Add tests that expect a nested vm exit, due to an unsupported instruction, to be handled by L0 even if L1 intercepts are set for that instruction. The new test exercises bug fixed by: https://lore.kernel.org/all/20251205070630.4013452-1-chengkev@google.com/ Signed-off-by: Kevin Cheng --- lib/x86/processor.h | 1 + x86/svm.h | 5 ++- x86/svm_tests.c | 88 +++++++++++++++++++++++++++++++++++++++++++++ x86/unittests.cfg | 11 +++++- 4 files changed, 103 insertions(+), 2 deletions(-) diff --git a/lib/x86/processor.h b/lib/x86/processor.h index 42dd2d2a4787c..7e1c562aa7378 100644 --- a/lib/x86/processor.h +++ b/lib/x86/processor.h @@ -358,6 +358,7 @@ struct x86_cpu_feature { * Extended Leafs, a.k.a. AMD defined */ #define X86_FEATURE_SVM X86_CPU_FEATURE(0x80000001, 0, ECX, 2) +#define X86_FEATURE_SKINIT X86_CPU_FEATURE(0x80000001, 0, ECX, 12) #define X86_FEATURE_PERFCTR_CORE X86_CPU_FEATURE(0x80000001, 0, ECX, 23) #define X86_FEATURE_NX X86_CPU_FEATURE(0x80000001, 0, EDX, 20) #define X86_FEATURE_GBPAGES X86_CPU_FEATURE(0x80000001, 0, EDX, 26) diff --git a/x86/svm.h b/x86/svm.h index c22c252fed001..e2158ab0622bb 100644 --- a/x86/svm.h +++ b/x86/svm.h @@ -406,7 +406,10 @@ struct __attribute__ ((__packed__)) vmcb { #define SVM_EXIT_MONITOR 0x08a #define SVM_EXIT_MWAIT 0x08b #define SVM_EXIT_MWAIT_COND 0x08c -#define SVM_EXIT_NPF 0x400 +#define SVM_EXIT_XSETBV 0x08d +#define SVM_EXIT_RDPRU 0x08e +#define SVM_EXIT_INVPCID 0x0a2 +#define SVM_EXIT_NPF 0x400 #define SVM_EXIT_ERR -1 diff --git a/x86/svm_tests.c b/x86/svm_tests.c index e732fb4eeea38..8ea3c344ec4fa 100644 --- a/x86/svm_tests.c +++ b/x86/svm_tests.c @@ -3575,6 +3575,93 @@ static void svm_shutdown_intercept_test(void) report(vmcb->control.exit_code == SVM_EXIT_SHUTDOWN, "shutdown test passed"); } +struct invpcid_desc desc; + +asm( + "insn_rdtscp: rdtscp;ret\n\t" + "insn_skinit: skinit;ret\n\t" + "insn_xsetbv: xor %eax, %eax; xor %edx, %edx; xor %ecx, %ecx; xsetbv;ret\n\t" + "insn_rdpru: xor %ecx, %ecx; rdpru;ret\n\t" + "insn_invpcid: xor %eax, %eax; invpcid desc, %rax;ret\n\t" +); + +extern void insn_rdtscp(struct svm_test *test); +extern void insn_skinit(struct svm_test *test); +extern void insn_xsetbv(struct svm_test *test); +extern void insn_rdpru(struct svm_test *test); +extern void insn_invpcid(struct svm_test *test); + +struct insn_table { + const char *name; + u64 intercept; + void (*insn_func)(struct svm_test *test); + u32 reason; +}; + +static struct insn_table insn_table[] = { + { "RDTSCP", INTERCEPT_RDTSCP, insn_rdtscp, SVM_EXIT_RDTSCP}, + { "SKINIT", INTERCEPT_SKINIT, insn_skinit, SVM_EXIT_SKINIT}, + { "XSETBV", INTERCEPT_XSETBV, insn_xsetbv, SVM_EXIT_XSETBV}, + { "RDPRU", INTERCEPT_RDPRU, insn_rdpru, SVM_EXIT_RDPRU}, + { "INVPCID", INTERCEPT_INVPCID, insn_invpcid, SVM_EXIT_INVPCID}, + { NULL }, +}; + +static void assert_unsupported_instructions(void) +{ + assert(!this_cpu_has(X86_FEATURE_RDTSCP)); + assert(!this_cpu_has(X86_FEATURE_SKINIT)); + assert(!this_cpu_has(X86_FEATURE_XSAVE)); + assert(!this_cpu_has(X86_FEATURE_RDPRU)); + assert(!this_cpu_has(X86_FEATURE_INVPCID)); +} + +/* + * Test that L1 does not intercept instructions that are not advertised in + * guest CPUID. + */ +static void svm_unsupported_instruction_intercept_test(void) +{ + u32 cur_insn; + u32 exit_code; + + assert_unsupported_instructions(); + + vmcb_set_intercept(INTERCEPT_EXCEPTION_OFFSET + UD_VECTOR); + + for (cur_insn = 0; insn_table[cur_insn].name != NULL; ++cur_insn) { + struct insn_table insn = insn_table[cur_insn]; + + test_set_guest(insn.insn_func); + vmcb_set_intercept(insn.intercept); + svm_vmrun(); + exit_code = vmcb->control.exit_code; + + if (exit_code == SVM_EXIT_EXCP_BASE + UD_VECTOR) + report_pass("UD Exception injected"); + else if (exit_code == insn.reason) + report_fail("L1 should not intercept %s when instruction is not advertised in guest CPUID", + insn.name); + else + report_fail("Unknown exit reason, 0x%x", exit_code); + + /* + * Verify that the intercept bits are not cleared in the vmcb. + * This is mainly to catch any potential bugs in the future + * if we ever directly copy from the cached vmcb12 to L1's + * vmcb12. KVM currently ignores the L1 intercept by + * conditionally clearing intercept bits from KVM's cached + * vmcb12 based on guest's CPUID table. This is only allowed as + * long as the assumption that the cached vmcb12 doesn't affect + * L1's vmcb12 holds true. + */ + report(test_and_clear_bit(insn.intercept, + vmcb->control.intercept), + "%s intercept bit not cleared by KVM", + insn.name); + } +} + struct svm_test svm_tests[] = { { "null", default_supported, default_prepare, default_prepare_gif_clear, null_test, @@ -3716,6 +3803,7 @@ struct svm_test svm_tests[] = { TEST(svm_tsc_scale_test), TEST(pause_filter_test), TEST(svm_shutdown_intercept_test), + TEST(svm_unsupported_instruction_intercept_test), { NULL, NULL, NULL, NULL, NULL, NULL, NULL } }; diff --git a/x86/unittests.cfg b/x86/unittests.cfg index 522318d32bf68..27a1a68104362 100644 --- a/x86/unittests.cfg +++ b/x86/unittests.cfg @@ -253,11 +253,20 @@ arch = x86_64 [svm] file = svm.flat smp = 2 -test_args = "-pause_filter_test" +test_args = "-pause_filter_test -svm_unsupported_instruction_intercept_test" qemu_params = -cpu max,+svm -m 4g arch = x86_64 groups = svm +# RDPRU feature name is not defined in Qemu so it can't be excluded here. This +# should be okay though since KVM does not advertise RDPRU by default anyways. +[svm_unsupported_instruction_intercept_test] +file = svm.flat +test_args = "svm_unsupported_instruction_intercept_test" +qemu_params = -cpu max,+svm,-rdtscp,-xsave,-invpcid,-skinit +arch = x86_64 +groups = svm + [svm_pause_filter] file = svm.flat test_args = pause_filter_test -- 2.52.0.351.gbe84eed79e-goog