[GIT PULL] KVM: x86 pull requests for 7.2

[GIT PULL] KVM: x86 pull requests for 7.2

[Sean Christopherson]

Sorry for not getting these to you yesterday.  I was all prepared to work on
them before meetings hit, and then SQUIRREL!


Outside of these pull requests, there's a set of five selftests patches[1] that
I have sitting in "selftests_l2_stacks" and fed into linux-next.  I'm not
including a pull request for that branch, as it's deliberately built on top of
all the other local merges to avoid a pile of annoying conflicts (the changes
allocate a proper stack for all L2 vCPUs, and so touches every test that does
anything nested related).  If you can apply the patches directly after merging
the other pull requests, that would make me quite happy.  Alternatively, I'll
send a separate pull request once this batch is merged.

[1] https://lore.kernel.org/all/20260610003030.2957261-1-seanjc@google.com


There are two conflicts I am aware of; thankfully both are fairly trivial.

Internal to these pull requests, "misc" and "svm" conflict on header includes
in svm.h: take the incoming headers and the kvm_cache_regs.h => regs.h rename.

diff --cc arch/x86/kvm/svm/svm.h
index d013a5ceb62e,87c6b105deef..000000000000
--- a/arch/x86/kvm/svm/svm.h
+++ b/arch/x86/kvm/svm/svm.h
@@@ -23,7 -23,9 +23,9 @@@
  #include <asm/sev-common.h>
  
  #include "cpuid.h"
 -#include "kvm_cache_regs.h"
 +#include "regs.h"
+ #include "x86.h"
+ #include "pmu.h"
  
  /*
   * Helpers to convert to/from physical addresses for pages whose address is

Externally, the "mmu" branch will conflict with the tip tree on
arch/x86/include/asm/tdx.h.  Mark's fixup in -next[2] is what I've been using
in my local resolutions.  Basically take the KVM changes, but keep the
void tdx_sys_disable(void); declaration.

[2] https://lore.kernel.org/all/ahb-PZwR5mEd8A9W@sirena.org.uk

[GIT PULL] KVM: x86: Generic changes for 7.2

[Sean Christopherson]

The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:

  Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-generic-7.2

for you to fetch changes up to 5804f58901af77ab507e199d31dfa263404e177c:

  call_once:: Fix typo in comment for call_once() (2026-05-26 12:28:32 -0700)

----------------------------------------------------------------
KVM generic changes for 7.2

 - Rename invalidate_begin() to invalidate_start() throughout KVM to follow
   the kernel's nomenclature, e.g. for mmu_notifiers.

 - Minor cleanups.

----------------------------------------------------------------
Jiun Jeong (1):
      call_once:: Fix typo in comment for call_once()

Peter Fang (1):
      KVM: Fix kvm_vcpu_map[_readonly]() function prototypes

Takahiro Itazuri (1):
      KVM: Rename invalidate_begin to invalidate_start for consistency

 arch/x86/kvm/mmu/mmu.c    |  2 +-
 include/linux/call_once.h |  2 +-
 include/linux/kvm_host.h  | 12 ++++++------
 virt/kvm/guest_memfd.c    | 14 +++++++-------
 virt/kvm/kvm_main.c       |  6 +++---
 5 files changed, 18 insertions(+), 18 deletions(-)

[GIT PULL] KVM: x86: guest_memfd changes for 7.2

[Sean Christopherson]

Fix a few bugs found by AI (mostly by Sashiko pointing out pre-existing bugs).

The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:

  Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-gmem-7.2

for you to fetch changes up to 48dbe473219832788c3940c84faa7f1df4375d5d:

  KVM: guest_memfd: fix NUMA interleave index double-counting (2026-06-08 09:15:43 -0700)

----------------------------------------------------------------
KVM guest_memfd changes for 7.2

 - Return -EEXIST instead of -EINVAL if userspace attempts to bind a gmem
   range to multiple memslots, and fix the test that was supposed to ensure
   KVM returns -EEXIST.

 - Treat memslot binding offsets and sizes as unsigned values to fix a bug
   where KVM interprets a large "offset + size" as a negative value and allows
   a nonsensical offset.

 - Use the inode number instead of the page offset for the NUMA interleaving
   index to fix a bug where the effective index would jump by two for
   consecutive pages (the caller also adds in the page offset).

----------------------------------------------------------------
Michael S. Tsirkin (1):
      KVM: guest_memfd: fix NUMA interleave index double-counting

Sean Christopherson (4):
      KVM: selftests: Remove unnecessary "%s" formatting of a constant string
      KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
      KVM: selftests: Expand the guest_memfd test macros to allow passing the VM
      KVM: selftests: Add guest_memfd regression test signed offset+size bug

Zongyao Chen (2):
      KVM: guest_memfd: Return -EEXIST for overlapping bindings
      KVM: selftests: Test guest_memfd binding overlap without GPA overlap

 tools/testing/selftests/kvm/guest_memfd_test.c     | 24 +++++++++++++++--
 .../testing/selftests/kvm/set_memory_region_test.c | 31 +++++++++++++++++++---
 virt/kvm/guest_memfd.c                             | 16 ++++++-----
 virt/kvm/kvm_mm.h                                  |  7 +++--
 4 files changed, 63 insertions(+), 15 deletions(-)

[GIT PULL] KVM: x86: Misc changes for 7.2

[Sean Christopherson]

By patch count, the register API cleanup dominates, but the most notable change
here is the SNP and TDX hypercall return code handling from Vishal+Sagi.  To
allow userspace to tell the guest to "retry", the changes interpret the return
code from userspace as an errno value, and explicitly recognize only EAGAIN and
EINVAL.  All other errnos are now reserved.  This is a change in uABI, but as
far as we know, it won't break any VMMs that support SNP or TDX

The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:

  Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-misc-7.2

for you to fetch changes up to 65aa483f32ec674f0506658329d43403cafe5eb0:

  Documentation: KVM: Synchronize x86 VM types (2026-06-08 09:20:19 -0700)

----------------------------------------------------------------
KVM misc x86 changes for 7.2

 - Handle EXIT_FASTPATH_EXIT_USERSPACE in vendor code to ensure vendor code
   gets a chance to handle things like reaping the PML buffer.

 - Ensure KVM's copy of CR0 and CR3 are up-to-date on SVM prior to invoking
   fastpath handlers.

 - Update KVM's view of PV async enabling if and only if the MSR write fully
   succeeds.

 - Fix a variety of issues where the emulator doesn't honor guest-debug state,
   and clean up related code along the way.

 - Synthesize EPT Violation and #NPF "error code" bits when injecting faults
   into L1 that didn't originate in hardware (in which case the VMCS/VMCB
   doesn't hold relevant information).

 - Add support for virtualizing (well, emulating) AMD's flavor of CPL>0 CPUID
   faulting.

 - Clean up the GPR APIs so that KVM's use of "raw" is consistent, and fix a
   variety of minor bugs along the way.

 - Fix an OOB memory access due to not checking the VP ID when handling a
   Hyper-V PV TLB flush for L2.

 - Fix a bug in the mediated PMU's handling of fixed counters that allowed the
   guest to bypass the PMU event filter.

 - Allow userspace to return EAGAIN when handling SNP and TDX hypercalls, so
   the KVM can forward a "retry" status code to the guest, and reserve all
   unused error codes for future usage.

 - Misc fixes and cleanups.

