1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * svm_vmcall_test
4  *
5  * Copyright © 2021 Amazon.com, Inc. or its affiliates.
6  *
7  * Xen shared_info / pvclock testing
8  */
9 
10 #include "test_util.h"
11 #include "kvm_util.h"
12 #include "processor.h"
13 
14 #include <stdint.h>
15 #include <time.h>
16 #include <sched.h>
17 #include <signal.h>
18 #include <pthread.h>
19 
20 #include <sys/eventfd.h>
21 
22 /* Defined in include/linux/kvm_types.h */
23 #define GPA_INVALID		(~(ulong)0)
24 
25 #define SHINFO_REGION_GVA	0xc0000000ULL
26 #define SHINFO_REGION_GPA	0xc0000000ULL
27 #define SHINFO_REGION_SLOT	10
28 
29 #define DUMMY_REGION_GPA	(SHINFO_REGION_GPA + (3 * PAGE_SIZE))
30 #define DUMMY_REGION_SLOT	11
31 
32 #define SHINFO_ADDR	(SHINFO_REGION_GPA)
33 #define VCPU_INFO_ADDR	(SHINFO_REGION_GPA + 0x40)
34 #define PVTIME_ADDR	(SHINFO_REGION_GPA + PAGE_SIZE)
35 #define RUNSTATE_ADDR	(SHINFO_REGION_GPA + PAGE_SIZE + PAGE_SIZE - 15)
36 
37 #define SHINFO_VADDR	(SHINFO_REGION_GVA)
38 #define VCPU_INFO_VADDR	(SHINFO_REGION_GVA + 0x40)
39 #define RUNSTATE_VADDR	(SHINFO_REGION_GVA + PAGE_SIZE + PAGE_SIZE - 15)
40 
41 #define EVTCHN_VECTOR	0x10
42 
43 #define EVTCHN_TEST1 15
44 #define EVTCHN_TEST2 66
45 #define EVTCHN_TIMER 13
46 
47 #define XEN_HYPERCALL_MSR	0x40000000
48 
49 #define MIN_STEAL_TIME		50000
50 
51 #define SHINFO_RACE_TIMEOUT	2	/* seconds */
52 
53 #define __HYPERVISOR_set_timer_op	15
54 #define __HYPERVISOR_sched_op		29
55 #define __HYPERVISOR_event_channel_op	32
56 
57 #define SCHEDOP_poll			3
58 
59 #define EVTCHNOP_send			4
60 
61 #define EVTCHNSTAT_interdomain		2
62 
63 struct evtchn_send {
64 	u32 port;
65 };
66 
67 struct sched_poll {
68 	u32 *ports;
69 	unsigned int nr_ports;
70 	u64 timeout;
71 };
72 
73 struct pvclock_vcpu_time_info {
74 	u32   version;
75 	u32   pad0;
76 	u64   tsc_timestamp;
77 	u64   system_time;
78 	u32   tsc_to_system_mul;
79 	s8    tsc_shift;
80 	u8    flags;
81 	u8    pad[2];
82 } __attribute__((__packed__)); /* 32 bytes */
83 
84 struct pvclock_wall_clock {
85 	u32   version;
86 	u32   sec;
87 	u32   nsec;
88 } __attribute__((__packed__));
89 
90 struct vcpu_runstate_info {
91 	uint32_t state;
92 	uint64_t state_entry_time;
93 	uint64_t time[5]; /* Extra field for overrun check */
94 };
95 
96 struct compat_vcpu_runstate_info {
97 	uint32_t state;
98 	uint64_t state_entry_time;
99 	uint64_t time[5];
100 } __attribute__((__packed__));;
101 
102 struct arch_vcpu_info {
103 	unsigned long cr2;
104 	unsigned long pad; /* sizeof(vcpu_info_t) == 64 */
105 };
106 
107 struct vcpu_info {
108 	uint8_t evtchn_upcall_pending;
109 	uint8_t evtchn_upcall_mask;
110 	unsigned long evtchn_pending_sel;
111 	struct arch_vcpu_info arch;
112 	struct pvclock_vcpu_time_info time;
113 }; /* 64 bytes (x86) */
114 
115 struct shared_info {
116 	struct vcpu_info vcpu_info[32];
117 	unsigned long evtchn_pending[64];
118 	unsigned long evtchn_mask[64];
119 	struct pvclock_wall_clock wc;
120 	uint32_t wc_sec_hi;
121 	/* arch_shared_info here */
122 };
123 
124 #define RUNSTATE_running  0
125 #define RUNSTATE_runnable 1
126 #define RUNSTATE_blocked  2
127 #define RUNSTATE_offline  3
128 
129 static const char *runstate_names[] = {
130 	"running",
131 	"runnable",
132 	"blocked",
133 	"offline"
134 };
135 
136 struct {
137 	struct kvm_irq_routing info;
138 	struct kvm_irq_routing_entry entries[2];
139 } irq_routes;
140 
141 static volatile bool guest_saw_irq;
142 
143 static void evtchn_handler(struct ex_regs *regs)
144 {
145 	struct vcpu_info *vi = (void *)VCPU_INFO_VADDR;
146 	vi->evtchn_upcall_pending = 0;
147 	vi->evtchn_pending_sel = 0;
148 	guest_saw_irq = true;
149 
150 	GUEST_SYNC(0x20);
151 }
152 
153 static void guest_wait_for_irq(void)
154 {
155 	while (!guest_saw_irq)
156 		__asm__ __volatile__ ("rep nop" : : : "memory");
157 	guest_saw_irq = false;
158 }
159 
160 static void guest_code(void)
161 {
162 	struct vcpu_runstate_info *rs = (void *)RUNSTATE_VADDR;
163 	int i;
164 
165 	__asm__ __volatile__(
166 		"sti\n"
167 		"nop\n"
168 	);
169 
170 	/* Trigger an interrupt injection */
171 	GUEST_SYNC(0);
172 
173 	guest_wait_for_irq();
174 
175 	/* Test having the host set runstates manually */
176 	GUEST_SYNC(RUNSTATE_runnable);
177 	GUEST_ASSERT(rs->time[RUNSTATE_runnable] != 0);
178 	GUEST_ASSERT(rs->state == 0);
179 
180 	GUEST_SYNC(RUNSTATE_blocked);
181 	GUEST_ASSERT(rs->time[RUNSTATE_blocked] != 0);
182 	GUEST_ASSERT(rs->state == 0);
183 
184 	GUEST_SYNC(RUNSTATE_offline);
