xref: /kvm-unit-tests/x86/svm_tests.c (revision 6d0ecbf6c926a66a1063aa56c8e38de4e226185a)
1ad879127SKrish Sadhukhan #include "svm.h"
2ad879127SKrish Sadhukhan #include "libcflat.h"
3ad879127SKrish Sadhukhan #include "processor.h"
4ad879127SKrish Sadhukhan #include "desc.h"
5ad879127SKrish Sadhukhan #include "msr.h"
6ad879127SKrish Sadhukhan #include "vm.h"
7ad879127SKrish Sadhukhan #include "smp.h"
8ad879127SKrish Sadhukhan #include "types.h"
9ad879127SKrish Sadhukhan #include "alloc_page.h"
10ad879127SKrish Sadhukhan #include "isr.h"
11ad879127SKrish Sadhukhan #include "apic.h"
129da1f4d8SCathy Avery #include "delay.h"
13ad879127SKrish Sadhukhan 
14ad879127SKrish Sadhukhan #define SVM_EXIT_MAX_DR_INTERCEPT 0x3f
15ad879127SKrish Sadhukhan 
16ad879127SKrish Sadhukhan static void *scratch_page;
17ad879127SKrish Sadhukhan 
18ad879127SKrish Sadhukhan #define LATENCY_RUNS 1000000
19ad879127SKrish Sadhukhan 
20ad879127SKrish Sadhukhan u64 tsc_start;
21ad879127SKrish Sadhukhan u64 tsc_end;
22ad879127SKrish Sadhukhan 
23ad879127SKrish Sadhukhan u64 vmrun_sum, vmexit_sum;
24ad879127SKrish Sadhukhan u64 vmsave_sum, vmload_sum;
25ad879127SKrish Sadhukhan u64 stgi_sum, clgi_sum;
26ad879127SKrish Sadhukhan u64 latvmrun_max;
27ad879127SKrish Sadhukhan u64 latvmrun_min;
28ad879127SKrish Sadhukhan u64 latvmexit_max;
29ad879127SKrish Sadhukhan u64 latvmexit_min;
30ad879127SKrish Sadhukhan u64 latvmload_max;
31ad879127SKrish Sadhukhan u64 latvmload_min;
32ad879127SKrish Sadhukhan u64 latvmsave_max;
33ad879127SKrish Sadhukhan u64 latvmsave_min;
34ad879127SKrish Sadhukhan u64 latstgi_max;
35ad879127SKrish Sadhukhan u64 latstgi_min;
36ad879127SKrish Sadhukhan u64 latclgi_max;
37ad879127SKrish Sadhukhan u64 latclgi_min;
38ad879127SKrish Sadhukhan u64 runs;
39ad879127SKrish Sadhukhan 
40ad879127SKrish Sadhukhan static void null_test(struct svm_test *test)
41ad879127SKrish Sadhukhan {
42ad879127SKrish Sadhukhan }
43ad879127SKrish Sadhukhan 
44ad879127SKrish Sadhukhan static bool null_check(struct svm_test *test)
45ad879127SKrish Sadhukhan {
46096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_VMMCALL;
47ad879127SKrish Sadhukhan }
48ad879127SKrish Sadhukhan 
49ad879127SKrish Sadhukhan static void prepare_no_vmrun_int(struct svm_test *test)
50ad879127SKrish Sadhukhan {
51096cf7feSPaolo Bonzini     vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMRUN);
52ad879127SKrish Sadhukhan }
53ad879127SKrish Sadhukhan 
54ad879127SKrish Sadhukhan static bool check_no_vmrun_int(struct svm_test *test)
55ad879127SKrish Sadhukhan {
56096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_ERR;
57ad879127SKrish Sadhukhan }
58ad879127SKrish Sadhukhan 
59ad879127SKrish Sadhukhan static void test_vmrun(struct svm_test *test)
60ad879127SKrish Sadhukhan {
61096cf7feSPaolo Bonzini     asm volatile ("vmrun %0" : : "a"(virt_to_phys(vmcb)));
62ad879127SKrish Sadhukhan }
63ad879127SKrish Sadhukhan 
64ad879127SKrish Sadhukhan static bool check_vmrun(struct svm_test *test)
65ad879127SKrish Sadhukhan {
66096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_VMRUN;
67ad879127SKrish Sadhukhan }
68ad879127SKrish Sadhukhan 
69401299a5SPaolo Bonzini static void prepare_rsm_intercept(struct svm_test *test)
70401299a5SPaolo Bonzini {
71401299a5SPaolo Bonzini     default_prepare(test);
72401299a5SPaolo Bonzini     vmcb->control.intercept |= 1 << INTERCEPT_RSM;
73401299a5SPaolo Bonzini     vmcb->control.intercept_exceptions |= (1ULL << UD_VECTOR);
74401299a5SPaolo Bonzini }
75401299a5SPaolo Bonzini 
76401299a5SPaolo Bonzini static void test_rsm_intercept(struct svm_test *test)
77401299a5SPaolo Bonzini {
78401299a5SPaolo Bonzini     asm volatile ("rsm" : : : "memory");
79401299a5SPaolo Bonzini }
80401299a5SPaolo Bonzini 
81401299a5SPaolo Bonzini static bool check_rsm_intercept(struct svm_test *test)
82401299a5SPaolo Bonzini {
83401299a5SPaolo Bonzini     return get_test_stage(test) == 2;
84401299a5SPaolo Bonzini }
85401299a5SPaolo Bonzini 
86401299a5SPaolo Bonzini static bool finished_rsm_intercept(struct svm_test *test)
87401299a5SPaolo Bonzini {
88401299a5SPaolo Bonzini     switch (get_test_stage(test)) {
89401299a5SPaolo Bonzini     case 0:
90401299a5SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_RSM) {
91401299a5SPaolo Bonzini             report(false, "VMEXIT not due to rsm. Exit reason 0x%x",
92401299a5SPaolo Bonzini                    vmcb->control.exit_code);
93401299a5SPaolo Bonzini             return true;
94401299a5SPaolo Bonzini         }
95401299a5SPaolo Bonzini         vmcb->control.intercept &= ~(1 << INTERCEPT_RSM);
96401299a5SPaolo Bonzini         inc_test_stage(test);
97401299a5SPaolo Bonzini         break;
98401299a5SPaolo Bonzini 
99401299a5SPaolo Bonzini     case 1:
100401299a5SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_EXCP_BASE + UD_VECTOR) {
101401299a5SPaolo Bonzini             report(false, "VMEXIT not due to #UD. Exit reason 0x%x",
102401299a5SPaolo Bonzini                    vmcb->control.exit_code);
103401299a5SPaolo Bonzini             return true;
104401299a5SPaolo Bonzini         }
105401299a5SPaolo Bonzini         vmcb->save.rip += 2;
106401299a5SPaolo Bonzini         inc_test_stage(test);
107401299a5SPaolo Bonzini         break;
108401299a5SPaolo Bonzini 
109401299a5SPaolo Bonzini     default:
110401299a5SPaolo Bonzini         return true;
111401299a5SPaolo Bonzini     }
112401299a5SPaolo Bonzini     return get_test_stage(test) == 2;
113401299a5SPaolo Bonzini }
114401299a5SPaolo Bonzini 
115ad879127SKrish Sadhukhan static void prepare_cr3_intercept(struct svm_test *test)
116ad879127SKrish Sadhukhan {
117ad879127SKrish Sadhukhan     default_prepare(test);
118096cf7feSPaolo Bonzini     vmcb->control.intercept_cr_read |= 1 << 3;
119ad879127SKrish Sadhukhan }
120ad879127SKrish Sadhukhan 
121ad879127SKrish Sadhukhan static void test_cr3_intercept(struct svm_test *test)
122ad879127SKrish Sadhukhan {
123ad879127SKrish Sadhukhan     asm volatile ("mov %%cr3, %0" : "=r"(test->scratch) : : "memory");
124ad879127SKrish Sadhukhan }
125ad879127SKrish Sadhukhan 
126ad879127SKrish Sadhukhan static bool check_cr3_intercept(struct svm_test *test)
127ad879127SKrish Sadhukhan {
128096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_READ_CR3;
129ad879127SKrish Sadhukhan }
130ad879127SKrish Sadhukhan 
131ad879127SKrish Sadhukhan static bool check_cr3_nointercept(struct svm_test *test)
132ad879127SKrish Sadhukhan {
133ad879127SKrish Sadhukhan     return null_check(test) && test->scratch == read_cr3();
134ad879127SKrish Sadhukhan }
135ad879127SKrish Sadhukhan 
136ad879127SKrish Sadhukhan static void corrupt_cr3_intercept_bypass(void *_test)
137ad879127SKrish Sadhukhan {
138ad879127SKrish Sadhukhan     struct svm_test *test = _test;
139ad879127SKrish Sadhukhan     extern volatile u32 mmio_insn;
140ad879127SKrish Sadhukhan 
141ad879127SKrish Sadhukhan     while (!__sync_bool_compare_and_swap(&test->scratch, 1, 2))
142ad879127SKrish Sadhukhan         pause();
143ad879127SKrish Sadhukhan     pause();
144ad879127SKrish Sadhukhan     pause();
145ad879127SKrish Sadhukhan     pause();
146ad879127SKrish Sadhukhan     mmio_insn = 0x90d8200f;  // mov %cr3, %rax; nop
147ad879127SKrish Sadhukhan }
148ad879127SKrish Sadhukhan 
149ad879127SKrish Sadhukhan static void prepare_cr3_intercept_bypass(struct svm_test *test)
150ad879127SKrish Sadhukhan {
151ad879127SKrish Sadhukhan     default_prepare(test);
152096cf7feSPaolo Bonzini     vmcb->control.intercept_cr_read |= 1 << 3;
153ad879127SKrish Sadhukhan     on_cpu_async(1, corrupt_cr3_intercept_bypass, test);
154ad879127SKrish Sadhukhan }
155ad879127SKrish Sadhukhan 
156ad879127SKrish Sadhukhan static void test_cr3_intercept_bypass(struct svm_test *test)
157ad879127SKrish Sadhukhan {
158ad879127SKrish Sadhukhan     ulong a = 0xa0000;
159ad879127SKrish Sadhukhan 
160ad879127SKrish Sadhukhan     test->scratch = 1;
161ad879127SKrish Sadhukhan     while (test->scratch != 2)
162ad879127SKrish Sadhukhan         barrier();
163ad879127SKrish Sadhukhan 
164ad879127SKrish Sadhukhan     asm volatile ("mmio_insn: mov %0, (%0); nop"
165ad879127SKrish Sadhukhan                   : "+a"(a) : : "memory");
166ad879127SKrish Sadhukhan     test->scratch = a;
167ad879127SKrish Sadhukhan }
168ad879127SKrish Sadhukhan 
169ad879127SKrish Sadhukhan static void prepare_dr_intercept(struct svm_test *test)
170ad879127SKrish Sadhukhan {
171ad879127SKrish Sadhukhan     default_prepare(test);
172096cf7feSPaolo Bonzini     vmcb->control.intercept_dr_read = 0xff;
173096cf7feSPaolo Bonzini     vmcb->control.intercept_dr_write = 0xff;
174ad879127SKrish Sadhukhan }
175ad879127SKrish Sadhukhan 
176ad879127SKrish Sadhukhan static void test_dr_intercept(struct svm_test *test)
177ad879127SKrish Sadhukhan {
178ad879127SKrish Sadhukhan     unsigned int i, failcnt = 0;
179ad879127SKrish Sadhukhan 
180ad879127SKrish Sadhukhan     /* Loop testing debug register reads */
181ad879127SKrish Sadhukhan     for (i = 0; i < 8; i++) {
182ad879127SKrish Sadhukhan 
183ad879127SKrish Sadhukhan         switch (i) {
184ad879127SKrish Sadhukhan         case 0:
185ad879127SKrish Sadhukhan             asm volatile ("mov %%dr0, %0" : "=r"(test->scratch) : : "memory");
186ad879127SKrish Sadhukhan             break;
187ad879127SKrish Sadhukhan         case 1:
188ad879127SKrish Sadhukhan             asm volatile ("mov %%dr1, %0" : "=r"(test->scratch) : : "memory");
189ad879127SKrish Sadhukhan             break;
190ad879127SKrish Sadhukhan         case 2:
191ad879127SKrish Sadhukhan             asm volatile ("mov %%dr2, %0" : "=r"(test->scratch) : : "memory");
192ad879127SKrish Sadhukhan             break;
193ad879127SKrish Sadhukhan         case 3:
194ad879127SKrish Sadhukhan             asm volatile ("mov %%dr3, %0" : "=r"(test->scratch) : : "memory");
195ad879127SKrish Sadhukhan             break;
196ad879127SKrish Sadhukhan         case 4:
197ad879127SKrish Sadhukhan             asm volatile ("mov %%dr4, %0" : "=r"(test->scratch) : : "memory");
198ad879127SKrish Sadhukhan             break;
199ad879127SKrish Sadhukhan         case 5:
200ad879127SKrish Sadhukhan             asm volatile ("mov %%dr5, %0" : "=r"(test->scratch) : : "memory");
201ad879127SKrish Sadhukhan             break;
202ad879127SKrish Sadhukhan         case 6:
203ad879127SKrish Sadhukhan             asm volatile ("mov %%dr6, %0" : "=r"(test->scratch) : : "memory");
204ad879127SKrish Sadhukhan             break;
205ad879127SKrish Sadhukhan         case 7:
206ad879127SKrish Sadhukhan             asm volatile ("mov %%dr7, %0" : "=r"(test->scratch) : : "memory");
207ad879127SKrish Sadhukhan             break;
208ad879127SKrish Sadhukhan         }
209ad879127SKrish Sadhukhan 
210ad879127SKrish Sadhukhan         if (test->scratch != i) {
211ad879127SKrish Sadhukhan             report(false, "dr%u read intercept", i);
212ad879127SKrish Sadhukhan             failcnt++;
213ad879127SKrish Sadhukhan         }
214ad879127SKrish Sadhukhan     }
215ad879127SKrish Sadhukhan 
216ad879127SKrish Sadhukhan     /* Loop testing debug register writes */
217ad879127SKrish Sadhukhan     for (i = 0; i < 8; i++) {
218ad879127SKrish Sadhukhan 
219ad879127SKrish Sadhukhan         switch (i) {
220ad879127SKrish Sadhukhan         case 0:
221ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr0" : : "r"(test->scratch) : "memory");
222ad879127SKrish Sadhukhan             break;
223ad879127SKrish Sadhukhan         case 1:
224ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr1" : : "r"(test->scratch) : "memory");
225ad879127SKrish Sadhukhan             break;
226ad879127SKrish Sadhukhan         case 2:
227ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr2" : : "r"(test->scratch) : "memory");
228ad879127SKrish Sadhukhan             break;
229ad879127SKrish Sadhukhan         case 3:
230ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr3" : : "r"(test->scratch) : "memory");
231ad879127SKrish Sadhukhan             break;
232ad879127SKrish Sadhukhan         case 4:
233ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr4" : : "r"(test->scratch) : "memory");
234ad879127SKrish Sadhukhan             break;
235ad879127SKrish Sadhukhan         case 5:
236ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr5" : : "r"(test->scratch) : "memory");
237ad879127SKrish Sadhukhan             break;
238ad879127SKrish Sadhukhan         case 6:
239ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr6" : : "r"(test->scratch) : "memory");
240ad879127SKrish Sadhukhan             break;
241ad879127SKrish Sadhukhan         case 7:
242ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr7" : : "r"(test->scratch) : "memory");
243ad879127SKrish Sadhukhan             break;
244ad879127SKrish Sadhukhan         }
245ad879127SKrish Sadhukhan 
246ad879127SKrish Sadhukhan         if (test->scratch != i) {
247ad879127SKrish Sadhukhan             report(false, "dr%u write intercept", i);
248ad879127SKrish Sadhukhan             failcnt++;
249ad879127SKrish Sadhukhan         }
250ad879127SKrish Sadhukhan     }
251ad879127SKrish Sadhukhan 
252ad879127SKrish Sadhukhan     test->scratch = failcnt;
253ad879127SKrish Sadhukhan }
254ad879127SKrish Sadhukhan 
255ad879127SKrish Sadhukhan static bool dr_intercept_finished(struct svm_test *test)
256ad879127SKrish Sadhukhan {
257096cf7feSPaolo Bonzini     ulong n = (vmcb->control.exit_code - SVM_EXIT_READ_DR0);
258ad879127SKrish Sadhukhan 
259ad879127SKrish Sadhukhan     /* Only expect DR intercepts */
260ad879127SKrish Sadhukhan     if (n > (SVM_EXIT_MAX_DR_INTERCEPT - SVM_EXIT_READ_DR0))
261ad879127SKrish Sadhukhan         return true;
262ad879127SKrish Sadhukhan 
263ad879127SKrish Sadhukhan     /*
264ad879127SKrish Sadhukhan      * Compute debug register number.
265ad879127SKrish Sadhukhan      * Per Appendix C "SVM Intercept Exit Codes" of AMD64 Architecture
266ad879127SKrish Sadhukhan      * Programmer's Manual Volume 2 - System Programming:
267ad879127SKrish Sadhukhan      * http://support.amd.com/TechDocs/24593.pdf
268ad879127SKrish Sadhukhan      * there are 16 VMEXIT codes each for DR read and write.
