The testcase log: kvm-unit-tests]# TESTNAME=svm_npt TIMEOUT=90s MACHINE= ACCEL= ./x86/run x86/svm_npt.flat -smp 2 -cpu max,+svm -m 4g ... enabling apic smp: waiting for 1 APs enabling apic setup: CPU 1 online paging enabled cr0 = 80010011 cr3 = 10bf000 cr4 = 20 NPT detected - running all tests with NPT enabled PASS: npt_nx PASS: npt_np PASS: npt_us PASS: npt_rw npt_rw_pfwalk_check: CR3: 10bf000 EXIT_INFO_2: 10bf5f8 FAIL: npt_rw_pfwalk ... CR4=0x20, PAE is enabled, CR3 is PDPT base address, aligned on a 32-byte boundary, looking at the above test results, it is still 4k alignment in reality, exit_info_2 in vmcb stores the falut address of GPA. So, after aligning the GPA to PAGE_SIZE, compare the CR3 and GPA. PAE Paging (CR4.PAE=1)—This field is 27 bits and occupies bits 31:5. The CR3 register points to the base address of the page-directory-pointer table. The page-directory-pointer table is aligned on a 32-byte boundary, with the low 5 address bits 4:0 assumed to be 0. Table C-1. SVM Intercept Codes (continued): Code Name Cause 400h VMEXIT_NPF EXITINFO2 contains the guest physical address causing the fault. This is described in the AMD64 Architecture Programmers Manual Volume 2, Order Number 24593. Signed-off-by: Qiang Ma <maqianga@xxxxxxxxxxxxx> --- x86/svm_npt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x86/svm_npt.c b/x86/svm_npt.c index bd5e8f35..08614d84 100644 --- a/x86/svm_npt.c +++ b/x86/svm_npt.c @@ -132,7 +132,7 @@ static bool npt_rw_pfwalk_check(struct svm_test *test) return (vmcb->control.exit_code == SVM_EXIT_NPF) && (vmcb->control.exit_info_1 == 0x200000007ULL) - && (vmcb->control.exit_info_2 == read_cr3()); + && ((vmcb->control.exit_info_2 & PAGE_MASK) == read_cr3()); } static bool was_x2apic; -- 2.20.1