xref: /kvm-unit-tests/x86/svm_tests.c (revision 665f5677583cb5280596a031b292d54d9dce7efa)
1ad879127SKrish Sadhukhan #include "svm.h"
2ad879127SKrish Sadhukhan #include "libcflat.h"
3ad879127SKrish Sadhukhan #include "processor.h"
4ad879127SKrish Sadhukhan #include "desc.h"
5ad879127SKrish Sadhukhan #include "msr.h"
6ad879127SKrish Sadhukhan #include "vm.h"
7ad879127SKrish Sadhukhan #include "smp.h"
8ad879127SKrish Sadhukhan #include "types.h"
9ad879127SKrish Sadhukhan #include "alloc_page.h"
10ad879127SKrish Sadhukhan #include "isr.h"
11ad879127SKrish Sadhukhan #include "apic.h"
129da1f4d8SCathy Avery #include "delay.h"
13ad879127SKrish Sadhukhan 
14ad879127SKrish Sadhukhan #define SVM_EXIT_MAX_DR_INTERCEPT 0x3f
15ad879127SKrish Sadhukhan 
16ad879127SKrish Sadhukhan static void *scratch_page;
17ad879127SKrish Sadhukhan 
18ad879127SKrish Sadhukhan #define LATENCY_RUNS 1000000
19ad879127SKrish Sadhukhan 
204770e9c8SCathy Avery extern u16 cpu_online_count;
214770e9c8SCathy Avery 
22ad879127SKrish Sadhukhan u64 tsc_start;
23ad879127SKrish Sadhukhan u64 tsc_end;
24ad879127SKrish Sadhukhan 
25ad879127SKrish Sadhukhan u64 vmrun_sum, vmexit_sum;
26ad879127SKrish Sadhukhan u64 vmsave_sum, vmload_sum;
27ad879127SKrish Sadhukhan u64 stgi_sum, clgi_sum;
28ad879127SKrish Sadhukhan u64 latvmrun_max;
29ad879127SKrish Sadhukhan u64 latvmrun_min;
30ad879127SKrish Sadhukhan u64 latvmexit_max;
31ad879127SKrish Sadhukhan u64 latvmexit_min;
32ad879127SKrish Sadhukhan u64 latvmload_max;
33ad879127SKrish Sadhukhan u64 latvmload_min;
34ad879127SKrish Sadhukhan u64 latvmsave_max;
35ad879127SKrish Sadhukhan u64 latvmsave_min;
36ad879127SKrish Sadhukhan u64 latstgi_max;
37ad879127SKrish Sadhukhan u64 latstgi_min;
38ad879127SKrish Sadhukhan u64 latclgi_max;
39ad879127SKrish Sadhukhan u64 latclgi_min;
40ad879127SKrish Sadhukhan u64 runs;
41ad879127SKrish Sadhukhan 
42ad879127SKrish Sadhukhan static void null_test(struct svm_test *test)
43ad879127SKrish Sadhukhan {
44ad879127SKrish Sadhukhan }
45ad879127SKrish Sadhukhan 
46ad879127SKrish Sadhukhan static bool null_check(struct svm_test *test)
47ad879127SKrish Sadhukhan {
48096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_VMMCALL;
49ad879127SKrish Sadhukhan }
50ad879127SKrish Sadhukhan 
51ad879127SKrish Sadhukhan static void prepare_no_vmrun_int(struct svm_test *test)
52ad879127SKrish Sadhukhan {
53096cf7feSPaolo Bonzini     vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMRUN);
54ad879127SKrish Sadhukhan }
55ad879127SKrish Sadhukhan 
56ad879127SKrish Sadhukhan static bool check_no_vmrun_int(struct svm_test *test)
57ad879127SKrish Sadhukhan {
58096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_ERR;
59ad879127SKrish Sadhukhan }
60ad879127SKrish Sadhukhan 
61ad879127SKrish Sadhukhan static void test_vmrun(struct svm_test *test)
62ad879127SKrish Sadhukhan {
63096cf7feSPaolo Bonzini     asm volatile ("vmrun %0" : : "a"(virt_to_phys(vmcb)));
64ad879127SKrish Sadhukhan }
65ad879127SKrish Sadhukhan 
66ad879127SKrish Sadhukhan static bool check_vmrun(struct svm_test *test)
67ad879127SKrish Sadhukhan {
68096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_VMRUN;
69ad879127SKrish Sadhukhan }
70ad879127SKrish Sadhukhan 
71401299a5SPaolo Bonzini static void prepare_rsm_intercept(struct svm_test *test)
72401299a5SPaolo Bonzini {
73401299a5SPaolo Bonzini     default_prepare(test);
74401299a5SPaolo Bonzini     vmcb->control.intercept |= 1 << INTERCEPT_RSM;
75401299a5SPaolo Bonzini     vmcb->control.intercept_exceptions |= (1ULL << UD_VECTOR);
76401299a5SPaolo Bonzini }
77401299a5SPaolo Bonzini 
78401299a5SPaolo Bonzini static void test_rsm_intercept(struct svm_test *test)
79401299a5SPaolo Bonzini {
80401299a5SPaolo Bonzini     asm volatile ("rsm" : : : "memory");
81401299a5SPaolo Bonzini }
82401299a5SPaolo Bonzini 
83401299a5SPaolo Bonzini static bool check_rsm_intercept(struct svm_test *test)
84401299a5SPaolo Bonzini {
85401299a5SPaolo Bonzini     return get_test_stage(test) == 2;
86401299a5SPaolo Bonzini }
87401299a5SPaolo Bonzini 
88401299a5SPaolo Bonzini static bool finished_rsm_intercept(struct svm_test *test)
89401299a5SPaolo Bonzini {
90401299a5SPaolo Bonzini     switch (get_test_stage(test)) {
91401299a5SPaolo Bonzini     case 0:
92401299a5SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_RSM) {
93401299a5SPaolo Bonzini             report(false, "VMEXIT not due to rsm. Exit reason 0x%x",
94401299a5SPaolo Bonzini                    vmcb->control.exit_code);
95401299a5SPaolo Bonzini             return true;
96401299a5SPaolo Bonzini         }
97401299a5SPaolo Bonzini         vmcb->control.intercept &= ~(1 << INTERCEPT_RSM);
98401299a5SPaolo Bonzini         inc_test_stage(test);
99401299a5SPaolo Bonzini         break;
100401299a5SPaolo Bonzini 
101401299a5SPaolo Bonzini     case 1:
102401299a5SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_EXCP_BASE + UD_VECTOR) {
103401299a5SPaolo Bonzini             report(false, "VMEXIT not due to #UD. Exit reason 0x%x",
104401299a5SPaolo Bonzini                    vmcb->control.exit_code);
105401299a5SPaolo Bonzini             return true;
106401299a5SPaolo Bonzini         }
107401299a5SPaolo Bonzini         vmcb->save.rip += 2;
108401299a5SPaolo Bonzini         inc_test_stage(test);
109401299a5SPaolo Bonzini         break;
110401299a5SPaolo Bonzini 
111401299a5SPaolo Bonzini     default:
112401299a5SPaolo Bonzini         return true;
113401299a5SPaolo Bonzini     }
114401299a5SPaolo Bonzini     return get_test_stage(test) == 2;
115401299a5SPaolo Bonzini }
116401299a5SPaolo Bonzini 
117ad879127SKrish Sadhukhan static void prepare_cr3_intercept(struct svm_test *test)
118ad879127SKrish Sadhukhan {
119ad879127SKrish Sadhukhan     default_prepare(test);
120096cf7feSPaolo Bonzini     vmcb->control.intercept_cr_read |= 1 << 3;
121ad879127SKrish Sadhukhan }
122ad879127SKrish Sadhukhan 
123ad879127SKrish Sadhukhan static void test_cr3_intercept(struct svm_test *test)
124ad879127SKrish Sadhukhan {
125ad879127SKrish Sadhukhan     asm volatile ("mov %%cr3, %0" : "=r"(test->scratch) : : "memory");
126ad879127SKrish Sadhukhan }
127ad879127SKrish Sadhukhan 
128ad879127SKrish Sadhukhan static bool check_cr3_intercept(struct svm_test *test)
129ad879127SKrish Sadhukhan {
130096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_READ_CR3;
131ad879127SKrish Sadhukhan }
132ad879127SKrish Sadhukhan 
133ad879127SKrish Sadhukhan static bool check_cr3_nointercept(struct svm_test *test)
134ad879127SKrish Sadhukhan {
135ad879127SKrish Sadhukhan     return null_check(test) && test->scratch == read_cr3();
136ad879127SKrish Sadhukhan }
137ad879127SKrish Sadhukhan 
138ad879127SKrish Sadhukhan static void corrupt_cr3_intercept_bypass(void *_test)
139ad879127SKrish Sadhukhan {
140ad879127SKrish Sadhukhan     struct svm_test *test = _test;
141ad879127SKrish Sadhukhan     extern volatile u32 mmio_insn;
142ad879127SKrish Sadhukhan 
143ad879127SKrish Sadhukhan     while (!__sync_bool_compare_and_swap(&test->scratch, 1, 2))
144ad879127SKrish Sadhukhan         pause();
145ad879127SKrish Sadhukhan     pause();
146ad879127SKrish Sadhukhan     pause();
147ad879127SKrish Sadhukhan     pause();
148ad879127SKrish Sadhukhan     mmio_insn = 0x90d8200f;  // mov %cr3, %rax; nop
149ad879127SKrish Sadhukhan }
150ad879127SKrish Sadhukhan 
151ad879127SKrish Sadhukhan static void prepare_cr3_intercept_bypass(struct svm_test *test)
152ad879127SKrish Sadhukhan {
153ad879127SKrish Sadhukhan     default_prepare(test);
154096cf7feSPaolo Bonzini     vmcb->control.intercept_cr_read |= 1 << 3;
155ad879127SKrish Sadhukhan     on_cpu_async(1, corrupt_cr3_intercept_bypass, test);
156ad879127SKrish Sadhukhan }
157ad879127SKrish Sadhukhan 
158ad879127SKrish Sadhukhan static void test_cr3_intercept_bypass(struct svm_test *test)
159ad879127SKrish Sadhukhan {
160ad879127SKrish Sadhukhan     ulong a = 0xa0000;
161ad879127SKrish Sadhukhan 
162ad879127SKrish Sadhukhan     test->scratch = 1;
163ad879127SKrish Sadhukhan     while (test->scratch != 2)
164ad879127SKrish Sadhukhan         barrier();
165ad879127SKrish Sadhukhan 
166ad879127SKrish Sadhukhan     asm volatile ("mmio_insn: mov %0, (%0); nop"
167ad879127SKrish Sadhukhan                   : "+a"(a) : : "memory");
168ad879127SKrish Sadhukhan     test->scratch = a;
169ad879127SKrish Sadhukhan }
170ad879127SKrish Sadhukhan 
171ad879127SKrish Sadhukhan static void prepare_dr_intercept(struct svm_test *test)
172ad879127SKrish Sadhukhan {
173ad879127SKrish Sadhukhan     default_prepare(test);
174096cf7feSPaolo Bonzini     vmcb->control.intercept_dr_read = 0xff;
175096cf7feSPaolo Bonzini     vmcb->control.intercept_dr_write = 0xff;
176ad879127SKrish Sadhukhan }
177ad879127SKrish Sadhukhan 
178ad879127SKrish Sadhukhan static void test_dr_intercept(struct svm_test *test)
179ad879127SKrish Sadhukhan {
180ad879127SKrish Sadhukhan     unsigned int i, failcnt = 0;
181ad879127SKrish Sadhukhan 
182ad879127SKrish Sadhukhan     /* Loop testing debug register reads */
183ad879127SKrish Sadhukhan     for (i = 0; i < 8; i++) {
184ad879127SKrish Sadhukhan 
185ad879127SKrish Sadhukhan         switch (i) {
186ad879127SKrish Sadhukhan         case 0:
187ad879127SKrish Sadhukhan             asm volatile ("mov %%dr0, %0" : "=r"(test->scratch) : : "memory");
188ad879127SKrish Sadhukhan             break;
189ad879127SKrish Sadhukhan         case 1:
190ad879127SKrish Sadhukhan             asm volatile ("mov %%dr1, %0" : "=r"(test->scratch) : : "memory");
191ad879127SKrish Sadhukhan             break;
192ad879127SKrish Sadhukhan         case 2:
193ad879127SKrish Sadhukhan             asm volatile ("mov %%dr2, %0" : "=r"(test->scratch) : : "memory");
194ad879127SKrish Sadhukhan             break;
195ad879127SKrish Sadhukhan         case 3:
196ad879127SKrish Sadhukhan             asm volatile ("mov %%dr3, %0" : "=r"(test->scratch) : : "memory");
197ad879127SKrish Sadhukhan             break;
198ad879127SKrish Sadhukhan         case 4:
199ad879127SKrish Sadhukhan             asm volatile ("mov %%dr4, %0" : "=r"(test->scratch) : : "memory");
200ad879127SKrish Sadhukhan             break;
201ad879127SKrish Sadhukhan         case 5:
202ad879127SKrish Sadhukhan             asm volatile ("mov %%dr5, %0" : "=r"(test->scratch) : : "memory");
203ad879127SKrish Sadhukhan             break;
204ad879127SKrish Sadhukhan         case 6:
205ad879127SKrish Sadhukhan             asm volatile ("mov %%dr6, %0" : "=r"(test->scratch) : : "memory");
206ad879127SKrish Sadhukhan             break;
207ad879127SKrish Sadhukhan         case 7:
208ad879127SKrish Sadhukhan             asm volatile ("mov %%dr7, %0" : "=r"(test->scratch) : : "memory");
209ad879127SKrish Sadhukhan             break;
210ad879127SKrish Sadhukhan         }
211ad879127SKrish Sadhukhan 
212ad879127SKrish Sadhukhan         if (test->scratch != i) {
213ad879127SKrish Sadhukhan             report(false, "dr%u read intercept", i);
214ad879127SKrish Sadhukhan             failcnt++;
215ad879127SKrish Sadhukhan         }
216ad879127SKrish Sadhukhan     }
217ad879127SKrish Sadhukhan 
218ad879127SKrish Sadhukhan     /* Loop testing debug register writes */
219ad879127SKrish Sadhukhan     for (i = 0; i < 8; i++) {
220ad879127SKrish Sadhukhan 
221ad879127SKrish Sadhukhan         switch (i) {
222ad879127SKrish Sadhukhan         case 0:
223ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr0" : : "r"(test->scratch) : "memory");
224ad879127SKrish Sadhukhan             break;
225ad879127SKrish Sadhukhan         case 1:
226ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr1" : : "r"(test->scratch) : "memory");
227ad879127SKrish Sadhukhan             break;
228ad879127SKrish Sadhukhan         case 2:
229ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr2" : : "r"(test->scratch) : "memory");
230ad879127SKrish Sadhukhan             break;
231ad879127SKrish Sadhukhan         case 3:
232ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr3" : : "r"(test->scratch) : "memory");
233ad879127SKrish Sadhukhan             break;
234ad879127SKrish Sadhukhan         case 4:
235ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr4" : : "r"(test->scratch) : "memory");
236ad879127SKrish Sadhukhan             break;
237ad879127SKrish Sadhukhan         case 5:
238ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr5" : : "r"(test->scratch) : "memory");
239ad879127SKrish Sadhukhan             break;
240ad879127SKrish Sadhukhan         case 6:
241ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr6" : : "r"(test->scratch) : "memory");
242ad879127SKrish Sadhukhan             break;
243ad879127SKrish Sadhukhan         case 7:
244ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr7" : : "r"(test->scratch) : "memory");
245ad879127SKrish Sadhukhan             break;
246ad879127SKrish Sadhukhan         }
247ad879127SKrish Sadhukhan 
248ad879127SKrish Sadhukhan         if (test->scratch != i) {
249ad879127SKrish Sadhukhan             report(false, "dr%u write intercept", i);
250ad879127SKrish Sadhukhan             failcnt++;
251ad879127SKrish Sadhukhan         }
252ad879127SKrish Sadhukhan     }
253ad879127SKrish Sadhukhan 
254ad879127SKrish Sadhukhan     test->scratch = failcnt;
255ad879127SKrish Sadhukhan }
256ad879127SKrish Sadhukhan 
257ad879127SKrish Sadhukhan static bool dr_intercept_finished(struct svm_test *test)
258ad879127SKrish Sadhukhan {
259096cf7feSPaolo Bonzini     ulong n = (vmcb->control.exit_code - SVM_EXIT_READ_DR0);
260ad879127SKrish Sadhukhan 
261ad879127SKrish Sadhukhan     /* Only expect DR intercepts */
262ad879127SKrish Sadhukhan     if (n > (SVM_EXIT_MAX_DR_INTERCEPT - SVM_EXIT_READ_DR0))
263ad879127SKrish Sadhukhan         return true;
264ad879127SKrish Sadhukhan 
265ad879127SKrish Sadhukhan     /*
266ad879127SKrish Sadhukhan      * Compute debug register number.
267ad879127SKrish Sadhukhan      * Per Appendix C "SVM Intercept Exit Codes" of AMD64 Architecture
268ad879127SKrish Sadhukhan      * Programmer's Manual Volume 2 - System Programming:
269ad879127SKrish Sadhukhan      * http://support.amd.com/TechDocs/24593.pdf
270ad879127SKrish Sadhukhan      * there are 16 VMEXIT codes each for DR read and write.
271ad879127SKrish Sadhukhan      */
272ad879127SKrish Sadhukhan     test->scratch = (n % 16);
273ad879127SKrish Sadhukhan 
274ad879127SKrish Sadhukhan     /* Jump over MOV instruction */
275096cf7feSPaolo Bonzini     vmcb->save.rip += 3;
276ad879127SKrish Sadhukhan 
277ad879127SKrish Sadhukhan     return false;
278ad879127SKrish Sadhukhan }
279ad879127SKrish Sadhukhan 
280ad879127SKrish Sadhukhan static bool check_dr_intercept(struct svm_test *test)
281ad879127SKrish Sadhukhan {
282ad879127SKrish Sadhukhan     return !test->scratch;
283ad879127SKrish Sadhukhan }
284ad879127SKrish Sadhukhan 
285ad879127SKrish Sadhukhan static bool next_rip_supported(void)
286ad879127SKrish Sadhukhan {
287ad879127SKrish Sadhukhan     return this_cpu_has(X86_FEATURE_NRIPS);
288ad879127SKrish Sadhukhan }
289ad879127SKrish Sadhukhan 
290ad879127SKrish Sadhukhan static void prepare_next_rip(struct svm_test *test)
291ad879127SKrish Sadhukhan {
292096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_RDTSC);
293ad879127SKrish Sadhukhan }
294ad879127SKrish Sadhukhan 
295ad879127SKrish Sadhukhan 
296ad879127SKrish Sadhukhan static void test_next_rip(struct svm_test *test)
297ad879127SKrish Sadhukhan {
298ad879127SKrish Sadhukhan     asm volatile ("rdtsc\n\t"
299ad879127SKrish Sadhukhan                   ".globl exp_next_rip\n\t"
300ad879127SKrish Sadhukhan                   "exp_next_rip:\n\t" ::: "eax", "edx");
301ad879127SKrish Sadhukhan }
302ad879127SKrish Sadhukhan 
303ad879127SKrish Sadhukhan static bool check_next_rip(struct svm_test *test)
304ad879127SKrish Sadhukhan {
305ad879127SKrish Sadhukhan     extern char exp_next_rip;
306ad879127SKrish Sadhukhan     unsigned long address = (unsigned long)&exp_next_rip;
307ad879127SKrish Sadhukhan 
308096cf7feSPaolo Bonzini     return address == vmcb->control.next_rip;
309ad879127SKrish Sadhukhan }
310ad879127SKrish Sadhukhan 
311ad879127SKrish Sadhukhan extern u8 *msr_bitmap;
312ad879127SKrish Sadhukhan 
313ad879127SKrish Sadhukhan static void prepare_msr_intercept(struct svm_test *test)
314ad879127SKrish Sadhukhan {
315ad879127SKrish Sadhukhan     default_prepare(test);
316096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_MSR_PROT);
317096cf7feSPaolo Bonzini     vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR);
318ad879127SKrish Sadhukhan     memset(msr_bitmap, 0xff, MSR_BITMAP_SIZE);
319ad879127SKrish Sadhukhan }
320ad879127SKrish Sadhukhan 
321ad879127SKrish Sadhukhan static void test_msr_intercept(struct svm_test *test)
322ad879127SKrish Sadhukhan {
323ad879127SKrish Sadhukhan     unsigned long msr_value = 0xef8056791234abcd; /* Arbitrary value */
324ad879127SKrish Sadhukhan     unsigned long msr_index;
325ad879127SKrish Sadhukhan 
326ad879127SKrish Sadhukhan     for (msr_index = 0; msr_index <= 0xc0011fff; msr_index++) {
327ad879127SKrish Sadhukhan         if (msr_index == 0xC0010131 /* MSR_SEV_STATUS */) {
328ad879127SKrish Sadhukhan             /*
329ad879127SKrish Sadhukhan              * Per section 15.34.10 "SEV_STATUS MSR" of AMD64 Architecture
330ad879127SKrish Sadhukhan              * Programmer's Manual volume 2 - System Programming:
331ad879127SKrish Sadhukhan              * http://support.amd.com/TechDocs/24593.pdf
332ad879127SKrish Sadhukhan              * SEV_STATUS MSR (C001_0131) is a non-interceptable MSR.
333ad879127SKrish Sadhukhan              */
334ad879127SKrish Sadhukhan             continue;
335ad879127SKrish Sadhukhan         }
336ad879127SKrish Sadhukhan 
337ad879127SKrish Sadhukhan         /* Skips gaps between supported MSR ranges */
338ad879127SKrish Sadhukhan         if (msr_index == 0x2000)
339ad879127SKrish Sadhukhan             msr_index = 0xc0000000;
340ad879127SKrish Sadhukhan         else if (msr_index == 0xc0002000)
341ad879127SKrish Sadhukhan             msr_index = 0xc0010000;
342ad879127SKrish Sadhukhan 
343ad879127SKrish Sadhukhan         test->scratch = -1;
344ad879127SKrish Sadhukhan 
345ad879127SKrish Sadhukhan         rdmsr(msr_index);
346ad879127SKrish Sadhukhan 
347ad879127SKrish Sadhukhan         /* Check that a read intercept occurred for MSR at msr_index */
348ad879127SKrish Sadhukhan         if (test->scratch != msr_index)
349ad879127SKrish Sadhukhan             report(false, "MSR 0x%lx read intercept", msr_index);
350ad879127SKrish Sadhukhan 
351ad879127SKrish Sadhukhan         /*
352ad879127SKrish Sadhukhan          * Poor man approach to generate a value that
353ad879127SKrish Sadhukhan          * seems arbitrary each time around the loop.
354ad879127SKrish Sadhukhan          */
355ad879127SKrish Sadhukhan         msr_value += (msr_value << 1);
356ad879127SKrish Sadhukhan 
357ad879127SKrish Sadhukhan         wrmsr(msr_index, msr_value);
358ad879127SKrish Sadhukhan 
359ad879127SKrish Sadhukhan         /* Check that a write intercept occurred for MSR with msr_value */
360ad879127SKrish Sadhukhan         if (test->scratch != msr_value)
361ad879127SKrish Sadhukhan             report(false, "MSR 0x%lx write intercept", msr_index);
362ad879127SKrish Sadhukhan     }
363ad879127SKrish Sadhukhan 
364ad879127SKrish Sadhukhan     test->scratch = -2;
365ad879127SKrish Sadhukhan }
366ad879127SKrish Sadhukhan 
367ad879127SKrish Sadhukhan static bool msr_intercept_finished(struct svm_test *test)
368ad879127SKrish Sadhukhan {
369096cf7feSPaolo Bonzini     u32 exit_code = vmcb->control.exit_code;
370ad879127SKrish Sadhukhan     u64 exit_info_1;
371ad879127SKrish Sadhukhan     u8 *opcode;
372ad879127SKrish Sadhukhan 
373ad879127SKrish Sadhukhan     if (exit_code == SVM_EXIT_MSR) {
374096cf7feSPaolo Bonzini         exit_info_1 = vmcb->control.exit_info_1;
375ad879127SKrish Sadhukhan     } else {
376ad879127SKrish Sadhukhan         /*
377ad879127SKrish Sadhukhan          * If #GP exception occurs instead, check that it was
378ad879127SKrish Sadhukhan          * for RDMSR/WRMSR and set exit_info_1 accordingly.
379ad879127SKrish Sadhukhan          */
380ad879127SKrish Sadhukhan 
381ad879127SKrish Sadhukhan         if (exit_code != (SVM_EXIT_EXCP_BASE + GP_VECTOR))
382ad879127SKrish Sadhukhan             return true;
383ad879127SKrish Sadhukhan 
384096cf7feSPaolo Bonzini         opcode = (u8 *)vmcb->save.rip;
385ad879127SKrish Sadhukhan         if (opcode[0] != 0x0f)
386ad879127SKrish Sadhukhan             return true;
387ad879127SKrish Sadhukhan 
388ad879127SKrish Sadhukhan         switch (opcode[1]) {
389ad879127SKrish Sadhukhan         case 0x30: /* WRMSR */
390ad879127SKrish Sadhukhan             exit_info_1 = 1;
391ad879127SKrish Sadhukhan             break;
392ad879127SKrish Sadhukhan         case 0x32: /* RDMSR */
393ad879127SKrish Sadhukhan             exit_info_1 = 0;
394ad879127SKrish Sadhukhan             break;
395ad879127SKrish Sadhukhan         default:
396ad879127SKrish Sadhukhan             return true;
397ad879127SKrish Sadhukhan         }
398ad879127SKrish Sadhukhan 
399ad879127SKrish Sadhukhan         /*
400ad879127SKrish Sadhukhan          * Warn that #GP exception occured instead.
