Merge tag 'kvm-x86-2025.02.21' of https://github.com/kvm-x86/kvm-unit-tests into HEAD

KVM-Unit-Tests x86 changes:

- Expand the per-CPU data+stack area to 12KiB per CPU to reduce the
probability

Merge tag 'kvm-x86-2025.02.21' of https://github.com/kvm-x86/kvm-unit-tests into HEAD

KVM-Unit-Tests x86 changes:

- Expand the per-CPU data+stack area to 12KiB per CPU to reduce the
probability of tests overflowing their stack and clobbering pre-CPU
data.

- Add testcases for LA57 canonical checks.

- Add testcases for LAM.

- Add a smoke test to make sure KVM doesn't bleed split-lock #AC/#DB into
the guest.

- Fix many warts and bugs in the PMU test, and prepare it for PMU version 5
and beyond.

- Many misc fixes and cleanups.

show more ...

x86: Add testcases for writing (non)canonical LA57 values to MSRs and bases

Extend the LA57 test to thoroughly validate the canonical checks that are
done when setting various MSRs and CPU registers

x86: Add testcases for writing (non)canonical LA57 values to MSRs and bases

Extend the LA57 test to thoroughly validate the canonical checks that are
done when setting various MSRs and CPU registers. CPUs that support LA57
have convoluted behavior when it comes to canonical checks. Writes to
MSRs, descriptor table bases, and for TLB invalidation instructions,
don't consult CR4.LA57, and so a value that is 57-bit canonical but not
48-bit canonical is allowed irrespective of CR4.LA57 if the CPU supports
5-level paging.

Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Link: https://lore.kernel.org/r/20240907005440.500075-5-mlevitsk@redhat.com
Co-developed-by: Sean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/r/20250215013018.1210432-6-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

show more ...

Merge tag 'kvm-x86-2023.09.01' of https://github.com/kvm-x86/kvm-unit-tests into HEAD

x86 fixes, cleanups, and new testcases, and a few generic changes

- Fix a bug in runtime.bash that caused it t

Merge tag 'kvm-x86-2023.09.01' of https://github.com/kvm-x86/kvm-unit-tests into HEAD

x86 fixes, cleanups, and new testcases, and a few generic changes

- Fix a bug in runtime.bash that caused it to mishandle "check" strings with
multiple entries, e.g. a test that depends on multiple module params
- Make the PMU tests depend on vPMU support being enabled in KVM
- Fix PMU's forced emulation test on CPUs with full-width writes
- Add a PMU testcase for measuring TSX transactional cycles
- Nested SVM testcase for virtual NMIs
- Move a pile of code to ASM_TRY() and "safe" helpers
- Set up the guest stack in the LBRV tests so that the tests don't fail if the
compiler decides to generate function calls in guest code
- Ignore the "mispredict" flag in nSVM's LBRV tests to fix false failures
- Clean up usage of helpers that disable interrupts, e.g. stop inserting
unnecessary nops
- Add helpers to dedup code for programming the APIC timer
- Fix a variety of bugs in nVMX testcases related to being a 64-bit host

show more ...

x86: Add defines for the various LBR record bit definitions

Add defines for Intel's LBR info MSRs, and a define (along with a snarky
message) for AMD's lovely mispredict bit that is shoved into the

x86: Add defines for the various LBR record bit definitions

Add defines for Intel's LBR info MSRs, and a define (along with a snarky
message) for AMD's lovely mispredict bit that is shoved into the LBR
MSRs themselves. The AMD mispredict bit will be used to address false
positives in the LBRV tests.

Link: https://lore.kernel.org/r/20230607210959.1577847-4-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

show more ...

x86/msr: Add testcases for MSR_IA32_FLUSH_CMD and its L1D_FLUSH command

Add test coverage to verify MSR_IA32_FLUSH_CMD is write-only, that it can
be written with '0' (nop command) and '1' (L1D flush

x86/msr: Add testcases for MSR_IA32_FLUSH_CMD and its L1D_FLUSH command

Add test coverage to verify MSR_IA32_FLUSH_CMD is write-only, that it can
be written with '0' (nop command) and '1' (L1D flush command) when the L1D
flush command is suported, and that writing any other bit (1-63) triggers
a #GP due to the bits/commands being reserved.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20230328050231.3008531-4-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

x86: Add define for MSR_IA32_PRED_CMD's PRED_CMD_IBPB (bit 0)

Add a define for PRED_CMD_IBPB and use it to replace the open coded '1' in
the nVMX library.

