arch/x86/kvm/svm/nested.c | 9 --------- arch/x86/kvm/svm/svm.c | 36 +++++++++++++++++++++++++++++++++--- arch/x86/kvm/svm/svm.h | 1 - 3 files changed, 33 insertions(+), 13 deletions(-)
When KVM_X86_QUIRK_NESTED_SVM_SHARED_PAT is disabled and the vCPU is in
guest mode with nested NPT enabled, guest accesses to IA32_PAT are
redirected to the gPAT register, which is stored in VMCB02's g_pat field.
Non-guest accesses (e.g. from userspace) to IA32_PAT are always redirected
to hPAT, which is stored in vcpu->arch.pat.
Directing host-initiated accesses to hPAT ensures that KVM_GET/SET_MSRS and
KVM_GET/SET_NESTED_STATE are independent of each other and can be ordered
arbitrarily during save and restore. gPAT is saved and restored separately
via KVM_GET/SET_NESTED_STATE.
Use WARN_ON_ONCE to flag any host-initiated accesses originating from KVM
itself rather than userspace.
Use pr_warn_once to flag any use of the common MSR-handling code (now
shared by VMX and TDX) for IA32_PAT by a vCPU that is SVM-capable.
Fixes: 15038e147247 ("KVM: SVM: obey guest PAT")
Signed-off-by: Jim Mattson <jmattson@google.com>
Co-developed-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
arch/x86/kvm/svm/nested.c | 9 ---------
arch/x86/kvm/svm/svm.c | 36 +++++++++++++++++++++++++++++++++---
arch/x86/kvm/svm/svm.h | 1 -
3 files changed, 33 insertions(+), 13 deletions(-)
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index 58574e803812..8c9dd685b616 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -703,15 +703,6 @@ static int nested_svm_load_cr3(struct kvm_vcpu *vcpu, unsigned long cr3,
return 0;
}
-void nested_vmcb02_compute_g_pat(struct vcpu_svm *svm)
-{
- if (!svm->nested.vmcb02.ptr)
- return;
-
- /* FIXME: merge g_pat from vmcb01 and vmcb12. */
- vmcb_set_gpat(svm->nested.vmcb02.ptr, svm->vmcb01.ptr->save.g_pat);
-}
-
static bool nested_vmcb12_has_lbrv(struct kvm_vcpu *vcpu)
{
return guest_cpu_cap_has(vcpu, X86_FEATURE_LBRV) &&
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 56b6bd5dfdca..8d968ead6f45 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -2767,6 +2767,20 @@ static bool sev_es_prevent_msr_access(struct kvm_vcpu *vcpu,
!msr_write_intercepted(vcpu, msr_info->index);
}
+static bool svm_pat_accesses_gpat(struct kvm_vcpu *vcpu, bool from_host)
+{
+ /*
+ * When KVM_X86_QUIRK_NESTED_SVM_SHARED_PAT is disabled and nested
+ * NPT is enabled, L2 has a separate PAT from L1. Guest accesses
+ * to IA32_PAT while running L2 target L2's gPAT; host-initiated
+ * accesses always target L1's hPAT so that KVM_GET/SET_MSRS and
+ * KVM_GET/SET_NESTED_STATE are independent of each other and can
+ * be ordered arbitrarily during save and restore.
+ */
+ WARN_ON_ONCE(from_host && vcpu->wants_to_run);
+ return !from_host && is_guest_mode(vcpu) && l2_has_separate_pat(vcpu);
+}
+
static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
{
struct vcpu_svm *svm = to_svm(vcpu);
@@ -2883,6 +2897,12 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
case MSR_AMD64_DE_CFG:
msr_info->data = svm->msr_decfg;
break;
+ case MSR_IA32_CR_PAT:
+ if (svm_pat_accesses_gpat(vcpu, msr_info->host_initiated)) {
+ msr_info->data = svm->vmcb->save.g_pat;
+ break;
+ }
+ return kvm_get_msr_common(vcpu, msr_info);
default:
return kvm_get_msr_common(vcpu, msr_info);
}
@@ -2966,13 +2986,23 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
break;
case MSR_IA32_CR_PAT:
+ if (svm_pat_accesses_gpat(vcpu, msr->host_initiated)) {
+ if (!kvm_pat_valid(data))
+ return 1;
+
+ vmcb_set_gpat(svm->vmcb, data);
+ break;
+ }
+
ret = kvm_set_msr_common(vcpu, msr);
if (ret)
break;
- vmcb_set_gpat(svm->vmcb01.ptr, data);
- if (is_guest_mode(vcpu))
- nested_vmcb02_compute_g_pat(svm);
+ if (npt_enabled) {
+ vmcb_set_gpat(svm->vmcb01.ptr, data);
+ if (is_guest_mode(vcpu) && !l2_has_separate_pat(vcpu))
+ vmcb_set_gpat(svm->vmcb, data);
+ }
break;
case MSR_IA32_SPEC_CTRL:
if (!msr->host_initiated &&
diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
index fdd6286d965e..677e899bda33 100644
--- a/arch/x86/kvm/svm/svm.h
+++ b/arch/x86/kvm/svm/svm.h
@@ -881,7 +881,6 @@ void nested_copy_vmcb_control_to_cache(struct vcpu_svm *svm,
void nested_copy_vmcb_save_to_cache(struct vcpu_svm *svm,
struct vmcb_save_area *save);