----------------------------------------------------------------
Carlos López (2):
      KVM: x86: Take PIC lock on KVM_GET_IRQCHIP path
      Documentation: KVM: Synchronize x86 VM types

Ethan Yang (1):
      KVM: x86: Don't leave APF half-enabled on bad APF data GPA

Hou Wenlong (7):
      KVM: x86: Capture "struct x86_exception" in inject_emulated_exception()
      KVM: x86: Set guest DR6 by kvm_queue_exception_p() in instruction emulation
      KVM: x86: Honor KVM_GUESTDBG_USE_HW_BP when emulating MOV DR (in emulator)
      KVM: x86: Honor KVM_GUESTDBG_USE_HW_BP when checking for code breakpoints in emulation
      KVM: x86: Move KVM_GUESTDBG_SINGLESTEP handling into kvm_inject_emulated_db()
      KVM: selftests: Verify guest debug DR7.GD checking during instruction emulation
      KVM: selftests: Verify VMX's GUEST_PENDING_DBG_EXCEPTIONS.BS Consistency Check

Hyunwoo Kim (1):
      KVM: x86: hyper-v: Bound the bank index when querying sparse banks

Jim Mattson (4):
      KVM: x86: Prioritize CPUID faulting over CPUID VM-exits in nested VMX
      KVM: x86: Remove supports_cpuid_fault() helper
      KVM: x86: Virtualize AMD CPUID faulting
      KVM: selftests: Update hwcr_msr_test for CPUID faulting bit

Kai Huang (1):
      KVM: x86: Use <linux/lockdep.h> for lockdep header inclusion

Kevin Cheng (4):
      KVM: x86: Widen x86_exception's error_code to 64 bits
      KVM: SVM: Fix nested NPF injection of PFERR_GUEST_{PAGE,FINAL}_MASK bits
      KVM: VMX: Synthesize nested EPT violation GVA_IS_VALID/GVA_TRANSLATED bits
      KVM: selftests: Add nested page fault injection test

Krzysztof Kozlowski (1):
      MAINTAINERS: KVM: Include maintainer profile

Li RongQing (3):
      KVM: x86: Fix wrong return value type in guest_cpuid_has()
      KVM: x86: Use fls() instead of ffs() for rmaps histogram bucketing
      KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect()

Sagi Shahar (1):
      KVM: SEV: Restrict userspace return codes for KVM_HC_MAP_GPA_RANGE

Sean Christopherson (28):
      KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
      KVM: SVM: Refresh vcpu->arch.cr{0,3} prior to invoking fastpath handler
      KVM: x86: Drop superfluous caching of KVM_ASYNC_PF_DELIVERY_AS_PF_VMEXIT
      KVM: x86: Drop superfluous caching of KVM_ASYNC_PF_SEND_ALWAYS
      KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
      KVM: x86: Drop kvm_vcpu_do_singlestep() now that it's been gutted
      KVM: selftests: Add all (known) EFLAGS bit definitions
      KVM: x86: Remove unused X86EMUL_MODE_HOST define
      KVM: x86: Tell ->inject_page_fault() whether or a fault came from hardware
      KVM: x86: Consolidate CPUID fault handling for emulator and interception logic
      KVM: SVM: Truncate INVLPGA address in compatibility mode
      KVM: x86/xen: Bug the VM if 32-bit KVM observes a 64-bit mode hypercall
      KVM: x86/xen: Don't truncate RAX when handling hypercall from protected guest
      KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode
      KVM: x86: Trace hypercall register *after* truncating values for 32-bit
      KVM: x86: Rename kvm_cache_regs.h => regs.h
      KVM: x86: Move inlined GPR, CR, and DR helpers from x86.h to regs.h
      KVM: x86: Add mode-aware versions of kvm_<reg>_{read,write}() helpers
      KVM: x86: Drop non-raw kvm_<reg>_write() helpers
      KVM: nSVM: Use kvm_rax_read() now that it's mode-aware
      Revert "KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode"
      KVM: x86: Harden is_64_bit_hypercall() against bugs on 32-bit kernels
      KVM: x86: Move update_cr8_intercept() to lapic.c
      KVM: x86: Move async #PF helpers to x86.h (as inlines)
      KVM: x86: Drop defunct vcpu_tsc_khz() declaration
      KVM: x86: Remove defunct kvm_load_segment_descriptor() declaration.
      KVM: x86/pmu: Use hardware value when reprogramming for FIXED_CTR_CTRL changes
      KVM: selftests: Add regression test for mediated PMU fixed counter filter bug

Vishal Annapurve (2):
      KVM: x86: Treat KVM's virtual PMU as disabled for TDX VMs
      KVM: TDX: Allow userspace to return errors to guest for MAPGPA

 Documentation/virt/kvm/api.rst                     |   5 +
 MAINTAINERS                                        |   1 +
 arch/x86/include/asm/kvm_host.h                    |  27 +-
 arch/x86/include/asm/msr-index.h                   |   1 +
 arch/x86/kvm/cpuid.c                               |  21 +-
 arch/x86/kvm/cpuid.h                               |  20 +-
 arch/x86/kvm/debugfs.c                             |   2 +-
 arch/x86/kvm/emulate.c                             |  22 +-
 arch/x86/kvm/hyperv.c                              |  26 +-
 arch/x86/kvm/hyperv.h                              |   4 +-
 arch/x86/kvm/ioapic.c                              |   2 +-
 arch/x86/kvm/irq.c                                 |   4 +
 arch/x86/kvm/kvm_emulate.h                         |  17 +-
 arch/x86/kvm/lapic.c                               |  28 +-
 arch/x86/kvm/lapic.h                               |   1 +
 arch/x86/kvm/mmu.h                                 |   2 +-
 arch/x86/kvm/mmu/mmu.c                             |   2 +-
 arch/x86/kvm/mmu/paging_tmpl.h                     |  36 +-
 arch/x86/kvm/{kvm_cache_regs.h => regs.h}          | 198 +++++++++--
 arch/x86/kvm/smm.c                                 |   2 +-
 arch/x86/kvm/svm/nested.c                          |  46 ++-
 arch/x86/kvm/svm/sev.c                             |  12 +-
 arch/x86/kvm/svm/svm.c                             |  34 +-
 arch/x86/kvm/svm/svm.h                             |   2 +-
 arch/x86/kvm/vmx/nested.c                          |  39 ++-
 arch/x86/kvm/vmx/nested.h                          |   2 +-
 arch/x86/kvm/vmx/pmu_intel.c                       |  10 +-
 arch/x86/kvm/vmx/sgx.c                             |   6 +-
 arch/x86/kvm/vmx/tdx.c                             |  52 ++-
 arch/x86/kvm/vmx/vmx.c                             |  40 ++-
 arch/x86/kvm/vmx/vmx.h                             |   2 +-
 arch/x86/kvm/x86.c                                 | 374 +++++++++------------
 arch/x86/kvm/x86.h                                 | 134 ++------
 arch/x86/kvm/xen.c                                 |  39 ++-
 tools/testing/selftests/kvm/Makefile.kvm           |   1 +
 .../testing/selftests/kvm/include/x86/processor.h  |  29 +-
 tools/testing/selftests/kvm/lib/x86/processor.c    |   2 +-
 tools/testing/selftests/kvm/lib/x86/vmx.c          |   2 +-
 tools/testing/selftests/kvm/x86/debug_regs.c       |  88 ++++-
 tools/testing/selftests/kvm/x86/hwcr_msr_test.c    |   9 +-
 .../selftests/kvm/x86/nested_tdp_fault_test.c      | 313 +++++++++++++++++
 .../selftests/kvm/x86/pmu_event_filter_test.c      |   6 +
 42 files changed, 1116 insertions(+), 547 deletions(-)
 rename arch/x86/kvm/{kvm_cache_regs.h => regs.h} (59%)
 create mode 100644 tools/testing/selftests/kvm/x86/nested_tdp_fault_test.c

[GIT PULL] KVM: x86: MMU changes for 7.2

[Sean Christopherson]

A big overhaul of the TDP MMU => S-EPT code in prepartion for Dynamic PAMT
support.  The non-KVM changes have acks from Dave.

