linux-kernel - [RFC PATCH 2/6] KVM: x86: nSVM: Redirect PAT MSR accesses to gPAT when NPT is enabled in vmcb12

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251107201151.3303170-3-jmattson@google.com>
Date: Fri,  7 Nov 2025 12:11:25 -0800
From: Jim Mattson <jmattson@...gle.com>
To: Sean Christopherson <seanjc@...gle.com>, Paolo Bonzini <pbonzini@...hat.com>, 
	Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>, 
	Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org, 
	"H. Peter Anvin" <hpa@...or.com>, Alexander Graf <agraf@...e.de>, Joerg Roedel <joro@...tes.org>, 
	Avi Kivity <avi@...hat.com>, 
	"Radim Krčmář" <rkrcmar@...hat.com>, David Hildenbrand <david@...hat.com>, kvm@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Cc: Jim Mattson <jmattson@...gle.com>
Subject: [RFC PATCH 2/6] KVM: x86: nSVM: Redirect PAT MSR accesses to gPAT
 when NPT is enabled in vmcb12

According to the APM volume 2, section 15.25.2: "Replicated State,"

  While nested paging is enabled, all (guest) references to the state of
  the paging registers by x86 code (MOV to/from CRn, etc.) read and write
  the guest copy of the registers.

The PAT MSR is explicitly enumerated as a "paging register" in that
section of the APM.

Implement the architected behavior by redirecting PAT MSR accesses
from vcpu->arch.pat to svm->vmcb->save.g_pat when L2 is active and
nested paging is enabled in vmcb12.

Note that the change in KVM_{GET,SET}_MSRS semantics breaks
serialization. Trigger a fixup in svm_set_nested_state() by setting
the VALID_GPAT flag in the SVM nested state header.

Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler")
Signed-off-by: Jim Mattson <jmattson@...gle.com>
---
 arch/x86/kvm/svm/nested.c |  1 +
 arch/x86/kvm/svm/svm.c    | 25 +++++++++++++++++--------
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index ad11b11f482e..c68511948501 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1728,6 +1728,7 @@ static int svm_get_nested_state(struct kvm_vcpu *vcpu,
 	/* First fill in the header and copy it out.  */
 	if (is_guest_mode(vcpu)) {
 		kvm_state.hdr.svm.vmcb_pa = svm->nested.vmcb12_gpa;
+		kvm_state.hdr.svm.flags = KVM_STATE_SVM_VALID_GPAT;
 		kvm_state.size += KVM_STATE_NESTED_SVM_VMCB_SIZE;
 		kvm_state.flags |= KVM_STATE_NESTED_GUEST_MODE;
 
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index b4e5a0684f57..7e192fd5fb7f 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -2675,6 +2675,12 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 			return 1;
 		msr_info->data = svm->tsc_ratio_msr;
 		break;
+	case MSR_IA32_CR_PAT:
+		if (!(is_guest_mode(vcpu) && nested_npt_enabled(svm)))
+			msr_info->data = vcpu->arch.pat;
+		else
+			msr_info->data = svm->vmcb->save.g_pat;
+		break;
 	case MSR_STAR:
 		msr_info->data = svm->vmcb01.ptr->save.star;
 		break;
@@ -2864,14 +2870,17 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
 
 		break;
 	case MSR_IA32_CR_PAT:
-		ret = kvm_set_msr_common(vcpu, msr);
-		if (ret)
-			break;
-
-		svm->vmcb01.ptr->save.g_pat = data;
-		if (is_guest_mode(vcpu))
-			nested_vmcb02_compute_g_pat(svm);
-		vmcb_mark_dirty(svm->vmcb, VMCB_NPT);
+		if (!kvm_pat_valid(data))
+			return 1;
+		if (!(is_guest_mode(vcpu) && nested_npt_enabled(svm))) {
+			vcpu->arch.pat = data;
+			svm->vmcb01.ptr->save.g_pat = data;
+			vmcb_mark_dirty(svm->vmcb01.ptr, VMCB_NPT);
+		}
+		if (is_guest_mode(vcpu)) {
+			svm->vmcb->save.g_pat = data;
+			vmcb_mark_dirty(svm->vmcb, VMCB_NPT);
+		}
 		break;
 	case MSR_IA32_SPEC_CTRL:
 		if (!msr->host_initiated &&
-- 
2.51.2.1041.gc1ab5b90ca-goog