void nested_sync_control_from_vmcb02(struct vcpu_svm *svm);
-void nested_vmcb02_compute_g_pat(struct vcpu_svm *svm);
void svm_switch_vmcb(struct vcpu_svm *svm, struct kvm_vmcb_info *target_vmcb);
extern struct kvm_x86_nested_ops svm_nested_ops;
--
2.53.0.1213.gd9a14994de-googOn Tue, Apr 07, 2026, Jim Mattson wrote: > When KVM_X86_QUIRK_NESTED_SVM_SHARED_PAT is disabled and the vCPU is in > guest mode with nested NPT enabled, guest accesses to IA32_PAT are > redirected to the gPAT register, which is stored in VMCB02's g_pat field. > > Non-guest accesses (e.g. from userspace) to IA32_PAT are always redirected > to hPAT, which is stored in vcpu->arch.pat. > > Directing host-initiated accesses to hPAT ensures that KVM_GET/SET_MSRS and > KVM_GET/SET_NESTED_STATE are independent of each other and can be ordered > arbitrarily during save and restore. gPAT is saved and restored separately > via KVM_GET/SET_NESTED_STATE. > > Use WARN_ON_ONCE to flag any host-initiated accesses originating from KVM > itself rather than userspace. > > Use pr_warn_once to flag any use of the common MSR-handling code (now > shared by VMX and TDX) for IA32_PAT by a vCPU that is SVM-capable. Changelog is stale, but otherwise this LGTM. I'll fixup the changelog when applying (in a few weeks).
On Tue, Apr 7, 2026 at 12:24 PM Sean Christopherson <seanjc@google.com> wrote: > > On Tue, Apr 07, 2026, Jim Mattson wrote: > > When KVM_X86_QUIRK_NESTED_SVM_SHARED_PAT is disabled and the vCPU is in > > guest mode with nested NPT enabled, guest accesses to IA32_PAT are > > redirected to the gPAT register, which is stored in VMCB02's g_pat field. > > > > Non-guest accesses (e.g. from userspace) to IA32_PAT are always redirected > > to hPAT, which is stored in vcpu->arch.pat. > > > > Directing host-initiated accesses to hPAT ensures that KVM_GET/SET_MSRS and > > KVM_GET/SET_NESTED_STATE are independent of each other and can be ordered > > arbitrarily during save and restore. gPAT is saved and restored separately > > via KVM_GET/SET_NESTED_STATE. > > > > Use WARN_ON_ONCE to flag any host-initiated accesses originating from KVM > > itself rather than userspace. > > > > Use pr_warn_once to flag any use of the common MSR-handling code (now > > shared by VMX and TDX) for IA32_PAT by a vCPU that is SVM-capable. > > Changelog is stale, but otherwise this LGTM. I'll fixup the changelog when > applying (in a few weeks). Oh, crud. This was supposed to be 5/8, but I made some changes after checkpatch.pl complained and then tried to just regenerate this one, but I totally flubbed it.
On Tue, Apr 07, 2026, Jim Mattson wrote: > On Tue, Apr 7, 2026 at 12:24 PM Sean Christopherson <seanjc@google.com> wrote: > > > > On Tue, Apr 07, 2026, Jim Mattson wrote: > > > When KVM_X86_QUIRK_NESTED_SVM_SHARED_PAT is disabled and the vCPU is in > > > guest mode with nested NPT enabled, guest accesses to IA32_PAT are > > > redirected to the gPAT register, which is stored in VMCB02's g_pat field. > > > > > > Non-guest accesses (e.g. from userspace) to IA32_PAT are always redirected > > > to hPAT, which is stored in vcpu->arch.pat. > > > > > > Directing host-initiated accesses to hPAT ensures that KVM_GET/SET_MSRS and > > > KVM_GET/SET_NESTED_STATE are independent of each other and can be ordered > > > arbitrarily during save and restore. gPAT is saved and restored separately > > > via KVM_GET/SET_NESTED_STATE. > > > > > > Use WARN_ON_ONCE to flag any host-initiated accesses originating from KVM > > > itself rather than userspace. > > > > > > Use pr_warn_once to flag any use of the common MSR-handling code (now > > > shared by VMX and TDX) for IA32_PAT by a vCPU that is SVM-capable. > > > > Changelog is stale, but otherwise this LGTM. I'll fixup the changelog when > > applying (in a few weeks). > > Oh, crud. This was supposed to be 5/8, but I made some changes after > checkpatch.pl complained and then tried to just regenerate this one, > but I totally flubbed it. Huh. The patch shows up when I grab the thread via b4 mbox and open it with mutt, but b4 am skips it. I'm guessing there's version-based filtering somewhere in b4. No need for a v9 on my account, I can splice in 5/8 when applying.
© 2016 - 2026 Red Hat, Inc.