269ad879127SKrish Sadhukhan      */
270ad879127SKrish Sadhukhan     test->scratch = (n % 16);
271ad879127SKrish Sadhukhan 
272ad879127SKrish Sadhukhan     /* Jump over MOV instruction */
273096cf7feSPaolo Bonzini     vmcb->save.rip += 3;
274ad879127SKrish Sadhukhan 
275ad879127SKrish Sadhukhan     return false;
276ad879127SKrish Sadhukhan }
277ad879127SKrish Sadhukhan 
278ad879127SKrish Sadhukhan static bool check_dr_intercept(struct svm_test *test)
279ad879127SKrish Sadhukhan {
280ad879127SKrish Sadhukhan     return !test->scratch;
281ad879127SKrish Sadhukhan }
282ad879127SKrish Sadhukhan 
283ad879127SKrish Sadhukhan static bool next_rip_supported(void)
284ad879127SKrish Sadhukhan {
285ad879127SKrish Sadhukhan     return this_cpu_has(X86_FEATURE_NRIPS);
286ad879127SKrish Sadhukhan }
287ad879127SKrish Sadhukhan 
288ad879127SKrish Sadhukhan static void prepare_next_rip(struct svm_test *test)
289ad879127SKrish Sadhukhan {
290096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_RDTSC);
291ad879127SKrish Sadhukhan }
292ad879127SKrish Sadhukhan 
293ad879127SKrish Sadhukhan 
294ad879127SKrish Sadhukhan static void test_next_rip(struct svm_test *test)
295ad879127SKrish Sadhukhan {
296ad879127SKrish Sadhukhan     asm volatile ("rdtsc\n\t"
297ad879127SKrish Sadhukhan                   ".globl exp_next_rip\n\t"
298ad879127SKrish Sadhukhan                   "exp_next_rip:\n\t" ::: "eax", "edx");
299ad879127SKrish Sadhukhan }
300ad879127SKrish Sadhukhan 
301ad879127SKrish Sadhukhan static bool check_next_rip(struct svm_test *test)
302ad879127SKrish Sadhukhan {
303ad879127SKrish Sadhukhan     extern char exp_next_rip;
304ad879127SKrish Sadhukhan     unsigned long address = (unsigned long)&exp_next_rip;
305ad879127SKrish Sadhukhan 
306096cf7feSPaolo Bonzini     return address == vmcb->control.next_rip;
307ad879127SKrish Sadhukhan }
308ad879127SKrish Sadhukhan 
309ad879127SKrish Sadhukhan extern u8 *msr_bitmap;
310ad879127SKrish Sadhukhan 
311ad879127SKrish Sadhukhan static void prepare_msr_intercept(struct svm_test *test)
312ad879127SKrish Sadhukhan {
313ad879127SKrish Sadhukhan     default_prepare(test);
314096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_MSR_PROT);
315096cf7feSPaolo Bonzini     vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR);
316ad879127SKrish Sadhukhan     memset(msr_bitmap, 0xff, MSR_BITMAP_SIZE);
317ad879127SKrish Sadhukhan }
318ad879127SKrish Sadhukhan 
319ad879127SKrish Sadhukhan static void test_msr_intercept(struct svm_test *test)
320ad879127SKrish Sadhukhan {
321ad879127SKrish Sadhukhan     unsigned long msr_value = 0xef8056791234abcd; /* Arbitrary value */
322ad879127SKrish Sadhukhan     unsigned long msr_index;
323ad879127SKrish Sadhukhan 
324ad879127SKrish Sadhukhan     for (msr_index = 0; msr_index <= 0xc0011fff; msr_index++) {
325ad879127SKrish Sadhukhan         if (msr_index == 0xC0010131 /* MSR_SEV_STATUS */) {
326ad879127SKrish Sadhukhan             /*
327ad879127SKrish Sadhukhan              * Per section 15.34.10 "SEV_STATUS MSR" of AMD64 Architecture
328ad879127SKrish Sadhukhan              * Programmer's Manual volume 2 - System Programming:
329ad879127SKrish Sadhukhan              * http://support.amd.com/TechDocs/24593.pdf
330ad879127SKrish Sadhukhan              * SEV_STATUS MSR (C001_0131) is a non-interceptable MSR.
331ad879127SKrish Sadhukhan              */
332ad879127SKrish Sadhukhan             continue;
333ad879127SKrish Sadhukhan         }
334ad879127SKrish Sadhukhan 
335ad879127SKrish Sadhukhan         /* Skips gaps between supported MSR ranges */
336ad879127SKrish Sadhukhan         if (msr_index == 0x2000)
337ad879127SKrish Sadhukhan             msr_index = 0xc0000000;
338ad879127SKrish Sadhukhan         else if (msr_index == 0xc0002000)
339ad879127SKrish Sadhukhan             msr_index = 0xc0010000;
340ad879127SKrish Sadhukhan 
341ad879127SKrish Sadhukhan         test->scratch = -1;
342ad879127SKrish Sadhukhan 
343ad879127SKrish Sadhukhan         rdmsr(msr_index);
344ad879127SKrish Sadhukhan 
345ad879127SKrish Sadhukhan         /* Check that a read intercept occurred for MSR at msr_index */
346ad879127SKrish Sadhukhan         if (test->scratch != msr_index)
347ad879127SKrish Sadhukhan             report(false, "MSR 0x%lx read intercept", msr_index);
348ad879127SKrish Sadhukhan 
349ad879127SKrish Sadhukhan         /*
350ad879127SKrish Sadhukhan          * Poor man approach to generate a value that
351ad879127SKrish Sadhukhan          * seems arbitrary each time around the loop.
352ad879127SKrish Sadhukhan          */
353ad879127SKrish Sadhukhan         msr_value += (msr_value << 1);
354ad879127SKrish Sadhukhan 
355ad879127SKrish Sadhukhan         wrmsr(msr_index, msr_value);
356ad879127SKrish Sadhukhan 
357ad879127SKrish Sadhukhan         /* Check that a write intercept occurred for MSR with msr_value */
358ad879127SKrish Sadhukhan         if (test->scratch != msr_value)
359ad879127SKrish Sadhukhan             report(false, "MSR 0x%lx write intercept", msr_index);
360ad879127SKrish Sadhukhan     }
361ad879127SKrish Sadhukhan 
362ad879127SKrish Sadhukhan     test->scratch = -2;
363ad879127SKrish Sadhukhan }
364ad879127SKrish Sadhukhan 
365ad879127SKrish Sadhukhan static bool msr_intercept_finished(struct svm_test *test)
366ad879127SKrish Sadhukhan {
367096cf7feSPaolo Bonzini     u32 exit_code = vmcb->control.exit_code;
368ad879127SKrish Sadhukhan     u64 exit_info_1;
369ad879127SKrish Sadhukhan     u8 *opcode;
370ad879127SKrish Sadhukhan 
371ad879127SKrish Sadhukhan     if (exit_code == SVM_EXIT_MSR) {
372096cf7feSPaolo Bonzini         exit_info_1 = vmcb->control.exit_info_1;
373ad879127SKrish Sadhukhan     } else {
374ad879127SKrish Sadhukhan         /*
375ad879127SKrish Sadhukhan          * If #GP exception occurs instead, check that it was
376ad879127SKrish Sadhukhan          * for RDMSR/WRMSR and set exit_info_1 accordingly.
377ad879127SKrish Sadhukhan          */
378ad879127SKrish Sadhukhan 
379ad879127SKrish Sadhukhan         if (exit_code != (SVM_EXIT_EXCP_BASE + GP_VECTOR))
380ad879127SKrish Sadhukhan             return true;
381ad879127SKrish Sadhukhan 
382096cf7feSPaolo Bonzini         opcode = (u8 *)vmcb->save.rip;
383ad879127SKrish Sadhukhan         if (opcode[0] != 0x0f)
384ad879127SKrish Sadhukhan             return true;
385ad879127SKrish Sadhukhan 
386ad879127SKrish Sadhukhan         switch (opcode[1]) {
387ad879127SKrish Sadhukhan         case 0x30: /* WRMSR */
388ad879127SKrish Sadhukhan             exit_info_1 = 1;
389ad879127SKrish Sadhukhan             break;
390ad879127SKrish Sadhukhan         case 0x32: /* RDMSR */
391ad879127SKrish Sadhukhan             exit_info_1 = 0;
392ad879127SKrish Sadhukhan             break;
393ad879127SKrish Sadhukhan         default:
394ad879127SKrish Sadhukhan             return true;
395ad879127SKrish Sadhukhan         }
396ad879127SKrish Sadhukhan 
397ad879127SKrish Sadhukhan         /*
398ad879127SKrish Sadhukhan          * Warn that #GP exception occured instead.
399ad879127SKrish Sadhukhan          * RCX holds the MSR index.
400ad879127SKrish Sadhukhan          */
401ad879127SKrish Sadhukhan         printf("%s 0x%lx #GP exception\n",
402ad879127SKrish Sadhukhan             exit_info_1 ? "WRMSR" : "RDMSR", get_regs().rcx);
403ad879127SKrish Sadhukhan     }
404ad879127SKrish Sadhukhan 
405ad879127SKrish Sadhukhan     /* Jump over RDMSR/WRMSR instruction */
406096cf7feSPaolo Bonzini     vmcb->save.rip += 2;
407ad879127SKrish Sadhukhan 
408ad879127SKrish Sadhukhan     /*
409ad879127SKrish Sadhukhan      * Test whether the intercept was for RDMSR/WRMSR.
410ad879127SKrish Sadhukhan      * For RDMSR, test->scratch is set to the MSR index;
411ad879127SKrish Sadhukhan      *      RCX holds the MSR index.
412ad879127SKrish Sadhukhan      * For WRMSR, test->scratch is set to the MSR value;
413ad879127SKrish Sadhukhan      *      RDX holds the upper 32 bits of the MSR value,
414ad879127SKrish Sadhukhan      *      while RAX hold its lower 32 bits.
415ad879127SKrish Sadhukhan      */
416ad879127SKrish Sadhukhan     if (exit_info_1)
417ad879127SKrish Sadhukhan         test->scratch =
418096cf7feSPaolo Bonzini             ((get_regs().rdx << 32) | (vmcb->save.rax & 0xffffffff));
419ad879127SKrish Sadhukhan     else
420ad879127SKrish Sadhukhan         test->scratch = get_regs().rcx;
421ad879127SKrish Sadhukhan 
422ad879127SKrish Sadhukhan     return false;
423ad879127SKrish Sadhukhan }
424ad879127SKrish Sadhukhan 
425ad879127SKrish Sadhukhan static bool check_msr_intercept(struct svm_test *test)
426ad879127SKrish Sadhukhan {
427ad879127SKrish Sadhukhan     memset(msr_bitmap, 0, MSR_BITMAP_SIZE);
428ad879127SKrish Sadhukhan     return (test->scratch == -2);
429ad879127SKrish Sadhukhan }
430ad879127SKrish Sadhukhan 
431ad879127SKrish Sadhukhan static void prepare_mode_switch(struct svm_test *test)
432ad879127SKrish Sadhukhan {
433096cf7feSPaolo Bonzini     vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR)
434ad879127SKrish Sadhukhan                                              |  (1ULL << UD_VECTOR)
435ad879127SKrish Sadhukhan                                              |  (1ULL << DF_VECTOR)
436ad879127SKrish Sadhukhan                                              |  (1ULL << PF_VECTOR);
437ad879127SKrish Sadhukhan     test->scratch = 0;
438ad879127SKrish Sadhukhan }
439ad879127SKrish Sadhukhan 
440ad879127SKrish Sadhukhan static void test_mode_switch(struct svm_test *test)
441ad879127SKrish Sadhukhan {
442ad879127SKrish Sadhukhan     asm volatile("	cli\n"
443ad879127SKrish Sadhukhan 		 "	ljmp *1f\n" /* jump to 32-bit code segment */
444ad879127SKrish Sadhukhan 		 "1:\n"
445ad879127SKrish Sadhukhan 		 "	.long 2f\n"
446ad879127SKrish Sadhukhan 		 "	.long " xstr(KERNEL_CS32) "\n"
447ad879127SKrish Sadhukhan 		 ".code32\n"
448ad879127SKrish Sadhukhan 		 "2:\n"
449ad879127SKrish Sadhukhan 		 "	movl %%cr0, %%eax\n"
450ad879127SKrish Sadhukhan 		 "	btcl  $31, %%eax\n" /* clear PG */
451ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr0\n"
452ad879127SKrish Sadhukhan 		 "	movl $0xc0000080, %%ecx\n" /* EFER */
453ad879127SKrish Sadhukhan 		 "	rdmsr\n"
454ad879127SKrish Sadhukhan 		 "	btcl $8, %%eax\n" /* clear LME */
455ad879127SKrish Sadhukhan 		 "	wrmsr\n"
456ad879127SKrish Sadhukhan 		 "	movl %%cr4, %%eax\n"
457ad879127SKrish Sadhukhan 		 "	btcl $5, %%eax\n" /* clear PAE */
458ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr4\n"
459ad879127SKrish Sadhukhan 		 "	movw %[ds16], %%ax\n"
460ad879127SKrish Sadhukhan 		 "	movw %%ax, %%ds\n"
461ad879127SKrish Sadhukhan 		 "	ljmpl %[cs16], $3f\n" /* jump to 16 bit protected-mode */
462ad879127SKrish Sadhukhan 		 ".code16\n"
463ad879127SKrish Sadhukhan 		 "3:\n"
464ad879127SKrish Sadhukhan 		 "	movl %%cr0, %%eax\n"
465ad879127SKrish Sadhukhan 		 "	btcl $0, %%eax\n" /* clear PE  */
466ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr0\n"
467ad879127SKrish Sadhukhan 		 "	ljmpl $0, $4f\n"   /* jump to real-mode */
468ad879127SKrish Sadhukhan 		 "4:\n"
469ad879127SKrish Sadhukhan 		 "	vmmcall\n"
470ad879127SKrish Sadhukhan 		 "	movl %%cr0, %%eax\n"
471ad879127SKrish Sadhukhan 		 "	btsl $0, %%eax\n" /* set PE  */
472ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr0\n"
473ad879127SKrish Sadhukhan 		 "	ljmpl %[cs32], $5f\n" /* back to protected mode */
474ad879127SKrish Sadhukhan 		 ".code32\n"
475ad879127SKrish Sadhukhan 		 "5:\n"
476ad879127SKrish Sadhukhan 		 "	movl %%cr4, %%eax\n"
477ad879127SKrish Sadhukhan 		 "	btsl $5, %%eax\n" /* set PAE */
478ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr4\n"
479ad879127SKrish Sadhukhan 		 "	movl $0xc0000080, %%ecx\n" /* EFER */
480ad879127SKrish Sadhukhan 		 "	rdmsr\n"
481ad879127SKrish Sadhukhan 		 "	btsl $8, %%eax\n" /* set LME */
482ad879127SKrish Sadhukhan 		 "	wrmsr\n"
483ad879127SKrish Sadhukhan 		 "	movl %%cr0, %%eax\n"
484ad879127SKrish Sadhukhan 		 "	btsl  $31, %%eax\n" /* set PG */
485ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr0\n"
486ad879127SKrish Sadhukhan 		 "	ljmpl %[cs64], $6f\n"    /* back to long mode */
487ad879127SKrish Sadhukhan 		 ".code64\n\t"
488ad879127SKrish Sadhukhan 		 "6:\n"
489ad879127SKrish Sadhukhan 		 "	vmmcall\n"
490ad879127SKrish Sadhukhan 		 :: [cs16] "i"(KERNEL_CS16), [ds16] "i"(KERNEL_DS16),
491ad879127SKrish Sadhukhan 		    [cs32] "i"(KERNEL_CS32), [cs64] "i"(KERNEL_CS64)
492ad879127SKrish Sadhukhan 		 : "rax", "rbx", "rcx", "rdx", "memory");
493ad879127SKrish Sadhukhan }
494ad879127SKrish Sadhukhan 
495ad879127SKrish Sadhukhan static bool mode_switch_finished(struct svm_test *test)
496ad879127SKrish Sadhukhan {
497ad879127SKrish Sadhukhan     u64 cr0, cr4, efer;
498ad879127SKrish Sadhukhan 
499096cf7feSPaolo Bonzini     cr0  = vmcb->save.cr0;
500096cf7feSPaolo Bonzini     cr4  = vmcb->save.cr4;
501096cf7feSPaolo Bonzini     efer = vmcb->save.efer;
502ad879127SKrish Sadhukhan 
503ad879127SKrish Sadhukhan     /* Only expect VMMCALL intercepts */
504096cf7feSPaolo Bonzini     if (vmcb->control.exit_code != SVM_EXIT_VMMCALL)
505ad879127SKrish Sadhukhan 	    return true;
506ad879127SKrish Sadhukhan 
507ad879127SKrish Sadhukhan     /* Jump over VMMCALL instruction */
508096cf7feSPaolo Bonzini     vmcb->save.rip += 3;
509ad879127SKrish Sadhukhan 
510ad879127SKrish Sadhukhan     /* Do sanity checks */
511ad879127SKrish Sadhukhan     switch (test->scratch) {
512ad879127SKrish Sadhukhan     case 0:
513ad879127SKrish Sadhukhan         /* Test should be in real mode now - check for this */
514ad879127SKrish Sadhukhan         if ((cr0  & 0x80000001) || /* CR0.PG, CR0.PE */
515ad879127SKrish Sadhukhan             (cr4  & 0x00000020) || /* CR4.PAE */
516ad879127SKrish Sadhukhan             (efer & 0x00000500))   /* EFER.LMA, EFER.LME */
517ad879127SKrish Sadhukhan                 return true;
518ad879127SKrish Sadhukhan         break;
519ad879127SKrish Sadhukhan     case 2:
520ad879127SKrish Sadhukhan         /* Test should be back in long-mode now - check for this */
521ad879127SKrish Sadhukhan         if (((cr0  & 0x80000001) != 0x80000001) || /* CR0.PG, CR0.PE */
522ad879127SKrish Sadhukhan             ((cr4  & 0x00000020) != 0x00000020) || /* CR4.PAE */
523ad879127SKrish Sadhukhan             ((efer & 0x00000500) != 0x00000500))   /* EFER.LMA, EFER.LME */
524ad879127SKrish Sadhukhan 		    return true;
525ad879127SKrish Sadhukhan 	break;
526ad879127SKrish Sadhukhan     }
527ad879127SKrish Sadhukhan 
528ad879127SKrish Sadhukhan     /* one step forward */
529ad879127SKrish Sadhukhan     test->scratch += 1;
530ad879127SKrish Sadhukhan 
531ad879127SKrish Sadhukhan     return test->scratch == 2;
532ad879127SKrish Sadhukhan }
533ad879127SKrish Sadhukhan 
534ad879127SKrish Sadhukhan static bool check_mode_switch(struct svm_test *test)
535ad879127SKrish Sadhukhan {
536ad879127SKrish Sadhukhan 	return test->scratch == 2;
537ad879127SKrish Sadhukhan }
538ad879127SKrish Sadhukhan 
539ad879127SKrish Sadhukhan extern u8 *io_bitmap;
540ad879127SKrish Sadhukhan 
541ad879127SKrish Sadhukhan static void prepare_ioio(struct svm_test *test)
542ad879127SKrish Sadhukhan {
543096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_IOIO_PROT);
544ad879127SKrish Sadhukhan     test->scratch = 0;
545ad879127SKrish Sadhukhan     memset(io_bitmap, 0, 8192);
546ad879127SKrish Sadhukhan     io_bitmap[8192] = 0xFF;
547ad879127SKrish Sadhukhan }
548ad879127SKrish Sadhukhan 
549ad879127SKrish Sadhukhan static void test_ioio(struct svm_test *test)
550ad879127SKrish Sadhukhan {
551ad879127SKrish Sadhukhan     // stage 0, test IO pass
552ad879127SKrish Sadhukhan     inb(0x5000);
553ad879127SKrish Sadhukhan     outb(0x0, 0x5000);
554ad879127SKrish Sadhukhan     if (get_test_stage(test) != 0)
555ad879127SKrish Sadhukhan         goto fail;
556ad879127SKrish Sadhukhan 
557ad879127SKrish Sadhukhan     // test IO width, in/out
558ad879127SKrish Sadhukhan     io_bitmap[0] = 0xFF;
559ad879127SKrish Sadhukhan     inc_test_stage(test);
560ad879127SKrish Sadhukhan     inb(0x0);
561ad879127SKrish Sadhukhan     if (get_test_stage(test) != 2)
562ad879127SKrish Sadhukhan         goto fail;
563ad879127SKrish Sadhukhan 
564ad879127SKrish Sadhukhan     outw(0x0, 0x0);
565ad879127SKrish Sadhukhan     if (get_test_stage(test) != 3)
566ad879127SKrish Sadhukhan         goto fail;
567ad879127SKrish Sadhukhan 
568ad879127SKrish Sadhukhan     inl(0x0);
569ad879127SKrish Sadhukhan     if (get_test_stage(test) != 4)
570ad879127SKrish Sadhukhan         goto fail;
571ad879127SKrish Sadhukhan 
572ad879127SKrish Sadhukhan     // test low/high IO port
573ad879127SKrish Sadhukhan     io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8));
