[PATCH 0/3] KVM: nSVM: Fixes for SVM_EXIT_CR0_SEL_WRITE injection

[PATCH 0/3] KVM: nSVM: Fixes for SVM_EXIT_CR0_SEL_WRITE injection

[Yosry Ahmed]

A couple of fixes for injecting SVM_EXIT_CR0_SEL_WRITE to L1 when
emulating MOV-to-CR0 or LMSW. LMSW is handled by the emulator even in
some cases where decode assists are enabled, so it's a more important
fix. An example would be if L0 intercepts SVM_EXIT_WRITE_CR0 while L1
intercepts SVM_EXIT_CR0_SEL_WRITE.

Patch is an unrelated cleanup that can be dropped/merged separately.

Yosry Ahmed (3):
  KVM: nSVM: Remove redundant cases in nested_svm_intercept()
  KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW
    emulation
  KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE

 arch/x86/kvm/svm/nested.c | 10 ----------
 arch/x86/kvm/svm/svm.c    | 34 ++++++++++++++++++++++------------
 2 files changed, 22 insertions(+), 22 deletions(-)

-- 
2.51.1.821.gb6fe4d2222-goog

[PATCH 1/3] KVM: nSVM: Remove redundant cases in nested_svm_intercept()

[Yosry Ahmed]

Both the CRx and DRx cases are doing exactly what the default case is
doing, remove them.

No functional change intended.

Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
---
 arch/x86/kvm/svm/nested.c | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index a6443feab2520..71272efc16609 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1436,16 +1436,6 @@ static int nested_svm_intercept(struct vcpu_svm *svm)
 	case SVM_EXIT_IOIO:
 		vmexit = nested_svm_intercept_ioio(svm);
 		break;
-	case SVM_EXIT_READ_CR0 ... SVM_EXIT_WRITE_CR8: {
-		if (vmcb12_is_intercept(&svm->nested.ctl, exit_code))
-			vmexit = NESTED_EXIT_DONE;
-		break;
-	}
-	case SVM_EXIT_READ_DR0 ... SVM_EXIT_WRITE_DR7: {
-		if (vmcb12_is_intercept(&svm->nested.ctl, exit_code))
-			vmexit = NESTED_EXIT_DONE;
-		break;
-	}
 	case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 0x1f: {
 		/*
 		 * Host-intercepted exceptions have been checked already in
-- 
2.51.1.821.gb6fe4d2222-goog

[PATCH 2/3] KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation

[Yosry Ahmed]

When emulating L2 instructions, svm_check_intercept() checks whether a
write to CR0 should trigger a synthesized #VMEXIT with
SVM_EXIT_CR0_SEL_WRITE. For MOV-to-CR0, SVM_EXIT_CR0_SEL_WRITE is only
triggered if any bit other than CR0.MP and CR0.TS is updated. However,
according to the APM (24593—Rev.  3.42—March 2024, Table 15-7):

  The LMSW instruction treats the selective CR0-write
  intercept as a non-selective intercept (i.e., it intercepts
  regardless of the value being written).

Skip checking the changed bits for x86_intercept_lmsw and always inject
SVM_EXIT_CR0_SEL_WRITE.

Fixes: cfec82cb7d31 ("KVM: SVM: Add intercept check for emulated cr accesses")
Cc: stable@vger.kernel
Reported-by: Matteo Rizzo <matteorizzo@google.com>
Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
---
 arch/x86/kvm/svm/svm.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 153c12dbf3eb1..9ea0ff136e299 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -4541,20 +4541,20 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu,
 					INTERCEPT_SELECTIVE_CR0)))
 			break;
 
-		cr0 = vcpu->arch.cr0 & ~SVM_CR0_SELECTIVE_MASK;
-		val = info->src_val  & ~SVM_CR0_SELECTIVE_MASK;
-
+		/* LMSW always triggers INTERCEPT_SELECTIVE_CR0 */
 		if (info->intercept == x86_intercept_lmsw) {
-			cr0 &= 0xfUL;
-			val &= 0xfUL;
-			/* lmsw can't clear PE - catch this here */
-			if (cr0 & X86_CR0_PE)
-				val |= X86_CR0_PE;
+			icpt_info.exit_code = SVM_EXIT_CR0_SEL_WRITE;
+			break;
 		}
 
