[PATCH v2 2/4] KVM: nVMX: Make VMPTRST return eVMCS GPA when it is used
From: Vitaly Kuznetsov
Date: Tue Aug 18 2026 - 12:55:22 EST
VMPTRST with active eVMCS is currently forbidden, however, returning 1
without skipping the instruction will likely result in L1 getting
stuck. While TLFS does not specify the expected behavior, genuine Hyper-V
seems to be returning eVMCS GPA. Implement the same behavior in KVM.
Reported-by: f734222792@xxxxxxxxx
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221841
Signed-off-by: Vitaly Kuznetsov <vkuznets@xxxxxxxxxx>
---
arch/x86/kvm/vmx/nested.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 216f54a0b8ae..4b56df4c57f1 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -5946,7 +5946,7 @@ static int handle_vmptrst(struct kvm_vcpu *vcpu)
{
unsigned long exit_qual = vmx_get_exit_qual(vcpu);
u32 instr_info = vmcs_read32(VMX_INSTRUCTION_INFO);
- gpa_t current_vmptr = to_vmx(vcpu)->nested.current_vmptr;
+ gpa_t current_vmptr;
struct x86_exception e;
gva_t gva;
int r;
@@ -5954,8 +5954,16 @@ static int handle_vmptrst(struct kvm_vcpu *vcpu)
if (!nested_vmx_check_permission(vcpu))
return 1;
- if (unlikely(nested_vmx_is_evmptr12_valid(to_vmx(vcpu))))
- return 1;
+ /*
+ * Hyper-V TLFS does not specify the behavior of VMPTRST when eVMCS is used
+ * but genuine Hyper-V seems to be returning eVMCS GPA.
+ */
+#ifdef CONFIG_KVM_HYPERV
+ if (nested_vmx_is_evmptr12_valid(to_vmx(vcpu)))
+ current_vmptr = to_vmx(vcpu)->nested.hv_evmcs_vmptr;
+ else
+#endif
+ current_vmptr = to_vmx(vcpu)->nested.current_vmptr;
if (get_vmx_mem_address(vcpu, exit_qual, instr_info,
true, sizeof(gpa_t), &gva))
--
2.55.0