| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CABgObfavktYG1ZmsSoVY3W2Rxm7Sh7ri6BkVkbZM3LHmg1m9nA@mail.gmail.com>
Date: Mon, 9 Feb 2026 18:51:51 +0100
From: Paolo Bonzini <pbonzini@...hat.com>
To: Sean Christopherson <seanjc@...gle.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [GIT PULL] KVM: x86: SVM changes for 6.20
On Sat, Feb 7, 2026 at 5:10 AM Sean Christopherson <seanjc@...gle.com> wrote:
>
> Complete the "u64 exit_code" cleanup, start fixing nSVM issues (a lot more of
> those will be coming in the near future), virtualize EPAPS, and support for
> fetching SNP certificates.
>
> The following changes since commit 9ace4753a5202b02191d54e9fdf7f9e3d02b85eb:
>
> Linux 6.19-rc4 (2026-01-04 14:41:55 -0800)
>
> are available in the Git repository at:
>
> https://github.com/kvm-x86/linux.git tags/kvm-x86-svm-6.20
>
> for you to fetch changes up to 20c3c4108d58f87c711bf44cb0b498b3ac5af6bf:
>
> KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (2026-01-23 09:14:16 -0800)
Pulled, thanks.
Paolo
> ----------------------------------------------------------------
> KVM SVM changes for 6.20
>
> - Drop a user-triggerable WARN on nested_svm_load_cr3() failure.
>
> - Add support for virtualizing ERAPS. Note, correct virtualization of ERAPS
> relies on an upcoming, publicly announced change in the APM to reduce the
> set of conditions where hardware (i.e. KVM) *must* flush the RAP.
>
> - Ignore nSVM intercepts for instructions that are not supported according to
> L1's virtual CPU model.
>
> - Add support for expedited writes to the fast MMIO bus, a la VMX's fastpath
> for EPT Misconfig.
>
> - Don't set GIF when clearing EFER.SVME, as GIF exists independently of SVM,
> and allow userspace to restore nested state with GIF=0.
>
> - Treat exit_code as an unsigned 64-bit value through all of KVM.
>
> - Add support for fetching SNP certificates from userspace.
>
> - Fix a bug where KVM would use vmcb02 instead of vmcb01 when emulating VMLOAD
> or VMSAVE on behalf of L2.
>
> - Misc fixes and cleanups.
>
> ----------------------------------------------------------------
> Amit Shah (1):
> KVM: SVM: Virtualize and advertise support for ERAPS
>
> Jim Mattson (2):
> KVM: SVM: Don't set GIF when clearing EFER.SVME
> KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0
>
> Kevin Cheng (1):
> KVM: SVM: Don't allow L1 intercepts for instructions not advertised
>
> Michael Roth (2):
> KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching
> KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command
>
> Sean Christopherson (14):
> KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding
> KVM: SVM: Rename "fault_address" to "gpa" in npf_interception()
> KVM: SVM: Add support for expedited writes to the fast MMIO bus
> KVM: SVM: Drop the module param to control SEV-ES DebugSwap
> KVM: SVM: Tag sev_supported_vmsa_features as read-only after init
> KVM: SVM: Add a helper to detect VMRUN failures
> KVM: SVM: Open code handling of unexpected exits in svm_invoke_exit_handler()
> KVM: SVM: Check for an unexpected VM-Exit after RETPOLINE "fast" handling
> KVM: SVM: Filter out 64-bit exit codes when invoking exit handlers on bare metal
> KVM: SVM: Treat exit_code as an unsigned 64-bit value through all of KVM
> KVM: SVM: Limit incorrect check on SVM_EXIT_ERR to running as a VM
> KVM: SVM: Harden exit_code against being used in Spectre-like attacks
> KVM: SVM: Assert that Hyper-V's HV_SVM_EXITCODE_ENL == SVM_EXIT_SW
> KVM: SVM: Fix an off-by-one typo in the comment for enabling AVIC by default
>
> Yosry Ahmed (5):
> KVM: selftests: Use TEST_ASSERT_EQ() in test_vmx_nested_state()
> KVM: selftests: Extend vmx_set_nested_state_test to cover SVM
> KVM: nSVM: Drop redundant/wrong comment in nested_vmcb02_prepare_save()
> KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
> KVM: SVM: Stop toggling virtual VMSAVE/VMLOAD on intercept recalc
>
> Documentation/virt/kvm/api.rst | 44 +++++++
> .../virt/kvm/x86/amd-memory-encryption.rst | 52 ++++++++-
> arch/x86/include/asm/cpufeatures.h | 1 +
> arch/x86/include/asm/kvm_host.h | 8 ++
> arch/x86/include/asm/svm.h | 9 +-
> arch/x86/include/uapi/asm/kvm.h | 2 +
> arch/x86/include/uapi/asm/svm.h | 32 ++---
> arch/x86/kvm/cpuid.c | 9 +-
> arch/x86/kvm/svm/avic.c | 4 +-
> arch/x86/kvm/svm/hyperv.c | 7 +-
> arch/x86/kvm/svm/nested.c | 82 ++++++++-----
> arch/x86/kvm/svm/sev.c | 129 ++++++++++++++-------
> arch/x86/kvm/svm/svm.c | 121 ++++++++++++++-----
> arch/x86/kvm/svm/svm.h | 49 ++++++--
> arch/x86/kvm/trace.h | 6 +-
> arch/x86/kvm/x86.c | 12 ++
> include/hyperv/hvgdk.h | 2 +-
> include/uapi/linux/kvm.h | 9 ++
> tools/testing/selftests/kvm/Makefile.kvm | 2 +-
> tools/testing/selftests/kvm/include/x86/svm.h | 3 +-
> ...nested_state_test.c => nested_set_state_test.c} | 128 +++++++++++++++++---
> .../kvm/x86/svm_nested_soft_inject_test.c | 4 +-
> 22 files changed, 559 insertions(+), 156 deletions(-)
> rename tools/testing/selftests/kvm/x86/{vmx_set_nested_state_test.c => nested_set_state_test.c} (70%)
>
Powered by blists - more mailing lists