xref: /kvm-unit-tests/x86/svm_tests.c (revision ade7601d13e65a4da6bb37021c6ea7353048f2fa)
1ad879127SKrish Sadhukhan #include "svm.h"
2ad879127SKrish Sadhukhan #include "libcflat.h"
3ad879127SKrish Sadhukhan #include "processor.h"
4ad879127SKrish Sadhukhan #include "desc.h"
5ad879127SKrish Sadhukhan #include "msr.h"
6ad879127SKrish Sadhukhan #include "vm.h"
7ad879127SKrish Sadhukhan #include "smp.h"
8ad879127SKrish Sadhukhan #include "types.h"
9ad879127SKrish Sadhukhan #include "alloc_page.h"
10ad879127SKrish Sadhukhan #include "isr.h"
11ad879127SKrish Sadhukhan #include "apic.h"
129da1f4d8SCathy Avery #include "delay.h"
13ad879127SKrish Sadhukhan 
14ad879127SKrish Sadhukhan #define SVM_EXIT_MAX_DR_INTERCEPT 0x3f
15ad879127SKrish Sadhukhan 
16ad879127SKrish Sadhukhan #define LATENCY_RUNS 1000000
17ad879127SKrish Sadhukhan 
184770e9c8SCathy Avery extern u16 cpu_online_count;
194770e9c8SCathy Avery 
20ad879127SKrish Sadhukhan u64 tsc_start;
21ad879127SKrish Sadhukhan u64 tsc_end;
22ad879127SKrish Sadhukhan 
23ad879127SKrish Sadhukhan u64 vmrun_sum, vmexit_sum;
24ad879127SKrish Sadhukhan u64 vmsave_sum, vmload_sum;
25ad879127SKrish Sadhukhan u64 stgi_sum, clgi_sum;
26ad879127SKrish Sadhukhan u64 latvmrun_max;
27ad879127SKrish Sadhukhan u64 latvmrun_min;
28ad879127SKrish Sadhukhan u64 latvmexit_max;
29ad879127SKrish Sadhukhan u64 latvmexit_min;
30ad879127SKrish Sadhukhan u64 latvmload_max;
31ad879127SKrish Sadhukhan u64 latvmload_min;
32ad879127SKrish Sadhukhan u64 latvmsave_max;
33ad879127SKrish Sadhukhan u64 latvmsave_min;
34ad879127SKrish Sadhukhan u64 latstgi_max;
35ad879127SKrish Sadhukhan u64 latstgi_min;
36ad879127SKrish Sadhukhan u64 latclgi_max;
37ad879127SKrish Sadhukhan u64 latclgi_min;
38ad879127SKrish Sadhukhan u64 runs;
39ad879127SKrish Sadhukhan 
40ad879127SKrish Sadhukhan static void null_test(struct svm_test *test)
41ad879127SKrish Sadhukhan {
42ad879127SKrish Sadhukhan }
43ad879127SKrish Sadhukhan 
44ad879127SKrish Sadhukhan static bool null_check(struct svm_test *test)
45ad879127SKrish Sadhukhan {
46096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_VMMCALL;
47ad879127SKrish Sadhukhan }
48ad879127SKrish Sadhukhan 
49ad879127SKrish Sadhukhan static void prepare_no_vmrun_int(struct svm_test *test)
50ad879127SKrish Sadhukhan {
51096cf7feSPaolo Bonzini     vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMRUN);
52ad879127SKrish Sadhukhan }
53ad879127SKrish Sadhukhan 
54ad879127SKrish Sadhukhan static bool check_no_vmrun_int(struct svm_test *test)
55ad879127SKrish Sadhukhan {
56096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_ERR;
57ad879127SKrish Sadhukhan }
58ad879127SKrish Sadhukhan 
59ad879127SKrish Sadhukhan static void test_vmrun(struct svm_test *test)
60ad879127SKrish Sadhukhan {
61096cf7feSPaolo Bonzini     asm volatile ("vmrun %0" : : "a"(virt_to_phys(vmcb)));
62ad879127SKrish Sadhukhan }
63ad879127SKrish Sadhukhan 
64ad879127SKrish Sadhukhan static bool check_vmrun(struct svm_test *test)
65ad879127SKrish Sadhukhan {
66096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_VMRUN;
67ad879127SKrish Sadhukhan }
68ad879127SKrish Sadhukhan 
69401299a5SPaolo Bonzini static void prepare_rsm_intercept(struct svm_test *test)
70401299a5SPaolo Bonzini {
71401299a5SPaolo Bonzini     default_prepare(test);
72401299a5SPaolo Bonzini     vmcb->control.intercept |= 1 << INTERCEPT_RSM;
73401299a5SPaolo Bonzini     vmcb->control.intercept_exceptions |= (1ULL << UD_VECTOR);
74401299a5SPaolo Bonzini }
75401299a5SPaolo Bonzini 
76401299a5SPaolo Bonzini static void test_rsm_intercept(struct svm_test *test)
77401299a5SPaolo Bonzini {
78401299a5SPaolo Bonzini     asm volatile ("rsm" : : : "memory");
79401299a5SPaolo Bonzini }
80401299a5SPaolo Bonzini 
81401299a5SPaolo Bonzini static bool check_rsm_intercept(struct svm_test *test)
82401299a5SPaolo Bonzini {
83401299a5SPaolo Bonzini     return get_test_stage(test) == 2;
84401299a5SPaolo Bonzini }
85401299a5SPaolo Bonzini 
86401299a5SPaolo Bonzini static bool finished_rsm_intercept(struct svm_test *test)
87401299a5SPaolo Bonzini {
88401299a5SPaolo Bonzini     switch (get_test_stage(test)) {
89401299a5SPaolo Bonzini     case 0:
90401299a5SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_RSM) {
91198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to rsm. Exit reason 0x%x",
92401299a5SPaolo Bonzini                         vmcb->control.exit_code);
93401299a5SPaolo Bonzini             return true;
94401299a5SPaolo Bonzini         }
95401299a5SPaolo Bonzini         vmcb->control.intercept &= ~(1 << INTERCEPT_RSM);
96401299a5SPaolo Bonzini         inc_test_stage(test);
97401299a5SPaolo Bonzini         break;
98401299a5SPaolo Bonzini 
99401299a5SPaolo Bonzini     case 1:
100401299a5SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_EXCP_BASE + UD_VECTOR) {
101198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to #UD. Exit reason 0x%x",
102401299a5SPaolo Bonzini                         vmcb->control.exit_code);
103401299a5SPaolo Bonzini             return true;
104401299a5SPaolo Bonzini         }
105401299a5SPaolo Bonzini         vmcb->save.rip += 2;
106401299a5SPaolo Bonzini         inc_test_stage(test);
107401299a5SPaolo Bonzini         break;
108401299a5SPaolo Bonzini 
109401299a5SPaolo Bonzini     default:
110401299a5SPaolo Bonzini         return true;
111401299a5SPaolo Bonzini     }
112401299a5SPaolo Bonzini     return get_test_stage(test) == 2;
113401299a5SPaolo Bonzini }
114401299a5SPaolo Bonzini 
115ad879127SKrish Sadhukhan static void prepare_cr3_intercept(struct svm_test *test)
116ad879127SKrish Sadhukhan {
117ad879127SKrish Sadhukhan     default_prepare(test);
118096cf7feSPaolo Bonzini     vmcb->control.intercept_cr_read |= 1 << 3;
119ad879127SKrish Sadhukhan }
120ad879127SKrish Sadhukhan 
121ad879127SKrish Sadhukhan static void test_cr3_intercept(struct svm_test *test)
122ad879127SKrish Sadhukhan {
123ad879127SKrish Sadhukhan     asm volatile ("mov %%cr3, %0" : "=r"(test->scratch) : : "memory");
124ad879127SKrish Sadhukhan }
125ad879127SKrish Sadhukhan 
126ad879127SKrish Sadhukhan static bool check_cr3_intercept(struct svm_test *test)
127ad879127SKrish Sadhukhan {
128096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_READ_CR3;
129ad879127SKrish Sadhukhan }
130ad879127SKrish Sadhukhan 
131ad879127SKrish Sadhukhan static bool check_cr3_nointercept(struct svm_test *test)
132ad879127SKrish Sadhukhan {
133ad879127SKrish Sadhukhan     return null_check(test) && test->scratch == read_cr3();
134ad879127SKrish Sadhukhan }
135ad879127SKrish Sadhukhan 
136ad879127SKrish Sadhukhan static void corrupt_cr3_intercept_bypass(void *_test)
137ad879127SKrish Sadhukhan {
138ad879127SKrish Sadhukhan     struct svm_test *test = _test;
139ad879127SKrish Sadhukhan     extern volatile u32 mmio_insn;
140ad879127SKrish Sadhukhan 
141ad879127SKrish Sadhukhan     while (!__sync_bool_compare_and_swap(&test->scratch, 1, 2))
142ad879127SKrish Sadhukhan         pause();
143ad879127SKrish Sadhukhan     pause();
144ad879127SKrish Sadhukhan     pause();
145ad879127SKrish Sadhukhan     pause();
146ad879127SKrish Sadhukhan     mmio_insn = 0x90d8200f;  // mov %cr3, %rax; nop
147ad879127SKrish Sadhukhan }
148ad879127SKrish Sadhukhan 
149ad879127SKrish Sadhukhan static void prepare_cr3_intercept_bypass(struct svm_test *test)
150ad879127SKrish Sadhukhan {
151ad879127SKrish Sadhukhan     default_prepare(test);
152096cf7feSPaolo Bonzini     vmcb->control.intercept_cr_read |= 1 << 3;
153ad879127SKrish Sadhukhan     on_cpu_async(1, corrupt_cr3_intercept_bypass, test);
154ad879127SKrish Sadhukhan }
155ad879127SKrish Sadhukhan 
156ad879127SKrish Sadhukhan static void test_cr3_intercept_bypass(struct svm_test *test)
157ad879127SKrish Sadhukhan {
158ad879127SKrish Sadhukhan     ulong a = 0xa0000;
159ad879127SKrish Sadhukhan 
160ad879127SKrish Sadhukhan     test->scratch = 1;
161ad879127SKrish Sadhukhan     while (test->scratch != 2)
162ad879127SKrish Sadhukhan         barrier();
163ad879127SKrish Sadhukhan 
164ad879127SKrish Sadhukhan     asm volatile ("mmio_insn: mov %0, (%0); nop"
165ad879127SKrish Sadhukhan                   : "+a"(a) : : "memory");
166ad879127SKrish Sadhukhan     test->scratch = a;
167ad879127SKrish Sadhukhan }
168ad879127SKrish Sadhukhan 
169ad879127SKrish Sadhukhan static void prepare_dr_intercept(struct svm_test *test)
170ad879127SKrish Sadhukhan {
171ad879127SKrish Sadhukhan     default_prepare(test);
172096cf7feSPaolo Bonzini     vmcb->control.intercept_dr_read = 0xff;
173096cf7feSPaolo Bonzini     vmcb->control.intercept_dr_write = 0xff;
174ad879127SKrish Sadhukhan }
175ad879127SKrish Sadhukhan 
176ad879127SKrish Sadhukhan static void test_dr_intercept(struct svm_test *test)
177ad879127SKrish Sadhukhan {
178ad879127SKrish Sadhukhan     unsigned int i, failcnt = 0;
179ad879127SKrish Sadhukhan 
180ad879127SKrish Sadhukhan     /* Loop testing debug register reads */
181ad879127SKrish Sadhukhan     for (i = 0; i < 8; i++) {
182ad879127SKrish Sadhukhan 
183ad879127SKrish Sadhukhan         switch (i) {
184ad879127SKrish Sadhukhan         case 0:
185ad879127SKrish Sadhukhan             asm volatile ("mov %%dr0, %0" : "=r"(test->scratch) : : "memory");
186ad879127SKrish Sadhukhan             break;
187ad879127SKrish Sadhukhan         case 1:
188ad879127SKrish Sadhukhan             asm volatile ("mov %%dr1, %0" : "=r"(test->scratch) : : "memory");
189ad879127SKrish Sadhukhan             break;
190ad879127SKrish Sadhukhan         case 2:
191ad879127SKrish Sadhukhan             asm volatile ("mov %%dr2, %0" : "=r"(test->scratch) : : "memory");
192ad879127SKrish Sadhukhan             break;
193ad879127SKrish Sadhukhan         case 3:
194ad879127SKrish Sadhukhan             asm volatile ("mov %%dr3, %0" : "=r"(test->scratch) : : "memory");
195ad879127SKrish Sadhukhan             break;
196ad879127SKrish Sadhukhan         case 4:
197ad879127SKrish Sadhukhan             asm volatile ("mov %%dr4, %0" : "=r"(test->scratch) : : "memory");
198ad879127SKrish Sadhukhan             break;
199ad879127SKrish Sadhukhan         case 5:
200ad879127SKrish Sadhukhan             asm volatile ("mov %%dr5, %0" : "=r"(test->scratch) : : "memory");
201ad879127SKrish Sadhukhan             break;
202ad879127SKrish Sadhukhan         case 6:
203ad879127SKrish Sadhukhan             asm volatile ("mov %%dr6, %0" : "=r"(test->scratch) : : "memory");
204ad879127SKrish Sadhukhan             break;
205ad879127SKrish Sadhukhan         case 7:
206ad879127SKrish Sadhukhan             asm volatile ("mov %%dr7, %0" : "=r"(test->scratch) : : "memory");
207ad879127SKrish Sadhukhan             break;
208ad879127SKrish Sadhukhan         }
209ad879127SKrish Sadhukhan 
210ad879127SKrish Sadhukhan         if (test->scratch != i) {
211198dfd0eSJanis Schoetterl-Glausch             report_fail("dr%u read intercept", i);
212ad879127SKrish Sadhukhan             failcnt++;
213ad879127SKrish Sadhukhan         }
214ad879127SKrish Sadhukhan     }
215ad879127SKrish Sadhukhan 
216ad879127SKrish Sadhukhan     /* Loop testing debug register writes */
217ad879127SKrish Sadhukhan     for (i = 0; i < 8; i++) {
218ad879127SKrish Sadhukhan 
219ad879127SKrish Sadhukhan         switch (i) {
220ad879127SKrish Sadhukhan         case 0:
221ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr0" : : "r"(test->scratch) : "memory");
222ad879127SKrish Sadhukhan             break;
223ad879127SKrish Sadhukhan         case 1:
224ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr1" : : "r"(test->scratch) : "memory");
225ad879127SKrish Sadhukhan             break;
226ad879127SKrish Sadhukhan         case 2:
227ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr2" : : "r"(test->scratch) : "memory");
228ad879127SKrish Sadhukhan             break;
229ad879127SKrish Sadhukhan         case 3:
230ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr3" : : "r"(test->scratch) : "memory");
231ad879127SKrish Sadhukhan             break;
232ad879127SKrish Sadhukhan         case 4:
233ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr4" : : "r"(test->scratch) : "memory");
234ad879127SKrish Sadhukhan             break;
235ad879127SKrish Sadhukhan         case 5:
236ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr5" : : "r"(test->scratch) : "memory");
237ad879127SKrish Sadhukhan             break;
238ad879127SKrish Sadhukhan         case 6:
239ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr6" : : "r"(test->scratch) : "memory");
240ad879127SKrish Sadhukhan             break;
241ad879127SKrish Sadhukhan         case 7:
242ad879127SKrish Sadhukhan             asm volatile ("mov %0, %%dr7" : : "r"(test->scratch) : "memory");
243ad879127SKrish Sadhukhan             break;
244ad879127SKrish Sadhukhan         }
245ad879127SKrish Sadhukhan 
246ad879127SKrish Sadhukhan         if (test->scratch != i) {
247198dfd0eSJanis Schoetterl-Glausch             report_fail("dr%u write intercept", i);
248ad879127SKrish Sadhukhan             failcnt++;
249ad879127SKrish Sadhukhan         }
250ad879127SKrish Sadhukhan     }
251ad879127SKrish Sadhukhan 
252ad879127SKrish Sadhukhan     test->scratch = failcnt;
253ad879127SKrish Sadhukhan }
254ad879127SKrish Sadhukhan 
255ad879127SKrish Sadhukhan static bool dr_intercept_finished(struct svm_test *test)
256ad879127SKrish Sadhukhan {
257096cf7feSPaolo Bonzini     ulong n = (vmcb->control.exit_code - SVM_EXIT_READ_DR0);
258ad879127SKrish Sadhukhan 
259ad879127SKrish Sadhukhan     /* Only expect DR intercepts */
260ad879127SKrish Sadhukhan     if (n > (SVM_EXIT_MAX_DR_INTERCEPT - SVM_EXIT_READ_DR0))
261ad879127SKrish Sadhukhan         return true;
262ad879127SKrish Sadhukhan 
263ad879127SKrish Sadhukhan     /*
264ad879127SKrish Sadhukhan      * Compute debug register number.
265ad879127SKrish Sadhukhan      * Per Appendix C "SVM Intercept Exit Codes" of AMD64 Architecture
266ad879127SKrish Sadhukhan      * Programmer's Manual Volume 2 - System Programming:
267ad879127SKrish Sadhukhan      * http://support.amd.com/TechDocs/24593.pdf
268ad879127SKrish Sadhukhan      * there are 16 VMEXIT codes each for DR read and write.
269ad879127SKrish Sadhukhan      */
270ad879127SKrish Sadhukhan     test->scratch = (n % 16);
271ad879127SKrish Sadhukhan 
272ad879127SKrish Sadhukhan     /* Jump over MOV instruction */
273096cf7feSPaolo Bonzini     vmcb->save.rip += 3;
274ad879127SKrish Sadhukhan 
275ad879127SKrish Sadhukhan     return false;
276ad879127SKrish Sadhukhan }
277ad879127SKrish Sadhukhan 
278ad879127SKrish Sadhukhan static bool check_dr_intercept(struct svm_test *test)
279ad879127SKrish Sadhukhan {
280ad879127SKrish Sadhukhan     return !test->scratch;
281ad879127SKrish Sadhukhan }
282ad879127SKrish Sadhukhan 
283ad879127SKrish Sadhukhan static bool next_rip_supported(void)
284ad879127SKrish Sadhukhan {
285ad879127SKrish Sadhukhan     return this_cpu_has(X86_FEATURE_NRIPS);
286ad879127SKrish Sadhukhan }
287ad879127SKrish Sadhukhan 
288ad879127SKrish Sadhukhan static void prepare_next_rip(struct svm_test *test)
289ad879127SKrish Sadhukhan {
290096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_RDTSC);
291ad879127SKrish Sadhukhan }
292ad879127SKrish Sadhukhan 
293ad879127SKrish Sadhukhan 
294ad879127SKrish Sadhukhan static void test_next_rip(struct svm_test *test)
295ad879127SKrish Sadhukhan {
296ad879127SKrish Sadhukhan     asm volatile ("rdtsc\n\t"
297ad879127SKrish Sadhukhan                   ".globl exp_next_rip\n\t"
298ad879127SKrish Sadhukhan                   "exp_next_rip:\n\t" ::: "eax", "edx");
299ad879127SKrish Sadhukhan }
300ad879127SKrish Sadhukhan 
301ad879127SKrish Sadhukhan static bool check_next_rip(struct svm_test *test)
302ad879127SKrish Sadhukhan {
303ad879127SKrish Sadhukhan     extern char exp_next_rip;
304ad879127SKrish Sadhukhan     unsigned long address = (unsigned long)&exp_next_rip;
305ad879127SKrish Sadhukhan 
306096cf7feSPaolo Bonzini     return address == vmcb->control.next_rip;
307ad879127SKrish Sadhukhan }
308ad879127SKrish Sadhukhan 
309ad879127SKrish Sadhukhan extern u8 *msr_bitmap;
310ad879127SKrish Sadhukhan 
311ad879127SKrish Sadhukhan static void prepare_msr_intercept(struct svm_test *test)
312ad879127SKrish Sadhukhan {
313ad879127SKrish Sadhukhan     default_prepare(test);
314096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_MSR_PROT);
315096cf7feSPaolo Bonzini     vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR);
316ad879127SKrish Sadhukhan     memset(msr_bitmap, 0xff, MSR_BITMAP_SIZE);
317ad879127SKrish Sadhukhan }
318ad879127SKrish Sadhukhan 
319ad879127SKrish Sadhukhan static void test_msr_intercept(struct svm_test *test)
320ad879127SKrish Sadhukhan {
321ad879127SKrish Sadhukhan     unsigned long msr_value = 0xef8056791234abcd; /* Arbitrary value */
322ad879127SKrish Sadhukhan     unsigned long msr_index;
323ad879127SKrish Sadhukhan 
324ad879127SKrish Sadhukhan     for (msr_index = 0; msr_index <= 0xc0011fff; msr_index++) {
325ad879127SKrish Sadhukhan         if (msr_index == 0xC0010131 /* MSR_SEV_STATUS */) {
326ad879127SKrish Sadhukhan             /*
327ad879127SKrish Sadhukhan              * Per section 15.34.10 "SEV_STATUS MSR" of AMD64 Architecture
328ad879127SKrish Sadhukhan              * Programmer's Manual volume 2 - System Programming:
329ad879127SKrish Sadhukhan              * http://support.amd.com/TechDocs/24593.pdf
330ad879127SKrish Sadhukhan              * SEV_STATUS MSR (C001_0131) is a non-interceptable MSR.
331ad879127SKrish Sadhukhan              */
332ad879127SKrish Sadhukhan             continue;
333ad879127SKrish Sadhukhan         }
334ad879127SKrish Sadhukhan 
335ad879127SKrish Sadhukhan         /* Skips gaps between supported MSR ranges */
336ad879127SKrish Sadhukhan         if (msr_index == 0x2000)
337ad879127SKrish Sadhukhan             msr_index = 0xc0000000;
338ad879127SKrish Sadhukhan         else if (msr_index == 0xc0002000)
339ad879127SKrish Sadhukhan             msr_index = 0xc0010000;
340ad879127SKrish Sadhukhan 
341ad879127SKrish Sadhukhan         test->scratch = -1;
342ad879127SKrish Sadhukhan 
343ad879127SKrish Sadhukhan         rdmsr(msr_index);
344ad879127SKrish Sadhukhan 
345ad879127SKrish Sadhukhan         /* Check that a read intercept occurred for MSR at msr_index */
346ad879127SKrish Sadhukhan         if (test->scratch != msr_index)
347198dfd0eSJanis Schoetterl-Glausch             report_fail("MSR 0x%lx read intercept", msr_index);
348ad879127SKrish Sadhukhan 
349ad879127SKrish Sadhukhan         /*
350ad879127SKrish Sadhukhan          * Poor man approach to generate a value that
351ad879127SKrish Sadhukhan          * seems arbitrary each time around the loop.
352ad879127SKrish Sadhukhan          */
353ad879127SKrish Sadhukhan         msr_value += (msr_value << 1);
354ad879127SKrish Sadhukhan 
355ad879127SKrish Sadhukhan         wrmsr(msr_index, msr_value);
356ad879127SKrish Sadhukhan 
357ad879127SKrish Sadhukhan         /* Check that a write intercept occurred for MSR with msr_value */
358ad879127SKrish Sadhukhan         if (test->scratch != msr_value)
359198dfd0eSJanis Schoetterl-Glausch             report_fail("MSR 0x%lx write intercept", msr_index);
360ad879127SKrish Sadhukhan     }
361ad879127SKrish Sadhukhan 
362ad879127SKrish Sadhukhan     test->scratch = -2;
363ad879127SKrish Sadhukhan }
364ad879127SKrish Sadhukhan 
365ad879127SKrish Sadhukhan static bool msr_intercept_finished(struct svm_test *test)
366ad879127SKrish Sadhukhan {
367096cf7feSPaolo Bonzini     u32 exit_code = vmcb->control.exit_code;
368ad879127SKrish Sadhukhan     u64 exit_info_1;
369ad879127SKrish Sadhukhan     u8 *opcode;
370ad879127SKrish Sadhukhan 
371ad879127SKrish Sadhukhan     if (exit_code == SVM_EXIT_MSR) {
372096cf7feSPaolo Bonzini         exit_info_1 = vmcb->control.exit_info_1;
373ad879127SKrish Sadhukhan     } else {
374ad879127SKrish Sadhukhan         /*
375ad879127SKrish Sadhukhan          * If #GP exception occurs instead, check that it was
376ad879127SKrish Sadhukhan          * for RDMSR/WRMSR and set exit_info_1 accordingly.
377ad879127SKrish Sadhukhan          */
378ad879127SKrish Sadhukhan 
379ad879127SKrish Sadhukhan         if (exit_code != (SVM_EXIT_EXCP_BASE + GP_VECTOR))
380ad879127SKrish Sadhukhan             return true;
381ad879127SKrish Sadhukhan 
382096cf7feSPaolo Bonzini         opcode = (u8 *)vmcb->save.rip;
383ad879127SKrish Sadhukhan         if (opcode[0] != 0x0f)
384ad879127SKrish Sadhukhan             return true;
385ad879127SKrish Sadhukhan 
386ad879127SKrish Sadhukhan         switch (opcode[1]) {
387ad879127SKrish Sadhukhan         case 0x30: /* WRMSR */
388ad879127SKrish Sadhukhan             exit_info_1 = 1;
389ad879127SKrish Sadhukhan             break;
390ad879127SKrish Sadhukhan         case 0x32: /* RDMSR */
391ad879127SKrish Sadhukhan             exit_info_1 = 0;
392ad879127SKrish Sadhukhan             break;
393ad879127SKrish Sadhukhan         default:
394ad879127SKrish Sadhukhan             return true;
395ad879127SKrish Sadhukhan         }
396ad879127SKrish Sadhukhan 
397ad879127SKrish Sadhukhan         /*
398912c0d72SThomas Huth          * Warn that #GP exception occurred instead.
399ad879127SKrish Sadhukhan          * RCX holds the MSR index.
400ad879127SKrish Sadhukhan          */
401ad879127SKrish Sadhukhan         printf("%s 0x%lx #GP exception\n",
402ad879127SKrish Sadhukhan             exit_info_1 ? "WRMSR" : "RDMSR", get_regs().rcx);
403ad879127SKrish Sadhukhan     }
404ad879127SKrish Sadhukhan 
405ad879127SKrish Sadhukhan     /* Jump over RDMSR/WRMSR instruction */
406096cf7feSPaolo Bonzini     vmcb->save.rip += 2;
407ad879127SKrish Sadhukhan 
408ad879127SKrish Sadhukhan     /*
409ad879127SKrish Sadhukhan      * Test whether the intercept was for RDMSR/WRMSR.
410ad879127SKrish Sadhukhan      * For RDMSR, test->scratch is set to the MSR index;
411ad879127SKrish Sadhukhan      *      RCX holds the MSR index.
412ad879127SKrish Sadhukhan      * For WRMSR, test->scratch is set to the MSR value;
413ad879127SKrish Sadhukhan      *      RDX holds the upper 32 bits of the MSR value,
414ad879127SKrish Sadhukhan      *      while RAX hold its lower 32 bits.
