// Copyright 2017 The Fuchsia Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "hypervisor_tests_constants.h"

#define IA32_GS_BASE              0xc0000101
#define X86_MSR_IA32_STAR         0xc0000081
#define X86_MSR_IA32_LSTAR        0xc0000082
#define X86_MSR_IA32_SYSENTER_CS  0x00000174
#define X86_MSR_IA32_SYSENTER_ESP 0x00000175
#define X86_MSR_IA32_SYSENTER_EIP 0x00000176
#define X86_MSR_IA32_EFER         0xc0000080
#define ABSOLUTE_ADDR(base, x)    (x - base + GUEST_ENTRY)
#define CODE_32_SELECTOR          (1<<3)
#define CODE_64_SELECTOR          (2<<3)
#define DATA_SELECTOR             (3<<3)
#define USER_CODE_32_SELECTOR     (4<<3)
#define USER_DATA_SELECTOR        (5<<3)
#define USER_CODE_64_SELECTOR     (6<<3)
#define CODE_16_SELECTOR          (8<<3)
#define INVALID_HYPERCALL         0xffffffff

.text

// Define new function 'name'.
// Local label '1:' used by other macros to compute offsets.
.macro FUNCTION name
    .global \name
    .type \name, STT_FUNC
    \name:
    1:
.endm

.macro init_gdt start
    lgdt ABSOLUTE_ADDR(\start, gdtr_for_\start)
    mov $GUEST_ENTRY + 0x1000, %rsp
    jmp end_of_init_gdt_for_\start

.align 8
gdt_for_\start:
    // Null entry.
    .8byte 0
    // CODE_32_SELECTOR
    .2byte 0xffff                                   // Limit 15:00
    .2byte 0x0000                                   // Base 15:00
    .byte  0x00                                     // Base 23:16
    .byte  0b10011010                               // P(1) DPL(00) S(1) 1 C(0) R(1) A(0)
    .byte  0b11001111                               // G(1) D(1) L(0) AVL(0) Limit 19:16
    .byte  0x0                                      // Base 31:24
    // CODE_64_SELECTOR
    .2byte 0xffff                                   // Limit 15:00
    .2byte 0x0000                                   // Base 15:00
    .byte  0x00                                     // Base 23:16
    .byte  0b10011010                               // P(1) DPL(00) S(1) 1 C(0) R(1) A(0)
    .byte  0b10101111                               // G(1) D(0) L(1) AVL(0) Limit 19:16
    .byte  0x0                                      // Base 31:24
    // DATA_SELECTOR
    .2byte 0xffff                                   // Limit 15:00
    .2byte 0x0000                                   // Base 15:00
    .byte  0x00                                     // Base 23:16
    .byte  0b10010010                               // P(1) DPL(00) S(1) 0 E(0) W(1) A(0)
    .byte  0b11001111                               // G(1) B(1) L(0) AVL(0) Limit 19:16
    .byte  0x0                                      // Base 31:24
    // USER_CODE_32_SELECTOR
    .2byte 0xffff                                   // Limit 15:00
    .2byte 0x0000                                   // Base 15:00
    .byte  0x00                                     // Base 23:16
    .byte  0b11111010                               // P(1) DPL(11) S(1) 1 C(0) R(1) A(0)
    .byte  0b11001111                               // G(1) D(1) L(0) AVL(0) Limit 19:16
    .byte  0x0                                      // Base 31:24
    // USER_DATA_SELECTOR
    .2byte 0xffff                                   // Limit 15:00
    .2byte 0x0000                                   // Base 15:00
    .byte  0x00                                     // Base 23:16
    .byte  0b11110010                               // P(1) DPL(11) S(1) 0 E(0) W(1) A(0)
    .byte  0b11001111                               // G(1) B(1) 0 0 limit 19:16
    .byte  0x0                                      // Base 31:24
    // USER_CODE_64_SELECTOR
    .2byte 0xffff                                   // Limit 15:00
    .2byte 0x0000                                   // Base 15:00
    .byte  0x00                                     // Base 23:16
    .byte  0b11111010                               // P(1) DPL(11) S(1) 1 C(0) R(1) A(0)
    .byte  0b10101111                               // G(1) D(0) L(1) AVL(0) Limit 19:16
    .byte  0x0                                      // Base 31:24
    // USER_DATA_SELECTOR duplicate for sysexit
    .2byte 0xffff                                   // Limit 15:00
    .2byte 0x0000                                   // Base 15:00
    .byte  0x00                                     // Base 23:16
    .byte  0b11110010                               // P(1) DPL(11) S(1) 0 E(0) W(1) A(0)
    .byte  0b11001111                               // G(1) B(1) 0 0 limit 19:16
    .byte  0x0                                      // Base 31:24
    // CODE_16_SELECTOR
    .2byte 0xffff                                   // Limit 15:00
    .2byte 0x0000                                   // Base 15:00
    .byte  0x00                                     // Base 23:16
    .byte  0b10011010                               // P(1) DPL(00) S(1) 1 C(0) R(1) A(0)
    .byte  0b10001111                               // G(1) D(0) L(0) AVL(0) Limit 19:16
    .byte  0x0                                      // Base 31:24
gdtr_for_\start:
    .2byte gdtr_for_\start - gdt_for_\start - 1
    .8byte ABSOLUTE_ADDR(\start, gdt_for_\start)
end_of_init_gdt_for_\start:
.endm