+		/*
+		 * MOV-to-CR0 only triggers INTERCEPT_SELECTIVE_CR0 if any bit
+		 * other than SVM_CR0_SELECTIVE_MASK is changed.
+		 */
+		cr0 = vcpu->arch.cr0 & ~SVM_CR0_SELECTIVE_MASK;
+		val = info->src_val  & ~SVM_CR0_SELECTIVE_MASK;
 		if (cr0 ^ val)
 			icpt_info.exit_code = SVM_EXIT_CR0_SEL_WRITE;
-
 		break;
 	}
 	case SVM_EXIT_READ_DR0:
-- 
2.51.1.821.gb6fe4d2222-goog

[PATCH 3/3] KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE

[Yosry Ahmed]

When emulating L2 instructions, svm_check_intercept() checks whether a
write to CR0 should trigger a synthesized #VMEXIT with
SVM_EXIT_CR0_SEL_WRITE. However, it does not check whether L1 enabled
the intercept for SVM_EXIT_WRITE_CR0, which has higher priority
according to the APM (24593—Rev.  3.42—March 2024, Table 15-7):

  When both selective and non-selective CR0-write
  intercepts are active at the same time, the non-selective
  intercept takes priority. With respect to exceptions, the
  priority of this inter

Make sure L1 does NOT intercept SVM_EXIT_WRITE_CR0 before checking if
SVM_EXIT_CR0_SEL_WRITE needs to be injected.

Fixes: cfec82cb7d31 ("KVM: SVM: Add intercept check for emulated cr accesses")
Cc: stable@vger.kernel
Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
---
 arch/x86/kvm/svm/svm.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 9ea0ff136e299..4f79c4d837535 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -4533,12 +4533,22 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu,
 		if (info->intercept == x86_intercept_cr_write)
 			icpt_info.exit_code += info->modrm_reg;
 
+		/*
+		 * If the write is indeed to CR0, check whether the exit_code
+		 * needs to be converted to SVM_EXIT_CR0_SEL_WRITE. Intercepting
+		 * SVM_EXIT_WRITE_CR0 has higher priority than
+		 * SVM_EXIT_CR0_SEL_WRITE, so this is only relevant if L1 sets
+		 * INTERCEPT_SELECTIVE_CR0 but not INTERCEPT_CR0_WRITE.
+		 */
 		if (icpt_info.exit_code != SVM_EXIT_WRITE_CR0 ||
-		    info->intercept == x86_intercept_clts)
+		    vmcb12_is_intercept(&svm->nested.ctl,
+					INTERCEPT_CR0_WRITE) ||
+		    !(vmcb12_is_intercept(&svm->nested.ctl,
+					  INTERCEPT_SELECTIVE_CR0)))
 			break;
 
-		if (!(vmcb12_is_intercept(&svm->nested.ctl,
-					INTERCEPT_SELECTIVE_CR0)))
+		/* CLTS never triggers INTERCEPT_SELECTIVE_CR0 */
+		if (info->intercept == x86_intercept_clts)
 			break;
 
 		/* LMSW always triggers INTERCEPT_SELECTIVE_CR0 */
-- 
2.51.1.821.gb6fe4d2222-goog

Re: [PATCH 0/3] KVM: nSVM: Fixes for SVM_EXIT_CR0_SEL_WRITE injection

[Yosry Ahmed]

On Fri, Oct 24, 2025 at 07:29:15PM +0000, Yosry Ahmed wrote:
> A couple of fixes for injecting SVM_EXIT_CR0_SEL_WRITE to L1 when
> emulating MOV-to-CR0 or LMSW. LMSW is handled by the emulator even in
> some cases where decode assists are enabled, so it's a more important
> fix. An example would be if L0 intercepts SVM_EXIT_WRITE_CR0 while L1
> intercepts SVM_EXIT_CR0_SEL_WRITE.
> 
> Patch is an unrelated cleanup that can be dropped/merged separately.

Patch 1*

Also, related tests:
https://lore.kernel.org/kvm/20251024194925.3201933-1-yosry.ahmed@linux.dev/

> 
> Yosry Ahmed (3):
>   KVM: nSVM: Remove redundant cases in nested_svm_intercept()
>   KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW
>     emulation
>   KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE
> 
>  arch/x86/kvm/svm/nested.c | 10 ----------
>  arch/x86/kvm/svm/svm.c    | 34 ++++++++++++++++++++++------------
>  2 files changed, 22 insertions(+), 22 deletions(-)
> 
> -- 
> 2.51.1.821.gb6fe4d2222-goog
> 

Re: [PATCH 2/3] KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation

[Sean Christopherson]