Signed-off-by: Sean Christopherson <seanjc

x86: Add define for MSR_IA32_PRED_CMD's PRED_CMD_IBPB (bit 0)

Add a define for PRED_CMD_IBPB and use it to replace the open coded '1' in
the nVMX library.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20230328050231.3008531-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

x86/msr: Add testcases for MSR_IA32_FLUSH_CMD and its L1D_FLUSH command

Add test coverage to verify MSR_IA32_FLUSH_CMD is write-only, that it can
be written with '0' (nop command) and '1' (L1D flush

x86/msr: Add testcases for MSR_IA32_FLUSH_CMD and its L1D_FLUSH command

Add test coverage to verify MSR_IA32_FLUSH_CMD is write-only, that it can
be written with '0' (nop command) and '1' (L1D flush command) when the L1D
flush command is suported, and that writing any other bit (1-63) triggers
a #GP due to the bits/commands being reserved.

Link: https://lore.kernel.org/r/20230328050231.3008531-4-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

show more ...

x86: Add define for MSR_IA32_PRED_CMD's PRED_CMD_IBPB (bit 0)

Add a define for PRED_CMD_IBPB and use it to replace the open coded '1' in
the VM-Exit test.

Link: https://lore.kernel.org/r/2023032805

x86: Add define for MSR_IA32_PRED_CMD's PRED_CMD_IBPB (bit 0)

Add a define for PRED_CMD_IBPB and use it to replace the open coded '1' in
the VM-Exit test.

Link: https://lore.kernel.org/r/20230328050231.3008531-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

show more ...

x86/pmu: Add AMD Guest PerfMonV2 testcases

Updated test cases to cover KVM enabling code for AMD Guest PerfMonV2.

The Intel-specific PMU helpers were added to check for AMD cpuid, and
some of the s

x86/pmu: Add AMD Guest PerfMonV2 testcases

Updated test cases to cover KVM enabling code for AMD Guest PerfMonV2.

The Intel-specific PMU helpers were added to check for AMD cpuid, and
some of the same semantics of MSRs were assigned during the initialization
phase. The vast majority of pmu test cases are reused seamlessly.

On some x86 machines (AMD only), even with retired events, the same
workload is measured repeatedly and the number of events collected is
erratic, which essentially reflects the details of hardware implementation,
and from a software perspective, the type of event is an unprecise event,
which brings a tolerance check in the counter overflow testcases.

Signed-off-by: Like Xu <likexu@tencent.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/r/20221102225110.3023543-28-seanjc@google.com

show more ...

x86/pmu: Update testcases to cover AMD PMU

AMD core PMU before Zen4 did not have version numbers, there were
no fixed counters, it had a hard-coded number of generic counters,
bit-width, and only ha

x86/pmu: Update testcases to cover AMD PMU

AMD core PMU before Zen4 did not have version numbers, there were
no fixed counters, it had a hard-coded number of generic counters,
bit-width, and only hardware events common across amd generations
(starting with K7) were added to amd_gp_events[] table.

All above differences are instantiated at the detection step, and it
also covers the K7 PMU registers, which is consistent with bare-metal.

Cc: Sandipan Das <sandipan.das@amd.com>
Signed-off-by: Like Xu <likexu@tencent.com>
[sean: set bases to K7 values for !PERFCTR_CORE case (reported by Paolo)]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/r/20221102225110.3023543-27-seanjc@google.com

show more ...

x86: Add tests for Guest Processor Event Based Sampling (PEBS)

This unit-test is intended to test the KVM's support for
the Processor Event Based Sampling (PEBS) which is another
PMU feature on Inte

x86: Add tests for Guest Processor Event Based Sampling (PEBS)

This unit-test is intended to test the KVM's support for
the Processor Event Based Sampling (PEBS) which is another
PMU feature on Intel processors (start from Ice Lake Server).