415ad879127SKrish Sadhukhan      */
416ad879127SKrish Sadhukhan     if (exit_info_1)
417ad879127SKrish Sadhukhan         test->scratch =
418096cf7feSPaolo Bonzini             ((get_regs().rdx << 32) | (vmcb->save.rax & 0xffffffff));
419ad879127SKrish Sadhukhan     else
420ad879127SKrish Sadhukhan         test->scratch = get_regs().rcx;
421ad879127SKrish Sadhukhan 
422ad879127SKrish Sadhukhan     return false;
423ad879127SKrish Sadhukhan }
424ad879127SKrish Sadhukhan 
425ad879127SKrish Sadhukhan static bool check_msr_intercept(struct svm_test *test)
426ad879127SKrish Sadhukhan {
427ad879127SKrish Sadhukhan     memset(msr_bitmap, 0, MSR_BITMAP_SIZE);
428ad879127SKrish Sadhukhan     return (test->scratch == -2);
429ad879127SKrish Sadhukhan }
430ad879127SKrish Sadhukhan 
431ad879127SKrish Sadhukhan static void prepare_mode_switch(struct svm_test *test)
432ad879127SKrish Sadhukhan {
433096cf7feSPaolo Bonzini     vmcb->control.intercept_exceptions |= (1ULL << GP_VECTOR)
434ad879127SKrish Sadhukhan                                              |  (1ULL << UD_VECTOR)
435ad879127SKrish Sadhukhan                                              |  (1ULL << DF_VECTOR)
436ad879127SKrish Sadhukhan                                              |  (1ULL << PF_VECTOR);
437ad879127SKrish Sadhukhan     test->scratch = 0;
438ad879127SKrish Sadhukhan }
439ad879127SKrish Sadhukhan 
440ad879127SKrish Sadhukhan static void test_mode_switch(struct svm_test *test)
441ad879127SKrish Sadhukhan {
442ad879127SKrish Sadhukhan     asm volatile("	cli\n"
443ad879127SKrish Sadhukhan 		 "	ljmp *1f\n" /* jump to 32-bit code segment */
444ad879127SKrish Sadhukhan 		 "1:\n"
445ad879127SKrish Sadhukhan 		 "	.long 2f\n"
446ad879127SKrish Sadhukhan 		 "	.long " xstr(KERNEL_CS32) "\n"
447ad879127SKrish Sadhukhan 		 ".code32\n"
448ad879127SKrish Sadhukhan 		 "2:\n"
449ad879127SKrish Sadhukhan 		 "	movl %%cr0, %%eax\n"
450ad879127SKrish Sadhukhan 		 "	btcl  $31, %%eax\n" /* clear PG */
451ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr0\n"
452ad879127SKrish Sadhukhan 		 "	movl $0xc0000080, %%ecx\n" /* EFER */
453ad879127SKrish Sadhukhan 		 "	rdmsr\n"
454ad879127SKrish Sadhukhan 		 "	btcl $8, %%eax\n" /* clear LME */
455ad879127SKrish Sadhukhan 		 "	wrmsr\n"
456ad879127SKrish Sadhukhan 		 "	movl %%cr4, %%eax\n"
457ad879127SKrish Sadhukhan 		 "	btcl $5, %%eax\n" /* clear PAE */
458ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr4\n"
459ad879127SKrish Sadhukhan 		 "	movw %[ds16], %%ax\n"
460ad879127SKrish Sadhukhan 		 "	movw %%ax, %%ds\n"
461ad879127SKrish Sadhukhan 		 "	ljmpl %[cs16], $3f\n" /* jump to 16 bit protected-mode */
462ad879127SKrish Sadhukhan 		 ".code16\n"
463ad879127SKrish Sadhukhan 		 "3:\n"
464ad879127SKrish Sadhukhan 		 "	movl %%cr0, %%eax\n"
465ad879127SKrish Sadhukhan 		 "	btcl $0, %%eax\n" /* clear PE  */
466ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr0\n"
467ad879127SKrish Sadhukhan 		 "	ljmpl $0, $4f\n"   /* jump to real-mode */
468ad879127SKrish Sadhukhan 		 "4:\n"
469ad879127SKrish Sadhukhan 		 "	vmmcall\n"
470ad879127SKrish Sadhukhan 		 "	movl %%cr0, %%eax\n"
471ad879127SKrish Sadhukhan 		 "	btsl $0, %%eax\n" /* set PE  */
472ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr0\n"
473ad879127SKrish Sadhukhan 		 "	ljmpl %[cs32], $5f\n" /* back to protected mode */
474ad879127SKrish Sadhukhan 		 ".code32\n"
475ad879127SKrish Sadhukhan 		 "5:\n"
476ad879127SKrish Sadhukhan 		 "	movl %%cr4, %%eax\n"
477ad879127SKrish Sadhukhan 		 "	btsl $5, %%eax\n" /* set PAE */
478ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr4\n"
479ad879127SKrish Sadhukhan 		 "	movl $0xc0000080, %%ecx\n" /* EFER */
480ad879127SKrish Sadhukhan 		 "	rdmsr\n"
481ad879127SKrish Sadhukhan 		 "	btsl $8, %%eax\n" /* set LME */
482ad879127SKrish Sadhukhan 		 "	wrmsr\n"
483ad879127SKrish Sadhukhan 		 "	movl %%cr0, %%eax\n"
484ad879127SKrish Sadhukhan 		 "	btsl  $31, %%eax\n" /* set PG */
485ad879127SKrish Sadhukhan 		 "	movl %%eax, %%cr0\n"
486ad879127SKrish Sadhukhan 		 "	ljmpl %[cs64], $6f\n"    /* back to long mode */
487ad879127SKrish Sadhukhan 		 ".code64\n\t"
488ad879127SKrish Sadhukhan 		 "6:\n"
489ad879127SKrish Sadhukhan 		 "	vmmcall\n"
490ad879127SKrish Sadhukhan 		 :: [cs16] "i"(KERNEL_CS16), [ds16] "i"(KERNEL_DS16),
491ad879127SKrish Sadhukhan 		    [cs32] "i"(KERNEL_CS32), [cs64] "i"(KERNEL_CS64)
492ad879127SKrish Sadhukhan 		 : "rax", "rbx", "rcx", "rdx", "memory");
493ad879127SKrish Sadhukhan }
494ad879127SKrish Sadhukhan 
495ad879127SKrish Sadhukhan static bool mode_switch_finished(struct svm_test *test)
496ad879127SKrish Sadhukhan {
497ad879127SKrish Sadhukhan     u64 cr0, cr4, efer;
498ad879127SKrish Sadhukhan 
499096cf7feSPaolo Bonzini     cr0  = vmcb->save.cr0;
500096cf7feSPaolo Bonzini     cr4  = vmcb->save.cr4;
501096cf7feSPaolo Bonzini     efer = vmcb->save.efer;
502ad879127SKrish Sadhukhan 
503ad879127SKrish Sadhukhan     /* Only expect VMMCALL intercepts */
504096cf7feSPaolo Bonzini     if (vmcb->control.exit_code != SVM_EXIT_VMMCALL)
505ad879127SKrish Sadhukhan 	    return true;
506ad879127SKrish Sadhukhan 
507ad879127SKrish Sadhukhan     /* Jump over VMMCALL instruction */
508096cf7feSPaolo Bonzini     vmcb->save.rip += 3;
509ad879127SKrish Sadhukhan 
510ad879127SKrish Sadhukhan     /* Do sanity checks */
511ad879127SKrish Sadhukhan     switch (test->scratch) {
512ad879127SKrish Sadhukhan     case 0:
513ad879127SKrish Sadhukhan         /* Test should be in real mode now - check for this */
514ad879127SKrish Sadhukhan         if ((cr0  & 0x80000001) || /* CR0.PG, CR0.PE */
515ad879127SKrish Sadhukhan             (cr4  & 0x00000020) || /* CR4.PAE */
516ad879127SKrish Sadhukhan             (efer & 0x00000500))   /* EFER.LMA, EFER.LME */
517ad879127SKrish Sadhukhan                 return true;
518ad879127SKrish Sadhukhan         break;
519ad879127SKrish Sadhukhan     case 2:
520ad879127SKrish Sadhukhan         /* Test should be back in long-mode now - check for this */
521ad879127SKrish Sadhukhan         if (((cr0  & 0x80000001) != 0x80000001) || /* CR0.PG, CR0.PE */
522ad879127SKrish Sadhukhan             ((cr4  & 0x00000020) != 0x00000020) || /* CR4.PAE */
523ad879127SKrish Sadhukhan             ((efer & 0x00000500) != 0x00000500))   /* EFER.LMA, EFER.LME */
524ad879127SKrish Sadhukhan 		    return true;
525ad879127SKrish Sadhukhan 	break;
526ad879127SKrish Sadhukhan     }
527ad879127SKrish Sadhukhan 
528ad879127SKrish Sadhukhan     /* one step forward */
529ad879127SKrish Sadhukhan     test->scratch += 1;
530ad879127SKrish Sadhukhan 
531ad879127SKrish Sadhukhan     return test->scratch == 2;
532ad879127SKrish Sadhukhan }
533ad879127SKrish Sadhukhan 
534ad879127SKrish Sadhukhan static bool check_mode_switch(struct svm_test *test)
535ad879127SKrish Sadhukhan {
536ad879127SKrish Sadhukhan 	return test->scratch == 2;
537ad879127SKrish Sadhukhan }
538ad879127SKrish Sadhukhan 
539ad879127SKrish Sadhukhan extern u8 *io_bitmap;
540ad879127SKrish Sadhukhan 
541ad879127SKrish Sadhukhan static void prepare_ioio(struct svm_test *test)
542ad879127SKrish Sadhukhan {
543096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_IOIO_PROT);
544ad879127SKrish Sadhukhan     test->scratch = 0;
545ad879127SKrish Sadhukhan     memset(io_bitmap, 0, 8192);
546ad879127SKrish Sadhukhan     io_bitmap[8192] = 0xFF;
547ad879127SKrish Sadhukhan }
548ad879127SKrish Sadhukhan 
549ad879127SKrish Sadhukhan static void test_ioio(struct svm_test *test)
550ad879127SKrish Sadhukhan {
551ad879127SKrish Sadhukhan     // stage 0, test IO pass
552ad879127SKrish Sadhukhan     inb(0x5000);
553ad879127SKrish Sadhukhan     outb(0x0, 0x5000);
554ad879127SKrish Sadhukhan     if (get_test_stage(test) != 0)
555ad879127SKrish Sadhukhan         goto fail;
556ad879127SKrish Sadhukhan 
557ad879127SKrish Sadhukhan     // test IO width, in/out
558ad879127SKrish Sadhukhan     io_bitmap[0] = 0xFF;
559ad879127SKrish Sadhukhan     inc_test_stage(test);
560ad879127SKrish Sadhukhan     inb(0x0);
561ad879127SKrish Sadhukhan     if (get_test_stage(test) != 2)
562ad879127SKrish Sadhukhan         goto fail;
563ad879127SKrish Sadhukhan 
564ad879127SKrish Sadhukhan     outw(0x0, 0x0);
565ad879127SKrish Sadhukhan     if (get_test_stage(test) != 3)
566ad879127SKrish Sadhukhan         goto fail;
567ad879127SKrish Sadhukhan 
568ad879127SKrish Sadhukhan     inl(0x0);
569ad879127SKrish Sadhukhan     if (get_test_stage(test) != 4)
570ad879127SKrish Sadhukhan         goto fail;
571ad879127SKrish Sadhukhan 
572ad879127SKrish Sadhukhan     // test low/high IO port
573ad879127SKrish Sadhukhan     io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8));
574ad879127SKrish Sadhukhan     inb(0x5000);
575ad879127SKrish Sadhukhan     if (get_test_stage(test) != 5)
576ad879127SKrish Sadhukhan         goto fail;
577ad879127SKrish Sadhukhan 
578ad879127SKrish Sadhukhan     io_bitmap[0x9000 / 8] = (1 << (0x9000 % 8));
579ad879127SKrish Sadhukhan     inw(0x9000);
580ad879127SKrish Sadhukhan     if (get_test_stage(test) != 6)
581ad879127SKrish Sadhukhan         goto fail;
582ad879127SKrish Sadhukhan 
583ad879127SKrish Sadhukhan     // test partial pass
584ad879127SKrish Sadhukhan     io_bitmap[0x5000 / 8] = (1 << (0x5000 % 8));
585ad879127SKrish Sadhukhan     inl(0x4FFF);
586ad879127SKrish Sadhukhan     if (get_test_stage(test) != 7)
587ad879127SKrish Sadhukhan         goto fail;
588ad879127SKrish Sadhukhan 
589ad879127SKrish Sadhukhan     // test across pages
590ad879127SKrish Sadhukhan     inc_test_stage(test);
591ad879127SKrish Sadhukhan     inl(0x7FFF);
592ad879127SKrish Sadhukhan     if (get_test_stage(test) != 8)
593ad879127SKrish Sadhukhan         goto fail;
594ad879127SKrish Sadhukhan 
595ad879127SKrish Sadhukhan     inc_test_stage(test);
596ad879127SKrish Sadhukhan     io_bitmap[0x8000 / 8] = 1 << (0x8000 % 8);
597ad879127SKrish Sadhukhan     inl(0x7FFF);
598ad879127SKrish Sadhukhan     if (get_test_stage(test) != 10)
599ad879127SKrish Sadhukhan         goto fail;
600ad879127SKrish Sadhukhan 
601ad879127SKrish Sadhukhan     io_bitmap[0] = 0;
602ad879127SKrish Sadhukhan     inl(0xFFFF);
603ad879127SKrish Sadhukhan     if (get_test_stage(test) != 11)
604ad879127SKrish Sadhukhan         goto fail;
605ad879127SKrish Sadhukhan 
606ad879127SKrish Sadhukhan     io_bitmap[0] = 0xFF;
607ad879127SKrish Sadhukhan     io_bitmap[8192] = 0;
608ad879127SKrish Sadhukhan     inl(0xFFFF);
609ad879127SKrish Sadhukhan     inc_test_stage(test);
610ad879127SKrish Sadhukhan     if (get_test_stage(test) != 12)
611ad879127SKrish Sadhukhan         goto fail;
612ad879127SKrish Sadhukhan 
613ad879127SKrish Sadhukhan     return;
614ad879127SKrish Sadhukhan 
615ad879127SKrish Sadhukhan fail:
616198dfd0eSJanis Schoetterl-Glausch     report_fail("stage %d", get_test_stage(test));
617ad879127SKrish Sadhukhan     test->scratch = -1;
618ad879127SKrish Sadhukhan }
619ad879127SKrish Sadhukhan 
620ad879127SKrish Sadhukhan static bool ioio_finished(struct svm_test *test)
621ad879127SKrish Sadhukhan {
622ad879127SKrish Sadhukhan     unsigned port, size;
623ad879127SKrish Sadhukhan 
624ad879127SKrish Sadhukhan     /* Only expect IOIO intercepts */
625096cf7feSPaolo Bonzini     if (vmcb->control.exit_code == SVM_EXIT_VMMCALL)
626ad879127SKrish Sadhukhan         return true;
627ad879127SKrish Sadhukhan 
628096cf7feSPaolo Bonzini     if (vmcb->control.exit_code != SVM_EXIT_IOIO)
629ad879127SKrish Sadhukhan         return true;
630ad879127SKrish Sadhukhan 
631ad879127SKrish Sadhukhan     /* one step forward */
632ad879127SKrish Sadhukhan     test->scratch += 1;
633ad879127SKrish Sadhukhan 
634096cf7feSPaolo Bonzini     port = vmcb->control.exit_info_1 >> 16;
635096cf7feSPaolo Bonzini     size = (vmcb->control.exit_info_1 >> SVM_IOIO_SIZE_SHIFT) & 7;
636ad879127SKrish Sadhukhan 
637ad879127SKrish Sadhukhan     while (size--) {
638ad879127SKrish Sadhukhan         io_bitmap[port / 8] &= ~(1 << (port & 7));
639ad879127SKrish Sadhukhan         port++;
640ad879127SKrish Sadhukhan     }
641ad879127SKrish Sadhukhan 
642ad879127SKrish Sadhukhan     return false;
643ad879127SKrish Sadhukhan }
644ad879127SKrish Sadhukhan 
645ad879127SKrish Sadhukhan static bool check_ioio(struct svm_test *test)
646ad879127SKrish Sadhukhan {
647ad879127SKrish Sadhukhan     memset(io_bitmap, 0, 8193);
648ad879127SKrish Sadhukhan     return test->scratch != -1;
649ad879127SKrish Sadhukhan }
650ad879127SKrish Sadhukhan 
651ad879127SKrish Sadhukhan static void prepare_asid_zero(struct svm_test *test)
652ad879127SKrish Sadhukhan {
653096cf7feSPaolo Bonzini     vmcb->control.asid = 0;
654ad879127SKrish Sadhukhan }
655ad879127SKrish Sadhukhan 
656ad879127SKrish Sadhukhan static void test_asid_zero(struct svm_test *test)
657ad879127SKrish Sadhukhan {
658ad879127SKrish Sadhukhan     asm volatile ("vmmcall\n\t");
659ad879127SKrish Sadhukhan }
660ad879127SKrish Sadhukhan 
661ad879127SKrish Sadhukhan static bool check_asid_zero(struct svm_test *test)
662ad879127SKrish Sadhukhan {
663096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_ERR;
664ad879127SKrish Sadhukhan }
665ad879127SKrish Sadhukhan 
666ad879127SKrish Sadhukhan static void sel_cr0_bug_prepare(struct svm_test *test)
667ad879127SKrish Sadhukhan {
668096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_SELECTIVE_CR0);
669ad879127SKrish Sadhukhan }
670ad879127SKrish Sadhukhan 
671ad879127SKrish Sadhukhan static bool sel_cr0_bug_finished(struct svm_test *test)
672ad879127SKrish Sadhukhan {
673ad879127SKrish Sadhukhan 	return true;
674ad879127SKrish Sadhukhan }
675ad879127SKrish Sadhukhan 
676ad879127SKrish Sadhukhan static void sel_cr0_bug_test(struct svm_test *test)
677ad879127SKrish Sadhukhan {
678ad879127SKrish Sadhukhan     unsigned long cr0;
679ad879127SKrish Sadhukhan 
680ad879127SKrish Sadhukhan     /* read cr0, clear CD, and write back */
681ad879127SKrish Sadhukhan     cr0  = read_cr0();
682ad879127SKrish Sadhukhan     cr0 |= (1UL << 30);
683ad879127SKrish Sadhukhan     write_cr0(cr0);
684ad879127SKrish Sadhukhan 
685ad879127SKrish Sadhukhan     /*
686ad879127SKrish Sadhukhan      * If we are here the test failed, not sure what to do now because we
687ad879127SKrish Sadhukhan      * are not in guest-mode anymore so we can't trigger an intercept.
688ad879127SKrish Sadhukhan      * Trigger a tripple-fault for now.
689ad879127SKrish Sadhukhan      */
690198dfd0eSJanis Schoetterl-Glausch     report_fail("sel_cr0 test. Can not recover from this - exiting");
691ad879127SKrish Sadhukhan     exit(report_summary());
692ad879127SKrish Sadhukhan }
693ad879127SKrish Sadhukhan 
694ad879127SKrish Sadhukhan static bool sel_cr0_bug_check(struct svm_test *test)
695ad879127SKrish Sadhukhan {
696096cf7feSPaolo Bonzini     return vmcb->control.exit_code == SVM_EXIT_CR0_SEL_WRITE;
697ad879127SKrish Sadhukhan }
698ad879127SKrish Sadhukhan 
699ad879127SKrish Sadhukhan #define TSC_ADJUST_VALUE    (1ll << 32)
700f3154609SBill Wendling #define TSC_OFFSET_VALUE    (~0ull << 48)
701ad879127SKrish Sadhukhan static bool ok;
702ad879127SKrish Sadhukhan 
70310a65fc4SNadav Amit static bool tsc_adjust_supported(void)
70410a65fc4SNadav Amit {
70510a65fc4SNadav Amit     return this_cpu_has(X86_FEATURE_TSC_ADJUST);
70610a65fc4SNadav Amit }
70710a65fc4SNadav Amit 
708ad879127SKrish Sadhukhan static void tsc_adjust_prepare(struct svm_test *test)
709ad879127SKrish Sadhukhan {
710ad879127SKrish Sadhukhan     default_prepare(test);
711096cf7feSPaolo Bonzini     vmcb->control.tsc_offset = TSC_OFFSET_VALUE;
712ad879127SKrish Sadhukhan 
713ad879127SKrish Sadhukhan     wrmsr(MSR_IA32_TSC_ADJUST, -TSC_ADJUST_VALUE);
714ad879127SKrish Sadhukhan     int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST);
715ad879127SKrish Sadhukhan     ok = adjust == -TSC_ADJUST_VALUE;
716ad879127SKrish Sadhukhan }
717ad879127SKrish Sadhukhan 
718ad879127SKrish Sadhukhan static void tsc_adjust_test(struct svm_test *test)
719ad879127SKrish Sadhukhan {
720ad879127SKrish Sadhukhan     int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST);
721ad879127SKrish Sadhukhan     ok &= adjust == -TSC_ADJUST_VALUE;
722ad879127SKrish Sadhukhan 
723ad879127SKrish Sadhukhan     uint64_t l1_tsc = rdtsc() - TSC_OFFSET_VALUE;
724ad879127SKrish Sadhukhan     wrmsr(MSR_IA32_TSC, l1_tsc - TSC_ADJUST_VALUE);
725ad879127SKrish Sadhukhan 
726ad879127SKrish Sadhukhan     adjust = rdmsr(MSR_IA32_TSC_ADJUST);
727ad879127SKrish Sadhukhan     ok &= adjust <= -2 * TSC_ADJUST_VALUE;
728ad879127SKrish Sadhukhan 
729ad879127SKrish Sadhukhan     uint64_t l1_tsc_end = rdtsc() - TSC_OFFSET_VALUE;
730ad879127SKrish Sadhukhan     ok &= (l1_tsc_end + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE;
731ad879127SKrish Sadhukhan 
732ad879127SKrish Sadhukhan     uint64_t l1_tsc_msr = rdmsr(MSR_IA32_TSC) - TSC_OFFSET_VALUE;
733ad879127SKrish Sadhukhan     ok &= (l1_tsc_msr + TSC_ADJUST_VALUE - l1_tsc) < TSC_ADJUST_VALUE;
734ad879127SKrish Sadhukhan }
735ad879127SKrish Sadhukhan 
736ad879127SKrish Sadhukhan static bool tsc_adjust_check(struct svm_test *test)
737ad879127SKrish Sadhukhan {
738ad879127SKrish Sadhukhan     int64_t adjust = rdmsr(MSR_IA32_TSC_ADJUST);
739ad879127SKrish Sadhukhan 
740ad879127SKrish Sadhukhan     wrmsr(MSR_IA32_TSC_ADJUST, 0);
741ad879127SKrish Sadhukhan     return ok && adjust <= -2 * TSC_ADJUST_VALUE;
742ad879127SKrish Sadhukhan }
743ad879127SKrish Sadhukhan 
744a8503d50SMaxim Levitsky 
745a8503d50SMaxim Levitsky static u64 guest_tsc_delay_value;
746a8503d50SMaxim Levitsky /* number of bits to shift tsc right for stable result */
747a8503d50SMaxim Levitsky #define TSC_SHIFT 24
748a8503d50SMaxim Levitsky #define TSC_SCALE_ITERATIONS 10
749a8503d50SMaxim Levitsky 
750a8503d50SMaxim Levitsky static void svm_tsc_scale_guest(struct svm_test *test)
751a8503d50SMaxim Levitsky {
752a8503d50SMaxim Levitsky     u64 start_tsc = rdtsc();
753a8503d50SMaxim Levitsky 
754a8503d50SMaxim Levitsky     while (rdtsc() - start_tsc < guest_tsc_delay_value)
755a8503d50SMaxim Levitsky         cpu_relax();
756a8503d50SMaxim Levitsky }
757a8503d50SMaxim Levitsky 
758a8503d50SMaxim Levitsky static void svm_tsc_scale_run_testcase(u64 duration,
759a8503d50SMaxim Levitsky         double tsc_scale, u64 tsc_offset)
760a8503d50SMaxim Levitsky {
761a8503d50SMaxim Levitsky     u64 start_tsc, actual_duration;
762a8503d50SMaxim Levitsky 
763a8503d50SMaxim Levitsky     guest_tsc_delay_value = (duration << TSC_SHIFT) * tsc_scale;
764a8503d50SMaxim Levitsky 
765a8503d50SMaxim Levitsky     test_set_guest(svm_tsc_scale_guest);
766a8503d50SMaxim Levitsky     vmcb->control.tsc_offset = tsc_offset;
767a8503d50SMaxim Levitsky     wrmsr(MSR_AMD64_TSC_RATIO, (u64)(tsc_scale * (1ULL << 32)));
768a8503d50SMaxim Levitsky 
769a8503d50SMaxim Levitsky     start_tsc = rdtsc();
770a8503d50SMaxim Levitsky 
771a8503d50SMaxim Levitsky     if (svm_vmrun() != SVM_EXIT_VMMCALL)
772a8503d50SMaxim Levitsky         report_fail("unexpected vm exit code 0x%x", vmcb->control.exit_code);
773a8503d50SMaxim Levitsky 
774a8503d50SMaxim Levitsky     actual_duration = (rdtsc() - start_tsc) >> TSC_SHIFT;
775a8503d50SMaxim Levitsky 
776a8503d50SMaxim Levitsky     report(duration == actual_duration, "tsc delay (expected: %lu, actual: %lu)",
777a8503d50SMaxim Levitsky             duration, actual_duration);
778a8503d50SMaxim Levitsky }
779a8503d50SMaxim Levitsky 
780a8503d50SMaxim Levitsky static void svm_tsc_scale_test(void)
781a8503d50SMaxim Levitsky {
782a8503d50SMaxim Levitsky     int i;
783a8503d50SMaxim Levitsky 
784a8503d50SMaxim Levitsky     if (!tsc_scale_supported()) {
785a8503d50SMaxim Levitsky         report_skip("TSC scale not supported in the guest");
786a8503d50SMaxim Levitsky         return;
787a8503d50SMaxim Levitsky     }
788a8503d50SMaxim Levitsky 
789a8503d50SMaxim Levitsky     report(rdmsr(MSR_AMD64_TSC_RATIO) == TSC_RATIO_DEFAULT,
790a8503d50SMaxim Levitsky            "initial TSC scale ratio");
791a8503d50SMaxim Levitsky 
792a8503d50SMaxim Levitsky     for (i = 0 ; i < TSC_SCALE_ITERATIONS; i++) {
793a8503d50SMaxim Levitsky 
794a8503d50SMaxim Levitsky         double tsc_scale = (double)(rdrand() % 100 + 1) / 10;
795a8503d50SMaxim Levitsky         int duration = rdrand() % 50 + 1;
796a8503d50SMaxim Levitsky         u64 tsc_offset = rdrand();
797a8503d50SMaxim Levitsky 
798a8503d50SMaxim Levitsky         report_info("duration=%d, tsc_scale=%d, tsc_offset=%ld",
799a8503d50SMaxim Levitsky                     duration, (int)(tsc_scale * 100), tsc_offset);
800a8503d50SMaxim Levitsky 
801a8503d50SMaxim Levitsky         svm_tsc_scale_run_testcase(duration, tsc_scale, tsc_offset);
802a8503d50SMaxim Levitsky     }
803a8503d50SMaxim Levitsky 
804a8503d50SMaxim Levitsky     svm_tsc_scale_run_testcase(50, 255, rdrand());
805a8503d50SMaxim Levitsky     svm_tsc_scale_run_testcase(50, 0.0001, rdrand());
806a8503d50SMaxim Levitsky }
807a8503d50SMaxim Levitsky 
808ad879127SKrish Sadhukhan static void latency_prepare(struct svm_test *test)
809ad879127SKrish Sadhukhan {
810ad879127SKrish Sadhukhan     default_prepare(test);
811ad879127SKrish Sadhukhan     runs = LATENCY_RUNS;
812ad879127SKrish Sadhukhan     latvmrun_min = latvmexit_min = -1ULL;
813ad879127SKrish Sadhukhan     latvmrun_max = latvmexit_max = 0;
814ad879127SKrish Sadhukhan     vmrun_sum = vmexit_sum = 0;
815ad879127SKrish Sadhukhan     tsc_start = rdtsc();
816ad879127SKrish Sadhukhan }
817ad879127SKrish Sadhukhan 
818ad879127SKrish Sadhukhan static void latency_test(struct svm_test *test)
819ad879127SKrish Sadhukhan {
820ad879127SKrish Sadhukhan     u64 cycles;
821ad879127SKrish Sadhukhan 
822ad879127SKrish Sadhukhan start:
823ad879127SKrish Sadhukhan     tsc_end = rdtsc();
824ad879127SKrish Sadhukhan 
825ad879127SKrish Sadhukhan     cycles = tsc_end - tsc_start;
826ad879127SKrish Sadhukhan 
827ad879127SKrish Sadhukhan     if (cycles > latvmrun_max)
828ad879127SKrish Sadhukhan         latvmrun_max = cycles;
829ad879127SKrish Sadhukhan 
830ad879127SKrish Sadhukhan     if (cycles < latvmrun_min)
831ad879127SKrish Sadhukhan         latvmrun_min = cycles;
832ad879127SKrish Sadhukhan 
833ad879127SKrish Sadhukhan     vmrun_sum += cycles;
834ad879127SKrish Sadhukhan 
835ad879127SKrish Sadhukhan     tsc_start = rdtsc();
836ad879127SKrish Sadhukhan 
837ad879127SKrish Sadhukhan     asm volatile ("vmmcall" : : : "memory");
838ad879127SKrish Sadhukhan     goto start;
839ad879127SKrish Sadhukhan }
840ad879127SKrish Sadhukhan 
841ad879127SKrish Sadhukhan static bool latency_finished(struct svm_test *test)
842ad879127SKrish Sadhukhan {
843ad879127SKrish Sadhukhan     u64 cycles;
844ad879127SKrish Sadhukhan 
845ad879127SKrish Sadhukhan     tsc_end = rdtsc();
846ad879127SKrish Sadhukhan 
847ad879127SKrish Sadhukhan     cycles = tsc_end - tsc_start;
848ad879127SKrish Sadhukhan 
849ad879127SKrish Sadhukhan     if (cycles > latvmexit_max)
850ad879127SKrish Sadhukhan         latvmexit_max = cycles;
851ad879127SKrish Sadhukhan 
852ad879127SKrish Sadhukhan     if (cycles < latvmexit_min)
853ad879127SKrish Sadhukhan         latvmexit_min = cycles;
854ad879127SKrish Sadhukhan 
855ad879127SKrish Sadhukhan     vmexit_sum += cycles;
856ad879127SKrish Sadhukhan 
857096cf7feSPaolo Bonzini     vmcb->save.rip += 3;
858ad879127SKrish Sadhukhan 
859ad879127SKrish Sadhukhan     runs -= 1;
860ad879127SKrish Sadhukhan 
861ad879127SKrish Sadhukhan     tsc_end = rdtsc();
862ad879127SKrish Sadhukhan 
863ad879127SKrish Sadhukhan     return runs == 0;
864ad879127SKrish Sadhukhan }
865ad879127SKrish Sadhukhan 
866f7fa53dcSPaolo Bonzini static bool latency_finished_clean(struct svm_test *test)
867f7fa53dcSPaolo Bonzini {
868f7fa53dcSPaolo Bonzini     vmcb->control.clean = VMCB_CLEAN_ALL;
869f7fa53dcSPaolo Bonzini     return latency_finished(test);
870f7fa53dcSPaolo Bonzini }
871f7fa53dcSPaolo Bonzini 
872ad879127SKrish Sadhukhan static bool latency_check(struct svm_test *test)
873ad879127SKrish Sadhukhan {
874ad879127SKrish Sadhukhan     printf("    Latency VMRUN : max: %ld min: %ld avg: %ld\n", latvmrun_max,
875ad879127SKrish Sadhukhan             latvmrun_min, vmrun_sum / LATENCY_RUNS);
876ad879127SKrish Sadhukhan     printf("    Latency VMEXIT: max: %ld min: %ld avg: %ld\n", latvmexit_max,
877ad879127SKrish Sadhukhan             latvmexit_min, vmexit_sum / LATENCY_RUNS);
878ad879127SKrish Sadhukhan     return true;
879ad879127SKrish Sadhukhan }
880ad879127SKrish Sadhukhan 
881ad879127SKrish Sadhukhan static void lat_svm_insn_prepare(struct svm_test *test)
882ad879127SKrish Sadhukhan {
883ad879127SKrish Sadhukhan     default_prepare(test);
884ad879127SKrish Sadhukhan     runs = LATENCY_RUNS;
885ad879127SKrish Sadhukhan     latvmload_min = latvmsave_min = latstgi_min = latclgi_min = -1ULL;
