linux.git/tools/testing/selftests/kvm/lib/x86, branch master

KVM: selftests: Do not intercept #PF by default in nVMX tests

2026-07-29T12:45:52+00:00

init_vmcs_control_fields() sets PFEC_MASK and PFEC_MATCH so that they
never match, which reverses the meaning of the PF_VECTOR bit in
EXCEPTION_BITMAP (which is zeroed), effectively enabling #PF
interception by default.

The relevant part of the SDM describes this:

  When a page fault occurs, a processor consults (1) bit 14 of the
  exception bitmap; (2) the error code produced with the page fault [PFEC];
  (3) the page-fault error-code mask field [PFEC_MASK]; and (4) the
  page-fault error-code match field [PFEC_MATCH].

  It checks if PFEC & PFEC_MASK = PFEC_MATCH.  If there is equality, the
  specification of bit 14 in the exception bitmap is followed (for example,
  a VM exit occurs if that bit is set). If there is inequality, the meaning
  of that bit is reversed (for example, a VM exit occurs if that bit is
  clear).

Clear PFEC_MATCH such that there is equality, and the #PF bit in the
exception bitmap is followed, so that #PFs are not intercepted by default,
same as every other exception.  This also allows tests to set the #PF bit
in the exception bitmap if they want to intercept #PFs, without having to
muck with the PFEC_{MASK,MATCH} fields.

Suggested-by: Sean Christopherson 
Signed-off-by: Yosry Ahmed 
Link: https://patch.msgid.link/20260728174232.2423257-10-yosry@kernel.org
Signed-off-by: Sean Christopherson

KVM: selftests: Expose PTE masks to guests as part of an MMU

2026-07-29T12:45:27+00:00

Expose a guest_mmu to the guest to allow guest code to use the PTE masks
for page table manipulation. Since guest page tables are not mapped in
the guest by default, zero the PGD in guest_mmu in an attempt to make it
more difficult for new tests to shoot themselves in the foot and assume
that page tables can be immediately used by guest code.

Ultimately, guest code can read CR3 any way, so guest_mmu.pgd doesn't
add a lot of value.

Suggested-by: Sean Christopherson 
Signed-off-by: Yosry Ahmed 
Link: https://patch.msgid.link/20260728174232.2423257-9-yosry@kernel.org
Signed-off-by: Sean Christopherson

KVM: selftests: Drop HORRIFIC_L2_UCALL_CLOBBER_HACK

2026-07-29T12:45:26+00:00

Now that nVMX test codes preserves GPRs across nested VM-Exits
(specifically RBP, RDX, and RDI among others), drop the ucall-specific
hack to avoid clobbering these registers.

Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Yosry Ahmed 
Link: https://patch.msgid.link/20260728174232.2423257-7-yosry@kernel.org
Signed-off-by: Sean Christopherson

KVM: selftests: Handle rflags save/restore for SVM in guest_regs

2026-07-29T12:45:26+00:00

Instead of handling rflags separately, add it to guest_regs. No
functional change intended.

Assisted-by: Gemini:Gemini-Next
Signed-off-by: Yosry Ahmed 
Link: https://patch.msgid.link/20260728174232.2423257-5-yosry@kernel.org
Signed-off-by: Sean Christopherson

KVM: selftests: Rework GPR registers switching for SVM (and fix offsets)

2026-07-29T12:45:26+00:00

The assembly code defined by SAVE_GPR_C uses the wrong offsets for some
registers in guest_regs. For example, the offset of RCX should be 0x08
not 0x10. Also, the last offset in the struct (R15) is 0x78, not 0x80,
so the code actually saves and restore beyond the end of gpr64_regs.

Eliminate hardcoded offsets by dynamically generating offsets using
offset_of() and using macros to pass the offsets to assembly as asm
constraints.

To avoid register conflicts in inline assembly (since almost all GPRs are
context-switched), access guest_regs via absolute symbol addressing
(guest_regs + offset) rather than using a base register which could
get overwritten mid-assembly.

