According to the APM volume 2, section 15.25.2: "Replicated State,"

  While nested paging is enabled, all (guest) references to the state of
  the paging registers by x86 code (MOV to/from CRn, etc.) read and write
  the guest copy of the registers.

The PAT MSR is explicitly enumerated as a "paging register" in that
section of the APM.

Implement the architected behavior by redirecting PAT MSR accesses
from vcpu->arch.pat to svm->vmcb->save.g_pat when L2 is active and
nested paging is enabled in vmcb12.

Note that the change in KVM_{GET,SET}_MSRS semantics breaks
serialization. Trigger a fixup in svm_set_nested_state() by setting
the VALID_GPAT flag in the SVM nested state header.

Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler")
Signed-off-by: Jim Mattson <jmattson@google.com>
---
 arch/x86/kvm/svm/nested.c |  1 +
 arch/x86/kvm/svm/svm.c    | 25 +++++++++++++++++--------
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index ad11b11f482e..c68511948501 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1728,6 +1728,7 @@ static int svm_get_nested_state(struct kvm_vcpu *vcpu,
 	/* First fill in the header and copy it out.  */
 	if (is_guest_mode(vcpu)) {
 		kvm_state.hdr.svm.vmcb_pa = svm->nested.vmcb12_gpa;
+		kvm_state.hdr.svm.flags = KVM_STATE_SVM_VALID_GPAT;
 		kvm_state.size += KVM_STATE_NESTED_SVM_VMCB_SIZE;
 		kvm_state.flags |= KVM_STATE_NESTED_GUEST_MODE;
 
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index b4e5a0684f57..7e192fd5fb7f 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -2675,6 +2675,12 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 			return 1;
 		msr_info->data = svm->tsc_ratio_msr;
 		break;
+	case MSR_IA32_CR_PAT:
+		if (!(is_guest_mode(vcpu) && nested_npt_enabled(svm)))
+			msr_info->data = vcpu->arch.pat;
+		else
+			msr_info->data = svm->vmcb->save.g_pat;
+		break;
 	case MSR_STAR:
 		msr_info->data = svm->vmcb01.ptr->save.star;
 		break;
@@ -2864,14 +2870,17 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
 
 		break;
 	case MSR_IA32_CR_PAT:
-		ret = kvm_set_msr_common(vcpu, msr);
-		if (ret)
-			break;
-
-		svm->vmcb01.ptr->save.g_pat = data;
-		if (is_guest_mode(vcpu))
-			nested_vmcb02_compute_g_pat(svm);
-		vmcb_mark_dirty(svm->vmcb, VMCB_NPT);
+		if (!kvm_pat_valid(data))
+			return 1;
+		if (!(is_guest_mode(vcpu) && nested_npt_enabled(svm))) {
+			vcpu->arch.pat = data;
+			svm->vmcb01.ptr->save.g_pat = data;
+			vmcb_mark_dirty(svm->vmcb01.ptr, VMCB_NPT);
+		}
+		if (is_guest_mode(vcpu)) {
+			svm->vmcb->save.g_pat = data;
+			vmcb_mark_dirty(svm->vmcb, VMCB_NPT);
+		}
 		break;
 	case MSR_IA32_SPEC_CTRL:
 		if (!msr->host_initiated &&
-- 
2.51.2.1041.gc1ab5b90ca-goog