
680ad879127SKrish Sadhukhan 	cr0  = read_cr0();
681ad879127SKrish Sadhukhan 	cr0 |= (1UL << 30);
682ad879127SKrish Sadhukhan 	write_cr0(cr0);
683ad879127SKrish Sadhukhan 
684ad879127SKrish Sadhukhan 	/*
685ad879127SKrish Sadhukhan 	 * If we are here the test failed, not sure what to do now because we
686ad879127SKrish Sadhukhan 	 * are not in guest-mode anymore so we can't trigger an intercept.
687ad879127SKrish Sadhukhan 	 * Trigger a tripple-fault for now.
688ad879127SKrish Sadhukhan 	 */
689198dfd0eSJanis Schoetterl-Glausch 	report_fail("sel_cr0 test. Can not recover from this - exiting");
690ad879127SKrish Sadhukhan 	exit(report_summary());
691ad879127SKrish Sadhukhan }
692ad879127SKrish Sadhukhan 
693ad879127SKrish Sadhukhan static bool sel_cr0_bug_check(struct svm_test *test)
694ad879127SKrish Sadhukhan {
695096cf7feSPaolo Bonzini 	return vmcb->control.exit_code == SVM_EXIT_CR0_SEL_WRITE;
696ad879127SKrish Sadhukhan }
697ad879127SKrish Sadhukhan 
698ad879127SKrish Sadhukhan #define TSC_ADJUST_VALUE    (1ll << 32)
699f3154609SBill Wendling #define TSC_OFFSET_VALUE    (~0ull << 48)
700ad879127SKrish Sadhukhan static bool ok;
701ad879127SKrish Sadhukhan 
70210a65fc4SNadav Amit static bool tsc_adjust_supported(void)
70310a65fc4SNadav Amit {
70410a65fc4SNadav Amit 	return this_cpu_has(X86_FEATURE_TSC_ADJUST);
70510a65fc4SNadav Amit }
70610a65fc4SNadav Amit 
707ad879127SKrish Sadhukhan static void tsc_adjust_prepare(struct svm_test *test)
708ad879127SKrish Sadhukhan {
709ad879127SKrish Sadhukhan 	default_prepare(test);
710096cf7feSPaolo Bonzini 	vmcb->control.tsc_offset = TSC_OFFSET_VALUE;
711ad879127SKrish Sadhukhan 
712ad879127SKrish Sadhukhan 	wrmsr(MSR_IA32_TSC_ADJUST, -TSC_ADJUST_VALUE);
713ad879127SKrish Sadhukhan 	int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST);
714ad879127SKrish Sadhukhan 	ok = adjust == -TSC_ADJUST_VALUE;
715ad879127SKrish Sadhukhan }
716ad879127SKrish Sadhukhan 
717ad879127SKrish Sadhukhan static void tsc_adjust_test(struct svm_test *test)
718ad879127SKrish Sadhukhan {
719ad879127SKrish Sadhukhan 	int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST);
720ad879127SKrish Sadhukhan 	ok &= adjust == -TSC_ADJUST_VALUE;
721ad879127SKrish Sadhukhan 
722ad879127SKrish Sadhukhan 	uint64_t l1_tsc = rdtsc() - TSC_OFFSET_VALUE;
723ad879127SKrish Sadhukhan 	wrmsr(MSR_IA32_TSC, l1_tsc - TSC_ADJUST_VALUE);
724ad879127SKrish Sadhukhan 
725ad879127SKrish Sadhukhan 	adjust = rdmsr(MSR_IA32_TSC_ADJUST);
726ad879127SKrish Sadhukhan 	ok &= adjust <= -2 * TSC_ADJUST_VALUE;
727ad879127SKrish Sadhukhan 
728ad879127SKrish Sadhukhan 	uint64_t l1_tsc_end = rdtsc() - TSC_OFFSET_VALUE;
729ad879127SKrish Sadhukhan 	ok &= (l1_tsc_end + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE;
730ad879127SKrish Sadhukhan 
731ad879127SKrish Sadhukhan 	uint64_t l1_tsc_msr = rdmsr(MSR_IA32_TSC) - TSC_OFFSET_VALUE;
732ad879127SKrish Sadhukhan 	ok &= (l1_tsc_msr + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE;
733ad879127SKrish Sadhukhan }
734ad879127SKrish Sadhukhan 
735ad879127SKrish Sadhukhan static bool tsc_adjust_check(struct svm_test *test)
736ad879127SKrish Sadhukhan {
737ad879127SKrish Sadhukhan 	int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST);
738ad879127SKrish Sadhukhan 
739ad879127SKrish Sadhukhan 	wrmsr(MSR_IA32_TSC_ADJUST, 0);
740ad879127SKrish Sadhukhan 	return ok && adjust <= -2 * TSC_ADJUST_VALUE;
741ad879127SKrish Sadhukhan }
742ad879127SKrish Sadhukhan 
743a8503d50SMaxim Levitsky 
744a8503d50SMaxim Levitsky static u64 guest_tsc_delay_value;
745a8503d50SMaxim Levitsky /* number of bits to shift tsc right for stable result */
746a8503d50SMaxim Levitsky #define TSC_SHIFT 24
747a8503d50SMaxim Levitsky #define TSC_SCALE_ITERATIONS 10
748a8503d50SMaxim Levitsky 
749a8503d50SMaxim Levitsky static void svm_tsc_scale_guest(struct svm_test *test)
750a8503d50SMaxim Levitsky {
751a8503d50SMaxim Levitsky 	u64 start_tsc = rdtsc();
752a8503d50SMaxim Levitsky 
753a8503d50SMaxim Levitsky 	while (rdtsc() - start_tsc < guest_tsc_delay_value)
754a8503d50SMaxim Levitsky 		cpu_relax();
755a8503d50SMaxim Levitsky }
756a8503d50SMaxim Levitsky 
757a8503d50SMaxim Levitsky static void svm_tsc_scale_run_testcase(u64 duration,
758a8503d50SMaxim Levitsky 				       double tsc_scale, u64 tsc_offset)
759a8503d50SMaxim Levitsky {
760a8503d50SMaxim Levitsky 	u64 start_tsc, actual_duration;
761a8503d50SMaxim Levitsky 
762a8503d50SMaxim Levitsky 	guest_tsc_delay_value = (duration << TSC_SHIFT) * tsc_scale;
763a8503d50SMaxim Levitsky 
764a8503d50SMaxim Levitsky 	test_set_guest(svm_tsc_scale_guest);
765a8503d50SMaxim Levitsky 	vmcb->control.tsc_offset = tsc_offset;
766a8503d50SMaxim Levitsky 	wrmsr(MSR_AMD64_TSC_RATIO, (u64)(tsc_scale * (1ULL << 32)));
767a8503d50SMaxim Levitsky 
768a8503d50SMaxim Levitsky 	start_tsc = rdtsc();
769a8503d50SMaxim Levitsky 
770a8503d50SMaxim Levitsky 	if (svm_vmrun() != SVM_EXIT_VMMCALL)
771a8503d50SMaxim Levitsky 		report_fail("unexpected vm exit code 0x%x", vmcb->control.exit_code);
772a8503d50SMaxim Levitsky 
773a8503d50SMaxim Levitsky 	actual_duration = (rdtsc() - start_tsc) >> TSC_SHIFT;
774a8503d50SMaxim Levitsky 
775a8503d50SMaxim Levitsky 	report(duration == actual_duration, "tsc delay (expected: %lu, actual: %lu)",
776a8503d50SMaxim Levitsky 	       duration, actual_duration);
777a8503d50SMaxim Levitsky }
778a8503d50SMaxim Levitsky 
779a8503d50SMaxim Levitsky static void svm_tsc_scale_test(void)
780a8503d50SMaxim Levitsky {
781a8503d50SMaxim Levitsky 	int i;
782a8503d50SMaxim Levitsky 
783a8503d50SMaxim Levitsky 	if (!tsc_scale_supported()) {
784a8503d50SMaxim Levitsky 		report_skip("TSC scale not supported in the guest");
785a8503d50SMaxim Levitsky 		return;
786a8503d50SMaxim Levitsky 	}
787a8503d50SMaxim Levitsky 
788a8503d50SMaxim Levitsky 	report(rdmsr(MSR_AMD64_TSC_RATIO) == TSC_RATIO_DEFAULT,
789a8503d50SMaxim Levitsky 	       "initial TSC scale ratio");
790a8503d50SMaxim Levitsky 
791a8503d50SMaxim Levitsky 	for (i = 0 ; i < TSC_SCALE_ITERATIONS; i++) {
792a8503d50SMaxim Levitsky 
793a8503d50SMaxim Levitsky 		double tsc_scale = (double)(rdrand() % 100 + 1) / 10;
794a8503d50SMaxim Levitsky 		int duration = rdrand() % 50 + 1;
795a8503d50SMaxim Levitsky 		u64 tsc_offset = rdrand();
796a8503d50SMaxim Levitsky 
797a8503d50SMaxim Levitsky 		report_info("duration=%d, tsc_scale=%d, tsc_offset=%ld",
798a8503d50SMaxim Levitsky 			    duration, (int)(tsc_scale * 100), tsc_offset);
799a8503d50SMaxim Levitsky 
800a8503d50SMaxim Levitsky 		svm_tsc_scale_run_testcase(duration, tsc_scale, tsc_offset);
801a8503d50SMaxim Levitsky 	}
802a8503d50SMaxim Levitsky 
803a8503d50SMaxim Levitsky 	svm_tsc_scale_run_testcase(50, 255, rdrand());
804a8503d50SMaxim Levitsky 	svm_tsc_scale_run_testcase(50, 0.0001, rdrand());
805a8503d50SMaxim Levitsky }
806a8503d50SMaxim Levitsky 
807ad879127SKrish Sadhukhan static void latency_prepare(struct svm_test *test)
808ad879127SKrish Sadhukhan {
809ad879127SKrish Sadhukhan 	default_prepare(test);
810ad879127SKrish Sadhukhan 	runs = LATENCY_RUNS;
811ad879127SKrish Sadhukhan 	latvmrun_min = latvmexit_min = -1ULL;
812ad879127SKrish Sadhukhan 	latvmrun_max = latvmexit_max = 0;
813ad879127SKrish Sadhukhan 	vmrun_sum = vmexit_sum = 0;
814ad879127SKrish Sadhukhan 	tsc_start = rdtsc();
815ad879127SKrish Sadhukhan }
816ad879127SKrish Sadhukhan 
817ad879127SKrish Sadhukhan static void latency_test(struct svm_test *test)
818ad879127SKrish Sadhukhan {
819ad879127SKrish Sadhukhan 	u64 cycles;
820ad879127SKrish Sadhukhan 
821ad879127SKrish Sadhukhan start:
822ad879127SKrish Sadhukhan 	tsc_end = rdtsc();
823ad879127SKrish Sadhukhan 
824ad879127SKrish Sadhukhan 	cycles = tsc_end - tsc_start;
825ad879127SKrish Sadhukhan 
826ad879127SKrish Sadhukhan 	if (cycles > latvmrun_max)
827ad879127SKrish Sadhukhan 		latvmrun_max = cycles;
828ad879127SKrish Sadhukhan 
829ad879127SKrish Sadhukhan 	if (cycles < latvmrun_min)
830ad879127SKrish Sadhukhan 		latvmrun_min = cycles;
831ad879127SKrish Sadhukhan 
832ad879127SKrish Sadhukhan 	vmrun_sum += cycles;
833ad879127SKrish Sadhukhan 
834ad879127SKrish Sadhukhan 	tsc_start = rdtsc();
835ad879127SKrish Sadhukhan 
836ad879127SKrish Sadhukhan 	asm volatile ("vmmcall" : : : "memory");
837ad879127SKrish Sadhukhan 	goto start;
838ad879127SKrish Sadhukhan }
839ad879127SKrish Sadhukhan 
840ad879127SKrish Sadhukhan static bool latency_finished(struct svm_test *test)
841ad879127SKrish Sadhukhan {
842ad879127SKrish Sadhukhan 	u64 cycles;
843ad879127SKrish Sadhukhan 
844ad879127SKrish Sadhukhan 	tsc_end = rdtsc();
845ad879127SKrish Sadhukhan 
846ad879127SKrish Sadhukhan 	cycles = tsc_end - tsc_start;
847ad879127SKrish Sadhukhan 
848ad879127SKrish Sadhukhan 	if (cycles > latvmexit_max)
849ad879127SKrish Sadhukhan 		latvmexit_max = cycles;
850ad879127SKrish Sadhukhan 
851ad879127SKrish Sadhukhan 	if (cycles < latvmexit_min)
852ad879127SKrish Sadhukhan 		latvmexit_min = cycles;
853ad879127SKrish Sadhukhan 
854ad879127SKrish Sadhukhan 	vmexit_sum += cycles;
855ad879127SKrish Sadhukhan 
856096cf7feSPaolo Bonzini 	vmcb->save.rip += 3;
857ad879127SKrish Sadhukhan 
858ad879127SKrish Sadhukhan 	runs -= 1;
859ad879127SKrish Sadhukhan 
860ad879127SKrish Sadhukhan 	tsc_end = rdtsc();
861ad879127SKrish Sadhukhan 
862ad879127SKrish Sadhukhan 	return runs == 0;
863ad879127SKrish Sadhukhan }
864ad879127SKrish Sadhukhan 
865f7fa53dcSPaolo Bonzini static bool latency_finished_clean(struct svm_test *test)
866f7fa53dcSPaolo Bonzini {
867f7fa53dcSPaolo Bonzini 	vmcb->control.clean = VMCB_CLEAN_ALL;
868f7fa53dcSPaolo Bonzini 	return latency_finished(test);
869f7fa53dcSPaolo Bonzini }
870f7fa53dcSPaolo Bonzini 
871ad879127SKrish Sadhukhan static bool latency_check(struct svm_test *test)
872ad879127SKrish Sadhukhan {
873ad879127SKrish Sadhukhan 	printf("    Latency VMRUN : max: %ld min: %ld avg: %ld\n", latvmrun_max,
874ad879127SKrish Sadhukhan 	       latvmrun_min, vmrun_sum / LATENCY_RUNS);
875ad879127SKrish Sadhukhan 	printf("    Latency VMEXIT: max: %ld min: %ld avg: %ld\n", latvmexit_max,
876ad879127SKrish Sadhukhan 	       latvmexit_min, vmexit_sum / LATENCY_RUNS);
877ad879127SKrish Sadhukhan 	return true;
878ad879127SKrish Sadhukhan }
879ad879127SKrish Sadhukhan 
880ad879127SKrish Sadhukhan static void lat_svm_insn_prepare(struct svm_test *test)
881ad879127SKrish Sadhukhan {
882ad879127SKrish Sadhukhan 	default_prepare(test);
883ad879127SKrish Sadhukhan 	runs = LATENCY_RUNS;
884ad879127SKrish Sadhukhan 	latvmload_min = latvmsave_min = latstgi_min = latclgi_min = -1ULL;
885ad879127SKrish Sadhukhan 	latvmload_max = latvmsave_max = latstgi_max = latclgi_max = 0;
886ad879127SKrish Sadhukhan 	vmload_sum = vmsave_sum = stgi_sum = clgi_sum;
887ad879127SKrish Sadhukhan }
888ad879127SKrish Sadhukhan 
889ad879127SKrish Sadhukhan static bool lat_svm_insn_finished(struct svm_test *test)
890ad879127SKrish Sadhukhan {
891096cf7feSPaolo Bonzini 	u64 vmcb_phys = virt_to_phys(vmcb);
892ad879127SKrish Sadhukhan 	u64 cycles;
893ad879127SKrish Sadhukhan 
894ad879127SKrish Sadhukhan 	for ( ; runs != 0; runs--) {
895ad879127SKrish Sadhukhan 		tsc_start = rdtsc();
896ad879127SKrish Sadhukhan 		asm volatile("vmload %0\n\t" : : "a"(vmcb_phys) : "memory");
897ad879127SKrish Sadhukhan 		cycles = rdtsc() - tsc_start;
898ad879127SKrish Sadhukhan 		if (cycles > latvmload_max)
899ad879127SKrish Sadhukhan 			latvmload_max = cycles;
900ad879127SKrish Sadhukhan 		if (cycles < latvmload_min)
901ad879127SKrish Sadhukhan 			latvmload_min = cycles;
902ad879127SKrish Sadhukhan 		vmload_sum += cycles;
903ad879127SKrish Sadhukhan 
904ad879127SKrish Sadhukhan 		tsc_start = rdtsc();
905ad879127SKrish Sadhukhan 		asm volatile("vmsave %0\n\t" : : "a"(vmcb_phys) : "memory");
906ad879127SKrish Sadhukhan 		cycles = rdtsc() - tsc_start;
907ad879127SKrish Sadhukhan 		if (cycles > latvmsave_max)
908ad879127SKrish Sadhukhan 			latvmsave_max = cycles;
909ad879127SKrish Sadhukhan 		if (cycles < latvmsave_min)
910ad879127SKrish Sadhukhan 			latvmsave_min = cycles;
911ad879127SKrish Sadhukhan 		vmsave_sum += cycles;
912ad879127SKrish Sadhukhan 
913ad879127SKrish Sadhukhan 		tsc_start = rdtsc();
914ad879127SKrish Sadhukhan 		asm volatile("stgi\n\t");
915ad879127SKrish Sadhukhan 		cycles = rdtsc() - tsc_start;
916ad879127SKrish Sadhukhan 		if (cycles > latstgi_max)
917ad879127SKrish Sadhukhan 			latstgi_max = cycles;
918ad879127SKrish Sadhukhan 		if (cycles < latstgi_min)
919ad879127SKrish Sadhukhan 			latstgi_min = cycles;
920ad879127SKrish Sadhukhan 		stgi_sum += cycles;
921ad879127SKrish Sadhukhan 
922ad879127SKrish Sadhukhan 		tsc_start = rdtsc();
923ad879127SKrish Sadhukhan 		asm volatile("clgi\n\t");
924ad879127SKrish Sadhukhan 		cycles = rdtsc() - tsc_start;
925ad879127SKrish Sadhukhan 		if (cycles > latclgi_max)
926ad879127SKrish Sadhukhan 			latclgi_max = cycles;
927ad879127SKrish Sadhukhan 		if (cycles < latclgi_min)
928ad879127SKrish Sadhukhan 			latclgi_min = cycles;
929ad879127SKrish Sadhukhan 		clgi_sum += cycles;
930ad879127SKrish Sadhukhan 	}
931ad879127SKrish Sadhukhan 
932ad879127SKrish Sadhukhan 	tsc_end = rdtsc();
933ad879127SKrish Sadhukhan 
934ad879127SKrish Sadhukhan 	return true;
935ad879127SKrish Sadhukhan }
936ad879127SKrish Sadhukhan 
937ad879127SKrish Sadhukhan static bool lat_svm_insn_check(struct svm_test *test)
938ad879127SKrish Sadhukhan {
939ad879127SKrish Sadhukhan 	printf("    Latency VMLOAD: max: %ld min: %ld avg: %ld\n", latvmload_max,
940ad879127SKrish Sadhukhan 	       latvmload_min, vmload_sum / LATENCY_RUNS);
941ad879127SKrish Sadhukhan 	printf("    Latency VMSAVE: max: %ld min: %ld avg: %ld\n", latvmsave_max,
942ad879127SKrish Sadhukhan 	       latvmsave_min, vmsave_sum / LATENCY_RUNS);
943ad879127SKrish Sadhukhan 	printf("    Latency STGI:   max: %ld min: %ld avg: %ld\n", latstgi_max,
944ad879127SKrish Sadhukhan 	       latstgi_min, stgi_sum / LATENCY_RUNS);
945ad879127SKrish Sadhukhan 	printf("    Latency CLGI:   max: %ld min: %ld avg: %ld\n", latclgi_max,
946ad879127SKrish Sadhukhan 	       latclgi_min, clgi_sum / LATENCY_RUNS);
947ad879127SKrish Sadhukhan 	return true;
948ad879127SKrish Sadhukhan }
949ad879127SKrish Sadhukhan 
950493d27d4SSean Christopherson /*
951493d27d4SSean Christopherson  * Report failures from SVM guest code, and on failure, set the stage to -1 and
952493d27d4SSean Christopherson  * do VMMCALL to terminate the test (host side must treat -1 as "finished").
953493d27d4SSean Christopherson  * TODO: fix the tests that don't play nice with a straight report, e.g. the
954493d27d4SSean Christopherson  * V_TPR test fails if report() is invoked.
