From: Paolo Bonzini <pbonzini@redhat.com>
To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org
Cc: seanjc@google.com, x86@kernel.org, stable@vger.kernel.org
Subject: [PATCH 3/4] selftests: kvm: try getting XFD and XSAVE state out of sync
Date: Thu, 1 Jan 2026 10:05:15 +0100 [thread overview]
Message-ID: <20260101090516.316883-4-pbonzini@redhat.com> (raw)
In-Reply-To: <20260101090516.316883-1-pbonzini@redhat.com>
The host is allowed to set FPU state that includes a disabled
xstate component. Check that this does not cause bad effects.
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
tools/testing/selftests/kvm/x86/amx_test.c | 38 +++++++++++++++++-----
1 file changed, 30 insertions(+), 8 deletions(-)
diff --git a/tools/testing/selftests/kvm/x86/amx_test.c b/tools/testing/selftests/kvm/x86/amx_test.c
index 4ac41c1a7255..00a42a592a37 100644
--- a/tools/testing/selftests/kvm/x86/amx_test.c
+++ b/tools/testing/selftests/kvm/x86/amx_test.c
@@ -125,11 +125,17 @@ static void set_tilecfg(struct tile_config *cfg)
}
enum {
+ /* Retrieve TMM0 from guest, stash it for TEST_RESTORE_TILEDATA */
+ TEST_SAVE_TILEDATA = 1,
+
/* Check TMM0 against tiledata */
- TEST_COMPARE_TILEDATA = 1,
+ TEST_COMPARE_TILEDATA = 2,
+
+ /* Restore TMM0 from earlier save */
+ TEST_RESTORE_TILEDATA = 4,
/* Full VM save/restore */
- TEST_SAVE_RESTORE = 2,
+ TEST_SAVE_RESTORE = 8,
};
static void __attribute__((__flatten__)) guest_code(struct tile_config *amx_cfg,
@@ -150,7 +156,16 @@ static void __attribute__((__flatten__)) guest_code(struct tile_config *amx_cfg,
GUEST_SYNC(TEST_SAVE_RESTORE);
/* Check save/restore when trap to userspace */
__tileloadd(tiledata);
- GUEST_SYNC(TEST_COMPARE_TILEDATA | TEST_SAVE_RESTORE);
+ GUEST_SYNC(TEST_SAVE_TILEDATA | TEST_COMPARE_TILEDATA | TEST_SAVE_RESTORE);
+
+ /* xfd=0x40000, disable amx tiledata */
+ wrmsr(MSR_IA32_XFD, XFEATURE_MASK_XTILE_DATA);
+
+ /* host tries setting tiledata while guest XFD is set */
+ GUEST_SYNC(TEST_RESTORE_TILEDATA);
+ GUEST_SYNC(TEST_SAVE_RESTORE);
+
+ wrmsr(MSR_IA32_XFD, 0);
__tilerelease();
GUEST_SYNC(TEST_SAVE_RESTORE);
/*
@@ -210,10 +225,10 @@ int main(int argc, char *argv[])
struct kvm_vcpu *vcpu;
struct kvm_vm *vm;
struct kvm_x86_state *state;
+ struct kvm_x86_state *tile_state = NULL;
int xsave_restore_size;
vm_vaddr_t amx_cfg, tiledata, xstate;
struct ucall uc;
- u32 amx_offset;
int ret;
/*
@@ -265,20 +280,27 @@ int main(int argc, char *argv[])
/* NOT REACHED */
case UCALL_SYNC:
++iter;
+ if (uc.args[1] & TEST_SAVE_TILEDATA) {
+ fprintf(stderr, "GUEST_SYNC #%d, save tiledata\n", iter);
+ tile_state = vcpu_save_state(vcpu);
+ }
if (uc.args[1] & TEST_COMPARE_TILEDATA) {
fprintf(stderr, "GUEST_SYNC #%d, check TMM0 contents\n", iter);
/* Compacted mode, get amx offset by xsave area
* size subtract 8K amx size.
