Re: [PATCH v2 0/5] KVM: nSVM: Disallow bad L1 EFER for KVM_SET_NESTED_STATE

[Sean Christopherson]

On Wed, 02 Sep 2026 16:20:23 -0700, Sean Christopherson wrote:
> Fix a bug where KVM allows userspace to set an impossible EFER for L1 via
> KVM_SET_NESTED_STATE, which ultimately can lead to KVM misconfiguring L2's
> MMU (yay, NPT!) and overflowing the guest_walker arrays.  Then, harden the
> MMU against similar bugs (hopefully it works this time; nVMX also had a
> similar bug, but the "NPT uses L1's EFER/CR4" wrinkle rendered the existing
> hardening useless).
> 
> [...]

Applied to kvm-x86 misc, thanks!

[1/5] KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0
      https://github.com/kvm-x86/linux/commit/5dc500a354cc
[2/5] KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state
      https://github.com/kvm-x86/linux/commit/1c4c84a643b7
[3/5] KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has
      https://github.com/kvm-x86/linux/commit/115f9405a2ed
[4/5] KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0
      https://github.com/kvm-x86/linux/commit/34dacbe7ae93
[5/5] KVM: x86/mmu: Convert MMU walker's bounds check from BUG_ON() to KVM_BUG_ON()
      https://github.com/kvm-x86/linux/commit/47b437b2d903

--
https://github.com/kvm-x86/linux/tree/next