linux-kernel - [PATCH 0/3] KVM: SVM: Set PFERR_GUEST_{PAGE,FINAL}

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260121004906.2373989-1-chengkev@google.com>
Date: Wed, 21 Jan 2026 00:49:03 +0000
From: Kevin Cheng <chengkev@...gle.com>
To: seanjc@...gle.com, pbonzini@...hat.com
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org, yosry.ahmed@...ux.dev, 
	Kevin Cheng <chengkev@...gle.com>
Subject: [PATCH 0/3] KVM: SVM: Set PFERR_GUEST_{PAGE,FINAL}_MASK for nested
 NPF and add selftest

This series fixes the setting of PFERR_GUEST_PAGE_MASK and
PFERR_GUEST_FINAL_MASK when injecting a nested page fault to L1,
and adds a selftest to verify the behavior.

When a nested page fault occurs, L1 needs to know whether the fault
happened during the page table walk (on a PT page) or on the final
data page translation. This information is conveyed through
PFERR_GUEST_PAGE_MASK (bit 33) and PFERR_GUEST_FINAL_MASK (bit 32)
in exit_info_1.

Currently, these bits are not set when an NPF is injected during
instruction emulation where the original exit reason was not NPF
(e.g., during string I/O emulation). This series fixes that and adds
test coverage.

Patch 1 adds the PFERR_GUEST_{PAGE,FINAL}_MASK bits to the fault error
code in paging_tmpl.h when the GPA->HPA translation fails during a
guest page table walk or final page translation.

Patch 2 adds TDP unmap helper functions to the selftest library,
enabling tests to selectively unmap pages from the NPT to trigger
nested page faults.

Patch 3 adds a selftest that exercises the nested NPF injection path
by having L2 execute an OUTS instruction with the source address
unmapped from L1's NPT. The test verifies that the correct
PFERR_GUEST_* bit is set and that exit_info_2 contains the faulting
GPA.

Kevin Cheng (3):
  KVM: SVM: Fix nested NPF injection to set
    PFERR_GUEST_{PAGE,FINAL}_MASK
  KVM: selftests: Add TDP unmap helpers
  KVM: selftests: Add nested NPF injection test for SVM

 arch/x86/kvm/kvm_emulate.h                    |   2 +-
 arch/x86/kvm/mmu/paging_tmpl.h                |  22 ++-
 arch/x86/kvm/svm/nested.c                     |  11 +-
 tools/testing/selftests/kvm/Makefile.kvm      |   1 +
 .../selftests/kvm/include/x86/processor.h     |   6 +
 .../testing/selftests/kvm/lib/x86/processor.c |  53 ++++++
 .../selftests/kvm/x86/svm_nested_npf_test.c   | 154 ++++++++++++++++++
 7 files changed, 230 insertions(+), 19 deletions(-)
 create mode 100644 tools/testing/selftests/kvm/x86/svm_nested_npf_test.c

base-commit: 38f626812b20ad22ab6dc9cfe6d811850f2d8244
--
2.52.0.457.g6b5491de43-goog