[GIT PULL] KVM: x86 pull requests for 7.3

[GIT PULL] KVM: x86 pull requests for 7.3

[Sean Christopherson]

Nothing super unusual is cycle.  I did manage to end up with two selftests pull
requests, appropriately named selftests and selftests2 in the spirt of KVM uAPI,
with a minor conflict between them.  I originally created a dedicated topic
branch for the new irq_test to isolate a dependency on the VFIO library, but
then realized I really wanted to use some of the new infrastructure APIs in
other tests.

Assuming you merge selftests before selftests2, the resolution I've been using is
to use the kvm_ prefixes pthread APIs (which assert success), but otherwise keep
the functional changes from "selftests".

diff --cc tools/testing/selftests/kvm/steal_time.c
index 92e7ffcd68b7,83a1e3aa15cf..6e9cc0e34ec0
--- tools/testing/selftests/kvm/steal_time.c
+++ tools/testing/selftests/kvm/steal_time.c
@@@ -553,11 -553,7 +548,11 @@@ int main(int ac, char **av
  
                /* Steal time from the VCPU. The steal time thread has the same CPU affinity as the VCPUs. */
                run_delay = get_run_delay();
-               pthread_create(&thread, NULL, do_steal_time, NULL);
-               pthread_getaffinity_np(thread, sizeof(cpuset), &cpuset);
 -              kvm_pthread_create(&thread, &attr, do_steal_time, NULL);
++              kvm_pthread_create(&thread, NULL, do_steal_time, NULL);
++              kvm_pthread_getaffinity_np(thread, sizeof(cpuset), &cpuset);
 +              TEST_ASSERT(CPU_COUNT(&cpuset) == 1 && CPU_ISSET(cpu, &cpuset),
 +                          "Worker failed to inherit parent's CPU affinity");
 +
                do
                        sched_yield();
                while (get_run_delay() - run_delay < MIN_RUN_DELAY_NS);

[GIT PULL] KVM: x86: Xen clock/timekeeping changes for 7.3

[Sean Christopherson]

Three small Xen-specific changes.  I was hoping to include a much larger pile
of kvmclock and timekeeping changes from David, hence the "clocks" name.
Another 21 patches _this_ close to making the 7.3 cut, and there's another 25
coming on top of those.

While kvmclock is on your mind (or at least, close to being on your mind), can
you weigh on on the KVM_SET_CLOCK_GUEST discussion[*]?  I hopefully, finally
understand the code well enough to be comfortable merging the code, but your
input on the uAPI would be super helpful.  Thanks!

[*] https://lore.kernel.org/all/ants4VjfAiblaWsl@google.com

The following changes since commit 8cdeaa50eae8dad34885515f62559ee83e7e8dda:

  Linux 7.2-rc2 (2026-07-05 14:44:06 -1000)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-clocks-7.3

for you to fetch changes up to 7d3bd21e457bd091beb982553fcf32fd9ee5929f:

  KVM: x86: Remove runtime Xen TSC frequency CPUID update (2026-08-07 09:11:56 -0700)

----------------------------------------------------------------
KVM x86 PV clocks and timekeeping related changes for 7.3

 - Remove a defunct masterclock update from kvm_xen_shared_info_init() that
   could result in corrupting kvmclock, for a lose definition or "corrupting",
   due to triggering an unnecessary switch to/from masterclock mode.

 - Skip Xen runstate time updates if time has effectively gone backwards, so
   that the guest doesn't report 100% steal time for a very, very long time.

 - Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM was
   updating the wrong sub-leaf, and upstream KVM will soon provide all the
   information needed by userspace to populate the CPUID field itself.

----------------------------------------------------------------
David Woodhouse (3):
      KVM: x86/xen: Do not corrupt KVM clock in kvm_xen_shared_info_init()
      KVM: x86/xen: Prevent runstate times from becoming negative
      KVM: x86: Remove runtime Xen TSC frequency CPUID update

 arch/x86/kvm/cpuid.c | 16 ----------------
 arch/x86/kvm/xen.c   | 30 ++++++++++++++++++++++--------
 arch/x86/kvm/xen.h   | 13 -------------
 3 files changed, 22 insertions(+), 37 deletions(-)

[GIT PULL] KVM: guest_memfd and x86 CoCo changes for 7.3

[Sean Christopherson]

Fix the SNP VMSA PUNCH_HOLE bug, and prepare guest_memfd for in-place
conversion.  Regarding in-place conversion, my goal is to get it applied very
soon after 7.3-rc1, and then get you a pull request by -rc3 or -rc4.  I think
we're past the functional issues phase and fully into bikeshedding, so fingers
crossed.

The following changes since commit a204badd8432f93b7e862e7dac6db0fe3d65f370:

  Merge branch 'kvm-chainsaw' into HEAD (2026-06-25 11:32:09 +0200)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-coco-7.3

for you to fetch changes up to 2abcdf03fda1380bcbe00417b9ce2b4afb30899b:

  KVM: guest_memfd: Make private exactly what can be mapped on page fault (2026-07-27 09:43:44 -0700)

----------------------------------------------------------------
KVM guest_memfd and x86 CoCo changes for 7.3

 - Forcefully invalidate SNP VMSA pages if their backing guest_memfd page is
   zapped/invalidated, e.g. due to a PUNCH_HOLE in response to a Page-State
   Change request.

 - Rework the so called "prepare" and "invalidate" guest_memfd hooks to prepare
   for in-place private<=>shared conversion, and clean up a few warts along the
   way.