574ad879127SKrish Sadhukhan     inb(0x5000);
575ad879127SKrish Sadhukhan     if (get_test_stage(test) != 5)
576ad879127SKrish Sadhukhan         goto fail;
577ad879127SKrish Sadhukhan 
578ad879127SKrish Sadhukhan     io_bitmap[0x9000 / 8] = (1 << (0x9000 % 8));
579ad879127SKrish Sadhukhan     inw(0x9000);
580ad879127SKrish Sadhukhan     if (get_test_stage(test) != 6)
581ad879127SKrish Sadhukhan         goto fail;
582ad879127SKrish Sadhukhan 
583ad879127SKrish Sadhukhan     // test partial pass
584ad879127SKrish Sadhukhan     io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8));
585ad879127SKrish Sadhukhan     inl(0x4FFF);
586ad879127SKrish Sadhukhan     if (get_test_stage(test) != 7)
587ad879127SKrish Sadhukhan         goto fail;
588ad879127SKrish Sadhukhan 
589ad879127SKrish Sadhukhan     // test across pages
590ad879127SKrish Sadhukhan     inc_test_stage(test);
591ad879127SKrish Sadhukhan     inl(0x7FFF);
592ad879127SKrish Sadhukhan     if (get_test_stage(test) != 8)
593ad879127SKrish Sadhukhan         goto fail;
594ad879127SKrish Sadhukhan 
595ad879127SKrish Sadhukhan     inc_test_stage(test);
596ad879127SKrish Sadhukhan     io_bitmap[0x8000 / 8] = 1 << (0x8000 % 8);
597ad879127SKrish Sadhukhan     inl(0x7FFF);
598ad879127SKrish Sadhukhan     if (get_test_stage(test) != 10)
599ad879127SKrish Sadhukhan         goto fail;
600ad879127SKrish Sadhukhan 
601ad879127SKrish Sadhukhan     io_bitmap[0] = 0;
602ad879127SKrish Sadhukhan     inl(0xFFFF);
603ad879127SKrish Sadhukhan     if (get_test_stage(test) != 11)
604ad879127SKrish Sadhukhan         goto fail;
605ad879127SKrish Sadhukhan 
606ad879127SKrish Sadhukhan     io_bitmap[0] = 0xFF;
607ad879127SKrish Sadhukhan     io_bitmap[8192] = 0;
608ad879127SKrish Sadhukhan     inl(0xFFFF);
609ad879127SKrish Sadhukhan     inc_test_stage(test);
610ad879127SKrish Sadhukhan     if (get_test_stage(test) != 12)
611ad879127SKrish Sadhukhan         goto fail;
612ad879127SKrish Sadhukhan 
613ad879127SKrish Sadhukhan     return;
614ad879127SKrish Sadhukhan 
615ad879127SKrish Sadhukhan fail:
616ad879127SKrish Sadhukhan     report(false, "stage %d", get_test_stage(test));
617ad879127SKrish Sadhukhan     test->scratch = -1;
618ad879127SKrish Sadhukhan }
619ad879127SKrish Sadhukhan 
620ad879127SKrish Sadhukhan static bool ioio_finished(struct svm_test *test)
621ad879127SKrish Sadhukhan {
622ad879127SKrish Sadhukhan     unsigned port, size;
623ad879127SKrish Sadhukhan 
624ad879127SKrish Sadhukhan     /* Only expect IOIO intercepts */
625096cf7feSPaolo Bonzini     if (vmcb->control.exit_code == SVM_EXIT_VMMCALL)
626ad879127SKrish Sadhukhan         return true;
627ad879127SKrish Sadhukhan 
628096cf7feSPaolo Bonzini     if (vmcb->control.exit_code != SVM_EXIT_IOIO)
629ad879127SKrish Sadhukhan         return true;
630ad879127SKrish Sadhukhan 
631ad879127SKrish Sadhukhan     /* one step forward */
632ad879127SKrish Sadhukhan     test->scratch += 1;
633ad879127SKrish Sadhukhan 
634096cf7feSPaolo Bonzini     port = vmcb->control.exit_info_1 >> 16;
635096cf7feSPaolo Bonzini     size = (vmcb->control.exit_info_1 >> SVM_IOIO_SIZE_SHIFT) & 7;
636ad879127SKrish Sadhukhan 
637ad879127SKrish Sadhukhan     while (size--) {
638ad879127SKrish Sadhukhan         io_bitmap[port / 8] &= ~(1 << (port & 7));
639ad879127SKrish Sadhukhan         port++;
640ad879127SKrish Sadhukhan     }
641ad879127SKrish Sadhukhan 
642ad879127SKrish Sadhukhan     return false;
643ad879127SKrish Sadhukhan }
644ad879127SKrish Sadhukhan 
645ad879127SKrish Sadhukhan static bool check_ioio(struct svm_test *test)
646ad879127SKrish Sadhukhan {
647ad879127SKrish Sadhukhan     memset(io_bitmap, 0, 8193);
648ad879127SKrish Sadhukhan     return test->scratch != -1;
649ad879127SKrish Sadhukhan }
650ad879127SKrish Sadhukhan 
651ad879127SKrish Sadhukhan static void prepare_asid_zero(struct svm_test *test)
652ad879127SKrish Sadhukhan {
653096cf7feSPaolo Bonzini     vmcb->control.asid = 0;
654ad879127SKrish Sadhukhan }
655ad879127SKrish Sadhukhan 
656ad879127SKrish Sadhukhan static void test_asid_zero(struct svm_test *test)
657ad879127SKrish Sadhukhan {
658ad879127SKrish Sadhukhan     asm volatile ("vmmcall\n\t");
659ad879127SKrish Sadhukhan }
660ad879127SKrish Sadhukhan 
661ad879127SKrish Sadhukhan static bool check_asid_zero(struct svm_test *test)
662ad879127SKrish Sadhukhan {
663096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_ERR;
664ad879127SKrish Sadhukhan }
665ad879127SKrish Sadhukhan 
666ad879127SKrish Sadhukhan static void sel_cr0_bug_prepare(struct svm_test *test)
667ad879127SKrish Sadhukhan {
668096cf7feSPaolo Bonzini     vmcb_ident(vmcb);
669096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_SELECTIVE_CR0);
670ad879127SKrish Sadhukhan }
671ad879127SKrish Sadhukhan 
672ad879127SKrish Sadhukhan static bool sel_cr0_bug_finished(struct svm_test *test)
673ad879127SKrish Sadhukhan {
674ad879127SKrish Sadhukhan 	return true;
675ad879127SKrish Sadhukhan }
676ad879127SKrish Sadhukhan 
677ad879127SKrish Sadhukhan static void sel_cr0_bug_test(struct svm_test *test)
678ad879127SKrish Sadhukhan {
679ad879127SKrish Sadhukhan     unsigned long cr0;
680ad879127SKrish Sadhukhan 
681ad879127SKrish Sadhukhan     /* read cr0, clear CD, and write back */
682ad879127SKrish Sadhukhan     cr0  = read_cr0();
683ad879127SKrish Sadhukhan     cr0 |= (1UL << 30);
684ad879127SKrish Sadhukhan     write_cr0(cr0);
685ad879127SKrish Sadhukhan 
686ad879127SKrish Sadhukhan     /*
687ad879127SKrish Sadhukhan      * If we are here the test failed, not sure what to do now because we
688ad879127SKrish Sadhukhan      * are not in guest-mode anymore so we can't trigger an intercept.
689ad879127SKrish Sadhukhan      * Trigger a tripple-fault for now.
690ad879127SKrish Sadhukhan      */
691ad879127SKrish Sadhukhan     report(false, "sel_cr0 test. Can not recover from this - exiting");
692ad879127SKrish Sadhukhan     exit(report_summary());
693ad879127SKrish Sadhukhan }
694ad879127SKrish Sadhukhan 
695ad879127SKrish Sadhukhan static bool sel_cr0_bug_check(struct svm_test *test)
696ad879127SKrish Sadhukhan {
697096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_CR0_SEL_WRITE;
698ad879127SKrish Sadhukhan }
699ad879127SKrish Sadhukhan 
700ad879127SKrish Sadhukhan static void npt_nx_prepare(struct svm_test *test)
701ad879127SKrish Sadhukhan {
702ad879127SKrish Sadhukhan 
703ad879127SKrish Sadhukhan     u64 *pte;
704ad879127SKrish Sadhukhan 
705096cf7feSPaolo Bonzini     vmcb_ident(vmcb);
706ad879127SKrish Sadhukhan     pte = npt_get_pte((u64)null_test);
707ad879127SKrish Sadhukhan 
708ad879127SKrish Sadhukhan     *pte |= (1ULL << 63);
709ad879127SKrish Sadhukhan }
710ad879127SKrish Sadhukhan 
711ad879127SKrish Sadhukhan static bool npt_nx_check(struct svm_test *test)
712ad879127SKrish Sadhukhan {
713ad879127SKrish Sadhukhan     u64 *pte = npt_get_pte((u64)null_test);
714ad879127SKrish Sadhukhan 
715ad879127SKrish Sadhukhan     *pte &= ~(1ULL << 63);
716ad879127SKrish Sadhukhan 
717096cf7feSPaolo Bonzini     vmcb->save.efer |= (1 << 11);
718ad879127SKrish Sadhukhan 
719096cf7feSPaolo Bonzini     return (vmcb->control.exit_code == SVM_EXIT_NPF)
720096cf7feSPaolo Bonzini            && (vmcb->control.exit_info_1 == 0x100000015ULL);
721ad879127SKrish Sadhukhan }
722ad879127SKrish Sadhukhan 
7236faca2a5SKrish Sadhukhan static void npt_np_prepare(struct svm_test *test)
7246faca2a5SKrish Sadhukhan {
7256faca2a5SKrish Sadhukhan     u64 *pte;
7266faca2a5SKrish Sadhukhan 
7276faca2a5SKrish Sadhukhan     scratch_page = alloc_page();
7286faca2a5SKrish Sadhukhan     vmcb_ident(vmcb);
7296faca2a5SKrish Sadhukhan     pte = npt_get_pte((u64)scratch_page);
7306faca2a5SKrish Sadhukhan 
7316faca2a5SKrish Sadhukhan     *pte &= ~1ULL;
7326faca2a5SKrish Sadhukhan }
7336faca2a5SKrish Sadhukhan 
7346faca2a5SKrish Sadhukhan static void npt_np_test(struct svm_test *test)
7356faca2a5SKrish Sadhukhan {
7366faca2a5SKrish Sadhukhan     (void) *(volatile u64 *)scratch_page;
7376faca2a5SKrish Sadhukhan }
7386faca2a5SKrish Sadhukhan 
7396faca2a5SKrish Sadhukhan static bool npt_np_check(struct svm_test *test)
7406faca2a5SKrish Sadhukhan {
7416faca2a5SKrish Sadhukhan     u64 *pte = npt_get_pte((u64)scratch_page);
7426faca2a5SKrish Sadhukhan 
7436faca2a5SKrish Sadhukhan     *pte |= 1ULL;
7446faca2a5SKrish Sadhukhan 
7456faca2a5SKrish Sadhukhan     return (vmcb->control.exit_code == SVM_EXIT_NPF)
7466faca2a5SKrish Sadhukhan            && (vmcb->control.exit_info_1 == 0x100000004ULL);
7476faca2a5SKrish Sadhukhan }
7486faca2a5SKrish Sadhukhan 
749ad879127SKrish Sadhukhan static void npt_us_prepare(struct svm_test *test)
750ad879127SKrish Sadhukhan {
751ad879127SKrish Sadhukhan     u64 *pte;
752ad879127SKrish Sadhukhan 
753ad879127SKrish Sadhukhan     scratch_page = alloc_page();
754096cf7feSPaolo Bonzini     vmcb_ident(vmcb);
755ad879127SKrish Sadhukhan     pte = npt_get_pte((u64)scratch_page);
756ad879127SKrish Sadhukhan 
757ad879127SKrish Sadhukhan     *pte &= ~(1ULL << 2);
758ad879127SKrish Sadhukhan }
759ad879127SKrish Sadhukhan 
760ad879127SKrish Sadhukhan static void npt_us_test(struct svm_test *test)
761ad879127SKrish Sadhukhan {
762ad879127SKrish Sadhukhan     (void) *(volatile u64 *)scratch_page;
763ad879127SKrish Sadhukhan }
764ad879127SKrish Sadhukhan 
765ad879127SKrish Sadhukhan static bool npt_us_check(struct svm_test *test)
766ad879127SKrish Sadhukhan {
767ad879127SKrish Sadhukhan     u64 *pte = npt_get_pte((u64)scratch_page);
768ad879127SKrish Sadhukhan 
769ad879127SKrish Sadhukhan     *pte |= (1ULL << 2);
770ad879127SKrish Sadhukhan 
771096cf7feSPaolo Bonzini     return (vmcb->control.exit_code == SVM_EXIT_NPF)
772096cf7feSPaolo Bonzini            && (vmcb->control.exit_info_1 == 0x100000005ULL);
773ad879127SKrish Sadhukhan }
774ad879127SKrish Sadhukhan 
775ad879127SKrish Sadhukhan u64 save_pde;
776ad879127SKrish Sadhukhan 
777ad879127SKrish Sadhukhan static void npt_rsvd_prepare(struct svm_test *test)
778ad879127SKrish Sadhukhan {
779ad879127SKrish Sadhukhan     u64 *pde;
780ad879127SKrish Sadhukhan 
781096cf7feSPaolo Bonzini     vmcb_ident(vmcb);
782ad879127SKrish Sadhukhan     pde = npt_get_pde((u64) null_test);
783ad879127SKrish Sadhukhan 
784ad879127SKrish Sadhukhan     save_pde = *pde;
785ad879127SKrish Sadhukhan     *pde = (1ULL << 19) | (1ULL << 7) | 0x27;
786ad879127SKrish Sadhukhan }
787ad879127SKrish Sadhukhan 
788ad879127SKrish Sadhukhan static bool npt_rsvd_check(struct svm_test *test)
789ad879127SKrish Sadhukhan {
790ad879127SKrish Sadhukhan     u64 *pde = npt_get_pde((u64) null_test);
791ad879127SKrish Sadhukhan 
792ad879127SKrish Sadhukhan     *pde = save_pde;
793ad879127SKrish Sadhukhan 
794096cf7feSPaolo Bonzini     return (vmcb->control.exit_code == SVM_EXIT_NPF)
795096cf7feSPaolo Bonzini             && (vmcb->control.exit_info_1 == 0x10000001dULL);
796ad879127SKrish Sadhukhan }
797ad879127SKrish Sadhukhan 
798ad879127SKrish Sadhukhan static void npt_rw_prepare(struct svm_test *test)
799ad879127SKrish Sadhukhan {
800ad879127SKrish Sadhukhan 
801ad879127SKrish Sadhukhan     u64 *pte;
802ad879127SKrish Sadhukhan 
803096cf7feSPaolo Bonzini     vmcb_ident(vmcb);
804ad879127SKrish Sadhukhan     pte = npt_get_pte(0x80000);
805ad879127SKrish Sadhukhan 
806ad879127SKrish Sadhukhan     *pte &= ~(1ULL << 1);
807ad879127SKrish Sadhukhan }
808ad879127SKrish Sadhukhan 
809ad879127SKrish Sadhukhan static void npt_rw_test(struct svm_test *test)
810ad879127SKrish Sadhukhan {
811ad879127SKrish Sadhukhan     u64 *data = (void*)(0x80000);
812ad879127SKrish Sadhukhan 
813ad879127SKrish Sadhukhan     *data = 0;
814ad879127SKrish Sadhukhan }
815ad879127SKrish Sadhukhan 
816ad879127SKrish Sadhukhan static bool npt_rw_check(struct svm_test *test)
817ad879127SKrish Sadhukhan {
818ad879127SKrish Sadhukhan     u64 *pte = npt_get_pte(0x80000);
819ad879127SKrish Sadhukhan 
820ad879127SKrish Sadhukhan     *pte |= (1ULL << 1);
821ad879127SKrish Sadhukhan 
822096cf7feSPaolo Bonzini     return (vmcb->control.exit_code == SVM_EXIT_NPF)
823096cf7feSPaolo Bonzini            && (vmcb->control.exit_info_1 == 0x100000007ULL);
824ad879127SKrish Sadhukhan }
825ad879127SKrish Sadhukhan 
826ad879127SKrish Sadhukhan static void npt_rw_pfwalk_prepare(struct svm_test *test)
827ad879127SKrish Sadhukhan {
828ad879127SKrish Sadhukhan 
829ad879127SKrish Sadhukhan     u64 *pte;
830ad879127SKrish Sadhukhan 
831096cf7feSPaolo Bonzini     vmcb_ident(vmcb);
832ad879127SKrish Sadhukhan     pte = npt_get_pte(read_cr3());
833ad879127SKrish Sadhukhan 
834ad879127SKrish Sadhukhan     *pte &= ~(1ULL << 1);
835ad879127SKrish Sadhukhan }
836ad879127SKrish Sadhukhan 
837ad879127SKrish Sadhukhan static bool npt_rw_pfwalk_check(struct svm_test *test)
838ad879127SKrish Sadhukhan {
839ad879127SKrish Sadhukhan     u64 *pte = npt_get_pte(read_cr3());
840ad879127SKrish Sadhukhan 
841ad879127SKrish Sadhukhan     *pte |= (1ULL << 1);
842ad879127SKrish Sadhukhan 
843096cf7feSPaolo Bonzini     return (vmcb->control.exit_code == SVM_EXIT_NPF)
844a6051f06SNadav Amit            && (vmcb->control.exit_info_1 == 0x200000007ULL)
845096cf7feSPaolo Bonzini 	   && (vmcb->control.exit_info_2 == read_cr3());
846ad879127SKrish Sadhukhan }
847ad879127SKrish Sadhukhan 
848ad879127SKrish Sadhukhan static void npt_rsvd_pfwalk_prepare(struct svm_test *test)
849ad879127SKrish Sadhukhan {
850ad879127SKrish Sadhukhan     u64 *pdpe;
851096cf7feSPaolo Bonzini     vmcb_ident(vmcb);
852ad879127SKrish Sadhukhan 
853c6405e37SNadav Amit     pdpe = npt_get_pml4e();
854ad879127SKrish Sadhukhan     pdpe[0] |= (1ULL << 8);
855ad879127SKrish Sadhukhan }
856ad879127SKrish Sadhukhan 
857ad879127SKrish Sadhukhan static bool npt_rsvd_pfwalk_check(struct svm_test *test)
858ad879127SKrish Sadhukhan {
859c6405e37SNadav Amit     u64 *pdpe = npt_get_pml4e();
860ad879127SKrish Sadhukhan     pdpe[0] &= ~(1ULL << 8);
861ad879127SKrish Sadhukhan 
862096cf7feSPaolo Bonzini     return (vmcb->control.exit_code == SVM_EXIT_NPF)
863a6051f06SNadav Amit             && (vmcb->control.exit_info_1 == 0x20000000fULL);
864ad879127SKrish Sadhukhan }
865ad879127SKrish Sadhukhan 
866ad879127SKrish Sadhukhan static void npt_l1mmio_prepare(struct svm_test *test)
867ad879127SKrish Sadhukhan {
868096cf7feSPaolo Bonzini     vmcb_ident(vmcb);
869ad879127SKrish Sadhukhan }
870ad879127SKrish Sadhukhan 
871ad879127SKrish Sadhukhan u32 nested_apic_version1;
872ad879127SKrish Sadhukhan u32 nested_apic_version2;
873ad879127SKrish Sadhukhan 
874ad879127SKrish Sadhukhan static void npt_l1mmio_test(struct svm_test *test)
875ad879127SKrish Sadhukhan {
876ad879127SKrish Sadhukhan     volatile u32 *data = (volatile void*)(0xfee00030UL);
877ad879127SKrish Sadhukhan 
878ad879127SKrish Sadhukhan     nested_apic_version1 = *data;
879ad879127SKrish Sadhukhan     nested_apic_version2 = *data;
880ad879127SKrish Sadhukhan }
881ad879127SKrish Sadhukhan 
882ad879127SKrish Sadhukhan static bool npt_l1mmio_check(struct svm_test *test)
883ad879127SKrish Sadhukhan {
884ad879127SKrish Sadhukhan     volatile u32 *data = (volatile void*)(0xfee00030);
885ad879127SKrish Sadhukhan     u32 lvr = *data;
886ad879127SKrish Sadhukhan 
887ad879127SKrish Sadhukhan     return nested_apic_version1 == lvr && nested_apic_version2 == lvr;
888ad879127SKrish Sadhukhan }
889ad879127SKrish Sadhukhan 
890ad879127SKrish Sadhukhan static void npt_rw_l1mmio_prepare(struct svm_test *test)
891ad879127SKrish Sadhukhan {
892ad879127SKrish Sadhukhan 
893ad879127SKrish Sadhukhan     u64 *pte;
894ad879127SKrish Sadhukhan 
895096cf7feSPaolo Bonzini     vmcb_ident(vmcb);
896ad879127SKrish Sadhukhan     pte = npt_get_pte(0xfee00080);
897ad879127SKrish Sadhukhan 
898ad879127SKrish Sadhukhan     *pte &= ~(1ULL << 1);
899ad879127SKrish Sadhukhan }
900ad879127SKrish Sadhukhan 
901ad879127SKrish Sadhukhan static void npt_rw_l1mmio_test(struct svm_test *test)
902ad879127SKrish Sadhukhan {
903ad879127SKrish Sadhukhan     volatile u32 *data = (volatile void*)(0xfee00080);
904ad879127SKrish Sadhukhan 
905ad879127SKrish Sadhukhan     *data = *data;
906ad879127SKrish Sadhukhan }
907ad879127SKrish Sadhukhan 
908ad879127SKrish Sadhukhan static bool npt_rw_l1mmio_check(struct svm_test *test)
909ad879127SKrish Sadhukhan {
910ad879127SKrish Sadhukhan     u64 *pte = npt_get_pte(0xfee00080);
911ad879127SKrish Sadhukhan 
912ad879127SKrish Sadhukhan     *pte |= (1ULL << 1);
913ad879127SKrish Sadhukhan 
914096cf7feSPaolo Bonzini     return (vmcb->control.exit_code == SVM_EXIT_NPF)
915096cf7feSPaolo Bonzini            && (vmcb->control.exit_info_1 == 0x100000007ULL);
916ad879127SKrish Sadhukhan }
917ad879127SKrish Sadhukhan 
