On Fri, Feb 6, 2026 at 10:23 AM Yosry Ahmed <[email protected]> wrote: > > February 6, 2026 at 10:19 AM, "Sean Christopherson" <[email protected]> wrote: > > > > > > On Thu, Feb 05, 2026, Jim Mattson wrote: > > > > > > > > Cache g_pat from vmcb12 in svm->nested.gpat to avoid TOCTTOU issues, and > > > add a validity check so that when nested paging is enabled for vmcb12, an > > > invalid g_pat causes an immediate VMEXIT with exit code VMEXIT_INVALID, > > > as > > > specified in the APM, volume 2: "Nested Paging and VMRUN/VMEXIT." > > > > > > Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler") > > > Signed-off-by: Jim Mattson <[email protected]> > > > --- > > > arch/x86/kvm/svm/nested.c | 4 +++- > > > arch/x86/kvm/svm/svm.h | 3 +++ > > > 2 files changed, 6 insertions(+), 1 deletion(-) > > > > > > diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c > > > index f72dbd10dcad..1d4ff6408b34 100644 > > > --- a/arch/x86/kvm/svm/nested.c > > > +++ b/arch/x86/kvm/svm/nested.c > > > @@ -1027,9 +1027,11 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) > > > > > > nested_copy_vmcb_control_to_cache(svm, &vmcb12->control); > > > nested_copy_vmcb_save_to_cache(svm, &vmcb12->save); > > > + svm->nested.gpat = vmcb12->save.g_pat; > > > > > > if (!nested_vmcb_check_save(vcpu) || > > > - !nested_vmcb_check_controls(vcpu)) { > > > + !nested_vmcb_check_controls(vcpu) || > > > + (nested_npt_enabled(svm) && !kvm_pat_valid(svm->nested.gpat))) { > > > vmcb12->control.exit_code = SVM_EXIT_ERR; > > > vmcb12->control.exit_info_1 = 0; > > > vmcb12->control.exit_info_2 = 0; > > > diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h > > > index 986d90f2d4ca..42a4bf83b3aa 100644 > > > --- a/arch/x86/kvm/svm/svm.h > > > +++ b/arch/x86/kvm/svm/svm.h > > > @@ -208,6 +208,9 @@ struct svm_nested_state { > > > */ > > > struct vmcb_save_area_cached save; > > > > > > + /* Cached guest PAT from vmcb12.save.g_pat */ > > > + u64 gpat; > > > > > Shouldn't this go in vmcb_save_area_cached? > > I believe Jim changed it after this discussion on v2: > https://lore.kernel.org/kvm/[email protected]/.
Right. The two issues with putting it in vmcb_save_area_cached were: 1. Checking all of vmcb_save_area_cached requires access to the corresponding control area (or at least the boolean, "NTP enabled.") 2. In the nested state serialization payload, everything else in the vmcb_save_area_cached comes from L1 (host state to be restored at emulated #VMEXIT.) The first issue was a little messy, but not that distasteful. The second issue was really a mess.
