Re: [PATCH v2 13/13] KVM: nSVM: Only copy NP_ENABLE from VMCB01's misc_ctl

Sean Christopherson
2025-12-09T16:23:30Z

On Mon, Nov 10, 2025, Yosry Ahmed wrote:
> The 'misc_ctl' field in VMCB02 is taken as-is from VMCB01. However, the
> only bit that needs to copied is NP_ENABLE.

Nit, explicitly state that all other existing bits are for SEV right away, e.g.

However, the only bit that needs to copied is NP_ENABLE, as all other known
bits in misc_ctl are related to SEV guests, and KVM doesn't support nested
virtualization for SEV guests.

> This is a nop now because other bits are for SEV guests, which do not support
> nested. Nonetheless, this hardens against future bugs if/when other bits are
> set for L1 but should not be set for L2.
>
> Opportunistically add a comment explaining why NP_ENABLE is taken from
> VMCB01 and not VMCB02.
>
> Suggested-by: Jim Mattson <jmattson@google.com>
> Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
> ---
> arch/x86/kvm/svm/nested.c | 12 ++++++++++--
> 1 file changed, 10 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index 503cb7f5a4c5f..4e278c1f9e6b3 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -837,8 +837,16 @@ static void nested_vmcb02_prepare_control(struct vcpu_svm *svm,
> V_NMI_BLOCKING_MASK);
> }
>
> - /* Copied from vmcb01. msrpm_base can be overwritten later. */
> - vmcb02->control.misc_ctl = vmcb01->control.misc_ctl;
> + /*
> + * Copied from vmcb01. msrpm_base can be overwritten later.
> + *
> + * NP_ENABLE in vmcb12 is only used for consistency checks. If L1
> + * enables NPTs, KVM shadows L1's NPTs and uses those to run L2. If L1
> + * disables NPT, KVM runs L2 with the same NPTs used to run L1. For the
> + * latter, L1 runs L2 with shadow page tables that translate L2 GVAs to
> + * L1 GPAs, so the same NPTs can be used for L1 and L2.
> + */
> + vmcb02->control.misc_ctl = vmcb01->control.misc_ctl & SVM_MISC_CTL_NP_ENABLE;
> vmcb02->control.iopm_base_pa = vmcb01->control.iopm_base_pa;
> vmcb02->control.msrpm_base_pa = vmcb01->control.msrpm_base_pa;
>
> --
> 2.51.2.1041.gc1ab5b90ca-goog
>