886ad879127SKrish Sadhukhan     latvmload_max = latvmsave_max = latstgi_max = latclgi_max = 0;
887ad879127SKrish Sadhukhan     vmload_sum = vmsave_sum = stgi_sum = clgi_sum;
888ad879127SKrish Sadhukhan }
889ad879127SKrish Sadhukhan 
890ad879127SKrish Sadhukhan static bool lat_svm_insn_finished(struct svm_test *test)
891ad879127SKrish Sadhukhan {
892096cf7feSPaolo Bonzini     u64 vmcb_phys = virt_to_phys(vmcb);
893ad879127SKrish Sadhukhan     u64 cycles;
894ad879127SKrish Sadhukhan 
895ad879127SKrish Sadhukhan     for ( ; runs != 0; runs--) {
896ad879127SKrish Sadhukhan         tsc_start = rdtsc();
897ad879127SKrish Sadhukhan         asm volatile("vmload %0\n\t" : : "a"(vmcb_phys) : "memory");
898ad879127SKrish Sadhukhan         cycles = rdtsc() - tsc_start;
899ad879127SKrish Sadhukhan         if (cycles > latvmload_max)
900ad879127SKrish Sadhukhan             latvmload_max = cycles;
901ad879127SKrish Sadhukhan         if (cycles < latvmload_min)
902ad879127SKrish Sadhukhan             latvmload_min = cycles;
903ad879127SKrish Sadhukhan         vmload_sum += cycles;
904ad879127SKrish Sadhukhan 
905ad879127SKrish Sadhukhan         tsc_start = rdtsc();
906ad879127SKrish Sadhukhan         asm volatile("vmsave %0\n\t" : : "a"(vmcb_phys) : "memory");
907ad879127SKrish Sadhukhan         cycles = rdtsc() - tsc_start;
908ad879127SKrish Sadhukhan         if (cycles > latvmsave_max)
909ad879127SKrish Sadhukhan             latvmsave_max = cycles;
910ad879127SKrish Sadhukhan         if (cycles < latvmsave_min)
911ad879127SKrish Sadhukhan             latvmsave_min = cycles;
912ad879127SKrish Sadhukhan         vmsave_sum += cycles;
913ad879127SKrish Sadhukhan 
914ad879127SKrish Sadhukhan         tsc_start = rdtsc();
915ad879127SKrish Sadhukhan         asm volatile("stgi\n\t");
916ad879127SKrish Sadhukhan         cycles = rdtsc() - tsc_start;
917ad879127SKrish Sadhukhan         if (cycles > latstgi_max)
918ad879127SKrish Sadhukhan             latstgi_max = cycles;
919ad879127SKrish Sadhukhan         if (cycles < latstgi_min)
920ad879127SKrish Sadhukhan             latstgi_min = cycles;
921ad879127SKrish Sadhukhan         stgi_sum += cycles;
922ad879127SKrish Sadhukhan 
923ad879127SKrish Sadhukhan         tsc_start = rdtsc();
924ad879127SKrish Sadhukhan         asm volatile("clgi\n\t");
925ad879127SKrish Sadhukhan         cycles = rdtsc() - tsc_start;
926ad879127SKrish Sadhukhan         if (cycles > latclgi_max)
927ad879127SKrish Sadhukhan             latclgi_max = cycles;
928ad879127SKrish Sadhukhan         if (cycles < latclgi_min)
929ad879127SKrish Sadhukhan             latclgi_min = cycles;
930ad879127SKrish Sadhukhan         clgi_sum += cycles;
931ad879127SKrish Sadhukhan     }
932ad879127SKrish Sadhukhan 
933ad879127SKrish Sadhukhan     tsc_end = rdtsc();
934ad879127SKrish Sadhukhan 
935ad879127SKrish Sadhukhan     return true;
936ad879127SKrish Sadhukhan }
937ad879127SKrish Sadhukhan 
938ad879127SKrish Sadhukhan static bool lat_svm_insn_check(struct svm_test *test)
939ad879127SKrish Sadhukhan {
940ad879127SKrish Sadhukhan     printf("    Latency VMLOAD: max: %ld min: %ld avg: %ld\n", latvmload_max,
941ad879127SKrish Sadhukhan             latvmload_min, vmload_sum / LATENCY_RUNS);
942ad879127SKrish Sadhukhan     printf("    Latency VMSAVE: max: %ld min: %ld avg: %ld\n", latvmsave_max,
943ad879127SKrish Sadhukhan             latvmsave_min, vmsave_sum / LATENCY_RUNS);
944ad879127SKrish Sadhukhan     printf("    Latency STGI:   max: %ld min: %ld avg: %ld\n", latstgi_max,
945ad879127SKrish Sadhukhan             latstgi_min, stgi_sum / LATENCY_RUNS);
946ad879127SKrish Sadhukhan     printf("    Latency CLGI:   max: %ld min: %ld avg: %ld\n", latclgi_max,
947ad879127SKrish Sadhukhan             latclgi_min, clgi_sum / LATENCY_RUNS);
948ad879127SKrish Sadhukhan     return true;
949ad879127SKrish Sadhukhan }
950ad879127SKrish Sadhukhan 
951ad879127SKrish Sadhukhan bool pending_event_ipi_fired;
952ad879127SKrish Sadhukhan bool pending_event_guest_run;
953ad879127SKrish Sadhukhan 
954ad879127SKrish Sadhukhan static void pending_event_ipi_isr(isr_regs_t *regs)
955ad879127SKrish Sadhukhan {
956ad879127SKrish Sadhukhan     pending_event_ipi_fired = true;
957ad879127SKrish Sadhukhan     eoi();
958ad879127SKrish Sadhukhan }
959ad879127SKrish Sadhukhan 
960ad879127SKrish Sadhukhan static void pending_event_prepare(struct svm_test *test)
961ad879127SKrish Sadhukhan {
962ad879127SKrish Sadhukhan     int ipi_vector = 0xf1;
963ad879127SKrish Sadhukhan 
964ad879127SKrish Sadhukhan     default_prepare(test);
965ad879127SKrish Sadhukhan 
966ad879127SKrish Sadhukhan     pending_event_ipi_fired = false;
967ad879127SKrish Sadhukhan 
968ad879127SKrish Sadhukhan     handle_irq(ipi_vector, pending_event_ipi_isr);
969ad879127SKrish Sadhukhan 
970ad879127SKrish Sadhukhan     pending_event_guest_run = false;
971ad879127SKrish Sadhukhan 
972096cf7feSPaolo Bonzini     vmcb->control.intercept |= (1ULL << INTERCEPT_INTR);
973096cf7feSPaolo Bonzini     vmcb->control.int_ctl |= V_INTR_MASKING_MASK;
974ad879127SKrish Sadhukhan 
975ad879127SKrish Sadhukhan     apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL |
976ad879127SKrish Sadhukhan                   APIC_DM_FIXED | ipi_vector, 0);
977ad879127SKrish Sadhukhan 
978ad879127SKrish Sadhukhan     set_test_stage(test, 0);
979ad879127SKrish Sadhukhan }
980ad879127SKrish Sadhukhan 
981ad879127SKrish Sadhukhan static void pending_event_test(struct svm_test *test)
982ad879127SKrish Sadhukhan {
983ad879127SKrish Sadhukhan     pending_event_guest_run = true;
984ad879127SKrish Sadhukhan }
985ad879127SKrish Sadhukhan 
986ad879127SKrish Sadhukhan static bool pending_event_finished(struct svm_test *test)
987ad879127SKrish Sadhukhan {
988ad879127SKrish Sadhukhan     switch (get_test_stage(test)) {
989ad879127SKrish Sadhukhan     case 0:
990096cf7feSPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_INTR) {
991198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to pending interrupt. Exit reason 0x%x",
992096cf7feSPaolo Bonzini                         vmcb->control.exit_code);
993ad879127SKrish Sadhukhan             return true;
994ad879127SKrish Sadhukhan         }
995ad879127SKrish Sadhukhan 
996096cf7feSPaolo Bonzini         vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR);
997096cf7feSPaolo Bonzini         vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
998ad879127SKrish Sadhukhan 
999ad879127SKrish Sadhukhan         if (pending_event_guest_run) {
1000198dfd0eSJanis Schoetterl-Glausch             report_fail("Guest ran before host received IPI\n");
1001ad879127SKrish Sadhukhan             return true;
1002ad879127SKrish Sadhukhan         }
1003ad879127SKrish Sadhukhan 
1004ad879127SKrish Sadhukhan         irq_enable();
1005ad879127SKrish Sadhukhan         asm volatile ("nop");
1006ad879127SKrish Sadhukhan         irq_disable();
1007ad879127SKrish Sadhukhan 
1008ad879127SKrish Sadhukhan         if (!pending_event_ipi_fired) {
1009198dfd0eSJanis Schoetterl-Glausch             report_fail("Pending interrupt not dispatched after IRQ enabled\n");
1010ad879127SKrish Sadhukhan             return true;
1011ad879127SKrish Sadhukhan         }
1012ad879127SKrish Sadhukhan         break;
1013ad879127SKrish Sadhukhan 
1014ad879127SKrish Sadhukhan     case 1:
1015ad879127SKrish Sadhukhan         if (!pending_event_guest_run) {
1016198dfd0eSJanis Schoetterl-Glausch             report_fail("Guest did not resume when no interrupt\n");
1017ad879127SKrish Sadhukhan             return true;
1018ad879127SKrish Sadhukhan         }
1019ad879127SKrish Sadhukhan         break;
1020ad879127SKrish Sadhukhan     }
1021ad879127SKrish Sadhukhan 
1022ad879127SKrish Sadhukhan     inc_test_stage(test);
1023ad879127SKrish Sadhukhan 
1024ad879127SKrish Sadhukhan     return get_test_stage(test) == 2;
1025ad879127SKrish Sadhukhan }
1026ad879127SKrish Sadhukhan 
1027ad879127SKrish Sadhukhan static bool pending_event_check(struct svm_test *test)
1028ad879127SKrish Sadhukhan {
1029ad879127SKrish Sadhukhan     return get_test_stage(test) == 2;
1030ad879127SKrish Sadhukhan }
1031ad879127SKrish Sadhukhan 
103285dc2aceSPaolo Bonzini static void pending_event_cli_prepare(struct svm_test *test)
1033ad879127SKrish Sadhukhan {
1034ad879127SKrish Sadhukhan     default_prepare(test);
1035ad879127SKrish Sadhukhan 
1036ad879127SKrish Sadhukhan     pending_event_ipi_fired = false;
1037ad879127SKrish Sadhukhan 
1038ad879127SKrish Sadhukhan     handle_irq(0xf1, pending_event_ipi_isr);
1039ad879127SKrish Sadhukhan 
1040ad879127SKrish Sadhukhan     apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL |
1041ad879127SKrish Sadhukhan               APIC_DM_FIXED | 0xf1, 0);
1042ad879127SKrish Sadhukhan 
1043ad879127SKrish Sadhukhan     set_test_stage(test, 0);
1044ad879127SKrish Sadhukhan }
1045ad879127SKrish Sadhukhan 
104685dc2aceSPaolo Bonzini static void pending_event_cli_prepare_gif_clear(struct svm_test *test)
1047ad879127SKrish Sadhukhan {
1048ad879127SKrish Sadhukhan     asm("cli");
1049ad879127SKrish Sadhukhan }
1050ad879127SKrish Sadhukhan 
105185dc2aceSPaolo Bonzini static void pending_event_cli_test(struct svm_test *test)
1052ad879127SKrish Sadhukhan {
1053ad879127SKrish Sadhukhan     if (pending_event_ipi_fired == true) {
1054ad879127SKrish Sadhukhan         set_test_stage(test, -1);
1055198dfd0eSJanis Schoetterl-Glausch         report_fail("Interrupt preceeded guest");
1056ad879127SKrish Sadhukhan         vmmcall();
1057ad879127SKrish Sadhukhan     }
1058ad879127SKrish Sadhukhan 
105985dc2aceSPaolo Bonzini     /* VINTR_MASKING is zero.  This should cause the IPI to fire.  */
1060ad879127SKrish Sadhukhan     irq_enable();
1061ad879127SKrish Sadhukhan     asm volatile ("nop");
1062ad879127SKrish Sadhukhan     irq_disable();
1063ad879127SKrish Sadhukhan 
1064ad879127SKrish Sadhukhan     if (pending_event_ipi_fired != true) {
1065ad879127SKrish Sadhukhan         set_test_stage(test, -1);
1066198dfd0eSJanis Schoetterl-Glausch         report_fail("Interrupt not triggered by guest");
1067ad879127SKrish Sadhukhan     }
1068ad879127SKrish Sadhukhan 
1069ad879127SKrish Sadhukhan     vmmcall();
1070ad879127SKrish Sadhukhan 
107185dc2aceSPaolo Bonzini     /*
107285dc2aceSPaolo Bonzini      * Now VINTR_MASKING=1, but no interrupt is pending so
107385dc2aceSPaolo Bonzini      * the VINTR interception should be clear in VMCB02.  Check
107485dc2aceSPaolo Bonzini      * that L0 did not leave a stale VINTR in the VMCB.
107585dc2aceSPaolo Bonzini      */
1076ad879127SKrish Sadhukhan     irq_enable();
1077ad879127SKrish Sadhukhan     asm volatile ("nop");
1078ad879127SKrish Sadhukhan     irq_disable();
1079ad879127SKrish Sadhukhan }
1080ad879127SKrish Sadhukhan 
108185dc2aceSPaolo Bonzini static bool pending_event_cli_finished(struct svm_test *test)
1082ad879127SKrish Sadhukhan {
1083096cf7feSPaolo Bonzini     if ( vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1084198dfd0eSJanis Schoetterl-Glausch         report_fail("VM_EXIT return to host is not EXIT_VMMCALL exit reason 0x%x",
1085096cf7feSPaolo Bonzini                     vmcb->control.exit_code);
1086ad879127SKrish Sadhukhan         return true;
1087ad879127SKrish Sadhukhan     }
1088ad879127SKrish Sadhukhan 
1089ad879127SKrish Sadhukhan     switch (get_test_stage(test)) {
1090ad879127SKrish Sadhukhan     case 0:
1091096cf7feSPaolo Bonzini         vmcb->save.rip += 3;
1092ad879127SKrish Sadhukhan 
1093ad879127SKrish Sadhukhan         pending_event_ipi_fired = false;
1094ad879127SKrish Sadhukhan 
1095096cf7feSPaolo Bonzini         vmcb->control.int_ctl |= V_INTR_MASKING_MASK;
1096ad879127SKrish Sadhukhan 
109785dc2aceSPaolo Bonzini 	/* Now entering again with VINTR_MASKING=1.  */
1098ad879127SKrish Sadhukhan         apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL |
1099ad879127SKrish Sadhukhan               APIC_DM_FIXED | 0xf1, 0);
1100ad879127SKrish Sadhukhan 
1101ad879127SKrish Sadhukhan         break;
1102ad879127SKrish Sadhukhan 
1103ad879127SKrish Sadhukhan     case 1:
1104ad879127SKrish Sadhukhan         if (pending_event_ipi_fired == true) {
1105198dfd0eSJanis Schoetterl-Glausch             report_fail("Interrupt triggered by guest");
1106ad879127SKrish Sadhukhan             return true;
1107ad879127SKrish Sadhukhan         }
1108ad879127SKrish Sadhukhan 
1109ad879127SKrish Sadhukhan         irq_enable();
1110ad879127SKrish Sadhukhan         asm volatile ("nop");
1111ad879127SKrish Sadhukhan         irq_disable();
1112ad879127SKrish Sadhukhan 
1113ad879127SKrish Sadhukhan         if (pending_event_ipi_fired != true) {
1114198dfd0eSJanis Schoetterl-Glausch             report_fail("Interrupt not triggered by host");
1115ad879127SKrish Sadhukhan             return true;
1116ad879127SKrish Sadhukhan         }
1117ad879127SKrish Sadhukhan 
1118ad879127SKrish Sadhukhan         break;
1119ad879127SKrish Sadhukhan 
1120ad879127SKrish Sadhukhan     default:
1121ad879127SKrish Sadhukhan         return true;
1122ad879127SKrish Sadhukhan     }
1123ad879127SKrish Sadhukhan 
1124ad879127SKrish Sadhukhan     inc_test_stage(test);
1125ad879127SKrish Sadhukhan 
1126ad879127SKrish Sadhukhan     return get_test_stage(test) == 2;
1127ad879127SKrish Sadhukhan }
1128ad879127SKrish Sadhukhan 
112985dc2aceSPaolo Bonzini static bool pending_event_cli_check(struct svm_test *test)
1130ad879127SKrish Sadhukhan {
1131ad879127SKrish Sadhukhan     return get_test_stage(test) == 2;
1132ad879127SKrish Sadhukhan }
1133ad879127SKrish Sadhukhan 
113485dc2aceSPaolo Bonzini #define TIMER_VECTOR    222
113585dc2aceSPaolo Bonzini 
113685dc2aceSPaolo Bonzini static volatile bool timer_fired;
113785dc2aceSPaolo Bonzini 
113885dc2aceSPaolo Bonzini static void timer_isr(isr_regs_t *regs)
113985dc2aceSPaolo Bonzini {
114085dc2aceSPaolo Bonzini     timer_fired = true;
114185dc2aceSPaolo Bonzini     apic_write(APIC_EOI, 0);
114285dc2aceSPaolo Bonzini }
114385dc2aceSPaolo Bonzini 
114485dc2aceSPaolo Bonzini static void interrupt_prepare(struct svm_test *test)
114585dc2aceSPaolo Bonzini {
114685dc2aceSPaolo Bonzini     default_prepare(test);
114785dc2aceSPaolo Bonzini     handle_irq(TIMER_VECTOR, timer_isr);
114885dc2aceSPaolo Bonzini     timer_fired = false;
114985dc2aceSPaolo Bonzini     set_test_stage(test, 0);
115085dc2aceSPaolo Bonzini }
115185dc2aceSPaolo Bonzini 
115285dc2aceSPaolo Bonzini static void interrupt_test(struct svm_test *test)
115385dc2aceSPaolo Bonzini {
115485dc2aceSPaolo Bonzini     long long start, loops;
115585dc2aceSPaolo Bonzini 
115685dc2aceSPaolo Bonzini     apic_write(APIC_LVTT, TIMER_VECTOR);
115785dc2aceSPaolo Bonzini     irq_enable();
115885dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 1); //Timer Initial Count Register 0x380 one-shot
115985dc2aceSPaolo Bonzini     for (loops = 0; loops < 10000000 && !timer_fired; loops++)
116085dc2aceSPaolo Bonzini         asm volatile ("nop");
116185dc2aceSPaolo Bonzini 
116285dc2aceSPaolo Bonzini     report(timer_fired, "direct interrupt while running guest");
116385dc2aceSPaolo Bonzini 
116485dc2aceSPaolo Bonzini     if (!timer_fired) {
116585dc2aceSPaolo Bonzini         set_test_stage(test, -1);
116685dc2aceSPaolo Bonzini         vmmcall();
116785dc2aceSPaolo Bonzini     }
116885dc2aceSPaolo Bonzini 
116985dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 0);
117085dc2aceSPaolo Bonzini     irq_disable();
117185dc2aceSPaolo Bonzini     vmmcall();
117285dc2aceSPaolo Bonzini 
117385dc2aceSPaolo Bonzini     timer_fired = false;
117485dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 1);
117585dc2aceSPaolo Bonzini     for (loops = 0; loops < 10000000 && !timer_fired; loops++)
117685dc2aceSPaolo Bonzini         asm volatile ("nop");
117785dc2aceSPaolo Bonzini 
117885dc2aceSPaolo Bonzini     report(timer_fired, "intercepted interrupt while running guest");
117985dc2aceSPaolo Bonzini 
118085dc2aceSPaolo Bonzini     if (!timer_fired) {
118185dc2aceSPaolo Bonzini         set_test_stage(test, -1);
118285dc2aceSPaolo Bonzini         vmmcall();
118385dc2aceSPaolo Bonzini     }
118485dc2aceSPaolo Bonzini 
118585dc2aceSPaolo Bonzini     irq_enable();
118685dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 0);
118785dc2aceSPaolo Bonzini     irq_disable();
118885dc2aceSPaolo Bonzini 
118985dc2aceSPaolo Bonzini     timer_fired = false;
119085dc2aceSPaolo Bonzini     start = rdtsc();
119185dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 1000000);
1192a3001422SOliver Upton     safe_halt();
119385dc2aceSPaolo Bonzini 
119485dc2aceSPaolo Bonzini     report(rdtsc() - start > 10000 && timer_fired,
119585dc2aceSPaolo Bonzini           "direct interrupt + hlt");
119685dc2aceSPaolo Bonzini 
119785dc2aceSPaolo Bonzini     if (!timer_fired) {
119885dc2aceSPaolo Bonzini         set_test_stage(test, -1);
119985dc2aceSPaolo Bonzini         vmmcall();
120085dc2aceSPaolo Bonzini     }
120185dc2aceSPaolo Bonzini 
120285dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 0);
120385dc2aceSPaolo Bonzini     irq_disable();
120485dc2aceSPaolo Bonzini     vmmcall();
120585dc2aceSPaolo Bonzini 
120685dc2aceSPaolo Bonzini     timer_fired = false;
120785dc2aceSPaolo Bonzini     start = rdtsc();
120885dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 1000000);
120985dc2aceSPaolo Bonzini     asm volatile ("hlt");
121085dc2aceSPaolo Bonzini 
121185dc2aceSPaolo Bonzini     report(rdtsc() - start > 10000 && timer_fired,
121285dc2aceSPaolo Bonzini            "intercepted interrupt + hlt");
121385dc2aceSPaolo Bonzini 
121485dc2aceSPaolo Bonzini     if (!timer_fired) {
121585dc2aceSPaolo Bonzini         set_test_stage(test, -1);
121685dc2aceSPaolo Bonzini         vmmcall();
121785dc2aceSPaolo Bonzini     }
121885dc2aceSPaolo Bonzini 
121985dc2aceSPaolo Bonzini     apic_write(APIC_TMICT, 0);
122085dc2aceSPaolo Bonzini     irq_disable();
122185dc2aceSPaolo Bonzini }
122285dc2aceSPaolo Bonzini 
122385dc2aceSPaolo Bonzini static bool interrupt_finished(struct svm_test *test)
122485dc2aceSPaolo Bonzini {
122585dc2aceSPaolo Bonzini     switch (get_test_stage(test)) {
122685dc2aceSPaolo Bonzini     case 0:
122785dc2aceSPaolo Bonzini     case 2:
1228096cf7feSPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1229198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
1230096cf7feSPaolo Bonzini                         vmcb->control.exit_code);
123185dc2aceSPaolo Bonzini             return true;
123285dc2aceSPaolo Bonzini         }
1233096cf7feSPaolo Bonzini         vmcb->save.rip += 3;
123485dc2aceSPaolo Bonzini 
1235096cf7feSPaolo Bonzini         vmcb->control.intercept |= (1ULL << INTERCEPT_INTR);
1236096cf7feSPaolo Bonzini         vmcb->control.int_ctl |= V_INTR_MASKING_MASK;
123785dc2aceSPaolo Bonzini         break;
123885dc2aceSPaolo Bonzini 
123985dc2aceSPaolo Bonzini     case 1:
124085dc2aceSPaolo Bonzini     case 3:
1241096cf7feSPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_INTR) {
1242198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to intr intercept. Exit reason 0x%x",
1243096cf7feSPaolo Bonzini                         vmcb->control.exit_code);
124485dc2aceSPaolo Bonzini             return true;
124585dc2aceSPaolo Bonzini         }
124685dc2aceSPaolo Bonzini 
124785dc2aceSPaolo Bonzini         irq_enable();
124885dc2aceSPaolo Bonzini         asm volatile ("nop");
124985dc2aceSPaolo Bonzini         irq_disable();
125085dc2aceSPaolo Bonzini 
1251096cf7feSPaolo Bonzini         vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR);
1252096cf7feSPaolo Bonzini         vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
125385dc2aceSPaolo Bonzini         break;
125485dc2aceSPaolo Bonzini 
125585dc2aceSPaolo Bonzini     case 4:
125685dc2aceSPaolo Bonzini         break;
125785dc2aceSPaolo Bonzini 
125885dc2aceSPaolo Bonzini     default:
125985dc2aceSPaolo Bonzini         return true;
126085dc2aceSPaolo Bonzini     }
126185dc2aceSPaolo Bonzini 
126285dc2aceSPaolo Bonzini     inc_test_stage(test);
126385dc2aceSPaolo Bonzini 
126485dc2aceSPaolo Bonzini     return get_test_stage(test) == 5;
126585dc2aceSPaolo Bonzini }
126685dc2aceSPaolo Bonzini 
126785dc2aceSPaolo Bonzini static bool interrupt_check(struct svm_test *test)
126885dc2aceSPaolo Bonzini {
126985dc2aceSPaolo Bonzini     return get_test_stage(test) == 5;
127085dc2aceSPaolo Bonzini }
127185dc2aceSPaolo Bonzini 
1272d4db486bSCathy Avery static volatile bool nmi_fired;
1273d4db486bSCathy Avery 
12744a1207f6SMaxim Levitsky static void nmi_handler(struct ex_regs *regs)
1275d4db486bSCathy Avery {
1276d4db486bSCathy Avery     nmi_fired = true;
1277d4db486bSCathy Avery }
1278d4db486bSCathy Avery 
1279d4db486bSCathy Avery static void nmi_prepare(struct svm_test *test)
1280d4db486bSCathy Avery {
1281d4db486bSCathy Avery     default_prepare(test);
1282d4db486bSCathy Avery     nmi_fired = false;
12834a1207f6SMaxim Levitsky     handle_exception(NMI_VECTOR, nmi_handler);
1284d4db486bSCathy Avery     set_test_stage(test, 0);
1285d4db486bSCathy Avery }
1286d4db486bSCathy Avery 
1287d4db486bSCathy Avery static void nmi_test(struct svm_test *test)
1288d4db486bSCathy Avery {
1289d4db486bSCathy Avery     apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0);
1290d4db486bSCathy Avery 
1291d4db486bSCathy Avery     report(nmi_fired, "direct NMI while running guest");
1292d4db486bSCathy Avery 
1293d4db486bSCathy Avery     if (!nmi_fired)
1294d4db486bSCathy Avery         set_test_stage(test, -1);
1295d4db486bSCathy Avery 
1296d4db486bSCathy Avery     vmmcall();
1297d4db486bSCathy Avery 
1298d4db486bSCathy Avery     nmi_fired = false;
1299d4db486bSCathy Avery 
1300d4db486bSCathy Avery     apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, 0);
1301d4db486bSCathy Avery 
1302d4db486bSCathy Avery     if (!nmi_fired) {
1303d4db486bSCathy Avery         report(nmi_fired, "intercepted pending NMI not dispatched");
1304d4db486bSCathy Avery         set_test_stage(test, -1);
1305d4db486bSCathy Avery     }
1306d4db486bSCathy Avery 
1307d4db486bSCathy Avery }
1308d4db486bSCathy Avery 
1309d4db486bSCathy Avery static bool nmi_finished(struct svm_test *test)
1310d4db486bSCathy Avery {
1311d4db486bSCathy Avery     switch (get_test_stage(test)) {
1312d4db486bSCathy Avery     case 0:
1313d4db486bSCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1314198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
1315d4db486bSCathy Avery                         vmcb->control.exit_code);
1316d4db486bSCathy Avery             return true;
1317d4db486bSCathy Avery         }
1318d4db486bSCathy Avery         vmcb->save.rip += 3;
1319d4db486bSCathy Avery 
1320d4db486bSCathy Avery         vmcb->control.intercept |= (1ULL << INTERCEPT_NMI);
1321d4db486bSCathy Avery         break;
1322d4db486bSCathy Avery 
1323d4db486bSCathy Avery     case 1:
1324d4db486bSCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_NMI) {
1325198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to NMI intercept. Exit reason 0x%x",
1326d4db486bSCathy Avery                         vmcb->control.exit_code);
1327d4db486bSCathy Avery             return true;
1328d4db486bSCathy Avery         }
1329d4db486bSCathy Avery 
13305c3582f0SJanis Schoetterl-Glausch         report_pass("NMI intercept while running guest");
1331d4db486bSCathy Avery         break;
1332d4db486bSCathy Avery 
1333d4db486bSCathy Avery     case 2:
1334d4db486bSCathy Avery         break;
1335d4db486bSCathy Avery 
1336d4db486bSCathy Avery     default:
1337d4db486bSCathy Avery         return true;
1338d4db486bSCathy Avery     }
1339d4db486bSCathy Avery 
1340d4db486bSCathy Avery     inc_test_stage(test);
1341d4db486bSCathy Avery 
1342d4db486bSCathy Avery     return get_test_stage(test) == 3;
1343d4db486bSCathy Avery }
1344d4db486bSCathy Avery 
1345d4db486bSCathy Avery static bool nmi_check(struct svm_test *test)
1346d4db486bSCathy Avery {
1347d4db486bSCathy Avery     return get_test_stage(test) == 3;
1348d4db486bSCathy Avery }
1349d4db486bSCathy Avery 
13509da1f4d8SCathy Avery #define NMI_DELAY 100000000ULL
13519da1f4d8SCathy Avery 
13529da1f4d8SCathy Avery static void nmi_message_thread(void *_test)
13539da1f4d8SCathy Avery {
13549da1f4d8SCathy Avery     struct svm_test *test = _test;
13559da1f4d8SCathy Avery 
13569da1f4d8SCathy Avery     while (get_test_stage(test) != 1)
13579da1f4d8SCathy Avery         pause();
13589da1f4d8SCathy Avery 
13599da1f4d8SCathy Avery     delay(NMI_DELAY);
13609da1f4d8SCathy Avery 
13619da1f4d8SCathy Avery     apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]);
13629da1f4d8SCathy Avery 
13639da1f4d8SCathy Avery     while (get_test_stage(test) != 2)
13649da1f4d8SCathy Avery         pause();
13659da1f4d8SCathy Avery 