185 	GUEST_ASSERT(rs->time[RUNSTATE_offline] != 0);
186 	GUEST_ASSERT(rs->state == 0);
187 
188 	/* Test runstate time adjust */
189 	GUEST_SYNC(4);
190 	GUEST_ASSERT(rs->time[RUNSTATE_blocked] == 0x5a);
191 	GUEST_ASSERT(rs->time[RUNSTATE_offline] == 0x6b6b);
192 
193 	/* Test runstate time set */
194 	GUEST_SYNC(5);
195 	GUEST_ASSERT(rs->state_entry_time >= 0x8000);
196 	GUEST_ASSERT(rs->time[RUNSTATE_runnable] == 0);
197 	GUEST_ASSERT(rs->time[RUNSTATE_blocked] == 0x6b6b);
198 	GUEST_ASSERT(rs->time[RUNSTATE_offline] == 0x5a);
199 
200 	/* sched_yield() should result in some 'runnable' time */
201 	GUEST_SYNC(6);
202 	GUEST_ASSERT(rs->time[RUNSTATE_runnable] >= MIN_STEAL_TIME);
203 
204 	/* Attempt to deliver a *masked* interrupt */
205 	GUEST_SYNC(7);
206 
207 	/* Wait until we see the bit set */
208 	struct shared_info *si = (void *)SHINFO_VADDR;
209 	while (!si->evtchn_pending[0])
210 		__asm__ __volatile__ ("rep nop" : : : "memory");
211 
212 	/* Now deliver an *unmasked* interrupt */
213 	GUEST_SYNC(8);
214 
215 	guest_wait_for_irq();
216 
217 	/* Change memslots and deliver an interrupt */
218 	GUEST_SYNC(9);
219 
220 	guest_wait_for_irq();
221 
222 	/* Deliver event channel with KVM_XEN_HVM_EVTCHN_SEND */
223 	GUEST_SYNC(10);
224 
225 	guest_wait_for_irq();
226 
227 	GUEST_SYNC(11);
228 
229 	/* Our turn. Deliver event channel (to ourselves) with
230 	 * EVTCHNOP_send hypercall. */
231 	unsigned long rax;
232 	struct evtchn_send s = { .port = 127 };
233 	__asm__ __volatile__ ("vmcall" :
234 			      "=a" (rax) :
235 			      "a" (__HYPERVISOR_event_channel_op),
236 			      "D" (EVTCHNOP_send),
237 			      "S" (&s));
238 
239 	GUEST_ASSERT(rax == 0);
240 
241 	guest_wait_for_irq();
242 
243 	GUEST_SYNC(12);
244 
245 	/* Deliver "outbound" event channel to an eventfd which
246 	 * happens to be one of our own irqfds. */
247 	s.port = 197;
248 	__asm__ __volatile__ ("vmcall" :
249 			      "=a" (rax) :
250 			      "a" (__HYPERVISOR_event_channel_op),
251 			      "D" (EVTCHNOP_send),
252 			      "S" (&s));
253 
254 	GUEST_ASSERT(rax == 0);
255 
256 	guest_wait_for_irq();
257 
258 	GUEST_SYNC(13);
259 
260 	/* Set a timer 100ms in the future. */
261 	__asm__ __volatile__ ("vmcall" :
262 			      "=a" (rax) :
263 			      "a" (__HYPERVISOR_set_timer_op),
264 			      "D" (rs->state_entry_time + 100000000));
265 	GUEST_ASSERT(rax == 0);
266 
267 	GUEST_SYNC(14);
268 
269 	/* Now wait for the timer */
270 	guest_wait_for_irq();
271 
272 	GUEST_SYNC(15);
273 
274 	/* The host has 'restored' the timer. Just wait for it. */
275 	guest_wait_for_irq();
276 
277 	GUEST_SYNC(16);
278 
279 	/* Poll for an event channel port which is already set */
280 	u32 ports[1] = { EVTCHN_TIMER };
281 	struct sched_poll p = {
282 		.ports = ports,
283 		.nr_ports = 1,
284 		.timeout = 0,
285 	};
286 
287 	__asm__ __volatile__ ("vmcall" :
288 			      "=a" (rax) :
289 			      "a" (__HYPERVISOR_sched_op),
290 			      "D" (SCHEDOP_poll),
291 			      "S" (&p));
292 
293 	GUEST_ASSERT(rax == 0);
294 
295 	GUEST_SYNC(17);
296 
297 	/* Poll for an unset port and wait for the timeout. */
298 	p.timeout = 100000000;
299 	__asm__ __volatile__ ("vmcall" :
300 			      "=a" (rax) :
301 			      "a" (__HYPERVISOR_sched_op),
302 			      "D" (SCHEDOP_poll),
303 			      "S" (&p));
304 
305 	GUEST_ASSERT(rax == 0);
306 
307 	GUEST_SYNC(18);
308 
309 	/* A timer will wake the masked port we're waiting on, while we poll */
310 	p.timeout = 0;
311 	__asm__ __volatile__ ("vmcall" :
312 			      "=a" (rax) :
313 			      "a" (__HYPERVISOR_sched_op),
314 			      "D" (SCHEDOP_poll),
315 			      "S" (&p));
316 
317 	GUEST_ASSERT(rax == 0);
318 
319 	GUEST_SYNC(19);
320 
321 	/* A timer wake an *unmasked* port which should wake us with an
322 	 * actual interrupt, while we're polling on a different port. */
323 	ports[0]++;
324 	p.timeout = 0;
325 	__asm__ __volatile__ ("vmcall" :
326 			      "=a" (rax) :
327 			      "a" (__HYPERVISOR_sched_op),
328 			      "D" (SCHEDOP_poll),
329 			      "S" (&p));
330 
331 	GUEST_ASSERT(rax == 0);
332 
333 	guest_wait_for_irq();
334 
335 	GUEST_SYNC(20);
336 
337 	/* Timer should have fired already */
338 	guest_wait_for_irq();
339 
340 	GUEST_SYNC(21);
341 	/* Racing host ioctls */
342 
343 	guest_wait_for_irq();
344 
345 	GUEST_SYNC(22);
346 	/* Racing vmcall against host ioctl */
347 
348 	ports[0] = 0;
349 
350 	p = (struct sched_poll) {
351 		.ports = ports,
352 		.nr_ports = 1,
353 		.timeout = 0
354 	};