The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:

  Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-mmu-7.2

for you to fetch changes up to 69397c92de77525f70aa43cf3a47256cef409382:

  KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (2026-06-08 15:23:09 -0700)

----------------------------------------------------------------
KVM x86 MMU changes for 7.2

 - Use the kernel's "enum pg_level" in the TDX APIs instead of the TDX-Module's
   level definitions (which are 0-based).

 - Rework the TDX memory APIs to not require/assume that guest memory is
   backed by "struct page" (in prepartion for guest_memfd hugepage support).

 - Overhaul the TDP MMU => S-EPT code to move as much S-EPT specific logic as
   possible into the TDX code, and to funnel (almost) all S-EPT updates into
   a single chokepoint.  The motivation is largely to prepare for upcoming
   Dynamic PAMT support, but the cleanups are nice to have on their own.

 - Plug a hole in the shadow MMU where KVM fails to recursively zap nested TDP
   shadow when L1 is tearing its TDP page tables from the bottom up, as KVM's
   TDP MMU now does.

----------------------------------------------------------------
Rick Edgecombe (4):
      KVM: TDX: Move KVM_BUG_ON()s in __tdp_mmu_set_spte_atomic() to TDX code
      KVM: TDX: Move lockdep assert in __tdp_mmu_set_spte_atomic() to TDX code
      KVM: x86/tdp_mmu: Morph !is_frozen_spte() check into a KVM_MMU_WARN_ON()
      KVM: x86/mmu: Drop KVM_BUG_ON() on shared lock to zap child external PTEs

Sean Christopherson (17):
      x86/tdx: Use pg_level in TDX APIs, not the TDX-Module's 0-based level
      KVM: x86/mmu: Update iter->old_spte if cmpxchg64 on mirror SPTE "fails"
      KVM: TDX: Account all non-transient page allocations for per-TD structures
      KVM: x86: Make "external SPTE" ops that can fail RET0 static calls
      x86/tdx: Use PFN directly for mapping guest private memory
      x86/tdx: Use PFN directly for unmapping guest private memory
      KVM: TDX: Drop kvm_x86_ops.link_external_spt()
      KVM: TDX: Wrap mapping of leaf and non-leaf S-EPT entries into helpers
      KVM: x86/mmu: Fold set_external_spte_present() into its sole caller
      KVM: x86/mmu: Plumb param "old_spte" into kvm_x86_ops.set_external_spte()
      KVM: x86/mmu: Plumb "sp" _pointer_ into the TDP MMU's handle_changed_spte()
      KVM: x86/tdp_mmu: Centrally propagate to-present/atomic zap updates to external PTEs
      KVM: TDX: Hoist tdx_sept_remove_private_spte() above set_private_spte()
      KVM: TDX: Drop kvm_x86_ops.remove_external_spte()
      KVM: x86: Move error handling inside free_external_spt()
      KVM: TDX: Move external page table freeing to TDX code
      KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes

Yan Zhao (3):
      x86/tdx: Drop exported function tdx_quirk_reset_page()
      x86/virt/tdx: Move mk_keyed_paddr() to tdx.c due to no external users
      KVM: TDX: Rename tdx_sept_remove_private_spte() to show it's for leaf SPTEs

 arch/x86/include/asm/kvm-x86-ops.h |   4 +-
 arch/x86/include/asm/kvm_host.h    |  13 +-
 arch/x86/include/asm/tdx.h         |  34 ++---
 arch/x86/kvm/mmu/mmu.c             |   2 +-
 arch/x86/kvm/mmu/tdp_mmu.c         | 275 ++++++++++++++++---------------------
 arch/x86/kvm/vmx/tdx.c             | 208 +++++++++++++++++-----------
 arch/x86/virt/vmx/tdx/tdx.c        |  64 +++++----
 7 files changed, 302 insertions(+), 298 deletions(-)

[GIT PULL] KVM: x86: Selftests changes for 7.2

[Sean Christopherson]

Pretty much everything here is a one-off fix/cleanup of some kind.

The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:

  Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-selftests-7.2

for you to fetch changes up to 5bd0387e3b56f7e0a81386f6d0a5fa2c3a92ad5d:

  KVM: selftests: hyperv_features: test write of 1 to HV_X64_MSR_RESET (2026-05-26 12:30:50 -0700)

----------------------------------------------------------------
KVM selftests changes for 7.2

 - Randomize the dirty log test's delay when reaping the bitmap on the first
   pass, as always waiting only 1ms hid a KVM RISC-V bug as the test reaped the
   bitmap before KVM could build up enough state to hit the bug.

 - A pile of one-off fixes and cleanups.

----------------------------------------------------------------
Mayuresh Chitale (1):
      KVM: selftests: memslot_perf_test: make host wait timeout configurable

Piotr Zarycki (4):
      KVM: selftests: sync_regs_test: drop stale TODO comment
      KVM: selftests: Fix typo in comment in hyperv_features.c
      KVM: selftests: hyperv_tlb_flush: replace NOP loop with udelay()
      KVM: selftests: hyperv_features: test write of 1 to HV_X64_MSR_RESET

Sean Christopherson (3):
      KVM: selftests: Cast guest_memfd fd to a signed int when checking for >= 0
      KVM: selftests: Add and use kvm_free_fd() to harden against fd goofs
      KVM: selftests: Randomize dirty_log_test's delay before reaping the bitmap

Zongyao Chen (1):
      KVM: selftests: Fix vcpu_get_stats_fd() ioctl name

 tools/testing/selftests/kvm/dirty_log_test.c       | 26 +++++++++++++++++-----
 tools/testing/selftests/kvm/include/kvm_syscalls.h |  6 +++++
 tools/testing/selftests/kvm/include/kvm_util.h     |  2 +-
 tools/testing/selftests/kvm/lib/kvm_util.c         | 25 ++++++++++-----------
 tools/testing/selftests/kvm/memslot_perf_test.c    | 12 +++++++---
 tools/testing/selftests/kvm/x86/hyperv_features.c  | 21 ++++++++++-------
 tools/testing/selftests/kvm/x86/hyperv_tlb_flush.c | 15 ++-----------
 tools/testing/selftests/kvm/x86/sync_regs_test.c   |  1 -
 8 files changed, 63 insertions(+), 45 deletions(-)

[GIT PULL] KVM: x86: SEV changes for 7.2

[Sean Christopherson]

Teach KVM not to advertise VM types that the system can't actually support,
rewrite the {de,en}crypt memory code, and fix two pre-existing bugs found by
Sashiko.

The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:

  Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-sev-7.2

for you to fetch changes up to 97cd21d57e9bd2da79845178d9250cfd19289cd4:

  KVM: SEV: Mark source page dirty when writing back CPUID data on failure (2026-05-26 09:56:36 -0700)

----------------------------------------------------------------
KVM SEV changes for 7.2

 - Don't advertise support for unusuable VM types, and account for VM types
   that are disabled by firmware, e.g. to mitigate security vulnerabilities.

 - Rewrite the SEV {en,de}crypt debug ioctls as they were riddle with bugs and
   unnecessarily complicated, and add comprehensive tests.

 - Clean up and deduplicate the SEV page pinning code.

 - Fix minor goofs related to writing back CPUID information after firmware
   rejects a CPUID page for an SNP vCPU.

