1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2026, Google, Inc. 4 */ 5 6 #include "test_util.h" 7 #include "kvm_util.h" 8 #include "processor.h" 9 #include "svm_util.h" 10 11 12 #define DO_BRANCH() do { asm volatile("jmp 1f\n 1: nop"); } while (0) 13 14 struct lbr_branch { 15 u64 from, to; 16 }; 17 18 volatile struct lbr_branch l2_branch; 19 20 #define RECORD_AND_CHECK_BRANCH(b) \ 21 do { \ 22 wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); \ 23 DO_BRANCH(); \ 24 (b)->from = rdmsr(MSR_IA32_LASTBRANCHFROMIP); \ 25 (b)->to = rdmsr(MSR_IA32_LASTBRANCHTOIP); \ 26 /* Disable LBR right after to avoid overriding the IPs */ \ 27 wrmsr(MSR_IA32_DEBUGCTLMSR, 0); \ 28 \ 29 GUEST_ASSERT_NE((b)->from, 0); \ 30 GUEST_ASSERT_NE((b)->to, 0); \ 31 } while (0) 32 33 #define CHECK_BRANCH_MSRS(b) \ 34 do { \ 35 GUEST_ASSERT_EQ((b)->from, rdmsr(MSR_IA32_LASTBRANCHFROMIP)); \ 36 GUEST_ASSERT_EQ((b)->to, rdmsr(MSR_IA32_LASTBRANCHTOIP)); \ 37 } while (0) 38 39 #define CHECK_BRANCH_VMCB(b, vmcb) \ 40 do { \ 41 GUEST_ASSERT_EQ((b)->from, vmcb->save.br_from); \ 42 GUEST_ASSERT_EQ((b)->to, vmcb->save.br_to); \ 43 } while (0) 44 45 static void l2_guest_code(struct svm_test_data *svm) 46 { 47 /* Record a branch, trigger save/restore, and make sure LBRs are intact */ 48 RECORD_AND_CHECK_BRANCH(&l2_branch); 49 GUEST_SYNC(true); 50 CHECK_BRANCH_MSRS(&l2_branch); 51 vmmcall(); 52 } 53 54 static void l1_guest_code(struct svm_test_data *svm, bool nested_lbrv) 55 { 56 struct vmcb *vmcb = svm->vmcb; 57 struct lbr_branch l1_branch; 58 59 /* Record a branch, trigger save/restore, and make sure LBRs are intact */ 60 RECORD_AND_CHECK_BRANCH(&l1_branch); 61 GUEST_SYNC(true); 62 CHECK_BRANCH_MSRS(&l1_branch); 63 64 /* Run L2, which will also do the same */ 65 generic_svm_setup(svm, l2_guest_code); 66 67 if (nested_lbrv) 68 vmcb->control.misc_ctl2 = SVM_MISC2_ENABLE_V_LBR; 69 else 70 vmcb->control.misc_ctl2 &= ~SVM_MISC2_ENABLE_V_LBR; 71 72 run_guest(vmcb, svm->vmcb_gpa); 73 GUEST_ASSERT(svm->vmcb->control.exit_code == SVM_EXIT_VMMCALL); 74 75 /* Trigger save/restore one more time before checking, just for kicks */ 76 GUEST_SYNC(true); 77 78 /* 79 * If LBR_CTL_ENABLE is set, L1 and L2 should have separate LBR MSRs, so 80 * expect L1's LBRs to remain intact and L2 LBRs to be in the VMCB. 81 * Otherwise, the MSRs are shared between L1 & L2 so expect L2's LBRs. 82 */ 83 if (nested_lbrv) { 84 CHECK_BRANCH_MSRS(&l1_branch); 85 CHECK_BRANCH_VMCB(&l2_branch, vmcb); 86 } else { 87 CHECK_BRANCH_MSRS(&l2_branch); 88 } 89 GUEST_DONE(); 90 } 91 92 void test_lbrv_nested_state(bool nested_lbrv) 93 { 94 struct kvm_x86_state *state = NULL; 95 struct kvm_vcpu *vcpu; 96 struct kvm_vm *vm; 97 struct ucall uc; 98 gva_t svm_gva; 99 100 pr_info("Testing with nested LBRV %s\n", nested_lbrv ? "enabled" : "disabled"); 101 102 vm = vm_create_with_one_vcpu(&vcpu, l1_guest_code); 103 vcpu_alloc_svm(vm, &svm_gva); 104 vcpu_args_set(vcpu, 2, svm_gva, nested_lbrv); 105 106 for (;;) { 107 vcpu_run(vcpu); 108 TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_IO); 109 switch (get_ucall(vcpu, &uc)) { 110 case UCALL_SYNC: 111 /* Save the vCPU state and restore it in a new VM on sync */ 112 pr_info("Guest triggered save/restore.\n"); 113 state = vcpu_save_state(vcpu); 114 kvm_vm_release(vm); 115 vcpu = vm_recreate_with_one_vcpu(vm); 116 vcpu_load_state(vcpu, state); 117 kvm_x86_state_cleanup(state); 118 break; 119 case UCALL_ABORT: 120 REPORT_GUEST_ASSERT(uc); 121 /* NOT REACHED */ 122 case UCALL_DONE: 123 goto done; 124 default: 125 TEST_FAIL("Unknown ucall %lu", uc.cmd); 126 } 127 } 128 done: 129 kvm_vm_free(vm); 130 } 131 132 int main(int argc, char *argv[]) 133 { 134 TEST_REQUIRE(kvm_cpu_has(X86_FEATURE_SVM)); 135 TEST_REQUIRE(kvm_is_lbrv_enabled()); 136 137 test_lbrv_nested_state(/*nested_lbrv=*/false); 138 test_lbrv_nested_state(/*nested_lbrv=*/true); 139 140 return 0; 141 } 142