From: sashiko-bot@kernel.org
To: "Yosry Ahmed" <yosry@kernel.org>
Cc: kvm@vger.kernel.org
Subject: Re: [PATCH v3 10/27] KVM: SVM: Use a static ASID per vCPU
Date: Mon, 12 Oct 2026 23:54:02 +0000 [thread overview]
Message-ID: <sashiko-outbox-168751@kernel.org> (raw)
In-Reply-To: <20261012233638.2546339-11-yosry@kernel.org>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] kvm: svm: source SEV VM retains and uses migrated SEV ASID
--
commit 9452efa2aa9c0c4c26d340a238f30fbe12b3e4cc
Author: Yosry Ahmed <yosry@kernel.org>
KVM: SVM: Use a static ASID per vCPU
Switch from dynamic ASID allocation to a static per-vCPU ASID. The dynamic
ASID allocation logic is now only effectively used when running out of ASIDs
on a CPU, or switching CPUs.
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
[ ... ]
> @@ -3875,37 +3868,24 @@ static void svm_set_nested_run_soft_int_state(struct kvm_vcpu *vcpu)
[ ... ]
> static int pre_svm_run(struct kvm_vcpu *vcpu)
> {
[ ... ]
> if (is_sev_guest(vcpu))
> return pre_sev_run(svm, vcpu->cpu);
>
> - /* FIXME: handle wraparound of asid_generation */
> - if (svm->current_vmcb->asid_generation != sd->asid_generation)
> - new_asid(svm, sd);
> + if (unlikely(svm->vmcb->control.asid == fallback_asid))
> + vmcb_set_flush_asid(svm->vmcb);
>
> return 0;
> }
[Severity: Critical]
When an intra-host SEV VM migration occurs via KVM_VM_MOVE_ENC_CONTEXT_FROM,
the migration path in sev_vm_move_enc_context_from() transfers the SEV ASID
to the destination VM and marks the source VM as non-SEV by setting
sev->active to false. However, the source vCPUs retain the SEV ASID in their
svm->asid and vmcb->control.asid.
Previously, this was safely mitigated here in pre_svm_run() because the
generation mismatch (the SEV ASID generation was 0) triggered new_asid(),
allocating a new normal ASID for the source vCPU.
By removing the generation check here, does this allow a malicious host
userspace to execute KVM_RUN on the source vCPUs as non-SEV vCPUs while
still using the destination VM's SEV ASID? Could this break SEV
confidentiality and integrity by allowing the host to inject arbitrary
translations or read data from the destination SEV VM's TLB?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261012233638.2546339-1-yosry@kernel.org?part=10
next prev parent reply other threads:[~2026-10-12 23:54 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-12 23:36 [PATCH v3 00/27] KVM: nSVM: Optimize nSVM TLB flushes Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 01/27] KVM: nSVM: Flush the TLB after forcefully leaving nested Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 02/27] KVM: SVM: Document number of ASIDs CPUID setting Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 03/27] KVM: VMX: Generalize VPID allocation to be vendor-neutral Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 04/27] KVM: x86/mmu: Support specifying reserved TLB tags Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 05/27] KVM: SVM: Add helpers to set/clear ASID flush in VMCB Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 06/27] KVM: SVM: Fallback to flush everything if FLUSHBYASID is not available Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 07/27] KVM: SEV: Do ASID initialization at VMCB initialization Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 08/27] KVM: SEV: Expose sev_get_asid() outside of sev.c Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 09/27] KVM: SEV: Explicitly initialize the per vCPU ASID on SEV VM migration Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 10/27] KVM: SVM: Use a static ASID per vCPU Yosry Ahmed
2026-10-12 23:54 ` sashiko-bot [this message]
2026-10-12 23:55 ` Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 11/27] KVM: SVM: Only flush the fallback ASID when used by a different vCPU Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 12/27] KVM: nSVM: Drop svm->nested.initialized Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 13/27] KVM: nSVM: Add a placeholder ASID for L2 Yosry Ahmed
2026-10-13 0:01 ` sashiko-bot
2026-10-12 23:36 ` [PATCH v3 14/27] KVM: x86: hyper-v: Rename kvm_hv_vcpu_purge_flush_tlb() Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 15/27] KVM: x86: hyper-v: Allow purging all TLB flush FIFOs Yosry Ahmed
2026-10-12 23:56 ` sashiko-bot
2026-10-12 23:36 ` [PATCH v3 16/27] KVM: nSVM: Flush both L1 and L2 ASIDs on KVM_REQ_TLB_FLUSH Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 17/27] KVM: nSVM: Always switch VMCB before leaving guest mode Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 18/27] KVM: nSVM: Split nested_svm_transition_tlb_flush() into entry/exit fns Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 19/27] KVM: nSVM: Service local TLB flushes before nested transitions Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 20/27] KVM: x86: Add KVM_REQ_MMU_SYNC_ALL_ROOTS Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 21/27] KVM: nSVM: Handle nested TLB flush requests through TLB_CONTROL Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 22/27] KVM: nSVM: Flush the TLB if L1 changes L2's ASID in vmcb12 Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 23/27] KVM: nSVM: Do not reset TLB_CONTROL in vmcb02 on nested VM-Enter Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 24/27] KVM: nSVM: Flush L2's ASID when emulating INVLPGA Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 25/27] KVM: nSVM: Flush the ASID on nested transitions if shared by L1 and L2 Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 26/27] KVM: nSVM: Use different ASIDs for " Yosry Ahmed
2026-10-12 23:36 ` [PATCH v3 27/27] KVM: selftests: Add a test for nested TLB flushes Yosry Ahmed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-168751@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=kvm@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
--cc=yosry@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox