From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f202.google.com (mail-pg1-f202.google.com [209.85.215.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 14AAD2DC338 for ; Fri, 7 Nov 2025 22:38:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.202 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762555092; cv=none; b=OztPKMkNAt3cjyRlJvUfhv6WuE4eEv5dBkIaYtPVxK/mFgCRx47uByUVmswfFphsb+VDQ/iG2LXXcbdYPh3dL7j89frQsUSLCiy+9LCf8q8/3KLVgooTqBZgSrN7bq/bq7beXctI3vMU9u2SUHM/Is4QJ94wrCwpa1f751GtuwU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762555092; c=relaxed/simple; bh=rtZVSAacOqPDAFhwZey31w9nuqAAxwnJYwwpxH186z4=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=rWo17UMWaKIVXgsueE99nPfe2wmYd3lus2apBVwCXDUDmH7xstJBW8fz9bJHYKMOkbEOtYobmXF2oRB4nLCzCyLNfYfb0jPub16bTzKKJMcd3ZrdEw2I8jykb/fB6JnG+lIZ0UX+tIqJouISQx6TdikTJKO+9YuQ7GQfK+VMvEk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=q2+YlgGZ; arc=none smtp.client-ip=209.85.215.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="q2+YlgGZ" Received: by mail-pg1-f202.google.com with SMTP id 41be03b00d2f7-ba433d88288so962443a12.2 for ; Fri, 07 Nov 2025 14:38:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1762555090; x=1763159890; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:reply-to:from:to:cc :subject:date:message-id:reply-to; bh=i6ZWrSszRgf+OK0UMrDoILB8VEgH0P7tEZvUBb1KzcU=; b=q2+YlgGZ7CpdEYAzisJNRDxLQQAUBwLxVkQWMBf6UWvaH3JpRSSk2A8tvW8Ae1YKe9 xBDdXy6HroB9/wj++BUPckKd9nUSLAp7DV+jbV0iLxaMB+Wu+/r1Euc/OrTr8U8gaosK RfVpR7RCXAXdqr9f61y5M9/UI2Xqfljq4Mvs8KpxDNmcn7HCYkcusE/Tk2LS9oB1Ug0M V/N/KsU9z3TzAydSdmL+79tmmszFZ6UV19zh9IZgzneckMAe3aV4ajAbNjq542unHwHR KQiHVK/0484jZLWevKELATqDScqhYiQ2YYuswMYTK14Q/j8A5vgd6ZVPn/jAfjwgzIhY dxGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1762555090; x=1763159890; h=cc:to:from:subject:message-id:mime-version:date:reply-to :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=i6ZWrSszRgf+OK0UMrDoILB8VEgH0P7tEZvUBb1KzcU=; b=H3gltRsHr0vXmflw67uvixNqmd5THxx0ElBdbJlhyk7LtBDCQ/2yX79hoaM8g3QubS NZEV6EFVSrNoQq9pMqH2ZhzXmD0KdqSDjMSHEHS4lQACAuQTi5vViDhGIxkvB1jhvQvl PMDehBgdiqaG4eudnVA7giz67gvul+M5QysKYH3gOP9VMFNr0mitYRwx/ChhPwvNjBDq EmjrofQl3l9ce/ZMnmUbMOwGpeFAdaEcwNC6RYNN8JLEtX2zGIZ8rwh5M//5TgWjKVWB bdhSMHJs1fg4Kvxao6rTZfZUQhnVEE3pwvkaafNuajwBk4q7pGNa1MhhLUZK4bq5xKNW N9dg== X-Forwarded-Encrypted: i=1; AJvYcCWM27X+hlFMktoJQK3SYEwZxaMmb1Vb7fjsxCShmkWYbJ2pr0a/zaAwCiudh/CDvQHN/b9DlvlrBj45y6M=@vger.kernel.org X-Gm-Message-State: AOJu0Yzpv1sUDjnBvK7h4C5zAVzLZ+lNhut2uKF3BmlMwOtseiJHMjXs 7CXUQDXOkpiUUwaQrAAz3Sf9m78Ib3uc9p9pQhbxnh/Av8Ucximf0HmIQgXfPR/VRYYPLoE2GrL xAPTN/w== X-Google-Smtp-Source: AGHT+IEV6rezXdMLPCPwuqWjMz8IR9xWFef3dr3uacIFfEdeI79wnVgSP3RuuWePVcrDflpsPEvEVN3urR0= X-Received: from pge26.prod.google.com ([2002:a05:6a02:2d1a:b0:b85:7a45:1f8e]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:3286:b0:34f:d380:5f2b with SMTP id adf61e73a8af0-353a18e5b2emr949487637.17.1762555090163; Fri, 07 Nov 2025 14:38:10 -0800 (PST) Reply-To: Sean Christopherson Date: Fri, 7 Nov 2025 14:38:07 -0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.51.2.1041.gc1ab5b90ca-goog Message-ID: <20251107223807.860845-1-seanjc@google.com> Subject: [GIT PULL] KVM: x86 fixes and a guest_memd fix for 6.18 From: Sean Christopherson