On Thu, Feb 12, 2026 at 07:58:54AM -0800, Jim Mattson wrote:
> Add a 'flags' field to the SVM nested state header, and use bit 0 of the
> flags to indicate that gPAT is stored in the nested state.
>
> If in guest mode with NPT enabled, store the current vmcb->save.g_pat value
> into the header of the nested state, and set the flag.
>
> Note that struct kvm_svm_nested_state_hdr is included in a union padded to
> 120 bytes, so there is room to add the flags field and the gpat field
> without changing any offsets.
>
> Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE")
> Signed-off-by: Jim Mattson <jmattson@google.com>
Reviewed-by: Yosry Ahmed <yosry.ahmed@linux.dev>
> ---
> arch/x86/include/uapi/asm/kvm.h | 5 +++++
> arch/x86/kvm/svm/nested.c | 16 ++++++++++++++++
> 2 files changed, 21 insertions(+)
>
> diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
> index 846a63215ce1..664d04d1db3f 100644
> --- a/arch/x86/include/uapi/asm/kvm.h
> +++ b/arch/x86/include/uapi/asm/kvm.h
> @@ -495,6 +495,8 @@ struct kvm_sync_regs {
>
> #define KVM_STATE_VMX_PREEMPTION_TIMER_DEADLINE 0x00000001
>
> +#define KVM_STATE_SVM_VALID_GPAT 0x00000001
> +
> /* vendor-independent attributes for system fd (group 0) */
> #define KVM_X86_GRP_SYSTEM 0
> # define KVM_X86_XCOMP_GUEST_SUPP 0
> @@ -531,6 +533,9 @@ struct kvm_svm_nested_state_data {
>
> struct kvm_svm_nested_state_hdr {
> __u64 vmcb_pa;
> + __u32 flags;
> + __u32 reserved;
> + __u64 gpat;
> };
>
> /* for KVM_CAP_NESTED_STATE */
> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index 26f758e294ab..f73f3e586012 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -1893,6 +1893,10 @@ static int svm_get_nested_state(struct kvm_vcpu *vcpu,
> /* First fill in the header and copy it out. */
> if (is_guest_mode(vcpu)) {
> kvm_state.hdr.svm.vmcb_pa = svm->nested.vmcb12_gpa;
> + if (nested_npt_enabled(svm)) {
> + kvm_state.hdr.svm.flags |= KVM_STATE_SVM_VALID_GPAT;
> + kvm_state.hdr.svm.gpat = svm->nested.save.g_pat;
> + }
> kvm_state.size += KVM_STATE_NESTED_SVM_VMCB_SIZE;
> kvm_state.flags |= KVM_STATE_NESTED_GUEST_MODE;
>
> @@ -2022,6 +2026,14 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu,
> !nested_vmcb_check_save(vcpu, &save_cached, false))
> goto out_free;
>
> + /*
> + * Validate gPAT, if provided. This is done separately from the
> + * vmcb_save_area_cached validation above, because gPAT is L2
> + * state, but the vmcb_save_area_cached is populated with L1 state.
> + */
> + if ((kvm_state->hdr.svm.flags & KVM_STATE_SVM_VALID_GPAT) &&
> + !kvm_pat_valid(kvm_state->hdr.svm.gpat))
> + goto out_free;
>
> /*
> * All checks done, we can enter guest mode. Userspace provides
> @@ -2061,6 +2073,10 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu,
> if (ret)
> goto out_free;
>
> + if (nested_npt_enabled(svm) &&
> + (kvm_state->hdr.svm.flags & KVM_STATE_SVM_VALID_GPAT))
> + svm_set_gpat(svm, kvm_state->hdr.svm.gpat);
> +
> svm_switch_vmcb(svm, &svm->nested.vmcb02);
> nested_vmcb02_prepare_control(svm, svm->vmcb->save.rip, svm->vmcb->save.cs.base);
>
> --
> 2.53.0.239.g8d8fc8a987-goog
>