[GIT PULL] KVM: x86: Misc changes for 7.4

[Sean Christopherson <seanjc@google.com>]

This one really lives up to its name.  There's a lot of smallish stuff all over.
There's a minor conflict between this and the "vmx" branch, more details in the
"vmx" pull request.

The following changes since commit d4b7fb647204f0c81dfeae2d1a708e4d858e0c94:

  Merge branch 'kvm-xen-longmode' into HEAD (2026-09-04 17:35:03 +0200)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-misc-7.4

for you to fetch changes up to 88b23a2e8286b7016c3b58dc10093cf28c22aa3d:

  KVM: x86: Request event processing for exception VM-Exits (2026-10-02 07:49:40 -0700)

----------------------------------------------------------------
KVM x86 misc changes for 7.4

 - Mask off the address space ID when checking for illegal usage of
   kvm_set_internal_memslot() to prevent false negatives on the sanity check.

 - Explicitly zero reserved flags when delivering a SynIC message to avoid
   leaking a byte of stack information to the guest.

 - Rework TDX's handling of the canonical MMU root level to not rely on
   userspace to fill CPUID correctly, as doing so lets userspace trivially
   trigger a KVM_BUG_ON().

 - Reject KVM_SET_NESTED_STATE if userspace "restores" L1 with EFER.LMA=1 &&
   EFER.LME=0, which confuses KVM into trying to configure an 64-bit MMU
   without PAE.

 - Ignore EFER.LMA (clear it from KVM's cached save state) if EFER.LME=0 when
   preparing L2 state, to fix another way to confuse KVM's MMU (and because
   real hardware also ignores EFER.LMA).

 - Improve KVM's sanity checks for a misconfigured MMU to (hopefully) detect
   all of the ways KVM can botch EFER.LMA vs. CR4.PAE.

 - Remove the "full" out-param from kvm_x86_ops.flush_tlb_gva() as the param
   is only used to avoid what effectively amounts to a single memory write.

 - Fix a mostly-benign bug where KVM can write through a guest's read-only
   mapping due to not checking the error code when expediting emulated MMIO
   page faults.

 - Honor the guest's view of the "EFER.LMSLE must be zero" defeature so that
   userspace can provide migration compatibility between Rome and Milan+.

 - Pend a KVM_REQ_EVENT request when an exception is morphed into a nested
   VM-Exit, otherwise KVM can fail to actually deliver the nested VM-Exit,
   e.g. when injecting a page fault.

 - Add support for PML on SVM.

 - Add support for virtualizating Bus Lock Detect on SVM, and fix a number of
   DR6 bugs and warts along the way.

 - Misc fixes and cleanups.

----------------------------------------------------------------
Hao Xiang (1):
      KVM: x86: Rename CPUID feature bit AVX10_VNNI_INT to AVX10_V1_AUX

Jim Mattson (4):
      KVM: x86: Advertise EFER_LMSLE_MBZ when KVM disallows EFER.LMSLE
      KVM: x86: Honor the guest's EFER_LMSLE_MBZ
      KVM: selftests: Rename svm_nested_clear_efer_svme to svm_nested_efer_test
      KVM: selftests: Add coverage for the EFER_LMSLE_MBZ defeature

Karl Mehltretter (2):
      Documentation: KVM: SEV: Use the uapi structure names
      Documentation: KVM: x86: Use struct kvm_clock_pairing in hypercalls.rst

Kyle Zeng (1):
      KVM: x86: Restrict saved GPA writes to hardware write faults

Loc Nguyen (1):
      KVM: x86: Request event processing for exception VM-Exits

Luka Absandze (1):
      KVM: x86/pmu: Don't retry a counter whose config was rejected

Nikunj A Dadhania (7):
      KVM: x86: Move PML page to common vcpu arch structure
      KVM: x86: Carve out PML flush routine
      KVM: VMX: Use cpu_dirty_log_size instead of enable_pml for PML checks
      KVM: x86: Carve out common dirty logging update
      x86/cpufeatures: Add Page modification logging
      KVM: SVM: Use BIT_ULL for 64-bit misc_ctl bit definitions
      KVM: SVM: Add Page modification logging support

Paolo Bonzini (1):
      KVM: x86: remove "full" out-argument from flush_tlb_gva

Ravi Bangoria (1):
      KVM: SVM: Add support for virtualizating Bus Lock Detect

