Re: [PATCH v3] KVM: x86: Mark nested RSM-created VM-Enter as untrusted

[Sean Christopherson <seanjc@google.com>]

On Mon, Jul 27, 2026, Hao Zhang wrote:
> On Tue, Jul 21, 2026, Sean Christopherson wrote:
> > On Tue, Jul 21, 2026, Hao Zhang wrote:
> > Do you happen to have a reproducer I can test?  Either way, I'll try to add a
> > testcase to tools/testing/selftests/kvm/x86/vmx_invalid_nested_guest_state.c to
> > cover the SMRAM => RSM path.
> >
> 
> I tried to capture your suggestion in a KVM selftest that covers the RSM
> path directly.
> 
> The test extends vmx_invalid_nested_guest_state.c by entering SMM after L2
> has run, corrupting the 64-bit SMRAM image for TR, and then executing RSM.
> This makes KVM attempt to resume L2 with invalid guest state restored from
> SMRAM.
> 
> On an unfixed kernel, the test fails in the new RSM path with KVM_RUN
> returning -EIO.
> 
> Please let me know if this matches what you had in mind, or if you would
> prefer the coverage to be structured differently.

Very nice!  There are some tweaks that can be done to reduce the amount of
duplicate code, but this is exactly what I was thinking.

I have this massaged into a proper set of patches, I'll post v4 shortly.