13669da1f4d8SCathy Avery     delay(NMI_DELAY);
13679da1f4d8SCathy Avery 
13689da1f4d8SCathy Avery     apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_NMI | APIC_INT_ASSERT, id_map[0]);
13699da1f4d8SCathy Avery }
13709da1f4d8SCathy Avery 
13719da1f4d8SCathy Avery static void nmi_hlt_test(struct svm_test *test)
13729da1f4d8SCathy Avery {
13739da1f4d8SCathy Avery     long long start;
13749da1f4d8SCathy Avery 
13759da1f4d8SCathy Avery     on_cpu_async(1, nmi_message_thread, test);
13769da1f4d8SCathy Avery 
13779da1f4d8SCathy Avery     start = rdtsc();
13789da1f4d8SCathy Avery 
13799da1f4d8SCathy Avery     set_test_stage(test, 1);
13809da1f4d8SCathy Avery 
13819da1f4d8SCathy Avery     asm volatile ("hlt");
13829da1f4d8SCathy Avery 
13839da1f4d8SCathy Avery     report((rdtsc() - start > NMI_DELAY) && nmi_fired,
13849da1f4d8SCathy Avery           "direct NMI + hlt");
13859da1f4d8SCathy Avery 
13869da1f4d8SCathy Avery     if (!nmi_fired)
13879da1f4d8SCathy Avery         set_test_stage(test, -1);
13889da1f4d8SCathy Avery 
13899da1f4d8SCathy Avery     nmi_fired = false;
13909da1f4d8SCathy Avery 
13919da1f4d8SCathy Avery     vmmcall();
13929da1f4d8SCathy Avery 
13939da1f4d8SCathy Avery     start = rdtsc();
13949da1f4d8SCathy Avery 
13959da1f4d8SCathy Avery     set_test_stage(test, 2);
13969da1f4d8SCathy Avery 
13979da1f4d8SCathy Avery     asm volatile ("hlt");
13989da1f4d8SCathy Avery 
13999da1f4d8SCathy Avery     report((rdtsc() - start > NMI_DELAY) && nmi_fired,
14009da1f4d8SCathy Avery            "intercepted NMI + hlt");
14019da1f4d8SCathy Avery 
14029da1f4d8SCathy Avery     if (!nmi_fired) {
14039da1f4d8SCathy Avery         report(nmi_fired, "intercepted pending NMI not dispatched");
14049da1f4d8SCathy Avery         set_test_stage(test, -1);
14057e7d9357SCathy Avery         vmmcall();
14069da1f4d8SCathy Avery     }
14079da1f4d8SCathy Avery 
14089da1f4d8SCathy Avery     set_test_stage(test, 3);
14099da1f4d8SCathy Avery }
14109da1f4d8SCathy Avery 
14119da1f4d8SCathy Avery static bool nmi_hlt_finished(struct svm_test *test)
14129da1f4d8SCathy Avery {
14139da1f4d8SCathy Avery     switch (get_test_stage(test)) {
14149da1f4d8SCathy Avery     case 1:
14159da1f4d8SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1416198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
14179da1f4d8SCathy Avery                         vmcb->control.exit_code);
14189da1f4d8SCathy Avery             return true;
14199da1f4d8SCathy Avery         }
14209da1f4d8SCathy Avery         vmcb->save.rip += 3;
14219da1f4d8SCathy Avery 
14229da1f4d8SCathy Avery         vmcb->control.intercept |= (1ULL << INTERCEPT_NMI);
14239da1f4d8SCathy Avery         break;
14249da1f4d8SCathy Avery 
14259da1f4d8SCathy Avery     case 2:
14269da1f4d8SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_NMI) {
1427198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to NMI intercept. Exit reason 0x%x",
14289da1f4d8SCathy Avery                         vmcb->control.exit_code);
14299da1f4d8SCathy Avery             return true;
14309da1f4d8SCathy Avery         }
14319da1f4d8SCathy Avery 
14325c3582f0SJanis Schoetterl-Glausch         report_pass("NMI intercept while running guest");
14339da1f4d8SCathy Avery         break;
14349da1f4d8SCathy Avery 
14359da1f4d8SCathy Avery     case 3:
14369da1f4d8SCathy Avery         break;
14379da1f4d8SCathy Avery 
14389da1f4d8SCathy Avery     default:
14399da1f4d8SCathy Avery         return true;
14409da1f4d8SCathy Avery     }
14419da1f4d8SCathy Avery 
14429da1f4d8SCathy Avery     return get_test_stage(test) == 3;
14439da1f4d8SCathy Avery }
14449da1f4d8SCathy Avery 
14459da1f4d8SCathy Avery static bool nmi_hlt_check(struct svm_test *test)
14469da1f4d8SCathy Avery {
14479da1f4d8SCathy Avery     return get_test_stage(test) == 3;
14489da1f4d8SCathy Avery }
14499da1f4d8SCathy Avery 
14504b4fb247SPaolo Bonzini static volatile int count_exc = 0;
14514b4fb247SPaolo Bonzini 
14524b4fb247SPaolo Bonzini static void my_isr(struct ex_regs *r)
14534b4fb247SPaolo Bonzini {
14544b4fb247SPaolo Bonzini         count_exc++;
14554b4fb247SPaolo Bonzini }
14564b4fb247SPaolo Bonzini 
14574b4fb247SPaolo Bonzini static void exc_inject_prepare(struct svm_test *test)
14584b4fb247SPaolo Bonzini {
14598634a266SPaolo Bonzini     default_prepare(test);
14604b4fb247SPaolo Bonzini     handle_exception(DE_VECTOR, my_isr);
14614b4fb247SPaolo Bonzini     handle_exception(NMI_VECTOR, my_isr);
14624b4fb247SPaolo Bonzini }
14634b4fb247SPaolo Bonzini 
14644b4fb247SPaolo Bonzini 
14654b4fb247SPaolo Bonzini static void exc_inject_test(struct svm_test *test)
14664b4fb247SPaolo Bonzini {
14674b4fb247SPaolo Bonzini     asm volatile ("vmmcall\n\tvmmcall\n\t");
14684b4fb247SPaolo Bonzini }
14694b4fb247SPaolo Bonzini 
14704b4fb247SPaolo Bonzini static bool exc_inject_finished(struct svm_test *test)
14714b4fb247SPaolo Bonzini {
14724b4fb247SPaolo Bonzini     switch (get_test_stage(test)) {
14734b4fb247SPaolo Bonzini     case 0:
14744b4fb247SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1475198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
14764b4fb247SPaolo Bonzini                         vmcb->control.exit_code);
14774b4fb247SPaolo Bonzini             return true;
14784b4fb247SPaolo Bonzini         }
14792c1ca866SNadav Amit         vmcb->save.rip += 3;
14804b4fb247SPaolo Bonzini         vmcb->control.event_inj = NMI_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID;
14814b4fb247SPaolo Bonzini         break;
14824b4fb247SPaolo Bonzini 
14834b4fb247SPaolo Bonzini     case 1:
14844b4fb247SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_ERR) {
1485198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to error. Exit reason 0x%x",
14864b4fb247SPaolo Bonzini                         vmcb->control.exit_code);
14874b4fb247SPaolo Bonzini             return true;
14884b4fb247SPaolo Bonzini         }
14894b4fb247SPaolo Bonzini         report(count_exc == 0, "exception with vector 2 not injected");
14904b4fb247SPaolo Bonzini         vmcb->control.event_inj = DE_VECTOR | SVM_EVTINJ_TYPE_EXEPT | SVM_EVTINJ_VALID;
14914b4fb247SPaolo Bonzini         break;
14924b4fb247SPaolo Bonzini 
14934b4fb247SPaolo Bonzini     case 2:
14944b4fb247SPaolo Bonzini         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1495198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
14964b4fb247SPaolo Bonzini                         vmcb->control.exit_code);
14974b4fb247SPaolo Bonzini             return true;
14984b4fb247SPaolo Bonzini         }
14992c1ca866SNadav Amit         vmcb->save.rip += 3;
15004b4fb247SPaolo Bonzini         report(count_exc == 1, "divide overflow exception injected");
15014b4fb247SPaolo Bonzini         report(!(vmcb->control.event_inj & SVM_EVTINJ_VALID), "eventinj.VALID cleared");
15024b4fb247SPaolo Bonzini         break;
15034b4fb247SPaolo Bonzini 
15044b4fb247SPaolo Bonzini     default:
15054b4fb247SPaolo Bonzini         return true;
15064b4fb247SPaolo Bonzini     }
15074b4fb247SPaolo Bonzini 
15084b4fb247SPaolo Bonzini     inc_test_stage(test);
15094b4fb247SPaolo Bonzini 
15104b4fb247SPaolo Bonzini     return get_test_stage(test) == 3;
15114b4fb247SPaolo Bonzini }
15124b4fb247SPaolo Bonzini 
15134b4fb247SPaolo Bonzini static bool exc_inject_check(struct svm_test *test)
15144b4fb247SPaolo Bonzini {
15154b4fb247SPaolo Bonzini     return count_exc == 1 && get_test_stage(test) == 3;
15164b4fb247SPaolo Bonzini }
15174b4fb247SPaolo Bonzini 
15189c838954SCathy Avery static volatile bool virq_fired;
15199c838954SCathy Avery 
15209c838954SCathy Avery static void virq_isr(isr_regs_t *regs)
15219c838954SCathy Avery {
15229c838954SCathy Avery     virq_fired = true;
15239c838954SCathy Avery }
15249c838954SCathy Avery 
15259c838954SCathy Avery static void virq_inject_prepare(struct svm_test *test)
15269c838954SCathy Avery {
15279c838954SCathy Avery     handle_irq(0xf1, virq_isr);
15289c838954SCathy Avery     default_prepare(test);
15299c838954SCathy Avery     vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
15309c838954SCathy Avery                             (0x0f << V_INTR_PRIO_SHIFT); // Set to the highest priority
15319c838954SCathy Avery     vmcb->control.int_vector = 0xf1;
15329c838954SCathy Avery     virq_fired = false;
15339c838954SCathy Avery     set_test_stage(test, 0);
15349c838954SCathy Avery }
15359c838954SCathy Avery 
15369c838954SCathy Avery static void virq_inject_test(struct svm_test *test)
15379c838954SCathy Avery {
15389c838954SCathy Avery     if (virq_fired) {
1539198dfd0eSJanis Schoetterl-Glausch         report_fail("virtual interrupt fired before L2 sti");
15409c838954SCathy Avery         set_test_stage(test, -1);
15419c838954SCathy Avery         vmmcall();
15429c838954SCathy Avery     }
15439c838954SCathy Avery 
15449c838954SCathy Avery     irq_enable();
15459c838954SCathy Avery     asm volatile ("nop");
15469c838954SCathy Avery     irq_disable();
15479c838954SCathy Avery 
15489c838954SCathy Avery     if (!virq_fired) {
1549198dfd0eSJanis Schoetterl-Glausch         report_fail("virtual interrupt not fired after L2 sti");
15509c838954SCathy Avery         set_test_stage(test, -1);
15519c838954SCathy Avery     }
15529c838954SCathy Avery 
15539c838954SCathy Avery     vmmcall();
15549c838954SCathy Avery 
15559c838954SCathy Avery     if (virq_fired) {
1556198dfd0eSJanis Schoetterl-Glausch         report_fail("virtual interrupt fired before L2 sti after VINTR intercept");
15579c838954SCathy Avery         set_test_stage(test, -1);
15589c838954SCathy Avery         vmmcall();
15599c838954SCathy Avery     }
15609c838954SCathy Avery 
15619c838954SCathy Avery     irq_enable();
15629c838954SCathy Avery     asm volatile ("nop");
15639c838954SCathy Avery     irq_disable();
15649c838954SCathy Avery 
15659c838954SCathy Avery     if (!virq_fired) {
1566198dfd0eSJanis Schoetterl-Glausch         report_fail("virtual interrupt not fired after return from VINTR intercept");
15679c838954SCathy Avery         set_test_stage(test, -1);
15689c838954SCathy Avery     }
15699c838954SCathy Avery 
15709c838954SCathy Avery     vmmcall();
15719c838954SCathy Avery 
15729c838954SCathy Avery     irq_enable();
15739c838954SCathy Avery     asm volatile ("nop");
15749c838954SCathy Avery     irq_disable();
15759c838954SCathy Avery 
15769c838954SCathy Avery     if (virq_fired) {
1577198dfd0eSJanis Schoetterl-Glausch         report_fail("virtual interrupt fired when V_IRQ_PRIO less than V_TPR");
15789c838954SCathy Avery         set_test_stage(test, -1);
15799c838954SCathy Avery     }
15809c838954SCathy Avery 
15819c838954SCathy Avery     vmmcall();
15829c838954SCathy Avery     vmmcall();
15839c838954SCathy Avery }
15849c838954SCathy Avery 
15859c838954SCathy Avery static bool virq_inject_finished(struct svm_test *test)
15869c838954SCathy Avery {
15879c838954SCathy Avery     vmcb->save.rip += 3;
15889c838954SCathy Avery 
15899c838954SCathy Avery     switch (get_test_stage(test)) {
15909c838954SCathy Avery     case 0:
15919c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1592198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
15939c838954SCathy Avery                         vmcb->control.exit_code);
15949c838954SCathy Avery             return true;
15959c838954SCathy Avery         }
15969c838954SCathy Avery         if (vmcb->control.int_ctl & V_IRQ_MASK) {
1597198dfd0eSJanis Schoetterl-Glausch             report_fail("V_IRQ not cleared on VMEXIT after firing");
15989c838954SCathy Avery             return true;
15999c838954SCathy Avery         }
16009c838954SCathy Avery         virq_fired = false;
16019c838954SCathy Avery         vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
16029c838954SCathy Avery         vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
16039c838954SCathy Avery                             (0x0f << V_INTR_PRIO_SHIFT);
16049c838954SCathy Avery         break;
16059c838954SCathy Avery 
16069c838954SCathy Avery     case 1:
16079c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VINTR) {
1608198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to vintr. Exit reason 0x%x",
16099c838954SCathy Avery                         vmcb->control.exit_code);
16109c838954SCathy Avery             return true;
16119c838954SCathy Avery         }
16129c838954SCathy Avery         if (virq_fired) {
1613198dfd0eSJanis Schoetterl-Glausch             report_fail("V_IRQ fired before SVM_EXIT_VINTR");
16149c838954SCathy Avery             return true;
16159c838954SCathy Avery         }
16169c838954SCathy Avery         vmcb->control.intercept &= ~(1ULL << INTERCEPT_VINTR);
16179c838954SCathy Avery         break;
16189c838954SCathy Avery 
16199c838954SCathy Avery     case 2:
16209c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1621198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
16229c838954SCathy Avery                         vmcb->control.exit_code);
16239c838954SCathy Avery             return true;
16249c838954SCathy Avery         }
16259c838954SCathy Avery         virq_fired = false;
16269c838954SCathy Avery         // Set irq to lower priority
16279c838954SCathy Avery         vmcb->control.int_ctl = V_INTR_MASKING_MASK | V_IRQ_MASK |
16289c838954SCathy Avery                             (0x08 << V_INTR_PRIO_SHIFT);
16299c838954SCathy Avery         // Raise guest TPR
16309c838954SCathy Avery         vmcb->control.int_ctl |= 0x0a & V_TPR_MASK;
16319c838954SCathy Avery         break;
16329c838954SCathy Avery 
16339c838954SCathy Avery     case 3:
16349c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1635198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
16369c838954SCathy Avery                         vmcb->control.exit_code);
16379c838954SCathy Avery             return true;
16389c838954SCathy Avery         }
16399c838954SCathy Avery         vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
16409c838954SCathy Avery         break;
16419c838954SCathy Avery 
16429c838954SCathy Avery     case 4:
16439c838954SCathy Avery         // INTERCEPT_VINTR should be ignored because V_INTR_PRIO < V_TPR
16449c838954SCathy Avery         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1645198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to vmmcall. Exit reason 0x%x",
16469c838954SCathy Avery                         vmcb->control.exit_code);
16479c838954SCathy Avery             return true;
16489c838954SCathy Avery         }
16499c838954SCathy Avery         break;
16509c838954SCathy Avery 
16519c838954SCathy Avery     default:
16529c838954SCathy Avery         return true;
16539c838954SCathy Avery     }
16549c838954SCathy Avery 
16559c838954SCathy Avery     inc_test_stage(test);
16569c838954SCathy Avery 
16579c838954SCathy Avery     return get_test_stage(test) == 5;
16589c838954SCathy Avery }
16599c838954SCathy Avery 
16609c838954SCathy Avery static bool virq_inject_check(struct svm_test *test)
16619c838954SCathy Avery {
16629c838954SCathy Avery     return get_test_stage(test) == 5;
16639c838954SCathy Avery }
16649c838954SCathy Avery 
1665da338a31SMaxim Levitsky /*
1666da338a31SMaxim Levitsky  * Detect nested guest RIP corruption as explained in kernel commit
1667da338a31SMaxim Levitsky  * b6162e82aef19fee9c32cb3fe9ac30d9116a8c73
1668da338a31SMaxim Levitsky  *
1669da338a31SMaxim Levitsky  * In the assembly loop below 'ins' is executed while IO instructions
1670da338a31SMaxim Levitsky  * are not intercepted; the instruction is emulated by L0.
1671da338a31SMaxim Levitsky  *
1672da338a31SMaxim Levitsky  * At the same time we are getting interrupts from the local APIC timer,
1673da338a31SMaxim Levitsky  * and we do intercept them in L1
1674da338a31SMaxim Levitsky  *
1675da338a31SMaxim Levitsky  * If the interrupt happens on the insb instruction, L0 will VMexit, emulate
1676da338a31SMaxim Levitsky  * the insb instruction and then it will inject the interrupt to L1 through
1677da338a31SMaxim Levitsky  * a nested VMexit.  Due to a bug, it would leave pre-emulation values of RIP,
1678da338a31SMaxim Levitsky  * RAX and RSP in the VMCB.
1679da338a31SMaxim Levitsky  *
1680da338a31SMaxim Levitsky  * In our intercept handler we detect the bug by checking that RIP is that of
1681da338a31SMaxim Levitsky  * the insb instruction, but its memory operand has already been written.
1682da338a31SMaxim Levitsky  * This means that insb was already executed.
1683da338a31SMaxim Levitsky  */
1684da338a31SMaxim Levitsky 
1685da338a31SMaxim Levitsky static volatile int isr_cnt = 0;
1686da338a31SMaxim Levitsky static volatile uint8_t io_port_var = 0xAA;
1687da338a31SMaxim Levitsky extern const char insb_instruction_label[];
1688da338a31SMaxim Levitsky 
1689da338a31SMaxim Levitsky static void reg_corruption_isr(isr_regs_t *regs)
1690da338a31SMaxim Levitsky {
1691da338a31SMaxim Levitsky     isr_cnt++;
1692da338a31SMaxim Levitsky     apic_write(APIC_EOI, 0);
1693da338a31SMaxim Levitsky }
1694da338a31SMaxim Levitsky 
1695da338a31SMaxim Levitsky static void reg_corruption_prepare(struct svm_test *test)
1696da338a31SMaxim Levitsky {
1697da338a31SMaxim Levitsky     default_prepare(test);
1698da338a31SMaxim Levitsky     set_test_stage(test, 0);
1699da338a31SMaxim Levitsky 
1700da338a31SMaxim Levitsky     vmcb->control.int_ctl = V_INTR_MASKING_MASK;
1701da338a31SMaxim Levitsky     vmcb->control.intercept |= (1ULL << INTERCEPT_INTR);
1702da338a31SMaxim Levitsky 
1703da338a31SMaxim Levitsky     handle_irq(TIMER_VECTOR, reg_corruption_isr);
1704da338a31SMaxim Levitsky 
1705da338a31SMaxim Levitsky     /* set local APIC to inject external interrupts */
1706da338a31SMaxim Levitsky     apic_write(APIC_TMICT, 0);
1707da338a31SMaxim Levitsky     apic_write(APIC_TDCR, 0);
1708da338a31SMaxim Levitsky     apic_write(APIC_LVTT, TIMER_VECTOR | APIC_LVT_TIMER_PERIODIC);
1709da338a31SMaxim Levitsky     apic_write(APIC_TMICT, 1000);
1710da338a31SMaxim Levitsky }
1711da338a31SMaxim Levitsky 
1712da338a31SMaxim Levitsky static void reg_corruption_test(struct svm_test *test)
1713da338a31SMaxim Levitsky {
1714da338a31SMaxim Levitsky     /* this is endless loop, which is interrupted by the timer interrupt */
1715da338a31SMaxim Levitsky     asm volatile (
1716da338a31SMaxim Levitsky             "1:\n\t"
1717da338a31SMaxim Levitsky             "movw $0x4d0, %%dx\n\t" // IO port
1718da338a31SMaxim Levitsky             "lea %[io_port_var], %%rdi\n\t"
1719da338a31SMaxim Levitsky             "movb $0xAA, %[io_port_var]\n\t"
1720da338a31SMaxim Levitsky             "insb_instruction_label:\n\t"
1721da338a31SMaxim Levitsky             "insb\n\t"
1722da338a31SMaxim Levitsky             "jmp 1b\n\t"
1723da338a31SMaxim Levitsky 
1724da338a31SMaxim Levitsky             : [io_port_var] "=m" (io_port_var)
1725da338a31SMaxim Levitsky             : /* no inputs*/
1726da338a31SMaxim Levitsky             : "rdx", "rdi"
1727da338a31SMaxim Levitsky     );
1728da338a31SMaxim Levitsky }
1729da338a31SMaxim Levitsky 
1730da338a31SMaxim Levitsky static bool reg_corruption_finished(struct svm_test *test)
1731da338a31SMaxim Levitsky {
1732da338a31SMaxim Levitsky     if (isr_cnt == 10000) {
17335c3582f0SJanis Schoetterl-Glausch         report_pass("No RIP corruption detected after %d timer interrupts",
1734da338a31SMaxim Levitsky                     isr_cnt);
1735da338a31SMaxim Levitsky         set_test_stage(test, 1);
1736491bbc64SMaxim Levitsky         goto cleanup;
1737da338a31SMaxim Levitsky     }
1738da338a31SMaxim Levitsky 
1739da338a31SMaxim Levitsky     if (vmcb->control.exit_code == SVM_EXIT_INTR) {
1740da338a31SMaxim Levitsky 
1741da338a31SMaxim Levitsky         void* guest_rip = (void*)vmcb->save.rip;
1742da338a31SMaxim Levitsky 
1743da338a31SMaxim Levitsky         irq_enable();
1744da338a31SMaxim Levitsky         asm volatile ("nop");
1745da338a31SMaxim Levitsky         irq_disable();
1746da338a31SMaxim Levitsky 
1747da338a31SMaxim Levitsky         if (guest_rip == insb_instruction_label && io_port_var != 0xAA) {
1748198dfd0eSJanis Schoetterl-Glausch             report_fail("RIP corruption detected after %d timer interrupts",
1749da338a31SMaxim Levitsky                         isr_cnt);
1750491bbc64SMaxim Levitsky             goto cleanup;
1751da338a31SMaxim Levitsky         }
1752da338a31SMaxim Levitsky 
1753da338a31SMaxim Levitsky     }
1754da338a31SMaxim Levitsky     return false;
1755491bbc64SMaxim Levitsky cleanup:
1756491bbc64SMaxim Levitsky     apic_write(APIC_LVTT, APIC_LVT_TIMER_MASK);
1757491bbc64SMaxim Levitsky     apic_write(APIC_TMICT, 0);
1758491bbc64SMaxim Levitsky     return true;
1759491bbc64SMaxim Levitsky 
1760da338a31SMaxim Levitsky }
1761da338a31SMaxim Levitsky 
1762da338a31SMaxim Levitsky static bool reg_corruption_check(struct svm_test *test)
1763da338a31SMaxim Levitsky {
1764da338a31SMaxim Levitsky     return get_test_stage(test) == 1;
1765da338a31SMaxim Levitsky }
1766da338a31SMaxim Levitsky 
17674770e9c8SCathy Avery static void get_tss_entry(void *data)
17684770e9c8SCathy Avery {
1769a7f32d87SPaolo Bonzini     *((gdt_entry_t **)data) = get_tss_descr();
17704770e9c8SCathy Avery }
17714770e9c8SCathy Avery 
17724770e9c8SCathy Avery static int orig_cpu_count;
17734770e9c8SCathy Avery 
17744770e9c8SCathy Avery static void init_startup_prepare(struct svm_test *test)
17754770e9c8SCathy Avery {
1776a7f32d87SPaolo Bonzini     gdt_entry_t *tss_entry;
17774770e9c8SCathy Avery     int i;
17784770e9c8SCathy Avery 
17794770e9c8SCathy Avery     on_cpu(1, get_tss_entry, &tss_entry);
17804770e9c8SCathy Avery 
17814770e9c8SCathy Avery     orig_cpu_count = cpu_online_count;
17824770e9c8SCathy Avery 
17834770e9c8SCathy Avery     apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_INIT | APIC_INT_ASSERT,
17844770e9c8SCathy Avery                    id_map[1]);
17854770e9c8SCathy Avery 
17864770e9c8SCathy Avery     delay(100000000ULL);
17874770e9c8SCathy Avery 
17884770e9c8SCathy Avery     --cpu_online_count;
17894770e9c8SCathy Avery 
1790a7f32d87SPaolo Bonzini     tss_entry->type &= ~DESC_BUSY;
17914770e9c8SCathy Avery 
17924770e9c8SCathy Avery     apic_icr_write(APIC_DEST_PHYSICAL | APIC_DM_STARTUP, id_map[1]);
17934770e9c8SCathy Avery 
17944770e9c8SCathy Avery     for (i = 0; i < 5 && cpu_online_count < orig_cpu_count; i++)
17954770e9c8SCathy Avery        delay(100000000ULL);
17964770e9c8SCathy Avery }
17974770e9c8SCathy Avery 
17984770e9c8SCathy Avery static bool init_startup_finished(struct svm_test *test)
17994770e9c8SCathy Avery {
18004770e9c8SCathy Avery     return true;
18014770e9c8SCathy Avery }
18024770e9c8SCathy Avery 
18034770e9c8SCathy Avery static bool init_startup_check(struct svm_test *test)
18044770e9c8SCathy Avery {
18054770e9c8SCathy Avery     return cpu_online_count == orig_cpu_count;
18064770e9c8SCathy Avery }
18074770e9c8SCathy Avery 
1808d5da6dfeSCathy Avery static volatile bool init_intercept;
1809d5da6dfeSCathy Avery 
1810d5da6dfeSCathy Avery static void init_intercept_prepare(struct svm_test *test)
1811d5da6dfeSCathy Avery {
1812d5da6dfeSCathy Avery     init_intercept = false;
1813d5da6dfeSCathy Avery     vmcb->control.intercept |= (1ULL << INTERCEPT_INIT);
1814d5da6dfeSCathy Avery }
1815d5da6dfeSCathy Avery 
1816d5da6dfeSCathy Avery static void init_intercept_test(struct svm_test *test)
1817d5da6dfeSCathy Avery {
1818d5da6dfeSCathy Avery     apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_INIT | APIC_INT_ASSERT, 0);
1819d5da6dfeSCathy Avery }
1820d5da6dfeSCathy Avery 
1821d5da6dfeSCathy Avery static bool init_intercept_finished(struct svm_test *test)
1822d5da6dfeSCathy Avery {
1823d5da6dfeSCathy Avery     vmcb->save.rip += 3;
1824d5da6dfeSCathy Avery 
1825d5da6dfeSCathy Avery     if (vmcb->control.exit_code != SVM_EXIT_INIT) {
1826198dfd0eSJanis Schoetterl-Glausch         report_fail("VMEXIT not due to init intercept. Exit reason 0x%x",
1827d5da6dfeSCathy Avery                     vmcb->control.exit_code);
1828d5da6dfeSCathy Avery 
1829d5da6dfeSCathy Avery         return true;
1830d5da6dfeSCathy Avery         }
1831d5da6dfeSCathy Avery 
1832d5da6dfeSCathy Avery     init_intercept = true;
1833d5da6dfeSCathy Avery 
18345c3582f0SJanis Schoetterl-Glausch     report_pass("INIT to vcpu intercepted");
1835d5da6dfeSCathy Avery 
1836d5da6dfeSCathy Avery     return true;
1837d5da6dfeSCathy Avery }
1838d5da6dfeSCathy Avery 
1839d5da6dfeSCathy Avery static bool init_intercept_check(struct svm_test *test)
1840d5da6dfeSCathy Avery {
1841d5da6dfeSCathy Avery     return init_intercept;
1842d5da6dfeSCathy Avery }
1843d5da6dfeSCathy Avery 
18447839b0ecSKrish Sadhukhan /*
18457839b0ecSKrish Sadhukhan  * Setting host EFLAGS.TF causes a #DB trap after the VMRUN completes on the
18467839b0ecSKrish Sadhukhan  * host side (i.e., after the #VMEXIT from the guest).
