From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793819860; b=nrAxErg7XHl75L2AstcGAKv2HoN8ulBH4dBmkPTMaSnnpYQymvwCQx/mx187mxg4H4zI w/7NPYlgDPRYnD2srypHmPwGUGmpi+MezKB4bu3GtPZthp92JW0xGjQLL0UgZOjL6H0z4 FIL4CKukMHfOEepnJDGHhidEr+1NSPS5/REx0LOMKPOZm6QGWf+GQ324oCcNPfbg6S4a1 7QUAstwwR/Q0u5N3qxchtRyrPRLPGVxJTcNpXboYW285hSHxfBnukhjea40SznVc/rCBX pBZ35Fb07Abf3pfh6HWkjin0W8Gk8iuYlVej+bl5MShssOQ1dJh73cqCZoPPECApPcA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793819860; h=Received:DKIM-Signature:Subject:To:Cc:From:Date:Message-ID: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=U9+4YSbqhHe0WY8j9SQQ84HN/8Gyz2F7onpfiZybp4k=; b=0VaAfZFUVn+UJCYZ9DOPlq0ABO/EhHdYAL2r5nyDg/vy0T0UPxFRHDMHQg+3uwLW/Xxg sHoSk2kgGLA3bE7PzOPs1C0h96uFOrciHgOLSDkUxvtcYdim+9e1QiENswaXxlIguq73I TBedupMF2/KfF+ZloX5EKCg6VDZ+q+KGAxIZF7RSVJYMO3j7euRfD5k+0OM8IyFP7OVSM IphQvhiq/4M/xuwIUl27QMvgfqH6yr4bUjlqXa5BFR6C3Q505QgXFTU/lB5X+8tMwb3DG RokRjGDn0IrOPpwN3eRJHlL+QfM7sVjHJ/4gAXxR4KFNzCk18WVQhvyc+guaA8PTtcA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=hCtiTuPx; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0113F60A3832 for ; Wed, 4 Nov 2026 19:17:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=hCtiTuPx Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4B23B1F0093A; Wed, 4 Nov 2026 19:17:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793819859; bh=U9+4YSbqhHe0WY8j9SQQ84HN/8Gyz2F7onpfiZybp4k=; h=Subject:To:Cc:From:Date; b=hCtiTuPxAAqiVlVSqzBpd9F6+9XkX8WNHKji/9X6hmecjr59hCYdtDBo1YI2HU9wY cF8p4YMrLFcz4QK2JoY7hsB73bSkyM/6XN57Z+I+vq71vCiDu6R0VVqWozwc8EoYhr NuP+wOQrjnqeDIlxgEpb3LqfWSXcgS0SeTHyjICA= Subject: FAILED: patch "[PATCH] KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1" failed to apply to 6.12-stable tree To: seanjc@google.com,fane@google.com,yosry@kernel.org Cc: From: Date: Wed, 04 Nov 2026 14:17:37 -0500 Message-ID: <2026110437-payer-attire-6993@gregkh> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.12-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y git checkout FETCH_HEAD git cherry-pick -x 5dc500a354cc8e109df678076ae3488094649468 # git commit -s git send-email --to '' --in-reply-to '2026110437-payer-attire-6993@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..' Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 5dc500a354cc8e109df678076ae3488094649468 Mon Sep 17 00:00:00 2001 From: Sean Christopherson Date: Wed, 2 Sep 2026 16:20:24 -0700 Subject: [PATCH] KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0 Reject KVM_SET_NESTED_STATE if the incoming L1 host state has what is effectively an impossible EFER combination of LMA=1 but LME=0, i.e. if the state says long mode is active but not enabled. Unlike VMX, SVM doesn't have an explicit consistent check for the illegal combination; presumably hardware simply ignores EFER.LMA if EFER.LME=0. Unfortunately, KVM doesn't ignore EFER.LMA in this case and consumes the illegal state when constructing the shadow MMU for L2. E.g. if userspace also clears CR4.PAE, then kvm_calc_cpu_role() will compute a role with 4 or 5 levels of paging, but shadow_mmu_init_context() will wire up the MMU to use the paging32 template, which maxes out its levels at 2. Note, the "real badness" is effectively the same as what happened with the nVMX bug fixed by commit 112e66017bff ("KVM: nVMX: add missing consistency checks for CR0 and CR4"). Unfortunately, the sanity check added by commit 72e2fb24a0b0 ("KVM: x86/mmu: Bug the VM if a vCPU ends up in long mode without PAE enabled") doesn't work for this case, since L2 state is active at the time of the page fault, but it's L1 that has the bad state. Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") Cc: stable@vger.kernel.org Cc: Yosry Ahmed Reported-by: Stefan Teodorescu Link: https://patch.msgid.link/20260902232028.2767071-2-seanjc@google.com Signed-off-by: Sean Christopherson diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 73f37b050d0a..49fb10ad1f9f 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -2028,6 +2028,7 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, if (!(save->cr0 & X86_CR0_PG) || !(save->cr0 & X86_CR0_PE) || (save->rflags & X86_EFLAGS_VM) || + ((save->efer & EFER_LMA) && !(save->efer & EFER_LME)) || !nested_vmcb_check_save(vcpu, &save_cached, false)) goto out_free;