Re: [GIT PULL] KVM: x86: Fixes for 7.3-rc6+

[Paolo Bonzini]

On Fri, Oct 2, 2026 at 6:48 PM Sean Christopherson <seanjc@xxxxxxxxxx> wrote:
>
> Please pull a few more fixes.  These aren't _that_ urgent, so feel free to
> punt these to 7.4 if you think we're throwing too much into late RCs.
>
> That said, I'd really like to get the AVIC fix into 7.3 as I very deliberately
> didn't tag it for stable@.  The fix depends on what ended up being the changes
> to hold kvm->lock for all of vCPU creation, which I don't really want to
> encourage folks to backport to LTS kernels.  So, if we squeak the AVIC fix
> into 7.3, which is presumably the next LTS, we'll save a one-off backport.
>
> Thanks!
>
> The following changes since commit 973ea70393e885e540f714904e51bc6cac80e3d7:
>
>   KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state (2026-09-28 17:11:49 -0400)
>
> are available in the Git repository at:
>
>   https://github.com/kvm-x86/linux.git tags/kvm-x86-fixes-7.3-rc6
>
> for you to fetch changes up to b3e6212dea2e4328a841ceb37f377583176dc735:
>
>   KVM: x86: Use active memslots for the per-vCPU MMIO cache (2026-09-30 06:40:49 -0700)

Pulled, thanks.

Paolo

> ----------------------------------------------------------------
> KVM x86 fixed for 7.3-rcN
>
>  - If creating a vCPU ultimately fails, clear its entry in the AVIC Physical ID
>    table used by hardware to perform IPI Virtualization and delivered posted
>    IRQs.  I.e. plug the same use-after-free hole related to IPI virtualization
>    and posted IRQs that was fixed for APICv by commit b41f2ca6c0601 ("KVM: VMX:
>    Fix stale PID-pointer table entry left after vCPU free").
>
>  - Use set_page_dirty_lock() instead of set_page_dirty() when marking a page
>    dirty after writing back SNP firmware's desired CPUID state to userspace.
>    Using set_page_dirty() is unsafe if the page/folio isn't locked (as pointed
>    out by its function comment's big DANGER warning, which no one reads given
>    the number of bugs of this exact nature).
>
>  - When checking for an MMIO generation match, use the memslots for the current
>    vCPU context (non-SMM vs. SMM), as a misbehaving guest can coerce KVM into
>    incorrectly identifying a write as MMIO in order to bypass KVM's
>    write-tracking.
>
> ----------------------------------------------------------------
> Jann Horn (1):
>       KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
>
> Jinu Kim (1):
>       KVM: x86: Use active memslots for the per-vCPU MMIO cache
>
> Naveen N Rao (AMD) (1):
>       KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails
>
> Sean Christopherson (2):
>       KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable
>       KVM: SVM: Use "is AVIC-addressable" helper to sanity check load()/put()
>
>  arch/x86/kvm/svm/avic.c | 22 ++++++++++++++++------
>  arch/x86/kvm/svm/sev.c  |  2 +-
>  arch/x86/kvm/svm/svm.c  |  6 +++++-
>  arch/x86/kvm/svm/svm.h  |  1 +
>  arch/x86/kvm/x86.h      |  4 ++--
>  5 files changed, 25 insertions(+), 10 deletions(-)
>