From: Paolo Bonzini <pbonzini@redhat.com>
To: kvm@vger.kernel.org
Cc: Jon Kohler <jon@nutanix.com>, Nikunj A Dadhania <nikunj@amd.com>,
Amit Shah <amit.shah@amd.com>,
Sean Christopherson <seanjc@google.com>
Subject: [PATCH kvm-unit-tests 7/9] x86/vmx: add user execution operation to EPT access tests
Date: Thu, 26 Mar 2026 10:50:33 -0400 [thread overview]
Message-ID: <20260326145035.119519-8-pbonzini@redhat.com> (raw)
In-Reply-To: <20260326145035.119519-1-pbonzini@redhat.com>
Introduce a new ept_access_op, OP_EXEC_USER, to the EPT access tests to
prepare for MBEC, which allows execution of user-level code.
Since the tests do not support MBEC yet, the expected behavior is the
same as for OP_EXEC.
Co-authored-by: Jon Kohler <jon@nutanix.com>
Signed-off-by: Jon Kohler <jon@nutanix.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
x86/vmx_tests.c | 51 +++++++++++++++++++++++++++++++++++++++++++++----
1 file changed, 47 insertions(+), 4 deletions(-)
diff --git a/x86/vmx_tests.c b/x86/vmx_tests.c
index dbc456cb..023512e6 100644
--- a/x86/vmx_tests.c
+++ b/x86/vmx_tests.c
@@ -2285,6 +2285,7 @@ enum ept_access_op {
OP_READ,
OP_WRITE,
OP_EXEC,
+ OP_EXEC_USER,
OP_FLUSH_TLB,
OP_EXIT,
};
@@ -2399,8 +2400,8 @@ ept_violation_at_level_mkhuge(bool mkhuge, int level, unsigned long clear,
orig_pte = ept_twiddle(data->gpa, mkhuge, level, clear, set);
do_ept_violation(level == 1 || mkhuge, op, expected_qual,
- op == OP_EXEC ? data->gpa + sizeof(unsigned long) :
- data->gpa);
+ (op == OP_EXEC || op == OP_EXEC_USER
+ ? data->gpa + sizeof(unsigned long) : data->gpa));
/* Fix the violation and resume the op loop. */
ept_untwiddle(data->gpa, level, orig_pte);
@@ -2589,11 +2590,13 @@ static void ept_ignored_bit(int bit)
ept_allowed(0, 1ul << bit, OP_READ);
ept_allowed(0, 1ul << bit, OP_WRITE);
ept_allowed(0, 1ul << bit, OP_EXEC);
+ ept_allowed(0, 1ul << bit, OP_EXEC_USER);
/* Clear the bit. */
ept_allowed(1ul << bit, 0, OP_READ);
ept_allowed(1ul << bit, 0, OP_WRITE);
ept_allowed(1ul << bit, 0, OP_EXEC);
+ ept_allowed(1ul << bit, 0, OP_EXEC_USER);
}
static void ept_access_allowed(unsigned long access, enum ept_access_op op)
@@ -2726,10 +2729,20 @@ static void ept_access_test_teardown(void *unused)
do_ept_access_op(OP_EXIT);
}
+static u64 exec_user_on_gva(void)
+{
+ struct ept_access_test_data *data = &ept_access_test_data;
+ int (*code)(void) = (int (*)(void)) &data->gva[1];
+
+ return code();
+}
+
static void ept_access_test_guest(void)
{
struct ept_access_test_data *data = &ept_access_test_data;
int (*code)(void) = (int (*)(void)) &data->gva[1];
+ bool unused;
+ u64 ret_val;
while (true) {
switch (data->op) {
@@ -2744,6 +2757,11 @@ static void ept_access_test_guest(void)
case OP_EXEC:
TEST_ASSERT_EQ(42, code());
break;
+ case OP_EXEC_USER:
+ ret_val = run_in_user(exec_user_on_gva, DE_VECTOR, // no exceptions
+ 0, 0, 0, 0, &unused);
+ TEST_ASSERT_EQ(42, ret_val);
+ break;
case OP_FLUSH_TLB:
write_cr3(read_cr3());
break;
@@ -2803,6 +2821,7 @@ static void ept_access_test_not_present(void)
ept_access_violation(0, OP_READ, EPT_VLT_RD);
