linux-kernel - Re: [PATCH v2 7/8] KVM: x86: nSVM: Handle restore of legacy nested state

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CALMp9eTUx74tENnQEawfR5jdfkjcoAXb6xfHfJ7geyHP9Qyk0w@mail.gmail.com>
Date: Tue, 20 Jan 2026 10:27:48 -0800
From: Jim Mattson <jmattson@...gle.com>
To: Sean Christopherson <seanjc@...gle.com>, Paolo Bonzini <pbonzini@...hat.com>, 
	Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>, 
	Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org, 
	"H. Peter Anvin" <hpa@...or.com>, Shuah Khan <shuah@...nel.org>, kvm@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-kselftest@...r.kernel.org
Subject: Re: [PATCH v2 7/8] KVM: x86: nSVM: Handle restore of legacy nested state

On Thu, Jan 15, 2026 at 3:22 PM Jim Mattson <jmattson@...gle.com> wrote:
>
> When nested NPT is enabled and KVM_SET_NESTED_STATE is used to restore an
> old checkpoint (without a valid gPAT), the current IA32_PAT value must be
> copied to vmcb02->save.g_pat.
>
> Unfortunately, the current IA32_PAT value may be restored by KVM_SET_MSRS
> after KVM_SET_NESTED_STATE.
>
> Introduce a new boolean, svm->nested.restore_gpat_from_pat. If set,
> svm_vcpu_pre_run() will copy vcpu->arch.pat to vmcb02->save.g_pat and clear
> the boolean.
>
> Signed-off-by: Jim Mattson <jmattson@...gle.com>
> ---
>  arch/x86/kvm/svm/nested.c | 9 ++++++---
>  arch/x86/kvm/svm/svm.c    | 8 ++++++++
>  arch/x86/kvm/svm/svm.h    | 6 ++++++
>  3 files changed, 20 insertions(+), 3 deletions(-)
>
> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index c50fb7172672..61a3e7226cde 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -1958,9 +1958,12 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu,
>         if (ret)
>                 goto out_free;
>
> -       if (is_guest_mode(vcpu) && nested_npt_enabled(svm) &&
> -           (kvm_state.hdr.svm.flags & KVM_STATE_SVM_VALID_GPAT))
> -               svm->vmcb->save.g_pat = save_cached.g_pat;
> +       if (is_guest_mode(vcpu) && nested_npt_enabled(svm)) {
> +               svm->nested.restore_gpat_from_pat =
> +                       !(kvm_state->hdr.svm.flags & KVM_STATE_SVM_VALID_GPAT);
> +               if (kvm_state->hdr.svm.flags & KVM_STATE_SVM_VALID_GPAT)
> +                       svm->vmcb->save.g_pat = save_cached.g_pat;
> +       }
>
>         svm->nested.force_msr_bitmap_recalc = true;
>
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 3f8581adf0c1..5dceab9f4c3f 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -4217,9 +4217,17 @@ static void svm_cancel_injection(struct kvm_vcpu *vcpu)
>
>  static int svm_vcpu_pre_run(struct kvm_vcpu *vcpu)
>  {
> +       struct vcpu_svm *svm = to_svm(vcpu);
> +
>         if (to_kvm_sev_info(vcpu->kvm)->need_init)
>                 return -EINVAL;
>
> +       if (svm->nested.restore_gpat_from_pat) {
> +               svm->vmcb->save.g_pat = vcpu->arch.pat;
> +               vmcb_mark_dirty(svm->vmcb, VMCB_NPT);
> +               svm->nested.restore_gpat_from_pat = false;
> +       }
> +

Something like this is probably needed in svm_get_nested_state() as
well, but without clearing the boolean.

>         return 1;
>  }
>
> diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
> index 39138378531e..1964ab6e45f4 100644
> --- a/arch/x86/kvm/svm/svm.h
> +++ b/arch/x86/kvm/svm/svm.h
> @@ -219,6 +219,12 @@ struct svm_nested_state {
>          * on its side.
>          */
>         bool force_msr_bitmap_recalc;
> +
> +       /*
> +        * Indicates that vcpu->arch.pat should be copied to
> +        * vmcb02->save.g_pat at the next vcpu_run.
> +        */
> +       bool restore_gpat_from_pat;
>  };
>
>  struct vcpu_sev_es_state {
> --
> 2.52.0.457.g6b5491de43-goog
>