xref: /linux/tools/testing/selftests/kvm/x86/xen_shinfo_test.c (revision 67f8bc848ee31831336bd478e57d2f993551902e)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright © 2021 Amazon.com, Inc. or its affiliates.
4  */
5 
6 #include "test_util.h"
7 #include "kvm_util.h"
8 #include "processor.h"
9 
10 #include <stdint.h>
11 #include <time.h>
12 #include <sched.h>
13 #include <signal.h>
14 #include <pthread.h>
15 
16 #include <sys/eventfd.h>
17 
18 #define SHINFO_REGION_GVA	0xc0000000ULL
19 #define SHINFO_REGION_GPA	0xc0000000ULL
20 #define SHINFO_REGION_SLOT	10
21 
22 #define DUMMY_REGION_GPA	(SHINFO_REGION_GPA + (3 * PAGE_SIZE))
23 #define DUMMY_REGION_SLOT	11
24 
25 #define DUMMY_REGION_GPA_2	(SHINFO_REGION_GPA + (4 * PAGE_SIZE))
26 #define DUMMY_REGION_SLOT_2	12
27 
28 #define SHINFO_ADDR	(SHINFO_REGION_GPA)
29 #define VCPU_INFO_ADDR	(SHINFO_REGION_GPA + 0x40)
30 #define PVTIME_ADDR	(SHINFO_REGION_GPA + PAGE_SIZE)
31 #define RUNSTATE_ADDR	(SHINFO_REGION_GPA + PAGE_SIZE + PAGE_SIZE - 15)
32 
33 #define SHINFO_VADDR	(SHINFO_REGION_GVA)
34 #define VCPU_INFO_VADDR	(SHINFO_REGION_GVA + 0x40)
35 #define RUNSTATE_VADDR	(SHINFO_REGION_GVA + PAGE_SIZE + PAGE_SIZE - 15)
36 
37 #define EVTCHN_VECTOR	0x10
38 
39 #define EVTCHN_TEST1 15
40 #define EVTCHN_TEST2 66
41 #define EVTCHN_TIMER 13
42 
43 enum {
44 	TEST_INJECT_VECTOR = 0,
45 	TEST_RUNSTATE_runnable,
46 	TEST_RUNSTATE_blocked,
47 	TEST_RUNSTATE_offline,
48 	TEST_RUNSTATE_ADJUST,
49 	TEST_RUNSTATE_DATA,
50 	TEST_STEAL_TIME,
51 	TEST_EVTCHN_MASKED,
52 	TEST_EVTCHN_UNMASKED,
53 	TEST_EVTCHN_SLOWPATH,
54 	TEST_EVTCHN_SEND_IOCTL,
55 	TEST_EVTCHN_HCALL,
56 	TEST_EVTCHN_HCALL_SLOWPATH,
57 	TEST_EVTCHN_HCALL_EVENTFD,
58 	TEST_TIMER_SETUP,
59 	TEST_TIMER_WAIT,
60 	TEST_TIMER_RESTORE,
61 	TEST_POLL_READY,
62 	TEST_POLL_TIMEOUT,
63 	TEST_POLL_MASKED,
64 	TEST_POLL_WAKE,
65 	SET_VCPU_INFO,
66 	TEST_TIMER_PAST,
67 	TEST_LOCKING_SEND_RACE,
68 	TEST_LOCKING_POLL_RACE,
69 	TEST_LOCKING_POLL_TIMEOUT,
70 	TEST_DONE,
71 
72 	TEST_GUEST_SAW_IRQ,
73 };
74 
75 #define XEN_HYPERCALL_MSR	0x40000000
76 
77 #define MIN_STEAL_TIME		50000
78 
79 #define SHINFO_RACE_TIMEOUT	2	/* seconds */
80 
81 #define __HYPERVISOR_set_timer_op	15
82 #define __HYPERVISOR_sched_op		29
83 #define __HYPERVISOR_event_channel_op	32
84 
85 #define SCHEDOP_poll			3
86 
87 #define EVTCHNOP_send			4
88 
89 #define EVTCHNSTAT_interdomain		2
90 
91 struct evtchn_send {
92 	u32 port;
93 };
94 
95 struct sched_poll {
96 	u32 *ports;
97 	unsigned int nr_ports;
98 	u64 timeout;
99 };
100 
101 struct pvclock_vcpu_time_info {
102 	u32   version;
103 	u32   pad0;
104 	u64   tsc_timestamp;
105 	u64   system_time;
106 	u32   tsc_to_system_mul;
107 	s8    tsc_shift;
108 	u8    flags;
109 	u8    pad[2];
110 } __attribute__((__packed__)); /* 32 bytes */
111 
112 struct pvclock_wall_clock {
113 	u32   version;
114 	u32   sec;
115 	u32   nsec;
116 } __attribute__((__packed__));
117 
118 struct vcpu_runstate_info {
119 	u32 state;
120 	u64 state_entry_time;
121 	u64 time[5]; /* Extra field for overrun check */
122 };
123 
124 struct compat_vcpu_runstate_info {
125 	u32 state;
126 	u64 state_entry_time;
127 	u64 time[5];
128 } __attribute__((__packed__));
129 
130 struct arch_vcpu_info {
131 	unsigned long cr2;
132 	unsigned long pad; /* sizeof(vcpu_info_t) == 64 */
133 };
134 
135 struct vcpu_info {
136 	u8 evtchn_upcall_pending;
137 	u8 evtchn_upcall_mask;
138 	unsigned long evtchn_pending_sel;
139 	struct arch_vcpu_info arch;
140 	struct pvclock_vcpu_time_info time;
141 }; /* 64 bytes (x86) */
142 
143 struct shared_info {
144 	struct vcpu_info vcpu_info[32];
145 	unsigned long evtchn_pending[64];
146 	unsigned long evtchn_mask[64];
147 	struct pvclock_wall_clock wc;
148 	u32 wc_sec_hi;
149 	/* arch_shared_info here */
150 };
151 
152 #define RUNSTATE_running  0
153 #define RUNSTATE_runnable 1
154 #define RUNSTATE_blocked  2
155 #define RUNSTATE_offline  3
156 
157 static const char *runstate_names[] = {
158 	"running",
159 	"runnable",
160 	"blocked",
161 	"offline"
162 };
163 
164 struct {
165 	struct kvm_irq_routing info;
166 	struct kvm_irq_routing_entry entries[2];
167 } irq_routes;
168 
169 static volatile bool guest_saw_irq;
170 
171 static void evtchn_handler(struct ex_regs *regs)
172 {
173 	struct vcpu_info *vi = (void *)VCPU_INFO_VADDR;
174 
175 	vcpu_arch_put_guest(vi->evtchn_upcall_pending, 0);
176 	vcpu_arch_put_guest(vi->evtchn_pending_sel, 0);
177 	guest_saw_irq = true;
178 
179 	GUEST_SYNC(TEST_GUEST_SAW_IRQ);
180 }
181 
182 static void guest_wait_for_irq(void)
183 {
184 	while (!guest_saw_irq)
185 		__asm__ __volatile__ ("rep nop" : : : "memory");
186 	guest_saw_irq = false;
187 }
188 
189 static void guest_code(void)
190 {
191 	struct vcpu_runstate_info *rs = (void *)RUNSTATE_VADDR;
192 	int i;
193 
194 	sti_nop();
195 
196 	/* Trigger an interrupt injection */
197 	GUEST_SYNC(TEST_INJECT_VECTOR);
198 
199 	guest_wait_for_irq();
200 
201 	/* Test having the host set runstates manually */
202 	GUEST_SYNC(TEST_RUNSTATE_runnable);
203 	GUEST_ASSERT(rs->time[RUNSTATE_runnable] != 0);
204 	GUEST_ASSERT(rs->state == 0);
205 
206 	GUEST_SYNC(TEST_RUNSTATE_blocked);
207 	GUEST_ASSERT(rs->time[RUNSTATE_blocked] != 0);
208 	GUEST_ASSERT(rs->state == 0);
209 
210 	GUEST_SYNC(TEST_RUNSTATE_offline);
211 	GUEST_ASSERT(rs->time[RUNSTATE_offline] != 0);
212 	GUEST_ASSERT(rs->state == 0);
213 
214 	/* Test runstate time adjust */
215 	GUEST_SYNC(TEST_RUNSTATE_ADJUST);
216 	GUEST_ASSERT(rs->time[RUNSTATE_blocked] == 0x5a);
217 	GUEST_ASSERT(rs->time[RUNSTATE_offline] == 0x6b6b);
218 
219 	/* Test runstate time set */
220 	GUEST_SYNC(TEST_RUNSTATE_DATA);
221 	GUEST_ASSERT(rs->state_entry_time >= 0x8000);
222 	GUEST_ASSERT(rs->time[RUNSTATE_runnable] == 0);
223 	GUEST_ASSERT(rs->time[RUNSTATE_blocked] == 0x6b6b);
224 	GUEST_ASSERT(rs->time[RUNSTATE_offline] == 0x5a);
225 
226 	/* sched_yield() should result in some 'runnable' time */
227 	GUEST_SYNC(TEST_STEAL_TIME);
228 	GUEST_ASSERT(rs->time[RUNSTATE_runnable] >= MIN_STEAL_TIME);
229 
230 	/* Attempt to deliver a *masked* interrupt */
231 	GUEST_SYNC(TEST_EVTCHN_MASKED);
232 
233 	/* Wait until we see the bit set */
234 	struct shared_info *si = (void *)SHINFO_VADDR;
235 	while (!si->evtchn_pending[0])
236 		__asm__ __volatile__ ("rep nop" : : : "memory");
237 
238 	/* Now deliver an *unmasked* interrupt */
239 	GUEST_SYNC(TEST_EVTCHN_UNMASKED);
240 
241 	guest_wait_for_irq();
242 
243 	/* Change memslots and deliver an interrupt */
244 	GUEST_SYNC(TEST_EVTCHN_SLOWPATH);
245 
246 	guest_wait_for_irq();
247 
248 	/* Deliver event channel with KVM_XEN_HVM_EVTCHN_SEND */
249 	GUEST_SYNC(TEST_EVTCHN_SEND_IOCTL);
250 
251 	guest_wait_for_irq();
252 
253 	GUEST_SYNC(TEST_EVTCHN_HCALL);
254 
255 	/* Our turn. Deliver event channel (to ourselves) with
256 	 * EVTCHNOP_send hypercall. */
257 	struct evtchn_send s = { .port = 127 };
258 	xen_hypercall(__HYPERVISOR_event_channel_op, EVTCHNOP_send, &s);
259 
260 	guest_wait_for_irq();
261 
262 	GUEST_SYNC(TEST_EVTCHN_HCALL_SLOWPATH);
263 
264 	/*
265 	 * Same again, but this time the host has messed with memslots so it
266 	 * should take the slow path in kvm_xen_set_evtchn().
267 	 */
268 	xen_hypercall(__HYPERVISOR_event_channel_op, EVTCHNOP_send, &s);
269 
270 	guest_wait_for_irq();
271 
272 	GUEST_SYNC(TEST_EVTCHN_HCALL_EVENTFD);
273 
274 	/* Deliver "outbound" event channel to an eventfd which
275 	 * happens to be one of our own irqfds. */
276 	s.port = 197;
277 	xen_hypercall(__HYPERVISOR_event_channel_op, EVTCHNOP_send, &s);
278 
279 	guest_wait_for_irq();
280 
281 	GUEST_SYNC(TEST_TIMER_SETUP);
282 
283 	/* Set a timer 100ms in the future. */
284 	xen_hypercall(__HYPERVISOR_set_timer_op,
285 		      rs->state_entry_time + 100000000, NULL);
286 
287 	GUEST_SYNC(TEST_TIMER_WAIT);
288 
289 	/* Now wait for the timer */
290 	guest_wait_for_irq();
291 
292 	GUEST_SYNC(TEST_TIMER_RESTORE);
293 
294 	/* The host has 'restored' the timer. Just wait for it. */
295 	guest_wait_for_irq();
296 
297 	GUEST_SYNC(TEST_POLL_READY);
298 
299 	/* Poll for an event channel port which is already set */
300 	u32 ports[1] = { EVTCHN_TIMER };
301 	struct sched_poll p = {
302 		.ports = ports,
303 		.nr_ports = 1,
304 		.timeout = 0,
305 	};
306 
307 	xen_hypercall(__HYPERVISOR_sched_op, SCHEDOP_poll, &p);
308 
309 	GUEST_SYNC(TEST_POLL_TIMEOUT);
310 
311 	/* Poll for an unset port and wait for the timeout. */
312 	p.timeout = 100000000;
313 	xen_hypercall(__HYPERVISOR_sched_op, SCHEDOP_poll, &p);
314 
315 	GUEST_SYNC(TEST_POLL_MASKED);
316 
317 	/* A timer will wake the masked port we're waiting on, while we poll */
318 	p.timeout = 0;
319 	xen_hypercall(__HYPERVISOR_sched_op, SCHEDOP_poll, &p);
320 
321 	GUEST_SYNC(TEST_POLL_WAKE);
322 
323 	/* Set the vcpu_info to point at exactly the place it already is to
324 	 * make sure the attribute is functional. */
325 	GUEST_SYNC(SET_VCPU_INFO);
326 
327 	/* A timer wake an *unmasked* port which should wake us with an
328 	 * actual interrupt, while we're polling on a different port. */
329 	ports[0]++;
330 	p.timeout = 0;
331 	xen_hypercall(__HYPERVISOR_sched_op, SCHEDOP_poll, &p);
332 
333 	guest_wait_for_irq();
334 
335 	GUEST_SYNC(TEST_TIMER_PAST);
336 
337 	/* Timer should have fired already */
338 	guest_wait_for_irq();
339 
340 	GUEST_SYNC(TEST_LOCKING_SEND_RACE);
341 	/* Racing host ioctls */
342 
343 	guest_wait_for_irq();
344 
345 	GUEST_SYNC(TEST_LOCKING_POLL_RACE);
346 	/* Racing vmcall against host ioctl */
347 
348 	ports[0] = 0;
349 
350 	p = (struct sched_poll) {
351 		.ports = ports,
352 		.nr_ports = 1,
353 		.timeout = 0
354 	};
355 
356 wait_for_timer:
357 	/*
358 	 * Poll for a timer wake event while the worker thread is mucking with
359 	 * the shared info.  KVM XEN drops timer IRQs if the shared info is
360 	 * invalid when the timer expires.  Arbitrarily poll 100 times before
361 	 * giving up and asking the VMM to re-arm the timer.  100 polls should
362 	 * consume enough time to beat on KVM without taking too long if the
363 	 * timer IRQ is dropped due to an invalid event channel.
364 	 */
365 	for (i = 0; i < 100 && !guest_saw_irq; i++)
366 		__xen_hypercall(__HYPERVISOR_sched_op, SCHEDOP_poll, &p);
367 
368 	/*
369 	 * Re-send the timer IRQ if it was (likely) dropped due to the timer
370 	 * expiring while the event channel was invalid.
371 	 */
372 	if (!guest_saw_irq) {
373 		GUEST_SYNC(TEST_LOCKING_POLL_TIMEOUT);
374 		goto wait_for_timer;
375 	}
376 	guest_saw_irq = false;
377 
378 	GUEST_SYNC(TEST_DONE);
379 }
380 
381 static struct shared_info *shinfo;
382 static struct vcpu_info *vinfo;
383 static struct kvm_vcpu *vcpu;
384 
385 static void handle_alrm(int sig)
386 {
387 	if (vinfo)
388 		printf("evtchn_upcall_pending 0x%x\n", vinfo->evtchn_upcall_pending);
389 	vcpu_dump(stdout, vcpu, 0);
390 	TEST_FAIL("IRQ delivery timed out");
391 }
392 
393 static void *juggle_shinfo_state(void *arg)
394 {
395 	struct kvm_vm *vm = (struct kvm_vm *)arg;
396 
397 	struct kvm_xen_hvm_attr cache_activate_gfn = {
398 		.type = KVM_XEN_ATTR_TYPE_SHARED_INFO,
399 		.u.shared_info.gfn = SHINFO_REGION_GPA / PAGE_SIZE
400 	};
401 
402 	struct kvm_xen_hvm_attr cache_deactivate_gfn = {
403 		.type = KVM_XEN_ATTR_TYPE_SHARED_INFO,
404 		.u.shared_info.gfn = KVM_XEN_INVALID_GFN
405 	};
406 
407 	struct kvm_xen_hvm_attr cache_activate_hva = {
408 		.type = KVM_XEN_ATTR_TYPE_SHARED_INFO_HVA,
409 		.u.shared_info.hva = (unsigned long)shinfo
410 	};
411 
412 	struct kvm_xen_hvm_attr cache_deactivate_hva = {
413 		.type = KVM_XEN_ATTR_TYPE_SHARED_INFO,
414 		.u.shared_info.hva = 0
415 	};
416 
417 	int xen_caps = kvm_check_cap(KVM_CAP_XEN_HVM);
418 
419 	for (;;) {
420 		__vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &cache_activate_gfn);
421 		pthread_testcancel();
422 		__vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &cache_deactivate_gfn);
423 
424 		if (xen_caps & KVM_XEN_HVM_CONFIG_SHARED_INFO_HVA) {
425 			__vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &cache_activate_hva);
426 			pthread_testcancel();
427 			__vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &cache_deactivate_hva);
428 		}
429 	}
430 
431 	return NULL;
432 }
433 
434 int main(int argc, char *argv[])
435 {
436 	struct kvm_xen_hvm_attr evt_reset;
437 	struct kvm_vm *vm;
438 	pthread_t thread;
439 	bool verbose;
440 
441 	verbose = argc > 1 && (!strncmp(argv[1], "-v", 3) ||
442 			       !strncmp(argv[1], "--verbose", 10));
443 
444 	int xen_caps = kvm_check_cap(KVM_CAP_XEN_HVM);
445 	TEST_REQUIRE(xen_caps & KVM_XEN_HVM_CONFIG_SHARED_INFO);
446 
447 	bool do_runstate_tests = !!(xen_caps & KVM_XEN_HVM_CONFIG_RUNSTATE);
448 	bool do_runstate_flag = !!(xen_caps & KVM_XEN_HVM_CONFIG_RUNSTATE_UPDATE_FLAG);
449 	bool do_eventfd_tests = !!(xen_caps & KVM_XEN_HVM_CONFIG_EVTCHN_2LEVEL);
450 	bool do_evtchn_tests = do_eventfd_tests && !!(xen_caps & KVM_XEN_HVM_CONFIG_EVTCHN_SEND);
451 	bool has_shinfo_hva = !!(xen_caps & KVM_XEN_HVM_CONFIG_SHARED_INFO_HVA);
452 
453 	vm = vm_create_with_one_vcpu(&vcpu, guest_code);
454 
455 	/* Map a region for the shared_info page */
456 	vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS,
457 				    SHINFO_REGION_GPA, SHINFO_REGION_SLOT, 3, 0);
458 	virt_map(vm, SHINFO_REGION_GVA, SHINFO_REGION_GPA, 3);
459 
460 	shinfo = addr_gpa2hva(vm, SHINFO_VADDR);
461 
462 	int zero_fd = open("/dev/zero", O_RDONLY);
463 	TEST_ASSERT(zero_fd != -1, "Failed to open /dev/zero");
464 
465 	struct kvm_xen_hvm_config hvmc = {
466 		.flags = KVM_XEN_HVM_CONFIG_INTERCEPT_HCALL,
467 		.msr = XEN_HYPERCALL_MSR,
468 	};
469 
470 	/* Let the kernel know that we *will* use it for sending all
471 	 * event channels, which lets it intercept SCHEDOP_poll */
472 	if (do_evtchn_tests)
473 		hvmc.flags |= KVM_XEN_HVM_CONFIG_EVTCHN_SEND;
474 
475 	vm_ioctl(vm, KVM_XEN_HVM_CONFIG, &hvmc);
476 
477 	struct kvm_xen_hvm_attr lm = {
478 		.type = KVM_XEN_ATTR_TYPE_LONG_MODE,
479 		.u.long_mode = 1,
480 	};
481 	vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &lm);
482 
483 	if (do_runstate_flag) {
484 		struct kvm_xen_hvm_attr ruf = {
485 			.type = KVM_XEN_ATTR_TYPE_RUNSTATE_UPDATE_FLAG,
486 			.u.runstate_update_flag = 1,
487 		};
488 		vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &ruf);
489 
490 		ruf.u.runstate_update_flag = 0;
491 		vm_ioctl(vm, KVM_XEN_HVM_GET_ATTR, &ruf);
492 		TEST_ASSERT(ruf.u.runstate_update_flag == 1,
493 			    "Failed to read back RUNSTATE_UPDATE_FLAG attr");
494 	}
495 
496 	struct kvm_xen_hvm_attr ha = {};
497 
498 	if (has_shinfo_hva) {
499 		ha.type = KVM_XEN_ATTR_TYPE_SHARED_INFO_HVA;
500 		ha.u.shared_info.hva = (unsigned long)shinfo;
501 	} else {
502 		ha.type = KVM_XEN_ATTR_TYPE_SHARED_INFO;
503 		ha.u.shared_info.gfn = SHINFO_ADDR / PAGE_SIZE;
504 	}
505 
506 	vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &ha);
507 
508 	/*
509 	 * Test what happens when the HVA of the shinfo page is remapped after
510 	 * the kernel has a reference to it. But make sure we copy the clock
511 	 * info over since that's only set at setup time, and we test it later.
512 	 */
513 	struct pvclock_wall_clock wc_copy = shinfo->wc;
514 	void *m = mmap(shinfo, PAGE_SIZE, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_PRIVATE, zero_fd, 0);
515 	TEST_ASSERT(m == shinfo, "Failed to map /dev/zero over shared info");
516 	shinfo->wc = wc_copy;
517 
518 	struct kvm_xen_vcpu_attr vi = {
519 		.type = KVM_XEN_VCPU_ATTR_TYPE_VCPU_INFO,
520 		.u.gpa = VCPU_INFO_ADDR,
521 	};
522 	vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &vi);
523 
524 	struct kvm_xen_vcpu_attr pvclock = {
525 		.type = KVM_XEN_VCPU_ATTR_TYPE_VCPU_TIME_INFO,
526 		.u.gpa = PVTIME_ADDR,
527 	};
528 	vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &pvclock);
529 
530 	struct kvm_xen_hvm_attr vec = {
531 		.type = KVM_XEN_ATTR_TYPE_UPCALL_VECTOR,
532 		.u.vector = EVTCHN_VECTOR,
533 	};
534 	vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &vec);
535 
536 	vm_install_exception_handler(vm, EVTCHN_VECTOR, evtchn_handler);
537 
538 	if (do_runstate_tests) {
539 		struct kvm_xen_vcpu_attr st = {
540 			.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADDR,
541 			.u.gpa = RUNSTATE_ADDR,
542 		};
543 		vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &st);
544 	}
545 
546 	int irq_fd[2] = { -1, -1 };
547 
548 	if (do_eventfd_tests) {
549 		irq_fd[0] = kvm_new_eventfd();
550 		irq_fd[1] = kvm_new_eventfd();
551 
552 		irq_routes.info.nr = 2;
553 
554 		irq_routes.entries[0].gsi = 32;
555 		irq_routes.entries[0].type = KVM_IRQ_ROUTING_XEN_EVTCHN;
556 		irq_routes.entries[0].u.xen_evtchn.port = EVTCHN_TEST1;
557 		irq_routes.entries[0].u.xen_evtchn.vcpu = vcpu->id;
558 		irq_routes.entries[0].u.xen_evtchn.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
559 
560 		irq_routes.entries[1].gsi = 33;
561 		irq_routes.entries[1].type = KVM_IRQ_ROUTING_XEN_EVTCHN;
562 		irq_routes.entries[1].u.xen_evtchn.port = EVTCHN_TEST2;
563 		irq_routes.entries[1].u.xen_evtchn.vcpu = vcpu->id;
564 		irq_routes.entries[1].u.xen_evtchn.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
565 
566 		vm_ioctl(vm, KVM_SET_GSI_ROUTING, &irq_routes.info);
567 
568 		kvm_assign_irqfd(vm, 32, irq_fd[0]);
569 		kvm_assign_irqfd(vm, 33, irq_fd[1]);
570 
571 		struct sigaction sa = { };
572 		sa.sa_handler = handle_alrm;
573 		sigaction(SIGALRM, &sa, NULL);
574 	}
575 
576 	struct kvm_xen_vcpu_attr tmr = {
577 		.type = KVM_XEN_VCPU_ATTR_TYPE_TIMER,
578 		.u.timer.port = EVTCHN_TIMER,
579 		.u.timer.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL,
580 		.u.timer.expires_ns = 0
581 	};
582 
583 	if (do_evtchn_tests) {
584 		struct kvm_xen_hvm_attr inj = {
585 			.type = KVM_XEN_ATTR_TYPE_EVTCHN,
586 			.u.evtchn.send_port = 127,
587 			.u.evtchn.type = EVTCHNSTAT_interdomain,
588 			.u.evtchn.flags = 0,
589 			.u.evtchn.deliver.port.port = EVTCHN_TEST1,
590 			.u.evtchn.deliver.port.vcpu = vcpu->id + 1,
591 			.u.evtchn.deliver.port.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL,
592 		};
593 		vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &inj);
594 
595 		/* Test migration to a different vCPU */
596 		inj.u.evtchn.flags = KVM_XEN_EVTCHN_UPDATE;
597 		inj.u.evtchn.deliver.port.vcpu = vcpu->id;
598 		vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &inj);
599 
600 		inj.u.evtchn.send_port = 197;
601 		inj.u.evtchn.deliver.eventfd.port = 0;