955493d27d4SSean Christopherson  */
956493d27d4SSean Christopherson #define report_svm_guest(cond, test, fmt, args...)	\
957493d27d4SSean Christopherson do {							\
958493d27d4SSean Christopherson 	if (!(cond)) {					\
959493d27d4SSean Christopherson 		report_fail(fmt, ##args);		\
960493d27d4SSean Christopherson 		set_test_stage(test, -1);		\
961493d27d4SSean Christopherson 		vmmcall();				\
962493d27d4SSean Christopherson 	}						\
963493d27d4SSean Christopherson } while (0)
964493d27d4SSean Christopherson 
965ad879127SKrish Sadhukhan bool pending_event_ipi_fired;
966ad879127SKrish Sadhukhan bool pending_event_guest_run;
967ad879127SKrish Sadhukhan 
968ad879127SKrish Sadhukhan static void pending_event_ipi_isr(isr_regs_t *regs)
969ad879127SKrish Sadhukhan {
970ad879127SKrish Sadhukhan 	pending_event_ipi_fired = true;
971ad879127SKrish Sadhukhan 	eoi();
972ad879127SKrish Sadhukhan }
973ad879127SKrish Sadhukhan 
974ad879127SKrish Sadhukhan static void pending_event_prepare(struct svm_test *test)
975ad879127SKrish Sadhukhan {
976ad879127SKrish Sadhukhan 	int ipi_vector = 0xf1;
977ad879127SKrish Sadhukhan 
978ad879127SKrish Sadhukhan 	default_prepare(test);
979ad879127SKrish Sadhukhan 
980ad879127SKrish Sadhukhan 	pending_event_ipi_fired = false;
981ad879127SKrish Sadhukhan 
982ad879127SKrish Sadhukhan 	handle_irq(ipi_vector, pending_event_ipi_isr);
983ad879127SKrish Sadhukhan 
984ad879127SKrish Sadhukhan 	pending_event_guest_run = false;
985ad879127SKrish Sadhukhan 
986096cf7feSPaolo Bonzini 	vmcb->control.intercept |= (1ULL << INTERCEPT_INTR);
987096cf7feSPaolo Bonzini 	vmcb->control.int_ctl |= V_INTR_MASKING_MASK;
988ad879127SKrish Sadhukhan 
989ad879127SKrish Sadhukhan 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL |
990ad879127SKrish Sadhukhan 		       APIC_DM_FIXED | ipi_vector, 0);
991ad879127SKrish Sadhukhan 
992ad879127SKrish Sadhukhan 	set_test_stage(test, 0);
993ad879127SKrish Sadhukhan }
994ad879127SKrish Sadhukhan 
995ad879127SKrish Sadhukhan static void pending_event_test(struct svm_test *test)
996ad879127SKrish Sadhukhan {
997ad879127SKrish Sadhukhan 	pending_event_guest_run = true;
998ad879127SKrish Sadhukhan }
999ad879127SKrish Sadhukhan 
1000ad879127SKrish Sadhukhan static bool pending_event_finished(struct svm_test *test)
1001ad879127SKrish Sadhukhan {
1002ad879127SKrish Sadhukhan 	switch (get_test_stage(test)) {
1003ad879127SKrish Sadhukhan 	case 0:
1004096cf7feSPaolo Bonzini 		if (vmcb->control.exit_code != SVM_EXIT_INTR) {
1005198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to pending interrupt. Exit reason 0x%x",
1006096cf7feSPaolo Bonzini 				    vmcb->control.exit_code);
1007ad879127SKrish Sadhukhan 			return true;
1008ad879127SKrish Sadhukhan 		}
1009ad879127SKrish Sadhukhan 
1010096cf7feSPaolo Bonzini 		vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR);
1011096cf7feSPaolo Bonzini 		vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
1012ad879127SKrish Sadhukhan 
1013ad879127SKrish Sadhukhan 		if (pending_event_guest_run) {
1014198dfd0eSJanis Schoetterl-Glausch 			report_fail("Guest ran before host received IPI\n");
1015ad879127SKrish Sadhukhan 			return true;
1016ad879127SKrish Sadhukhan 		}
1017ad879127SKrish Sadhukhan 
1018ad879127SKrish Sadhukhan 		irq_enable();
1019ad879127SKrish Sadhukhan 		asm volatile ("nop");
1020ad879127SKrish Sadhukhan 		irq_disable();
1021ad879127SKrish Sadhukhan 
1022ad879127SKrish Sadhukhan 		if (!pending_event_ipi_fired) {
1023198dfd0eSJanis Schoetterl-Glausch 			report_fail("Pending interrupt not dispatched after IRQ enabled\n");
1024ad879127SKrish Sadhukhan 			return true;
1025ad879127SKrish Sadhukhan 		}
1026ad879127SKrish Sadhukhan 		break;
1027ad879127SKrish Sadhukhan 
1028ad879127SKrish Sadhukhan 	case 1:
1029ad879127SKrish Sadhukhan 		if (!pending_event_guest_run) {
1030198dfd0eSJanis Schoetterl-Glausch 			report_fail("Guest did not resume when no interrupt\n");
1031ad879127SKrish Sadhukhan 			return true;
1032ad879127SKrish Sadhukhan 		}
1033ad879127SKrish Sadhukhan 		break;
1034ad879127SKrish Sadhukhan 	}
1035ad879127SKrish Sadhukhan 
1036ad879127SKrish Sadhukhan 	inc_test_stage(test);
1037ad879127SKrish Sadhukhan 
1038ad879127SKrish Sadhukhan 	return get_test_stage(test) == 2;
1039ad879127SKrish Sadhukhan }
1040ad879127SKrish Sadhukhan 
1041ad879127SKrish Sadhukhan static bool pending_event_check(struct svm_test *test)
1042ad879127SKrish Sadhukhan {
1043ad879127SKrish Sadhukhan 	return get_test_stage(test) == 2;
1044ad879127SKrish Sadhukhan }
1045ad879127SKrish Sadhukhan 
104685dc2aceSPaolo Bonzini static void pending_event_cli_prepare(struct svm_test *test)
1047ad879127SKrish Sadhukhan {
1048ad879127SKrish Sadhukhan 	default_prepare(test);
1049ad879127SKrish Sadhukhan 
1050ad879127SKrish Sadhukhan 	pending_event_ipi_fired = false;
1051ad879127SKrish Sadhukhan 
1052ad879127SKrish Sadhukhan 	handle_irq(0xf1, pending_event_ipi_isr);
1053ad879127SKrish Sadhukhan 
1054ad879127SKrish Sadhukhan 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL |
1055ad879127SKrish Sadhukhan 		       APIC_DM_FIXED | 0xf1, 0);
1056ad879127SKrish Sadhukhan 
1057ad879127SKrish Sadhukhan 	set_test_stage(test, 0);
1058ad879127SKrish Sadhukhan }
1059ad879127SKrish Sadhukhan 
106085dc2aceSPaolo Bonzini static void pending_event_cli_prepare_gif_clear(struct svm_test *test)
1061ad879127SKrish Sadhukhan {
1062ad879127SKrish Sadhukhan 	asm("cli");
1063ad879127SKrish Sadhukhan }
1064ad879127SKrish Sadhukhan 
106585dc2aceSPaolo Bonzini static void pending_event_cli_test(struct svm_test *test)
1066ad879127SKrish Sadhukhan {
1067493d27d4SSean Christopherson 	report_svm_guest(!pending_event_ipi_fired, test,
1068493d27d4SSean Christopherson 			 "IRQ should NOT be delivered while IRQs disabled");
1069ad879127SKrish Sadhukhan 
107085dc2aceSPaolo Bonzini 	/* VINTR_MASKING is zero.  This should cause the IPI to fire.  */
1071ad879127SKrish Sadhukhan 	irq_enable();
1072ad879127SKrish Sadhukhan 	asm volatile ("nop");
1073ad879127SKrish Sadhukhan 	irq_disable();
1074ad879127SKrish Sadhukhan 
1075493d27d4SSean Christopherson 	report_svm_guest(pending_event_ipi_fired, test,
1076493d27d4SSean Christopherson 			 "IRQ should be delivered after enabling IRQs");
1077ad879127SKrish Sadhukhan 	vmmcall();
1078ad879127SKrish Sadhukhan 
107985dc2aceSPaolo Bonzini 	/*
108085dc2aceSPaolo Bonzini 	 * Now VINTR_MASKING=1, but no interrupt is pending so
108185dc2aceSPaolo Bonzini 	 * the VINTR interception should be clear in VMCB02.  Check
108285dc2aceSPaolo Bonzini 	 * that L0 did not leave a stale VINTR in the VMCB.
108385dc2aceSPaolo Bonzini 	 */
1084ad879127SKrish Sadhukhan 	irq_enable();
1085ad879127SKrish Sadhukhan 	asm volatile ("nop");
1086ad879127SKrish Sadhukhan 	irq_disable();
1087ad879127SKrish Sadhukhan }
1088ad879127SKrish Sadhukhan 
108985dc2aceSPaolo Bonzini static bool pending_event_cli_finished(struct svm_test *test)
1090ad879127SKrish Sadhukhan {
1091493d27d4SSean Christopherson 	report_svm_guest(vmcb->control.exit_code == SVM_EXIT_VMMCALL, test,
1092493d27d4SSean Christopherson 			 "Wanted VMMCALL VM-Exit, got exit reason 0x%x",
1093096cf7feSPaolo Bonzini 			 vmcb->control.exit_code);
1094ad879127SKrish Sadhukhan 
1095ad879127SKrish Sadhukhan 	switch (get_test_stage(test)) {
1096ad879127SKrish Sadhukhan 	case 0:
1097096cf7feSPaolo Bonzini 		vmcb->save.rip += 3;
1098ad879127SKrish Sadhukhan 
1099ad879127SKrish Sadhukhan 		pending_event_ipi_fired = false;
1100ad879127SKrish Sadhukhan 
1101096cf7feSPaolo Bonzini 		vmcb->control.int_ctl |= V_INTR_MASKING_MASK;
1102ad879127SKrish Sadhukhan 
110385dc2aceSPaolo Bonzini 		/* Now entering again with VINTR_MASKING=1.  */
1104ad879127SKrish Sadhukhan 		apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL |
1105ad879127SKrish Sadhukhan 			       APIC_DM_FIXED | 0xf1, 0);
1106ad879127SKrish Sadhukhan 
1107ad879127SKrish Sadhukhan 		break;
1108ad879127SKrish Sadhukhan 
1109ad879127SKrish Sadhukhan 	case 1:
1110ad879127SKrish Sadhukhan 		if (pending_event_ipi_fired == true) {
1111198dfd0eSJanis Schoetterl-Glausch 			report_fail("Interrupt triggered by guest");
1112ad879127SKrish Sadhukhan 			return true;
1113ad879127SKrish Sadhukhan 		}
1114ad879127SKrish Sadhukhan 
1115ad879127SKrish Sadhukhan 		irq_enable();
1116ad879127SKrish Sadhukhan 		asm volatile ("nop");
1117ad879127SKrish Sadhukhan 		irq_disable();
1118ad879127SKrish Sadhukhan 
1119ad879127SKrish Sadhukhan 		if (pending_event_ipi_fired != true) {
1120198dfd0eSJanis Schoetterl-Glausch 			report_fail("Interrupt not triggered by host");
1121ad879127SKrish Sadhukhan 			return true;
1122ad879127SKrish Sadhukhan 		}
1123ad879127SKrish Sadhukhan 
1124ad879127SKrish Sadhukhan 		break;
1125ad879127SKrish Sadhukhan 
1126ad879127SKrish Sadhukhan 	default:
1127ad879127SKrish Sadhukhan 		return true;
1128ad879127SKrish Sadhukhan 	}
1129ad879127SKrish Sadhukhan 
1130ad879127SKrish Sadhukhan 	inc_test_stage(test);
1131ad879127SKrish Sadhukhan 
1132ad879127SKrish Sadhukhan 	return get_test_stage(test) == 2;
1133ad879127SKrish Sadhukhan }
1134ad879127SKrish Sadhukhan 
113585dc2aceSPaolo Bonzini static bool pending_event_cli_check(struct svm_test *test)
1136ad879127SKrish Sadhukhan {
1137ad879127SKrish Sadhukhan 	return get_test_stage(test) == 2;
1138ad879127SKrish Sadhukhan }
1139ad879127SKrish Sadhukhan 
114085dc2aceSPaolo Bonzini #define TIMER_VECTOR    222
114185dc2aceSPaolo Bonzini 
114285dc2aceSPaolo Bonzini static volatile bool timer_fired;
114385dc2aceSPaolo Bonzini 
114485dc2aceSPaolo Bonzini static void timer_isr(isr_regs_t *regs)
114585dc2aceSPaolo Bonzini {
114685dc2aceSPaolo Bonzini 	timer_fired = true;
114785dc2aceSPaolo Bonzini 	apic_write(APIC_EOI, 0);
114885dc2aceSPaolo Bonzini }
114985dc2aceSPaolo Bonzini 
115085dc2aceSPaolo Bonzini static void interrupt_prepare(struct svm_test *test)
115185dc2aceSPaolo Bonzini {
115285dc2aceSPaolo Bonzini 	default_prepare(test);
115385dc2aceSPaolo Bonzini 	handle_irq(TIMER_VECTOR, timer_isr);
115485dc2aceSPaolo Bonzini 	timer_fired = false;
115585dc2aceSPaolo Bonzini 	set_test_stage(test, 0);
115685dc2aceSPaolo Bonzini }
115785dc2aceSPaolo Bonzini 
115885dc2aceSPaolo Bonzini static void interrupt_test(struct svm_test *test)
115985dc2aceSPaolo Bonzini {
116085dc2aceSPaolo Bonzini 	long long start, loops;
116185dc2aceSPaolo Bonzini 
116285dc2aceSPaolo Bonzini 	apic_write(APIC_LVTT, TIMER_VECTOR);
116385dc2aceSPaolo Bonzini 	irq_enable();
116485dc2aceSPaolo Bonzini 	apic_write(APIC_TMICT, 1); //Timer Initial Count Register 0x380 one-shot
116585dc2aceSPaolo Bonzini 	for (loops = 0; loops < 10000000 && !timer_fired; loops++)
116685dc2aceSPaolo Bonzini 		asm volatile ("nop");
116785dc2aceSPaolo Bonzini 
1168493d27d4SSean Christopherson 	report_svm_guest(timer_fired, test,
1169493d27d4SSean Christopherson 			 "direct interrupt while running guest");
117085dc2aceSPaolo Bonzini 
117185dc2aceSPaolo Bonzini 	apic_write(APIC_TMICT, 0);
117285dc2aceSPaolo Bonzini 	irq_disable();
117385dc2aceSPaolo Bonzini 	vmmcall();
117485dc2aceSPaolo Bonzini 
117585dc2aceSPaolo Bonzini 	timer_fired = false;
117685dc2aceSPaolo Bonzini 	apic_write(APIC_TMICT, 1);
117785dc2aceSPaolo Bonzini 	for (loops = 0; loops < 10000000 && !timer_fired; loops++)
117885dc2aceSPaolo Bonzini 		asm volatile ("nop");
117985dc2aceSPaolo Bonzini 
1180493d27d4SSean Christopherson 	report_svm_guest(timer_fired, test,
1181493d27d4SSean Christopherson 			 "intercepted interrupt while running guest");
118285dc2aceSPaolo Bonzini 
118385dc2aceSPaolo Bonzini 	irq_enable();
118485dc2aceSPaolo Bonzini 	apic_write(APIC_TMICT, 0);
118585dc2aceSPaolo Bonzini 	irq_disable();
118685dc2aceSPaolo Bonzini 
118785dc2aceSPaolo Bonzini 	timer_fired = false;
118885dc2aceSPaolo Bonzini 	start = rdtsc();
118985dc2aceSPaolo Bonzini 	apic_write(APIC_TMICT, 1000000);
1190a3001422SOliver Upton 	safe_halt();
119185dc2aceSPaolo Bonzini 
1192493d27d4SSean Christopherson 	report_svm_guest(timer_fired, test, "direct interrupt + hlt");
1193493d27d4SSean Christopherson 	report(rdtsc() - start > 10000, "IRQ arrived after expected delay");
119485dc2aceSPaolo Bonzini 
119585dc2aceSPaolo Bonzini 	apic_write(APIC_TMICT, 0);
119685dc2aceSPaolo Bonzini 	irq_disable();
119785dc2aceSPaolo Bonzini 	vmmcall();
119885dc2aceSPaolo Bonzini 
119985dc2aceSPaolo Bonzini 	timer_fired = false;
120085dc2aceSPaolo Bonzini 	start = rdtsc();
120185dc2aceSPaolo Bonzini 	apic_write(APIC_TMICT, 1000000);
120285dc2aceSPaolo Bonzini 	asm volatile ("hlt");
120385dc2aceSPaolo Bonzini 
1204493d27d4SSean Christopherson 	report_svm_guest(timer_fired, test, "intercepted interrupt + hlt");
1205493d27d4SSean Christopherson 	report(rdtsc() - start > 10000, "IRQ arrived after expected delay");
120685dc2aceSPaolo Bonzini 
120785dc2aceSPaolo Bonzini 	apic_write(APIC_TMICT, 0);
120885dc2aceSPaolo Bonzini 	irq_disable();
120985dc2aceSPaolo Bonzini }
121085dc2aceSPaolo Bonzini 
121185dc2aceSPaolo Bonzini static bool interrupt_finished(struct svm_test *test)
121285dc2aceSPaolo Bonzini {
121385dc2aceSPaolo Bonzini 	switch (get_test_stage(test)) {
121485dc2aceSPaolo Bonzini 	case 0:
121585dc2aceSPaolo Bonzini 	case 2:
1216096cf7feSPaolo Bonzini 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1217198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
1218096cf7feSPaolo Bonzini 				    vmcb->control.exit_code);
121985dc2aceSPaolo Bonzini 			return true;
122085dc2aceSPaolo Bonzini 		}
1221096cf7feSPaolo Bonzini 		vmcb->save.rip += 3;
122285dc2aceSPaolo Bonzini 
1223096cf7feSPaolo Bonzini 		vmcb->control.intercept |= (1ULL << INTERCEPT_INTR);
1224096cf7feSPaolo Bonzini 		vmcb->control.int_ctl |= V_INTR_MASKING_MASK;
122585dc2aceSPaolo Bonzini 		break;
122685dc2aceSPaolo Bonzini 
122785dc2aceSPaolo Bonzini 	case 1:
122885dc2aceSPaolo Bonzini 	case 3:
1229096cf7feSPaolo Bonzini 		if (vmcb->control.exit_code != SVM_EXIT_INTR) {
1230198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to intr intercept. Exit reason 0x%x",
1231096cf7feSPaolo Bonzini 				    vmcb->control.exit_code);
123285dc2aceSPaolo Bonzini 			return true;
123385dc2aceSPaolo Bonzini 		}
123485dc2aceSPaolo Bonzini 
123585dc2aceSPaolo Bonzini 		irq_enable();
123685dc2aceSPaolo Bonzini 		asm volatile ("nop");
123785dc2aceSPaolo Bonzini 		irq_disable();
123885dc2aceSPaolo Bonzini 
1239096cf7feSPaolo Bonzini 		vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR);
1240096cf7feSPaolo Bonzini 		vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
124185dc2aceSPaolo Bonzini 		break;
124285dc2aceSPaolo Bonzini 
124385dc2aceSPaolo Bonzini 	case 4:
124485dc2aceSPaolo Bonzini 		break;
124585dc2aceSPaolo Bonzini 
124685dc2aceSPaolo Bonzini 	default:
124785dc2aceSPaolo Bonzini 		return true;
124885dc2aceSPaolo Bonzini 	}
124985dc2aceSPaolo Bonzini 
125085dc2aceSPaolo Bonzini 	inc_test_stage(test);
125185dc2aceSPaolo Bonzini 
125285dc2aceSPaolo Bonzini 	return get_test_stage(test) == 5;
125385dc2aceSPaolo Bonzini }
125485dc2aceSPaolo Bonzini 
125585dc2aceSPaolo Bonzini static bool interrupt_check(struct svm_test *test)
125685dc2aceSPaolo Bonzini {
125785dc2aceSPaolo Bonzini 	return get_test_stage(test) == 5;
125885dc2aceSPaolo Bonzini }
125985dc2aceSPaolo Bonzini 
1260d4db486bSCathy Avery static volatile bool nmi_fired;
1261d4db486bSCathy Avery 
12624a1207f6SMaxim Levitsky static void nmi_handler(struct ex_regs *regs)
1263d4db486bSCathy Avery {
1264d4db486bSCathy Avery 	nmi_fired = true;
1265d4db486bSCathy Avery }
1266d4db486bSCathy Avery 
1267d4db486bSCathy Avery static void nmi_prepare(struct svm_test *test)
1268d4db486bSCathy Avery {
1269d4db486bSCathy Avery 	default_prepare(test);
1270d4db486bSCathy Avery 	nmi_fired = false;
12714a1207f6SMaxim Levitsky 	handle_exception(NMI_VECTOR, nmi_handler);
1272d4db486bSCathy Avery 	set_test_stage(test, 0);
1273d4db486bSCathy Avery }
1274d4db486bSCathy Avery 
1275d4db486bSCathy Avery static void nmi_test(struct svm_test *test)
1276d4db486bSCathy Avery {
1277d4db486bSCathy Avery 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0);
1278d4db486bSCathy Avery 
1279493d27d4SSean Christopherson 	report_svm_guest(nmi_fired, test, "direct NMI while running guest");
1280d4db486bSCathy Avery 
1281d4db486bSCathy Avery 	vmmcall();
1282d4db486bSCathy Avery 
1283d4db486bSCathy Avery 	nmi_fired = false;
1284d4db486bSCathy Avery 
1285d4db486bSCathy Avery 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0);
1286d4db486bSCathy Avery 
1287493d27d4SSean Christopherson 	report_svm_guest(nmi_fired, test, "intercepted pending NMI delivered to guest");
1288d4db486bSCathy Avery }
1289d4db486bSCathy Avery 
1290d4db486bSCathy Avery static bool nmi_finished(struct svm_test *test)
1291d4db486bSCathy Avery {
1292d4db486bSCathy Avery 	switch (get_test_stage(test)) {
1293d4db486bSCathy Avery 	case 0:
1294d4db486bSCathy Avery 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1295198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
1296d4db486bSCathy Avery 				    vmcb->control.exit_code);
1297d4db486bSCathy Avery 			return true;
1298d4db486bSCathy Avery 		}
1299d4db486bSCathy Avery 		vmcb->save.rip += 3;
1300d4db486bSCathy Avery 
1301d4db486bSCathy Avery 		vmcb->control.intercept |= (1ULL << INTERCEPT_NMI);
1302d4db486bSCathy Avery 		break;
1303d4db486bSCathy Avery 
1304d4db486bSCathy Avery 	case 1:
1305d4db486bSCathy Avery 		if (vmcb->control.exit_code != SVM_EXIT_NMI) {
1306198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to NMI intercept. Exit reason 0x%x",
1307d4db486bSCathy Avery 				    vmcb->control.exit_code);
1308d4db486bSCathy Avery 			return true;
1309d4db486bSCathy Avery 		}
1310d4db486bSCathy Avery 
13115c3582f0SJanis Schoetterl-Glausch 		report_pass("NMI intercept while running guest");
1312d4db486bSCathy Avery 		break;
1313d4db486bSCathy Avery 
1314d4db486bSCathy Avery 	case 2:
1315d4db486bSCathy Avery 		break;
1316d4db486bSCathy Avery 
1317d4db486bSCathy Avery 	default:
1318d4db486bSCathy Avery 		return true;
1319d4db486bSCathy Avery 	}
1320d4db486bSCathy Avery 
1321d4db486bSCathy Avery 	inc_test_stage(test);
1322d4db486bSCathy Avery 
1323d4db486bSCathy Avery 	return get_test_stage(test) == 3;
1324d4db486bSCathy Avery }
1325d4db486bSCathy Avery 
1326d4db486bSCathy Avery static bool nmi_check(struct svm_test *test)
1327d4db486bSCathy Avery {
1328d4db486bSCathy Avery 	return get_test_stage(test) == 3;
1329d4db486bSCathy Avery }
1330d4db486bSCathy Avery 
13319da1f4d8SCathy Avery #define NMI_DELAY 100000000ULL
13329da1f4d8SCathy Avery 
13339da1f4d8SCathy Avery static void nmi_message_thread(void *_test)
13349da1f4d8SCathy Avery {
13359da1f4d8SCathy Avery 	struct svm_test *test = _test;
13369da1f4d8SCathy Avery 
13379da1f4d8SCathy Avery 	while (get_test_stage(test) != 1)
13389da1f4d8SCathy Avery 		pause();
13399da1f4d8SCathy Avery 
13409da1f4d8SCathy Avery 	delay(NMI_DELAY);
13419da1f4d8SCathy Avery 
13429da1f4d8SCathy Avery 	apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]);
13439da1f4d8SCathy Avery 
13449da1f4d8SCathy Avery 	while (get_test_stage(test) != 2)
13459da1f4d8SCathy Avery 		pause();
13469da1f4d8SCathy Avery 
13479da1f4d8SCathy Avery 	delay(NMI_DELAY);
13489da1f4d8SCathy Avery 
13499da1f4d8SCathy Avery 	apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]);
13509da1f4d8SCathy Avery }
13519da1f4d8SCathy Avery 
13529da1f4d8SCathy Avery static void nmi_hlt_test(struct svm_test *test)
13539da1f4d8SCathy Avery {
13549da1f4d8SCathy Avery 	long long start;
13559da1f4d8SCathy Avery 
13569da1f4d8SCathy Avery 	on_cpu_async(1, nmi_message_thread, test);
13579da1f4d8SCathy Avery 
13589da1f4d8SCathy Avery 	start = rdtsc();
13599da1f4d8SCathy Avery 
13609da1f4d8SCathy Avery 	set_test_stage(test, 1);
13619da1f4d8SCathy Avery 
13629da1f4d8SCathy Avery 	asm volatile ("hlt");
13639da1f4d8SCathy Avery 
1364493d27d4SSean Christopherson 	report_svm_guest(nmi_fired, test, "direct NMI + hlt");
1365493d27d4SSean Christopherson 	report(rdtsc() - start > NMI_DELAY, "direct NMI after expected delay");
13669da1f4d8SCathy Avery 
13679da1f4d8SCathy Avery 	nmi_fired = false;
13689da1f4d8SCathy Avery 
13699da1f4d8SCathy Avery 	vmmcall();
13709da1f4d8SCathy Avery 
13719da1f4d8SCathy Avery 	start = rdtsc();
13729da1f4d8SCathy Avery 
13739da1f4d8SCathy Avery 	set_test_stage(test, 2);
13749da1f4d8SCathy Avery 
13759da1f4d8SCathy Avery 	asm volatile ("hlt");
13769da1f4d8SCathy Avery 
1377493d27d4SSean Christopherson 	report_svm_guest(nmi_fired, test, "intercepted NMI + hlt");
1378493d27d4SSean Christopherson 	report(rdtsc() - start > NMI_DELAY, "intercepted NMI after expected delay");
13799da1f4d8SCathy Avery 
13809da1f4d8SCathy Avery 	set_test_stage(test, 3);
13819da1f4d8SCathy Avery }
13829da1f4d8SCathy Avery 
13839da1f4d8SCathy Avery static bool nmi_hlt_finished(struct svm_test *test)
13849da1f4d8SCathy Avery {
13859da1f4d8SCathy Avery 	switch (get_test_stage(test)) {
13869da1f4d8SCathy Avery 	case 1:
13879da1f4d8SCathy Avery 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1388198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
13899da1f4d8SCathy Avery 				    vmcb->control.exit_code);
13909da1f4d8SCathy Avery 			return true;
13919da1f4d8SCathy Avery 		}
13929da1f4d8SCathy Avery 		vmcb->save.rip += 3;
13939da1f4d8SCathy Avery 
13949da1f4d8SCathy Avery 		vmcb->control.intercept |= (1ULL << INTERCEPT_NMI);
13959da1f4d8SCathy Avery 		break;
13969da1f4d8SCathy Avery 
13979da1f4d8SCathy Avery 	case 2:
13989da1f4d8SCathy Avery 		if (vmcb->control.exit_code != SVM_EXIT_NMI) {
1399198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to NMI intercept. Exit reason 0x%x",
14009da1f4d8SCathy Avery 				    vmcb->control.exit_code);
14019da1f4d8SCathy Avery 			return true;
14029da1f4d8SCathy Avery 		}
14039da1f4d8SCathy Avery 
14045c3582f0SJanis Schoetterl-Glausch 		report_pass("NMI intercept while running guest");
14059da1f4d8SCathy Avery 		break;
14069da1f4d8SCathy Avery 
14079da1f4d8SCathy Avery 	case 3:
14089da1f4d8SCathy Avery 		break;
14099da1f4d8SCathy Avery 
14109da1f4d8SCathy Avery 	default:
14119da1f4d8SCathy Avery 		return true;
14129da1f4d8SCathy Avery 	}
14139da1f4d8SCathy Avery 
14149da1f4d8SCathy Avery 	return get_test_stage(test) == 3;
14159da1f4d8SCathy Avery }
14169da1f4d8SCathy Avery 
14179da1f4d8SCathy Avery static bool nmi_hlt_check(struct svm_test *test)
14189da1f4d8SCathy Avery {
14199da1f4d8SCathy Avery 	return get_test_stage(test) == 3;
14209da1f4d8SCathy Avery }
14219da1f4d8SCathy Avery 
142208200397SSantosh Shukla static void vnmi_prepare(struct svm_test *test)
142308200397SSantosh Shukla {
142408200397SSantosh Shukla 	nmi_prepare(test);
142508200397SSantosh Shukla 
142608200397SSantosh Shukla 	/*
142708200397SSantosh Shukla 	 * Disable NMI interception to start.  Enabling vNMI without
142808200397SSantosh Shukla 	 * intercepting "real" NMIs should result in an ERR VM-Exit.