----------------------------------------------------------------
Ackerley Tng (1):
      KVM: guest_memfd: Only "prepare" folios for private pages

Sean Christopherson (20):
      KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
      KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
      KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
      KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y
      KVM: x86: Serialize writes to disabled_quirks using kvm->lock
      KVM: x86: Ensure runtime reads of disabled_quirks are resolved once
      KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()
      KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves
      KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot
      KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped
      KVM: SEV: Mark vCPU has having guest-provided VMSA even if its invalid
      KVM: x86: Guard .gmem_prepare() declarations with HAVE_KVM_GMEM_PREPARE=y
      KVM: guest_memfd: Pass the number of pages instead of the end pfn into .invalidate()
      KVM: guest_memfd: Rename invalidate() arch hook to reclaim() and isolate it
      KVM: x86: Rename kvm_x86_ops' gmem_invalidate() to gmem_make_shared()
      KVM: guest_memfd: Drop the redundant printk on arch gmem_prepare() failure
      KVM: guest_memfd: Add helpers to query SHARED vs. PRIVATE for a given page
      KVM: guest_memfd: Rename prepare() hook and Kconfig to make_private() / CONVERT
      KVM: guest_memfd: Explicitly pass number of pages to make_private() hook
      KVM: guest_memfd: Make private exactly what can be mapped on page fault

 arch/x86/include/asm/kvm-x86-ops.h |  12 ++-
 arch/x86/include/asm/kvm_host.h    |  15 ++-
 arch/x86/kvm/Kconfig               |   3 +-
 arch/x86/kvm/mmu/mmu.c             |  74 ++++++++------
 arch/x86/kvm/svm/sev.c             | 197 +++++++++++++++++++++++++------------
 arch/x86/kvm/svm/svm.c             |  10 +-
 arch/x86/kvm/svm/svm.h             |  19 ++--
 arch/x86/kvm/x86.c                 |  25 +++--
 arch/x86/kvm/x86.h                 |   2 +-
 include/linux/kvm_host.h           |  11 ++-
 virt/kvm/Kconfig                   |   6 +-
 virt/kvm/guest_memfd.c             |  72 ++++----------
 12 files changed, 269 insertions(+), 177 deletions(-)

[GIT PULL] KVM: Generic and documentation updates for 7.3

[Sean Christopherson]

So the subject is a bit of a lie, as three of the five patches are x86 specific.
But two are common documentation updates, and the third has a hard dependency on
a common KVM change that might be questionable.

The potentially controversial change is to add a per-VM bitmap to track which
vCPU IDs have been "claimed", so that arch code doesn't have to guard against
duplicate vCPU IDs during kvm_arch_vcpu_create() and kvm_arch_vcpu_destroy().
The part that's a little less than awesome is that the bitmap is effectively
wasted memory once the VM has reached steady state.  But, AFAICT, it shouldn't
be a meaningful amount of memory in practice.

The alternative solution we came up with was to use another xarray so that the
tracking entry could be deleted once a vCPU is fully realized.  The consensus
was that the complexity of the xarray approach wasn't justified, even though
the added complexity is relatively small.

The following changes since commit a204badd8432f93b7e862e7dac6db0fe3d65f370:

  Merge branch 'kvm-chainsaw' into HEAD (2026-06-25 11:32:09 +0200)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-generic-7.3

for you to fetch changes up to b41f2ca6c06011c36b75f5d53aa17c05ed90be21:

  KVM: VMX: Fix stale PID-pointer table entry left after vCPU free (2026-07-31 15:13:31 -0700)

----------------------------------------------------------------
KVM arch-neutral and documentation changes for 7.3

 - Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's debugfs.

 - Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs
   on x86.

 - Add a per-VM bitmap to track which vCPU IDs have been "claimed" but for
   which the vCPU isn't yet online, and use the bitmap to reject duplicate IDs
   before calling into arch code.  This allows arch code to consume vcpu_id
   without having to worry about cross-vCPU clobbering (at least s390 and x86
   have had related bugs).

 - Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI
   virtualization when the vCPU is freed to fix a use-after-free where hardware
   will write to a freed vCPU's PID.

----------------------------------------------------------------
Dmytro Maluka (2):
      KVM: Check for duplicate vcpu_id as early as possible
      KVM: VMX: Fix stale PID-pointer table entry left after vCPU free

Tim Wiederhake (2):
      KVM: x86: Document that KVM_CREATE_IRQCHIP must precede vCPU creation
      KVM: x86: Document APIC base address constraint for in-kernel irqchip

leixiang (1):
      KVM: Remove kvm_debugfs_dir on kvm_init() error paths

 Documentation/virt/kvm/api.rst | 15 ++++++++++++++-
 arch/x86/kvm/vmx/vmx.c         |  3 +++
 include/linux/kvm_host.h       |  1 +
 virt/kvm/kvm_main.c            | 10 +++++++++-
 4 files changed, 27 insertions(+), 2 deletions(-)

[GIT PULL] KVM: MAINTAINERS updates for 7.3

[Sean Christopherson]

The MAINTAINERS updates that I assume you've already seen, given that you Acked
the last patch in the series.  I went with an "ask for forgiveness, not for
permission" approach, and no one yelled at me when I send b4 thanks, so here we
are. :-)

The following changes since commit a204badd8432f93b7e862e7dac6db0fe3d65f370:

  Merge branch 'kvm-chainsaw' into HEAD (2026-06-25 11:32:09 +0200)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-maintainers-7.3

for you to fetch changes up to 82bd660be36f345415e0744911df141b9c31a33d:

  MAINTAINERS: Add myself (Sean) as a reviewer in the main KVM entry (2026-08-05 10:00:53 -0700)

----------------------------------------------------------------
KVM MAINTAINERS changes for 7.3

 - Add the kvm-x86 tree to KVM x86 entries so that humans and robots alike can
   more easily find in-flight x86 changes.

 - Add a dedicated entry for guest_memfd, with the usual suspects as
   Maintainers, and David Hildenbrand as a Reviewer.

 - Add Sean as a Reviewer for overall KVM.

----------------------------------------------------------------
Sean Christopherson (5):
      MAINTAINERS: Add kvm-x86 tree to KVM x86 entries
      KVM: guest_memfd: Move gmem function declarations to dedicated guest_memfd.h
      MAINTAINERS: Add an entry for KVM's guest_memfd
      MAINTAINERS: Add David H. as a KVM guest_memfd reviewer
      MAINTAINERS: Add myself (Sean) as a reviewer in the main KVM entry

 MAINTAINERS            | 14 ++++++++++++++
 virt/kvm/guest_memfd.c |  1 +
 virt/kvm/guest_memfd.h | 34 ++++++++++++++++++++++++++++++++++
 virt/kvm/kvm_main.c    |  1 +
 virt/kvm/kvm_mm.h      | 27 ---------------------------
 5 files changed, 50 insertions(+), 27 deletions(-)
 create mode 100644 virt/kvm/guest_memfd.h

[GIT PULL] KVM: x86: Misc changes for 7.3

[Sean Christopherson]

The main set of x86 changes for 7.3.  Yosry's INVVPID and EFER validation changes
are probably the most interesting.  Almost everything from me falls into the
category of "fixes for things that are technically bugs, but that no one cares
about in practice".

The following changes since commit a204badd8432f93b7e862e7dac6db0fe3d65f370:

  Merge branch 'kvm-chainsaw' into HEAD (2026-06-25 11:32:09 +0200)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-misc-7.3

for you to fetch changes up to 66ee8f1556575c8f9ae76932dd3aca65b4b60e59:

  KVM: x86/pmu: Clean up vPMU comments and stray blank lines (2026-08-05 16:42:23 -0700)

----------------------------------------------------------------
KVM x86 misc changes for 7.3

 - Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.

 - Harden the SNP and TDX "populate" ioctls against bad input, and to prepare
   for supporting in-place private<=>shared conversion.

 - Fix a variety of #DB priority bugs.

 - Fix a class of races related to enabling Hyper-V emulation on a vCPU after
   the vCPU is visible to the rest of KVM.

 - Use static calls for nested virtualization ops.

 - Move more KVM-internal code out of x86's kvm_host.h.

 - Enumerate support for a variety of Zhaoxin instructions that don't require
   explicit virtualization.

 - Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.

 - Harden kvm_vcpu_map() against double-mapping and thus leaking references.

 - Misc fixes and cleanups, e.g. for largely benign syzkaller splats.

----------------------------------------------------------------
Binbin Wu (1):
      KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf

Carlos López (3):
      KVM: x86: Treat any non-zero return from set_dr() as a faulting condition
      KVM: x86: Fix array_index_nospec() protection in kvm_vcpu_ioctl_x86_set_mce()
      KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock

Ewan Hai-oc (5):
      KVM: x86: Expose Zhaoxin SM2 CPUID feature
      KVM: x86: Expose Zhaoxin CCS (SM3 + SM4) CPUID feature
      KVM: x86: Expose Zhaoxin RNG2 CPUID feature
      KVM: x86: Expose Zhaoxin PHE2 CPUID feature
      KVM: x86: Expose Zhaoxin RSA CPUID feature

Hao Zhang (1):
      KVM: selftests: Extend the invalid nVMX guest state test to cover RSM

Joerg Roedel (1):
      KVM: SEV: Explicitly disallow NULL user address for SNP_LAUNCH_UPDATE

Kai Huang (1):
      KVM: x86: Use KVM_X86_OP() for the .pi_update_irte() hook

Like Xu (1):
      KVM: x86/pmu: Clean up vPMU comments and stray blank lines

Sean Christopherson (45):
      KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02
      KVM: TDX: Return EINVAL, not EOPNOTSUPP, for NULL INIT_MEM_REGION source
      KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 value
      KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority
      KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPL
      KVM: VMX: Prioritize DR7.GD=1 #DB over CPL>0 #GP on Intel
      KVM: x86: Use kvm_dr{6,7}_valid() to check DR{4,5,6,7} write values in emulator
      KVM: x86: WARN if MOV DR emulation hits a "too late" #GP
      KVM: x86: Read CR4.DE in emulator if and only if accessing DR4 or DR5
      KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller
      KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo()
      KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses
      KVM: x86/xen: Always route non-singleshot-timer vCPU hypercalls to userspace
      KVM: x86/xen: Consolidate checks on Xen vCPU ID for singleshot timer hypercalls
      KVM: x86/xen: Punt singleshot timer hcalls to userspace if Xen vCPU ID isn't set
      KVM: Initialize a vCPU's index to '-1' while it's being created
      KVM: Move nVMX's lockdep logic for vcpu->mutex to a common helper
      KVM: x86: Treat a vCPU as unreachable if its index is invalid
      KVM: x86/hyperv: Assert vCPU's mutex is held in to_hv_vcpu()
      KVM: x86/hyperv: Use {READ,WRITE}_ONCE for cross-task synic->active accesses
      KVM: x86: Move the "APIC attention" macros from kvm_host.h => lapic.c
      KVM: x86/mmu: Annotate tdp_enabled as being read-mostly
      KVM: x86: Pluralize the macro guard name for msrs.h
      KVM: x86: Move CR and DR macro definitions from kvm_host.h => regs.h
      KVM: x86: Move KVM_GUESTDBG_VALID_MASK from kvm_host.h => x86.c
      KVM: x86: Add static asserts to document connection b/w TSS structs and macros
      KVM: x86: Move KVM's arbitrary task switch reason enums to x86.h
      KVM: x86: Move "struct kvm_apic_map" definition from kvm_host.h => lapic.h
      KVM: x86: Move "struct kvm_vcpu_hv" and all children from kvm_host.h => hyperv.h
      KVM: x86: Reject nested CAP enablement if nested virtualization is disabled
      KVM: x86: Add static calls for nested virtualization ops
      KVM: x86: Move nested_ops out of kvm_x86_ops, to global kvm_nested_ops
      KVM: x86: Don't WARN if IRQ disappears because it was cleared from the PIC
      KVM: x86: Don't WARN if IRQ disappears when Xen emulation is enabled.
      KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit
      KVM: nSVM: Add CLASS()es for automagically handling local kvm_vcpu_map() usage
      KVM: nSVM: Use CLASS(kvm_vcpu_map_local) for SMM VMCB mappings
      KVM: nVMX: Use CLASS(kvm_vcpu_map_local_readonly) for MSR bitmap merging
      KVM: PPC: Use CLASS(kvm_vcpu_map_local) to patch dcbz
      KVM: Harden kvm_vcpu_map() against double-mapping and thus leaking references
      KVM: x86: Extract VMX's unhandleable emulation check to common x86
      KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation
      KVM: x86: Rework kvm_x86_ops.vcpu_pre_run() into .vcpu_needs_initialization()
      KVM: selftests: Use port 0x80 in invalid nVMX guest state test
      KVM: selftests: Refactor invalid nVMX state test to prepare for RSM testcase