ept_access_violation(0, OP_WRITE, EPT_VLT_WR);
ept_access_violation(0, OP_EXEC, EPT_VLT_FETCH);
+ ept_access_violation(0, OP_EXEC_USER, EPT_VLT_FETCH);
}
static void ept_access_test_read_only(void)
@@ -2813,6 +2832,7 @@ static void ept_access_test_read_only(void)
ept_access_allowed(EPT_RA, OP_READ);
ept_access_violation(EPT_RA, OP_WRITE, EPT_VLT_WR | EPT_VLT_PERM_RD);
ept_access_violation(EPT_RA, OP_EXEC, EPT_VLT_FETCH | EPT_VLT_PERM_RD);
+ ept_access_violation(EPT_RA, OP_EXEC_USER, EPT_VLT_FETCH | EPT_VLT_PERM_RD);
}
static void ept_access_test_write_only(void)
@@ -2829,7 +2849,11 @@ static void ept_access_test_read_write(void)
ept_access_allowed(EPT_RA | EPT_WA, OP_READ);
ept_access_allowed(EPT_RA | EPT_WA, OP_WRITE);
ept_access_violation(EPT_RA | EPT_WA, OP_EXEC,
- EPT_VLT_FETCH | EPT_VLT_PERM_RD | EPT_VLT_PERM_WR);
+ EPT_VLT_FETCH | EPT_VLT_PERM_RD |
+ EPT_VLT_PERM_WR);
+ ept_access_violation(EPT_RA | EPT_WA, OP_EXEC_USER,
+ EPT_VLT_FETCH | EPT_VLT_PERM_RD |
+ EPT_VLT_PERM_WR);
}
@@ -2843,6 +2867,7 @@ static void ept_access_test_execute_only(void)
ept_access_violation(EPT_EA, OP_WRITE,
EPT_VLT_WR | EPT_VLT_PERM_EX);
ept_access_allowed(EPT_EA, OP_EXEC);
+ ept_access_allowed(EPT_EA, OP_EXEC_USER);
} else {
ept_access_misconfig(EPT_EA);
}
@@ -2854,8 +2879,9 @@ static void ept_access_test_read_execute(void)
/* r-x */
ept_access_allowed(EPT_RA | EPT_EA, OP_READ);
ept_access_violation(EPT_RA | EPT_EA, OP_WRITE,
- EPT_VLT_WR | EPT_VLT_PERM_RD | EPT_VLT_PERM_EX);
+ EPT_VLT_WR | EPT_VLT_PERM_RD | EPT_VLT_PERM_EX);
ept_access_allowed(EPT_RA | EPT_EA, OP_EXEC);
+ ept_access_allowed(EPT_RA | EPT_EA, OP_EXEC_USER);
}
static void ept_access_test_write_execute(void)
@@ -2872,6 +2898,7 @@ static void ept_access_test_read_write_execute(void)
ept_access_allowed(EPT_RA | EPT_WA | EPT_EA, OP_READ);
ept_access_allowed(EPT_RA | EPT_WA | EPT_EA, OP_WRITE);
ept_access_allowed(EPT_RA | EPT_WA | EPT_EA, OP_EXEC);
+ ept_access_allowed(EPT_RA | EPT_WA | EPT_EA, OP_EXEC_USER);
}
static void ept_access_test_reserved_bits(void)
@@ -2952,6 +2979,7 @@ static void ept_access_test_paddr_not_present_ad_disabled(void)
ept_access_violation_paddr(0, PT_AD_MASK, OP_READ, EPT_VLT_RD);
ept_access_violation_paddr(0, PT_AD_MASK, OP_WRITE, EPT_VLT_RD);
ept_access_violation_paddr(0, PT_AD_MASK, OP_EXEC, EPT_VLT_RD);
+ ept_access_violation_paddr(0, PT_AD_MASK, OP_EXEC_USER, EPT_VLT_RD);
}
static void ept_access_test_paddr_not_present_ad_enabled(void)
@@ -2964,6 +2992,7 @@ static void ept_access_test_paddr_not_present_ad_enabled(void)
ept_access_violation_paddr(0, PT_AD_MASK, OP_READ, qual);
ept_access_violation_paddr(0, PT_AD_MASK, OP_WRITE, qual);
ept_access_violation_paddr(0, PT_AD_MASK, OP_EXEC, qual);
+ ept_access_violation_paddr(0, PT_AD_MASK, OP_EXEC_USER, qual);
}
static void ept_access_test_paddr_read_only_ad_disabled(void)
@@ -2983,14 +3012,17 @@ static void ept_access_test_paddr_read_only_ad_disabled(void)
ept_access_violation_paddr(EPT_RA, 0, OP_READ, qual);
ept_access_violation_paddr(EPT_RA, 0, OP_WRITE, qual);
ept_access_violation_paddr(EPT_RA, 0, OP_EXEC, qual);
+ ept_access_violation_paddr(EPT_RA, 0, OP_EXEC_USER, qual);
/* AD bits disabled, so only writes try to update the D bit. */
ept_access_allowed_paddr(EPT_RA, PT_ACCESSED_MASK, OP_READ);
ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_WRITE, qual);
ept_access_allowed_paddr(EPT_RA, PT_ACCESSED_MASK, OP_EXEC);
+ ept_access_allowed_paddr(EPT_RA, PT_ACCESSED_MASK, OP_EXEC_USER);
/* Both A and D already set, so read-only is OK. */
ept_access_allowed_paddr(EPT_RA, PT_AD_MASK, OP_READ);
ept_access_allowed_paddr(EPT_RA, PT_AD_MASK, OP_WRITE);
ept_access_allowed_paddr(EPT_RA, PT_AD_MASK, OP_EXEC);
+ ept_access_allowed_paddr(EPT_RA, PT_AD_MASK, OP_EXEC_USER);
}
static void ept_access_test_paddr_read_only_ad_enabled(void)
@@ -3008,12 +3040,15 @@ static void ept_access_test_paddr_read_only_ad_enabled(void)
ept_access_violation_paddr(EPT_RA, 0, OP_READ, qual);
ept_access_violation_paddr(EPT_RA, 0, OP_WRITE, qual);
ept_access_violation_paddr(EPT_RA, 0, OP_EXEC, qual);
+ ept_access_violation_paddr(EPT_RA, 0, OP_EXEC_USER, qual);
ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_READ, qual);
ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_WRITE, qual);
ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_EXEC, qual);
+ ept_access_violation_paddr(EPT_RA, PT_ACCESSED_MASK, OP_EXEC_USER, qual);
ept_access_violation_paddr(EPT_RA, PT_AD_MASK, OP_READ, qual);
ept_access_violation_paddr(EPT_RA, PT_AD_MASK, OP_WRITE, qual);
ept_access_violation_paddr(EPT_RA, PT_AD_MASK, OP_EXEC, qual);
+ ept_access_violation_paddr(EPT_RA, PT_AD_MASK, OP_EXEC_USER, qual);
}
static void ept_access_test_paddr_read_write(void)
@@ -3023,6 +3058,7 @@ static void ept_access_test_paddr_read_write(void)
ept_access_allowed_paddr(EPT_RA | EPT_WA, 0, OP_READ);
ept_access_allowed_paddr(EPT_RA | EPT_WA, 0, OP_WRITE);
ept_access_allowed_paddr(EPT_RA | EPT_WA, 0, OP_EXEC);
+ ept_access_allowed_paddr(EPT_RA | EPT_WA, 0, OP_EXEC_USER);
}
static void ept_access_test_paddr_read_write_execute(void)
@@ -3032,6 +3068,7 @@ static void ept_access_test_paddr_read_write_execute(void)
ept_access_allowed_paddr(EPT_RA | EPT_WA | EPT_EA, 0, OP_READ);
ept_access_allowed_paddr(EPT_RA | EPT_WA | EPT_EA, 0, OP_WRITE);
ept_access_allowed_paddr(EPT_RA | EPT_WA | EPT_EA, 0, OP_EXEC);
+ ept_access_allowed_paddr(EPT_RA | EPT_WA | EPT_EA, 0, OP_EXEC_USER);
}
static void ept_access_test_paddr_read_execute_ad_disabled(void)
@@ -3051,14 +3088,17 @@ static void ept_access_test_paddr_read_execute_ad_disabled(void)
ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_READ, qual);
ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_WRITE, qual);
ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_EXEC, qual);
+ ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_EXEC_USER, qual);
/* AD bits disabled, so only writes try to update the D bit. */
ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_READ);
ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_WRITE, qual);
ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_EXEC);
+ ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_EXEC_USER);