On Fri, Oct 24, 2025, Yosry Ahmed wrote:
> When emulating L2 instructions, svm_check_intercept() checks whether a
> write to CR0 should trigger a synthesized #VMEXIT with
> SVM_EXIT_CR0_SEL_WRITE. For MOV-to-CR0, SVM_EXIT_CR0_SEL_WRITE is only
> triggered if any bit other than CR0.MP and CR0.TS is updated. However,
> according to the APM (24593—Rev.  3.42—March 2024, Table 15-7):
> 
>   The LMSW instruction treats the selective CR0-write
>   intercept as a non-selective intercept (i.e., it intercepts
>   regardless of the value being written).
> 
> Skip checking the changed bits for x86_intercept_lmsw and always inject
> SVM_EXIT_CR0_SEL_WRITE.
> 
> Fixes: cfec82cb7d31 ("KVM: SVM: Add intercept check for emulated cr accesses")
> Cc: stable@vger.kernel

Bad email (mostly in case you're using a macro for this; the next patch has the
same typo).

Re: [PATCH 3/3] KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE

[Sean Christopherson]

On Fri, Oct 24, 2025, Yosry Ahmed wrote:
> When emulating L2 instructions, svm_check_intercept() checks whether a
> write to CR0 should trigger a synthesized #VMEXIT with
> SVM_EXIT_CR0_SEL_WRITE. However, it does not check whether L1 enabled
> the intercept for SVM_EXIT_WRITE_CR0, which has higher priority
> according to the APM (24593—Rev.  3.42—March 2024, Table 15-7):
> 
>   When both selective and non-selective CR0-write
>   intercepts are active at the same time, the non-selective
>   intercept takes priority. With respect to exceptions, the
>   priority of this inter
> 
> Make sure L1 does NOT intercept SVM_EXIT_WRITE_CR0 before checking if
> SVM_EXIT_CR0_SEL_WRITE needs to be injected.
> 
> Fixes: cfec82cb7d31 ("KVM: SVM: Add intercept check for emulated cr accesses")
> Cc: stable@vger.kernel
> Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
> ---
>  arch/x86/kvm/svm/svm.c | 16 +++++++++++++---
>  1 file changed, 13 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 9ea0ff136e299..4f79c4d837535 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -4533,12 +4533,22 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu,
>  		if (info->intercept == x86_intercept_cr_write)
>  			icpt_info.exit_code += info->modrm_reg;
>  
> +		/*
> +		 * If the write is indeed to CR0, check whether the exit_code
> +		 * needs to be converted to SVM_EXIT_CR0_SEL_WRITE. Intercepting
> +		 * SVM_EXIT_WRITE_CR0 has higher priority than
> +		 * SVM_EXIT_CR0_SEL_WRITE, so this is only relevant if L1 sets
> +		 * INTERCEPT_SELECTIVE_CR0 but not INTERCEPT_CR0_WRITE.
> +		 */
>  		if (icpt_info.exit_code != SVM_EXIT_WRITE_CR0 ||

Oof, the existing is all kinds of confusing.  Even with your comment, it took me
a few seconds to understand how/where the exit_code is being modified.  Eww.

Any objection to opportunistically fixing this up to the (completely untested)
below when applying?

		/*
		 * Adjust the exit code accordingly if a CR other than CR0 is
		 * being written, and skip straight to the common handling as
		 * only CR0 has an additional selective intercept.
		 */
		if (info->intercept == x86_intercept_cr_write && info->modrm_reg) {
			icpt_info.exit_code += info->modrm_reg;
			break;
		}

		/*
		 * Convert the exit_code to SVM_EXIT_CR0_SEL_WRITE if L1 set
		 * INTERCEPT_SELECTIVE_CR0 but not INTERCEPT_CR0_WRITE, as the
		 * unconditional intercept has higher priority.
		 */
		if (vmcb12_is_intercept(&svm->nested.ctl, INTERCEPT_CR0_WRITE) ||
		    !(vmcb12_is_intercept(&svm->nested.ctl, INTERCEPT_SELECTIVE_CR0)))
			break;


> -		    info->intercept == x86_intercept_clts)
> +		    vmcb12_is_intercept(&svm->nested.ctl,
> +					INTERCEPT_CR0_WRITE) ||
> +		    !(vmcb12_is_intercept(&svm->nested.ctl,
> +					  INTERCEPT_SELECTIVE_CR0)))

Let these poke out.