918ad879127SKrish Sadhukhan #define TSC_ADJUST_VALUE    (1ll << 32)
919f3154609SBill Wendling #define TSC_OFFSET_VALUE    (~0ull << 48)
920ad879127SKrish Sadhukhan static bool ok;
921ad879127SKrish Sadhukhan 
92210a65fc4SNadav Amit static bool tsc_adjust_supported(void)
92310a65fc4SNadav Amit {
92410a65fc4SNadav Amit     return this_cpu_has(X86_FEATURE_TSC_ADJUST);
92510a65fc4SNadav Amit }
92610a65fc4SNadav Amit 
927ad879127SKrish Sadhukhan static void tsc_adjust_prepare(struct svm_test *test)
928ad879127SKrish Sadhukhan {
929ad879127SKrish Sadhukhan     default_prepare(test);
930096cf7feSPaolo Bonzini     vmcb->control.tsc_offset = TSC_OFFSET_VALUE;
931ad879127SKrish Sadhukhan 
932ad879127SKrish Sadhukhan     wrmsr(MSR_IA32_TSC_ADJUST, -TSC_ADJUST_VALUE);
933ad879127SKrish Sadhukhan     int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST);
934ad879127SKrish Sadhukhan     ok = adjust == -TSC_ADJUST_VALUE;
935ad879127SKrish Sadhukhan }
936ad879127SKrish Sadhukhan 
937ad879127SKrish Sadhukhan static void tsc_adjust_test(struct svm_test *test)
938ad879127SKrish Sadhukhan {
939ad879127SKrish Sadhukhan     int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST);
940ad879127SKrish Sadhukhan     ok &= adjust == -TSC_ADJUST_VALUE;
941ad879127SKrish Sadhukhan 
942ad879127SKrish Sadhukhan     uint64_t l1_tsc = rdtsc() - TSC_OFFSET_VALUE;
943ad879127SKrish Sadhukhan     wrmsr(MSR_IA32_TSC, l1_tsc - TSC_ADJUST_VALUE);
944ad879127SKrish Sadhukhan 
945ad879127SKrish Sadhukhan     adjust = rdmsr(MSR_IA32_TSC_ADJUST);
946ad879127SKrish Sadhukhan     ok &= adjust <= -2 * TSC_ADJUST_VALUE;
947ad879127SKrish Sadhukhan 
948ad879127SKrish Sadhukhan     uint64_t l1_tsc_end = rdtsc() - TSC_OFFSET_VALUE;
949ad879127SKrish Sadhukhan     ok &= (l1_tsc_end + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE;
950ad879127SKrish Sadhukhan 
951ad879127SKrish Sadhukhan     uint64_t l1_tsc_msr = rdmsr(MSR_IA32_TSC) - TSC_OFFSET_VALUE;
952ad879127SKrish Sadhukhan     ok &= (l1_tsc_msr + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE;
953ad879127SKrish Sadhukhan }
954ad879127SKrish Sadhukhan 
955ad879127SKrish Sadhukhan static bool tsc_adjust_check(struct svm_test *test)
956ad879127SKrish Sadhukhan {
957ad879127SKrish Sadhukhan     int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST);
958ad879127SKrish Sadhukhan 
959ad879127SKrish Sadhukhan     wrmsr(MSR_IA32_TSC_ADJUST, 0);
960ad879127SKrish Sadhukhan     return ok && adjust <= -2 * TSC_ADJUST_VALUE;
961ad879127SKrish Sadhukhan }
962ad879127SKrish Sadhukhan 
963ad879127SKrish Sadhukhan static void latency_prepare(struct svm_test *test)
964ad879127SKrish Sadhukhan {
965ad879127SKrish Sadhukhan     default_prepare(test);
966ad879127SKrish Sadhukhan     runs = LATENCY_RUNS;
967ad879127SKrish Sadhukhan     latvmrun_min = latvmexit_min = -1ULL;
968ad879127SKrish Sadhukhan     latvmrun_max = latvmexit_max = 0;
969ad879127SKrish Sadhukhan     vmrun_sum = vmexit_sum = 0;
970ad879127SKrish Sadhukhan     tsc_start = rdtsc();
971ad879127SKrish Sadhukhan }
972ad879127SKrish Sadhukhan 
973ad879127SKrish Sadhukhan static void latency_test(struct svm_test *test)
974ad879127SKrish Sadhukhan {
975ad879127SKrish Sadhukhan     u64 cycles;
976ad879127SKrish Sadhukhan 
977ad879127SKrish Sadhukhan start:
978ad879127SKrish Sadhukhan     tsc_end = rdtsc();
979ad879127SKrish Sadhukhan 
980ad879127SKrish Sadhukhan     cycles = tsc_end - tsc_start;
981ad879127SKrish Sadhukhan 
982ad879127SKrish Sadhukhan     if (cycles > latvmrun_max)
983ad879127SKrish Sadhukhan         latvmrun_max = cycles;
984ad879127SKrish Sadhukhan 
985ad879127SKrish Sadhukhan     if (cycles < latvmrun_min)
986ad879127SKrish Sadhukhan         latvmrun_min = cycles;
987ad879127SKrish Sadhukhan 
988ad879127SKrish Sadhukhan     vmrun_sum += cycles;
989ad879127SKrish Sadhukhan 
990ad879127SKrish Sadhukhan     tsc_start = rdtsc();
991ad879127SKrish Sadhukhan 
992ad879127SKrish Sadhukhan     asm volatile ("vmmcall" : : : "memory");
993ad879127SKrish Sadhukhan     goto start;
994ad879127SKrish Sadhukhan }
995ad879127SKrish Sadhukhan 
996ad879127SKrish Sadhukhan static bool latency_finished(struct svm_test *test)
997ad879127SKrish Sadhukhan {
998ad879127SKrish Sadhukhan     u64 cycles;
999ad879127SKrish Sadhukhan 
1000ad879127SKrish Sadhukhan     tsc_end = rdtsc();
1001ad879127SKrish Sadhukhan 
1002ad879127SKrish Sadhukhan     cycles = tsc_end - tsc_start;
1003ad879127SKrish Sadhukhan 
1004ad879127SKrish Sadhukhan     if (cycles > latvmexit_max)
1005ad879127SKrish Sadhukhan         latvmexit_max = cycles;
1006ad879127SKrish Sadhukhan 
1007ad879127SKrish Sadhukhan     if (cycles < latvmexit_min)
1008ad879127SKrish Sadhukhan         latvmexit_min = cycles;
1009ad879127SKrish Sadhukhan 
1010ad879127SKrish Sadhukhan     vmexit_sum += cycles;
1011ad879127SKrish Sadhukhan 
1012096cf7feSPaolo Bonzini     vmcb->save.rip += 3;
1013ad879127SKrish Sadhukhan 
1014ad879127SKrish Sadhukhan     runs -= 1;
1015ad879127SKrish Sadhukhan 
1016ad879127SKrish Sadhukhan     tsc_end = rdtsc();
1017ad879127SKrish Sadhukhan 
1018ad879127SKrish Sadhukhan     return runs == 0;
1019ad879127SKrish Sadhukhan }
1020ad879127SKrish Sadhukhan 
1021ad879127SKrish Sadhukhan static bool latency_check(struct svm_test *test)
1022ad879127SKrish Sadhukhan {
1023ad879127SKrish Sadhukhan     printf("    Latency VMRUN : max: %ld min: %ld avg: %ld\n", latvmrun_max,
1024ad879127SKrish Sadhukhan             latvmrun_min, vmrun_sum / LATENCY_RUNS);
1025ad879127SKrish Sadhukhan     printf("    Latency VMEXIT: max: %ld min: %ld avg: %ld\n", latvmexit_max,
1026ad879127SKrish Sadhukhan             latvmexit_min, vmexit_sum / LATENCY_RUNS);
1027ad879127SKrish Sadhukhan     return true;
1028ad879127SKrish Sadhukhan }
1029ad879127SKrish Sadhukhan 
1030ad879127SKrish Sadhukhan static void lat_svm_insn_prepare(struct svm_test *test)
1031ad879127SKrish Sadhukhan {
1032ad879127SKrish Sadhukhan     default_prepare(test);
1033ad879127SKrish Sadhukhan     runs = LATENCY_RUNS;
1034ad879127SKrish Sadhukhan     latvmload_min = latvmsave_min = latstgi_min = latclgi_min = -1ULL;
1035ad879127SKrish Sadhukhan     latvmload_max = latvmsave_max = latstgi_max = latclgi_max = 0;
1036ad879127SKrish Sadhukhan     vmload_sum = vmsave_sum = stgi_sum = clgi_sum;
1037ad879127SKrish Sadhukhan }
1038ad879127SKrish Sadhukhan 
1039ad879127SKrish Sadhukhan static bool lat_svm_insn_finished(struct svm_test *test)
1040ad879127SKrish Sadhukhan {
1041096cf7feSPaolo Bonzini     u64 vmcb_phys = virt_to_phys(vmcb);
1042ad879127SKrish Sadhukhan     u64 cycles;
1043ad879127SKrish Sadhukhan 
1044ad879127SKrish Sadhukhan     for ( ; runs != 0; runs--) {
1045ad879127SKrish Sadhukhan         tsc_start = rdtsc();
1046ad879127SKrish Sadhukhan         asm volatile("vmload %0\n\t" : : "a"(vmcb_phys) : "memory");
1047ad879127SKrish Sadhukhan         cycles = rdtsc() - tsc_start;
1048ad879127SKrish Sadhukhan         if (cycles > latvmload_max)
1049ad879127SKrish Sadhukhan             latvmload_max = cycles;
1050ad879127SKrish Sadhukhan         if (cycles < latvmload_min)
1051ad879127SKrish Sadhukhan             latvmload_min = cycles;
1052ad879127SKrish Sadhukhan         vmload_sum += cycles;
1053ad879127SKrish Sadhukhan 
1054ad879127SKrish Sadhukhan         tsc_start = rdtsc();
1055ad879127SKrish Sadhukhan         asm volatile("vmsave %0\n\t" : : "a"(vmcb_phys) : "memory");
1056ad879127SKrish Sadhukhan         cycles = rdtsc() - tsc_start;
1057ad879127SKrish Sadhukhan         if (cycles > latvmsave_max)
1058ad879127SKrish Sadhukhan             latvmsave_max = cycles;
1059ad879127SKrish Sadhukhan         if (cycles < latvmsave_min)
1060ad879127SKrish Sadhukhan             latvmsave_min = cycles;
1061ad879127SKrish Sadhukhan         vmsave_sum += cycles;
1062ad879127SKrish Sadhukhan 
1063ad879127SKrish Sadhukhan         tsc_start = rdtsc();
1064ad879127SKrish Sadhukhan         asm volatile("stgi\n\t");
1065ad879127SKrish Sadhukhan         cycles = rdtsc() - tsc_start;
1066ad879127SKrish Sadhukhan         if (cycles > latstgi_max)
1067ad879127SKrish Sadhukhan             latstgi_max = cycles;
1068ad879127SKrish Sadhukhan         if (cycles < latstgi_min)
1069ad879127SKrish Sadhukhan             latstgi_min = cycles;
1070ad879127SKrish Sadhukhan         stgi_sum += cycles;
1071ad879127SKrish Sadhukhan 
1072ad879127SKrish Sadhukhan         tsc_start = rdtsc();
1073ad879127SKrish Sadhukhan         asm volatile("clgi\n\t");
1074ad879127SKrish Sadhukhan         cycles = rdtsc() - tsc_start;
1075ad879127SKrish Sadhukhan         if (cycles > latclgi_max)
1076ad879127SKrish Sadhukhan             latclgi_max = cycles;
1077ad879127SKrish Sadhukhan         if (cycles < latclgi_min)
1078ad879127SKrish Sadhukhan             latclgi_min = cycles;
1079ad879127SKrish Sadhukhan         clgi_sum += cycles;
1080ad879127SKrish Sadhukhan     }
1081ad879127SKrish Sadhukhan 
1082ad879127SKrish Sadhukhan     tsc_end = rdtsc();
1083ad879127SKrish Sadhukhan 
1084ad879127SKrish Sadhukhan     return true;
1085ad879127SKrish Sadhukhan }
1086ad879127SKrish Sadhukhan 
1087ad879127SKrish Sadhukhan static bool lat_svm_insn_check(struct svm_test *test)
1088ad879127SKrish Sadhukhan {
1089ad879127SKrish Sadhukhan     printf("    Latency VMLOAD: max: %ld min: %ld avg: %ld\n", latvmload_max,
1090ad879127SKrish Sadhukhan             latvmload_min, vmload_sum / LATENCY_RUNS);
1091ad879127SKrish Sadhukhan     printf("    Latency VMSAVE: max: %ld min: %ld avg: %ld\n", latvmsave_max,
1092ad879127SKrish Sadhukhan             latvmsave_min, vmsave_sum / LATENCY_RUNS);
1093ad879127SKrish Sadhukhan     printf("    Latency STGI:   max: %ld min: %ld avg: %ld\n", latstgi_max,
1094ad879127SKrish Sadhukhan             latstgi_min, stgi_sum / LATENCY_RUNS);
1095ad879127SKrish Sadhukhan     printf("    Latency CLGI:   max: %ld min: %ld avg: %ld\n", latclgi_max,
1096ad879127SKrish Sadhukhan             latclgi_min, clgi_sum / LATENCY_RUNS);
1097ad879127SKrish Sadhukhan     return true;
1098ad879127SKrish Sadhukhan }
1099ad879127SKrish Sadhukhan 
1100ad879127SKrish Sadhukhan bool pending_event_ipi_fired;
1101ad879127SKrish Sadhukhan bool pending_event_guest_run;
1102ad879127SKrish Sadhukhan 
1103ad879127SKrish Sadhukhan static void pending_event_ipi_isr(isr_regs_t *regs)
1104ad879127SKrish Sadhukhan {
1105ad879127SKrish Sadhukhan     pending_event_ipi_fired = true;
1106ad879127SKrish Sadhukhan     eoi();
1107ad879127SKrish Sadhukhan }
1108ad879127SKrish Sadhukhan 
1109ad879127SKrish Sadhukhan static void pending_event_prepare(struct svm_test *test)
1110ad879127SKrish Sadhukhan {
1111ad879127SKrish Sadhukhan     int ipi_vector = 0xf1;
1112ad879127SKrish Sadhukhan 
1113ad879127SKrish Sadhukhan     default_prepare(test);
1114ad879127SKrish Sadhukhan 
1115ad879127SKrish Sadhukhan     pending_event_ipi_fired = false;
1116ad879127SKrish Sadhukhan 
1117ad879127SKrish Sadhukhan     handle_irq(ipi_vector, pending_event_ipi_isr);
1118ad879127SKrish Sadhukhan 
1119ad879127SKrish Sadhukhan     pending_event_guest_run = false;
1120ad879127SKrish Sadhukhan 
1121096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_INTR);
1122096cf7feSPaolo Bonzini     vmcb->control.int_ctl |= V_INTR_MASKING_MASK;
1123ad879127SKrish Sadhukhan 
1124ad879127SKrish Sadhukhan     apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL |
1125ad879127SKrish Sadhukhan                   APIC_DM_FIXED | ipi_vector, 0);
1126ad879127SKrish Sadhukhan 
1127ad879127SKrish Sadhukhan     set_test_stage(test, 0);
1128ad879127SKrish Sadhukhan }
1129ad879127SKrish Sadhukhan 
1130ad879127SKrish Sadhukhan static void pending_event_test(struct svm_test *test)
1131ad879127SKrish Sadhukhan {
1132ad879127SKrish Sadhukhan     pending_event_guest_run = true;
1133ad879127SKrish Sadhukhan }
1134ad879127SKrish Sadhukhan 
1135ad879127SKrish Sadhukhan static bool pending_event_finished(struct svm_test *test)
1136ad879127SKrish Sadhukhan {
1137ad879127SKrish Sadhukhan     switch (get_test_stage(test)) {
1138ad879127SKrish Sadhukhan     case 0:
1139096cf7feSPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_INTR) {
1140ad879127SKrish Sadhukhan             report(false, "VMEXIT not due to pending interrupt. Exit reason 0x%x",
1141096cf7feSPaolo Bonzini                    vmcb->control.exit_code);
1142ad879127SKrish Sadhukhan             return true;
1143ad879127SKrish Sadhukhan         }
1144ad879127SKrish Sadhukhan 
1145096cf7feSPaolo Bonzini         vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR);
1146096cf7feSPaolo Bonzini         vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
1147ad879127SKrish Sadhukhan 
1148ad879127SKrish Sadhukhan         if (pending_event_guest_run) {
1149ad879127SKrish Sadhukhan             report(false, "Guest ran before host received IPI\n");
1150ad879127SKrish Sadhukhan             return true;
1151ad879127SKrish Sadhukhan         }
1152ad879127SKrish Sadhukhan 
1153ad879127SKrish Sadhukhan         irq_enable();
1154ad879127SKrish Sadhukhan         asm volatile ("nop");
1155ad879127SKrish Sadhukhan         irq_disable();
1156ad879127SKrish Sadhukhan 
1157ad879127SKrish Sadhukhan         if (!pending_event_ipi_fired) {
1158ad879127SKrish Sadhukhan             report(false, "Pending interrupt not dispatched after IRQ enabled\n");
1159ad879127SKrish Sadhukhan             return true;
1160ad879127SKrish Sadhukhan         }
1161ad879127SKrish Sadhukhan         break;
1162ad879127SKrish Sadhukhan 
1163ad879127SKrish Sadhukhan     case 1:
1164ad879127SKrish Sadhukhan         if (!pending_event_guest_run) {
1165ad879127SKrish Sadhukhan             report(false, "Guest did not resume when no interrupt\n");
1166ad879127SKrish Sadhukhan             return true;
1167ad879127SKrish Sadhukhan         }
1168ad879127SKrish Sadhukhan         break;
1169ad879127SKrish Sadhukhan     }
1170ad879127SKrish Sadhukhan 
1171ad879127SKrish Sadhukhan     inc_test_stage(test);
1172ad879127SKrish Sadhukhan 
1173ad879127SKrish Sadhukhan     return get_test_stage(test) == 2;
1174ad879127SKrish Sadhukhan }
1175ad879127SKrish Sadhukhan 
1176ad879127SKrish Sadhukhan static bool pending_event_check(struct svm_test *test)
1177ad879127SKrish Sadhukhan {
1178ad879127SKrish Sadhukhan     return get_test_stage(test) == 2;
1179ad879127SKrish Sadhukhan }
1180ad879127SKrish Sadhukhan 
118185dc2aceSPaolo Bonzini static void pending_event_cli_prepare(struct svm_test *test)
1182ad879127SKrish Sadhukhan {
1183ad879127SKrish Sadhukhan     default_prepare(test);
1184ad879127SKrish Sadhukhan 
1185ad879127SKrish Sadhukhan     pending_event_ipi_fired = false;
1186ad879127SKrish Sadhukhan 
1187ad879127SKrish Sadhukhan     handle_irq(0xf1, pending_event_ipi_isr);
1188ad879127SKrish Sadhukhan 
1189ad879127SKrish Sadhukhan     apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL |
1190ad879127SKrish Sadhukhan               APIC_DM_FIXED | 0xf1, 0);
1191ad879127SKrish Sadhukhan 
1192ad879127SKrish Sadhukhan     set_test_stage(test, 0);
1193ad879127SKrish Sadhukhan }
1194ad879127SKrish Sadhukhan 
119585dc2aceSPaolo Bonzini static void pending_event_cli_prepare_gif_clear(struct svm_test *test)
1196ad879127SKrish Sadhukhan {
1197ad879127SKrish Sadhukhan     asm("cli");
1198ad879127SKrish Sadhukhan }
1199ad879127SKrish Sadhukhan 
120085dc2aceSPaolo Bonzini static void pending_event_cli_test(struct svm_test *test)
1201ad879127SKrish Sadhukhan {
1202ad879127SKrish Sadhukhan     if (pending_event_ipi_fired == true) {
1203ad879127SKrish Sadhukhan         set_test_stage(test, -1);
1204ad879127SKrish Sadhukhan         report(false, "Interrupt preceeded guest");
1205ad879127SKrish Sadhukhan         vmmcall();
1206ad879127SKrish Sadhukhan     }
1207ad879127SKrish Sadhukhan 
120885dc2aceSPaolo Bonzini     /* VINTR_MASKING is zero.  This should cause the IPI to fire.  */
1209ad879127SKrish Sadhukhan     irq_enable();
1210ad879127SKrish Sadhukhan     asm volatile ("nop");
1211ad879127SKrish Sadhukhan     irq_disable();
1212ad879127SKrish Sadhukhan 
1213ad879127SKrish Sadhukhan     if (pending_event_ipi_fired != true) {
1214ad879127SKrish Sadhukhan         set_test_stage(test, -1);
1215ad879127SKrish Sadhukhan         report(false, "Interrupt not triggered by guest");
1216ad879127SKrish Sadhukhan     }
1217ad879127SKrish Sadhukhan 
1218ad879127SKrish Sadhukhan     vmmcall();
1219ad879127SKrish Sadhukhan 
122085dc2aceSPaolo Bonzini     /*
122185dc2aceSPaolo Bonzini      * Now VINTR_MASKING=1, but no interrupt is pending so
122285dc2aceSPaolo Bonzini      * the VINTR interception should be clear in VMCB02.  Check
122385dc2aceSPaolo Bonzini      * that L0 did not leave a stale VINTR in the VMCB.