355 
356 wait_for_timer:
357 	/*
358 	 * Poll for a timer wake event while the worker thread is mucking with
359 	 * the shared info.  KVM XEN drops timer IRQs if the shared info is
360 	 * invalid when the timer expires.  Arbitrarily poll 100 times before
361 	 * giving up and asking the VMM to re-arm the timer.  100 polls should
362 	 * consume enough time to beat on KVM without taking too long if the
363 	 * timer IRQ is dropped due to an invalid event channel.
364 	 */
365 	for (i = 0; i < 100 && !guest_saw_irq; i++)
366 		asm volatile("vmcall"
367 			     : "=a" (rax)
368 			     : "a" (__HYPERVISOR_sched_op),
369 			       "D" (SCHEDOP_poll),
370 			       "S" (&p)
371 			     : "memory");
372 
373 	/*
374 	 * Re-send the timer IRQ if it was (likely) dropped due to the timer
375 	 * expiring while the event channel was invalid.
376 	 */
377 	if (!guest_saw_irq) {
378 		GUEST_SYNC(23);
379 		goto wait_for_timer;
380 	}
381 	guest_saw_irq = false;
382 
383 	GUEST_SYNC(24);
384 }
385 
386 static int cmp_timespec(struct timespec *a, struct timespec *b)
387 {
388 	if (a->tv_sec > b->tv_sec)
389 		return 1;
390 	else if (a->tv_sec < b->tv_sec)
391 		return -1;
392 	else if (a->tv_nsec > b->tv_nsec)
393 		return 1;
394 	else if (a->tv_nsec < b->tv_nsec)
395 		return -1;
396 	else
397 		return 0;
398 }
399 
400 static struct vcpu_info *vinfo;
401 static struct kvm_vcpu *vcpu;
402 
403 static void handle_alrm(int sig)
404 {
405 	if (vinfo)
406 		printf("evtchn_upcall_pending 0x%x\n", vinfo->evtchn_upcall_pending);
407 	vcpu_dump(stdout, vcpu, 0);
408 	TEST_FAIL("IRQ delivery timed out");
409 }
410 
411 static void *juggle_shinfo_state(void *arg)
412 {
413 	struct kvm_vm *vm = (struct kvm_vm *)arg;
414 
415 	struct kvm_xen_hvm_attr cache_init = {
416 		.type = KVM_XEN_ATTR_TYPE_SHARED_INFO,
417 		.u.shared_info.gfn = SHINFO_REGION_GPA / PAGE_SIZE
418 	};
419 
420 	struct kvm_xen_hvm_attr cache_destroy = {
421 		.type = KVM_XEN_ATTR_TYPE_SHARED_INFO,
422 		.u.shared_info.gfn = GPA_INVALID
423 	};
424 
425 	for (;;) {
426 		__vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &cache_init);
427 		__vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &cache_destroy);
428 		pthread_testcancel();
429 	};
430 
431 	return NULL;
432 }
433 
434 int main(int argc, char *argv[])
435 {
436 	struct timespec min_ts, max_ts, vm_ts;
437 	struct kvm_xen_hvm_attr evt_reset;
438 	struct kvm_vm *vm;
439 	pthread_t thread;
440 	bool verbose;
441 	int ret;
442 
443 	verbose = argc > 1 && (!strncmp(argv[1], "-v", 3) ||
444 			       !strncmp(argv[1], "--verbose", 10));
445 
446 	int xen_caps = kvm_check_cap(KVM_CAP_XEN_HVM);
447 	TEST_REQUIRE(xen_caps & KVM_XEN_HVM_CONFIG_SHARED_INFO);
448 
449 	bool do_runstate_tests = !!(xen_caps & KVM_XEN_HVM_CONFIG_RUNSTATE);
450 	bool do_runstate_flag = !!(xen_caps & KVM_XEN_HVM_CONFIG_RUNSTATE_UPDATE_FLAG);
451 	bool do_eventfd_tests = !!(xen_caps & KVM_XEN_HVM_CONFIG_EVTCHN_2LEVEL);
452 	bool do_evtchn_tests = do_eventfd_tests && !!(xen_caps & KVM_XEN_HVM_CONFIG_EVTCHN_SEND);
453 
454 	clock_gettime(CLOCK_REALTIME, &min_ts);
455 
456 	vm = vm_create_with_one_vcpu(&vcpu, guest_code);
457 
458 	/* Map a region for the shared_info page */
459 	vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS,
460 				    SHINFO_REGION_GPA, SHINFO_REGION_SLOT, 3, 0);
461 	virt_map(vm, SHINFO_REGION_GVA, SHINFO_REGION_GPA, 3);
462 
463 	struct shared_info *shinfo = addr_gpa2hva(vm, SHINFO_VADDR);
464 
465 	int zero_fd = open("/dev/zero", O_RDONLY);
466 	TEST_ASSERT(zero_fd != -1, "Failed to open /dev/zero");
467 
468 	struct kvm_xen_hvm_config hvmc = {
469 		.flags = KVM_XEN_HVM_CONFIG_INTERCEPT_HCALL,
470 		.msr = XEN_HYPERCALL_MSR,
471 	};
472 
473 	/* Let the kernel know that we *will* use it for sending all
474 	 * event channels, which lets it intercept SCHEDOP_poll */
475 	if (do_evtchn_tests)
476 		hvmc.flags |= KVM_XEN_HVM_CONFIG_EVTCHN_SEND;
477 
478 	vm_ioctl(vm, KVM_XEN_HVM_CONFIG, &hvmc);
479 
480 	struct kvm_xen_hvm_attr lm = {
481 		.type = KVM_XEN_ATTR_TYPE_LONG_MODE,
482 		.u.long_mode = 1,
483 	};
484 	vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &lm);
485 
486 	if (do_runstate_flag) {
487 		struct kvm_xen_hvm_attr ruf = {
488 			.type = KVM_XEN_ATTR_TYPE_RUNSTATE_UPDATE_FLAG,
489 			.u.runstate_update_flag = 1,
490 		};
491 		vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &ruf);
492 
493 		ruf.u.runstate_update_flag = 0;
494 		vm_ioctl(vm, KVM_XEN_HVM_GET_ATTR, &ruf);
