Add a helper to configure save.rip and save.rsp, and use it in the LBRV tests, which use a "bare" VMRUN to avoid branches around VMRUN. This fixes a bug where the LBRV tests explode in confusing ways if the compiler generates guest code that touches the stack in *any* way. Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx> --- x86/svm.c | 7 ++++++- x86/svm.h | 2 +- x86/svm_tests.c | 8 ++++---- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/x86/svm.c b/x86/svm.c index ba435b4a..c24cb97c 100644 --- a/x86/svm.c +++ b/x86/svm.c @@ -212,10 +212,15 @@ struct svm_test *v2_test; u64 guest_stack[10000]; -int __svm_vmrun(u64 rip) +void svm_setup_vmrun(u64 rip) { vmcb->save.rip = (ulong)rip; vmcb->save.rsp = (ulong)(guest_stack + ARRAY_SIZE(guest_stack)); +} + +int __svm_vmrun(u64 rip) +{ + svm_setup_vmrun(rip); regs.rdi = (ulong)v2_test; asm volatile ( diff --git a/x86/svm.h b/x86/svm.h index 766ff7e3..4857212b 100644 --- a/x86/svm.h +++ b/x86/svm.h @@ -425,8 +425,8 @@ void inc_test_stage(struct svm_test *test); void vmcb_ident(struct vmcb *vmcb); struct regs get_regs(void); void vmmcall(void); +void svm_setup_vmrun(u64 rip); int __svm_vmrun(u64 rip); -void __svm_bare_vmrun(void); int svm_vmrun(void); void test_set_guest(test_guest_func func); u64* get_npt_pte(u64 *pml4, u64 guest_addr, int level); diff --git a/x86/svm_tests.c b/x86/svm_tests.c index 27ce47b4..e20f6697 100644 --- a/x86/svm_tests.c +++ b/x86/svm_tests.c @@ -2895,7 +2895,7 @@ static void svm_lbrv_test1(void) { report(true, "Test that without LBRV enabled, guest LBR state does 'leak' to the host(1)"); - vmcb->save.rip = (ulong)svm_lbrv_test_guest1; + svm_setup_vmrun((u64)svm_lbrv_test_guest1); vmcb->control.virt_ext = 0; wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); @@ -2917,7 +2917,7 @@ static void svm_lbrv_test2(void) { report(true, "Test that without LBRV enabled, guest LBR state does 'leak' to the host(2)"); - vmcb->save.rip = (ulong)svm_lbrv_test_guest2; + svm_setup_vmrun((u64)svm_lbrv_test_guest2); vmcb->control.virt_ext = 0; wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); @@ -2945,7 +2945,7 @@ static void svm_lbrv_nested_test1(void) } report(true, "Test that with LBRV enabled, guest LBR state doesn't leak (1)"); - vmcb->save.rip = (ulong)svm_lbrv_test_guest1; + svm_setup_vmrun((u64)svm_lbrv_test_guest1); vmcb->control.virt_ext = LBR_CTL_ENABLE_MASK; vmcb->save.dbgctl = DEBUGCTLMSR_LBR; @@ -2978,7 +2978,7 @@ static void svm_lbrv_nested_test2(void) } report(true, "Test that with LBRV enabled, guest LBR state doesn't leak (2)"); - vmcb->save.rip = (ulong)svm_lbrv_test_guest2; + svm_setup_vmrun((u64)svm_lbrv_test_guest2); vmcb->control.virt_ext = LBR_CTL_ENABLE_MASK; vmcb->save.dbgctl = 0; -- 2.41.0.162.gfafddb0af9-goog