.macro isr start, n
int_\n\()_for_\start:
    mov $\n, %rax
    movq $0, (EXIT_TEST_ADDR)
.endm

.macro idt start, n
    .2byte ABSOLUTE_ADDR(\start, \
                         int_\n\()_for_\start)      // Offset 15:00
    .2byte CODE_64_SELECTOR                         // Segment selector
    .byte  0                                        // IST(000)
    .byte  0b10001110                               // P(1) DPL(00) 0 Type(1110)
    .2byte 0                                        // Offset 31:16
    .4byte 0                                        // Offset 63:32
    .4byte 0                                        // Reserved
.endm

.macro init_interrupt_handling start
    init_gdt \start
    lidt ABSOLUTE_ADDR(\start, idtr_for_\start)
    mov $GUEST_ENTRY + 0x1000, %rsp
    jmp end_of_\start

.irp n, 0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15, \
       16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32
    isr \start \n
.endr

.align 8
idt_for_\start:
.irp n, 0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15, \
       16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32
    idt \start \n
.endr

idtr_for_\start:
    .2byte idtr_for_\start - idt_for_\start - 1     // Limit
    .8byte ABSOLUTE_ADDR(\start, idt_for_\start)    // Address
end_of_\start:
.endm

// Test vcpu_resume.
FUNCTION vcpu_resume_start
    // Test that we do not exit on load/store of CR3.
    mov %cr3, %rax
    mov %rax, %cr3

    // Test that we do not exit on store of GS_BASE.
    xor %eax, %eax
    xor %edx, %edx
    mov $IA32_GS_BASE, %ecx
    wrmsr

    // Test that we handle CPUID instruction correctly.
    xor %eax, %eax
    cpuid

    movq $0, (EXIT_TEST_ADDR)
FUNCTION vcpu_resume_end

// Test vcpu_read_state and vcpu_write_state.
FUNCTION vcpu_read_write_state_start
    add $1, %rax
    add $2, %rcx
    add $3, %rdx
    add $4, %rbx
    add $5, %rsp
    add $6, %rbp
    add $7, %rsi
    add $8, %rdi
    add $9, %r8
    add $10, %r9
    add $11, %r10
    add $12, %r11
    add $13, %r12
    add $14, %r13
    add $15, %r14
    add $16, %r15

    stc  // Set carry flag (bit 0)
    stac // Set AC flag (bit 18)

    movq $0, (EXIT_TEST_ADDR)
FUNCTION vcpu_read_write_state_end

// Test vcpu_interrupt.
FUNCTION vcpu_interrupt_start
    init_interrupt_handling vcpu_interrupt_start
    sti
    movq $0, (EXIT_TEST_ADDR)
    jmp .
FUNCTION vcpu_interrupt_end

// Test guest_set_trap using a memory-based trap.
FUNCTION guest_set_trap_start
    movq $0, (TRAP_ADDR)
    movq $0, (EXIT_TEST_ADDR)
FUNCTION guest_set_trap_end

// Test guest HLT instruction handling.
FUNCTION vcpu_hlt_start
    init_interrupt_handling vcpu_hlt_start
    sti
    hlt
FUNCTION vcpu_hlt_end

// Test that pause exiting works correctly.
FUNCTION vcpu_pause_start
    pause
    movq $0, (EXIT_TEST_ADDR)
FUNCTION vcpu_pause_end

// Test that reading and writing cr0 works correctly.
FUNCTION vcpu_write_cr0_start
    // Read cr0.
    mov %cr0, %rax

    // Copy the initial value into rbx to be checked after exiting to the host.
    mov %rax, %rbx

    // Toggle NE and CD. These bits are in the guest/host mask.
    // Note: NW should already be clear, but CD=0 NW=1 is an invalid state.
    and $~(X86_CR0_CD | X86_CR0_NW), %rax
    or $X86_CR0_NE, %rax
    mov %rax, %cr0

    // Load cr0 to test masking and shadowing. NE, NW, and CD should be shadowed
    // and will be checked after exiting back to the host.
    mov %cr0, %rax

    movq $0, (EXIT_TEST_ADDR)
FUNCTION vcpu_write_cr0_end

// Test writing an invalid value to CR0.
FUNCTION vcpu_write_invalid_cr0_start
    init_interrupt_handling vcpu_write_invalid_cr0_start

    // Read cr0.
    mov %cr0, %rax

    // CD=0 NW=1 is an invalid state.
    and $~X86_CR0_CD, %rax
    or $X86_CR0_NW, %rax
    mov %rax, %cr0

    // The previous instruction should generate a GP.
    jmp .
FUNCTION vcpu_write_invalid_cr0_end

// Test 32 bit compatibility mode (long mode disabled).
FUNCTION vcpu_compat_mode_start
    init_gdt vcpu_compat_mode_start
    movq $0, %rbx
    movq $0, %rcx

    // Drop into compatibility mode
    pushq $CODE_32_SELECTOR
    lea vcpu_compat_mode_code(%rip),%rax
    pushq %rax
    lretq

.code32
vcpu_compat_mode_code:
    // Hack to check if we're x86 or x64. In x86, 0x41 is `inc %ecx` and loop
    // falls through. In x64, 0x41 is the REX.B prefix and %ecx is not
    // incremented so loop jmps to vcpu_compat_mode_exit.
    xor %ecx,%ecx
    .byte 0x41 // x86: inc %ecx; x64: rex.B prefix
    loop vcpu_compat_mode_exit

    // Write a value to ebx to check in guest.cpp
    mov $1,%ebx

    // Go back to long mode
    pushl $CODE_64_SELECTOR
    pushl $ABSOLUTE_ADDR(vcpu_compat_mode_start, vcpu_compat_mode_test16)
    lret
.code64

vcpu_compat_mode_test16:
    // Drop into compatibility mode with 16 bit default operands.
    pushq $CODE_16_SELECTOR
    lea vcpu_compat_mode_code16(%rip),%rax
    pushq %rax
    lretq

.code32
vcpu_compat_mode_code16:
    // The default operand size should be 16 bits and push should subtract 2
    // from the stack pointer.
    mov %esp,%eax
    sub $2,%eax
    push $0
    cmp %esp,%eax
    pop %eax
    jne vcpu_compat_mode_code16_done

    // Write a value to ebx to check in guest.cpp
    mov $2,%ecx

    // Go back to long mode
vcpu_compat_mode_code16_done:
    pushl $CODE_64_SELECTOR
    pushl $ABSOLUTE_ADDR(vcpu_compat_mode_start, vcpu_compat_mode_done)
    lret
.code64

vcpu_compat_mode_done:
    // Fix the data segment selectors
    mov $DATA_SELECTOR,%rax
    mov %rax,%ds
    mov %rax,%es
    mov %rax,%fs
    mov %rax,%gs
    mov %rax,%ss

vcpu_compat_mode_exit:
    movq $0, (EXIT_TEST_ADDR)
FUNCTION vcpu_compat_mode_end

FUNCTION vcpu_syscall_start
    init_interrupt_handling vcpu_syscall_start

    xor %eax, %eax
    mov $((USER_CODE_32_SELECTOR << 16) | CODE_64_SELECTOR), %edx
    mov $X86_MSR_IA32_STAR, %ecx
    wrmsr

    xor %edx, %edx
    mov $ABSOLUTE_ADDR(vcpu_syscall_start, vcpu_syscall_done), %eax
    mov $X86_MSR_IA32_LSTAR, %ecx
    wrmsr

    pushfq
    pop %r11
    mov $ABSOLUTE_ADDR(vcpu_syscall_start, vcpu_syscall_ring3), %rcx
    sysretq