401ad879127SKrish Sadhukhan          * RCX holds the MSR index.
402ad879127SKrish Sadhukhan          */
403ad879127SKrish Sadhukhan         printf("%s 0x%lx #GP exception\n",
404ad879127SKrish Sadhukhan             exit_info_1 ? "WRMSR" : "RDMSR", get_regs().rcx);
405ad879127SKrish Sadhukhan     }
406ad879127SKrish Sadhukhan 
407ad879127SKrish Sadhukhan     /* Jump over RDMSR/WRMSR instruction */
408096cf7feSPaolo Bonzini     vmcb->save.rip += 2;
409ad879127SKrish Sadhukhan 
410ad879127SKrish Sadhukhan     /*
411ad879127SKrish Sadhukhan      * Test whether the intercept was for RDMSR/WRMSR.
412ad879127SKrish Sadhukhan      * For RDMSR, test->scratch is set to the MSR index;
413ad879127SKrish Sadhukhan      *      RCX holds the MSR index.
414ad879127SKrish Sadhukhan      * For WRMSR, test->scratch is set to the MSR value;
415ad879127SKrish Sadhukhan      *      RDX holds the upper 32 bits of the MSR value,
416ad879127SKrish Sadhukhan      *      while RAX hold its lower 32 bits.
417ad879127SKrish Sadhukhan      */
418ad879127SKrish Sadhukhan     if (exit_info_1)
419ad879127SKrish Sadhukhan         test->scratch =
420096cf7feSPaolo Bonzini             ((get_regs().rdx << 32) | (vmcb->save.rax & 0xffffffff));
421ad879127SKrish Sadhukhan     else
422ad879127SKrish Sadhukhan         test->scratch = get_regs().rcx;
423ad879127SKrish Sadhukhan 
424ad879127SKrish Sadhukhan     return false;
425ad879127SKrish Sadhukhan }
426ad879127SKrish Sadhukhan 
427ad879127SKrish Sadhukhan static bool check_msr_intercept(struct svm_test *test)
428ad879127SKrish Sadhukhan {
429ad879127SKrish Sadhukhan     memset(msr_bitmap, 0, MSR_BITMAP_SIZE);
430ad879127SKrish Sadhukhan     return (test->scratch == -2);
431ad879127SKrish Sadhukhan }
432ad879127SKrish Sadhukhan 
433ad879127SKrish Sadhukhan static void prepare_mode_switch(struct svm_test *test)
434ad879127SKrish Sadhukhan {
435096cf7feSPaolo Bonzini     vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR)
436ad879127SKrish Sadhukhan                                              |  (1ULL << UD_VECTOR)
437ad879127SKrish Sadhukhan                                              |  (1ULL << DF_VECTOR)
438ad879127SKrish Sadhukhan                                              |  (1ULL << PF_VECTOR);
439ad879127SKrish Sadhukhan     test->scratch = 0;
440ad879127SKrish Sadhukhan }
441ad879127SKrish Sadhukhan 
442ad879127SKrish Sadhukhan static void test_mode_switch(struct svm_test *test)
443ad879127SKrish Sadhukhan {
444ad879127SKrish Sadhukhan     asm volatile("	cli\n"
445ad879127SKrish Sadhukhan 		 "	ljmp *1f\n" /* jump to 32-bit code segment */
446ad879127SKrish Sadhukhan 		 "1:\n"
447ad879127SKrish Sadhukhan 		 "	.long 2f\n"
448ad879127SKrish Sadhukhan 		 "	.long " xstr(KERNEL_CS32) "\n"
449ad879127SKrish Sadhukhan 		 ".code32\n"
450ad879127SKrish Sadhukhan 		 "2:\n"
451ad879127SKrish Sadhukhan 		 "	movl %%cr0, %%eax\n"
452ad879127SKrish Sadhukhan 		 "	btcl  $31, %%eax\n" /* clear PG */
453ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr0\n"
454ad879127SKrish Sadhukhan 		 "	movl $0xc0000080, %%ecx\n" /* EFER */
455ad879127SKrish Sadhukhan 		 "	rdmsr\n"
456ad879127SKrish Sadhukhan 		 "	btcl $8, %%eax\n" /* clear LME */
457ad879127SKrish Sadhukhan 		 "	wrmsr\n"
458ad879127SKrish Sadhukhan 		 "	movl %%cr4, %%eax\n"
459ad879127SKrish Sadhukhan 		 "	btcl $5, %%eax\n" /* clear PAE */
460ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr4\n"
461ad879127SKrish Sadhukhan 		 "	movw %[ds16], %%ax\n"
462ad879127SKrish Sadhukhan 		 "	movw %%ax, %%ds\n"
463ad879127SKrish Sadhukhan 		 "	ljmpl %[cs16], $3f\n" /* jump to 16 bit protected-mode */
464ad879127SKrish Sadhukhan 		 ".code16\n"
465ad879127SKrish Sadhukhan 		 "3:\n"
466ad879127SKrish Sadhukhan 		 "	movl %%cr0, %%eax\n"
467ad879127SKrish Sadhukhan 		 "	btcl $0, %%eax\n" /* clear PE  */
468ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr0\n"
469ad879127SKrish Sadhukhan 		 "	ljmpl $0, $4f\n"   /* jump to real-mode */
470ad879127SKrish Sadhukhan 		 "4:\n"
471ad879127SKrish Sadhukhan 		 "	vmmcall\n"
472ad879127SKrish Sadhukhan 		 "	movl %%cr0, %%eax\n"
473ad879127SKrish Sadhukhan 		 "	btsl $0, %%eax\n" /* set PE  */
474ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr0\n"
475ad879127SKrish Sadhukhan 		 "	ljmpl %[cs32], $5f\n" /* back to protected mode */
476ad879127SKrish Sadhukhan 		 ".code32\n"
477ad879127SKrish Sadhukhan 		 "5:\n"
478ad879127SKrish Sadhukhan 		 "	movl %%cr4, %%eax\n"
479ad879127SKrish Sadhukhan 		 "	btsl $5, %%eax\n" /* set PAE */
480ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr4\n"
481ad879127SKrish Sadhukhan 		 "	movl $0xc0000080, %%ecx\n" /* EFER */
482ad879127SKrish Sadhukhan 		 "	rdmsr\n"
483ad879127SKrish Sadhukhan 		 "	btsl $8, %%eax\n" /* set LME */
484ad879127SKrish Sadhukhan 		 "	wrmsr\n"
485ad879127SKrish Sadhukhan 		 "	movl %%cr0, %%eax\n"
486ad879127SKrish Sadhukhan 		 "	btsl  $31, %%eax\n" /* set PG */
487ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr0\n"
488ad879127SKrish Sadhukhan 		 "	ljmpl %[cs64], $6f\n"    /* back to long mode */
489ad879127SKrish Sadhukhan 		 ".code64\n\t"
490ad879127SKrish Sadhukhan 		 "6:\n"
491ad879127SKrish Sadhukhan 		 "	vmmcall\n"
492ad879127SKrish Sadhukhan 		 :: [cs16] "i"(KERNEL_CS16), [ds16] "i"(KERNEL_DS16),
493ad879127SKrish Sadhukhan 		    [cs32] "i"(KERNEL_CS32), [cs64] "i"(KERNEL_CS64)
494ad879127SKrish Sadhukhan 		 : "rax", "rbx", "rcx", "rdx", "memory");
495ad879127SKrish Sadhukhan }
496ad879127SKrish Sadhukhan 
497ad879127SKrish Sadhukhan static bool mode_switch_finished(struct svm_test *test)
498ad879127SKrish Sadhukhan {
499ad879127SKrish Sadhukhan     u64 cr0, cr4, efer;
500ad879127SKrish Sadhukhan 
501096cf7feSPaolo Bonzini     cr0  = vmcb->save.cr0;
502096cf7feSPaolo Bonzini     cr4  = vmcb->save.cr4;
503096cf7feSPaolo Bonzini     efer = vmcb->save.efer;
504ad879127SKrish Sadhukhan 
505ad879127SKrish Sadhukhan     /* Only expect VMMCALL intercepts */
506096cf7feSPaolo Bonzini     if (vmcb->control.exit_code != SVM_EXIT_VMMCALL)
507ad879127SKrish Sadhukhan 	    return true;
508ad879127SKrish Sadhukhan 
509ad879127SKrish Sadhukhan     /* Jump over VMMCALL instruction */
510096cf7feSPaolo Bonzini     vmcb->save.rip += 3;
511ad879127SKrish Sadhukhan 
512ad879127SKrish Sadhukhan     /* Do sanity checks */
513ad879127SKrish Sadhukhan     switch (test->scratch) {
514ad879127SKrish Sadhukhan     case 0:
515ad879127SKrish Sadhukhan         /* Test should be in real mode now - check for this */
516ad879127SKrish Sadhukhan         if ((cr0  & 0x80000001) || /* CR0.PG, CR0.PE */
517ad879127SKrish Sadhukhan             (cr4  & 0x00000020) || /* CR4.PAE */
518ad879127SKrish Sadhukhan             (efer & 0x00000500))   /* EFER.LMA, EFER.LME */
519ad879127SKrish Sadhukhan                 return true;
520ad879127SKrish Sadhukhan         break;
521ad879127SKrish Sadhukhan     case 2:
522ad879127SKrish Sadhukhan         /* Test should be back in long-mode now - check for this */
523ad879127SKrish Sadhukhan         if (((cr0  & 0x80000001) != 0x80000001) || /* CR0.PG, CR0.PE */
524ad879127SKrish Sadhukhan             ((cr4  & 0x00000020) != 0x00000020) || /* CR4.PAE */
525ad879127SKrish Sadhukhan             ((efer & 0x00000500) != 0x00000500))   /* EFER.LMA, EFER.LME */
526ad879127SKrish Sadhukhan 		    return true;
527ad879127SKrish Sadhukhan 	break;
528ad879127SKrish Sadhukhan     }
529ad879127SKrish Sadhukhan 
530ad879127SKrish Sadhukhan     /* one step forward */
531ad879127SKrish Sadhukhan     test->scratch += 1;
532ad879127SKrish Sadhukhan 
533ad879127SKrish Sadhukhan     return test->scratch == 2;
534ad879127SKrish Sadhukhan }
535ad879127SKrish Sadhukhan 
536ad879127SKrish Sadhukhan static bool check_mode_switch(struct svm_test *test)
537ad879127SKrish Sadhukhan {
538ad879127SKrish Sadhukhan 	return test->scratch == 2;
539ad879127SKrish Sadhukhan }
540ad879127SKrish Sadhukhan 
541ad879127SKrish Sadhukhan extern u8 *io_bitmap;
542ad879127SKrish Sadhukhan 
543ad879127SKrish Sadhukhan static void prepare_ioio(struct svm_test *test)
544ad879127SKrish Sadhukhan {
545096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_IOIO_PROT);
546ad879127SKrish Sadhukhan     test->scratch = 0;
547ad879127SKrish Sadhukhan     memset(io_bitmap, 0, 8192);
548ad879127SKrish Sadhukhan     io_bitmap[8192] = 0xFF;
549ad879127SKrish Sadhukhan }
550ad879127SKrish Sadhukhan 
551ad879127SKrish Sadhukhan static void test_ioio(struct svm_test *test)
552ad879127SKrish Sadhukhan {
553ad879127SKrish Sadhukhan     // stage 0, test IO pass
554ad879127SKrish Sadhukhan     inb(0x5000);
555ad879127SKrish Sadhukhan     outb(0x0, 0x5000);
556ad879127SKrish Sadhukhan     if (get_test_stage(test) != 0)
557ad879127SKrish Sadhukhan         goto fail;
558ad879127SKrish Sadhukhan 
559ad879127SKrish Sadhukhan     // test IO width, in/out
560ad879127SKrish Sadhukhan     io_bitmap[0] = 0xFF;
561ad879127SKrish Sadhukhan     inc_test_stage(test);
562ad879127SKrish Sadhukhan     inb(0x0);
563ad879127SKrish Sadhukhan     if (get_test_stage(test) != 2)
564ad879127SKrish Sadhukhan         goto fail;
565ad879127SKrish Sadhukhan 
566ad879127SKrish Sadhukhan     outw(0x0, 0x0);
567ad879127SKrish Sadhukhan     if (get_test_stage(test) != 3)
568ad879127SKrish Sadhukhan         goto fail;
569ad879127SKrish Sadhukhan 
570ad879127SKrish Sadhukhan     inl(0x0);
571ad879127SKrish Sadhukhan     if (get_test_stage(test) != 4)
572ad879127SKrish Sadhukhan         goto fail;
573ad879127SKrish Sadhukhan 
574ad879127SKrish Sadhukhan     // test low/high IO port
575ad879127SKrish Sadhukhan     io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8));
576ad879127SKrish Sadhukhan     inb(0x5000);
577ad879127SKrish Sadhukhan     if (get_test_stage(test) != 5)
578ad879127SKrish Sadhukhan         goto fail;
579ad879127SKrish Sadhukhan 
580ad879127SKrish Sadhukhan     io_bitmap[0x9000 / 8] = (1 << (0x9000 % 8));
581ad879127SKrish Sadhukhan     inw(0x9000);
582ad879127SKrish Sadhukhan     if (get_test_stage(test) != 6)
583ad879127SKrish Sadhukhan         goto fail;
584ad879127SKrish Sadhukhan 
585ad879127SKrish Sadhukhan     // test partial pass
586ad879127SKrish Sadhukhan     io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8));
587ad879127SKrish Sadhukhan     inl(0x4FFF);
588ad879127SKrish Sadhukhan     if (get_test_stage(test) != 7)
589ad879127SKrish Sadhukhan         goto fail;
590ad879127SKrish Sadhukhan 
591ad879127SKrish Sadhukhan     // test across pages
592ad879127SKrish Sadhukhan     inc_test_stage(test);
593ad879127SKrish Sadhukhan     inl(0x7FFF);
594ad879127SKrish Sadhukhan     if (get_test_stage(test) != 8)
595ad879127SKrish Sadhukhan         goto fail;
596ad879127SKrish Sadhukhan 
597ad879127SKrish Sadhukhan     inc_test_stage(test);
598ad879127SKrish Sadhukhan     io_bitmap[0x8000 / 8] = 1 << (0x8000 % 8);
599ad879127SKrish Sadhukhan     inl(0x7FFF);
600ad879127SKrish Sadhukhan     if (get_test_stage(test) != 10)
601ad879127SKrish Sadhukhan         goto fail;
602ad879127SKrish Sadhukhan 
603ad879127SKrish Sadhukhan     io_bitmap[0] = 0;
604ad879127SKrish Sadhukhan     inl(0xFFFF);
605ad879127SKrish Sadhukhan     if (get_test_stage(test) != 11)
606ad879127SKrish Sadhukhan         goto fail;
607ad879127SKrish Sadhukhan 
608ad879127SKrish Sadhukhan     io_bitmap[0] = 0xFF;
609ad879127SKrish Sadhukhan     io_bitmap[8192] = 0;
610ad879127SKrish Sadhukhan     inl(0xFFFF);
611ad879127SKrish Sadhukhan     inc_test_stage(test);
612ad879127SKrish Sadhukhan     if (get_test_stage(test) != 12)
613ad879127SKrish Sadhukhan         goto fail;
614ad879127SKrish Sadhukhan 
615ad879127SKrish Sadhukhan     return;
616ad879127SKrish Sadhukhan 
617ad879127SKrish Sadhukhan fail:
618ad879127SKrish Sadhukhan     report(false, "stage %d", get_test_stage(test));
619ad879127SKrish Sadhukhan     test->scratch = -1;
620ad879127SKrish Sadhukhan }
621ad879127SKrish Sadhukhan 
622ad879127SKrish Sadhukhan static bool ioio_finished(struct svm_test *test)
623ad879127SKrish Sadhukhan {
624ad879127SKrish Sadhukhan     unsigned port, size;
625ad879127SKrish Sadhukhan 
626ad879127SKrish Sadhukhan     /* Only expect IOIO intercepts */
627096cf7feSPaolo Bonzini     if (vmcb->control.exit_code == SVM_EXIT_VMMCALL)
628ad879127SKrish Sadhukhan         return true;
629ad879127SKrish Sadhukhan 
630096cf7feSPaolo Bonzini     if (vmcb->control.exit_code != SVM_EXIT_IOIO)
631ad879127SKrish Sadhukhan         return true;
632ad879127SKrish Sadhukhan 
633ad879127SKrish Sadhukhan     /* one step forward */
634ad879127SKrish Sadhukhan     test->scratch += 1;
635ad879127SKrish Sadhukhan 
636096cf7feSPaolo Bonzini     port = vmcb->control.exit_info_1 >> 16;
637096cf7feSPaolo Bonzini     size = (vmcb->control.exit_info_1 >> SVM_IOIO_SIZE_SHIFT) & 7;
638ad879127SKrish Sadhukhan 
639ad879127SKrish Sadhukhan     while (size--) {
640ad879127SKrish Sadhukhan         io_bitmap[port / 8] &= ~(1 << (port & 7));
641ad879127SKrish Sadhukhan         port++;
642ad879127SKrish Sadhukhan     }
643ad879127SKrish Sadhukhan 
644ad879127SKrish Sadhukhan     return false;
645ad879127SKrish Sadhukhan }
646ad879127SKrish Sadhukhan 
647ad879127SKrish Sadhukhan static bool check_ioio(struct svm_test *test)
648ad879127SKrish Sadhukhan {
649ad879127SKrish Sadhukhan     memset(io_bitmap, 0, 8193);
650ad879127SKrish Sadhukhan     return test->scratch != -1;
651ad879127SKrish Sadhukhan }
652ad879127SKrish Sadhukhan 
653ad879127SKrish Sadhukhan static void prepare_asid_zero(struct svm_test *test)
654ad879127SKrish Sadhukhan {
655096cf7feSPaolo Bonzini     vmcb->control.asid = 0;
656ad879127SKrish Sadhukhan }
657ad879127SKrish Sadhukhan 
658ad879127SKrish Sadhukhan static void test_asid_zero(struct svm_test *test)
659ad879127SKrish Sadhukhan {
660ad879127SKrish Sadhukhan     asm volatile ("vmmcall\n\t");
661ad879127SKrish Sadhukhan }
662ad879127SKrish Sadhukhan 
663ad879127SKrish Sadhukhan static bool check_asid_zero(struct svm_test *test)
664ad879127SKrish Sadhukhan {
665096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_ERR;
666ad879127SKrish Sadhukhan }
667ad879127SKrish Sadhukhan 
668ad879127SKrish Sadhukhan static void sel_cr0_bug_prepare(struct svm_test *test)
669ad879127SKrish Sadhukhan {
670096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_SELECTIVE_CR0);
671ad879127SKrish Sadhukhan }
672ad879127SKrish Sadhukhan 
673ad879127SKrish Sadhukhan static bool sel_cr0_bug_finished(struct svm_test *test)
674ad879127SKrish Sadhukhan {
675ad879127SKrish Sadhukhan 	return true;
676ad879127SKrish Sadhukhan }
677ad879127SKrish Sadhukhan 
678ad879127SKrish Sadhukhan static void sel_cr0_bug_test(struct svm_test *test)
679ad879127SKrish Sadhukhan {
680ad879127SKrish Sadhukhan     unsigned long cr0;
681ad879127SKrish Sadhukhan 
682ad879127SKrish Sadhukhan     /* read cr0, clear CD, and write back */
683ad879127SKrish Sadhukhan     cr0  = read_cr0();
684ad879127SKrish Sadhukhan     cr0 |= (1UL << 30);
685ad879127SKrish Sadhukhan     write_cr0(cr0);
686ad879127SKrish Sadhukhan 
687ad879127SKrish Sadhukhan     /*
688ad879127SKrish Sadhukhan      * If we are here the test failed, not sure what to do now because we
689ad879127SKrish Sadhukhan      * are not in guest-mode anymore so we can't trigger an intercept.
690ad879127SKrish Sadhukhan      * Trigger a tripple-fault for now.
