Re: [PATCH v3 10/10] KVM: selftests: Trigger L2->L1 exits stress save+restore and #PF test

[Sean Christopherson <seanjc@google.com>]

On Mon, Jun 29, 2026, Yosry Ahmed wrote:
> Extend the testing coverage in L2 by injecting a #UD into the vCPU every
> other iteration during restore, and intercepting #UD from L1,
> essentially forcing an L2 -> L1 VM-Exit directly after save+restore.

Assuming the #UD is a means to an end, make that the focus of the intro blurb.
I read this changelog without looking at the shortlog, and was about to ask why
injecting a #UD is interesting, and then I saw the comment.  It'd be helpful
to add a bit more context too, as it took me a few seconds to piece together
that the goal is to force the exit while L0 has control, i.e. a more obvious
hypercall from L2 wouldn't suffice.

> With this change, the test reliably reproduces the CR2 bug fixed by
> commit 5c247d08bc81 ("KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12
> on nested #VMEXIT") -- at least on Milan, Genoa, and Turin CPUs.
> 
> Assisted-by: Gemini:gemini-3.1-pro
> Signed-off-by: Yosry Ahmed <yosry@kernel.org>
> ---
>  .../kvm/x86/stress_save_restore_pf_test.c     | 47 +++++++++++++++++--
>  1 file changed, 42 insertions(+), 5 deletions(-)
> 
> diff --git a/tools/testing/selftests/kvm/x86/stress_save_restore_pf_test.c b/tools/testing/selftests/kvm/x86/stress_save_restore_pf_test.c
> index 9ab52d27a61d9..2b76e56f744e7 100644
> --- a/tools/testing/selftests/kvm/x86/stress_save_restore_pf_test.c
> +++ b/tools/testing/selftests/kvm/x86/stress_save_restore_pf_test.c
> @@ -105,8 +105,12 @@ static void guest_access_memory(void *arg)
>  static void l1_svm_code(struct svm_test_data *svm)
>  {
>  	generic_svm_setup(svm, guest_access_memory);
> -	run_guest(svm->vmcb, svm->vmcb_gpa);
> -	GUEST_ASSERT(false);
> +	svm->vmcb->control.intercept_exceptions |= BIT(UD_VECTOR);
> +
> +	while (1) {
> +		run_guest(svm->vmcb, svm->vmcb_gpa);
> +		GUEST_ASSERT_EQ(svm->vmcb->control.exit_code, (SVM_EXIT_EXCP_BASE + UD_VECTOR));

Please wrap this one, it's so long that I find it genuinely difficult to parse.

		GUEST_ASSERT_EQ(svm->vmcb->control.exit_code,
				(SVM_EXIT_EXCP_BASE + UD_VECTOR));

