Re: [PATCH v3 2/8] KVM: x86: nSVM: Cache and validate vmcb12 g_pat

[Sean Christopherson <seanjc@google.com>]

On Thu, Feb 05, 2026, Jim Mattson wrote:
> Cache g_pat from vmcb12 in svm->nested.gpat to avoid TOCTTOU issues, and
> add a validity check so that when nested paging is enabled for vmcb12, an
> invalid g_pat causes an immediate VMEXIT with exit code VMEXIT_INVALID, as
> specified in the APM, volume 2: "Nested Paging and VMRUN/VMEXIT."
> 
> Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler")
> Signed-off-by: Jim Mattson <jmattson@google.com>
> ---
>  arch/x86/kvm/svm/nested.c | 4 +++-
>  arch/x86/kvm/svm/svm.h    | 3 +++
>  2 files changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index f72dbd10dcad..1d4ff6408b34 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -1027,9 +1027,11 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu)
>  
>  	nested_copy_vmcb_control_to_cache(svm, &vmcb12->control);
>  	nested_copy_vmcb_save_to_cache(svm, &vmcb12->save);
> +	svm->nested.gpat = vmcb12->save.g_pat;
>  
>  	if (!nested_vmcb_check_save(vcpu) ||
> -	    !nested_vmcb_check_controls(vcpu)) {
> +	    !nested_vmcb_check_controls(vcpu) ||
> +	    (nested_npt_enabled(svm) && !kvm_pat_valid(svm->nested.gpat))) {
>  		vmcb12->control.exit_code    = SVM_EXIT_ERR;
>  		vmcb12->control.exit_info_1  = 0;
>  		vmcb12->control.exit_info_2  = 0;
> diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
> index 986d90f2d4ca..42a4bf83b3aa 100644
> --- a/arch/x86/kvm/svm/svm.h
> +++ b/arch/x86/kvm/svm/svm.h
> @@ -208,6 +208,9 @@ struct svm_nested_state {
>  	 */
>  	struct vmcb_save_area_cached save;
>  
> +	/* Cached guest PAT from vmcb12.save.g_pat */
> +	u64 gpat;

Shouldn't this go in vmcb_save_area_cached?

> +
>  	bool initialized;
>  
>  	/*
> -- 
> 2.53.0.rc2.204.g2597b5adb4-goog
>