Remove all references to x86 from the root dir (except from in
configure).  Also remove references from the root dir README
by moving that documentation to the x86/README, and touch up
the READMEs at the same time.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
[Drop --test-dir, adjust includes. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

- remove a redundant '-display none'
- remove a redundant -g from CFLAGS
- remove a useless -I../include/x86 from CFLAGS
- remove lib autodep files on make clean

Signed-off-by: Andrew Jones <drjones@redhat.com>
Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

There are several unused files, primarily because powerpc is an unused
arch. The exceptions are config-ia64.mak, which is also an unused arch
file, lib/fwcfg.c, lib/panic.c, x86/print.h and x86/run-kvm-unit-tests,
which are just unused. Remove them all in order to tidy things up.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

SMSW instruction on long-mode is performed according to the operand size, if
the destination operand is a register.  This patch tests whether it is
performed correctly instead of always using two-bytes operands (as KVM
previously did).  Note that when a dword destination operand is used, the
result is zero-extended to qword on long-mode.

Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

The smsw instruction has an undocumented behavior, in which the high-order
16-bits of CR0 are also saved in a 32-bit destination register.  This is
similar to the way smsw behaves in long-mode. However, it is hard to test the
long-mode case, since we need to cause an "invalid guest state" in long-mode.

The test works as follows: it sets CR0.CD (bit 30), so any of the high 16-bits
would be set.  It then executes smsw to register destination and compares the
register value with that of CR0.  CR0 value is restored when the test is done.

This test is expected to fail only when unrestricted mode is disabled or
unsupported.

Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

An additional test case for the emulator was added to test smsw which is
trapped by the emulator.  The other existing test-cases occur in the guest (at
least on VMX), since the values are read directly from the CR0 read shadow.

Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

The current realmode tests always report success when done, regardless to
whether any of the tests failed.  Although the log includes the individual test
results, this behavior complicates the life of the tester.

Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

If the hypervisor has the interrupt acknowledgement bit set,
vector information is already present in intr_info during a vmexit.
The hypervisor then uses it to call the appropriate handler.

Signed-off-by: Bandan Das <bsd@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

It's incorrect to assume the context in which invept
is called. Check what is supported and fallback if
single context invalidation isn't supported

Signed-off-by: Bandan Das <bsd@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

A bit that is only reserved for large pages.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Test various combinations of the AC bit and reading/writing into
user pages at CPL=0.

One notable missing test is implicit kernel reads and writes (e.g.
reading the IDT/GDT/LDT/TSS).  The interesting part of this is that
AC must be ignored in ring 3; the processor always behaves as if AC=0.
I skipped this because QEMU doesn't emulate this correctly, and because
right now there's no kvm-unit-tests infrastructure to run code in ring
3 at all.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

This lets us modify the flags for the PTE corresponding to a virtual address.
The SMAP testcase will use this to build supervisor-mode pages.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Tests whether the emulator ignores the mod bits on mov DR instruction.  The
test performs regular mov to DR0 and reads back the data using custom mov from
DR0 while mod bits are set to zero. The expected result is obviously the value
which was written to DR0 before.

The test is performed in realmode and is only expected to fail if the CPU does
not support unrestricted mode. Note that mov-CR/DR in protected mode are
usually not handled by the emulator, as their data is available in the exit
information fields.

Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

It is pointless to make the leaf user-accessible if the intermediate page
tables are not.  In a real OS, what would matter is that the page tables
themselves are only accessible through a supervisor mapping.

The SMAP testcase will rely on the user bit, so fix it now.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

We will make it public in vm.c with the next patch.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Use ISTs instead of tasks.

One big remaining difference between 32- and 64-bits is that tasks
on 32-bits take care of saving registers.  ISTs do not, only the
stack is affected.

For now, just save/restore caller-save registers in the assembly
wrapper, since there's just one test that uses ISTs.  Later we
can extend the existing APIs to register exception handlers, so
that they can use tasks or ISTs too.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Sharing the GDT between 32-bit and 64-bit means that the non-present
code segment is now always there, and the test just works.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Using assembler trampolines instead of && fixes NMI IRET test.

There is another bug, however.  Returns to the same privilege level do
not pop SS:RSP on 32-bit, so the nested NMI underflowed the stack at "s".
This is fixed in the new code.  The new code doesn't set up SS:RSP and
instead leaves some space for the nested NMI handler on the alternate
stack.  The old stack pointer is kept and restored when the nested
handler returns.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Introduce a new API that replaces setup_tss32 and set_intr_task_gate
in tests that run in both modes.  This will enable three more tests in
eventinj to run in 64-bit mode.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Move them together with the inline function that read/write the
control registers.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Except the TSS, which is 16-bytes in 64-bit mode, we can use the same
structure and share the constants.  This will aid in porting tests
to 64-bit.

Multiple bitwidth and ring 3 selectors aren't used yet.  I couldn't
make my mind on keeping vs. dropping them, in the end I kept the ring 3
selectors which have a chance of being used for SMAP or paging unit tests.

With this change, vmx.c can start using desc.h's constants and those
in vm.h (why vm.h?) can be dropped.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

The APIs in desc.c make it much simpler to understand what the test
is doing.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

There is no particular reason to use a specific TSS in tests that
use task-switching.  In fact, in many cases the tests just want
a separate interrupt stack and could run on 64-bit just as well
if the task-switching is abstracted.

As a first step, remove duplicate protected mode setup from desc.c's
users.  Just leave some spare selectors in cstart.S's GDT before
the CPUs' main TSS.  Then reuse CPU 0's TSS as TSS_MAIN.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

This interface, already used in taskswitch.c, is a bit easier to use.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

These are necessary in many testcases that includes hand-written
assembly, otherwise they will only run for either 32- or 64-bit.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Rename "str" to "xxstr" to avoid a conflict with lib/x86/processor.h.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

run_tests always reported 'PASS debug', even when subtests were
failing. Fix that.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

We need a prefix to loop on ECX.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Missed this in the previous commit.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

ECX is initialized to 0 in case the highest CPUID leaf has
sub-functions (as is the case for 0xD on processors with XSAVE).
However, this was only happening in the big real mode case due
to a typo in the asm constraint.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

There's room for speeding up emulation of invalid guest state.  Let's
track our progress by adding a few small performance tests.

Current results on a Xeon E5 (Sandy Bridge) with unrestricted_guest=0:

    739 cycles/emulated jump instruction
    925 cycles/emulated move instruction
    887 cycles/emulated arithmetic instruction
    916 cycles/emulated memory load instruction
    1109 cycles/emulated memory RMW instruction

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

This checks that we properly expire the preemption timer while the guest
is in HLT state and that we do not progress guest execution of the
preemption timer is activated with a timer value of 0.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

This checks for interrupt delivery to L2, unintercepted hlt in L2 and
explicit L2 suspension via the activity state HLT. All tests are
performed both with direct interrupt injection and external interrupt
interception.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Currently each MOV to a debug register causes a debug exit.  Add a
testcase to track upcoming improvements.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>