If a bit in PEBS_ENABLE is set to 1, its corresponding counter will
write at least one PEBS records (including partial state of the vcpu
at the time of the current hardware event) to the guest memory on
counter overflow, and trigger an interrupt at a specific DS state.
The format of a PEBS record can be configured by another register.

These tests cover most usage scenarios, for example there are some
specially constructed scenarios (not a typical behaviour of Linux
PEBS driver). It lowers the threshold for others to understand this
feature and opens up more exploration of KVM implementation or
hw feature itself.

Signed-off-by: Like Xu <likexu@tencent.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/r/20221102225110.3023543-23-seanjc@google.com

show more ...

x86/pmu: Add lib/x86/pmu.[c.h] and move common code to header files

Given all the PMU stuff coming in, we need e.g. lib/x86/pmu.h to hold all
of the hardware-defined stuff, e.g. #defines, accessors,

x86/pmu: Add lib/x86/pmu.[c.h] and move common code to header files

Given all the PMU stuff coming in, we need e.g. lib/x86/pmu.h to hold all
of the hardware-defined stuff, e.g. #defines, accessors, helpers and structs
that are dictated by hardware. This will greatly help with code reuse and
reduce unnecessary vm-exit.

Opportunistically move lbr msrs definition to header processor.h.

Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Like Xu <likexu@tencent.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/r/20221102225110.3023543-14-seanjc@google.com

show more ...

svm: add test for nested tsc scaling

Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Message-Id: <20220322205613.250925-9-mlevitsk@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

x86: unify header guards

Standardize header guards to _ASMX86_HEADER_H_, _X86_HEADER_H_,
and X86_HEADER_H.

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: David Hildenbrand <david@red

x86: unify header guards

Standardize header guards to _ASMX86_HEADER_H_, _X86_HEADER_H_,
and X86_HEADER_H.

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-Id: <20210609143712.60933-8-cohuck@redhat.com>

show more ...

x86: Add test cases for user-mode CET validation

This unit test is intended to test user-mode CET support of KVM,
it's tested on Intel new platform. Two CET features: Shadow Stack
Protection(SHSTK)

x86: Add test cases for user-mode CET validation

This unit test is intended to test user-mode CET support of KVM,
it's tested on Intel new platform. Two CET features: Shadow Stack
Protection(SHSTK) and Indirect-Branch Tracking(IBT) are enclosed.

In SHSTK test, if the function return-address in normal stack is
tampered with a value not equal to the one on shadow-stack, #CP
(Control Protection Exception)will generated on function returning.
This feature is supported by processor itself, no compiler/link
option is required.

However, to enabled IBT, we need to add -fcf-protection=full in
compiler options, this makes the compiler insert endbr64 at the
very beginning of each jmp/call target given the binary is for
x86_64.

To get PASS results, the following conditions must be met:
1) The processor is powered with CET feature.
2) The kernel is patched with the latest CET kernel patches.
3) The KVM and QEMU are patched with the latest CET patches.
4) Use CET-enabled gcc to compile the test app.

v2:
- Removed extra dependency on test framework for user/kernel mode switch.
- Directly set #CP handler instead of through TSS.

Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
Message-Id: <20200506082110.25441-12-weijiang.yang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

x86: Add tests for PKS

This unit-test is intended to test the KVM support for Protection Keys
for Supervisor Pages (PKS). If CR4.PKS is set in long mode, supervisor
pkeys are checked in addition to

x86: Add tests for PKS

This unit-test is intended to test the KVM support for Protection Keys
for Supervisor Pages (PKS). If CR4.PKS is set in long mode, supervisor
pkeys are checked in addition to normal paging protections and Access or
Write can be disabled via a MSR update without TLB flushes when
permissions change.

Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
Message-Id: <20201105081805.5674-9-chenyi.qiang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

x86: vmx: Add test for SIPI signal processing

The test verifies the following functionality:
A SIPI signal received when CPU is in VMX non-root mode:
if ACTIVITY_STATE == WAIT_SIPI
VMExi

x86: vmx: Add test for SIPI signal processing

The test verifies the following functionality:
A SIPI signal received when CPU is in VMX non-root mode:
if ACTIVITY_STATE == WAIT_SIPI
VMExit with (reason == 4)
else
SIPI signal is ignored

The test cases depends on IA32_VMX_MISC:bit(8), if this bit is 1
then the test cases would be executed, otherwise the test cases
would be skiped.