18477839b0ecSKrish Sadhukhan  *
18480689a980SKrish Sadhukhan  * Setting host EFLAGS.RF suppresses any potential instruction breakpoint
18490689a980SKrish Sadhukhan  * match on the VMRUN and completion of the VMRUN instruction clears the
18500689a980SKrish Sadhukhan  * host EFLAGS.RF bit.
18510689a980SKrish Sadhukhan  *
18527839b0ecSKrish Sadhukhan  * [AMD APM]
18537839b0ecSKrish Sadhukhan  */
18547839b0ecSKrish Sadhukhan static volatile u8 host_rflags_guest_main_flag = 0;
18557839b0ecSKrish Sadhukhan static volatile u8 host_rflags_db_handler_flag = 0;
18567839b0ecSKrish Sadhukhan static volatile bool host_rflags_ss_on_vmrun = false;
18577839b0ecSKrish Sadhukhan static volatile bool host_rflags_vmrun_reached = false;
18587839b0ecSKrish Sadhukhan static volatile bool host_rflags_set_tf = false;
18590689a980SKrish Sadhukhan static volatile bool host_rflags_set_rf = false;
18600689a980SKrish Sadhukhan static u64 rip_detected;
18617839b0ecSKrish Sadhukhan 
18627839b0ecSKrish Sadhukhan extern u64 *vmrun_rip;
18637839b0ecSKrish Sadhukhan 
18647839b0ecSKrish Sadhukhan static void host_rflags_db_handler(struct ex_regs *r)
18657839b0ecSKrish Sadhukhan {
18667839b0ecSKrish Sadhukhan 	if (host_rflags_ss_on_vmrun) {
18677839b0ecSKrish Sadhukhan 		if (host_rflags_vmrun_reached) {
18680689a980SKrish Sadhukhan 			if (!host_rflags_set_rf) {
18697839b0ecSKrish Sadhukhan 				r->rflags &= ~X86_EFLAGS_TF;
18700689a980SKrish Sadhukhan 				rip_detected = r->rip;
18717839b0ecSKrish Sadhukhan 			} else {
18720689a980SKrish Sadhukhan 				r->rflags |= X86_EFLAGS_RF;
18730689a980SKrish Sadhukhan 				++host_rflags_db_handler_flag;
18740689a980SKrish Sadhukhan 			}
18750689a980SKrish Sadhukhan 		} else {
18760689a980SKrish Sadhukhan 			if (r->rip == (u64)&vmrun_rip) {
18777839b0ecSKrish Sadhukhan 				host_rflags_vmrun_reached = true;
18780689a980SKrish Sadhukhan 
18790689a980SKrish Sadhukhan 				if (host_rflags_set_rf) {
18800689a980SKrish Sadhukhan 					host_rflags_guest_main_flag = 0;
18810689a980SKrish Sadhukhan 					rip_detected = r->rip;
18820689a980SKrish Sadhukhan 					r->rflags &= ~X86_EFLAGS_TF;
18830689a980SKrish Sadhukhan 
18840689a980SKrish Sadhukhan 					/* Trigger #DB via debug registers */
18850689a980SKrish Sadhukhan 					write_dr0((void *)&vmrun_rip);
18860689a980SKrish Sadhukhan 					write_dr7(0x403);
18870689a980SKrish Sadhukhan 				}
18880689a980SKrish Sadhukhan 			}
18897839b0ecSKrish Sadhukhan 		}
18907839b0ecSKrish Sadhukhan 	} else {
18917839b0ecSKrish Sadhukhan 		r->rflags &= ~X86_EFLAGS_TF;
18927839b0ecSKrish Sadhukhan 	}
18937839b0ecSKrish Sadhukhan }
18947839b0ecSKrish Sadhukhan 
18957839b0ecSKrish Sadhukhan static void host_rflags_prepare(struct svm_test *test)
18967839b0ecSKrish Sadhukhan {
18977839b0ecSKrish Sadhukhan 	default_prepare(test);
18987839b0ecSKrish Sadhukhan 	handle_exception(DB_VECTOR, host_rflags_db_handler);
18997839b0ecSKrish Sadhukhan 	set_test_stage(test, 0);
19007839b0ecSKrish Sadhukhan }
19017839b0ecSKrish Sadhukhan 
19027839b0ecSKrish Sadhukhan static void host_rflags_prepare_gif_clear(struct svm_test *test)
19037839b0ecSKrish Sadhukhan {
19047839b0ecSKrish Sadhukhan 	if (host_rflags_set_tf)
19057839b0ecSKrish Sadhukhan 		write_rflags(read_rflags() | X86_EFLAGS_TF);
19067839b0ecSKrish Sadhukhan }
19077839b0ecSKrish Sadhukhan 
19087839b0ecSKrish Sadhukhan static void host_rflags_test(struct svm_test *test)
19097839b0ecSKrish Sadhukhan {
19107839b0ecSKrish Sadhukhan 	while (1) {
19110689a980SKrish Sadhukhan 		if (get_test_stage(test) > 0) {
19120689a980SKrish Sadhukhan 			if ((host_rflags_set_tf && !host_rflags_ss_on_vmrun && !host_rflags_db_handler_flag) ||
19130689a980SKrish Sadhukhan 			    (host_rflags_set_rf && host_rflags_db_handler_flag == 1))
19147839b0ecSKrish Sadhukhan 				host_rflags_guest_main_flag = 1;
19150689a980SKrish Sadhukhan 		}
19160689a980SKrish Sadhukhan 
19170689a980SKrish Sadhukhan 		if (get_test_stage(test) == 4)
19187839b0ecSKrish Sadhukhan 			break;
19197839b0ecSKrish Sadhukhan 		vmmcall();
19207839b0ecSKrish Sadhukhan 	}
19217839b0ecSKrish Sadhukhan }
19227839b0ecSKrish Sadhukhan 
19237839b0ecSKrish Sadhukhan static bool host_rflags_finished(struct svm_test *test)
19247839b0ecSKrish Sadhukhan {
19257839b0ecSKrish Sadhukhan 	switch (get_test_stage(test)) {
19267839b0ecSKrish Sadhukhan 	case 0:
19277839b0ecSKrish Sadhukhan 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
1928198dfd0eSJanis Schoetterl-Glausch 			report_fail("Unexpected VMEXIT. Exit reason 0x%x",
19297839b0ecSKrish Sadhukhan 				    vmcb->control.exit_code);
19307839b0ecSKrish Sadhukhan 			return true;
19317839b0ecSKrish Sadhukhan 		}
19327839b0ecSKrish Sadhukhan 		vmcb->save.rip += 3;
19337839b0ecSKrish Sadhukhan 		/*
19347839b0ecSKrish Sadhukhan 		 * Setting host EFLAGS.TF not immediately before VMRUN, causes
19357839b0ecSKrish Sadhukhan 		 * #DB trap before first guest instruction is executed
19367839b0ecSKrish Sadhukhan 		 */
19377839b0ecSKrish Sadhukhan 		host_rflags_set_tf = true;
19387839b0ecSKrish Sadhukhan 		break;
19397839b0ecSKrish Sadhukhan 	case 1:
19407839b0ecSKrish Sadhukhan 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL ||
19410689a980SKrish Sadhukhan 		    host_rflags_guest_main_flag != 1) {
1942198dfd0eSJanis Schoetterl-Glausch 			report_fail("Unexpected VMEXIT or #DB handler"
19437839b0ecSKrish Sadhukhan 				    " invoked before guest main. Exit reason 0x%x",
19447839b0ecSKrish Sadhukhan 				    vmcb->control.exit_code);
19457839b0ecSKrish Sadhukhan 			return true;
19467839b0ecSKrish Sadhukhan 		}
19477839b0ecSKrish Sadhukhan 		vmcb->save.rip += 3;
19487839b0ecSKrish Sadhukhan 		/*
19497839b0ecSKrish Sadhukhan 		 * Setting host EFLAGS.TF immediately before VMRUN, causes #DB
19507839b0ecSKrish Sadhukhan 		 * trap after VMRUN completes on the host side (i.e., after
19517839b0ecSKrish Sadhukhan 		 * VMEXIT from guest).
19527839b0ecSKrish Sadhukhan 		 */
19537839b0ecSKrish Sadhukhan 		host_rflags_ss_on_vmrun = true;
19547839b0ecSKrish Sadhukhan 		break;
19557839b0ecSKrish Sadhukhan 	case 2:
19567839b0ecSKrish Sadhukhan 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL ||
19570c22fd44SPaolo Bonzini 		    rip_detected != (u64)&vmrun_rip + 3) {
1958198dfd0eSJanis Schoetterl-Glausch 			report_fail("Unexpected VMEXIT or RIP mismatch."
19590689a980SKrish Sadhukhan 				    " Exit reason 0x%x, RIP actual: %lx, RIP expected: "
19600689a980SKrish Sadhukhan 				    "%lx", vmcb->control.exit_code,
19610c22fd44SPaolo Bonzini 				    (u64)&vmrun_rip + 3, rip_detected);
19620689a980SKrish Sadhukhan 			return true;
19630689a980SKrish Sadhukhan 		}
19640689a980SKrish Sadhukhan 		host_rflags_set_rf = true;
19650689a980SKrish Sadhukhan 		host_rflags_guest_main_flag = 0;
19660689a980SKrish Sadhukhan 		host_rflags_vmrun_reached = false;
19670689a980SKrish Sadhukhan 		vmcb->save.rip += 3;
19680689a980SKrish Sadhukhan 		break;
19690689a980SKrish Sadhukhan 	case 3:
19700689a980SKrish Sadhukhan 		if (vmcb->control.exit_code != SVM_EXIT_VMMCALL ||
19710689a980SKrish Sadhukhan 		    rip_detected != (u64)&vmrun_rip ||
19720689a980SKrish Sadhukhan 		    host_rflags_guest_main_flag != 1 ||
19730689a980SKrish Sadhukhan 		    host_rflags_db_handler_flag > 1 ||
19740689a980SKrish Sadhukhan 		    read_rflags() & X86_EFLAGS_RF) {
1975198dfd0eSJanis Schoetterl-Glausch 			report_fail("Unexpected VMEXIT or RIP mismatch or "
19760689a980SKrish Sadhukhan 				    "EFLAGS.RF not cleared."
19770689a980SKrish Sadhukhan 				    " Exit reason 0x%x, RIP actual: %lx, RIP expected: "
19780689a980SKrish Sadhukhan 				    "%lx", vmcb->control.exit_code,
19790689a980SKrish Sadhukhan 				    (u64)&vmrun_rip, rip_detected);
19807839b0ecSKrish Sadhukhan 			return true;
19817839b0ecSKrish Sadhukhan 		}
19827839b0ecSKrish Sadhukhan 		host_rflags_set_tf = false;
19830689a980SKrish Sadhukhan 		host_rflags_set_rf = false;
19847839b0ecSKrish Sadhukhan 		vmcb->save.rip += 3;
19857839b0ecSKrish Sadhukhan 		break;
19867839b0ecSKrish Sadhukhan 	default:
19877839b0ecSKrish Sadhukhan 		return true;
19887839b0ecSKrish Sadhukhan 	}
19897839b0ecSKrish Sadhukhan 	inc_test_stage(test);
19900689a980SKrish Sadhukhan 	return get_test_stage(test) == 5;
19917839b0ecSKrish Sadhukhan }
19927839b0ecSKrish Sadhukhan 
19937839b0ecSKrish Sadhukhan static bool host_rflags_check(struct svm_test *test)
19947839b0ecSKrish Sadhukhan {
19950689a980SKrish Sadhukhan 	return get_test_stage(test) == 4;
19967839b0ecSKrish Sadhukhan }
19977839b0ecSKrish Sadhukhan 
19988660d1b5SKrish Sadhukhan #define TEST(name) { #name, .v2 = name }
19998660d1b5SKrish Sadhukhan 
2000ba29942cSKrish Sadhukhan /*
2001ba29942cSKrish Sadhukhan  * v2 tests
2002ba29942cSKrish Sadhukhan  */
2003ba29942cSKrish Sadhukhan 
2004f32183f5SJim Mattson /*
2005f32183f5SJim Mattson  * Ensure that kvm recalculates the L1 guest's CPUID.01H:ECX.OSXSAVE
2006f32183f5SJim Mattson  * after VM-exit from an L2 guest that sets CR4.OSXSAVE to a different
2007f32183f5SJim Mattson  * value than in L1.
2008f32183f5SJim Mattson  */
2009f32183f5SJim Mattson 
2010f32183f5SJim Mattson static void svm_cr4_osxsave_test_guest(struct svm_test *test)
2011f32183f5SJim Mattson {
2012f32183f5SJim Mattson 	write_cr4(read_cr4() & ~X86_CR4_OSXSAVE);
2013f32183f5SJim Mattson }
2014f32183f5SJim Mattson 
2015f32183f5SJim Mattson static void svm_cr4_osxsave_test(void)
2016f32183f5SJim Mattson {
2017f32183f5SJim Mattson 	if (!this_cpu_has(X86_FEATURE_XSAVE)) {
2018f32183f5SJim Mattson 		report_skip("XSAVE not detected");
2019f32183f5SJim Mattson 		return;
2020f32183f5SJim Mattson 	}
2021f32183f5SJim Mattson 
2022f32183f5SJim Mattson 	if (!(read_cr4() & X86_CR4_OSXSAVE)) {
2023f32183f5SJim Mattson 		unsigned long cr4 = read_cr4() | X86_CR4_OSXSAVE;
2024f32183f5SJim Mattson 
2025f32183f5SJim Mattson 		write_cr4(cr4);
2026f32183f5SJim Mattson 		vmcb->save.cr4 = cr4;
2027f32183f5SJim Mattson 	}
2028f32183f5SJim Mattson 
2029f32183f5SJim Mattson 	report(cpuid_osxsave(), "CPUID.01H:ECX.XSAVE set before VMRUN");
2030f32183f5SJim Mattson 
2031f32183f5SJim Mattson 	test_set_guest(svm_cr4_osxsave_test_guest);
2032f32183f5SJim Mattson 	report(svm_vmrun() == SVM_EXIT_VMMCALL,
2033f32183f5SJim Mattson 	       "svm_cr4_osxsave_test_guest finished with VMMCALL");
2034f32183f5SJim Mattson 
2035f32183f5SJim Mattson 	report(cpuid_osxsave(), "CPUID.01H:ECX.XSAVE set after VMRUN");
2036f32183f5SJim Mattson }
2037f32183f5SJim Mattson 
2038ba29942cSKrish Sadhukhan static void basic_guest_main(struct svm_test *test)
2039ba29942cSKrish Sadhukhan {
2040ba29942cSKrish Sadhukhan }
2041ba29942cSKrish Sadhukhan 
2042eae10e8fSKrish Sadhukhan 
2043eae10e8fSKrish Sadhukhan #define SVM_TEST_REG_RESERVED_BITS(start, end, inc, str_name, reg, val,	\
2044eae10e8fSKrish Sadhukhan 				   resv_mask)				\
2045eae10e8fSKrish Sadhukhan {									\
2046eae10e8fSKrish Sadhukhan         u64 tmp, mask;							\
2047eae10e8fSKrish Sadhukhan         int i;								\
2048eae10e8fSKrish Sadhukhan 									\
2049eae10e8fSKrish Sadhukhan         for (i = start; i <= end; i = i + inc) {			\
2050eae10e8fSKrish Sadhukhan                 mask = 1ull << i;					\
2051eae10e8fSKrish Sadhukhan                 if (!(mask & resv_mask))				\
2052eae10e8fSKrish Sadhukhan                         continue;					\
2053eae10e8fSKrish Sadhukhan                 tmp = val | mask;					\
2054eae10e8fSKrish Sadhukhan 		reg = tmp;						\
2055eae10e8fSKrish Sadhukhan 		report(svm_vmrun() == SVM_EXIT_ERR, "Test %s %d:%d: %lx",\
2056eae10e8fSKrish Sadhukhan 		    str_name, end, start, tmp);				\
2057eae10e8fSKrish Sadhukhan         }								\
2058eae10e8fSKrish Sadhukhan }
2059eae10e8fSKrish Sadhukhan 
20606d0ecbf6SKrish Sadhukhan #define SVM_TEST_CR_RESERVED_BITS(start, end, inc, cr, val, resv_mask,	\
2061cb6524f3SPaolo Bonzini 				  exit_code, test_name)			\
2062a79c9495SKrish Sadhukhan {									\
2063a79c9495SKrish Sadhukhan 	u64 tmp, mask;							\
20648ae6d77fSSean Christopherson 	u32 r;								\
2065a79c9495SKrish Sadhukhan 	int i;								\
2066a79c9495SKrish Sadhukhan 									\
2067a79c9495SKrish Sadhukhan 	for (i = start; i <= end; i = i + inc) {			\
2068a79c9495SKrish Sadhukhan 		mask = 1ull << i;					\
2069a79c9495SKrish Sadhukhan 		if (!(mask & resv_mask))				\
2070a79c9495SKrish Sadhukhan 			continue;					\
2071a79c9495SKrish Sadhukhan 		tmp = val | mask;					\
2072a79c9495SKrish Sadhukhan 		switch (cr) {						\
2073a79c9495SKrish Sadhukhan 		case 0:							\
2074a79c9495SKrish Sadhukhan 			vmcb->save.cr0 = tmp;				\
2075a79c9495SKrish Sadhukhan 			break;						\
2076a79c9495SKrish Sadhukhan 		case 3:							\
2077a79c9495SKrish Sadhukhan 			vmcb->save.cr3 = tmp;				\
2078a79c9495SKrish Sadhukhan 			break;						\
2079a79c9495SKrish Sadhukhan 		case 4:							\
2080a79c9495SKrish Sadhukhan 			vmcb->save.cr4 = tmp;				\
2081a79c9495SKrish Sadhukhan 		}							\
20828ae6d77fSSean Christopherson 		r = svm_vmrun();					\
20838ae6d77fSSean Christopherson 		report(r == exit_code, "Test CR%d %s%d:%d: %lx, wanted exit 0x%x, got 0x%x",\
20848ae6d77fSSean Christopherson 		       cr, test_name, end, start, tmp, exit_code, r);	\
2085a79c9495SKrish Sadhukhan 	}								\
2086a79c9495SKrish Sadhukhan }
2087e8d7a8f6SKrish Sadhukhan 
2088a79c9495SKrish Sadhukhan static void test_efer(void)
2089a79c9495SKrish Sadhukhan {
2090e8d7a8f6SKrish Sadhukhan 	/*
2091e8d7a8f6SKrish Sadhukhan 	 * Un-setting EFER.SVME is illegal
2092e8d7a8f6SKrish Sadhukhan 	 */
2093ba29942cSKrish Sadhukhan 	u64 efer_saved = vmcb->save.efer;
2094ba29942cSKrish Sadhukhan 	u64 efer = efer_saved;
2095ba29942cSKrish Sadhukhan 
2096ba29942cSKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "EFER.SVME: %lx", efer);
2097ba29942cSKrish Sadhukhan 	efer &= ~EFER_SVME;
2098ba29942cSKrish Sadhukhan 	vmcb->save.efer = efer;
2099ba29942cSKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_ERR, "EFER.SVME: %lx", efer);
2100ba29942cSKrish Sadhukhan 	vmcb->save.efer = efer_saved;
2101e8d7a8f6SKrish Sadhukhan 
2102e8d7a8f6SKrish Sadhukhan 	/*
2103a79c9495SKrish Sadhukhan 	 * EFER MBZ bits: 63:16, 9
2104a79c9495SKrish Sadhukhan 	 */
2105a79c9495SKrish Sadhukhan 	efer_saved = vmcb->save.efer;
2106a79c9495SKrish Sadhukhan 
2107a79c9495SKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(8, 9, 1, "EFER", vmcb->save.efer,
2108a79c9495SKrish Sadhukhan 	    efer_saved, SVM_EFER_RESERVED_MASK);
2109a79c9495SKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(16, 63, 4, "EFER", vmcb->save.efer,
2110a79c9495SKrish Sadhukhan 	    efer_saved, SVM_EFER_RESERVED_MASK);
2111a79c9495SKrish Sadhukhan 
21121d7bde08SKrish Sadhukhan 	/*
21131d7bde08SKrish Sadhukhan 	 * EFER.LME and CR0.PG are both set and CR4.PAE is zero.
21141d7bde08SKrish Sadhukhan 	 */
21151d7bde08SKrish Sadhukhan 	u64 cr0_saved = vmcb->save.cr0;
21161d7bde08SKrish Sadhukhan 	u64 cr0;
21171d7bde08SKrish Sadhukhan 	u64 cr4_saved = vmcb->save.cr4;
21181d7bde08SKrish Sadhukhan 	u64 cr4;
21191d7bde08SKrish Sadhukhan 
21201d7bde08SKrish Sadhukhan 	efer = efer_saved | EFER_LME;
21211d7bde08SKrish Sadhukhan 	vmcb->save.efer = efer;
21221d7bde08SKrish Sadhukhan 	cr0 = cr0_saved | X86_CR0_PG | X86_CR0_PE;
21231d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
21241d7bde08SKrish Sadhukhan 	cr4 = cr4_saved & ~X86_CR4_PAE;
21251d7bde08SKrish Sadhukhan 	vmcb->save.cr4 = cr4;
21261d7bde08SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), "
21271d7bde08SKrish Sadhukhan 	    "CR0.PG=1 (%lx) and CR4.PAE=0 (%lx)", efer, cr0, cr4);
21281d7bde08SKrish Sadhukhan 
21291d7bde08SKrish Sadhukhan 	/*
21301d7bde08SKrish Sadhukhan 	 * EFER.LME and CR0.PG are both set and CR0.PE is zero.
2131fc050452SLara Lazier 	 * CR4.PAE needs to be set as we otherwise cannot
2132fc050452SLara Lazier 	 * determine if CR4.PAE=0 or CR0.PE=0 triggered the
2133fc050452SLara Lazier 	 * SVM_EXIT_ERR.
21341d7bde08SKrish Sadhukhan 	 */
2135fc050452SLara Lazier 	cr4 = cr4_saved | X86_CR4_PAE;
2136fc050452SLara Lazier 	vmcb->save.cr4 = cr4;
21371d7bde08SKrish Sadhukhan 	cr0 &= ~X86_CR0_PE;
21381d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
21391d7bde08SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), "
21401d7bde08SKrish Sadhukhan 	    "CR0.PG=1 and CR0.PE=0 (%lx)", efer, cr0);
21411d7bde08SKrish Sadhukhan 
21421d7bde08SKrish Sadhukhan 	/*
21431d7bde08SKrish Sadhukhan 	 * EFER.LME, CR0.PG, CR4.PAE, CS.L, and CS.D are all non-zero.