122485dc2aceSPaolo Bonzini      */
1225ad879127SKrish Sadhukhan     irq_enable();
1226ad879127SKrish Sadhukhan     asm volatile ("nop");
1227ad879127SKrish Sadhukhan     irq_disable();
1228ad879127SKrish Sadhukhan }
1229ad879127SKrish Sadhukhan 
123085dc2aceSPaolo Bonzini static bool pending_event_cli_finished(struct svm_test *test)
1231ad879127SKrish Sadhukhan {
1232096cf7feSPaolo Bonzini     if ( vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1233ad879127SKrish Sadhukhan         report(false, "VM_EXIT return to host is not EXIT_VMMCALL exit reason 0x%x",
1234096cf7feSPaolo Bonzini                vmcb->control.exit_code);
1235ad879127SKrish Sadhukhan         return true;
1236ad879127SKrish Sadhukhan     }
1237ad879127SKrish Sadhukhan 
1238ad879127SKrish Sadhukhan     switch (get_test_stage(test)) {
1239ad879127SKrish Sadhukhan     case 0:
1240096cf7feSPaolo Bonzini         vmcb->save.rip += 3;
1241ad879127SKrish Sadhukhan 
1242ad879127SKrish Sadhukhan         pending_event_ipi_fired = false;
1243ad879127SKrish Sadhukhan 
1244096cf7feSPaolo Bonzini         vmcb->control.int_ctl |= V_INTR_MASKING_MASK;
1245ad879127SKrish Sadhukhan 
124685dc2aceSPaolo Bonzini 	/* Now entering again with VINTR_MASKING=1.  */
1247ad879127SKrish Sadhukhan         apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL |
1248ad879127SKrish Sadhukhan               APIC_DM_FIXED | 0xf1, 0);
1249ad879127SKrish Sadhukhan 
1250ad879127SKrish Sadhukhan         break;
1251ad879127SKrish Sadhukhan 
1252ad879127SKrish Sadhukhan     case 1:
1253ad879127SKrish Sadhukhan         if (pending_event_ipi_fired == true) {
1254ad879127SKrish Sadhukhan             report(false, "Interrupt triggered by guest");
1255ad879127SKrish Sadhukhan             return true;
1256ad879127SKrish Sadhukhan         }
1257ad879127SKrish Sadhukhan 
1258ad879127SKrish Sadhukhan         irq_enable();
1259ad879127SKrish Sadhukhan         asm volatile ("nop");
1260ad879127SKrish Sadhukhan         irq_disable();
1261ad879127SKrish Sadhukhan 
1262ad879127SKrish Sadhukhan         if (pending_event_ipi_fired != true) {
1263ad879127SKrish Sadhukhan             report(false, "Interrupt not triggered by host");
1264ad879127SKrish Sadhukhan             return true;
1265ad879127SKrish Sadhukhan         }
1266ad879127SKrish Sadhukhan 
1267ad879127SKrish Sadhukhan         break;
1268ad879127SKrish Sadhukhan 
1269ad879127SKrish Sadhukhan     default:
1270ad879127SKrish Sadhukhan         return true;
1271ad879127SKrish Sadhukhan     }
1272ad879127SKrish Sadhukhan 
1273ad879127SKrish Sadhukhan     inc_test_stage(test);
1274ad879127SKrish Sadhukhan 
1275ad879127SKrish Sadhukhan     return get_test_stage(test) == 2;
1276ad879127SKrish Sadhukhan }
1277ad879127SKrish Sadhukhan 
127885dc2aceSPaolo Bonzini static bool pending_event_cli_check(struct svm_test *test)
1279ad879127SKrish Sadhukhan {
1280ad879127SKrish Sadhukhan     return get_test_stage(test) == 2;
1281ad879127SKrish Sadhukhan }
1282ad879127SKrish Sadhukhan 
128385dc2aceSPaolo Bonzini #define TIMER_VECTOR    222
128485dc2aceSPaolo Bonzini 
128585dc2aceSPaolo Bonzini static volatile bool timer_fired;
128685dc2aceSPaolo Bonzini 
128785dc2aceSPaolo Bonzini static void timer_isr(isr_regs_t *regs)
128885dc2aceSPaolo Bonzini {
128985dc2aceSPaolo Bonzini     timer_fired = true;
129085dc2aceSPaolo Bonzini     apic_write(APIC_EOI, 0);
129185dc2aceSPaolo Bonzini }
129285dc2aceSPaolo Bonzini 
129385dc2aceSPaolo Bonzini static void interrupt_prepare(struct svm_test *test)
129485dc2aceSPaolo Bonzini {
129585dc2aceSPaolo Bonzini     default_prepare(test);
129685dc2aceSPaolo Bonzini     handle_irq(TIMER_VECTOR, timer_isr);
129785dc2aceSPaolo Bonzini     timer_fired = false;
129885dc2aceSPaolo Bonzini     set_test_stage(test, 0);
129985dc2aceSPaolo Bonzini }
130085dc2aceSPaolo Bonzini 
130185dc2aceSPaolo Bonzini static void interrupt_test(struct svm_test *test)
130285dc2aceSPaolo Bonzini {
130385dc2aceSPaolo Bonzini     long long start, loops;
130485dc2aceSPaolo Bonzini 
130585dc2aceSPaolo Bonzini     apic_write(APIC_LVTT, TIMER_VECTOR);
130685dc2aceSPaolo Bonzini     irq_enable();
130785dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 1); //Timer Initial Count Register 0x380 one-shot
130885dc2aceSPaolo Bonzini     for (loops = 0; loops < 10000000 && !timer_fired; loops++)
130985dc2aceSPaolo Bonzini         asm volatile ("nop");
131085dc2aceSPaolo Bonzini 
131185dc2aceSPaolo Bonzini     report(timer_fired, "direct interrupt while running guest");
131285dc2aceSPaolo Bonzini 
131385dc2aceSPaolo Bonzini     if (!timer_fired) {
131485dc2aceSPaolo Bonzini         set_test_stage(test, -1);
131585dc2aceSPaolo Bonzini         vmmcall();
131685dc2aceSPaolo Bonzini     }
131785dc2aceSPaolo Bonzini 
131885dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 0);
131985dc2aceSPaolo Bonzini     irq_disable();
132085dc2aceSPaolo Bonzini     vmmcall();
132185dc2aceSPaolo Bonzini 
132285dc2aceSPaolo Bonzini     timer_fired = false;
132385dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 1);
132485dc2aceSPaolo Bonzini     for (loops = 0; loops < 10000000 && !timer_fired; loops++)
132585dc2aceSPaolo Bonzini         asm volatile ("nop");
132685dc2aceSPaolo Bonzini 
132785dc2aceSPaolo Bonzini     report(timer_fired, "intercepted interrupt while running guest");
132885dc2aceSPaolo Bonzini 
132985dc2aceSPaolo Bonzini     if (!timer_fired) {
133085dc2aceSPaolo Bonzini         set_test_stage(test, -1);
133185dc2aceSPaolo Bonzini         vmmcall();
133285dc2aceSPaolo Bonzini     }
133385dc2aceSPaolo Bonzini 
133485dc2aceSPaolo Bonzini     irq_enable();
133585dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 0);
133685dc2aceSPaolo Bonzini     irq_disable();
133785dc2aceSPaolo Bonzini 
133885dc2aceSPaolo Bonzini     timer_fired = false;
133985dc2aceSPaolo Bonzini     start = rdtsc();
134085dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 1000000);
134185dc2aceSPaolo Bonzini     asm volatile ("sti; hlt");
134285dc2aceSPaolo Bonzini 
134385dc2aceSPaolo Bonzini     report(rdtsc() - start > 10000 && timer_fired,
134485dc2aceSPaolo Bonzini           "direct interrupt + hlt");
134585dc2aceSPaolo Bonzini 
134685dc2aceSPaolo Bonzini     if (!timer_fired) {
134785dc2aceSPaolo Bonzini         set_test_stage(test, -1);
134885dc2aceSPaolo Bonzini         vmmcall();
134985dc2aceSPaolo Bonzini     }
135085dc2aceSPaolo Bonzini 
135185dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 0);
135285dc2aceSPaolo Bonzini     irq_disable();
135385dc2aceSPaolo Bonzini     vmmcall();
135485dc2aceSPaolo Bonzini 
135585dc2aceSPaolo Bonzini     timer_fired = false;
135685dc2aceSPaolo Bonzini     start = rdtsc();
135785dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 1000000);
135885dc2aceSPaolo Bonzini     asm volatile ("hlt");
135985dc2aceSPaolo Bonzini 
136085dc2aceSPaolo Bonzini     report(rdtsc() - start > 10000 && timer_fired,
136185dc2aceSPaolo Bonzini            "intercepted interrupt + hlt");
136285dc2aceSPaolo Bonzini 
136385dc2aceSPaolo Bonzini     if (!timer_fired) {
136485dc2aceSPaolo Bonzini         set_test_stage(test, -1);
136585dc2aceSPaolo Bonzini         vmmcall();
136685dc2aceSPaolo Bonzini     }
136785dc2aceSPaolo Bonzini 
136885dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 0);
136985dc2aceSPaolo Bonzini     irq_disable();
137085dc2aceSPaolo Bonzini }
137185dc2aceSPaolo Bonzini 
137285dc2aceSPaolo Bonzini static bool interrupt_finished(struct svm_test *test)
137385dc2aceSPaolo Bonzini {
137485dc2aceSPaolo Bonzini     switch (get_test_stage(test)) {
137585dc2aceSPaolo Bonzini     case 0:
137685dc2aceSPaolo Bonzini     case 2:
1377096cf7feSPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
137885dc2aceSPaolo Bonzini             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
1379096cf7feSPaolo Bonzini                    vmcb->control.exit_code);
138085dc2aceSPaolo Bonzini             return true;
138185dc2aceSPaolo Bonzini         }
1382096cf7feSPaolo Bonzini         vmcb->save.rip += 3;
138385dc2aceSPaolo Bonzini 
1384096cf7feSPaolo Bonzini         vmcb->control.intercept |= (1ULL << INTERCEPT_INTR);
1385096cf7feSPaolo Bonzini         vmcb->control.int_ctl |= V_INTR_MASKING_MASK;
138685dc2aceSPaolo Bonzini         break;
138785dc2aceSPaolo Bonzini 
138885dc2aceSPaolo Bonzini     case 1:
138985dc2aceSPaolo Bonzini     case 3:
1390096cf7feSPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_INTR) {
139185dc2aceSPaolo Bonzini             report(false, "VMEXIT not due to intr intercept. Exit reason 0x%x",
1392096cf7feSPaolo Bonzini                    vmcb->control.exit_code);
139385dc2aceSPaolo Bonzini             return true;
139485dc2aceSPaolo Bonzini         }
139585dc2aceSPaolo Bonzini 
139685dc2aceSPaolo Bonzini         irq_enable();
139785dc2aceSPaolo Bonzini         asm volatile ("nop");
139885dc2aceSPaolo Bonzini         irq_disable();
139985dc2aceSPaolo Bonzini 
1400096cf7feSPaolo Bonzini         vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR);
1401096cf7feSPaolo Bonzini         vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
140285dc2aceSPaolo Bonzini         break;
140385dc2aceSPaolo Bonzini 
140485dc2aceSPaolo Bonzini     case 4:
140585dc2aceSPaolo Bonzini         break;
140685dc2aceSPaolo Bonzini 
140785dc2aceSPaolo Bonzini     default:
140885dc2aceSPaolo Bonzini         return true;
140985dc2aceSPaolo Bonzini     }
141085dc2aceSPaolo Bonzini 
141185dc2aceSPaolo Bonzini     inc_test_stage(test);
141285dc2aceSPaolo Bonzini 
141385dc2aceSPaolo Bonzini     return get_test_stage(test) == 5;
141485dc2aceSPaolo Bonzini }
141585dc2aceSPaolo Bonzini 
141685dc2aceSPaolo Bonzini static bool interrupt_check(struct svm_test *test)
141785dc2aceSPaolo Bonzini {
141885dc2aceSPaolo Bonzini     return get_test_stage(test) == 5;
141985dc2aceSPaolo Bonzini }
142085dc2aceSPaolo Bonzini 
1421d4db486bSCathy Avery static volatile bool nmi_fired;
1422d4db486bSCathy Avery 
1423d4db486bSCathy Avery static void nmi_handler(isr_regs_t *regs)
1424d4db486bSCathy Avery {
1425d4db486bSCathy Avery     nmi_fired = true;
1426d4db486bSCathy Avery     apic_write(APIC_EOI, 0);
1427d4db486bSCathy Avery }
1428d4db486bSCathy Avery 
1429d4db486bSCathy Avery static void nmi_prepare(struct svm_test *test)
1430d4db486bSCathy Avery {
1431d4db486bSCathy Avery     default_prepare(test);
1432d4db486bSCathy Avery     nmi_fired = false;
1433d4db486bSCathy Avery     handle_irq(NMI_VECTOR, nmi_handler);
1434d4db486bSCathy Avery     set_test_stage(test, 0);
1435d4db486bSCathy Avery }
1436d4db486bSCathy Avery 
1437d4db486bSCathy Avery static void nmi_test(struct svm_test *test)
1438d4db486bSCathy Avery {
1439d4db486bSCathy Avery     apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0);
1440d4db486bSCathy Avery 
1441d4db486bSCathy Avery     report(nmi_fired, "direct NMI while running guest");
1442d4db486bSCathy Avery 
1443d4db486bSCathy Avery     if (!nmi_fired)
1444d4db486bSCathy Avery         set_test_stage(test, -1);
1445d4db486bSCathy Avery 
1446d4db486bSCathy Avery     vmmcall();
1447d4db486bSCathy Avery 
1448d4db486bSCathy Avery     nmi_fired = false;
1449d4db486bSCathy Avery 
1450d4db486bSCathy Avery     apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0);
1451d4db486bSCathy Avery 
1452d4db486bSCathy Avery     if (!nmi_fired) {
1453d4db486bSCathy Avery         report(nmi_fired, "intercepted pending NMI not dispatched");
1454d4db486bSCathy Avery         set_test_stage(test, -1);
1455d4db486bSCathy Avery     }
1456d4db486bSCathy Avery 
1457d4db486bSCathy Avery }
1458d4db486bSCathy Avery 
1459d4db486bSCathy Avery static bool nmi_finished(struct svm_test *test)
1460d4db486bSCathy Avery {
1461d4db486bSCathy Avery     switch (get_test_stage(test)) {
1462d4db486bSCathy Avery     case 0:
1463d4db486bSCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1464d4db486bSCathy Avery             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
1465d4db486bSCathy Avery                    vmcb->control.exit_code);
1466d4db486bSCathy Avery             return true;
1467d4db486bSCathy Avery         }
1468d4db486bSCathy Avery         vmcb->save.rip += 3;
1469d4db486bSCathy Avery 
1470d4db486bSCathy Avery         vmcb->control.intercept |= (1ULL << INTERCEPT_NMI);
1471d4db486bSCathy Avery         break;
1472d4db486bSCathy Avery 
1473d4db486bSCathy Avery     case 1:
1474d4db486bSCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_NMI) {
1475d4db486bSCathy Avery             report(false, "VMEXIT not due to NMI intercept. Exit reason 0x%x",
1476d4db486bSCathy Avery                    vmcb->control.exit_code);
1477d4db486bSCathy Avery             return true;
1478d4db486bSCathy Avery         }
1479d4db486bSCathy Avery 
1480d4db486bSCathy Avery         report(true, "NMI intercept while running guest");
1481d4db486bSCathy Avery         break;
1482d4db486bSCathy Avery 
1483d4db486bSCathy Avery     case 2:
1484d4db486bSCathy Avery         break;
1485d4db486bSCathy Avery 
1486d4db486bSCathy Avery     default:
1487d4db486bSCathy Avery         return true;
1488d4db486bSCathy Avery     }
1489d4db486bSCathy Avery 
1490d4db486bSCathy Avery     inc_test_stage(test);
1491d4db486bSCathy Avery 
1492d4db486bSCathy Avery     return get_test_stage(test) == 3;
1493d4db486bSCathy Avery }
1494d4db486bSCathy Avery 
1495d4db486bSCathy Avery static bool nmi_check(struct svm_test *test)
1496d4db486bSCathy Avery {
1497d4db486bSCathy Avery     return get_test_stage(test) == 3;
1498d4db486bSCathy Avery }
1499d4db486bSCathy Avery 
15009da1f4d8SCathy Avery #define NMI_DELAY 100000000ULL
15019da1f4d8SCathy Avery 
15029da1f4d8SCathy Avery static void nmi_message_thread(void *_test)
15039da1f4d8SCathy Avery {
15049da1f4d8SCathy Avery     struct svm_test *test = _test;
15059da1f4d8SCathy Avery 
15069da1f4d8SCathy Avery     while (get_test_stage(test) != 1)
15079da1f4d8SCathy Avery         pause();
15089da1f4d8SCathy Avery 
15099da1f4d8SCathy Avery     delay(NMI_DELAY);
15109da1f4d8SCathy Avery 
15119da1f4d8SCathy Avery     apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]);
15129da1f4d8SCathy Avery 
15139da1f4d8SCathy Avery     while (get_test_stage(test) != 2)
15149da1f4d8SCathy Avery         pause();
15159da1f4d8SCathy Avery 
15169da1f4d8SCathy Avery     delay(NMI_DELAY);
15179da1f4d8SCathy Avery 
15189da1f4d8SCathy Avery     apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]);
15199da1f4d8SCathy Avery }
15209da1f4d8SCathy Avery 
15219da1f4d8SCathy Avery static void nmi_hlt_test(struct svm_test *test)
15229da1f4d8SCathy Avery {
15239da1f4d8SCathy Avery     long long start;
15249da1f4d8SCathy Avery 
15259da1f4d8SCathy Avery     on_cpu_async(1, nmi_message_thread, test);
15269da1f4d8SCathy Avery 
15279da1f4d8SCathy Avery     start = rdtsc();
15289da1f4d8SCathy Avery 
15299da1f4d8SCathy Avery     set_test_stage(test, 1);
