Message-ID: <20260205214326.1029278-1-jmattson@google.com>
Date: Thu,  5 Feb 2026 13:43:00 -0800
From: Jim Mattson <jmattson@...gle.com>
To: Sean Christopherson <seanjc@...gle.com>, Paolo Bonzini <pbonzini@...hat.com>, 
	Thomas Gleixner <tglx@...nel.org>, Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>, 
	Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org, 
	"H. Peter Anvin" <hpa@...or.com>, Shuah Khan <shuah@...nel.org>, kvm@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-kselftest@...r.kernel.org, 
	Yosry Ahmed <yosry.ahmed@...ux.dev>
Cc: Jim Mattson <jmattson@...gle.com>
Subject: [PATCH v3 0/8] KVM: x86: nSVM: Improve PAT virtualization

Currently, KVM's implementation of nested SVM treats the PAT MSR the same
way whether or not nested NPT is enabled: L1 and L2 share a single
PAT. However, the APM specifies that when nested NPT is enabled, the host
(L1) and the guest (L2) should have independent PATs: hPAT for L1 and gPAT
for L2. This patch series implements the architectural specification in
KVM.

Use the existing PAT MSR (vcpu->arch.pat) for hPAT. Add a new field,
svm->nested.gpat, for gPAT. With nested NPT enabled, redirect guest
accesses to the IA32_PAT MSR to gPAT. All other accesses, including
userspace accesses via KVM_{GET,SET}_MSRS, continue to reference hPAT.  The
special handling of userspace accesses ensures save/restore forward
compatibility (i.e. resuming a new checkpoint on an older kernel). When an
old kernel restores a checkpoint from a new kernel, the gPAT will be lost,
and L2 will simply use L1's PAT, which is the existing behavior of the old
kernel anyway.

v1: https://lore.kernel.org/kvm/20260113003016.3511895-1-jmattson@google.com/
v2: https://lore.kernel.org/kvm/20260115232154.3021475-1-jmattson@google.com/

v2 -> v3:

* Extract VMCB_NPT clean bit fix as a separate patch [Yosry]
* Squash v2 patches 2 and 3 (cache and validate g_pat) [Yosry]
* Drop redundant npt_enabled check in g_pat validation since existing
  nested_vmcb_check_controls() already rejects NP_ENABLE when !npt_enabled
  [Yosry]
* Fix svm_set_hpat() to propagate to vmcb02 only when !nested_npt_enabled,
  not unconditionally when in guest mode [Jim]
* Warn in svm_{get,set}_msr() if host_initiated and vcpu_wants_to_run when
  accessing IA32_PAT [Sean]
* Use dedicated svm->nested.gpat field instead of vmcb_save_area_cached
* Use dedicated header field (kvm_svm_nested_state_hdr.gpat) for nested
  state save/restore instead of overwriting vmcb01 save area
* Replace restore_gpat_from_pat with legacy_gpat_semantics to correctly
  handle KVM_GET_NESTED_STATE before the first KVM_RUN [Jim]
* Remove nested_vmcb02_compute_g_pat() after removing all callers [Yosry]

Jim Mattson (8):
  KVM: x86: nSVM: Clear VMCB_NPT clean bit when updating g_pat in L2
  KVM: x86: nSVM: Cache and validate vmcb12 g_pat
  KVM: x86: nSVM: Set vmcb02.g_pat correctly for nested NPT
  KVM: x86: nSVM: Redirect IA32_PAT accesses to either hPAT or gPAT
  KVM: x86: nSVM: Save gPAT to vmcb12.g_pat on VMEXIT
  KVM: x86: nSVM: Save/restore gPAT with KVM_{GET,SET}_NESTED_STATE
  KVM: x86: nSVM: Handle restore of legacy nested state
  KVM: selftests: nSVM: Add svm_nested_pat test

 arch/x86/include/uapi/asm/kvm.h               |   5 +
 arch/x86/kvm/svm/nested.c                     |  51 ++-
 arch/x86/kvm/svm/svm.c                        |  37 ++-
 arch/x86/kvm/svm/svm.h                        |  35 +-
 tools/testing/selftests/kvm/Makefile.kvm      |   1 +
 .../selftests/kvm/x86/svm_nested_pat_test.c   | 298 ++++++++++++++++++
 6 files changed, 406 insertions(+), 21 deletions(-)
 create mode 100644 tools/testing/selftests/kvm/x86/svm_nested_pat_test.c


base-commit: e944fe2c09f405a2e2d147145c9b470084bc4c9a
-- 
2.53.0.rc2.204.g2597b5adb4-goog

Powered by blists - more mailing lists