----------------------------------------------------------------
Ackerley Tng (2):
      KVM: SEV: Unmap local kmaps in LIFO order, per highmem requirements
      KVM: SEV: Mark source page dirty when writing back CPUID data on failure

Ashutosh Desai (1):
      KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path

Sean Christopherson (9):
      KVM: SEV: Set supported SEV+ VM types during sev_hardware_setup()
      KVM: SEV: Consolidate logic for printing state of SEV{,-ES,-SNP} enabling
      KVM: SEV: Don't advertise support for unusable VM types
      KVM: selftests: Add a test to verify SEV {en,de}crypt debug ioctls
      KVM: SEV: Explicitly validate the dst buffer for debug operations
      KVM: SEV: Add helper function to pin/unpin a single page
      KVM: SEV: Rewrite logic to {de,en}crypt memory for debug
      KVM: SEV: Allocate only as many bytes as needed for temp crypt buffers
      KVM: SEV: Pin source page for write when adding CPUID data for SNP guest

Tycho Andersen (4):
      crypto/ccp: hoist kernel part of SNP_PLATFORM_STATUS
      crypto/ccp: export firmware supported vm types
      KVM: SEV: Don't advertise VM types that are disabled by firmware
      KVM: selftests: Teach sev_*_test about revoking VM types

 arch/x86/kvm/svm/sev.c                             | 469 ++++++++++-----------
 arch/x86/kvm/vmx/tdx.c                             |   2 +-
 drivers/crypto/ccp/sev-dev.c                       | 101 ++++-
 include/linux/kvm_host.h                           |   3 +-
 include/linux/psp-sev.h                            |  37 ++
 tools/testing/selftests/kvm/Makefile.kvm           |   1 +
 tools/testing/selftests/kvm/include/x86/sev.h      |  24 ++
 tools/testing/selftests/kvm/x86/sev_dbg_test.c     | 118 ++++++
 tools/testing/selftests/kvm/x86/sev_init2_tests.c  |  14 +-
 .../testing/selftests/kvm/x86/sev_migrate_tests.c  |   2 +-
 tools/testing/selftests/kvm/x86/sev_smoke_test.c   |   4 +-
 virt/kvm/guest_memfd.c                             |   6 +-
 12 files changed, 521 insertions(+), 260 deletions(-)
 create mode 100644 tools/testing/selftests/kvm/x86/sev_dbg_test.c

[GIT PULL] KVM: x86: SVM changes for 7.2

[Sean Christopherson]

Nested SVM is again the main theme this cycle.  I think this is the last of the
changes? Barring one-offs that will inevitably meander in.

Note, there's no new capability or anything to enumerate support for Host-Only
and Guest-Only PMC support, which is sketchy, but I think is fine?  Because
AFAICT, there's no way for hardware to communicate support, i.e. software just
has to assume it's there.

The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:

  Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-svm-7.2

for you to fetch changes up to adeb462cecae964ae4525512e31d54e545539476:

  KVM: selftests: Add a test for gPAT handling in L2 (2026-06-03 05:42:35 -0700)

----------------------------------------------------------------
KVM SVN changes for 7.2

 - Add support for virtualizing gPAT (KVM previously just used L1's PAT when
   running L2).

 - Fix goofs where KVM mishandles side effects (e.g. single-step and PMC
   updates) when emulating VMRUN.

 - Fix a variety of bugs in AVIC's handling of x2APIC MSR interception, most
   notably where KVM didn't disable interception of IRR, ISR, and TMR regs.

 - Add support for virtualizing Host-Only/Guest-Only bits in the mediated PMU.

----------------------------------------------------------------
Jim Mattson (9):
      KVM: x86: Define KVM_X86_QUIRK_NESTED_SVM_SHARED_PAT
      KVM: x86: nSVM: Clear VMCB_NPT clean bit when updating hPAT from guest mode
      KVM: x86: nSVM: Cache and validate vmcb12 g_pat
      KVM: x86: nSVM: Set vmcb02.g_pat correctly for nested NPT
      KVM: x86: nSVM: Redirect IA32_PAT accesses to either hPAT or gPAT
      KVM: x86: nSVM: Save gPAT to vmcb12.g_pat on VMEXIT
      KVM: Documentation: document KVM_{GET,SET}_NESTED_STATE for SVM
      KVM: x86: nSVM: Save/restore gPAT with KVM_{GET,SET}_NESTED_STATE
      KVM: x86/pmu: Allow Host-Only/Guest-Only bits with nSVM and mediated PMU

Sean Christopherson (3):
      KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs
      KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports
      KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated

Yosry Ahmed (13):
      KVM: nSVM: Stop leaking single-stepping on VMRUN into L2
      KVM: nSVM: Bail early out of VMRUN emulation if advancing RIP fails
      KVM: nSVM: Unify RIP and PMU handling calls when emulating VMRUN
      KVM: nSVM: Move VMRUN instruction retirement after entering guest mode
      KVM: x86: Move enable_pmu/enable_mediated_pmu to pmu.h and pmu.c
      KVM: x86/pmu: Rename reprogram_counters() to clarify usage
      KVM: x86/pmu: Do a single atomic OR when reprogramming counters
      KVM: x86/pmu: Check mediated PMU counter enablement before event filters
      KVM: x86/pmu: Add support for KVM_X86_PMU_OP_OPTIONAL_RET0
      KVM: x86/pmu: Disable counters based on Host-Only/Guest-Only bits in SVM
      KVM: x86/pmu: Track mediated PMU counters with mode-specific enables
      KVM: x86/pmu: Reprogram Host/Guest-Only counters on nested transitions
      KVM: selftests: Add a test for gPAT handling in L2

 Documentation/virt/kvm/api.rst                     |  26 +++
 arch/x86/include/asm/kvm-x86-pmu-ops.h             |   5 +-
 arch/x86/include/asm/kvm_host.h                    |   6 +-
 arch/x86/include/asm/perf_event.h                  |   2 +
 arch/x86/include/uapi/asm/kvm.h                    |   2 +
 arch/x86/kvm/lapic.c                               |  21 ++-
 arch/x86/kvm/lapic.h                               |   2 +-
 arch/x86/kvm/pmu.c                                 |  21 ++-
 arch/x86/kvm/pmu.h                                 |  44 ++++-
 arch/x86/kvm/svm/avic.c                            |  47 ++---
 arch/x86/kvm/svm/nested.c                          | 107 ++++++++---
 arch/x86/kvm/svm/pmu.c                             |  42 +++++
 arch/x86/kvm/svm/svm.c                             |  40 ++++-
 arch/x86/kvm/svm/svm.h                             |  44 ++++-
 arch/x86/kvm/vmx/pmu_intel.c                       |   2 +-
 arch/x86/kvm/vmx/vmx.c                             |   3 +-
 arch/x86/kvm/x86.c                                 |   9 -
 arch/x86/kvm/x86.h                                 |   3 -
 tools/testing/selftests/kvm/Makefile.kvm           |   1 +
 .../selftests/kvm/x86/svm_nested_pat_test.c        | 196 +++++++++++++++++++++
 20 files changed, 525 insertions(+), 98 deletions(-)
 create mode 100644 tools/testing/selftests/kvm/x86/svm_nested_pat_test.c

[GIT PULL] KVM: VFIO changes for 7.2

[Sean Christopherson]

The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:

  Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-vfio-7.2

for you to fetch changes up to 156615264fd3430e7f90b36f46076b2f6ec4a24a:

  KVM: VFIO: update coherency only if file was deleted (2026-05-13 11:12:40 -0700)

----------------------------------------------------------------
KVM VFIO changes for 7.2

Use guard() to cleanup up various KVM+VFIO flows.

