From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f201.google.com (mail-pl1-f201.google.com [209.85.214.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 061F42F83A0 for ; Wed, 4 Mar 2026 00:30:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772584214; cv=none; b=QJDOoXP9SocOeOnja8n45DllDGwtp72WHwdpncUS5/yR3Q6AOlDdbaIinDn5pPl/eJuRdDtZYbevaZzVtJmg99+sAavDdigdi1GWiLIUAGsBERA1pGpNmPkIM9ufTXCsmdFPWfjdl+zzIp5CyaRJyYpH8vymRvAJjt5Jen0FlHo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772584214; c=relaxed/simple; bh=3tPhoIC6Bu08Eim7X/y0ycnEkAVtQrk7kENmz9hQFhI=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=XbkwqHDGzjVJZcUrqrYbwSfa4z9QhQT/iMDv71DXW/mvcG89ik1pWuY1nU+2rM5PGd6iaHUbwLORlhytjzU8KNew6wb/ioVb5fNYFJESu+Ub/w0Pr5ZJJYY/y0ts6qh7Lk87L7h1XHOC3prrDK5YAPfh0geUAV8dEPzLEpaDlJY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=fLkkth2d; arc=none smtp.client-ip=209.85.214.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="fLkkth2d" Received: by mail-pl1-f201.google.com with SMTP id d9443c01a7336-2ae4e20a414so140772455ad.3 for ; Tue, 03 Mar 2026 16:30:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1772584212; x=1773189012; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:reply-to:from:to:cc :subject:date:message-id:reply-to; bh=vN42vQciUoJdrWBNVw0ChEaojXRkmaJ1ILHWzzE+t7o=; b=fLkkth2d7UKpGE8FWBJ+oucBHZpmo6hmeuJZi0ykCVPrcQcNz0eRsWICe4BbjK4ggk 6cjn7tPuBJ2inKYBoG+4DpqSwEZkgxp5oLrViwTFyQSAIUSj4mdchfyYROk629dgQmwj e1fvv0bLIsj9KsVcyYPR5WAwOzjB0nFDfAL07B81HMmtDJACUn2Ho7Ff3BqK8vlDsaov 8vvpJ4I45OkmK0cU7jL4+kVipT2FoNBBPdt58zutNzdZ4mp+RR5vVDZEGywMmazRsFzJ 6gOAwt7kta1XaNaEsE6VWSQWPRDtPPY7GxzUAsxEfmSYXatClSfZSnQR08KBplRaHwXD gxJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772584212; x=1773189012; h=cc:to:from:subject:message-id:mime-version:date:reply-to :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=vN42vQciUoJdrWBNVw0ChEaojXRkmaJ1ILHWzzE+t7o=; b=hj0zsEp7Mo9tFrBMGjFVaJM0Kyjj4w942syEhQJOI3v0FvIJD6TbXDWkKiSIKGDMxe KCQs3wdn6uDHp82s5z5SH975T+7CqiaZ0R86arXOSPqzUgXaWuCIZxYdUk3C9xlpCeyV L/IBsOzGejD/zLNZQuIxKade+IcQmcotNhsjqCUjf97hiN0IveUcZfTURcBWcyiIP4Z2 XPK368YcIwqH5OJmGTkaPDOUzT4s0v0ijbRveaNdl37u25puhmGe8x22o7SzDnyjO5sh DIArWrCkCc/NT9xE4jVyyy34bF3ZT9H+TourERUglXRGnVcJA0Y2jw9x5XvjHLzPRJts O6VA== X-Forwarded-Encrypted: i=1; AJvYcCW+VB3N39jO1PWaueXloowdfAUF+g43lttLEhy1yCQnT3Ll2Ij/+tmtaYnYTpiBxYP8u/Pnb51jmz7KE8U=@vger.kernel.org X-Gm-Message-State: AOJu0YyRKw89M5ZIbMkOLO7LxCbdWb66BL3nhHgJGiiHsLgroG3Dry/a Z/1XtdMl/6TdPmpdQVinemrkV5oShQ6I6mUqRU5qDd9PLXfG3Y4U04QdyARzPkMJWOSE+/PqVgA gj8PrIw== X-Received: from plho18.prod.google.com ([2002:a17:903:23d2:b0:2ae:5645:97f9]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:3201:b0:2aa:d11d:5c36 with SMTP id d9443c01a7336-2ae6aaf2100mr3173705ad.30.1772584212206; Tue, 03 Mar 2026 16:30:12 -0800 (PST) Reply-To: Sean Christopherson Date: Tue, 3 Mar 2026 16:30:08 -0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.53.0.473.g4a7958ca14-goog Message-ID: <20260304003010.1108257-1-seanjc@google.com> Subject: [PATCH v5 0/2] KVM: nSVM: Intercept STGI/CLGI as needed to inject #UD From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Kevin Cheng Content-Type: text/plain; charset="UTF-8" The STGI/CLGI fixes from Kevin's broader "Align SVM with APM defined behaviors" series. v5: - Separate the STGI/CLGI fixes from everything else. - Apply the Intel compatibiliy weirdness only to VMLOAD/VMSAVE (to fixup SYSENTER MSRs). - Re-remove STGI/CLGI intercept clearing in init_vmcb(). v4: - https://lore.kernel.org/all/20260228033328.2285047-1-chengkev@google.com - Dropped "KVM: SVM: Inject #UD for STGI if EFER.SVME=0 and SVM Lock and DEV are not available" as per Sean - Added back STGI and CLGI intercept clearing in init_vmcb to maintain previous behavior on intel guests. Previously intel guests always had STGI and CLGI intercepts cleared if vgif was enabled. In V3, because the clearing of the intercepts was moved from init_vmcb() to the !guest_cpuid_is_intel_compatible() case in svm_recalc_instruction_intercepts(), the CLGI intercept would be indefinitely set on intel guests. I added back the clearing to init_vmcb() to retain intel guest behavior before this patch. - In "Raise #UD if VMMCALL instruction is not intercepted" patch: - Exempt Hyper-V L2 TLB flush hypercalls from the #UD injection, as L0 intentionally intercepts these VMMCALLs on behalf of L1 via the direct hypercall enlightenment. - Added nested_svm_is_l2_tlb_flush_hcall() which just returns true if the hypercall was a Hyper-V L2 TLB flush hypercall. v3: - https://lore.kernel.org/kvm/20260122045755.205203-1-chengkev@google.com/ - Elaborated on 'Move STGI and CLGI intercept handling' commit message as per Sean - Fixed bug due to interaction with svm_enable_nmi_window() and 'Move STGI and CLGI intercept handling' as pointed out by Yosry. Code changes suggested by Sean/Yosry. - Removed open-coded nested_svm_check_permissions() in STGI interception function as per Yosry v2: - https://lore.kernel.org/all/20260112174535.3132800-1-chengkev@google.com - Split up the series into smaller more logical changes as suggested by Sean - Added patch for injecting #UD for STGI under APM defined conditions as suggested by Sean - Combined EFER.SVME=0 conditional with intel CPU logic in svm_recalc_instruction_intercepts Kevin Cheng (2): KVM: SVM: Move STGI and CLGI intercept handling KVM: SVM: Recalc instructions intercepts when EFER.SVME is toggled arch/x86/kvm/svm/svm.c | 53 +++++++++++++++++++++++++++++++----------- 1 file changed, 40 insertions(+), 13 deletions(-) base-commit: 11439c4635edd669ae435eec308f4ab8a0804808 -- 2.53.0.473.g4a7958ca14-goog