15309da1f4d8SCathy Avery 
15319da1f4d8SCathy Avery     asm volatile ("hlt");
15329da1f4d8SCathy Avery 
15339da1f4d8SCathy Avery     report((rdtsc() - start > NMI_DELAY) && nmi_fired,
15349da1f4d8SCathy Avery           "direct NMI + hlt");
15359da1f4d8SCathy Avery 
15369da1f4d8SCathy Avery     if (!nmi_fired)
15379da1f4d8SCathy Avery         set_test_stage(test, -1);
15389da1f4d8SCathy Avery 
15399da1f4d8SCathy Avery     nmi_fired = false;
15409da1f4d8SCathy Avery 
15419da1f4d8SCathy Avery     vmmcall();
15429da1f4d8SCathy Avery 
15439da1f4d8SCathy Avery     start = rdtsc();
15449da1f4d8SCathy Avery 
15459da1f4d8SCathy Avery     set_test_stage(test, 2);
15469da1f4d8SCathy Avery 
15479da1f4d8SCathy Avery     asm volatile ("hlt");
15489da1f4d8SCathy Avery 
15499da1f4d8SCathy Avery     report((rdtsc() - start > NMI_DELAY) && nmi_fired,
15509da1f4d8SCathy Avery            "intercepted NMI + hlt");
15519da1f4d8SCathy Avery 
15529da1f4d8SCathy Avery     if (!nmi_fired) {
15539da1f4d8SCathy Avery         report(nmi_fired, "intercepted pending NMI not dispatched");
15549da1f4d8SCathy Avery         set_test_stage(test, -1);
15557e7d9357SCathy Avery         vmmcall();
15569da1f4d8SCathy Avery     }
15579da1f4d8SCathy Avery 
15589da1f4d8SCathy Avery     set_test_stage(test, 3);
15599da1f4d8SCathy Avery }
15609da1f4d8SCathy Avery 
15619da1f4d8SCathy Avery static bool nmi_hlt_finished(struct svm_test *test)
15629da1f4d8SCathy Avery {
15639da1f4d8SCathy Avery     switch (get_test_stage(test)) {
15649da1f4d8SCathy Avery     case 1:
15659da1f4d8SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
15669da1f4d8SCathy Avery             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
15679da1f4d8SCathy Avery                    vmcb->control.exit_code);
15689da1f4d8SCathy Avery             return true;
15699da1f4d8SCathy Avery         }
15709da1f4d8SCathy Avery         vmcb->save.rip += 3;
15719da1f4d8SCathy Avery 
15729da1f4d8SCathy Avery         vmcb->control.intercept |= (1ULL << INTERCEPT_NMI);
15739da1f4d8SCathy Avery         break;
15749da1f4d8SCathy Avery 
15759da1f4d8SCathy Avery     case 2:
15769da1f4d8SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_NMI) {
15779da1f4d8SCathy Avery             report(false, "VMEXIT not due to NMI intercept. Exit reason 0x%x",
15789da1f4d8SCathy Avery                    vmcb->control.exit_code);
15799da1f4d8SCathy Avery             return true;
15809da1f4d8SCathy Avery         }
15819da1f4d8SCathy Avery 
15829da1f4d8SCathy Avery         report(true, "NMI intercept while running guest");
15839da1f4d8SCathy Avery         break;
15849da1f4d8SCathy Avery 
15859da1f4d8SCathy Avery     case 3:
15869da1f4d8SCathy Avery         break;
15879da1f4d8SCathy Avery 
15889da1f4d8SCathy Avery     default:
15899da1f4d8SCathy Avery         return true;
15909da1f4d8SCathy Avery     }
15919da1f4d8SCathy Avery 
15929da1f4d8SCathy Avery     return get_test_stage(test) == 3;
15939da1f4d8SCathy Avery }
15949da1f4d8SCathy Avery 
15959da1f4d8SCathy Avery static bool nmi_hlt_check(struct svm_test *test)
15969da1f4d8SCathy Avery {
15979da1f4d8SCathy Avery     return get_test_stage(test) == 3;
15989da1f4d8SCathy Avery }
15999da1f4d8SCathy Avery 
16004b4fb247SPaolo Bonzini static volatile int count_exc = 0;
16014b4fb247SPaolo Bonzini 
16024b4fb247SPaolo Bonzini static void my_isr(struct ex_regs *r)
16034b4fb247SPaolo Bonzini {
16044b4fb247SPaolo Bonzini         count_exc++;
16054b4fb247SPaolo Bonzini }
16064b4fb247SPaolo Bonzini 
16074b4fb247SPaolo Bonzini static void exc_inject_prepare(struct svm_test *test)
16084b4fb247SPaolo Bonzini {
16098634a266SPaolo Bonzini     default_prepare(test);
16104b4fb247SPaolo Bonzini     handle_exception(DE_VECTOR, my_isr);
16114b4fb247SPaolo Bonzini     handle_exception(NMI_VECTOR, my_isr);
16124b4fb247SPaolo Bonzini }
16134b4fb247SPaolo Bonzini 
16144b4fb247SPaolo Bonzini 
16154b4fb247SPaolo Bonzini static void exc_inject_test(struct svm_test *test)
16164b4fb247SPaolo Bonzini {
16174b4fb247SPaolo Bonzini     asm volatile ("vmmcall\n\tvmmcall\n\t");
16184b4fb247SPaolo Bonzini }
16194b4fb247SPaolo Bonzini 
16204b4fb247SPaolo Bonzini static bool exc_inject_finished(struct svm_test *test)
16214b4fb247SPaolo Bonzini {
16224b4fb247SPaolo Bonzini     switch (get_test_stage(test)) {
16234b4fb247SPaolo Bonzini     case 0:
16244b4fb247SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
16254b4fb247SPaolo Bonzini             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
16264b4fb247SPaolo Bonzini                    vmcb->control.exit_code);
16274b4fb247SPaolo Bonzini             return true;
16284b4fb247SPaolo Bonzini         }
16292c1ca866SNadav Amit         vmcb->save.rip += 3;
16304b4fb247SPaolo Bonzini         vmcb->control.event_inj = NMI_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID;
16314b4fb247SPaolo Bonzini         break;
16324b4fb247SPaolo Bonzini 
16334b4fb247SPaolo Bonzini     case 1:
16344b4fb247SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_ERR) {
16354b4fb247SPaolo Bonzini             report(false, "VMEXIT not due to error. Exit reason 0x%x",
16364b4fb247SPaolo Bonzini                    vmcb->control.exit_code);
16374b4fb247SPaolo Bonzini             return true;
16384b4fb247SPaolo Bonzini         }
16394b4fb247SPaolo Bonzini         report(count_exc == 0, "exception with vector 2 not injected");
16404b4fb247SPaolo Bonzini         vmcb->control.event_inj = DE_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID;
16414b4fb247SPaolo Bonzini         break;
16424b4fb247SPaolo Bonzini 
16434b4fb247SPaolo Bonzini     case 2:
16444b4fb247SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
16454b4fb247SPaolo Bonzini             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
16464b4fb247SPaolo Bonzini                    vmcb->control.exit_code);
16474b4fb247SPaolo Bonzini             return true;
16484b4fb247SPaolo Bonzini         }
16492c1ca866SNadav Amit         vmcb->save.rip += 3;
16504b4fb247SPaolo Bonzini         report(count_exc == 1, "divide overflow exception injected");
16514b4fb247SPaolo Bonzini         report(!(vmcb->control.event_inj & SVM_EVTINJ_VALID), "eventinj.VALID cleared");
16524b4fb247SPaolo Bonzini         break;
16534b4fb247SPaolo Bonzini 
16544b4fb247SPaolo Bonzini     default:
16554b4fb247SPaolo Bonzini         return true;
16564b4fb247SPaolo Bonzini     }
16574b4fb247SPaolo Bonzini 
16584b4fb247SPaolo Bonzini     inc_test_stage(test);
16594b4fb247SPaolo Bonzini 
16604b4fb247SPaolo Bonzini     return get_test_stage(test) == 3;
16614b4fb247SPaolo Bonzini }
16624b4fb247SPaolo Bonzini 
16634b4fb247SPaolo Bonzini static bool exc_inject_check(struct svm_test *test)
16644b4fb247SPaolo Bonzini {
16654b4fb247SPaolo Bonzini     return count_exc == 1 && get_test_stage(test) == 3;
16664b4fb247SPaolo Bonzini }
16674b4fb247SPaolo Bonzini 
16689c838954SCathy Avery static volatile bool virq_fired;
16699c838954SCathy Avery 
16709c838954SCathy Avery static void virq_isr(isr_regs_t *regs)
16719c838954SCathy Avery {
16729c838954SCathy Avery     virq_fired = true;
16739c838954SCathy Avery }
16749c838954SCathy Avery 
16759c838954SCathy Avery static void virq_inject_prepare(struct svm_test *test)
16769c838954SCathy Avery {
16779c838954SCathy Avery     handle_irq(0xf1, virq_isr);
16789c838954SCathy Avery     default_prepare(test);
16799c838954SCathy Avery     vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
16809c838954SCathy Avery                             (0x0f << V_INTR_PRIO_SHIFT); // Set to the highest priority
16819c838954SCathy Avery     vmcb->control.int_vector = 0xf1;
16829c838954SCathy Avery     virq_fired = false;
16839c838954SCathy Avery     set_test_stage(test, 0);
16849c838954SCathy Avery }
16859c838954SCathy Avery 
16869c838954SCathy Avery static void virq_inject_test(struct svm_test *test)
16879c838954SCathy Avery {
16889c838954SCathy Avery     if (virq_fired) {
16899c838954SCathy Avery         report(false, "virtual interrupt fired before L2 sti");
16909c838954SCathy Avery         set_test_stage(test, -1);
16919c838954SCathy Avery         vmmcall();
16929c838954SCathy Avery     }
16939c838954SCathy Avery 
16949c838954SCathy Avery     irq_enable();
16959c838954SCathy Avery     asm volatile ("nop");
16969c838954SCathy Avery     irq_disable();
16979c838954SCathy Avery 
16989c838954SCathy Avery     if (!virq_fired) {
16999c838954SCathy Avery         report(false, "virtual interrupt not fired after L2 sti");
17009c838954SCathy Avery         set_test_stage(test, -1);
17019c838954SCathy Avery     }
17029c838954SCathy Avery 
17039c838954SCathy Avery     vmmcall();
17049c838954SCathy Avery 
17059c838954SCathy Avery     if (virq_fired) {
17069c838954SCathy Avery         report(false, "virtual interrupt fired before L2 sti after VINTR intercept");
17079c838954SCathy Avery         set_test_stage(test, -1);
17089c838954SCathy Avery         vmmcall();
17099c838954SCathy Avery     }
17109c838954SCathy Avery 
17119c838954SCathy Avery     irq_enable();
17129c838954SCathy Avery     asm volatile ("nop");
17139c838954SCathy Avery     irq_disable();
17149c838954SCathy Avery 
17159c838954SCathy Avery     if (!virq_fired) {
17169c838954SCathy Avery         report(false, "virtual interrupt not fired after return from VINTR intercept");
17179c838954SCathy Avery         set_test_stage(test, -1);
17189c838954SCathy Avery     }
17199c838954SCathy Avery 
17209c838954SCathy Avery     vmmcall();
17219c838954SCathy Avery 
17229c838954SCathy Avery     irq_enable();
17239c838954SCathy Avery     asm volatile ("nop");
17249c838954SCathy Avery     irq_disable();
17259c838954SCathy Avery 
17269c838954SCathy Avery     if (virq_fired) {
17279c838954SCathy Avery         report(false, "virtual interrupt fired when V_IRQ_PRIO less than V_TPR");
17289c838954SCathy Avery         set_test_stage(test, -1);
17299c838954SCathy Avery     }
17309c838954SCathy Avery 
17319c838954SCathy Avery     vmmcall();
17329c838954SCathy Avery     vmmcall();
17339c838954SCathy Avery }
17349c838954SCathy Avery 
17359c838954SCathy Avery static bool virq_inject_finished(struct svm_test *test)
17369c838954SCathy Avery {
17379c838954SCathy Avery     vmcb->save.rip += 3;
17389c838954SCathy Avery 
17399c838954SCathy Avery     switch (get_test_stage(test)) {
17409c838954SCathy Avery     case 0:
17419c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
17429c838954SCathy Avery             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
17439c838954SCathy Avery                    vmcb->control.exit_code);
17449c838954SCathy Avery             return true;
17459c838954SCathy Avery         }
17469c838954SCathy Avery         if (vmcb->control.int_ctl & V_IRQ_MASK) {
17479c838954SCathy Avery             report(false, "V_IRQ not cleared on VMEXIT after firing");
17489c838954SCathy Avery             return true;
17499c838954SCathy Avery         }
17509c838954SCathy Avery         virq_fired = false;
17519c838954SCathy Avery         vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
17529c838954SCathy Avery         vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
17539c838954SCathy Avery                             (0x0f << V_INTR_PRIO_SHIFT);
17549c838954SCathy Avery         break;
17559c838954SCathy Avery 
17569c838954SCathy Avery     case 1:
17579c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VINTR) {
17589c838954SCathy Avery             report(false, "VMEXIT not due to vintr. Exit reason 0x%x",
17599c838954SCathy Avery                    vmcb->control.exit_code);
17609c838954SCathy Avery             return true;
17619c838954SCathy Avery         }
17629c838954SCathy Avery         if (virq_fired) {
17639c838954SCathy Avery             report(false, "V_IRQ fired before SVM_EXIT_VINTR");
17649c838954SCathy Avery             return true;
17659c838954SCathy Avery         }
17669c838954SCathy Avery         vmcb->control.intercept &= ~(1ULL << INTERCEPT_VINTR);
17679c838954SCathy Avery         break;
17689c838954SCathy Avery 
17699c838954SCathy Avery     case 2:
17709c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
17719c838954SCathy Avery             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
17729c838954SCathy Avery                    vmcb->control.exit_code);
17739c838954SCathy Avery             return true;
17749c838954SCathy Avery         }
17759c838954SCathy Avery         virq_fired = false;
17769c838954SCathy Avery         // Set irq to lower priority
17779c838954SCathy Avery         vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
17789c838954SCathy Avery                             (0x08 << V_INTR_PRIO_SHIFT);
17799c838954SCathy Avery         // Raise guest TPR
17809c838954SCathy Avery         vmcb->control.int_ctl |= 0x0a & V_TPR_MASK;
17819c838954SCathy Avery         break;
17829c838954SCathy Avery 
17839c838954SCathy Avery     case 3:
17849c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
17859c838954SCathy Avery             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
17869c838954SCathy Avery                    vmcb->control.exit_code);
17879c838954SCathy Avery             return true;
17889c838954SCathy Avery         }
17899c838954SCathy Avery         vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
17909c838954SCathy Avery         break;
17919c838954SCathy Avery 
17929c838954SCathy Avery     case 4:
17939c838954SCathy Avery         // INTERCEPT_VINTR should be ignored because V_INTR_PRIO < V_TPR
17949c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
17959c838954SCathy Avery             report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
17969c838954SCathy Avery                    vmcb->control.exit_code);
17979c838954SCathy Avery             return true;
17989c838954SCathy Avery         }
17999c838954SCathy Avery         break;
18009c838954SCathy Avery 
18019c838954SCathy Avery     default:
18029c838954SCathy Avery         return true;
18039c838954SCathy Avery     }
18049c838954SCathy Avery 
18059c838954SCathy Avery     inc_test_stage(test);
18069c838954SCathy Avery 
18079c838954SCathy Avery     return get_test_stage(test) == 5;
18089c838954SCathy Avery }
18099c838954SCathy Avery 
18109c838954SCathy Avery static bool virq_inject_check(struct svm_test *test)
18119c838954SCathy Avery {
18129c838954SCathy Avery     return get_test_stage(test) == 5;
18139c838954SCathy Avery }
18149c838954SCathy Avery 
1815da338a31SMaxim Levitsky /*
1816da338a31SMaxim Levitsky  * Detect nested guest RIP corruption as explained in kernel commit
1817da338a31SMaxim Levitsky  * b6162e82aef19fee9c32cb3fe9ac30d9116a8c73
1818da338a31SMaxim Levitsky  *
1819da338a31SMaxim Levitsky  * In the assembly loop below 'ins' is executed while IO instructions
1820da338a31SMaxim Levitsky  * are not intercepted; the instruction is emulated by L0.