691ad879127SKrish Sadhukhan      */
692ad879127SKrish Sadhukhan     report(false, "sel_cr0 test. Can not recover from this - exiting");
693ad879127SKrish Sadhukhan     exit(report_summary());
694ad879127SKrish Sadhukhan }
695ad879127SKrish Sadhukhan 
696ad879127SKrish Sadhukhan static bool sel_cr0_bug_check(struct svm_test *test)
697ad879127SKrish Sadhukhan {
698096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_CR0_SEL_WRITE;
699ad879127SKrish Sadhukhan }
700ad879127SKrish Sadhukhan 
701ad879127SKrish Sadhukhan static void npt_nx_prepare(struct svm_test *test)
702ad879127SKrish Sadhukhan {
703ad879127SKrish Sadhukhan     u64 *pte;
704ad879127SKrish Sadhukhan 
7051a0bbf91SSean Christopherson     test->scratch = rdmsr(MSR_EFER);
7061a0bbf91SSean Christopherson     wrmsr(MSR_EFER, test->scratch | EFER_NX);
7071a0bbf91SSean Christopherson 
7083fdf0e6eSSean Christopherson     /* Clear the guest's EFER.NX, it should not affect NPT behavior. */
7093fdf0e6eSSean Christopherson     vmcb->save.efer &= ~EFER_NX;
7103fdf0e6eSSean Christopherson 
711ad879127SKrish Sadhukhan     pte = npt_get_pte((u64)null_test);
712ad879127SKrish Sadhukhan 
7139bb2b6ebSSean Christopherson     *pte |= PT64_NX_MASK;
714ad879127SKrish Sadhukhan }
715ad879127SKrish Sadhukhan 
716ad879127SKrish Sadhukhan static bool npt_nx_check(struct svm_test *test)
717ad879127SKrish Sadhukhan {
718ad879127SKrish Sadhukhan     u64 *pte = npt_get_pte((u64)null_test);
719ad879127SKrish Sadhukhan 
7201a0bbf91SSean Christopherson     wrmsr(MSR_EFER, test->scratch);
7211a0bbf91SSean Christopherson 
7229bb2b6ebSSean Christopherson     *pte &= ~PT64_NX_MASK;
723ad879127SKrish Sadhukhan 
724096cf7feSPaolo Bonzini     return (vmcb->control.exit_code == SVM_EXIT_NPF)
725096cf7feSPaolo Bonzini            && (vmcb->control.exit_info_1 == 0x100000015ULL);
726ad879127SKrish Sadhukhan }
727ad879127SKrish Sadhukhan 
7286faca2a5SKrish Sadhukhan static void npt_np_prepare(struct svm_test *test)
7296faca2a5SKrish Sadhukhan {
7306faca2a5SKrish Sadhukhan     u64 *pte;
7316faca2a5SKrish Sadhukhan 
7326faca2a5SKrish Sadhukhan     scratch_page = alloc_page();
7336faca2a5SKrish Sadhukhan     pte = npt_get_pte((u64)scratch_page);
7346faca2a5SKrish Sadhukhan 
7356faca2a5SKrish Sadhukhan     *pte &= ~1ULL;
7366faca2a5SKrish Sadhukhan }
7376faca2a5SKrish Sadhukhan 
7386faca2a5SKrish Sadhukhan static void npt_np_test(struct svm_test *test)
7396faca2a5SKrish Sadhukhan {
7406faca2a5SKrish Sadhukhan     (void) *(volatile u64 *)scratch_page;
7416faca2a5SKrish Sadhukhan }
7426faca2a5SKrish Sadhukhan 
7436faca2a5SKrish Sadhukhan static bool npt_np_check(struct svm_test *test)
7446faca2a5SKrish Sadhukhan {
7456faca2a5SKrish Sadhukhan     u64 *pte = npt_get_pte((u64)scratch_page);
7466faca2a5SKrish Sadhukhan 
7476faca2a5SKrish Sadhukhan     *pte |= 1ULL;
7486faca2a5SKrish Sadhukhan 
7496faca2a5SKrish Sadhukhan     return (vmcb->control.exit_code == SVM_EXIT_NPF)
7506faca2a5SKrish Sadhukhan            && (vmcb->control.exit_info_1 == 0x100000004ULL);
7516faca2a5SKrish Sadhukhan }
7526faca2a5SKrish Sadhukhan 
753ad879127SKrish Sadhukhan static void npt_us_prepare(struct svm_test *test)
754ad879127SKrish Sadhukhan {
755ad879127SKrish Sadhukhan     u64 *pte;
756ad879127SKrish Sadhukhan 
757ad879127SKrish Sadhukhan     scratch_page = alloc_page();
758ad879127SKrish Sadhukhan     pte = npt_get_pte((u64)scratch_page);
759ad879127SKrish Sadhukhan 
760ad879127SKrish Sadhukhan     *pte &= ~(1ULL << 2);
761ad879127SKrish Sadhukhan }
762ad879127SKrish Sadhukhan 
763ad879127SKrish Sadhukhan static void npt_us_test(struct svm_test *test)
764ad879127SKrish Sadhukhan {
765ad879127SKrish Sadhukhan     (void) *(volatile u64 *)scratch_page;
766ad879127SKrish Sadhukhan }
767ad879127SKrish Sadhukhan 
768ad879127SKrish Sadhukhan static bool npt_us_check(struct svm_test *test)
769ad879127SKrish Sadhukhan {
770ad879127SKrish Sadhukhan     u64 *pte = npt_get_pte((u64)scratch_page);
771ad879127SKrish Sadhukhan 
772ad879127SKrish Sadhukhan     *pte |= (1ULL << 2);
773ad879127SKrish Sadhukhan 
774096cf7feSPaolo Bonzini     return (vmcb->control.exit_code == SVM_EXIT_NPF)
775096cf7feSPaolo Bonzini            && (vmcb->control.exit_info_1 == 0x100000005ULL);
776ad879127SKrish Sadhukhan }
777ad879127SKrish Sadhukhan 
778ad879127SKrish Sadhukhan static void npt_rw_prepare(struct svm_test *test)
779ad879127SKrish Sadhukhan {
780ad879127SKrish Sadhukhan 
781ad879127SKrish Sadhukhan     u64 *pte;
782ad879127SKrish Sadhukhan 
783ad879127SKrish Sadhukhan     pte = npt_get_pte(0x80000);
784ad879127SKrish Sadhukhan 
785ad879127SKrish Sadhukhan     *pte &= ~(1ULL << 1);
786ad879127SKrish Sadhukhan }
787ad879127SKrish Sadhukhan 
788ad879127SKrish Sadhukhan static void npt_rw_test(struct svm_test *test)
789ad879127SKrish Sadhukhan {
790ad879127SKrish Sadhukhan     u64 *data = (void*)(0x80000);
791ad879127SKrish Sadhukhan 
792ad879127SKrish Sadhukhan     *data = 0;
793ad879127SKrish Sadhukhan }
794ad879127SKrish Sadhukhan 
795ad879127SKrish Sadhukhan static bool npt_rw_check(struct svm_test *test)
796ad879127SKrish Sadhukhan {
797ad879127SKrish Sadhukhan     u64 *pte = npt_get_pte(0x80000);
798ad879127SKrish Sadhukhan 
799ad879127SKrish Sadhukhan     *pte |= (1ULL << 1);
800ad879127SKrish Sadhukhan 
801096cf7feSPaolo Bonzini     return (vmcb->control.exit_code == SVM_EXIT_NPF)
802096cf7feSPaolo Bonzini            && (vmcb->control.exit_info_1 == 0x100000007ULL);
803ad879127SKrish Sadhukhan }
804ad879127SKrish Sadhukhan 
805ad879127SKrish Sadhukhan static void npt_rw_pfwalk_prepare(struct svm_test *test)
806ad879127SKrish Sadhukhan {
807ad879127SKrish Sadhukhan 
808ad879127SKrish Sadhukhan     u64 *pte;
809ad879127SKrish Sadhukhan 
810ad879127SKrish Sadhukhan     pte = npt_get_pte(read_cr3());
811ad879127SKrish Sadhukhan 
812ad879127SKrish Sadhukhan     *pte &= ~(1ULL << 1);
813ad879127SKrish Sadhukhan }
814ad879127SKrish Sadhukhan 
815ad879127SKrish Sadhukhan static bool npt_rw_pfwalk_check(struct svm_test *test)
816ad879127SKrish Sadhukhan {
817ad879127SKrish Sadhukhan     u64 *pte = npt_get_pte(read_cr3());
818ad879127SKrish Sadhukhan 
819ad879127SKrish Sadhukhan     *pte |= (1ULL << 1);
820ad879127SKrish Sadhukhan 
821096cf7feSPaolo Bonzini     return (vmcb->control.exit_code == SVM_EXIT_NPF)
822a6051f06SNadav Amit            && (vmcb->control.exit_info_1 == 0x200000007ULL)
823096cf7feSPaolo Bonzini 	   && (vmcb->control.exit_info_2 == read_cr3());
824ad879127SKrish Sadhukhan }
825ad879127SKrish Sadhukhan 
826ad879127SKrish Sadhukhan static void npt_l1mmio_prepare(struct svm_test *test)
827ad879127SKrish Sadhukhan {
828ad879127SKrish Sadhukhan }
829ad879127SKrish Sadhukhan 
830ad879127SKrish Sadhukhan u32 nested_apic_version1;
831ad879127SKrish Sadhukhan u32 nested_apic_version2;
832ad879127SKrish Sadhukhan 
833ad879127SKrish Sadhukhan static void npt_l1mmio_test(struct svm_test *test)
834ad879127SKrish Sadhukhan {
835ad879127SKrish Sadhukhan     volatile u32 *data = (volatile void*)(0xfee00030UL);
836ad879127SKrish Sadhukhan 
837ad879127SKrish Sadhukhan     nested_apic_version1 = *data;
838ad879127SKrish Sadhukhan     nested_apic_version2 = *data;
839ad879127SKrish Sadhukhan }
840ad879127SKrish Sadhukhan 
841ad879127SKrish Sadhukhan static bool npt_l1mmio_check(struct svm_test *test)
842ad879127SKrish Sadhukhan {
843ad879127SKrish Sadhukhan     volatile u32 *data = (volatile void*)(0xfee00030);
844ad879127SKrish Sadhukhan     u32 lvr = *data;
845ad879127SKrish Sadhukhan 
846ad879127SKrish Sadhukhan     return nested_apic_version1 == lvr && nested_apic_version2 == lvr;
847ad879127SKrish Sadhukhan }
848ad879127SKrish Sadhukhan 
849ad879127SKrish Sadhukhan static void npt_rw_l1mmio_prepare(struct svm_test *test)
850ad879127SKrish Sadhukhan {
851ad879127SKrish Sadhukhan 
852ad879127SKrish Sadhukhan     u64 *pte;
853ad879127SKrish Sadhukhan 
854ad879127SKrish Sadhukhan     pte = npt_get_pte(0xfee00080);
855ad879127SKrish Sadhukhan 
856ad879127SKrish Sadhukhan     *pte &= ~(1ULL << 1);
857ad879127SKrish Sadhukhan }
858ad879127SKrish Sadhukhan 
859ad879127SKrish Sadhukhan static void npt_rw_l1mmio_test(struct svm_test *test)
860ad879127SKrish Sadhukhan {
861ad879127SKrish Sadhukhan     volatile u32 *data = (volatile void*)(0xfee00080);
862ad879127SKrish Sadhukhan 
863ad879127SKrish Sadhukhan     *data = *data;
864ad879127SKrish Sadhukhan }
865ad879127SKrish Sadhukhan 
866ad879127SKrish Sadhukhan static bool npt_rw_l1mmio_check(struct svm_test *test)
867ad879127SKrish Sadhukhan {
868ad879127SKrish Sadhukhan     u64 *pte = npt_get_pte(0xfee00080);
869ad879127SKrish Sadhukhan 
870ad879127SKrish Sadhukhan     *pte |= (1ULL << 1);
871ad879127SKrish Sadhukhan 
872096cf7feSPaolo Bonzini     return (vmcb->control.exit_code == SVM_EXIT_NPF)
873096cf7feSPaolo Bonzini            && (vmcb->control.exit_info_1 == 0x100000007ULL);
874ad879127SKrish Sadhukhan }
875ad879127SKrish Sadhukhan 
876ad879127SKrish Sadhukhan #define TSC_ADJUST_VALUE    (1ll << 32)
877f3154609SBill Wendling #define TSC_OFFSET_VALUE    (~0ull << 48)
878ad879127SKrish Sadhukhan static bool ok;
879ad879127SKrish Sadhukhan 
88010a65fc4SNadav Amit static bool tsc_adjust_supported(void)
88110a65fc4SNadav Amit {
88210a65fc4SNadav Amit     return this_cpu_has(X86_FEATURE_TSC_ADJUST);
88310a65fc4SNadav Amit }
88410a65fc4SNadav Amit 
885ad879127SKrish Sadhukhan static void tsc_adjust_prepare(struct svm_test *test)
886ad879127SKrish Sadhukhan {
887ad879127SKrish Sadhukhan     default_prepare(test);
888096cf7feSPaolo Bonzini     vmcb->control.tsc_offset = TSC_OFFSET_VALUE;
889ad879127SKrish Sadhukhan 
890ad879127SKrish Sadhukhan     wrmsr(MSR_IA32_TSC_ADJUST, -TSC_ADJUST_VALUE);
891ad879127SKrish Sadhukhan     int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST);
892ad879127SKrish Sadhukhan     ok = adjust == -TSC_ADJUST_VALUE;
893ad879127SKrish Sadhukhan }
894ad879127SKrish Sadhukhan 
895ad879127SKrish Sadhukhan static void tsc_adjust_test(struct svm_test *test)
896ad879127SKrish Sadhukhan {
897ad879127SKrish Sadhukhan     int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST);
898ad879127SKrish Sadhukhan     ok &= adjust == -TSC_ADJUST_VALUE;
899ad879127SKrish Sadhukhan 
900ad879127SKrish Sadhukhan     uint64_t l1_tsc = rdtsc() - TSC_OFFSET_VALUE;
901ad879127SKrish Sadhukhan     wrmsr(MSR_IA32_TSC, l1_tsc - TSC_ADJUST_VALUE);
902ad879127SKrish Sadhukhan 
903ad879127SKrish Sadhukhan     adjust = rdmsr(MSR_IA32_TSC_ADJUST);
904ad879127SKrish Sadhukhan     ok &= adjust <= -2 * TSC_ADJUST_VALUE;
905ad879127SKrish Sadhukhan 
906ad879127SKrish Sadhukhan     uint64_t l1_tsc_end = rdtsc() - TSC_OFFSET_VALUE;
907ad879127SKrish Sadhukhan     ok &= (l1_tsc_end + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE;
908ad879127SKrish Sadhukhan 
909ad879127SKrish Sadhukhan     uint64_t l1_tsc_msr = rdmsr(MSR_IA32_TSC) - TSC_OFFSET_VALUE;
910ad879127SKrish Sadhukhan     ok &= (l1_tsc_msr + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE;
911ad879127SKrish Sadhukhan }
912ad879127SKrish Sadhukhan 
913ad879127SKrish Sadhukhan static bool tsc_adjust_check(struct svm_test *test)
914ad879127SKrish Sadhukhan {
915ad879127SKrish Sadhukhan     int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST);
916ad879127SKrish Sadhukhan 
917ad879127SKrish Sadhukhan     wrmsr(MSR_IA32_TSC_ADJUST, 0);
918ad879127SKrish Sadhukhan     return ok && adjust <= -2 * TSC_ADJUST_VALUE;
919ad879127SKrish Sadhukhan }
920ad879127SKrish Sadhukhan 
921ad879127SKrish Sadhukhan static void latency_prepare(struct svm_test *test)
922ad879127SKrish Sadhukhan {
923ad879127SKrish Sadhukhan     default_prepare(test);
924ad879127SKrish Sadhukhan     runs = LATENCY_RUNS;
925ad879127SKrish Sadhukhan     latvmrun_min = latvmexit_min = -1ULL;
926ad879127SKrish Sadhukhan     latvmrun_max = latvmexit_max = 0;
927ad879127SKrish Sadhukhan     vmrun_sum = vmexit_sum = 0;
928ad879127SKrish Sadhukhan     tsc_start = rdtsc();
929ad879127SKrish Sadhukhan }
930ad879127SKrish Sadhukhan 
931ad879127SKrish Sadhukhan static void latency_test(struct svm_test *test)
932ad879127SKrish Sadhukhan {
933ad879127SKrish Sadhukhan     u64 cycles;
934ad879127SKrish Sadhukhan 
935ad879127SKrish Sadhukhan start:
936ad879127SKrish Sadhukhan     tsc_end = rdtsc();
937ad879127SKrish Sadhukhan 
938ad879127SKrish Sadhukhan     cycles = tsc_end - tsc_start;
939ad879127SKrish Sadhukhan 
940ad879127SKrish Sadhukhan     if (cycles > latvmrun_max)
941ad879127SKrish Sadhukhan         latvmrun_max = cycles;
942ad879127SKrish Sadhukhan 
943ad879127SKrish Sadhukhan     if (cycles < latvmrun_min)
944ad879127SKrish Sadhukhan         latvmrun_min = cycles;
945ad879127SKrish Sadhukhan 
946ad879127SKrish Sadhukhan     vmrun_sum += cycles;
947ad879127SKrish Sadhukhan 
948ad879127SKrish Sadhukhan     tsc_start = rdtsc();
949ad879127SKrish Sadhukhan 
950ad879127SKrish Sadhukhan     asm volatile ("vmmcall" : : : "memory");
951ad879127SKrish Sadhukhan     goto start;
952ad879127SKrish Sadhukhan }
953ad879127SKrish Sadhukhan 
954ad879127SKrish Sadhukhan static bool latency_finished(struct svm_test *test)
955ad879127SKrish Sadhukhan {
956ad879127SKrish Sadhukhan     u64 cycles;
957ad879127SKrish Sadhukhan 
958ad879127SKrish Sadhukhan     tsc_end = rdtsc();
959ad879127SKrish Sadhukhan 
960ad879127SKrish Sadhukhan     cycles = tsc_end - tsc_start;
961ad879127SKrish Sadhukhan 
962ad879127SKrish Sadhukhan     if (cycles > latvmexit_max)
963ad879127SKrish Sadhukhan         latvmexit_max = cycles;
964ad879127SKrish Sadhukhan 
965ad879127SKrish Sadhukhan     if (cycles < latvmexit_min)
966ad879127SKrish Sadhukhan         latvmexit_min = cycles;
967ad879127SKrish Sadhukhan 
968ad879127SKrish Sadhukhan     vmexit_sum += cycles;
969ad879127SKrish Sadhukhan 
970096cf7feSPaolo Bonzini     vmcb->save.rip += 3;
971ad879127SKrish Sadhukhan 
972ad879127SKrish Sadhukhan     runs -= 1;
973ad879127SKrish Sadhukhan 
974ad879127SKrish Sadhukhan     tsc_end = rdtsc();
975ad879127SKrish Sadhukhan 
976ad879127SKrish Sadhukhan     return runs == 0;
977ad879127SKrish Sadhukhan }
978ad879127SKrish Sadhukhan 
979f7fa53dcSPaolo Bonzini static bool latency_finished_clean(struct svm_test *test)
980f7fa53dcSPaolo Bonzini {
981f7fa53dcSPaolo Bonzini     vmcb->control.clean = VMCB_CLEAN_ALL;
982f7fa53dcSPaolo Bonzini     return latency_finished(test);
983f7fa53dcSPaolo Bonzini }
984f7fa53dcSPaolo Bonzini 
985ad879127SKrish Sadhukhan static bool latency_check(struct svm_test *test)
986ad879127SKrish Sadhukhan {
987ad879127SKrish Sadhukhan     printf("    Latency VMRUN : max: %ld min: %ld avg: %ld\n", latvmrun_max,
988ad879127SKrish Sadhukhan             latvmrun_min, vmrun_sum / LATENCY_RUNS);
989ad879127SKrish Sadhukhan     printf("    Latency VMEXIT: max: %ld min: %ld avg: %ld\n", latvmexit_max,
990ad879127SKrish Sadhukhan             latvmexit_min, vmexit_sum / LATENCY_RUNS);
991ad879127SKrish Sadhukhan     return true;
992ad879127SKrish Sadhukhan }
993ad879127SKrish Sadhukhan 
994ad879127SKrish Sadhukhan static void lat_svm_insn_prepare(struct svm_test *test)
995ad879127SKrish Sadhukhan {
996ad879127SKrish Sadhukhan     default_prepare(test);
997ad879127SKrish Sadhukhan     runs = LATENCY_RUNS;
998ad879127SKrish Sadhukhan     latvmload_min = latvmsave_min = latstgi_min = latclgi_min = -1ULL;
999ad879127SKrish Sadhukhan     latvmload_max = latvmsave_max = latstgi_max = latclgi_max = 0;
1000ad879127SKrish Sadhukhan     vmload_sum = vmsave_sum = stgi_sum = clgi_sum;
1001ad879127SKrish Sadhukhan }
1002ad879127SKrish Sadhukhan 
1003ad879127SKrish Sadhukhan static bool lat_svm_insn_finished(struct svm_test *test)
1004ad879127SKrish Sadhukhan {
1005096cf7feSPaolo Bonzini     u64 vmcb_phys = virt_to_phys(vmcb);
1006ad879127SKrish Sadhukhan     u64 cycles;
1007ad879127SKrish Sadhukhan 
1008ad879127SKrish Sadhukhan     for ( ; runs != 0; runs--) {
1009ad879127SKrish Sadhukhan         tsc_start = rdtsc();
1010ad879127SKrish Sadhukhan         asm volatile("vmload %0\n\t" : : "a"(vmcb_phys) : "memory");
1011ad879127SKrish Sadhukhan         cycles = rdtsc() - tsc_start;
1012ad879127SKrish Sadhukhan         if (cycles > latvmload_max)
1013ad879127SKrish Sadhukhan             latvmload_max = cycles;
1014ad879127SKrish Sadhukhan         if (cycles < latvmload_min)
1015ad879127SKrish Sadhukhan             latvmload_min = cycles;
1016ad879127SKrish Sadhukhan         vmload_sum += cycles;
1017ad879127SKrish Sadhukhan 
1018ad879127SKrish Sadhukhan         tsc_start = rdtsc();
1019ad879127SKrish Sadhukhan         asm volatile("vmsave %0\n\t" : : "a"(vmcb_phys) : "memory");
1020ad879127SKrish Sadhukhan         cycles = rdtsc() - tsc_start;
1021ad879127SKrish Sadhukhan         if (cycles > latvmsave_max)
1022ad879127SKrish Sadhukhan             latvmsave_max = cycles;
1023ad879127SKrish Sadhukhan         if (cycles < latvmsave_min)
1024ad879127SKrish Sadhukhan             latvmsave_min = cycles;
1025ad879127SKrish Sadhukhan         vmsave_sum += cycles;
1026ad879127SKrish Sadhukhan 
1027ad879127SKrish Sadhukhan         tsc_start = rdtsc();
1028ad879127SKrish Sadhukhan         asm volatile("stgi\n\t");
1029ad879127SKrish Sadhukhan         cycles = rdtsc() - tsc_start;
1030ad879127SKrish Sadhukhan         if (cycles > latstgi_max)
1031ad879127SKrish Sadhukhan             latstgi_max = cycles;
1032ad879127SKrish Sadhukhan         if (cycles < latstgi_min)
1033ad879127SKrish Sadhukhan             latstgi_min = cycles;
1034ad879127SKrish Sadhukhan         stgi_sum += cycles;
1035ad879127SKrish Sadhukhan 
1036ad879127SKrish Sadhukhan         tsc_start = rdtsc();
1037ad879127SKrish Sadhukhan         asm volatile("clgi\n\t");
1038ad879127SKrish Sadhukhan         cycles = rdtsc() - tsc_start;
1039ad879127SKrish Sadhukhan         if (cycles > latclgi_max)
1040ad879127SKrish Sadhukhan             latclgi_max = cycles;
1041ad879127SKrish Sadhukhan         if (cycles < latclgi_min)
1042ad879127SKrish Sadhukhan             latclgi_min = cycles;
1043ad879127SKrish Sadhukhan         clgi_sum += cycles;
1044ad879127SKrish Sadhukhan     }
1045ad879127SKrish Sadhukhan 
1046ad879127SKrish Sadhukhan     tsc_end = rdtsc();
1047ad879127SKrish Sadhukhan 
1048ad879127SKrish Sadhukhan     return true;
1049ad879127SKrish Sadhukhan }
1050ad879127SKrish Sadhukhan 
1051ad879127SKrish Sadhukhan static bool lat_svm_insn_check(struct svm_test *test)
1052ad879127SKrish Sadhukhan {
1053ad879127SKrish Sadhukhan     printf("    Latency VMLOAD: max: %ld min: %ld avg: %ld\n", latvmload_max,
1054ad879127SKrish Sadhukhan             latvmload_min, vmload_sum / LATENCY_RUNS);
1055ad879127SKrish Sadhukhan     printf("    Latency VMSAVE: max: %ld min: %ld avg: %ld\n", latvmsave_max,
1056ad879127SKrish Sadhukhan             latvmsave_min, vmsave_sum / LATENCY_RUNS);
1057ad879127SKrish Sadhukhan     printf("    Latency STGI:   max: %ld min: %ld avg: %ld\n", latstgi_max,
1058ad879127SKrish Sadhukhan             latstgi_min, stgi_sum / LATENCY_RUNS);
1059ad879127SKrish Sadhukhan     printf("    Latency CLGI:   max: %ld min: %ld avg: %ld\n", latclgi_max,
1060ad879127SKrish Sadhukhan             latclgi_min, clgi_sum / LATENCY_RUNS);
1061ad879127SKrish Sadhukhan     return true;
1062ad879127SKrish Sadhukhan }
1063ad879127SKrish Sadhukhan 
1064ad879127SKrish Sadhukhan bool pending_event_ipi_fired;
1065ad879127SKrish Sadhukhan bool pending_event_guest_run;
1066ad879127SKrish Sadhukhan 
1067ad879127SKrish Sadhukhan static void pending_event_ipi_isr(isr_regs_t *regs)
1068ad879127SKrish Sadhukhan {
1069ad879127SKrish Sadhukhan     pending_event_ipi_fired = true;
1070ad879127SKrish Sadhukhan     eoi();
1071ad879127SKrish Sadhukhan }
1072ad879127SKrish Sadhukhan 
1073ad879127SKrish Sadhukhan static void pending_event_prepare(struct svm_test *test)
1074ad879127SKrish Sadhukhan {
1075ad879127SKrish Sadhukhan     int ipi_vector = 0xf1;
1076ad879127SKrish Sadhukhan 
1077ad879127SKrish Sadhukhan     default_prepare(test);
1078ad879127SKrish Sadhukhan 
1079ad879127SKrish Sadhukhan     pending_event_ipi_fired = false;
1080ad879127SKrish Sadhukhan 
1081ad879127SKrish Sadhukhan     handle_irq(ipi_vector, pending_event_ipi_isr);
1082ad879127SKrish Sadhukhan 
1083ad879127SKrish Sadhukhan     pending_event_guest_run = false;
1084ad879127SKrish Sadhukhan 
1085096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_INTR);
1086096cf7feSPaolo Bonzini     vmcb->control.int_ctl |= V_INTR_MASKING_MASK;
1087ad879127SKrish Sadhukhan 
1088ad879127SKrish Sadhukhan     apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL |
1089ad879127SKrish Sadhukhan                   APIC_DM_FIXED | ipi_vector, 0);
1090ad879127SKrish Sadhukhan 
1091ad879127SKrish Sadhukhan     set_test_stage(test, 0);
1092ad879127SKrish Sadhukhan }
1093ad879127SKrish Sadhukhan 
1094ad879127SKrish Sadhukhan static void pending_event_test(struct svm_test *test)
1095ad879127SKrish Sadhukhan {
1096ad879127SKrish Sadhukhan     pending_event_guest_run = true;
1097ad879127SKrish Sadhukhan }
1098ad879127SKrish Sadhukhan 
1099ad879127SKrish Sadhukhan static bool pending_event_finished(struct svm_test *test)
1100ad879127SKrish Sadhukhan {
1101ad879127SKrish Sadhukhan     switch (get_test_stage(test)) {
1102ad879127SKrish Sadhukhan     case 0:
1103096cf7feSPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_INTR) {
1104ad879127SKrish Sadhukhan             report(false, "VMEXIT not due to pending interrupt. Exit reason 0x%x",
1105096cf7feSPaolo Bonzini                    vmcb->control.exit_code);
1106ad879127SKrish Sadhukhan             return true;
1107ad879127SKrish Sadhukhan         }
1108ad879127SKrish Sadhukhan 
1109096cf7feSPaolo Bonzini         vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR);
1110096cf7feSPaolo Bonzini         vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
1111ad879127SKrish Sadhukhan 
1112ad879127SKrish Sadhukhan         if (pending_event_guest_run) {
1113ad879127SKrish Sadhukhan             report(false, "Guest ran before host received IPI\n");
1114ad879127SKrish Sadhukhan             return true;
1115ad879127SKrish Sadhukhan         }
1116ad879127SKrish Sadhukhan 
1117ad879127SKrish Sadhukhan         irq_enable();
1118ad879127SKrish Sadhukhan         asm volatile ("nop");
1119ad879127SKrish Sadhukhan         irq_disable();
1120ad879127SKrish Sadhukhan 
1121ad879127SKrish Sadhukhan         if (!pending_event_ipi_fired) {
1122ad879127SKrish Sadhukhan             report(false, "Pending interrupt not dispatched after IRQ enabled\n");
1123ad879127SKrish Sadhukhan             return true;
1124ad879127SKrish Sadhukhan         }
1125ad879127SKrish Sadhukhan         break;
1126ad879127SKrish Sadhukhan 
1127ad879127SKrish Sadhukhan     case 1:
1128ad879127SKrish Sadhukhan         if (!pending_event_guest_run) {
1129ad879127SKrish Sadhukhan             report(false, "Guest did not resume when no interrupt\n");
1130ad879127SKrish Sadhukhan             return true;
1131ad879127SKrish Sadhukhan         }
1132ad879127SKrish Sadhukhan         break;
1133ad879127SKrish Sadhukhan     }
1134ad879127SKrish Sadhukhan 
1135ad879127SKrish Sadhukhan     inc_test_stage(test);
1136ad879127SKrish Sadhukhan 
1137ad879127SKrish Sadhukhan     return get_test_stage(test) == 2;
1138ad879127SKrish Sadhukhan }
1139ad879127SKrish Sadhukhan 
1140ad879127SKrish Sadhukhan static bool pending_event_check(struct svm_test *test)
1141ad879127SKrish Sadhukhan {
1142ad879127SKrish Sadhukhan     return get_test_stage(test) == 2;
1143ad879127SKrish Sadhukhan }
1144ad879127SKrish Sadhukhan 
114585dc2aceSPaolo Bonzini static void pending_event_cli_prepare(struct svm_test *test)
1146ad879127SKrish Sadhukhan {
1147ad879127SKrish Sadhukhan     default_prepare(test);
1148ad879127SKrish Sadhukhan 
1149ad879127SKrish Sadhukhan     pending_event_ipi_fired = false;
1150ad879127SKrish Sadhukhan 
1151ad879127SKrish Sadhukhan     handle_irq(0xf1, pending_event_ipi_isr);
1152ad879127SKrish Sadhukhan 
1153ad879127SKrish Sadhukhan     apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL |
1154ad879127SKrish Sadhukhan               APIC_DM_FIXED | 0xf1, 0);
1155ad879127SKrish Sadhukhan 
1156ad879127SKrish Sadhukhan     set_test_stage(test, 0);
1157ad879127SKrish Sadhukhan }
1158ad879127SKrish Sadhukhan 
115985dc2aceSPaolo Bonzini static void pending_event_cli_prepare_gif_clear(struct svm_test *test)
1160ad879127SKrish Sadhukhan {
1161ad879127SKrish Sadhukhan     asm("cli");
1162ad879127SKrish Sadhukhan }
1163ad879127SKrish Sadhukhan 
116485dc2aceSPaolo Bonzini static void pending_event_cli_test(struct svm_test *test)
1165ad879127SKrish Sadhukhan {
1166ad879127SKrish Sadhukhan     if (pending_event_ipi_fired == true) {
1167ad879127SKrish Sadhukhan         set_test_stage(test, -1);
1168ad879127SKrish Sadhukhan         report(false, "Interrupt preceeded guest");
1169ad879127SKrish Sadhukhan         vmmcall();
1170ad879127SKrish Sadhukhan     }
1171ad879127SKrish Sadhukhan 
117285dc2aceSPaolo Bonzini     /* VINTR_MASKING is zero.  This should cause the IPI to fire.  */
1173ad879127SKrish Sadhukhan     irq_enable();
1174ad879127SKrish Sadhukhan     asm volatile ("nop");
1175ad879127SKrish Sadhukhan     irq_disable();
1176ad879127SKrish Sadhukhan 
1177ad879127SKrish Sadhukhan     if (pending_event_ipi_fired != true) {
1178ad879127SKrish Sadhukhan         set_test_stage(test, -1);
1179ad879127SKrish Sadhukhan         report(false, "Interrupt not triggered by guest");
1180ad879127SKrish Sadhukhan     }
1181ad879127SKrish Sadhukhan 
1182ad879127SKrish Sadhukhan     vmmcall();
1183ad879127SKrish Sadhukhan 
118485dc2aceSPaolo Bonzini     /*
118585dc2aceSPaolo Bonzini      * Now VINTR_MASKING=1, but no interrupt is pending so
118685dc2aceSPaolo Bonzini      * the VINTR interception should be clear in VMCB02.  Check
118785dc2aceSPaolo Bonzini      * that L0 did not leave a stale VINTR in the VMCB.
118885dc2aceSPaolo Bonzini      */
1189ad879127SKrish Sadhukhan     irq_enable();
1190ad879127SKrish Sadhukhan     asm volatile ("nop");
1191ad879127SKrish Sadhukhan     irq_disable();
1192ad879127SKrish Sadhukhan }
1193ad879127SKrish Sadhukhan 
119485dc2aceSPaolo Bonzini static bool pending_event_cli_finished(struct svm_test *test)
1195ad879127SKrish Sadhukhan {
1196096cf7feSPaolo Bonzini     if ( vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1197ad879127SKrish Sadhukhan         report(false, "VM_EXIT return to host is not EXIT_VMMCALL exit reason 0x%x",
1198096cf7feSPaolo Bonzini                vmcb->control.exit_code);
1199ad879127SKrish Sadhukhan         return true;
1200ad879127SKrish Sadhukhan     }
1201ad879127SKrish Sadhukhan 
1202ad879127SKrish Sadhukhan     switch (get_test_stage(test)) {
1203ad879127SKrish Sadhukhan     case 0:
1204096cf7feSPaolo Bonzini         vmcb->save.rip += 3;
1205ad879127SKrish Sadhukhan 
1206ad879127SKrish Sadhukhan         pending_event_ipi_fired = false;
1207ad879127SKrish Sadhukhan 
1208096cf7feSPaolo Bonzini         vmcb->control.int_ctl |= V_INTR_MASKING_MASK;
1209ad879127SKrish Sadhukhan 
121085dc2aceSPaolo Bonzini 	/* Now entering again with VINTR_MASKING=1.  */
1211ad879127SKrish Sadhukhan         apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL |
1212ad879127SKrish Sadhukhan               APIC_DM_FIXED | 0xf1, 0);
1213ad879127SKrish Sadhukhan 
1214ad879127SKrish Sadhukhan         break;
1215ad879127SKrish Sadhukhan 
1216ad879127SKrish Sadhukhan     case 1:
1217ad879127SKrish Sadhukhan         if (pending_event_ipi_fired == true) {
1218ad879127SKrish Sadhukhan             report(false, "Interrupt triggered by guest");
1219ad879127SKrish Sadhukhan             return true;
1220ad879127SKrish Sadhukhan         }
1221ad879127SKrish Sadhukhan 
1222ad879127SKrish Sadhukhan         irq_enable();
1223ad879127SKrish Sadhukhan         asm volatile ("nop");
1224ad879127SKrish Sadhukhan         irq_disable();
1225ad879127SKrish Sadhukhan 
1226ad879127SKrish Sadhukhan         if (pending_event_ipi_fired != true) {
1227ad879127SKrish Sadhukhan             report(false, "Interrupt not triggered by host");
1228ad879127SKrish Sadhukhan             return true;
1229ad879127SKrish Sadhukhan         }
1230ad879127SKrish Sadhukhan 
1231ad879127SKrish Sadhukhan         break;
1232ad879127SKrish Sadhukhan 
1233ad879127SKrish Sadhukhan     default:
1234ad879127SKrish Sadhukhan         return true;
1235ad879127SKrish Sadhukhan     }
1236ad879127SKrish Sadhukhan 
1237ad879127SKrish Sadhukhan     inc_test_stage(test);
1238ad879127SKrish Sadhukhan 
1239ad879127SKrish Sadhukhan     return get_test_stage(test) == 2;
1240ad879127SKrish Sadhukhan }
1241ad879127SKrish Sadhukhan 
124285dc2aceSPaolo Bonzini static bool pending_event_cli_check(struct svm_test *test)
1243ad879127SKrish Sadhukhan {
1244ad879127SKrish Sadhukhan     return get_test_stage(test) == 2;
1245ad879127SKrish Sadhukhan }
1246ad879127SKrish Sadhukhan 
124785dc2aceSPaolo Bonzini #define TIMER_VECTOR    222
124885dc2aceSPaolo Bonzini 
124985dc2aceSPaolo Bonzini static volatile bool timer_fired;
125085dc2aceSPaolo Bonzini 
125185dc2aceSPaolo Bonzini static void timer_isr(isr_regs_t *regs)
125285dc2aceSPaolo Bonzini {
125385dc2aceSPaolo Bonzini     timer_fired = true;
125485dc2aceSPaolo Bonzini     apic_write(APIC_EOI, 0);
125585dc2aceSPaolo Bonzini }
125685dc2aceSPaolo Bonzini 
125785dc2aceSPaolo Bonzini static void interrupt_prepare(struct svm_test *test)
125885dc2aceSPaolo Bonzini {
125985dc2aceSPaolo Bonzini     default_prepare(test);
126085dc2aceSPaolo Bonzini     handle_irq(TIMER_VECTOR, timer_isr);
126185dc2aceSPaolo Bonzini     timer_fired = false;
126285dc2aceSPaolo Bonzini     set_test_stage(test, 0);
126385dc2aceSPaolo Bonzini }
126485dc2aceSPaolo Bonzini 
126585dc2aceSPaolo Bonzini static void interrupt_test(struct svm_test *test)
126685dc2aceSPaolo Bonzini {
126785dc2aceSPaolo Bonzini     long long start, loops;
126885dc2aceSPaolo Bonzini 
126985dc2aceSPaolo Bonzini     apic_write(APIC_LVTT, TIMER_VECTOR);
127085dc2aceSPaolo Bonzini     irq_enable();
127185dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 1); //Timer Initial Count Register 0x380 one-shot
127285dc2aceSPaolo Bonzini     for (loops = 0; loops < 10000000 && !timer_fired; loops++)
127385dc2aceSPaolo Bonzini         asm volatile ("nop");
127485dc2aceSPaolo Bonzini 
127585dc2aceSPaolo Bonzini     report(timer_fired, "direct interrupt while running guest");
127685dc2aceSPaolo Bonzini 
127785dc2aceSPaolo Bonzini     if (!timer_fired) {
127885dc2aceSPaolo Bonzini         set_test_stage(test, -1);
127985dc2aceSPaolo Bonzini         vmmcall();
128085dc2aceSPaolo Bonzini     }
128185dc2aceSPaolo Bonzini 
128285dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 0);
128385dc2aceSPaolo Bonzini     irq_disable();
128485dc2aceSPaolo Bonzini     vmmcall();
128585dc2aceSPaolo Bonzini 
128685dc2aceSPaolo Bonzini     timer_fired = false;
128785dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 1);
128885dc2aceSPaolo Bonzini     for (loops = 0; loops < 10000000 && !timer_fired; loops++)
128985dc2aceSPaolo Bonzini         asm volatile ("nop");
129085dc2aceSPaolo Bonzini 
129185dc2aceSPaolo Bonzini     report(timer_fired, "intercepted interrupt while running guest");
129285dc2aceSPaolo Bonzini 
129385dc2aceSPaolo Bonzini     if (!timer_fired) {
129485dc2aceSPaolo Bonzini         set_test_stage(test, -1);
129585dc2aceSPaolo Bonzini         vmmcall();
129685dc2aceSPaolo Bonzini     }
129785dc2aceSPaolo Bonzini 
129885dc2aceSPaolo Bonzini     irq_enable();
129985dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 0);
130085dc2aceSPaolo Bonzini     irq_disable();
130185dc2aceSPaolo Bonzini 
130285dc2aceSPaolo Bonzini     timer_fired = false;
130385dc2aceSPaolo Bonzini     start = rdtsc();
130485dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 1000000);
130585dc2aceSPaolo Bonzini     asm volatile ("sti; hlt");
130685dc2aceSPaolo Bonzini 
130785dc2aceSPaolo Bonzini     report(rdtsc() - start > 10000 && timer_fired,
130885dc2aceSPaolo Bonzini           "direct interrupt + hlt");
130985dc2aceSPaolo Bonzini 
131085dc2aceSPaolo Bonzini     if (!timer_fired) {
131185dc2aceSPaolo Bonzini         set_test_stage(test, -1);
131285dc2aceSPaolo Bonzini         vmmcall();
131385dc2aceSPaolo Bonzini     }
131485dc2aceSPaolo Bonzini 
131585dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 0);
131685dc2aceSPaolo Bonzini     irq_disable();
131785dc2aceSPaolo Bonzini     vmmcall();
131885dc2aceSPaolo Bonzini 
131985dc2aceSPaolo Bonzini     timer_fired = false;
132085dc2aceSPaolo Bonzini     start = rdtsc();
132185dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 1000000);
132285dc2aceSPaolo Bonzini     asm volatile ("hlt");
132385dc2aceSPaolo Bonzini 
132485dc2aceSPaolo Bonzini     report(rdtsc() - start > 10000 && timer_fired,
132585dc2aceSPaolo Bonzini            "intercepted interrupt + hlt");
132685dc2aceSPaolo Bonzini 
132785dc2aceSPaolo Bonzini     if (!timer_fired) {
132885dc2aceSPaolo Bonzini         set_test_stage(test, -1);
132985dc2aceSPaolo Bonzini         vmmcall();
133085dc2aceSPaolo Bonzini     }
133185dc2aceSPaolo Bonzini 
133285dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 0);
133385dc2aceSPaolo Bonzini     irq_disable();
133485dc2aceSPaolo Bonzini }
133585dc2aceSPaolo Bonzini 
133685dc2aceSPaolo Bonzini static bool interrupt_finished(struct svm_test *test)
133785dc2aceSPaolo Bonzini {
133885dc2aceSPaolo Bonzini     switch (get_test_stage(test)) {
133985dc2aceSPaolo Bonzini     case 0:
134085dc2aceSPaolo Bonzini     case 2:
1341096cf7feSPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
134285dc2aceSPaolo Bonzini             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
1343096cf7feSPaolo Bonzini                    vmcb->control.exit_code);
134485dc2aceSPaolo Bonzini             return true;
134585dc2aceSPaolo Bonzini         }
1346096cf7feSPaolo Bonzini         vmcb->save.rip += 3;
134785dc2aceSPaolo Bonzini 
1348096cf7feSPaolo Bonzini         vmcb->control.intercept |= (1ULL << INTERCEPT_INTR);
1349096cf7feSPaolo Bonzini         vmcb->control.int_ctl |= V_INTR_MASKING_MASK;
135085dc2aceSPaolo Bonzini         break;
135185dc2aceSPaolo Bonzini 
135285dc2aceSPaolo Bonzini     case 1:
135385dc2aceSPaolo Bonzini     case 3:
1354096cf7feSPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_INTR) {
135585dc2aceSPaolo Bonzini             report(false, "VMEXIT not due to intr intercept. Exit reason 0x%x",
1356096cf7feSPaolo Bonzini                    vmcb->control.exit_code);
135785dc2aceSPaolo Bonzini             return true;
135885dc2aceSPaolo Bonzini         }
135985dc2aceSPaolo Bonzini 
136085dc2aceSPaolo Bonzini         irq_enable();
136185dc2aceSPaolo Bonzini         asm volatile ("nop");
136285dc2aceSPaolo Bonzini         irq_disable();
136385dc2aceSPaolo Bonzini 
1364096cf7feSPaolo Bonzini         vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR);
1365096cf7feSPaolo Bonzini         vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
136685dc2aceSPaolo Bonzini         break;
136785dc2aceSPaolo Bonzini 
136885dc2aceSPaolo Bonzini     case 4:
136985dc2aceSPaolo Bonzini         break;
137085dc2aceSPaolo Bonzini 
137185dc2aceSPaolo Bonzini     default:
137285dc2aceSPaolo Bonzini         return true;
137385dc2aceSPaolo Bonzini     }
137485dc2aceSPaolo Bonzini 
137585dc2aceSPaolo Bonzini     inc_test_stage(test);
137685dc2aceSPaolo Bonzini 
137785dc2aceSPaolo Bonzini     return get_test_stage(test) == 5;
137885dc2aceSPaolo Bonzini }
137985dc2aceSPaolo Bonzini 
138085dc2aceSPaolo Bonzini static bool interrupt_check(struct svm_test *test)
138185dc2aceSPaolo Bonzini {
138285dc2aceSPaolo Bonzini     return get_test_stage(test) == 5;
138385dc2aceSPaolo Bonzini }
138485dc2aceSPaolo Bonzini 
1385d4db486bSCathy Avery static volatile bool nmi_fired;
1386d4db486bSCathy Avery 
1387d4db486bSCathy Avery static void nmi_handler(isr_regs_t *regs)
1388d4db486bSCathy Avery {
1389d4db486bSCathy Avery     nmi_fired = true;
1390d4db486bSCathy Avery     apic_write(APIC_EOI, 0);
1391d4db486bSCathy Avery }
1392d4db486bSCathy Avery 
1393d4db486bSCathy Avery static void nmi_prepare(struct svm_test *test)
1394d4db486bSCathy Avery {
1395d4db486bSCathy Avery     default_prepare(test);
1396d4db486bSCathy Avery     nmi_fired = false;
1397d4db486bSCathy Avery     handle_irq(NMI_VECTOR, nmi_handler);
1398d4db486bSCathy Avery     set_test_stage(test, 0);
1399d4db486bSCathy Avery }
1400d4db486bSCathy Avery 
1401d4db486bSCathy Avery static void nmi_test(struct svm_test *test)
1402d4db486bSCathy Avery {
1403d4db486bSCathy Avery     apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0);
1404d4db486bSCathy Avery 
1405d4db486bSCathy Avery     report(nmi_fired, "direct NMI while running guest");
1406d4db486bSCathy Avery 
1407d4db486bSCathy Avery     if (!nmi_fired)
1408d4db486bSCathy Avery         set_test_stage(test, -1);
1409d4db486bSCathy Avery 
1410d4db486bSCathy Avery     vmmcall();
1411d4db486bSCathy Avery 
1412d4db486bSCathy Avery     nmi_fired = false;
1413d4db486bSCathy Avery 
1414d4db486bSCathy Avery     apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0);
1415d4db486bSCathy Avery 
1416d4db486bSCathy Avery     if (!nmi_fired) {
1417d4db486bSCathy Avery         report(nmi_fired, "intercepted pending NMI not dispatched");
1418d4db486bSCathy Avery         set_test_stage(test, -1);
1419d4db486bSCathy Avery     }
1420d4db486bSCathy Avery 
1421d4db486bSCathy Avery }
1422d4db486bSCathy Avery 
1423d4db486bSCathy Avery static bool nmi_finished(struct svm_test *test)
1424d4db486bSCathy Avery {
1425d4db486bSCathy Avery     switch (get_test_stage(test)) {
1426d4db486bSCathy Avery     case 0:
1427d4db486bSCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1428d4db486bSCathy Avery             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
1429d4db486bSCathy Avery                    vmcb->control.exit_code);
1430d4db486bSCathy Avery             return true;
1431d4db486bSCathy Avery         }
1432d4db486bSCathy Avery         vmcb->save.rip += 3;
1433d4db486bSCathy Avery 
1434d4db486bSCathy Avery         vmcb->control.intercept |= (1ULL << INTERCEPT_NMI);
1435d4db486bSCathy Avery         break;
1436d4db486bSCathy Avery 
1437d4db486bSCathy Avery     case 1:
1438d4db486bSCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_NMI) {
1439d4db486bSCathy Avery             report(false, "VMEXIT not due to NMI intercept. Exit reason 0x%x",
1440d4db486bSCathy Avery                    vmcb->control.exit_code);
1441d4db486bSCathy Avery             return true;
1442d4db486bSCathy Avery         }
1443d4db486bSCathy Avery 
1444d4db486bSCathy Avery         report(true, "NMI intercept while running guest");
1445d4db486bSCathy Avery         break;
1446d4db486bSCathy Avery 
1447d4db486bSCathy Avery     case 2:
1448d4db486bSCathy Avery         break;
1449d4db486bSCathy Avery 
1450d4db486bSCathy Avery     default:
1451d4db486bSCathy Avery         return true;
1452d4db486bSCathy Avery     }
1453d4db486bSCathy Avery 
1454d4db486bSCathy Avery     inc_test_stage(test);
1455d4db486bSCathy Avery 
1456d4db486bSCathy Avery     return get_test_stage(test) == 3;
1457d4db486bSCathy Avery }
1458d4db486bSCathy Avery 
1459d4db486bSCathy Avery static bool nmi_check(struct svm_test *test)
1460d4db486bSCathy Avery {
1461d4db486bSCathy Avery     return get_test_stage(test) == 3;
1462d4db486bSCathy Avery }
1463d4db486bSCathy Avery 
14649da1f4d8SCathy Avery #define NMI_DELAY 100000000ULL
14659da1f4d8SCathy Avery 
14669da1f4d8SCathy Avery static void nmi_message_thread(void *_test)
14679da1f4d8SCathy Avery {
14689da1f4d8SCathy Avery     struct svm_test *test = _test;
14699da1f4d8SCathy Avery 
14709da1f4d8SCathy Avery     while (get_test_stage(test) != 1)
14719da1f4d8SCathy Avery         pause();
14729da1f4d8SCathy Avery 
14739da1f4d8SCathy Avery     delay(NMI_DELAY);
14749da1f4d8SCathy Avery 
14759da1f4d8SCathy Avery     apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]);
14769da1f4d8SCathy Avery 
14779da1f4d8SCathy Avery     while (get_test_stage(test) != 2)
14789da1f4d8SCathy Avery         pause();
14799da1f4d8SCathy Avery 
14809da1f4d8SCathy Avery     delay(NMI_DELAY);
14819da1f4d8SCathy Avery 
14829da1f4d8SCathy Avery     apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]);
14839da1f4d8SCathy Avery }
14849da1f4d8SCathy Avery 
14859da1f4d8SCathy Avery static void nmi_hlt_test(struct svm_test *test)
14869da1f4d8SCathy Avery {
14879da1f4d8SCathy Avery     long long start;
14889da1f4d8SCathy Avery 
14899da1f4d8SCathy Avery     on_cpu_async(1, nmi_message_thread, test);
14909da1f4d8SCathy Avery 
14919da1f4d8SCathy Avery     start = rdtsc();
14929da1f4d8SCathy Avery 
14939da1f4d8SCathy Avery     set_test_stage(test, 1);
14949da1f4d8SCathy Avery 
14959da1f4d8SCathy Avery     asm volatile ("hlt");
14969da1f4d8SCathy Avery 
14979da1f4d8SCathy Avery     report((rdtsc() - start > NMI_DELAY) && nmi_fired,
14989da1f4d8SCathy Avery           "direct NMI + hlt");
14999da1f4d8SCathy Avery 
15009da1f4d8SCathy Avery     if (!nmi_fired)
15019da1f4d8SCathy Avery         set_test_stage(test, -1);
15029da1f4d8SCathy Avery 
15039da1f4d8SCathy Avery     nmi_fired = false;
15049da1f4d8SCathy Avery 
15059da1f4d8SCathy Avery     vmmcall();
15069da1f4d8SCathy Avery 
15079da1f4d8SCathy Avery     start = rdtsc();
15089da1f4d8SCathy Avery 
15099da1f4d8SCathy Avery     set_test_stage(test, 2);
15109da1f4d8SCathy Avery 
15119da1f4d8SCathy Avery     asm volatile ("hlt");
15129da1f4d8SCathy Avery 
15139da1f4d8SCathy Avery     report((rdtsc() - start > NMI_DELAY) && nmi_fired,
15149da1f4d8SCathy Avery            "intercepted NMI + hlt");
15159da1f4d8SCathy Avery 
15169da1f4d8SCathy Avery     if (!nmi_fired) {
15179da1f4d8SCathy Avery         report(nmi_fired, "intercepted pending NMI not dispatched");
15189da1f4d8SCathy Avery         set_test_stage(test, -1);
15197e7d9357SCathy Avery         vmmcall();
15209da1f4d8SCathy Avery     }
15219da1f4d8SCathy Avery 
15229da1f4d8SCathy Avery     set_test_stage(test, 3);
15239da1f4d8SCathy Avery }
15249da1f4d8SCathy Avery 
15259da1f4d8SCathy Avery static bool nmi_hlt_finished(struct svm_test *test)
15269da1f4d8SCathy Avery {
15279da1f4d8SCathy Avery     switch (get_test_stage(test)) {
15289da1f4d8SCathy Avery     case 1:
15299da1f4d8SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
15309da1f4d8SCathy Avery             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
15319da1f4d8SCathy Avery                    vmcb->control.exit_code);
15329da1f4d8SCathy Avery             return true;
15339da1f4d8SCathy Avery         }
15349da1f4d8SCathy Avery         vmcb->save.rip += 3;
15359da1f4d8SCathy Avery 
15369da1f4d8SCathy Avery         vmcb->control.intercept |= (1ULL << INTERCEPT_NMI);
15379da1f4d8SCathy Avery         break;
15389da1f4d8SCathy Avery 
15399da1f4d8SCathy Avery     case 2:
15409da1f4d8SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_NMI) {
15419da1f4d8SCathy Avery             report(false, "VMEXIT not due to NMI intercept. Exit reason 0x%x",
15429da1f4d8SCathy Avery                    vmcb->control.exit_code);
15439da1f4d8SCathy Avery             return true;
15449da1f4d8SCathy Avery         }
15459da1f4d8SCathy Avery 
15469da1f4d8SCathy Avery         report(true, "NMI intercept while running guest");
15479da1f4d8SCathy Avery         break;
15489da1f4d8SCathy Avery 
15499da1f4d8SCathy Avery     case 3:
15509da1f4d8SCathy Avery         break;
15519da1f4d8SCathy Avery 
15529da1f4d8SCathy Avery     default:
15539da1f4d8SCathy Avery         return true;
15549da1f4d8SCathy Avery     }
15559da1f4d8SCathy Avery 
15569da1f4d8SCathy Avery     return get_test_stage(test) == 3;
15579da1f4d8SCathy Avery }
15589da1f4d8SCathy Avery 
15599da1f4d8SCathy Avery static bool nmi_hlt_check(struct svm_test *test)
15609da1f4d8SCathy Avery {
15619da1f4d8SCathy Avery     return get_test_stage(test) == 3;
15629da1f4d8SCathy Avery }
15639da1f4d8SCathy Avery 
15644b4fb247SPaolo Bonzini static volatile int count_exc = 0;
15654b4fb247SPaolo Bonzini 
15664b4fb247SPaolo Bonzini static void my_isr(struct ex_regs *r)
15674b4fb247SPaolo Bonzini {
15684b4fb247SPaolo Bonzini         count_exc++;
15694b4fb247SPaolo Bonzini }
15704b4fb247SPaolo Bonzini 
15714b4fb247SPaolo Bonzini static void exc_inject_prepare(struct svm_test *test)
15724b4fb247SPaolo Bonzini {
15738634a266SPaolo Bonzini     default_prepare(test);
15744b4fb247SPaolo Bonzini     handle_exception(DE_VECTOR, my_isr);
15754b4fb247SPaolo Bonzini     handle_exception(NMI_VECTOR, my_isr);
15764b4fb247SPaolo Bonzini }
15774b4fb247SPaolo Bonzini 
15784b4fb247SPaolo Bonzini 
15794b4fb247SPaolo Bonzini static void exc_inject_test(struct svm_test *test)
15804b4fb247SPaolo Bonzini {
15814b4fb247SPaolo Bonzini     asm volatile ("vmmcall\n\tvmmcall\n\t");
15824b4fb247SPaolo Bonzini }
15834b4fb247SPaolo Bonzini 
15844b4fb247SPaolo Bonzini static bool exc_inject_finished(struct svm_test *test)
15854b4fb247SPaolo Bonzini {
15864b4fb247SPaolo Bonzini     switch (get_test_stage(test)) {
15874b4fb247SPaolo Bonzini     case 0:
15884b4fb247SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
15894b4fb247SPaolo Bonzini             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
15904b4fb247SPaolo Bonzini                    vmcb->control.exit_code);
15914b4fb247SPaolo Bonzini             return true;
15924b4fb247SPaolo Bonzini         }
15932c1ca866SNadav Amit         vmcb->save.rip += 3;
