[GIT PULL] KVM fixes for Linux 7.3-rc8 or final

[Paolo Bonzini]

Linus,

The following changes since commit a90ee4305c4a5df72c11b31dacfdc76e00fcf78a:

  Linux 7.3-rc6 (2026-10-04 13:45:25 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/virt/kvm/kvm.git tags/for-linus

for you to fetch changes up to e90ab3669181c6469e3647ef2b30ae408275f496:

  KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes (2026-10-12 18:58:45 +0200)

----------------------------------------------------------------
More x86 fixes:

- Fix a WARN if the SS bit is set in #NPF exit codes; the AMD manual
  is unclear about whether it can be set when the guest uses CET but the
  SupervisorShadowStackEn feature (which KVM does not use) is disabled.
  However, Hyper-V has started using CET now that KVM supports GMET
  (it wants the two feature in pairs), and that dissolves all the doubts:
  the SS bit *is* reported and not clearing it causes a WARN and/or a
  UBSAN splat.

- If creating a vCPU ultimately fails, clear its entry in the AVIC Physical ID
  table used by hardware to perform IPI Virtualization and delivered posted
  IRQs.  I.e. plug the same use-after-free hole related to IPI virtualization
  and posted IRQs that was fixed for APICv by commit b41f2ca6c0601 ("KVM: VMX:
  Fix stale PID-pointer table entry left after vCPU free").

- Use set_page_dirty_lock() instead of set_page_dirty() when marking a page
  dirty after writing back SNP firmware's desired CPUID state to userspace.
  Using set_page_dirty() is unsafe if the page/folio isn't locked (as pointed
  out by its function comment's big DANGER warning, which no one reads given
  the number of bugs of this exact nature).

- When checking for an MMIO generation match, use the memslots for the current
  vCPU context (non-SMM vs. SMM), as a misbehaving guest can coerce KVM into
  incorrectly identifying a write as MMIO in order to bypass KVM's
  write-tracking.

----------------------------------------------------------------
Jann Horn (1):
      KVM: SEV: Fix page dirtying in sev_gmem_post_populate()

Jinu Kim (1):
      KVM: x86: Use active memslots for the per-vCPU MMIO cache

Naveen N Rao (AMD) (1):
      KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails

Paolo Bonzini (2):
      Merge tag 'kvm-x86-fixes-7.3-rc6' of https://github.com/kvm-x86/linux into HEAD
      KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes

Sean Christopherson (2):
      KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable
      KVM: SVM: Use "is AVIC-addressable" helper to sanity check load()/put()

 arch/x86/kvm/mmu.h             | 16 ++++++++++++----
 arch/x86/kvm/mmu/paging_tmpl.h |  3 +--
 arch/x86/kvm/svm/avic.c        | 22 ++++++++++++++++------
 arch/x86/kvm/svm/sev.c         |  2 +-
 arch/x86/kvm/svm/svm.c         |  6 +++++-
 arch/x86/kvm/svm/svm.h         |  1 +
 arch/x86/kvm/x86.h             |  4 ++--
 7 files changed, 38 insertions(+), 16 deletions(-)