To: Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Sean Christopherson Content-Type: text/plain; charset="UTF-8" Please pull a variety of fixes that fall into one of three categories: - Recent-ish TDX-induced bugs (VM death on SEAMCALL/TDCALL, and my paperbag GVA_IS_VALID goof). - Long-standing issues that were exposed and/or are made releavnt by 6.18 (guest_memfd UAF race, GALog unregister and ir_list_lock from AVIC). - Bugs introduce in 6.18 (splat when emulating INIT for CET XSTATE). The following changes since commit 4361f5aa8bfcecbab3fc8db987482b9e08115a6a: Merge tag 'kvm-x86-fixes-6.18-rc2' of https://github.com/kvm-x86/linux into HEAD (2025-10-18 10:25:43 +0200) are available in the Git repository at: https://github.com/kvm-x86/linux.git tags/kvm-x86-fixes-6.18-rc5 for you to fetch changes up to d0164c161923ac303bd843e04ebe95cfd03c6e19: KVM: VMX: Fix check for valid GVA on an EPT violation (2025-11-06 06:06:18 -0800) ---------------------------------------------------------------- KVM x86 fixes for 6.18: - Inject #UD if the guest attempts to execute SEAMCALL or TDCALL as KVM doesn't support virtualization the instructions, but the instructions are gated only by VMXON, i.e. will VM-Exit instead of taking a #UD and thus result in KVM exiting to userspace with an emulation error. - Unload the "FPU" when emulating INIT of XSTATE features if and only if the FPU is actually loaded, instead of trying to predict when KVM will emulate an INIT (CET support missed the MP_STATE path). Add sanity checks to detect and harden against similar bugs in the future. - Unregister KVM's GALog notifier (for AVIC) when kvm-amd.ko is unloaded. - Use a raw spinlock for svm->ir_list_lock as the lock is taken during schedule(), and "normal" spinlocks are sleepable locks when PREEMPT_RT=y. - Remove guest_memfd bindings on memslot deletion when a gmem file is dying to fix a use-after-free race found by syzkaller. - Fix a goof in the EPT Violation handler where KVM checks the wrong variable when determining if the reported GVA is valid. ---------------------------------------------------------------- Chao Gao (1): KVM: x86: Call out MSR_IA32_S_CET is not handled by XSAVES Maxim Levitsky (1): KVM: SVM: switch to raw spinlock for svm->ir_list_lock Sean Christopherson (7): KVM: VMX: Inject #UD if guest tries to execute SEAMCALL or TDCALL KVM: x86: Unload "FPU" state on INIT if and only if its currently in-use KVM: x86: Harden KVM against imbalanced load/put of guest FPU state KVM: SVM: Initialize per-CPU svm_data at the end of hardware setup KVM: SVM: Unregister KVM's GALog notifier on kvm-amd.ko exit KVM: SVM: Make avic_ga_log_notifier() local to avic.c KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying Sukrit Bhatnagar (1): KVM: VMX: Fix check for valid GVA on an EPT violation arch/x86/include/uapi/asm/vmx.h | 1 + arch/x86/kvm/svm/avic.c | 24 +++++++++++++-------- arch/x86/kvm/svm/svm.c | 15 +++++++------ arch/x86/kvm/svm/svm.h | 4 ++-- arch/x86/kvm/vmx/common.h | 2 +- arch/x86/kvm/vmx/nested.c | 8 +++++++ arch/x86/kvm/vmx/vmx.c | 8 +++++++ arch/x86/kvm/x86.c | 48 +++++++++++++++++++++++++---------------- virt/kvm/guest_memfd.c | 47 ++++++++++++++++++++++++++++------------ 9 files changed, 106 insertions(+), 51 deletions(-)