15944b4fb247SPaolo Bonzini         vmcb->control.event_inj = NMI_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID;
15954b4fb247SPaolo Bonzini         break;
15964b4fb247SPaolo Bonzini 
15974b4fb247SPaolo Bonzini     case 1:
15984b4fb247SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_ERR) {
15994b4fb247SPaolo Bonzini             report(false, "VMEXIT not due to error. Exit reason 0x%x",
16004b4fb247SPaolo Bonzini                    vmcb->control.exit_code);
16014b4fb247SPaolo Bonzini             return true;
16024b4fb247SPaolo Bonzini         }
16034b4fb247SPaolo Bonzini         report(count_exc == 0, "exception with vector 2 not injected");
16044b4fb247SPaolo Bonzini         vmcb->control.event_inj = DE_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID;
16054b4fb247SPaolo Bonzini         break;
16064b4fb247SPaolo Bonzini 
16074b4fb247SPaolo Bonzini     case 2:
16084b4fb247SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
16094b4fb247SPaolo Bonzini             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
16104b4fb247SPaolo Bonzini                    vmcb->control.exit_code);
16114b4fb247SPaolo Bonzini             return true;
16124b4fb247SPaolo Bonzini         }
16132c1ca866SNadav Amit         vmcb->save.rip += 3;
16144b4fb247SPaolo Bonzini         report(count_exc == 1, "divide overflow exception injected");
16154b4fb247SPaolo Bonzini         report(!(vmcb->control.event_inj & SVM_EVTINJ_VALID), "eventinj.VALID cleared");
16164b4fb247SPaolo Bonzini         break;
16174b4fb247SPaolo Bonzini 
16184b4fb247SPaolo Bonzini     default:
16194b4fb247SPaolo Bonzini         return true;
16204b4fb247SPaolo Bonzini     }
16214b4fb247SPaolo Bonzini 
16224b4fb247SPaolo Bonzini     inc_test_stage(test);
16234b4fb247SPaolo Bonzini 
16244b4fb247SPaolo Bonzini     return get_test_stage(test) == 3;
16254b4fb247SPaolo Bonzini }
16264b4fb247SPaolo Bonzini 
16274b4fb247SPaolo Bonzini static bool exc_inject_check(struct svm_test *test)
16284b4fb247SPaolo Bonzini {
16294b4fb247SPaolo Bonzini     return count_exc == 1 && get_test_stage(test) == 3;
16304b4fb247SPaolo Bonzini }
16314b4fb247SPaolo Bonzini 
16329c838954SCathy Avery static volatile bool virq_fired;
16339c838954SCathy Avery 
16349c838954SCathy Avery static void virq_isr(isr_regs_t *regs)
16359c838954SCathy Avery {
16369c838954SCathy Avery     virq_fired = true;
16379c838954SCathy Avery }
16389c838954SCathy Avery 
16399c838954SCathy Avery static void virq_inject_prepare(struct svm_test *test)
16409c838954SCathy Avery {
16419c838954SCathy Avery     handle_irq(0xf1, virq_isr);
16429c838954SCathy Avery     default_prepare(test);
16439c838954SCathy Avery     vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
16449c838954SCathy Avery                             (0x0f << V_INTR_PRIO_SHIFT); // Set to the highest priority
16459c838954SCathy Avery     vmcb->control.int_vector = 0xf1;
16469c838954SCathy Avery     virq_fired = false;
16479c838954SCathy Avery     set_test_stage(test, 0);
16489c838954SCathy Avery }
16499c838954SCathy Avery 
16509c838954SCathy Avery static void virq_inject_test(struct svm_test *test)
16519c838954SCathy Avery {
16529c838954SCathy Avery     if (virq_fired) {
16539c838954SCathy Avery         report(false, "virtual interrupt fired before L2 sti");
16549c838954SCathy Avery         set_test_stage(test, -1);
16559c838954SCathy Avery         vmmcall();
16569c838954SCathy Avery     }
16579c838954SCathy Avery 
16589c838954SCathy Avery     irq_enable();
16599c838954SCathy Avery     asm volatile ("nop");
16609c838954SCathy Avery     irq_disable();
16619c838954SCathy Avery 
16629c838954SCathy Avery     if (!virq_fired) {
16639c838954SCathy Avery         report(false, "virtual interrupt not fired after L2 sti");
16649c838954SCathy Avery         set_test_stage(test, -1);
16659c838954SCathy Avery     }
16669c838954SCathy Avery 
16679c838954SCathy Avery     vmmcall();
16689c838954SCathy Avery 
16699c838954SCathy Avery     if (virq_fired) {
16709c838954SCathy Avery         report(false, "virtual interrupt fired before L2 sti after VINTR intercept");
16719c838954SCathy Avery         set_test_stage(test, -1);
16729c838954SCathy Avery         vmmcall();
16739c838954SCathy Avery     }
16749c838954SCathy Avery 
16759c838954SCathy Avery     irq_enable();
16769c838954SCathy Avery     asm volatile ("nop");
16779c838954SCathy Avery     irq_disable();
16789c838954SCathy Avery 
16799c838954SCathy Avery     if (!virq_fired) {
16809c838954SCathy Avery         report(false, "virtual interrupt not fired after return from VINTR intercept");
16819c838954SCathy Avery         set_test_stage(test, -1);
16829c838954SCathy Avery     }
16839c838954SCathy Avery 
16849c838954SCathy Avery     vmmcall();
16859c838954SCathy Avery 
16869c838954SCathy Avery     irq_enable();
16879c838954SCathy Avery     asm volatile ("nop");
16889c838954SCathy Avery     irq_disable();
16899c838954SCathy Avery 
16909c838954SCathy Avery     if (virq_fired) {
16919c838954SCathy Avery         report(false, "virtual interrupt fired when V_IRQ_PRIO less than V_TPR");
16929c838954SCathy Avery         set_test_stage(test, -1);
16939c838954SCathy Avery     }
16949c838954SCathy Avery 
16959c838954SCathy Avery     vmmcall();
16969c838954SCathy Avery     vmmcall();
16979c838954SCathy Avery }
16989c838954SCathy Avery 
16999c838954SCathy Avery static bool virq_inject_finished(struct svm_test *test)
17009c838954SCathy Avery {
17019c838954SCathy Avery     vmcb->save.rip += 3;
17029c838954SCathy Avery 
17039c838954SCathy Avery     switch (get_test_stage(test)) {
17049c838954SCathy Avery     case 0:
17059c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
17069c838954SCathy Avery             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
17079c838954SCathy Avery                    vmcb->control.exit_code);
17089c838954SCathy Avery             return true;
17099c838954SCathy Avery         }
17109c838954SCathy Avery         if (vmcb->control.int_ctl & V_IRQ_MASK) {
17119c838954SCathy Avery             report(false, "V_IRQ not cleared on VMEXIT after firing");
17129c838954SCathy Avery             return true;
17139c838954SCathy Avery         }
17149c838954SCathy Avery         virq_fired = false;
17159c838954SCathy Avery         vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
17169c838954SCathy Avery         vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
17179c838954SCathy Avery                             (0x0f << V_INTR_PRIO_SHIFT);
17189c838954SCathy Avery         break;
17199c838954SCathy Avery 
17209c838954SCathy Avery     case 1:
17219c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VINTR) {
17229c838954SCathy Avery             report(false, "VMEXIT not due to vintr. Exit reason 0x%x",
17239c838954SCathy Avery                    vmcb->control.exit_code);
17249c838954SCathy Avery             return true;
17259c838954SCathy Avery         }
17269c838954SCathy Avery         if (virq_fired) {
17279c838954SCathy Avery             report(false, "V_IRQ fired before SVM_EXIT_VINTR");
17289c838954SCathy Avery             return true;
17299c838954SCathy Avery         }
17309c838954SCathy Avery         vmcb->control.intercept &= ~(1ULL << INTERCEPT_VINTR);
17319c838954SCathy Avery         break;
17329c838954SCathy Avery 
17339c838954SCathy Avery     case 2:
17349c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
17359c838954SCathy Avery             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
17369c838954SCathy Avery                    vmcb->control.exit_code);
17379c838954SCathy Avery             return true;
17389c838954SCathy Avery         }
17399c838954SCathy Avery         virq_fired = false;
17409c838954SCathy Avery         // Set irq to lower priority
17419c838954SCathy Avery         vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
17429c838954SCathy Avery                             (0x08 << V_INTR_PRIO_SHIFT);
17439c838954SCathy Avery         // Raise guest TPR
17449c838954SCathy Avery         vmcb->control.int_ctl |= 0x0a & V_TPR_MASK;
17459c838954SCathy Avery         break;
17469c838954SCathy Avery 
17479c838954SCathy Avery     case 3:
17489c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
17499c838954SCathy Avery             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
17509c838954SCathy Avery                    vmcb->control.exit_code);
17519c838954SCathy Avery             return true;
17529c838954SCathy Avery         }
17539c838954SCathy Avery         vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
17549c838954SCathy Avery         break;
17559c838954SCathy Avery 
17569c838954SCathy Avery     case 4:
17579c838954SCathy Avery         // INTERCEPT_VINTR should be ignored because V_INTR_PRIO < V_TPR
17589c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
17599c838954SCathy Avery             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
17609c838954SCathy Avery                    vmcb->control.exit_code);
17619c838954SCathy Avery             return true;
17629c838954SCathy Avery         }
17639c838954SCathy Avery         break;
17649c838954SCathy Avery 
17659c838954SCathy Avery     default:
17669c838954SCathy Avery         return true;
17679c838954SCathy Avery     }
17689c838954SCathy Avery 
17699c838954SCathy Avery     inc_test_stage(test);
17709c838954SCathy Avery 
17719c838954SCathy Avery     return get_test_stage(test) == 5;
17729c838954SCathy Avery }
17739c838954SCathy Avery 
17749c838954SCathy Avery static bool virq_inject_check(struct svm_test *test)
17759c838954SCathy Avery {
17769c838954SCathy Avery     return get_test_stage(test) == 5;
17779c838954SCathy Avery }
17789c838954SCathy Avery 
1779da338a31SMaxim Levitsky /*
1780da338a31SMaxim Levitsky  * Detect nested guest RIP corruption as explained in kernel commit
1781da338a31SMaxim Levitsky  * b6162e82aef19fee9c32cb3fe9ac30d9116a8c73
1782da338a31SMaxim Levitsky  *
1783da338a31SMaxim Levitsky  * In the assembly loop below 'ins' is executed while IO instructions
1784da338a31SMaxim Levitsky  * are not intercepted; the instruction is emulated by L0.
1785da338a31SMaxim Levitsky  *
1786da338a31SMaxim Levitsky  * At the same time we are getting interrupts from the local APIC timer,
1787da338a31SMaxim Levitsky  * and we do intercept them in L1
1788da338a31SMaxim Levitsky  *
1789da338a31SMaxim Levitsky  * If the interrupt happens on the insb instruction, L0 will VMexit, emulate
1790da338a31SMaxim Levitsky  * the insb instruction and then it will inject the interrupt to L1 through
1791da338a31SMaxim Levitsky  * a nested VMexit.  Due to a bug, it would leave pre-emulation values of RIP,
1792da338a31SMaxim Levitsky  * RAX and RSP in the VMCB.
1793da338a31SMaxim Levitsky  *
1794da338a31SMaxim Levitsky  * In our intercept handler we detect the bug by checking that RIP is that of
1795da338a31SMaxim Levitsky  * the insb instruction, but its memory operand has already been written.
1796da338a31SMaxim Levitsky  * This means that insb was already executed.
1797da338a31SMaxim Levitsky  */
1798da338a31SMaxim Levitsky 
1799da338a31SMaxim Levitsky static volatile int isr_cnt = 0;
1800da338a31SMaxim Levitsky static volatile uint8_t io_port_var = 0xAA;
1801da338a31SMaxim Levitsky extern const char insb_instruction_label[];
1802da338a31SMaxim Levitsky 
1803da338a31SMaxim Levitsky static void reg_corruption_isr(isr_regs_t *regs)
1804da338a31SMaxim Levitsky {
1805da338a31SMaxim Levitsky     isr_cnt++;
1806da338a31SMaxim Levitsky     apic_write(APIC_EOI, 0);
1807da338a31SMaxim Levitsky }
1808da338a31SMaxim Levitsky 
1809da338a31SMaxim Levitsky static void reg_corruption_prepare(struct svm_test *test)
1810da338a31SMaxim Levitsky {
1811da338a31SMaxim Levitsky     default_prepare(test);
1812da338a31SMaxim Levitsky     set_test_stage(test, 0);
1813da338a31SMaxim Levitsky 
1814da338a31SMaxim Levitsky     vmcb->control.int_ctl = V_INTR_MASKING_MASK;
1815da338a31SMaxim Levitsky     vmcb->control.intercept |= (1ULL << INTERCEPT_INTR);
1816da338a31SMaxim Levitsky 
1817da338a31SMaxim Levitsky     handle_irq(TIMER_VECTOR, reg_corruption_isr);
1818da338a31SMaxim Levitsky 
1819da338a31SMaxim Levitsky     /* set local APIC to inject external interrupts */
1820da338a31SMaxim Levitsky     apic_write(APIC_TMICT, 0);
1821da338a31SMaxim Levitsky     apic_write(APIC_TDCR, 0);
1822da338a31SMaxim Levitsky     apic_write(APIC_LVTT, TIMER_VECTOR | APIC_LVT_TIMER_PERIODIC);
1823da338a31SMaxim Levitsky     apic_write(APIC_TMICT, 1000);
1824da338a31SMaxim Levitsky }
1825da338a31SMaxim Levitsky 
1826da338a31SMaxim Levitsky static void reg_corruption_test(struct svm_test *test)
1827da338a31SMaxim Levitsky {
1828da338a31SMaxim Levitsky     /* this is endless loop, which is interrupted by the timer interrupt */
1829da338a31SMaxim Levitsky     asm volatile (
1830da338a31SMaxim Levitsky             "1:\n\t"
1831da338a31SMaxim Levitsky             "movw $0x4d0, %%dx\n\t" // IO port
1832da338a31SMaxim Levitsky             "lea %[io_port_var], %%rdi\n\t"
1833da338a31SMaxim Levitsky             "movb $0xAA, %[io_port_var]\n\t"
1834da338a31SMaxim Levitsky             "insb_instruction_label:\n\t"
1835da338a31SMaxim Levitsky             "insb\n\t"
1836da338a31SMaxim Levitsky             "jmp 1b\n\t"
1837da338a31SMaxim Levitsky 
1838da338a31SMaxim Levitsky             : [io_port_var] "=m" (io_port_var)
1839da338a31SMaxim Levitsky             : /* no inputs*/
1840da338a31SMaxim Levitsky             : "rdx", "rdi"
1841da338a31SMaxim Levitsky     );
1842da338a31SMaxim Levitsky }
1843da338a31SMaxim Levitsky 
1844da338a31SMaxim Levitsky static bool reg_corruption_finished(struct svm_test *test)
1845da338a31SMaxim Levitsky {
1846da338a31SMaxim Levitsky     if (isr_cnt == 10000) {
1847da338a31SMaxim Levitsky         report(true,
1848da338a31SMaxim Levitsky                "No RIP corruption detected after %d timer interrupts",
1849da338a31SMaxim Levitsky                isr_cnt);
1850da338a31SMaxim Levitsky         set_test_stage(test, 1);
1851da338a31SMaxim Levitsky         return true;
1852da338a31SMaxim Levitsky     }
1853da338a31SMaxim Levitsky 
1854da338a31SMaxim Levitsky     if (vmcb->control.exit_code == SVM_EXIT_INTR) {
1855da338a31SMaxim Levitsky 
1856da338a31SMaxim Levitsky         void* guest_rip = (void*)vmcb->save.rip;
1857da338a31SMaxim Levitsky 
1858da338a31SMaxim Levitsky         irq_enable();
1859da338a31SMaxim Levitsky         asm volatile ("nop");
1860da338a31SMaxim Levitsky         irq_disable();
1861da338a31SMaxim Levitsky 
1862da338a31SMaxim Levitsky         if (guest_rip == insb_instruction_label && io_port_var != 0xAA) {
1863da338a31SMaxim Levitsky             report(false,
1864da338a31SMaxim Levitsky                    "RIP corruption detected after %d timer interrupts",
1865da338a31SMaxim Levitsky                    isr_cnt);
1866da338a31SMaxim Levitsky             return true;
1867da338a31SMaxim Levitsky         }
1868da338a31SMaxim Levitsky 
1869da338a31SMaxim Levitsky     }
1870da338a31SMaxim Levitsky     return false;
1871da338a31SMaxim Levitsky }
1872da338a31SMaxim Levitsky 
1873da338a31SMaxim Levitsky static bool reg_corruption_check(struct svm_test *test)
1874da338a31SMaxim Levitsky {
1875da338a31SMaxim Levitsky     return get_test_stage(test) == 1;
1876da338a31SMaxim Levitsky }
1877da338a31SMaxim Levitsky 
18784770e9c8SCathy Avery static void get_tss_entry(void *data)
18794770e9c8SCathy Avery {
18804770e9c8SCathy Avery     struct descriptor_table_ptr gdt;
18814770e9c8SCathy Avery     struct segment_desc64 *gdt_table;
18824770e9c8SCathy Avery     struct segment_desc64 *tss_entry;
18834770e9c8SCathy Avery     u16 tr = 0;
18844770e9c8SCathy Avery 
18854770e9c8SCathy Avery     sgdt(&gdt);
18864770e9c8SCathy Avery     tr = str();
18874770e9c8SCathy Avery     gdt_table = (struct segment_desc64 *) gdt.base;
18884770e9c8SCathy Avery     tss_entry = &gdt_table[tr / sizeof(struct segment_desc64)];
18894770e9c8SCathy Avery     *((struct segment_desc64 **)data) = tss_entry;
18904770e9c8SCathy Avery }
18914770e9c8SCathy Avery 
18924770e9c8SCathy Avery static int orig_cpu_count;
18934770e9c8SCathy Avery 
18944770e9c8SCathy Avery static void init_startup_prepare(struct svm_test *test)
18954770e9c8SCathy Avery {
18964770e9c8SCathy Avery     struct segment_desc64 *tss_entry;
18974770e9c8SCathy Avery     int i;
18984770e9c8SCathy Avery 
18994770e9c8SCathy Avery     on_cpu(1, get_tss_entry, &tss_entry);
19004770e9c8SCathy Avery 
19014770e9c8SCathy Avery     orig_cpu_count = cpu_online_count;
19024770e9c8SCathy Avery 
19034770e9c8SCathy Avery     apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_INIT | APIC_INT_ASSERT,
19044770e9c8SCathy Avery                    id_map[1]);
19054770e9c8SCathy Avery 
19064770e9c8SCathy Avery     delay(100000000ULL);
19074770e9c8SCathy Avery 
19084770e9c8SCathy Avery     --cpu_online_count;
19094770e9c8SCathy Avery 
19104770e9c8SCathy Avery     *(uint64_t *)tss_entry &= ~DESC_BUSY;
19114770e9c8SCathy Avery 
19124770e9c8SCathy Avery     apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_STARTUP, id_map[1]);
19134770e9c8SCathy Avery 
19144770e9c8SCathy Avery     for (i = 0; i < 5 && cpu_online_count < orig_cpu_count; i++)
19154770e9c8SCathy Avery        delay(100000000ULL);
19164770e9c8SCathy Avery }
19174770e9c8SCathy Avery 
19184770e9c8SCathy Avery static bool init_startup_finished(struct svm_test *test)
19194770e9c8SCathy Avery {
19204770e9c8SCathy Avery     return true;
19214770e9c8SCathy Avery }
19224770e9c8SCathy Avery 
19234770e9c8SCathy Avery static bool init_startup_check(struct svm_test *test)
19244770e9c8SCathy Avery {
19254770e9c8SCathy Avery     return cpu_online_count == orig_cpu_count;
19264770e9c8SCathy Avery }
19274770e9c8SCathy Avery 
1928d5da6dfeSCathy Avery static volatile bool init_intercept;
1929d5da6dfeSCathy Avery 
1930d5da6dfeSCathy Avery static void init_intercept_prepare(struct svm_test *test)
1931d5da6dfeSCathy Avery {
1932d5da6dfeSCathy Avery     init_intercept = false;
1933d5da6dfeSCathy Avery     vmcb->control.intercept |= (1ULL << INTERCEPT_INIT);
1934d5da6dfeSCathy Avery }
1935d5da6dfeSCathy Avery 
1936d5da6dfeSCathy Avery static void init_intercept_test(struct svm_test *test)
1937d5da6dfeSCathy Avery {
1938d5da6dfeSCathy Avery     apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_INIT | APIC_INT_ASSERT, 0);
1939d5da6dfeSCathy Avery }
1940d5da6dfeSCathy Avery 
1941d5da6dfeSCathy Avery static bool init_intercept_finished(struct svm_test *test)
1942d5da6dfeSCathy Avery {
1943d5da6dfeSCathy Avery     vmcb->save.rip += 3;
1944d5da6dfeSCathy Avery 
1945d5da6dfeSCathy Avery     if (vmcb->control.exit_code != SVM_EXIT_INIT) {
1946d5da6dfeSCathy Avery         report(false, "VMEXIT not due to init intercept. Exit reason 0x%x",
1947d5da6dfeSCathy Avery                vmcb->control.exit_code);
1948d5da6dfeSCathy Avery 
1949d5da6dfeSCathy Avery         return true;
1950d5da6dfeSCathy Avery         }
1951d5da6dfeSCathy Avery 
1952d5da6dfeSCathy Avery     init_intercept = true;
1953d5da6dfeSCathy Avery 
1954d5da6dfeSCathy Avery     report(true, "INIT to vcpu intercepted");
1955d5da6dfeSCathy Avery 
1956d5da6dfeSCathy Avery     return true;
1957d5da6dfeSCathy Avery }
1958d5da6dfeSCathy Avery 
1959d5da6dfeSCathy Avery static bool init_intercept_check(struct svm_test *test)
1960d5da6dfeSCathy Avery {
1961d5da6dfeSCathy Avery     return init_intercept;
1962d5da6dfeSCathy Avery }
1963d5da6dfeSCathy Avery 
19647839b0ecSKrish Sadhukhan /*
19657839b0ecSKrish Sadhukhan  * Setting host EFLAGS.TF causes a #DB trap after the VMRUN completes on the
19667839b0ecSKrish Sadhukhan  * host side (i.e., after the #VMEXIT from the guest).