21441d7bde08SKrish Sadhukhan 	 */
21451d7bde08SKrish Sadhukhan 	u32 cs_attrib_saved = vmcb->save.cs.attrib;
21461d7bde08SKrish Sadhukhan 	u32 cs_attrib;
21471d7bde08SKrish Sadhukhan 
21481d7bde08SKrish Sadhukhan 	cr0 |= X86_CR0_PE;
21491d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
21501d7bde08SKrish Sadhukhan 	cs_attrib = cs_attrib_saved | SVM_SELECTOR_L_MASK |
21511d7bde08SKrish Sadhukhan 	    SVM_SELECTOR_DB_MASK;
21521d7bde08SKrish Sadhukhan 	vmcb->save.cs.attrib = cs_attrib;
21531d7bde08SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_ERR, "EFER.LME=1 (%lx), "
21541d7bde08SKrish Sadhukhan 	    "CR0.PG=1 (%lx), CR4.PAE=1 (%lx), CS.L=1 and CS.D=1 (%x)",
21551d7bde08SKrish Sadhukhan 	    efer, cr0, cr4, cs_attrib);
21561d7bde08SKrish Sadhukhan 
21571d7bde08SKrish Sadhukhan 	vmcb->save.cr0 = cr0_saved;
21581d7bde08SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved;
2159a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer_saved;
21601d7bde08SKrish Sadhukhan 	vmcb->save.cs.attrib = cs_attrib_saved;
2161a79c9495SKrish Sadhukhan }
2162a79c9495SKrish Sadhukhan 
2163a79c9495SKrish Sadhukhan static void test_cr0(void)
2164a79c9495SKrish Sadhukhan {
2165a79c9495SKrish Sadhukhan 	/*
2166e8d7a8f6SKrish Sadhukhan 	 * Un-setting CR0.CD and setting CR0.NW is illegal combination
2167e8d7a8f6SKrish Sadhukhan 	 */
2168e8d7a8f6SKrish Sadhukhan 	u64 cr0_saved = vmcb->save.cr0;
2169e8d7a8f6SKrish Sadhukhan 	u64 cr0 = cr0_saved;
2170e8d7a8f6SKrish Sadhukhan 
2171e8d7a8f6SKrish Sadhukhan 	cr0 |= X86_CR0_CD;
2172e8d7a8f6SKrish Sadhukhan 	cr0 &= ~X86_CR0_NW;
2173e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2174a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=0: %lx",
2175a79c9495SKrish Sadhukhan 	    cr0);
2176e8d7a8f6SKrish Sadhukhan 	cr0 |= X86_CR0_NW;
2177e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2178a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=1,NW=1: %lx",
2179a79c9495SKrish Sadhukhan 	    cr0);
2180e8d7a8f6SKrish Sadhukhan 	cr0 &= ~X86_CR0_NW;
2181e8d7a8f6SKrish Sadhukhan 	cr0 &= ~X86_CR0_CD;
2182e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2183a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR0 CD=0,NW=0: %lx",
2184a79c9495SKrish Sadhukhan 	    cr0);
2185e8d7a8f6SKrish Sadhukhan 	cr0 |= X86_CR0_NW;
2186e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0;
2187a79c9495SKrish Sadhukhan 	report (svm_vmrun() == SVM_EXIT_ERR, "Test CR0 CD=0,NW=1: %lx",
2188a79c9495SKrish Sadhukhan 	    cr0);
2189e8d7a8f6SKrish Sadhukhan 	vmcb->save.cr0 = cr0_saved;
21905c052c90SKrish Sadhukhan 
21915c052c90SKrish Sadhukhan 	/*
21925c052c90SKrish Sadhukhan 	 * CR0[63:32] are not zero
21935c052c90SKrish Sadhukhan 	 */
21945c052c90SKrish Sadhukhan 	cr0 = cr0_saved;
2195eae10e8fSKrish Sadhukhan 
2196eae10e8fSKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "CR0", vmcb->save.cr0, cr0_saved,
2197eae10e8fSKrish Sadhukhan 	    SVM_CR0_RESERVED_MASK);
21985c052c90SKrish Sadhukhan 	vmcb->save.cr0 = cr0_saved;
2199a79c9495SKrish Sadhukhan }
2200eae10e8fSKrish Sadhukhan 
2201a79c9495SKrish Sadhukhan static void test_cr3(void)
2202a79c9495SKrish Sadhukhan {
2203a79c9495SKrish Sadhukhan 	/*
2204a79c9495SKrish Sadhukhan 	 * CR3 MBZ bits based on different modes:
220529a01803SNadav Amit 	 *   [63:52] - long mode
2206a79c9495SKrish Sadhukhan 	 */
2207a79c9495SKrish Sadhukhan 	u64 cr3_saved = vmcb->save.cr3;
2208a79c9495SKrish Sadhukhan 
2209a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(0, 63, 1, 3, cr3_saved,
2210cb6524f3SPaolo Bonzini 	    SVM_CR3_LONG_MBZ_MASK, SVM_EXIT_ERR, "");
22116d0ecbf6SKrish Sadhukhan 
22126d0ecbf6SKrish Sadhukhan 	vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_MBZ_MASK;
22136d0ecbf6SKrish Sadhukhan 	report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx",
22146d0ecbf6SKrish Sadhukhan 	    vmcb->save.cr3);
22156d0ecbf6SKrish Sadhukhan 
22166d0ecbf6SKrish Sadhukhan 	/*
22176d0ecbf6SKrish Sadhukhan 	 * CR3 non-MBZ reserved bits based on different modes:
2218cb6524f3SPaolo Bonzini 	 *   [11:5] [2:0] - long mode (PCIDE=0)
22196d0ecbf6SKrish Sadhukhan 	 *          [2:0] - PAE legacy mode
22206d0ecbf6SKrish Sadhukhan 	 */
22216d0ecbf6SKrish Sadhukhan 	u64 cr4_saved = vmcb->save.cr4;
22226d0ecbf6SKrish Sadhukhan 	u64 *pdpe = npt_get_pml4e();
22236d0ecbf6SKrish Sadhukhan 
22246d0ecbf6SKrish Sadhukhan 	/*
22256d0ecbf6SKrish Sadhukhan 	 * Long mode
22266d0ecbf6SKrish Sadhukhan 	 */
22276d0ecbf6SKrish Sadhukhan 	if (this_cpu_has(X86_FEATURE_PCID)) {
22286d0ecbf6SKrish Sadhukhan 		vmcb->save.cr4 = cr4_saved | X86_CR4_PCIDE;
22296d0ecbf6SKrish Sadhukhan 		SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved,
2230cb6524f3SPaolo Bonzini 		    SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_VMMCALL, "(PCIDE=1) ");
22316d0ecbf6SKrish Sadhukhan 
22326d0ecbf6SKrish Sadhukhan 		vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_RESERVED_MASK;
22336d0ecbf6SKrish Sadhukhan 		report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx",
22346d0ecbf6SKrish Sadhukhan 		    vmcb->save.cr3);
2235cb6524f3SPaolo Bonzini 	}
22366d0ecbf6SKrish Sadhukhan 
22376d0ecbf6SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved & ~X86_CR4_PCIDE;
22386d0ecbf6SKrish Sadhukhan 
2239993749ffSSean Christopherson 	if (!npt_supported())
2240993749ffSSean Christopherson 		goto skip_npt_only;
2241993749ffSSean Christopherson 
22426d0ecbf6SKrish Sadhukhan 	/* Clear P (Present) bit in NPT in order to trigger #NPF */
22436d0ecbf6SKrish Sadhukhan 	pdpe[0] &= ~1ULL;
22446d0ecbf6SKrish Sadhukhan 
22456d0ecbf6SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved,
2246cb6524f3SPaolo Bonzini 	    SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_NPF, "(PCIDE=0) ");
22476d0ecbf6SKrish Sadhukhan 
22486d0ecbf6SKrish Sadhukhan 	pdpe[0] |= 1ULL;
2249cb6524f3SPaolo Bonzini 	vmcb->save.cr3 = cr3_saved;
22506d0ecbf6SKrish Sadhukhan 
22516d0ecbf6SKrish Sadhukhan 	/*
22526d0ecbf6SKrish Sadhukhan 	 * PAE legacy
22536d0ecbf6SKrish Sadhukhan 	 */
22546d0ecbf6SKrish Sadhukhan 	pdpe[0] &= ~1ULL;
22556d0ecbf6SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved | X86_CR4_PAE;
22566d0ecbf6SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(0, 2, 1, 3, cr3_saved,
2257cb6524f3SPaolo Bonzini 	    SVM_CR3_PAE_LEGACY_RESERVED_MASK, SVM_EXIT_NPF, "(PAE) ");
22586d0ecbf6SKrish Sadhukhan 
22596d0ecbf6SKrish Sadhukhan 	pdpe[0] |= 1ULL;
2260993749ffSSean Christopherson 
2261993749ffSSean Christopherson skip_npt_only:
2262a79c9495SKrish Sadhukhan 	vmcb->save.cr3 = cr3_saved;
22636d0ecbf6SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved;
2264a79c9495SKrish Sadhukhan }
2265a79c9495SKrish Sadhukhan 
2266d30973c3SWei Huang /* Test CR4 MBZ bits based on legacy or long modes */
2267a79c9495SKrish Sadhukhan static void test_cr4(void)
2268a79c9495SKrish Sadhukhan {
2269a79c9495SKrish Sadhukhan 	u64 cr4_saved = vmcb->save.cr4;
2270a79c9495SKrish Sadhukhan 	u64 efer_saved = vmcb->save.efer;
2271a79c9495SKrish Sadhukhan 	u64 efer = efer_saved;
2272a79c9495SKrish Sadhukhan 
2273a79c9495SKrish Sadhukhan 	efer &= ~EFER_LME;
2274a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer;
2275a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved,
2276cb6524f3SPaolo Bonzini 	    SVM_CR4_LEGACY_RESERVED_MASK, SVM_EXIT_ERR, "");
2277a79c9495SKrish Sadhukhan 
2278a79c9495SKrish Sadhukhan 	efer |= EFER_LME;
2279a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer;
2280a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved,
2281cb6524f3SPaolo Bonzini 	    SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR, "");
2282a79c9495SKrish Sadhukhan 	SVM_TEST_CR_RESERVED_BITS(32, 63, 4, 4, cr4_saved,
2283cb6524f3SPaolo Bonzini 	    SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR, "");
2284a79c9495SKrish Sadhukhan 
2285a79c9495SKrish Sadhukhan 	vmcb->save.cr4 = cr4_saved;
2286a79c9495SKrish Sadhukhan 	vmcb->save.efer = efer_saved;
2287a79c9495SKrish Sadhukhan }
2288a79c9495SKrish Sadhukhan 
2289a79c9495SKrish Sadhukhan static void test_dr(void)
2290a79c9495SKrish Sadhukhan {
2291eae10e8fSKrish Sadhukhan 	/*
2292eae10e8fSKrish Sadhukhan 	 * DR6[63:32] and DR7[63:32] are MBZ
2293eae10e8fSKrish Sadhukhan 	 */
2294eae10e8fSKrish Sadhukhan 	u64 dr_saved = vmcb->save.dr6;
2295eae10e8fSKrish Sadhukhan 
2296eae10e8fSKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR6", vmcb->save.dr6, dr_saved,
2297eae10e8fSKrish Sadhukhan 	    SVM_DR6_RESERVED_MASK);
2298eae10e8fSKrish Sadhukhan 	vmcb->save.dr6 = dr_saved;
2299eae10e8fSKrish Sadhukhan 
2300eae10e8fSKrish Sadhukhan 	dr_saved = vmcb->save.dr7;
2301eae10e8fSKrish Sadhukhan 	SVM_TEST_REG_RESERVED_BITS(32, 63, 4, "DR7", vmcb->save.dr7, dr_saved,
2302eae10e8fSKrish Sadhukhan 	    SVM_DR7_RESERVED_MASK);
2303eae10e8fSKrish Sadhukhan 
2304eae10e8fSKrish Sadhukhan 	vmcb->save.dr7 = dr_saved;
2305a79c9495SKrish Sadhukhan }
2306eae10e8fSKrish Sadhukhan 
2307abe82380SKrish Sadhukhan /* TODO: verify if high 32-bits are sign- or zero-extended on bare metal */
2308abe82380SKrish Sadhukhan #define	TEST_BITMAP_ADDR(save_intercept, type, addr, exit_code,		\
2309abe82380SKrish Sadhukhan 			 msg) {						\
2310abe82380SKrish Sadhukhan 	vmcb->control.intercept = saved_intercept | 1ULL << type;	\
2311abe82380SKrish Sadhukhan 	if (type == INTERCEPT_MSR_PROT)					\
2312abe82380SKrish Sadhukhan 		vmcb->control.msrpm_base_pa = addr;			\
2313abe82380SKrish Sadhukhan 	else								\
2314abe82380SKrish Sadhukhan 		vmcb->control.iopm_base_pa = addr;			\
2315abe82380SKrish Sadhukhan 	report(svm_vmrun() == exit_code,				\
2316abe82380SKrish Sadhukhan 	    "Test %s address: %lx", msg, addr);                         \
2317abe82380SKrish Sadhukhan }
2318abe82380SKrish Sadhukhan 
2319abe82380SKrish Sadhukhan /*
2320abe82380SKrish Sadhukhan  * If the MSR or IOIO intercept table extends to a physical address that
2321abe82380SKrish Sadhukhan  * is greater than or equal to the maximum supported physical address, the
2322abe82380SKrish Sadhukhan  * guest state is illegal.
2323abe82380SKrish Sadhukhan  *
2324abe82380SKrish Sadhukhan  * The VMRUN instruction ignores the lower 12 bits of the address specified
2325abe82380SKrish Sadhukhan  * in the VMCB.
2326abe82380SKrish Sadhukhan  *
2327abe82380SKrish Sadhukhan  * MSRPM spans 2 contiguous 4KB pages while IOPM spans 2 contiguous 4KB
2328abe82380SKrish Sadhukhan  * pages + 1 byte.
2329abe82380SKrish Sadhukhan  *
2330abe82380SKrish Sadhukhan  * [APM vol 2]
2331abe82380SKrish Sadhukhan  *
2332abe82380SKrish Sadhukhan  * Note: Unallocated MSRPM addresses conforming to consistency checks, generate
2333abe82380SKrish Sadhukhan  * #NPF.
2334abe82380SKrish Sadhukhan  */
2335abe82380SKrish Sadhukhan static void test_msrpm_iopm_bitmap_addrs(void)
2336abe82380SKrish Sadhukhan {
2337abe82380SKrish Sadhukhan 	u64 saved_intercept = vmcb->control.intercept;
2338abe82380SKrish Sadhukhan 	u64 addr_beyond_limit = 1ull << cpuid_maxphyaddr();
2339abe82380SKrish Sadhukhan 	u64 addr = virt_to_phys(msr_bitmap) & (~((1ull << 12) - 1));
2340abe82380SKrish Sadhukhan 
2341abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT,
2342abe82380SKrish Sadhukhan 			addr_beyond_limit - 2 * PAGE_SIZE, SVM_EXIT_ERR,
2343abe82380SKrish Sadhukhan 			"MSRPM");
2344abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT,
2345abe82380SKrish Sadhukhan 			addr_beyond_limit - 2 * PAGE_SIZE + 1, SVM_EXIT_ERR,
2346abe82380SKrish Sadhukhan 			"MSRPM");
2347abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT,
2348abe82380SKrish Sadhukhan 			addr_beyond_limit - PAGE_SIZE, SVM_EXIT_ERR,
2349abe82380SKrish Sadhukhan 			"MSRPM");
2350abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, addr,
2351abe82380SKrish Sadhukhan 			SVM_EXIT_VMMCALL, "MSRPM");
2352abe82380SKrish Sadhukhan 	addr |= (1ull << 12) - 1;
2353abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_MSR_PROT, addr,
2354abe82380SKrish Sadhukhan 			SVM_EXIT_VMMCALL, "MSRPM");
2355abe82380SKrish Sadhukhan 
2356abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2357abe82380SKrish Sadhukhan 			addr_beyond_limit - 4 * PAGE_SIZE, SVM_EXIT_VMMCALL,
2358abe82380SKrish Sadhukhan 			"IOPM");
2359abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2360abe82380SKrish Sadhukhan 			addr_beyond_limit - 3 * PAGE_SIZE, SVM_EXIT_VMMCALL,
2361abe82380SKrish Sadhukhan 			"IOPM");
2362abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2363abe82380SKrish Sadhukhan 			addr_beyond_limit - 2 * PAGE_SIZE - 2, SVM_EXIT_VMMCALL,
2364abe82380SKrish Sadhukhan 			"IOPM");
2365abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2366abe82380SKrish Sadhukhan 			addr_beyond_limit - 2 * PAGE_SIZE, SVM_EXIT_ERR,
2367abe82380SKrish Sadhukhan 			"IOPM");
2368abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT,
2369abe82380SKrish Sadhukhan 			addr_beyond_limit - PAGE_SIZE, SVM_EXIT_ERR,
2370abe82380SKrish Sadhukhan 			"IOPM");
2371abe82380SKrish Sadhukhan 	addr = virt_to_phys(io_bitmap) & (~((1ull << 11) - 1));
2372abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, addr,
2373abe82380SKrish Sadhukhan 			SVM_EXIT_VMMCALL, "IOPM");
2374abe82380SKrish Sadhukhan 	addr |= (1ull << 12) - 1;
2375abe82380SKrish Sadhukhan 	TEST_BITMAP_ADDR(saved_intercept, INTERCEPT_IOIO_PROT, addr,
2376abe82380SKrish Sadhukhan 			SVM_EXIT_VMMCALL, "IOPM");
2377abe82380SKrish Sadhukhan 
2378abe82380SKrish Sadhukhan 	vmcb->control.intercept = saved_intercept;
2379abe82380SKrish Sadhukhan }
2380abe82380SKrish Sadhukhan 
2381ba3c9773SLara Lazier /*
2382ba3c9773SLara Lazier  * Unlike VMSAVE, VMRUN seems not to update the value of noncanonical
2383ba3c9773SLara Lazier  * segment bases in the VMCB.  However, VMENTRY succeeds as documented.
2384ba3c9773SLara Lazier  */
2385ba3c9773SLara Lazier #define TEST_CANONICAL_VMRUN(seg_base, msg)					\
2386a99070ebSKrish Sadhukhan 	saved_addr = seg_base;					\
2387a99070ebSKrish Sadhukhan 	seg_base = (seg_base & ((1ul << addr_limit) - 1)) | noncanonical_mask; \
2388ba3c9773SLara Lazier 	return_value = svm_vmrun(); \
2389ba3c9773SLara Lazier 	report(return_value == SVM_EXIT_VMMCALL, \
2390ba3c9773SLara Lazier 			"Successful VMRUN with noncanonical %s.base", msg); \
2391a99070ebSKrish Sadhukhan 	seg_base = saved_addr;
2392a99070ebSKrish Sadhukhan 
2393ba3c9773SLara Lazier 
2394ba3c9773SLara Lazier #define TEST_CANONICAL_VMLOAD(seg_base, msg)					\
2395ba3c9773SLara Lazier 	saved_addr = seg_base;					\
2396ba3c9773SLara Lazier 	seg_base = (seg_base & ((1ul << addr_limit) - 1)) | noncanonical_mask; \
2397ba3c9773SLara Lazier 	asm volatile ("vmload %0" : : "a"(vmcb_phys) : "memory"); \
2398ba3c9773SLara Lazier 	asm volatile ("vmsave %0" : : "a"(vmcb_phys) : "memory"); \
2399ba3c9773SLara Lazier 	report(is_canonical(seg_base), \
2400ba3c9773SLara Lazier 			"Test %s.base for canonical form: %lx", msg, seg_base); \
2401ba3c9773SLara Lazier 	seg_base = saved_addr;
2402ba3c9773SLara Lazier 
2403ba3c9773SLara Lazier static void test_canonicalization(void)
2404a99070ebSKrish Sadhukhan {
2405a99070ebSKrish Sadhukhan 	u64 saved_addr;
2406ba3c9773SLara Lazier 	u64 return_value;
2407ba3c9773SLara Lazier 	u64 addr_limit;
2408ba3c9773SLara Lazier 	u64 vmcb_phys = virt_to_phys(vmcb);
2409ba3c9773SLara Lazier 
2410ba3c9773SLara Lazier 	addr_limit = (this_cpu_has(X86_FEATURE_LA57)) ? 57 : 48;
2411a99070ebSKrish Sadhukhan 	u64 noncanonical_mask = NONCANONICAL & ~((1ul << addr_limit) - 1);
2412a99070ebSKrish Sadhukhan 
2413ba3c9773SLara Lazier 	TEST_CANONICAL_VMLOAD(vmcb->save.fs.base, "FS");
2414ba3c9773SLara Lazier 	TEST_CANONICAL_VMLOAD(vmcb->save.gs.base, "GS");
2415ba3c9773SLara Lazier 	TEST_CANONICAL_VMLOAD(vmcb->save.ldtr.base, "LDTR");
2416ba3c9773SLara Lazier 	TEST_CANONICAL_VMLOAD(vmcb->save.tr.base, "TR");
2417ba3c9773SLara Lazier 	TEST_CANONICAL_VMLOAD(vmcb->save.kernel_gs_base, "KERNEL GS");
2418ba3c9773SLara Lazier 	TEST_CANONICAL_VMRUN(vmcb->save.es.base, "ES");
2419ba3c9773SLara Lazier 	TEST_CANONICAL_VMRUN(vmcb->save.cs.base, "CS");
2420ba3c9773SLara Lazier 	TEST_CANONICAL_VMRUN(vmcb->save.ss.base, "SS");
2421ba3c9773SLara Lazier 	TEST_CANONICAL_VMRUN(vmcb->save.ds.base, "DS");
2422ba3c9773SLara Lazier 	TEST_CANONICAL_VMRUN(vmcb->save.gdtr.base, "GDTR");
2423ba3c9773SLara Lazier 	TEST_CANONICAL_VMRUN(vmcb->save.idtr.base, "IDTR");
2424a99070ebSKrish Sadhukhan }
2425a99070ebSKrish Sadhukhan 
2426665f5677SKrish Sadhukhan /*
2427665f5677SKrish Sadhukhan  * When VMRUN loads a guest value of 1 in EFLAGS.TF, that value does not
2428665f5677SKrish Sadhukhan  * cause a trace trap between the VMRUN and the first guest instruction, but
2429665f5677SKrish Sadhukhan  * rather after completion of the first guest instruction.
2430665f5677SKrish Sadhukhan  *
2431665f5677SKrish Sadhukhan  * [APM vol 2]
2432665f5677SKrish Sadhukhan  */
2433665f5677SKrish Sadhukhan u64 guest_rflags_test_trap_rip;
2434665f5677SKrish Sadhukhan 
2435665f5677SKrish Sadhukhan static void guest_rflags_test_db_handler(struct ex_regs *r)
2436665f5677SKrish Sadhukhan {
2437665f5677SKrish Sadhukhan 	guest_rflags_test_trap_rip = r->rip;
2438665f5677SKrish Sadhukhan 	r->rflags &= ~X86_EFLAGS_TF;
2439665f5677SKrish Sadhukhan }
2440665f5677SKrish Sadhukhan 
2441a79c9495SKrish Sadhukhan static void svm_guest_state_test(void)
2442a79c9495SKrish Sadhukhan {
2443a79c9495SKrish Sadhukhan 	test_set_guest(basic_guest_main);
2444a79c9495SKrish Sadhukhan 	test_efer();
2445a79c9495SKrish Sadhukhan 	test_cr0();
2446a79c9495SKrish Sadhukhan 	test_cr3();
2447a79c9495SKrish Sadhukhan 	test_cr4();
2448a79c9495SKrish Sadhukhan 	test_dr();
2449abe82380SKrish Sadhukhan 	test_msrpm_iopm_bitmap_addrs();
2450ba3c9773SLara Lazier 	test_canonicalization();
2451ba29942cSKrish Sadhukhan }
2452ba29942cSKrish Sadhukhan 
2453665f5677SKrish Sadhukhan extern void guest_rflags_test_guest(struct svm_test *test);
2454665f5677SKrish Sadhukhan extern u64 *insn2;
2455665f5677SKrish Sadhukhan extern u64 *guest_end;
2456665f5677SKrish Sadhukhan 
2457665f5677SKrish Sadhukhan asm("guest_rflags_test_guest:\n\t"
2458665f5677SKrish Sadhukhan     "push %rbp\n\t"
2459665f5677SKrish Sadhukhan     ".global insn2\n\t"
2460665f5677SKrish Sadhukhan     "insn2:\n\t"
2461665f5677SKrish Sadhukhan     "mov %rsp,%rbp\n\t"
2462665f5677SKrish Sadhukhan     "vmmcall\n\t"
2463665f5677SKrish Sadhukhan     "vmmcall\n\t"
2464665f5677SKrish Sadhukhan     ".global guest_end\n\t"
2465665f5677SKrish Sadhukhan     "guest_end:\n\t"
2466665f5677SKrish Sadhukhan     "vmmcall\n\t"
2467665f5677SKrish Sadhukhan     "pop %rbp\n\t"
2468665f5677SKrish Sadhukhan     "ret");
2469665f5677SKrish Sadhukhan 
2470665f5677SKrish Sadhukhan static void svm_test_singlestep(void)
2471665f5677SKrish Sadhukhan {
2472665f5677SKrish Sadhukhan 	handle_exception(DB_VECTOR, guest_rflags_test_db_handler);
2473665f5677SKrish Sadhukhan 
2474665f5677SKrish Sadhukhan 	/*
2475665f5677SKrish Sadhukhan 	 * Trap expected after completion of first guest instruction
2476665f5677SKrish Sadhukhan 	 */
2477665f5677SKrish Sadhukhan 	vmcb->save.rflags |= X86_EFLAGS_TF;
2478665f5677SKrish Sadhukhan 	report (__svm_vmrun((u64)guest_rflags_test_guest) == SVM_EXIT_VMMCALL &&
2479665f5677SKrish Sadhukhan 		guest_rflags_test_trap_rip == (u64)&insn2,
2480665f5677SKrish Sadhukhan                "Test EFLAGS.TF on VMRUN: trap expected  after completion of first guest instruction");
2481665f5677SKrish Sadhukhan 	/*
2482665f5677SKrish Sadhukhan 	 * No trap expected
2483665f5677SKrish Sadhukhan 	 */
2484665f5677SKrish Sadhukhan 	guest_rflags_test_trap_rip = 0;
2485665f5677SKrish Sadhukhan 	vmcb->save.rip += 3;
2486665f5677SKrish Sadhukhan 	vmcb->save.rflags |= X86_EFLAGS_TF;
2487665f5677SKrish Sadhukhan 	report (__svm_vmrun(vmcb->save.rip) == SVM_EXIT_VMMCALL &&
2488665f5677SKrish Sadhukhan 		guest_rflags_test_trap_rip == 0, "Test EFLAGS.TF on VMRUN: trap not expected");
2489665f5677SKrish Sadhukhan 
2490665f5677SKrish Sadhukhan 	/*
2491665f5677SKrish Sadhukhan 	 * Let guest finish execution
2492665f5677SKrish Sadhukhan 	 */
2493665f5677SKrish Sadhukhan 	vmcb->save.rip += 3;
2494665f5677SKrish Sadhukhan 	report (__svm_vmrun(vmcb->save.rip) == SVM_EXIT_VMMCALL &&
2495665f5677SKrish Sadhukhan 		vmcb->save.rip == (u64)&guest_end, "Test EFLAGS.TF on VMRUN: guest execution completion");
2496665f5677SKrish Sadhukhan }
2497665f5677SKrish Sadhukhan 
24987a57ef5dSMaxim Levitsky static bool volatile svm_errata_reproduced = false;
24997a57ef5dSMaxim Levitsky static unsigned long volatile physical = 0;
25007a57ef5dSMaxim Levitsky 
25017a57ef5dSMaxim Levitsky 
25027a57ef5dSMaxim Levitsky /*
25037a57ef5dSMaxim Levitsky  *
25047a57ef5dSMaxim Levitsky  * Test the following errata:
25057a57ef5dSMaxim Levitsky  * If the VMRUN/VMSAVE/VMLOAD are attempted by the nested guest,
25067a57ef5dSMaxim Levitsky  * the CPU would first check the EAX against host reserved memory
25077a57ef5dSMaxim Levitsky  * regions (so far only SMM_ADDR/SMM_MASK are known to cause it),
25087a57ef5dSMaxim Levitsky  * and only then signal #VMexit
25097a57ef5dSMaxim Levitsky  *
25107a57ef5dSMaxim Levitsky  * Try to reproduce this by trying vmsave on each possible 4K aligned memory
25117a57ef5dSMaxim Levitsky  * address in the low 4G where the SMM area has to reside.