----------------------------------------------------------------
Carlos López (4):
      KVM: VFIO: clean up control flow in kvm_vfio_file_add()
      KVM: VFIO: use mutex guard in kvm_vfio_file_set_spapr_tce()
      KVM: VFIO: deduplicate file release logic
      KVM: VFIO: update coherency only if file was deleted

 virt/kvm/vfio.c | 98 +++++++++++++++++++++------------------------------------
 1 file changed, 35 insertions(+), 63 deletions(-)

[GIT PULL] KVM: x86: VMX changes for 7.2

[Sean Christopherson]

The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:

  Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-vmx-7.2

for you to fetch changes up to ca674df13b195eb6d124ab059799d4e03fa40624:

  KVM: VMX: Handle bad values on proxied writes to LBR MSRs (2026-05-27 16:41:51 -0700)

----------------------------------------------------------------
KVM VMX changes for 7.2

 - Fix a largely benign bug where KVM TDX would incorrectly state it could
   emulate several x2APIC MSRs.

 - Use the "safe" WRMSR API when proxying LBR MSR writes as the to-be-written
   value is guest controlled and completely unvalidated.

----------------------------------------------------------------
Rick Edgecombe (1):
      KVM: TDX: Fix x2APIC MSR handling in tdx_has_emulated_msr()

Xuanqing Shi (1):
      KVM: VMX: Handle bad values on proxied writes to LBR MSRs

 arch/x86/kvm/vmx/pmu_intel.c |  6 ++++--
 arch/x86/kvm/vmx/tdx.c       | 38 ++++++++++++++++++++++----------------
 2 files changed, 26 insertions(+), 18 deletions(-)

Re: [GIT PULL] KVM: x86: Generic changes for 7.2

[Paolo Bonzini]

On Fri, Jun 12, 2026 at 2:48 AM Sean Christopherson <seanjc@google.com> wrote:
>
> The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:
>
>   Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)
>
> are available in the Git repository at:
>
>   https://github.com/kvm-x86/linux.git tags/kvm-x86-generic-7.2
>
> for you to fetch changes up to 5804f58901af77ab507e199d31dfa263404e177c:
>
>   call_once:: Fix typo in comment for call_once() (2026-05-26 12:28:32 -0700)

Pulled, thanks.

Paolo

>
> ----------------------------------------------------------------
> KVM generic changes for 7.2
>
>  - Rename invalidate_begin() to invalidate_start() throughout KVM to follow
>    the kernel's nomenclature, e.g. for mmu_notifiers.
>
>  - Minor cleanups.
>
> ----------------------------------------------------------------
> Jiun Jeong (1):
>       call_once:: Fix typo in comment for call_once()
>
> Peter Fang (1):
>       KVM: Fix kvm_vcpu_map[_readonly]() function prototypes
>
> Takahiro Itazuri (1):
>       KVM: Rename invalidate_begin to invalidate_start for consistency
>
>  arch/x86/kvm/mmu/mmu.c    |  2 +-
>  include/linux/call_once.h |  2 +-
>  include/linux/kvm_host.h  | 12 ++++++------
>  virt/kvm/guest_memfd.c    | 14 +++++++-------
>  virt/kvm/kvm_main.c       |  6 +++---
>  5 files changed, 18 insertions(+), 18 deletions(-)
>

Re: [GIT PULL] KVM: x86: guest_memfd changes for 7.2

[Paolo Bonzini]

On Fri, Jun 12, 2026 at 2:48 AM Sean Christopherson <seanjc@google.com> wrote:
>
> Fix a few bugs found by AI (mostly by Sashiko pointing out pre-existing bugs).
>
> The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:
>
>   Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)
>
> are available in the Git repository at:
>
>   https://github.com/kvm-x86/linux.git tags/kvm-x86-gmem-7.2
>
> for you to fetch changes up to 48dbe473219832788c3940c84faa7f1df4375d5d:
>
>   KVM: guest_memfd: fix NUMA interleave index double-counting (2026-06-08 09:15:43 -0700)

Pulled, thanks.

Paolo

> ----------------------------------------------------------------
> KVM guest_memfd changes for 7.2
>
>  - Return -EEXIST instead of -EINVAL if userspace attempts to bind a gmem
>    range to multiple memslots, and fix the test that was supposed to ensure
>    KVM returns -EEXIST.
>
>  - Treat memslot binding offsets and sizes as unsigned values to fix a bug
>    where KVM interprets a large "offset + size" as a negative value and allows
>    a nonsensical offset.
>
>  - Use the inode number instead of the page offset for the NUMA interleaving
>    index to fix a bug where the effective index would jump by two for
>    consecutive pages (the caller also adds in the page offset).
>
> ----------------------------------------------------------------
> Michael S. Tsirkin (1):
>       KVM: guest_memfd: fix NUMA interleave index double-counting
>
> Sean Christopherson (4):
>       KVM: selftests: Remove unnecessary "%s" formatting of a constant string
>       KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
>       KVM: selftests: Expand the guest_memfd test macros to allow passing the VM
>       KVM: selftests: Add guest_memfd regression test signed offset+size bug
>
> Zongyao Chen (2):
>       KVM: guest_memfd: Return -EEXIST for overlapping bindings
>       KVM: selftests: Test guest_memfd binding overlap without GPA overlap
>
>  tools/testing/selftests/kvm/guest_memfd_test.c     | 24 +++++++++++++++--
>  .../testing/selftests/kvm/set_memory_region_test.c | 31 +++++++++++++++++++---
>  virt/kvm/guest_memfd.c                             | 16 ++++++-----
>  virt/kvm/kvm_mm.h                                  |  7 +++--
>  4 files changed, 63 insertions(+), 15 deletions(-)
>

Re: [GIT PULL] KVM: x86: Selftests changes for 7.2

[Paolo Bonzini]

Pulled, thanks.

Paolo

On Fri, Jun 12, 2026 at 2:48 AM Sean Christopherson <seanjc@google.com> wrote:
>
> Pretty much everything here is a one-off fix/cleanup of some kind.
>
> The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:
>
>   Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)
>
> are available in the Git repository at:
>
>   https://github.com/kvm-x86/linux.git tags/kvm-x86-selftests-7.2
>
> for you to fetch changes up to 5bd0387e3b56f7e0a81386f6d0a5fa2c3a92ad5d:
>
>   KVM: selftests: hyperv_features: test write of 1 to HV_X64_MSR_RESET (2026-05-26 12:30:50 -0700)
>
> ----------------------------------------------------------------
> KVM selftests changes for 7.2
>
>  - Randomize the dirty log test's delay when reaping the bitmap on the first
>    pass, as always waiting only 1ms hid a KVM RISC-V bug as the test reaped the
>    bitmap before KVM could build up enough state to hit the bug.
>
>  - A pile of one-off fixes and cleanups.
>
> ----------------------------------------------------------------
> Mayuresh Chitale (1):
>       KVM: selftests: memslot_perf_test: make host wait timeout configurable
>
> Piotr Zarycki (4):
>       KVM: selftests: sync_regs_test: drop stale TODO comment
>       KVM: selftests: Fix typo in comment in hyperv_features.c
>       KVM: selftests: hyperv_tlb_flush: replace NOP loop with udelay()
>       KVM: selftests: hyperv_features: test write of 1 to HV_X64_MSR_RESET
>
> Sean Christopherson (3):
>       KVM: selftests: Cast guest_memfd fd to a signed int when checking for >= 0
>       KVM: selftests: Add and use kvm_free_fd() to harden against fd goofs
>       KVM: selftests: Randomize dirty_log_test's delay before reaping the bitmap
>
> Zongyao Chen (1):
>       KVM: selftests: Fix vcpu_get_stats_fd() ioctl name
>
>  tools/testing/selftests/kvm/dirty_log_test.c       | 26 +++++++++++++++++-----
>  tools/testing/selftests/kvm/include/kvm_syscalls.h |  6 +++++
>  tools/testing/selftests/kvm/include/kvm_util.h     |  2 +-
>  tools/testing/selftests/kvm/lib/kvm_util.c         | 25 ++++++++++-----------
>  tools/testing/selftests/kvm/memslot_perf_test.c    | 12 +++++++---
>  tools/testing/selftests/kvm/x86/hyperv_features.c  | 21 ++++++++++-------
>  tools/testing/selftests/kvm/x86/hyperv_tlb_flush.c | 15 ++-----------
>  tools/testing/selftests/kvm/x86/sync_regs_test.c   |  1 -
>  8 files changed, 63 insertions(+), 45 deletions(-)
>

