Currently, KVM's implementation of nested SVM treats the PAT MSR the same
way whether or not nested NPT is enabled: L1 and L2 share a single
PAT. However, the AMD APM specifies that when nested NPT is enabled, the host
(L1) and the guest (L2) should have independent PATs: hPAT for L1 and gPAT
for L2.
This patch series implements independent PATs for L1 and L2 when nested NPT
is enabled, but only when a new quirk, KVM_X86_QUIRK_NESTED_SVM_SHARED_PAT,
is disabled. By default, the quirk is enabled, preserving KVM's legacy
behavior. When the quirk is disabled, KVM correctly virtualizes a separate
PAT register for L2, using the g_pat field in the VMCB.
Guest accesses to the IA32_PAT MSR are redirected to either hPAT or gPAT
depending on the current mode and whether nested NPT is enabled. All other
accesses, including userspace accesses via KVM_{GET,SET}_MSRS, continue to
reference hPAT. L2's gPAT is saved and restored via a new 'gpat' field in
kvm_svm_nested_state_hdr, which is within the existing padding of the header
to maintain ABI compatibility.
v1: https://lore.kernel.org/kvm/[email protected]/
v2: https://lore.kernel.org/kvm/[email protected]/
v3: https://lore.kernel.org/kvm/[email protected]/
v4: https://lore.kernel.org/kvm/[email protected]/
v5: https://lore.kernel.org/kvm/[email protected]/
v6: https://lore.kernel.org/kvm/[email protected]/
v6 -> v7:
* Drop the patch "KVM: x86: Remove common handling of MSR_IA32_CR_PAT,"
because TDX still calls the common handler.
* Instead, add a warning to the common PAT handling code if it is
called by an SVM-capable vCPU
* Add comments about userspace disabling the quirk while a vCPU is
running.
* Cache the value of use_separate_l2_pat in KVM_SET_NESTED_STATE, in
case the quirk is disabled concurrently with the execution of that
function.
Jim Mattson (9):
KVM: x86: Define KVM_X86_QUIRK_NESTED_SVM_SHARED_PAT
KVM: x86: nSVM: Clear VMCB_NPT clean bit when updating hPAT from guest
mode
KVM: x86: nSVM: Cache and validate vmcb12 g_pat
KVM: x86: nSVM: Set vmcb02.g_pat correctly for nested NPT
KVM: x86: nSVM: Redirect IA32_PAT accesses to either hPAT or gPAT
KVM: x86: nSVM: Save gPAT to vmcb12.g_pat on VMEXIT
KVM: Documentation: document KVM_{GET,SET}_NESTED_STATE for SVM
KVM: x86: nSVM: Save/restore gPAT with KVM_{GET,SET}_NESTED_STATE
KVM: selftests: nSVM: Add svm_nested_pat test
Documentation/virt/kvm/api.rst | 26 ++
arch/x86/include/asm/kvm_host.h | 3 +-
arch/x86/include/uapi/asm/kvm.h | 2 +
arch/x86/kvm/svm/nested.c | 65 +++-
arch/x86/kvm/svm/svm.c | 54 +++-
arch/x86/kvm/svm/svm.h | 19 +-
arch/x86/kvm/x86.c | 6 +
tools/arch/x86/include/uapi/asm/kvm.h | 2 +
tools/testing/selftests/kvm/Makefile.kvm | 1 +
.../selftests/kvm/x86/svm_nested_pat_test.c | 304 ++++++++++++++++++
10 files changed, 457 insertions(+), 25 deletions(-)
create mode 100644 tools/testing/selftests/kvm/x86/svm_nested_pat_test.c
base-commit: 3d6cdcc8883b5726513d245eef0e91cabfc397f7
--
2.53.0.1018.g2bb0e51243-goog