495 		TEST_ASSERT(ruf.u.runstate_update_flag == 1,
496 			    "Failed to read back RUNSTATE_UPDATE_FLAG attr");
497 	}
498 
499 	struct kvm_xen_hvm_attr ha = {
500 		.type = KVM_XEN_ATTR_TYPE_SHARED_INFO,
501 		.u.shared_info.gfn = SHINFO_REGION_GPA / PAGE_SIZE,
502 	};
503 	vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &ha);
504 
505 	/*
506 	 * Test what happens when the HVA of the shinfo page is remapped after
507 	 * the kernel has a reference to it. But make sure we copy the clock
508 	 * info over since that's only set at setup time, and we test it later.
509 	 */
510 	struct pvclock_wall_clock wc_copy = shinfo->wc;
511 	void *m = mmap(shinfo, PAGE_SIZE, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_PRIVATE, zero_fd, 0);
512 	TEST_ASSERT(m == shinfo, "Failed to map /dev/zero over shared info");
513 	shinfo->wc = wc_copy;
514 
515 	struct kvm_xen_vcpu_attr vi = {
516 		.type = KVM_XEN_VCPU_ATTR_TYPE_VCPU_INFO,
517 		.u.gpa = VCPU_INFO_ADDR,
518 	};
519 	vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &vi);
520 
521 	struct kvm_xen_vcpu_attr pvclock = {
522 		.type = KVM_XEN_VCPU_ATTR_TYPE_VCPU_TIME_INFO,
523 		.u.gpa = PVTIME_ADDR,
524 	};
525 	vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &pvclock);
526 
527 	struct kvm_xen_hvm_attr vec = {
528 		.type = KVM_XEN_ATTR_TYPE_UPCALL_VECTOR,
529 		.u.vector = EVTCHN_VECTOR,
530 	};
531 	vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &vec);
532 
533 	vm_init_descriptor_tables(vm);
534 	vcpu_init_descriptor_tables(vcpu);
535 	vm_install_exception_handler(vm, EVTCHN_VECTOR, evtchn_handler);
536 
537 	if (do_runstate_tests) {
538 		struct kvm_xen_vcpu_attr st = {
539 			.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADDR,
540 			.u.gpa = RUNSTATE_ADDR,
541 		};
542 		vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &st);
543 	}
544 
545 	int irq_fd[2] = { -1, -1 };
546 
547 	if (do_eventfd_tests) {
548 		irq_fd[0] = eventfd(0, 0);
549 		irq_fd[1] = eventfd(0, 0);
550 
551 		/* Unexpected, but not a KVM failure */
552 		if (irq_fd[0] == -1 || irq_fd[1] == -1)
553 			do_evtchn_tests = do_eventfd_tests = false;
554 	}
555 
556 	if (do_eventfd_tests) {
557 		irq_routes.info.nr = 2;
558 
559 		irq_routes.entries[0].gsi = 32;
560 		irq_routes.entries[0].type = KVM_IRQ_ROUTING_XEN_EVTCHN;
561 		irq_routes.entries[0].u.xen_evtchn.port = EVTCHN_TEST1;
562 		irq_routes.entries[0].u.xen_evtchn.vcpu = vcpu->id;
563 		irq_routes.entries[0].u.xen_evtchn.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
564 
565 		irq_routes.entries[1].gsi = 33;
566 		irq_routes.entries[1].type = KVM_IRQ_ROUTING_XEN_EVTCHN;
567 		irq_routes.entries[1].u.xen_evtchn.port = EVTCHN_TEST2;
568 		irq_routes.entries[1].u.xen_evtchn.vcpu = vcpu->id;
569 		irq_routes.entries[1].u.xen_evtchn.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
570 
571 		vm_ioctl(vm, KVM_SET_GSI_ROUTING, &irq_routes.info);
572 
573 		struct kvm_irqfd ifd = { };
574 
575 		ifd.fd = irq_fd[0];
576 		ifd.gsi = 32;
577 		vm_ioctl(vm, KVM_IRQFD, &ifd);
578 
579 		ifd.fd = irq_fd[1];
580 		ifd.gsi = 33;
581 		vm_ioctl(vm, KVM_IRQFD, &ifd);
582 
583 		struct sigaction sa = { };
584 		sa.sa_handler = handle_alrm;
585 		sigaction(SIGALRM, &sa, NULL);
586 	}
587 
588 	struct kvm_xen_vcpu_attr tmr = {
589 		.type = KVM_XEN_VCPU_ATTR_TYPE_TIMER,
590 		.u.timer.port = EVTCHN_TIMER,
591 		.u.timer.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL,
592 		.u.timer.expires_ns = 0
593 	};
594 
595 	if (do_evtchn_tests) {
596 		struct kvm_xen_hvm_attr inj = {
597 			.type = KVM_XEN_ATTR_TYPE_EVTCHN,
598 			.u.evtchn.send_port = 127,
599 			.u.evtchn.type = EVTCHNSTAT_interdomain,
600 			.u.evtchn.flags = 0,
601 			.u.evtchn.deliver.port.port = EVTCHN_TEST1,
602 			.u.evtchn.deliver.port.vcpu = vcpu->id + 1,
603 			.u.evtchn.deliver.port.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL,
604 		};
605 		vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &inj);
606 
607 		/* Test migration to a different vCPU */
608 		inj.u.evtchn.flags = KVM_XEN_EVTCHN_UPDATE;
609 		inj.u.evtchn.deliver.port.vcpu = vcpu->id;
610 		vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &inj);
611 
612 		inj.u.evtchn.send_port = 197;
613 		inj.u.evtchn.deliver.eventfd.port = 0;
614 		inj.u.evtchn.deliver.eventfd.fd = irq_fd[1];
615 		inj.u.evtchn.flags = 0;
616 		vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &inj);
617 
618 		vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
619 	}
