Re: [PATCH v2 2/5] KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state

[Sean Christopherson <seanjc@google.com>]

On Wed, Sep 02, 2026, sashiko-bot@kernel.org wrote:
> > diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> > index 49fb10ad1f9f6..23d29597d6bf2 100644
> > --- a/arch/x86/kvm/svm/nested.c
> > +++ b/arch/x86/kvm/svm/nested.c
> > @@ -789,6 +789,10 @@ static void nested_vmcb02_prepare_save(struct vcpu_svm *svm)
> >  
> >  	kvm_set_rflags(vcpu, save->rflags | X86_EFLAGS_FIXED);
> >  
> > +	/* SVM ignores EFER.LMA if EFER.LME=0 (instead of failing VMRUN). */
> > +	if (!(svm->nested.save.efer & EFER_LME))
> > +		svm->nested.save.efer &= ~EFER_LMA;
> > +
> >  	svm_set_efer(vcpu, svm->nested.save.efer);
> >  
> >  	svm_set_cr0(vcpu, svm->nested.save.cr0);
> 
> [Severity: High]
> This is a pre-existing issue, but does this logic only implement half of the
> hardware VMRUN rule? 
> 
> While this correctly fixes the invariant for EFER.LME=0, could a malicious
> guest desynchronize KVM's MMU state from the physical CPU when EFER.LME=1?
> 
> If an L1 guest creates a VMCB12 with EFER.LME=1, CR0.PG=1, but EFER.LMA=0,
> and executes VMRUN, nested_vmcb02_prepare_save() skips the LMA update
> because LME=1, passing LMA=0 to svm_set_efer().
> 
> Then, when we reach svm_set_cr0(), it fails to correct EFER.LMA because it
> expects an edge transition (!is_paging(vcpu)), which is always false since
> L1 must already be paging to execute VMRUN:
> 
> arch/x86/kvm/svm/svm.c:svm_set_cr0() {
>     ...
>     if (vcpu->arch.efer & EFER_LME) {
>         if (!is_paging(vcpu) && (cr0 & X86_CR0_PG)) {
>             vcpu->arch.efer |= EFER_LMA;
>     ...
> }
> 
> Would this allow the guest to trick KVM's instruction emulator into fetching
> arbitrary instructions from a different physical page than what the guest
> actually executed?

Maybe?  But unless it negatively affects the host, I don't think we care?