602 		inj.u.evtchn.deliver.eventfd.fd = irq_fd[1];
603 		inj.u.evtchn.flags = 0;
604 		vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &inj);
605 
606 		vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
607 	}
608 	vinfo = addr_gpa2hva(vm, VCPU_INFO_VADDR);
609 	vinfo->evtchn_upcall_pending = 0;
610 
611 	struct vcpu_runstate_info *rs = addr_gpa2hva(vm, RUNSTATE_ADDR);
612 	rs->state = 0x5a;
613 
614 	bool evtchn_irq_expected = false;
615 
616 	for (;;) {
617 		struct ucall uc;
618 
619 		vcpu_run(vcpu);
620 		TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_IO);
621 
622 		switch (get_ucall(vcpu, &uc)) {
623 		case UCALL_ABORT:
624 			REPORT_GUEST_ASSERT(uc);
625 			/* NOT REACHED */
626 		case UCALL_SYNC: {
627 			struct kvm_xen_vcpu_attr rst;
628 			long rundelay;
629 
630 			if (do_runstate_tests)
631 				TEST_ASSERT(rs->state_entry_time == rs->time[0] +
632 					    rs->time[1] + rs->time[2] + rs->time[3],
633 					    "runstate times don't add up");
634 
635 			switch (uc.args[1]) {
636 			case TEST_INJECT_VECTOR:
637 				if (verbose)
638 					printf("Delivering evtchn upcall\n");
639 				evtchn_irq_expected = true;
640 				vinfo->evtchn_upcall_pending = 1;
641 				break;
642 
643 			case TEST_RUNSTATE_runnable...TEST_RUNSTATE_offline:
644 				TEST_ASSERT(!evtchn_irq_expected, "Event channel IRQ not seen");
645 				if (!do_runstate_tests)
646 					goto done;
647 				if (verbose)
648 					printf("Testing runstate %s\n", runstate_names[uc.args[1]]);
649 				rst.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_CURRENT;
650 				rst.u.runstate.state = uc.args[1] + RUNSTATE_runnable -
651 					TEST_RUNSTATE_runnable;
652 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &rst);
653 				break;
654 
655 			case TEST_RUNSTATE_ADJUST:
656 				if (verbose)
657 					printf("Testing RUNSTATE_ADJUST\n");
658 				rst.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADJUST;
659 				memset(&rst.u, 0, sizeof(rst.u));
660 				rst.u.runstate.state = (u64)-1;
661 				rst.u.runstate.time_blocked =
662 					0x5a - rs->time[RUNSTATE_blocked];
663 				rst.u.runstate.time_offline =
664 					0x6b6b - rs->time[RUNSTATE_offline];
665 				rst.u.runstate.time_runnable = -rst.u.runstate.time_blocked -
666 					rst.u.runstate.time_offline;
667 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &rst);
668 				break;
669 
670 			case TEST_RUNSTATE_DATA:
671 				if (verbose)
672 					printf("Testing RUNSTATE_DATA\n");
673 				rst.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_DATA;
674 				memset(&rst.u, 0, sizeof(rst.u));
675 				rst.u.runstate.state = RUNSTATE_running;
676 				rst.u.runstate.state_entry_time = 0x6b6b + 0x5a;
677 				rst.u.runstate.time_blocked = 0x6b6b;
678 				rst.u.runstate.time_offline = 0x5a;
679 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &rst);
680 				break;
681 
682 			case TEST_STEAL_TIME:
683 				if (verbose)
684 					printf("Testing steal time\n");
685 				/* Yield until scheduler delay exceeds target */
686 				rundelay = get_run_delay() + MIN_STEAL_TIME;
687 				do {
688 					sched_yield();
689 				} while (get_run_delay() < rundelay);
690 				break;
691 
692 			case TEST_EVTCHN_MASKED:
693 				if (!do_eventfd_tests)
694 					goto done;
695 				if (verbose)
696 					printf("Testing masked event channel\n");
697 				shinfo->evtchn_mask[0] = 1UL << EVTCHN_TEST1;
698 				eventfd_write(irq_fd[0], 1UL);
699 				alarm(1);
700 				break;
701 
702 			case TEST_EVTCHN_UNMASKED:
703 				if (verbose)
704 					printf("Testing unmasked event channel\n");
705 				/* Unmask that, but deliver the other one */
706 				shinfo->evtchn_pending[0] = 0;
707 				shinfo->evtchn_mask[0] = 0;
708 				eventfd_write(irq_fd[1], 1UL);
709 				evtchn_irq_expected = true;
710 				alarm(1);
711 				break;
712 
713 			case TEST_EVTCHN_SLOWPATH:
714 				TEST_ASSERT(!evtchn_irq_expected,
715 					    "Expected event channel IRQ but it didn't happen");
716 				shinfo->evtchn_pending[1] = 0;
717 				if (verbose)
718 					printf("Testing event channel after memslot change\n");
719 				vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS,
720 							    DUMMY_REGION_GPA, DUMMY_REGION_SLOT, 1, 0);
721 				eventfd_write(irq_fd[0], 1UL);
722 				evtchn_irq_expected = true;
723 				alarm(1);
724 				break;
725 
726 			case TEST_EVTCHN_SEND_IOCTL:
727 				TEST_ASSERT(!evtchn_irq_expected,
728 					    "Expected event channel IRQ but it didn't happen");
729 				if (!do_evtchn_tests)
730 					goto done;
731 
732 				shinfo->evtchn_pending[0] = 0;
733 				if (verbose)
734 					printf("Testing injection with KVM_XEN_HVM_EVTCHN_SEND\n");
735 
736 				struct kvm_irq_routing_xen_evtchn e;
737 				e.port = EVTCHN_TEST2;
738 				e.vcpu = vcpu->id;
739 				e.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
740 
741 				vm_ioctl(vm, KVM_XEN_HVM_EVTCHN_SEND, &e);
742 				evtchn_irq_expected = true;
743 				alarm(1);
744 				break;
745 
746 			case TEST_EVTCHN_HCALL:
747 				TEST_ASSERT(!evtchn_irq_expected,
748 					    "Expected event channel IRQ but it didn't happen");
749 				shinfo->evtchn_pending[1] = 0;
750 
751 				if (verbose)
752 					printf("Testing guest EVTCHNOP_send direct to evtchn\n");
753 				evtchn_irq_expected = true;
754 				alarm(1);
755 				break;
756 
757 			case TEST_EVTCHN_HCALL_SLOWPATH:
758 				TEST_ASSERT(!evtchn_irq_expected,
759 					    "Expected event channel IRQ but it didn't happen");
760 				shinfo->evtchn_pending[0] = 0;
761 
762 				if (verbose)
763 					printf("Testing guest EVTCHNOP_send direct to evtchn after memslot change\n");
764 				vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS,