142908200397SSantosh Shukla 	 */
143008200397SSantosh Shukla 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_NMI);
143108200397SSantosh Shukla 	vmcb->control.int_ctl = V_NMI_ENABLE_MASK;
143208200397SSantosh Shukla 	vmcb->control.int_vector = NMI_VECTOR;
143308200397SSantosh Shukla }
143408200397SSantosh Shukla 
143508200397SSantosh Shukla static void vnmi_test(struct svm_test *test)
143608200397SSantosh Shukla {
143708200397SSantosh Shukla 	report_svm_guest(!nmi_fired, test, "No vNMI before injection");
143808200397SSantosh Shukla 	vmmcall();
143908200397SSantosh Shukla 
144008200397SSantosh Shukla 	report_svm_guest(nmi_fired, test, "vNMI delivered after injection");
144108200397SSantosh Shukla 	vmmcall();
144208200397SSantosh Shukla }
144308200397SSantosh Shukla 
144408200397SSantosh Shukla static bool vnmi_finished(struct svm_test *test)
144508200397SSantosh Shukla {
144608200397SSantosh Shukla 	switch (get_test_stage(test)) {
144708200397SSantosh Shukla 	case 0:
144808200397SSantosh Shukla 		if (vmcb->control.exit_code != SVM_EXIT_ERR) {
144908200397SSantosh Shukla 			report_fail("Wanted ERR VM-Exit, got 0x%x",
145008200397SSantosh Shukla 				    vmcb->control.exit_code);
145108200397SSantosh Shukla 			return true;
145208200397SSantosh Shukla 		}
145308200397SSantosh Shukla 		report(!nmi_fired, "vNMI enabled but NMI_INTERCEPT unset!");
145408200397SSantosh Shukla 		vmcb->control.intercept |= (1ULL << INTERCEPT_NMI);
145508200397SSantosh Shukla 		vmcb->save.rip += 3;
145608200397SSantosh Shukla 		break;
145708200397SSantosh Shukla 
145808200397SSantosh Shukla 	case 1:
145908200397SSantosh Shukla 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
146008200397SSantosh Shukla 			report_fail("Wanted VMMCALL VM-Exit, got 0x%x",
146108200397SSantosh Shukla 				    vmcb->control.exit_code);
146208200397SSantosh Shukla 			return true;
146308200397SSantosh Shukla 		}
146408200397SSantosh Shukla 		report(!nmi_fired, "vNMI with vector 2 not injected");
146508200397SSantosh Shukla 		vmcb->control.int_ctl |= V_NMI_PENDING_MASK;
146608200397SSantosh Shukla 		vmcb->save.rip += 3;
146708200397SSantosh Shukla 		break;
146808200397SSantosh Shukla 
146908200397SSantosh Shukla 	case 2:
147008200397SSantosh Shukla 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
147108200397SSantosh Shukla 			report_fail("Wanted VMMCALL VM-Exit, got 0x%x",
147208200397SSantosh Shukla 				    vmcb->control.exit_code);
147308200397SSantosh Shukla 			return true;
147408200397SSantosh Shukla 		}
147508200397SSantosh Shukla 		if (vmcb->control.int_ctl & V_NMI_BLOCKING_MASK) {
147608200397SSantosh Shukla 			report_fail("V_NMI_BLOCKING_MASK not cleared on VMEXIT");
147708200397SSantosh Shukla 			return true;
147808200397SSantosh Shukla 		}
147908200397SSantosh Shukla 		report_pass("VNMI serviced");
148008200397SSantosh Shukla 		vmcb->save.rip += 3;
148108200397SSantosh Shukla 		break;
148208200397SSantosh Shukla 
148308200397SSantosh Shukla 	default:
148408200397SSantosh Shukla 		return true;
148508200397SSantosh Shukla 	}
148608200397SSantosh Shukla 
148708200397SSantosh Shukla 	inc_test_stage(test);
148808200397SSantosh Shukla 
148908200397SSantosh Shukla 	return get_test_stage(test) == 3;
149008200397SSantosh Shukla }
149108200397SSantosh Shukla 
149208200397SSantosh Shukla static bool vnmi_check(struct svm_test *test)
149308200397SSantosh Shukla {
149408200397SSantosh Shukla 	return get_test_stage(test) == 3;
149508200397SSantosh Shukla }
149608200397SSantosh Shukla 
14974b4fb247SPaolo Bonzini static volatile int count_exc = 0;
14984b4fb247SPaolo Bonzini 
14994b4fb247SPaolo Bonzini static void my_isr(struct ex_regs *r)
15004b4fb247SPaolo Bonzini {
15014b4fb247SPaolo Bonzini 	count_exc++;
15024b4fb247SPaolo Bonzini }
15034b4fb247SPaolo Bonzini 
15044b4fb247SPaolo Bonzini static void exc_inject_prepare(struct svm_test *test)
15054b4fb247SPaolo Bonzini {
15068634a266SPaolo Bonzini 	default_prepare(test);
15074b4fb247SPaolo Bonzini 	handle_exception(DE_VECTOR, my_isr);
15084b4fb247SPaolo Bonzini 	handle_exception(NMI_VECTOR, my_isr);
15094b4fb247SPaolo Bonzini }
15104b4fb247SPaolo Bonzini 
15114b4fb247SPaolo Bonzini 
15124b4fb247SPaolo Bonzini static void exc_inject_test(struct svm_test *test)
15134b4fb247SPaolo Bonzini {
15144b4fb247SPaolo Bonzini 	asm volatile ("vmmcall\n\tvmmcall\n\t");
15154b4fb247SPaolo Bonzini }
15164b4fb247SPaolo Bonzini 
15174b4fb247SPaolo Bonzini static bool exc_inject_finished(struct svm_test *test)
15184b4fb247SPaolo Bonzini {
15194b4fb247SPaolo Bonzini 	switch (get_test_stage(test)) {
15204b4fb247SPaolo Bonzini 	case 0:
15214b4fb247SPaolo Bonzini 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1522198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
15234b4fb247SPaolo Bonzini 				    vmcb->control.exit_code);
15244b4fb247SPaolo Bonzini 			return true;
15254b4fb247SPaolo Bonzini 		}
15262c1ca866SNadav Amit 		vmcb->save.rip += 3;
15274b4fb247SPaolo Bonzini 		vmcb->control.event_inj = NMI_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID;
15284b4fb247SPaolo Bonzini 		break;
15294b4fb247SPaolo Bonzini 
15304b4fb247SPaolo Bonzini 	case 1:
15314b4fb247SPaolo Bonzini 		if (vmcb->control.exit_code != SVM_EXIT_ERR) {
1532198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to error. Exit reason 0x%x",
15334b4fb247SPaolo Bonzini 				    vmcb->control.exit_code);
15344b4fb247SPaolo Bonzini 			return true;
15354b4fb247SPaolo Bonzini 		}
15364b4fb247SPaolo Bonzini 		report(count_exc == 0, "exception with vector 2 not injected");
15374b4fb247SPaolo Bonzini 		vmcb->control.event_inj = DE_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID;
15384b4fb247SPaolo Bonzini 		break;
15394b4fb247SPaolo Bonzini 
15404b4fb247SPaolo Bonzini 	case 2:
15414b4fb247SPaolo Bonzini 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1542198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
15434b4fb247SPaolo Bonzini 				    vmcb->control.exit_code);
15444b4fb247SPaolo Bonzini 			return true;
15454b4fb247SPaolo Bonzini 		}
15462c1ca866SNadav Amit 		vmcb->save.rip += 3;
15474b4fb247SPaolo Bonzini 		report(count_exc == 1, "divide overflow exception injected");
15484b4fb247SPaolo Bonzini 		report(!(vmcb->control.event_inj & SVM_EVTINJ_VALID), "eventinj.VALID cleared");
15494b4fb247SPaolo Bonzini 		break;
15504b4fb247SPaolo Bonzini 
15514b4fb247SPaolo Bonzini 	default:
15524b4fb247SPaolo Bonzini 		return true;
15534b4fb247SPaolo Bonzini 	}
15544b4fb247SPaolo Bonzini 
15554b4fb247SPaolo Bonzini 	inc_test_stage(test);
15564b4fb247SPaolo Bonzini 
15574b4fb247SPaolo Bonzini 	return get_test_stage(test) == 3;
15584b4fb247SPaolo Bonzini }
15594b4fb247SPaolo Bonzini 
15604b4fb247SPaolo Bonzini static bool exc_inject_check(struct svm_test *test)
15614b4fb247SPaolo Bonzini {
15624b4fb247SPaolo Bonzini 	return count_exc == 1 && get_test_stage(test) == 3;
15634b4fb247SPaolo Bonzini }
15644b4fb247SPaolo Bonzini 
15659c838954SCathy Avery static volatile bool virq_fired;
15669c838954SCathy Avery 
15679c838954SCathy Avery static void virq_isr(isr_regs_t *regs)
15689c838954SCathy Avery {
15699c838954SCathy Avery 	virq_fired = true;
15709c838954SCathy Avery }
15719c838954SCathy Avery 
15729c838954SCathy Avery static void virq_inject_prepare(struct svm_test *test)
15739c838954SCathy Avery {
15749c838954SCathy Avery 	handle_irq(0xf1, virq_isr);
15759c838954SCathy Avery 	default_prepare(test);
15769c838954SCathy Avery 	vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
15779c838954SCathy Avery 		(0x0f << V_INTR_PRIO_SHIFT); // Set to the highest priority
15789c838954SCathy Avery 	vmcb->control.int_vector = 0xf1;
15799c838954SCathy Avery 	virq_fired = false;
15809c838954SCathy Avery 	set_test_stage(test, 0);
15819c838954SCathy Avery }
15829c838954SCathy Avery 
15839c838954SCathy Avery static void virq_inject_test(struct svm_test *test)
15849c838954SCathy Avery {
1585493d27d4SSean Christopherson 	report_svm_guest(!virq_fired, test, "virtual IRQ blocked after L2 cli");
15869c838954SCathy Avery 
15879c838954SCathy Avery 	irq_enable();
15889c838954SCathy Avery 	asm volatile ("nop");
15899c838954SCathy Avery 	irq_disable();
15909c838954SCathy Avery 
1591493d27d4SSean Christopherson 	report_svm_guest(virq_fired, test, "virtual IRQ fired after L2 sti");
15929c838954SCathy Avery 
15939c838954SCathy Avery 	vmmcall();
15949c838954SCathy Avery 
1595493d27d4SSean Christopherson 	report_svm_guest(!virq_fired, test, "intercepted VINTR blocked after L2 cli");
15969c838954SCathy Avery 
15979c838954SCathy Avery 	irq_enable();
15989c838954SCathy Avery 	asm volatile ("nop");
15999c838954SCathy Avery 	irq_disable();
16009c838954SCathy Avery 
1601493d27d4SSean Christopherson 	report_svm_guest(virq_fired, test, "intercepted VINTR fired after L2 sti");
16029c838954SCathy Avery 
16039c838954SCathy Avery 	vmmcall();
16049c838954SCathy Avery 
16059c838954SCathy Avery 	irq_enable();
16069c838954SCathy Avery 	asm volatile ("nop");
16079c838954SCathy Avery 	irq_disable();
16089c838954SCathy Avery 
1609493d27d4SSean Christopherson 	report_svm_guest(!virq_fired, test,
1610493d27d4SSean Christopherson 			  "virtual IRQ blocked V_IRQ_PRIO less than V_TPR");
16119c838954SCathy Avery 
16129c838954SCathy Avery 	vmmcall();
16139c838954SCathy Avery 	vmmcall();
16149c838954SCathy Avery }
16159c838954SCathy Avery 
16169c838954SCathy Avery static bool virq_inject_finished(struct svm_test *test)
16179c838954SCathy Avery {
16189c838954SCathy Avery 	vmcb->save.rip += 3;
16199c838954SCathy Avery 
16209c838954SCathy Avery 	switch (get_test_stage(test)) {
16219c838954SCathy Avery 	case 0:
16229c838954SCathy Avery 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1623198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
16249c838954SCathy Avery 				    vmcb->control.exit_code);
16259c838954SCathy Avery 			return true;
16269c838954SCathy Avery 		}
16279c838954SCathy Avery 		if (vmcb->control.int_ctl & V_IRQ_MASK) {
1628198dfd0eSJanis Schoetterl-Glausch 			report_fail("V_IRQ not cleared on VMEXIT after firing");
16299c838954SCathy Avery 			return true;
16309c838954SCathy Avery 		}
16319c838954SCathy Avery 		virq_fired = false;
16329c838954SCathy Avery 		vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
16339c838954SCathy Avery 		vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
16349c838954SCathy Avery 			(0x0f << V_INTR_PRIO_SHIFT);
16359c838954SCathy Avery 		break;
16369c838954SCathy Avery 
16379c838954SCathy Avery 	case 1:
16389c838954SCathy Avery 		if (vmcb->control.exit_code != SVM_EXIT_VINTR) {
1639198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to vintr. Exit reason 0x%x",
16409c838954SCathy Avery 				    vmcb->control.exit_code);
16419c838954SCathy Avery 			return true;
16429c838954SCathy Avery 		}
16439c838954SCathy Avery 		if (virq_fired) {
1644198dfd0eSJanis Schoetterl-Glausch 			report_fail("V_IRQ fired before SVM_EXIT_VINTR");
16459c838954SCathy Avery 			return true;
16469c838954SCathy Avery 		}
16479c838954SCathy Avery 		vmcb->control.intercept &= ~(1ULL << INTERCEPT_VINTR);
16489c838954SCathy Avery 		break;
16499c838954SCathy Avery 
16509c838954SCathy Avery 	case 2:
16519c838954SCathy Avery 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1652198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
16539c838954SCathy Avery 				    vmcb->control.exit_code);
16549c838954SCathy Avery 			return true;
16559c838954SCathy Avery 		}
16569c838954SCathy Avery 		virq_fired = false;
16579c838954SCathy Avery 		// Set irq to lower priority
16589c838954SCathy Avery 		vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
16599c838954SCathy Avery 			(0x08 << V_INTR_PRIO_SHIFT);
16609c838954SCathy Avery 		// Raise guest TPR
16619c838954SCathy Avery 		vmcb->control.int_ctl |= 0x0a & V_TPR_MASK;
16629c838954SCathy Avery 		break;
16639c838954SCathy Avery 
16649c838954SCathy Avery 	case 3:
16659c838954SCathy Avery 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1666198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
16679c838954SCathy Avery 				    vmcb->control.exit_code);
16689c838954SCathy Avery 			return true;
16699c838954SCathy Avery 		}
16709c838954SCathy Avery 		vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
16719c838954SCathy Avery 		break;
16729c838954SCathy Avery 
16739c838954SCathy Avery 	case 4:
16749c838954SCathy Avery 		// INTERCEPT_VINTR should be ignored because V_INTR_PRIO < V_TPR
16759c838954SCathy Avery 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1676198dfd0eSJanis Schoetterl-Glausch 			report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
16779c838954SCathy Avery 				    vmcb->control.exit_code);
16789c838954SCathy Avery 			return true;
16799c838954SCathy Avery 		}
16809c838954SCathy Avery 		break;
16819c838954SCathy Avery 
16829c838954SCathy Avery 	default:
16839c838954SCathy Avery 		return true;
16849c838954SCathy Avery 	}
16859c838954SCathy Avery 
16869c838954SCathy Avery 	inc_test_stage(test);
16879c838954SCathy Avery 
16889c838954SCathy Avery 	return get_test_stage(test) == 5;
16899c838954SCathy Avery }
16909c838954SCathy Avery 
16919c838954SCathy Avery static bool virq_inject_check(struct svm_test *test)
16929c838954SCathy Avery {
16939c838954SCathy Avery 	return get_test_stage(test) == 5;
16949c838954SCathy Avery }
16959c838954SCathy Avery 
1696da338a31SMaxim Levitsky /*
1697da338a31SMaxim Levitsky  * Detect nested guest RIP corruption as explained in kernel commit
1698da338a31SMaxim Levitsky  * b6162e82aef19fee9c32cb3fe9ac30d9116a8c73
1699da338a31SMaxim Levitsky  *
1700da338a31SMaxim Levitsky  * In the assembly loop below 'ins' is executed while IO instructions
1701da338a31SMaxim Levitsky  * are not intercepted; the instruction is emulated by L0.
1702da338a31SMaxim Levitsky  *
1703da338a31SMaxim Levitsky  * At the same time we are getting interrupts from the local APIC timer,
1704da338a31SMaxim Levitsky  * and we do intercept them in L1
1705da338a31SMaxim Levitsky  *
1706da338a31SMaxim Levitsky  * If the interrupt happens on the insb instruction, L0 will VMexit, emulate
1707da338a31SMaxim Levitsky  * the insb instruction and then it will inject the interrupt to L1 through
1708da338a31SMaxim Levitsky  * a nested VMexit.  Due to a bug, it would leave pre-emulation values of RIP,
1709da338a31SMaxim Levitsky  * RAX and RSP in the VMCB.
1710da338a31SMaxim Levitsky  *
1711da338a31SMaxim Levitsky  * In our intercept handler we detect the bug by checking that RIP is that of
1712da338a31SMaxim Levitsky  * the insb instruction, but its memory operand has already been written.
1713da338a31SMaxim Levitsky  * This means that insb was already executed.
