Re: [PATCH v2 1/3] KVM: SVM: Configure ALLOW_LARGER_RAP in svm_vcpu_after_set_cpuid()

[Sean Christopherson <seanjc@google.com>]

On Mon, Jul 20, 2026, Sean Christopherson wrote:
> On Fri, Jul 17, 2026, Jim Mattson wrote:
> > On initial vCPU creation, init_vmcb() is called before userspace configures
> > guest CPUID via KVM_SET_CPUID2. Consequently, ERAP_CONTROL_ALLOW_LARGER_RAP
> > is never set during initial vCPU creation. If an AP later receives an INIT
> > signal after CPUID has been set, init_vmcb() would set the bit for that AP,
> > but the BSP would be left with ALLOW_LARGER_RAP clear.
> > 
> > Configure ALLOW_LARGER_RAP in svm_vcpu_after_set_cpuid() to handle the BSP.
> > 
> > Keep the code in init_vmcb() to restore ALLOW_LARGER_RAP after the VMCB has
> > been cleared on the VCPU triple-fault reset path.
> > 
> > Fixes: db5e82496492 ("KVM: SVM: Virtualize and advertise support for ERAPS")
> > Assisted-by: Gemini:Gemini-Next
> > Signed-off-by: Jim Mattson <jmattson@google.com>
> > ---
> >  arch/x86/kvm/svm/svm.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> > 
> > diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> > index 4d2bacd00ec4..bf868da14cd2 100644
> > --- a/arch/x86/kvm/svm/svm.c
> > +++ b/arch/x86/kvm/svm/svm.c
> > @@ -4736,6 +4736,11 @@ static void svm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu)
> >  	if (guest_cpuid_is_intel_compatible(vcpu))
> >  		guest_cpu_cap_clear(vcpu, X86_FEATURE_V_VMSAVE_VMLOAD);
> >  
> > +	if (guest_cpu_cap_has(vcpu, X86_FEATURE_ERAPS))
> > +		svm->vmcb01.ptr->control.erap_ctl |= ERAP_CONTROL_ALLOW_LARGER_RAP;
> > +	else
> > +		svm->vmcb01.ptr->control.erap_ctl &= ~ERAP_CONTROL_ALLOW_LARGER_RAP;
> 
> If we handle ERAPS here, can't we drop the code in init_vmcb()?  In the context
> of PML enablement, AMD is updating the APM to clarify that the control area remains
> valid after shutdown, i.e. KVM doesn't need to re-initialize erap_ctl when
> synthesizing INIT from shutdown_interception().
> 
>   "After an intercepted shutdown, the VMCB control area is valid (with the
>    exception of offsets 60h, 61h, and 68h) and the VMCB state save area is
>    undefined."
> 
> https://lore.kernel.org/all/6688fe2e-c723-404a-80e1-3f4c5f5cc4c6@amd.com

LOL, nice, I just saw the Sashiko report from v1.  I think the way to handle this
is to go with this version, and then rework shutdown_interception() as part of PML
enablement to not clear the entire page, only the contents that may be corrupted.