*/
- amx_offset = xsave_restore_size - NUM_TILES*TILE_SIZE;
- state = vcpu_save_state(vcpu);
- void *amx_start = (void *)state->xsave + amx_offset;
+ u32 amx_offset = xsave_restore_size - NUM_TILES*TILE_SIZE;
+ void *amx_start = (void *)tile_state->xsave + amx_offset;
void *tiles_data = (void *)addr_gva2hva(vm, tiledata);
/* Only check TMM0 register, 1 tile */
ret = memcmp(amx_start, tiles_data, TILE_SIZE);
TEST_ASSERT(ret == 0, "memcmp failed, ret=%d", ret);
- kvm_x86_state_cleanup(state);
+ }
+ if (uc.args[1] & TEST_RESTORE_TILEDATA) {
+ fprintf(stderr, "GUEST_SYNC #%d, before KVM_SET_XSAVE\n", iter);
+ vcpu_xsave_set(vcpu, tile_state->xsave);
+ fprintf(stderr, "GUEST_SYNC #%d, after KVM_SET_XSAVE\n", iter);
}
if (uc.args[1] & TEST_SAVE_RESTORE) {
fprintf(stderr, "GUEST_SYNC #%d, save/restore VM state\n", iter);
--
2.52.0
next prev parent reply other threads:[~2026-01-01 9:05 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-01 9:05 [PATCH v2 0/4] x86, fpu/kvm: fix crash with AMX Paolo Bonzini
2026-01-01 9:05 ` [PATCH 1/4] x86/fpu: Clear XSTATE_BV[i] in save state whenever XFD[i]=1 Paolo Bonzini
2026-01-03 2:06 ` Yao Yuan
2026-01-05 17:31 ` Sean Christopherson
2026-01-06 5:25 ` Yao Yuan
2026-01-06 0:54 ` Jim Mattson
2026-01-06 1:17 ` Sean Christopherson
2026-01-06 17:56 ` Jim Mattson
2026-01-15 16:07 ` Dave Hansen
2026-01-15 16:12 ` Paolo Bonzini
2026-01-15 16:27 ` Dave Hansen
2026-01-07 0:28 ` Chang S. Bae
2026-01-07 22:33 ` Paolo Bonzini
2026-01-08 3:06 ` Binbin Wu
2026-01-08 16:26 ` Paolo Bonzini
2026-01-15 15:54 ` Dave Hansen
2026-01-15 16:22 ` Paolo Bonzini
2026-01-15 18:19 ` Dave Hansen
2026-01-15 18:26 ` Paolo Bonzini
2026-01-15 23:43 ` Chang S. Bae
2026-01-01 9:05 ` [PATCH 2/4] selftests: kvm: replace numbered sync points with actions Paolo Bonzini
2026-01-06 0:02 ` Sean Christopherson
2026-01-07 22:28 ` Paolo Bonzini
2026-01-08 20:26 ` Sean Christopherson
2026-01-01 9:05 ` Paolo Bonzini [this message]
2026-01-01 9:05 ` [PATCH 4/4] selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 Paolo Bonzini
2026-01-06 1:18 ` [PATCH v2 0/4] x86, fpu/kvm: fix crash with AMX Sean Christopherson
2026-01-15 12:22 ` Borislav Petkov
2026-01-15 13:49 ` Paolo Bonzini
2026-01-15 16:39 ` Sean Christopherson
2026-01-15 17:05 ` Borislav Petkov
2026-01-15 17:12 ` Sean Christopherson
2026-01-16 12:22 ` Borislav Petkov
2026-01-21 11:35 ` Paolo Bonzini
2026-01-22 11:12 ` Borislav Petkov
2026-01-22 12:00 ` Paolo Bonzini
2026-01-23 13:23 ` Borislav Petkov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260101090516.316883-4-pbonzini@redhat.com \
--to=pbonzini@redhat.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=seanjc@google.com \
--cc=stable@vger.kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®