From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.69 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792501490; b=qLKwxWMlELiaa+IqyxYkLm/skkjI2ULFVBN9SpgK/ABTPlyRrTnw5muHqUDGdF8/Kxc3 YhscuZw1JOaQ32nMv38NZ8ehmIVznrFmqpg3QWMbdARYInoTVz3Ly5eYGND1seftGq6Rr xyDFPV7rVYXWpZnBZG3VvA/kcoe9ylOL3vP1pfYmGtz/88sLshXIhwz8XCmrzrGWtfkg9 chSP43+30mHPjfE9m/glkm7z7NgK1d6wsds9Om8vucv5s4kjZYrDT3TGyR2ssVsVcHHyk aZauPTyeT4D44YQRZKpMJAS1Akd1hKfMpdoMTN1RE70JTX8sAe5KP8EuDeWSNyjYntQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792501490; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Received:Date:In-Reply-To: Mime-Version:References:Message-ID:Subject:From:To:Cc:Content-Type; bh=TiOSNZMdnqqChU7eCmFOfWFFqcm5VOjZEu4im1R13jg=; b=2z/RxxEcjgmqPnbmn9Pxvep/ukNcF+5ts/Pv7ln5S9qXf0/BWAGLM+q6XAJrrOAkSu2N TManL6/MYpLPidKcrcVLEICpT9qYZc2Uir2NLr2j9BLXzVEawC9An6QpgRLp4i+qX4O12 iUvq81dfe/PobEA0TR6Ypbx6ixWhIbnhyA+cWvUp3zN9yYVRS1AM5BWLyal0EuhGCZSMB UKOb6ILeLcDpA2s8vrj3zFtdpYEAS8zx7DuUWIQHOgbkVbFzD+bTCQSafMXxVu0rwe2DR CTrKsU4bzsrlokmUNOU0vngdK4d+B1mlwK0TIaBPGCtlymqrpKW/QIzhKnxDtXA0TZw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=YQ2yPgUk; arc=none smtp.remote-ip=209.85.216.69 Received: from mail-pj1-f69.google.com (mail-pj1-f69.google.com [209.85.216.69]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6B3A7606A323 for ; Tue, 20 Oct 2026 13:04:50 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 6B3A7606A323 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=YQ2yPgUk Received: by mail-pj1-f69.google.com with SMTP id 98e67ed59e1d1-3ab341816f6so2273671a91.1 for ; Tue, 20 Oct 2026 06:04:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1792501490; x=1793106290; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=TiOSNZMdnqqChU7eCmFOfWFFqcm5VOjZEu4im1R13jg=; b=YQ2yPgUkImKwegXLNDHIcOX5JNJ/5SLVpdvaMABJpkZMluLNOhHThjsFMwD/G+Jk+I shoEJu/zVkAvDY8UoDqp+o424Rkv8BlJO1EQJ2gxFh7kiwFDLcLrgxhIOfUUrhvQyjJ5 nVKeHcAnqJbWISOBFNHYp7hyRcFxu7W5CYER2mmEX30YScCcF2uc9JCPrr/zb8V7SifC sBNzOEa/UxaMBVw63a/wZa2/3zabZuvNothwnoHPQRNj8eViTxRtxkbHBKuO5klMZgzi 6dqXe3PxAp+Me/1byDOnk+SQEJwSQrZRNkWi7mB26/B1iH/wI49G+lkDHvxIsFpMqWYA lR7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792501490; x=1793106290; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=TiOSNZMdnqqChU7eCmFOfWFFqcm5VOjZEu4im1R13jg=; b=cesuQ/pYA53HiXDMH8I8SihpYa78hgMkAX4IP0w/f9q4j8RhwxqsxxT39p+LTSVvkn kpJgqWzmHQm3PQ4KUJsBb9njp3saC78Ptvhut40YbTHzpmOIUc+AugnBZDaI8WAFbKmO LhF++zoKd0+5Bqg/xjNQGU45Oo9HAv1qiiCLuyUuN8nmziWCiecfoE5YWKYSVGybBX0P SyrcH8ASy3ngVeGtD3guxUQGjh00DkMuVgRnh1JyI9svfyXIQXM4/yXYcC41RGIMjtvx uAsQAUXV9Z09jcefn4adh59zYbAFczqs7vVJ1d5fCz1FXyLIjuDGhNIDYKaBN2qUNdX7 FYbw== X-Forwarded-Encrypted: i=1; AKwUvBxnmp15pD1KSZhJ8ndoAmYIZWpGx6FL4luNor4SpADBsyLb5IhgURPuCDWSG8tMblfHHgqAsW5BgdFgoNU=@vger.kernel.org X-Gm-Message-State: AFq9FYLpQk+++X1ICxSWSJKNm9vNicjaaCGi2fN2Sp8jEmwfB1wHFF2c kZf7OQmu+gAhQ1GHLvD6mlG29Vro899g7qLP7Dn0LD7DRU43WBLgiylxCPtlD595nUZFZ7DqfVX r4KsOgQ== X-Received: from pjdn34.prod.google.com ([2002:a17:90a:2ca5:b0:3ab:c22:1eb0]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:2e85:b0:3ac:aa8d:19eb with SMTP id 98e67ed59e1d1-3acee29585cmr8240994a91.3.1792501489305; Tue, 20 Oct 2026 06:04:49 -0700 (PDT) Date: Tue, 20 