From nobody Sun Feb 8 08:27:33 2026 Received: from out-183.mta0.migadu.com (out-183.mta0.migadu.com [91.218.175.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0498123185D for ; Thu, 15 Jan 2026 01:13:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.183 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439613; cv=none; b=SB4tmGLkrp/I+X1SuyE1xupI4BDNc8wskKDbdEBtIP7OlnJ5DQyeIC2/pSF+pkIQRqm0HefaIUxnWnr5/jgZTfvSKNmt7vSbd/RBEVmhz7rm1xIpWpZucHRE1CD42zYN2iK2yA5R/LWzaLI3zdPDt/p9H6x58PmXeRFLMbOmrfI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439613; c=relaxed/simple; bh=KybUh/BRRf0sXH3LbhLQ5wT2bC+SrW3SAoOE77RFvRY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=EK9CjNUczNo4/bp+CQmIEJpImwn2hhEDeotG5sutPXrQNuaFUv2UCjhDeehe19Pi7UIas0tsIqrpjWLlUco/GyMMumdDvIFJhha+VZRTDR+wJHRsanp7bGmpX7IetxCK7DD8bgq6KvnK3wHgoOJbuwv6VSwBGqN9xMW8vqyyy8o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=X8CfVZgl; arc=none smtp.client-ip=91.218.175.183 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="X8CfVZgl" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439608; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JC6dMFBz0Nq3n10+HuEIFyVp7/kFO2fc5OMKv6jt4XI=; b=X8CfVZglGsYgFr9AVOVx1yndDGaAAZXrtsEKikRkIlBqRTIgYOdVqItNqJBdYVdq78zs1j mLU9BAVanUeF6ftZTfkOPI5YpqfuVPYGzXNpcMRsnk32iwVa2rEMbjobb9OtrYKAAlWxG+ zWhoWomFBdf41vVPXi7K4B7H3R4zpYI= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 01/26] KVM: SVM: Switch svm_copy_lbrs() to a macro Date: Thu, 15 Jan 2026 01:12:47 +0000 Message-ID: <20260115011312.3675857-2-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" In preparation for using svm_copy_lbrs() with 'struct vmcb_save_area' without a containing 'struct vmcb', and later even 'struct vmcb_save_area_cached', make it a macro. Pull the call to vmcb_mark_dirty() out to the callers. Macros are generally not preferred compared to functions, mainly due to type-safety. However, in this case it seems like having a simple macro copying a few fields is better than copy-pasting the same 5 lines of code in different places. On the bright side, pulling vmcb_mark_dirty() calls to the callers makes it clear that in one case, vmcb_mark_dirty() was being called on VMCB12. It is not architecturally defined for the CPU to clear arbitrary clean bits, and it is not needed, so drop that one call. Technically fixes the non-architectural behavior of setting the dirty bit on VMCB12. Fixes: d20c796ca370 ("KVM: x86: nSVM: implement nested LBR virtualization") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 16 ++++++++++------ arch/x86/kvm/svm/svm.c | 11 ----------- arch/x86/kvm/svm/svm.h | 10 +++++++++- 3 files changed, 19 insertions(+), 18 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index f295a41ec659..58f843681a71 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -712,10 +712,12 @@ static void nested_vmcb02_prepare_save(struct vcpu_sv= m *svm, struct vmcb *vmcb12 * Reserved bits of DEBUGCTL are ignored. Be consistent with * svm_set_msr's definition of reserved bits. */ - svm_copy_lbrs(vmcb02, vmcb12); + svm_copy_lbrs(&vmcb02->save, &vmcb12->save); + vmcb_mark_dirty(vmcb02, VMCB_LBR); vmcb02->save.dbgctl &=3D ~DEBUGCTL_RESERVED_BITS; } else { - svm_copy_lbrs(vmcb02, vmcb01); + svm_copy_lbrs(&vmcb02->save, &vmcb01->save); + vmcb_mark_dirty(vmcb02, VMCB_LBR); } svm_update_lbrv(&svm->vcpu); } @@ -1238,10 +1240,12 @@ int nested_svm_vmexit(struct vcpu_svm *svm) kvm_make_request(KVM_REQ_EVENT, &svm->vcpu); =20 if (unlikely(guest_cpu_cap_has(vcpu, X86_FEATURE_LBRV) && - (svm->nested.ctl.virt_ext & LBR_CTL_ENABLE_MASK))) - svm_copy_lbrs(vmcb12, vmcb02); - else - svm_copy_lbrs(vmcb01, vmcb02); + (svm->nested.ctl.virt_ext & LBR_CTL_ENABLE_MASK))) { + svm_copy_lbrs(&vmcb12->save, &vmcb02->save); + } else { + svm_copy_lbrs(&vmcb01->save, &vmcb02->save); + vmcb_mark_dirty(vmcb01, VMCB_LBR); + } =20 svm_update_lbrv(vcpu); =20 diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 7041498a8091..a387b52032cd 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -841,17 +841,6 @@ static void svm_recalc_msr_intercepts(struct kvm_vcpu = *vcpu) */ } =20 -void svm_copy_lbrs(struct vmcb *to_vmcb, struct vmcb *from_vmcb) -{ - to_vmcb->save.dbgctl =3D from_vmcb->save.dbgctl; - to_vmcb->save.br_from =3D from_vmcb->save.br_from; - to_vmcb->save.br_to =3D from_vmcb->save.br_to; - to_vmcb->save.last_excp_from =3D from_vmcb->save.last_excp_from; - to_vmcb->save.last_excp_to =3D from_vmcb->save.last_excp_to; - - vmcb_mark_dirty(to_vmcb, VMCB_LBR); -} - static void __svm_enable_lbrv(struct kvm_vcpu *vcpu) { to_svm(vcpu)->vmcb->control.virt_ext |=3D LBR_CTL_ENABLE_MASK; diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 7d28a739865f..2ce62cc55d7b 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -705,8 +705,16 @@ static inline void *svm_vcpu_alloc_msrpm(void) return svm_alloc_permissions_map(MSRPM_SIZE, GFP_KERNEL_ACCOUNT); } =20 +#define svm_copy_lbrs(to, from) \ +({ \ + (to)->dbgctl =3D (from)->dbgctl; \ + (to)->br_from =3D (from)->br_from; \ + (to)->br_to =3D (from)->br_to; \ + (to)->last_excp_from =3D (from)->last_excp_from; \ + (to)->last_excp_to =3D (from)->last_excp_to; \ +}) + void svm_vcpu_free_msrpm(void *msrpm); -void svm_copy_lbrs(struct vmcb *to_vmcb, struct vmcb *from_vmcb); void svm_enable_lbrv(struct kvm_vcpu *vcpu); void svm_update_lbrv(struct kvm_vcpu *vcpu); =20 --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-188.mta0.migadu.com (out-188.mta0.migadu.com [91.218.175.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC50125776 for ; Thu, 15 Jan 2026 01:13:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439615; cv=none; b=eIMAqQTxETpAcIJHpSE5HPPN94XOQV0vnUx2+HGp5o4rUsVpWRkrK5Gy1MD3LMDdzXryt6Va4JLxAb318mCXxXfOMDf/Djv8KHSYzRiPhL0MxUid+A6nB+U7pCsDtIshGYjzN5lrJM3YTLAK7avF8iWkJ2txh6x6rTI7NrdKgGM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439615; c=relaxed/simple; bh=uQPLXjFDg6ZFEhd8vy7B1DGkEFfDiXAQ0XwqZPVm1rA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jqYtZuzZiE7BIvXst470o2Y16VPVeUPh6YNTD9vtXVcUdn9Ag2m3su3PLcB8P26OmyOGp+luW+v86UewYM/BcqGws0sHRt4HHKyJzK/HEzO6bXFgI2Q4yi/kRGZRi2lcmI+28U1++PYVoWTodakCdeiR98DVSpP/DwfCnWbNNBk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=a2ZZyLX0; arc=none smtp.client-ip=91.218.175.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="a2ZZyLX0" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439610; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=s7LxR8DM4ndhbBh+39vPuUgm/qdJCgyvaLXfvcbZYjw=; b=a2ZZyLX0JpogKYP5a5MaErttjVYYFrzCbqO8ZvMDlRRDvnOBbWhROAQNyUEgZejonqWITv LEpRMJIpEp/dx9kC/sfqSev0dfm8aSXYUJzhPAGk2HTvJSi/yWKhp4rb365X3ao/ns+DLe PTNXVbx4xk6EGapkNYYhC9RxjZSDf2U= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org, Jim Mattson Subject: [PATCH v4 02/26] KVM: SVM: Add missing save/restore handling of LBR MSRs Date: Thu, 15 Jan 2026 01:12:48 +0000 Message-ID: <20260115011312.3675857-3-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" MSR_IA32_DEBUGCTLMSR and LBR MSRs are currently not enumerated by KVM_GET_MSR_INDEX_LIST, and LBR MSRs cannot be set with KVM_SET_MSRS. So save/restore is completely broken. Fix it by adding the MSRs to msrs_to_save_base, and allowing writes to LBR MSRs from userspace only (as they are read-only MSRs). Additionally, to correctly restore L1's LBRs while L2 is running, make sure the LBRs are copied from the captured VMCB01 save area in svm_copy_vmrun_state(). Fixes: 24e09cbf480a ("KVM: SVM: enable LBR virtualization") Cc: stable@vger.kernel.org Reported-by: Jim Mattson Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 3 +++ arch/x86/kvm/svm/svm.c | 20 ++++++++++++++++++++ arch/x86/kvm/x86.c | 3 +++ 3 files changed, 26 insertions(+) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 58f843681a71..03a2c4390676 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1106,6 +1106,9 @@ void svm_copy_vmrun_state(struct vmcb_save_area *to_s= ave, to_save->isst_addr =3D from_save->isst_addr; to_save->ssp =3D from_save->ssp; } + + if (lbrv) + svm_copy_lbrs(to_save, from_save); } =20 void svm_copy_vmloadsave_state(struct vmcb *to_vmcb, struct vmcb *from_vmc= b) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index a387b52032cd..c6ed59e5f0b8 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3065,6 +3065,26 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct= msr_data *msr) vmcb_mark_dirty(svm->vmcb, VMCB_LBR); svm_update_lbrv(vcpu); break; + case MSR_IA32_LASTBRANCHFROMIP: + if (!msr->host_initiated) + return 1; + svm->vmcb->save.br_from =3D data; + break; + case MSR_IA32_LASTBRANCHTOIP: + if (!msr->host_initiated) + return 1; + svm->vmcb->save.br_to =3D data; + break; + case MSR_IA32_LASTINTFROMIP: + if (!msr->host_initiated) + return 1; + svm->vmcb->save.last_excp_from =3D data; + break; + case MSR_IA32_LASTINTTOIP: + if (!msr->host_initiated) + return 1; + svm->vmcb->save.last_excp_to =3D data; + break; case MSR_VM_HSAVE_PA: /* * Old kernels did not validate the value written to diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 3d4e07f9cff5..9c3099e76f3c 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -349,6 +349,9 @@ static const u32 msrs_to_save_base[] =3D { MSR_IA32_U_CET, MSR_IA32_S_CET, MSR_IA32_PL0_SSP, MSR_IA32_PL1_SSP, MSR_IA32_PL2_SSP, MSR_IA32_PL3_SSP, MSR_IA32_INT_SSP_TAB, + MSR_IA32_DEBUGCTLMSR, + MSR_IA32_LASTBRANCHFROMIP, MSR_IA32_LASTBRANCHTOIP, + MSR_IA32_LASTINTFROMIP, MSR_IA32_LASTINTTOIP, }; =20 static const u32 msrs_to_save_pmu[] =3D { --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-172.mta0.migadu.com (out-172.mta0.migadu.com [91.218.175.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 63C8A248880 for ; Thu, 15 Jan 2026 01:13:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439620; cv=none; b=Ft23k8GZSbr8FQLiwR01l0iRufVRdFmeL9iFM3E1aOQShLGaYYaxBN5OYuzRBlYaZRvGjYJm4ptLwIzZMQxM68kChWM67m9cC/l9gXkd7tq2bRaR4xlyq5OFFpqxD9+yckGaifoR5mySnsLFa2enO8iqkEev+RFnMd7MIK13ZWo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439620; c=relaxed/simple; bh=8KcsBXVOOyyGKmxX7UEdEQdFNc9BgDj+bpUHeZ4MD/c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YJTXooze/JZa4pcY7rbgSDfkXWzuZoenNC1x8WWcypyHVaajwpZs7eQ73FlZ+RrYVs/e+oboEmeyMuwIQnbwoWai0/Iu2tvULrZj361U2ju7BpBU+gwsQE12jcAwLTbNOroS3NxK7Q5WVbspGv/9CSi0bAK0qxPU7FwyRQWu/pY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=sjjaI41W; arc=none smtp.client-ip=91.218.175.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="sjjaI41W" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439612; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=MIGZmNEH1XnLZ0kZvZ028HYRTub7tS3joetCerTLltA=; b=sjjaI41WLtIeWiE1GZQK2a4aX2SehCbExLGd1dvX6e4FCghlJ4gghfadI9L+MLzNLXxKg/ PBSBMMicYzLTDADWtOylky00Vd3Dxsp+jVbOmFQXRmBPbV4e6/iJ/2xATtwBrWpOVXK7SY /4tcNnEkBzOYVNGQ8cDUplaVTHMQ5nk= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed Subject: [PATCH v4 03/26] KVM: selftests: Add a test for LBR save/restore (ft. nested) Date: Thu, 15 Jan 2026 01:12:49 +0000 Message-ID: <20260115011312.3675857-4-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Add a selftest exercising save/restore with usage of LBRs in both L1 and L2, and making sure all LBRs remain intact. Signed-off-by: Yosry Ahmed --- tools/testing/selftests/kvm/Makefile.kvm | 1 + .../selftests/kvm/include/x86/processor.h | 5 + .../selftests/kvm/x86/svm_lbr_nested_state.c | 155 ++++++++++++++++++ 3 files changed, 161 insertions(+) create mode 100644 tools/testing/selftests/kvm/x86/svm_lbr_nested_state.c diff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selft= ests/kvm/Makefile.kvm index 33ff81606638..a7dbd7a79fca 100644 --- a/tools/testing/selftests/kvm/Makefile.kvm +++ b/tools/testing/selftests/kvm/Makefile.kvm @@ -111,6 +111,7 @@ TEST_GEN_PROGS_x86 +=3D x86/svm_vmcall_test TEST_GEN_PROGS_x86 +=3D x86/svm_int_ctl_test TEST_GEN_PROGS_x86 +=3D x86/svm_nested_shutdown_test TEST_GEN_PROGS_x86 +=3D x86/svm_nested_soft_inject_test +TEST_GEN_PROGS_x86 +=3D x86/svm_lbr_nested_state TEST_GEN_PROGS_x86 +=3D x86/tsc_scaling_sync TEST_GEN_PROGS_x86 +=3D x86/sync_regs_test TEST_GEN_PROGS_x86 +=3D x86/ucna_injection_test diff --git a/tools/testing/selftests/kvm/include/x86/processor.h b/tools/te= sting/selftests/kvm/include/x86/processor.h index 8f130e7d7048..855cc7aae83c 100644 --- a/tools/testing/selftests/kvm/include/x86/processor.h +++ b/tools/testing/selftests/kvm/include/x86/processor.h @@ -1359,6 +1359,11 @@ static inline bool kvm_is_ignore_msrs(void) return get_kvm_param_bool("ignore_msrs"); } =20 +static inline bool kvm_is_lbrv_enabled(void) +{ + return !!get_kvm_amd_param_integer("lbrv"); +} + uint64_t *vm_get_pte(struct kvm_vm *vm, uint64_t vaddr); =20 uint64_t kvm_hypercall(uint64_t nr, uint64_t a0, uint64_t a1, uint64_t a2, diff --git a/tools/testing/selftests/kvm/x86/svm_lbr_nested_state.c b/tools= /testing/selftests/kvm/x86/svm_lbr_nested_state.c new file mode 100644 index 000000000000..a343279546fd --- /dev/null +++ b/tools/testing/selftests/kvm/x86/svm_lbr_nested_state.c @@ -0,0 +1,155 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * svm_lbr_nested_state + * + * Test that LBRs are maintained correctly in both L1 and L2 during + * save/restore. + * + * Copyright (C) 2025, Google, Inc. + */ + +#include "test_util.h" +#include "kvm_util.h" +#include "processor.h" +#include "svm_util.h" + + +#define L2_GUEST_STACK_SIZE 64 + +#define DO_BRANCH() asm volatile("jmp 1f\n 1: nop") + +struct lbr_branch { + u64 from, to; +}; + +volatile struct lbr_branch l2_branch; + +#define RECORD_BRANCH(b, s) \ +({ \ + wrmsr(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR); \ + DO_BRANCH(); \ + (b)->from =3D rdmsr(MSR_IA32_LASTBRANCHFROMIP); \ + (b)->to =3D rdmsr(MSR_IA32_LASTBRANCHTOIP); \ + /* Disabe LBR right after to avoid overriding the IPs */ \ + wrmsr(MSR_IA32_DEBUGCTLMSR, 0); \ + \ + GUEST_ASSERT_NE((b)->from, 0); \ + GUEST_ASSERT_NE((b)->to, 0); \ + GUEST_PRINTF("%s: (0x%lx, 0x%lx)\n", (s), (b)->from, (b)->to); \ +}) \ + +#define CHECK_BRANCH_MSRS(b) \ +({ \ + GUEST_ASSERT_EQ((b)->from, rdmsr(MSR_IA32_LASTBRANCHFROMIP)); \ + GUEST_ASSERT_EQ((b)->to, rdmsr(MSR_IA32_LASTBRANCHTOIP)); \ +}) + +#define CHECK_BRANCH_VMCB(b, vmcb) \ +({ \ + GUEST_ASSERT_EQ((b)->from, vmcb->save.br_from); \ + GUEST_ASSERT_EQ((b)->to, vmcb->save.br_to); \ +}) \ + +static void l2_guest_code(struct svm_test_data *svm) +{ + /* Record a branch, trigger save/restore, and make sure LBRs are intact */ + RECORD_BRANCH(&l2_branch, "L2 branch"); + GUEST_SYNC(true); + CHECK_BRANCH_MSRS(&l2_branch); + vmmcall(); +} + +static void l1_guest_code(struct svm_test_data *svm, bool nested_lbrv) +{ + unsigned long l2_guest_stack[L2_GUEST_STACK_SIZE]; + struct vmcb *vmcb =3D svm->vmcb; + struct lbr_branch l1_branch; + + /* Record a branch, trigger save/restore, and make sure LBRs are intact */ + RECORD_BRANCH(&l1_branch, "L1 branch"); + GUEST_SYNC(true); + CHECK_BRANCH_MSRS(&l1_branch); + + /* Run L2, which will also do the same */ + generic_svm_setup(svm, l2_guest_code, + &l2_guest_stack[L2_GUEST_STACK_SIZE]); + + if (nested_lbrv) + vmcb->control.virt_ext =3D LBR_CTL_ENABLE_MASK; + else + vmcb->control.virt_ext &=3D ~LBR_CTL_ENABLE_MASK; + + run_guest(vmcb, svm->vmcb_gpa); + GUEST_ASSERT(svm->vmcb->control.exit_code =3D=3D SVM_EXIT_VMMCALL); + + /* Trigger save/restore one more time before checking, just for kicks */ + GUEST_SYNC(true); + + /* + * If LBR_CTL_ENABLE is set, L1 and L2 should have separate LBR MSRs, so + * expect L1's LBRs to remain intact and L2 LBRs to be in the VMCB. + * Otherwise, the MSRs are shared between L1 & L2 so expect L2's LBRs. + */ + if (nested_lbrv) { + CHECK_BRANCH_MSRS(&l1_branch); + CHECK_BRANCH_VMCB(&l2_branch, vmcb); + } else { + CHECK_BRANCH_MSRS(&l2_branch); + } + GUEST_DONE(); +} + +void test_lbrv_nested_state(bool nested_lbrv) +{ + struct kvm_x86_state *state =3D NULL; + struct kvm_vcpu *vcpu; + vm_vaddr_t svm_gva; + struct kvm_vm *vm; + struct ucall uc; + + pr_info("Testing with nested LBRV %s\n", nested_lbrv ? "enabled" : "disab= led"); + + vm =3D vm_create_with_one_vcpu(&vcpu, l1_guest_code); + vcpu_alloc_svm(vm, &svm_gva); + vcpu_args_set(vcpu, 2, svm_gva, nested_lbrv); + + for (;;) { + vcpu_run(vcpu); + TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_IO); + switch (get_ucall(vcpu, &uc)) { + case UCALL_SYNC: + /* Save the vCPU state and restore it in a new VM on sync */ + pr_info("Guest triggered save/restore.\n"); + state =3D vcpu_save_state(vcpu); + kvm_vm_release(vm); + vcpu =3D vm_recreate_with_one_vcpu(vm); + vcpu_load_state(vcpu, state); + break; + case UCALL_ABORT: + REPORT_GUEST_ASSERT(uc); + /* NOT REACHED */ + case UCALL_DONE: + goto done; + case UCALL_PRINTF: + pr_info("%s", uc.buffer); + break; + default: + TEST_FAIL("Unknown ucall %lu", uc.cmd); + } + } +done: + if (state) + kvm_x86_state_cleanup(state); + kvm_vm_free(vm); +} + +int main(int argc, char *argv[]) +{ + TEST_REQUIRE(kvm_cpu_has(X86_FEATURE_SVM)); + TEST_REQUIRE(kvm_is_lbrv_enabled()); + + test_lbrv_nested_state(/*nested_lbrv=3D*/false); + test_lbrv_nested_state(/*nested_lbrv=3D*/true); + + return 0; +} --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-178.mta0.migadu.com (out-178.mta0.migadu.com [91.218.175.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E3193223702 for ; Thu, 15 Jan 2026 01:13:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439620; cv=none; b=jWim7lz8UCkI7SlsEnMK9bAM3ATKdLODTvy9ZCJYdotYDc3Cpb671T6BfEgx6Q6jZAezsBQlI9Mg7WnJRuGbktIH5mhDWJQGdLPXDN/Wb/8L8RJaWl8s31LtLVP3UQQ5fNKKrSPAhFCFJcr8o+pYvvL3YC7Ts68jxdrOyYHCFFs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439620; c=relaxed/simple; bh=ChBGH0EIeAQB4+XYtp32lQzDWmZ2qjzvmHmcPEp31bw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=lERJCmX8fQMhlaRpwaYDSEWINQfrfsKykJOQe0pWbuUQb1/8ZcOJI05QobfLGqpvrNIWYo8B853by/B2qVU7cbw7UONi/NLOntWu/AK70Bxr9j0r/t6SXD8GIfN5PaClkmVn6R6sBef+r9BkBjPOEFDuU85pITqovvzkEr2sOKQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=SHcI4Ojk; arc=none smtp.client-ip=91.218.175.