Re: [GIT PULL] KVM: x86: SEV changes for 7.2

[Paolo Bonzini]

On Fri, Jun 12, 2026 at 2:48 AM Sean Christopherson <seanjc@google.com> wrote:
>
> Teach KVM not to advertise VM types that the system can't actually support,
> rewrite the {de,en}crypt memory code, and fix two pre-existing bugs found by
> Sashiko.
>
> The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:
>
>   Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)
>
> are available in the Git repository at:
>
>   https://github.com/kvm-x86/linux.git tags/kvm-x86-sev-7.2
>
> for you to fetch changes up to 97cd21d57e9bd2da79845178d9250cfd19289cd4:
>
>   KVM: SEV: Mark source page dirty when writing back CPUID data on failure (2026-05-26 09:56:36 -0700)

Pulled, thanks.

Paolo

> ----------------------------------------------------------------
> KVM SEV changes for 7.2
>
>  - Don't advertise support for unusuable VM types, and account for VM types
>    that are disabled by firmware, e.g. to mitigate security vulnerabilities.
>
>  - Rewrite the SEV {en,de}crypt debug ioctls as they were riddle with bugs and
>    unnecessarily complicated, and add comprehensive tests.
>
>  - Clean up and deduplicate the SEV page pinning code.
>
>  - Fix minor goofs related to writing back CPUID information after firmware
>    rejects a CPUID page for an SNP vCPU.
>
> ----------------------------------------------------------------
> Ackerley Tng (2):
>       KVM: SEV: Unmap local kmaps in LIFO order, per highmem requirements
>       KVM: SEV: Mark source page dirty when writing back CPUID data on failure
>
> Ashutosh Desai (1):
>       KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
>
> Sean Christopherson (9):
>       KVM: SEV: Set supported SEV+ VM types during sev_hardware_setup()
>       KVM: SEV: Consolidate logic for printing state of SEV{,-ES,-SNP} enabling
>       KVM: SEV: Don't advertise support for unusable VM types
>       KVM: selftests: Add a test to verify SEV {en,de}crypt debug ioctls
>       KVM: SEV: Explicitly validate the dst buffer for debug operations
>       KVM: SEV: Add helper function to pin/unpin a single page
>       KVM: SEV: Rewrite logic to {de,en}crypt memory for debug
>       KVM: SEV: Allocate only as many bytes as needed for temp crypt buffers
>       KVM: SEV: Pin source page for write when adding CPUID data for SNP guest
>
> Tycho Andersen (4):
>       crypto/ccp: hoist kernel part of SNP_PLATFORM_STATUS
>       crypto/ccp: export firmware supported vm types
>       KVM: SEV: Don't advertise VM types that are disabled by firmware
>       KVM: selftests: Teach sev_*_test about revoking VM types
>
>  arch/x86/kvm/svm/sev.c                             | 469 ++++++++++-----------
>  arch/x86/kvm/vmx/tdx.c                             |   2 +-
>  drivers/crypto/ccp/sev-dev.c                       | 101 ++++-
>  include/linux/kvm_host.h                           |   3 +-
>  include/linux/psp-sev.h                            |  37 ++
>  tools/testing/selftests/kvm/Makefile.kvm           |   1 +
>  tools/testing/selftests/kvm/include/x86/sev.h      |  24 ++
>  tools/testing/selftests/kvm/x86/sev_dbg_test.c     | 118 ++++++
>  tools/testing/selftests/kvm/x86/sev_init2_tests.c  |  14 +-
>  .../testing/selftests/kvm/x86/sev_migrate_tests.c  |   2 +-
>  tools/testing/selftests/kvm/x86/sev_smoke_test.c   |   4 +-
>  virt/kvm/guest_memfd.c                             |   6 +-
>  12 files changed, 521 insertions(+), 260 deletions(-)
>  create mode 100644 tools/testing/selftests/kvm/x86/sev_dbg_test.c
>

Re: [GIT PULL] KVM: x86: Misc changes for 7.2

[Paolo Bonzini]

On Fri, Jun 12, 2026 at 2:48 AM Sean Christopherson <seanjc@google.com> wrote:
>
> By patch count, the register API cleanup dominates, but the most notable change
> here is the SNP and TDX hypercall return code handling from Vishal+Sagi.  To
> allow userspace to tell the guest to "retry", the changes interpret the return
> code from userspace as an errno value, and explicitly recognize only EAGAIN and
> EINVAL.  All other errnos are now reserved.  This is a change in uABI, but as
> far as we know, it won't break any VMMs that support SNP or TDX
>
> The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:
>
>   Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)
>
> are available in the Git repository at:
>
>   https://github.com/kvm-x86/linux.git tags/kvm-x86-misc-7.2
>
> for you to fetch changes up to 65aa483f32ec674f0506658329d43403cafe5eb0:
>
>   Documentation: KVM: Synchronize x86 VM types (2026-06-08 09:20:19 -0700)
>
> ----------------------------------------------------------------
> KVM misc x86 changes for 7.2
>
>  - Handle EXIT_FASTPATH_EXIT_USERSPACE in vendor code to ensure vendor code
>    gets a chance to handle things like reaping the PML buffer.
>
>  - Ensure KVM's copy of CR0 and CR3 are up-to-date on SVM prior to invoking
>    fastpath handlers.
>
>  - Update KVM's view of PV async enabling if and only if the MSR write fully
>    succeeds.
>
>  - Fix a variety of issues where the emulator doesn't honor guest-debug state,
>    and clean up related code along the way.
>
>  - Synthesize EPT Violation and #NPF "error code" bits when injecting faults
>    into L1 that didn't originate in hardware (in which case the VMCS/VMCB
>    doesn't hold relevant information).
>
>  - Add support for virtualizing (well, emulating) AMD's flavor of CPL>0 CPUID
>    faulting.
>
>  - Clean up the GPR APIs so that KVM's use of "raw" is consistent, and fix a
>    variety of minor bugs along the way.
>
>  - Fix an OOB memory access due to not checking the VP ID when handling a
>    Hyper-V PV TLB flush for L2.
>
>  - Fix a bug in the mediated PMU's handling of fixed counters that allowed the
>    guest to bypass the PMU event filter.
>
>  - Allow userspace to return EAGAIN when handling SNP and TDX hypercalls, so
>    the KVM can forward a "retry" status code to the guest, and reserve all
>    unused error codes for future usage.
>
>  - Misc fixes and cleanups.
>
> ----------------------------------------------------------------

Pulled, thanks.

