linux-kernel - [RFC PATCH 1/6] KVM: x86: nSVM: Shuffle guest PAT and PAT MSR in svm_set_nested

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251107201151.3303170-2-jmattson@google.com>
Date: Fri,  7 Nov 2025 12:11:24 -0800
From: Jim Mattson <jmattson@...gle.com>
To: Sean Christopherson <seanjc@...gle.com>, Paolo Bonzini <pbonzini@...hat.com>, 
	Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>, 
	Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org, 
	"H. Peter Anvin" <hpa@...or.com>, Alexander Graf <agraf@...e.de>, Joerg Roedel <joro@...tes.org>, 
	Avi Kivity <avi@...hat.com>, 
	"Radim Krčmář" <rkrcmar@...hat.com>, David Hildenbrand <david@...hat.com>, kvm@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Cc: Jim Mattson <jmattson@...gle.com>
Subject: [RFC PATCH 1/6] KVM: x86: nSVM: Shuffle guest PAT and PAT MSR in svm_set_nested_state()

When L2 is active and using nested paging, accesses to the PAT MSR
should be redirected to the Guest PAT register. As a result,
KVM_GET_MSRS will save the Guest PAT register rather than the PAT
MSR. However, on restore, KVM_SET_MSRS is called before
KVM_SET_NESTED_STATE, so the Guest PAT register will be restored to
the PAT MSR.

To fix the serialization of the Guest PAT register and the PAT MSR,
copy the PAT MSR to the Guest PAT register (vmcb02->save.g_pat) and
copy vmcb01->save.g_pat to the PAT MSR in svm_set_nested_state() under
the right conditions. One of these conditions is a new SVM nested
state flag, which will be set in the commit that modifies the
KVM_{GET,SET}_MSRS semantics.

Signed-off-by: Jim Mattson <jmattson@...gle.com>
---
 arch/x86/include/uapi/asm/kvm.h |  2 ++
 arch/x86/kvm/svm/nested.c       | 15 +++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
index d420c9c066d4..df8ae68f56f7 100644
--- a/arch/x86/include/uapi/asm/kvm.h
+++ b/arch/x86/include/uapi/asm/kvm.h
@@ -494,6 +494,7 @@ struct kvm_sync_regs {
 #define KVM_STATE_NESTED_SVM_VMCB_SIZE	0x1000
 
 #define KVM_STATE_VMX_PREEMPTION_TIMER_DEADLINE	0x00000001
+#define KVM_STATE_SVM_VALID_GPAT	0x00000001
 
 /* vendor-independent attributes for system fd (group 0) */
 #define KVM_X86_GRP_SYSTEM		0
@@ -529,6 +530,7 @@ struct kvm_svm_nested_state_data {
 
 struct kvm_svm_nested_state_hdr {
 	__u64 vmcb_pa;
+	__u32 flags;
 };
 
 /* for KVM_CAP_NESTED_STATE */
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index a6443feab252..ad11b11f482e 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1052,6 +1052,7 @@ void svm_copy_vmrun_state(struct vmcb_save_area *to_save,
 	to_save->rsp = from_save->rsp;
 	to_save->rip = from_save->rip;
 	to_save->cpl = 0;
+	to_save->g_pat = from_save->g_pat;
 
 	if (kvm_cpu_cap_has(X86_FEATURE_SHSTK)) {
 		to_save->s_cet  = from_save->s_cet;
@@ -1890,6 +1891,20 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu,
 	if (WARN_ON_ONCE(ret))
 		goto out_free;
 
+	/*
+	 * If nested paging is enabled in vmcb12, then KVM_SET_MSRS restored
+	 * the guest PAT register to the PAT MSR. Move this to the guest PAT
+	 * register (svm->vmcb->save.g_pat) and restore the PAT MSR from
+	 * svm->vmcb01.ptr->save.g_pat).
+	 */
+	if ((kvm_state->hdr.svm.flags & KVM_STATE_SVM_VALID_GPAT) &&
+		nested_npt_enabled(svm)) {
+		ret = -EINVAL;
+		svm->vmcb->save.g_pat = vcpu->arch.pat;
+		if (!kvm_pat_valid(svm->vmcb01.ptr->save.g_pat))
+			goto out_free;
+		vcpu->arch.pat = svm->vmcb01.ptr->save.g_pat;
+	}
 	svm->nested.force_msr_bitmap_recalc = true;
 
 	kvm_make_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu);
-- 
2.51.2.1041.gc1ab5b90ca-goog