[GIT PULL] KVM: x86: Misc changes for 7.4
From: Sean Christopherson
Date: Fri Oct 16 2026 - 00:46:03 EST
This one really lives up to its name. There's a lot of smallish stuff all over.
There's a minor conflict between this and the "vmx" branch, more details in the
"vmx" pull request.
The following changes since commit d4b7fb647204f0c81dfeae2d1a708e4d858e0c94:
Merge branch 'kvm-xen-longmode' into HEAD (2026-09-04 17:35:03 +0200)
are available in the Git repository at:
https://github.com/kvm-x86/linux.git tags/kvm-x86-misc-7.4
for you to fetch changes up to 88b23a2e8286b7016c3b58dc10093cf28c22aa3d:
KVM: x86: Request event processing for exception VM-Exits (2026-10-02 07:49:40 -0700)
----------------------------------------------------------------
KVM x86 misc changes for 7.4
- Mask off the address space ID when checking for illegal usage of
kvm_set_internal_memslot() to prevent false negatives on the sanity check.
- Explicitly zero reserved flags when delivering a SynIC message to avoid
leaking a byte of stack information to the guest.
- Rework TDX's handling of the canonical MMU root level to not rely on
userspace to fill CPUID correctly, as doing so lets userspace trivially
trigger a KVM_BUG_ON().
- Reject KVM_SET_NESTED_STATE if userspace "restores" L1 with EFER.LMA=1 &&
EFER.LME=0, which confuses KVM into trying to configure an 64-bit MMU
without PAE.
- Ignore EFER.LMA (clear it from KVM's cached save state) if EFER.LME=0 when
preparing L2 state, to fix another way to confuse KVM's MMU (and because
real hardware also ignores EFER.LMA).
- Improve KVM's sanity checks for a misconfigured MMU to (hopefully) detect
all of the ways KVM can botch EFER.LMA vs. CR4.PAE.
- Remove the "full" out-param from kvm_x86_ops.flush_tlb_gva() as the param
is only used to avoid what effectively amounts to a single memory write.
- Fix a mostly-benign bug where KVM can write through a guest's read-only
mapping due to not checking the error code when expediting emulated MMIO
page faults.
- Honor the guest's view of the "EFER.LMSLE must be zero" defeature so that
userspace can provide migration compatibility between Rome and Milan+.
- Pend a KVM_REQ_EVENT request when an exception is morphed into a nested
VM-Exit, otherwise KVM can fail to actually deliver the nested VM-Exit,
e.g. when injecting a page fault.
- Add support for PML on SVM.
- Add support for virtualizating Bus Lock Detect on SVM, and fix a number of
DR6 bugs and warts along the way.
- Misc fixes and cleanups.
----------------------------------------------------------------
Hao Xiang (1):
KVM: x86: Rename CPUID feature bit AVX10_VNNI_INT to AVX10_V1_AUX
Jim Mattson (4):
KVM: x86: Advertise EFER_LMSLE_MBZ when KVM disallows EFER.LMSLE
KVM: x86: Honor the guest's EFER_LMSLE_MBZ
KVM: selftests: Rename svm_nested_clear_efer_svme to svm_nested_efer_test
KVM: selftests: Add coverage for the EFER_LMSLE_MBZ defeature
Karl Mehltretter (2):
Documentation: KVM: SEV: Use the uapi structure names
Documentation: KVM: x86: Use struct kvm_clock_pairing in hypercalls.rst
Kyle Zeng (1):
KVM: x86: Restrict saved GPA writes to hardware write faults
Loc Nguyen (1):
KVM: x86: Request event processing for exception VM-Exits
Luka Absandze (1):
KVM: x86/pmu: Don't retry a counter whose config was rejected
Nikunj A Dadhania (7):
KVM: x86: Move PML page to common vcpu arch structure
KVM: x86: Carve out PML flush routine
KVM: VMX: Use cpu_dirty_log_size instead of enable_pml for PML checks
KVM: x86: Carve out common dirty logging update
x86/cpufeatures: Add Page modification logging
KVM: SVM: Use BIT_ULL for 64-bit misc_ctl bit definitions
