[PATCH] KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode

[PATCH] KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode

[Yosry Ahmed]

On nested VMRUN, KVM ensures AVIC is inhibited by requesting
KVM_REQ_APICV_UPDATE, triggering a check of inhibit reasons, finding
APICV_INHIBIT_REASON_NESTED, and disabling AVIC.

However, when KVM_SET_NESTED_STATE is performed on a vCPU not in guest
mode with AVIC enabled, KVM_REQ_APICV_UPDATE is not requested, and AVIC
is not inhibited.

Request KVM_REQ_APICV_UPDATE in the KVM_SET_NESTED_STATE path if AVIC is
active, similar to the nested VMRUN path.

Fixes: f44509f849fe ("KVM: x86: SVM: allow AVIC to co-exist with a nested guest running")
Cc: stable@vger.kernel.org
Signed-off-by: Yosry Ahmed <yosry@kernel.org>
---

After the dust settles from all the inflight changes touching this area,
we really need to reuse enter_svm_guest_mode() in svm_set_nested_state()
imo. There are a few differences that will need to be addressed:

1. nested_vmcb02_prepare_save() needs to be skipped.

2. nested_svm_copy_common_state() may need to be skipped (or honestly,
just folded into nested_vmcb02_prepare_save()?).

2. The CR3 value passed to nested_svm_load_cr3() needs to change.

3. Need to check if calling nested_svm_hv_update_vm_vp_ids() is
okay/needed (might be another bug actually).

I think mostly likely we'll pass a boolean arg to
enter_svm_guest_mode(), something like use_cached_save, and key 1 to 3
off of it. I don't like it (smells like from_vmrun), but it's the
simplest way to avoid bugs like this in the future.

---
 arch/x86/kvm/svm/nested.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index de90b104a0dd5..82e512631e514 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1922,6 +1922,9 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu,
 
 	svm->nested.force_msr_bitmap_recalc = true;
 
+	if (kvm_vcpu_apicv_active(vcpu))
+		kvm_make_request(KVM_REQ_APICV_UPDATE, vcpu);
+
 	kvm_make_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu);
 	ret = 0;
 out_free:
-- 
2.53.0.414.gf7e9f6c205-goog

Re: [PATCH] KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode

[Sean Christopherson]

On Tue, 24 Feb 2026 22:50:17 +0000, Yosry Ahmed wrote:
> On nested VMRUN, KVM ensures AVIC is inhibited by requesting
> KVM_REQ_APICV_UPDATE, triggering a check of inhibit reasons, finding
> APICV_INHIBIT_REASON_NESTED, and disabling AVIC.
> 
> However, when KVM_SET_NESTED_STATE is performed on a vCPU not in guest
> mode with AVIC enabled, KVM_REQ_APICV_UPDATE is not requested, and AVIC
> is not inhibited.
> 
> [...]

Applied to kvm-x86 nested, thanks!

[1/1] KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
      https://github.com/kvm-x86/linux/commit/24f7d36b824b

--
https://github.com/kvm-x86/linux/tree/next