25127a57ef5dSMaxim Levitsky  */
25137a57ef5dSMaxim Levitsky 
25147a57ef5dSMaxim Levitsky static void gp_isr(struct ex_regs *r)
25157a57ef5dSMaxim Levitsky {
25167a57ef5dSMaxim Levitsky     svm_errata_reproduced = true;
25177a57ef5dSMaxim Levitsky     /* skip over the vmsave instruction*/
25187a57ef5dSMaxim Levitsky     r->rip += 3;
25197a57ef5dSMaxim Levitsky }
25207a57ef5dSMaxim Levitsky 
25217a57ef5dSMaxim Levitsky static void svm_vmrun_errata_test(void)
25227a57ef5dSMaxim Levitsky {
25237a57ef5dSMaxim Levitsky     unsigned long *last_page = NULL;
25247a57ef5dSMaxim Levitsky 
25257a57ef5dSMaxim Levitsky     handle_exception(GP_VECTOR, gp_isr);
25267a57ef5dSMaxim Levitsky 
25277a57ef5dSMaxim Levitsky     while (!svm_errata_reproduced) {
25287a57ef5dSMaxim Levitsky 
25297a57ef5dSMaxim Levitsky         unsigned long *page = alloc_pages(1);
25307a57ef5dSMaxim Levitsky 
25317a57ef5dSMaxim Levitsky         if (!page) {
25325c3582f0SJanis Schoetterl-Glausch             report_pass("All guest memory tested, no bug found");
25337a57ef5dSMaxim Levitsky             break;
25347a57ef5dSMaxim Levitsky         }
25357a57ef5dSMaxim Levitsky 
25367a57ef5dSMaxim Levitsky         physical = virt_to_phys(page);
25377a57ef5dSMaxim Levitsky 
25387a57ef5dSMaxim Levitsky         asm volatile (
25397a57ef5dSMaxim Levitsky             "mov %[_physical], %%rax\n\t"
25407a57ef5dSMaxim Levitsky             "vmsave %%rax\n\t"
25417a57ef5dSMaxim Levitsky 
25427a57ef5dSMaxim Levitsky             : [_physical] "=m" (physical)
25437a57ef5dSMaxim Levitsky             : /* no inputs*/
25447a57ef5dSMaxim Levitsky             : "rax" /*clobbers*/
25457a57ef5dSMaxim Levitsky         );
25467a57ef5dSMaxim Levitsky 
25477a57ef5dSMaxim Levitsky         if (svm_errata_reproduced) {
2548198dfd0eSJanis Schoetterl-Glausch             report_fail("Got #GP exception - svm errata reproduced at 0x%lx",
25497a57ef5dSMaxim Levitsky                         physical);
25507a57ef5dSMaxim Levitsky             break;
25517a57ef5dSMaxim Levitsky         }
25527a57ef5dSMaxim Levitsky 
25537a57ef5dSMaxim Levitsky         *page = (unsigned long)last_page;
25547a57ef5dSMaxim Levitsky         last_page = page;
25557a57ef5dSMaxim Levitsky     }
25567a57ef5dSMaxim Levitsky 
25577a57ef5dSMaxim Levitsky     while (last_page) {
25587a57ef5dSMaxim Levitsky         unsigned long *page = last_page;
25597a57ef5dSMaxim Levitsky         last_page = (unsigned long *)*last_page;
25607a57ef5dSMaxim Levitsky         free_pages_by_order(page, 1);
25617a57ef5dSMaxim Levitsky     }
25627a57ef5dSMaxim Levitsky }
25637a57ef5dSMaxim Levitsky 
25640b6f6cedSKrish Sadhukhan static void vmload_vmsave_guest_main(struct svm_test *test)
25650b6f6cedSKrish Sadhukhan {
25660b6f6cedSKrish Sadhukhan 	u64 vmcb_phys = virt_to_phys(vmcb);
25670b6f6cedSKrish Sadhukhan 
25680b6f6cedSKrish Sadhukhan 	asm volatile ("vmload %0" : : "a"(vmcb_phys));
25690b6f6cedSKrish Sadhukhan 	asm volatile ("vmsave %0" : : "a"(vmcb_phys));
25700b6f6cedSKrish Sadhukhan }
25710b6f6cedSKrish Sadhukhan 
25720b6f6cedSKrish Sadhukhan static void svm_vmload_vmsave(void)
25730b6f6cedSKrish Sadhukhan {
25740b6f6cedSKrish Sadhukhan 	u32 intercept_saved = vmcb->control.intercept;
25750b6f6cedSKrish Sadhukhan 
25760b6f6cedSKrish Sadhukhan 	test_set_guest(vmload_vmsave_guest_main);
25770b6f6cedSKrish Sadhukhan 
25780b6f6cedSKrish Sadhukhan 	/*
25790b6f6cedSKrish Sadhukhan 	 * Disabling intercept for VMLOAD and VMSAVE doesn't cause
25800b6f6cedSKrish Sadhukhan 	 * respective #VMEXIT to host
25810b6f6cedSKrish Sadhukhan 	 */
25820b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD);
25830b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE);
25840b6f6cedSKrish Sadhukhan 	svm_vmrun();
25850b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test "
25860b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT");
25870b6f6cedSKrish Sadhukhan 
25880b6f6cedSKrish Sadhukhan 	/*
25890b6f6cedSKrish Sadhukhan 	 * Enabling intercept for VMLOAD and VMSAVE causes respective
25900b6f6cedSKrish Sadhukhan 	 * #VMEXIT to host
25910b6f6cedSKrish Sadhukhan 	 */
25920b6f6cedSKrish Sadhukhan 	vmcb->control.intercept |= (1ULL << INTERCEPT_VMLOAD);
25930b6f6cedSKrish Sadhukhan 	svm_vmrun();
25940b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMLOAD, "Test "
25950b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMLOAD #VMEXIT");
25960b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD);
25970b6f6cedSKrish Sadhukhan 	vmcb->control.intercept |= (1ULL << INTERCEPT_VMSAVE);
25980b6f6cedSKrish Sadhukhan 	svm_vmrun();
25990b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMSAVE, "Test "
26000b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMSAVE #VMEXIT");
26010b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE);
26020b6f6cedSKrish Sadhukhan 	svm_vmrun();
26030b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test "
26040b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT");
26050b6f6cedSKrish Sadhukhan 
26060b6f6cedSKrish Sadhukhan 	vmcb->control.intercept |= (1ULL << INTERCEPT_VMLOAD);
26070b6f6cedSKrish Sadhukhan 	svm_vmrun();
26080b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMLOAD, "Test "
26090b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMLOAD #VMEXIT");
26100b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMLOAD);
26110b6f6cedSKrish Sadhukhan 	svm_vmrun();
26120b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test "
26130b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT");
26140b6f6cedSKrish Sadhukhan 
26150b6f6cedSKrish Sadhukhan 	vmcb->control.intercept |= (1ULL << INTERCEPT_VMSAVE);
26160b6f6cedSKrish Sadhukhan 	svm_vmrun();
26170b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMSAVE, "Test "
26180b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMSAVE #VMEXIT");
26190b6f6cedSKrish Sadhukhan 	vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMSAVE);
26200b6f6cedSKrish Sadhukhan 	svm_vmrun();
26210b6f6cedSKrish Sadhukhan 	report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "Test "
26220b6f6cedSKrish Sadhukhan 	    "VMLOAD/VMSAVE intercept: Expected VMMCALL #VMEXIT");
26230b6f6cedSKrish Sadhukhan 
26240b6f6cedSKrish Sadhukhan 	vmcb->control.intercept = intercept_saved;
26250b6f6cedSKrish Sadhukhan }
26260b6f6cedSKrish Sadhukhan 
2627f6972bd6SLara Lazier static void prepare_vgif_enabled(struct svm_test *test)
2628f6972bd6SLara Lazier {
2629f6972bd6SLara Lazier     default_prepare(test);
2630f6972bd6SLara Lazier }
2631f6972bd6SLara Lazier 
2632f6972bd6SLara Lazier static void test_vgif(struct svm_test *test)
2633f6972bd6SLara Lazier {
2634f6972bd6SLara Lazier     asm volatile ("vmmcall\n\tstgi\n\tvmmcall\n\tclgi\n\tvmmcall\n\t");
2635f6972bd6SLara Lazier 
2636f6972bd6SLara Lazier }
2637f6972bd6SLara Lazier 
2638f6972bd6SLara Lazier static bool vgif_finished(struct svm_test *test)
2639f6972bd6SLara Lazier {
2640f6972bd6SLara Lazier     switch (get_test_stage(test))
2641f6972bd6SLara Lazier     {
2642f6972bd6SLara Lazier     case 0:
2643f6972bd6SLara Lazier         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
2644198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to vmmcall.");
2645f6972bd6SLara Lazier             return true;
2646f6972bd6SLara Lazier         }
2647f6972bd6SLara Lazier         vmcb->control.int_ctl |= V_GIF_ENABLED_MASK;
2648f6972bd6SLara Lazier         vmcb->save.rip += 3;
2649f6972bd6SLara Lazier         inc_test_stage(test);
2650f6972bd6SLara Lazier         break;
2651f6972bd6SLara Lazier     case 1:
2652f6972bd6SLara Lazier         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
2653198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to vmmcall.");
2654f6972bd6SLara Lazier             return true;
2655f6972bd6SLara Lazier         }
2656f6972bd6SLara Lazier         if (!(vmcb->control.int_ctl & V_GIF_MASK)) {
2657198dfd0eSJanis Schoetterl-Glausch             report_fail("Failed to set VGIF when executing STGI.");
2658f6972bd6SLara Lazier             vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK;
2659f6972bd6SLara Lazier             return true;
2660f6972bd6SLara Lazier         }
26615c3582f0SJanis Schoetterl-Glausch         report_pass("STGI set VGIF bit.");
2662f6972bd6SLara Lazier         vmcb->save.rip += 3;
2663f6972bd6SLara Lazier         inc_test_stage(test);
2664f6972bd6SLara Lazier         break;
2665f6972bd6SLara Lazier     case 2:
2666f6972bd6SLara Lazier         if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
2667198dfd0eSJanis Schoetterl-Glausch             report_fail("VMEXIT not due to vmmcall.");
2668f6972bd6SLara Lazier             return true;
2669f6972bd6SLara Lazier         }
2670f6972bd6SLara Lazier         if (vmcb->control.int_ctl & V_GIF_MASK) {
2671198dfd0eSJanis Schoetterl-Glausch             report_fail("Failed to clear VGIF when executing CLGI.");
2672f6972bd6SLara Lazier             vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK;
2673f6972bd6SLara Lazier             return true;
2674f6972bd6SLara Lazier         }
26755c3582f0SJanis Schoetterl-Glausch         report_pass("CLGI cleared VGIF bit.");
2676f6972bd6SLara Lazier         vmcb->save.rip += 3;
2677f6972bd6SLara Lazier         inc_test_stage(test);
2678f6972bd6SLara Lazier         vmcb->control.int_ctl &= ~V_GIF_ENABLED_MASK;
2679f6972bd6SLara Lazier         break;
2680f6972bd6SLara Lazier     default:
2681f6972bd6SLara Lazier         return true;
2682f6972bd6SLara Lazier         break;
2683f6972bd6SLara Lazier     }
2684f6972bd6SLara Lazier 
2685f6972bd6SLara Lazier     return get_test_stage(test) == 3;
2686f6972bd6SLara Lazier }
2687f6972bd6SLara Lazier 
2688f6972bd6SLara Lazier static bool vgif_check(struct svm_test *test)
2689f6972bd6SLara Lazier {
2690f6972bd6SLara Lazier     return get_test_stage(test) == 3;
2691f6972bd6SLara Lazier }
2692f6972bd6SLara Lazier 
26938650dffeSMaxim Levitsky 
26948650dffeSMaxim Levitsky static int pause_test_counter;
26958650dffeSMaxim Levitsky static int wait_counter;
26968650dffeSMaxim Levitsky 
26978650dffeSMaxim Levitsky static void pause_filter_test_guest_main(struct svm_test *test)
26988650dffeSMaxim Levitsky {
26998650dffeSMaxim Levitsky     int i;
27008650dffeSMaxim Levitsky     for (i = 0 ; i < pause_test_counter ; i++)
27018650dffeSMaxim Levitsky         pause();
27028650dffeSMaxim Levitsky 
27038650dffeSMaxim Levitsky     if (!wait_counter)
27048650dffeSMaxim Levitsky         return;
27058650dffeSMaxim Levitsky 
27068650dffeSMaxim Levitsky     for (i = 0; i < wait_counter; i++)
27078650dffeSMaxim Levitsky         ;
27088650dffeSMaxim Levitsky 
27098650dffeSMaxim Levitsky     for (i = 0 ; i < pause_test_counter ; i++)
27108650dffeSMaxim Levitsky         pause();
27118650dffeSMaxim Levitsky 
27128650dffeSMaxim Levitsky }
27138650dffeSMaxim Levitsky 
27148650dffeSMaxim Levitsky static void pause_filter_run_test(int pause_iterations, int filter_value, int wait_iterations, int threshold)
27158650dffeSMaxim Levitsky {
27168650dffeSMaxim Levitsky     test_set_guest(pause_filter_test_guest_main);
27178650dffeSMaxim Levitsky 
27188650dffeSMaxim Levitsky     pause_test_counter = pause_iterations;
27198650dffeSMaxim Levitsky     wait_counter = wait_iterations;
27208650dffeSMaxim Levitsky 
27218650dffeSMaxim Levitsky     vmcb->control.pause_filter_count = filter_value;
27228650dffeSMaxim Levitsky     vmcb->control.pause_filter_thresh = threshold;
27238650dffeSMaxim Levitsky     svm_vmrun();
27248650dffeSMaxim Levitsky 
27258650dffeSMaxim Levitsky     if (filter_value <= pause_iterations || wait_iterations < threshold)
27268650dffeSMaxim Levitsky         report(vmcb->control.exit_code == SVM_EXIT_PAUSE, "expected PAUSE vmexit");
27278650dffeSMaxim Levitsky     else
27288650dffeSMaxim Levitsky         report(vmcb->control.exit_code == SVM_EXIT_VMMCALL, "no expected PAUSE vmexit");
27298650dffeSMaxim Levitsky }
27308650dffeSMaxim Levitsky 
27318650dffeSMaxim Levitsky static void pause_filter_test(void)
27328650dffeSMaxim Levitsky {
27338650dffeSMaxim Levitsky     if (!pause_filter_supported()) {
27348650dffeSMaxim Levitsky             report_skip("PAUSE filter not supported in the guest");
27358650dffeSMaxim Levitsky             return;
27368650dffeSMaxim Levitsky     }
27378650dffeSMaxim Levitsky 
27388650dffeSMaxim Levitsky     vmcb->control.intercept |= (1 << INTERCEPT_PAUSE);
27398650dffeSMaxim Levitsky 
27408650dffeSMaxim Levitsky     // filter count more that pause count - no VMexit
27418650dffeSMaxim Levitsky     pause_filter_run_test(10, 9, 0, 0);
27428650dffeSMaxim Levitsky 
27438650dffeSMaxim Levitsky     // filter count smaller pause count - no VMexit
27448650dffeSMaxim Levitsky     pause_filter_run_test(20, 21, 0, 0);
27458650dffeSMaxim Levitsky 
27468650dffeSMaxim Levitsky 
27478650dffeSMaxim Levitsky     if (pause_threshold_supported()) {
27488650dffeSMaxim Levitsky         // filter count smaller pause count - no VMexit +  large enough threshold
27498650dffeSMaxim Levitsky         // so that filter counter resets
27508650dffeSMaxim Levitsky         pause_filter_run_test(20, 21, 1000, 10);
27518650dffeSMaxim Levitsky 
27528650dffeSMaxim Levitsky         // filter count smaller pause count - no VMexit +  small threshold
27538650dffeSMaxim Levitsky         // so that filter doesn't reset
27548650dffeSMaxim Levitsky         pause_filter_run_test(20, 21, 10, 1000);
27558650dffeSMaxim Levitsky     } else {
27568650dffeSMaxim Levitsky         report_skip("PAUSE threshold not supported in the guest");
27578650dffeSMaxim Levitsky         return;
27588650dffeSMaxim Levitsky     }
27598650dffeSMaxim Levitsky }
27608650dffeSMaxim Levitsky 
27618650dffeSMaxim Levitsky 
2762af13008dSManali Shukla static int of_test_counter;
2763af13008dSManali Shukla 
2764af13008dSManali Shukla static void guest_test_of_handler(struct ex_regs *r)
2765af13008dSManali Shukla {
2766af13008dSManali Shukla     of_test_counter++;
2767af13008dSManali Shukla }
2768af13008dSManali Shukla 
2769af13008dSManali Shukla static void svm_of_test_guest(struct svm_test *test)
2770af13008dSManali Shukla {
2771af13008dSManali Shukla     struct far_pointer32 fp = {
2772af13008dSManali Shukla         .offset = (uintptr_t)&&into,
2773af13008dSManali Shukla         .selector = KERNEL_CS32,
2774af13008dSManali Shukla     };
2775af13008dSManali Shukla     uintptr_t rsp;
2776af13008dSManali Shukla 
2777af13008dSManali Shukla     asm volatile ("mov %%rsp, %0" : "=r"(rsp));
2778af13008dSManali Shukla 
2779af13008dSManali Shukla     if (fp.offset != (uintptr_t)&&into) {
2780af13008dSManali Shukla         printf("Codee address too high.\n");
2781af13008dSManali Shukla         return;
2782af13008dSManali Shukla     }
2783af13008dSManali Shukla 
2784af13008dSManali Shukla     if ((u32)rsp != rsp) {
2785af13008dSManali Shukla         printf("Stack address too high.\n");
2786af13008dSManali Shukla     }
2787af13008dSManali Shukla 
2788af13008dSManali Shukla     asm goto("lcall *%0" : : "m" (fp) : "rax" : into);
2789af13008dSManali Shukla     return;
2790af13008dSManali Shukla into:
2791af13008dSManali Shukla 
2792af13008dSManali Shukla     asm volatile (".code32;"
2793af13008dSManali Shukla             "movl $0x7fffffff, %eax;"
2794af13008dSManali Shukla             "addl %eax, %eax;"
2795af13008dSManali Shukla             "into;"
2796af13008dSManali Shukla             "lret;"
2797af13008dSManali Shukla             ".code64");
2798af13008dSManali Shukla     __builtin_unreachable();
2799af13008dSManali Shukla }
2800af13008dSManali Shukla 
2801af13008dSManali Shukla static void svm_into_test(void)
2802af13008dSManali Shukla {
2803af13008dSManali Shukla     handle_exception(OF_VECTOR, guest_test_of_handler);
2804af13008dSManali Shukla     test_set_guest(svm_of_test_guest);
2805af13008dSManali Shukla     report(svm_vmrun() == SVM_EXIT_VMMCALL && of_test_counter == 1,
2806af13008dSManali Shukla         "#OF is generated in L2 exception handler0");
2807af13008dSManali Shukla }
2808af13008dSManali Shukla 
2809c8e16d20SManali Shukla static int bp_test_counter;
2810c8e16d20SManali Shukla 
2811c8e16d20SManali Shukla static void guest_test_bp_handler(struct ex_regs *r)
2812c8e16d20SManali Shukla {
2813c8e16d20SManali Shukla     bp_test_counter++;
2814c8e16d20SManali Shukla }
2815c8e16d20SManali Shukla 
2816c8e16d20SManali Shukla static void svm_bp_test_guest(struct svm_test *test)
2817c8e16d20SManali Shukla {
2818c8e16d20SManali Shukla     asm volatile("int3");
2819c8e16d20SManali Shukla }
2820c8e16d20SManali Shukla 
2821c8e16d20SManali Shukla static void svm_int3_test(void)
2822c8e16d20SManali Shukla {
2823c8e16d20SManali Shukla     handle_exception(BP_VECTOR, guest_test_bp_handler);
2824c8e16d20SManali Shukla     test_set_guest(svm_bp_test_guest);
2825c8e16d20SManali Shukla     report(svm_vmrun() == SVM_EXIT_VMMCALL && bp_test_counter == 1,
2826c8e16d20SManali Shukla         "#BP is handled in L2 exception handler");
2827c8e16d20SManali Shukla }
2828c8e16d20SManali Shukla 
28295c92f156SManali Shukla static int nm_test_counter;
28305c92f156SManali Shukla 
28315c92f156SManali Shukla static void guest_test_nm_handler(struct ex_regs *r)
28325c92f156SManali Shukla {
28335c92f156SManali Shukla     nm_test_counter++;
28345c92f156SManali Shukla     write_cr0(read_cr0() & ~X86_CR0_TS);
28355c92f156SManali Shukla     write_cr0(read_cr0() & ~X86_CR0_EM);
28365c92f156SManali Shukla }
28375c92f156SManali Shukla 
28385c92f156SManali Shukla static void svm_nm_test_guest(struct svm_test *test)
28395c92f156SManali Shukla {
28405c92f156SManali Shukla     asm volatile("fnop");
28415c92f156SManali Shukla }
28425c92f156SManali Shukla 
28435c92f156SManali Shukla /* This test checks that:
28445c92f156SManali Shukla  *
28455c92f156SManali Shukla  * (a) If CR0.TS is set in L2, #NM is handled by L2 when
28465c92f156SManali Shukla  *     just an L2 handler is registered.
28475c92f156SManali Shukla  *
28485c92f156SManali Shukla  * (b) If CR0.TS is cleared and CR0.EM is set, #NM is handled
28495c92f156SManali Shukla  *     by L2 when just an l2 handler is registered.
28505c92f156SManali Shukla  *
28515c92f156SManali Shukla  * (c) If CR0.TS and CR0.EM are cleared in L2, no exception
28525c92f156SManali Shukla  *     is generated.
28535c92f156SManali Shukla  */
28545c92f156SManali Shukla 
28555c92f156SManali Shukla static void svm_nm_test(void)
28565c92f156SManali Shukla {
28575c92f156SManali Shukla     handle_exception(NM_VECTOR, guest_test_nm_handler);
28585c92f156SManali Shukla     write_cr0(read_cr0() & ~X86_CR0_TS);
28595c92f156SManali Shukla     test_set_guest(svm_nm_test_guest);
28605c92f156SManali Shukla 
28615c92f156SManali Shukla     vmcb->save.cr0 = vmcb->save.cr0 | X86_CR0_TS;
28625c92f156SManali Shukla     report(svm_vmrun() == SVM_EXIT_VMMCALL && nm_test_counter == 1,
28635c92f156SManali Shukla         "fnop with CR0.TS set in L2, #NM is triggered");
28645c92f156SManali Shukla 
28655c92f156SManali Shukla     vmcb->save.cr0 = (vmcb->save.cr0 & ~X86_CR0_TS) | X86_CR0_EM;
28665c92f156SManali Shukla     report(svm_vmrun() == SVM_EXIT_VMMCALL && nm_test_counter == 2,
28675c92f156SManali Shukla         "fnop with CR0.EM set in L2, #NM is triggered");
28685c92f156SManali Shukla 
28695c92f156SManali Shukla     vmcb->save.cr0 = vmcb->save.cr0 & ~(X86_CR0_TS | X86_CR0_EM);
28705c92f156SManali Shukla     report(svm_vmrun() == SVM_EXIT_VMMCALL && nm_test_counter == 2,
2871912c0d72SThomas Huth         "fnop with CR0.TS and CR0.EM unset no #NM exception");
28725c92f156SManali Shukla }
2873f6972bd6SLara Lazier 
2874537d39dfSMaxim Levitsky 
2875537d39dfSMaxim Levitsky static bool check_lbr(u64 *from_excepted, u64 *to_expected)
2876537d39dfSMaxim Levitsky {
2877537d39dfSMaxim Levitsky 	u64 from = rdmsr(MSR_IA32_LASTBRANCHFROMIP);
2878537d39dfSMaxim Levitsky 	u64 to = rdmsr(MSR_IA32_LASTBRANCHTOIP);
2879537d39dfSMaxim Levitsky 
2880537d39dfSMaxim Levitsky 	if ((u64)from_excepted != from) {
2881537d39dfSMaxim Levitsky 		report(false, "MSR_IA32_LASTBRANCHFROMIP, expected=0x%lx, actual=0x%lx",
2882537d39dfSMaxim Levitsky 			(u64)from_excepted, from);
2883537d39dfSMaxim Levitsky 		return false;
2884537d39dfSMaxim Levitsky 	}
2885537d39dfSMaxim Levitsky 
2886537d39dfSMaxim Levitsky 	if ((u64)to_expected != to) {
2887537d39dfSMaxim Levitsky 		report(false, "MSR_IA32_LASTBRANCHFROMIP, expected=0x%lx, actual=0x%lx",
2888537d39dfSMaxim Levitsky 			(u64)from_excepted, from);
2889537d39dfSMaxim Levitsky 		return false;
2890537d39dfSMaxim Levitsky 	}
2891537d39dfSMaxim Levitsky 
2892537d39dfSMaxim Levitsky 	return true;
2893537d39dfSMaxim Levitsky }
2894537d39dfSMaxim Levitsky 
2895537d39dfSMaxim Levitsky static bool check_dbgctl(u64 dbgctl, u64 dbgctl_expected)
2896537d39dfSMaxim Levitsky {
2897537d39dfSMaxim Levitsky 	if (dbgctl != dbgctl_expected) {
2898537d39dfSMaxim Levitsky 		report(false, "Unexpected MSR_IA32_DEBUGCTLMSR value 0x%lx", dbgctl);
2899537d39dfSMaxim Levitsky 		return false;
2900537d39dfSMaxim Levitsky 	}
2901537d39dfSMaxim Levitsky 	return true;
2902537d39dfSMaxim Levitsky }
2903537d39dfSMaxim Levitsky 
2904537d39dfSMaxim Levitsky 
2905537d39dfSMaxim Levitsky #define DO_BRANCH(branch_name) \
2906537d39dfSMaxim Levitsky 	asm volatile ( \
2907537d39dfSMaxim Levitsky 		# branch_name "_from:" \
2908537d39dfSMaxim Levitsky 		"jmp " # branch_name  "_to\n" \
2909537d39dfSMaxim Levitsky 		"nop\n" \
2910537d39dfSMaxim Levitsky 		"nop\n" \
2911537d39dfSMaxim Levitsky 		# branch_name  "_to:" \
2912537d39dfSMaxim Levitsky 		"nop\n" \
2913537d39dfSMaxim Levitsky 	)
2914537d39dfSMaxim Levitsky 
2915537d39dfSMaxim Levitsky 
2916537d39dfSMaxim Levitsky extern u64 guest_branch0_from, guest_branch0_to;
2917537d39dfSMaxim Levitsky extern u64 guest_branch2_from, guest_branch2_to;
2918537d39dfSMaxim Levitsky 
2919537d39dfSMaxim Levitsky extern u64 host_branch0_from, host_branch0_to;
2920537d39dfSMaxim Levitsky extern u64 host_branch2_from, host_branch2_to;
2921537d39dfSMaxim Levitsky extern u64 host_branch3_from, host_branch3_to;
2922537d39dfSMaxim Levitsky extern u64 host_branch4_from, host_branch4_to;
2923537d39dfSMaxim Levitsky 
2924537d39dfSMaxim Levitsky u64 dbgctl;
2925537d39dfSMaxim Levitsky 
2926537d39dfSMaxim Levitsky static void svm_lbrv_test_guest1(void)
2927537d39dfSMaxim Levitsky {
2928537d39dfSMaxim Levitsky 	/*
2929537d39dfSMaxim Levitsky 	 * This guest expects the LBR to be already enabled when it starts,
2930537d39dfSMaxim Levitsky 	 * it does a branch, and then disables the LBR and then checks.
2931537d39dfSMaxim Levitsky 	 */
2932537d39dfSMaxim Levitsky 
2933537d39dfSMaxim Levitsky 	DO_BRANCH(guest_branch0);
2934537d39dfSMaxim Levitsky 
2935537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
2936537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, 0);
2937537d39dfSMaxim Levitsky 
2938537d39dfSMaxim Levitsky 	if (dbgctl != DEBUGCTLMSR_LBR)
2939537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2940537d39dfSMaxim Levitsky 	if (rdmsr(MSR_IA32_DEBUGCTLMSR) != 0)
2941537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2942537d39dfSMaxim Levitsky 	if (rdmsr(MSR_IA32_LASTBRANCHFROMIP) != (u64)&guest_branch0_from)
2943537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2944537d39dfSMaxim Levitsky 	if (rdmsr(MSR_IA32_LASTBRANCHTOIP) != (u64)&guest_branch0_to)
2945537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2946537d39dfSMaxim Levitsky 
2947537d39dfSMaxim Levitsky 	asm volatile ("vmmcall\n");
2948537d39dfSMaxim Levitsky }
2949537d39dfSMaxim Levitsky 
2950537d39dfSMaxim Levitsky static void svm_lbrv_test_guest2(void)
2951537d39dfSMaxim Levitsky {
2952537d39dfSMaxim Levitsky 	/*
2953537d39dfSMaxim Levitsky 	 * This guest expects the LBR to be disabled when it starts,
2954537d39dfSMaxim Levitsky 	 * enables it, does a branch, disables it and then checks.