Tim Wiederhake (1):
      KVM: x86: Replace delivery mode TODO with WARN_ON_ONCE

Yosry Ahmed (9):
      KVM: nVMX: Always flush vpid02 on first use
      KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
      KVM: x86: Move enabling EFER.SVME and EFER.LMSLE to generic EFER setup
      KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported
      KVM: x86: Always initialize EFER reserved bits on vendor initialization
      KVM: x86: Reverse the polarity of efer_reserved_bits
      KVM: x86: Move supported EFER bits to kvm_caps
      KVM: x86: Check EFER validity on KVM_SET_SREGS*
      KVM: selftests: Extend set_sregs test to cover EFER

leixiang (1):
      KVM: Remove kvm_debugfs_dir on kvm_init() error paths

 arch/powerpc/kvm/book3s_pr.c                       |  11 +-
 arch/x86/include/asm/cpufeatures.h                 |  10 +
 arch/x86/include/asm/kvm-x86-nested-ops.h          |  36 ++++
 arch/x86/include/asm/kvm-x86-ops.h                 |   5 +-
 arch/x86/include/asm/kvm_host.h                    | 212 ++-------------------
 arch/x86/kvm/cpuid.c                               |  22 ++-
 arch/x86/kvm/emulate.c                             |  49 +++--
 arch/x86/kvm/hyperv.c                              |  95 +++++----
 arch/x86/kvm/hyperv.h                              | 117 +++++++++++-
 arch/x86/kvm/irq.h                                 |  20 ++
 arch/x86/kvm/lapic.c                               |  13 +-
 arch/x86/kvm/lapic.h                               |  33 ++++
 arch/x86/kvm/mmu.h                                 |  11 +-
 arch/x86/kvm/mmu/mmu.c                             |   2 +-
 arch/x86/kvm/mmu/paging_tmpl.h                     |   2 +-
 arch/x86/kvm/msrs.c                                |  21 +-
 arch/x86/kvm/msrs.h                                |   5 +-
 arch/x86/kvm/pmu.c                                 |  12 +-
 arch/x86/kvm/pmu.h                                 |   4 +-
 arch/x86/kvm/regs.c                                |   3 +-
 arch/x86/kvm/regs.h                                |  38 ++++
 arch/x86/kvm/smm.c                                 |   4 +
 arch/x86/kvm/svm/nested.c                          |  20 +-
 arch/x86/kvm/svm/sev.c                             |  16 +-
 arch/x86/kvm/svm/svm.c                             |  66 ++-----
 arch/x86/kvm/svm/svm.h                             |   1 +
 arch/x86/kvm/tss.h                                 |   7 +
 arch/x86/kvm/vmx/main.c                            |  24 ++-
 arch/x86/kvm/vmx/nested.c                          |  81 ++++----
 arch/x86/kvm/vmx/nested.h                          |   6 +-
 arch/x86/kvm/vmx/pmu_intel.c                       |   1 -
 arch/x86/kvm/vmx/tdx.c                             |  16 +-
 arch/x86/kvm/vmx/vmx.c                             |  19 +-
 arch/x86/kvm/vmx/x86_ops.h                         |   4 +-
 arch/x86/kvm/x86.c                                 | 110 ++++++++---
 arch/x86/kvm/x86.h                                 |   8 +-
 arch/x86/kvm/xen.c                                 |  43 +++--
 include/linux/kvm_host.h                           |  26 +++
 .../testing/selftests/kvm/include/x86/processor.h  |   2 +
 .../testing/selftests/kvm/x86/pmu_counters_test.c  |   6 +-
 .../selftests/kvm/x86/pmu_event_filter_test.c      |   4 +-
 tools/testing/selftests/kvm/x86/set_sregs_test.c   |  81 ++++++--
 .../kvm/x86/vmx_invalid_nested_guest_state.c       | 118 ++++++++++--
 virt/kvm/kvm_main.c                                |  12 ++
 44 files changed, 857 insertions(+), 539 deletions(-)
 create mode 100644 arch/x86/include/asm/kvm-x86-nested-ops.h

[GIT PULL] KVM: x86: MMU changes for 7.3

[Sean Christopherson]

Two fixes for bugs in the lockless aging code, plus a related hardening in the
same code.

