[PATCH v3 10/14] x86/svm: Generalize and improve selective CR0 write intercept test

Yosry Ahmed
2025-11-10T23:27:20Z

In preparation for adding more test cases, make the test easier to
extend. Create a generic helper that sets an arbitrary bit in CR0,
optionally using FEP. The helper also stores the value to be written in
test->scratch, making it possible to double check if the write was
actually executed or not.

Use report_svm_guest() instead of report_fail() + exit().

Make test_sel_cr0_write_intercept() use the generic helper, and add
another test case that sets FEP to exercise the interception path in the
emulator.

Finally, in check_sel_cr0_intercept() also check that the write was not
executed by comparing CR0 value in the VMCB12 with the
value-to-be-written stored in test->scratch.

Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
---
x86/svm_tests.c | 38 +++++++++++++++++++++++++-------------
1 file changed, 25 insertions(+), 13 deletions(-)

diff --git a/x86/svm_tests.c b/x86/svm_tests.c
index 1e7556a37adec..7e292a9a7b4ec 100644
--- a/x86/svm_tests.c
+++ b/x86/svm_tests.c
@@ -133,27 +133,36 @@ static void prepare_sel_cr0_intercept(struct svm_test *test)
vmcb->control.intercept |= (1ULL << INTERCEPT_SELECTIVE_CR0);
}

-static void test_sel_cr0_write_intercept(struct svm_test *test)
+static void __test_cr0_write_bit(struct svm_test *test, unsigned long bit,
+ bool intercept, bool fep)
{
unsigned long cr0;

- /* read cr0, set CD, and write back */
- cr0 = read_cr0();
- cr0 |= X86_CR0_CD;
- write_cr0(cr0);
+ cr0 = read_cr0();
+ cr0 |= bit;
+ test->scratch = cr0;

- /*
- * If we are here the test failed, not sure what to do now because we
- * are not in guest-mode anymore so we can't trigger an intercept.
- * Trigger a tripple-fault for now.
- */
- report_fail("sel_cr0 test. Can not recover from this - exiting");
- exit(report_summary());
+ asm_conditional_fep_safe(fep, "mov %0,%%cr0", "r"(cr0));
+
+ /* This code should be unreachable when an intercept is expected */
+ report_svm_guest(!intercept, test, "Expected intercept on CR0 write");
+}
+
+/* MOV-to-CR0 updating CR0.CD is intercepted by the selective intercept */
+static void test_sel_cr0_write_intercept(struct svm_test *test)
+{
+ __test_cr0_write_bit(test, X86_CR0_CD, true, false);
+}
+
+static void test_sel_cr0_write_intercept_emul(struct svm_test *test)
+{
+ __test_cr0_write_bit(test, X86_CR0_CD, true, true);
}

static bool check_sel_cr0_intercept(struct svm_test *test)
{
- return vmcb->control.exit_code == SVM_EXIT_CR0_SEL_WRITE;
+ return vmcb->control.exit_code == SVM_EXIT_CR0_SEL_WRITE &&
+ vmcb->save.cr0 != test->scratch;
}

static void prepare_cr3_intercept(struct svm_test *test)
@@ -3461,6 +3470,9 @@ struct svm_test svm_tests[] = {
{ "sel cr0 write intercept", default_supported,
prepare_sel_cr0_intercept, default_prepare_gif_clear,
test_sel_cr0_write_intercept, default_finished, check_sel_cr0_intercept},
+ { "sel cr0 write intercept emulate", fep_supported,
+ prepare_sel_cr0_intercept, default_prepare_gif_clear,
+ test_sel_cr0_write_intercept_emul, default_finished, check_sel_cr0_intercept},
{ "cr3 read intercept", default_supported,
prepare_cr3_intercept, default_prepare_gif_clear,
test_cr3_intercept, default_finished, check_cr3_intercept },
--
2.51.2.1041.gc1ab5b90ca-goog