620 	vinfo = addr_gpa2hva(vm, VCPU_INFO_VADDR);
621 	vinfo->evtchn_upcall_pending = 0;
622 
623 	struct vcpu_runstate_info *rs = addr_gpa2hva(vm, RUNSTATE_ADDR);
624 	rs->state = 0x5a;
625 
626 	bool evtchn_irq_expected = false;
627 
628 	for (;;) {
629 		volatile struct kvm_run *run = vcpu->run;
630 		struct ucall uc;
631 
632 		vcpu_run(vcpu);
633 
634 		TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
635 			    "Got exit_reason other than KVM_EXIT_IO: %u (%s)\n",
636 			    run->exit_reason,
637 			    exit_reason_str(run->exit_reason));
638 
639 		switch (get_ucall(vcpu, &uc)) {
640 		case UCALL_ABORT:
641 			REPORT_GUEST_ASSERT(uc);
642 			/* NOT REACHED */
643 		case UCALL_SYNC: {
644 			struct kvm_xen_vcpu_attr rst;
645 			long rundelay;
646 
647 			if (do_runstate_tests)
648 				TEST_ASSERT(rs->state_entry_time == rs->time[0] +
649 					    rs->time[1] + rs->time[2] + rs->time[3],
650 					    "runstate times don't add up");
651 
652 			switch (uc.args[1]) {
653 			case 0:
654 				if (verbose)
655 					printf("Delivering evtchn upcall\n");
656 				evtchn_irq_expected = true;
657 				vinfo->evtchn_upcall_pending = 1;
658 				break;
659 
660 			case RUNSTATE_runnable...RUNSTATE_offline:
661 				TEST_ASSERT(!evtchn_irq_expected, "Event channel IRQ not seen");
662 				if (!do_runstate_tests)
663 					goto done;
664 				if (verbose)
665 					printf("Testing runstate %s\n", runstate_names[uc.args[1]]);
666 				rst.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_CURRENT;
667 				rst.u.runstate.state = uc.args[1];
668 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &rst);
669 				break;
670 
671 			case 4:
672 				if (verbose)
673 					printf("Testing RUNSTATE_ADJUST\n");
674 				rst.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADJUST;
675 				memset(&rst.u, 0, sizeof(rst.u));
676 				rst.u.runstate.state = (uint64_t)-1;
677 				rst.u.runstate.time_blocked =
678 					0x5a - rs->time[RUNSTATE_blocked];
679 				rst.u.runstate.time_offline =
680 					0x6b6b - rs->time[RUNSTATE_offline];
681 				rst.u.runstate.time_runnable = -rst.u.runstate.time_blocked -
682 					rst.u.runstate.time_offline;
683 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &rst);
684 				break;
685 
686 			case 5:
687 				if (verbose)
688 					printf("Testing RUNSTATE_DATA\n");
689 				rst.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_DATA;
690 				memset(&rst.u, 0, sizeof(rst.u));
691 				rst.u.runstate.state = RUNSTATE_running;
692 				rst.u.runstate.state_entry_time = 0x6b6b + 0x5a;
693 				rst.u.runstate.time_blocked = 0x6b6b;
694 				rst.u.runstate.time_offline = 0x5a;
695 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &rst);
696 				break;
697 
698 			case 6:
699 				if (verbose)
700 					printf("Testing steal time\n");
701 				/* Yield until scheduler delay exceeds target */
702 				rundelay = get_run_delay() + MIN_STEAL_TIME;
703 				do {
704 					sched_yield();
705 				} while (get_run_delay() < rundelay);
706 				break;
707 
708 			case 7:
709 				if (!do_eventfd_tests)
710 					goto done;
711 				if (verbose)
712 					printf("Testing masked event channel\n");
713 				shinfo->evtchn_mask[0] = 1UL << EVTCHN_TEST1;
714 				eventfd_write(irq_fd[0], 1UL);
715 				alarm(1);
716 				break;
717 
718 			case 8:
719 				if (verbose)
720 					printf("Testing unmasked event channel\n");
721 				/* Unmask that, but deliver the other one */
722 				shinfo->evtchn_pending[0] = 0;
723 				shinfo->evtchn_mask[0] = 0;
724 				eventfd_write(irq_fd[1], 1UL);
725 				evtchn_irq_expected = true;
726 				alarm(1);
727 				break;
728 
729 			case 9:
730 				TEST_ASSERT(!evtchn_irq_expected,
731 					    "Expected event channel IRQ but it didn't happen");
732 				shinfo->evtchn_pending[1] = 0;
733 				if (verbose)
734 					printf("Testing event channel after memslot change\n");
735 				vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS,
736 							    DUMMY_REGION_GPA, DUMMY_REGION_SLOT, 1, 0);
737 				eventfd_write(irq_fd[0], 1UL);
738 				evtchn_irq_expected = true;
739 				alarm(1);
740 				break;
741 
742 			case 10:
743 				TEST_ASSERT(!evtchn_irq_expected,
744 					    "Expected event channel IRQ but it didn't happen");
745 				if (!do_evtchn_tests)
746 					goto done;
747 
748 				shinfo->evtchn_pending[0] = 0;
749 				if (verbose)
750 					printf("Testing injection with KVM_XEN_HVM_EVTCHN_SEND\n");
751 
752 				struct kvm_irq_routing_xen_evtchn e;
753 				e.port = EVTCHN_TEST2;
754 				e.vcpu = vcpu->id;
