linux-kernel - [kvm-unit-tests] x86/svm: Correctly extract the IP from LBR MSRs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251113224639.2916783-1-yosry.ahmed@linux.dev>
Date: Thu, 13 Nov 2025 22:46:39 +0000
From: Yosry Ahmed <yosry.ahmed@...ux.dev>
To: Sean Christopherson <seanjc@...gle.com>
Cc: Paolo Bonzini <pbonzini@...hat.com>,
	Jim Mattson <jmattson@...gle.com>,
	kvm@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Yosry Ahmed <yosry.ahmed@...ux.dev>
Subject: [kvm-unit-tests] x86/svm: Correctly extract the IP from LBR MSRs

Currently, only bit 63 is ignored when reading LBR MSRs. However,
different AMD CPUs use upper bits of the MSR differently. For example,
some Zen 4 processors document bit 63 in LASTBRACNHFROMIP and bits 63:61
in LASTBRANCHTOIP to be reserved. On the other hand, some Zen 5
processors bits 63:57 to be reserved in both MSRs.

Use the common denominator and always bits 63:57 when reading the LBR
MSRs, which should be sufficient testing. This fixes the test flaking on
some AMD processors that set bit 62 in LASTBRANCHTOIP.

Reported-by: Sean Christopherson <seanjc@...gle.com>
Signed-off-by: Yosry Ahmed <yosry.ahmed@...ux.dev>
---
 lib/x86/msr.h   | 8 ++++++--
 x86/svm_tests.c | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/x86/msr.h b/lib/x86/msr.h
index cc4cb8551ea1b..e586a8e931900 100644
--- a/lib/x86/msr.h
+++ b/lib/x86/msr.h
@@ -85,8 +85,12 @@
 #define MSR_IA32_LASTINTFROMIP		0x000001dd
 #define MSR_IA32_LASTINTTOIP		0x000001de
 
-/* Yes, AMD does indeed record mispredict info in the LBR records themselves. */
-#define AMD_LBR_RECORD_MISPREDICT	BIT_ULL(63)
+/*
+ * Different AMD CPUs use the upper bits of the IP LBRs differently. For the
+ * purposes of tests, use the common denominator of the IP bits.
+ */
+#define AMD_LBR_RECORD_IP_BITS		57
+#define AMD_LBR_RECORD_IP_MASK		((1UL << AMD_LBR_RECORD_IP_BITS)-1)
 
 #define LBR_INFO_MISPRED		BIT_ULL(63)
 #define LBR_INFO_IN_TX			BIT_ULL(62)
diff --git a/x86/svm_tests.c b/x86/svm_tests.c
index 80d5aeb108650..43e76badf1638 100644
--- a/x86/svm_tests.c
+++ b/x86/svm_tests.c
@@ -2953,7 +2953,7 @@ static void svm_no_nm_test(void)
 
 static u64 amd_get_lbr_rip(u32 msr)
 {
-	return rdmsr(msr) & ~AMD_LBR_RECORD_MISPREDICT;
+	return rdmsr(msr) & AMD_LBR_RECORD_IP_MASK;
 }
 
 #define HOST_CHECK_LBR(from_expected, to_expected)					\
-- 
2.52.0.rc1.455.g30608eb744-goog