Paolo

> Carlos López (2):
>       KVM: x86: Take PIC lock on KVM_GET_IRQCHIP path
>       Documentation: KVM: Synchronize x86 VM types
>
> Ethan Yang (1):
>       KVM: x86: Don't leave APF half-enabled on bad APF data GPA
>
> Hou Wenlong (7):
>       KVM: x86: Capture "struct x86_exception" in inject_emulated_exception()
>       KVM: x86: Set guest DR6 by kvm_queue_exception_p() in instruction emulation
>       KVM: x86: Honor KVM_GUESTDBG_USE_HW_BP when emulating MOV DR (in emulator)
>       KVM: x86: Honor KVM_GUESTDBG_USE_HW_BP when checking for code breakpoints in emulation
>       KVM: x86: Move KVM_GUESTDBG_SINGLESTEP handling into kvm_inject_emulated_db()
>       KVM: selftests: Verify guest debug DR7.GD checking during instruction emulation
>       KVM: selftests: Verify VMX's GUEST_PENDING_DBG_EXCEPTIONS.BS Consistency Check
>
> Hyunwoo Kim (1):
>       KVM: x86: hyper-v: Bound the bank index when querying sparse banks
>
> Jim Mattson (4):
>       KVM: x86: Prioritize CPUID faulting over CPUID VM-exits in nested VMX
>       KVM: x86: Remove supports_cpuid_fault() helper
>       KVM: x86: Virtualize AMD CPUID faulting
>       KVM: selftests: Update hwcr_msr_test for CPUID faulting bit
>
> Kai Huang (1):
>       KVM: x86: Use <linux/lockdep.h> for lockdep header inclusion
>
> Kevin Cheng (4):
>       KVM: x86: Widen x86_exception's error_code to 64 bits
>       KVM: SVM: Fix nested NPF injection of PFERR_GUEST_{PAGE,FINAL}_MASK bits
>       KVM: VMX: Synthesize nested EPT violation GVA_IS_VALID/GVA_TRANSLATED bits
>       KVM: selftests: Add nested page fault injection test
>
> Krzysztof Kozlowski (1):
>       MAINTAINERS: KVM: Include maintainer profile
>
> Li RongQing (3):
>       KVM: x86: Fix wrong return value type in guest_cpuid_has()
>       KVM: x86: Use fls() instead of ffs() for rmaps histogram bucketing
>       KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect()
>
> Sagi Shahar (1):
>       KVM: SEV: Restrict userspace return codes for KVM_HC_MAP_GPA_RANGE
>
> Sean Christopherson (28):
>       KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
>       KVM: SVM: Refresh vcpu->arch.cr{0,3} prior to invoking fastpath handler
>       KVM: x86: Drop superfluous caching of KVM_ASYNC_PF_DELIVERY_AS_PF_VMEXIT
>       KVM: x86: Drop superfluous caching of KVM_ASYNC_PF_SEND_ALWAYS
>       KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
>       KVM: x86: Drop kvm_vcpu_do_singlestep() now that it's been gutted
>       KVM: selftests: Add all (known) EFLAGS bit definitions
>       KVM: x86: Remove unused X86EMUL_MODE_HOST define
>       KVM: x86: Tell ->inject_page_fault() whether or a fault came from hardware
>       KVM: x86: Consolidate CPUID fault handling for emulator and interception logic
>       KVM: SVM: Truncate INVLPGA address in compatibility mode
>       KVM: x86/xen: Bug the VM if 32-bit KVM observes a 64-bit mode hypercall
>       KVM: x86/xen: Don't truncate RAX when handling hypercall from protected guest
>       KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode
>       KVM: x86: Trace hypercall register *after* truncating values for 32-bit
>       KVM: x86: Rename kvm_cache_regs.h => regs.h
>       KVM: x86: Move inlined GPR, CR, and DR helpers from x86.h to regs.h
>       KVM: x86: Add mode-aware versions of kvm_<reg>_{read,write}() helpers
>       KVM: x86: Drop non-raw kvm_<reg>_write() helpers
>       KVM: nSVM: Use kvm_rax_read() now that it's mode-aware
>       Revert "KVM: VMX: Read 32-bit GPR values for ENCLS instructions outside of 64-bit mode"
>       KVM: x86: Harden is_64_bit_hypercall() against bugs on 32-bit kernels
>       KVM: x86: Move update_cr8_intercept() to lapic.c
>       KVM: x86: Move async #PF helpers to x86.h (as inlines)
>       KVM: x86: Drop defunct vcpu_tsc_khz() declaration
>       KVM: x86: Remove defunct kvm_load_segment_descriptor() declaration.
>       KVM: x86/pmu: Use hardware value when reprogramming for FIXED_CTR_CTRL changes
>       KVM: selftests: Add regression test for mediated PMU fixed counter filter bug
>
> Vishal Annapurve (2):
>       KVM: x86: Treat KVM's virtual PMU as disabled for TDX VMs
>       KVM: TDX: Allow userspace to return errors to guest for MAPGPA
>
>  Documentation/virt/kvm/api.rst                     |   5 +
>  MAINTAINERS                                        |   1 +
>  arch/x86/include/asm/kvm_host.h                    |  27 +-
>  arch/x86/include/asm/msr-index.h                   |   1 +
>  arch/x86/kvm/cpuid.c                               |  21 +-
>  arch/x86/kvm/cpuid.h                               |  20 +-
>  arch/x86/kvm/debugfs.c                             |   2 +-
>  arch/x86/kvm/emulate.c                             |  22 +-
>  arch/x86/kvm/hyperv.c                              |  26 +-
>  arch/x86/kvm/hyperv.h                              |   4 +-
>  arch/x86/kvm/ioapic.c                              |   2 +-
>  arch/x86/kvm/irq.c                                 |   4 +
>  arch/x86/kvm/kvm_emulate.h                         |  17 +-
>  arch/x86/kvm/lapic.c                               |  28 +-
>  arch/x86/kvm/lapic.h                               |   1 +
>  arch/x86/kvm/mmu.h                                 |   2 +-
>  arch/x86/kvm/mmu/mmu.c                             |   2 +-
>  arch/x86/kvm/mmu/paging_tmpl.h                     |  36 +-
>  arch/x86/kvm/{kvm_cache_regs.h => regs.h}          | 198 +++++++++--
>  arch/x86/kvm/smm.c                                 |   2 +-
>  arch/x86/kvm/svm/nested.c                          |  46 ++-
>  arch/x86/kvm/svm/sev.c                             |  12 +-
>  arch/x86/kvm/svm/svm.c                             |  34 +-
>  arch/x86/kvm/svm/svm.h                             |   2 +-
>  arch/x86/kvm/vmx/nested.c                          |  39 ++-
>  arch/x86/kvm/vmx/nested.h                          |   2 +-
>  arch/x86/kvm/vmx/pmu_intel.c                       |  10 +-
>  arch/x86/kvm/vmx/sgx.c                             |   6 +-
>  arch/x86/kvm/vmx/tdx.c                             |  52 ++-
>  arch/x86/kvm/vmx/vmx.c                             |  40 ++-
>  arch/x86/kvm/vmx/vmx.h                             |   2 +-
>  arch/x86/kvm/x86.c                                 | 374 +++++++++------------
>  arch/x86/kvm/x86.h                                 | 134 ++------
>  arch/x86/kvm/xen.c                                 |  39 ++-
>  tools/testing/selftests/kvm/Makefile.kvm           |   1 +
>  .../testing/selftests/kvm/include/x86/processor.h  |  29 +-
>  tools/testing/selftests/kvm/lib/x86/processor.c    |   2 +-
>  tools/testing/selftests/kvm/lib/x86/vmx.c          |   2 +-
>  tools/testing/selftests/kvm/x86/debug_regs.c       |  88 ++++-
>  tools/testing/selftests/kvm/x86/hwcr_msr_test.c    |   9 +-
>  .../selftests/kvm/x86/nested_tdp_fault_test.c      | 313 +++++++++++++++++
>  .../selftests/kvm/x86/pmu_event_filter_test.c      |   6 +
>  42 files changed, 1116 insertions(+), 547 deletions(-)
>  rename arch/x86/kvm/{kvm_cache_regs.h => regs.h} (59%)
>  create mode 100644 tools/testing/selftests/kvm/x86/nested_tdp_fault_test.c
>

