[PATCH] KVM: SVM: Sync CR8 to the local APIC after marking the VMCB clean

[PATCH] KVM: SVM: Sync CR8 to the local APIC after marking the VMCB clean

[Sean Christopherson]

From: Chris Oo <cho@microsoft.com>

Sync CR8 from the VMCB to the TPR *after* marking all VMCB fields as clean,
as syncing CR8 can toggle the CR8 write intercept and thus mark INTERCEPTS
as dirty.  Clobbering the dirty bit can result in KVM failing to detect CR8
writes if the underlying "hardware" uses the clean bits to optimize VMRUN,
e.g. when KVM is running on Hyper-V.

Failure to intercept CR8 usually manifests as hangs when running Windows as
L2, as KVM's view of vTPR stays high and so KVM never injects pending IRQs.

Fixes: bb365a506b1e ("KVM: x86: Unconditionally recompute CR8 intercept on PPR update")
Cc: stable@vger.kernel.org
Cc: Carlos López <clopez@suse.de>
Cc: Stefano Garzarella <sgarzare@redhat.com>
Not-signed-off-by: Chris Oo <cho@microsoft.com>
[sean: rewrite changelog, massage comment]
Signed-off-by: Sean Christopherson <seanjc@google.com>
---

Chris, as mentioned, I need your SoB.

 arch/x86/kvm/svm/svm.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 581bc3a23c95..3152846a6ccd 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -4726,8 +4726,6 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)
 	if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
 		kvm_after_interrupt(vcpu);
 
-	sync_cr8_to_lapic(vcpu);
-
 	svm->next_rip = 0;
 	if (is_guest_mode(vcpu)) {
 		nested_sync_control_from_vmcb02(svm);
@@ -4758,6 +4756,13 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)
 			       vcpu_to_pmu(vcpu)->global_ctrl);
 	}
 
+	/*
+	 * Note!  Any action that might dirty the VMCB must be done *after*
+	 * marking all VMCB fields as clean, e.g. syncing CR8 can toggle the
+	 * CR8 write intercept and thus mark the intercepts field dirty.
+	 */
+	sync_cr8_to_lapic(vcpu);
+
 	/* if exit due to PF check for async PF */
 	if (svm->vmcb->control.exit_code == SVM_EXIT_EXCP_BASE + PF_VECTOR)
 		vcpu->arch.apf.host_apf_flags =

base-commit: d21eef2084a9af87ac2a783bc7c2b175ba114e4e
-- 
2.56.1.703.gf848ed807c-goog

Re: [PATCH] KVM: SVM: Sync CR8 to the local APIC after marking the VMCB clean

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] KVM: SVM: missing Signed-off-by trailer from patch author
--

commit 233803838af902e26ce77bf3e6c981b3c2991bd9
Author: Chris Oo <cho@microsoft.com>

> KVM: SVM: Sync CR8 to the local APIC after marking the VMCB clean
>
> Sync CR8 from the VMCB to the TPR *after* marking all VMCB fields as clean,
> as syncing CR8 can toggle the CR8 write intercept and thus mark INTERCEPTS
> as dirty.  Clobbering the dirty bit can result in KVM failing to detect CR8
> writes if the underlying "hardware" uses the clean bits to optimize VMRUN,
> e.g. when KVM is running on Hyper-V.
>
> Failure to intercept CR8 usually manifests as hangs when running Windows as
> L2, as KVM's view of vTPR stays high and so KVM never injects pending IRQs.
>
> Fixes: bb365a506b1e ("KVM: x86: Unconditionally recompute CR8 intercept on PPR update")
> Cc: stable@vger.kernel.org
> Cc: Carlos López <clopez@suse.de>
> Cc: Stefano Garzarella <sgarzare@redhat.com>
> Not-signed-off-by: Chris Oo <cho@microsoft.com>
> [sean: rewrite changelog, massage comment]
> Signed-off-by: Sean Christopherson <seanjc@google.com>

[Severity: High]
As noted below the tearline, the patch author's Signed-off-by trailer is
missing and currently listed as Not-signed-off-by.  A Signed-off-by from
Chris Oo <cho@microsoft.com> is required under the Developer's Certificate
of Origin before this commit can be merged.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113162556.461390-1-seanjc@google.com?part=1

Re: [EXTERNAL] [PATCH] KVM: SVM: Sync CR8 to the local APIC after marking the VMCB clean

[Chris Oo]

Thanks for helping to clean up my patch Sean, appreciate it. 