1821da338a31SMaxim Levitsky  *
1822da338a31SMaxim Levitsky  * At the same time we are getting interrupts from the local APIC timer,
1823da338a31SMaxim Levitsky  * and we do intercept them in L1
1824da338a31SMaxim Levitsky  *
1825da338a31SMaxim Levitsky  * If the interrupt happens on the insb instruction, L0 will VMexit, emulate
1826da338a31SMaxim Levitsky  * the insb instruction and then it will inject the interrupt to L1 through
1827da338a31SMaxim Levitsky  * a nested VMexit.  Due to a bug, it would leave pre-emulation values of RIP,
1828da338a31SMaxim Levitsky  * RAX and RSP in the VMCB.
1829da338a31SMaxim Levitsky  *
1830da338a31SMaxim Levitsky  * In our intercept handler we detect the bug by checking that RIP is that of
1831da338a31SMaxim Levitsky  * the insb instruction, but its memory operand has already been written.
1832da338a31SMaxim Levitsky  * This means that insb was already executed.
1833da338a31SMaxim Levitsky  */
1834da338a31SMaxim Levitsky 
1835da338a31SMaxim Levitsky static volatile int isr_cnt = 0;
1836da338a31SMaxim Levitsky static volatile uint8_t io_port_var = 0xAA;
1837da338a31SMaxim Levitsky extern const char insb_instruction_label[];
1838da338a31SMaxim Levitsky 
1839da338a31SMaxim Levitsky static void reg_corruption_isr(isr_regs_t *regs)
1840da338a31SMaxim Levitsky {
1841da338a31SMaxim Levitsky     isr_cnt++;
1842da338a31SMaxim Levitsky     apic_write(APIC_EOI, 0);
1843da338a31SMaxim Levitsky }
1844da338a31SMaxim Levitsky 
1845da338a31SMaxim Levitsky static void reg_corruption_prepare(struct svm_test *test)
1846da338a31SMaxim Levitsky {
1847da338a31SMaxim Levitsky     default_prepare(test);
1848da338a31SMaxim Levitsky     set_test_stage(test, 0);
1849da338a31SMaxim Levitsky 
1850da338a31SMaxim Levitsky     vmcb->control.int_ctl = V_INTR_MASKING_MASK;
1851da338a31SMaxim Levitsky     vmcb->control.intercept |= (1ULL << INTERCEPT_INTR);
1852da338a31SMaxim Levitsky 
1853da338a31SMaxim Levitsky     handle_irq(TIMER_VECTOR, reg_corruption_isr);
1854da338a31SMaxim Levitsky 
1855da338a31SMaxim Levitsky     /* set local APIC to inject external interrupts */
1856da338a31SMaxim Levitsky     apic_write(APIC_TMICT, 0);
1857da338a31SMaxim Levitsky     apic_write(APIC_TDCR, 0);
1858da338a31SMaxim Levitsky     apic_write(APIC_LVTT, TIMER_VECTOR | APIC_LVT_TIMER_PERIODIC);
1859da338a31SMaxim Levitsky     apic_write(APIC_TMICT, 1000);
1860da338a31SMaxim Levitsky }
1861da338a31SMaxim Levitsky 
1862da338a31SMaxim Levitsky static void reg_corruption_test(struct svm_test *test)
1863da338a31SMaxim Levitsky {
1864da338a31SMaxim Levitsky     /* this is endless loop, which is interrupted by the timer interrupt */
1865da338a31SMaxim Levitsky     asm volatile (
1866da338a31SMaxim Levitsky             "1:\n\t"
1867da338a31SMaxim Levitsky             "movw $0x4d0, %%dx\n\t" // IO port
1868da338a31SMaxim Levitsky             "lea %[io_port_var], %%rdi\n\t"
1869da338a31SMaxim Levitsky             "movb $0xAA, %[io_port_var]\n\t"
1870da338a31SMaxim Levitsky             "insb_instruction_label:\n\t"
1871da338a31SMaxim Levitsky             "insb\n\t"
1872da338a31SMaxim Levitsky             "jmp 1b\n\t"
1873da338a31SMaxim Levitsky 
1874da338a31SMaxim Levitsky             : [io_port_var] "=m" (io_port_var)
1875da338a31SMaxim Levitsky             : /* no inputs*/
1876da338a31SMaxim Levitsky             : "rdx", "rdi"
1877da338a31SMaxim Levitsky     );
1878da338a31SMaxim Levitsky }
1879da338a31SMaxim Levitsky 
1880da338a31SMaxim Levitsky static bool reg_corruption_finished(struct svm_test *test)
1881da338a31SMaxim Levitsky {
1882da338a31SMaxim Levitsky     if (isr_cnt == 10000) {
1883da338a31SMaxim Levitsky         report(true,
1884da338a31SMaxim Levitsky                "No RIP corruption detected after %d timer interrupts",
1885da338a31SMaxim Levitsky                isr_cnt);
1886da338a31SMaxim Levitsky         set_test_stage(test, 1);
1887da338a31SMaxim Levitsky         return true;
1888da338a31SMaxim Levitsky     }
1889da338a31SMaxim Levitsky 
1890da338a31SMaxim Levitsky     if (vmcb->control.exit_code == SVM_EXIT_INTR) {
1891da338a31SMaxim Levitsky 
1892da338a31SMaxim Levitsky         void* guest_rip = (void*)vmcb->save.rip;
1893da338a31SMaxim Levitsky 
1894da338a31SMaxim Levitsky         irq_enable();
1895da338a31SMaxim Levitsky         asm volatile ("nop");
1896da338a31SMaxim Levitsky         irq_disable();
1897da338a31SMaxim Levitsky 
1898da338a31SMaxim Levitsky         if (guest_rip == insb_instruction_label && io_port_var != 0xAA) {
1899da338a31SMaxim Levitsky             report(false,
1900da338a31SMaxim Levitsky                    "RIP corruption detected after %d timer interrupts",
1901da338a31SMaxim Levitsky                    isr_cnt);
1902da338a31SMaxim Levitsky             return true;
1903da338a31SMaxim Levitsky         }
1904da338a31SMaxim Levitsky 
1905da338a31SMaxim Levitsky     }
1906da338a31SMaxim Levitsky     return false;
1907da338a31SMaxim Levitsky }
1908da338a31SMaxim Levitsky 
1909da338a31SMaxim Levitsky static bool reg_corruption_check(struct svm_test *test)
1910da338a31SMaxim Levitsky {
1911da338a31SMaxim Levitsky     return get_test_stage(test) == 1;
1912da338a31SMaxim Levitsky }
1913da338a31SMaxim Levitsky 
19148660d1b5SKrish Sadhukhan #define TEST(name) { #name, .v2 = name }
19158660d1b5SKrish Sadhukhan 
1916ba29942cSKrish Sadhukhan /*
1917ba29942cSKrish Sadhukhan  * v2 tests
1918ba29942cSKrish Sadhukhan  */
1919ba29942cSKrish Sadhukhan 
1920ba29942cSKrish Sadhukhan static void basic_guest_main(struct svm_test *test)
1921ba29942cSKrish Sadhukhan {
1922ba29942cSKrish Sadhukhan }
1923ba29942cSKrish Sadhukhan 
1924eae10e8fSKrish Sadhukhan 
1925eae10e8fSKrish Sadhukhan #define SVM_TEST_REG_RESERVED_BITS(start, end, inc, str_name, reg, val,	\
1926eae10e8fSKrish Sadhukhan 				   resv_mask)				\
1927eae10e8fSKrish Sadhukhan {									\
1928eae10e8fSKrish Sadhukhan         u64 tmp, mask;							\
1929eae10e8fSKrish Sadhukhan         int i;								\
1930eae10e8fSKrish Sadhukhan 									\
1931eae10e8fSKrish Sadhukhan         for (i = start; i <= end; i = i + inc) {			\
1932eae10e8fSKrish Sadhukhan                 mask = 1ull << i;					\
1933eae10e8fSKrish Sadhukhan                 if (!(mask & resv_mask))				\
1934eae10e8fSKrish Sadhukhan                         continue;					\
1935eae10e8fSKrish Sadhukhan                 tmp = val | mask;					\
1936eae10e8fSKrish Sadhukhan 		reg = tmp;						\
1937eae10e8fSKrish Sadhukhan 		report(svm_vmrun() == SVM_EXIT_ERR, "Test %s %d:%d: %lx",\
1938eae10e8fSKrish Sadhukhan 		    str_name, end, start, tmp);				\
1939eae10e8fSKrish Sadhukhan         }								\
1940eae10e8fSKrish Sadhukhan }
1941eae10e8fSKrish Sadhukhan 
1942*6d0ecbf6SKrish Sadhukhan #define SVM_TEST_CR_RESERVED_BITS(start, end, inc, cr, val, resv_mask,	\
1943*6d0ecbf6SKrish Sadhukhan 				  exit_code)				\
1944a79c9495SKrish Sadhukhan {									\
1945a79c9495SKrish Sadhukhan 	u64 tmp, mask;							\
1946a79c9495SKrish Sadhukhan 	int i;								\
1947a79c9495SKrish Sadhukhan 									\
1948a79c9495SKrish Sadhukhan 	for (i = start; i <= end; i = i + inc) {			\
1949a79c9495SKrish Sadhukhan 		mask = 1ull << i;					\
1950a79c9495SKrish Sadhukhan 		if (!(mask & resv_mask))				\
1951a79c9495SKrish Sadhukhan 			continue;					\
1952a79c9495SKrish Sadhukhan 		tmp = val | mask;					\
1953a79c9495SKrish Sadhukhan 		switch (cr) {						\
1954a79c9495SKrish Sadhukhan 		case 0:							\
1955a79c9495SKrish Sadhukhan 			vmcb->save.cr0 = tmp;				\
1956a79c9495SKrish Sadhukhan 			break;						\
1957a79c9495SKrish Sadhukhan 		case 3:							\
1958a79c9495SKrish Sadhukhan 			vmcb->save.cr3 = tmp;				\
1959a79c9495SKrish Sadhukhan 			break;						\
1960a79c9495SKrish Sadhukhan 		case 4:							\
1961a79c9495SKrish Sadhukhan 			vmcb->save.cr4 = tmp;				\
1962a79c9495SKrish Sadhukhan 		}							\
1963*6d0ecbf6SKrish Sadhukhan 		report(svm_vmrun() == exit_code, "Test CR%d %d:%d: %lx",\
1964a79c9495SKrish Sadhukhan 		    cr, end, start, tmp);				\
1965a79c9495SKrish Sadhukhan 	}								\
1966a79c9495SKrish Sadhukhan }
1967e8d7a8f6SKrish Sadhukhan 
1968a79c9495SKrish Sadhukhan static void test_efer(void)
1969a79c9495SKrish Sadhukhan {
1970e8d7a8f6SKrish Sadhukhan 	/*
1971e8d7a8f6SKrish Sadhukhan 	 * Un-setting EFER.SVME is illegal
1972e8d7a8f6SKrish Sadhukhan 	 */
1973ba29942cSKrish Sadhukhan 	u64 efer_saved = vmcb->save.efer;
1974ba29942cSKrish Sadhukhan 	u64 efer = efer_saved;
1975ba29942cSKrish Sadhukhan 
1976ba29942cSKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "EFER.SVME: %lx", efer);
1977ba29942cSKrish Sadhukhan 	efer &= ~EFER_SVME;
1978ba29942cSKrish Sadhukhan 	vmcb->save.efer = efer;
1979ba29942cSKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_ERR, "EFER.SVME: %lx", efer);
1980ba29942cSKrish Sadhukhan 	vmcb->save.efer = efer_saved;
1981e8d7a8f6SKrish Sadhukhan 
1982e8d7a8f6SKrish Sadhukhan 	/*
1983a79c9495SKrish Sadhukhan 	 * EFER MBZ bits: 63:16, 9
1984a79c9495SKrish Sadhukhan 	 */
1985a79c9495SKrish Sadhukhan 	efer_saved = vmcb->save.efer;
1986a79c9495SKrish Sadhukhan 
1987a79c9495SKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(8, 9, 1, "EFER", vmcb->save.efer,
1988a79c9495SKrish Sadhukhan 	    efer_saved, SVM_EFER_RESERVED_MASK);
1989a79c9495SKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(16, 63, 4, "EFER", vmcb->save.efer,
1990a79c9495SKrish Sadhukhan 	    efer_saved, SVM_EFER_RESERVED_MASK);
1991a79c9495SKrish Sadhukhan 
19921d7bde08SKrish Sadhukhan 	/*
19931d7bde08SKrish Sadhukhan 	 * EFER.LME and CR0.PG are both set and CR4.PAE is zero.
19941d7bde08SKrish Sadhukhan 	 */
19951d7bde08SKrish Sadhukhan 	u64 cr0_saved = vmcb->save.cr0;
19961d7bde08SKrish Sadhukhan 	u64 cr0;
19971d7bde08SKrish Sadhukhan 	u64 cr4_saved = vmcb->save.cr4;
19981d7bde08SKrish Sadhukhan 	u64 cr4;
19991d7bde08SKrish Sadhukhan 
20001d7bde08SKrish Sadhukhan 	efer = efer_saved | EFER_LME;
20011d7bde08SKrish Sadhukhan 	vmcb->save.efer = efer;
20021d7bde08SKrish Sadhukhan 	cr0 = cr0_saved | X86_CR0_PG | X86_CR0_PE;
20031d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
20041d7bde08SKrish Sadhukhan 	cr4 = cr4_saved & ~X86_CR4_PAE;
20051d7bde08SKrish Sadhukhan 	vmcb->save.cr4 = cr4;
20061d7bde08SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), "
20071d7bde08SKrish Sadhukhan 	    "CR0.PG=1 (%lx) and CR4.PAE=0 (%lx)", efer, cr0, cr4);
20081d7bde08SKrish Sadhukhan 
20091d7bde08SKrish Sadhukhan 	/*
20101d7bde08SKrish Sadhukhan 	 * EFER.LME and CR0.PG are both set and CR0.PE is zero.
20111d7bde08SKrish Sadhukhan 	 */
20121d7bde08SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved | X86_CR4_PAE;
20131d7bde08SKrish Sadhukhan 	cr0 &= ~X86_CR0_PE;
20141d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
20151d7bde08SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), "
20161d7bde08SKrish Sadhukhan 	    "CR0.PG=1 and CR0.PE=0 (%lx)", efer, cr0);
20171d7bde08SKrish Sadhukhan 
20181d7bde08SKrish Sadhukhan 	/*
20191d7bde08SKrish Sadhukhan 	 * EFER.LME, CR0.PG, CR4.PAE, CS.L, and CS.D are all non-zero.