vcpu_syscall_ring3:
    syscall

vcpu_syscall_done:
    movq $0, (EXIT_TEST_ADDR)
FUNCTION vcpu_syscall_end

FUNCTION vcpu_sysenter_start
    init_interrupt_handling vcpu_sysenter_start

    xor %edx, %edx
    mov $CODE_64_SELECTOR, %eax
    mov $X86_MSR_IA32_SYSENTER_CS, %ecx
    wrmsr

    mov $ABSOLUTE_ADDR(vcpu_sysenter_start, vcpu_sysenter_done), %eax
    mov $X86_MSR_IA32_SYSENTER_EIP, %ecx
    wrmsr

    mov %esp, %eax
    mov $X86_MSR_IA32_SYSENTER_ESP, %ecx
    wrmsr

    mov %rsp, %rdx
    mov $ABSOLUTE_ADDR(vcpu_sysenter_start, vcpu_sysenter_ring3), %rdx
    .byte 0x48 // rex.W
    sysexit

vcpu_sysenter_ring3:
    sysenter

vcpu_sysenter_done:
    movq $0, (EXIT_TEST_ADDR)
FUNCTION vcpu_sysenter_end

FUNCTION vcpu_sysenter_compat_start
    init_interrupt_handling vcpu_sysenter_compat_start

    xor %edx, %edx
    mov $CODE_64_SELECTOR, %eax
    mov $X86_MSR_IA32_SYSENTER_CS, %ecx
    wrmsr

    mov $ABSOLUTE_ADDR(vcpu_sysenter_compat_start, vcpu_sysenter_compat_done), %eax
    mov $X86_MSR_IA32_SYSENTER_EIP, %ecx
    wrmsr

    mov %esp, %eax
    mov $X86_MSR_IA32_SYSENTER_ESP, %ecx
    wrmsr

    mov %rsp, %rdx
    mov $ABSOLUTE_ADDR(vcpu_sysenter_compat_start, vcpu_sysenter_compat_ring3), %rdx
    sysexit

.code32
vcpu_sysenter_compat_ring3:
    sysenter
.code64

vcpu_sysenter_compat_done:
    movq $0, (EXIT_TEST_ADDR)
FUNCTION vcpu_sysenter_compat_end

FUNCTION vcpu_vmcall_invalid_number_start
    movq $(INVALID_HYPERCALL), %rax
    vmcall
    movq $0, (EXIT_TEST_ADDR)
FUNCTION vcpu_vmcall_invalid_number_end

FUNCTION vcpu_vmcall_invalid_cpl_start
    init_interrupt_handling vcpu_vmcall_invalid_cpl_start

    xor %eax, %eax
    mov $((USER_CODE_64_SELECTOR << 16) | CODE_64_SELECTOR), %edx
    mov $X86_MSR_IA32_STAR, %ecx
    wrmsr

    pushfq
    mov $ABSOLUTE_ADDR(vcpu_vmcall_invalid_cpl_start, vcpu_vmcall_invalid_cpl_ring3), %rcx
    sysretq

vcpu_vmcall_invalid_cpl_ring3:
    movq $(INVALID_HYPERCALL), %rax
    vmcall
    movq $0, (EXIT_TEST_ADDR)
FUNCTION vcpu_vmcall_invalid_cpl_end

FUNCTION vcpu_extended_registers_start
    // Enable SSE instructions.
    mov %cr4, %rax
    or $(X86_CR4_OSFXSR), %rax
    mov %rax, %cr4

    // Store data in xmm0.
    movdqu xmm_data(%rip), %xmm0

    movq $0, (EXIT_TEST_ADDR)

    // Read data back from xmm0 into rax:rbx.
    movq %xmm0, %rax
    movhlps %xmm0, %xmm0
    movq %xmm0, %rbx

    movq $0, (EXIT_TEST_ADDR)

    // Disable SSE instructions
    mov %cr4, %rax
    and $(~(X86_CR4_OSFXSR)), %rax
    mov %rax, %cr4

    movq $0, (EXIT_TEST_ADDR)
    // If we can get back here then the host correctly handled our sse state becoming reduced
    movq $0, (EXIT_TEST_ADDR)

.align 16
xmm_data:
    .4byte 0x01234567
    .4byte 0x89abcdef
    .4byte 0xfedcba98
    .4byte 0x76543210
FUNCTION vcpu_extended_registers_end

// Test guest_set_trap using an IO-based trap.
FUNCTION guest_set_trap_with_io_start
    out %al, $TRAP_PORT
    movq $0, (EXIT_TEST_ADDR)
FUNCTION guest_set_trap_with_io_end