Signed-off-by: Chris Oo <cho@microsoft.com>

Thanks,
Chris

________________________________________
From: Sean Christopherson <seanjc@google.com>
Sent: Friday, November 13, 2026 8:25 AM
To: Sean Christopherson <seanjc@google.com>; Paolo Bonzini <pbonzini@redhat.com>
Cc: kvm@vger.kernel.org <kvm@vger.kernel.org>; linux-kernel@vger.kernel.org <linux-kernel@vger.kernel.org>; Carlos López <clopez@suse.de>; Stefano Garzarella <sgarzare@redhat.com>; Chris Oo <cho@microsoft.com>
Subject: [EXTERNAL] [PATCH] KVM: SVM: Sync CR8 to the local APIC after marking the VMCB clean
 
From: Chris Oo <cho@microsoft.com>

Sync CR8 from the VMCB to the TPR *after* marking all VMCB fields as clean,
as syncing CR8 can toggle the CR8 write intercept and thus mark INTERCEPTS
as dirty.  Clobbering the dirty bit can result in KVM failing to detect CR8
writes if the underlying "hardware" uses the clean bits to optimize VMRUN,
e.g. when KVM is running on Hyper-V.

Failure to intercept CR8 usually manifests as hangs when running Windows as
L2, as KVM's view of vTPR stays high and so KVM never injects pending IRQs.

Fixes: bb365a506b1e ("KVM: x86: Unconditionally recompute CR8 intercept on PPR update")
Cc: stable@vger.kernel.org
Cc: Carlos López <clopez@suse.de>
Cc: Stefano Garzarella <sgarzare@redhat.com>
Not-signed-off-by: Chris Oo <cho@microsoft.com>
[sean: rewrite changelog, massage comment]
Signed-off-by: Sean Christopherson <seanjc@google.com>
---

Chris, as mentioned, I need your SoB.

 arch/x86/kvm/svm/svm.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 581bc3a23c95..3152846a6ccd 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -4726,8 +4726,6 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)
        if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
                kvm_after_interrupt(vcpu);
 
-       sync_cr8_to_lapic(vcpu);
-
        svm->next_rip = 0;
        if (is_guest_mode(vcpu)) {
                nested_sync_control_from_vmcb02(svm);
@@ -4758,6 +4756,13 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)
                               vcpu_to_pmu(vcpu)->global_ctrl);
        }
 
+       /*
+        * Note!  Any action that might dirty the VMCB must be done *after*
+        * marking all VMCB fields as clean, e.g. syncing CR8 can toggle the
+        * CR8 write intercept and thus mark the intercepts field dirty.
+        */
+       sync_cr8_to_lapic(vcpu);
+
        /* if exit due to PF check for async PF */
        if (svm->vmcb->control.exit_code == SVM_EXIT_EXCP_BASE + PF_VECTOR)
                vcpu->arch.apf.host_apf_flags =

base-commit: d21eef2084a9af87ac2a783bc7c2b175ba114e4e
--
2.56.1.703.gf848ed807c-goog

Re: [PATCH] KVM: SVM: Sync CR8 to the local APIC after marking the VMCB clean

[Yosry Ahmed]

On Fri, Nov 13, 2026 at 8:28 AM Sean Christopherson <seanjc@google.com> wrote:
>
> From: Chris Oo <cho@microsoft.com>
>
> Sync CR8 from the VMCB to the TPR *after* marking all VMCB fields as clean,
> as syncing CR8 can toggle the CR8 write intercept and thus mark INTERCEPTS
> as dirty.  Clobbering the dirty bit can result in KVM failing to detect CR8
> writes if the underlying "hardware" uses the clean bits to optimize VMRUN,
> e.g. when KVM is running on Hyper-V.
>
> Failure to intercept CR8 usually manifests as hangs when running Windows as
> L2, as KVM's view of vTPR stays high and so KVM never injects pending IRQs.
>
> Fixes: bb365a506b1e ("KVM: x86: Unconditionally recompute CR8 intercept on PPR update")
> Cc: stable@vger.kernel.org
> Cc: Carlos López <clopez@suse.de>
> Cc: Stefano Garzarella <sgarzare@redhat.com>
> Not-signed-off-by: Chris Oo <cho@microsoft.com>
> [sean: rewrite changelog, massage comment]
> Signed-off-by: Sean Christopherson <seanjc@google.com>

Reviewed-by: Yosry Ahmed <yosry@kernel.org>