Currently, KVM's implementation of nested SVM treats the PAT MSR the same
way whether or not nested NPT is enabled: L1 and L2 share a single
PAT. However, the APM specifies that when nested NPT is enabled, the host
(L1) and the guest (L2) should have independent PATs: hPAT for L1 and gPAT
for L2. This patch series implements the architectural specification in
KVM.
Use the existing PAT MSR (vcpu->arch.pat) for hPAT. Add a new field,
svm->nested.gpat, for gPAT. With nested NPT enabled, redirect guest
accesses to the IA32_PAT MSR to gPAT. All other accesses, including
userspace accesses via KVM_{GET,SET}_MSRS, continue to reference hPAT. The
special handling of userspace accesses ensures save/restore forward
compatibility (i.e. resuming a new checkpoint on an older kernel). When an
old kernel restores a checkpoint from a new kernel, the gPAT will be lost,
and L2 will simply use L1's PAT, which is the existing behavior of the old
kernel anyway.
v1: https://lore.kernel.org/kvm/[email protected]/
v2: https://lore.kernel.org/kvm/[email protected]/
v3: https://lore.kernel.org/kvm/[email protected]/
v3 -> v4:
* Rebase on top of Yosry's v5 "Nested SVM fixes, cleanups, and hardening"
* Rename the svm_set_vmcb_gpat() helper to vmcb_set_gpat() for
consistency with other VMCB helpers [Yosry].
* Cache g_pat within struct vmcb_save_area_cached (as
svm->nested.save.g_pat) instead of using a standalone field in
svm->nested [Sean].
* Update nested_vmcb_check_save() to optionally validate the cached
g_pat, depending on a new boolean argument [Yosry].
* Reduce indentation in nested_vmcb02_prepare_save() when setting the
guest PAT [Sean].
Jim Mattson (8):
KVM: x86: nSVM: Clear VMCB_NPT clean bit when updating hPAT from guest
mode
KVM: x86: nSVM: Cache and validate vmcb12 g_pat
KVM: x86: nSVM: Set vmcb02.g_pat correctly for nested NPT
KVM: x86: nSVM: Redirect IA32_PAT accesses to either hPAT or gPAT
KVM: x86: nSVM: Save gPAT to vmcb12.g_pat on VMEXIT
KVM: x86: nSVM: Save/restore gPAT with KVM_{GET,SET}_NESTED_STATE
KVM: x86: nSVM: Handle restore of legacy nested state
KVM: selftests: nSVM: Add svm_nested_pat test
arch/x86/include/uapi/asm/kvm.h | 5 +
arch/x86/kvm/svm/nested.c | 60 +++-
arch/x86/kvm/svm/svm.c | 40 ++-
arch/x86/kvm/svm/svm.h | 38 ++-
tools/testing/selftests/kvm/Makefile.kvm | 1 +
.../selftests/kvm/x86/svm_nested_pat_test.c | 298 ++++++++++++++++++
6 files changed, 413 insertions(+), 29 deletions(-)
create mode 100644 tools/testing/selftests/kvm/x86/svm_nested_pat_test.c
--
2.53.0.239.g8d8fc8a987-goog
