Jim pointed out that VMRUN/VMLOAD/VMSAVE injecting a #GP when the vmcb12
GPA is valid but not mappable is not architectural [1]. The series
handles them as emulation failures and (mostly) exits to userspace
instead. It also fixes the checks performed on the vmcb12 GPA (i.e. RAX)
in a few places.

Note that there's a few other bugs that this series leaves alone, mostly
to keep it focused on fixing the non-architectrual #GPs, this includes:
- KVM synthesizing #VMEXIT(VMLOAD/VMSAVE) to L1 when intercepting #GP
  from L2 on VMLOAD/VMSAVE, even if L1 does not intercept VMLOAD/VMSAVE
  (e.g. VLS enabled).
- KVM not respecting priority of #GP vs. #UD when EFER.SVME is disabled
  by the guest.

However, the series documents these bugs with FIXMEs so that they can
hopefully be fixed up later.

v3 -> v4:
- Fix the RAX check in the emulator instead of dropping it [Paolo].
- Add refactoring of SVM instructions on #GP intercept to facilitate
  following fixes.
- Use kvm_register_read() to handle 32-bit correctly and avoid false
  negatives.
- Do #UD and #GP checks before synthesizing #VMEXIT to L1 when KVM
  intercepts #GP on SVM instruction in L2.
- Update changelogs.

v3: https://lore.kernel.org/kvm/20260306210900.1933788-1-yosry@kernel.org/

[1]https://lore.kernel.org/kvm/CALMp9eSMtzDJn7tGtbj=zLYpcU7Tc7XjcWBRZH7Aa5YihSmN7g@mail.gmail.com/

Yosry Ahmed (9):
  KVM: SVM: Properly check RAX in the emulator for SVM instructions
  KVM: SVM: Refactor SVM instruction handling on #GP intercept
  KVM: SVM: Properly check RAX on #GP intercept of SVM instructions
  KVM: SVM: Move RAX legality check to SVM insn interception handlers
  KVM: SVM: Check EFER.SVME and CPL on #GP intercept of SVM instructions
  KVM: SVM: Treat mapping failures equally in VMLOAD/VMSAVE emulation
  KVM: nSVM: Fail emulation of VMRUN/VMLOAD/VMSAVE if mapping vmcb12
    fails
  KVM: selftests: Rework svm_nested_invalid_vmcb12_gpa
  KVM: selftests: Drop 'invalid' from svm_nested_invalid_vmcb12_gpa's
    name

 arch/x86/kvm/emulate.c                        |   3 +-
 arch/x86/kvm/kvm_emulate.h                    |   2 +
 arch/x86/kvm/svm/nested.c                     |  12 +-
 arch/x86/kvm/svm/svm.c                        | 107 +++++------
 arch/x86/kvm/x86.c                            |   6 +
 tools/testing/selftests/kvm/Makefile.kvm      |   2 +-
 .../kvm/x86/svm_nested_invalid_vmcb12_gpa.c   |  98 ----------
 .../selftests/kvm/x86/svm_nested_vmcb12_gpa.c | 176 ++++++++++++++++++
 8 files changed, 244 insertions(+), 162 deletions(-)
 delete mode 100644 tools/testing/selftests/kvm/x86/svm_nested_invalid_vmcb12_gpa.c
 create mode 100644 tools/testing/selftests/kvm/x86/svm_nested_vmcb12_gpa.c


base-commit: 3d6cdcc8883b5726513d245eef0e91cabfc397f7
-- 
2.53.0.851.ga537e3e6e9-goog

On Mon, Mar 16, 2026, Yosry Ahmed wrote:
> Jim pointed out that VMRUN/VMLOAD/VMSAVE injecting a #GP when the vmcb12
> GPA is valid but not mappable is not architectural [1]. The series
> handles them as emulation failures and (mostly) exits to userspace
> instead. It also fixes the checks performed on the vmcb12 GPA (i.e. RAX)
> in a few places.
> 
> Note that there's a few other bugs that this series leaves alone, mostly
> to keep it focused on fixing the non-architectrual #GPs, this includes:
> - KVM synthesizing #VMEXIT(VMLOAD/VMSAVE) to L1 when intercepting #GP
>   from L2 on VMLOAD/VMSAVE, even if L1 does not intercept VMLOAD/VMSAVE
>   (e.g. VLS enabled).
> - KVM not respecting priority of #GP vs. #UD when EFER.SVME is disabled
>   by the guest.
> 
> However, the series documents these bugs with FIXMEs so that they can
> hopefully be fixed up later.
> 
> v3 -> v4:
> - Fix the RAX check in the emulator instead of dropping it [Paolo].
> - Add refactoring of SVM instructions on #GP intercept to facilitate
>   following fixes.
> - Use kvm_register_read() to handle 32-bit correctly and avoid false
>   negatives.
> - Do #UD and #GP checks before synthesizing #VMEXIT to L1 when KVM
>   intercepts #GP on SVM instruction in L2.
> - Update changelogs.
> 
> v3: https://lore.kernel.org/kvm/20260306210900.1933788-1-yosry@kernel.org/
> 
> [1]https://lore.kernel.org/kvm/CALMp9eSMtzDJn7tGtbj=zLYpcU7Tc7XjcWBRZH7Aa5YihSmN7g@mail.gmail.com/
> 
> Yosry Ahmed (9):
>   KVM: SVM: Properly check RAX in the emulator for SVM instructions
>   KVM: SVM: Refactor SVM instruction handling on #GP intercept
>   KVM: SVM: Properly check RAX on #GP intercept of SVM instructions
>   KVM: SVM: Move RAX legality check to SVM insn interception handlers
>   KVM: SVM: Check EFER.SVME and CPL on #GP intercept of SVM instructions
>   KVM: SVM: Treat mapping failures equally in VMLOAD/VMSAVE emulation
>   KVM: nSVM: Fail emulation of VMRUN/VMLOAD/VMSAVE if mapping vmcb12
>     fails
>   KVM: selftests: Rework svm_nested_invalid_vmcb12_gpa
>   KVM: selftests: Drop 'invalid' from svm_nested_invalid_vmcb12_gpa's
>     name

Some nits and suggestsions, but I can clean them up when applying.  I'm leaning
strongly toward applying this for 7.1 even though it's super late in the cycle,
as there's very little risk (e.g. compared to the gPTA or host/guest PMU series),
and getting the VCPU_REGS_RAX landed would make my life easier for 7.2.

> > Yosry Ahmed (9):
> >   KVM: SVM: Properly check RAX in the emulator for SVM instructions
> >   KVM: SVM: Refactor SVM instruction handling on #GP intercept
> >   KVM: SVM: Properly check RAX on #GP intercept of SVM instructions
> >   KVM: SVM: Move RAX legality check to SVM insn interception handlers
> >   KVM: SVM: Check EFER.SVME and CPL on #GP intercept of SVM instructions
> >   KVM: SVM: Treat mapping failures equally in VMLOAD/VMSAVE emulation
> >   KVM: nSVM: Fail emulation of VMRUN/VMLOAD/VMSAVE if mapping vmcb12
> >     fails
> >   KVM: selftests: Rework svm_nested_invalid_vmcb12_gpa
> >   KVM: selftests: Drop 'invalid' from svm_nested_invalid_vmcb12_gpa's
> >     name
>
> Some nits and suggestsions, but I can clean them up when applying.  I'm leaning
> strongly toward applying this for 7.1 even though it's super late in the cycle,
> as there's very little risk (e.g. compared to the gPTA or host/guest PMU series),
> and getting the VCPU_REGS_RAX landed would make my life easier for 7.2.

Thank you!