755 				e.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
756 
757 				vm_ioctl(vm, KVM_XEN_HVM_EVTCHN_SEND, &e);
758 				evtchn_irq_expected = true;
759 				alarm(1);
760 				break;
761 
762 			case 11:
763 				TEST_ASSERT(!evtchn_irq_expected,
764 					    "Expected event channel IRQ but it didn't happen");
765 				shinfo->evtchn_pending[1] = 0;
766 
767 				if (verbose)
768 					printf("Testing guest EVTCHNOP_send direct to evtchn\n");
769 				evtchn_irq_expected = true;
770 				alarm(1);
771 				break;
772 
773 			case 12:
774 				TEST_ASSERT(!evtchn_irq_expected,
775 					    "Expected event channel IRQ but it didn't happen");
776 				shinfo->evtchn_pending[0] = 0;
777 
778 				if (verbose)
779 					printf("Testing guest EVTCHNOP_send to eventfd\n");
780 				evtchn_irq_expected = true;
781 				alarm(1);
782 				break;
783 
784 			case 13:
785 				TEST_ASSERT(!evtchn_irq_expected,
786 					    "Expected event channel IRQ but it didn't happen");
787 				shinfo->evtchn_pending[1] = 0;
788 
789 				if (verbose)
790 					printf("Testing guest oneshot timer\n");
791 				break;
792 
793 			case 14:
794 				memset(&tmr, 0, sizeof(tmr));
795 				tmr.type = KVM_XEN_VCPU_ATTR_TYPE_TIMER;
796 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr);
797 				TEST_ASSERT(tmr.u.timer.port == EVTCHN_TIMER,
798 					    "Timer port not returned");
799 				TEST_ASSERT(tmr.u.timer.priority == KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL,
800 					    "Timer priority not returned");
801 				TEST_ASSERT(tmr.u.timer.expires_ns > rs->state_entry_time,
802 					    "Timer expiry not returned");
803 				evtchn_irq_expected = true;
804 				alarm(1);
805 				break;
806 
807 			case 15:
808 				TEST_ASSERT(!evtchn_irq_expected,
809 					    "Expected event channel IRQ but it didn't happen");
810 				shinfo->evtchn_pending[0] = 0;
811 
812 				if (verbose)
813 					printf("Testing restored oneshot timer\n");
814 
815 				tmr.u.timer.expires_ns = rs->state_entry_time + 100000000;
816 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
817 				evtchn_irq_expected = true;
818 				alarm(1);
819 				break;
820 
821 			case 16:
822 				TEST_ASSERT(!evtchn_irq_expected,
823 					    "Expected event channel IRQ but it didn't happen");
824 
825 				if (verbose)
826 					printf("Testing SCHEDOP_poll with already pending event\n");
827 				shinfo->evtchn_pending[0] = shinfo->evtchn_mask[0] = 1UL << EVTCHN_TIMER;
828 				alarm(1);
829 				break;
830 
831 			case 17:
832 				if (verbose)
833 					printf("Testing SCHEDOP_poll timeout\n");
834 				shinfo->evtchn_pending[0] = 0;
835 				alarm(1);
836 				break;
837 
838 			case 18:
839 				if (verbose)
840 					printf("Testing SCHEDOP_poll wake on masked event\n");
841 
842 				tmr.u.timer.expires_ns = rs->state_entry_time + 100000000;
843 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
844 				alarm(1);
845 				break;
846 
847 			case 19:
848 				shinfo->evtchn_pending[0] = shinfo->evtchn_mask[0] = 0;
849 				if (verbose)
850 					printf("Testing SCHEDOP_poll wake on unmasked event\n");
851 
852 				evtchn_irq_expected = true;
853 				tmr.u.timer.expires_ns = rs->state_entry_time + 100000000;
854 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
855 
856 				/* Read it back and check the pending time is reported correctly */
857 				tmr.u.timer.expires_ns = 0;
858 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr);
859 				TEST_ASSERT(tmr.u.timer.expires_ns == rs->state_entry_time + 100000000,
860 					    "Timer not reported pending");
861 				alarm(1);
862 				break;
863 
864 			case 20:
865 				TEST_ASSERT(!evtchn_irq_expected,
866 					    "Expected event channel IRQ but it didn't happen");
867 				/* Read timer and check it is no longer pending */
868 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr);
869 				TEST_ASSERT(!tmr.u.timer.expires_ns, "Timer still reported pending");
870 
871 				shinfo->evtchn_pending[0] = 0;
872 				if (verbose)
873 					printf("Testing timer in the past\n");
874 
875 				evtchn_irq_expected = true;
876 				tmr.u.timer.expires_ns = rs->state_entry_time - 100000000ULL;
877 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
878 				alarm(1);
879 				break;
880 
881 			case 21:
882 				TEST_ASSERT(!evtchn_irq_expected,
883 					    "Expected event channel IRQ but it didn't happen");
884 				alarm(0);
885 
886 				if (verbose)
887 					printf("Testing shinfo lock corruption (KVM_XEN_HVM_EVTCHN_SEND)\n");
888 