While at it, rename SAVE_GPR_C and LOAD_GPR_C to a single macro,
SVM_SWITCH_GPRS_ASM, rename gpr64_regs to guest_regs, and expose it in
processor.h (in preparation for reusing it for VMX).

Assisted-by: Gemini:Gemini-Next
Signed-off-by: Yosry Ahmed 
Link: https://patch.msgid.link/20260728174232.2423257-4-yosry@kernel.org
Signed-off-by: Sean Christopherson

KVM: selftests: Fix RAX and RFLAGS VMCB offsets when running L2

2026-07-29T12:45:26+00:00

The offsets used (0x170 and 0x1f8) are offsets within vmcb_save_area,
not vmcb. The correct offsets should include the base of vmcb_save_area
within vmcb (which is 0x400 -- so 0x570 and 0x5f8).

Instead of just correcting the offsets, use vmcb->save.rax and
vmcb->save.rflags as parameters to the asm block and avoid hardcoding
offsets completely. While at it, also use guest_regs.rax directly
instead of assuming it's at offset 0 of guest_regs.

Note: "+m" must be used for vmcb_rax and vmcb_rflags, as caching those
fields in registers would be wrong as the underlying KVM will update
them in memory.

The same problem was recently fixed (differently) for kvm-unit-tests
[1].

[1]https://lore.kernel.org/all/20260521092311.86030-1-pbonzini@redhat.com/

Reported-by: Sashiko 
Closes: https://sashiko.dev/#/patchset/20260518202514.2037078-1-yosry%40kernel.org?part=1
Signed-off-by: Yosry Ahmed 
Link: https://patch.msgid.link/20260728174232.2423257-3-yosry@kernel.org
Signed-off-by: Sean Christopherson

KVM: selftests: Drop L1-provided stacks for L2 guests on x86

2026-06-18T00:56:15+00:00

Now that a dedicated page is allocated for L2's stack and stuffed in
RSP, the L1-provided stack is unused. Drop the stacks allocated by L1
guest code for L2 in all x86 tests.

Suggested-by: Sean Christopherson 
Signed-off-by: Yosry Ahmed 
Link: https://patch.msgid.link/20260610003030.2957261-4-seanjc@google.com
Signed-off-by: Sean Christopherson

KVM: selftests: Allocate a dedicated guest page for x86 L2 guest stack

2026-06-18T00:56:15+00:00

Instead of relying on the L1-provided stack for L2, which is usually an
array on L1's own stack, allocate a dedicated page of VM memory for the
L2 stack in vcpu_alloc_{vmx/svm}() and use that as L2's RSP in the
VMCS/VMCB instead of the L1-provided value.

Most L1 guest code does not do anything with the L2 stack other than
stuff it in RSP, so this change is transparent and the L1-provided stack
is silently ignored. The only exception is memstress nested L1 code
which puts the vCPU index on L2's stack, so update this code to use the
newly allocated stack.

L1-provided stacks will be dropped and cleaned up separately.

Suggested-by: Sean Christopherson 
Signed-off-by: Yosry Ahmed 
Link: https://patch.msgid.link/20260610003030.2957261-3-seanjc@google.com
Signed-off-by: Sean Christopherson

KVM: selftests: Refactor allocating guest stack into a helper

2026-06-18T00:56:14+00:00

In preparation for reusing the logic to allocate stacks for nested
guests, refactoring allocating a guest stack and aligning RSP into a
helper.

No functional change intended.

Signed-off-by: Yosry Ahmed 
Link: https://patch.msgid.link/20260610003030.2957261-2-seanjc@google.com
Signed-off-by: Sean Christopherson

KVM: selftests: Add all (known) EFLAGS bit definitions

2026-05-21T21:40:24+00:00

Add #defines for all known EFLAGS bit, e.g. so that tests can use things
like EFLAGS.TF to validate single-stepping behavior.  Opportunistically
use X86_EFLAGS_FIXED instead of an open-coded equivalent when stuffing
initial vCPU state.

No functional change intended.

Link: https://patch.msgid.link/20260515222638.1949982-9-seanjc@google.com
Signed-off-by: Sean Christopherson