[kvm-unit-tests PATCH] x86: nSVM: Fix exit_info_2 check error of npt_rw_pfwalk_check()

[kvm-unit-tests PATCH] x86: nSVM: Fix exit_info_2 check error of npt_rw_pfwalk_check()

[Qiang Ma]

The testcase log:

kvm-unit-tests]# TESTNAME=svm_npt TIMEOUT=90s MACHINE= ACCEL= ./x86/run x86/svm_npt.flat -smp 2 -cpu max,+svm -m 4g
...
enabling apic
smp: waiting for 1 APs
enabling apic
setup: CPU 1 online
paging enabled
cr0 = 80010011
cr3 = 10bf000
cr4 = 20
NPT detected - running all tests with NPT enabled
PASS: npt_nx
PASS: npt_np
PASS: npt_us
PASS: npt_rw
npt_rw_pfwalk_check: CR3: 10bf000 EXIT_INFO_2: 10bf5f8
FAIL: npt_rw_pfwalk
...

CR4=0x20, PAE is enabled, CR3 is PDPT base address, aligned on a 32-byte
boundary, looking at the above test results, it is still 4k alignment in reality,
exit_info_2 in vmcb stores the falut address of GPA.

So, after aligning the GPA to PAGE_SIZE, compare the CR3 and GPA.

PAE Paging (CR4.PAE=1)—This field is 27 bits and occupies bits 31:5.
The CR3 register points to the base address of the page-directory-pointer
table. The page-directory-pointer table is aligned on a 32-byte boundary,
with the low 5 address bits 4:0 assumed to be 0.

Table C-1. SVM Intercept Codes (continued):
Code Name       Cause
400h VMEXIT_NPF EXITINFO2 contains the guest physical address causing the fault.

This is described in the AMD64 Architecture Programmers Manual Volume
2, Order Number 24593.

Signed-off-by: Qiang Ma <maqianga@uniontech.com>
---
 x86/svm_npt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x86/svm_npt.c b/x86/svm_npt.c
index bd5e8f35..08614d84 100644
--- a/x86/svm_npt.c
+++ b/x86/svm_npt.c
@@ -132,7 +132,7 @@ static bool npt_rw_pfwalk_check(struct svm_test *test)
 
 	return (vmcb->control.exit_code == SVM_EXIT_NPF)
 	    && (vmcb->control.exit_info_1 == 0x200000007ULL)
-	    && (vmcb->control.exit_info_2 == read_cr3());
+	    && ((vmcb->control.exit_info_2 & PAGE_MASK) == read_cr3());
 }
 
 static bool was_x2apic;
-- 
2.20.1

Re: [kvm-unit-tests PATCH] x86: nSVM: Fix exit_info_2 check error of npt_rw_pfwalk_check()

[Sean Christopherson]

On Mon, Jul 14, 2025, Qiang Ma wrote:
> The testcase log:
> 
> kvm-unit-tests]# TESTNAME=svm_npt TIMEOUT=90s MACHINE= ACCEL= ./x86/run x86/svm_npt.flat -smp 2 -cpu max,+svm -m 4g
> ...
> enabling apic
> smp: waiting for 1 APs
> enabling apic
> setup: CPU 1 online
> paging enabled
> cr0 = 80010011
> cr3 = 10bf000
> cr4 = 20
> NPT detected - running all tests with NPT enabled
> PASS: npt_nx
> PASS: npt_np
> PASS: npt_us
> PASS: npt_rw
> npt_rw_pfwalk_check: CR3: 10bf000 EXIT_INFO_2: 10bf5f8
> FAIL: npt_rw_pfwalk
> ...
> 
> CR4=0x20, PAE is enabled, CR3 is PDPT base address, aligned on a 32-byte
> boundary, looking at the above test results, it is still 4k alignment in reality,

No, the nested SVM tests only support 64-bit mode.  I.e. they're using 64-bit
paging, not PAE paging.

Can you provide instructions on how to repro the failure?  This could be an
actual KVM bug (or maybe a test bug?), and masking the reported GPA will paper
over such a bug.

> exit_info_2 in vmcb stores the falut address of GPA.
> 
> So, after aligning the GPA to PAGE_SIZE, compare the CR3 and GPA.
> 
> PAE Paging (CR4.PAE=1)—This field is 27 bits and occupies bits 31:5.
> The CR3 register points to the base address of the page-directory-pointer
> table. The page-directory-pointer table is aligned on a 32-byte boundary,
> with the low 5 address bits 4:0 assumed to be 0.
> 
> Table C-1. SVM Intercept Codes (continued):
> Code Name       Cause
> 400h VMEXIT_NPF EXITINFO2 contains the guest physical address causing the fault.
> 
> This is described in the AMD64 Architecture Programmers Manual Volume
> 2, Order Number 24593.
> 
> Signed-off-by: Qiang Ma <maqianga@uniontech.com>
> ---
>  x86/svm_npt.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/x86/svm_npt.c b/x86/svm_npt.c
> index bd5e8f35..08614d84 100644
> --- a/x86/svm_npt.c
> +++ b/x86/svm_npt.c
> @@ -132,7 +132,7 @@ static bool npt_rw_pfwalk_check(struct svm_test *test)
>  
>  	return (vmcb->control.exit_code == SVM_EXIT_NPF)
>  	    && (vmcb->control.exit_info_1 == 0x200000007ULL)
> -	    && (vmcb->control.exit_info_2 == read_cr3());
> +	    && ((vmcb->control.exit_info_2 & PAGE_MASK) == read_cr3());
>  }
>  
>  static bool was_x2apic;
> -- 
> 2.20.1
>