From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A73F919E7F7 for ; Thu, 8 Jan 2026 22:17:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767910645; cv=none; b=Oxhfqw+QTKgGdotS55MfkQK7I9qolomrE8y/lSRUZSCILAflRz5mYCYPoMRSfJlsIz+XLF2btamX4C9nHG3g2lGmh9KWdd8G3O2iFtlzxkNRSFOD/tJLIYdn5LI2JjtBXr2AB+IIHJtJo8s+WqFtq1DBMCx28U9FzsJt0oD7yKk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767910645; c=relaxed/simple; bh=kGtIyrozfErdkkp8yatgyuEMfGxbnG/eJ0Eg4bIJqas=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=tZv9j7tFL5Mxg4ok7fMWKhLrhqvOUKLFX6IBNGMJ0F2vyh4I5GYbEDJKFmnkM5bEjPRlhcZkpEUf0S9aCyRh2PSbGOtMU0mnNa8aHQ4XdtuNOMkhOQRZ1PNqpEL+U5GrfIHIF7aT/eGuCbDjStnZi4s5EOvNjPko6iwH9eVwA1c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=sdkPgPYT; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="sdkPgPYT" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-2a0e952f153so87059825ad.0 for ; Thu, 08 Jan 2026 14:17:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1767910644; x=1768515444; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=oX0bkmnPVOAK4yukHCtxtzEmrtPV4mhJxow2A9Nc6IQ=; b=sdkPgPYTfsxqh3iHXsq5wrQ/Egs0R31yb6NENIvVr3UPdw3Eb4ZiLI+LocoKsyZDbL nYudO+FvHDGYt9qOoMmKj80LIZ2XXJ6HpGwe93iy9oYvrz+5DQewnwUc7Uq5Oj0bnor4 JXtphOlkcEPpG5X+dXYKGwo8gPbiRRSJShxjnJF59xsvFZqHDuH/RWaFApsqysRozZNb BxQtXFdT+09SZPWkZ9QjXKWJKTczfT3HBs/Cy57oqo0zi0CgXxtrDViBoJK47p6rND2R kWD4s6Kg6aCxSY3AIIYIAaWFEZMzOHW9PFUIP6exCfZGDZXFwDiAmS9b21f/e8Vv+gqU 8AcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767910644; x=1768515444; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=oX0bkmnPVOAK4yukHCtxtzEmrtPV4mhJxow2A9Nc6IQ=; b=dvcQ8nmCKIlQ5Ss3LjlQr+Ff4liEoZjitWEeCEx1dOBb6lHq/YTKTIFlqytYoDUQFh 9G67g/yvyIQxsUSWOEpxQrHzRY1ZuHT2mBkJ3ZVX8jaGibICEoHIpQ8sbK6hj+owKe0v qNtacITi/CeaqqoIleauW5D4TctVxsT12FqiuriYYQEW5IB45VryK3ltG+5EzO7rzExn Ld/1+DBJnyWimYZNIuK3lg+qofGYZYGlf1g08dhHTfKkiv6OZEe4qO8ie6c13g81PJ7/ euR8511c0Ocs72sQdmSNlvg1PTu3/genAF3Mzn0SsH5arp1EBkdddQ8qx8lr9Dw2ia76 tfiw== X-Forwarded-Encrypted: i=1; AJvYcCXoRSGkrOXxgcMbsHaPgIsyn3snG1r+PVuOGupl/4KTYXdpeQvlA87yix5CScqwFIOjGjNkhYBYkxmpceo=@vger.kernel.org X-Gm-Message-State: AOJu0Yyx/MHQgtxI5ax2E2M/96GNoQQjPR23xro1WQIqLaBU5Hf41Ost N332ze6ZQuHwJHxwHiCm1ehPx4/ipyjjTKEJWZXRh8WR9YE7QqG+SXty5AU46Sf7ZUFD+3WO2r5 ennSp6Q== X-Google-Smtp-Source: AGHT+IHBPQPVdtqOzZVlwV2MFsxhm6DsSl3Eiuip947UQeWs/gCMNAAUq1vwfiXrUcABp9WPpgsMGngD7P4= X-Received: from pjbfv11.prod.google.com ([2002:a17:90b:e8b:b0:34c:2f02:7f5d]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:a122:b0:384:fa66:c1a with SMTP id adf61e73a8af0-3898f997599mr6687544637.48.1767910643892; Thu, 08 Jan 2026 14:17:23 -0800 (PST) Date: Thu, 8 Jan 2026 14:17:22 -0800 In-Reply-To: <6ilulzhszphdjk3ta5jt7t222jicn3zj5e6em3fknzmudeqr3f@dogx6h7lsrax> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251121204803.991707-1-yosry.ahmed@linux.dev> <20251121204803.991707-2-yosry.ahmed@linux.dev> <6ilulzhszphdjk3ta5jt7t222jicn3zj5e6em3fknzmudeqr3f@dogx6h7lsrax> Message-ID: Subject: Re: [PATCH v3 1/4] KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 From: Sean Christopherson To: Yosry Ahmed Cc: Paolo Bonzini , Jim Mattson , kvm@vger.kernel.org, linux-kernel@vger.kernel.org Content-Type: text/plain; charset="us-ascii" On Thu, Jan 08, 2026, Yosry Ahmed wrote: > On Thu, Jan 08, 2026 at 10:58:40AM -0800, Sean Christopherson wrote: > > On Fri, Nov 21, 2025, Yosry Ahmed wrote: > > > From: Jim Mattson > > > > > > GIF==0 together with EFER.SVME==0 is a valid architectural > > > state. Don't return -EINVAL for KVM_SET_NESTED_STATE when this > > > combination is specified. > > > > > > Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") > > > Signed-off-by: Jim Mattson > > > Reviewed-by: Yosry Ahmed > > > Signed-off-by: Yosry Ahmed > > > --- > > > arch/x86/kvm/svm/nested.c | 4 ++-- > > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > > > diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c > > > index c81005b24522..3e4bd8d69788 100644 > > > --- a/arch/x86/kvm/svm/nested.c > > > +++ b/arch/x86/kvm/svm/nested.c > > > @@ -1784,8 +1784,8 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, > > > * EFER.SVME, but EFER.SVME still has to be 1 for VMRUN to succeed. > > > */ > > > if (!(vcpu->arch.efer & EFER_SVME)) { > > > - /* GIF=1 and no guest mode are required if SVME=0. */ > > > - if (kvm_state->flags != KVM_STATE_NESTED_GIF_SET) > > > + /* GUEST_MODE must be clear when SVME==0 */ > > > + if (kvm_state->flags & KVM_STATE_NESTED_GUEST_MODE) > > > > Hmm, this is technically wrong, as it will allow KVM_STATE_NESTED_RUN_PENDING. > > Now, arguably KVM already has a flaw there as KVM allows KVM_STATE_NESTED_RUN_PENDING > > without KVM_STATE_NESTED_GUEST_MODE for SVME=1, but I'd prefer not to make the > > hole bigger. > > > > The nested if-statement is also unnecessary. > > > > How about this instead? (not yet tested) > > > > /* > > * If in guest mode, vcpu->arch.efer actually refers to the L2 guest's > > * EFER.SVME, but EFER.SVME still has to be 1 for VMRUN to succeed. > > * If SVME is disabled, the only valid states are "none" and GIF=1 > > * (clearing SVME does NOT set GIF, i.e. GIF=0 is allowed). > > */ > > if (!(vcpu->arch.efer & EFER_SVME) && kvm_state->flags && > > kvm_state->flags != KVM_STATE_NESTED_GIF_SET) > > return -EINVAL; > > Looks good to me, with the tiny exception that at this point clearing > SVME does set GIF. Maybe re-order the patches? > > Let me know if you want me to send a new version or if you'll fix it up > while applying. No need for a new version.