Oct 2026 06:04:47 -0700 In-Reply-To: <20261019214611.404880-1-yosry@kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 References: <20261019214611.404880-1-yosry@kernel.org> Message-ID: Subject: Re: [PATCH 6.18.y] KVM: SVM: Stop toggling virtual VMSAVE/VMLOAD on intercept recalc From: Sean Christopherson To: Yosry Ahmed Cc: stable@vger.kernel.org, Paolo Bonzini , Jim Mattson , Kevin Cheng , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Andrew Morton , david@kernel.org, Lorenzo Stoakes , Borislav Petkov , Dave Hansen , David Laight , Kiryl Shutsemau , Lance Yang , Luiz Capitulino , Matt Fleming , Pedro Falcato , Rik van Riel , Mike Rapoport , Tal Zussman , andrew.cooper3@citrix.com, gregkh@linuxfoundation.org, sashal@kernel.org, Yosry Ahmed , Nikola Ciprich Content-Type: text/plain; charset="us-ascii" On Mon, Oct 19, 2026, Yosry Ahmed wrote: > From: Yosry Ahmed > > [ Upstream commit 55780d8a1dcc93d2c4b33c565ada88df12c9f206 ] > > Virtual VMSAVE/VMLOAD enablement (i.e. > VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK) is set/cleared by > svm_recalc_instruction_intercepts() when the intercepts are cleared/set. > This is unnecessary because the bit is meaningless when intercepts are > set and KVM emulates the instructions. Initialize the bit in vmcb01 base > on vls, and keep it unchanged. > > This is similar-ish to how vGIF is handled. It is enabled in init_vmcb() > if vgif=1 and remains unchanged when the STGI intercept is enabled (e.g. > for NMI windows). > > This fixes a bug in svm_recalc_instruction_intercepts(). The intercepts > for VMSAVE/VMLOAD are always toggled in vmcb01, but > VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK is toggled in the current VMCB, which > could be vmcb02 instead of vmcb01 if L2 is active. > > Virtual VMSAVE/VMLOAD enablement in vmcb02 is separately controlled by > nested_vmcb02_prepare_control() based on the vCPU features and VMCB12, > and if intercepts are needed they are set by recalc_intercepts(). > > The bug is benign though. Not toggling the bit for vmcb01 is harmless > because it's useless anyway. For vmcb02: > > - The bit could be incorrectly cleared when intercepts are set in > vmcb01. This is harmless because VMSAVE/VMLOAD will be emulated by KVM > anyway. > > - The bit could be incorrectly set when the intercepts are cleared in > vmcb01. However, if the bit was originally clear in vmcb02, then > recalc_intercepts() will enable in the intercepts in vmcb02 anyway and > VMSAVE/VMLOAD will be emulated by KVM. > > Signed-off-by: Yosry Ahmed > Link: https://patch.msgid.link/20260110004821.3411245-3-yosry.ahmed@linux.dev > Signed-off-by: Sean Christopherson > Fixes: 5a1a726e68ff ("KVM: x86: Use KVM_REQ_RECALC_INTERCEPTS to react to CPUID updates") > Reported-by: Nikola Ciprich > Closes: https://lore.kernel.org/linux-mm/arY1Wq6R9OY20ans@pcnci.linuxbox.cz/ > Tested-by: Nikola Ciprich > [ yosry: The bug is not benign. Since 5a1a726e68ff, a vCPU restored into > L2 (e.g. on live migration) recalculates intercepts with vmcb02 > loaded, leaving vmcb01 with neither VMLOAD/VMSAVE intercepts nor > virtual VMLOAD/VMSAVE, so L1's VMLOAD/VMSAVE corrupt host memory. ] > Signed-off-by: Yosry Ahmed > --- Acked-by: Sean Christopherson