765 							    DUMMY_REGION_GPA_2, DUMMY_REGION_SLOT_2, 1, 0);
766 				evtchn_irq_expected = true;
767 				alarm(1);
768 				break;
769 
770 			case TEST_EVTCHN_HCALL_EVENTFD:
771 				TEST_ASSERT(!evtchn_irq_expected,
772 					    "Expected event channel IRQ but it didn't happen");
773 				shinfo->evtchn_pending[0] = 0;
774 
775 				if (verbose)
776 					printf("Testing guest EVTCHNOP_send to eventfd\n");
777 				evtchn_irq_expected = true;
778 				alarm(1);
779 				break;
780 
781 			case TEST_TIMER_SETUP:
782 				TEST_ASSERT(!evtchn_irq_expected,
783 					    "Expected event channel IRQ but it didn't happen");
784 				shinfo->evtchn_pending[1] = 0;
785 
786 				if (verbose)
787 					printf("Testing guest oneshot timer\n");
788 				break;
789 
790 			case TEST_TIMER_WAIT:
791 				memset(&tmr, 0, sizeof(tmr));
792 				tmr.type = KVM_XEN_VCPU_ATTR_TYPE_TIMER;
793 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr);
794 				TEST_ASSERT(tmr.u.timer.port == EVTCHN_TIMER,
795 					    "Timer port not returned");
796 				TEST_ASSERT(tmr.u.timer.priority == KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL,
797 					    "Timer priority not returned");
798 				TEST_ASSERT(tmr.u.timer.expires_ns > rs->state_entry_time,
799 					    "Timer expiry not returned");
800 				evtchn_irq_expected = true;
801 				alarm(1);
802 				break;
803 
804 			case TEST_TIMER_RESTORE:
805 				TEST_ASSERT(!evtchn_irq_expected,
806 					    "Expected event channel IRQ but it didn't happen");
807 				shinfo->evtchn_pending[0] = 0;
808 
809 				if (verbose)
810 					printf("Testing restored oneshot timer\n");
811 
812 				tmr.u.timer.expires_ns = rs->state_entry_time + 100000000;
813 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
814 				evtchn_irq_expected = true;
815 				alarm(1);
816 				break;
817 
818 			case TEST_POLL_READY:
819 				TEST_ASSERT(!evtchn_irq_expected,
820 					    "Expected event channel IRQ but it didn't happen");
821 
822 				if (verbose)
823 					printf("Testing SCHEDOP_poll with already pending event\n");
824 				shinfo->evtchn_pending[0] = shinfo->evtchn_mask[0] = 1UL << EVTCHN_TIMER;
825 				alarm(1);
826 				break;
827 
828 			case TEST_POLL_TIMEOUT:
829 				if (verbose)
830 					printf("Testing SCHEDOP_poll timeout\n");
831 				shinfo->evtchn_pending[0] = 0;
832 				alarm(1);
833 				break;
834 
835 			case TEST_POLL_MASKED:
836 				if (verbose)
837 					printf("Testing SCHEDOP_poll wake on masked event\n");
838 
839 				tmr.u.timer.expires_ns = rs->state_entry_time + 100000000;
840 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
841 				alarm(1);
842 				break;
843 
844 			case TEST_POLL_WAKE:
845 				shinfo->evtchn_pending[0] = shinfo->evtchn_mask[0] = 0;
846 				if (verbose)
847 					printf("Testing SCHEDOP_poll wake on unmasked event\n");
848 
849 				evtchn_irq_expected = true;
850 				tmr.u.timer.expires_ns = rs->state_entry_time + 100000000;
851 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
852 
853 				/* Read it back and check the pending time is reported correctly */
854 				tmr.u.timer.expires_ns = 0;
855 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr);
856 				TEST_ASSERT(tmr.u.timer.expires_ns == rs->state_entry_time + 100000000,
857 					    "Timer not reported pending");
858 				alarm(1);
859 				break;
860 
861 			case SET_VCPU_INFO:
862 				if (has_shinfo_hva) {
863 					struct kvm_xen_vcpu_attr vih = {
864 						.type = KVM_XEN_VCPU_ATTR_TYPE_VCPU_INFO_HVA,
865 						.u.hva = (unsigned long)vinfo
866 					};
867 					vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &vih);
868 				}
869 				break;
870 
871 			case TEST_TIMER_PAST:
872 				TEST_ASSERT(!evtchn_irq_expected,
873 					    "Expected event channel IRQ but it didn't happen");
874 				/* Read timer and check it is no longer pending */
875 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr);
876 				TEST_ASSERT(!tmr.u.timer.expires_ns, "Timer still reported pending");
877 
878 				shinfo->evtchn_pending[0] = 0;
879 				if (verbose)
880 					printf("Testing timer in the past\n");
881 
882 				evtchn_irq_expected = true;
883 				tmr.u.timer.expires_ns = rs->state_entry_time - 100000000ULL;
884 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
885 				alarm(1);
886 				break;
887 
888 			case TEST_LOCKING_SEND_RACE:
889 				TEST_ASSERT(!evtchn_irq_expected,
890 					    "Expected event channel IRQ but it didn't happen");
891 				alarm(0);
892 
893 				if (verbose)
894 					printf("Testing shinfo lock corruption (KVM_XEN_HVM_EVTCHN_SEND)\n");
895 
896 				kvm_pthread_create(&thread, NULL, &juggle_shinfo_state, (void *)vm);
897 
898 				struct kvm_irq_routing_xen_evtchn uxe = {
899 					.port = 1,
900 					.vcpu = vcpu->id,
901 					.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL
902 				};
903 
904 				evtchn_irq_expected = true;
905 				for (time_t t = time(NULL) + SHINFO_RACE_TIMEOUT; time(NULL) < t;)
906 					__vm_ioctl(vm, KVM_XEN_HVM_EVTCHN_SEND, &uxe);
907 				break;
908 
909 			case TEST_LOCKING_POLL_RACE:
910 				TEST_ASSERT(!evtchn_irq_expected,
911 					    "Expected event channel IRQ but it didn't happen");
912 
913 				if (verbose)
914 					printf("Testing shinfo lock corruption (SCHEDOP_poll)\n");
915 
916 				shinfo->evtchn_pending[0] = 1;
917 
918 				evtchn_irq_expected = true;
919 				tmr.u.timer.expires_ns = rs->state_entry_time +
920 							 SHINFO_RACE_TIMEOUT * 1000000000ULL;
921 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
922 				break;
923 
924 			case TEST_LOCKING_POLL_TIMEOUT:
925 				/*
926 				 * Optional and possibly repeated sync point.
927 				 * Injecting the timer IRQ may fail if the
928 				 * shinfo is invalid when the timer expires.
929 				 * If the timer has expired but the IRQ hasn't
930 				 * been delivered, rearm the timer and retry.
931 				 */
932 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &tmr);
933 
934 				/* Resume the guest if the timer is still pending. */
935 				if (tmr.u.timer.expires_ns)
936 					break;
937 
938 				/* All done if the IRQ was delivered. */
939 				if (!evtchn_irq_expected)
940 					break;
941 
942 				tmr.u.timer.expires_ns = rs->state_entry_time +
943 							 SHINFO_RACE_TIMEOUT * 1000000000ULL;
944 				vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &tmr);
945 				break;
946 			case TEST_DONE:
947 				TEST_ASSERT(!evtchn_irq_expected,
948 					    "Expected event channel IRQ but it didn't happen");
949 
950 				kvm_pthread_cancel_join(thread);
951 				goto done;
952 
953 			case TEST_GUEST_SAW_IRQ:
954 				TEST_ASSERT(evtchn_irq_expected, "Unexpected event channel IRQ");
955 				evtchn_irq_expected = false;
956 				break;
957 			}
958 			break;
959 		}
960 		case UCALL_DONE:
961 			goto done;
962 		default:
963 			TEST_FAIL("Unknown ucall 0x%lx.", uc.cmd);
964 		}
965 	}
966 
967  done:
968 	evt_reset.type = KVM_XEN_ATTR_TYPE_EVTCHN;
969 	evt_reset.u.evtchn.flags = KVM_XEN_EVTCHN_RESET;
970 	vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &evt_reset);
971 
972 	alarm(0);
973 
974 	/*
975 	 * Just a *really* basic check that things are being put in the
976 	 * right place. The actual calculations are much the same for
977 	 * Xen as they are for the KVM variants, so no need to check.
978 	 */
979 	struct pvclock_wall_clock *wc;
980 	struct pvclock_vcpu_time_info *ti, *ti2;
981 	struct kvm_clock_data kcdata;
982 	long long delta;
983 
984 	wc = addr_gpa2hva(vm, SHINFO_REGION_GPA + 0xc00);
985 	ti = addr_gpa2hva(vm, SHINFO_REGION_GPA + 0x40 + 0x20);
986 	ti2 = addr_gpa2hva(vm, PVTIME_ADDR);
987 
988 	if (verbose) {
989 		printf("Wall clock (v %d) %d.%09d\n", wc->version, wc->sec, wc->nsec);
990 		printf("Time info 1: v %u tsc %" PRIu64 " time %" PRIu64 " mul %u shift %u flags %x\n",
991 		       ti->version, ti->tsc_timestamp, ti->system_time, ti->tsc_to_system_mul,
992 		       ti->tsc_shift, ti->flags);
993 		printf("Time info 2: v %u tsc %" PRIu64 " time %" PRIu64 " mul %u shift %u flags %x\n",
994 		       ti2->version, ti2->tsc_timestamp, ti2->system_time, ti2->tsc_to_system_mul,
995 		       ti2->tsc_shift, ti2->flags);
996 	}
997 
998 	TEST_ASSERT(wc->version && !(wc->version & 1),
999 		    "Bad wallclock version %x", wc->version);
1000 
1001 	vm_ioctl(vm, KVM_GET_CLOCK, &kcdata);
1002 
1003 	if (kcdata.flags & KVM_CLOCK_REALTIME) {
1004 		if (verbose) {
1005 			printf("KVM_GET_CLOCK clock: %lld.%09lld\n",
1006 			       kcdata.clock / NSEC_PER_SEC, kcdata.clock % NSEC_PER_SEC);
1007 			printf("KVM_GET_CLOCK realtime: %lld.%09lld\n",
1008 			       kcdata.realtime / NSEC_PER_SEC, kcdata.realtime % NSEC_PER_SEC);
1009 		}
1010 
1011 		delta = (wc->sec * NSEC_PER_SEC + wc->nsec) - (kcdata.realtime - kcdata.clock);
1012 
1013 		/*
1014 		 * KVM_GET_CLOCK gives CLOCK_REALTIME which jumps on leap seconds updates but
1015 		 * unfortunately KVM doesn't currently offer a CLOCK_TAI alternative. Accept 1s
1016 		 * delta as testing clock accuracy is not the goal here. The test just needs to
1017 		 * check that the value in shinfo is somewhat sane.