>  			break;
>  
> -		if (!(vmcb12_is_intercept(&svm->nested.ctl,
> -					INTERCEPT_SELECTIVE_CR0)))
> +		/* CLTS never triggers INTERCEPT_SELECTIVE_CR0 */
> +		if (info->intercept == x86_intercept_clts)
>  			break;
>  
>  		/* LMSW always triggers INTERCEPT_SELECTIVE_CR0 */
> -- 
> 2.51.1.821.gb6fe4d2222-goog
> 

Re: [PATCH 2/3] KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation

[Yosry Ahmed]

On Wed, Nov 05, 2025 at 11:44:27AM -0800, Sean Christopherson wrote:
> On Fri, Oct 24, 2025, Yosry Ahmed wrote:
> > When emulating L2 instructions, svm_check_intercept() checks whether a
> > write to CR0 should trigger a synthesized #VMEXIT with
> > SVM_EXIT_CR0_SEL_WRITE. For MOV-to-CR0, SVM_EXIT_CR0_SEL_WRITE is only
> > triggered if any bit other than CR0.MP and CR0.TS is updated. However,
> > according to the APM (24593—Rev.  3.42—March 2024, Table 15-7):
> > 
> >   The LMSW instruction treats the selective CR0-write
> >   intercept as a non-selective intercept (i.e., it intercepts
> >   regardless of the value being written).
> > 
> > Skip checking the changed bits for x86_intercept_lmsw and always inject
> > SVM_EXIT_CR0_SEL_WRITE.
> > 
> > Fixes: cfec82cb7d31 ("KVM: SVM: Add intercept check for emulated cr accesses")
> > Cc: stable@vger.kernel
> 
> Bad email (mostly in case you're using a macro for this; the next patch has the
> same typo).

Yeah I realized after sending it. Will fixup if there's a new version.

Re: [PATCH 3/3] KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE

[Yosry Ahmed]

On Wed, Nov 05, 2025 at 11:48:27AM -0800, Sean Christopherson wrote:
> On Fri, Oct 24, 2025, Yosry Ahmed wrote:
> > When emulating L2 instructions, svm_check_intercept() checks whether a
> > write to CR0 should trigger a synthesized #VMEXIT with
> > SVM_EXIT_CR0_SEL_WRITE. However, it does not check whether L1 enabled
> > the intercept for SVM_EXIT_WRITE_CR0, which has higher priority
> > according to the APM (24593—Rev.  3.42—March 2024, Table 15-7):
> > 
> >   When both selective and non-selective CR0-write
> >   intercepts are active at the same time, the non-selective
> >   intercept takes priority. With respect to exceptions, the
> >   priority of this inter
> > 
> > Make sure L1 does NOT intercept SVM_EXIT_WRITE_CR0 before checking if
> > SVM_EXIT_CR0_SEL_WRITE needs to be injected.
> > 
> > Fixes: cfec82cb7d31 ("KVM: SVM: Add intercept check for emulated cr accesses")
> > Cc: stable@vger.kernel
> > Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
> > ---
> >  arch/x86/kvm/svm/svm.c | 16 +++++++++++++---
> >  1 file changed, 13 insertions(+), 3 deletions(-)
> > 
> > diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> > index 9ea0ff136e299..4f79c4d837535 100644
> > --- a/arch/x86/kvm/svm/svm.c
> > +++ b/arch/x86/kvm/svm/svm.c
> > @@ -4533,12 +4533,22 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu,
> >  		if (info->intercept == x86_intercept_cr_write)
> >  			icpt_info.exit_code += info->modrm_reg;
> >  
> > +		/*
> > +		 * If the write is indeed to CR0, check whether the exit_code
> > +		 * needs to be converted to SVM_EXIT_CR0_SEL_WRITE. Intercepting
> > +		 * SVM_EXIT_WRITE_CR0 has higher priority than
> > +		 * SVM_EXIT_CR0_SEL_WRITE, so this is only relevant if L1 sets
> > +		 * INTERCEPT_SELECTIVE_CR0 but not INTERCEPT_CR0_WRITE.
> > +		 */
> >  		if (icpt_info.exit_code != SVM_EXIT_WRITE_CR0 ||
> 
> Oof, the existing is all kinds of confusing.  Even with your comment, it took me
> a few seconds to understand how/where the exit_code is being modified.  Eww.
> 
> Any objection to opportunistically fixing this up to the (completely untested)
> below when applying?

Looks good with a minor nit:

> 
> 		/*
> 		 * Adjust the exit code accordingly if a CR other than CR0 is
> 		 * being written, and skip straight to the common handling as
> 		 * only CR0 has an additional selective intercept.
> 		 */
> 		if (info->intercept == x86_intercept_cr_write && info->modrm_reg) {
> 			icpt_info.exit_code += info->modrm_reg;
> 			break;
> 		}
> 
> 		/*
> 		 * Convert the exit_code to SVM_EXIT_CR0_SEL_WRITE if L1 set
> 		 * INTERCEPT_SELECTIVE_CR0 but not INTERCEPT_CR0_WRITE, as the
> 		 * unconditional intercept has higher priority.
> 		 */

We only convert the exict_code to SVM_EXIT_CR0_SEL_WRITE if other
conditions are true below. So maybe "Check if the exit_code needs to be
converted to.."?

> 		if (vmcb12_is_intercept(&svm->nested.ctl, INTERCEPT_CR0_WRITE) ||
> 		    !(vmcb12_is_intercept(&svm->nested.ctl, INTERCEPT_SELECTIVE_CR0)))
> 			break;
> 
> 
> > -		    info->intercept == x86_intercept_clts)
> > +		    vmcb12_is_intercept(&svm->nested.ctl,
> > +					INTERCEPT_CR0_WRITE) ||
> > +		    !(vmcb12_is_intercept(&svm->nested.ctl,
> > +					  INTERCEPT_SELECTIVE_CR0)))
> 
> Let these poke out.

Sure. Do you prefer a new version with this + your fixup above, or will
you fix them up while applying?

> 
> >  			break;
> >  
> > -		if (!(vmcb12_is_intercept(&svm->nested.ctl,
> > -					INTERCEPT_SELECTIVE_CR0)))
> > +		/* CLTS never triggers INTERCEPT_SELECTIVE_CR0 */
> > +		if (info->intercept == x86_intercept_clts)
> >  			break;
> >  
> >  		/* LMSW always triggers INTERCEPT_SELECTIVE_CR0 */
> > -- 
> > 2.51.1.821.gb6fe4d2222-goog
> > 

Re: [PATCH 3/3] KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE

[Sean Christopherson]

On Wed, Nov 05, 2025, Yosry Ahmed wrote:
> On Wed, Nov 05, 2025 at 11:48:27AM -0800, Sean Christopherson wrote:
> > On Fri, Oct 24, 2025, Yosry Ahmed wrote:
> Looks good with a minor nit:
> 
> > 
> > 		/*
> > 		 * Adjust the exit code accordingly if a CR other than CR0 is
> > 		 * being written, and skip straight to the common handling as
> > 		 * only CR0 has an additional selective intercept.
> > 		 */
> > 		if (info->intercept == x86_intercept_cr_write && info->modrm_reg) {
> > 			icpt_info.exit_code += info->modrm_reg;
> > 			break;
> > 		}
> > 
> > 		/*
> > 		 * Convert the exit_code to SVM_EXIT_CR0_SEL_WRITE if L1 set
> > 		 * INTERCEPT_SELECTIVE_CR0 but not INTERCEPT_CR0_WRITE, as the
> > 		 * unconditional intercept has higher priority.
> > 		 */
> 
> We only convert the exict_code to SVM_EXIT_CR0_SEL_WRITE if other
> conditions are true below. So maybe "Check if the exit_code needs to be
> converted to.."?

Ouch, good point.  I keep forgetting that the common code below this needs to
check the exit_code against the intercept enables.  How about this?

		/*
		 * Convert the exit_code to SVM_EXIT_CR0_SEL_WRITE if a
		 * selective CR0 intercept is triggered (the common logic will
		 * treat the selective intercept as being enabled).  Note, the
		 * unconditional intercept has higher priority, i.e. this is
		 * only relevant if *only* the selective intercept is enabled.
		 */

> 
> > 		if (vmcb12_is_intercept(&svm->nested.ctl, INTERCEPT_CR0_WRITE) ||
> > 		    !(vmcb12_is_intercept(&svm->nested.ctl, INTERCEPT_SELECTIVE_CR0)))
> > 			break;
> > 
> > 
> > > -		    info->intercept == x86_intercept_clts)
> > > +		    vmcb12_is_intercept(&svm->nested.ctl,
> > > +					INTERCEPT_CR0_WRITE) ||
> > > +		    !(vmcb12_is_intercept(&svm->nested.ctl,
> > > +					  INTERCEPT_SELECTIVE_CR0)))
> > 
> > Let these poke out.
> 
> Sure. Do you prefer a new version with this + your fixup above, or will
> you fix them up while applying?