1714da338a31SMaxim Levitsky  */
1715da338a31SMaxim Levitsky 
1716da338a31SMaxim Levitsky static volatile int isr_cnt = 0;
1717da338a31SMaxim Levitsky static volatile uint8_t io_port_var = 0xAA;
1718da338a31SMaxim Levitsky extern const char insb_instruction_label[];
1719da338a31SMaxim Levitsky 
1720da338a31SMaxim Levitsky static void reg_corruption_isr(isr_regs_t *regs)
1721da338a31SMaxim Levitsky {
1722da338a31SMaxim Levitsky 	isr_cnt++;
1723da338a31SMaxim Levitsky 	apic_write(APIC_EOI, 0);
1724da338a31SMaxim Levitsky }
1725da338a31SMaxim Levitsky 
1726da338a31SMaxim Levitsky static void reg_corruption_prepare(struct svm_test *test)
1727da338a31SMaxim Levitsky {
1728da338a31SMaxim Levitsky 	default_prepare(test);
1729da338a31SMaxim Levitsky 	set_test_stage(test, 0);
1730da338a31SMaxim Levitsky 
1731da338a31SMaxim Levitsky 	vmcb->control.int_ctl = V_INTR_MASKING_MASK;
1732da338a31SMaxim Levitsky 	vmcb->control.intercept |= (1ULL << INTERCEPT_INTR);
1733da338a31SMaxim Levitsky 
1734da338a31SMaxim Levitsky 	handle_irq(TIMER_VECTOR, reg_corruption_isr);
1735da338a31SMaxim Levitsky 
1736da338a31SMaxim Levitsky 	/* set local APIC to inject external interrupts */
1737da338a31SMaxim Levitsky 	apic_write(APIC_TMICT, 0);
1738da338a31SMaxim Levitsky 	apic_write(APIC_TDCR, 0);
1739da338a31SMaxim Levitsky 	apic_write(APIC_LVTT, TIMER_VECTOR | APIC_LVT_TIMER_PERIODIC);
1740da338a31SMaxim Levitsky 	apic_write(APIC_TMICT, 1000);
1741da338a31SMaxim Levitsky }
1742da338a31SMaxim Levitsky 
1743da338a31SMaxim Levitsky static void reg_corruption_test(struct svm_test *test)
1744da338a31SMaxim Levitsky {
1745da338a31SMaxim Levitsky 	/* this is endless loop, which is interrupted by the timer interrupt */
1746da338a31SMaxim Levitsky 	asm volatile (
1747da338a31SMaxim Levitsky 		      "1:\n\t"
1748da338a31SMaxim Levitsky 		      "movw $0x4d0, %%dx\n\t" // IO port
1749da338a31SMaxim Levitsky 		      "lea %[io_port_var], %%rdi\n\t"
1750da338a31SMaxim Levitsky 		      "movb $0xAA, %[io_port_var]\n\t"
1751da338a31SMaxim Levitsky 		      "insb_instruction_label:\n\t"
1752da338a31SMaxim Levitsky 		      "insb\n\t"
1753da338a31SMaxim Levitsky 		      "jmp 1b\n\t"
1754da338a31SMaxim Levitsky 
1755da338a31SMaxim Levitsky 		      : [io_port_var] "=m" (io_port_var)
1756da338a31SMaxim Levitsky 		      : /* no inputs*/
1757da338a31SMaxim Levitsky 		      : "rdx", "rdi"
1758da338a31SMaxim Levitsky 		      );
1759da338a31SMaxim Levitsky }
1760da338a31SMaxim Levitsky 
1761da338a31SMaxim Levitsky static bool reg_corruption_finished(struct svm_test *test)
1762da338a31SMaxim Levitsky {
1763da338a31SMaxim Levitsky 	if (isr_cnt == 10000) {
17645c3582f0SJanis Schoetterl-Glausch 		report_pass("No RIP corruption detected after %d timer interrupts",
1765da338a31SMaxim Levitsky 			    isr_cnt);
1766da338a31SMaxim Levitsky 		set_test_stage(test, 1);
1767491bbc64SMaxim Levitsky 		goto cleanup;
1768da338a31SMaxim Levitsky 	}
1769da338a31SMaxim Levitsky 
1770da338a31SMaxim Levitsky 	if (vmcb->control.exit_code == SVM_EXIT_INTR) {
1771da338a31SMaxim Levitsky 
1772da338a31SMaxim Levitsky 		void* guest_rip = (void*)vmcb->save.rip;
1773da338a31SMaxim Levitsky 
1774da338a31SMaxim Levitsky 		irq_enable();
1775da338a31SMaxim Levitsky 		asm volatile ("nop");
1776da338a31SMaxim Levitsky 		irq_disable();
1777da338a31SMaxim Levitsky 
1778da338a31SMaxim Levitsky 		if (guest_rip == insb_instruction_label && io_port_var != 0xAA) {
1779198dfd0eSJanis Schoetterl-Glausch 			report_fail("RIP corruption detected after %d timer interrupts",
1780da338a31SMaxim Levitsky 				    isr_cnt);
1781491bbc64SMaxim Levitsky 			goto cleanup;
1782da338a31SMaxim Levitsky 		}
1783da338a31SMaxim Levitsky 
1784da338a31SMaxim Levitsky 	}
1785da338a31SMaxim Levitsky 	return false;
1786491bbc64SMaxim Levitsky cleanup:
1787491bbc64SMaxim Levitsky 	apic_write(APIC_LVTT, APIC_LVT_TIMER_MASK);
1788491bbc64SMaxim Levitsky 	apic_write(APIC_TMICT, 0);
1789491bbc64SMaxim Levitsky 	return true;
1790491bbc64SMaxim Levitsky 
1791da338a31SMaxim Levitsky }
1792da338a31SMaxim Levitsky 
1793da338a31SMaxim Levitsky static bool reg_corruption_check(struct svm_test *test)
1794da338a31SMaxim Levitsky {
1795da338a31SMaxim Levitsky 	return get_test_stage(test) == 1;
1796da338a31SMaxim Levitsky }
1797da338a31SMaxim Levitsky 
17984770e9c8SCathy Avery static void get_tss_entry(void *data)
17994770e9c8SCathy Avery {
1800a7f32d87SPaolo Bonzini 	*((gdt_entry_t **)data) = get_tss_descr();
18014770e9c8SCathy Avery }
18024770e9c8SCathy Avery 
18034770e9c8SCathy Avery static int orig_cpu_count;
18044770e9c8SCathy Avery 
18054770e9c8SCathy Avery static void init_startup_prepare(struct svm_test *test)
18064770e9c8SCathy Avery {
1807a7f32d87SPaolo Bonzini 	gdt_entry_t *tss_entry;
18084770e9c8SCathy Avery 	int i;
18094770e9c8SCathy Avery 
18104770e9c8SCathy Avery 	on_cpu(1, get_tss_entry, &tss_entry);
18114770e9c8SCathy Avery 
1812d36b378fSVarad Gautam 	orig_cpu_count = atomic_read(&cpu_online_count);
18134770e9c8SCathy Avery 
18144770e9c8SCathy Avery 	apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_INIT | APIC_INT_ASSERT,
18154770e9c8SCathy Avery 		       id_map[1]);
18164770e9c8SCathy Avery 
18174770e9c8SCathy Avery 	delay(100000000ULL);
18184770e9c8SCathy Avery 
1819d36b378fSVarad Gautam 	atomic_dec(&cpu_online_count);
18204770e9c8SCathy Avery 
1821a7f32d87SPaolo Bonzini 	tss_entry->type &= ~DESC_BUSY;
18224770e9c8SCathy Avery 
18234770e9c8SCathy Avery 	apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_STARTUP, id_map[1]);
18244770e9c8SCathy Avery 
1825d36b378fSVarad Gautam 	for (i = 0; i < 5 && atomic_read(&cpu_online_count) < orig_cpu_count; i++)
18264770e9c8SCathy Avery 		delay(100000000ULL);
18274770e9c8SCathy Avery }
18284770e9c8SCathy Avery 
18294770e9c8SCathy Avery static bool init_startup_finished(struct svm_test *test)
18304770e9c8SCathy Avery {
18314770e9c8SCathy Avery 	return true;
18324770e9c8SCathy Avery }
18334770e9c8SCathy Avery 
18344770e9c8SCathy Avery static bool init_startup_check(struct svm_test *test)
18354770e9c8SCathy Avery {
1836d36b378fSVarad Gautam 	return atomic_read(&cpu_online_count) == orig_cpu_count;
18374770e9c8SCathy Avery }
18384770e9c8SCathy Avery 
1839d5da6dfeSCathy Avery static volatile bool init_intercept;
1840d5da6dfeSCathy Avery 
1841d5da6dfeSCathy Avery static void init_intercept_prepare(struct svm_test *test)
1842d5da6dfeSCathy Avery {
1843d5da6dfeSCathy Avery 	init_intercept = false;
1844d5da6dfeSCathy Avery 	vmcb->control.intercept |= (1ULL << INTERCEPT_INIT);
1845d5da6dfeSCathy Avery }
1846d5da6dfeSCathy Avery 
1847d5da6dfeSCathy Avery static void init_intercept_test(struct svm_test *test)
1848d5da6dfeSCathy Avery {
1849d5da6dfeSCathy Avery 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_INIT | APIC_INT_ASSERT, 0);
1850d5da6dfeSCathy Avery }
1851d5da6dfeSCathy Avery 
1852d5da6dfeSCathy Avery static bool init_intercept_finished(struct svm_test *test)
1853d5da6dfeSCathy Avery {
1854d5da6dfeSCathy Avery 	vmcb->save.rip += 3;
1855d5da6dfeSCathy Avery 
1856d5da6dfeSCathy Avery 	if (vmcb->control.exit_code != SVM_EXIT_INIT) {
1857198dfd0eSJanis Schoetterl-Glausch 		report_fail("VMEXIT not due to init intercept. Exit reason 0x%x",
1858d5da6dfeSCathy Avery 			    vmcb->control.exit_code);
1859d5da6dfeSCathy Avery 
1860d5da6dfeSCathy Avery 		return true;
1861d5da6dfeSCathy Avery 	}
1862d5da6dfeSCathy Avery 
1863d5da6dfeSCathy Avery 	init_intercept = true;
1864d5da6dfeSCathy Avery 
18655c3582f0SJanis Schoetterl-Glausch 	report_pass("INIT to vcpu intercepted");
1866d5da6dfeSCathy Avery 
1867d5da6dfeSCathy Avery 	return true;
1868d5da6dfeSCathy Avery }
1869d5da6dfeSCathy Avery 
1870d5da6dfeSCathy Avery static bool init_intercept_check(struct svm_test *test)
1871d5da6dfeSCathy Avery {
1872d5da6dfeSCathy Avery 	return init_intercept;
1873d5da6dfeSCathy Avery }
1874d5da6dfeSCathy Avery 
18757839b0ecSKrish Sadhukhan /*
18767839b0ecSKrish Sadhukhan  * Setting host EFLAGS.TF causes a #DB trap after the VMRUN completes on the
18777839b0ecSKrish Sadhukhan  * host side (i.e., after the #VMEXIT from the guest).
18787839b0ecSKrish Sadhukhan  *
18790689a980SKrish Sadhukhan  * Setting host EFLAGS.RF suppresses any potential instruction breakpoint
18800689a980SKrish Sadhukhan  * match on the VMRUN and completion of the VMRUN instruction clears the
18810689a980SKrish Sadhukhan  * host EFLAGS.RF bit.
18820689a980SKrish Sadhukhan  *
18837839b0ecSKrish Sadhukhan  * [AMD APM]
18847839b0ecSKrish Sadhukhan  */
18857839b0ecSKrish Sadhukhan static volatile u8 host_rflags_guest_main_flag = 0;
18867839b0ecSKrish Sadhukhan static volatile u8 host_rflags_db_handler_flag = 0;
18877839b0ecSKrish Sadhukhan static volatile bool host_rflags_ss_on_vmrun = false;
18887839b0ecSKrish Sadhukhan static volatile bool host_rflags_vmrun_reached = false;
18897839b0ecSKrish Sadhukhan static volatile bool host_rflags_set_tf = false;
18900689a980SKrish Sadhukhan static volatile bool host_rflags_set_rf = false;
18910689a980SKrish Sadhukhan static u64 rip_detected;
18927839b0ecSKrish Sadhukhan 
18937839b0ecSKrish Sadhukhan extern u64 *vmrun_rip;
18947839b0ecSKrish Sadhukhan 
18957839b0ecSKrish Sadhukhan static void host_rflags_db_handler(struct ex_regs *r)
18967839b0ecSKrish Sadhukhan {
18977839b0ecSKrish Sadhukhan 	if (host_rflags_ss_on_vmrun) {
18987839b0ecSKrish Sadhukhan 		if (host_rflags_vmrun_reached) {
18990689a980SKrish Sadhukhan 			if (!host_rflags_set_rf) {
19007839b0ecSKrish Sadhukhan 				r->rflags &= ~X86_EFLAGS_TF;
19010689a980SKrish Sadhukhan 				rip_detected = r->rip;
19027839b0ecSKrish Sadhukhan 			} else {
19030689a980SKrish Sadhukhan 				r->rflags |= X86_EFLAGS_RF;
19040689a980SKrish Sadhukhan 				++host_rflags_db_handler_flag;
19050689a980SKrish Sadhukhan 			}
19060689a980SKrish Sadhukhan 		} else {
19070689a980SKrish Sadhukhan 			if (r->rip == (u64)&vmrun_rip) {
19087839b0ecSKrish Sadhukhan 				host_rflags_vmrun_reached = true;
19090689a980SKrish Sadhukhan 
19100689a980SKrish Sadhukhan 				if (host_rflags_set_rf) {
19110689a980SKrish Sadhukhan 					host_rflags_guest_main_flag = 0;
19120689a980SKrish Sadhukhan 					rip_detected = r->rip;
19130689a980SKrish Sadhukhan 					r->rflags &= ~X86_EFLAGS_TF;
19140689a980SKrish Sadhukhan 
19150689a980SKrish Sadhukhan 					/* Trigger #DB via debug registers */
19160689a980SKrish Sadhukhan 					write_dr0((void *)&vmrun_rip);
19170689a980SKrish Sadhukhan 					write_dr7(0x403);
19180689a980SKrish Sadhukhan 				}
19190689a980SKrish Sadhukhan 			}
19207839b0ecSKrish Sadhukhan 		}
19217839b0ecSKrish Sadhukhan 	} else {
19227839b0ecSKrish Sadhukhan 		r->rflags &= ~X86_EFLAGS_TF;
19237839b0ecSKrish Sadhukhan 	}
19247839b0ecSKrish Sadhukhan }
19257839b0ecSKrish Sadhukhan 
19267839b0ecSKrish Sadhukhan static void host_rflags_prepare(struct svm_test *test)
19277839b0ecSKrish Sadhukhan {
19287839b0ecSKrish Sadhukhan 	default_prepare(test);
19297839b0ecSKrish Sadhukhan 	handle_exception(DB_VECTOR, host_rflags_db_handler);
19307839b0ecSKrish Sadhukhan 	set_test_stage(test, 0);
19317839b0ecSKrish Sadhukhan }
19327839b0ecSKrish Sadhukhan 
19337839b0ecSKrish Sadhukhan static void host_rflags_prepare_gif_clear(struct svm_test *test)
19347839b0ecSKrish Sadhukhan {
19357839b0ecSKrish Sadhukhan 	if (host_rflags_set_tf)
19367839b0ecSKrish Sadhukhan 		write_rflags(read_rflags() | X86_EFLAGS_TF);
19377839b0ecSKrish Sadhukhan }
19387839b0ecSKrish Sadhukhan 
19397839b0ecSKrish Sadhukhan static void host_rflags_test(struct svm_test *test)
19407839b0ecSKrish Sadhukhan {
19417839b0ecSKrish Sadhukhan 	while (1) {
19420689a980SKrish Sadhukhan 		if (get_test_stage(test) > 0) {
19430689a980SKrish Sadhukhan 			if ((host_rflags_set_tf && !host_rflags_ss_on_vmrun && !host_rflags_db_handler_flag) ||
19440689a980SKrish Sadhukhan 			    (host_rflags_set_rf && host_rflags_db_handler_flag == 1))
19457839b0ecSKrish Sadhukhan 				host_rflags_guest_main_flag = 1;
19460689a980SKrish Sadhukhan 		}
19470689a980SKrish Sadhukhan 
19480689a980SKrish Sadhukhan 		if (get_test_stage(test) == 4)
19497839b0ecSKrish Sadhukhan 			break;
19507839b0ecSKrish Sadhukhan 		vmmcall();
19517839b0ecSKrish Sadhukhan 	}
19527839b0ecSKrish Sadhukhan }
19537839b0ecSKrish Sadhukhan 
19547839b0ecSKrish Sadhukhan static bool host_rflags_finished(struct svm_test *test)
19557839b0ecSKrish Sadhukhan {
19567839b0ecSKrish Sadhukhan 	switch (get_test_stage(test)) {
19577839b0ecSKrish Sadhukhan 	case 0:
19587839b0ecSKrish Sadhukhan 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1959198dfd0eSJanis Schoetterl-Glausch 			report_fail("Unexpected VMEXIT. Exit reason 0x%x",
19607839b0ecSKrish Sadhukhan 				    vmcb->control.exit_code);
19617839b0ecSKrish Sadhukhan 			return true;
19627839b0ecSKrish Sadhukhan 		}
19637839b0ecSKrish Sadhukhan 		vmcb->save.rip += 3;
19647839b0ecSKrish Sadhukhan 		/*
19657839b0ecSKrish Sadhukhan 		 * Setting host EFLAGS.TF not immediately before VMRUN, causes
19667839b0ecSKrish Sadhukhan 		 * #DB trap before first guest instruction is executed
19677839b0ecSKrish Sadhukhan 		 */
19687839b0ecSKrish Sadhukhan 		host_rflags_set_tf = true;
19697839b0ecSKrish Sadhukhan 		break;
19707839b0ecSKrish Sadhukhan 	case 1:
19717839b0ecSKrish Sadhukhan 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL ||
19720689a980SKrish Sadhukhan 		    host_rflags_guest_main_flag != 1) {
1973198dfd0eSJanis Schoetterl-Glausch 			report_fail("Unexpected VMEXIT or #DB handler"
19747839b0ecSKrish Sadhukhan 				    " invoked before guest main. Exit reason 0x%x",
19757839b0ecSKrish Sadhukhan 				    vmcb->control.exit_code);
19767839b0ecSKrish Sadhukhan 			return true;
19777839b0ecSKrish Sadhukhan 		}
19787839b0ecSKrish Sadhukhan 		vmcb->save.rip += 3;
19797839b0ecSKrish Sadhukhan 		/*
19807839b0ecSKrish Sadhukhan 		 * Setting host EFLAGS.TF immediately before VMRUN, causes #DB
19817839b0ecSKrish Sadhukhan 		 * trap after VMRUN completes on the host side (i.e., after
19827839b0ecSKrish Sadhukhan 		 * VMEXIT from guest).
19837839b0ecSKrish Sadhukhan 		 */
19847839b0ecSKrish Sadhukhan 		host_rflags_ss_on_vmrun = true;
19857839b0ecSKrish Sadhukhan 		break;
19867839b0ecSKrish Sadhukhan 	case 2:
19877839b0ecSKrish Sadhukhan 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL ||
19880c22fd44SPaolo Bonzini 		    rip_detected != (u64)&vmrun_rip + 3) {
1989198dfd0eSJanis Schoetterl-Glausch 			report_fail("Unexpected VMEXIT or RIP mismatch."
19900689a980SKrish Sadhukhan 				    " Exit reason 0x%x, RIP actual: %lx, RIP expected: "
19910689a980SKrish Sadhukhan 				    "%lx", vmcb->control.exit_code,
19920c22fd44SPaolo Bonzini 				    (u64)&vmrun_rip + 3, rip_detected);
19930689a980SKrish Sadhukhan 			return true;
19940689a980SKrish Sadhukhan 		}
19950689a980SKrish Sadhukhan 		host_rflags_set_rf = true;
19960689a980SKrish Sadhukhan 		host_rflags_guest_main_flag = 0;
19970689a980SKrish Sadhukhan 		host_rflags_vmrun_reached = false;
19980689a980SKrish Sadhukhan 		vmcb->save.rip += 3;
19990689a980SKrish Sadhukhan 		break;
20000689a980SKrish Sadhukhan 	case 3:
20010689a980SKrish Sadhukhan 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL ||
20020689a980SKrish Sadhukhan 		    rip_detected != (u64)&vmrun_rip ||
20030689a980SKrish Sadhukhan 		    host_rflags_guest_main_flag != 1 ||
20040689a980SKrish Sadhukhan 		    host_rflags_db_handler_flag > 1 ||
20050689a980SKrish Sadhukhan 		    read_rflags() & X86_EFLAGS_RF) {
2006198dfd0eSJanis Schoetterl-Glausch 			report_fail("Unexpected VMEXIT or RIP mismatch or "
20070689a980SKrish Sadhukhan 				    "EFLAGS.RF not cleared."
20080689a980SKrish Sadhukhan 				    " Exit reason 0x%x, RIP actual: %lx, RIP expected: "
20090689a980SKrish Sadhukhan 				    "%lx", vmcb->control.exit_code,
20100689a980SKrish Sadhukhan 				    (u64)&vmrun_rip, rip_detected);
20117839b0ecSKrish Sadhukhan 			return true;
20127839b0ecSKrish Sadhukhan 		}
20137839b0ecSKrish Sadhukhan 		host_rflags_set_tf = false;
20140689a980SKrish Sadhukhan 		host_rflags_set_rf = false;
20157839b0ecSKrish Sadhukhan 		vmcb->save.rip += 3;
20167839b0ecSKrish Sadhukhan 		break;
20177839b0ecSKrish Sadhukhan 	default:
20187839b0ecSKrish Sadhukhan 		return true;
20197839b0ecSKrish Sadhukhan 	}
20207839b0ecSKrish Sadhukhan 	inc_test_stage(test);
20210689a980SKrish Sadhukhan 	return get_test_stage(test) == 5;
20227839b0ecSKrish Sadhukhan }
20237839b0ecSKrish Sadhukhan 
20247839b0ecSKrish Sadhukhan static bool host_rflags_check(struct svm_test *test)
20257839b0ecSKrish Sadhukhan {
20260689a980SKrish Sadhukhan 	return get_test_stage(test) == 4;
20277839b0ecSKrish Sadhukhan }
20287839b0ecSKrish Sadhukhan 
20298660d1b5SKrish Sadhukhan #define TEST(name) { #name, .v2 = name }
20308660d1b5SKrish Sadhukhan 
2031ba29942cSKrish Sadhukhan /*
2032ba29942cSKrish Sadhukhan  * v2 tests
2033ba29942cSKrish Sadhukhan  */
2034ba29942cSKrish Sadhukhan 
2035f32183f5SJim Mattson /*
2036f32183f5SJim Mattson  * Ensure that kvm recalculates the L1 guest's CPUID.01H:ECX.OSXSAVE
2037f32183f5SJim Mattson  * after VM-exit from an L2 guest that sets CR4.OSXSAVE to a different
2038f32183f5SJim Mattson  * value than in L1.
2039f32183f5SJim Mattson  */
2040f32183f5SJim Mattson 
2041f32183f5SJim Mattson static void svm_cr4_osxsave_test_guest(struct svm_test *test)
2042f32183f5SJim Mattson {
2043f32183f5SJim Mattson 	write_cr4(read_cr4() & ~X86_CR4_OSXSAVE);
2044f32183f5SJim Mattson }
2045f32183f5SJim Mattson 
2046f32183f5SJim Mattson static void svm_cr4_osxsave_test(void)
2047f32183f5SJim Mattson {
2048f32183f5SJim Mattson 	if (!this_cpu_has(X86_FEATURE_XSAVE)) {
2049f32183f5SJim Mattson 		report_skip("XSAVE not detected");
2050f32183f5SJim Mattson 		return;
2051f32183f5SJim Mattson 	}
2052f32183f5SJim Mattson 
2053f32183f5SJim Mattson 	if (!(read_cr4() & X86_CR4_OSXSAVE)) {
2054f32183f5SJim Mattson 		unsigned long cr4 = read_cr4() | X86_CR4_OSXSAVE;
2055f32183f5SJim Mattson 
2056f32183f5SJim Mattson 		write_cr4(cr4);
2057f32183f5SJim Mattson 		vmcb->save.cr4 = cr4;
2058f32183f5SJim Mattson 	}
2059f32183f5SJim Mattson 
2060816c0359SSean Christopherson 	report(this_cpu_has(X86_FEATURE_OSXSAVE), "CPUID.01H:ECX.XSAVE set before VMRUN");
2061f32183f5SJim Mattson 
2062f32183f5SJim Mattson 	test_set_guest(svm_cr4_osxsave_test_guest);
2063f32183f5SJim Mattson 	report(svm_vmrun() == SVM_EXIT_VMMCALL,
2064f32183f5SJim Mattson 	       "svm_cr4_osxsave_test_guest finished with VMMCALL");
2065f32183f5SJim Mattson 
2066816c0359SSean Christopherson 	report(this_cpu_has(X86_FEATURE_OSXSAVE), "CPUID.01H:ECX.XSAVE set after VMRUN");
2067f32183f5SJim Mattson }
2068f32183f5SJim Mattson 
2069ba29942cSKrish Sadhukhan static void basic_guest_main(struct svm_test *test)
2070ba29942cSKrish Sadhukhan {
2071ba29942cSKrish Sadhukhan }
2072ba29942cSKrish Sadhukhan 
2073eae10e8fSKrish Sadhukhan 
2074eae10e8fSKrish Sadhukhan #define SVM_TEST_REG_RESERVED_BITS(start, end, inc, str_name, reg, val,	\
2075eae10e8fSKrish Sadhukhan 				   resv_mask)				\
2076eae10e8fSKrish Sadhukhan {									\
2077eae10e8fSKrish Sadhukhan 	u64 tmp, mask;							\
2078eae10e8fSKrish Sadhukhan 	int i;								\
2079eae10e8fSKrish Sadhukhan 									\
2080eae10e8fSKrish Sadhukhan 	for (i = start; i <= end; i = i + inc) {			\
2081eae10e8fSKrish Sadhukhan 		mask = 1ull << i;					\
2082eae10e8fSKrish Sadhukhan 		if (!(mask & resv_mask))				\
2083eae10e8fSKrish Sadhukhan 			continue;					\
2084eae10e8fSKrish Sadhukhan 		tmp = val | mask;					\
2085eae10e8fSKrish Sadhukhan 		reg = tmp;						\
2086eae10e8fSKrish Sadhukhan 		report(svm_vmrun() == SVM_EXIT_ERR, "Test %s %d:%d: %lx", \
2087eae10e8fSKrish Sadhukhan 		       str_name, end, start, tmp);			\
2088eae10e8fSKrish Sadhukhan 	}								\
2089eae10e8fSKrish Sadhukhan }
2090eae10e8fSKrish Sadhukhan 
20916d0ecbf6SKrish Sadhukhan #define SVM_TEST_CR_RESERVED_BITS(start, end, inc, cr, val, resv_mask,	\
2092cb6524f3SPaolo Bonzini 				  exit_code, test_name)			\
2093a79c9495SKrish Sadhukhan {									\
2094a79c9495SKrish Sadhukhan 	u64 tmp, mask;							\
20958ae6d77fSSean Christopherson 	u32 r;								\
2096a79c9495SKrish Sadhukhan 	int i;								\
2097a79c9495SKrish Sadhukhan 									\
2098a79c9495SKrish Sadhukhan 	for (i = start; i <= end; i = i + inc) {			\
2099a79c9495SKrish Sadhukhan 		mask = 1ull << i;					\
2100a79c9495SKrish Sadhukhan 		if (!(mask & resv_mask))				\
2101a79c9495SKrish Sadhukhan 			continue;					\
2102a79c9495SKrish Sadhukhan 		tmp = val | mask;					\
2103a79c9495SKrish Sadhukhan 		switch (cr) {						\
2104a79c9495SKrish Sadhukhan 		case 0:							\
2105a79c9495SKrish Sadhukhan 			vmcb->save.cr0 = tmp;				\
2106a79c9495SKrish Sadhukhan 			break;						\
2107a79c9495SKrish Sadhukhan 		case 3:							\
2108a79c9495SKrish Sadhukhan 			vmcb->save.cr3 = tmp;				\
2109a79c9495SKrish Sadhukhan 			break;						\
2110a79c9495SKrish Sadhukhan 		case 4:							\
2111a79c9495SKrish Sadhukhan 			vmcb->save.cr4 = tmp;				\
2112a79c9495SKrish Sadhukhan 		}							\
21138ae6d77fSSean Christopherson 		r = svm_vmrun();					\
21148ae6d77fSSean Christopherson 		report(r == exit_code, "Test CR%d %s%d:%d: %lx, wanted exit 0x%x, got 0x%x", \
21158ae6d77fSSean Christopherson 		       cr, test_name, end, start, tmp, exit_code, r);	\
2116a79c9495SKrish Sadhukhan 	}								\
2117a79c9495SKrish Sadhukhan }
2118e8d7a8f6SKrish Sadhukhan 
2119a79c9495SKrish Sadhukhan static void test_efer(void)
2120a79c9495SKrish Sadhukhan {
2121e8d7a8f6SKrish Sadhukhan 	/*
2122e8d7a8f6SKrish Sadhukhan 	 * Un-setting EFER.SVME is illegal
2123e8d7a8f6SKrish Sadhukhan 	 */
2124ba29942cSKrish Sadhukhan 	u64 efer_saved = vmcb->save.efer;
2125ba29942cSKrish Sadhukhan 	u64 efer = efer_saved;
2126ba29942cSKrish Sadhukhan 
2127ba29942cSKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "EFER.SVME: %lx", efer);
2128ba29942cSKrish Sadhukhan 	efer &= ~EFER_SVME;
2129ba29942cSKrish Sadhukhan 	vmcb->save.efer = efer;
2130ba29942cSKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_ERR, "EFER.SVME: %lx", efer);
2131ba29942cSKrish Sadhukhan 	vmcb->save.efer = efer_saved;
2132e8d7a8f6SKrish Sadhukhan 
2133e8d7a8f6SKrish Sadhukhan 	/*
2134a79c9495SKrish Sadhukhan 	 * EFER MBZ bits: 63:16, 9
2135a79c9495SKrish Sadhukhan 	 */
2136a79c9495SKrish Sadhukhan 	efer_saved = vmcb->save.efer;
2137a79c9495SKrish Sadhukhan 
2138a79c9495SKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(8, 9, 1, "EFER", vmcb->save.efer,
2139a79c9495SKrish Sadhukhan 				   efer_saved, SVM_EFER_RESERVED_MASK);
2140a79c9495SKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(16, 63, 4, "EFER", vmcb->save.efer,
2141a79c9495SKrish Sadhukhan 				   efer_saved, SVM_EFER_RESERVED_MASK);
2142a79c9495SKrish Sadhukhan 
21431d7bde08SKrish Sadhukhan 	/*
21441d7bde08SKrish Sadhukhan 	 * EFER.LME and CR0.PG are both set and CR4.PAE is zero.
21451d7bde08SKrish Sadhukhan 	 */
21461d7bde08SKrish Sadhukhan 	u64 cr0_saved = vmcb->save.cr0;
21471d7bde08SKrish Sadhukhan 	u64 cr0;
21481d7bde08SKrish Sadhukhan 	u64 cr4_saved = vmcb->save.cr4;
21491d7bde08SKrish Sadhukhan 	u64 cr4;
21501d7bde08SKrish Sadhukhan 
21511d7bde08SKrish Sadhukhan 	efer = efer_saved | EFER_LME;
21521d7bde08SKrish Sadhukhan 	vmcb->save.efer = efer;
21531d7bde08SKrish Sadhukhan 	cr0 = cr0_saved | X86_CR0_PG | X86_CR0_PE;
21541d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
21551d7bde08SKrish Sadhukhan 	cr4 = cr4_saved & ~X86_CR4_PAE;
21561d7bde08SKrish Sadhukhan 	vmcb->save.cr4 = cr4;
21571d7bde08SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), "
21581d7bde08SKrish Sadhukhan 	       "CR0.PG=1 (%lx) and CR4.PAE=0 (%lx)", efer, cr0, cr4);
21591d7bde08SKrish Sadhukhan 
21601d7bde08SKrish Sadhukhan 	/*
21611d7bde08SKrish Sadhukhan 	 * EFER.LME and CR0.PG are both set and CR0.PE is zero.
2162fc050452SLara Lazier 	 * CR4.PAE needs to be set as we otherwise cannot
2163fc050452SLara Lazier 	 * determine if CR4.PAE=0 or CR0.PE=0 triggered the
2164fc050452SLara Lazier 	 * SVM_EXIT_ERR.
21651d7bde08SKrish Sadhukhan 	 */
2166fc050452SLara Lazier 	cr4 = cr4_saved | X86_CR4_PAE;
2167fc050452SLara Lazier 	vmcb->save.cr4 = cr4;
21681d7bde08SKrish Sadhukhan 	cr0 &= ~X86_CR0_PE;
21691d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
21701d7bde08SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), "
21711d7bde08SKrish Sadhukhan 	       "CR0.PG=1 and CR0.PE=0 (%lx)", efer, cr0);
21721d7bde08SKrish Sadhukhan 
21731d7bde08SKrish Sadhukhan 	/*
21741d7bde08SKrish Sadhukhan 	 * EFER.LME, CR0.PG, CR4.PAE, CS.L, and CS.D are all non-zero.
21751d7bde08SKrish Sadhukhan 	 */
21761d7bde08SKrish Sadhukhan 	u32 cs_attrib_saved = vmcb->save.cs.attrib;
21771d7bde08SKrish Sadhukhan 	u32 cs_attrib;
21781d7bde08SKrish Sadhukhan 
21791d7bde08SKrish Sadhukhan 	cr0 |= X86_CR0_PE;
21801d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
21811d7bde08SKrish Sadhukhan 	cs_attrib = cs_attrib_saved | SVM_SELECTOR_L_MASK |
21821d7bde08SKrish Sadhukhan 		SVM_SELECTOR_DB_MASK;
21831d7bde08SKrish Sadhukhan 	vmcb->save.cs.attrib = cs_attrib;
21841d7bde08SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), "
21851d7bde08SKrish Sadhukhan 	       "CR0.PG=1 (%lx), CR4.PAE=1 (%lx), CS.L=1 and CS.D=1 (%x)",
21861d7bde08SKrish Sadhukhan 	       efer, cr0, cr4, cs_attrib);
21871d7bde08SKrish Sadhukhan 
21881d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0_saved;
21891d7bde08SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved;
2190a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer_saved;
21911d7bde08SKrish Sadhukhan 	vmcb->save.cs.attrib = cs_attrib_saved;
2192a79c9495SKrish Sadhukhan }
2193a79c9495SKrish Sadhukhan 
2194a79c9495SKrish Sadhukhan static void test_cr0(void)
2195a79c9495SKrish Sadhukhan {
2196a79c9495SKrish Sadhukhan 	/*
2197e8d7a8f6SKrish Sadhukhan 	 * Un-setting CR0.CD and setting CR0.NW is illegal combination
2198e8d7a8f6SKrish Sadhukhan 	 */
2199e8d7a8f6SKrish Sadhukhan 	u64 cr0_saved = vmcb->save.cr0;
2200e8d7a8f6SKrish Sadhukhan 	u64 cr0 = cr0_saved;
2201e8d7a8f6SKrish Sadhukhan 
2202e8d7a8f6SKrish Sadhukhan 	cr0 |= X86_CR0_CD;
2203e8d7a8f6SKrish Sadhukhan 	cr0 &= ~X86_CR0_NW;
2204e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2205a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=0: %lx",
2206a79c9495SKrish Sadhukhan 		cr0);
2207e8d7a8f6SKrish Sadhukhan 	cr0 |= X86_CR0_NW;
2208e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2209a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=1: %lx",
2210a79c9495SKrish Sadhukhan 		cr0);
2211e8d7a8f6SKrish Sadhukhan 	cr0 &= ~X86_CR0_NW;
2212e8d7a8f6SKrish Sadhukhan 	cr0 &= ~X86_CR0_CD;
2213e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2214a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=0,NW=0: %lx",
2215a79c9495SKrish Sadhukhan 		cr0);
2216e8d7a8f6SKrish Sadhukhan 	cr0 |= X86_CR0_NW;
2217e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2218a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_ERR, "Test CR0 CD=0,NW=1: %lx",
2219a79c9495SKrish Sadhukhan 		cr0);
2220e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0_saved;
22215c052c90SKrish Sadhukhan 
22225c052c90SKrish Sadhukhan 	/*
22235c052c90SKrish Sadhukhan 	 * CR0[63:32] are not zero
22245c052c90SKrish Sadhukhan 	 */
22255c052c90SKrish Sadhukhan 	cr0 = cr0_saved;
2226eae10e8fSKrish Sadhukhan 
2227eae10e8fSKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "CR0", vmcb->save.cr0, cr0_saved,
2228eae10e8fSKrish Sadhukhan 				   SVM_CR0_RESERVED_MASK);
22295c052c90SKrish Sadhukhan 	vmcb->save.cr0 = cr0_saved;
2230a79c9495SKrish Sadhukhan }
2231eae10e8fSKrish Sadhukhan 
2232a79c9495SKrish Sadhukhan static void test_cr3(void)
2233a79c9495SKrish Sadhukhan {
2234a79c9495SKrish Sadhukhan 	/*
2235a79c9495SKrish Sadhukhan 	 * CR3 MBZ bits based on different modes:
223629a01803SNadav Amit 	 *   [63:52] - long mode
2237a79c9495SKrish Sadhukhan 	 */
2238a79c9495SKrish Sadhukhan 	u64 cr3_saved = vmcb->save.cr3;
2239a79c9495SKrish Sadhukhan 
2240a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(0, 63, 1, 3, cr3_saved,
2241cb6524f3SPaolo Bonzini 				  SVM_CR3_LONG_MBZ_MASK, SVM_EXIT_ERR, "");
22426d0ecbf6SKrish Sadhukhan 
22436d0ecbf6SKrish Sadhukhan 	vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_MBZ_MASK;
22446d0ecbf6SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx",
22456d0ecbf6SKrish Sadhukhan 	       vmcb->save.cr3);
22466d0ecbf6SKrish Sadhukhan 
22476d0ecbf6SKrish Sadhukhan 	/*
22486d0ecbf6SKrish Sadhukhan 	 * CR3 non-MBZ reserved bits based on different modes:
2249cb6524f3SPaolo Bonzini 	 *   [11:5] [2:0] - long mode (PCIDE=0)
22506d0ecbf6SKrish Sadhukhan 	 *          [2:0] - PAE legacy mode
22516d0ecbf6SKrish Sadhukhan 	 */
22526d0ecbf6SKrish Sadhukhan 	u64 cr4_saved = vmcb->save.cr4;
22536d0ecbf6SKrish Sadhukhan 	u64 *pdpe = npt_get_pml4e();
22546d0ecbf6SKrish Sadhukhan 
22556d0ecbf6SKrish Sadhukhan 	/*
22566d0ecbf6SKrish Sadhukhan 	 * Long mode
22576d0ecbf6SKrish Sadhukhan 	 */
22586d0ecbf6SKrish Sadhukhan 	if (this_cpu_has(X86_FEATURE_PCID)) {
22596d0ecbf6SKrish Sadhukhan 		vmcb->save.cr4 = cr4_saved | X86_CR4_PCIDE;
22606d0ecbf6SKrish Sadhukhan 		SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved,
2261cb6524f3SPaolo Bonzini 					  SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_VMMCALL, "(PCIDE=1) ");
22626d0ecbf6SKrish Sadhukhan 
22636d0ecbf6SKrish Sadhukhan 		vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_RESERVED_MASK;
22646d0ecbf6SKrish Sadhukhan 		report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx",
22656d0ecbf6SKrish Sadhukhan 		       vmcb->save.cr3);
2266cb6524f3SPaolo Bonzini 	}
22676d0ecbf6SKrish Sadhukhan 
22686d0ecbf6SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved & ~X86_CR4_PCIDE;
22696d0ecbf6SKrish Sadhukhan 
2270993749ffSSean Christopherson 	if (!npt_supported())
2271993749ffSSean Christopherson 		goto skip_npt_only;
2272993749ffSSean Christopherson 
22736d0ecbf6SKrish Sadhukhan 	/* Clear P (Present) bit in NPT in order to trigger #NPF */
22746d0ecbf6SKrish Sadhukhan 	pdpe[0] &= ~1ULL;
22756d0ecbf6SKrish Sadhukhan 
22766d0ecbf6SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved,
2277cb6524f3SPaolo Bonzini 				  SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_NPF, "(PCIDE=0) ");
22786d0ecbf6SKrish Sadhukhan 
22796d0ecbf6SKrish Sadhukhan 	pdpe[0] |= 1ULL;
2280cb6524f3SPaolo Bonzini 	vmcb->save.cr3 = cr3_saved;
22816d0ecbf6SKrish Sadhukhan 
22826d0ecbf6SKrish Sadhukhan 	/*
22836d0ecbf6SKrish Sadhukhan 	 * PAE legacy
22846d0ecbf6SKrish Sadhukhan 	 */
22856d0ecbf6SKrish Sadhukhan 	pdpe[0] &= ~1ULL;
22866d0ecbf6SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved | X86_CR4_PAE;
22876d0ecbf6SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(0, 2, 1, 3, cr3_saved,
2288cb6524f3SPaolo Bonzini 				  SVM_CR3_PAE_LEGACY_RESERVED_MASK, SVM_EXIT_NPF, "(PAE) ");
22896d0ecbf6SKrish Sadhukhan 
22906d0ecbf6SKrish Sadhukhan 	pdpe[0] |= 1ULL;
2291993749ffSSean Christopherson 
2292993749ffSSean Christopherson skip_npt_only:
2293a79c9495SKrish Sadhukhan 	vmcb->save.cr3 = cr3_saved;
22946d0ecbf6SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved;
2295a79c9495SKrish Sadhukhan }
2296a79c9495SKrish Sadhukhan 
2297d30973c3SWei Huang /* Test CR4 MBZ bits based on legacy or long modes */
2298a79c9495SKrish Sadhukhan static void test_cr4(void)
2299a79c9495SKrish Sadhukhan {
2300a79c9495SKrish Sadhukhan 	u64 cr4_saved = vmcb->save.cr4;
2301a79c9495SKrish Sadhukhan 	u64 efer_saved = vmcb->save.efer;
2302a79c9495SKrish Sadhukhan 	u64 efer = efer_saved;
2303a79c9495SKrish Sadhukhan 
2304a79c9495SKrish Sadhukhan 	efer &= ~EFER_LME;
2305a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer;
2306a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved,
2307cb6524f3SPaolo Bonzini 				  SVM_CR4_LEGACY_RESERVED_MASK, SVM_EXIT_ERR, "");
2308a79c9495SKrish Sadhukhan 
2309a79c9495SKrish Sadhukhan 	efer |= EFER_LME;
2310a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer;
2311a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved,
2312cb6524f3SPaolo Bonzini 				  SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR, "");
2313a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(32, 63, 4, 4, cr4_saved,
2314cb6524f3SPaolo Bonzini 				  SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR, "");
2315a79c9495SKrish Sadhukhan 
2316a79c9495SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved;
2317a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer_saved;
2318a79c9495SKrish Sadhukhan }
2319a79c9495SKrish Sadhukhan 
2320a79c9495SKrish Sadhukhan static void test_dr(void)
2321a79c9495SKrish Sadhukhan {
2322eae10e8fSKrish Sadhukhan 	/*
2323eae10e8fSKrish Sadhukhan 	 * DR6[63:32] and DR7[63:32] are MBZ
2324eae10e8fSKrish Sadhukhan 	 */
2325eae10e8fSKrish Sadhukhan 	u64 dr_saved = vmcb->save.dr6;
2326eae10e8fSKrish Sadhukhan 
2327eae10e8fSKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR6", vmcb->save.dr6, dr_saved,
2328eae10e8fSKrish Sadhukhan 				   SVM_DR6_RESERVED_MASK);
2329eae10e8fSKrish Sadhukhan 	vmcb->save.dr6 = dr_saved;
2330eae10e8fSKrish Sadhukhan 
2331eae10e8fSKrish Sadhukhan 	dr_saved = vmcb->save.dr7;
2332eae10e8fSKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR7", vmcb->save.dr7, dr_saved,
2333eae10e8fSKrish Sadhukhan 				   SVM_DR7_RESERVED_MASK);
2334eae10e8fSKrish Sadhukhan 
2335eae10e8fSKrish Sadhukhan 	vmcb->save.dr7 = dr_saved;
2336a79c9495SKrish Sadhukhan }
2337eae10e8fSKrish Sadhukhan 
2338abe82380SKrish Sadhukhan /* TODO: verify if high 32-bits are sign- or zero-extended on bare metal */
2339abe82380SKrish Sadhukhan #define	TEST_BITMAP_ADDR(save_intercept, type, addr, exit_code,		\
2340abe82380SKrish Sadhukhan 			 msg) {						\
2341abe82380SKrish Sadhukhan 		vmcb->control.intercept = saved_intercept | 1ULL << type; \
2342abe82380SKrish Sadhukhan 		if (type == INTERCEPT_MSR_PROT)				\
2343abe82380SKrish Sadhukhan 			vmcb->control.msrpm_base_pa = addr;		\
2344abe82380SKrish Sadhukhan 		else							\
2345abe82380SKrish Sadhukhan 			vmcb->control.iopm_base_pa = addr;		\
2346abe82380SKrish Sadhukhan 		report(svm_vmrun() == exit_code,			\
2347abe82380SKrish Sadhukhan 		       "Test %s address: %lx", msg, addr);		\
2348abe82380SKrish Sadhukhan 	}
2349abe82380SKrish Sadhukhan 
2350abe82380SKrish Sadhukhan /*
2351abe82380SKrish Sadhukhan  * If the MSR or IOIO intercept table extends to a physical address that
2352abe82380SKrish Sadhukhan  * is greater than or equal to the maximum supported physical address, the
2353abe82380SKrish Sadhukhan  * guest state is illegal.
2354abe82380SKrish Sadhukhan  *
2355abe82380SKrish Sadhukhan  * The VMRUN instruction ignores the lower 12 bits of the address specified
2356abe82380SKrish Sadhukhan  * in the VMCB.
2357abe82380SKrish Sadhukhan  *
2358abe82380SKrish Sadhukhan  * MSRPM spans 2 contiguous 4KB pages while IOPM spans 2 contiguous 4KB
2359abe82380SKrish Sadhukhan  * pages + 1 byte.
2360abe82380SKrish Sadhukhan  *
2361abe82380SKrish Sadhukhan  * [APM vol 2]
2362abe82380SKrish Sadhukhan  *
2363abe82380SKrish Sadhukhan  * Note: Unallocated MSRPM addresses conforming to consistency checks, generate
2364abe82380SKrish Sadhukhan  * #NPF.
2365abe82380SKrish Sadhukhan  */
2366abe82380SKrish Sadhukhan static void test_msrpm_iopm_bitmap_addrs(void)
2367abe82380SKrish Sadhukhan {
2368abe82380SKrish Sadhukhan 	u64 saved_intercept = vmcb->control.intercept;
2369abe82380SKrish Sadhukhan 	u64 addr_beyond_limit = 1ull << cpuid_maxphyaddr();
2370abe82380SKrish Sadhukhan 	u64 addr = virt_to_phys(msr_bitmap) & (~((1ull << 12) - 1));
2371abe82380SKrish Sadhukhan 
2372abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT,
2373abe82380SKrish Sadhukhan 			 addr_beyond_limit - 2 * PAGE_SIZE, SVM_EXIT_ERR,
2374abe82380SKrish Sadhukhan 			 "MSRPM");
2375abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT,
2376abe82380SKrish Sadhukhan 			 addr_beyond_limit - 2 * PAGE_SIZE + 1, SVM_EXIT_ERR,
2377abe82380SKrish Sadhukhan 			 "MSRPM");
2378abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT,
2379abe82380SKrish Sadhukhan 			 addr_beyond_limit - PAGE_SIZE, SVM_EXIT_ERR,
2380abe82380SKrish Sadhukhan 			 "MSRPM");
2381abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, addr,
2382abe82380SKrish Sadhukhan 			 SVM_EXIT_VMMCALL, "MSRPM");
2383abe82380SKrish Sadhukhan 	addr |= (1ull << 12) - 1;
2384abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, addr,
2385abe82380SKrish Sadhukhan 			 SVM_EXIT_VMMCALL, "MSRPM");
2386abe82380SKrish Sadhukhan 
2387abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2388abe82380SKrish Sadhukhan 			 addr_beyond_limit - 4 * PAGE_SIZE, SVM_EXIT_VMMCALL,
2389abe82380SKrish Sadhukhan 			 "IOPM");
2390abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2391abe82380SKrish Sadhukhan 			 addr_beyond_limit - 3 * PAGE_SIZE, SVM_EXIT_VMMCALL,
2392abe82380SKrish Sadhukhan 			 "IOPM");
2393abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2394abe82380SKrish Sadhukhan 			 addr_beyond_limit - 2 * PAGE_SIZE - 2, SVM_EXIT_VMMCALL,
2395abe82380SKrish Sadhukhan 			 "IOPM");
2396abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2397abe82380SKrish Sadhukhan 			 addr_beyond_limit - 2 * PAGE_SIZE, SVM_EXIT_ERR,
2398abe82380SKrish Sadhukhan 			 "IOPM");
2399abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2400abe82380SKrish Sadhukhan 			 addr_beyond_limit - PAGE_SIZE, SVM_EXIT_ERR,
2401abe82380SKrish Sadhukhan 			 "IOPM");
2402abe82380SKrish Sadhukhan 	addr = virt_to_phys(io_bitmap) & (~((1ull << 11) - 1));
2403abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, addr,
2404abe82380SKrish Sadhukhan 			 SVM_EXIT_VMMCALL, "IOPM");
2405abe82380SKrish Sadhukhan 	addr |= (1ull << 12) - 1;
2406abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, addr,
2407abe82380SKrish Sadhukhan 			 SVM_EXIT_VMMCALL, "IOPM");
2408abe82380SKrish Sadhukhan 
2409abe82380SKrish Sadhukhan 	vmcb->control.intercept = saved_intercept;
2410abe82380SKrish Sadhukhan }
2411abe82380SKrish Sadhukhan 
2412ba3c9773SLara Lazier /*
2413ba3c9773SLara Lazier  * Unlike VMSAVE, VMRUN seems not to update the value of noncanonical
2414ba3c9773SLara Lazier  * segment bases in the VMCB.  However, VMENTRY succeeds as documented.
2415ba3c9773SLara Lazier  */
2416ba3c9773SLara Lazier #define TEST_CANONICAL_VMRUN(seg_base, msg)				\
2417a99070ebSKrish Sadhukhan 	saved_addr = seg_base;						\
2418a99070ebSKrish Sadhukhan 	seg_base = (seg_base & ((1ul << addr_limit) - 1)) | noncanonical_mask; \
2419ba3c9773SLara Lazier 	return_value = svm_vmrun();					\
2420ba3c9773SLara Lazier 	report(return_value == SVM_EXIT_VMMCALL,			\
2421ba3c9773SLara Lazier 	       "Successful VMRUN with noncanonical %s.base", msg);	\
2422a99070ebSKrish Sadhukhan 	seg_base = saved_addr;
2423a99070ebSKrish Sadhukhan 
2424ba3c9773SLara Lazier 
2425ba3c9773SLara Lazier #define TEST_CANONICAL_VMLOAD(seg_base, msg)				\
2426ba3c9773SLara Lazier 	saved_addr = seg_base;						\
2427ba3c9773SLara Lazier 	seg_base = (seg_base & ((1ul << addr_limit) - 1)) | noncanonical_mask; \
2428ba3c9773SLara Lazier 	asm volatile ("vmload %0" : : "a"(vmcb_phys) : "memory");	\
2429ba3c9773SLara Lazier 	asm volatile ("vmsave %0" : : "a"(vmcb_phys) : "memory");	\
2430ba3c9773SLara Lazier 	report(is_canonical(seg_base),					\
2431ba3c9773SLara Lazier 	       "Test %s.base for canonical form: %lx", msg, seg_base);	\
2432ba3c9773SLara Lazier 	seg_base = saved_addr;
2433ba3c9773SLara Lazier 
2434ba3c9773SLara Lazier static void test_canonicalization(void)
2435a99070ebSKrish Sadhukhan {
2436a99070ebSKrish Sadhukhan 	u64 saved_addr;
2437ba3c9773SLara Lazier 	u64 return_value;
2438ba3c9773SLara Lazier 	u64 addr_limit;
2439ba3c9773SLara Lazier 	u64 vmcb_phys = virt_to_phys(vmcb);
2440ba3c9773SLara Lazier 
2441ba3c9773SLara Lazier 	addr_limit = (this_cpu_has(X86_FEATURE_LA57)) ? 57 : 48;
2442a99070ebSKrish Sadhukhan 	u64 noncanonical_mask = NONCANONICAL & ~((1ul << addr_limit) - 1);
2443a99070ebSKrish Sadhukhan 
2444ba3c9773SLara Lazier 	TEST_CANONICAL_VMLOAD(vmcb->save.fs.base, "FS");
2445ba3c9773SLara Lazier 	TEST_CANONICAL_VMLOAD(vmcb->save.gs.base, "GS");
2446ba3c9773SLara Lazier 	TEST_CANONICAL_VMLOAD(vmcb->save.ldtr.base, "LDTR");
2447ba3c9773SLara Lazier 	TEST_CANONICAL_VMLOAD(vmcb->save.tr.base, "TR");
2448ba3c9773SLara Lazier 	TEST_CANONICAL_VMLOAD(vmcb->save.kernel_gs_base, "KERNEL GS");
2449ba3c9773SLara Lazier 	TEST_CANONICAL_VMRUN(vmcb->save.es.base, "ES");
2450ba3c9773SLara Lazier 	TEST_CANONICAL_VMRUN(vmcb->save.cs.base, "CS");
2451ba3c9773SLara Lazier 	TEST_CANONICAL_VMRUN(vmcb->save.ss.base, "SS");
2452ba3c9773SLara Lazier 	TEST_CANONICAL_VMRUN(vmcb->save.ds.base, "DS");
2453ba3c9773SLara Lazier 	TEST_CANONICAL_VMRUN(vmcb->save.gdtr.base, "GDTR");
2454ba3c9773SLara Lazier 	TEST_CANONICAL_VMRUN(vmcb->save.idtr.base, "IDTR");
2455a99070ebSKrish Sadhukhan }
2456a99070ebSKrish Sadhukhan 
2457665f5677SKrish Sadhukhan /*
2458665f5677SKrish Sadhukhan  * When VMRUN loads a guest value of 1 in EFLAGS.TF, that value does not
2459665f5677SKrish Sadhukhan  * cause a trace trap between the VMRUN and the first guest instruction, but
2460665f5677SKrish Sadhukhan  * rather after completion of the first guest instruction.
2461665f5677SKrish Sadhukhan  *
2462665f5677SKrish Sadhukhan  * [APM vol 2]
2463665f5677SKrish Sadhukhan  */
2464665f5677SKrish Sadhukhan u64 guest_rflags_test_trap_rip;
2465665f5677SKrish Sadhukhan 
2466665f5677SKrish Sadhukhan static void guest_rflags_test_db_handler(struct ex_regs *r)
2467665f5677SKrish Sadhukhan {
2468665f5677SKrish Sadhukhan 	guest_rflags_test_trap_rip = r->rip;
2469665f5677SKrish Sadhukhan 	r->rflags &= ~X86_EFLAGS_TF;
2470665f5677SKrish Sadhukhan }
2471665f5677SKrish Sadhukhan 
2472a79c9495SKrish Sadhukhan static void svm_guest_state_test(void)
2473a79c9495SKrish Sadhukhan {
2474a79c9495SKrish Sadhukhan 	test_set_guest(basic_guest_main);
2475a79c9495SKrish Sadhukhan 	test_efer();
2476a79c9495SKrish Sadhukhan 	test_cr0();
2477a79c9495SKrish Sadhukhan 	test_cr3();
2478a79c9495SKrish Sadhukhan 	test_cr4();
2479a79c9495SKrish Sadhukhan 	test_dr();
2480abe82380SKrish Sadhukhan 	test_msrpm_iopm_bitmap_addrs();
2481ba3c9773SLara Lazier 	test_canonicalization();
2482ba29942cSKrish Sadhukhan }
2483ba29942cSKrish Sadhukhan 
2484665f5677SKrish Sadhukhan extern void guest_rflags_test_guest(struct svm_test *test);
2485665f5677SKrish Sadhukhan extern u64 *insn2;
2486665f5677SKrish Sadhukhan extern u64 *guest_end;
2487665f5677SKrish Sadhukhan 
2488665f5677SKrish Sadhukhan asm("guest_rflags_test_guest:\n\t"
2489665f5677SKrish Sadhukhan     "push %rbp\n\t"
2490665f5677SKrish Sadhukhan     ".global insn2\n\t"
2491665f5677SKrish Sadhukhan     "insn2:\n\t"
2492665f5677SKrish Sadhukhan     "mov %rsp,%rbp\n\t"
2493665f5677SKrish Sadhukhan     "vmmcall\n\t"
2494665f5677SKrish Sadhukhan     "vmmcall\n\t"
2495665f5677SKrish Sadhukhan     ".global guest_end\n\t"
2496665f5677SKrish Sadhukhan     "guest_end:\n\t"
2497665f5677SKrish Sadhukhan     "vmmcall\n\t"
2498665f5677SKrish Sadhukhan     "pop %rbp\n\t"
2499665f5677SKrish Sadhukhan     "ret");
2500665f5677SKrish Sadhukhan 
2501665f5677SKrish Sadhukhan static void svm_test_singlestep(void)
2502665f5677SKrish Sadhukhan {
2503665f5677SKrish Sadhukhan 	handle_exception(DB_VECTOR, guest_rflags_test_db_handler);
2504665f5677SKrish Sadhukhan 
2505665f5677SKrish Sadhukhan 	/*
2506665f5677SKrish Sadhukhan 	 * Trap expected after completion of first guest instruction
2507665f5677SKrish Sadhukhan 	 */
2508665f5677SKrish Sadhukhan 	vmcb->save.rflags |= X86_EFLAGS_TF;
2509665f5677SKrish Sadhukhan 	report (__svm_vmrun((u64)guest_rflags_test_guest) == SVM_EXIT_VMMCALL &&
2510665f5677SKrish Sadhukhan 		guest_rflags_test_trap_rip == (u64)&insn2,
2511665f5677SKrish Sadhukhan 		"Test EFLAGS.TF on VMRUN: trap expected  after completion of first guest instruction");
2512665f5677SKrish Sadhukhan 	/*
2513665f5677SKrish Sadhukhan 	 * No trap expected
2514665f5677SKrish Sadhukhan 	 */
2515665f5677SKrish Sadhukhan 	guest_rflags_test_trap_rip = 0;
2516665f5677SKrish Sadhukhan 	vmcb->save.rip += 3;
2517665f5677SKrish Sadhukhan 	vmcb->save.rflags |= X86_EFLAGS_TF;
2518665f5677SKrish Sadhukhan 	report (__svm_vmrun(vmcb->save.rip) == SVM_EXIT_VMMCALL &&
2519665f5677SKrish Sadhukhan 		guest_rflags_test_trap_rip == 0, "Test EFLAGS.TF on VMRUN: trap not expected");
2520665f5677SKrish Sadhukhan 
2521665f5677SKrish Sadhukhan 	/*
2522665f5677SKrish Sadhukhan 	 * Let guest finish execution
2523665f5677SKrish Sadhukhan 	 */
2524665f5677SKrish Sadhukhan 	vmcb->save.rip += 3;
2525665f5677SKrish Sadhukhan 	report (__svm_vmrun(vmcb->save.rip) == SVM_EXIT_VMMCALL &&
2526665f5677SKrish Sadhukhan 		vmcb->save.rip == (u64)&guest_end, "Test EFLAGS.TF on VMRUN: guest execution completion");
2527665f5677SKrish Sadhukhan }
2528665f5677SKrish Sadhukhan 
25297a57ef5dSMaxim Levitsky static bool volatile svm_errata_reproduced = false;
25307a57ef5dSMaxim Levitsky static unsigned long volatile physical = 0;
25317a57ef5dSMaxim Levitsky 
25327a57ef5dSMaxim Levitsky 
25337a57ef5dSMaxim Levitsky /*
25347a57ef5dSMaxim Levitsky  *
25357a57ef5dSMaxim Levitsky  * Test the following errata:
25367a57ef5dSMaxim Levitsky  * If the VMRUN/VMSAVE/VMLOAD are attempted by the nested guest,
25377a57ef5dSMaxim Levitsky  * the CPU would first check the EAX against host reserved memory
25387a57ef5dSMaxim Levitsky  * regions (so far only SMM_ADDR/SMM_MASK are known to cause it),
25397a57ef5dSMaxim Levitsky  * and only then signal #VMexit
25407a57ef5dSMaxim Levitsky  *
25417a57ef5dSMaxim Levitsky  * Try to reproduce this by trying vmsave on each possible 4K aligned memory
25427a57ef5dSMaxim Levitsky  * address in the low 4G where the SMM area has to reside.
25437a57ef5dSMaxim Levitsky  */
25447a57ef5dSMaxim Levitsky 
25457a57ef5dSMaxim Levitsky static void gp_isr(struct ex_regs *r)
25467a57ef5dSMaxim Levitsky {
25477a57ef5dSMaxim Levitsky 	svm_errata_reproduced = true;
25487a57ef5dSMaxim Levitsky 	/* skip over the vmsave instruction*/
25497a57ef5dSMaxim Levitsky 	r->rip += 3;
25507a57ef5dSMaxim Levitsky }
25517a57ef5dSMaxim Levitsky 
25527a57ef5dSMaxim Levitsky static void svm_vmrun_errata_test(void)
25537a57ef5dSMaxim Levitsky {
25547a57ef5dSMaxim Levitsky 	unsigned long *last_page = NULL;
25557a57ef5dSMaxim Levitsky 
25567a57ef5dSMaxim Levitsky 	handle_exception(GP_VECTOR, gp_isr);
25577a57ef5dSMaxim Levitsky 
25587a57ef5dSMaxim Levitsky 	while (!svm_errata_reproduced) {
25597a57ef5dSMaxim Levitsky 
25607a57ef5dSMaxim Levitsky 		unsigned long *page = alloc_pages(1);
25617a57ef5dSMaxim Levitsky 
25627a57ef5dSMaxim Levitsky 		if (!page) {
25635c3582f0SJanis Schoetterl-Glausch 			report_pass("All guest memory tested, no bug found");
25647a57ef5dSMaxim Levitsky 			break;
25657a57ef5dSMaxim Levitsky 		}
25667a57ef5dSMaxim Levitsky 
25677a57ef5dSMaxim Levitsky 		physical = virt_to_phys(page);
25687a57ef5dSMaxim Levitsky 
25697a57ef5dSMaxim Levitsky 		asm volatile (
25707a57ef5dSMaxim Levitsky 			      "mov %[_physical], %%rax\n\t"
25717a57ef5dSMaxim Levitsky 			      "vmsave %%rax\n\t"
25727a57ef5dSMaxim Levitsky 
25737a57ef5dSMaxim Levitsky 			      : [_physical] "=m" (physical)
25747a57ef5dSMaxim Levitsky 			      : /* no inputs*/
25757a57ef5dSMaxim Levitsky 			      : "rax" /*clobbers*/
25767a57ef5dSMaxim Levitsky 			      );
25777a57ef5dSMaxim Levitsky 
25787a57ef5dSMaxim Levitsky 		if (svm_errata_reproduced) {
2579198dfd0eSJanis Schoetterl-Glausch 			report_fail("Got #GP exception - svm errata reproduced at 0x%lx",
25807a57ef5dSMaxim Levitsky 				    physical);
25817a57ef5dSMaxim Levitsky 			break;
25827a57ef5dSMaxim Levitsky 		}
25837a57ef5dSMaxim Levitsky 
25847a57ef5dSMaxim Levitsky 		*page = (unsigned long)last_page;
25857a57ef5dSMaxim Levitsky 		last_page = page;
25867a57ef5dSMaxim Levitsky 	}
25877a57ef5dSMaxim Levitsky 
25887a57ef5dSMaxim Levitsky 	while (last_page) {
25897a57ef5dSMaxim Levitsky 		unsigned long *page = last_page;
25907a57ef5dSMaxim Levitsky 		last_page = (unsigned long *)*last_page;
25917a57ef5dSMaxim Levitsky 		free_pages_by_order(page, 1);
25927a57ef5dSMaxim Levitsky 	}
25937a57ef5dSMaxim Levitsky }
25947a57ef5dSMaxim Levitsky 
25950b6f6cedSKrish Sadhukhan static void vmload_vmsave_guest_main(struct svm_test *test)
25960b6f6cedSKrish Sadhukhan {
25970b6f6cedSKrish Sadhukhan 	u64 vmcb_phys = virt_to_phys(vmcb);
25980b6f6cedSKrish Sadhukhan 
25990b6f6cedSKrish Sadhukhan 	asm volatile ("vmload %0" : : "a"(vmcb_phys));
26000b6f6cedSKrish Sadhukhan 	asm volatile ("vmsave %0" : : "a"(vmcb_phys));
26010b6f6cedSKrish Sadhukhan }
26020b6f6cedSKrish Sadhukhan 
26030b6f6cedSKrish Sadhukhan static void svm_vmload_vmsave(void)
26040b6f6cedSKrish Sadhukhan {
26050b6f6cedSKrish Sadhukhan 	u32 intercept_saved = vmcb->control.intercept;
26060b6f6cedSKrish Sadhukhan 
26070b6f6cedSKrish Sadhukhan 	test_set_guest(vmload_vmsave_guest_main);
26080b6f6cedSKrish Sadhukhan 
26090b6f6cedSKrish Sadhukhan 	/*
26100b6f6cedSKrish Sadhukhan 	 * Disabling intercept for VMLOAD and VMSAVE doesn't cause
26110b6f6cedSKrish Sadhukhan 	 * respective #VMEXIT to host
26120b6f6cedSKrish Sadhukhan 	 */
26130b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD);
26140b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE);
26150b6f6cedSKrish Sadhukhan 	svm_vmrun();
26160b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test "
26170b6f6cedSKrish Sadhukhan 	       "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT");
26180b6f6cedSKrish Sadhukhan 
26190b6f6cedSKrish Sadhukhan 	/*
26200b6f6cedSKrish Sadhukhan 	 * Enabling intercept for VMLOAD and VMSAVE causes respective
26210b6f6cedSKrish Sadhukhan 	 * #VMEXIT to host
26220b6f6cedSKrish Sadhukhan 	 */
26230b6f6cedSKrish Sadhukhan 	vmcb->control.intercept |= (1ULL << INTERCEPT_VMLOAD);
26240b6f6cedSKrish Sadhukhan 	svm_vmrun();
26250b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMLOAD, "Test "
26260b6f6cedSKrish Sadhukhan 	       "VMLOAD/VMSAVE intercept: Expected VMLOAD #VMEXIT");
26270b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD);
26280b6f6cedSKrish Sadhukhan 	vmcb->control.intercept |= (1ULL << INTERCEPT_VMSAVE);
26290b6f6cedSKrish Sadhukhan 	svm_vmrun();
26300b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMSAVE, "Test "
26310b6f6cedSKrish Sadhukhan 	       "VMLOAD/VMSAVE intercept: Expected VMSAVE #VMEXIT");
26320b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE);
26330b6f6cedSKrish Sadhukhan 	svm_vmrun();
26340b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test "
26350b6f6cedSKrish Sadhukhan 	       "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT");
26360b6f6cedSKrish Sadhukhan 
26370b6f6cedSKrish Sadhukhan 	vmcb->control.intercept |= (1ULL << INTERCEPT_VMLOAD);
26380b6f6cedSKrish Sadhukhan 	svm_vmrun();
26390b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMLOAD, "Test "
26400b6f6cedSKrish Sadhukhan 	       "VMLOAD/VMSAVE intercept: Expected VMLOAD #VMEXIT");
26410b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD);
26420b6f6cedSKrish Sadhukhan 	svm_vmrun();
26430b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test "
26440b6f6cedSKrish Sadhukhan 	       "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT");
26450b6f6cedSKrish Sadhukhan 
26460b6f6cedSKrish Sadhukhan 	vmcb->control.intercept |= (1ULL << INTERCEPT_VMSAVE);
26470b6f6cedSKrish Sadhukhan 	svm_vmrun();
26480b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMSAVE, "Test "
26490b6f6cedSKrish Sadhukhan 	       "VMLOAD/VMSAVE intercept: Expected VMSAVE #VMEXIT");
26500b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE);
26510b6f6cedSKrish Sadhukhan 	svm_vmrun();
26520b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test "
26530b6f6cedSKrish Sadhukhan 	       "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT");
26540b6f6cedSKrish Sadhukhan 
26550b6f6cedSKrish Sadhukhan 	vmcb->control.intercept = intercept_saved;
26560b6f6cedSKrish Sadhukhan }
26570b6f6cedSKrish Sadhukhan 
2658f6972bd6SLara Lazier static void prepare_vgif_enabled(struct svm_test *test)
2659f6972bd6SLara Lazier {
2660f6972bd6SLara Lazier 	default_prepare(test);
2661f6972bd6SLara Lazier }
2662f6972bd6SLara Lazier 
2663f6972bd6SLara Lazier static void test_vgif(struct svm_test *test)
2664f6972bd6SLara Lazier {
2665f6972bd6SLara Lazier 	asm volatile ("vmmcall\n\tstgi\n\tvmmcall\n\tclgi\n\tvmmcall\n\t");
2666f6972bd6SLara Lazier }
2667f6972bd6SLara Lazier 
2668f6972bd6SLara Lazier static bool vgif_finished(struct svm_test *test)
2669f6972bd6SLara Lazier {
2670f6972bd6SLara Lazier 	switch (get_test_stage(test))
2671f6972bd6SLara Lazier 		{
2672f6972bd6SLara Lazier 		case 0:
2673f6972bd6SLara Lazier 			if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
2674198dfd0eSJanis Schoetterl-Glausch 				report_fail("VMEXIT not due to vmmcall.");
2675f6972bd6SLara Lazier 				return true;
2676f6972bd6SLara Lazier 			}
2677f6972bd6SLara Lazier 			vmcb->control.int_ctl |= V_GIF_ENABLED_MASK;
2678f6972bd6SLara Lazier 			vmcb->save.rip += 3;
2679f6972bd6SLara Lazier 			inc_test_stage(test);
2680f6972bd6SLara Lazier 			break;
2681f6972bd6SLara Lazier 		case 1:
2682f6972bd6SLara Lazier 			if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
2683198dfd0eSJanis Schoetterl-Glausch 				report_fail("VMEXIT not due to vmmcall.");
2684f6972bd6SLara Lazier 				return true;
2685f6972bd6SLara Lazier 			}
2686f6972bd6SLara Lazier 			if (!(vmcb->control.int_ctl & V_GIF_MASK)) {
2687198dfd0eSJanis Schoetterl-Glausch 				report_fail("Failed to set VGIF when executing STGI.");
2688f6972bd6SLara Lazier 				vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK;
2689f6972bd6SLara Lazier 				return true;
2690f6972bd6SLara Lazier 			}
26915c3582f0SJanis Schoetterl-Glausch 			report_pass("STGI set VGIF bit.");
2692f6972bd6SLara Lazier 			vmcb->save.rip += 3;
2693f6972bd6SLara Lazier 			inc_test_stage(test);
2694f6972bd6SLara Lazier 			break;
2695f6972bd6SLara Lazier 		case 2:
2696f6972bd6SLara Lazier 			if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
2697198dfd0eSJanis Schoetterl-Glausch 				report_fail("VMEXIT not due to vmmcall.");
2698f6972bd6SLara Lazier 				return true;
2699f6972bd6SLara Lazier 			}
2700f6972bd6SLara Lazier 			if (vmcb->control.int_ctl & V_GIF_MASK) {
2701198dfd0eSJanis Schoetterl-Glausch 				report_fail("Failed to clear VGIF when executing CLGI.");
2702f6972bd6SLara Lazier 				vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK;
2703f6972bd6SLara Lazier 				return true;
2704f6972bd6SLara Lazier 			}
27055c3582f0SJanis Schoetterl-Glausch 			report_pass("CLGI cleared VGIF bit.");
2706f6972bd6SLara Lazier 			vmcb->save.rip += 3;
2707f6972bd6SLara Lazier 			inc_test_stage(test);
2708f6972bd6SLara Lazier 			vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK;
2709f6972bd6SLara Lazier 			break;
2710f6972bd6SLara Lazier 		default:
2711f6972bd6SLara Lazier 			return true;
2712f6972bd6SLara Lazier 			break;
2713f6972bd6SLara Lazier 		}
2714f6972bd6SLara Lazier 
2715f6972bd6SLara Lazier 	return get_test_stage(test) == 3;
2716f6972bd6SLara Lazier }
2717f6972bd6SLara Lazier 
2718f6972bd6SLara Lazier static bool vgif_check(struct svm_test *test)
2719f6972bd6SLara Lazier {
2720f6972bd6SLara Lazier 	return get_test_stage(test) == 3;
2721f6972bd6SLara Lazier }
2722f6972bd6SLara Lazier 
27238650dffeSMaxim Levitsky 
27248650dffeSMaxim Levitsky static int pause_test_counter;
27258650dffeSMaxim Levitsky static int wait_counter;
27268650dffeSMaxim Levitsky 
27278650dffeSMaxim Levitsky static void pause_filter_test_guest_main(struct svm_test *test)
27288650dffeSMaxim Levitsky {
27298650dffeSMaxim Levitsky 	int i;
27308650dffeSMaxim Levitsky 	for (i = 0 ; i < pause_test_counter ; i++)
27318650dffeSMaxim Levitsky 		pause();
27328650dffeSMaxim Levitsky 
27338650dffeSMaxim Levitsky 	if (!wait_counter)
27348650dffeSMaxim Levitsky 		return;
27358650dffeSMaxim Levitsky 
27368650dffeSMaxim Levitsky 	for (i = 0; i < wait_counter; i++)
27378650dffeSMaxim Levitsky 		;
27388650dffeSMaxim Levitsky 
27398650dffeSMaxim Levitsky 	for (i = 0 ; i < pause_test_counter ; i++)
27408650dffeSMaxim Levitsky 		pause();
27418650dffeSMaxim Levitsky 
27428650dffeSMaxim Levitsky }
27438650dffeSMaxim Levitsky 
27448650dffeSMaxim Levitsky static void pause_filter_run_test(int pause_iterations, int filter_value, int wait_iterations, int threshold)
27458650dffeSMaxim Levitsky {
27468650dffeSMaxim Levitsky 	test_set_guest(pause_filter_test_guest_main);
27478650dffeSMaxim Levitsky 
27488650dffeSMaxim Levitsky 	pause_test_counter = pause_iterations;
27498650dffeSMaxim Levitsky 	wait_counter = wait_iterations;
27508650dffeSMaxim Levitsky 
27518650dffeSMaxim Levitsky 	vmcb->control.pause_filter_count = filter_value;
27528650dffeSMaxim Levitsky 	vmcb->control.pause_filter_thresh = threshold;
27538650dffeSMaxim Levitsky 	svm_vmrun();
27548650dffeSMaxim Levitsky 
27558650dffeSMaxim Levitsky 	if (filter_value <= pause_iterations || wait_iterations < threshold)
27568650dffeSMaxim Levitsky 		report(vmcb->control.exit_code == SVM_EXIT_PAUSE, "expected PAUSE vmexit");
27578650dffeSMaxim Levitsky 	else
27588650dffeSMaxim Levitsky 		report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "no expected PAUSE vmexit");
27598650dffeSMaxim Levitsky }
27608650dffeSMaxim Levitsky 
27618650dffeSMaxim Levitsky static void pause_filter_test(void)
27628650dffeSMaxim Levitsky {
27638650dffeSMaxim Levitsky 	if (!pause_filter_supported()) {
27648650dffeSMaxim Levitsky 		report_skip("PAUSE filter not supported in the guest");
27658650dffeSMaxim Levitsky 		return;
27668650dffeSMaxim Levitsky 	}
27678650dffeSMaxim Levitsky 
27688650dffeSMaxim Levitsky 	vmcb->control.intercept |= (1 << INTERCEPT_PAUSE);
27698650dffeSMaxim Levitsky 
27708650dffeSMaxim Levitsky 	// filter count more that pause count - no VMexit
27718650dffeSMaxim Levitsky 	pause_filter_run_test(10, 9, 0, 0);
27728650dffeSMaxim Levitsky 
27738650dffeSMaxim Levitsky 	// filter count smaller pause count - no VMexit
27748650dffeSMaxim Levitsky 	pause_filter_run_test(20, 21, 0, 0);
27758650dffeSMaxim Levitsky 
27768650dffeSMaxim Levitsky 
27778650dffeSMaxim Levitsky 	if (pause_threshold_supported()) {
27788650dffeSMaxim Levitsky 		// filter count smaller pause count - no VMexit +  large enough threshold
27798650dffeSMaxim Levitsky 		// so that filter counter resets
27808650dffeSMaxim Levitsky 		pause_filter_run_test(20, 21, 1000, 10);
27818650dffeSMaxim Levitsky 
27828650dffeSMaxim Levitsky 		// filter count smaller pause count - no VMexit +  small threshold
27838650dffeSMaxim Levitsky 		// so that filter doesn't reset
27848650dffeSMaxim Levitsky 		pause_filter_run_test(20, 21, 10, 1000);
27858650dffeSMaxim Levitsky 	} else {
27868650dffeSMaxim Levitsky 		report_skip("PAUSE threshold not supported in the guest");
27878650dffeSMaxim Levitsky 		return;
27888650dffeSMaxim Levitsky 	}
27898650dffeSMaxim Levitsky }
27908650dffeSMaxim Levitsky 
2791694e59baSManali Shukla /* If CR0.TS and CR0.EM are cleared in L2, no #NM is generated. */
2792694e59baSManali Shukla static void svm_no_nm_test(void)
27935c92f156SManali Shukla {
27945c92f156SManali Shukla 	write_cr0(read_cr0() & ~X86_CR0_TS);
2795694e59baSManali Shukla 	test_set_guest((test_guest_func)fnop);
27965c92f156SManali Shukla 
27975c92f156SManali Shukla 	vmcb->save.cr0 = vmcb->save.cr0 & ~(X86_CR0_TS | X86_CR0_EM);
2798694e59baSManali Shukla 	report(svm_vmrun() == SVM_EXIT_VMMCALL,
27993f27d772SManali Shukla 	       "fnop with CR0.TS and CR0.EM unset no #NM excpetion");
28005c92f156SManali Shukla }
2801f6972bd6SLara Lazier 
2802537d39dfSMaxim Levitsky static bool check_lbr(u64 *from_excepted, u64 *to_expected)
2803537d39dfSMaxim Levitsky {
2804537d39dfSMaxim Levitsky 	u64 from = rdmsr(MSR_IA32_LASTBRANCHFROMIP);
2805537d39dfSMaxim Levitsky 	u64 to = rdmsr(MSR_IA32_LASTBRANCHTOIP);
2806537d39dfSMaxim Levitsky 
2807537d39dfSMaxim Levitsky 	if ((u64)from_excepted != from) {
2808537d39dfSMaxim Levitsky 		report(false, "MSR_IA32_LASTBRANCHFROMIP, expected=0x%lx, actual=0x%lx",
2809537d39dfSMaxim Levitsky 		       (u64)from_excepted, from);
2810537d39dfSMaxim Levitsky 		return false;
2811537d39dfSMaxim Levitsky 	}
2812537d39dfSMaxim Levitsky 
2813537d39dfSMaxim Levitsky 	if ((u64)to_expected != to) {
2814537d39dfSMaxim Levitsky 		report(false, "MSR_IA32_LASTBRANCHFROMIP, expected=0x%lx, actual=0x%lx",
2815537d39dfSMaxim Levitsky 		       (u64)from_excepted, from);
2816537d39dfSMaxim Levitsky 		return false;
2817537d39dfSMaxim Levitsky 	}
2818537d39dfSMaxim Levitsky 
2819537d39dfSMaxim Levitsky 	return true;
2820537d39dfSMaxim Levitsky }
2821537d39dfSMaxim Levitsky 
2822537d39dfSMaxim Levitsky static bool check_dbgctl(u64 dbgctl, u64 dbgctl_expected)
2823537d39dfSMaxim Levitsky {
2824537d39dfSMaxim Levitsky 	if (dbgctl != dbgctl_expected) {
2825537d39dfSMaxim Levitsky 		report(false, "Unexpected MSR_IA32_DEBUGCTLMSR value 0x%lx", dbgctl);
2826537d39dfSMaxim Levitsky 		return false;
2827537d39dfSMaxim Levitsky 	}
2828537d39dfSMaxim Levitsky 	return true;
2829537d39dfSMaxim Levitsky }
2830537d39dfSMaxim Levitsky 
2831537d39dfSMaxim Levitsky 
2832537d39dfSMaxim Levitsky #define DO_BRANCH(branch_name)				\
2833537d39dfSMaxim Levitsky 	asm volatile (					\
2834537d39dfSMaxim Levitsky 		      # branch_name "_from:"		\
2835537d39dfSMaxim Levitsky 		      "jmp " # branch_name  "_to\n"	\
2836537d39dfSMaxim Levitsky 		      "nop\n"				\
2837537d39dfSMaxim Levitsky 		      "nop\n"				\
2838537d39dfSMaxim Levitsky 		      # branch_name  "_to:"		\
2839537d39dfSMaxim Levitsky 		      "nop\n"				\
2840537d39dfSMaxim Levitsky 		       )
2841537d39dfSMaxim Levitsky 
2842537d39dfSMaxim Levitsky 
2843537d39dfSMaxim Levitsky extern u64 guest_branch0_from, guest_branch0_to;
2844537d39dfSMaxim Levitsky extern u64 guest_branch2_from, guest_branch2_to;
2845537d39dfSMaxim Levitsky 
2846537d39dfSMaxim Levitsky extern u64 host_branch0_from, host_branch0_to;
2847537d39dfSMaxim Levitsky extern u64 host_branch2_from, host_branch2_to;
2848537d39dfSMaxim Levitsky extern u64 host_branch3_from, host_branch3_to;
2849537d39dfSMaxim Levitsky extern u64 host_branch4_from, host_branch4_to;
2850537d39dfSMaxim Levitsky 
2851537d39dfSMaxim Levitsky u64 dbgctl;
2852537d39dfSMaxim Levitsky 
2853537d39dfSMaxim Levitsky static void svm_lbrv_test_guest1(void)
2854537d39dfSMaxim Levitsky {
2855537d39dfSMaxim Levitsky 	/*
2856537d39dfSMaxim Levitsky 	 * This guest expects the LBR to be already enabled when it starts,
2857537d39dfSMaxim Levitsky 	 * it does a branch, and then disables the LBR and then checks.