20201d7bde08SKrish Sadhukhan 	 */
20211d7bde08SKrish Sadhukhan 	u32 cs_attrib_saved = vmcb->save.cs.attrib;
20221d7bde08SKrish Sadhukhan 	u32 cs_attrib;
20231d7bde08SKrish Sadhukhan 
20241d7bde08SKrish Sadhukhan 	cr0 |= X86_CR0_PE;
20251d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
20261d7bde08SKrish Sadhukhan 	cs_attrib = cs_attrib_saved | SVM_SELECTOR_L_MASK |
20271d7bde08SKrish Sadhukhan 	    SVM_SELECTOR_DB_MASK;
20281d7bde08SKrish Sadhukhan 	vmcb->save.cs.attrib = cs_attrib;
20291d7bde08SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), "
20301d7bde08SKrish Sadhukhan 	    "CR0.PG=1 (%lx), CR4.PAE=1 (%lx), CS.L=1 and CS.D=1 (%x)",
20311d7bde08SKrish Sadhukhan 	    efer, cr0, cr4, cs_attrib);
20321d7bde08SKrish Sadhukhan 
20331d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0_saved;
20341d7bde08SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved;
2035a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer_saved;
20361d7bde08SKrish Sadhukhan 	vmcb->save.cs.attrib = cs_attrib_saved;
2037a79c9495SKrish Sadhukhan }
2038a79c9495SKrish Sadhukhan 
2039a79c9495SKrish Sadhukhan static void test_cr0(void)
2040a79c9495SKrish Sadhukhan {
2041a79c9495SKrish Sadhukhan 	/*
2042e8d7a8f6SKrish Sadhukhan 	 * Un-setting CR0.CD and setting CR0.NW is illegal combination
2043e8d7a8f6SKrish Sadhukhan 	 */
2044e8d7a8f6SKrish Sadhukhan 	u64 cr0_saved = vmcb->save.cr0;
2045e8d7a8f6SKrish Sadhukhan 	u64 cr0 = cr0_saved;
2046e8d7a8f6SKrish Sadhukhan 
2047e8d7a8f6SKrish Sadhukhan 	cr0 |= X86_CR0_CD;
2048e8d7a8f6SKrish Sadhukhan 	cr0 &= ~X86_CR0_NW;
2049e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2050a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=0: %lx",
2051a79c9495SKrish Sadhukhan 	    cr0);
2052e8d7a8f6SKrish Sadhukhan 	cr0 |= X86_CR0_NW;
2053e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2054a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=1: %lx",
2055a79c9495SKrish Sadhukhan 	    cr0);
2056e8d7a8f6SKrish Sadhukhan 	cr0 &= ~X86_CR0_NW;
2057e8d7a8f6SKrish Sadhukhan 	cr0 &= ~X86_CR0_CD;
2058e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2059a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=0,NW=0: %lx",
2060a79c9495SKrish Sadhukhan 	    cr0);
2061e8d7a8f6SKrish Sadhukhan 	cr0 |= X86_CR0_NW;
2062e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2063a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_ERR, "Test CR0 CD=0,NW=1: %lx",
2064a79c9495SKrish Sadhukhan 	    cr0);
2065e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0_saved;
20665c052c90SKrish Sadhukhan 
20675c052c90SKrish Sadhukhan 	/*
20685c052c90SKrish Sadhukhan 	 * CR0[63:32] are not zero
20695c052c90SKrish Sadhukhan 	 */
20705c052c90SKrish Sadhukhan 	cr0 = cr0_saved;
2071eae10e8fSKrish Sadhukhan 
2072eae10e8fSKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "CR0", vmcb->save.cr0, cr0_saved,
2073eae10e8fSKrish Sadhukhan 	    SVM_CR0_RESERVED_MASK);
20745c052c90SKrish Sadhukhan 	vmcb->save.cr0 = cr0_saved;
2075a79c9495SKrish Sadhukhan }
2076eae10e8fSKrish Sadhukhan 
2077a79c9495SKrish Sadhukhan static void test_cr3(void)
2078a79c9495SKrish Sadhukhan {
2079a79c9495SKrish Sadhukhan 	/*
2080a79c9495SKrish Sadhukhan 	 * CR3 MBZ bits based on different modes:
208129a01803SNadav Amit 	 *   [63:52] - long mode
2082a79c9495SKrish Sadhukhan 	 */
2083a79c9495SKrish Sadhukhan 	u64 cr3_saved = vmcb->save.cr3;
2084a79c9495SKrish Sadhukhan 
2085a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(0, 63, 1, 3, cr3_saved,
2086*6d0ecbf6SKrish Sadhukhan 	    SVM_CR3_LONG_MBZ_MASK, SVM_EXIT_ERR);
2087*6d0ecbf6SKrish Sadhukhan 
2088*6d0ecbf6SKrish Sadhukhan 	vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_MBZ_MASK;
2089*6d0ecbf6SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx",
2090*6d0ecbf6SKrish Sadhukhan 	    vmcb->save.cr3);
2091*6d0ecbf6SKrish Sadhukhan 
2092*6d0ecbf6SKrish Sadhukhan 	/*
2093*6d0ecbf6SKrish Sadhukhan 	 * CR3 non-MBZ reserved bits based on different modes:
2094*6d0ecbf6SKrish Sadhukhan 	 *   [11:5] [2:0] - long mode
2095*6d0ecbf6SKrish Sadhukhan 	 *          [2:0] - PAE legacy mode
2096*6d0ecbf6SKrish Sadhukhan 	 */
2097*6d0ecbf6SKrish Sadhukhan 	u64 cr4_saved = vmcb->save.cr4;
2098*6d0ecbf6SKrish Sadhukhan 	u64 *pdpe = npt_get_pml4e();
2099*6d0ecbf6SKrish Sadhukhan 
2100*6d0ecbf6SKrish Sadhukhan 	/*
2101*6d0ecbf6SKrish Sadhukhan 	 * Long mode
2102*6d0ecbf6SKrish Sadhukhan 	 */
2103*6d0ecbf6SKrish Sadhukhan 	if (this_cpu_has(X86_FEATURE_PCID)) {
2104*6d0ecbf6SKrish Sadhukhan 		vmcb->save.cr4 = cr4_saved | X86_CR4_PCIDE;
2105*6d0ecbf6SKrish Sadhukhan 		SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved,
2106*6d0ecbf6SKrish Sadhukhan 		    SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_VMMCALL);
2107*6d0ecbf6SKrish Sadhukhan 
2108*6d0ecbf6SKrish Sadhukhan 		vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_RESERVED_MASK;
2109*6d0ecbf6SKrish Sadhukhan 		report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx",
2110*6d0ecbf6SKrish Sadhukhan 		    vmcb->save.cr3);
2111*6d0ecbf6SKrish Sadhukhan 	} else {
2112*6d0ecbf6SKrish Sadhukhan 
2113*6d0ecbf6SKrish Sadhukhan 		vmcb->save.cr4 = cr4_saved & ~X86_CR4_PCIDE;
2114*6d0ecbf6SKrish Sadhukhan 
2115*6d0ecbf6SKrish Sadhukhan 		/* Clear P (Present) bit in NPT in order to trigger #NPF */
2116*6d0ecbf6SKrish Sadhukhan 		pdpe[0] &= ~1ULL;
2117*6d0ecbf6SKrish Sadhukhan 
2118*6d0ecbf6SKrish Sadhukhan 		SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved,
2119*6d0ecbf6SKrish Sadhukhan 		    SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_NPF);
2120*6d0ecbf6SKrish Sadhukhan 
2121*6d0ecbf6SKrish Sadhukhan 		pdpe[0] |= 1ULL;
2122*6d0ecbf6SKrish Sadhukhan 		vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_RESERVED_MASK;
2123*6d0ecbf6SKrish Sadhukhan 		report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx",
2124*6d0ecbf6SKrish Sadhukhan 		    vmcb->save.cr3);
2125*6d0ecbf6SKrish Sadhukhan 	}
2126*6d0ecbf6SKrish Sadhukhan 
2127*6d0ecbf6SKrish Sadhukhan 	/*
2128*6d0ecbf6SKrish Sadhukhan 	 * PAE legacy
2129*6d0ecbf6SKrish Sadhukhan 	 */
2130*6d0ecbf6SKrish Sadhukhan 	pdpe[0] &= ~1ULL;
2131*6d0ecbf6SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved | X86_CR4_PAE;
2132*6d0ecbf6SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(0, 2, 1, 3, cr3_saved,
2133*6d0ecbf6SKrish Sadhukhan 	    SVM_CR3_PAE_LEGACY_RESERVED_MASK, SVM_EXIT_NPF);
2134*6d0ecbf6SKrish Sadhukhan 
2135*6d0ecbf6SKrish Sadhukhan 	pdpe[0] |= 1ULL;
2136*6d0ecbf6SKrish Sadhukhan 	vmcb->save.cr3 = cr3_saved & ~SVM_CR3_PAE_LEGACY_RESERVED_MASK;
2137*6d0ecbf6SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx",
2138*6d0ecbf6SKrish Sadhukhan 	    vmcb->save.cr3);
2139a79c9495SKrish Sadhukhan 
2140a79c9495SKrish Sadhukhan 	vmcb->save.cr3 = cr3_saved;
2141*6d0ecbf6SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved;
2142a79c9495SKrish Sadhukhan }
2143a79c9495SKrish Sadhukhan 
2144a79c9495SKrish Sadhukhan static void test_cr4(void)
2145a79c9495SKrish Sadhukhan {
2146a79c9495SKrish Sadhukhan 	/*
2147a79c9495SKrish Sadhukhan 	 * CR4 MBZ bits based on different modes:
2148a79c9495SKrish Sadhukhan 	 *   [15:12], 17, 19, [31:22] - legacy mode
2149a79c9495SKrish Sadhukhan 	 *   [15:12], 17, 19, [63:22] - long mode
2150a79c9495SKrish Sadhukhan 	 */
2151a79c9495SKrish Sadhukhan 	u64 cr4_saved = vmcb->save.cr4;
2152a79c9495SKrish Sadhukhan 	u64 efer_saved = vmcb->save.efer;
2153a79c9495SKrish Sadhukhan 	u64 efer = efer_saved;
2154a79c9495SKrish Sadhukhan 
2155a79c9495SKrish Sadhukhan 	efer &= ~EFER_LME;
2156a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer;
2157a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved,
2158*6d0ecbf6SKrish Sadhukhan 	    SVM_CR4_LEGACY_RESERVED_MASK, SVM_EXIT_ERR);
2159a79c9495SKrish Sadhukhan 
2160a79c9495SKrish Sadhukhan 	efer |= EFER_LME;
2161a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer;
2162a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved,
2163*6d0ecbf6SKrish Sadhukhan 	    SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR);
2164a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(32, 63, 4, 4, cr4_saved,
2165*6d0ecbf6SKrish Sadhukhan 	    SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR);
2166a79c9495SKrish Sadhukhan 
2167a79c9495SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved;
2168a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer_saved;
2169a79c9495SKrish Sadhukhan }
2170a79c9495SKrish Sadhukhan 
2171a79c9495SKrish Sadhukhan static void test_dr(void)
2172a79c9495SKrish Sadhukhan {
2173eae10e8fSKrish Sadhukhan 	/*
2174eae10e8fSKrish Sadhukhan 	 * DR6[63:32] and DR7[63:32] are MBZ
2175eae10e8fSKrish Sadhukhan 	 */
2176eae10e8fSKrish Sadhukhan 	u64 dr_saved = vmcb->save.dr6;
2177eae10e8fSKrish Sadhukhan 
2178eae10e8fSKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR6", vmcb->save.dr6, dr_saved,
2179eae10e8fSKrish Sadhukhan 	    SVM_DR6_RESERVED_MASK);
2180eae10e8fSKrish Sadhukhan 	vmcb->save.dr6 = dr_saved;
2181eae10e8fSKrish Sadhukhan 
2182eae10e8fSKrish Sadhukhan 	dr_saved = vmcb->save.dr7;
2183eae10e8fSKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR7", vmcb->save.dr7, dr_saved,
2184eae10e8fSKrish Sadhukhan 	    SVM_DR7_RESERVED_MASK);
2185eae10e8fSKrish Sadhukhan 
2186eae10e8fSKrish Sadhukhan 	vmcb->save.dr7 = dr_saved;
2187a79c9495SKrish Sadhukhan }
2188eae10e8fSKrish Sadhukhan 
2189a79c9495SKrish Sadhukhan static void svm_guest_state_test(void)
2190a79c9495SKrish Sadhukhan {
2191a79c9495SKrish Sadhukhan 	test_set_guest(basic_guest_main);
2192eae10e8fSKrish Sadhukhan 
2193a79c9495SKrish Sadhukhan 	test_efer();
2194a79c9495SKrish Sadhukhan 	test_cr0();
2195a79c9495SKrish Sadhukhan 	test_cr3();
2196a79c9495SKrish Sadhukhan 	test_cr4();
2197a79c9495SKrish Sadhukhan 	test_dr();
2198ba29942cSKrish Sadhukhan }
2199ba29942cSKrish Sadhukhan 
2200ad879127SKrish Sadhukhan struct svm_test svm_tests[] = {
2201ad879127SKrish Sadhukhan     { "null", default_supported, default_prepare,
2202ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test,
2203ad879127SKrish Sadhukhan       default_finished, null_check },
2204ad879127SKrish Sadhukhan     { "vmrun", default_supported, default_prepare,
2205ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_vmrun,
2206ad879127SKrish Sadhukhan        default_finished, check_vmrun },
2207ad879127SKrish Sadhukhan     { "ioio", default_supported, prepare_ioio,
2208ad879127SKrish Sadhukhan        default_prepare_gif_clear, test_ioio,
2209ad879127SKrish Sadhukhan        ioio_finished, check_ioio },
2210ad879127SKrish Sadhukhan     { "vmrun intercept check", default_supported, prepare_no_vmrun_int,
2211ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test, default_finished,
2212ad879127SKrish Sadhukhan       check_no_vmrun_int },
2213401299a5SPaolo Bonzini     { "rsm", default_supported,
2214401299a5SPaolo Bonzini       prepare_rsm_intercept, default_prepare_gif_clear,
2215401299a5SPaolo Bonzini       test_rsm_intercept, finished_rsm_intercept, check_rsm_intercept },
2216ad879127SKrish Sadhukhan     { "cr3 read intercept", default_supported,
2217ad879127SKrish Sadhukhan       prepare_cr3_intercept, default_prepare_gif_clear,
2218ad879127SKrish Sadhukhan       test_cr3_intercept, default_finished, check_cr3_intercept },
2219ad879127SKrish Sadhukhan     { "cr3 read nointercept", default_supported, default_prepare,
2220ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_cr3_intercept, default_finished,
2221ad879127SKrish Sadhukhan       check_cr3_nointercept },
2222ad879127SKrish Sadhukhan     { "cr3 read intercept emulate", smp_supported,
2223ad879127SKrish Sadhukhan       prepare_cr3_intercept_bypass, default_prepare_gif_clear,
2224ad879127SKrish Sadhukhan       test_cr3_intercept_bypass, default_finished, check_cr3_intercept },
2225ad879127SKrish Sadhukhan     { "dr intercept check", default_supported, prepare_dr_intercept,
2226ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_dr_intercept, dr_intercept_finished,
2227ad879127SKrish Sadhukhan       check_dr_intercept },
2228ad879127SKrish Sadhukhan     { "next_rip", next_rip_supported, prepare_next_rip,
2229ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_next_rip,
2230ad879127SKrish Sadhukhan       default_finished, check_next_rip },
2231ad879127SKrish Sadhukhan     { "msr intercept check", default_supported, prepare_msr_intercept,
2232ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_msr_intercept,
2233ad879127SKrish Sadhukhan       msr_intercept_finished, check_msr_intercept },
2234ad879127SKrish Sadhukhan     { "mode_switch", default_supported, prepare_mode_switch,
2235ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_mode_switch,
2236ad879127SKrish Sadhukhan        mode_switch_finished, check_mode_switch },
2237ad879127SKrish Sadhukhan     { "asid_zero", default_supported, prepare_asid_zero,
2238ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_asid_zero,
2239ad879127SKrish Sadhukhan        default_finished, check_asid_zero },
2240ad879127SKrish Sadhukhan     { "sel_cr0_bug", default_supported, sel_cr0_bug_prepare,
2241ad879127SKrish Sadhukhan       default_prepare_gif_clear, sel_cr0_bug_test,
2242ad879127SKrish Sadhukhan        sel_cr0_bug_finished, sel_cr0_bug_check },
2243ad879127SKrish Sadhukhan     { "npt_nx", npt_supported, npt_nx_prepare,
2244ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test,
2245ad879127SKrish Sadhukhan       default_finished, npt_nx_check },
22466faca2a5SKrish Sadhukhan     { "npt_np", npt_supported, npt_np_prepare,
22476faca2a5SKrish Sadhukhan       default_prepare_gif_clear, npt_np_test,
22486faca2a5SKrish Sadhukhan       default_finished, npt_np_check },
2249ad879127SKrish Sadhukhan     { "npt_us", npt_supported, npt_us_prepare,
2250ad879127SKrish Sadhukhan       default_prepare_gif_clear, npt_us_test,
2251ad879127SKrish Sadhukhan       default_finished, npt_us_check },
2252ad879127SKrish Sadhukhan     { "npt_rsvd", npt_supported, npt_rsvd_prepare,
2253ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test,
2254ad879127SKrish Sadhukhan       default_finished, npt_rsvd_check },
2255ad879127SKrish Sadhukhan     { "npt_rw", npt_supported, npt_rw_prepare,
2256ad879127SKrish Sadhukhan       default_prepare_gif_clear, npt_rw_test,
2257ad879127SKrish Sadhukhan       default_finished, npt_rw_check },
2258ad879127SKrish Sadhukhan     { "npt_rsvd_pfwalk", npt_supported, npt_rsvd_pfwalk_prepare,
2259ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test,
2260ad879127SKrish Sadhukhan       default_finished, npt_rsvd_pfwalk_check },
2261ad879127SKrish Sadhukhan     { "npt_rw_pfwalk", npt_supported, npt_rw_pfwalk_prepare,
2262ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test,
2263ad879127SKrish Sadhukhan       default_finished, npt_rw_pfwalk_check },
2264ad879127SKrish Sadhukhan     { "npt_l1mmio", npt_supported, npt_l1mmio_prepare,
2265ad879127SKrish Sadhukhan       default_prepare_gif_clear, npt_l1mmio_test,
2266ad879127SKrish Sadhukhan       default_finished, npt_l1mmio_check },
2267ad879127SKrish Sadhukhan     { "npt_rw_l1mmio", npt_supported, npt_rw_l1mmio_prepare,
2268ad879127SKrish Sadhukhan       default_prepare_gif_clear, npt_rw_l1mmio_test,
2269ad879127SKrish Sadhukhan       default_finished, npt_rw_l1mmio_check },
227010a65fc4SNadav Amit     { "tsc_adjust", tsc_adjust_supported, tsc_adjust_prepare,
2271ad879127SKrish Sadhukhan       default_prepare_gif_clear, tsc_adjust_test,
2272ad879127SKrish Sadhukhan       default_finished, tsc_adjust_check },
2273ad879127SKrish Sadhukhan     { "latency_run_exit", default_supported, latency_prepare,
2274ad879127SKrish Sadhukhan       default_prepare_gif_clear, latency_test,
2275ad879127SKrish Sadhukhan       latency_finished, latency_check },
2276ad879127SKrish Sadhukhan     { "latency_svm_insn", default_supported, lat_svm_insn_prepare,
2277ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test,
2278ad879127SKrish Sadhukhan       lat_svm_insn_finished, lat_svm_insn_check },
22794b4fb247SPaolo Bonzini     { "exc_inject", default_supported, exc_inject_prepare,
22804b4fb247SPaolo Bonzini       default_prepare_gif_clear, exc_inject_test,
22814b4fb247SPaolo Bonzini       exc_inject_finished, exc_inject_check },
2282ad879127SKrish Sadhukhan     { "pending_event", default_supported, pending_event_prepare,
2283ad879127SKrish Sadhukhan       default_prepare_gif_clear,
2284ad879127SKrish Sadhukhan       pending_event_test, pending_event_finished, pending_event_check },
228585dc2aceSPaolo Bonzini     { "pending_event_cli", default_supported, pending_event_cli_prepare,
228685dc2aceSPaolo Bonzini       pending_event_cli_prepare_gif_clear,
228785dc2aceSPaolo Bonzini       pending_event_cli_test, pending_event_cli_finished,
228885dc2aceSPaolo Bonzini       pending_event_cli_check },
228985dc2aceSPaolo Bonzini     { "interrupt", default_supported, interrupt_prepare,
229085dc2aceSPaolo Bonzini       default_prepare_gif_clear, interrupt_test,
229185dc2aceSPaolo Bonzini       interrupt_finished, interrupt_check },
2292d4db486bSCathy Avery     { "nmi", default_supported, nmi_prepare,
2293d4db486bSCathy Avery       default_prepare_gif_clear, nmi_test,
2294d4db486bSCathy Avery       nmi_finished, nmi_check },
22959da1f4d8SCathy Avery     { "nmi_hlt", smp_supported, nmi_prepare,
22969da1f4d8SCathy Avery       default_prepare_gif_clear, nmi_hlt_test,
22979da1f4d8SCathy Avery       nmi_hlt_finished, nmi_hlt_check },
22989c838954SCathy Avery     { "virq_inject", default_supported, virq_inject_prepare,
22999c838954SCathy Avery       default_prepare_gif_clear, virq_inject_test,
23009c838954SCathy Avery       virq_inject_finished, virq_inject_check },
2301da338a31SMaxim Levitsky     { "reg_corruption", default_supported, reg_corruption_prepare,
2302da338a31SMaxim Levitsky       default_prepare_gif_clear, reg_corruption_test,
2303da338a31SMaxim Levitsky       reg_corruption_finished, reg_corruption_check },
2304ba29942cSKrish Sadhukhan     TEST(svm_guest_state_test),
2305ad879127SKrish Sadhukhan     { NULL, NULL, NULL, NULL, NULL, NULL, NULL }
2306ad879127SKrish Sadhukhan };
2307