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="SHcI4Ojk" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439614; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=aQZKrV5jtvMOu7N9t4ncabozUsO3LP1NQaZvmuk0EHw=; b=SHcI4Ojk4so0EpLbpdpU7IeEMuWJWwWrSw3LUxWcpBXKwvyaMIoqueXTXP4fxfYWcCQFWh ceWqclXyIhOpRUIUMn81MGACU+oSCLexeMUzBUWYkW3FMjZOQA1l2dSrcCl5nzk4sqP/Y5 K7F1j6EyhvqfTsz7Wokw4cJq3Cgj2jU= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 04/26] KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Date: Thu, 15 Jan 2026 01:12:50 +0000 Message-ID: <20260115011312.3675857-5-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" nested_svm_vmrun() currently only injects a #GP if kvm_vcpu_map() fails with -EINVAL. But it could also fail with -EFAULT if creating a host mapping failed. Inject a #GP in all cases, no reason to treat failure modes differently. Fixes: 8c5fbf1a7231 ("KVM/nSVM: Use the new mapping API for mapping guest m= emory") CC: stable@vger.kernel.org Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 03a2c4390676..5f9c5ccc4783 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1015,12 +1015,9 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) } =20 vmcb12_gpa =3D svm->vmcb->save.rax; - ret =3D kvm_vcpu_map(vcpu, gpa_to_gfn(vmcb12_gpa), &map); - if (ret =3D=3D -EINVAL) { + if (kvm_vcpu_map(vcpu, gpa_to_gfn(vmcb12_gpa), &map)) { kvm_inject_gp(vcpu, 0); return 1; - } else if (ret) { - return kvm_skip_emulated_instruction(vcpu); } =20 ret =3D kvm_skip_emulated_instruction(vcpu); --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-185.mta0.migadu.com (out-185.mta0.migadu.com [91.218.175.185]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7C74C242925 for ; Thu, 15 Jan 2026 01:13:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.185 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439625; cv=none; b=JaW67Eaze8V/s264yFSDt2JszzoUnlS17klPPimkIoiEpEej/3gQ+5FEjYmX85uXOf33GEdSfj/tzglssFOSgnkC3KUUSzjz0/ypVDqdTnJwIxSPvEJZh+rmN3XDkaaXU6I8Ia7fYl9CApsoF2mOLK+RgCCcp0Dnb4UN6vYjVFk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439625; c=relaxed/simple; bh=kPBEhtet7msW97U1UtkWQGIvip99lcuempTwCIzWZFo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=OFXH92sTVnKVDIebg48PAqKen2K9mQuTbEnyANQYhU9qMbVy7aA6BJ69MC6R84cQf7mbGojZGkb4g/GuT2T4juazqGxWOjVtc820cOLrVgXuKr+sir7ilIT/HO3KRqn4exejhLQp6ApMnXsN62VDabmP+DUw11aN8fZQUFVZVPY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=N2DwNffe; arc=none smtp.client-ip=91.218.175.185 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="N2DwNffe" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439615; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mt6kDFRpZShd33pI8JsOKS60v65HU+EMybZ/DpWM4YU=; b=N2DwNffeDX8lNt2584gxr5RQ79K63tB9QilojzNKYGwzioxI0GJigiS6aDCvCYJQTkcVyw Q9bESgh338IFnK5aokx2z8wOQ+x3FSEDg/h9BANRwGEOGQAlThbiWzalzwMQVY5+Ekkk6y 077Daxj+aswBnkH/7zplP79LkAlRm5Y= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 05/26] KVM: nSVM: Triple fault if mapping VMCB12 fails on nested #VMEXIT Date: Thu, 15 Jan 2026 01:12:51 +0000 Message-ID: <20260115011312.3675857-6-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" KVM currently injects a #GP and hopes for the best if mapping VMCB12 fails on nested #VMEXIT, and only if the failure mode is -EINVAL. Mapping the VMCB12 could also fail if creating host mappings fails. After the #GP is injected, nested_svm_vmexit() bails early, without cleaning up (e.g. KVM_REQ_GET_NESTED_STATE_PAGES is set, is_guest_mode() is true, etc). Move mapping VMCB12 a bit later, after leaving guest mode and clearing KVM_REQ_GET_NESTED_STATE_PAGES, right before the VMCB12 is actually used. Instead of optionally injecting a #GP, triple fault the guest if mapping VMCB12 fails since KVM cannot make a sane recovery. The APM states that a #VMEXIT will triple fault if host state is illegal or an exception occurs while loading host state, so the behavior is not entirely made up. Also update the WARN_ON() in svm_get_nested_state_pages() to WARN_ON_ONCE() to avoid future user-triggeable bugs spamming kernel logs and potentially causing issues. Fixes: cf74a78b229d ("KVM: SVM: Add VMEXIT handler and intercepts") CC: stable@vger.kernel.org Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 5f9c5ccc4783..593f7005cdc7 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1127,24 +1127,14 @@ void svm_copy_vmloadsave_state(struct vmcb *to_vmcb= , struct vmcb *from_vmcb) int nested_svm_vmexit(struct vcpu_svm *svm) { struct kvm_vcpu *vcpu =3D &svm->vcpu; + gpa_t vmcb12_gpa =3D svm->nested.vmcb12_gpa; struct vmcb *vmcb01 =3D svm->vmcb01.ptr; struct vmcb *vmcb02 =3D svm->nested.vmcb02.ptr; struct vmcb *vmcb12; struct kvm_host_map map; - int rc; - - rc =3D kvm_vcpu_map(vcpu, gpa_to_gfn(svm->nested.vmcb12_gpa), &map); - if (rc) { - if (rc =3D=3D -EINVAL) - kvm_inject_gp(vcpu, 0); - return 1; - } - - vmcb12 =3D map.hva; =20 /* Exit Guest-Mode */ leave_guest_mode(vcpu); - svm->nested.vmcb12_gpa =3D 0; WARN_ON_ONCE(svm->nested.nested_run_pending); =20 kvm_clear_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu); @@ -1152,8 +1142,16 @@ int nested_svm_vmexit(struct vcpu_svm *svm) /* in case we halted in L2 */ kvm_set_mp_state(vcpu, KVM_MP_STATE_RUNNABLE); =20 + svm->nested.vmcb12_gpa =3D 0; + + if (kvm_vcpu_map(vcpu, gpa_to_gfn(vmcb12_gpa), &map)) { + kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu); + return 1; + } + /* Give the current vmcb to the guest */ =20 + vmcb12 =3D map.hva; vmcb12->save.es =3D vmcb02->save.es; vmcb12->save.cs =3D vmcb02->save.cs; vmcb12->save.ss =3D vmcb02->save.ss; @@ -1311,8 +1309,7 @@ int nested_svm_vmexit(struct vcpu_svm *svm) =20 nested_svm_uninit_mmu_context(vcpu); =20 - rc =3D nested_svm_load_cr3(vcpu, vmcb01->save.cr3, false, true); - if (rc) + if (nested_svm_load_cr3(vcpu, vmcb01->save.cr3, false, true)) return 1; =20 /* @@ -1947,7 +1944,7 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, =20 static bool svm_get_nested_state_pages(struct kvm_vcpu *vcpu) { - if (WARN_ON(!is_guest_mode(vcpu))) + if (WARN_ON_ONCE(!is_guest_mode(vcpu))) return true; =20 if (!vcpu->arch.pdptrs_from_userspace && --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-186.mta0.migadu.com (out-186.mta0.migadu.com [91.218.175.186]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 26DF823EA83 for ; Thu, 15 Jan 2026 01:13:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.186 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439634; cv=none; b=UK1DdqQbQL24WABvLtQBKd8y77KQKlxckjKwt/pFJkXTqsBHfncwC/MtqR1qoh99u29nrSyWN5cdY7fKmA54NPgTsQOirywvqqM2Jwhq/W+VR64MLGcBLqhFU2CLl2hCjNrg4hZiI4mW3Cgww8hcT8xlFcQf9eBPDxcvkifq3S0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439634; c=relaxed/simple; bh=9czlhT9MelW42l6PUXo8zE52l7aPZBgwxv7cMG0tNXs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JwOCwvvMK2OdU4UFxHA3KoRND2lVmCJFhOR12+zBPuhrmobjqp1asUecORgmk563A0DdbLR+YJ7b93KOtk+LAJHcjyEyNA4XaVkeYo/ov41nYOKtEMudZF+bro7vt35jPETk3awDk9ufw+rWmdlisk1kSAjKsdQwzvFKVmH3iBc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=LVPMrDoL; arc=none smtp.client-ip=91.218.175.186 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="LVPMrDoL" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439617; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=SMwRBNhJ5MsjLOU4PGjL+UV7F3zowtk6TenpcpWPABo=; b=LVPMrDoLAOjOosERicXVuB4ZBrVsUlSLfrjFwm8XnOpmRKPn1+JkAPxba6ACSNIkgm10hb AANYzxHEC9ZMVKrtF4UqJn8K/oBm3VyNdl5njkgz53j8hjNSwlUCywdlIB6HUygyq/KYPc cT2erX/0Rp+RPF5FmEIF7Vw1UcYdgi0= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 06/26] KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT Date: Thu, 15 Jan 2026 01:12:52 +0000 Message-ID: <20260115011312.3675857-7-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" If loading L1's CR3 fails on a nested #VMEXIT, nested_svm_vmexit() returns an error code that is ignored by most callers, and continues to run L1 with corrupted state. A sane recovery is not possible in this case, and HW behavior is to cause a shutdown. Inject a triple fault instead. From the APM: Upon #VMEXIT, the processor performs the following actions in order to return to the host execution context: ... if (illegal host state loaded, or exception while loading host state) shutdown else execute first host instruction following the VMRUN Remove the return value of nested_svm_vmexit(), which is mostly unchecked anyway. Fixes: d82aaef9c88a ("KVM: nSVM: use nested_svm_load_cr3() on guest->host s= witch") CC: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 12 ++++++------ arch/x86/kvm/svm/svm.c | 11 ++--------- arch/x86/kvm/svm/svm.h | 6 +++--- 3 files changed, 11 insertions(+), 18 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 593f7005cdc7..6c4c31d2b30f 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1124,7 +1124,7 @@ void svm_copy_vmloadsave_state(struct vmcb *to_vmcb, = struct vmcb *from_vmcb) to_vmcb->save.sysenter_eip =3D from_vmcb->save.sysenter_eip; } =20 -int nested_svm_vmexit(struct vcpu_svm *svm) +void nested_svm_vmexit(struct vcpu_svm *svm) { struct kvm_vcpu *vcpu =3D &svm->vcpu; gpa_t vmcb12_gpa =3D svm->nested.vmcb12_gpa; @@ -1146,7 +1146,7 @@ int nested_svm_vmexit(struct vcpu_svm *svm) =20 if (kvm_vcpu_map(vcpu, gpa_to_gfn(vmcb12_gpa), &map)) { kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu); - return 1; + return; } =20 /* Give the current vmcb to the guest */ @@ -1309,8 +1309,10 @@ int nested_svm_vmexit(struct vcpu_svm *svm) =20 nested_svm_uninit_mmu_context(vcpu); =20 - if (nested_svm_load_cr3(vcpu, vmcb01->save.cr3, false, true)) - return 1; + if (nested_svm_load_cr3(vcpu, vmcb01->save.cr3, false, true)) { + kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu); + return; + } =20 /* * Drop what we picked up for L2 via svm_complete_interrupts() so it @@ -1335,8 +1337,6 @@ int nested_svm_vmexit(struct vcpu_svm *svm) */ if (kvm_apicv_activated(vcpu->kvm)) __kvm_vcpu_update_apicv(vcpu); - - return 0; } =20 static void nested_svm_triple_fault(struct kvm_vcpu *vcpu) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index c6ed59e5f0b8..f3901f9ee487 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -2227,13 +2227,9 @@ static int emulate_svm_instr(struct kvm_vcpu *vcpu, = int opcode) [SVM_INSTR_VMSAVE] =3D vmsave_interception, }; struct vcpu_svm *svm =3D to_svm(vcpu); - int ret; =20 if (is_guest_mode(vcpu)) { - /* Returns '1' or -errno on failure, '0' on success. */ - ret =3D nested_svm_simple_vmexit(svm, guest_mode_exit_codes[opcode]); - if (ret) - return ret; + nested_svm_simple_vmexit(svm, guest_mode_exit_codes[opcode]); return 1; } return svm_instr_handlers[opcode](vcpu); @@ -4778,7 +4774,6 @@ static int svm_enter_smm(struct kvm_vcpu *vcpu, union= kvm_smram *smram) { struct vcpu_svm *svm =3D to_svm(vcpu); struct kvm_host_map map_save; - int ret; =20 if (!is_guest_mode(vcpu)) return 0; @@ -4798,9 +4793,7 @@ static int svm_enter_smm(struct kvm_vcpu *vcpu, union= kvm_smram *smram) svm->vmcb->save.rsp =3D vcpu->arch.regs[VCPU_REGS_RSP]; svm->vmcb->save.rip =3D vcpu->arch.regs[VCPU_REGS_RIP]; =20 - ret =3D nested_svm_simple_vmexit(svm, SVM_EXIT_SW); - if (ret) - return ret; + nested_svm_simple_vmexit(svm, SVM_EXIT_SW); =20 /* * KVM uses VMCB01 to store L1 host state while L2 runs but diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 2ce62cc55d7b..3e3dcd671aad 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -785,15 +785,15 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu); void svm_copy_vmrun_state(struct vmcb_save_area *to_save, struct vmcb_save_area *from_save); void svm_copy_vmloadsave_state(struct vmcb *to_vmcb, struct vmcb *from_vmc= b); -int nested_svm_vmexit(struct vcpu_svm *svm); +void nested_svm_vmexit(struct vcpu_svm *svm); =20 -static inline int nested_svm_simple_vmexit(struct vcpu_svm *svm, u32 exit_= code) +static inline void nested_svm_simple_vmexit(struct vcpu_svm *svm, u32 exit= _code) { svm->vmcb->control.exit_code =3D exit_code; svm->vmcb->control.exit_code_hi =3D 0; svm->vmcb->control.exit_info_1 =3D 0; svm->vmcb->control.exit_info_2 =3D 0; - return nested_svm_vmexit(svm); + nested_svm_vmexit(svm); } =20 int nested_svm_exit_handled(struct vcpu_svm *svm); --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-180.mta0.migadu.com (out-180.mta0.migadu.com [91.218.175.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DDC1823EA88 for ; Thu, 15 Jan 2026 01:13:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439635; cv=none; b=t+HhS/Gm/7JGwbS8dxAJDVoqpcgeR8/kuvI3hKVwUFKdAy4KLQlQ17BM/Ggx1kvk+2AB2qpfV4Q1Uea5KGIJO655t5kLHySeUXve5dbbrdC4hhXu3Vu7ugo0gvBAR1jO7InFtb6kBnLFgWtmbsOOvcYbsl/9YnQ69WmzoceWQ+4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439635; c=relaxed/simple; bh=rbMyStpl5MpDWBCnUDj24XnmlND4e9wzzGo8/CGCaps=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mFyz2ezOVHMeQMdEXm/sF7q1LPfI+qB174LAMvhndDJcdtbUh28Rr/9FHVyfElIkxiQSMHzSQ8SmUNfRbqsWr2HWc5nbeSNjlmDbLKVQpBCJKRIg79QcZJGySOGtUDWkr1rOe2d6e1qW9Qf9D8xIomWB3vkaNtprLfkZJ7k+QBA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=CgIIPoqN; arc=none smtp.client-ip=91.218.175.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="CgIIPoqN" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439619; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=D+nlw0TzzuQjQgM8JTprRz8C8eeo4gIPse+gpalZwME=; b=CgIIPoqNJzWEkRh4hHR6gvOSLeGnCeX3Ggbnl4difN/REVQuN7fHlBO4ERGNZ3khyeSCI3 VYXYJ0lRhY+km5GffnWz6gA2+0gtCBO1imUa+0c4i3GIy6TVHp8Lbz7EAJwrdMGbIu6SYu LtynN/pNEY4WtYYi9uR1YE1zN8bSHa8= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 07/26] KVM: nSVM: Drop nested_vmcb_check_{save/control}() wrappers Date: Thu, 15 Jan 2026 01:12:53 +0000 Message-ID: <20260115011312.3675857-8-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" The wrappers provide little value and make it harder to see what KVM is checking in the normal flow. Drop them. Opportunistically fixup comments referring to the functions, adding '()' to make it clear it's a reference to a function. No functional change intended. Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 36 ++++++++++-------------------------- 1 file changed, 10 insertions(+), 26 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 6c4c31d2b30f..8515ff81508a 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -340,8 +340,8 @@ static bool nested_svm_check_bitmap_pa(struct kvm_vcpu = *vcpu, u64 pa, u32 size) kvm_vcpu_is_legal_gpa(vcpu, addr + size - 1); } =20 -static bool __nested_vmcb_check_controls(struct kvm_vcpu *vcpu, - struct vmcb_ctrl_area_cached *control) +static bool nested_vmcb_check_controls(struct kvm_vcpu *vcpu, + struct vmcb_ctrl_area_cached *control) { if (CC(!vmcb12_is_intercept(control, INTERCEPT_VMRUN))) return false; @@ -368,8 +368,8 @@ static bool __nested_vmcb_check_controls(struct kvm_vcp= u *vcpu, } =20 /* Common checks that apply to both L1 and L2 state. */ -static bool __nested_vmcb_check_save(struct kvm_vcpu *vcpu, - struct vmcb_save_area_cached *save) +static bool nested_vmcb_check_save(struct kvm_vcpu *vcpu, + struct vmcb_save_area_cached *save) { if (CC(!(save->efer & EFER_SVME))) return false; @@ -403,22 +403,6 @@ static bool __nested_vmcb_check_save(struct kvm_vcpu *= vcpu, return true; } =20 -static bool nested_vmcb_check_save(struct kvm_vcpu *vcpu) -{ - struct vcpu_svm *svm =3D to_svm(vcpu); - struct vmcb_save_area_cached *save =3D &svm->nested.save; - - return __nested_vmcb_check_save(vcpu, save); -} - -static bool nested_vmcb_check_controls(struct kvm_vcpu *vcpu) -{ - struct vcpu_svm *svm =3D to_svm(vcpu); - struct vmcb_ctrl_area_cached *ctl =3D &svm->nested.ctl; - - return __nested_vmcb_check_controls(vcpu, ctl); -} - /* * If a feature is not advertised to L1, clear the corresponding vmcb12 * intercept. @@ -471,7 +455,7 @@ void __nested_copy_vmcb_control_to_cache(struct kvm_vcp= u *vcpu, to->pause_filter_count =3D from->pause_filter_count; to->pause_filter_thresh =3D from->pause_filter_thresh; =20 - /* Copy asid here because nested_vmcb_check_controls will check it. */ + /* Copy asid here because nested_vmcb_check_controls() will check it */ to->asid =3D from->asid; to->msrpm_base_pa &=3D ~0x0fffULL; to->iopm_base_pa &=3D ~0x0fffULL; @@ -1030,8 +1014,8 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) nested_copy_vmcb_control_to_cache(svm, &vmcb12->control); nested_copy_vmcb_save_to_cache(svm, &vmcb12->save); =20 - if (!nested_vmcb_check_save(vcpu) || - !nested_vmcb_check_controls(vcpu)) { + if (!nested_vmcb_check_save(vcpu, &svm->nested.save) || + !nested_vmcb_check_controls(vcpu, &svm->nested.ctl)) { vmcb12->control.exit_code =3D SVM_EXIT_ERR; vmcb12->control.exit_code_hi =3D -1u; vmcb12->control.exit_info_1 =3D 0; @@ -1872,12 +1856,12 @@ static int svm_set_nested_state(struct kvm_vcpu *vc= pu, =20 ret =3D -EINVAL; __nested_copy_vmcb_control_to_cache(vcpu, &ctl_cached, ctl); - if (!__nested_vmcb_check_controls(vcpu, &ctl_cached)) + if (!nested_vmcb_check_controls(vcpu, &ctl_cached)) goto out_free; =20 /* * Processor state contains L2 state. Check that it is - * valid for guest mode (see nested_vmcb_check_save). + * valid for guest mode (see nested_vmcb_check_save()). */ cr0 =3D kvm_read_cr0(vcpu); if (((cr0 & X86_CR0_CD) =3D=3D 0) && (cr0 & X86_CR0_NW)) @@ -1891,7 +1875,7 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, if (!(save->cr0 & X86_CR0_PG) || !(save->cr0 & X86_CR0_PE) || (save->rflags & X86_EFLAGS_VM) || - !__nested_vmcb_check_save(vcpu, &save_cached)) + !nested_vmcb_check_save(vcpu, &save_cached)) goto out_free; =20 =20 --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-172.mta0.migadu.com (out-172.mta0.migadu.com [91.218.175.