19677839b0ecSKrish Sadhukhan  *
19687839b0ecSKrish Sadhukhan  * [AMD APM]
19697839b0ecSKrish Sadhukhan  */
19707839b0ecSKrish Sadhukhan static volatile u8 host_rflags_guest_main_flag = 0;
19717839b0ecSKrish Sadhukhan static volatile u8 host_rflags_db_handler_flag = 0;
19727839b0ecSKrish Sadhukhan static volatile bool host_rflags_ss_on_vmrun = false;
19737839b0ecSKrish Sadhukhan static volatile bool host_rflags_vmrun_reached = false;
19747839b0ecSKrish Sadhukhan static volatile bool host_rflags_set_tf = false;
19757839b0ecSKrish Sadhukhan static u64 post_vmrun_rip;
19767839b0ecSKrish Sadhukhan 
19777839b0ecSKrish Sadhukhan extern u64 *vmrun_rip;
19787839b0ecSKrish Sadhukhan 
19797839b0ecSKrish Sadhukhan static void host_rflags_db_handler(struct ex_regs *r)
19807839b0ecSKrish Sadhukhan {
19817839b0ecSKrish Sadhukhan 	if (host_rflags_ss_on_vmrun) {
19827839b0ecSKrish Sadhukhan 		if (host_rflags_vmrun_reached) {
19837839b0ecSKrish Sadhukhan 			r->rflags &= ~X86_EFLAGS_TF;
19847839b0ecSKrish Sadhukhan 			post_vmrun_rip = r->rip;
19857839b0ecSKrish Sadhukhan 		} else {
19867839b0ecSKrish Sadhukhan 			if (r->rip == (u64)&vmrun_rip)
19877839b0ecSKrish Sadhukhan 				host_rflags_vmrun_reached = true;
19887839b0ecSKrish Sadhukhan 		}
19897839b0ecSKrish Sadhukhan 	} else {
19907839b0ecSKrish Sadhukhan 		r->rflags &= ~X86_EFLAGS_TF;
19917839b0ecSKrish Sadhukhan 	}
19927839b0ecSKrish Sadhukhan }
19937839b0ecSKrish Sadhukhan 
19947839b0ecSKrish Sadhukhan static void host_rflags_prepare(struct svm_test *test)
19957839b0ecSKrish Sadhukhan {
19967839b0ecSKrish Sadhukhan 	default_prepare(test);
19977839b0ecSKrish Sadhukhan 	handle_exception(DB_VECTOR, host_rflags_db_handler);
19987839b0ecSKrish Sadhukhan 	set_test_stage(test, 0);
19997839b0ecSKrish Sadhukhan }
20007839b0ecSKrish Sadhukhan 
20017839b0ecSKrish Sadhukhan static void host_rflags_prepare_gif_clear(struct svm_test *test)
20027839b0ecSKrish Sadhukhan {
20037839b0ecSKrish Sadhukhan 	if (host_rflags_set_tf)
20047839b0ecSKrish Sadhukhan 		write_rflags(read_rflags() | X86_EFLAGS_TF);
20057839b0ecSKrish Sadhukhan }
20067839b0ecSKrish Sadhukhan 
20077839b0ecSKrish Sadhukhan static void host_rflags_test(struct svm_test *test)
20087839b0ecSKrish Sadhukhan {
20097839b0ecSKrish Sadhukhan 	while (1) {
20107839b0ecSKrish Sadhukhan 		if (get_test_stage(test) > 0 && host_rflags_set_tf &&
20117839b0ecSKrish Sadhukhan 		    (!host_rflags_ss_on_vmrun) &&
20127839b0ecSKrish Sadhukhan 		    (!host_rflags_db_handler_flag))
20137839b0ecSKrish Sadhukhan 			host_rflags_guest_main_flag = 1;
20147839b0ecSKrish Sadhukhan 		if (get_test_stage(test) == 3)
20157839b0ecSKrish Sadhukhan 			break;
20167839b0ecSKrish Sadhukhan 		vmmcall();
20177839b0ecSKrish Sadhukhan 	}
20187839b0ecSKrish Sadhukhan }
20197839b0ecSKrish Sadhukhan 
20207839b0ecSKrish Sadhukhan static bool host_rflags_finished(struct svm_test *test)
20217839b0ecSKrish Sadhukhan {
20227839b0ecSKrish Sadhukhan 	switch (get_test_stage(test)) {
20237839b0ecSKrish Sadhukhan 	case 0:
20247839b0ecSKrish Sadhukhan 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
20257839b0ecSKrish Sadhukhan 			report(false, "Unexpected VMEXIT. Exit reason 0x%x",
20267839b0ecSKrish Sadhukhan 			    vmcb->control.exit_code);
20277839b0ecSKrish Sadhukhan 			return true;
20287839b0ecSKrish Sadhukhan 		}
20297839b0ecSKrish Sadhukhan 		vmcb->save.rip += 3;
20307839b0ecSKrish Sadhukhan 		/*
20317839b0ecSKrish Sadhukhan 		 * Setting host EFLAGS.TF not immediately before VMRUN, causes
20327839b0ecSKrish Sadhukhan 		 * #DB trap before first guest instruction is executed
20337839b0ecSKrish Sadhukhan 		 */
20347839b0ecSKrish Sadhukhan 		host_rflags_set_tf = true;
20357839b0ecSKrish Sadhukhan 		break;
20367839b0ecSKrish Sadhukhan 	case 1:
20377839b0ecSKrish Sadhukhan 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL ||
20387839b0ecSKrish Sadhukhan 		    (!host_rflags_guest_main_flag)) {
20397839b0ecSKrish Sadhukhan 			report(false, "Unexpected VMEXIT or #DB handler"
20407839b0ecSKrish Sadhukhan 			    " invoked before guest main. Exit reason 0x%x",
20417839b0ecSKrish Sadhukhan 			    vmcb->control.exit_code);
20427839b0ecSKrish Sadhukhan 			return true;
20437839b0ecSKrish Sadhukhan 		}
20447839b0ecSKrish Sadhukhan 		vmcb->save.rip += 3;
20457839b0ecSKrish Sadhukhan 		/*
20467839b0ecSKrish Sadhukhan 		 * Setting host EFLAGS.TF immediately before VMRUN, causes #DB
20477839b0ecSKrish Sadhukhan 		 * trap after VMRUN completes on the host side (i.e., after
20487839b0ecSKrish Sadhukhan 		 * VMEXIT from guest).
20497839b0ecSKrish Sadhukhan 		 */
20507839b0ecSKrish Sadhukhan 		host_rflags_ss_on_vmrun = true;
20517839b0ecSKrish Sadhukhan 		break;
20527839b0ecSKrish Sadhukhan 	case 2:
20537839b0ecSKrish Sadhukhan 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL ||
20547839b0ecSKrish Sadhukhan 		    (post_vmrun_rip - (u64)&vmrun_rip) != 3) {
20557839b0ecSKrish Sadhukhan 			report(false, "Unexpected VMEXIT or RIP mismatch."
20567839b0ecSKrish Sadhukhan 			    " Exit reason 0x%x, VMRUN RIP: %lx, post-VMRUN"
20577839b0ecSKrish Sadhukhan 			    " RIP: %lx", vmcb->control.exit_code,
20587839b0ecSKrish Sadhukhan 			    (u64)&vmrun_rip, post_vmrun_rip);
20597839b0ecSKrish Sadhukhan 			return true;
20607839b0ecSKrish Sadhukhan 		}
20617839b0ecSKrish Sadhukhan 		host_rflags_set_tf = false;
20627839b0ecSKrish Sadhukhan 		vmcb->save.rip += 3;
20637839b0ecSKrish Sadhukhan 		break;
20647839b0ecSKrish Sadhukhan 	default:
20657839b0ecSKrish Sadhukhan 		return true;
20667839b0ecSKrish Sadhukhan 	}
20677839b0ecSKrish Sadhukhan 	inc_test_stage(test);
20687839b0ecSKrish Sadhukhan 	return get_test_stage(test) == 4;
20697839b0ecSKrish Sadhukhan }
20707839b0ecSKrish Sadhukhan 
20717839b0ecSKrish Sadhukhan static bool host_rflags_check(struct svm_test *test)
20727839b0ecSKrish Sadhukhan {
20737839b0ecSKrish Sadhukhan 	return get_test_stage(test) == 3;
20747839b0ecSKrish Sadhukhan }
20757839b0ecSKrish Sadhukhan 
20768660d1b5SKrish Sadhukhan #define TEST(name) { #name, .v2 = name }
20778660d1b5SKrish Sadhukhan 
2078ba29942cSKrish Sadhukhan /*
2079ba29942cSKrish Sadhukhan  * v2 tests
2080ba29942cSKrish Sadhukhan  */
2081ba29942cSKrish Sadhukhan 
2082f32183f5SJim Mattson /*
2083f32183f5SJim Mattson  * Ensure that kvm recalculates the L1 guest's CPUID.01H:ECX.OSXSAVE
2084f32183f5SJim Mattson  * after VM-exit from an L2 guest that sets CR4.OSXSAVE to a different
2085f32183f5SJim Mattson  * value than in L1.
2086f32183f5SJim Mattson  */
2087f32183f5SJim Mattson 
2088f32183f5SJim Mattson static void svm_cr4_osxsave_test_guest(struct svm_test *test)
2089f32183f5SJim Mattson {
2090f32183f5SJim Mattson 	write_cr4(read_cr4() & ~X86_CR4_OSXSAVE);
2091f32183f5SJim Mattson }
2092f32183f5SJim Mattson 
2093f32183f5SJim Mattson static void svm_cr4_osxsave_test(void)
2094f32183f5SJim Mattson {
2095f32183f5SJim Mattson 	if (!this_cpu_has(X86_FEATURE_XSAVE)) {
2096f32183f5SJim Mattson 		report_skip("XSAVE not detected");
2097f32183f5SJim Mattson 		return;
2098f32183f5SJim Mattson 	}
2099f32183f5SJim Mattson 
2100f32183f5SJim Mattson 	if (!(read_cr4() & X86_CR4_OSXSAVE)) {
2101f32183f5SJim Mattson 		unsigned long cr4 = read_cr4() | X86_CR4_OSXSAVE;
2102f32183f5SJim Mattson 
2103f32183f5SJim Mattson 		write_cr4(cr4);
2104f32183f5SJim Mattson 		vmcb->save.cr4 = cr4;
2105f32183f5SJim Mattson 	}
2106f32183f5SJim Mattson 
2107f32183f5SJim Mattson 	report(cpuid_osxsave(), "CPUID.01H:ECX.XSAVE set before VMRUN");
2108f32183f5SJim Mattson 
2109f32183f5SJim Mattson 	test_set_guest(svm_cr4_osxsave_test_guest);
2110f32183f5SJim Mattson 	report(svm_vmrun() == SVM_EXIT_VMMCALL,
2111f32183f5SJim Mattson 	       "svm_cr4_osxsave_test_guest finished with VMMCALL");
2112f32183f5SJim Mattson 
2113f32183f5SJim Mattson 	report(cpuid_osxsave(), "CPUID.01H:ECX.XSAVE set after VMRUN");
2114f32183f5SJim Mattson }
2115f32183f5SJim Mattson 
2116ba29942cSKrish Sadhukhan static void basic_guest_main(struct svm_test *test)
2117ba29942cSKrish Sadhukhan {
2118ba29942cSKrish Sadhukhan }
2119ba29942cSKrish Sadhukhan 
2120eae10e8fSKrish Sadhukhan 
2121eae10e8fSKrish Sadhukhan #define SVM_TEST_REG_RESERVED_BITS(start, end, inc, str_name, reg, val,	\
2122eae10e8fSKrish Sadhukhan 				   resv_mask)				\
2123eae10e8fSKrish Sadhukhan {									\
2124eae10e8fSKrish Sadhukhan         u64 tmp, mask;							\
2125eae10e8fSKrish Sadhukhan         int i;								\
2126eae10e8fSKrish Sadhukhan 									\
2127eae10e8fSKrish Sadhukhan         for (i = start; i <= end; i = i + inc) {			\
2128eae10e8fSKrish Sadhukhan                 mask = 1ull << i;					\
2129eae10e8fSKrish Sadhukhan                 if (!(mask & resv_mask))				\
2130eae10e8fSKrish Sadhukhan                         continue;					\
2131eae10e8fSKrish Sadhukhan                 tmp = val | mask;					\
2132eae10e8fSKrish Sadhukhan 		reg = tmp;						\
2133eae10e8fSKrish Sadhukhan 		report(svm_vmrun() == SVM_EXIT_ERR, "Test %s %d:%d: %lx",\
2134eae10e8fSKrish Sadhukhan 		    str_name, end, start, tmp);				\
2135eae10e8fSKrish Sadhukhan         }								\
2136eae10e8fSKrish Sadhukhan }
2137eae10e8fSKrish Sadhukhan 
21386d0ecbf6SKrish Sadhukhan #define SVM_TEST_CR_RESERVED_BITS(start, end, inc, cr, val, resv_mask,	\
2139cb6524f3SPaolo Bonzini 				  exit_code, test_name)			\
2140a79c9495SKrish Sadhukhan {									\
2141a79c9495SKrish Sadhukhan 	u64 tmp, mask;							\
21428ae6d77fSSean Christopherson 	u32 r;								\
2143a79c9495SKrish Sadhukhan 	int i;								\
2144a79c9495SKrish Sadhukhan 									\
2145a79c9495SKrish Sadhukhan 	for (i = start; i <= end; i = i + inc) {			\
2146a79c9495SKrish Sadhukhan 		mask = 1ull << i;					\
2147a79c9495SKrish Sadhukhan 		if (!(mask & resv_mask))				\
2148a79c9495SKrish Sadhukhan 			continue;					\
2149a79c9495SKrish Sadhukhan 		tmp = val | mask;					\
2150a79c9495SKrish Sadhukhan 		switch (cr) {						\
2151a79c9495SKrish Sadhukhan 		case 0:							\
2152a79c9495SKrish Sadhukhan 			vmcb->save.cr0 = tmp;				\
2153a79c9495SKrish Sadhukhan 			break;						\
2154a79c9495SKrish Sadhukhan 		case 3:							\
2155a79c9495SKrish Sadhukhan 			vmcb->save.cr3 = tmp;				\
2156a79c9495SKrish Sadhukhan 			break;						\
2157a79c9495SKrish Sadhukhan 		case 4:							\
2158a79c9495SKrish Sadhukhan 			vmcb->save.cr4 = tmp;				\
2159a79c9495SKrish Sadhukhan 		}							\
21608ae6d77fSSean Christopherson 		r = svm_vmrun();					\
21618ae6d77fSSean Christopherson 		report(r == exit_code, "Test CR%d %s%d:%d: %lx, wanted exit 0x%x, got 0x%x",\
21628ae6d77fSSean Christopherson 		       cr, test_name, end, start, tmp, exit_code, r);	\
2163a79c9495SKrish Sadhukhan 	}								\
2164a79c9495SKrish Sadhukhan }
2165e8d7a8f6SKrish Sadhukhan 
2166a79c9495SKrish Sadhukhan static void test_efer(void)
2167a79c9495SKrish Sadhukhan {
2168e8d7a8f6SKrish Sadhukhan 	/*
2169e8d7a8f6SKrish Sadhukhan 	 * Un-setting EFER.SVME is illegal
2170e8d7a8f6SKrish Sadhukhan 	 */
2171ba29942cSKrish Sadhukhan 	u64 efer_saved = vmcb->save.efer;
2172ba29942cSKrish Sadhukhan 	u64 efer = efer_saved;
2173ba29942cSKrish Sadhukhan 
2174ba29942cSKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "EFER.SVME: %lx", efer);
2175ba29942cSKrish Sadhukhan 	efer &= ~EFER_SVME;
2176ba29942cSKrish Sadhukhan 	vmcb->save.efer = efer;
2177ba29942cSKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_ERR, "EFER.SVME: %lx", efer);
2178ba29942cSKrish Sadhukhan 	vmcb->save.efer = efer_saved;
2179e8d7a8f6SKrish Sadhukhan 
2180e8d7a8f6SKrish Sadhukhan 	/*
2181a79c9495SKrish Sadhukhan 	 * EFER MBZ bits: 63:16, 9
2182a79c9495SKrish Sadhukhan 	 */
2183a79c9495SKrish Sadhukhan 	efer_saved = vmcb->save.efer;
2184a79c9495SKrish Sadhukhan 
2185a79c9495SKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(8, 9, 1, "EFER", vmcb->save.efer,
2186a79c9495SKrish Sadhukhan 	    efer_saved, SVM_EFER_RESERVED_MASK);
2187a79c9495SKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(16, 63, 4, "EFER", vmcb->save.efer,
2188a79c9495SKrish Sadhukhan 	    efer_saved, SVM_EFER_RESERVED_MASK);
2189a79c9495SKrish Sadhukhan 
21901d7bde08SKrish Sadhukhan 	/*
21911d7bde08SKrish Sadhukhan 	 * EFER.LME and CR0.PG are both set and CR4.PAE is zero.
21921d7bde08SKrish Sadhukhan 	 */
21931d7bde08SKrish Sadhukhan 	u64 cr0_saved = vmcb->save.cr0;
21941d7bde08SKrish Sadhukhan 	u64 cr0;
21951d7bde08SKrish Sadhukhan 	u64 cr4_saved = vmcb->save.cr4;
21961d7bde08SKrish Sadhukhan 	u64 cr4;
21971d7bde08SKrish Sadhukhan 
21981d7bde08SKrish Sadhukhan 	efer = efer_saved | EFER_LME;
21991d7bde08SKrish Sadhukhan 	vmcb->save.efer = efer;
22001d7bde08SKrish Sadhukhan 	cr0 = cr0_saved | X86_CR0_PG | X86_CR0_PE;
22011d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
22021d7bde08SKrish Sadhukhan 	cr4 = cr4_saved & ~X86_CR4_PAE;
22031d7bde08SKrish Sadhukhan 	vmcb->save.cr4 = cr4;
22041d7bde08SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), "
22051d7bde08SKrish Sadhukhan 	    "CR0.PG=1 (%lx) and CR4.PAE=0 (%lx)", efer, cr0, cr4);
22061d7bde08SKrish Sadhukhan 
22071d7bde08SKrish Sadhukhan 	/*
22081d7bde08SKrish Sadhukhan 	 * EFER.LME and CR0.PG are both set and CR0.PE is zero.
2209fc050452SLara Lazier 	 * CR4.PAE needs to be set as we otherwise cannot
2210fc050452SLara Lazier 	 * determine if CR4.PAE=0 or CR0.PE=0 triggered the
2211fc050452SLara Lazier 	 * SVM_EXIT_ERR.
22121d7bde08SKrish Sadhukhan 	 */
2213fc050452SLara Lazier 	cr4 = cr4_saved | X86_CR4_PAE;
2214fc050452SLara Lazier 	vmcb->save.cr4 = cr4;
22151d7bde08SKrish Sadhukhan 	cr0 &= ~X86_CR0_PE;
22161d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
22171d7bde08SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), "
22181d7bde08SKrish Sadhukhan 	    "CR0.PG=1 and CR0.PE=0 (%lx)", efer, cr0);
22191d7bde08SKrish Sadhukhan 
22201d7bde08SKrish Sadhukhan 	/*
22211d7bde08SKrish Sadhukhan 	 * EFER.LME, CR0.PG, CR4.PAE, CS.L, and CS.D are all non-zero.
22221d7bde08SKrish Sadhukhan 	 */
22231d7bde08SKrish Sadhukhan 	u32 cs_attrib_saved = vmcb->save.cs.attrib;
22241d7bde08SKrish Sadhukhan 	u32 cs_attrib;
22251d7bde08SKrish Sadhukhan 
22261d7bde08SKrish Sadhukhan 	cr0 |= X86_CR0_PE;
22271d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
22281d7bde08SKrish Sadhukhan 	cs_attrib = cs_attrib_saved | SVM_SELECTOR_L_MASK |
22291d7bde08SKrish Sadhukhan 	    SVM_SELECTOR_DB_MASK;
22301d7bde08SKrish Sadhukhan 	vmcb->save.cs.attrib = cs_attrib;
22311d7bde08SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), "
22321d7bde08SKrish Sadhukhan 	    "CR0.PG=1 (%lx), CR4.PAE=1 (%lx), CS.L=1 and CS.D=1 (%x)",
22331d7bde08SKrish Sadhukhan 	    efer, cr0, cr4, cs_attrib);
22341d7bde08SKrish Sadhukhan 
22351d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0_saved;
22361d7bde08SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved;
2237a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer_saved;
22381d7bde08SKrish Sadhukhan 	vmcb->save.cs.attrib = cs_attrib_saved;
2239a79c9495SKrish Sadhukhan }
2240a79c9495SKrish Sadhukhan 
2241a79c9495SKrish Sadhukhan static void test_cr0(void)
2242a79c9495SKrish Sadhukhan {
2243a79c9495SKrish Sadhukhan 	/*
2244e8d7a8f6SKrish Sadhukhan 	 * Un-setting CR0.CD and setting CR0.NW is illegal combination
2245e8d7a8f6SKrish Sadhukhan 	 */
2246e8d7a8f6SKrish Sadhukhan 	u64 cr0_saved = vmcb->save.cr0;
2247e8d7a8f6SKrish Sadhukhan 	u64 cr0 = cr0_saved;
2248e8d7a8f6SKrish Sadhukhan 
2249e8d7a8f6SKrish Sadhukhan 	cr0 |= X86_CR0_CD;
2250e8d7a8f6SKrish Sadhukhan 	cr0 &= ~X86_CR0_NW;
2251e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2252a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=0: %lx",
2253a79c9495SKrish Sadhukhan 	    cr0);
2254e8d7a8f6SKrish Sadhukhan 	cr0 |= X86_CR0_NW;
2255e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2256a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=1: %lx",
2257a79c9495SKrish Sadhukhan 	    cr0);
2258e8d7a8f6SKrish Sadhukhan 	cr0 &= ~X86_CR0_NW;
2259e8d7a8f6SKrish Sadhukhan 	cr0 &= ~X86_CR0_CD;
2260e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2261a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=0,NW=0: %lx",
2262a79c9495SKrish Sadhukhan 	    cr0);
2263e8d7a8f6SKrish Sadhukhan 	cr0 |= X86_CR0_NW;
2264e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2265a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_ERR, "Test CR0 CD=0,NW=1: %lx",
2266a79c9495SKrish Sadhukhan 	    cr0);
2267e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0_saved;
22685c052c90SKrish Sadhukhan 
22695c052c90SKrish Sadhukhan 	/*
22705c052c90SKrish Sadhukhan 	 * CR0[63:32] are not zero
22715c052c90SKrish Sadhukhan 	 */
22725c052c90SKrish Sadhukhan 	cr0 = cr0_saved;
2273eae10e8fSKrish Sadhukhan 
2274eae10e8fSKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "CR0", vmcb->save.cr0, cr0_saved,
2275eae10e8fSKrish Sadhukhan 	    SVM_CR0_RESERVED_MASK);
22765c052c90SKrish Sadhukhan 	vmcb->save.cr0 = cr0_saved;
2277a79c9495SKrish Sadhukhan }
2278eae10e8fSKrish Sadhukhan 
2279a79c9495SKrish Sadhukhan static void test_cr3(void)
2280a79c9495SKrish Sadhukhan {
2281a79c9495SKrish Sadhukhan 	/*
2282a79c9495SKrish Sadhukhan 	 * CR3 MBZ bits based on different modes:
228329a01803SNadav Amit 	 *   [63:52] - long mode
2284a79c9495SKrish Sadhukhan 	 */
2285a79c9495SKrish Sadhukhan 	u64 cr3_saved = vmcb->save.cr3;
2286a79c9495SKrish Sadhukhan 
2287a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(0, 63, 1, 3, cr3_saved,
2288cb6524f3SPaolo Bonzini 	    SVM_CR3_LONG_MBZ_MASK, SVM_EXIT_ERR, "");
22896d0ecbf6SKrish Sadhukhan 
22906d0ecbf6SKrish Sadhukhan 	vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_MBZ_MASK;
22916d0ecbf6SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx",
22926d0ecbf6SKrish Sadhukhan 	    vmcb->save.cr3);
22936d0ecbf6SKrish Sadhukhan 
22946d0ecbf6SKrish Sadhukhan 	/*
22956d0ecbf6SKrish Sadhukhan 	 * CR3 non-MBZ reserved bits based on different modes:
2296cb6524f3SPaolo Bonzini 	 *   [11:5] [2:0] - long mode (PCIDE=0)
22976d0ecbf6SKrish Sadhukhan 	 *          [2:0] - PAE legacy mode
22986d0ecbf6SKrish Sadhukhan 	 */
22996d0ecbf6SKrish Sadhukhan 	u64 cr4_saved = vmcb->save.cr4;
23006d0ecbf6SKrish Sadhukhan 	u64 *pdpe = npt_get_pml4e();
23016d0ecbf6SKrish Sadhukhan 
23026d0ecbf6SKrish Sadhukhan 	/*
23036d0ecbf6SKrish Sadhukhan 	 * Long mode
23046d0ecbf6SKrish Sadhukhan 	 */
23056d0ecbf6SKrish Sadhukhan 	if (this_cpu_has(X86_FEATURE_PCID)) {
23066d0ecbf6SKrish Sadhukhan 		vmcb->save.cr4 = cr4_saved | X86_CR4_PCIDE;
23076d0ecbf6SKrish Sadhukhan 		SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved,
2308cb6524f3SPaolo Bonzini 		    SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_VMMCALL, "(PCIDE=1) ");
23096d0ecbf6SKrish Sadhukhan 
23106d0ecbf6SKrish Sadhukhan 		vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_RESERVED_MASK;
23116d0ecbf6SKrish Sadhukhan 		report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx",
23126d0ecbf6SKrish Sadhukhan 		    vmcb->save.cr3);
2313cb6524f3SPaolo Bonzini 	}
23146d0ecbf6SKrish Sadhukhan 
23156d0ecbf6SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved & ~X86_CR4_PCIDE;
23166d0ecbf6SKrish Sadhukhan 
2317993749ffSSean Christopherson 	if (!npt_supported())
2318993749ffSSean Christopherson 		goto skip_npt_only;
2319993749ffSSean Christopherson 
23206d0ecbf6SKrish Sadhukhan 	/* Clear P (Present) bit in NPT in order to trigger #NPF */
23216d0ecbf6SKrish Sadhukhan 	pdpe[0] &= ~1ULL;
23226d0ecbf6SKrish Sadhukhan 
23236d0ecbf6SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved,
2324cb6524f3SPaolo Bonzini 	    SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_NPF, "(PCIDE=0) ");
23256d0ecbf6SKrish Sadhukhan 
23266d0ecbf6SKrish Sadhukhan 	pdpe[0] |= 1ULL;
2327cb6524f3SPaolo Bonzini 	vmcb->save.cr3 = cr3_saved;
23286d0ecbf6SKrish Sadhukhan 
23296d0ecbf6SKrish Sadhukhan 	/*
23306d0ecbf6SKrish Sadhukhan 	 * PAE legacy
23316d0ecbf6SKrish Sadhukhan 	 */
23326d0ecbf6SKrish Sadhukhan 	pdpe[0] &= ~1ULL;
23336d0ecbf6SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved | X86_CR4_PAE;
23346d0ecbf6SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(0, 2, 1, 3, cr3_saved,
2335cb6524f3SPaolo Bonzini 	    SVM_CR3_PAE_LEGACY_RESERVED_MASK, SVM_EXIT_NPF, "(PAE) ");
23366d0ecbf6SKrish Sadhukhan 
23376d0ecbf6SKrish Sadhukhan 	pdpe[0] |= 1ULL;
2338993749ffSSean Christopherson 
2339993749ffSSean Christopherson skip_npt_only:
2340a79c9495SKrish Sadhukhan 	vmcb->save.cr3 = cr3_saved;
23416d0ecbf6SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved;
2342a79c9495SKrish Sadhukhan }
2343a79c9495SKrish Sadhukhan 
2344a79c9495SKrish Sadhukhan static void test_cr4(void)
2345a79c9495SKrish Sadhukhan {
2346a79c9495SKrish Sadhukhan 	/*
2347a79c9495SKrish Sadhukhan 	 * CR4 MBZ bits based on different modes:
2348a79c9495SKrish Sadhukhan 	 *   [15:12], 17, 19, [31:22] - legacy mode
2349a79c9495SKrish Sadhukhan 	 *   [15:12], 17, 19, [63:22] - long mode
2350a79c9495SKrish Sadhukhan 	 */
2351a79c9495SKrish Sadhukhan 	u64 cr4_saved = vmcb->save.cr4;
2352a79c9495SKrish Sadhukhan 	u64 efer_saved = vmcb->save.efer;
2353a79c9495SKrish Sadhukhan 	u64 efer = efer_saved;
2354a79c9495SKrish Sadhukhan 
2355a79c9495SKrish Sadhukhan 	efer &= ~EFER_LME;
2356a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer;
2357a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved,
2358cb6524f3SPaolo Bonzini 	    SVM_CR4_LEGACY_RESERVED_MASK, SVM_EXIT_ERR, "");
2359a79c9495SKrish Sadhukhan 
2360a79c9495SKrish Sadhukhan 	efer |= EFER_LME;
2361a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer;
2362a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved,
2363cb6524f3SPaolo Bonzini 	    SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR, "");
2364a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(32, 63, 4, 4, cr4_saved,
2365cb6524f3SPaolo Bonzini 	    SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR, "");
2366a79c9495SKrish Sadhukhan 
2367a79c9495SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved;
2368a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer_saved;
2369a79c9495SKrish Sadhukhan }
2370a79c9495SKrish Sadhukhan 
2371a79c9495SKrish Sadhukhan static void test_dr(void)
2372a79c9495SKrish Sadhukhan {
2373eae10e8fSKrish Sadhukhan 	/*
2374eae10e8fSKrish Sadhukhan 	 * DR6[63:32] and DR7[63:32] are MBZ
2375eae10e8fSKrish Sadhukhan 	 */
2376eae10e8fSKrish Sadhukhan 	u64 dr_saved = vmcb->save.dr6;
2377eae10e8fSKrish Sadhukhan 
2378eae10e8fSKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR6", vmcb->save.dr6, dr_saved,
2379eae10e8fSKrish Sadhukhan 	    SVM_DR6_RESERVED_MASK);
2380eae10e8fSKrish Sadhukhan 	vmcb->save.dr6 = dr_saved;
2381eae10e8fSKrish Sadhukhan 
2382eae10e8fSKrish Sadhukhan 	dr_saved = vmcb->save.dr7;
2383eae10e8fSKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR7", vmcb->save.dr7, dr_saved,
2384eae10e8fSKrish Sadhukhan 	    SVM_DR7_RESERVED_MASK);
2385eae10e8fSKrish Sadhukhan 
2386eae10e8fSKrish Sadhukhan 	vmcb->save.dr7 = dr_saved;
2387a79c9495SKrish Sadhukhan }
2388eae10e8fSKrish Sadhukhan 
2389abe82380SKrish Sadhukhan /* TODO: verify if high 32-bits are sign- or zero-extended on bare metal */
2390abe82380SKrish Sadhukhan #define	TEST_BITMAP_ADDR(save_intercept, type, addr, exit_code,		\
2391abe82380SKrish Sadhukhan 			 msg) {						\
2392abe82380SKrish Sadhukhan 	vmcb->control.intercept = saved_intercept | 1ULL << type;	\
2393abe82380SKrish Sadhukhan 	if (type == INTERCEPT_MSR_PROT)					\
2394abe82380SKrish Sadhukhan 		vmcb->control.msrpm_base_pa = addr;			\
2395abe82380SKrish Sadhukhan 	else								\
2396abe82380SKrish Sadhukhan 		vmcb->control.iopm_base_pa = addr;			\
2397abe82380SKrish Sadhukhan 	report(svm_vmrun() == exit_code,				\
2398abe82380SKrish Sadhukhan 	    "Test %s address: %lx", msg, addr);                         \
2399abe82380SKrish Sadhukhan }
2400abe82380SKrish Sadhukhan 
2401abe82380SKrish Sadhukhan /*
2402abe82380SKrish Sadhukhan  * If the MSR or IOIO intercept table extends to a physical address that
2403abe82380SKrish Sadhukhan  * is greater than or equal to the maximum supported physical address, the
2404abe82380SKrish Sadhukhan  * guest state is illegal.