2858537d39dfSMaxim Levitsky 	 */
2859537d39dfSMaxim Levitsky 
2860537d39dfSMaxim Levitsky 	DO_BRANCH(guest_branch0);
2861537d39dfSMaxim Levitsky 
2862537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
2863537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, 0);
2864537d39dfSMaxim Levitsky 
2865537d39dfSMaxim Levitsky 	if (dbgctl != DEBUGCTLMSR_LBR)
2866537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2867537d39dfSMaxim Levitsky 	if (rdmsr(MSR_IA32_DEBUGCTLMSR) != 0)
2868537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2869537d39dfSMaxim Levitsky 	if (rdmsr(MSR_IA32_LASTBRANCHFROMIP) != (u64)&guest_branch0_from)
2870537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2871537d39dfSMaxim Levitsky 	if (rdmsr(MSR_IA32_LASTBRANCHTOIP) != (u64)&guest_branch0_to)
2872537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2873537d39dfSMaxim Levitsky 
2874537d39dfSMaxim Levitsky 	asm volatile ("vmmcall\n");
2875537d39dfSMaxim Levitsky }
2876537d39dfSMaxim Levitsky 
2877537d39dfSMaxim Levitsky static void svm_lbrv_test_guest2(void)
2878537d39dfSMaxim Levitsky {
2879537d39dfSMaxim Levitsky 	/*
2880537d39dfSMaxim Levitsky 	 * This guest expects the LBR to be disabled when it starts,
2881537d39dfSMaxim Levitsky 	 * enables it, does a branch, disables it and then checks.
2882537d39dfSMaxim Levitsky 	 */
2883537d39dfSMaxim Levitsky 
2884537d39dfSMaxim Levitsky 	DO_BRANCH(guest_branch1);
2885537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
2886537d39dfSMaxim Levitsky 
2887537d39dfSMaxim Levitsky 	if (dbgctl != 0)
2888537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2889537d39dfSMaxim Levitsky 
2890537d39dfSMaxim Levitsky 	if (rdmsr(MSR_IA32_LASTBRANCHFROMIP) != (u64)&host_branch2_from)
2891537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2892537d39dfSMaxim Levitsky 	if (rdmsr(MSR_IA32_LASTBRANCHTOIP) != (u64)&host_branch2_to)
2893537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2894537d39dfSMaxim Levitsky 
2895537d39dfSMaxim Levitsky 
2896537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR);
2897537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
2898537d39dfSMaxim Levitsky 	DO_BRANCH(guest_branch2);
2899537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, 0);
2900537d39dfSMaxim Levitsky 
2901537d39dfSMaxim Levitsky 	if (dbgctl != DEBUGCTLMSR_LBR)
2902537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2903537d39dfSMaxim Levitsky 	if (rdmsr(MSR_IA32_LASTBRANCHFROMIP) != (u64)&guest_branch2_from)
2904537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2905537d39dfSMaxim Levitsky 	if (rdmsr(MSR_IA32_LASTBRANCHTOIP) != (u64)&guest_branch2_to)
2906537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2907537d39dfSMaxim Levitsky 
2908537d39dfSMaxim Levitsky 	asm volatile ("vmmcall\n");
2909537d39dfSMaxim Levitsky }
2910537d39dfSMaxim Levitsky 
2911537d39dfSMaxim Levitsky static void svm_lbrv_test0(void)
2912537d39dfSMaxim Levitsky {
2913537d39dfSMaxim Levitsky 	report(true, "Basic LBR test");
2914537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR);
2915537d39dfSMaxim Levitsky 	DO_BRANCH(host_branch0);
2916537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
2917537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, 0);
2918537d39dfSMaxim Levitsky 
2919537d39dfSMaxim Levitsky 	check_dbgctl(dbgctl, DEBUGCTLMSR_LBR);
2920537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
2921537d39dfSMaxim Levitsky 	check_dbgctl(dbgctl, 0);
2922537d39dfSMaxim Levitsky 
2923537d39dfSMaxim Levitsky 	check_lbr(&host_branch0_from, &host_branch0_to);
2924537d39dfSMaxim Levitsky }
2925537d39dfSMaxim Levitsky 
2926537d39dfSMaxim Levitsky static void svm_lbrv_test1(void)
2927537d39dfSMaxim Levitsky {
2928537d39dfSMaxim Levitsky 	report(true, "Test that without LBRV enabled, guest LBR state does 'leak' to the host(1)");
2929537d39dfSMaxim Levitsky 
2930*5200c1f1SSean Christopherson 	svm_setup_vmrun((u64)svm_lbrv_test_guest1);
2931537d39dfSMaxim Levitsky 	vmcb->control.virt_ext = 0;
2932537d39dfSMaxim Levitsky 
2933537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR);
2934537d39dfSMaxim Levitsky 	DO_BRANCH(host_branch1);
2935537d39dfSMaxim Levitsky 	SVM_BARE_VMRUN;
2936537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
2937537d39dfSMaxim Levitsky 
2938537d39dfSMaxim Levitsky 	if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
2939537d39dfSMaxim Levitsky 		report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
2940537d39dfSMaxim Levitsky 		       vmcb->control.exit_code);
2941537d39dfSMaxim Levitsky 		return;
2942537d39dfSMaxim Levitsky 	}
2943537d39dfSMaxim Levitsky 
2944537d39dfSMaxim Levitsky 	check_dbgctl(dbgctl, 0);
2945537d39dfSMaxim Levitsky 	check_lbr(&guest_branch0_from, &guest_branch0_to);
2946537d39dfSMaxim Levitsky }
2947537d39dfSMaxim Levitsky 
2948537d39dfSMaxim Levitsky static void svm_lbrv_test2(void)
2949537d39dfSMaxim Levitsky {
2950537d39dfSMaxim Levitsky 	report(true, "Test that without LBRV enabled, guest LBR state does 'leak' to the host(2)");
2951537d39dfSMaxim Levitsky 
2952*5200c1f1SSean Christopherson 	svm_setup_vmrun((u64)svm_lbrv_test_guest2);
2953537d39dfSMaxim Levitsky 	vmcb->control.virt_ext = 0;
2954537d39dfSMaxim Levitsky 
2955537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR);
2956537d39dfSMaxim Levitsky 	DO_BRANCH(host_branch2);
2957537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, 0);
2958537d39dfSMaxim Levitsky 	SVM_BARE_VMRUN;
2959537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
2960537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, 0);
2961537d39dfSMaxim Levitsky 
2962537d39dfSMaxim Levitsky 	if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
2963537d39dfSMaxim Levitsky 		report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
2964537d39dfSMaxim Levitsky 		       vmcb->control.exit_code);
2965537d39dfSMaxim Levitsky 		return;
2966537d39dfSMaxim Levitsky 	}
2967537d39dfSMaxim Levitsky 
2968537d39dfSMaxim Levitsky 	check_dbgctl(dbgctl, 0);
2969537d39dfSMaxim Levitsky 	check_lbr(&guest_branch2_from, &guest_branch2_to);
2970537d39dfSMaxim Levitsky }
2971537d39dfSMaxim Levitsky 
2972537d39dfSMaxim Levitsky static void svm_lbrv_nested_test1(void)
2973537d39dfSMaxim Levitsky {
2974537d39dfSMaxim Levitsky 	if (!lbrv_supported()) {
2975537d39dfSMaxim Levitsky 		report_skip("LBRV not supported in the guest");
2976537d39dfSMaxim Levitsky 		return;
2977537d39dfSMaxim Levitsky 	}
2978537d39dfSMaxim Levitsky 
2979537d39dfSMaxim Levitsky 	report(true, "Test that with LBRV enabled, guest LBR state doesn't leak (1)");
2980*5200c1f1SSean Christopherson 	svm_setup_vmrun((u64)svm_lbrv_test_guest1);
2981537d39dfSMaxim Levitsky 	vmcb->control.virt_ext = LBR_CTL_ENABLE_MASK;
2982537d39dfSMaxim Levitsky 	vmcb->save.dbgctl = DEBUGCTLMSR_LBR;
2983537d39dfSMaxim Levitsky 
2984537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR);
2985537d39dfSMaxim Levitsky 	DO_BRANCH(host_branch3);
2986537d39dfSMaxim Levitsky 	SVM_BARE_VMRUN;
2987537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
2988537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, 0);
2989537d39dfSMaxim Levitsky 
2990537d39dfSMaxim Levitsky 	if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
2991537d39dfSMaxim Levitsky 		report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
2992537d39dfSMaxim Levitsky 		       vmcb->control.exit_code);
2993537d39dfSMaxim Levitsky 		return;
2994537d39dfSMaxim Levitsky 	}
2995537d39dfSMaxim Levitsky 
2996537d39dfSMaxim Levitsky 	if (vmcb->save.dbgctl != 0) {
2997537d39dfSMaxim Levitsky 		report(false, "unexpected virtual guest MSR_IA32_DEBUGCTLMSR value 0x%lx", vmcb->save.dbgctl);
2998537d39dfSMaxim Levitsky 		return;
2999537d39dfSMaxim Levitsky 	}
3000537d39dfSMaxim Levitsky 
3001537d39dfSMaxim Levitsky 	check_dbgctl(dbgctl, DEBUGCTLMSR_LBR);
3002537d39dfSMaxim Levitsky 	check_lbr(&host_branch3_from, &host_branch3_to);
3003537d39dfSMaxim Levitsky }
30043f27d772SManali Shukla 
3005537d39dfSMaxim Levitsky static void svm_lbrv_nested_test2(void)
3006537d39dfSMaxim Levitsky {
3007537d39dfSMaxim Levitsky 	if (!lbrv_supported()) {
3008537d39dfSMaxim Levitsky 		report_skip("LBRV not supported in the guest");
3009537d39dfSMaxim Levitsky 		return;
3010537d39dfSMaxim Levitsky 	}
3011537d39dfSMaxim Levitsky 
3012537d39dfSMaxim Levitsky 	report(true, "Test that with LBRV enabled, guest LBR state doesn't leak (2)");
3013*5200c1f1SSean Christopherson 	svm_setup_vmrun((u64)svm_lbrv_test_guest2);
3014537d39dfSMaxim Levitsky 	vmcb->control.virt_ext = LBR_CTL_ENABLE_MASK;
3015537d39dfSMaxim Levitsky 
3016537d39dfSMaxim Levitsky 	vmcb->save.dbgctl = 0;
3017537d39dfSMaxim Levitsky 	vmcb->save.br_from = (u64)&host_branch2_from;
3018537d39dfSMaxim Levitsky 	vmcb->save.br_to = (u64)&host_branch2_to;
3019537d39dfSMaxim Levitsky 
3020537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR);
3021537d39dfSMaxim Levitsky 	DO_BRANCH(host_branch4);
3022537d39dfSMaxim Levitsky 	SVM_BARE_VMRUN;
3023537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
3024537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, 0);
3025537d39dfSMaxim Levitsky 
3026537d39dfSMaxim Levitsky 	if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
3027537d39dfSMaxim Levitsky 		report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
3028537d39dfSMaxim Levitsky 		       vmcb->control.exit_code);
3029537d39dfSMaxim Levitsky 		return;
3030537d39dfSMaxim Levitsky 	}
3031537d39dfSMaxim Levitsky 
3032537d39dfSMaxim Levitsky 	check_dbgctl(dbgctl, DEBUGCTLMSR_LBR);
3033537d39dfSMaxim Levitsky 	check_lbr(&host_branch4_from, &host_branch4_to);
3034537d39dfSMaxim Levitsky }
3035537d39dfSMaxim Levitsky 
3036c45bccfcSMaxim Levitsky 
3037c45bccfcSMaxim Levitsky // test that a nested guest which does enable INTR interception
3038c45bccfcSMaxim Levitsky // but doesn't enable virtual interrupt masking works
3039c45bccfcSMaxim Levitsky 
3040c45bccfcSMaxim Levitsky static volatile int dummy_isr_recevied;
3041c45bccfcSMaxim Levitsky static void dummy_isr(isr_regs_t *regs)
3042c45bccfcSMaxim Levitsky {
3043c45bccfcSMaxim Levitsky 	dummy_isr_recevied++;
3044c45bccfcSMaxim Levitsky 	eoi();
3045c45bccfcSMaxim Levitsky }
3046c45bccfcSMaxim Levitsky 
3047c45bccfcSMaxim Levitsky 
3048c45bccfcSMaxim Levitsky static volatile int nmi_recevied;
3049c45bccfcSMaxim Levitsky static void dummy_nmi_handler(struct ex_regs *regs)
3050c45bccfcSMaxim Levitsky {
3051c45bccfcSMaxim Levitsky 	nmi_recevied++;
3052c45bccfcSMaxim Levitsky }
3053c45bccfcSMaxim Levitsky 
3054c45bccfcSMaxim Levitsky 
3055c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_run_guest(volatile int *counter, int expected_vmexit)
3056c45bccfcSMaxim Levitsky {
3057c45bccfcSMaxim Levitsky 	if (counter)
3058c45bccfcSMaxim Levitsky 		*counter = 0;
3059c45bccfcSMaxim Levitsky 
3060c45bccfcSMaxim Levitsky 	sti();  // host IF value should not matter
3061c45bccfcSMaxim Levitsky 	clgi(); // vmrun will set back GI to 1
3062c45bccfcSMaxim Levitsky 
3063c45bccfcSMaxim Levitsky 	svm_vmrun();
3064c45bccfcSMaxim Levitsky 
3065c45bccfcSMaxim Levitsky 	if (counter)
3066c45bccfcSMaxim Levitsky 		report(!*counter, "No interrupt expected");
3067c45bccfcSMaxim Levitsky 
3068c45bccfcSMaxim Levitsky 	stgi();
3069c45bccfcSMaxim Levitsky 
3070c45bccfcSMaxim Levitsky 	if (counter)
3071c45bccfcSMaxim Levitsky 		report(*counter == 1, "Interrupt is expected");
3072c45bccfcSMaxim Levitsky 
3073c45bccfcSMaxim Levitsky 	report (vmcb->control.exit_code == expected_vmexit, "Test expected VM exit");
3074c45bccfcSMaxim Levitsky 	report(vmcb->save.rflags & X86_EFLAGS_IF, "Guest should have EFLAGS.IF set now");
3075c45bccfcSMaxim Levitsky 	cli();
3076c45bccfcSMaxim Levitsky }
3077c45bccfcSMaxim Levitsky 
3078c45bccfcSMaxim Levitsky 
3079c45bccfcSMaxim Levitsky // subtest: test that enabling EFLAGS.IF is enought to trigger an interrupt
3080c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_if_guest(struct svm_test *test)
3081c45bccfcSMaxim Levitsky {
3082c45bccfcSMaxim Levitsky 	asm volatile("nop;nop;nop;nop");
3083c45bccfcSMaxim Levitsky 	report(!dummy_isr_recevied, "No interrupt expected");
3084c45bccfcSMaxim Levitsky 	sti();
3085c45bccfcSMaxim Levitsky 	asm volatile("nop");
3086c45bccfcSMaxim Levitsky 	report(0, "must not reach here");
3087c45bccfcSMaxim Levitsky }
3088c45bccfcSMaxim Levitsky 
3089c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_if(void)
3090c45bccfcSMaxim Levitsky {
3091c45bccfcSMaxim Levitsky 	// make a physical interrupt to be pending
3092c45bccfcSMaxim Levitsky 	handle_irq(0x55, dummy_isr);
3093c45bccfcSMaxim Levitsky 
3094c45bccfcSMaxim Levitsky 	vmcb->control.intercept |= (1 << INTERCEPT_INTR);
3095c45bccfcSMaxim Levitsky 	vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
3096c45bccfcSMaxim Levitsky 	vmcb->save.rflags &= ~X86_EFLAGS_IF;
3097c45bccfcSMaxim Levitsky 
3098c45bccfcSMaxim Levitsky 	test_set_guest(svm_intr_intercept_mix_if_guest);
3099c45bccfcSMaxim Levitsky 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0);
3100c45bccfcSMaxim Levitsky 	svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR);
3101c45bccfcSMaxim Levitsky }
3102c45bccfcSMaxim Levitsky 
3103c45bccfcSMaxim Levitsky 
3104c45bccfcSMaxim Levitsky // subtest: test that a clever guest can trigger an interrupt by setting GIF
3105c45bccfcSMaxim Levitsky // if GIF is not intercepted
3106c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_gif_guest(struct svm_test *test)
3107c45bccfcSMaxim Levitsky {
3108c45bccfcSMaxim Levitsky 
3109c45bccfcSMaxim Levitsky 	asm volatile("nop;nop;nop;nop");
3110c45bccfcSMaxim Levitsky 	report(!dummy_isr_recevied, "No interrupt expected");
3111c45bccfcSMaxim Levitsky 
3112c45bccfcSMaxim Levitsky 	// clear GIF and enable IF
3113c45bccfcSMaxim Levitsky 	// that should still not cause VM exit
3114c45bccfcSMaxim Levitsky 	clgi();
3115c45bccfcSMaxim Levitsky 	sti();
3116c45bccfcSMaxim Levitsky 	asm volatile("nop");
3117c45bccfcSMaxim Levitsky 	report(!dummy_isr_recevied, "No interrupt expected");
3118c45bccfcSMaxim Levitsky 
3119c45bccfcSMaxim Levitsky 	stgi();
3120c45bccfcSMaxim Levitsky 	asm volatile("nop");
3121c45bccfcSMaxim Levitsky 	report(0, "must not reach here");
3122c45bccfcSMaxim Levitsky }
3123c45bccfcSMaxim Levitsky 
3124c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_gif(void)
3125c45bccfcSMaxim Levitsky {
3126c45bccfcSMaxim Levitsky 	handle_irq(0x55, dummy_isr);
3127c45bccfcSMaxim Levitsky 
3128c45bccfcSMaxim Levitsky 	vmcb->control.intercept |= (1 << INTERCEPT_INTR);
3129c45bccfcSMaxim Levitsky 	vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
3130c45bccfcSMaxim Levitsky 	vmcb->save.rflags &= ~X86_EFLAGS_IF;
3131c45bccfcSMaxim Levitsky 
3132c45bccfcSMaxim Levitsky 	test_set_guest(svm_intr_intercept_mix_gif_guest);
3133c45bccfcSMaxim Levitsky 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0);
3134c45bccfcSMaxim Levitsky 	svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR);
3135c45bccfcSMaxim Levitsky }
3136c45bccfcSMaxim Levitsky 
3137c45bccfcSMaxim Levitsky // subtest: test that a clever guest can trigger an interrupt by setting GIF
3138c45bccfcSMaxim Levitsky // if GIF is not intercepted and interrupt comes after guest
3139c45bccfcSMaxim Levitsky // started running
3140c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_gif_guest2(struct svm_test *test)
3141c45bccfcSMaxim Levitsky {
3142c45bccfcSMaxim Levitsky 	asm volatile("nop;nop;nop;nop");
3143c45bccfcSMaxim Levitsky 	report(!dummy_isr_recevied, "No interrupt expected");
3144c45bccfcSMaxim Levitsky 
3145c45bccfcSMaxim Levitsky 	clgi();
3146c45bccfcSMaxim Levitsky 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0);
3147c45bccfcSMaxim Levitsky 	report(!dummy_isr_recevied, "No interrupt expected");
3148c45bccfcSMaxim Levitsky 
3149c45bccfcSMaxim Levitsky 	stgi();
3150c45bccfcSMaxim Levitsky 	asm volatile("nop");
3151c45bccfcSMaxim Levitsky 	report(0, "must not reach here");
3152c45bccfcSMaxim Levitsky }
3153c45bccfcSMaxim Levitsky 
3154c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_gif2(void)
3155c45bccfcSMaxim Levitsky {
3156c45bccfcSMaxim Levitsky 	handle_irq(0x55, dummy_isr);
3157c45bccfcSMaxim Levitsky 
3158c45bccfcSMaxim Levitsky 	vmcb->control.intercept |= (1 << INTERCEPT_INTR);
3159c45bccfcSMaxim Levitsky 	vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
