Re: [PATCH 1/3] KVM: SVM: Configure ALLOW_LARGER_RAP in svm_vcpu_after_set_cpuid()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The ERAP_CONTROL_ALLOW_LARGER_RAP bit in the VMCB is permanently lost if the vCPU is reset due to a triple-fault (SHUTDOWN intercept).
--

--- Patch [1]: [PATCH 1/3] KVM: SVM: Configure ALLOW_LARGER_RAP in svm_vcpu_after_set_cpuid() ---
commit 7fe0a6077a4e214f36b5f568e5752ff88dbf1752
Author: Jim Mattson <jmattson@google.com>

KVM: SVM: Configure ALLOW_LARGER_RAP in svm_vcpu_after_set_cpuid()

This commit moves the configuration of the ALLOW_LARGER_RAP bit from
init_vmcb() to svm_vcpu_after_set_cpuid() so that it is properly set
when userspace configures the guest CPUID. It removes the previous
initialization logic from init_vmcb().

> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index ef69a51ab27f9..11e023abc7ab9 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -1243,9 +1243,6 @@ static void init_vmcb(struct kvm_vcpu *vcpu, bool init_event)
>  		svm_clr_intercept(svm, INTERCEPT_PAUSE);
>  	}
>  
> -	if (guest_cpu_cap_has(vcpu, X86_FEATURE_ERAPS))
> -		svm->vmcb->control.erap_ctl |= ERAP_CONTROL_ALLOW_LARGER_RAP;
> -

[Severity: High]
Does removing this initialization cause the ALLOW_LARGER_RAP bit to be
permanently lost after a triple-fault?

When a guest triggers a triple fault, KVM intercepts the shutdown and wipes
the VMCB:

arch/x86/kvm/svm/svm.c:shutdown_interception() {
    ...
    clear_page(svm->vmcb);
    kvm_vcpu_reset(vcpu, true);
    ...
}

kvm_vcpu_reset() then calls init_vmcb() to reinitialize the VMCB. Since the
ALLOW_LARGER_RAP setup is removed from init_vmcb(), and userspace typically
does not call KVM_SET_CPUID2 during a soft VM reset, will the ERAPS capability
remain disabled indefinitely after the reset?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716232524.2092085-1-jmattson@google.com?part=1