Re: [GIT PULL] KVM: x86: MMU changes for 7.2

[Paolo Bonzini]

On Fri, Jun 12, 2026 at 2:48 AM Sean Christopherson <seanjc@google.com> wrote:
>
> A big overhaul of the TDP MMU => S-EPT code in prepartion for Dynamic PAMT
> support.  The non-KVM changes have acks from Dave.
>
> The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:
>
>   Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)
>
> are available in the Git repository at:
>
>   https://github.com/kvm-x86/linux.git tags/kvm-x86-mmu-7.2
>
> for you to fetch changes up to 69397c92de77525f70aa43cf3a47256cef409382:
>
>   KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (2026-06-08 15:23:09 -0700)
>
> ----------------------------------------------------------------
> KVM x86 MMU changes for 7.2
>
>  - Use the kernel's "enum pg_level" in the TDX APIs instead of the TDX-Module's
>    level definitions (which are 0-based).
>
>  - Rework the TDX memory APIs to not require/assume that guest memory is
>    backed by "struct page" (in prepartion for guest_memfd hugepage support).
>
>  - Overhaul the TDP MMU => S-EPT code to move as much S-EPT specific logic as
>    possible into the TDX code, and to funnel (almost) all S-EPT updates into
>    a single chokepoint.  The motivation is largely to prepare for upcoming
>    Dynamic PAMT support, but the cleanups are nice to have on their own.
>
>  - Plug a hole in the shadow MMU where KVM fails to recursively zap nested TDP
>    shadow when L1 is tearing its TDP page tables from the bottom up, as KVM's
>    TDP MMU now does.
>
> ----------------------------------------------------------------

Pulled, thanks.

Paolo

> Rick Edgecombe (4):
>       KVM: TDX: Move KVM_BUG_ON()s in __tdp_mmu_set_spte_atomic() to TDX code
>       KVM: TDX: Move lockdep assert in __tdp_mmu_set_spte_atomic() to TDX code
>       KVM: x86/tdp_mmu: Morph !is_frozen_spte() check into a KVM_MMU_WARN_ON()
>       KVM: x86/mmu: Drop KVM_BUG_ON() on shared lock to zap child external PTEs
>
> Sean Christopherson (17):
>       x86/tdx: Use pg_level in TDX APIs, not the TDX-Module's 0-based level
>       KVM: x86/mmu: Update iter->old_spte if cmpxchg64 on mirror SPTE "fails"
>       KVM: TDX: Account all non-transient page allocations for per-TD structures
>       KVM: x86: Make "external SPTE" ops that can fail RET0 static calls
>       x86/tdx: Use PFN directly for mapping guest private memory
>       x86/tdx: Use PFN directly for unmapping guest private memory
>       KVM: TDX: Drop kvm_x86_ops.link_external_spt()
>       KVM: TDX: Wrap mapping of leaf and non-leaf S-EPT entries into helpers
>       KVM: x86/mmu: Fold set_external_spte_present() into its sole caller
>       KVM: x86/mmu: Plumb param "old_spte" into kvm_x86_ops.set_external_spte()
>       KVM: x86/mmu: Plumb "sp" _pointer_ into the TDP MMU's handle_changed_spte()
>       KVM: x86/tdp_mmu: Centrally propagate to-present/atomic zap updates to external PTEs
>       KVM: TDX: Hoist tdx_sept_remove_private_spte() above set_private_spte()
>       KVM: TDX: Drop kvm_x86_ops.remove_external_spte()
>       KVM: x86: Move error handling inside free_external_spt()
>       KVM: TDX: Move external page table freeing to TDX code
>       KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes
>
> Yan Zhao (3):
>       x86/tdx: Drop exported function tdx_quirk_reset_page()
>       x86/virt/tdx: Move mk_keyed_paddr() to tdx.c due to no external users
>       KVM: TDX: Rename tdx_sept_remove_private_spte() to show it's for leaf SPTEs
>
>  arch/x86/include/asm/kvm-x86-ops.h |   4 +-
>  arch/x86/include/asm/kvm_host.h    |  13 +-
>  arch/x86/include/asm/tdx.h         |  34 ++---
>  arch/x86/kvm/mmu/mmu.c             |   2 +-
>  arch/x86/kvm/mmu/tdp_mmu.c         | 275 ++++++++++++++++---------------------
>  arch/x86/kvm/vmx/tdx.c             | 208 +++++++++++++++++-----------
>  arch/x86/virt/vmx/tdx/tdx.c        |  64 +++++----
>  7 files changed, 302 insertions(+), 298 deletions(-)
>

Re: [GIT PULL] KVM: VFIO changes for 7.2

[Paolo Bonzini]

On Fri, Jun 12, 2026 at 2:48 AM Sean Christopherson <seanjc@google.com> wrote:
>
> The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:
>
>   Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)
>
> are available in the Git repository at:
>
>   https://github.com/kvm-x86/linux.git tags/kvm-x86-vfio-7.2
>
> for you to fetch changes up to 156615264fd3430e7f90b36f46076b2f6ec4a24a:
>
>   KVM: VFIO: update coherency only if file was deleted (2026-05-13 11:12:40 -0700)
>
> ----------------------------------------------------------------
> KVM VFIO changes for 7.2
>
> Use guard() to cleanup up various KVM+VFIO flows.
>
> ----------------------------------------------------------------
> Carlos López (4):
>       KVM: VFIO: clean up control flow in kvm_vfio_file_add()
>       KVM: VFIO: use mutex guard in kvm_vfio_file_set_spapr_tce()
>       KVM: VFIO: deduplicate file release logic
>       KVM: VFIO: update coherency only if file was deleted

Pulled, thanks.

Paolo

>  virt/kvm/vfio.c | 98 +++++++++++++++++++++------------------------------------
>  1 file changed, 35 insertions(+), 63 deletions(-)
>

Re: [GIT PULL] KVM: x86: VMX changes for 7.2

[Paolo Bonzini]

On Fri, Jun 12, 2026 at 2:48 AM Sean Christopherson <seanjc@google.com> wrote:
>
> The following changes since commit b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887:
>
>   Merge branch 'kvm-apx-prepare' into HEAD (2026-05-13 12:38:31 -0400)
>
> are available in the Git repository at:
>
>   https://github.com/kvm-x86/linux.git tags/kvm-x86-vmx-7.2
>
> for you to fetch changes up to ca674df13b195eb6d124ab059799d4e03fa40624:
>
>   KVM: VMX: Handle bad values on proxied writes to LBR MSRs (2026-05-27 16:41:51 -0700)
>
> ----------------------------------------------------------------
> KVM VMX changes for 7.2
>
>  - Fix a largely benign bug where KVM TDX would incorrectly state it could
>    emulate several x2APIC MSRs.
>
>  - Use the "safe" WRMSR API when proxying LBR MSR writes as the to-be-written
>    value is guest controlled and completely unvalidated.

Pulled, thanks.

Paolo

>
> ----------------------------------------------------------------
> Rick Edgecombe (1):
>       KVM: TDX: Fix x2APIC MSR handling in tdx_has_emulated_msr()
>
> Xuanqing Shi (1):
>       KVM: VMX: Handle bad values on proxied writes to LBR MSRs
>
>  arch/x86/kvm/vmx/pmu_intel.c |  6 ++++--
>  arch/x86/kvm/vmx/tdx.c       | 38 ++++++++++++++++++++++----------------
>  2 files changed, 26 insertions(+), 18 deletions(-)
>