2405abe82380SKrish Sadhukhan  *
2406abe82380SKrish Sadhukhan  * The VMRUN instruction ignores the lower 12 bits of the address specified
2407abe82380SKrish Sadhukhan  * in the VMCB.
2408abe82380SKrish Sadhukhan  *
2409abe82380SKrish Sadhukhan  * MSRPM spans 2 contiguous 4KB pages while IOPM spans 2 contiguous 4KB
2410abe82380SKrish Sadhukhan  * pages + 1 byte.
2411abe82380SKrish Sadhukhan  *
2412abe82380SKrish Sadhukhan  * [APM vol 2]
2413abe82380SKrish Sadhukhan  *
2414abe82380SKrish Sadhukhan  * Note: Unallocated MSRPM addresses conforming to consistency checks, generate
2415abe82380SKrish Sadhukhan  * #NPF.
2416abe82380SKrish Sadhukhan  */
2417abe82380SKrish Sadhukhan static void test_msrpm_iopm_bitmap_addrs(void)
2418abe82380SKrish Sadhukhan {
2419abe82380SKrish Sadhukhan 	u64 saved_intercept = vmcb->control.intercept;
2420abe82380SKrish Sadhukhan 	u64 addr_beyond_limit = 1ull << cpuid_maxphyaddr();
2421abe82380SKrish Sadhukhan 	u64 addr = virt_to_phys(msr_bitmap) & (~((1ull << 12) - 1));
2422abe82380SKrish Sadhukhan 
2423abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT,
2424abe82380SKrish Sadhukhan 			addr_beyond_limit - 2 * PAGE_SIZE, SVM_EXIT_ERR,
2425abe82380SKrish Sadhukhan 			"MSRPM");
2426abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT,
2427abe82380SKrish Sadhukhan 			addr_beyond_limit - 2 * PAGE_SIZE + 1, SVM_EXIT_ERR,
2428abe82380SKrish Sadhukhan 			"MSRPM");
2429abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT,
2430abe82380SKrish Sadhukhan 			addr_beyond_limit - PAGE_SIZE, SVM_EXIT_ERR,
2431abe82380SKrish Sadhukhan 			"MSRPM");
2432abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, addr,
2433abe82380SKrish Sadhukhan 			SVM_EXIT_VMMCALL, "MSRPM");
2434abe82380SKrish Sadhukhan 	addr |= (1ull << 12) - 1;
2435abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, addr,
2436abe82380SKrish Sadhukhan 			SVM_EXIT_VMMCALL, "MSRPM");
2437abe82380SKrish Sadhukhan 
2438abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2439abe82380SKrish Sadhukhan 			addr_beyond_limit - 4 * PAGE_SIZE, SVM_EXIT_VMMCALL,
2440abe82380SKrish Sadhukhan 			"IOPM");
2441abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2442abe82380SKrish Sadhukhan 			addr_beyond_limit - 3 * PAGE_SIZE, SVM_EXIT_VMMCALL,
2443abe82380SKrish Sadhukhan 			"IOPM");
2444abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2445abe82380SKrish Sadhukhan 			addr_beyond_limit - 2 * PAGE_SIZE - 2, SVM_EXIT_VMMCALL,
2446abe82380SKrish Sadhukhan 			"IOPM");
2447abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2448abe82380SKrish Sadhukhan 			addr_beyond_limit - 2 * PAGE_SIZE, SVM_EXIT_ERR,
2449abe82380SKrish Sadhukhan 			"IOPM");
2450abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2451abe82380SKrish Sadhukhan 			addr_beyond_limit - PAGE_SIZE, SVM_EXIT_ERR,
2452abe82380SKrish Sadhukhan 			"IOPM");
2453abe82380SKrish Sadhukhan 	addr = virt_to_phys(io_bitmap) & (~((1ull << 11) - 1));
2454abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, addr,
2455abe82380SKrish Sadhukhan 			SVM_EXIT_VMMCALL, "IOPM");
2456abe82380SKrish Sadhukhan 	addr |= (1ull << 12) - 1;
2457abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, addr,
2458abe82380SKrish Sadhukhan 			SVM_EXIT_VMMCALL, "IOPM");
2459abe82380SKrish Sadhukhan 
2460abe82380SKrish Sadhukhan 	vmcb->control.intercept = saved_intercept;
2461abe82380SKrish Sadhukhan }
2462abe82380SKrish Sadhukhan 
2463a99070ebSKrish Sadhukhan #define TEST_CANONICAL(seg_base, msg)					\
2464a99070ebSKrish Sadhukhan 	saved_addr = seg_base;						\
2465a99070ebSKrish Sadhukhan 	seg_base = (seg_base & ((1ul << addr_limit) - 1)) | noncanonical_mask; \
2466a99070ebSKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test %s.base for canonical form: %lx", msg, seg_base);							\
2467a99070ebSKrish Sadhukhan 	seg_base = saved_addr;
2468a99070ebSKrish Sadhukhan 
2469a99070ebSKrish Sadhukhan /*
2470a99070ebSKrish Sadhukhan  * VMRUN canonicalizes (i.e., sign-extend to bit 63) all base addresses
2471a99070ebSKrish Sadhukhan  • in the segment registers that have been loaded.
2472a99070ebSKrish Sadhukhan  */
2473a99070ebSKrish Sadhukhan static void test_vmrun_canonicalization(void)
2474a99070ebSKrish Sadhukhan {
2475a99070ebSKrish Sadhukhan 	u64 saved_addr;
2476a99070ebSKrish Sadhukhan 	u8 addr_limit = cpuid_maxphyaddr();
2477a99070ebSKrish Sadhukhan 	u64 noncanonical_mask = NONCANONICAL & ~((1ul << addr_limit) - 1);
2478a99070ebSKrish Sadhukhan 
2479a99070ebSKrish Sadhukhan 	TEST_CANONICAL(vmcb->save.es.base, "ES");
2480a99070ebSKrish Sadhukhan 	TEST_CANONICAL(vmcb->save.cs.base, "CS");
2481a99070ebSKrish Sadhukhan 	TEST_CANONICAL(vmcb->save.ss.base, "SS");
2482a99070ebSKrish Sadhukhan 	TEST_CANONICAL(vmcb->save.ds.base, "DS");
2483a99070ebSKrish Sadhukhan 	TEST_CANONICAL(vmcb->save.fs.base, "FS");
2484a99070ebSKrish Sadhukhan 	TEST_CANONICAL(vmcb->save.gs.base, "GS");
2485a99070ebSKrish Sadhukhan 	TEST_CANONICAL(vmcb->save.gdtr.base, "GDTR");
2486a99070ebSKrish Sadhukhan 	TEST_CANONICAL(vmcb->save.ldtr.base, "LDTR");
2487a99070ebSKrish Sadhukhan 	TEST_CANONICAL(vmcb->save.idtr.base, "IDTR");
2488a99070ebSKrish Sadhukhan 	TEST_CANONICAL(vmcb->save.tr.base, "TR");
2489a99070ebSKrish Sadhukhan }
2490a99070ebSKrish Sadhukhan 
2491*665f5677SKrish Sadhukhan /*
2492*665f5677SKrish Sadhukhan  * When VMRUN loads a guest value of 1 in EFLAGS.TF, that value does not
2493*665f5677SKrish Sadhukhan  * cause a trace trap between the VMRUN and the first guest instruction, but
2494*665f5677SKrish Sadhukhan  * rather after completion of the first guest instruction.
2495*665f5677SKrish Sadhukhan  *
2496*665f5677SKrish Sadhukhan  * [APM vol 2]
2497*665f5677SKrish Sadhukhan  */
2498*665f5677SKrish Sadhukhan u64 guest_rflags_test_trap_rip;
2499*665f5677SKrish Sadhukhan 
2500*665f5677SKrish Sadhukhan static void guest_rflags_test_db_handler(struct ex_regs *r)
2501*665f5677SKrish Sadhukhan {
2502*665f5677SKrish Sadhukhan 	guest_rflags_test_trap_rip = r->rip;
2503*665f5677SKrish Sadhukhan 	r->rflags &= ~X86_EFLAGS_TF;
2504*665f5677SKrish Sadhukhan }
2505*665f5677SKrish Sadhukhan 
2506a79c9495SKrish Sadhukhan static void svm_guest_state_test(void)
2507a79c9495SKrish Sadhukhan {
2508a79c9495SKrish Sadhukhan 	test_set_guest(basic_guest_main);
2509a79c9495SKrish Sadhukhan 	test_efer();
2510a79c9495SKrish Sadhukhan 	test_cr0();
2511a79c9495SKrish Sadhukhan 	test_cr3();
2512a79c9495SKrish Sadhukhan 	test_cr4();
2513a79c9495SKrish Sadhukhan 	test_dr();
2514abe82380SKrish Sadhukhan 	test_msrpm_iopm_bitmap_addrs();
2515a99070ebSKrish Sadhukhan 	test_vmrun_canonicalization();
2516ba29942cSKrish Sadhukhan }
2517ba29942cSKrish Sadhukhan 
2518*665f5677SKrish Sadhukhan extern void guest_rflags_test_guest(struct svm_test *test);
2519*665f5677SKrish Sadhukhan extern u64 *insn2;
2520*665f5677SKrish Sadhukhan extern u64 *guest_end;
2521*665f5677SKrish Sadhukhan 
2522*665f5677SKrish Sadhukhan asm("guest_rflags_test_guest:\n\t"
2523*665f5677SKrish Sadhukhan     "push %rbp\n\t"
2524*665f5677SKrish Sadhukhan     ".global insn2\n\t"
2525*665f5677SKrish Sadhukhan     "insn2:\n\t"
2526*665f5677SKrish Sadhukhan     "mov %rsp,%rbp\n\t"
2527*665f5677SKrish Sadhukhan     "vmmcall\n\t"
2528*665f5677SKrish Sadhukhan     "vmmcall\n\t"
2529*665f5677SKrish Sadhukhan     ".global guest_end\n\t"
2530*665f5677SKrish Sadhukhan     "guest_end:\n\t"
2531*665f5677SKrish Sadhukhan     "vmmcall\n\t"
2532*665f5677SKrish Sadhukhan     "pop %rbp\n\t"
2533*665f5677SKrish Sadhukhan     "ret");
2534*665f5677SKrish Sadhukhan 
2535*665f5677SKrish Sadhukhan static void svm_test_singlestep(void)
2536*665f5677SKrish Sadhukhan {
2537*665f5677SKrish Sadhukhan 	handle_exception(DB_VECTOR, guest_rflags_test_db_handler);
2538*665f5677SKrish Sadhukhan 
2539*665f5677SKrish Sadhukhan 	/*
2540*665f5677SKrish Sadhukhan 	 * Trap expected after completion of first guest instruction
2541*665f5677SKrish Sadhukhan 	 */
2542*665f5677SKrish Sadhukhan 	vmcb->save.rflags |= X86_EFLAGS_TF;
2543*665f5677SKrish Sadhukhan 	report (__svm_vmrun((u64)guest_rflags_test_guest) == SVM_EXIT_VMMCALL &&
2544*665f5677SKrish Sadhukhan 		guest_rflags_test_trap_rip == (u64)&insn2,
2545*665f5677SKrish Sadhukhan                "Test EFLAGS.TF on VMRUN: trap expected  after completion of first guest instruction");
2546*665f5677SKrish Sadhukhan 	/*
2547*665f5677SKrish Sadhukhan 	 * No trap expected
2548*665f5677SKrish Sadhukhan 	 */
2549*665f5677SKrish Sadhukhan 	guest_rflags_test_trap_rip = 0;
2550*665f5677SKrish Sadhukhan 	vmcb->save.rip += 3;
2551*665f5677SKrish Sadhukhan 	vmcb->save.rflags |= X86_EFLAGS_TF;
2552*665f5677SKrish Sadhukhan 	report (__svm_vmrun(vmcb->save.rip) == SVM_EXIT_VMMCALL &&
2553*665f5677SKrish Sadhukhan 		guest_rflags_test_trap_rip == 0, "Test EFLAGS.TF on VMRUN: trap not expected");
2554*665f5677SKrish Sadhukhan 
2555*665f5677SKrish Sadhukhan 	/*
2556*665f5677SKrish Sadhukhan 	 * Let guest finish execution
2557*665f5677SKrish Sadhukhan 	 */
2558*665f5677SKrish Sadhukhan 	vmcb->save.rip += 3;
2559*665f5677SKrish Sadhukhan 	report (__svm_vmrun(vmcb->save.rip) == SVM_EXIT_VMMCALL &&
2560*665f5677SKrish Sadhukhan 		vmcb->save.rip == (u64)&guest_end, "Test EFLAGS.TF on VMRUN: guest execution completion");
2561*665f5677SKrish Sadhukhan }
2562*665f5677SKrish Sadhukhan 
2563916635a8SSean Christopherson static void __svm_npt_rsvd_bits_test(u64 *pxe, u64 rsvd_bits, u64 efer,
2564916635a8SSean Christopherson 				     ulong cr4, u64 guest_efer, ulong guest_cr4)
2565916635a8SSean Christopherson {
2566916635a8SSean Christopherson 	u64 pxe_orig = *pxe;
2567916635a8SSean Christopherson 	int exit_reason;
2568916635a8SSean Christopherson 	u64 pfec;
2569916635a8SSean Christopherson 
2570916635a8SSean Christopherson 	wrmsr(MSR_EFER, efer);
2571916635a8SSean Christopherson 	write_cr4(cr4);
2572916635a8SSean Christopherson 
2573916635a8SSean Christopherson 	vmcb->save.efer = guest_efer;
2574916635a8SSean Christopherson 	vmcb->save.cr4  = guest_cr4;
2575916635a8SSean Christopherson 
2576916635a8SSean Christopherson 	*pxe |= rsvd_bits;
2577916635a8SSean Christopherson 
2578916635a8SSean Christopherson 	exit_reason = svm_vmrun();
2579916635a8SSean Christopherson 
2580916635a8SSean Christopherson 	report(exit_reason == SVM_EXIT_NPF,
2581916635a8SSean Christopherson 	       "Wanted #NPF on rsvd bits = 0x%lx, got exit = 0x%x", rsvd_bits, exit_reason);
2582916635a8SSean Christopherson 
2583916635a8SSean Christopherson 	if (pxe == npt_get_pdpe() || pxe == npt_get_pml4e()) {
2584916635a8SSean Christopherson 		/*
2585916635a8SSean Christopherson 		 * The guest's page tables will blow up on a bad PDPE/PML4E,
2586916635a8SSean Christopherson 		 * before starting the final walk of the guest page.
2587916635a8SSean Christopherson 		 */
2588916635a8SSean Christopherson 		pfec = 0x20000000full;
2589916635a8SSean Christopherson 	} else {
2590916635a8SSean Christopherson 		/* RSVD #NPF on final walk of guest page. */
2591916635a8SSean Christopherson 		pfec = 0x10000000dULL;
2592916635a8SSean Christopherson 
2593916635a8SSean Christopherson 		/* PFEC.FETCH=1 if NX=1 *or* SMEP=1. */
2594916635a8SSean Christopherson 		if ((cr4 & X86_CR4_SMEP) || (efer & EFER_NX))
2595916635a8SSean Christopherson 			pfec |= 0x10;
2596916635a8SSean Christopherson 
2597916635a8SSean Christopherson 	}
2598916635a8SSean Christopherson 
2599916635a8SSean Christopherson 	report(vmcb->control.exit_info_1 == pfec,
2600916635a8SSean Christopherson 	       "Wanted PFEC = 0x%lx, got PFEC = %lx, PxE = 0x%lx.  "
2601916635a8SSean Christopherson 	       "host.NX = %u, host.SMEP = %u, guest.NX = %u, guest.SMEP = %u",
2602916635a8SSean Christopherson 	       pfec, vmcb->control.exit_info_1, *pxe,
2603916635a8SSean Christopherson 	       !!(efer & EFER_NX), !!(cr4 & X86_CR4_SMEP),
2604916635a8SSean Christopherson 	       !!(guest_efer & EFER_NX), !!(guest_cr4 & X86_CR4_SMEP));
2605916635a8SSean Christopherson 
2606916635a8SSean Christopherson 	*pxe = pxe_orig;
2607916635a8SSean Christopherson }
2608916635a8SSean Christopherson 
2609916635a8SSean Christopherson static void _svm_npt_rsvd_bits_test(u64 *pxe, u64 pxe_rsvd_bits,  u64 efer,
2610916635a8SSean Christopherson 				    ulong cr4, u64 guest_efer, ulong guest_cr4)
2611916635a8SSean Christopherson {
2612916635a8SSean Christopherson 	u64 rsvd_bits;
2613916635a8SSean Christopherson 	int i;
2614916635a8SSean Christopherson 
2615916635a8SSean Christopherson 	/*
2616916635a8SSean Christopherson 	 * Test all combinations of guest/host EFER.NX and CR4.SMEP.  If host
2617916635a8SSean Christopherson 	 * EFER.NX=0, use NX as the reserved bit, otherwise use the passed in
2618916635a8SSean Christopherson 	 * @pxe_rsvd_bits.
2619916635a8SSean Christopherson 	 */
2620916635a8SSean Christopherson 	for (i = 0; i < 16; i++) {
2621916635a8SSean Christopherson 		if (i & 1) {
2622916635a8SSean Christopherson 			rsvd_bits = pxe_rsvd_bits;
2623916635a8SSean Christopherson 			efer |= EFER_NX;
2624916635a8SSean Christopherson 		} else {
2625916635a8SSean Christopherson 			rsvd_bits = PT64_NX_MASK;
2626916635a8SSean Christopherson 			efer &= ~EFER_NX;
2627916635a8SSean Christopherson 		}
2628916635a8SSean Christopherson 		if (i & 2)
2629916635a8SSean Christopherson 			cr4 |= X86_CR4_SMEP;
2630916635a8SSean Christopherson 		else
2631916635a8SSean Christopherson 			cr4 &= ~X86_CR4_SMEP;
2632916635a8SSean Christopherson 		if (i & 4)
2633916635a8SSean Christopherson 			guest_efer |= EFER_NX;
2634916635a8SSean Christopherson 		else
2635916635a8SSean Christopherson 			guest_efer &= ~EFER_NX;
2636916635a8SSean Christopherson 		if (i & 8)
2637916635a8SSean Christopherson 			guest_cr4 |= X86_CR4_SMEP;
2638916635a8SSean Christopherson 		else
2639916635a8SSean Christopherson 			guest_cr4 &= ~X86_CR4_SMEP;
2640916635a8SSean Christopherson 
2641916635a8SSean Christopherson 		__svm_npt_rsvd_bits_test(pxe, rsvd_bits, efer, cr4,
2642916635a8SSean Christopherson 					 guest_efer, guest_cr4);
2643916635a8SSean Christopherson 	}
2644916635a8SSean Christopherson }
2645916635a8SSean Christopherson 
2646916635a8SSean Christopherson static u64 get_random_bits(u64 hi, u64 low)
2647916635a8SSean Christopherson {
2648916635a8SSean Christopherson 	u64 rsvd_bits;
2649916635a8SSean Christopherson 
2650916635a8SSean Christopherson 	do {
2651916635a8SSean Christopherson 		rsvd_bits = (rdtsc() << low) & GENMASK_ULL(hi, low);
2652916635a8SSean Christopherson 	} while (!rsvd_bits);
2653916635a8SSean Christopherson 
2654916635a8SSean Christopherson 	return rsvd_bits;
2655916635a8SSean Christopherson }
2656916635a8SSean Christopherson 
2657916635a8SSean Christopherson 
2658916635a8SSean Christopherson static void svm_npt_rsvd_bits_test(void)
2659916635a8SSean Christopherson {
2660916635a8SSean Christopherson 	u64   saved_efer, host_efer, sg_efer, guest_efer;
2661916635a8SSean Christopherson 	ulong saved_cr4,  host_cr4,  sg_cr4,  guest_cr4;
2662916635a8SSean Christopherson 
2663916635a8SSean Christopherson 	if (!npt_supported()) {
2664916635a8SSean Christopherson 		report_skip("NPT not supported");
2665916635a8SSean Christopherson 		return;
2666916635a8SSean Christopherson 	}
2667916635a8SSean Christopherson 
2668916635a8SSean Christopherson 	saved_efer = host_efer  = rdmsr(MSR_EFER);
2669916635a8SSean Christopherson 	saved_cr4  = host_cr4   = read_cr4();
2670916635a8SSean Christopherson 	sg_efer    = guest_efer = vmcb->save.efer;
2671916635a8SSean Christopherson 	sg_cr4     = guest_cr4  = vmcb->save.cr4;
2672916635a8SSean Christopherson 
2673916635a8SSean Christopherson 	test_set_guest(basic_guest_main);
2674916635a8SSean Christopherson 
2675916635a8SSean Christopherson 	/*
2676916635a8SSean Christopherson 	 * 4k PTEs don't have reserved bits if MAXPHYADDR >= 52, just skip the
2677916635a8SSean Christopherson 	 * sub-test.  The NX test is still valid, but the extra bit of coverage
2678916635a8SSean Christopherson 	 * isn't worth the extra complexity.