1018 		 */
1019 		TEST_ASSERT(llabs(delta) < NSEC_PER_SEC,
1020 			    "Guest's epoch from shinfo %d.%09d differs from KVM_GET_CLOCK %lld.%lld",
1021 			    wc->sec, wc->nsec, (kcdata.realtime - kcdata.clock) / NSEC_PER_SEC,
1022 			    (kcdata.realtime - kcdata.clock) % NSEC_PER_SEC);
1023 	} else {
1024 		pr_info("Missing KVM_CLOCK_REALTIME, skipping shinfo epoch sanity check\n");
1025 	}
1026 
1027 	TEST_ASSERT(ti->version && !(ti->version & 1),
1028 		    "Bad time_info version %x", ti->version);
1029 	TEST_ASSERT(ti2->version && !(ti2->version & 1),
1030 		    "Bad time_info version %x", ti->version);
1031 
1032 	if (do_runstate_tests) {
1033 		/*
1034 		 * Fetch runstate and check sanity. Strictly speaking in the
1035 		 * general case we might not expect the numbers to be identical
1036 		 * but in this case we know we aren't running the vCPU any more.
1037 		 */
1038 		struct kvm_xen_vcpu_attr rst = {
1039 			.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_DATA,
1040 		};
1041 		vcpu_ioctl(vcpu, KVM_XEN_VCPU_GET_ATTR, &rst);
1042 
1043 		if (verbose) {
1044 			printf("Runstate: %s(%d), entry %" PRIu64 " ns\n",
1045 			       rs->state <= RUNSTATE_offline ? runstate_names[rs->state] : "unknown",
1046 			       rs->state, rs->state_entry_time);
1047 			for (int i = RUNSTATE_running; i <= RUNSTATE_offline; i++) {
1048 				printf("State %s: %" PRIu64 " ns\n",
1049 				       runstate_names[i], rs->time[i]);
1050 			}
1051 		}
1052 
1053 		/*
1054 		 * Exercise runstate info at all points across the page boundary, in
1055 		 * 32-bit and 64-bit mode. In particular, test the case where it is
1056 		 * configured in 32-bit mode and then switched to 64-bit mode while
1057 		 * active, which takes it onto the second page.
1058 		 */
1059 		unsigned long runstate_addr;
1060 		struct compat_vcpu_runstate_info *crs;
1061 		for (runstate_addr = SHINFO_REGION_GPA + PAGE_SIZE + PAGE_SIZE - sizeof(*rs) - 4;
1062 		     runstate_addr < SHINFO_REGION_GPA + PAGE_SIZE + PAGE_SIZE + 4; runstate_addr++) {
1063 
1064 			rs = addr_gpa2hva(vm, runstate_addr);
1065 			crs = (void *)rs;
1066 
1067 			memset(rs, 0xa5, sizeof(*rs));
1068 
1069 			/* Set to compatibility mode */
1070 			lm.u.long_mode = 0;
1071 			vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &lm);
1072 
1073 			/* Set runstate to new address (kernel will write it) */
1074 			struct kvm_xen_vcpu_attr st = {
1075 				.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADDR,
1076 				.u.gpa = runstate_addr,
1077 			};
1078 			vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &st);
1079 
1080 			if (verbose)
1081 				printf("Compatibility runstate at %08lx\n", runstate_addr);
1082 
1083 			TEST_ASSERT(crs->state == rst.u.runstate.state, "Runstate mismatch");
1084 			TEST_ASSERT(crs->state_entry_time == rst.u.runstate.state_entry_time,
1085 				    "State entry time mismatch");
1086 			TEST_ASSERT(crs->time[RUNSTATE_running] == rst.u.runstate.time_running,
1087 				    "Running time mismatch");
1088 			TEST_ASSERT(crs->time[RUNSTATE_runnable] == rst.u.runstate.time_runnable,
1089 				    "Runnable time mismatch");
1090 			TEST_ASSERT(crs->time[RUNSTATE_blocked] == rst.u.runstate.time_blocked,
1091 				    "Blocked time mismatch");
1092 			TEST_ASSERT(crs->time[RUNSTATE_offline] == rst.u.runstate.time_offline,
1093 				    "Offline time mismatch");
1094 			TEST_ASSERT(crs->time[RUNSTATE_offline + 1] == 0xa5a5a5a5a5a5a5a5ULL,
1095 				    "Structure overrun");
1096 			TEST_ASSERT(crs->state_entry_time == crs->time[0] +
1097 				    crs->time[1] + crs->time[2] + crs->time[3],
1098 				    "runstate times don't add up");
1099 
1100 
1101 			/* Now switch to 64-bit mode */
1102 			lm.u.long_mode = 1;
1103 			vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &lm);
1104 
1105 			memset(rs, 0xa5, sizeof(*rs));
1106 
1107 			/* Don't change the address, just trigger a write */
1108 			struct kvm_xen_vcpu_attr adj = {
1109 				.type = KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADJUST,
1110 				.u.runstate.state = (u64)-1
1111 			};
1112 			vcpu_ioctl(vcpu, KVM_XEN_VCPU_SET_ATTR, &adj);
1113 
1114 			if (verbose)
1115 				printf("64-bit runstate at %08lx\n", runstate_addr);
1116 
1117 			TEST_ASSERT(rs->state == rst.u.runstate.state, "Runstate mismatch");
1118 			TEST_ASSERT(rs->state_entry_time == rst.u.runstate.state_entry_time,
1119 				    "State entry time mismatch");
1120 			TEST_ASSERT(rs->time[RUNSTATE_running] == rst.u.runstate.time_running,
1121 				    "Running time mismatch");
1122 			TEST_ASSERT(rs->time[RUNSTATE_runnable] == rst.u.runstate.time_runnable,
1123 				    "Runnable time mismatch");
1124 			TEST_ASSERT(rs->time[RUNSTATE_blocked] == rst.u.runstate.time_blocked,
1125 				    "Blocked time mismatch");
1126 			TEST_ASSERT(rs->time[RUNSTATE_offline] == rst.u.runstate.time_offline,
1127 				    "Offline time mismatch");
1128 			TEST_ASSERT(rs->time[RUNSTATE_offline + 1] == 0xa5a5a5a5a5a5a5a5ULL,
1129 				    "Structure overrun");
1130 
1131 			TEST_ASSERT(rs->state_entry_time == rs->time[0] +
1132 				    rs->time[1] + rs->time[2] + rs->time[3],
1133 				    "runstate times don't add up");
1134 		}
1135 	}
1136 
1137 	kvm_vm_free(vm);
1138 	return 0;
1139 }
1140