Re: [GIT PULL] KVM: x86: Misc changes for 7.3

[Paolo Bonzini]

On Wed, Aug 12, 2026 at 11:32 PM Sean Christopherson <seanjc@xxxxxxxxxx> wrote:
>
> The main set of x86 changes for 7.3.  Yosry's INVVPID and EFER validation changes
> are probably the most interesting.  Almost everything from me falls into the
> category of "fixes for things that are technically bugs, but that no one cares
> about in practice".

Pulled, thanks.

Paolo

> The following changes since commit a204badd8432f93b7e862e7dac6db0fe3d65f370:
>
>   Merge branch 'kvm-chainsaw' into HEAD (2026-06-25 11:32:09 +0200)
>
> are available in the Git repository at:
>
>   https://github.com/kvm-x86/linux.git tags/kvm-x86-misc-7.3
>
> for you to fetch changes up to 66ee8f1556575c8f9ae76932dd3aca65b4b60e59:
>
>   KVM: x86/pmu: Clean up vPMU comments and stray blank lines (2026-08-05 16:42:23 -0700)
>
> ----------------------------------------------------------------
> KVM x86 misc changes for 7.3
>
>  - Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.
>
>  - Harden the SNP and TDX "populate" ioctls against bad input, and to prepare
>    for supporting in-place private<=>shared conversion.
>
>  - Fix a variety of #DB priority bugs.
>
>  - Fix a class of races related to enabling Hyper-V emulation on a vCPU after
>    the vCPU is visible to the rest of KVM.
>
>  - Use static calls for nested virtualization ops.
>
>  - Move more KVM-internal code out of x86's kvm_host.h.
>
>  - Enumerate support for a variety of Zhaoxin instructions that don't require
>    explicit virtualization.
>
>  - Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.
>
>  - Harden kvm_vcpu_map() against double-mapping and thus leaking references.
>
>  - Misc fixes and cleanups, e.g. for largely benign syzkaller splats.
>
> ----------------------------------------------------------------
> Binbin Wu (1):
>       KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf
>
> Carlos López (3):
>       KVM: x86: Treat any non-zero return from set_dr() as a faulting condition
>       KVM: x86: Fix array_index_nospec() protection in kvm_vcpu_ioctl_x86_set_mce()
>       KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
>
> Ewan Hai-oc (5):
>       KVM: x86: Expose Zhaoxin SM2 CPUID feature
>       KVM: x86: Expose Zhaoxin CCS (SM3 + SM4) CPUID feature
>       KVM: x86: Expose Zhaoxin RNG2 CPUID feature
>       KVM: x86: Expose Zhaoxin PHE2 CPUID feature
>       KVM: x86: Expose Zhaoxin RSA CPUID feature
>
> Hao Zhang (1):
>       KVM: selftests: Extend the invalid nVMX guest state test to cover RSM
>
> Joerg Roedel (1):
>       KVM: SEV: Explicitly disallow NULL user address for SNP_LAUNCH_UPDATE
>
> Kai Huang (1):
>       KVM: x86: Use KVM_X86_OP() for the .pi_update_irte() hook
>
> Like Xu (1):
>       KVM: x86/pmu: Clean up vPMU comments and stray blank lines
>
> Sean Christopherson (45):
>       KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02
>       KVM: TDX: Return EINVAL, not EOPNOTSUPP, for NULL INIT_MEM_REGION source
>       KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 value
>       KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority
>       KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPL
>       KVM: VMX: Prioritize DR7.GD=1 #DB over CPL>0 #GP on Intel
>       KVM: x86: Use kvm_dr{6,7}_valid() to check DR{4,5,6,7} write values in emulator
>       KVM: x86: WARN if MOV DR emulation hits a "too late" #GP
>       KVM: x86: Read CR4.DE in emulator if and only if accessing DR4 or DR5
>       KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller
>       KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo()
>       KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses
>       KVM: x86/xen: Always route non-singleshot-timer vCPU hypercalls to userspace
>       KVM: x86/xen: Consolidate checks on Xen vCPU ID for singleshot timer hypercalls
>       KVM: x86/xen: Punt singleshot timer hcalls to userspace if Xen vCPU ID isn't set
>       KVM: Initialize a vCPU's index to '-1' while it's being created
>       KVM: Move nVMX's lockdep logic for vcpu->mutex to a common helper
>       KVM: x86: Treat a vCPU as unreachable if its index is invalid
>       KVM: x86/hyperv: Assert vCPU's mutex is held in to_hv_vcpu()
>       KVM: x86/hyperv: Use {READ,WRITE}_ONCE for cross-task synic->active accesses
>       KVM: x86: Move the "APIC attention" macros from kvm_host.h => lapic.c
>       KVM: x86/mmu: Annotate tdp_enabled as being read-mostly
>       KVM: x86: Pluralize the macro guard name for msrs.h
>       KVM: x86: Move CR and DR macro definitions from kvm_host.h => regs.h
>       KVM: x86: Move KVM_GUESTDBG_VALID_MASK from kvm_host.h => x86.c
>       KVM: x86: Add static asserts to document connection b/w TSS structs and macros
>       KVM: x86: Move KVM's arbitrary task switch reason enums to x86.h
>       KVM: x86: Move "struct kvm_apic_map" definition from kvm_host.h => lapic.h
>       KVM: x86: Move "struct kvm_vcpu_hv" and all children from kvm_host.h => hyperv.h
>       KVM: x86: Reject nested CAP enablement if nested virtualization is disabled
>       KVM: x86: Add static calls for nested virtualization ops
>       KVM: x86: Move nested_ops out of kvm_x86_ops, to global kvm_nested_ops
>       KVM: x86: Don't WARN if IRQ disappears because it was cleared from the PIC
>       KVM: x86: Don't WARN if IRQ disappears when Xen emulation is enabled.
>       KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit
>       KVM: nSVM: Add CLASS()es for automagically handling local kvm_vcpu_map() usage
>       KVM: nSVM: Use CLASS(kvm_vcpu_map_local) for SMM VMCB mappings
>       KVM: nVMX: Use CLASS(kvm_vcpu_map_local_readonly) for MSR bitmap merging
>       KVM: PPC: Use CLASS(kvm_vcpu_map_local) to patch dcbz
>       KVM: Harden kvm_vcpu_map() against double-mapping and thus leaking references
>       KVM: x86: Extract VMX's unhandleable emulation check to common x86
>       KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation
>       KVM: x86: Rework kvm_x86_ops.vcpu_pre_run() into .vcpu_needs_initialization()
>       KVM: selftests: Use port 0x80 in invalid nVMX guest state test
>       KVM: selftests: Refactor invalid nVMX state test to prepare for RSM testcase
>
> Tim Wiederhake (1):
>       KVM: x86: Replace delivery mode TODO with WARN_ON_ONCE
>
> Yosry Ahmed (9):
>       KVM: nVMX: Always flush vpid02 on first use
>       KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
>       KVM: x86: Move enabling EFER.SVME and EFER.LMSLE to generic EFER setup
>       KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported
>       KVM: x86: Always initialize EFER reserved bits on vendor initialization
>       KVM: x86: Reverse the polarity of efer_reserved_bits
>       KVM: x86: Move supported EFER bits to kvm_caps
>       KVM: x86: Check EFER validity on KVM_SET_SREGS*
>       KVM: selftests: Extend set_sregs test to cover EFER
>
> leixiang (1):
>       KVM: Remove kvm_debugfs_dir on kvm_init() error paths
>
>  arch/powerpc/kvm/book3s_pr.c                       |  11 +-
>  arch/x86/include/asm/cpufeatures.h                 |  10 +
>  arch/x86/include/asm/kvm-x86-nested-ops.h          |  36 ++++
>  arch/x86/include/asm/kvm-x86-ops.h                 |   5 +-
>  arch/x86/include/asm/kvm_host.h                    | 212 ++-------------------
>  arch/x86/kvm/cpuid.c                               |  22 ++-
>  arch/x86/kvm/emulate.c                             |  49 +++--
>  arch/x86/kvm/hyperv.c                              |  95 +++++----
>  arch/x86/kvm/hyperv.h                              | 117 +++++++++++-
>  arch/x86/kvm/irq.h                                 |  20 ++
>  arch/x86/kvm/lapic.c                               |  13 +-
>  arch/x86/kvm/lapic.h                               |  33 ++++
>  arch/x86/kvm/mmu.h                                 |  11 +-
>  arch/x86/kvm/mmu/mmu.c                             |   2 +-
>  arch/x86/kvm/mmu/paging_tmpl.h                     |   2 +-
>  arch/x86/kvm/msrs.c                                |  21 +-
>  arch/x86/kvm/msrs.h                                |   5 +-
>  arch/x86/kvm/pmu.c                                 |  12 +-
>  arch/x86/kvm/pmu.h                                 |   4 +-
>  arch/x86/kvm/regs.c                                |   3 +-
>  arch/x86/kvm/regs.h                                |  38 ++++
>  arch/x86/kvm/smm.c                                 |   4 +
>  arch/x86/kvm/svm/nested.c                          |  20 +-
>  arch/x86/kvm/svm/sev.c                             |  16 +-
>  arch/x86/kvm/svm/svm.c                             |  66 ++-----
>  arch/x86/kvm/svm/svm.h                             |   1 +
>  arch/x86/kvm/tss.h                                 |   7 +
>  arch/x86/kvm/vmx/main.c                            |  24 ++-
>  arch/x86/kvm/vmx/nested.c                          |  81 ++++----
>  arch/x86/kvm/vmx/nested.h                          |   6 +-
>  arch/x86/kvm/vmx/pmu_intel.c                       |   1 -
>  arch/x86/kvm/vmx/tdx.c                             |  16 +-
>  arch/x86/kvm/vmx/vmx.c                             |  19 +-
>  arch/x86/kvm/vmx/x86_ops.h                         |   4 +-
>  arch/x86/kvm/x86.c                                 | 110 ++++++++---
>  arch/x86/kvm/x86.h                                 |   8 +-
>  arch/x86/kvm/xen.c                                 |  43 +++--
>  include/linux/kvm_host.h                           |  26 +++
>  .../testing/selftests/kvm/include/x86/processor.h  |   2 +
>  .../testing/selftests/kvm/x86/pmu_counters_test.c  |   6 +-
>  .../selftests/kvm/x86/pmu_event_filter_test.c      |   4 +-
>  tools/testing/selftests/kvm/x86/set_sregs_test.c   |  81 ++++++--
>  .../kvm/x86/vmx_invalid_nested_guest_state.c       | 118 ++++++++++--
>  virt/kvm/kvm_main.c                                |  12 ++
>  44 files changed, 857 insertions(+), 539 deletions(-)
>  create mode 100644 arch/x86/include/asm/kvm-x86-nested-ops.h
>