2679916635a8SSean Christopherson 	 */
2680916635a8SSean Christopherson 	if (cpuid_maxphyaddr() >= 52)
2681916635a8SSean Christopherson 		goto skip_pte_test;
2682916635a8SSean Christopherson 
2683916635a8SSean Christopherson 	_svm_npt_rsvd_bits_test(npt_get_pte((u64)basic_guest_main),
2684916635a8SSean Christopherson 				get_random_bits(51, cpuid_maxphyaddr()),
2685916635a8SSean Christopherson 				host_efer, host_cr4, guest_efer, guest_cr4);
2686916635a8SSean Christopherson 
2687916635a8SSean Christopherson skip_pte_test:
2688916635a8SSean Christopherson 	_svm_npt_rsvd_bits_test(npt_get_pde((u64)basic_guest_main),
2689916635a8SSean Christopherson 				get_random_bits(20, 13) | PT_PAGE_SIZE_MASK,
2690916635a8SSean Christopherson 				host_efer, host_cr4, guest_efer, guest_cr4);
2691916635a8SSean Christopherson 
2692916635a8SSean Christopherson 	_svm_npt_rsvd_bits_test(npt_get_pdpe(),
2693916635a8SSean Christopherson 				PT_PAGE_SIZE_MASK |
2694916635a8SSean Christopherson 					(this_cpu_has(X86_FEATURE_GBPAGES) ? get_random_bits(29, 13) : 0),
2695916635a8SSean Christopherson 				host_efer, host_cr4, guest_efer, guest_cr4);
2696916635a8SSean Christopherson 
2697916635a8SSean Christopherson 	_svm_npt_rsvd_bits_test(npt_get_pml4e(), BIT_ULL(8),
2698916635a8SSean Christopherson 				host_efer, host_cr4, guest_efer, guest_cr4);
2699916635a8SSean Christopherson 
2700916635a8SSean Christopherson 	wrmsr(MSR_EFER, saved_efer);
2701916635a8SSean Christopherson 	write_cr4(saved_cr4);
2702916635a8SSean Christopherson 	vmcb->save.efer = sg_efer;
2703916635a8SSean Christopherson 	vmcb->save.cr4  = sg_cr4;
2704916635a8SSean Christopherson }
27057a57ef5dSMaxim Levitsky 
27067a57ef5dSMaxim Levitsky static bool volatile svm_errata_reproduced = false;
27077a57ef5dSMaxim Levitsky static unsigned long volatile physical = 0;
27087a57ef5dSMaxim Levitsky 
27097a57ef5dSMaxim Levitsky 
27107a57ef5dSMaxim Levitsky /*
27117a57ef5dSMaxim Levitsky  *
27127a57ef5dSMaxim Levitsky  * Test the following errata:
27137a57ef5dSMaxim Levitsky  * If the VMRUN/VMSAVE/VMLOAD are attempted by the nested guest,
27147a57ef5dSMaxim Levitsky  * the CPU would first check the EAX against host reserved memory
27157a57ef5dSMaxim Levitsky  * regions (so far only SMM_ADDR/SMM_MASK are known to cause it),
27167a57ef5dSMaxim Levitsky  * and only then signal #VMexit
27177a57ef5dSMaxim Levitsky  *
27187a57ef5dSMaxim Levitsky  * Try to reproduce this by trying vmsave on each possible 4K aligned memory
27197a57ef5dSMaxim Levitsky  * address in the low 4G where the SMM area has to reside.
27207a57ef5dSMaxim Levitsky  */
27217a57ef5dSMaxim Levitsky 
27227a57ef5dSMaxim Levitsky static void gp_isr(struct ex_regs *r)
27237a57ef5dSMaxim Levitsky {
27247a57ef5dSMaxim Levitsky     svm_errata_reproduced = true;
27257a57ef5dSMaxim Levitsky     /* skip over the vmsave instruction*/
27267a57ef5dSMaxim Levitsky     r->rip += 3;
27277a57ef5dSMaxim Levitsky }
27287a57ef5dSMaxim Levitsky 
27297a57ef5dSMaxim Levitsky static void svm_vmrun_errata_test(void)
27307a57ef5dSMaxim Levitsky {
27317a57ef5dSMaxim Levitsky     unsigned long *last_page = NULL;
27327a57ef5dSMaxim Levitsky 
27337a57ef5dSMaxim Levitsky     handle_exception(GP_VECTOR, gp_isr);
27347a57ef5dSMaxim Levitsky 
27357a57ef5dSMaxim Levitsky     while (!svm_errata_reproduced) {
27367a57ef5dSMaxim Levitsky 
27377a57ef5dSMaxim Levitsky         unsigned long *page = alloc_pages(1);
27387a57ef5dSMaxim Levitsky 
27397a57ef5dSMaxim Levitsky         if (!page) {
27407a57ef5dSMaxim Levitsky             report(true, "All guest memory tested, no bug found");;
27417a57ef5dSMaxim Levitsky             break;
27427a57ef5dSMaxim Levitsky         }
27437a57ef5dSMaxim Levitsky 
27447a57ef5dSMaxim Levitsky         physical = virt_to_phys(page);
27457a57ef5dSMaxim Levitsky 
27467a57ef5dSMaxim Levitsky         asm volatile (
27477a57ef5dSMaxim Levitsky             "mov %[_physical], %%rax\n\t"
27487a57ef5dSMaxim Levitsky             "vmsave %%rax\n\t"
27497a57ef5dSMaxim Levitsky 
27507a57ef5dSMaxim Levitsky             : [_physical] "=m" (physical)
27517a57ef5dSMaxim Levitsky             : /* no inputs*/
27527a57ef5dSMaxim Levitsky             : "rax" /*clobbers*/
27537a57ef5dSMaxim Levitsky         );
27547a57ef5dSMaxim Levitsky 
27557a57ef5dSMaxim Levitsky         if (svm_errata_reproduced) {
27567a57ef5dSMaxim Levitsky             report(false, "Got #GP exception - svm errata reproduced at 0x%lx",
27577a57ef5dSMaxim Levitsky                    physical);
27587a57ef5dSMaxim Levitsky             break;
27597a57ef5dSMaxim Levitsky         }
27607a57ef5dSMaxim Levitsky 
27617a57ef5dSMaxim Levitsky         *page = (unsigned long)last_page;
27627a57ef5dSMaxim Levitsky         last_page = page;
27637a57ef5dSMaxim Levitsky     }
27647a57ef5dSMaxim Levitsky 
27657a57ef5dSMaxim Levitsky     while (last_page) {
27667a57ef5dSMaxim Levitsky         unsigned long *page = last_page;
27677a57ef5dSMaxim Levitsky         last_page = (unsigned long *)*last_page;
27687a57ef5dSMaxim Levitsky         free_pages_by_order(page, 1);
27697a57ef5dSMaxim Levitsky     }
27707a57ef5dSMaxim Levitsky }
27717a57ef5dSMaxim Levitsky 
27720b6f6cedSKrish Sadhukhan static void vmload_vmsave_guest_main(struct svm_test *test)
27730b6f6cedSKrish Sadhukhan {
27740b6f6cedSKrish Sadhukhan 	u64 vmcb_phys = virt_to_phys(vmcb);
27750b6f6cedSKrish Sadhukhan 
27760b6f6cedSKrish Sadhukhan 	asm volatile ("vmload %0" : : "a"(vmcb_phys));
27770b6f6cedSKrish Sadhukhan 	asm volatile ("vmsave %0" : : "a"(vmcb_phys));
27780b6f6cedSKrish Sadhukhan }
27790b6f6cedSKrish Sadhukhan 
27800b6f6cedSKrish Sadhukhan static void svm_vmload_vmsave(void)
27810b6f6cedSKrish Sadhukhan {
27820b6f6cedSKrish Sadhukhan 	u32 intercept_saved = vmcb->control.intercept;
27830b6f6cedSKrish Sadhukhan 
27840b6f6cedSKrish Sadhukhan 	test_set_guest(vmload_vmsave_guest_main);
27850b6f6cedSKrish Sadhukhan 
27860b6f6cedSKrish Sadhukhan 	/*
27870b6f6cedSKrish Sadhukhan 	 * Disabling intercept for VMLOAD and VMSAVE doesn't cause
27880b6f6cedSKrish Sadhukhan 	 * respective #VMEXIT to host
27890b6f6cedSKrish Sadhukhan 	 */
27900b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD);
27910b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE);
27920b6f6cedSKrish Sadhukhan 	svm_vmrun();
27930b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test "
27940b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT");
27950b6f6cedSKrish Sadhukhan 
27960b6f6cedSKrish Sadhukhan 	/*
27970b6f6cedSKrish Sadhukhan 	 * Enabling intercept for VMLOAD and VMSAVE causes respective
27980b6f6cedSKrish Sadhukhan 	 * #VMEXIT to host
27990b6f6cedSKrish Sadhukhan 	 */
28000b6f6cedSKrish Sadhukhan 	vmcb->control.intercept |= (1ULL << INTERCEPT_VMLOAD);
28010b6f6cedSKrish Sadhukhan 	svm_vmrun();
28020b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMLOAD, "Test "
28030b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMLOAD #VMEXIT");
28040b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD);
28050b6f6cedSKrish Sadhukhan 	vmcb->control.intercept |= (1ULL << INTERCEPT_VMSAVE);
28060b6f6cedSKrish Sadhukhan 	svm_vmrun();
28070b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMSAVE, "Test "
28080b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMSAVE #VMEXIT");
28090b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE);
28100b6f6cedSKrish Sadhukhan 	svm_vmrun();
28110b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test "
28120b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT");
28130b6f6cedSKrish Sadhukhan 
28140b6f6cedSKrish Sadhukhan 	vmcb->control.intercept |= (1ULL << INTERCEPT_VMLOAD);
28150b6f6cedSKrish Sadhukhan 	svm_vmrun();
28160b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMLOAD, "Test "
28170b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMLOAD #VMEXIT");
28180b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD);
28190b6f6cedSKrish Sadhukhan 	svm_vmrun();
28200b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test "
28210b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT");
28220b6f6cedSKrish Sadhukhan 
28230b6f6cedSKrish Sadhukhan 	vmcb->control.intercept |= (1ULL << INTERCEPT_VMSAVE);
28240b6f6cedSKrish Sadhukhan 	svm_vmrun();
28250b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMSAVE, "Test "
28260b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMSAVE #VMEXIT");
28270b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE);
28280b6f6cedSKrish Sadhukhan 	svm_vmrun();
28290b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test "
28300b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT");
28310b6f6cedSKrish Sadhukhan 
28320b6f6cedSKrish Sadhukhan 	vmcb->control.intercept = intercept_saved;
28330b6f6cedSKrish Sadhukhan }
28340b6f6cedSKrish Sadhukhan 
2835f6972bd6SLara Lazier static void prepare_vgif_enabled(struct svm_test *test)
2836f6972bd6SLara Lazier {
2837f6972bd6SLara Lazier     default_prepare(test);
2838f6972bd6SLara Lazier }
2839f6972bd6SLara Lazier 
2840f6972bd6SLara Lazier static void test_vgif(struct svm_test *test)
2841f6972bd6SLara Lazier {
2842f6972bd6SLara Lazier     asm volatile ("vmmcall\n\tstgi\n\tvmmcall\n\tclgi\n\tvmmcall\n\t");
2843f6972bd6SLara Lazier 
2844f6972bd6SLara Lazier }
2845f6972bd6SLara Lazier 
2846f6972bd6SLara Lazier static bool vgif_finished(struct svm_test *test)
2847f6972bd6SLara Lazier {
2848f6972bd6SLara Lazier     switch (get_test_stage(test))
2849f6972bd6SLara Lazier     {
2850f6972bd6SLara Lazier     case 0:
2851f6972bd6SLara Lazier         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
2852f6972bd6SLara Lazier             report(false, "VMEXIT not due to vmmcall.");
2853f6972bd6SLara Lazier             return true;
2854f6972bd6SLara Lazier         }
2855f6972bd6SLara Lazier         vmcb->control.int_ctl |= V_GIF_ENABLED_MASK;
2856f6972bd6SLara Lazier         vmcb->save.rip += 3;
2857f6972bd6SLara Lazier         inc_test_stage(test);
2858f6972bd6SLara Lazier         break;
2859f6972bd6SLara Lazier     case 1:
2860f6972bd6SLara Lazier         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
2861f6972bd6SLara Lazier             report(false, "VMEXIT not due to vmmcall.");
2862f6972bd6SLara Lazier             return true;
2863f6972bd6SLara Lazier         }
2864f6972bd6SLara Lazier         if (!(vmcb->control.int_ctl & V_GIF_MASK)) {
2865f6972bd6SLara Lazier             report(false, "Failed to set VGIF when executing STGI.");
2866f6972bd6SLara Lazier             vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK;
2867f6972bd6SLara Lazier             return true;
2868f6972bd6SLara Lazier         }
2869f6972bd6SLara Lazier         report(true, "STGI set VGIF bit.");
2870f6972bd6SLara Lazier         vmcb->save.rip += 3;
2871f6972bd6SLara Lazier         inc_test_stage(test);
2872f6972bd6SLara Lazier         break;
2873f6972bd6SLara Lazier     case 2:
2874f6972bd6SLara Lazier         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
2875f6972bd6SLara Lazier             report(false, "VMEXIT not due to vmmcall.");
2876f6972bd6SLara Lazier             return true;
2877f6972bd6SLara Lazier         }
2878f6972bd6SLara Lazier         if (vmcb->control.int_ctl & V_GIF_MASK) {
2879f6972bd6SLara Lazier             report(false, "Failed to clear VGIF when executing CLGI.");
2880f6972bd6SLara Lazier             vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK;
2881f6972bd6SLara Lazier             return true;
2882f6972bd6SLara Lazier         }
2883f6972bd6SLara Lazier         report(true, "CLGI cleared VGIF bit.");
2884f6972bd6SLara Lazier         vmcb->save.rip += 3;
2885f6972bd6SLara Lazier         inc_test_stage(test);
2886f6972bd6SLara Lazier         vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK;
2887f6972bd6SLara Lazier         break;
2888f6972bd6SLara Lazier     default:
2889f6972bd6SLara Lazier         return true;
2890f6972bd6SLara Lazier         break;
2891f6972bd6SLara Lazier     }
2892f6972bd6SLara Lazier 
2893f6972bd6SLara Lazier     return get_test_stage(test) == 3;
2894f6972bd6SLara Lazier }
2895f6972bd6SLara Lazier 
2896f6972bd6SLara Lazier static bool vgif_check(struct svm_test *test)
2897f6972bd6SLara Lazier {
2898f6972bd6SLara Lazier     return get_test_stage(test) == 3;
2899f6972bd6SLara Lazier }
2900f6972bd6SLara Lazier 
2901f6972bd6SLara Lazier 
2902ad879127SKrish Sadhukhan struct svm_test svm_tests[] = {
2903ad879127SKrish Sadhukhan     { "null", default_supported, default_prepare,
2904ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test,
2905ad879127SKrish Sadhukhan       default_finished, null_check },
2906ad879127SKrish Sadhukhan     { "vmrun", default_supported, default_prepare,
2907ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_vmrun,
2908ad879127SKrish Sadhukhan        default_finished, check_vmrun },
2909ad879127SKrish Sadhukhan     { "ioio", default_supported, prepare_ioio,
2910ad879127SKrish Sadhukhan        default_prepare_gif_clear, test_ioio,
2911ad879127SKrish Sadhukhan        ioio_finished, check_ioio },
2912ad879127SKrish Sadhukhan     { "vmrun intercept check", default_supported, prepare_no_vmrun_int,
2913ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test, default_finished,
2914ad879127SKrish Sadhukhan       check_no_vmrun_int },
2915401299a5SPaolo Bonzini     { "rsm", default_supported,
2916401299a5SPaolo Bonzini       prepare_rsm_intercept, default_prepare_gif_clear,
2917401299a5SPaolo Bonzini       test_rsm_intercept, finished_rsm_intercept, check_rsm_intercept },
2918ad879127SKrish Sadhukhan     { "cr3 read intercept", default_supported,
2919ad879127SKrish Sadhukhan       prepare_cr3_intercept, default_prepare_gif_clear,
2920ad879127SKrish Sadhukhan       test_cr3_intercept, default_finished, check_cr3_intercept },
2921ad879127SKrish Sadhukhan     { "cr3 read nointercept", default_supported, default_prepare,
2922ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_cr3_intercept, default_finished,
2923ad879127SKrish Sadhukhan       check_cr3_nointercept },
2924ad879127SKrish Sadhukhan     { "cr3 read intercept emulate", smp_supported,
2925ad879127SKrish Sadhukhan       prepare_cr3_intercept_bypass, default_prepare_gif_clear,
2926ad879127SKrish Sadhukhan       test_cr3_intercept_bypass, default_finished, check_cr3_intercept },
2927ad879127SKrish Sadhukhan     { "dr intercept check", default_supported, prepare_dr_intercept,
2928ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_dr_intercept, dr_intercept_finished,
2929ad879127SKrish Sadhukhan       check_dr_intercept },
2930ad879127SKrish Sadhukhan     { "next_rip", next_rip_supported, prepare_next_rip,
2931ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_next_rip,
2932ad879127SKrish Sadhukhan       default_finished, check_next_rip },
2933ad879127SKrish Sadhukhan     { "msr intercept check", default_supported, prepare_msr_intercept,
2934ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_msr_intercept,
2935ad879127SKrish Sadhukhan       msr_intercept_finished, check_msr_intercept },
2936ad879127SKrish Sadhukhan     { "mode_switch", default_supported, prepare_mode_switch,
2937ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_mode_switch,
2938ad879127SKrish Sadhukhan        mode_switch_finished, check_mode_switch },
2939ad879127SKrish Sadhukhan     { "asid_zero", default_supported, prepare_asid_zero,
2940ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_asid_zero,
2941ad879127SKrish Sadhukhan        default_finished, check_asid_zero },
2942ad879127SKrish Sadhukhan     { "sel_cr0_bug", default_supported, sel_cr0_bug_prepare,
2943ad879127SKrish Sadhukhan       default_prepare_gif_clear, sel_cr0_bug_test,
2944ad879127SKrish Sadhukhan        sel_cr0_bug_finished, sel_cr0_bug_check },
2945ad879127SKrish Sadhukhan     { "npt_nx", npt_supported, npt_nx_prepare,
2946ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test,
2947ad879127SKrish Sadhukhan       default_finished, npt_nx_check },
29486faca2a5SKrish Sadhukhan     { "npt_np", npt_supported, npt_np_prepare,
29496faca2a5SKrish Sadhukhan       default_prepare_gif_clear, npt_np_test,
29506faca2a5SKrish Sadhukhan       default_finished, npt_np_check },
2951ad879127SKrish Sadhukhan     { "npt_us", npt_supported, npt_us_prepare,
2952ad879127SKrish Sadhukhan       default_prepare_gif_clear, npt_us_test,
2953ad879127SKrish Sadhukhan       default_finished, npt_us_check },
2954ad879127SKrish Sadhukhan     { "npt_rw", npt_supported, npt_rw_prepare,
2955ad879127SKrish Sadhukhan       default_prepare_gif_clear, npt_rw_test,
2956ad879127SKrish Sadhukhan       default_finished, npt_rw_check },
2957ad879127SKrish Sadhukhan     { "npt_rw_pfwalk", npt_supported, npt_rw_pfwalk_prepare,
2958ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test,
2959ad879127SKrish Sadhukhan       default_finished, npt_rw_pfwalk_check },
2960ad879127SKrish Sadhukhan     { "npt_l1mmio", npt_supported, npt_l1mmio_prepare,
2961ad879127SKrish Sadhukhan       default_prepare_gif_clear, npt_l1mmio_test,
2962ad879127SKrish Sadhukhan       default_finished, npt_l1mmio_check },
2963ad879127SKrish Sadhukhan     { "npt_rw_l1mmio", npt_supported, npt_rw_l1mmio_prepare,
2964ad879127SKrish Sadhukhan       default_prepare_gif_clear, npt_rw_l1mmio_test,
2965ad879127SKrish Sadhukhan       default_finished, npt_rw_l1mmio_check },
296610a65fc4SNadav Amit     { "tsc_adjust", tsc_adjust_supported, tsc_adjust_prepare,
2967ad879127SKrish Sadhukhan       default_prepare_gif_clear, tsc_adjust_test,
2968ad879127SKrish Sadhukhan       default_finished, tsc_adjust_check },
2969ad879127SKrish Sadhukhan     { "latency_run_exit", default_supported, latency_prepare,
2970ad879127SKrish Sadhukhan       default_prepare_gif_clear, latency_test,
2971ad879127SKrish Sadhukhan       latency_finished, latency_check },
2972f7fa53dcSPaolo Bonzini     { "latency_run_exit_clean", default_supported, latency_prepare,
2973f7fa53dcSPaolo Bonzini       default_prepare_gif_clear, latency_test,
2974f7fa53dcSPaolo Bonzini       latency_finished_clean, latency_check },
2975ad879127SKrish Sadhukhan     { "latency_svm_insn", default_supported, lat_svm_insn_prepare,
2976ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test,
2977ad879127SKrish Sadhukhan       lat_svm_insn_finished, lat_svm_insn_check },
29784b4fb247SPaolo Bonzini     { "exc_inject", default_supported, exc_inject_prepare,
29794b4fb247SPaolo Bonzini       default_prepare_gif_clear, exc_inject_test,
29804b4fb247SPaolo Bonzini       exc_inject_finished, exc_inject_check },
2981ad879127SKrish Sadhukhan     { "pending_event", default_supported, pending_event_prepare,
2982ad879127SKrish Sadhukhan       default_prepare_gif_clear,
2983ad879127SKrish Sadhukhan       pending_event_test, pending_event_finished, pending_event_check },
298485dc2aceSPaolo Bonzini     { "pending_event_cli", default_supported, pending_event_cli_prepare,
298585dc2aceSPaolo Bonzini       pending_event_cli_prepare_gif_clear,
298685dc2aceSPaolo Bonzini       pending_event_cli_test, pending_event_cli_finished,
298785dc2aceSPaolo Bonzini       pending_event_cli_check },
298885dc2aceSPaolo Bonzini     { "interrupt", default_supported, interrupt_prepare,
298985dc2aceSPaolo Bonzini       default_prepare_gif_clear, interrupt_test,
299085dc2aceSPaolo Bonzini       interrupt_finished, interrupt_check },
2991d4db486bSCathy Avery     { "nmi", default_supported, nmi_prepare,
2992d4db486bSCathy Avery       default_prepare_gif_clear, nmi_test,
2993d4db486bSCathy Avery       nmi_finished, nmi_check },
29949da1f4d8SCathy Avery     { "nmi_hlt", smp_supported, nmi_prepare,
29959da1f4d8SCathy Avery       default_prepare_gif_clear, nmi_hlt_test,
29969da1f4d8SCathy Avery       nmi_hlt_finished, nmi_hlt_check },
29979c838954SCathy Avery     { "virq_inject", default_supported, virq_inject_prepare,
29989c838954SCathy Avery       default_prepare_gif_clear, virq_inject_test,
29999c838954SCathy Avery       virq_inject_finished, virq_inject_check },
3000da338a31SMaxim Levitsky     { "reg_corruption", default_supported, reg_corruption_prepare,
3001da338a31SMaxim Levitsky       default_prepare_gif_clear, reg_corruption_test,
3002da338a31SMaxim Levitsky       reg_corruption_finished, reg_corruption_check },
30034770e9c8SCathy Avery     { "svm_init_startup_test", smp_supported, init_startup_prepare,
30044770e9c8SCathy Avery       default_prepare_gif_clear, null_test,
30054770e9c8SCathy Avery       init_startup_finished, init_startup_check },
3006d5da6dfeSCathy Avery     { "svm_init_intercept_test", smp_supported, init_intercept_prepare,
3007d5da6dfeSCathy Avery       default_prepare_gif_clear, init_intercept_test,
3008d5da6dfeSCathy Avery       init_intercept_finished, init_intercept_check, .on_vcpu = 2 },
30097839b0ecSKrish Sadhukhan     { "host_rflags", default_supported, host_rflags_prepare,
30107839b0ecSKrish Sadhukhan       host_rflags_prepare_gif_clear, host_rflags_test,
30117839b0ecSKrish Sadhukhan       host_rflags_finished, host_rflags_check },
3012f6972bd6SLara Lazier     { "vgif", vgif_supported, prepare_vgif_enabled,
3013f6972bd6SLara Lazier       default_prepare_gif_clear, test_vgif, vgif_finished,
3014f6972bd6SLara Lazier       vgif_check },
3015f32183f5SJim Mattson     TEST(svm_cr4_osxsave_test),
3016ba29942cSKrish Sadhukhan     TEST(svm_guest_state_test),
3017916635a8SSean Christopherson     TEST(svm_npt_rsvd_bits_test),
30187a57ef5dSMaxim Levitsky     TEST(svm_vmrun_errata_test),
30190b6f6cedSKrish Sadhukhan     TEST(svm_vmload_vmsave),
3020*665f5677SKrish Sadhukhan     TEST(svm_test_singlestep),
3021ad879127SKrish Sadhukhan     { NULL, NULL, NULL, NULL, NULL, NULL, NULL }
3022ad879127SKrish Sadhukhan };
3023