The following changes since commit a204badd8432f93b7e862e7dac6db0fe3d65f370:

  Merge branch 'kvm-chainsaw' into HEAD (2026-06-25 11:32:09 +0200)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-mmu-7.3

for you to fetch changes up to fb25ee778aae357da2c1a8dc1d240b6061482454:

  KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in the shadow MMU (2026-07-29 05:44:24 -0700)

----------------------------------------------------------------
KVM x86 MMU changes for 7.3

 - Fix a bug where KVM would walk a newly created rmap without holding the rmap
   lock (or mmu_lock) during aging.

 - Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs.

----------------------------------------------------------------
Phil Rosenthal (1):
      KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk

Sean Christopherson (2):
      KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU
      KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in the shadow MMU

 arch/x86/kvm/mmu/mmu.c      | 58 +++++++++++++++++++++++++--------------------
 arch/x86/kvm/mmu/tdp_iter.h |  7 ++++++
 arch/x86/kvm/mmu/tdp_mmu.c  | 20 +++++++---------
 3 files changed, 48 insertions(+), 37 deletions(-)

[GIT PULL] KVM: Selftests change for 7.3, part 1

[Sean Christopherson]

This was supposed to be the "main" selftests pull request, but it ended up being
about half the size of the second pull request.  Yosry's work on the nested
virtualization infrastructure is by far the most notable thing here.

The following changes since commit a204badd8432f93b7e862e7dac6db0fe3d65f370:

  Merge branch 'kvm-chainsaw' into HEAD (2026-06-25 11:32:09 +0200)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-selftests-7.3

for you to fetch changes up to b18ee21055a77eb1fb6070cb3f819cd3372c466e:

  KVM: selftests: Add a test for KVM_CREATE_VM VM type enforcement (2026-07-31 15:47:25 -0700)

----------------------------------------------------------------
KVM selftests changes for 7.3, part 1

 - Clean up nested SVM's handling of GPRs on L2<=>L1 transitions, reuse the
   functionality for nested VMX, and drop the ucall hack that was fudging
   around the lack of GPR switching on nVMX.

 - Add a stress test to verify KVM doesn't clobber/drop #PF state, e.g. CR2,
   across save/restore, including when L2 is active.

 - Add a test to verify KVM_CREATE_VM accepts exactly what is reported by
   KVM_CAP_VM_TYPES.

 - Misc selftests fixes and cleanups

----------------------------------------------------------------
Hemanth Selam (1):
      KVM: selftests: Add a test for KVM_CREATE_VM VM type enforcement

Sean Christopherson (2):
      KVM: selftests: Drop superfluous use of pthread_attr_setaffinity_np()
      KVM: selftests: Randomize pCPU in steal time test

Shivank Sharma (1):
      KVM: selftests: Fix typos in x86 and riscv tests

Wang Yan (1):
      KVM: selftests: Fix a spelling error in an xapic_ipi_test comment

Yosry Ahmed (13):
      KVM: selftests: Use __stringify() instead of custom XSTR() macros
      KVM: selftests: Fix RAX and RFLAGS VMCB offsets when running L2
      KVM: selftests: Rework GPR registers switching for SVM (and fix offsets)
      KVM: selftests: Handle rflags save/restore for SVM in guest_regs
      KVM: selftests: Reuse GPR switching logic for nVMX
      KVM: selftests: Drop HORRIFIC_L2_UCALL_CLOBBER_HACK
      KVM: selftests: Add a blank line before logging assertion failures
      KVM: selftests: Expose PTE masks to guests as part of an MMU
      KVM: selftests: Do not intercept #PF by default in nVMX tests
      KVM: selftests: Add basic stress test for save+restore and #PF handling
      KVM: selftests: Trigger save+restore randomly in the #PF stress test
      KVM: selftests: Support running stress save+restore and #PF test in L2
      KVM: selftests: Trigger L2->L1 exits stress save+restore and #PF test

 tools/testing/selftests/kvm/Makefile.kvm           |   2 +
 tools/testing/selftests/kvm/include/test_util.h    |   1 +
 tools/testing/selftests/kvm/include/x86/evmcs.h    |  46 ++--
 .../testing/selftests/kvm/include/x86/processor.h  |  52 +++-
 tools/testing/selftests/kvm/include/x86/vmx.h      |  69 +++--
 tools/testing/selftests/kvm/lib/assert.c           |   2 +-
 tools/testing/selftests/kvm/lib/x86/processor.c    |  14 +
 tools/testing/selftests/kvm/lib/x86/svm.c          |  62 +++--
 tools/testing/selftests/kvm/lib/x86/ucall.c        |  32 +--
 tools/testing/selftests/kvm/lib/x86/vmx.c          |   2 +-
 tools/testing/selftests/kvm/riscv/sbi_pmu_test.c   |   4 +-
 tools/testing/selftests/kvm/steal_time.c           |  15 +-
 tools/testing/selftests/kvm/vm_types_test.c        |  48 ++++
 .../selftests/kvm/x86/evmcs_smm_controls_test.c    |   5 +-
 .../testing/selftests/kvm/x86/fix_hypercall_test.c |   1 -
 tools/testing/selftests/kvm/x86/hyperv_clock.c     |   4 +-
 tools/testing/selftests/kvm/x86/hyperv_evmcs.c     |   2 +-
 .../kvm/x86/save_restore_pf_stress_test.c          | 288 +++++++++++++++++++++
 tools/testing/selftests/kvm/x86/sev_init2_tests.c  |   4 -
 tools/testing/selftests/kvm/x86/smm_test.c         |   5 +-
 .../kvm/x86/vmx_invalid_nested_guest_state.c       |   2 +-
 tools/testing/selftests/kvm/x86/xapic_ipi_test.c   |   2 +-
 22 files changed, 502 insertions(+), 160 deletions(-)
 create mode 100644 tools/testing/selftests/kvm/vm_types_test.c
 create mode 100644 tools/testing/selftests/kvm/x86/save_restore_pf_stress_test.c

[GIT PULL] KVM: x86: KVM: Selftests change for 7.3, part 2

[Sean Christopherson]

Selftests, part 2.  This was originally just the irq_test from David and Josh,
but I piled on fixes for hardware_disable_test and pmu_counters_test that rely
on the pRNG changes/enhancements.