If you're happy with it, I'll just fixup when applying.

Re: [PATCH 3/3] KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE

[Yosry Ahmed]

On Wed, Nov 05, 2025 at 12:37:37PM -0800, Sean Christopherson wrote:
> On Wed, Nov 05, 2025, Yosry Ahmed wrote:
> > On Wed, Nov 05, 2025 at 11:48:27AM -0800, Sean Christopherson wrote:
> > > On Fri, Oct 24, 2025, Yosry Ahmed wrote:
> > Looks good with a minor nit:
> > 
> > > 
> > > 		/*
> > > 		 * Adjust the exit code accordingly if a CR other than CR0 is
> > > 		 * being written, and skip straight to the common handling as
> > > 		 * only CR0 has an additional selective intercept.
> > > 		 */
> > > 		if (info->intercept == x86_intercept_cr_write && info->modrm_reg) {
> > > 			icpt_info.exit_code += info->modrm_reg;
> > > 			break;
> > > 		}
> > > 
> > > 		/*
> > > 		 * Convert the exit_code to SVM_EXIT_CR0_SEL_WRITE if L1 set
> > > 		 * INTERCEPT_SELECTIVE_CR0 but not INTERCEPT_CR0_WRITE, as the
> > > 		 * unconditional intercept has higher priority.
> > > 		 */
> > 
> > We only convert the exict_code to SVM_EXIT_CR0_SEL_WRITE if other
> > conditions are true below. So maybe "Check if the exit_code needs to be
> > converted to.."?
> 
> Ouch, good point.  I keep forgetting that the common code below this needs to
> check the exit_code against the intercept enables.  How about this?

Looks good.

> 
> 		/*
> 		 * Convert the exit_code to SVM_EXIT_CR0_SEL_WRITE if a
> 		 * selective CR0 intercept is triggered (the common logic will
> 		 * treat the selective intercept as being enabled).  Note, the
> 		 * unconditional intercept has higher priority, i.e. this is
> 		 * only relevant if *only* the selective intercept is enabled.
> 		 */
> 
> > 
> > > 		if (vmcb12_is_intercept(&svm->nested.ctl, INTERCEPT_CR0_WRITE) ||
> > > 		    !(vmcb12_is_intercept(&svm->nested.ctl, INTERCEPT_SELECTIVE_CR0)))
> > > 			break;
> > > 
> > > 
> > > > -		    info->intercept == x86_intercept_clts)
> > > > +		    vmcb12_is_intercept(&svm->nested.ctl,
> > > > +					INTERCEPT_CR0_WRITE) ||
> > > > +		    !(vmcb12_is_intercept(&svm->nested.ctl,
> > > > +					  INTERCEPT_SELECTIVE_CR0)))
> > > 
> > > Let these poke out.
> > 
> > Sure. Do you prefer a new version with this + your fixup above, or will
> > you fix them up while applying?
> 
> If you're happy with it, I'll just fixup when applying.

More than happy :)

Re: [PATCH 0/3] KVM: nSVM: Fixes for SVM_EXIT_CR0_SEL_WRITE injection

[Sean Christopherson]

On Fri, 24 Oct 2025 19:29:15 +0000, Yosry Ahmed wrote:
> A couple of fixes for injecting SVM_EXIT_CR0_SEL_WRITE to L1 when
> emulating MOV-to-CR0 or LMSW. LMSW is handled by the emulator even in
> some cases where decode assists are enabled, so it's a more important
> fix. An example would be if L0 intercepts SVM_EXIT_WRITE_CR0 while L1
> intercepts SVM_EXIT_CR0_SEL_WRITE.
> 
> Patch is an unrelated cleanup that can be dropped/merged separately.
> 
> [...]

Applied to kvm-x86 svm, with the proper stable@ email and the tweaks to
svm_check_intercept().  Thanks!

[1/3] KVM: nSVM: Remove redundant cases in nested_svm_intercept()
      https://github.com/kvm-x86/linux/commit/3d31bdf9cc79
[2/3] KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation
      https://github.com/kvm-x86/linux/commit/5674a76db021
[3/3] KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE
      https://github.com/kvm-x86/linux/commit/3d80f4c93d3d

--
https://github.com/kvm-x86/linux/tree/next