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2BCC42417C2 for ; Thu, 15 Jan 2026 01:13:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439628; cv=none; b=bhvZYB2N5647FqhEUbdmHSVcvyuroerE4OCdlfVMRbDgud0syOlh2WL6YiLx1mTvD+HeJBgnpehk3R+OyiY4lmFWWPkfrYkcPbpzeAfd6b6PVjMnfTpKXqOR0wjiJzWJP7SLBEVr2pFm0e8lp4a2uzHshYtU+GCplT6XC8OPrdg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439628; c=relaxed/simple; bh=SvnJl/Qx7YbdnzpkzADENdnbM03g9c0nYE5AAk8vbss=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XmJucy3HQrVJu+aEKA/PeJ/jmKOpGZ8jIsj1BHChGwfTyjZ5SBxLdvlBKGVZnK4gNMo6ncxiecDRWc4FsXymazHYfvJ870MFgXrEz0lqpbBsZgszIRVrPUWpJqZlNfjOtUAePt0f+4YFr4gtSQIUzIs5WmNbkJaV1vQfQIHl1ps= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=he2lkuv2; arc=none smtp.client-ip=91.218.175.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="he2lkuv2" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439620; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=uWBKYRKqLR3Sf/6YuZ+mDu1Cr+lCy9BRdjKjJqfC+Js=; b=he2lkuv2PI2iBHlLj/ETD6DAB4YhoksK0vSlKS793awCQDgpDSHdTFYFVDAKSQ2kRv8qxi 2V5M7SzE/Zm0E6b1GUdcDeOyPd3HlLadoLpBk8Sso926MfwrHYURgRK5CMkIxSlkT+WAWa 4mkQ+cmUCP3pSnq2L6zMmkTqrLKJH+8= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 08/26] KVM: nSVM: Call enter_guest_mode() before switching to VMCB02 Date: Thu, 15 Jan 2026 01:12:54 +0000 Message-ID: <20260115011312.3675857-9-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" In preparation for moving more changes that rely on is_guest_mode() before switching to VMCB02, move entering guest mode a bit earlier. Nothing between the new callsite(s) and the old ones rely on is_guest_mode(), so this should be safe. No functional change intended. Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 8515ff81508a..536ca8e1d29f 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -745,9 +745,6 @@ static void nested_vmcb02_prepare_control(struct vcpu_s= vm *svm, =20 nested_svm_transition_tlb_flush(vcpu); =20 - /* Enter Guest-Mode */ - enter_guest_mode(vcpu); - /* * Filled at exit: exit_code, exit_code_hi, exit_info_1, exit_info_2, * exit_int_info, exit_int_info_err, next_rip, insn_len, insn_bytes. @@ -948,6 +945,8 @@ int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 vmc= b12_gpa, =20 WARN_ON(svm->vmcb =3D=3D svm->nested.vmcb02.ptr); =20 + enter_guest_mode(vcpu); + nested_svm_copy_common_state(svm->vmcb01.ptr, svm->nested.vmcb02.ptr); =20 svm_switch_vmcb(svm, &svm->nested.vmcb02); @@ -1901,6 +1900,7 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, svm_copy_vmrun_state(&svm->vmcb01.ptr->save, save); nested_copy_vmcb_control_to_cache(svm, ctl); =20 + enter_guest_mode(vcpu); svm_switch_vmcb(svm, &svm->nested.vmcb02); nested_vmcb02_prepare_control(svm, svm->vmcb->save.rip, svm->vmcb->save.c= s.base); =20 --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-172.mta0.migadu.com (out-172.mta0.migadu.com [91.218.175.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2D6DA246778 for ; Thu, 15 Jan 2026 01:13:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439635; cv=none; b=UPzg9m16XoEFpVsZnuAimA9/mxjhDMeEiunTmhOiEvPtO3eRF+MOErKzzmCr2+aX6axtR2Hjiwwey1GOVhg0k2ww3Q06Lmy1iovkYCh8IF5GxD9p4oUk3wrrueuV6wKTk90eMkRjqMFs83eXWrVFKPU1+JHbQreIvm1wJqB/3lE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439635; c=relaxed/simple; bh=QJkGO6buZj2FN76R5TlJ5b0ubRqJ+gXCFYiyaYYmb0I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ngR9Ejtjn8h5G1V6m7fc2Q2/Ff6TyoixRUa24Edy2tLvKFcDSqShQq/BLQhsYr6acmmYvTRR/e7vblgjs4YlnfqlNaQ4so6GOzCl+czaIyw002ydDm+igOVe6dWWzObU2xeFG64/2TesK68PR/G2UJ7+6t0t2BTlPaIfqkFN9as= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=R7tjGHDz; arc=none smtp.client-ip=91.218.175.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="R7tjGHDz" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439622; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HgQ/8xsqXO4D4VmyqO8Kbk6TDo6HNO5HxtqHdsr2+Ow=; b=R7tjGHDzeEb1FJMQpguFh0YBIhTVbIlJruRu2QVg8rN6EhUMbQr+GuauFfhx9aiMIvOHkh 8q+hvp/ggx0uQFF61n6r5aPuq7sSjvh1dx98KpskmMZV42GCcdb8w2k4XER+kgaY90CPX3 kLcvYmhv97UMJa+u2QeO7eHP4GvsXWo= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 09/26] KVM: nSVM: Make nested_svm_merge_msrpm() return an errno Date: Thu, 15 Jan 2026 01:12:55 +0000 Message-ID: <20260115011312.3675857-10-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" In preparation for moving nested_svm_merge_msrpm() within enter_svm_guest_mode(), which returns an errno, return an errno from nested_svm_merge_msrpm(). No functional change intended. Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 536ca8e1d29f..0915785f7770 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -277,7 +277,7 @@ int __init nested_svm_init_msrpm_merge_offsets(void) * is optimized in that it only merges the parts where KVM MSR permission = bitmap * may contain zero bits. */ -static bool nested_svm_merge_msrpm(struct kvm_vcpu *vcpu) +static int nested_svm_merge_msrpm(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm =3D to_svm(vcpu); nsvm_msrpm_merge_t *msrpm02 =3D svm->nested.msrpm; @@ -304,17 +304,19 @@ static bool nested_svm_merge_msrpm(struct kvm_vcpu *v= cpu) #endif =20 if (!(vmcb12_is_intercept(&svm->nested.ctl, INTERCEPT_MSR_PROT))) - return true; + return 0; =20 for (i =3D 0; i < nested_svm_nr_msrpm_merge_offsets; i++) { const int p =3D nested_svm_msrpm_merge_offsets[i]; nsvm_msrpm_merge_t l1_val; gpa_t gpa; + int r; =20 gpa =3D svm->nested.ctl.msrpm_base_pa + (p * sizeof(l1_val)); =20 - if (kvm_vcpu_read_guest(vcpu, gpa, &l1_val, sizeof(l1_val))) - return false; + r =3D kvm_vcpu_read_guest(vcpu, gpa, &l1_val, sizeof(l1_val)); + if (r) + return r; =20 msrpm02[p] =3D msrpm01[p] | l1_val; } @@ -326,7 +328,7 @@ static bool nested_svm_merge_msrpm(struct kvm_vcpu *vcp= u) #endif svm->vmcb->control.msrpm_base_pa =3D __sme_set(__pa(svm->nested.msrpm)); =20 - return true; + return 0; } =20 /* @@ -1040,7 +1042,7 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) if (enter_svm_guest_mode(vcpu, vmcb12_gpa, vmcb12, true)) goto out_exit_err; =20 - if (nested_svm_merge_msrpm(vcpu)) + if (!nested_svm_merge_msrpm(vcpu)) goto out; =20 out_exit_err: @@ -1941,7 +1943,7 @@ static bool svm_get_nested_state_pages(struct kvm_vcp= u *vcpu) if (CC(!load_pdptrs(vcpu, vcpu->arch.cr3))) return false; =20 - if (!nested_svm_merge_msrpm(vcpu)) { + if (nested_svm_merge_msrpm(vcpu)) { vcpu->run->exit_reason =3D KVM_EXIT_INTERNAL_ERROR; vcpu->run->internal.suberror =3D KVM_INTERNAL_ERROR_EMULATION; --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-177.mta0.migadu.com (out-177.mta0.migadu.com [91.218.175.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C3C224468C for ; Thu, 15 Jan 2026 01:13:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439634; cv=none; b=dsNsa8/icvVfivpeesbFMVgGohG9zzdVjamr+qRKRuXsyoWDRSTlOfjxygAHlE8GjujzR1K/7suZoCJH27T74wxf8i8jMk+zfLzzyp5yJ3rZeh109gnlIcxp/Gj35hQGHQI3sKeQxtU3viyQ3Q51ibz23F8wedMlCgaJc/SXW1A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439634; c=relaxed/simple; bh=m5o2l7lgFNmJcT3VJ87p2Uu/LmytSoMZzA3lD3R5fSE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Mv044Dk6E1t9/QquL/p6Xa2pGM0hO/eXtlEB12DIB4PevwYDABNvUNS98IoF7Uo3pnajAwRd9HOVq+2vTbd2K625gVCbl9MHzT8JmgBKcPWMUF91DTuukDEhetAiTiAzNi1s8E23heT40Wrx/ns9G709/GfaWoOr+o0REbQwoi8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=gMpm+vlS; arc=none smtp.client-ip=91.218.175.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="gMpm+vlS" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439624; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=dtVei9vob9XjSXdk/KBHveFzcLTnS2073L1TnPacuR0=; b=gMpm+vlSFvy9h6dXqmtDxa3hiBiX5reDI0IpcxSyS9fJkL/jIjDvePf8UMsPtJmL9zd8Tj +sfDozcN+ZaxD6mWnpdu2zHG3z2EbvdhYKm5AU9qtQ4zonJzOnBIwlED4yRoPBUI7wk2gM GUZG2xuYY1HSWOPF7sJj5IVKSyxhKKU= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 10/26] KVM: nSVM: Call nested_svm_merge_msrpm() from enter_svm_guest_mode() Date: Thu, 15 Jan 2026 01:12:56 +0000 Message-ID: <20260115011312.3675857-11-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" In preparation for unifying the VMRUN failure code paths, move calling nested_svm_merge_msrpm() into enter_svm_guest_mode() next to the nested_svm_load_cr3() call (the other failure path in enter_svm_guest_mode()). Adding more uses of the from_vmrun parameter is not pretty, but it is plumbed all the way to nested_svm_load_cr3() so it's not going away soon anyway. No functional change intended. Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 0915785f7770..debbce5c6511 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -960,6 +960,12 @@ int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 vm= cb12_gpa, if (ret) return ret; =20 + if (from_vmrun) { + ret =3D nested_svm_merge_msrpm(vcpu); + if (ret) + return ret; + } + if (!from_vmrun) kvm_make_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu); =20 @@ -1039,23 +1045,18 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) =20 svm->nested.nested_run_pending =3D 1; =20 - if (enter_svm_guest_mode(vcpu, vmcb12_gpa, vmcb12, true)) - goto out_exit_err; - - if (!nested_svm_merge_msrpm(vcpu)) - goto out; - -out_exit_err: - svm->nested.nested_run_pending =3D 0; - svm->nmi_l1_to_l2 =3D false; - svm->soft_int_injected =3D false; + if (enter_svm_guest_mode(vcpu, vmcb12_gpa, vmcb12, true)) { + svm->nested.nested_run_pending =3D 0; + svm->nmi_l1_to_l2 =3D false; + svm->soft_int_injected =3D false; =20 - svm->vmcb->control.exit_code =3D SVM_EXIT_ERR; - svm->vmcb->control.exit_code_hi =3D -1u; - svm->vmcb->control.exit_info_1 =3D 0; - svm->vmcb->control.exit_info_2 =3D 0; + svm->vmcb->control.exit_code =3D SVM_EXIT_ERR; + svm->vmcb->control.exit_code_hi =3D -1u; + svm->vmcb->control.exit_info_1 =3D 0; + svm->vmcb->control.exit_info_2 =3D 0; =20 - nested_svm_vmexit(svm); + nested_svm_vmexit(svm); + } =20 out: kvm_vcpu_unmap(vcpu, &map); --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-170.mta0.migadu.com (out-170.mta0.migadu.com [91.218.175.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D6E2A23185D for ; Thu, 15 Jan 2026 01:13:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439637; cv=none; b=DIimebkJMW6pVVAz0WopN7ctJPtDigrWmu/cXWSFoejyHMBO38H8es19Sfdq5HBYM4iIDxE7To5DoKjg/yOyNZKbpSBWiz+3ra/lew4s3tfemb6OK4bNkei8kGadCGU0/nfwDx8DozCIcAWUjrzKDOJfyu8qHzGwYocGFr1Cja4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439637; c=relaxed/simple; bh=Ea6rWEDN+cRIxk3jN8cryjzwbqVJQqjFfLbIhwK2/f0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Jo59JW3GnEldTLBn58hr3FT89ZLDlwr4CPBP7djQ3DYoVE5wxGa7amoktOavGFFLTZE+VND/7KZ5Sge3izel6uPqYcmkgRKvcbdO3wTkI1va1ttf8jYIdv9vavvKCofpiX3PZmPYZtb7uf+uqbpXbz6Vta+OWugCMvxYno9e+Tc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=rkxlqoZ4; arc=none smtp.client-ip=91.218.175.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="rkxlqoZ4" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439625; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WNERaqN0p70Upb1bv3QyZM9OSIxy0licFd67fEooyUg=; b=rkxlqoZ4QoptuWx0HpQn5E2NLyTJuzS4pFexq0op5yiieJJZHkTvmAIBNg9BW4M3w0vZOw 3k2axA3boIJy9NfEpRHXfdr5b+u7Rvl8HwQWLbgkMlSzJuw2k0QDAkI9o+iRnVnkQowEI4 HuEEcVtCSQ777M94kvo4uOGG3p1OT0M= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 11/26] KVM: nSVM: Call nested_svm_init_mmu_context() before switching to VMCB02 Date: Thu, 15 Jan 2026 01:12:57 +0000 Message-ID: <20260115011312.3675857-12-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" In preparation for moving more code that depends on nested_svm_init_mmu_context() before switching to VMCB02, move the call outside of nested_vmcb02_prepare_control() into callers, a bit earlier. nested_svm_init_mmu_context() needs to be called after enter_guest_mode(), but not after switching to VMCB02. No functional change intended. Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index debbce5c6511..f108f6fae5bc 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -807,10 +807,6 @@ static void nested_vmcb02_prepare_control(struct vcpu_= svm *svm, /* Also overwritten later if necessary. */ vmcb02->control.tlb_ctl =3D TLB_CONTROL_DO_NOTHING; =20 - /* nested_cr3. */ - if (nested_npt_enabled(svm)) - nested_svm_init_mmu_context(vcpu); - vcpu->arch.tsc_offset =3D kvm_calc_nested_tsc_offset( vcpu->arch.l1_tsc_offset, svm->nested.ctl.tsc_offset, @@ -949,6 +945,9 @@ int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 vmc= b12_gpa, =20 enter_guest_mode(vcpu); =20 + if (nested_npt_enabled(svm)) + nested_svm_init_mmu_context(vcpu); + nested_svm_copy_common_state(svm->vmcb01.ptr, svm->nested.vmcb02.ptr); =20 svm_switch_vmcb(svm, &svm->nested.vmcb02); @@ -1904,6 +1903,10 @@ static int svm_set_nested_state(struct kvm_vcpu *vcp= u, nested_copy_vmcb_control_to_cache(svm, ctl); =20 enter_guest_mode(vcpu); + + if (nested_npt_enabled(svm)) + nested_svm_init_mmu_context(vcpu); + svm_switch_vmcb(svm, &svm->nested.vmcb02); nested_vmcb02_prepare_control(svm, svm->vmcb->save.rip, svm->vmcb->save.c= s.base); =20 --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-184.mta0.migadu.com (out-184.mta0.migadu.com [91.218.175.184]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0AD8224DFF3 for ; Thu, 15 Jan 2026 01:13:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.184 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439635; cv=none; b=MLFxx/zSIqAEpeGuKzVfW8VTMlfo7p0PXEVTcQocp14RfkR0fYDCkJjMfth3kvIN8xtMYr+w3rBO8w2CD/eMXVHvgVPnOCyl64sBGqPtV3j2UEmU49h70qcSNLiuvsYW6PIz22s+rN/JJkDAYaLNoGQmNMaxEveBQO8MxIRmV2A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439635; c=relaxed/simple; bh=UkTB7/LqH/pyyGJdD2ZNakL2HnEOMm7V0uLGwDf8qjU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=c0pbRppeEwn53jwo32RZ+ifOkVbFSsJrTe25Ws81JiVYbSFwb/wiIfixpnIGFkaSW3jwmVWfkIUIfX2eC7ICh+a5V/R/t3Nux7xXcTPOvqn+5fap0AtqFnVqGBfZ/xn9v4NG+AUOdceDwjEEVSouml1HYN+0CEJSL18Y4QwqSAA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=kH2a+5Wk; arc=none smtp.client-ip=91.218.175.184 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="kH2a+5Wk" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439628; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jBZGK/DUsBaWT2N5OHFROUf2AuDR00qURUYy9nlXgrA=; b=kH2a+5Wk8lavW9jlY1bV8X39gV1Bw6Zy26gDvN0pga1sT1YNQZHX0liQVaA4yPlkP0aQPp 7VEAvYhiCIeVVRsgxSQifUlbyghRrSmntoXqs5OJ53ry/GRjsP9LnEKlN9oeM4zIVmcI01 /9P7EHAJSVmdKWx6lzH+1EhAaB+rp+E= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 12/26] KVM: nSVM: Refactor minimal #VMEXIT handling out of nested_svm_vmexit() Date: Thu, 15 Jan 2026 01:12:58 +0000 Message-ID: <20260115011312.3675857-13-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" In preparation for having a separate minimal #VMEXIT path for handling failed VMRUNs, move the minimal logic out of nested_svm_vmexit() into a helper. This includes clearing the GIF, handling single-stepping on VMRUN, and a few data structure cleanups. Basically, everything that is required by the architecture (or KVM) on a #VMEXIT where L2 never actually ran. Additionally move uninitializing the nested MMU and reloading host CR3 to the new helper. It is not required at this point, but following changes will require it. No functional change intended. Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 61 ++++++++++++++++++++++----------------- 1 file changed, 34 insertions(+), 27 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index f108f6fae5bc..53ae761b50e2 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -978,6 +978,34 @@ int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 vm= cb12_gpa, return 0; } =20 +static void __nested_svm_vmexit(struct vcpu_svm *svm) +{ + struct vmcb *vmcb01 =3D svm->vmcb01.ptr; + struct kvm_vcpu *vcpu =3D &svm->vcpu; + + svm->nested.vmcb12_gpa =3D 0; + svm->nested.ctl.nested_cr3 =3D 0; + + /* GIF is cleared on #VMEXIT, no event can be injected in L1 */ + svm_set_gif(svm, false); + vmcb01->control.exit_int_info =3D 0; + + nested_svm_uninit_mmu_context(vcpu); + if (nested_svm_load_cr3(vcpu, vmcb01->save.cr3, false, true)) { + kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu); + return; + } + + /* + * If we are here following the completion of a VMRUN that + * is being single-stepped, queue the pending #DB intercept + * right now so that it an be accounted for before we execute + * L1's next instruction. + */ + if (unlikely(vmcb01->save.rflags & X86_EFLAGS_TF)) + kvm_queue_exception(vcpu, DB_VECTOR); +} + int nested_svm_vmrun(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm =3D to_svm(vcpu); @@ -1127,8 +1155,6 @@ void nested_svm_vmexit(struct vcpu_svm *svm) /* in case we halted in L2 */ kvm_set_mp_state(vcpu, KVM_MP_STATE_RUNNABLE); =20 - svm->nested.vmcb12_gpa =3D 0; - if (kvm_vcpu_map(vcpu, gpa_to_gfn(vmcb12_gpa), &map)) { kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu); return; @@ -1246,13 +1272,6 @@ void nested_svm_vmexit(struct vcpu_svm *svm) } } =20 - /* - * On vmexit the GIF is set to false and - * no event can be injected in L1. - */ - svm_set_gif(svm, false); - vmcb01->control.exit_int_info =3D 0; - svm->vcpu.arch.tsc_offset =3D svm->vcpu.arch.l1_tsc_offset; if (vmcb01->control.tsc_offset !=3D svm->vcpu.arch.tsc_offset) { vmcb01->control.tsc_offset =3D svm->vcpu.arch.tsc_offset; @@ -1265,8 +1284,6 @@ void nested_svm_vmexit(struct vcpu_svm *svm) svm_write_tsc_multiplier(vcpu); } =20 - svm->nested.ctl.nested_cr3 =3D 0; - /* * Restore processor state that had been saved in vmcb01 */ @@ -1292,13 +1309,6 @@ void nested_svm_vmexit(struct vcpu_svm *svm) =20 nested_svm_transition_tlb_flush(vcpu); =20 - nested_svm_uninit_mmu_context(vcpu); - - if (nested_svm_load_cr3(vcpu, vmcb01->save.cr3, false, true)) { - kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu); - return; - } - /* * Drop what we picked up for L2 via svm_complete_interrupts() so it * doesn't end up in L1. @@ -1307,21 +1317,18 @@ void nested_svm_vmexit(struct vcpu_svm *svm) kvm_clear_exception_queue(vcpu); kvm_clear_interrupt_queue(vcpu); =20 - /* - * If we are here following the completion of a VMRUN that - * is being single-stepped, queue the pending #DB intercept - * right now so that it an be accounted for before we execute - * L1's next instruction. - */ - if (unlikely(vmcb01->save.rflags & X86_EFLAGS_TF)) - kvm_queue_exception(&(svm->vcpu), DB_VECTOR); - /* * Un-inhibit the AVIC right away, so that other vCPUs can start * to benefit from it right away. */ if (kvm_apicv_activated(vcpu->kvm)) __kvm_vcpu_update_apicv(vcpu); + + /* + * Potentially queues an exception, so it needs to be after + * kvm_clear_exception_queue() is called above. + */ + __nested_svm_vmexit(svm); } =20 static void nested_svm_triple_fault(struct kvm_vcpu *vcpu) --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-171.mta0.migadu.com (out-171.mta0.migadu.com [91.218.175.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF0A5275B0F for ; Thu, 15 Jan 2026 01:13:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439641; cv=none; b=rk3Z/lnKs4bLDSGFv02zM4mIBe2mUa10ByqPIO94mmwRzXDe4yi8y91pwswYWrFAwZTDO02n212d08+HTs0+0Ii9Izh5D9XKf5OjiNg7PG2nZnngkO9Cfw9nagydOGy/fJgyyfclxOQSua4ZTgZwbVMMDMFExfmkxDZ5ybfjQ+4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439641; c=relaxed/simple; bh=Rv6keflG74Ad0j+ZEDSNo83LtfdEflX6pihNX4fDAfQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TnOcob56kVWQKS8YkzM44c8YXzInEY438QDDKjpLSHdttF772lRQgjEUNqPOoxbcYK9JZz/9mA5zqP45ZcSUHF6eqnsCILnCMlp9uO0aZLfX2mdpkEhktGpzHdOlbvEHDy3ojPEqK0xn2wrysGQNfDLV0b4AVPW9BeW5d5HOIvk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=qCvnWcTJ; arc=none smtp.client-ip=91.218.175.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="qCvnWcTJ" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439631; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=oDJF82VacMjoEVccnBD70R2C6pOYhASDAZ5TCc4L/w8=; b=qCvnWcTJZVmQ+m4FcTByiat3Rl45Lf7qC4ax8RfrGgnX4Xq7BITVkE32b7Ufj8JUibEMTb u32UU6BIjHCZV0nPUm29IzeohRHNoBWWSXoRpSR4jXS4Qd6E4yo23bDYmK3IL7+b9qbykl afHBVWfngFUvmEK37s4z7x61D34cPCI= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 13/26] KVM: nSVM: Unify handling of VMRUN failures with proper cleanup Date: Thu, 15 Jan 2026 01:12:59 +0000 Message-ID: <20260115011312.3675857-14-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" There are currently two possible causes of VMRUN failures: 1) Consistency checks failures. In this case, KVM updates the exit code in the mapped VMCB12 and exits early in nested_svm_vmrun(). This causes a few problems: A) KVM does not clear the GIF if the early consistency checks fail (because nested_svm_vmexit() is not called). Nothing requires GIF=3D0 before a VMRUN, from the APM: It is assumed that VMM software cleared GIF some time before executing the VMRUN instruction, to ensure an atomic state switch. So an early #VMEXIT from early consistency checks could leave the GIF set. B) svm_leave_smm() is missing consistency checks on the newly loaded guest state, because the checks aren't performed by enter_svm_guest_mode(). 2) Failure to load L2's CR3 or merge the MSR bitmaps. In this case, a fully-fledged #VMEXIT injection is performed as VMCB02 is already prepared. Arguably all VMRUN failures should be handled before the VMCB02 is prepared, but with proper cleanup (e.g. clear the GIF). Move all the potential failure checks inside enter_svm_guest_mode() before switching to VMCB02. On failure of any of these checks, nested_svm_vmrun() synthesizes a minimal #VMEXIT through the new nested_svm_failed_vmrun() helper. __nested_svm_vmexit() already performs the necessary cleanup for a failed VMRUN, including uninitializing the nested MMU and reloading L1's CR3. This ensures that consistency check failures do proper necessary cleanup, while other failures do not doo too much cleanup. It also leaves a unified path for handling VMRUN failures. Cc: stable@vger.kernel.org Fixes: 52c65a30a5c6 ("KVM: SVM: Check for nested vmrun intercept before emu= lating vmrun") Suggested-by: Sean Christopherson Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 62 +++++++++++++++++++++++---------------- 1 file changed, 36 insertions(+), 26 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 53ae761b50e2..1dfe5800c98c 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -938,22 +938,19 @@ int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 v= mcb12_gpa, vmcb12->control.intercepts[INTERCEPT_WORD4], vmcb12->control.intercepts[INTERCEPT_WORD5]); =20 - svm->nested.vmcb12_gpa =3D vmcb12_gpa; =20 WARN_ON(svm->vmcb =3D=3D svm->nested.vmcb02.ptr); =20 enter_guest_mode(vcpu); =20 + if (!nested_vmcb_check_save(vcpu, &svm->nested.save) || + !nested_vmcb_check_controls(vcpu, &svm->nested.ctl)) + return -EINVAL; + if (nested_npt_enabled(svm)) nested_svm_init_mmu_context(vcpu); =20 - nested_svm_copy_common_state(svm->vmcb01.ptr, svm->nested.vmcb02.ptr); - - svm_switch_vmcb(svm, &svm->nested.vmcb02); - nested_vmcb02_prepare_control(svm, vmcb12->save.rip, vmcb12->save.cs.base= ); - nested_vmcb02_prepare_save(svm, vmcb12); - ret =3D nested_svm_load_cr3(&svm->vcpu, svm->nested.save.cr3, nested_npt_enabled(svm), from_vmrun); if (ret) @@ -965,6 +962,17 @@ int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 vm= cb12_gpa, return ret; } =20 + /* + * Any VMRUN failure needs to happen before this point, such that the + * nested #VMEXIT is injected properly by nested_svm_failed_vmrun(). + */ + + nested_svm_copy_common_state(svm->vmcb01.ptr, svm->nested.vmcb02.ptr); + + svm_switch_vmcb(svm, &svm->nested.vmcb02); + nested_vmcb02_prepare_control(svm, vmcb12->save.rip, vmcb12->save.cs.base= ); + nested_vmcb02_prepare_save(svm, vmcb12); + if (!from_vmrun) kvm_make_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu); =20 @@ -983,6 +991,8 @@ static void __nested_svm_vmexit(struct vcpu_svm *svm) struct vmcb *vmcb01 =3D svm->vmcb01.ptr; struct kvm_vcpu *vcpu =3D &svm->vcpu; =20 + WARN_ON_ONCE(is_guest_mode(vcpu)); + svm->nested.vmcb12_gpa =3D 0; svm->nested.ctl.nested_cr3 =3D 0; =20 @@ -1006,6 +1016,19 @@ static void __nested_svm_vmexit(struct vcpu_svm *svm) kvm_queue_exception(vcpu, DB_VECTOR); } =20 +static void nested_svm_failed_vmrun(struct vcpu_svm *svm, struct vmcb *vmc= b12) +{ + WARN_ON(svm->vmcb =3D=3D svm->nested.vmcb02.ptr); + + leave_guest_mode(vcpu); + + vmcb12->control.exit_code =3D SVM_EXIT_ERR; + vmcb12->control.exit_code_hi =3D -1u; + vmcb12->control.exit_info_1 =3D 0; + vmcb12->control.exit_info_2 =3D 0; + __nested_svm_vmexit(svm); +} + int nested_svm_vmrun(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm =3D to_svm(vcpu); @@ -1048,15 +1071,6 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) nested_copy_vmcb_control_to_cache(svm, &vmcb12->control); nested_copy_vmcb_save_to_cache(svm, &vmcb12->save); =20 - if (!nested_vmcb_check_save(vcpu, &svm->nested.save) || - !nested_vmcb_check_controls(vcpu, &svm->nested.ctl)) { - vmcb12->control.exit_code =3D SVM_EXIT_ERR; - vmcb12->control.exit_code_hi =3D -1u; - vmcb12->control.exit_info_1 =3D 0; - vmcb12->control.exit_info_2 =3D 0; - goto out; - } - /* * Since vmcb01 is not in use, we can use it to store some of the L1 * state. @@ -1077,15 +1091,9 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) svm->nmi_l1_to_l2 =3D false; svm->soft_int_injected =3D false; =20 - svm->vmcb->control.exit_code =3D SVM_EXIT_ERR; - svm->vmcb->control.exit_code_hi =3D -1u; - svm->vmcb->control.exit_info_1 =3D 0; - svm->vmcb->control.exit_info_2 =3D 0; - - nested_svm_vmexit(svm); + nested_svm_failed_vmrun(svm, vmcb12); } =20 -out: kvm_vcpu_unmap(vcpu, &map); =20 return ret; @@ -1224,6 +1232,8 @@ void nested_svm_vmexit(struct vcpu_svm *svm) if (guest_cpu_cap_has(vcpu, X86_FEATURE_ERAPS)) vmcb01->control.erap_ctl |=3D ERAP_CONTROL_CLEAR_RAP; =20 + /* VMRUN failures before switching to VMCB02 are handled by nested_svm_fa= iled_vmrun() */ + WARN_ON_ONCE(svm->vmcb !=3D svm->nested.vmcb02.ptr); svm_switch_vmcb(svm, &svm->vmcb01); =20 /* @@ -1914,9 +1924,6 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, if (nested_npt_enabled(svm)) nested_svm_init_mmu_context(vcpu); =20 - svm_switch_vmcb(svm, &svm->nested.vmcb02); - nested_vmcb02_prepare_control(svm, svm->vmcb->save.rip, svm->vmcb->save.c= s.base); - /* * While the nested guest CR3 is already checked and set by * KVM_SET_SREGS, it was set when nested state was yet loaded, @@ -1928,6 +1935,9 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, if (ret) goto out_free; =20 + svm_switch_vmcb(svm, &svm->nested.vmcb02); + nested_vmcb02_prepare_control(svm, svm->vmcb->save.rip, svm->vmcb->save.c= s.base); + svm->nested.force_msr_bitmap_recalc =3D true; =20 kvm_make_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu); --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-177.mta0.migadu.com (out-177.mta0.migadu.com [91.218.175.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D21EB26B2CE for ; Thu, 15 Jan 2026 01:13:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439638; cv=none; b=ZNS1bT+a5DJy8OJ/YDkQWqAqMF8tdAX/4/2IY423NRQwl+kAt6R+faPYdfR3Kj+ObX3LkwhUWS+yNNSZWDISbED3N0Y50Ru0cQNe0m1tf+Vg6j1g29UQKVJDW9SGuTxjRmIjuZNX8KfL2BgyRs7lOoNelC0adngTlSRB3AP7hbY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439638; c=relaxed/simple; bh=DmnQ5TdTjVWminP3Xf33CFReUn/d5NcYrsSTL0v+Us0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UBhVndq5YrGi7mJzc3mMQRdhftD4Zc4NMoXbcQ6H9wYBdcz80LLxIndnxTnUvpcHkKFPt9yYX+j9fK4KCaeB3fnKy56Y8KtmYe5Fk1TMNKNc4zwMd460TRdYUjzK3GUp+Yos4i0y9yXeNmLJve8ml7r8qq/pTwLFlTn2OLdpxtY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=vd6e04ms; arc=none smtp.client-ip=91.218.175.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="vd6e04ms" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439632; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=V3xfRFV9ep/SW8LI7/0sQuoQMcHZNc6trK3lXoKTrTE=; b=vd6e04msPa01i8xXYRxS0CpG4E35HfrFglavMXAb6mrtvVeywDODs84TxD+uKiB0qIA08P cHarIZdRWBsqLRReo7SBUqS6NxWJn9GmfIGK7N+2CbA+CsAC9P2p3LsEwM/PcqdLW6/RAy UAsoFI8LcDZmnciZK2j0uMSM4A6/klI= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 14/26] KVM: nSVM: Clear EVENTINJ field in VMCB12 on nested #VMEXIT Date: Thu, 15 Jan 2026 01:13:00 +0000 Message-ID: <20260115011312.3675857-15-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" According to the APM, from the reference of the VMRUN instruction: Upon #VMEXIT, the processor performs the following actions in order to return to the host execution context: ... clear EVENTINJ field in VMCB KVM correctly cleared EVENTINJ (i.e. event_inj and event_inj_err) on nested #VMEXIT before commit 2d8a42be0e2b ("KVM: nSVM: synchronize VMCB controls updated by the processor on every vmexit"). That commit made sure the fields are synchronized between VMCB02 and KVM's cached VMCB12 on every L2->L0 #VMEXIT, such that they are serialized correctly on save/restore. However, the commit also incorrectly copied the fields from KVM's cached VMCB12 to L1's VMCB12 on nested #VMEXIT. Go back to clearing the fields, and so in __nested_svm_vmexit() instead of nested_svm_vmexit(), such that it also applies to #VMEXITs caused by a failed VMRUN. Fixes: 2d8a42be0e2b ("KVM: nSVM: synchronize VMCB controls updated by the p= rocessor on every vmexit") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 1dfe5800c98c..704e572324f2 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -986,7 +986,7 @@ int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 vmc= b12_gpa, return 0; } =20 -static void __nested_svm_vmexit(struct vcpu_svm *svm) +static void __nested_svm_vmexit(struct vcpu_svm *svm, struct vmcb *vmcb12) { struct vmcb *vmcb01 =3D svm->vmcb01.ptr; struct kvm_vcpu *vcpu =3D &svm->vcpu; @@ -1000,6 +1000,10 @@ static void __nested_svm_vmexit(struct vcpu_svm *svm) svm_set_gif(svm, false); vmcb01->control.exit_int_info =3D 0; =20 + /* event_inj is cleared on #VMEXIT */ + vmcb12->control.event_inj =3D 0; + vmcb12->control.event_inj_err =3D 0; + nested_svm_uninit_mmu_context(vcpu); if (nested_svm_load_cr3(vcpu, vmcb01->save.cr3, false, true)) { kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu); @@ -1026,7 +1030,7 @@ static void nested_svm_failed_vmrun(struct vcpu_svm *= svm, struct vmcb *vmcb12) vmcb12->control.exit_code_hi =3D -1u; vmcb12->control.exit_info_1 =3D 0; vmcb12->control.exit_info_2 =3D 0; - __nested_svm_vmexit(svm); + __nested_svm_vmexit(svm, vmcb12); } =20 int nested_svm_vmrun(struct kvm_vcpu *vcpu) @@ -1209,8 +1213,6 @@ void nested_svm_vmexit(struct vcpu_svm *svm) vmcb12->control.next_rip =3D vmcb02->control.next_rip; =20 vmcb12->control.int_ctl =3D svm->nested.ctl.int_ctl; - vmcb12->control.event_inj =3D svm->nested.ctl.event_inj; - vmcb12->control.event_inj_err =3D svm->nested.ctl.event_inj_err; =20 if (!kvm_pause_in_guest(vcpu->kvm)) { vmcb01->control.pause_filter_count =3D vmcb02->control.pause_filter_coun= t; @@ -1315,8 +1317,6 @@ void nested_svm_vmexit(struct vcpu_svm *svm) vmcb12->control.exit_int_info_err, KVM_ISA_SVM); =20 - kvm_vcpu_unmap(vcpu, &map); - nested_svm_transition_tlb_flush(vcpu); =20 /* @@ -1338,7 +1338,9 @@ void nested_svm_vmexit(struct vcpu_svm *svm) * Potentially queues an exception, so it needs to be after * kvm_clear_exception_queue() is called above. */ - __nested_svm_vmexit(svm); + __nested_svm_vmexit(svm, vmcb12); + + kvm_vcpu_unmap(vcpu, &map); } =20 static void nested_svm_triple_fault(struct kvm_vcpu *vcpu) --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-183.mta0.migadu.com (out-183.mta0.migadu.com [91.218.175.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4D0E826F293; Thu, 15 Jan 2026 01:13:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.183 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439638; cv=none; b=s/HumfCPz8+vNhP/DTJQMnEgfHO2GBlptpDE/SFhWkOBPiJM3XaMdJ5E1zxuqGxWuqFJq8IRco20m28yO3xKa7+k9HcclmdHhfYBAXjh/eSmDgEIcclED/nveMZQAgYKWLbkfuGu7V95tlZYQ5qUXQYMZ0wCgHD3FrBDMlr39HU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439638; c=relaxed/simple; bh=NNy3KKalBGgQX+5SCjuQwk2g/AHfxzAtaZKdKc7dtsU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=U82ic74Q6l8ScxpmhJ4Uyv3D5XtiSDkdRtwKnLNV9pa0Km8YLHMZc5itNtfDvfgmwAvo2is0IXGrLCaURpSGJS3Zs4ai8ZdeQPsFmn7Pp4U0ga3OAx1o2aBSQkE9rcnpNYJ9FtXjRgFtRU3MDJohBtb/VQHeBBmOUu0hxhdoboU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=uGGOAORL; arc=none smtp.client-ip=91.218.175.183 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="uGGOAORL" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439634; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=92IseN4WbR7/gNBYYHdL6FsvVihQVPKtL41fgiBGnsA=; b=uGGOAORLW8S1s/Ve8LVfYwlpA9NUGPLT4L9gDvn9GS+/lbbk2t3snvaoJHzbIiv+YJ26aH SpBONyNutkZrweCGOWa0+3gwc1hKmQmCZ8t0k5GC1qCygaAmVkiBQCOV1Dmdgo3mx+IBMN z42Hb76cRI7FlIRBLLlHstUI8aH9tkg= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 15/26] KVM: nSVM: Drop the non-architectural consistency check for NP_ENABLE Date: Thu, 15 Jan 2026 01:13:01 +0000 Message-ID: <20260115011312.3675857-16-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" KVM currenty fails a nested VMRUN and injects VMEXIT_INVALID (aka SVM_EXIT_ERR) if L1 sets NP_ENABLE and the host does not support NPTs. On first glance, it seems like the check should actually be for guest_cpu_cap_has(X86_FEATURE_NPT) instead, as it is possible for the host to support NPTs but the guest CPUID to not advertise it. However, the consistency check is not architectural to begin with. The APM does not mention VMEXIT_INVALID if NP_ENABLE is set on a processor that does not have X86_FEATURE_NPT. Hence, NP_ENABLE should be ignored if X86_FEATURE_NPT is not available for L1, so sanitize it when copying from the VMCB12 to KVM's cache. Apart from the consistency check, NP_ENABLE in VMCB12 is currently ignored because the bit is actually copied from VMCB01 to VMCB02, not from VMCB12. Fixes: 4b16184c1cca ("KVM: SVM: Initialize Nested Nested MMU context on VMR= UN") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 704e572324f2..0f2b42803cf6 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -351,9 +351,6 @@ static bool nested_vmcb_check_controls(struct kvm_vcpu = *vcpu, if (CC(control->asid =3D=3D 0)) return false; =20 - if (CC((control->nested_ctl & SVM_NESTED_CTL_NP_ENABLE) && !npt_enabled)) - return false; - if (CC(!nested_svm_check_bitmap_pa(vcpu, control->msrpm_base_pa, MSRPM_SIZE))) return false; @@ -434,6 +431,11 @@ void __nested_copy_vmcb_control_to_cache(struct kvm_vc= pu *vcpu, nested_svm_sanitize_intercept(vcpu, to, SKINIT); nested_svm_sanitize_intercept(vcpu, to, RDPRU); =20 + /* Always clear NP_ENABLE if the guest cannot use NPTs */ + to->nested_ctl =3D from->nested_ctl; + if (!guest_cpu_cap_has(vcpu, X86_FEATURE_NPT)) + to->nested_ctl &=3D ~SVM_NESTED_CTL_NP_ENABLE; + to->iopm_base_pa =3D from->iopm_base_pa; to->msrpm_base_pa =3D from->msrpm_base_pa; to->tsc_offset =3D from->tsc_offset; @@ -448,7 +450,6 @@ void __nested_copy_vmcb_control_to_cache(struct kvm_vcp= u *vcpu, to->exit_info_2 =3D from->exit_info_2; to->exit_int_info =3D from->exit_int_info; to->exit_int_info_err =3D from->exit_int_info_err; - to->nested_ctl =3D from->nested_ctl; to->event_inj =3D from->event_inj; to->event_inj_err =3D from->event_inj_err; to->next_rip =3D from->next_rip; --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-185.mta0.migadu.com (out-185.mta0.migadu.com [91.218.175.185]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 248C42BFC85; Thu, 15 Jan 2026 01:14:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.185 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439646; cv=none; b=VcHGUJLZVHdHfPBpXsdUGbYQ/JcDKGFFXLxLF8cHQX9KivF0lNXNmJhEfpRJYvrZ/0EdziD7z2EvQ/1rknrbnnwtmYWLNHWZsCqvP3BQk+l837JULidJbozRhQGx9G6OVPKkvN+X2xuYQ3wSb2j1gC5ZOpNSFepbkc9PdsRljUc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439646; c=relaxed/simple; bh=jkSq9tDVGErvaaS/R2yTML7mgZQQNgvOV0zJe0C58jg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=HIg+huiPCGnHb7x4vKpr2hlGVK6K35o8rJxpG1BqufqbRMBUbdFk99VgpvVfazscLa3XK5h27Ptl8QTWCA130OuC2MkiE+USrmmuyxSy5MGMZ+Phw1H3DJXHbiosbDtZgZdZ+NxuDLDx5iTSsLeZ7UHbUCPIAW6zRnygHsT1aVg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=b/x+bvtR; arc=none smtp.client-ip=91.218.175.185 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="b/x+bvtR" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439636; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Xj+u+1+YUYkkYowwQzLxZwwWgktF/al3hH8x6AlKW9w=; b=b/x+bvtRef+H97dL2rr4LyC6zt/4lQnPcs96RwgsNwi+IH3NgyPFebdDWf1li9qQbAcwYG SnEXMCjkqbur7+8AoTba1EH82g6qf6TGH3l7omvo3kDimKYs+5KIMfBV5QN+5bxM6iowDx mp0EvrfRGI+0KIQiW1I5ZIImDwMGQMA= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 16/26] KVM: nSVM: Add missing consistency check for nCR3 validity Date: Thu, 15 Jan 2026 01:13:02 +0000 Message-ID: <20260115011312.3675857-17-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT From the APM Volume #2, 15.25.4 (24593=E2=80=94Rev. 3.42=E2=80=94March 2024= ): When VMRUN is executed with nested paging enabled (NP_ENABLE =3D 1), the following conditions are considered illegal state combinations, in addition to those mentioned in =E2=80=9CCanonicalization and Consistency Checks=E2=80=9D: =E2=80=A2 Any MBZ bit of nCR3 is set. =E2=80=A2 Any G_PAT.PA field has an unsupported type encoding or any reserved field in G_PAT has a nonzero value. Add the consistency check for nCR3 being a legal GPA with no MBZ bits set. The G_PAT.PA check was proposed separately [*]. [*]https://lore.kernel.org/kvm/20251107201151.3303170-6-jmattson@google.com/ Fixes: 4b16184c1cca ("KVM: SVM: Initialize Nested Nested MMU context on VMR= UN") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 0f2b42803cf6..eb4a633a668d 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -351,6 +351,11 @@ static bool nested_vmcb_check_controls(struct kvm_vcpu= *vcpu, if (CC(control->asid =3D=3D 0)) return false; =20 + if (nested_npt_enabled(to_svm(vcpu))) { + if (CC(!kvm_vcpu_is_legal_gpa(vcpu, control->nested_cr3))) + return false; + } + if (CC(!nested_svm_check_bitmap_pa(vcpu, control->msrpm_base_pa, MSRPM_SIZE))) return false; --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-188.mta0.migadu.com (out-188.mta0.migadu.com [91.218.175.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1DF35258ECB for ; Thu, 15 Jan 2026 01:14:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439649; cv=none; b=PYgDF0l2TLJki1PtFP0NvRc4uZTPF75Z3YftkRTGYfn5VHTIsFIqZRRe0c/aesgti2bCOrt0bGrXtQSUagoNA8iiF4B0intsJp/CisQoiEWZv5sroKXMdNEDVPX+JC9xNwKY+k4yYFFpH53FsuJt57mS/M9bgbpebys0vxb4lvc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439649; c=relaxed/simple; bh=FhTOmmi6gnSSLVnyBr/gDx4uaArPGwCmaY2IJPjijuM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=PExkakUPUvYK0QVOQebkuvFh++hu6mEEtSl5TMhK9UQIxGBL7m67ppcQPgXBg0b6fflXCDxav8SrTUYmW0iCUrUMfvs0zZzORsycC4DT7jR2J1oCXdvCx7UHpFMUNhw93syZm56kuJQz/dnpKdv5aFfueVYEaXB8ac4Y7W3Zbos= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=FtgnqG4P; arc=none smtp.client-ip=91.218.175.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="FtgnqG4P" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439638; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=QrdFcAsC8FiX1Peqg4gjJ2+Ki+Tm5p09T6ZYsAHHLkU=; b=FtgnqG4PjkcBNQ7yhBSvavt2zRWIuveyzqyN1ELxbTsxzNf7TW2lvkk/kxDzn7nQGr34sX +ELLYC1+Mn+c5SnG3bA1px00lM2B02aLyxOVeh+WoK9me9hy4akZViEAQmjQ5XBGgPKiav Pv9zYM5DMsSi5GuJJZL+Qm8lGseemio= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 17/26] KVM: nSVM: Add missing consistency check for hCR0.PG and NP_ENABLE Date: Thu, 15 Jan 2026 01:13:03 +0000 Message-ID: <20260115011312.3675857-18-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT From the APM Volume #2, 15.25.3 (24593=E2=80=94Rev. 3.42=E2=80=94March 2024= ): If VMRUN is executed with hCR0.PG cleared to zero and NP_ENABLE set to 1 , VMRUN terminates with #VMEXIT(VMEXIT_INVALID). Add the consistency check by plumbing L1's CR0 to nested_vmcb_check_controls(). Fixes: 4b16184c1cca ("KVM: SVM: Initialize Nested Nested MMU context on VMR= UN") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index eb4a633a668d..72db46b5126d 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -343,7 +343,8 @@ static bool nested_svm_check_bitmap_pa(struct kvm_vcpu = *vcpu, u64 pa, u32 size) } =20 static bool nested_vmcb_check_controls(struct kvm_vcpu *vcpu, - struct vmcb_ctrl_area_cached *control) + struct vmcb_ctrl_area_cached *control, + unsigned long l1_cr0) { if (CC(!vmcb12_is_intercept(control, INTERCEPT_VMRUN))) return false; @@ -354,6 +355,8 @@ static bool nested_vmcb_check_controls(struct kvm_vcpu = *vcpu, if (nested_npt_enabled(to_svm(vcpu))) { if (CC(!kvm_vcpu_is_legal_gpa(vcpu, control->nested_cr3))) return false; + if (CC(!(l1_cr0 & X86_CR0_PG))) + return false; } =20 if (CC(!nested_svm_check_bitmap_pa(vcpu, control->msrpm_base_pa, @@ -951,7 +954,8 @@ int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 vmc= b12_gpa, enter_guest_mode(vcpu); =20 if (!nested_vmcb_check_save(vcpu, &svm->nested.save) || - !nested_vmcb_check_controls(vcpu, &svm->nested.ctl)) + !nested_vmcb_check_controls(vcpu, &svm->nested.ctl, + svm->vmcb01.ptr->save.cr0)) return -EINVAL; =20 if (nested_npt_enabled(svm)) @@ -1882,7 +1886,8 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, =20 ret =3D -EINVAL; __nested_copy_vmcb_control_to_cache(vcpu, &ctl_cached, ctl); - if (!nested_vmcb_check_controls(vcpu, &ctl_cached)) + /* 'save' contains L1 state saved from before VMRUN */ + if (!nested_vmcb_check_controls(vcpu, &ctl_cached, save->cr0)) goto out_free; =20 /* --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-178.mta0.migadu.com (out-178.mta0.migadu.com [91.218.175.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 16D7C253F13 for ; Thu, 15 Jan 2026 01:14:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439648; cv=none; b=Z8s+jSiEQcdh1j1N9qMOmJc0B8yf5W4a6y4V29CpR3E3Bw2N0QxrvfKrXo4gGt6Y0pu8gsZJYgFf8AG+N4CDGB32pFdUChGE15qV4WqIi/kNikX7PdxXr/r8mEXvWWaHa79XFHfr6FlBahDNAaMSbs6gamFoLthtyTnl6dbcIIw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439648; c=relaxed/simple; bh=/iYHmwrHBc4Z/9o/cwPY7owGtq7bxTWgmkTdkDT1YjY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ioWoOOoT1LiY0KNvm5SsXvuL5uQU9DDySrA+NlaHfXfaRU0H9mIccda4ptzDjQ1wWLdj1yMe7eMlYRQXvomn920D0qbipUXWTudO8zlqq9/f6y6ARm7VkoNYqWACX7tZLdHcZTfDMSOJnuwPLhe9N0L9qpnXgfxmmnKstvex2No= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=ARbW/+gH; arc=none smtp.client-ip=91.218.175.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="ARbW/+gH" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439640; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3ZxEkfJ4v9hif4brlpeOid1QR0PaBxuKeB/A2Sc7/9E=; b=ARbW/+gHbrqorKGryMkW2O2qsapZy/78qr+4wDB8fXh3TdRSrjzhZm0f0GmvvRHAIpeST7 c0AMv3Bl2O9g4k6Ti5dzBnBCH7zWK9HPDoi7ZM1gOWPEKGNLuzqwoAW8T6KDa61OPgnW5F Sl02kS4gmDfp2A5zqcc/vGLeXaxlVC4= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 18/26] KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Date: Thu, 15 Jan 2026 01:13:04 +0000 Message-ID: <20260115011312.3675857-19-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT According to the APM Volume #2, 15.5, Canonicalization and Consistency Checks (24593=E2=80=94Rev. 3.42=E2=80=94March 2024), the following conditio= n (among others) results in a #VMEXIT with VMEXIT_INVALID (aka SVM_EXIT_ERR): EFER.LME, CR0.PG, CR4.PAE, CS.L, and CS.D are all non-zero. Add the missing consistency check. This is functionally a nop because the nested VMRUN results in SVM_EXIT_ERR in HW, which is forwarded to L1, but KVM makes all consistency checks before a VMRUN is actually attempted. Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 7 +++++++ arch/x86/kvm/svm/svm.h | 1 + 2 files changed, 8 insertions(+) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 72db46b5126d..d8c79b3ea55e 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -398,6 +398,11 @@ static bool nested_vmcb_check_save(struct kvm_vcpu *vc= pu, CC(!(save->cr0 & X86_CR0_PE)) || CC(!kvm_vcpu_is_legal_cr3(vcpu, save->cr3))) return false; + + if (CC((save->cr4 & X86_CR4_PAE) && + (save->cs.attrib & SVM_SELECTOR_L_MASK) && + (save->cs.attrib & SVM_SELECTOR_DB_MASK))) + return false; } =20 /* Note, SVM doesn't have any additional restrictions on CR4. */ @@ -494,6 +499,8 @@ static void __nested_copy_vmcb_save_to_cache(struct vmc= b_save_area_cached *to, * Copy only fields that are validated, as we need them * to avoid TOC/TOU races. */ + to->cs =3D from->cs; + to->efer =3D from->efer; to->cr0 =3D from->cr0; to->cr3 =3D from->cr3; diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 3e3dcd671aad..dc0ce2141d5f 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -139,6 +139,7 @@ struct kvm_vmcb_info { }; =20 struct vmcb_save_area_cached { + struct vmcb_seg cs; u64 efer; u64 cr4; u64 cr3; --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-181.mta0.migadu.com (out-181.mta0.migadu.com [91.218.175.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 66C40264A65; Thu, 15 Jan 2026 01:14:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439647; cv=none; b=od2gujJ9H7DO5K03Wd/X7DTzDANIZ1JyHbLBM4Yh9C3FvkBxcnMTI0UCIomP5LqyGXuhQ4Zt/Spc6wEFUVKJirQDUE4NJsjI1xQ+UANCcoDVRyiCE77P9o27lFUSBIpRyxcQULisOaSPffjDFKLkr9AXvC5pEIyeAm0QcetMgXM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439647; c=relaxed/simple; bh=lCwWYrC+i/WlW0FzLo8Y3vpJnW3WvFax7tAQm04Kw6E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=O6+WoltSvjVc7l9VTb2r0gfzqREAsPsvsgkYrMV8gBWnb3SDtDwbKDxpAMQCRNnK/qUogLx7w3IqJHIT8mQJ66wYr/Hp8/p3GIa8NUKN4ipD/ywLTABUDXT8oGcul5Pj4tx7mXIvu6oHuDTGdmq0/w8e6Ob+DdfNLOPSwYu+geg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=FPxphtO3; arc=none smtp.client-ip=91.218.175.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="FPxphtO3" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439641; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=STHpibAtHQzZNIIE51mSVp+HkDDjwfWOOM+rEzu4sw8=; b=FPxphtO3yej0lCJwlU+g+l42a2h+GLF27VJXEpUFDUH8qTSDZ8hUCTyiq5PfWBZ0ArOKiu hcL+maaH3xQjTJR7aBfXH69E5UxIRwM6sZqfPa1ByqZHlaVhag5NBG5Iw/FFlJFAXErt8+ JnjlY+/4LQj9lxJiBiSoQFQkH8z6sFk= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v4 19/26] KVM: nSVM: Add missing consistency check for event_inj Date: Thu, 15 Jan 2026 01:13:05 +0000 Message-ID: <20260115011312.3675857-20-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT According to the APM Volume #2, 15.20 (24593=E2=80=94Rev. 3.42=E2=80=94Marc= h 2024): VMRUN exits with VMEXIT_INVALID error code if either: =E2=80=A2 Reserved values of TYPE have been specified, or =E2=80=A2 TYPE =3D 3 (exception) has been specified with a vector that do= es not correspond to an exception (this includes vector 2, which is an NMI, not an exception). Add the missing consistency checks to KVM. For the second point, inject VMEXIT_INVALID if the vector is anything but the vectors defined by the APM for exceptions. Reserved vectors are also considered invalid, which matches the HW behavior. Vector 9 (i.e. #CSO) is considered invalid because it is reserved on modern CPUs, and according to LLMs no CPUs exist supporting SVM and producing #CSOs. Defined exceptions could be different between virtual CPUs as new CPUs define new vectors. In a best effort to dynamically define the valid vectors, make all currently defined vectors as valid except those obviously tied to a CPU feature: SHSTK -> #CP and SEV-ES -> #VC. As new vectors are defined, they can similarly be tied to corresponding CPU features. Invalid vectors on specific (e.g. old) CPUs that are missed by KVM should be rejected by HW anyway. Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler") CC: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 51 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index d8c79b3ea55e..79db1e1c8b2a 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -342,6 +342,54 @@ static bool nested_svm_check_bitmap_pa(struct kvm_vcpu= *vcpu, u64 pa, u32 size) kvm_vcpu_is_legal_gpa(vcpu, addr + size - 1); } =20 +static bool nested_svm_event_inj_valid_exept(struct kvm_vcpu *vcpu, u8 vec= tor) +{ + /* + * Vectors that do not correspond to a defined exception are invalid + * (including #NMI and reserved vectors). In a best effort to define + * valid exceptions based on the virtual CPU, make all exceptions always + * valid except those obviously tied to a CPU feature. + */ + switch (vector) { + case DE_VECTOR: case DB_VECTOR: case BP_VECTOR: case OF_VECTOR: + case BR_VECTOR: case UD_VECTOR: case NM_VECTOR: case DF_VECTOR: + case TS_VECTOR: case NP_VECTOR: case SS_VECTOR: case GP_VECTOR: + case PF_VECTOR: case MF_VECTOR: case AC_VECTOR: case MC_VECTOR: + case XM_VECTOR: case HV_VECTOR: case SX_VECTOR: + return true; + case CP_VECTOR: + return guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK); + case VC_VECTOR: + return guest_cpu_cap_has(vcpu, X86_FEATURE_SEV_ES); + } + return false; +} + +/* + * According to the APM, VMRUN exits with SVM_EXIT_ERR if SVM_EVTINJ_VALID= is + * set and: + * - The type of event_inj is not one of the defined values. + * - The type is SVM_EVTINJ_TYPE_EXEPT, but the vector is not a valid exce= ption. + */ +static bool nested_svm_check_event_inj(struct kvm_vcpu *vcpu, u32 event_in= j) +{ + u32 type =3D event_inj & SVM_EVTINJ_TYPE_MASK; + u8 vector =3D event_inj & SVM_EVTINJ_VEC_MASK; + + if (!(event_inj & SVM_EVTINJ_VALID)) + return true; + + if (type !=3D SVM_EVTINJ_TYPE_INTR && type !=3D SVM_EVTINJ_TYPE_NMI && + type !=3D SVM_EVTINJ_TYPE_EXEPT && type !=3D SVM_EVTINJ_TYPE_SOFT) + return false; + + if (type =3D=3D SVM_EVTINJ_TYPE_EXEPT && + !nested_svm_event_inj_valid_exept(vcpu, vector)) + return false; + + return true; +} + static bool nested_vmcb_check_controls(struct kvm_vcpu *vcpu, struct vmcb_ctrl_area_cached *control, unsigned long l1_cr0) @@ -371,6 +419,9 @@ static bool nested_vmcb_check_controls(struct kvm_vcpu = *vcpu, return false; } =20 + if (CC(!nested_svm_check_event_inj(vcpu, control->event_inj))) + return false; + return true; } =20 --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-184.mta0.migadu.com (out-184.mta0.migadu.com [91.218.175.184]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EE8B62C08AC for ; Thu, 15 Jan 2026 01:14:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.184 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439647; cv=none; b=S1NT/SvHTQIJhjFVSNM2ek8qrthXfeeXhIkfcfpRiUz1l7OPxSI79IiPF00yKbKnZH1oZK4puvqbB0GoAPfqfyranTIv4zC7/KyrdQScwgk4/XXCXDP0/eBc9ZhUnZyvdNtUAmVtaLyh0tsXK1NsJ1yyt2fmpnLWA7k1lifeEyc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439647; c=relaxed/simple; bh=QZukHD1jb3jA7ZmfYuCVooVzql93sc61Up+B8EMXDTY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=iSCu7snrkCA167v9KIB+mjuvChXn+IUoBo3ZLZtMifDd4ECjFTeuDcOG8DlFSBodD+RwUQ3edkvoY8C6CTpOWgsydoWVEpt1ztfGtGVjSPzzRFw6xml2eCRNNb84mrcCbx5Rn6dz2dkXtd4XFndzNY/wsQDbI2EjDH6Eg+TTd7U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=naFQ+INR; arc=none smtp.client-ip=91.218.175.184 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="naFQ+INR" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439643; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WNDyOlyEyIQPEF1lGqpybPE2otDvXgipCFufI2UQZoQ=; b=naFQ+INR1gCDZQvpXiHOyS/Ks/pBTEerXQbunUuTGb0slzvkcPEVE9SMrbkbuvdDamz9td Eracrp1kKfcoc4WGRMBDGGLdAwJolXyY8ONipvtu2Pi68T5GEUtpXlOhzFz5okkouohDMj X5+rcMrGHUvHxhuXHhUkIpEIaC8+UVs= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed Subject: [PATCH v4 20/26] KVM: SVM: Rename vmcb->nested_ctl to vmcb->misc_ctl Date: Thu, 15 Jan 2026 01:13:06 +0000 Message-ID: <20260115011312.3675857-21-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" The 'nested_ctl' field is misnamed. Although the first bit is for nested paging, the other defined bits are for SEV/SEV-ES. Other bits in the same field according to the APM (but not defined by KVM) include "Guest Mode Execution Trap", "Enable INVLPGB/TLBSYNC", and other control bits unrelated to 'nested'. There is nothing common among these bits, so just name the field misc_ctl. Also rename the flags accordingly. Signed-off-by: Yosry Ahmed --- arch/x86/include/asm/svm.h | 8 ++++---- arch/x86/kvm/svm/nested.c | 10 +++++----- arch/x86/kvm/svm/sev.c | 4 ++-- arch/x86/kvm/svm/svm.c | 4 ++-- arch/x86/kvm/svm/svm.h | 4 ++-- tools/testing/selftests/kvm/include/x86/svm.h | 6 +++--- tools/testing/selftests/kvm/lib/x86/svm.c | 2 +- 7 files changed, 19 insertions(+), 19 deletions(-) diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h index 50ece197c98a..2e39ac15ee5a 100644 --- a/arch/x86/include/asm/svm.h +++ b/arch/x86/include/asm/svm.h @@ -143,7 +143,7 @@ struct __attribute__ ((__packed__)) vmcb_control_area { u64 exit_info_2; u32 exit_int_info; u32 exit_int_info_err; - u64 nested_ctl; + u64 misc_ctl; u64 avic_vapic_bar; u64 ghcb_gpa; u32 event_inj; @@ -240,9 +240,9 @@ struct __attribute__ ((__packed__)) vmcb_control_area { #define SVM_IOIO_SIZE_MASK (7 << SVM_IOIO_SIZE_SHIFT) #define SVM_IOIO_ASIZE_MASK (7 << SVM_IOIO_ASIZE_SHIFT) =20 -#define SVM_NESTED_CTL_NP_ENABLE BIT(0) -#define SVM_NESTED_CTL_SEV_ENABLE BIT(1) -#define SVM_NESTED_CTL_SEV_ES_ENABLE BIT(2) +#define SVM_MISC_CTL_NP_ENABLE BIT(0) +#define SVM_MISC_CTL_SEV_ENABLE BIT(1) +#define SVM_MISC_CTL_SEV_ES_ENABLE BIT(2) =20 =20 #define SVM_TSC_RATIO_RSVD 0xffffff0000000000ULL diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 79db1e1c8b2a..605e202ba208 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -496,9 +496,9 @@ void __nested_copy_vmcb_control_to_cache(struct kvm_vcp= u *vcpu, nested_svm_sanitize_intercept(vcpu, to, RDPRU); =20 /* Always clear NP_ENABLE if the guest cannot use NPTs */ - to->nested_ctl =3D from->nested_ctl; + to->misc_ctl =3D from->misc_ctl; if (!guest_cpu_cap_has(vcpu, X86_FEATURE_NPT)) - to->nested_ctl &=3D ~SVM_NESTED_CTL_NP_ENABLE; + to->misc_ctl &=3D ~SVM_MISC_CTL_NP_ENABLE; =20 to->iopm_base_pa =3D from->iopm_base_pa; to->msrpm_base_pa =3D from->msrpm_base_pa; @@ -837,7 +837,7 @@ static void nested_vmcb02_prepare_control(struct vcpu_s= vm *svm, } =20 /* Copied from vmcb01. msrpm_base can be overwritten later. */ - vmcb02->control.nested_ctl =3D vmcb01->control.nested_ctl; + vmcb02->control.misc_ctl =3D vmcb01->control.misc_ctl; vmcb02->control.iopm_base_pa =3D vmcb01->control.iopm_base_pa; vmcb02->control.msrpm_base_pa =3D vmcb01->control.msrpm_base_pa; vmcb_mark_dirty(vmcb02, VMCB_PERM_MAP); @@ -993,7 +993,7 @@ int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 vmc= b12_gpa, vmcb12->save.rip, vmcb12->control.int_ctl, vmcb12->control.event_inj, - vmcb12->control.nested_ctl, + vmcb12->control.misc_ctl, vmcb12->control.nested_cr3, vmcb12->save.cr3, KVM_ISA_SVM); @@ -1804,7 +1804,7 @@ static void nested_copy_vmcb_cache_to_control(struct = vmcb_control_area *dst, dst->exit_info_2 =3D from->exit_info_2; dst->exit_int_info =3D from->exit_int_info; dst->exit_int_info_err =3D from->exit_int_info_err; - dst->nested_ctl =3D from->nested_ctl; + dst->misc_ctl =3D from->misc_ctl; dst->event_inj =3D from->event_inj; dst->event_inj_err =3D from->event_inj_err; dst->next_rip =3D from->next_rip; diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index f59c65abe3cf..dbeb776b0492 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -4564,7 +4564,7 @@ static void sev_es_init_vmcb(struct vcpu_svm *svm, bo= ol init_event) struct kvm_sev_info *sev =3D to_kvm_sev_info(svm->vcpu.kvm); struct vmcb *vmcb =3D svm->vmcb01.ptr; =20 - svm->vmcb->control.nested_ctl |=3D SVM_NESTED_CTL_SEV_ES_ENABLE; + svm->vmcb->control.misc_ctl |=3D SVM_MISC_CTL_SEV_ES_ENABLE; =20 /* * An SEV-ES guest requires a VMSA area that is a separate from the @@ -4635,7 +4635,7 @@ void sev_init_vmcb(struct vcpu_svm *svm, bool init_ev= ent) { struct kvm_vcpu *vcpu =3D &svm->vcpu; =20 - svm->vmcb->control.nested_ctl |=3D SVM_NESTED_CTL_SEV_ENABLE; + svm->vmcb->control.misc_ctl |=3D SVM_MISC_CTL_SEV_ENABLE; clr_exception_intercept(svm, UD_VECTOR); =20 /* diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index f3901f9ee487..e64bbae8f852 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -1149,7 +1149,7 @@ static void init_vmcb(struct kvm_vcpu *vcpu, bool ini= t_event) =20 if (npt_enabled) { /* Setup VMCB for Nested Paging */ - control->nested_ctl |=3D SVM_NESTED_CTL_NP_ENABLE; + control->misc_ctl |=3D SVM_MISC_CTL_NP_ENABLE; svm_clr_intercept(svm, INTERCEPT_INVLPG); clr_exception_intercept(svm, PF_VECTOR); svm_clr_intercept(svm, INTERCEPT_CR3_READ); @@ -3352,7 +3352,7 @@ static void dump_vmcb(struct kvm_vcpu *vcpu) pr_err("%-20s%016llx\n", "exit_info2:", control->exit_info_2); pr_err("%-20s%08x\n", "exit_int_info:", control->exit_int_info); pr_err("%-20s%08x\n", "exit_int_info_err:", control->exit_int_info_err); - pr_err("%-20s%lld\n", "nested_ctl:", control->nested_ctl); + pr_err("%-20s%lld\n", "misc_ctl:", control->misc_ctl); pr_err("%-20s%016llx\n", "nested_cr3:", control->nested_cr3); pr_err("%-20s%016llx\n", "avic_vapic_bar:", control->avic_vapic_bar); pr_err("%-20s%016llx\n", "ghcb:", control->ghcb_gpa); diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index dc0ce2141d5f..166d2b93797d 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -167,7 +167,7 @@ struct vmcb_ctrl_area_cached { u64 exit_info_2; u32 exit_int_info; u32 exit_int_info_err; - u64 nested_ctl; + u64 misc_ctl; u32 event_inj; u32 event_inj_err; u64 next_rip; @@ -571,7 +571,7 @@ static inline bool gif_set(struct vcpu_svm *svm) =20 static inline bool nested_npt_enabled(struct vcpu_svm *svm) { - return svm->nested.ctl.nested_ctl & SVM_NESTED_CTL_NP_ENABLE; + return svm->nested.ctl.misc_ctl & SVM_MISC_CTL_NP_ENABLE; } =20 static inline bool nested_vnmi_enabled(struct vcpu_svm *svm) diff --git a/tools/testing/selftests/kvm/include/x86/svm.h b/tools/testing/= selftests/kvm/include/x86/svm.h index 29cffd0a9181..5d2bcce34c01 100644 --- a/tools/testing/selftests/kvm/include/x86/svm.h +++ b/tools/testing/selftests/kvm/include/x86/svm.h @@ -98,7 +98,7 @@ struct __attribute__ ((__packed__)) vmcb_control_area { u64 exit_info_2; u32 exit_int_info; u32 exit_int_info_err; - u64 nested_ctl; + u64 misc_ctl; u64 avic_vapic_bar; u8 reserved_4[8]; u32 event_inj; @@ -176,8 +176,8 @@ struct __attribute__ ((__packed__)) vmcb_control_area { #define SVM_VM_CR_SVM_LOCK_MASK 0x0008ULL #define SVM_VM_CR_SVM_DIS_MASK 0x0010ULL =20 -#define SVM_NESTED_CTL_NP_ENABLE BIT(0) -#define SVM_NESTED_CTL_SEV_ENABLE BIT(1) +#define SVM_MISC_CTL_CTL_NP_ENABLE BIT(0) +#define SVM_MISC_CTL_SEV_ENABLE BIT(1) =20 struct __attribute__ ((__packed__)) vmcb_seg { u16 selector; diff --git a/tools/testing/selftests/kvm/lib/x86/svm.c b/tools/testing/self= tests/kvm/lib/x86/svm.c index 2e5c480c9afd..fd70984a2aa5 100644 --- a/tools/testing/selftests/kvm/lib/x86/svm.c +++ b/tools/testing/selftests/kvm/lib/x86/svm.c @@ -126,7 +126,7 @@ void generic_svm_setup(struct svm_test_data *svm, void = *guest_rip, void *guest_r guest_regs.rdi =3D (u64)svm; =20 if (svm->ncr3_gpa) { - ctrl->nested_ctl |=3D SVM_NESTED_CTL_NP_ENABLE; + ctrl->misc_ctl |=3D SVM_MISC_CTL_CTL_NP_ENABLE; ctrl->nested_cr3 =3D svm->ncr3_gpa; } } --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-182.mta0.migadu.com (out-182.mta0.migadu.com [91.218.175.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB26E2C0F83 for ; Thu, 15 Jan 2026 01:14:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439649; cv=none; b=lTJP6bTLmBdTKuea1sWKUaL82aDKjux9cqc9e9XyZkUR56RQbjhxOeUYOUDDhKY4phq4UdIGDBNqU6uXTjLskhGSkGqoZGu/RhSgSLnDNuploqAqH7Gqb6PfKjqTom1Lf5gpeAZyyUyzCDTHtUXM15mcIAqORnnRMvryowljHkg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439649; c=relaxed/simple; bh=X1wOirQ3Ml+7WSd6rXv9UCQcS7jkjR6WHbgbDQSIaaE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=h9t3Q9bUQkj1INT/bl5mi/FoC3SIiK1rV8zwAs0PYRp5xPCkwlKG9mRnpAqXowDABubHOD9CsV6gIaZtssjaJuKb2HhS0mQngPXyKPriQBkSvsUfkDw8koNUDAM9VCyNWqoeYsn0eIQEj6vXB/TAcaMU2ew1n21FNo1wS+CCQwc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=Tg0eQ8yV; arc=none smtp.client-ip=91.218.175.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="Tg0eQ8yV" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439644; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=lJyPZPHpm06xpJ9FcxRG+UucXrX8lFZjQcT3AglbbHA=; b=Tg0eQ8yVvLZ1SV9lVXp4HL4ErcvBST7VY73fe+QHWug2xH1eBi3aydZyZyUNT05I9qZcXr raQV+bY/jDd7we/oOB4z9wgm2LJwK8132Lhn0rW8CZtYz4OzbvD4kHrjvTLf04mCYM84nv io9LgVWNiPOSig1G4VEeTQuePtZqjVY= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed Subject: [PATCH v4 21/26] KVM: SVM: Rename vmcb->virt_ext to vmcb->misc_ctl2 Date: Thu, 15 Jan 2026 01:13:07 +0000 Message-ID: <20260115011312.3675857-22-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" 'virt' is confusing in the VMCB because it is relative and ambiguous. The 'virt_ext' field includes bits for LBR virtualization and VMSAVE/VMLOAD virtualization, so it's just another miscellaneous control field. Name it as such. While at it, move the definitions of the bits below those for 'misc_ctl' and rename them for consistency. Signed-off-by: Yosry Ahmed --- arch/x86/include/asm/svm.h | 7 +++---- arch/x86/kvm/svm/nested.c | 18 ++++++++--------- arch/x86/kvm/svm/svm.c | 20 +++++++++---------- arch/x86/kvm/svm/svm.h | 2 +- tools/testing/selftests/kvm/include/x86/svm.h | 8 ++++---- .../selftests/kvm/x86/svm_lbr_nested_state.c | 4 ++-- 6 files changed, 29 insertions(+), 30 deletions(-) diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h index 2e39ac15ee5a..770c7aed5fa5 100644 --- a/arch/x86/include/asm/svm.h +++ b/arch/x86/include/asm/svm.h @@ -149,7 +149,7 @@ struct __attribute__ ((__packed__)) vmcb_control_area { u32 event_inj; u32 event_inj_err; u64 nested_cr3; - u64 virt_ext; + u64 misc_ctl2; u32 clean; u32 reserved_5; u64 next_rip; @@ -223,9 +223,6 @@ struct __attribute__ ((__packed__)) vmcb_control_area { #define X2APIC_MODE_SHIFT 30 #define X2APIC_MODE_MASK (1 << X2APIC_MODE_SHIFT) =20 -#define LBR_CTL_ENABLE_MASK BIT_ULL(0) -#define VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK BIT_ULL(1) - #define SVM_INTERRUPT_SHADOW_MASK BIT_ULL(0) #define SVM_GUEST_INTERRUPT_MASK BIT_ULL(1) =20 @@ -244,6 +241,8 @@ struct __attribute__ ((__packed__)) vmcb_control_area { #define SVM_MISC_CTL_SEV_ENABLE BIT(1) #define SVM_MISC_CTL_SEV_ES_ENABLE BIT(2) =20 +#define SVM_MISC_CTL2_LBR_CTL_ENABLE BIT_ULL(0) +#define SVM_MISC_CTL2_V_VMLOAD_VMSAVE_ENABLE BIT_ULL(1) =20 #define SVM_TSC_RATIO_RSVD 0xffffff0000000000ULL #define SVM_TSC_RATIO_MIN 0x0000000000000001ULL diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 605e202ba208..69bd926530b3 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -117,7 +117,7 @@ static bool nested_vmcb_needs_vls_intercept(struct vcpu= _svm *svm) if (!nested_npt_enabled(svm)) return true; =20 - if (!(svm->nested.ctl.virt_ext & VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK)) + if (!(svm->nested.ctl.misc_ctl2 & SVM_MISC_CTL2_V_VMLOAD_VMSAVE_ENABLE)) return true; =20 return false; @@ -180,7 +180,7 @@ void recalc_intercepts(struct vcpu_svm *svm) vmcb_set_intercept(c, INTERCEPT_VMLOAD); vmcb_set_intercept(c, INTERCEPT_VMSAVE); } else { - WARN_ON(!(c->virt_ext & VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK)); + WARN_ON(!(c->misc_ctl2 & SVM_MISC_CTL2_V_VMLOAD_VMSAVE_ENABLE)); } } =20 @@ -518,7 +518,7 @@ void __nested_copy_vmcb_control_to_cache(struct kvm_vcp= u *vcpu, to->event_inj_err =3D from->event_inj_err; to->next_rip =3D from->next_rip; to->nested_cr3 =3D from->nested_cr3; - to->virt_ext =3D from->virt_ext; + to->misc_ctl2 =3D from->misc_ctl2; to->pause_filter_count =3D from->pause_filter_count; to->pause_filter_thresh =3D from->pause_filter_thresh; =20 @@ -760,7 +760,7 @@ static void nested_vmcb02_prepare_save(struct vcpu_svm = *svm, struct vmcb *vmcb12 } =20 if (unlikely(guest_cpu_cap_has(vcpu, X86_FEATURE_LBRV) && - (svm->nested.ctl.virt_ext & LBR_CTL_ENABLE_MASK))) { + (svm->nested.ctl.misc_ctl2 & SVM_MISC_CTL2_LBR_CTL_ENABLE))) { /* * Reserved bits of DEBUGCTL are ignored. Be consistent with * svm_set_msr's definition of reserved bits. @@ -918,10 +918,10 @@ static void nested_vmcb02_prepare_control(struct vcpu= _svm *svm, svm->soft_int_next_rip =3D vmcb12_rip; } =20 - /* LBR_CTL_ENABLE_MASK is controlled by svm_update_lbrv() */ + /* SVM_MISC_CTL2_LBR_CTL_ENABLE is controlled by svm_update_lbrv() */ =20 if (!nested_vmcb_needs_vls_intercept(svm)) - vmcb02->control.virt_ext |=3D VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK; + vmcb02->control.misc_ctl2 |=3D SVM_MISC_CTL2_V_VMLOAD_VMSAVE_ENABLE; =20 if (guest_cpu_cap_has(vcpu, X86_FEATURE_PAUSEFILTER)) pause_count12 =3D svm->nested.ctl.pause_filter_count; @@ -1329,7 +1329,7 @@ void nested_svm_vmexit(struct vcpu_svm *svm) kvm_make_request(KVM_REQ_EVENT, &svm->vcpu); =20 if (unlikely(guest_cpu_cap_has(vcpu, X86_FEATURE_LBRV) && - (svm->nested.ctl.virt_ext & LBR_CTL_ENABLE_MASK))) { + (svm->nested.ctl.misc_ctl2 & SVM_MISC_CTL2_LBR_CTL_ENABLE))) { svm_copy_lbrs(&vmcb12->save, &vmcb02->save); } else { svm_copy_lbrs(&vmcb01->save, &vmcb02->save); @@ -1808,8 +1808,8 @@ static void nested_copy_vmcb_cache_to_control(struct = vmcb_control_area *dst, dst->event_inj =3D from->event_inj; dst->event_inj_err =3D from->event_inj_err; dst->next_rip =3D from->next_rip; - dst->nested_cr3 =3D from->nested_cr3; - dst->virt_ext =3D from->virt_ext; + dst->nested_cr3 =3D from->nested_cr3; + dst->misc_ctl2 =3D from->misc_ctl2; dst->pause_filter_count =3D from->pause_filter_count; dst->pause_filter_thresh =3D from->pause_filter_thresh; /* 'clean' and 'hv_enlightenments' are not changed by KVM */ diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index e64bbae8f852..d6a850c35225 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -710,7 +710,7 @@ void *svm_alloc_permissions_map(unsigned long size, gfp= _t gfp_mask) static void svm_recalc_lbr_msr_intercepts(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm =3D to_svm(vcpu); - bool intercept =3D !(svm->vmcb->control.virt_ext & LBR_CTL_ENABLE_MASK); + bool intercept =3D !(svm->vmcb->control.misc_ctl2 & SVM_MISC_CTL2_LBR_CTL= _ENABLE); =20 if (intercept =3D=3D svm->lbr_msrs_intercepted) return; @@ -843,7 +843,7 @@ static void svm_recalc_msr_intercepts(struct kvm_vcpu *= vcpu) =20 static void __svm_enable_lbrv(struct kvm_vcpu *vcpu) { - to_svm(vcpu)->vmcb->control.virt_ext |=3D LBR_CTL_ENABLE_MASK; + to_svm(vcpu)->vmcb->control.misc_ctl2 |=3D SVM_MISC_CTL2_LBR_CTL_ENABLE; } =20 void svm_enable_lbrv(struct kvm_vcpu *vcpu) @@ -855,16 +855,16 @@ void svm_enable_lbrv(struct kvm_vcpu *vcpu) static void __svm_disable_lbrv(struct kvm_vcpu *vcpu) { KVM_BUG_ON(sev_es_guest(vcpu->kvm), vcpu->kvm); - to_svm(vcpu)->vmcb->control.virt_ext &=3D ~LBR_CTL_ENABLE_MASK; + to_svm(vcpu)->vmcb->control.misc_ctl2 &=3D ~SVM_MISC_CTL2_LBR_CTL_ENABLE; } =20 void svm_update_lbrv(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm =3D to_svm(vcpu); - bool current_enable_lbrv =3D svm->vmcb->control.virt_ext & LBR_CTL_ENABLE= _MASK; + bool current_enable_lbrv =3D svm->vmcb->control.misc_ctl2 & SVM_MISC_CTL2= _LBR_CTL_ENABLE; bool enable_lbrv =3D (svm->vmcb->save.dbgctl & DEBUGCTLMSR_LBR) || (is_guest_mode(vcpu) && guest_cpu_cap_has(vcpu, X86_FEATURE_LBRV) && - (svm->nested.ctl.virt_ext & LBR_CTL_ENABLE_MASK)); + (svm->nested.ctl.misc_ctl2 & SVM_MISC_CTL2_LBR_CTL_ENABLE)); =20 if (enable_lbrv && !current_enable_lbrv) __svm_enable_lbrv(vcpu); @@ -1025,7 +1025,7 @@ static void svm_recalc_instruction_intercepts(struct = kvm_vcpu *vcpu) if (guest_cpuid_is_intel_compatible(vcpu)) { svm_set_intercept(svm, INTERCEPT_VMLOAD); svm_set_intercept(svm, INTERCEPT_VMSAVE); - svm->vmcb->control.virt_ext &=3D ~VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK; + svm->vmcb->control.misc_ctl2 &=3D ~SVM_MISC_CTL2_V_VMLOAD_VMSAVE_ENABLE; } else { /* * If hardware supports Virtual VMLOAD VMSAVE then enable it @@ -1034,7 +1034,7 @@ static void svm_recalc_instruction_intercepts(struct = kvm_vcpu *vcpu) if (vls) { svm_clr_intercept(svm, INTERCEPT_VMLOAD); svm_clr_intercept(svm, INTERCEPT_VMSAVE); - svm->vmcb->control.virt_ext |=3D VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK; + svm->vmcb->control.misc_ctl2 |=3D SVM_MISC_CTL2_V_VMLOAD_VMSAVE_ENABLE; } } =20 @@ -3358,7 +3358,7 @@ static void dump_vmcb(struct kvm_vcpu *vcpu) pr_err("%-20s%016llx\n", "ghcb:", control->ghcb_gpa); pr_err("%-20s%08x\n", "event_inj:", control->event_inj); pr_err("%-20s%08x\n", "event_inj_err:", control->event_inj_err); - pr_err("%-20s%lld\n", "virt_ext:", control->virt_ext); + pr_err("%-20s%lld\n", "misc_ctl2:", control->misc_ctl2); pr_err("%-20s%016llx\n", "next_rip:", control->next_rip); pr_err("%-20s%016llx\n", "avic_backing_page:", control->avic_backing_page= ); pr_err("%-20s%016llx\n", "avic_logical_id:", control->avic_logical_id); @@ -4344,7 +4344,7 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_= vcpu *vcpu, u64 run_flags) * VM-Exit), as running with the host's DEBUGCTL can negatively affect * guest state and can even be fatal, e.g. due to Bus Lock Detect. */ - if (!(svm->vmcb->control.virt_ext & LBR_CTL_ENABLE_MASK) && + if (!(svm->vmcb->control.misc_ctl2 & SVM_MISC_CTL2_LBR_CTL_ENABLE) && vcpu->arch.host_debugctl !=3D svm->vmcb->save.dbgctl) update_debugctlmsr(svm->vmcb->save.dbgctl); =20 @@ -4375,7 +4375,7 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_= vcpu *vcpu, u64 run_flags) if (unlikely(svm->vmcb->control.exit_code =3D=3D SVM_EXIT_NMI)) kvm_before_interrupt(vcpu, KVM_HANDLING_NMI); =20 - if (!(svm->vmcb->control.virt_ext & LBR_CTL_ENABLE_MASK) && + if (!(svm->vmcb->control.misc_ctl2 & SVM_MISC_CTL2_LBR_CTL_ENABLE) && vcpu->arch.host_debugctl !=3D svm->vmcb->save.dbgctl) update_debugctlmsr(vcpu->arch.host_debugctl); =20 diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 166d2b93797d..7609a2e6df88 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -172,7 +172,7 @@ struct vmcb_ctrl_area_cached { u32 event_inj_err; u64 next_rip; u64 nested_cr3; - u64 virt_ext; + u64 misc_ctl2; u32 clean; u64 bus_lock_rip; union { diff --git a/tools/testing/selftests/kvm/include/x86/svm.h b/tools/testing/= selftests/kvm/include/x86/svm.h index 5d2bcce34c01..a3f4eadffeb4 100644 --- a/tools/testing/selftests/kvm/include/x86/svm.h +++ b/tools/testing/selftests/kvm/include/x86/svm.h @@ -104,7 +104,7 @@ struct __attribute__ ((__packed__)) vmcb_control_area { u32 event_inj; u32 event_inj_err; u64 nested_cr3; - u64 virt_ext; + u64 misc_ctl2; u32 clean; u32 reserved_5; u64 next_rip; @@ -156,9 +156,6 @@ struct __attribute__ ((__packed__)) vmcb_control_area { #define AVIC_ENABLE_SHIFT 31 #define AVIC_ENABLE_MASK (1 << AVIC_ENABLE_SHIFT) =20 -#define LBR_CTL_ENABLE_MASK BIT_ULL(0) -#define VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK BIT_ULL(1) - #define SVM_INTERRUPT_SHADOW_MASK 1 =20 #define SVM_IOIO_STR_SHIFT 2 @@ -179,6 +176,9 @@ struct __attribute__ ((__packed__)) vmcb_control_area { #define SVM_MISC_CTL_CTL_NP_ENABLE BIT(0) #define SVM_MISC_CTL_SEV_ENABLE BIT(1) =20 +#define SVM_MISC_CTL2_LBR_CTL_ENABLE BIT_ULL(0) +#define SVM_MISC_CTL2_V_VMLOAD_VMSAVE_ENABLE BIT_ULL(1) + struct __attribute__ ((__packed__)) vmcb_seg { u16 selector; u16 attrib; diff --git a/tools/testing/selftests/kvm/x86/svm_lbr_nested_state.c b/tools= /testing/selftests/kvm/x86/svm_lbr_nested_state.c index a343279546fd..4a9e644b8931 100644 --- a/tools/testing/selftests/kvm/x86/svm_lbr_nested_state.c +++ b/tools/testing/selftests/kvm/x86/svm_lbr_nested_state.c @@ -75,9 +75,9 @@ static void l1_guest_code(struct svm_test_data *svm, bool= nested_lbrv) &l2_guest_stack[L2_GUEST_STACK_SIZE]); =20 if (nested_lbrv) - vmcb->control.virt_ext =3D LBR_CTL_ENABLE_MASK; + vmcb->control.misc_ctl2 =3D SVM_MISC_CTL2_LBR_CTL_ENABLE; else - vmcb->control.virt_ext &=3D ~LBR_CTL_ENABLE_MASK; + vmcb->control.misc_ctl2 &=3D ~SVM_MISC_CTL2_LBR_CTL_ENABLE; =20 run_guest(vmcb, svm->vmcb_gpa); GUEST_ASSERT(svm->vmcb->control.exit_code =3D=3D SVM_EXIT_VMMCALL); --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-171.mta0.migadu.com (out-171.mta0.migadu.com [91.218.175.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF4D72D24B7 for ; Thu, 15 Jan 2026 01:14:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439650; cv=none; b=Jr0UY7ctI1kMIiwRffktcUDYJTcpg3Wuz+wCFrKsePpxshEooPdyWz4euCzroEGaO5X9okBI258j0IeOn6C6tDud32eUgq8eqiDE1/gHKMaOm4y6oiu8i7TC26j/Q2gMHRYq9nhzc541WibK8T/edwSyNiA8HEBNaTEzZtvlndo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439650; c=relaxed/simple; bh=3QP0bb3GDMptRIKrVXdEcSGoJ5I47VZUMyyzgkRfKMU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Rr82wTcU1NFWyoZNijR/asUJAuqDS6duX/zbO4mxk76h8RtZ+rvKJYZnYJ/75DjAKTDQ8HNx3rT0ALuT3S03MoIHVhWdedhGtSSOBxXFwsTd9fV1OiUwrsCwkzR4ReLLpy8yLbDVdzAgSZrjfQgW4Q7lMVEOkYMd6CvvNQ5sz30= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=j59JEpYx; arc=none smtp.client-ip=91.218.175.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="j59JEpYx" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439646; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=7IrGfhTdzxgOo0JvNAgS7vFeXnezCbGeHIZllu7YIbE=; b=j59JEpYxO4DDHcSvtWiZqH/yJL2pbQUVBqd/kn213XZwrC+o/54mX8aXfjp5Osv3Tv+lRa 0mh50DmEPnl1raiGtPCB1qAZx0LtXy7JkVFsgNusLkHoQdoF8A8di9bnHgRsdBxLWQYSsY qrOtlgIgm38UETbbf/j8ohQdqniN+o4= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed Subject: [PATCH v4 22/26] KVM: SVM: Use BIT() and GENMASK() for definitions in svm.h Date: Thu, 15 Jan 2026 01:13:08 +0000 Message-ID: <20260115011312.3675857-23-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Use BIT() and GENMASK() (and *_ULL() variants) to define the bitmasks in svm.h. Opportunistically switch the definitions of AVIC_ENABLE_{SHIFT/MASK} and X2APIC_MODE_{SHIFT/MASK}, as well as SVM_EVTINJ_VALID and SVM_EVTINJ_VALID_ERR, such that the bitmasks are defined in the correct order. No functional change intended. Signed-off-by: Yosry Ahmed --- arch/x86/include/asm/svm.h | 78 +++++++++++++++++++------------------- 1 file changed, 39 insertions(+), 39 deletions(-) diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h index 770c7aed5fa5..0bc26b2b3fd7 100644 --- a/arch/x86/include/asm/svm.h +++ b/arch/x86/include/asm/svm.h @@ -189,39 +189,39 @@ struct __attribute__ ((__packed__)) vmcb_control_area= { #define V_TPR_MASK 0x0f =20 #define V_IRQ_SHIFT 8 -#define V_IRQ_MASK (1 << V_IRQ_SHIFT) +#define V_IRQ_MASK BIT(V_IRQ_SHIFT) =20 #define V_GIF_SHIFT 9 -#define V_GIF_MASK (1 << V_GIF_SHIFT) +#define V_GIF_MASK BIT(V_GIF_SHIFT) =20 #define V_NMI_PENDING_SHIFT 11 -#define V_NMI_PENDING_MASK (1 << V_NMI_PENDING_SHIFT) +#define V_NMI_PENDING_MASK BIT(V_NMI_PENDING_SHIFT) =20 #define V_NMI_BLOCKING_SHIFT 12 -#define V_NMI_BLOCKING_MASK (1 << V_NMI_BLOCKING_SHIFT) +#define V_NMI_BLOCKING_MASK BIT(V_NMI_BLOCKING_SHIFT) =20 #define V_INTR_PRIO_SHIFT 16 -#define V_INTR_PRIO_MASK (0x0f << V_INTR_PRIO_SHIFT) +#define V_INTR_PRIO_MASK GENMASK(V_INTR_PRIO_SHIFT + 3, V_INTR_PRIO_SHIFT) =20 #define V_IGN_TPR_SHIFT 20 -#define V_IGN_TPR_MASK (1 << V_IGN_TPR_SHIFT) +#define V_IGN_TPR_MASK BIT(V_IGN_TPR_SHIFT) =20 #define V_IRQ_INJECTION_BITS_MASK (V_IRQ_MASK | V_INTR_PRIO_MASK | V_IGN_T= PR_MASK) =20 #define V_INTR_MASKING_SHIFT 24 -#define V_INTR_MASKING_MASK (1 << V_INTR_MASKING_SHIFT) +#define V_INTR_MASKING_MASK BIT(V_INTR_MASKING_SHIFT) =20 #define V_GIF_ENABLE_SHIFT 25 -#define V_GIF_ENABLE_MASK (1 << V_GIF_ENABLE_SHIFT) +#define V_GIF_ENABLE_MASK BIT(V_GIF_ENABLE_SHIFT) =20 #define V_NMI_ENABLE_SHIFT 26 -#define V_NMI_ENABLE_MASK (1 << V_NMI_ENABLE_SHIFT) - -#define AVIC_ENABLE_SHIFT 31 -#define AVIC_ENABLE_MASK (1 << AVIC_ENABLE_SHIFT) +#define V_NMI_ENABLE_MASK BIT(V_NMI_ENABLE_SHIFT) =20 #define X2APIC_MODE_SHIFT 30 -#define X2APIC_MODE_MASK (1 << X2APIC_MODE_SHIFT) +#define X2APIC_MODE_MASK BIT(X2APIC_MODE_SHIFT) + +#define AVIC_ENABLE_SHIFT 31 +#define AVIC_ENABLE_MASK BIT(AVIC_ENABLE_SHIFT) =20 #define SVM_INTERRUPT_SHADOW_MASK BIT_ULL(0) #define SVM_GUEST_INTERRUPT_MASK BIT_ULL(1) @@ -232,10 +232,10 @@ struct __attribute__ ((__packed__)) vmcb_control_area= { #define SVM_IOIO_ASIZE_SHIFT 7 =20 #define SVM_IOIO_TYPE_MASK 1 -#define SVM_IOIO_STR_MASK (1 << SVM_IOIO_STR_SHIFT) -#define SVM_IOIO_REP_MASK (1 << SVM_IOIO_REP_SHIFT) -#define SVM_IOIO_SIZE_MASK (7 << SVM_IOIO_SIZE_SHIFT) -#define SVM_IOIO_ASIZE_MASK (7 << SVM_IOIO_ASIZE_SHIFT) +#define SVM_IOIO_STR_MASK BIT(SVM_IOIO_STR_SHIFT) +#define SVM_IOIO_REP_MASK BIT(SVM_IOIO_REP_SHIFT) +#define SVM_IOIO_SIZE_MASK GENMASK(SVM_IOIO_SIZE_SHIFT + 2, SVM_IOIO_SIZE_= SHIFT) +#define SVM_IOIO_ASIZE_MASK GENMASK(SVM_IOIO_ASIZE_SHIFT + 2, SVM_IOIO_ASI= ZE_SHIFT) =20 #define SVM_MISC_CTL_NP_ENABLE BIT(0) #define SVM_MISC_CTL_SEV_ENABLE BIT(1) @@ -251,9 +251,9 @@ struct __attribute__ ((__packed__)) vmcb_control_area { =20 =20 /* AVIC */ -#define AVIC_LOGICAL_ID_ENTRY_GUEST_PHYSICAL_ID_MASK (0xFFULL) +#define AVIC_LOGICAL_ID_ENTRY_GUEST_PHYSICAL_ID_MASK GENMASK_ULL(7, 0) #define AVIC_LOGICAL_ID_ENTRY_VALID_BIT 31 -#define AVIC_LOGICAL_ID_ENTRY_VALID_MASK (1 << 31) +#define AVIC_LOGICAL_ID_ENTRY_VALID_MASK BIT(AVIC_LOGICAL_ID_ENTRY_VALID_= BIT) =20 /* * GA_LOG_INTR is a synthetic flag that's never propagated to hardware-vis= ible @@ -264,15 +264,15 @@ struct __attribute__ ((__packed__)) vmcb_control_area= { =20 #define AVIC_PHYSICAL_ID_ENTRY_HOST_PHYSICAL_ID_MASK GENMASK_ULL(11, 0) #define AVIC_PHYSICAL_ID_ENTRY_BACKING_PAGE_MASK GENMASK_ULL(51, 12) -#define AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK (1ULL << 62) -#define AVIC_PHYSICAL_ID_ENTRY_VALID_MASK (1ULL << 63) -#define AVIC_PHYSICAL_ID_TABLE_SIZE_MASK (0xFFULL) +#define AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK BIT_ULL(62) +#define AVIC_PHYSICAL_ID_ENTRY_VALID_MASK BIT_ULL(63) +#define AVIC_PHYSICAL_ID_TABLE_SIZE_MASK GENMASK_ULL(7, 0) =20 #define AVIC_DOORBELL_PHYSICAL_ID_MASK GENMASK_ULL(11, 0) =20 #define AVIC_UNACCEL_ACCESS_WRITE_MASK 1 -#define AVIC_UNACCEL_ACCESS_OFFSET_MASK 0xFF0 -#define AVIC_UNACCEL_ACCESS_VECTOR_MASK 0xFFFFFFFF +#define AVIC_UNACCEL_ACCESS_OFFSET_MASK GENMASK(11, 4) +#define AVIC_UNACCEL_ACCESS_VECTOR_MASK GENMASK(31, 0) =20 enum avic_ipi_failure_cause { AVIC_IPI_FAILURE_INVALID_INT_TYPE, @@ -611,30 +611,30 @@ static inline void __unused_size_checks(void) #define SVM_SELECTOR_G_SHIFT 11 =20 #define SVM_SELECTOR_TYPE_MASK (0xf) -#define SVM_SELECTOR_S_MASK (1 << SVM_SELECTOR_S_SHIFT) -#define SVM_SELECTOR_DPL_MASK (3 << SVM_SELECTOR_DPL_SHIFT) -#define SVM_SELECTOR_P_MASK (1 << SVM_SELECTOR_P_SHIFT) -#define SVM_SELECTOR_AVL_MASK (1 << SVM_SELECTOR_AVL_SHIFT) -#define SVM_SELECTOR_L_MASK (1 << SVM_SELECTOR_L_SHIFT) -#define SVM_SELECTOR_DB_MASK (1 << SVM_SELECTOR_DB_SHIFT) -#define SVM_SELECTOR_G_MASK (1 << SVM_SELECTOR_G_SHIFT) - -#define SVM_SELECTOR_WRITE_MASK (1 << 1) +#define SVM_SELECTOR_S_MASK BIT(SVM_SELECTOR_S_SHIFT) +#define SVM_SELECTOR_DPL_MASK GENMASK(SVM_SELECTOR_DPL_SHIFT + 1, SVM_SELE= CTOR_DPL_SHIFT) +#define SVM_SELECTOR_P_MASK BIT(SVM_SELECTOR_P_SHIFT) +#define SVM_SELECTOR_AVL_MASK BIT(SVM_SELECTOR_AVL_SHIFT) +#define SVM_SELECTOR_L_MASK BIT(SVM_SELECTOR_L_SHIFT) +#define SVM_SELECTOR_DB_MASK BIT(SVM_SELECTOR_DB_SHIFT) +#define SVM_SELECTOR_G_MASK BIT(SVM_SELECTOR_G_SHIFT) + +#define SVM_SELECTOR_WRITE_MASK BIT(1) #define SVM_SELECTOR_READ_MASK SVM_SELECTOR_WRITE_MASK -#define SVM_SELECTOR_CODE_MASK (1 << 3) +#define SVM_SELECTOR_CODE_MASK BIT(3) =20 -#define SVM_EVTINJ_VEC_MASK 0xff +#define SVM_EVTINJ_VEC_MASK GENMASK(7, 0) =20 #define SVM_EVTINJ_TYPE_SHIFT 8 -#define SVM_EVTINJ_TYPE_MASK (7 << SVM_EVTINJ_TYPE_SHIFT) +#define SVM_EVTINJ_TYPE_MASK GENMASK(SVM_EVTINJ_TYPE_SHIFT + 2, SVM_EVTINJ= _TYPE_SHIFT) =20 #define SVM_EVTINJ_TYPE_INTR (0 << SVM_EVTINJ_TYPE_SHIFT) #define SVM_EVTINJ_TYPE_NMI (2 << SVM_EVTINJ_TYPE_SHIFT) #define SVM_EVTINJ_TYPE_EXEPT (3 << SVM_EVTINJ_TYPE_SHIFT) #define SVM_EVTINJ_TYPE_SOFT (4 << SVM_EVTINJ_TYPE_SHIFT) =20 -#define SVM_EVTINJ_VALID (1 << 31) -#define SVM_EVTINJ_VALID_ERR (1 << 11) +#define SVM_EVTINJ_VALID_ERR BIT(11) +#define SVM_EVTINJ_VALID BIT(31) =20 #define SVM_EXITINTINFO_VEC_MASK SVM_EVTINJ_VEC_MASK #define SVM_EXITINTINFO_TYPE_MASK SVM_EVTINJ_TYPE_MASK @@ -651,7 +651,7 @@ static inline void __unused_size_checks(void) #define SVM_EXITINFOSHIFT_TS_REASON_JMP 38 #define SVM_EXITINFOSHIFT_TS_HAS_ERROR_CODE 44 =20 -#define SVM_EXITINFO_REG_MASK 0x0F +#define SVM_EXITINFO_REG_MASK GENMASK(3, 0) =20 #define SVM_CR0_SELECTIVE_MASK (X86_CR0_TS | X86_CR0_MP) =20 --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-173.mta0.migadu.com (out-173.mta0.migadu.com [91.218.175.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D6302DBF45 for ; Thu, 15 Jan 2026 01:14:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439655; cv=none; b=FesOXyMubp4vaaZ3yDoV1CUimDFqRW17iDq+Q/kZxAZsH116XyzJ6G8P9t6n83U2lc5I7bJHcHEU7Y+g4On0khdXy9kZbsL+Y/bS+CJKt4blLqH+UHWpgx4on6GpEjaz9F0eYmHAewaewzN5jhuE+neUVaqm5g4DumU7mRmCSH0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439655; c=relaxed/simple; bh=SX8PTg3GL+3FSl26/mRXQfb4G986t8SrZiuXo4179qQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tDLz5sZaO0E7ak22XoGDzCeIwscDxiDz37OXZ+m6pmNtDhDxQ5gJ/YdUSIp7dgv+1hzPoiUTmEVqMv3VJcGirBk5FvZvkznK2Qx5d2V/tDEydouXEYpbTN14Rw+I8K4HbVmyLR/SCoL7+hAxEuqyU+FrutmNJSMIe/ny44Kk0d8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=NpEgjqGw; arc=none smtp.client-ip=91.218.175.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="NpEgjqGw" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439647; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=eufh0w2C1eQss9bB4CCLnsr5HQFkBZLnaSZwpMvlgQg=; b=NpEgjqGwCl+FkUhvzDNuwXQhOuDRE6ZKJDNcd/TCXchP8B0m+BaapgF4Hpfkvl8rlkM+lO SfIIAINuV7SKjVQgbzLv4A9TMLezQihSue1ecs0vyu874HxdTA5iscE1RvB6Wt0mBtmuBv 7LQxUopuTyCF3DSFKYjNi/7OqJGo2xQ= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed Subject: [PATCH v4 23/26] KVM: nSVM: Cache all used fields from VMCB12 Date: Thu, 15 Jan 2026 01:13:09 +0000 Message-ID: <20260115011312.3675857-24-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Currently, most fields used from VMCB12 are cached in svm->nested.{ctl/save}. This is mainly to avoid TOC-TOU bugs. However, for the save area, only the fields used in the consistency checks (i.e. nested_vmcb_check_save()) were being cached. Other fields are read directly from guest memory in nested_vmcb02_prepare_save(). While probably benign, this still makes it possible for TOC-TOU bugs to happen. For example, RAX, RSP, and RIP are read twice, once to store in VMCB02, and once to store in vcpu->arch.regs. It is possible for the guest to modify the value between both reads, potentially causing nasty bugs. Harden against such bugs by caching everything in svm->nested.save. Cache all the needed fields, and keep all accesses to the VMCB12 strictly in nested_svm_vmrun() for caching and early error injection. Following changes will further limit the access to the VMCB12 in the nested VMRUN path. Introduce vmcb12_is_dirty() to use with the cached control fields instead of vmcb_is_dirty(), similar to vmcb12_is_intercept(). Opportunistically order the copies in __nested_copy_vmcb_save_to_cache() by the order in which the fields are defined in struct vmcb_save_area. Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 116 ++++++++++++++++++++++---------------- arch/x86/kvm/svm/svm.c | 2 +- arch/x86/kvm/svm/svm.h | 27 ++++++++- 3 files changed, 93 insertions(+), 52 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 69bd926530b3..7209bbe19548 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -546,19 +546,34 @@ void nested_copy_vmcb_control_to_cache(struct vcpu_sv= m *svm, static void __nested_copy_vmcb_save_to_cache(struct vmcb_save_area_cached = *to, struct vmcb_save_area *from) { - /* - * Copy only fields that are validated, as we need them - * to avoid TOC/TOU races. - */ + to->es =3D from->es; to->cs =3D from->cs; + to->ss =3D from->ss; + to->ds =3D from->ds; + to->gdtr =3D from->gdtr; + to->idtr =3D from->idtr; + + to->cpl =3D from->cpl; =20 to->efer =3D from->efer; - to->cr0 =3D from->cr0; - to->cr3 =3D from->cr3; to->cr4 =3D from->cr4; - - to->dr6 =3D from->dr6; + to->cr3 =3D from->cr3; + to->cr0 =3D from->cr0; to->dr7 =3D from->dr7; + to->dr6 =3D from->dr6; + + to->rflags =3D from->rflags; + to->rip =3D from->rip; + to->rsp =3D from->rsp; + + to->s_cet =3D from->s_cet; + to->ssp =3D from->ssp; + to->isst_addr =3D from->isst_addr; + + to->rax =3D from->rax; + to->cr2 =3D from->cr2; + + svm_copy_lbrs(to, from); } =20 void nested_copy_vmcb_save_to_cache(struct vcpu_svm *svm, @@ -694,8 +709,10 @@ void nested_vmcb02_compute_g_pat(struct vcpu_svm *svm) svm->nested.vmcb02.ptr->save.g_pat =3D svm->vmcb01.ptr->save.g_pat; } =20 -static void nested_vmcb02_prepare_save(struct vcpu_svm *svm, struct vmcb *= vmcb12) +static void nested_vmcb02_prepare_save(struct vcpu_svm *svm) { + struct vmcb_ctrl_area_cached *control =3D &svm->nested.ctl; + struct vmcb_save_area_cached *save =3D &svm->nested.save; bool new_vmcb12 =3D false; struct vmcb *vmcb01 =3D svm->vmcb01.ptr; struct vmcb *vmcb02 =3D svm->nested.vmcb02.ptr; @@ -711,49 +728,49 @@ static void nested_vmcb02_prepare_save(struct vcpu_sv= m *svm, struct vmcb *vmcb12 svm->nested.force_msr_bitmap_recalc =3D true; } =20 - if (unlikely(new_vmcb12 || vmcb_is_dirty(vmcb12, VMCB_SEG))) { - vmcb02->save.es =3D vmcb12->save.es; - vmcb02->save.cs =3D vmcb12->save.cs; - vmcb02->save.ss =3D vmcb12->save.ss; - vmcb02->save.ds =3D vmcb12->save.ds; - vmcb02->save.cpl =3D vmcb12->save.cpl; + if (unlikely(new_vmcb12 || vmcb12_is_dirty(control, VMCB_SEG))) { + vmcb02->save.es =3D save->es; + vmcb02->save.cs =3D save->cs; + vmcb02->save.ss =3D save->ss; + vmcb02->save.ds =3D save->ds; + vmcb02->save.cpl =3D save->cpl; vmcb_mark_dirty(vmcb02, VMCB_SEG); } =20 - if (unlikely(new_vmcb12 || vmcb_is_dirty(vmcb12, VMCB_DT))) { - vmcb02->save.gdtr =3D vmcb12->save.gdtr; - vmcb02->save.idtr =3D vmcb12->save.idtr; + if (unlikely(new_vmcb12 || vmcb12_is_dirty(control, VMCB_DT))) { + vmcb02->save.gdtr =3D save->gdtr; + vmcb02->save.idtr =3D save->idtr; vmcb_mark_dirty(vmcb02, VMCB_DT); } =20 if (guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) && - (unlikely(new_vmcb12 || vmcb_is_dirty(vmcb12, VMCB_CET)))) { - vmcb02->save.s_cet =3D vmcb12->save.s_cet; - vmcb02->save.isst_addr =3D vmcb12->save.isst_addr; - vmcb02->save.ssp =3D vmcb12->save.ssp; + (unlikely(new_vmcb12 || vmcb12_is_dirty(control, VMCB_CET)))) { + vmcb02->save.s_cet =3D save->s_cet; + vmcb02->save.isst_addr =3D save->isst_addr; + vmcb02->save.ssp =3D save->ssp; vmcb_mark_dirty(vmcb02, VMCB_CET); } =20 - kvm_set_rflags(vcpu, vmcb12->save.rflags | X86_EFLAGS_FIXED); + kvm_set_rflags(vcpu, save->rflags | X86_EFLAGS_FIXED); =20 svm_set_efer(vcpu, svm->nested.save.efer); =20 svm_set_cr0(vcpu, svm->nested.save.cr0); svm_set_cr4(vcpu, svm->nested.save.cr4); =20 - svm->vcpu.arch.cr2 =3D vmcb12->save.cr2; + svm->vcpu.arch.cr2 =3D save->cr2; =20 - kvm_rax_write(vcpu, vmcb12->save.rax); - kvm_rsp_write(vcpu, vmcb12->save.rsp); - kvm_rip_write(vcpu, vmcb12->save.rip); + kvm_rax_write(vcpu, save->rax); + kvm_rsp_write(vcpu, save->rsp); + kvm_rip_write(vcpu, save->rip); =20 /* In case we don't even reach vcpu_run, the fields are not updated */ - vmcb02->save.rax =3D vmcb12->save.rax; - vmcb02->save.rsp =3D vmcb12->save.rsp; - vmcb02->save.rip =3D vmcb12->save.rip; + vmcb02->save.rax =3D save->rax; + vmcb02->save.rsp =3D save->rsp; + vmcb02->save.rip =3D save->rip; =20 /* These bits will be set properly on the first execution when new_vmc12 = is true */ - if (unlikely(new_vmcb12 || vmcb_is_dirty(vmcb12, VMCB_DR))) { + if (unlikely(new_vmcb12 || vmcb12_is_dirty(control, VMCB_DR))) { vmcb02->save.dr7 =3D svm->nested.save.dr7 | DR7_FIXED_1; svm->vcpu.arch.dr6 =3D svm->nested.save.dr6 | DR6_ACTIVE_LOW; vmcb_mark_dirty(vmcb02, VMCB_DR); @@ -765,7 +782,7 @@ static void nested_vmcb02_prepare_save(struct vcpu_svm = *svm, struct vmcb *vmcb12 * Reserved bits of DEBUGCTL are ignored. Be consistent with * svm_set_msr's definition of reserved bits. */ - svm_copy_lbrs(&vmcb02->save, &vmcb12->save); + svm_copy_lbrs(&vmcb02->save, save); vmcb_mark_dirty(vmcb02, VMCB_LBR); vmcb02->save.dbgctl &=3D ~DEBUGCTL_RESERVED_BITS; } else { @@ -982,28 +999,29 @@ static void nested_svm_copy_common_state(struct vmcb = *from_vmcb, struct vmcb *to to_vmcb->save.spec_ctrl =3D from_vmcb->save.spec_ctrl; } =20 -int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 vmcb12_gpa, - struct vmcb *vmcb12, bool from_vmrun) +int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 vmcb12_gpa, bool from_= vmrun) { struct vcpu_svm *svm =3D to_svm(vcpu); + struct vmcb_ctrl_area_cached *control =3D &svm->nested.ctl; + struct vmcb_save_area_cached *save =3D &svm->nested.save; int ret; =20 trace_kvm_nested_vmenter(svm->vmcb->save.rip, vmcb12_gpa, - vmcb12->save.rip, - vmcb12->control.int_ctl, - vmcb12->control.event_inj, - vmcb12->control.misc_ctl, - vmcb12->control.nested_cr3, - vmcb12->save.cr3, + save->rip, + control->int_ctl, + control->event_inj, + control->misc_ctl, + control->nested_cr3, + save->cr3, KVM_ISA_SVM); =20 - trace_kvm_nested_intercepts(vmcb12->control.intercepts[INTERCEPT_CR] & 0x= ffff, - vmcb12->control.intercepts[INTERCEPT_CR] >> 16, - vmcb12->control.intercepts[INTERCEPT_EXCEPTION], - vmcb12->control.intercepts[INTERCEPT_WORD3], - vmcb12->control.intercepts[INTERCEPT_WORD4], - vmcb12->control.intercepts[INTERCEPT_WORD5]); + trace_kvm_nested_intercepts(control->intercepts[INTERCEPT_CR] & 0xffff, + control->intercepts[INTERCEPT_CR] >> 16, + control->intercepts[INTERCEPT_EXCEPTION], + control->intercepts[INTERCEPT_WORD3], + control->intercepts[INTERCEPT_WORD4], + control->intercepts[INTERCEPT_WORD5]); =20 svm->nested.vmcb12_gpa =3D vmcb12_gpa; =20 @@ -1038,8 +1056,8 @@ int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 v= mcb12_gpa, nested_svm_copy_common_state(svm->vmcb01.ptr, svm->nested.vmcb02.ptr); =20 svm_switch_vmcb(svm, &svm->nested.vmcb02); - nested_vmcb02_prepare_control(svm, vmcb12->save.rip, vmcb12->save.cs.base= ); - nested_vmcb02_prepare_save(svm, vmcb12); + nested_vmcb02_prepare_control(svm, save->rip, save->cs.base); + nested_vmcb02_prepare_save(svm); =20 if (!from_vmrun) kvm_make_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu); @@ -1158,7 +1176,7 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) =20 svm->nested.nested_run_pending =3D 1; =20 - if (enter_svm_guest_mode(vcpu, vmcb12_gpa, vmcb12, true)) { + if (enter_svm_guest_mode(vcpu, vmcb12_gpa, true)) { svm->nested.nested_run_pending =3D 0; svm->nmi_l1_to_l2 =3D false; svm->soft_int_injected =3D false; diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index d6a850c35225..25cca79abce6 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -4867,7 +4867,7 @@ static int svm_leave_smm(struct kvm_vcpu *vcpu, const= union kvm_smram *smram) vmcb12 =3D map.hva; nested_copy_vmcb_control_to_cache(svm, &vmcb12->control); nested_copy_vmcb_save_to_cache(svm, &vmcb12->save); - ret =3D enter_svm_guest_mode(vcpu, smram64->svm_guest_vmcb_gpa, vmcb12, f= alse); + ret =3D enter_svm_guest_mode(vcpu, smram64->svm_guest_vmcb_gpa, false); =20 if (ret) goto unmap_save; diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 7609a2e6df88..2fc25803d0c7 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -139,13 +139,32 @@ struct kvm_vmcb_info { }; =20 struct vmcb_save_area_cached { + struct vmcb_seg es; struct vmcb_seg cs; + struct vmcb_seg ss; + struct vmcb_seg ds; + struct vmcb_seg gdtr; + struct vmcb_seg idtr; + u8 cpl; u64 efer; u64 cr4; u64 cr3; u64 cr0; u64 dr7; u64 dr6; + u64 rflags; + u64 rip; + u64 rsp; + u64 s_cet; + u64 ssp; + u64 isst_addr; + u64 rax; + u64 cr2; + u64 dbgctl; + u64 br_from; + u64 br_to; + u64 last_excp_from; + u64 last_excp_to; }; =20 struct vmcb_ctrl_area_cached { @@ -421,6 +440,11 @@ static inline bool vmcb_is_dirty(struct vmcb *vmcb, in= t bit) return !test_bit(bit, (unsigned long *)&vmcb->control.clean); } =20 +static inline bool vmcb12_is_dirty(struct vmcb_ctrl_area_cached *control, = int bit) +{ + return !test_bit(bit, (unsigned long *)&control->clean); +} + static __always_inline struct vcpu_svm *to_svm(struct kvm_vcpu *vcpu) { return container_of(vcpu, struct vcpu_svm, vcpu); @@ -777,8 +801,7 @@ static inline bool nested_exit_on_nmi(struct vcpu_svm *= svm) =20 int __init nested_svm_init_msrpm_merge_offsets(void); =20 -int enter_svm_guest_mode(struct kvm_vcpu *vcpu, - u64 vmcb_gpa, struct vmcb *vmcb12, bool from_vmrun); +int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 vmcb_gpa, bool from_vm= run); void svm_leave_nested(struct kvm_vcpu *vcpu); void svm_free_nested(struct vcpu_svm *svm); int svm_allocate_nested(struct vcpu_svm *svm); --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-184.mta0.migadu.com (out-184.mta0.migadu.com [91.218.175.184]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2633B2EB5B8 for ; Thu, 15 Jan 2026 01:14:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.184 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439653; cv=none; b=SrGTPs5/w7VMc+yA5Fa3c56V+3ygPY9StD0QXahnnmGeCOSqAgp7yX1LBY5Ax9jKdjChXOp2XYoLLut3ctruHsPsfexjLayuVhysnV6Vmmvoqtr11hpUZz2xNo7JQxE2KkCa24uoH2uINeKrjGiuHQZuq3t1ksnMsBEOlWU7bWo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439653; c=relaxed/simple; bh=Qlu3Lp54f4zFWXD5cf4zC5yJctkRtLqm+EfogPn9oaU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=exVxUUqJdUMfO9tpHKYKXzjRHbXKs8io03xe2SRhCo81rxd1IKrEPDjMf+ULKtEVf4q5UZDl6huxZ0vcE1o/PdSifR4xeD1cdLUrgZKUoGaQm8LDqNLNTAWqqfAHg7M3wjZHDABen+NAzJVSQhN6mdo0m4sbBhCv3S10e3zwhBs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=qUgFLV2r; arc=none smtp.client-ip=91.218.175.184 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="qUgFLV2r" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439649; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AP1xGvQmyw2BkX2nyvuRJpthBoydAPRLydd8FnGb970=; b=qUgFLV2rfN8FQvuqAxEyNeoCsDBwWD4PNDf/mFrtR7JZCJDDwx0mvY7MOmqWz+Ex+m8vQB vytmCx/8iXvVUyeyn3LCdc57pAwX2+eWx64g0ljzZ64jizqouhi2y6Na6LTzRT7xvruuPH KtZVaZYqSTn/YsfkvlcEGE+ptzzUy+A= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed Subject: [PATCH v4 24/26] KVM: nSVM: Restrict mapping VMCB12 on nested VMRUN Date: Thu, 15 Jan 2026 01:13:10 +0000 Message-ID: <20260115011312.3675857-25-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" All accesses to the VMCB12 in the guest memory on nested VMRUN are limited to nested_svm_vmrun() and nested_svm_failed_vmrun(). However, the VMCB12 remains mapped throughout nested_svm_vmrun(). Mapping and unmapping around usages is possible, but it becomes easy-ish to introduce bugs where 'vmcb12' is used after being unmapped. Move reading the VMCB12 and copying to cache from nested_svm_vmrun() into a new helper, nested_svm_copy_vmcb12_to_cache(), that maps the VMCB12, caches the needed fields, and unmaps it. Use kvm_vcpu_map_readonly() as only reading the VMCB12 is needed. Similarly, move mapping the VMCB12 on VMRUN failure into nested_svm_failed_vmrun(). Inject a triple fault if the mapping fails, similar to nested_svm_vmexit(). Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 55 ++++++++++++++++++++++++++++----------- 1 file changed, 40 insertions(+), 15 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 7209bbe19548..ffb741f401d0 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1106,25 +1106,57 @@ static void __nested_svm_vmexit(struct vcpu_svm *sv= m, struct vmcb *vmcb12) kvm_queue_exception(vcpu, DB_VECTOR); } =20 -static void nested_svm_failed_vmrun(struct vcpu_svm *svm, struct vmcb *vmc= b12) +static void nested_svm_failed_vmrun(struct vcpu_svm *svm, u64 vmcb12_gpa) { + struct kvm_vcpu *vcpu =3D &svm->vcpu; + struct kvm_host_map map; + struct vmcb *vmcb12; + int r; + WARN_ON(svm->vmcb =3D=3D svm->nested.vmcb02.ptr); =20 leave_guest_mode(vcpu); =20 + r =3D kvm_vcpu_map(vcpu, gpa_to_gfn(vmcb12_gpa), &map); + if (r) { + kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu); + return; + } + + vmcb12 =3D map.hva; vmcb12->control.exit_code =3D SVM_EXIT_ERR; vmcb12->control.exit_code_hi =3D -1u; vmcb12->control.exit_info_1 =3D 0; vmcb12->control.exit_info_2 =3D 0; __nested_svm_vmexit(svm, vmcb12); + + kvm_vcpu_unmap(vcpu, &map); +} + +static int nested_svm_copy_vmcb12_to_cache(struct kvm_vcpu *vcpu, u64 vmcb= 12_gpa) +{ + struct vcpu_svm *svm =3D to_svm(vcpu); + struct kvm_host_map map; + struct vmcb *vmcb12; + int r; + + r =3D kvm_vcpu_map_readonly(vcpu, gpa_to_gfn(vmcb12_gpa), &map); + if (r) + return r; + + vmcb12 =3D map.hva; + + nested_copy_vmcb_control_to_cache(svm, &vmcb12->control); + nested_copy_vmcb_save_to_cache(svm, &vmcb12->save); + + kvm_vcpu_unmap(vcpu, &map); + return 0; } =20 int nested_svm_vmrun(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm =3D to_svm(vcpu); int ret; - struct vmcb *vmcb12; - struct kvm_host_map map; u64 vmcb12_gpa; struct vmcb *vmcb01 =3D svm->vmcb01.ptr; =20 @@ -1145,22 +1177,17 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) return ret; } =20 + if (WARN_ON_ONCE(!svm->nested.initialized)) + return -EINVAL; + vmcb12_gpa =3D svm->vmcb->save.rax; - if (kvm_vcpu_map(vcpu, gpa_to_gfn(vmcb12_gpa), &map)) { + if (nested_svm_copy_vmcb12_to_cache(vcpu, vmcb12_gpa)) { kvm_inject_gp(vcpu, 0); return 1; } =20 ret =3D kvm_skip_emulated_instruction(vcpu); =20 - vmcb12 =3D map.hva; - - if (WARN_ON_ONCE(!svm->nested.initialized)) - return -EINVAL; - - nested_copy_vmcb_control_to_cache(svm, &vmcb12->control); - nested_copy_vmcb_save_to_cache(svm, &vmcb12->save); - /* * Since vmcb01 is not in use, we can use it to store some of the L1 * state. @@ -1181,11 +1208,9 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) svm->nmi_l1_to_l2 =3D false; svm->soft_int_injected =3D false; =20 - nested_svm_failed_vmrun(svm, vmcb12); + nested_svm_failed_vmrun(svm, vmcb12_gpa); } =20 - kvm_vcpu_unmap(vcpu, &map); - return ret; } =20 --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-188.mta0.migadu.com (out-188.mta0.migadu.com [91.218.175.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7750A2F49F1 for ; Thu, 15 Jan 2026 01:14:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439655; cv=none; b=uMes4BZ+alZH9gIdLTJP2zwGbl+dfboliyi3/U4lEa2TqA+VhBZvqqRBcgVUK8UvmB71l52bdwrioCBDwuIlaZaAV0+IbYRtvX2RkGnwD2yuGnYFwNQUFtsDChBMon/5l9LfY4HfdEyPLQAmJZQSLxhSGW6S3NJkTCzXi45WdtM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439655; c=relaxed/simple; bh=jgExKD7Pqhku8XbX3FURIJcuUtj+mT/Dip5GXR/zGk0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LKotsrqOSHqqn+3FVrwO6XIXliGOK8ZJ4zFP1jRCYUBzYp5cVGI+qr+TqS6VShwGdoFCb0LymT4o+dwGaoepLzhh6hL+Sxuz1cUMvn8afgNvyg/fDGSO4ehYf5gd9LLogw2YZkXHhmBFbICnYLxue3X/tqd3cHqU6H9Y0IPBfHs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=qUj6AEYQ; arc=none smtp.client-ip=91.218.175.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="qUj6AEYQ" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439650; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AaPwS3yIusekQJKUcXWje+5DrHU3lEqF2BgYk2mX7ns=; b=qUj6AEYQj839qjoHJmqBHXguKPKjV5lTFur3Z+SvleYzGngBh6qD3vCNGGas/DTBgzuLM0 NajBdwe3V1r+xSntQUDiEmr7wT7rzQX0smoEarMX8Ii21Dcu1V33UhMeQ5x/t57VDPOM3r gZLS8kvMe8LqQA7nCJAaeexllOzP778= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , Jim Mattson Subject: [PATCH v4 25/26] KVM: nSVM: Sanitize control fields copied from VMCB12 Date: Thu, 15 Jan 2026 01:13:11 +0000 Message-ID: <20260115011312.3675857-26-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Make sure all fields used from VMCB12 in creating the VMCB02 are sanitized, such that no unhandled or reserved bits end up in the VMCB02. The following control fields are read from VMCB12 and have bits that are either reserved or not handled/advertised by KVM: tlb_ctl, int_ctl, int_state, int_vector, event_inj, misc_ctl, and misc_ctl2. The following fields do not require any extra sanitizing: - int_ctl: bits from VMCB12 are copied bit-by-bit as needed. - misc_ctl: only used in consistency checks (particularly NP_ENABLE). - misc_ctl2: bits from VMCB12 are copied bit-by-bit as needed. For the remaining fields, make sure only defined bits are copied from L1's VMCB12 into KVM'cache by defining appropriate masks where needed. The only exception is tlb_ctl, which is unused, so remove it. Opportunistically cleanup ignoring the lower bits of {io/msr}pm_base_pa in __nested_copy_vmcb_control_to_cache() by using PAGE_MASK. Also, move the ASID copying ahead with other special cases, and expand the comment about the ASID being copied only for consistency checks. Suggested-by: Jim Mattson Signed-off-by: Yosry Ahmed --- arch/x86/include/asm/svm.h | 5 +++++ arch/x86/kvm/svm/nested.c | 28 +++++++++++++++------------- arch/x86/kvm/svm/svm.h | 1 - 3 files changed, 20 insertions(+), 14 deletions(-) diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h index 0bc26b2b3fd7..d3632fbb80be 100644 --- a/arch/x86/include/asm/svm.h +++ b/arch/x86/include/asm/svm.h @@ -223,6 +223,8 @@ struct __attribute__ ((__packed__)) vmcb_control_area { #define AVIC_ENABLE_SHIFT 31 #define AVIC_ENABLE_MASK BIT(AVIC_ENABLE_SHIFT) =20 +#define SVM_INT_VECTOR_MASK GENMASK(7, 0) + #define SVM_INTERRUPT_SHADOW_MASK BIT_ULL(0) #define SVM_GUEST_INTERRUPT_MASK BIT_ULL(1) =20 @@ -636,6 +638,9 @@ static inline void __unused_size_checks(void) #define SVM_EVTINJ_VALID_ERR BIT(11) #define SVM_EVTINJ_VALID BIT(31) =20 +#define SVM_EVTINJ_RESERVED_BITS ~(SVM_EVTINJ_VEC_MASK | SVM_EVTINJ_TYPE_M= ASK | \ + SVM_EVTINJ_VALID_ERR | SVM_EVTINJ_VALID) + #define SVM_EXITINTINFO_VEC_MASK SVM_EVTINJ_VEC_MASK #define SVM_EXITINTINFO_TYPE_MASK SVM_EVTINJ_TYPE_MASK =20 diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index ffb741f401d0..e62fd6524feb 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -500,33 +500,36 @@ void __nested_copy_vmcb_control_to_cache(struct kvm_v= cpu *vcpu, if (!guest_cpu_cap_has(vcpu, X86_FEATURE_NPT)) to->misc_ctl &=3D ~SVM_MISC_CTL_NP_ENABLE; =20 - to->iopm_base_pa =3D from->iopm_base_pa; - to->msrpm_base_pa =3D from->msrpm_base_pa; + /* + * Copy the ASID here because nested_vmcb_check_controls() will check + * it. The ASID could be invalid, or conflict with another VM's ASID , + * so it should never be used directly to run L2. + */ + to->asid =3D from->asid; + + /* Lower bits of IOPM_BASE_PA and MSRPM_BASE_PA are ignored */ + to->iopm_base_pa =3D from->iopm_base_pa & PAGE_MASK; + to->msrpm_base_pa =3D from->msrpm_base_pa & PAGE_MASK; + to->tsc_offset =3D from->tsc_offset; - to->tlb_ctl =3D from->tlb_ctl; to->erap_ctl =3D from->erap_ctl; to->int_ctl =3D from->int_ctl; - to->int_vector =3D from->int_vector; - to->int_state =3D from->int_state; + to->int_vector =3D from->int_vector & SVM_INT_VECTOR_MASK; + to->int_state =3D from->int_state & SVM_INTERRUPT_SHADOW_MASK; to->exit_code =3D from->exit_code; to->exit_code_hi =3D from->exit_code_hi; to->exit_info_1 =3D from->exit_info_1; to->exit_info_2 =3D from->exit_info_2; to->exit_int_info =3D from->exit_int_info; to->exit_int_info_err =3D from->exit_int_info_err; - to->event_inj =3D from->event_inj; + to->event_inj =3D from->event_inj & ~SVM_EVTINJ_RESERVED_BITS; to->event_inj_err =3D from->event_inj_err; to->next_rip =3D from->next_rip; to->nested_cr3 =3D from->nested_cr3; - to->misc_ctl2 =3D from->misc_ctl2; + to->misc_ctl2 =3D from->misc_ctl2; to->pause_filter_count =3D from->pause_filter_count; to->pause_filter_thresh =3D from->pause_filter_thresh; =20 - /* Copy asid here because nested_vmcb_check_controls() will check it */ - to->asid =3D from->asid; - to->msrpm_base_pa &=3D ~0x0fffULL; - to->iopm_base_pa &=3D ~0x0fffULL; - #ifdef CONFIG_KVM_HYPERV /* Hyper-V extensions (Enlightened VMCB) */ if (kvm_hv_hypercall_enabled(vcpu)) { @@ -1836,7 +1839,6 @@ static void nested_copy_vmcb_cache_to_control(struct = vmcb_control_area *dst, dst->msrpm_base_pa =3D from->msrpm_base_pa; dst->tsc_offset =3D from->tsc_offset; dst->asid =3D from->asid; - dst->tlb_ctl =3D from->tlb_ctl; dst->erap_ctl =3D from->erap_ctl; dst->int_ctl =3D from->int_ctl; dst->int_vector =3D from->int_vector; diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 2fc25803d0c7..4bc69e0d7e0a 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -175,7 +175,6 @@ struct vmcb_ctrl_area_cached { u64 msrpm_base_pa; u64 tsc_offset; u32 asid; - u8 tlb_ctl; u8 erap_ctl; u32 int_ctl; u32 int_vector; --=20 2.52.0.457.g6b5491de43-goog From nobody Sun Feb 8 08:27:33 2026 Received: from out-178.mta0.migadu.com (out-178.mta0.migadu.com [91.218.175.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1EC442798EA for ; Thu, 15 Jan 2026 01:14:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439655; cv=none; b=Yodoy1sfGvRpY1/h1phGM5HmAsLa+DUqth5FEvFYjBxiFViBBxPB7qQ4xIFPOcKK5RalpkW1LznB9OWk/lDgEMh0OBwYMrmL7S+/fKk8ZNylMiip/cGJRAf6P7ZMZNH8zQiu1lguOHEq30MUOFq6g/pHDvwMJSas8nVbfIs0pdM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768439655; c=relaxed/simple; bh=UVpG+EowREj/Awus5qFoFw4/iJjJS9YFFtLxBIvxXkM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=OROTxY7nbaUEnAY2vR0w5T9WudVkvrNHpIT9NI1vYpqwFvBSA9rORcHl6MX6WtA/C7+QOi49wnITBJBLPHYgLSsJYXo4EZy5wmnT5NfVREBUooD2t2qZy1kUGThVegmAL4TbUgAKMuUSG4QuEBPTHE0N4lgnC3jU82Mb1t7dGQ0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=LxWrpQ9X; arc=none smtp.client-ip=91.218.175.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="LxWrpQ9X" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768439652; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6ldoCItHVLee7RyUR5hi7FAn/d6Xlp6dLDsYhKHH3XQ=; b=LxWrpQ9XUl9FttggHFtQ2DYhNp+ZOR2KUSQotMhpunpoxMut278NYtUHMlMBc7Maf9xNBu QkiKLVEdSeNk3J9qeFQ8nQD+fipOski4fAW5LXRrnN+Dgj/cxt8o5GNNPB4zIFUyXbkov5 NLzCa2MvBjtD6UmULJfN8it4iPPnzA8= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , Jim Mattson Subject: [PATCH v4 26/26] KVM: nSVM: Only copy NP_ENABLE from VMCB01's misc_ctl Date: Thu, 15 Jan 2026 01:13:12 +0000 Message-ID: <20260115011312.3675857-27-yosry.ahmed@linux.dev> In-Reply-To: <20260115011312.3675857-1-yosry.ahmed@linux.dev> References: <20260115011312.3675857-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" The 'misc_ctl' field in VMCB02 is taken as-is from VMCB01. However, the only bit that needs to copied is NP_ENABLE, as all other known bits in misc_ctl are related to SEV guests, and KVM doesn't support nested virtualization for SEV guests. Only copy NP_ENABLE to harden against future bugs if/when other bits are set for L1 but should not be set for L2. Opportunistically add a comment explaining why NP_ENABLE is taken from VMCB01 and not VMCB02. Suggested-by: Jim Mattson Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index e62fd6524feb..b3a90ff262d5 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -856,8 +856,16 @@ static void nested_vmcb02_prepare_control(struct vcpu_= svm *svm, V_NMI_BLOCKING_MASK); } =20 - /* Copied from vmcb01. msrpm_base can be overwritten later. */ - vmcb02->control.misc_ctl =3D vmcb01->control.misc_ctl; + /* + * Copied from vmcb01. msrpm_base can be overwritten later. + * + * NP_ENABLE in vmcb12 is only used for consistency checks. If L1 + * enables NPTs, KVM shadows L1's NPTs and uses those to run L2. If L1 + * disables NPT, KVM runs L2 with the same NPTs used to run L1. For the + * latter, L1 runs L2 with shadow page tables that translate L2 GVAs to + * L1 GPAs, so the same NPTs can be used for L1 and L2. + */ + vmcb02->control.misc_ctl =3D vmcb01->control.misc_ctl & SVM_MISC_CTL_NP_E= NABLE; vmcb02->control.iopm_base_pa =3D vmcb01->control.iopm_base_pa; vmcb02->control.msrpm_base_pa =3D vmcb01->control.msrpm_base_pa; vmcb_mark_dirty(vmcb02, VMCB_PERM_MAP); --=20 2.52.0.457.g6b5491de43-goog