There have been a few hiccups with linking to the VFIO selfest library, but I
think they're all sorted out.  I.e. this should Just Work on your end.

As mentioned in the cover letter, this will conflict with part 1.  Part 2 just
adds syscall wrappers, i.e. keep the functional test changes from part 1, but
use the newfangled wrappers from part 2.

diff --cc tools/testing/selftests/kvm/steal_time.c
index 92e7ffcd68b7,83a1e3aa15cf..6e9cc0e34ec0
--- tools/testing/selftests/kvm/steal_time.c
+++ tools/testing/selftests/kvm/steal_time.c
@@@ -553,11 -553,7 +548,11 @@@ int main(int ac, char **av
  
                /* Steal time from the VCPU. The steal time thread has the same CPU affinity as the VCPUs. */
                run_delay = get_run_delay();
-               pthread_create(&thread, NULL, do_steal_time, NULL);
-               pthread_getaffinity_np(thread, sizeof(cpuset), &cpuset);
 -              kvm_pthread_create(&thread, &attr, do_steal_time, NULL);
++              kvm_pthread_create(&thread, NULL, do_steal_time, NULL);
++              kvm_pthread_getaffinity_np(thread, sizeof(cpuset), &cpuset);
 +              TEST_ASSERT(CPU_COUNT(&cpuset) == 1 && CPU_ISSET(cpu, &cpuset),
 +                          "Worker failed to inherit parent's CPU affinity");
 +
                do
                        sched_yield();
                while (get_run_delay() - run_delay < MIN_RUN_DELAY_NS);

The following changes since commit 8cdeaa50eae8dad34885515f62559ee83e7e8dda:

  Linux 7.2-rc2 (2026-07-05 14:44:06 -1000)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-selftests2-7.3

for you to fetch changes up to 4fe8b4e1545a0179ceebe098cce0dcfe9134a6cd:

  KVM: selftests: Create one VM with many vCPUs for each major PMU counters test (2026-08-10 08:04:13 -0700)

----------------------------------------------------------------
KVM selftests changes for 7.3, part 2

 - Fix several issues with seeding KVM's pRNG, and rework the pRNG APIs to that
   the pRNG can be sanely used in host code, not just guest code.

 - Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up via
   KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for triggering IRQs
   via writes to an assigned VFIO device.

 - Add syscall wrappers to assert success on a variety of pthreads and CPU
   affinity APIs.

 - Set vCPU pthread affinity as early as possible to reduce contention issues
   that were surfaced by PREEMPT_LAZY, which result in runtimes of over a
   minute on large hosts, versus the expected ~5 seconds.

 - Rework the PMU counters test to run each testcase using a single VM with
   many vCPUs for each sub-testcase, instead of using a unique VM for each
   sub-testcase.  This cuts the runtime by ~20x.

----------------------------------------------------------------
David Matlack (11):
      KVM: selftests: Build and link selftests/vfio/lib into KVM selftests
      KVM: selftests: Add macros to read/write+sync to/from guest memory
      KVM: selftests: Add an irqfd send+receive (and later IRQ bypass) test
      KVM: selftests: Add helper to get host IRQ from device MSI-X for IRQ bypass test
      KVM: selftests: Add VFIO device support to eventfd IRQ test
      KVM: selftests: Verify interrupts are received when IRQ affinity changes in IRQ test
      KVM: selftests: Add option to set empty routing between IRQs in eventfd IRQ test
      KVM: selftests: Make number of IRQs configurable in IRQ test
      KVM: selftests: Verify vCPU migration during IRQ delivery in IRQ test
      KVM: selftests: Make number of vCPUs configurable in IRQ test
      KVM: selftests: Add xAPIC support in eventfd IRQ test

Josh Hilke (6):
      KVM: selftests: Rename guest_rng to kvm_rng
      KVM: selftests: Add helper to generate random u64 in range [min,max]
      KVM: selftests: Add a helper to set proc IRQ affinity for IRQ test
      KVM: selftests: Add kvm_gettid() wrapper and convert users
      KVM: selftests: Add kvm_sched_getaffinity() wrapper and convert users
      KVM: selftests: Add a utility to pin a task to a random CPU, given a CPU set

Sean Christopherson (18):
      KVM: selftests: Initialize the default/global pRNG during kvm_selftest_init()
      KVM: selftests: Seed libc's RNG before using it to generate a seed for KVM's pRNG
      KVM: selftests: Verify non-postable IRQ remapping in IRQ test
      KVM: selftests: Only link to VFIO library on x86
      KVM: selftests: Add a KVM syscall wrapper for sched_setaffinity()
      KVM: selftests: Set threads CPU affinity before doing work in hardware disable test
      KVM: selftests: Pre-set threads affinity in hardware disable test when possible
      KVM: selftests: Return the target CPU from pin_task_to_random_cpu()
      KVM: selftests: Extract picking of random CPU from cpu_set_t to separate API
      KVM: selftests: Affine threads to random CPUs in hardware disable test
      KVM: selftests: Drop unreachable, dead code from hardware disable test
      KVM: selftests: Add KVM syscall wrapper for pthread_create()
      KVM: selftests: Add KVM syscall wrappers for pthread_{cancel,join}()
      KVM: selftests: Add helper APIs to cancel+join pthreads
      KVM: selftests: Clean up global constants in hardware disable test
      KVM: selftests: Add KVM syscall wrappers for pthread_{g,s}etaffinity_np()
      KVM: selftests: Test one random GP counter in PMU arch events testcase
      KVM: selftests: Create one VM with many vCPUs for each major PMU counters test

 tools/testing/selftests/kvm/Makefile.kvm                       |  12 +++-
 tools/testing/selftests/kvm/arch_timer.c                       |  20 ++----
 tools/testing/selftests/kvm/arm64/arch_timer_edge_cases.c      |   2 +-
 tools/testing/selftests/kvm/arm64/vgic_irq.c                   |  14 ++--
 tools/testing/selftests/kvm/arm64/vgic_lpi_stress.c            |   8 +--
 tools/testing/selftests/kvm/demand_paging_test.c               |   2 +-
 tools/testing/selftests/kvm/dirty_log_perf_test.c              |   4 +-
 tools/testing/selftests/kvm/dirty_log_test.c                   |  15 ++---
 tools/testing/selftests/kvm/hardware_disable_test.c            | 109 ++++++++++++++-----------------
 tools/testing/selftests/kvm/include/kvm_syscalls.h             |  55 ++++++++++++++++
 tools/testing/selftests/kvm/include/kvm_util.h                 |  21 ++++++
 tools/testing/selftests/kvm/include/proc_util.h                |  11 ++++
 tools/testing/selftests/kvm/include/test_util.h                |  25 +++----
 tools/testing/selftests/kvm/include/x86/kvm_util_arch.h        |   4 +-
 tools/testing/selftests/kvm/irq_test.c                         | 362 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 tools/testing/selftests/kvm/irqfd_test.c                       |   4 +-
 tools/testing/selftests/kvm/kvm_page_table_test.c              |   6 +-
 tools/testing/selftests/kvm/lib/assert.c                       |   8 +--
 tools/testing/selftests/kvm/lib/kvm_util.c                     |  52 +++++++++++----
 tools/testing/selftests/kvm/lib/memstress.c                    |  12 ++--
 tools/testing/selftests/kvm/lib/proc_util.c                    |  54 ++++++++++++++++
 tools/testing/selftests/kvm/lib/test_util.c                    |  41 ++++++++++--
 tools/testing/selftests/kvm/lib/userfaultfd_util.c             |   7 +-
 tools/testing/selftests/kvm/memslot_perf_test.c                |   4 +-
 tools/testing/selftests/kvm/mmu_stress_test.c                  |  19 ++----
 tools/testing/selftests/kvm/pre_fault_memory_test.c            |   4 +-
 tools/testing/selftests/kvm/rseq_test.c                        |  16 ++---
 tools/testing/selftests/kvm/s390/memop.c                       |   4 +-
 tools/testing/selftests/kvm/set_memory_region_test.c           |   6 +-
 tools/testing/selftests/kvm/steal_time.c                       |  26 +++-----
 tools/testing/selftests/kvm/x86/hyperv_ipi.c                   |  32 ++-------
 tools/testing/selftests/kvm/x86/hyperv_tlb_flush.c             |  30 ++-------
 tools/testing/selftests/kvm/x86/pmu_counters_test.c            | 227 ++++++++++++++++++++++++++++++++++++----------------------------
 tools/testing/selftests/kvm/x86/private_mem_conversions_test.c |   4 +-
 tools/testing/selftests/kvm/x86/private_mem_kvm_exits_test.c   |   7 +-
 tools/testing/selftests/kvm/x86/recalc_apic_map_test.c         |   5 +-
 tools/testing/selftests/kvm/x86/sev_dbg_test.c                 |   2 +-
 tools/testing/selftests/kvm/x86/sev_migrate_tests.c            |   4 +-
 tools/testing/selftests/kvm/x86/sync_regs_test.c               |   5 +-
 tools/testing/selftests/kvm/x86/tsc_scaling_sync.c             |   4 +-
 tools/testing/selftests/kvm/x86/xapic_ipi_test.c               |  31 ++-------
 tools/testing/selftests/kvm/x86/xen_shinfo_test.c              |  10 +--
 42 files changed, 883 insertions(+), 405 deletions(-)
 create mode 100644 tools/testing/selftests/kvm/include/proc_util.h
 create mode 100644 tools/testing/selftests/kvm/irq_test.c
 create mode 100644 tools/testing/selftests/kvm/lib/proc_util.c

[GIT PULL] KVM: x86: SVM changes for 7.3

[Sean Christopherson]

A somewhat random collection of fixes.  Note, dropping FOLL_WRITE is safe as
GUP breaks CoW for FOLL_PIN.  This is explained in the changelog, but I figured
I'd call it out here too in case you have the same knee-jerk reaction I had.

The following changes since commit a204badd8432f93b7e862e7dac6db0fe3d65f370:

  Merge branch 'kvm-chainsaw' into HEAD (2026-06-25 11:32:09 +0200)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-svm-7.3

for you to fetch changes up to ec9a16c6aeba8e19ce98c58a1ac255681a4dd0ac:

  KVM: SVM: Always intercept ICEBP to workaround AMD ICEBP+TASK_SWITCH flaws (2026-07-24 13:15:14 -0700)

----------------------------------------------------------------
KVM SVM changes for 7.3

 - Remove a dying VM from the GA Log notifier list before the VM is actually
   destroyed, to fix a potential use-after-free.

 - Don't pass FOLL_WRITE when registering encrypted memory regions, i.e. when
   pinning SEV/SEV-ES guest memory, to fix a regression with file-backed memory
   introduced by KVM's (correct) usage of long-term pins.

 - Allocate full pages for SEV/SEV-ES {DE,EN}CRYPT ops on SNP-enabled hosts to
   fix a data corruption issue due to the PSP driver assigning to-be-written
   pages to firmware (as required by the SNP specs).

 - Unconditionally intercept ICBEP so that KVM generates the correct guest RIP
   when handling an ICEBP-induced TASK_SWITCH #VMEXIT.

----------------------------------------------------------------
David Woodhouse (1):
      KVM: SVM: Always intercept ICEBP to workaround AMD ICEBP+TASK_SWITCH flaws

Pankaj Gupta (1):
      KVM: SEV: Drop FOLL_WRITE for encrypted region registration

Qiang Ma (1):
      KVM: SVM: Remove redundant ret = 0 in svm_set_nested_state

Sean Christopherson (4):
      KVM: SVM: Make kvm_x86_ops.vcpu_precreate() hook fully AVIC specific
      KVM: SVM: Do all per-VM AVIC initialization during vCPU precreation phase
      KVM: SVM: Remove VM from the GA Log notifier list before VM destruction
      KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts

 arch/x86/kvm/svm/avic.c   | 96 +++++++++++++++++++++++++++++++----------------
 arch/x86/kvm/svm/nested.c |  1 -
 arch/x86/kvm/svm/sev.c    | 29 ++++++++++++--
 arch/x86/kvm/svm/svm.c    | 34 +++++++++++------
 arch/x86/kvm/svm/svm.h    |  4 +-
 5 files changed, 113 insertions(+), 51 deletions(-)

[GIT PULL] KVM: x86: VMX changes for 7.3

[Sean Christopherson]

Like the SVM changes, a small batch of fixes and cleanups.

The following changes since commit a204badd8432f93b7e862e7dac6db0fe3d65f370:

  Merge branch 'kvm-chainsaw' into HEAD (2026-06-25 11:32:09 +0200)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-vmx-7.3

for you to fetch changes up to 0aaedada606aef1732cf0e123403a1e8b8b38c0d:

  KVM: VMX: Cap VMX preemption timer to work around Intel erratum (2026-07-31 13:41:56 -0700)

----------------------------------------------------------------
KVM VMX changes for 7.3

 - Service local TLB flushes on a failed nested VM-Enter to fix a bug where KVM
   could miss a TLB on a future, successful VM-Enter with the same L2 VPID.

 - Cap the maximum value shoved into the VMX Preemption Timer to workaround an
   erratum that affects all existing Intel CPUs that support CPUID 0x15.

----------------------------------------------------------------
Hao Zhang (1):
      KVM: VMX: Use cached vcpu_vmx pointer in MSR and segment helpers

Jim Mattson (1):
      KVM: VMX: Cap VMX preemption timer to work around Intel erratum

Sean Christopherson (1):
      KVM: VMX: Bury all of the VMX preemption timer code under CONFIG_X86_64=y

Yosry Ahmed (1):
      KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

 arch/x86/kvm/vmx/nested.c |   8 +++
 arch/x86/kvm/vmx/vmx.c    | 171 +++++++++++++++++++++++++++++-----------------
 2 files changed, 117 insertions(+), 62 deletions(-)

Re: [GIT PULL] KVM: x86 pull requests for 7.3

[David Woodhouse]

[-- Attachment #1: Type: text/plain, Size: 193 bytes --]

This was intended as the safe stable bugfix part, split out from all
the RCU and rwlock RT fun that can come later:

https://lore.kernel.org/all/20260811094829.98794-1-dwmw2@infradead.org/

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 6179 bytes --]

Re: [GIT PULL] KVM: x86 pull requests for 7.3

[Paolo Bonzini]

Il ven 14 ago 2026, 21:25 David Woodhouse <dwmw2@infradead.org> ha scritto:
>
> This was intended as the safe stable bugfix part, split out from all
> the RCU and rwlock RT fun that can come later:
>
> https://lore.kernel.org/all/20260811094829.98794-1-dwmw2@infradead.org/

Ok, I will take a look.

Paolo

>

Re: [GIT PULL] KVM: x86 pull requests for 7.3

[David Woodhouse]

[-- Attachment #1: Type: text/plain, Size: 725 bytes --]

On Sat, 2026-08-15 at 09:55 +0200, Paolo Bonzini wrote:
> Il ven 14 ago 2026, 21:25 David Woodhouse <dwmw2@infradead.org> ha scritto:
> > 
> > This was intended as the safe stable bugfix part, split out from all
> > the RCU and rwlock RT fun that can come later:
> > 
> > https://lore.kernel.org/all/20260811094829.98794-1-dwmw2@infradead.org/
> 
> Ok, I will take a look.

Thanks. Although that nudge was directed more at Sean than you.

I wouldn't necessarily want it to go forward *without* Sean's ack, but
those commits were deliberately split out as the ones I genuinely
believe to be simple uncontroversial fixes, with the fun stuff held
back for later. A couple of these ones are even actually Sean's.

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 6179 bytes --]

Re: [GIT PULL] KVM: x86 pull requests for 7.3

[Sean Christopherson]

On Sat, Aug 15, 2026, David Woodhouse wrote:
> On Sat, 2026-08-15 at 09:55 +0200, Paolo Bonzini wrote:
> > Il ven 14 ago 2026, 21:25 David Woodhouse <dwmw2@infradead.org> ha scritto:
> > > 
> > > This was intended as the safe stable bugfix part, split out from all
> > > the RCU and rwlock RT fun that can come later:
> > > 
> > > https://lore.kernel.org/all/20260811094829.98794-1-dwmw2@infradead.org/
> > 
> > Ok, I will take a look.
> 
> Thanks. Although that nudge was directed more at Sean than you.
> 
> I wouldn't necessarily want it to go forward *without* Sean's ack, but
> those commits were deliberately split out as the ones I genuinely
> believe to be simple uncontroversial fixes, with the fun stuff held
> back for later. A couple of these ones are even actually Sean's.

Those changes are very much on my radar, the latest version simply came in too
late for 7.3.