Sean Christopherson (20):
      KVM: x86: Zero reserved synic flags when delivering message to avoid stack leak
      KVM: x86: Track kvm_vcpu_arch.pending_ioapic_eoi as a u8 to drop dead BUG_ON()
      KVM: x86/mmu: Use KVM's max TDP level to determine need for 32-bit TDP root
      KVM: VMX: Explicitly track TDX VMs' root level instead of guessing it from CPUID
      KVM: VMX: Drop TDX_SHARED_BIT_PWL_{4,5} and dedup related code
      KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0
      KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state
      KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has
      KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0
      KVM: x86/mmu: Convert MMU walker's bounds check from BUG_ON() to KVM_BUG_ON()
      KVM: VMX: Pass @vcpu, not @vmx to init_vmcs()
      KVM: x86: Preserve DR6.BLD (Bus Lock Detect) when delivering #DB payload
      KVM: x86: Rename kvm_dr6_fixed() => kvm_get_dr6_fixed_1()
      KVM: Return an "unsigned long", not "u64" for the fixed-1 DR6 bits
      KVM: x86: Force fixed-1 bits in DR6 after synchronizing with hardware
      KVM: x86: Set guest's fixed-1 DR6 bits when delivering #DB payload
      KVM: x86: Kill off DR6_FIXED_1 to prevent future misuse
      KVM: SVM: Add helper to query if LBR virtualization needs to be enabled
      KVM: nSVM: Open code check on LBR virtualization being enabled in vmcb12
      KVM: selftests: Add module param API to check if nested virtualization is enabled

Shivansh Dhiman (3):
      KVM: nSVM: Disable LBRV in nested control cache when unsupported
      KVM: nSVM: Don't assume all active-low bits DR6 are fixed-1
      KVM: SVM: Add a vCPU-aware helper to get supported DEBUGCTL bits

Tharit Tangkijwanichakul (2):
      KVM: x86: Reject reserved CR8 bits in KVM_SET_SREGS
      KVM: selftests: Add CR8 reserved-bit checks to set_sregs_test

Zeng Chi (1):
      KVM: Mask off the address space ID in kvm_set_internal_memslot() check

 Documentation/virt/kvm/api.rst                     |  25 ++
 .../virt/kvm/x86/amd-memory-encryption.rst         |   8 +-
 Documentation/virt/kvm/x86/hypercalls.rst          |   2 +-
 arch/x86/include/asm/cpufeatures.h                 |   1 +
 arch/x86/include/asm/kvm_host.h                    |  10 +-
 arch/x86/include/asm/svm.h                         |  14 +-
 arch/x86/include/uapi/asm/svm.h                    |   2 +
 arch/x86/kernel/cpu/scattered.c                    |   1 +
 arch/x86/kvm/cpuid.c                               |  36 +--
 arch/x86/kvm/cpuid.h                               |   1 -
 arch/x86/kvm/hyperv.c                              |   9 +-
 arch/x86/kvm/kvm_emulate.h                         |   4 +-
 arch/x86/kvm/lapic.c                               |   4 +-
 arch/x86/kvm/lapic.h                               |   2 +-
 arch/x86/kvm/mmu/mmu.c                             |  29 ++-
 arch/x86/kvm/mmu/paging_tmpl.h                     |  17 +-
 arch/x86/kvm/msrs.c                                |  12 +-
 arch/x86/kvm/pmu.c                                 |  14 +-
 arch/x86/kvm/regs.c                                |  16 +-
 arch/x86/kvm/regs.h                                |  11 +-
 arch/x86/kvm/reverse_cpuid.h                       |   2 +-
 arch/x86/kvm/svm/nested.c                          |  46 ++--
 arch/x86/kvm/svm/sev.c                             |   7 +-
 arch/x86/kvm/svm/svm.c                             | 162 ++++++++++++-
 arch/x86/kvm/svm/svm.h                             |  13 +-
 arch/x86/kvm/vmx/main.c                            |   8 +-
 arch/x86/kvm/vmx/tdx.c                             |  21 +-
 arch/x86/kvm/vmx/vmx.c                             |  94 +++-----
 arch/x86/kvm/vmx/vmx.h                             |   9 +-
 arch/x86/kvm/vmx/x86_ops.h                         |   4 +-
 arch/x86/kvm/x86.c                                 | 130 +++++++---
 arch/x86/kvm/x86.h                                 |  10 +
 tools/testing/selftests/kvm/Makefile.kvm           |   2 +-
 .../testing/selftests/kvm/include/x86/processor.h  |  14 ++
 tools/testing/selftests/kvm/x86/set_sregs_test.c   |  11 +
 .../selftests/kvm/x86/svm_nested_clear_efer_svme.c |  50 ----
 .../selftests/kvm/x86/svm_nested_efer_test.c       | 266 +++++++++++++++++++++
 virt/kvm/kvm_main.c                                |   2 +-
 38 files changed, 803 insertions(+), 266 deletions(-)
 delete mode 100644 tools/testing/selftests/kvm/x86/svm_nested_clear_efer_svme.c
 create mode 100644 tools/testing/selftests/kvm/x86/svm_nested_efer_test.c