889 				ret = pthread_create(&thread, NULL, &juggle_shinfo_state, (void *)vm);
890 				TEST_ASSERT(ret == 0, "pthread_create() failed: %s", strerror(ret));
891 
892 				struct kvm_irq_routing_xen_evtchn uxe = {
893 					.port = 1,
894 					.vcpu = vcpu->id,
895 					.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL
896 				};
897 
898 				evtchn_irq_expected = true;
899 				for (time_t t = time(NULL) + SHINFO_RACE_TIMEOUT; time(NULL) < t;)
900 					__vm_ioctl(vm, KVM_XEN_HVM_EVTCHN_SEND, &uxe);
901 				break;
902 
903 			case 22:
904 				TEST_ASSERT(!evtchn_irq_expected,
905 					    "Expected event channel IRQ but it didn't happen");
906 
907 				if (verbose)
908 					printf("Testing shinfo lock corruption (SCHEDOP_poll)\n");
909 
910 				shinfo->evtchn_pending[0] = 1;
911 
912 				evtchn_irq_expected = true;
913 				tmr.u.timer.expires_ns = rs->state_entry_time +
914 							 SHINFO_RACE_TIMEOUT * 1000000000ULL;
915 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
916 				break;
917 
918 			case 23:
919 				/*
920 				 * Optional and possibly repeated sync point.
921 				 * Injecting the timer IRQ may fail if the
922 				 * shinfo is invalid when the timer expires.
923 				 * If the timer has expired but the IRQ hasn't
924 				 * been delivered, rearm the timer and retry.
925 				 */
926 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr);
927 
928 				/* Resume the guest if the timer is still pending. */
929 				if (tmr.u.timer.expires_ns)
930 					break;
931 
932 				/* All done if the IRQ was delivered. */
933 				if (!evtchn_irq_expected)
934 					break;
935 
936 				tmr.u.timer.expires_ns = rs->state_entry_time +
937 							 SHINFO_RACE_TIMEOUT * 1000000000ULL;
938 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
939 				break;
940 			case 24:
941 				TEST_ASSERT(!evtchn_irq_expected,
942 					    "Expected event channel IRQ but it didn't happen");
943 
944 				ret = pthread_cancel(thread);
945 				TEST_ASSERT(ret == 0, "pthread_cancel() failed: %s", strerror(ret));
946 
947 				ret = pthread_join(thread, 0);
948 				TEST_ASSERT(ret == 0, "pthread_join() failed: %s", strerror(ret));
949 				goto done;
950 
951 			case 0x20:
952 				TEST_ASSERT(evtchn_irq_expected, "Unexpected event channel IRQ");
953 				evtchn_irq_expected = false;
954 				break;
955 			}
956 			break;
957 		}
958 		case UCALL_DONE:
959 			goto done;
960 		default:
961 			TEST_FAIL("Unknown ucall 0x%lx.", uc.cmd);
962 		}
963 	}
964 
965  done:
966 	evt_reset.type = KVM_XEN_ATTR_TYPE_EVTCHN;
967 	evt_reset.u.evtchn.flags = KVM_XEN_EVTCHN_RESET;
968 	vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &evt_reset);
969 
970 	alarm(0);
971 	clock_gettime(CLOCK_REALTIME, &max_ts);
972 
973 	/*
974 	 * Just a *really* basic check that things are being put in the
975 	 * right place. The actual calculations are much the same for
976 	 * Xen as they are for the KVM variants, so no need to check.
977 	 */
978 	struct pvclock_wall_clock *wc;
979 	struct pvclock_vcpu_time_info *ti, *ti2;
980 
981 	wc = addr_gpa2hva(vm, SHINFO_REGION_GPA + 0xc00);
982 	ti = addr_gpa2hva(vm, SHINFO_REGION_GPA + 0x40 + 0x20);
983 	ti2 = addr_gpa2hva(vm, PVTIME_ADDR);
984 
985 	if (verbose) {
986 		printf("Wall clock (v %d) %d.%09d\n", wc->version, wc->sec, wc->nsec);
987 		printf("Time info 1: v %u tsc %" PRIu64 " time %" PRIu64 " mul %u shift %u flags %x\n",
988 		       ti->version, ti->tsc_timestamp, ti->system_time, ti->tsc_to_system_mul,
989 		       ti->tsc_shift, ti->flags);
990 		printf("Time info 2: v %u tsc %" PRIu64 " time %" PRIu64 " mul %u shift %u flags %x\n",
991 		       ti2->version, ti2->tsc_timestamp, ti2->system_time, ti2->tsc_to_system_mul,
992 		       ti2->tsc_shift, ti2->flags);
993 	}
994 
995 	vm_ts.tv_sec = wc->sec;
996 	vm_ts.tv_nsec = wc->nsec;
997 	TEST_ASSERT(wc->version && !(wc->version & 1),
998 		    "Bad wallclock version %x", wc->version);
999 	TEST_ASSERT(cmp_timespec(&min_ts, &vm_ts) <= 0, "VM time too old");
1000 	TEST_ASSERT(cmp_timespec(&max_ts, &vm_ts) >= 0, "VM time too new");
1001 
1002 	TEST_ASSERT(ti->version && !(ti->version & 1),
1003 		    "Bad time_info version %x", ti->version);
1004 	TEST_ASSERT(ti2->version && !(ti2->version & 1),
1005 		    "Bad time_info version %x", ti->version);
1006 
1007 	if (do_runstate_tests) {
1008 		/*
1009 		 * Fetch runstate and check sanity. Strictly speaking in the
1010 		 * general case we might not expect the numbers to be identical
1011 		 * but in this case we know we aren't running the vCPU any more.