> +	}
>  }
>  
>  static void l1_vmx_code(struct vmx_pages *vmx)
> @@ -115,13 +119,17 @@ static void l1_vmx_code(struct vmx_pages *vmx)
>  	GUEST_ASSERT(load_vmcs(vmx));
>  	prepare_vmcs(vmx, guest_access_memory);
>  
> -	/* Ignore any #PF */
> -	GUEST_ASSERT(!vmwrite(EXCEPTION_BITMAP, BIT(PF_VECTOR)));
> +	/* Intercept UD, ignore any #PF */
> +	GUEST_ASSERT(!vmwrite(EXCEPTION_BITMAP, BIT(UD_VECTOR) | BIT(PF_VECTOR)));
>  	GUEST_ASSERT(!vmwrite(PAGE_FAULT_ERROR_CODE_MASK, 0));
>  	GUEST_ASSERT(!vmwrite(PAGE_FAULT_ERROR_CODE_MATCH, -1));
>  
>  	GUEST_ASSERT(!vmlaunch());
> -	GUEST_ASSERT(false);
> +	while (1) {
> +		GUEST_ASSERT_EQ(vmreadz(VM_EXIT_REASON), EXIT_REASON_EXCEPTION_NMI);
> +		GUEST_ASSERT_EQ(vmreadz(VM_EXIT_INTR_INFO) & 0xff, UD_VECTOR);
> +		GUEST_ASSERT(!vmresume());
> +	}
>  }
>  
>  static void l1_guest_code(void *test_data)
> @@ -159,6 +167,24 @@ static void vcpu_sigusr_ignore(void)
>  	sigaction(SIGUSR1, &sa, NULL);
>  }
>  
> +static bool vcpu_state_is_guest_mode(struct kvm_x86_state *state)
> +{
> +	return !!(state->nested.flags & KVM_STATE_NESTED_GUEST_MODE);
> +}
> +
> +static void vcpu_state_inject_ud(struct kvm_x86_state *state)
> +{
> +	if (state->events.exception.pending || state->events.exception.injected)
> +		return;
> +
> +	state->events.flags |= KVM_VCPUEVENT_VALID_PAYLOAD;
> +	state->events.exception.pending = true;
> +	state->events.exception.injected = false;
> +	state->events.exception.nr = UD_VECTOR;
> +	state->events.exception.has_error_code = false;
> +	state->events.exception_has_payload = false;
> +}
> +
>  static bool parse_args_nested(int argc, char *argv[])
>  {
>  	bool nested = false;
> @@ -192,10 +218,13 @@ int main(int argc, char *argv[])
>  	gva_t gva;
>  	u64 pte;
>  
> +	TEST_REQUIRE(kvm_has_cap(KVM_CAP_EXCEPTION_PAYLOAD));

But KVM_CAP_EXCEPTION_PAYLOAD _isn't_ required, it's an optional feature.  Actually,
this is ridiculous.  The test is injecting a #UD, it doesn't have a payload.
Bad AI, bad.

> +
>  	nested = parse_args_nested(argc, argv);
>  
>  	vm = vm_create_with_one_vcpu(&vcpu, nested ? l1_guest_code : guest_access_memory);
>  	vm_install_exception_handler(vm, PF_VECTOR, guest_pf_handler);
> +	vm_enable_cap(vm, KVM_CAP_EXCEPTION_PAYLOAD, -2ul);

-2ul?

>  	if (nested) {
>  		TEST_REQUIRE(kvm_cpu_has(X86_FEATURE_SVM) || kvm_cpu_has(X86_FEATURE_VMX));
> @@ -270,8 +299,16 @@ int main(int argc, char *argv[])
>  
>  		state = vcpu_save_state(vcpu);
>  
> +		/*
> +		 * If the vCPU is in guest mode, inject a #UD to trigger an
> +		 * L2->L1 VM-Exit every other iteration.
> +		 */
> +		if (nested && vcpu_state_is_guest_mode(state) && count % 2 == 0)

Checking "nested" here is unnecessary.

> +			vcpu_state_inject_ud(state);

Honestly, I'd rather open code this whole thing, because this doesn't actually
inject a #UD.  It _prepares_ state, but doesn't send that into KVM.  E.g.

		/*
		 * If the vCPU is in guest mode, inject a #UD to trigger an
		 * L2->L1 VM-Exit every other iteration, unless the vCPU has.  Take care not to
		 * clobber any exceptions
		 */
		if ((i & 1) && (state.nested.flags & KVM_STATE_NESTED_GUEST_MODE) &&
		    !state.events.exception.pending && !state.events.exception.injected) {
			state->events.exception.pending = true;
			state->events.exception.injected = false;
			state->events.exception.nr = UD_VECTOR;
			state->events.exception.has_error_code = false;
		}			

> +
>  		kvm_vm_release(vm);
>  		vcpu = vm_recreate_with_one_vcpu(vm);
> +		vm_enable_cap(vm, KVM_CAP_EXCEPTION_PAYLOAD, -2ul);
>  		vcpu_load_state(vcpu, state);
>  		kvm_x86_state_cleanup(state);
>  
> -- 
> 2.55.0.rc0.799.gd6f94ed593-goog
>