3160c45bccfcSMaxim Levitsky 	vmcb->save.rflags |= X86_EFLAGS_IF;
3161c45bccfcSMaxim Levitsky 
3162c45bccfcSMaxim Levitsky 	test_set_guest(svm_intr_intercept_mix_gif_guest2);
3163c45bccfcSMaxim Levitsky 	svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR);
3164c45bccfcSMaxim Levitsky }
3165c45bccfcSMaxim Levitsky 
3166c45bccfcSMaxim Levitsky 
3167c45bccfcSMaxim Levitsky // subtest: test that pending NMI will be handled when guest enables GIF
3168c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_nmi_guest(struct svm_test *test)
3169c45bccfcSMaxim Levitsky {
3170c45bccfcSMaxim Levitsky 	asm volatile("nop;nop;nop;nop");
3171c45bccfcSMaxim Levitsky 	report(!nmi_recevied, "No NMI expected");
3172c45bccfcSMaxim Levitsky 	cli(); // should have no effect
3173c45bccfcSMaxim Levitsky 
3174c45bccfcSMaxim Levitsky 	clgi();
3175c45bccfcSMaxim Levitsky 	asm volatile("nop");
3176c45bccfcSMaxim Levitsky 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI, 0);
3177c45bccfcSMaxim Levitsky 	sti(); // should have no effect
3178c45bccfcSMaxim Levitsky 	asm volatile("nop");
3179c45bccfcSMaxim Levitsky 	report(!nmi_recevied, "No NMI expected");
3180c45bccfcSMaxim Levitsky 
3181c45bccfcSMaxim Levitsky 	stgi();
3182c45bccfcSMaxim Levitsky 	asm volatile("nop");
3183c45bccfcSMaxim Levitsky 	report(0, "must not reach here");
3184c45bccfcSMaxim Levitsky }
3185c45bccfcSMaxim Levitsky 
3186c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_nmi(void)
3187c45bccfcSMaxim Levitsky {
3188c45bccfcSMaxim Levitsky 	handle_exception(2, dummy_nmi_handler);
3189c45bccfcSMaxim Levitsky 
3190c45bccfcSMaxim Levitsky 	vmcb->control.intercept |= (1 << INTERCEPT_NMI);
3191c45bccfcSMaxim Levitsky 	vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
3192c45bccfcSMaxim Levitsky 	vmcb->save.rflags |= X86_EFLAGS_IF;
3193c45bccfcSMaxim Levitsky 
3194c45bccfcSMaxim Levitsky 	test_set_guest(svm_intr_intercept_mix_nmi_guest);
3195c45bccfcSMaxim Levitsky 	svm_intr_intercept_mix_run_guest(&nmi_recevied, SVM_EXIT_NMI);
3196c45bccfcSMaxim Levitsky }
3197c45bccfcSMaxim Levitsky 
3198c45bccfcSMaxim Levitsky // test that pending SMI will be handled when guest enables GIF
3199c45bccfcSMaxim Levitsky // TODO: can't really count #SMIs so just test that guest doesn't hang
3200c45bccfcSMaxim Levitsky // and VMexits on SMI
3201c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_smi_guest(struct svm_test *test)
3202c45bccfcSMaxim Levitsky {
3203c45bccfcSMaxim Levitsky 	asm volatile("nop;nop;nop;nop");
3204c45bccfcSMaxim Levitsky 
3205c45bccfcSMaxim Levitsky 	clgi();
3206c45bccfcSMaxim Levitsky 	asm volatile("nop");
3207c45bccfcSMaxim Levitsky 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_SMI, 0);
3208c45bccfcSMaxim Levitsky 	sti(); // should have no effect
3209c45bccfcSMaxim Levitsky 	asm volatile("nop");
3210c45bccfcSMaxim Levitsky 	stgi();
3211c45bccfcSMaxim Levitsky 	asm volatile("nop");
3212c45bccfcSMaxim Levitsky 	report(0, "must not reach here");
3213c45bccfcSMaxim Levitsky }
3214c45bccfcSMaxim Levitsky 
3215c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_smi(void)
3216c45bccfcSMaxim Levitsky {
3217c45bccfcSMaxim Levitsky 	vmcb->control.intercept |= (1 << INTERCEPT_SMI);
3218c45bccfcSMaxim Levitsky 	vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
3219c45bccfcSMaxim Levitsky 	test_set_guest(svm_intr_intercept_mix_smi_guest);
3220c45bccfcSMaxim Levitsky 	svm_intr_intercept_mix_run_guest(NULL, SVM_EXIT_SMI);
3221c45bccfcSMaxim Levitsky }
3222c45bccfcSMaxim Levitsky 
32238177dc62SManali Shukla static void svm_l2_ac_test(void)
32248177dc62SManali Shukla {
32258177dc62SManali Shukla 	bool hit_ac = false;
32268177dc62SManali Shukla 
32278177dc62SManali Shukla 	write_cr0(read_cr0() | X86_CR0_AM);
32288177dc62SManali Shukla 	write_rflags(read_rflags() | X86_EFLAGS_AC);
32298177dc62SManali Shukla 
32308177dc62SManali Shukla 	run_in_user(generate_usermode_ac, AC_VECTOR, 0, 0, 0, 0, &hit_ac);
32318177dc62SManali Shukla 	report(hit_ac, "Usermode #AC handled in L2");
32328177dc62SManali Shukla 	vmmcall();
32338177dc62SManali Shukla }
32348177dc62SManali Shukla 
32358177dc62SManali Shukla struct svm_exception_test {
32368177dc62SManali Shukla 	u8 vector;
32378177dc62SManali Shukla 	void (*guest_code)(void);
32388177dc62SManali Shukla };
32398177dc62SManali Shukla 
32408177dc62SManali Shukla struct svm_exception_test svm_exception_tests[] = {
32418177dc62SManali Shukla 	{ GP_VECTOR, generate_non_canonical_gp },
32428177dc62SManali Shukla 	{ UD_VECTOR, generate_ud },
32438177dc62SManali Shukla 	{ DE_VECTOR, generate_de },
32448177dc62SManali Shukla 	{ DB_VECTOR, generate_single_step_db },
324544550f53SManali Shukla 	{ BP_VECTOR, generate_bp },
32468177dc62SManali Shukla 	{ AC_VECTOR, svm_l2_ac_test },
32470851b7f7SManali Shukla 	{ OF_VECTOR, generate_of },
3248694e59baSManali Shukla 	{ NM_VECTOR, generate_cr0_ts_nm },
3249694e59baSManali Shukla 	{ NM_VECTOR, generate_cr0_em_nm },
32508177dc62SManali Shukla };
32518177dc62SManali Shukla 
32528177dc62SManali Shukla static u8 svm_exception_test_vector;
32538177dc62SManali Shukla 
32548177dc62SManali Shukla static void svm_exception_handler(struct ex_regs *regs)
32558177dc62SManali Shukla {
32568177dc62SManali Shukla 	report(regs->vector == svm_exception_test_vector,
32578177dc62SManali Shukla 		"Handling %s in L2's exception handler",
32588177dc62SManali Shukla 		exception_mnemonic(svm_exception_test_vector));
32598177dc62SManali Shukla 	vmmcall();
32608177dc62SManali Shukla }
32618177dc62SManali Shukla 
32628177dc62SManali Shukla static void handle_exception_in_l2(u8 vector)
32638177dc62SManali Shukla {
32648177dc62SManali Shukla 	handler old_handler = handle_exception(vector, svm_exception_handler);
32658177dc62SManali Shukla 	svm_exception_test_vector = vector;
32668177dc62SManali Shukla 
32678177dc62SManali Shukla 	report(svm_vmrun() == SVM_EXIT_VMMCALL,
32688177dc62SManali Shukla 		"%s handled by L2", exception_mnemonic(vector));
32698177dc62SManali Shukla 
32708177dc62SManali Shukla 	handle_exception(vector, old_handler);
32718177dc62SManali Shukla }
32728177dc62SManali Shukla 
32738177dc62SManali Shukla static void handle_exception_in_l1(u32 vector)
32748177dc62SManali Shukla {
32758177dc62SManali Shukla 	u32 old_ie = vmcb->control.intercept_exceptions;
32768177dc62SManali Shukla 
32778177dc62SManali Shukla 	vmcb->control.intercept_exceptions |= (1ULL << vector);
32788177dc62SManali Shukla 
32798177dc62SManali Shukla 	report(svm_vmrun() == (SVM_EXIT_EXCP_BASE + vector),
32808177dc62SManali Shukla 		"%s handled by L1",  exception_mnemonic(vector));
32818177dc62SManali Shukla 
32828177dc62SManali Shukla 	vmcb->control.intercept_exceptions = old_ie;
32838177dc62SManali Shukla }
32848177dc62SManali Shukla 
32858177dc62SManali Shukla static void svm_exception_test(void)
32868177dc62SManali Shukla {
32878177dc62SManali Shukla 	struct svm_exception_test *t;
32888177dc62SManali Shukla 	int i;
32898177dc62SManali Shukla 
32908177dc62SManali Shukla 	for (i = 0; i < ARRAY_SIZE(svm_exception_tests); i++) {
32918177dc62SManali Shukla 		t = &svm_exception_tests[i];
32928177dc62SManali Shukla 		test_set_guest((test_guest_func)t->guest_code);
32938177dc62SManali Shukla 
32948177dc62SManali Shukla 		handle_exception_in_l2(t->vector);
32958177dc62SManali Shukla 		vmcb_ident(vmcb);
32968177dc62SManali Shukla 
32978177dc62SManali Shukla 		handle_exception_in_l1(t->vector);
32988177dc62SManali Shukla 		vmcb_ident(vmcb);
32998177dc62SManali Shukla 	}
33008177dc62SManali Shukla }
33018177dc62SManali Shukla 
33023f27d772SManali Shukla struct svm_test svm_tests[] = {
3303ad879127SKrish Sadhukhan 	{ "null", default_supported, default_prepare,
3304ad879127SKrish Sadhukhan 	  default_prepare_gif_clear, null_test,
3305ad879127SKrish Sadhukhan 	  default_finished, null_check },
3306ad879127SKrish Sadhukhan 	{ "vmrun", default_supported, default_prepare,
3307ad879127SKrish Sadhukhan 	  default_prepare_gif_clear, test_vmrun,
3308ad879127SKrish Sadhukhan 	  default_finished, check_vmrun },
3309ad879127SKrish Sadhukhan 	{ "ioio", default_supported, prepare_ioio,
3310ad879127SKrish Sadhukhan 	  default_prepare_gif_clear, test_ioio,
3311ad879127SKrish Sadhukhan 	  ioio_finished, check_ioio },
3312ad879127SKrish Sadhukhan 	{ "vmrun intercept check", default_supported, prepare_no_vmrun_int,
3313ad879127SKrish Sadhukhan 	  default_prepare_gif_clear, null_test, default_finished,
3314ad879127SKrish Sadhukhan 	  check_no_vmrun_int },
3315401299a5SPaolo Bonzini 	{ "rsm", default_supported,
3316401299a5SPaolo Bonzini 	  prepare_rsm_intercept, default_prepare_gif_clear,
3317401299a5SPaolo Bonzini 	  test_rsm_intercept, finished_rsm_intercept, check_rsm_intercept },
3318ad879127SKrish Sadhukhan 	{ "cr3 read intercept", default_supported,
3319ad879127SKrish Sadhukhan 	  prepare_cr3_intercept, default_prepare_gif_clear,
3320ad879127SKrish Sadhukhan 	  test_cr3_intercept, default_finished, check_cr3_intercept },
3321ad879127SKrish Sadhukhan 	{ "cr3 read nointercept", default_supported, default_prepare,
3322ad879127SKrish Sadhukhan 	  default_prepare_gif_clear, test_cr3_intercept, default_finished,
3323ad879127SKrish Sadhukhan 	  check_cr3_nointercept },
3324ad879127SKrish Sadhukhan 	{ "cr3 read intercept emulate", smp_supported,
3325ad879127SKrish Sadhukhan 	  prepare_cr3_intercept_bypass, default_prepare_gif_clear,
3326ad879127SKrish Sadhukhan 	  test_cr3_intercept_bypass, default_finished, check_cr3_intercept },
3327ad879127SKrish Sadhukhan 	{ "dr intercept check", default_supported, prepare_dr_intercept,
3328ad879127SKrish Sadhukhan 	  default_prepare_gif_clear, test_dr_intercept, dr_intercept_finished,
3329ad879127SKrish Sadhukhan 	  check_dr_intercept },
3330ad879127SKrish Sadhukhan 	{ "next_rip", next_rip_supported, prepare_next_rip,
3331ad879127SKrish Sadhukhan 	  default_prepare_gif_clear, test_next_rip,
3332ad879127SKrish Sadhukhan 	  default_finished, check_next_rip },
3333ad879127SKrish Sadhukhan 	{ "msr intercept check", default_supported, prepare_msr_intercept,
3334ad879127SKrish Sadhukhan 	  default_prepare_gif_clear, test_msr_intercept,
3335ad879127SKrish Sadhukhan 	  msr_intercept_finished, check_msr_intercept },
3336ad879127SKrish Sadhukhan 	{ "mode_switch", default_supported, prepare_mode_switch,
3337ad879127SKrish Sadhukhan 	  default_prepare_gif_clear, test_mode_switch,
3338ad879127SKrish Sadhukhan 	  mode_switch_finished, check_mode_switch },
3339ad879127SKrish Sadhukhan 	{ "asid_zero", default_supported, prepare_asid_zero,
3340ad879127SKrish Sadhukhan 	  default_prepare_gif_clear, test_asid_zero,
3341ad879127SKrish Sadhukhan 	  default_finished, check_asid_zero },
3342ad879127SKrish Sadhukhan 	{ "sel_cr0_bug", default_supported, sel_cr0_bug_prepare,
3343ad879127SKrish Sadhukhan 	  default_prepare_gif_clear, sel_cr0_bug_test,
3344ad879127SKrish Sadhukhan 	  sel_cr0_bug_finished, sel_cr0_bug_check },
334510a65fc4SNadav Amit 	{ "tsc_adjust", tsc_adjust_supported, tsc_adjust_prepare,
3346ad879127SKrish Sadhukhan 	  default_prepare_gif_clear, tsc_adjust_test,
3347ad879127SKrish Sadhukhan 	  default_finished, tsc_adjust_check },
3348ad879127SKrish Sadhukhan 	{ "latency_run_exit", default_supported, latency_prepare,
3349ad879127SKrish Sadhukhan 	  default_prepare_gif_clear, latency_test,
3350ad879127SKrish Sadhukhan 	  latency_finished, latency_check },
3351f7fa53dcSPaolo Bonzini 	{ "latency_run_exit_clean", default_supported, latency_prepare,
3352f7fa53dcSPaolo Bonzini 	  default_prepare_gif_clear, latency_test,
3353f7fa53dcSPaolo Bonzini 	  latency_finished_clean, latency_check },
3354ad879127SKrish Sadhukhan 	{ "latency_svm_insn", default_supported, lat_svm_insn_prepare,
3355ad879127SKrish Sadhukhan 	  default_prepare_gif_clear, null_test,
3356ad879127SKrish Sadhukhan 	  lat_svm_insn_finished, lat_svm_insn_check },
33574b4fb247SPaolo Bonzini 	{ "exc_inject", default_supported, exc_inject_prepare,
33584b4fb247SPaolo Bonzini 	  default_prepare_gif_clear, exc_inject_test,
33594b4fb247SPaolo Bonzini 	  exc_inject_finished, exc_inject_check },
3360ad879127SKrish Sadhukhan 	{ "pending_event", default_supported, pending_event_prepare,
3361ad879127SKrish Sadhukhan 	  default_prepare_gif_clear,
3362ad879127SKrish Sadhukhan 	  pending_event_test, pending_event_finished, pending_event_check },
336385dc2aceSPaolo Bonzini 	{ "pending_event_cli", default_supported, pending_event_cli_prepare,
336485dc2aceSPaolo Bonzini 	  pending_event_cli_prepare_gif_clear,
336585dc2aceSPaolo Bonzini 	  pending_event_cli_test, pending_event_cli_finished,
336685dc2aceSPaolo Bonzini 	  pending_event_cli_check },
336785dc2aceSPaolo Bonzini 	{ "interrupt", default_supported, interrupt_prepare,
336885dc2aceSPaolo Bonzini 	  default_prepare_gif_clear, interrupt_test,
336985dc2aceSPaolo Bonzini 	  interrupt_finished, interrupt_check },
3370d4db486bSCathy Avery 	{ "nmi", default_supported, nmi_prepare,
3371d4db486bSCathy Avery 	  default_prepare_gif_clear, nmi_test,
3372d4db486bSCathy Avery 	  nmi_finished, nmi_check },
33739da1f4d8SCathy Avery 	{ "nmi_hlt", smp_supported, nmi_prepare,
33749da1f4d8SCathy Avery 	  default_prepare_gif_clear, nmi_hlt_test,
33759da1f4d8SCathy Avery 	  nmi_hlt_finished, nmi_hlt_check },
337608200397SSantosh Shukla         { "vnmi", vnmi_supported, vnmi_prepare,
337708200397SSantosh Shukla           default_prepare_gif_clear, vnmi_test,
337808200397SSantosh Shukla           vnmi_finished, vnmi_check },
33799c838954SCathy Avery 	{ "virq_inject", default_supported, virq_inject_prepare,
33809c838954SCathy Avery 	  default_prepare_gif_clear, virq_inject_test,
33819c838954SCathy Avery 	  virq_inject_finished, virq_inject_check },
3382da338a31SMaxim Levitsky 	{ "reg_corruption", default_supported, reg_corruption_prepare,
3383da338a31SMaxim Levitsky 	  default_prepare_gif_clear, reg_corruption_test,
3384da338a31SMaxim Levitsky 	  reg_corruption_finished, reg_corruption_check },
33854770e9c8SCathy Avery 	{ "svm_init_startup_test", smp_supported, init_startup_prepare,
33864770e9c8SCathy Avery 	  default_prepare_gif_clear, null_test,
33874770e9c8SCathy Avery 	  init_startup_finished, init_startup_check },
3388d5da6dfeSCathy Avery 	{ "svm_init_intercept_test", smp_supported, init_intercept_prepare,
3389d5da6dfeSCathy Avery 	  default_prepare_gif_clear, init_intercept_test,
3390d5da6dfeSCathy Avery 	  init_intercept_finished, init_intercept_check, .on_vcpu = 2 },
33917839b0ecSKrish Sadhukhan 	{ "host_rflags", default_supported, host_rflags_prepare,
33927839b0ecSKrish Sadhukhan 	  host_rflags_prepare_gif_clear, host_rflags_test,
33937839b0ecSKrish Sadhukhan 	  host_rflags_finished, host_rflags_check },
3394f6972bd6SLara Lazier 	{ "vgif", vgif_supported, prepare_vgif_enabled,
3395f6972bd6SLara Lazier 	  default_prepare_gif_clear, test_vgif, vgif_finished,
3396f6972bd6SLara Lazier 	  vgif_check },
3397f32183f5SJim Mattson 	TEST(svm_cr4_osxsave_test),
3398ba29942cSKrish Sadhukhan 	TEST(svm_guest_state_test),
33997a57ef5dSMaxim Levitsky 	TEST(svm_vmrun_errata_test),
34000b6f6cedSKrish Sadhukhan 	TEST(svm_vmload_vmsave),
3401665f5677SKrish Sadhukhan 	TEST(svm_test_singlestep),
3402694e59baSManali Shukla 	TEST(svm_no_nm_test),
34038177dc62SManali Shukla 	TEST(svm_exception_test),
3404537d39dfSMaxim Levitsky 	TEST(svm_lbrv_test0),
3405537d39dfSMaxim Levitsky 	TEST(svm_lbrv_test1),
3406537d39dfSMaxim Levitsky 	TEST(svm_lbrv_test2),
3407537d39dfSMaxim Levitsky 	TEST(svm_lbrv_nested_test1),
3408537d39dfSMaxim Levitsky 	TEST(svm_lbrv_nested_test2),
3409c45bccfcSMaxim Levitsky 	TEST(svm_intr_intercept_mix_if),
3410c45bccfcSMaxim Levitsky 	TEST(svm_intr_intercept_mix_gif),
3411c45bccfcSMaxim Levitsky 	TEST(svm_intr_intercept_mix_gif2),
3412c45bccfcSMaxim Levitsky 	TEST(svm_intr_intercept_mix_nmi),
3413c45bccfcSMaxim Levitsky 	TEST(svm_intr_intercept_mix_smi),
3414a8503d50SMaxim Levitsky 	TEST(svm_tsc_scale_test),
34158650dffeSMaxim Levitsky 	TEST(pause_filter_test),
3416ad879127SKrish Sadhukhan 	{ NULL, NULL, NULL, NULL, NULL, NULL, NULL }
3417ad879127SKrish Sadhukhan };
3418712840d5SManali Shukla 
3419712840d5SManali Shukla int main(int ac, char **av)
3420712840d5SManali Shukla {
3421ade7601dSSean Christopherson 	setup_vm();
3422712840d5SManali Shukla 	return run_svm_tests(ac, av, svm_tests);
3423712840d5SManali Shukla }
3424