/* Both A and D already set, so read-only is OK. */
ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_READ);
ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_WRITE);
ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_EXEC);
+ ept_access_allowed_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_EXEC_USER);
}
static void ept_access_test_paddr_read_execute_ad_enabled(void)
@@ -3076,12 +3116,15 @@ static void ept_access_test_paddr_read_execute_ad_enabled(void)
ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_READ, qual);
ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_WRITE, qual);
ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_EXEC, qual);
+ ept_access_violation_paddr(EPT_RA | EPT_EA, 0, OP_EXEC_USER, qual);
ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_READ, qual);
ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_WRITE, qual);
ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_EXEC, qual);
+ ept_access_violation_paddr(EPT_RA | EPT_EA, PT_ACCESSED_MASK, OP_EXEC_USER, qual);
ept_access_violation_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_READ, qual);
ept_access_violation_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_WRITE, qual);
ept_access_violation_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_EXEC, qual);
+ ept_access_violation_paddr(EPT_RA | EPT_EA, PT_AD_MASK, OP_EXEC_USER, qual);
}
static void ept_access_test_paddr_not_present_page_fault(void)
--
2.52.0
next prev parent reply other threads:[~2026-03-26 14:50 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-26 14:50 [PATCH kvm-unit-tests 0/9] Combined GMET and MBEC tests Paolo Bonzini
2026-03-26 14:50 ` [PATCH kvm-unit-tests 1/9] move PFERR_* constants to lib Paolo Bonzini
2026-03-26 14:50 ` [PATCH kvm-unit-tests 2/9] add definitions for nested_ctl Paolo Bonzini
2026-03-26 14:50 ` [PATCH kvm-unit-tests 3/9] svm: add basic GMET tests Paolo Bonzini
2026-03-27 16:03 ` Jon Kohler
2026-03-26 14:50 ` [PATCH kvm-unit-tests 4/9] x86/vmx: update EPT installation to use EPT_PRESENT flag Paolo Bonzini
2026-03-26 14:50 ` [PATCH kvm-unit-tests 5/9] x86/vmx: diagnose unexpected EPT violations Paolo Bonzini
2026-03-26 14:50 ` [PATCH kvm-unit-tests 6/9] x86/vmx: add mode-based execute control test for Skylake and above Paolo Bonzini
2026-03-27 15:57 ` Jon Kohler
2026-03-26 14:50 ` Paolo Bonzini [this message]
2026-03-26 14:50 ` [PATCH kvm-unit-tests 8/9] x86/vmx: run EPT tests with MBEC enabled when available Paolo Bonzini
2026-03-26 16:13 ` Paolo Bonzini
2026-03-27 15:57 ` Jon Kohler
2026-03-27 15:57 ` Jon Kohler
2026-03-26 14:50 ` [PATCH kvm-unit-tests 9/9] x86/vmx: add EPT tests covering XU permission Paolo Bonzini
2026-03-27 15:56 ` Jon Kohler
2026-05-12 11:06 ` [PATCH kvm-unit-tests 0/9] Combined GMET and MBEC tests Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260326145035.119519-8-pbonzini@redhat.com \
--to=pbonzini@redhat.com \
--cc=amit.shah@amd.com \
--cc=jon@nutanix.com \
--cc=kvm@vger.kernel.org \
--cc=nikunj@amd.com \
--cc=seanjc@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox