[GIT PULL] KVM: x86: Misc changes for 7.3

[Sean Christopherson]

The main set of x86 changes for 7.3.  Yosry's INVVPID and EFER validation changes
are probably the most interesting.  Almost everything from me falls into the
category of "fixes for things that are technically bugs, but that no one cares
about in practice".

The following changes since commit a204badd8432f93b7e862e7dac6db0fe3d65f370:

  Merge branch 'kvm-chainsaw' into HEAD (2026-06-25 11:32:09 +0200)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-misc-7.3

for you to fetch changes up to 66ee8f1556575c8f9ae76932dd3aca65b4b60e59:

  KVM: x86/pmu: Clean up vPMU comments and stray blank lines (2026-08-05 16:42:23 -0700)

----------------------------------------------------------------
KVM x86 misc changes for 7.3

 - Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.

 - Harden the SNP and TDX "populate" ioctls against bad input, and to prepare
   for supporting in-place private<=>shared conversion.

 - Fix a variety of #DB priority bugs.

 - Fix a class of races related to enabling Hyper-V emulation on a vCPU after
   the vCPU is visible to the rest of KVM.

 - Use static calls for nested virtualization ops.

 - Move more KVM-internal code out of x86's kvm_host.h.

 - Enumerate support for a variety of Zhaoxin instructions that don't require
   explicit virtualization.

 - Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.

 - Harden kvm_vcpu_map() against double-mapping and thus leaking references.

 - Misc fixes and cleanups, e.g. for largely benign syzkaller splats.

----------------------------------------------------------------
Binbin Wu (1):
      KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf

Carlos López (3):
      KVM: x86: Treat any non-zero return from set_dr() as a faulting condition
      KVM: x86: Fix array_index_nospec() protection in kvm_vcpu_ioctl_x86_set_mce()
      KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock

Ewan Hai-oc (5):
      KVM: x86: Expose Zhaoxin SM2 CPUID feature
      KVM: x86: Expose Zhaoxin CCS (SM3 + SM4) CPUID feature
      KVM: x86: Expose Zhaoxin RNG2 CPUID feature
      KVM: x86: Expose Zhaoxin PHE2 CPUID feature
      KVM: x86: Expose Zhaoxin RSA CPUID feature

Hao Zhang (1):
      KVM: selftests: Extend the invalid nVMX guest state test to cover RSM

Joerg Roedel (1):
      KVM: SEV: Explicitly disallow NULL user address for SNP_LAUNCH_UPDATE

Kai Huang (1):
      KVM: x86: Use KVM_X86_OP() for the .pi_update_irte() hook

Like Xu (1):
      KVM: x86/pmu: Clean up vPMU comments and stray blank lines

Sean Christopherson (45):
      KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02
      KVM: TDX: Return EINVAL, not EOPNOTSUPP, for NULL INIT_MEM_REGION source
      KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 value
      KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority
      KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPL
      KVM: VMX: Prioritize DR7.GD=1 #DB over CPL>0 #GP on Intel
      KVM: x86: Use kvm_dr{6,7}_valid() to check DR{4,5,6,7} write values in emulator
      KVM: x86: WARN if MOV DR emulation hits a "too late" #GP
      KVM: x86: Read CR4.DE in emulator if and only if accessing DR4 or DR5
      KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller
      KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo()
      KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses
      KVM: x86/xen: Always route non-singleshot-timer vCPU hypercalls to userspace
      KVM: x86/xen: Consolidate checks on Xen vCPU ID for singleshot timer hypercalls
      KVM: x86/xen: Punt singleshot timer hcalls to userspace if Xen vCPU ID isn't set
      KVM: Initialize a vCPU's index to '-1' while it's being created
      KVM: Move nVMX's lockdep logic for vcpu->mutex to a common helper
      KVM: x86: Treat a vCPU as unreachable if its index is invalid
      KVM: x86/hyperv: Assert vCPU's mutex is held in to_hv_vcpu()
      KVM: x86/hyperv: Use {READ,WRITE}_ONCE for cross-task synic->active accesses
      KVM: x86: Move the "APIC attention" macros from kvm_host.h => lapic.c
      KVM: x86/mmu: Annotate tdp_enabled as being read-mostly
      KVM: x86: Pluralize the macro guard name for msrs.h
      KVM: x86: Move CR and DR macro definitions from kvm_host.h => regs.h
      KVM: x86: Move KVM_GUESTDBG_VALID_MASK from kvm_host.h => x86.c
      KVM: x86: Add static asserts to document connection b/w TSS structs and macros
      KVM: x86: Move KVM's arbitrary task switch reason enums to x86.h
      KVM: x86: Move "struct kvm_apic_map" definition from kvm_host.h => lapic.h
      KVM: x86: Move "struct kvm_vcpu_hv" and all children from kvm_host.h => hyperv.h
      KVM: x86: Reject nested CAP enablement if nested virtualization is disabled
      KVM: x86: Add static calls for nested virtualization ops
      KVM: x86: Move nested_ops out of kvm_x86_ops, to global kvm_nested_ops
      KVM: x86: Don't WARN if IRQ disappears because it was cleared from the PIC
      KVM: x86: Don't WARN if IRQ disappears when Xen emulation is enabled.
      KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit
      KVM: nSVM: Add CLASS()es for automagically handling local kvm_vcpu_map() usage
      KVM: nSVM: Use CLASS(kvm_vcpu_map_local) for SMM VMCB mappings
      KVM: nVMX: Use CLASS(kvm_vcpu_map_local_readonly) for MSR bitmap merging
      KVM: PPC: Use CLASS(kvm_vcpu_map_local) to patch dcbz
      KVM: Harden kvm_vcpu_map() against double-mapping and thus leaking references
      KVM: x86: Extract VMX's unhandleable emulation check to common x86
      KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation
      KVM: x86: Rework kvm_x86_ops.vcpu_pre_run() into .vcpu_needs_initialization()
      KVM: selftests: Use port 0x80 in invalid nVMX guest state test
      KVM: selftests: Refactor invalid nVMX state test to prepare for RSM testcase

Tim Wiederhake (1):
      KVM: x86: Replace delivery mode TODO with WARN_ON_ONCE

Yosry Ahmed (9):
      KVM: nVMX: Always flush vpid02 on first use
      KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
      KVM: x86: Move enabling EFER.SVME and EFER.LMSLE to generic EFER setup
      KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported
      KVM: x86: Always initialize EFER reserved bits on vendor initialization
      KVM: x86: Reverse the polarity of efer_reserved_bits
      KVM: x86: Move supported EFER bits to kvm_caps
      KVM: x86: Check EFER validity on KVM_SET_SREGS*
      KVM: selftests: Extend set_sregs test to cover EFER

leixiang (1):
      KVM: Remove kvm_debugfs_dir on kvm_init() error paths

 arch/powerpc/kvm/book3s_pr.c                       |  11 +-
 arch/x86/include/asm/cpufeatures.h                 |  10 +
 arch/x86/include/asm/kvm-x86-nested-ops.h          |  36 ++++
 arch/x86/include/asm/kvm-x86-ops.h                 |   5 +-
 arch/x86/include/asm/kvm_host.h                    | 212 ++-------------------
 arch/x86/kvm/cpuid.c                               |  22 ++-
 arch/x86/kvm/emulate.c                             |  49 +++--
 arch/x86/kvm/hyperv.c                              |  95 +++++----
 arch/x86/kvm/hyperv.h                              | 117 +++++++++++-
 arch/x86/kvm/irq.h                                 |  20 ++
 arch/x86/kvm/lapic.c                               |  13 +-
 arch/x86/kvm/lapic.h                               |  33 ++++
 arch/x86/kvm/mmu.h                                 |  11 +-
 arch/x86/kvm/mmu/mmu.c                             |   2 +-
 arch/x86/kvm/mmu/paging_tmpl.h                     |   2 +-
 arch/x86/kvm/msrs.c                                |  21 +-
 arch/x86/kvm/msrs.h                                |   5 +-
 arch/x86/kvm/pmu.c                                 |  12 +-
 arch/x86/kvm/pmu.h                                 |   4 +-
 arch/x86/kvm/regs.c                                |   3 +-
 arch/x86/kvm/regs.h                                |  38 ++++
 arch/x86/kvm/smm.c                                 |   4 +
 arch/x86/kvm/svm/nested.c                          |  20 +-
 arch/x86/kvm/svm/sev.c                             |  16 +-
 arch/x86/kvm/svm/svm.c                             |  66 ++-----
 arch/x86/kvm/svm/svm.h                             |   1 +
 arch/x86/kvm/tss.h                                 |   7 +
 arch/x86/kvm/vmx/main.c                            |  24 ++-
 arch/x86/kvm/vmx/nested.c                          |  81 ++++----
 arch/x86/kvm/vmx/nested.h                          |   6 +-
 arch/x86/kvm/vmx/pmu_intel.c                       |   1 -
 arch/x86/kvm/vmx/tdx.c                             |  16 +-
 arch/x86/kvm/vmx/vmx.c                             |  19 +-
 arch/x86/kvm/vmx/x86_ops.h                         |   4 +-
 arch/x86/kvm/x86.c                                 | 110 ++++++++---
 arch/x86/kvm/x86.h                                 |   8 +-
 arch/x86/kvm/xen.c                                 |  43 +++--
 include/linux/kvm_host.h                           |  26 +++
 .../testing/selftests/kvm/include/x86/processor.h  |   2 +
 .../testing/selftests/kvm/x86/pmu_counters_test.c  |   6 +-
 .../selftests/kvm/x86/pmu_event_filter_test.c      |   4 +-
 tools/testing/selftests/kvm/x86/set_sregs_test.c   |  81 ++++++--
 .../kvm/x86/vmx_invalid_nested_guest_state.c       | 118 ++++++++++--
 virt/kvm/kvm_main.c                                |  12 ++
 44 files changed, 857 insertions(+), 539 deletions(-)
 create mode 100644 arch/x86/include/asm/kvm-x86-nested-ops.h