Re: [PATCH v3 2/5] KVM: nSVM: Disable LBRV in nested control cache when unsupported

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The `SVM_MISC2_ENABLE_V_VMLOAD_VMSAVE` bit is never cleared in `vmcb02->control.misc_ctl2` once set, allowing L2 to bypass L1 intercepts or causing host log spam.
--

--- Patch [2]: [PATCH v3 2/5] KVM: nSVM: Disable LBRV in nested control cache when unsupported ---
commit 54bf374923da671433d0174e1a9df561ac634275
Author: Shivansh Dhiman <shivansh.dhiman@amd.com>

KVM: nSVM: Disable LBRV in nested control cache when unsupported

Clear SVM_MISC2_ENABLE_V_LBR in __nested_copy_vmcb_control_to_cache() when
the vCPU does not support LBR Virtualization. This lets the cached value be
consumed directly instead of re-checking X86_FEATURE_LBRV on every access.

> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index d3df6b22bfefe..84248e6665cfe 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -534,6 +534,11 @@ void __nested_copy_vmcb_control_to_cache(struct kvm_vcpu *vcpu,
>  	if (!gmet_enabled || !guest_cpu_cap_has(vcpu, X86_FEATURE_GMET))
>  		to->misc_ctl &= ~SVM_MISC_ENABLE_GMET;
>  
> +	/* Always clear misc_ctl2 bits that the guest cannot use */
> +	to->misc_ctl2 = from->misc_ctl2;
> +	if (!lbrv || !guest_cpu_cap_has(vcpu, X86_FEATURE_LBRV))
> +		to->misc_ctl2 &= ~SVM_MISC2_ENABLE_V_LBR;
> +
>  	to->iopm_base_pa        = from->iopm_base_pa & PAGE_MASK;
>  	to->msrpm_base_pa       = from->msrpm_base_pa & PAGE_MASK;
>  	to->tsc_offset          = from->tsc_offset;

While reviewing these updates to misc_ctl2, I noticed a related pre-existing
behavior in nested_vmcb02_prepare_control():

arch/x86/kvm/svm/nested.c:nested_vmcb02_prepare_control() {
...
	if (!nested_vmcb_needs_vls_intercept(svm))
		vmcb02->control.misc_ctl2 |= SVM_MISC2_ENABLE_V_VMLOAD_VMSAVE;
...
}

[Severity: High]
This is a pre-existing issue, but does this code leave the
SVM_MISC2_ENABLE_V_VMLOAD_VMSAVE bit set in vmcb02->control.misc_ctl2 once it
has been enabled?

If L1 enables virtual VMLOAD/VMSAVE for L2, KVM sets this bit via bitwise OR.
On a subsequent nested VMRUN where L1 disables the feature or disables nested
paging, KVM correctly tries to set intercepts or clears NP_ENABLE. However,
it appears to leave V_VMLOAD_VMSAVE set to 1 since there is no else branch
to clear it, and the vmcb02 page is reused across runs.

Could this allow a malicious L2 guest to bypass L1's intercepts for VMLOAD and
VMSAVE, or cause an L1 guest to spam the host kernel log with SVM_EXIT_ERR by
toggling NP_ENABLE while V_VMLOAD_VMSAVE remains stuck at 1?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709082953.69434-1-shivansh.dhiman@amd.com?part=2