KVM: SVM: Add Page modification logging support
Paolo Bonzini (1):
KVM: x86: remove "full" out-argument from flush_tlb_gva
Ravi Bangoria (1):
KVM: SVM: Add support for virtualizating Bus Lock Detect
Sean Christopherson (20):
KVM: x86: Zero reserved synic flags when delivering message to avoid stack leak
KVM: x86: Track kvm_vcpu_arch.pending_ioapic_eoi as a u8 to drop dead BUG_ON()
KVM: x86/mmu: Use KVM's max TDP level to determine need for 32-bit TDP root
KVM: VMX: Explicitly track TDX VMs' root level instead of guessing it from CPUID
KVM: VMX: Drop TDX_SHARED_BIT_PWL_{4,5} and dedup related code
KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0
KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state
KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has
KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0
KVM: x86/mmu: Convert MMU walker's bounds check from BUG_ON() to KVM_BUG_ON()
KVM: VMX: Pass @vcpu, not @vmx to init_vmcs()
KVM: x86: Preserve DR6.BLD (Bus Lock Detect) when delivering #DB payload
KVM: x86: Rename kvm_dr6_fixed() => kvm_get_dr6_fixed_1()
KVM: Return an "unsigned long", not "u64" for the fixed-1 DR6 bits
KVM: x86: Force fixed-1 bits in DR6 after synchronizing with hardware
KVM: x86: Set guest's fixed-1 DR6 bits when delivering #DB payload
KVM: x86: Kill off DR6_FIXED_1 to prevent future misuse
KVM: SVM: Add helper to query if LBR virtualization needs to be enabled
KVM: nSVM: Open code check on LBR virtualization being enabled in vmcb12
KVM: selftests: Add module param API to check if nested virtualization is enabled
Shivansh Dhiman (3):
KVM: nSVM: Disable LBRV in nested control cache when unsupported
KVM: nSVM: Don't assume all active-low bits DR6 are fixed-1
KVM: SVM: Add a vCPU-aware helper to get supported DEBUGCTL bits
Tharit Tangkijwanichakul (2):
KVM: x86: Reject reserved CR8 bits in KVM_SET_SREGS
KVM: selftests: Add CR8 reserved-bit checks to set_sregs_test
Zeng Chi (1):
KVM: Mask off the address space ID in kvm_set_internal_memslot() check
Documentation/virt/kvm/api.rst | 25 ++
.../virt/kvm/x86/amd-memory-encryption.rst | 8 +-
Documentation/virt/kvm/x86/hypercalls.rst | 2 +-
arch/x86/include/asm/cpufeatures.h | 1 +
arch/x86/include/asm/kvm_host.h | 10 +-
arch/x86/include/asm/svm.h | 14 +-
arch/x86/include/uapi/asm/svm.h | 2 +
arch/x86/kernel/cpu/scattered.c | 1 +
arch/x86/kvm/cpuid.c | 36 +--
arch/x86/kvm/cpuid.h | 1 -
arch/x86/kvm/hyperv.c | 9 +-
arch/x86/kvm/kvm_emulate.h | 4 +-
arch/x86/kvm/lapic.c | 4 +-
arch/x86/kvm/lapic.h | 2 +-
arch/x86/kvm/mmu/mmu.c | 29 ++-
arch/x86/kvm/mmu/paging_tmpl.h | 17 +-
arch/x86/kvm/msrs.c | 12 +-
arch/x86/kvm/pmu.c | 14 +-
arch/x86/kvm/regs.c | 16 +-
arch/x86/kvm/regs.h | 11 +-
arch/x86/kvm/reverse_cpuid.h | 2 +-
arch/x86/kvm/svm/nested.c | 46 ++--
arch/x86/kvm/svm/sev.c | 7 +-
arch/x86/kvm/svm/svm.c | 162 ++++++++++++-
arch/x86/kvm/svm/svm.h | 13 +-
arch/x86/kvm/vmx/main.c | 8 +-
arch/x86/kvm/vmx/tdx.c | 21 +-
arch/x86/kvm/vmx/vmx.c | 94 +++-----
arch/x86/kvm/vmx/vmx.h | 9 +-
arch/x86/kvm/vmx/x86_ops.h | 4 +-
arch/x86/kvm/x86.c | 130 +++++++---
arch/x86/kvm/x86.h | 10 +
tools/testing/selftests/kvm/Makefile.kvm | 2 +-
.../testing/selftests/kvm/include/x86/processor.h | 14 ++
tools/testing/selftests/kvm/x86/set_sregs_test.c | 11 +
.../selftests/kvm/x86/svm_nested_clear_efer_svme.c | 50 ----
.../selftests/kvm/x86/svm_nested_efer_test.c | 266 +++++++++++++++++++++
virt/kvm/kvm_main.c | 2 +-
38 files changed, 803 insertions(+), 266 deletions(-)
delete mode 100644 tools/testing/selftests/kvm/x86/svm_nested_clear_efer_svme.c
create mode 100644 tools/testing/selftests/kvm/x86/svm_nested_efer_test.c