2955537d39dfSMaxim Levitsky 	 */
2956537d39dfSMaxim Levitsky 
2957537d39dfSMaxim Levitsky 	DO_BRANCH(guest_branch1);
2958537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
2959537d39dfSMaxim Levitsky 
2960537d39dfSMaxim Levitsky 	if (dbgctl != 0)
2961537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2962537d39dfSMaxim Levitsky 
2963537d39dfSMaxim Levitsky 	if (rdmsr(MSR_IA32_LASTBRANCHFROMIP) != (u64)&host_branch2_from)
2964537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2965537d39dfSMaxim Levitsky 	if (rdmsr(MSR_IA32_LASTBRANCHTOIP) != (u64)&host_branch2_to)
2966537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2967537d39dfSMaxim Levitsky 
2968537d39dfSMaxim Levitsky 
2969537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR);
2970537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
2971537d39dfSMaxim Levitsky 	DO_BRANCH(guest_branch2);
2972537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, 0);
2973537d39dfSMaxim Levitsky 
2974537d39dfSMaxim Levitsky 	if (dbgctl != DEBUGCTLMSR_LBR)
2975537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2976537d39dfSMaxim Levitsky 	if (rdmsr(MSR_IA32_LASTBRANCHFROMIP) != (u64)&guest_branch2_from)
2977537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2978537d39dfSMaxim Levitsky 	if (rdmsr(MSR_IA32_LASTBRANCHTOIP) != (u64)&guest_branch2_to)
2979537d39dfSMaxim Levitsky 		asm volatile("ud2\n");
2980537d39dfSMaxim Levitsky 
2981537d39dfSMaxim Levitsky 	asm volatile ("vmmcall\n");
2982537d39dfSMaxim Levitsky }
2983537d39dfSMaxim Levitsky 
2984537d39dfSMaxim Levitsky static void svm_lbrv_test0(void)
2985537d39dfSMaxim Levitsky {
2986537d39dfSMaxim Levitsky 	report(true, "Basic LBR test");
2987537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR);
2988537d39dfSMaxim Levitsky 	DO_BRANCH(host_branch0);
2989537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
2990537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, 0);
2991537d39dfSMaxim Levitsky 
2992537d39dfSMaxim Levitsky 	check_dbgctl(dbgctl, DEBUGCTLMSR_LBR);
2993537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
2994537d39dfSMaxim Levitsky 	check_dbgctl(dbgctl, 0);
2995537d39dfSMaxim Levitsky 
2996537d39dfSMaxim Levitsky 	check_lbr(&host_branch0_from, &host_branch0_to);
2997537d39dfSMaxim Levitsky }
2998537d39dfSMaxim Levitsky 
2999537d39dfSMaxim Levitsky static void svm_lbrv_test1(void)
3000537d39dfSMaxim Levitsky {
3001537d39dfSMaxim Levitsky 	report(true, "Test that without LBRV enabled, guest LBR state does 'leak' to the host(1)");
3002537d39dfSMaxim Levitsky 
3003537d39dfSMaxim Levitsky 	vmcb->save.rip = (ulong)svm_lbrv_test_guest1;
3004537d39dfSMaxim Levitsky 	vmcb->control.virt_ext = 0;
3005537d39dfSMaxim Levitsky 
3006537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR);
3007537d39dfSMaxim Levitsky 	DO_BRANCH(host_branch1);
3008537d39dfSMaxim Levitsky 	SVM_BARE_VMRUN;
3009537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
3010537d39dfSMaxim Levitsky 
3011537d39dfSMaxim Levitsky 	if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
3012537d39dfSMaxim Levitsky 		report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
3013537d39dfSMaxim Levitsky 		vmcb->control.exit_code);
3014537d39dfSMaxim Levitsky 		return;
3015537d39dfSMaxim Levitsky 	}
3016537d39dfSMaxim Levitsky 
3017537d39dfSMaxim Levitsky 	check_dbgctl(dbgctl, 0);
3018537d39dfSMaxim Levitsky 	check_lbr(&guest_branch0_from, &guest_branch0_to);
3019537d39dfSMaxim Levitsky }
3020537d39dfSMaxim Levitsky 
3021537d39dfSMaxim Levitsky static void svm_lbrv_test2(void)
3022537d39dfSMaxim Levitsky {
3023537d39dfSMaxim Levitsky 	report(true, "Test that without LBRV enabled, guest LBR state does 'leak' to the host(2)");
3024537d39dfSMaxim Levitsky 
3025537d39dfSMaxim Levitsky 	vmcb->save.rip = (ulong)svm_lbrv_test_guest2;
3026537d39dfSMaxim Levitsky 	vmcb->control.virt_ext = 0;
3027537d39dfSMaxim Levitsky 
3028537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR);
3029537d39dfSMaxim Levitsky 	DO_BRANCH(host_branch2);
3030537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, 0);
3031537d39dfSMaxim Levitsky 	SVM_BARE_VMRUN;
3032537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
3033537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, 0);
3034537d39dfSMaxim Levitsky 
3035537d39dfSMaxim Levitsky 	if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
3036537d39dfSMaxim Levitsky 		report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
3037537d39dfSMaxim Levitsky 		vmcb->control.exit_code);
3038537d39dfSMaxim Levitsky 		return;
3039537d39dfSMaxim Levitsky 	}
3040537d39dfSMaxim Levitsky 
3041537d39dfSMaxim Levitsky 	check_dbgctl(dbgctl, 0);
3042537d39dfSMaxim Levitsky 	check_lbr(&guest_branch2_from, &guest_branch2_to);
3043537d39dfSMaxim Levitsky }
3044537d39dfSMaxim Levitsky 
3045537d39dfSMaxim Levitsky static void svm_lbrv_nested_test1(void)
3046537d39dfSMaxim Levitsky {
3047537d39dfSMaxim Levitsky 	if (!lbrv_supported()) {
3048537d39dfSMaxim Levitsky 		report_skip("LBRV not supported in the guest");
3049537d39dfSMaxim Levitsky 		return;
3050537d39dfSMaxim Levitsky 	}
3051537d39dfSMaxim Levitsky 
3052537d39dfSMaxim Levitsky 	report(true, "Test that with LBRV enabled, guest LBR state doesn't leak (1)");
3053537d39dfSMaxim Levitsky 	vmcb->save.rip = (ulong)svm_lbrv_test_guest1;
3054537d39dfSMaxim Levitsky 	vmcb->control.virt_ext = LBR_CTL_ENABLE_MASK;
3055537d39dfSMaxim Levitsky 	vmcb->save.dbgctl = DEBUGCTLMSR_LBR;
3056537d39dfSMaxim Levitsky 
3057537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR);
3058537d39dfSMaxim Levitsky 	DO_BRANCH(host_branch3);
3059537d39dfSMaxim Levitsky 	SVM_BARE_VMRUN;
3060537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
3061537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, 0);
3062537d39dfSMaxim Levitsky 
3063537d39dfSMaxim Levitsky 	if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
3064537d39dfSMaxim Levitsky 		report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
3065537d39dfSMaxim Levitsky 		vmcb->control.exit_code);
3066537d39dfSMaxim Levitsky 		return;
3067537d39dfSMaxim Levitsky 	}
3068537d39dfSMaxim Levitsky 
3069537d39dfSMaxim Levitsky 	if (vmcb->save.dbgctl != 0) {
3070537d39dfSMaxim Levitsky 		report(false, "unexpected virtual guest MSR_IA32_DEBUGCTLMSR value 0x%lx", vmcb->save.dbgctl);
3071537d39dfSMaxim Levitsky 		return;
3072537d39dfSMaxim Levitsky 	}
3073537d39dfSMaxim Levitsky 
3074537d39dfSMaxim Levitsky 	check_dbgctl(dbgctl, DEBUGCTLMSR_LBR);
3075537d39dfSMaxim Levitsky 	check_lbr(&host_branch3_from, &host_branch3_to);
3076537d39dfSMaxim Levitsky }
3077537d39dfSMaxim Levitsky static void svm_lbrv_nested_test2(void)
3078537d39dfSMaxim Levitsky {
3079537d39dfSMaxim Levitsky 	if (!lbrv_supported()) {
3080537d39dfSMaxim Levitsky 		report_skip("LBRV not supported in the guest");
3081537d39dfSMaxim Levitsky 		return;
3082537d39dfSMaxim Levitsky 	}
3083537d39dfSMaxim Levitsky 
3084537d39dfSMaxim Levitsky 	report(true, "Test that with LBRV enabled, guest LBR state doesn't leak (2)");
3085537d39dfSMaxim Levitsky 	vmcb->save.rip = (ulong)svm_lbrv_test_guest2;
3086537d39dfSMaxim Levitsky 	vmcb->control.virt_ext = LBR_CTL_ENABLE_MASK;
3087537d39dfSMaxim Levitsky 
3088537d39dfSMaxim Levitsky 	vmcb->save.dbgctl = 0;
3089537d39dfSMaxim Levitsky 	vmcb->save.br_from = (u64)&host_branch2_from;
3090537d39dfSMaxim Levitsky 	vmcb->save.br_to = (u64)&host_branch2_to;
3091537d39dfSMaxim Levitsky 
3092537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR);
3093537d39dfSMaxim Levitsky 	DO_BRANCH(host_branch4);
3094537d39dfSMaxim Levitsky 	SVM_BARE_VMRUN;
3095537d39dfSMaxim Levitsky 	dbgctl = rdmsr(MSR_IA32_DEBUGCTLMSR);
3096537d39dfSMaxim Levitsky 	wrmsr(MSR_IA32_DEBUGCTLMSR, 0);
3097537d39dfSMaxim Levitsky 
3098537d39dfSMaxim Levitsky 	if (vmcb->control.exit_code != SVM_EXIT_VMMCALL) {
3099537d39dfSMaxim Levitsky 		report(false, "VMEXIT not due to vmmcall. Exit reason 0x%x",
3100537d39dfSMaxim Levitsky 		vmcb->control.exit_code);
3101537d39dfSMaxim Levitsky 		return;
3102537d39dfSMaxim Levitsky 	}
3103537d39dfSMaxim Levitsky 
3104537d39dfSMaxim Levitsky 	check_dbgctl(dbgctl, DEBUGCTLMSR_LBR);
3105537d39dfSMaxim Levitsky 	check_lbr(&host_branch4_from, &host_branch4_to);
3106537d39dfSMaxim Levitsky }
3107537d39dfSMaxim Levitsky 
3108c45bccfcSMaxim Levitsky 
3109c45bccfcSMaxim Levitsky // test that a nested guest which does enable INTR interception
3110c45bccfcSMaxim Levitsky // but doesn't enable virtual interrupt masking works
3111c45bccfcSMaxim Levitsky 
3112c45bccfcSMaxim Levitsky static volatile int dummy_isr_recevied;
3113c45bccfcSMaxim Levitsky static void dummy_isr(isr_regs_t *regs)
3114c45bccfcSMaxim Levitsky {
3115c45bccfcSMaxim Levitsky 	dummy_isr_recevied++;
3116c45bccfcSMaxim Levitsky 	eoi();
3117c45bccfcSMaxim Levitsky }
3118c45bccfcSMaxim Levitsky 
3119c45bccfcSMaxim Levitsky 
3120c45bccfcSMaxim Levitsky static volatile int nmi_recevied;
3121c45bccfcSMaxim Levitsky static void dummy_nmi_handler(struct ex_regs *regs)
3122c45bccfcSMaxim Levitsky {
3123c45bccfcSMaxim Levitsky 	nmi_recevied++;
3124c45bccfcSMaxim Levitsky }
3125c45bccfcSMaxim Levitsky 
3126c45bccfcSMaxim Levitsky 
3127c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_run_guest(volatile int *counter, int expected_vmexit)
3128c45bccfcSMaxim Levitsky {
3129c45bccfcSMaxim Levitsky 	if (counter)
3130c45bccfcSMaxim Levitsky 		*counter = 0;
3131c45bccfcSMaxim Levitsky 
3132c45bccfcSMaxim Levitsky 	sti();  // host IF value should not matter
3133c45bccfcSMaxim Levitsky 	clgi(); // vmrun will set back GI to 1
3134c45bccfcSMaxim Levitsky 
3135c45bccfcSMaxim Levitsky 	svm_vmrun();
3136c45bccfcSMaxim Levitsky 
3137c45bccfcSMaxim Levitsky 	if (counter)
3138c45bccfcSMaxim Levitsky 		report(!*counter, "No interrupt expected");
3139c45bccfcSMaxim Levitsky 
3140c45bccfcSMaxim Levitsky 	stgi();
3141c45bccfcSMaxim Levitsky 
3142c45bccfcSMaxim Levitsky 	if (counter)
3143c45bccfcSMaxim Levitsky 		report(*counter == 1, "Interrupt is expected");
3144c45bccfcSMaxim Levitsky 
3145c45bccfcSMaxim Levitsky 	report (vmcb->control.exit_code == expected_vmexit, "Test expected VM exit");
3146c45bccfcSMaxim Levitsky 	report(vmcb->save.rflags & X86_EFLAGS_IF, "Guest should have EFLAGS.IF set now");
3147c45bccfcSMaxim Levitsky 	cli();
3148c45bccfcSMaxim Levitsky }
3149c45bccfcSMaxim Levitsky 
3150c45bccfcSMaxim Levitsky 
3151c45bccfcSMaxim Levitsky // subtest: test that enabling EFLAGS.IF is enought to trigger an interrupt
3152c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_if_guest(struct svm_test *test)
3153c45bccfcSMaxim Levitsky {
3154c45bccfcSMaxim Levitsky 	asm volatile("nop;nop;nop;nop");
3155c45bccfcSMaxim Levitsky 	report(!dummy_isr_recevied, "No interrupt expected");
3156c45bccfcSMaxim Levitsky 	sti();
3157c45bccfcSMaxim Levitsky 	asm volatile("nop");
3158c45bccfcSMaxim Levitsky 	report(0, "must not reach here");
3159c45bccfcSMaxim Levitsky }
3160c45bccfcSMaxim Levitsky 
3161c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_if(void)
3162c45bccfcSMaxim Levitsky {
3163c45bccfcSMaxim Levitsky 	// make a physical interrupt to be pending
3164c45bccfcSMaxim Levitsky 	handle_irq(0x55, dummy_isr);
3165c45bccfcSMaxim Levitsky 
3166c45bccfcSMaxim Levitsky 	vmcb->control.intercept |= (1 << INTERCEPT_INTR);
3167c45bccfcSMaxim Levitsky 	vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
3168c45bccfcSMaxim Levitsky 	vmcb->save.rflags &= ~X86_EFLAGS_IF;
3169c45bccfcSMaxim Levitsky 
3170c45bccfcSMaxim Levitsky 	test_set_guest(svm_intr_intercept_mix_if_guest);
3171c45bccfcSMaxim Levitsky 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0);
3172c45bccfcSMaxim Levitsky 	svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR);
3173c45bccfcSMaxim Levitsky }
3174c45bccfcSMaxim Levitsky 
3175c45bccfcSMaxim Levitsky 
3176c45bccfcSMaxim Levitsky // subtest: test that a clever guest can trigger an interrupt by setting GIF
3177c45bccfcSMaxim Levitsky // if GIF is not intercepted
3178c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_gif_guest(struct svm_test *test)
3179c45bccfcSMaxim Levitsky {
3180c45bccfcSMaxim Levitsky 
3181c45bccfcSMaxim Levitsky 	asm volatile("nop;nop;nop;nop");
3182c45bccfcSMaxim Levitsky 	report(!dummy_isr_recevied, "No interrupt expected");
3183c45bccfcSMaxim Levitsky 
3184c45bccfcSMaxim Levitsky 	// clear GIF and enable IF
3185c45bccfcSMaxim Levitsky 	// that should still not cause VM exit
3186c45bccfcSMaxim Levitsky 	clgi();
3187c45bccfcSMaxim Levitsky 	sti();
3188c45bccfcSMaxim Levitsky 	asm volatile("nop");
3189c45bccfcSMaxim Levitsky 	report(!dummy_isr_recevied, "No interrupt expected");
3190c45bccfcSMaxim Levitsky 
3191c45bccfcSMaxim Levitsky 	stgi();
3192c45bccfcSMaxim Levitsky 	asm volatile("nop");
3193c45bccfcSMaxim Levitsky 	report(0, "must not reach here");
3194c45bccfcSMaxim Levitsky }
3195c45bccfcSMaxim Levitsky 
3196c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_gif(void)
3197c45bccfcSMaxim Levitsky {
3198c45bccfcSMaxim Levitsky 	handle_irq(0x55, dummy_isr);
3199c45bccfcSMaxim Levitsky 
3200c45bccfcSMaxim Levitsky 	vmcb->control.intercept |= (1 << INTERCEPT_INTR);
3201c45bccfcSMaxim Levitsky 	vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
3202c45bccfcSMaxim Levitsky 	vmcb->save.rflags &= ~X86_EFLAGS_IF;
3203c45bccfcSMaxim Levitsky 
3204c45bccfcSMaxim Levitsky 	test_set_guest(svm_intr_intercept_mix_gif_guest);
3205c45bccfcSMaxim Levitsky 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0);
3206c45bccfcSMaxim Levitsky 	svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR);
3207c45bccfcSMaxim Levitsky }
3208c45bccfcSMaxim Levitsky 
3209c45bccfcSMaxim Levitsky 
3210c45bccfcSMaxim Levitsky 
3211c45bccfcSMaxim Levitsky // subtest: test that a clever guest can trigger an interrupt by setting GIF
3212c45bccfcSMaxim Levitsky // if GIF is not intercepted and interrupt comes after guest
3213c45bccfcSMaxim Levitsky // started running
3214c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_gif_guest2(struct svm_test *test)
3215c45bccfcSMaxim Levitsky {
3216c45bccfcSMaxim Levitsky 	asm volatile("nop;nop;nop;nop");
3217c45bccfcSMaxim Levitsky 	report(!dummy_isr_recevied, "No interrupt expected");
3218c45bccfcSMaxim Levitsky 
3219c45bccfcSMaxim Levitsky 	clgi();
3220c45bccfcSMaxim Levitsky 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_FIXED | 0x55, 0);
3221c45bccfcSMaxim Levitsky 	report(!dummy_isr_recevied, "No interrupt expected");
3222c45bccfcSMaxim Levitsky 
3223c45bccfcSMaxim Levitsky 	stgi();
3224c45bccfcSMaxim Levitsky 	asm volatile("nop");
3225c45bccfcSMaxim Levitsky 	report(0, "must not reach here");
3226c45bccfcSMaxim Levitsky }
3227c45bccfcSMaxim Levitsky 
3228c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_gif2(void)
3229c45bccfcSMaxim Levitsky {
3230c45bccfcSMaxim Levitsky 	handle_irq(0x55, dummy_isr);
3231c45bccfcSMaxim Levitsky 
3232c45bccfcSMaxim Levitsky 	vmcb->control.intercept |= (1 << INTERCEPT_INTR);
3233c45bccfcSMaxim Levitsky 	vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
3234c45bccfcSMaxim Levitsky 	vmcb->save.rflags |= X86_EFLAGS_IF;
3235c45bccfcSMaxim Levitsky 
3236c45bccfcSMaxim Levitsky 	test_set_guest(svm_intr_intercept_mix_gif_guest2);
3237c45bccfcSMaxim Levitsky 	svm_intr_intercept_mix_run_guest(&dummy_isr_recevied, SVM_EXIT_INTR);
3238c45bccfcSMaxim Levitsky }
3239c45bccfcSMaxim Levitsky 
3240c45bccfcSMaxim Levitsky 
3241c45bccfcSMaxim Levitsky // subtest: test that pending NMI will be handled when guest enables GIF
3242c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_nmi_guest(struct svm_test *test)
3243c45bccfcSMaxim Levitsky {
3244c45bccfcSMaxim Levitsky 	asm volatile("nop;nop;nop;nop");
3245c45bccfcSMaxim Levitsky 	report(!nmi_recevied, "No NMI expected");
3246c45bccfcSMaxim Levitsky 	cli(); // should have no effect
3247c45bccfcSMaxim Levitsky 
3248c45bccfcSMaxim Levitsky 	clgi();
3249c45bccfcSMaxim Levitsky 	asm volatile("nop");
3250c45bccfcSMaxim Levitsky 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_NMI, 0);
3251c45bccfcSMaxim Levitsky 	sti(); // should have no effect
3252c45bccfcSMaxim Levitsky 	asm volatile("nop");
3253c45bccfcSMaxim Levitsky 	report(!nmi_recevied, "No NMI expected");
3254c45bccfcSMaxim Levitsky 
3255c45bccfcSMaxim Levitsky 	stgi();
3256c45bccfcSMaxim Levitsky 	asm volatile("nop");
3257c45bccfcSMaxim Levitsky 	report(0, "must not reach here");
3258c45bccfcSMaxim Levitsky }
3259c45bccfcSMaxim Levitsky 
3260c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_nmi(void)
3261c45bccfcSMaxim Levitsky {
3262c45bccfcSMaxim Levitsky 	handle_exception(2, dummy_nmi_handler);
3263c45bccfcSMaxim Levitsky 
3264c45bccfcSMaxim Levitsky 	vmcb->control.intercept |= (1 << INTERCEPT_NMI);
3265c45bccfcSMaxim Levitsky 	vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
3266c45bccfcSMaxim Levitsky 	vmcb->save.rflags |= X86_EFLAGS_IF;
3267c45bccfcSMaxim Levitsky 
3268c45bccfcSMaxim Levitsky 	test_set_guest(svm_intr_intercept_mix_nmi_guest);
3269c45bccfcSMaxim Levitsky 	svm_intr_intercept_mix_run_guest(&nmi_recevied, SVM_EXIT_NMI);
3270c45bccfcSMaxim Levitsky }
3271c45bccfcSMaxim Levitsky 
3272c45bccfcSMaxim Levitsky // test that pending SMI will be handled when guest enables GIF
3273c45bccfcSMaxim Levitsky // TODO: can't really count #SMIs so just test that guest doesn't hang
3274c45bccfcSMaxim Levitsky // and VMexits on SMI
3275c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_smi_guest(struct svm_test *test)
3276c45bccfcSMaxim Levitsky {
3277c45bccfcSMaxim Levitsky 	asm volatile("nop;nop;nop;nop");
3278c45bccfcSMaxim Levitsky 
3279c45bccfcSMaxim Levitsky 	clgi();
3280c45bccfcSMaxim Levitsky 	asm volatile("nop");
3281c45bccfcSMaxim Levitsky 	apic_icr_write(APIC_DEST_SELF | APIC_DEST_PHYSICAL | APIC_DM_SMI, 0);
3282c45bccfcSMaxim Levitsky 	sti(); // should have no effect
3283c45bccfcSMaxim Levitsky 	asm volatile("nop");
3284c45bccfcSMaxim Levitsky 	stgi();
3285c45bccfcSMaxim Levitsky 	asm volatile("nop");
3286c45bccfcSMaxim Levitsky 	report(0, "must not reach here");
3287c45bccfcSMaxim Levitsky }
3288c45bccfcSMaxim Levitsky 
3289c45bccfcSMaxim Levitsky static void svm_intr_intercept_mix_smi(void)
3290c45bccfcSMaxim Levitsky {
3291c45bccfcSMaxim Levitsky 	vmcb->control.intercept |= (1 << INTERCEPT_SMI);
3292c45bccfcSMaxim Levitsky 	vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
3293c45bccfcSMaxim Levitsky 	test_set_guest(svm_intr_intercept_mix_smi_guest);
3294c45bccfcSMaxim Levitsky 	svm_intr_intercept_mix_run_guest(NULL, SVM_EXIT_SMI);
3295c45bccfcSMaxim Levitsky }
3296c45bccfcSMaxim Levitsky 
3297712840d5SManali Shukla static struct svm_test svm_tests[] = {
3298ad879127SKrish Sadhukhan     { "null", default_supported, default_prepare,
3299ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test,
3300ad879127SKrish Sadhukhan       default_finished, null_check },
3301ad879127SKrish Sadhukhan     { "vmrun", default_supported, default_prepare,
3302ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_vmrun,
3303ad879127SKrish Sadhukhan        default_finished, check_vmrun },
3304ad879127SKrish Sadhukhan     { "ioio", default_supported, prepare_ioio,
3305ad879127SKrish Sadhukhan        default_prepare_gif_clear, test_ioio,
3306ad879127SKrish Sadhukhan        ioio_finished, check_ioio },
3307ad879127SKrish Sadhukhan     { "vmrun intercept check", default_supported, prepare_no_vmrun_int,
3308ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test, default_finished,
3309ad879127SKrish Sadhukhan       check_no_vmrun_int },
3310401299a5SPaolo Bonzini     { "rsm", default_supported,
3311401299a5SPaolo Bonzini       prepare_rsm_intercept, default_prepare_gif_clear,
3312401299a5SPaolo Bonzini       test_rsm_intercept, finished_rsm_intercept, check_rsm_intercept },
3313ad879127SKrish Sadhukhan     { "cr3 read intercept", default_supported,
3314ad879127SKrish Sadhukhan       prepare_cr3_intercept, default_prepare_gif_clear,
3315ad879127SKrish Sadhukhan       test_cr3_intercept, default_finished, check_cr3_intercept },
3316ad879127SKrish Sadhukhan     { "cr3 read nointercept", default_supported, default_prepare,
3317ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_cr3_intercept, default_finished,
3318ad879127SKrish Sadhukhan       check_cr3_nointercept },
3319ad879127SKrish Sadhukhan     { "cr3 read intercept emulate", smp_supported,
3320ad879127SKrish Sadhukhan       prepare_cr3_intercept_bypass, default_prepare_gif_clear,
3321ad879127SKrish Sadhukhan       test_cr3_intercept_bypass, default_finished, check_cr3_intercept },
3322ad879127SKrish Sadhukhan     { "dr intercept check", default_supported, prepare_dr_intercept,
3323ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_dr_intercept, dr_intercept_finished,
3324ad879127SKrish Sadhukhan       check_dr_intercept },
3325ad879127SKrish Sadhukhan     { "next_rip", next_rip_supported, prepare_next_rip,
3326ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_next_rip,
3327ad879127SKrish Sadhukhan       default_finished, check_next_rip },
3328ad879127SKrish Sadhukhan     { "msr intercept check", default_supported, prepare_msr_intercept,
3329ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_msr_intercept,
3330ad879127SKrish Sadhukhan       msr_intercept_finished, check_msr_intercept },
3331ad879127SKrish Sadhukhan     { "mode_switch", default_supported, prepare_mode_switch,
3332ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_mode_switch,
3333ad879127SKrish Sadhukhan        mode_switch_finished, check_mode_switch },
3334ad879127SKrish Sadhukhan     { "asid_zero", default_supported, prepare_asid_zero,
3335ad879127SKrish Sadhukhan       default_prepare_gif_clear, test_asid_zero,
3336ad879127SKrish Sadhukhan        default_finished, check_asid_zero },
3337ad879127SKrish Sadhukhan     { "sel_cr0_bug", default_supported, sel_cr0_bug_prepare,
3338ad879127SKrish Sadhukhan       default_prepare_gif_clear, sel_cr0_bug_test,
3339ad879127SKrish Sadhukhan        sel_cr0_bug_finished, sel_cr0_bug_check },
334010a65fc4SNadav Amit     { "tsc_adjust", tsc_adjust_supported, tsc_adjust_prepare,
3341ad879127SKrish Sadhukhan       default_prepare_gif_clear, tsc_adjust_test,
3342ad879127SKrish Sadhukhan       default_finished, tsc_adjust_check },
3343ad879127SKrish Sadhukhan     { "latency_run_exit", default_supported, latency_prepare,
3344ad879127SKrish Sadhukhan       default_prepare_gif_clear, latency_test,
3345ad879127SKrish Sadhukhan       latency_finished, latency_check },
3346f7fa53dcSPaolo Bonzini     { "latency_run_exit_clean", default_supported, latency_prepare,
3347f7fa53dcSPaolo Bonzini       default_prepare_gif_clear, latency_test,
3348f7fa53dcSPaolo Bonzini       latency_finished_clean, latency_check },
3349ad879127SKrish Sadhukhan     { "latency_svm_insn", default_supported, lat_svm_insn_prepare,
3350ad879127SKrish Sadhukhan       default_prepare_gif_clear, null_test,
3351ad879127SKrish Sadhukhan       lat_svm_insn_finished, lat_svm_insn_check },
33524b4fb247SPaolo Bonzini     { "exc_inject", default_supported, exc_inject_prepare,
33534b4fb247SPaolo Bonzini       default_prepare_gif_clear, exc_inject_test,
33544b4fb247SPaolo Bonzini       exc_inject_finished, exc_inject_check },
3355ad879127SKrish Sadhukhan     { "pending_event", default_supported, pending_event_prepare,
3356ad879127SKrish Sadhukhan       default_prepare_gif_clear,
3357ad879127SKrish Sadhukhan       pending_event_test, pending_event_finished, pending_event_check },
335885dc2aceSPaolo Bonzini     { "pending_event_cli", default_supported, pending_event_cli_prepare,
335985dc2aceSPaolo Bonzini       pending_event_cli_prepare_gif_clear,
336085dc2aceSPaolo Bonzini       pending_event_cli_test, pending_event_cli_finished,
336185dc2aceSPaolo Bonzini       pending_event_cli_check },
336285dc2aceSPaolo Bonzini     { "interrupt", default_supported, interrupt_prepare,
336385dc2aceSPaolo Bonzini       default_prepare_gif_clear, interrupt_test,
336485dc2aceSPaolo Bonzini       interrupt_finished, interrupt_check },
3365d4db486bSCathy Avery     { "nmi", default_supported, nmi_prepare,
3366d4db486bSCathy Avery       default_prepare_gif_clear, nmi_test,
3367d4db486bSCathy Avery       nmi_finished, nmi_check },
33689da1f4d8SCathy Avery     { "nmi_hlt", smp_supported, nmi_prepare,
33699da1f4d8SCathy Avery       default_prepare_gif_clear, nmi_hlt_test,
33709da1f4d8SCathy Avery       nmi_hlt_finished, nmi_hlt_check },
33719c838954SCathy Avery     { "virq_inject", default_supported, virq_inject_prepare,
33729c838954SCathy Avery       default_prepare_gif_clear, virq_inject_test,
33739c838954SCathy Avery       virq_inject_finished, virq_inject_check },
3374da338a31SMaxim Levitsky     { "reg_corruption", default_supported, reg_corruption_prepare,
3375da338a31SMaxim Levitsky       default_prepare_gif_clear, reg_corruption_test,
3376da338a31SMaxim Levitsky       reg_corruption_finished, reg_corruption_check },
33774770e9c8SCathy Avery     { "svm_init_startup_test", smp_supported, init_startup_prepare,
33784770e9c8SCathy Avery       default_prepare_gif_clear, null_test,
33794770e9c8SCathy Avery       init_startup_finished, init_startup_check },
3380d5da6dfeSCathy Avery     { "svm_init_intercept_test", smp_supported, init_intercept_prepare,
3381d5da6dfeSCathy Avery       default_prepare_gif_clear, init_intercept_test,
3382d5da6dfeSCathy Avery       init_intercept_finished, init_intercept_check, .on_vcpu = 2 },
33837839b0ecSKrish Sadhukhan     { "host_rflags", default_supported, host_rflags_prepare,
33847839b0ecSKrish Sadhukhan       host_rflags_prepare_gif_clear, host_rflags_test,
33857839b0ecSKrish Sadhukhan       host_rflags_finished, host_rflags_check },
3386f6972bd6SLara Lazier     { "vgif", vgif_supported, prepare_vgif_enabled,
3387f6972bd6SLara Lazier       default_prepare_gif_clear, test_vgif, vgif_finished,
3388f6972bd6SLara Lazier       vgif_check },
3389f32183f5SJim Mattson     TEST(svm_cr4_osxsave_test),
3390ba29942cSKrish Sadhukhan     TEST(svm_guest_state_test),
33917a57ef5dSMaxim Levitsky     TEST(svm_vmrun_errata_test),
33920b6f6cedSKrish Sadhukhan     TEST(svm_vmload_vmsave),
3393665f5677SKrish Sadhukhan     TEST(svm_test_singlestep),
33945c92f156SManali Shukla     TEST(svm_nm_test),
3395c8e16d20SManali Shukla     TEST(svm_int3_test),
3396af13008dSManali Shukla     TEST(svm_into_test),
3397537d39dfSMaxim Levitsky     TEST(svm_lbrv_test0),
3398537d39dfSMaxim Levitsky     TEST(svm_lbrv_test1),
3399537d39dfSMaxim Levitsky     TEST(svm_lbrv_test2),
3400537d39dfSMaxim Levitsky     TEST(svm_lbrv_nested_test1),
3401537d39dfSMaxim Levitsky     TEST(svm_lbrv_nested_test2),
3402c45bccfcSMaxim Levitsky     TEST(svm_intr_intercept_mix_if),
3403c45bccfcSMaxim Levitsky     TEST(svm_intr_intercept_mix_gif),
3404c45bccfcSMaxim Levitsky     TEST(svm_intr_intercept_mix_gif2),
3405c45bccfcSMaxim Levitsky     TEST(svm_intr_intercept_mix_nmi),
3406c45bccfcSMaxim Levitsky     TEST(svm_intr_intercept_mix_smi),
3407a8503d50SMaxim Levitsky     TEST(svm_tsc_scale_test),
34088650dffeSMaxim Levitsky     TEST(pause_filter_test),
3409ad879127SKrish Sadhukhan     { NULL, NULL, NULL, NULL, NULL, NULL, NULL }
3410ad879127SKrish Sadhukhan };
3411712840d5SManali Shukla 
3412712840d5SManali Shukla int main(int ac, char **av)
3413712840d5SManali Shukla {
3414*ade7601dSSean Christopherson 	setup_vm();
3415712840d5SManali Shukla 	return run_svm_tests(ac, av, svm_tests);
3416712840d5SManali Shukla }
3417