1012 		 */
1013 		struct kvm_xen_vcpu_attr rst = {
1014 			.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_DATA,
1015 		};
1016 		vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &rst);
1017 
1018 		if (verbose) {
1019 			printf("Runstate: %s(%d), entry %" PRIu64 " ns\n",
1020 			       rs->state <= RUNSTATE_offline ? runstate_names[rs->state] : "unknown",
1021 			       rs->state, rs->state_entry_time);
1022 			for (int i = RUNSTATE_running; i <= RUNSTATE_offline; i++) {
1023 				printf("State %s: %" PRIu64 " ns\n",
1024 				       runstate_names[i], rs->time[i]);
1025 			}
1026 		}
1027 
1028 		/*
1029 		 * Exercise runstate info at all points across the page boundary, in
1030 		 * 32-bit and 64-bit mode. In particular, test the case where it is
1031 		 * configured in 32-bit mode and then switched to 64-bit mode while
1032 		 * active, which takes it onto the second page.
1033 		 */
1034 		unsigned long runstate_addr;
1035 		struct compat_vcpu_runstate_info *crs;
1036 		for (runstate_addr = SHINFO_REGION_GPA + PAGE_SIZE + PAGE_SIZE - sizeof(*rs) - 4;
1037 		     runstate_addr < SHINFO_REGION_GPA + PAGE_SIZE + PAGE_SIZE + 4; runstate_addr++) {
1038 
1039 			rs = addr_gpa2hva(vm, runstate_addr);
1040 			crs = (void *)rs;
1041 
1042 			memset(rs, 0xa5, sizeof(*rs));
1043 
1044 			/* Set to compatibility mode */
1045 			lm.u.long_mode = 0;
1046 			vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &lm);
1047 
1048 			/* Set runstate to new address (kernel will write it) */
1049 			struct kvm_xen_vcpu_attr st = {
1050 				.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADDR,
1051 				.u.gpa = runstate_addr,
1052 			};
1053 			vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &st);
1054 
1055 			if (verbose)
1056 				printf("Compatibility runstate at %08lx\n", runstate_addr);
1057 
1058 			TEST_ASSERT(crs->state == rst.u.runstate.state, "Runstate mismatch");
1059 			TEST_ASSERT(crs->state_entry_time == rst.u.runstate.state_entry_time,
1060 				    "State entry time mismatch");
1061 			TEST_ASSERT(crs->time[RUNSTATE_running] == rst.u.runstate.time_running,
1062 				    "Running time mismatch");
1063 			TEST_ASSERT(crs->time[RUNSTATE_runnable] == rst.u.runstate.time_runnable,
1064 				    "Runnable time mismatch");
1065 			TEST_ASSERT(crs->time[RUNSTATE_blocked] == rst.u.runstate.time_blocked,
1066 				    "Blocked time mismatch");
1067 			TEST_ASSERT(crs->time[RUNSTATE_offline] == rst.u.runstate.time_offline,
1068 				    "Offline time mismatch");
1069 			TEST_ASSERT(crs->time[RUNSTATE_offline + 1] == 0xa5a5a5a5a5a5a5a5ULL,
1070 				    "Structure overrun");
1071 			TEST_ASSERT(crs->state_entry_time == crs->time[0] +
1072 				    crs->time[1] + crs->time[2] + crs->time[3],
1073 				    "runstate times don't add up");
1074 
1075 
1076 			/* Now switch to 64-bit mode */
1077 			lm.u.long_mode = 1;
1078 			vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &lm);
1079 
1080 			memset(rs, 0xa5, sizeof(*rs));
1081 
1082 			/* Don't change the address, just trigger a write */
1083 			struct kvm_xen_vcpu_attr adj = {
1084 				.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADJUST,
1085 				.u.runstate.state = (uint64_t)-1
1086 			};
1087 			vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &adj);
1088 
1089 			if (verbose)
1090 				printf("64-bit runstate at %08lx\n", runstate_addr);
1091 
1092 			TEST_ASSERT(rs->state == rst.u.runstate.state, "Runstate mismatch");
1093 			TEST_ASSERT(rs->state_entry_time == rst.u.runstate.state_entry_time,
1094 				    "State entry time mismatch");
1095 			TEST_ASSERT(rs->time[RUNSTATE_running] == rst.u.runstate.time_running,
1096 				    "Running time mismatch");
1097 			TEST_ASSERT(rs->time[RUNSTATE_runnable] == rst.u.runstate.time_runnable,
1098 				    "Runnable time mismatch");
1099 			TEST_ASSERT(rs->time[RUNSTATE_blocked] == rst.u.runstate.time_blocked,
1100 				    "Blocked time mismatch");
1101 			TEST_ASSERT(rs->time[RUNSTATE_offline] == rst.u.runstate.time_offline,
1102 				    "Offline time mismatch");
1103 			TEST_ASSERT(rs->time[RUNSTATE_offline + 1] == 0xa5a5a5a5a5a5a5a5ULL,
1104 				    "Structure overrun");
1105 
1106 			TEST_ASSERT(rs->state_entry_time == rs->time[0] +
1107 				    rs->time[1] + rs->time[2] + rs->time[3],
1108 				    "runstate times don't add up");
1109 		}
1110 	}
1111 
1112 	kvm_vm_free(vm);
1113 	return 0;
1114 }
1115