Signed-off-by: Yadong Qi <yadong.qi@intel.com>
Message-Id: <20201013052845.249113-1-yadong.qi@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

x86: pmu: Test full-width counter writes support

When the full-width writes capability is set, use the alternative MSR
range to write larger sign counter values (up to GP counter width).

Signed-off

x86: pmu: Test full-width counter writes support

When the full-width writes capability is set, use the alternative MSR
range to write larger sign counter values (up to GP counter width).

Signed-off-by: Like Xu <like.xu@linux.intel.com>
Message-Id: <20200529074347.124619-4-like.xu@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

x86: add tests for MSR_IA32_TSX_CTRL

Tested-by: Jim Mattson <jmattson@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

x86: nVMX: Enhance basic vmwrite/vmread test

Check that "read-only" fields are writable when the IA32_VMX_MISC MSR
reports that software can use VMWRITE to write to any supported field in
the VMCS.

x86: nVMX: Enhance basic vmwrite/vmread test

Check that "read-only" fields are writable when the IA32_VMX_MISC MSR
reports that software can use VMWRITE to write to any supported field in
the VMCS.

Signed-off-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Liran Alon <liran.alon@oracle.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

x86: move TSC_ADJUST MSR to msr.h

The MSR is defined in two places, and a third is coming. Centralize
the definition.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

add vmexit tests for IBRS and IBPB

Results on Haswell:

wr_ibrs_msr 506 (actually ~250, because the test writes twice)
wr_ibpb_msr 4212

Yuck.

Signed-off-by: Paolo Bonzini <pbonzini@redha

add vmexit tests for IBRS and IBPB

Results on Haswell:

wr_ibrs_msr 506 (actually ~250, because the test writes twice)
wr_ibpb_msr 4212

Yuck.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

x86: move APIC timer related defines to headers

Change names to match Linux where necessary.

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>

x86/hyperv: Move Hyper-V generic code into hyperv.h/hyperv.c

This code will be used as shared between hyperv_synic
and hyperv_stimer tests.

Signed-off-by: Andrey Smetanin <asmetanin@virtuozzo.com>

x86/hyperv: Move Hyper-V generic code into hyperv.h/hyperv.c

This code will be used as shared between hyperv_synic
and hyperv_stimer tests.

Signed-off-by: Andrey Smetanin <asmetanin@virtuozzo.com>
CC: Paolo Bonzini <pbonzini@redhat.com>
CC: Marcelo Tosatti <mtosatti@redhat.com>
CC: Roman Kagan <rkagan@virtuozzo.com>
CC: Denis V. Lunev <den@openvz.org>
CC: qemu-devel@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

x86: hyperv_synic: Hyper-V SynIC test

Hyper-V SynIC is a Hyper-V synthetic interrupt controller.

The test runs on every vCPU and performs the following steps:
* read from all Hyper-V SynIC MSR's
*

x86: hyperv_synic: Hyper-V SynIC test

Hyper-V SynIC is a Hyper-V synthetic interrupt controller.

The test runs on every vCPU and performs the following steps:
* read from all Hyper-V SynIC MSR's
* setup Hyper-V SynIC evt/msg pages
* setup SINT's routing
* inject SINT's into destination vCPU by 'hyperv-synic-test-device'
* wait for SINT's isr's completion
* clear Hyper-V SynIC evt/msg pages and destroy SINT's routing

Signed-off-by: Andrey Smetanin <asmetanin@virtuozzo.com>
Reviewed-by: Roman Kagan <rkagan@virtuozzo.com>
Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Vitaly Kuznetsov <vkuznets@redhat.com>
CC: "K. Y. Srinivasan" <kys@microsoft.com>
CC: Gleb Natapov <gleb@kernel.org>
CC: Paolo Bonzini <pbonzini@redhat.com>
CC: Roman Kagan <rkagan@virtuozzo.com>
CC: Denis V. Lunev <den@openvz.org>
CC: qemu-devel@nongnu.org
CC: virtualization@lists.linux-foundation.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...