From 6df94efdbeef04495475cae9d3343cb7dc98af97 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 3 May 2026 14:23:15 +0200 Subject: [PATCH] 5.10-stable patches added patches: kvm-nsvm-clear-gif-on-nested-vmexit-invalid.patch kvm-nsvm-ensure-avic-is-inhibited-when-restoring-a-vcpu-to-guest-mode.patch kvm-nsvm-mark-all-of-vmcb02-dirty-when-restoring-nested-state.patch kvm-nsvm-sync-interrupt-shadow-to-cached-vmcb12-after-vmrun-of-l2.patch kvm-nsvm-sync-nextrip-to-cached-vmcb12-after-vmrun-of-l2.patch userfaultfd-allow-registration-of-ranges-below-mmap_min_addr.patch --- ...m-clear-gif-on-nested-vmexit-invalid.patch | 33 ++++++++++ ...-when-restoring-a-vcpu-to-guest-mode.patch | 42 +++++++++++++ ...02-dirty-when-restoring-nested-state.patch | 42 +++++++++++++ ...w-to-cached-vmcb12-after-vmrun-of-l2.patch | 52 ++++++++++++++++ ...p-to-cached-vmcb12-after-vmrun-of-l2.patch | 55 +++++++++++++++++ queue-5.10/series | 6 ++ ...ration-of-ranges-below-mmap_min_addr.patch | 60 +++++++++++++++++++ 7 files changed, 290 insertions(+) create mode 100644 queue-5.10/kvm-nsvm-clear-gif-on-nested-vmexit-invalid.patch create mode 100644 queue-5.10/kvm-nsvm-ensure-avic-is-inhibited-when-restoring-a-vcpu-to-guest-mode.patch create mode 100644 queue-5.10/kvm-nsvm-mark-all-of-vmcb02-dirty-when-restoring-nested-state.patch create mode 100644 queue-5.10/kvm-nsvm-sync-interrupt-shadow-to-cached-vmcb12-after-vmrun-of-l2.patch create mode 100644 queue-5.10/kvm-nsvm-sync-nextrip-to-cached-vmcb12-after-vmrun-of-l2.patch create mode 100644 queue-5.10/userfaultfd-allow-registration-of-ranges-below-mmap_min_addr.patch diff --git a/queue-5.10/kvm-nsvm-clear-gif-on-nested-vmexit-invalid.patch b/queue-5.10/kvm-nsvm-clear-gif-on-nested-vmexit-invalid.patch new file mode 100644 index 0000000000..46d806a5fd --- /dev/null +++ b/queue-5.10/kvm-nsvm-clear-gif-on-nested-vmexit-invalid.patch @@ -0,0 +1,33 @@ +From f85a6ce06e4a0d49652f57967a649ab09e06287c Mon Sep 17 00:00:00 2001 +From: Yosry Ahmed +Date: Tue, 3 Mar 2026 00:34:04 +0000 +Subject: KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) + +From: Yosry Ahmed + +commit f85a6ce06e4a0d49652f57967a649ab09e06287c upstream. + +According to the APM, GIF is set to 0 on any #VMEXIT, including +an #VMEXIT(INVALID) due to failed consistency checks. Clear GIF on +consistency check failures. + +Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler") +Cc: stable@vger.kernel.org +Signed-off-by: Yosry Ahmed +Link: https://patch.msgid.link/20260303003421.2185681-11-yosry@kernel.org +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/svm/nested.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/kvm/svm/nested.c ++++ b/arch/x86/kvm/svm/nested.c +@@ -532,6 +532,7 @@ int nested_svm_vmrun(struct vcpu_svm *sv + vmcb12->control.exit_code_hi = -1u; + vmcb12->control.exit_info_1 = 0; + vmcb12->control.exit_info_2 = 0; ++ svm_set_gif(svm, false); + goto out; + } + diff --git a/queue-5.10/kvm-nsvm-ensure-avic-is-inhibited-when-restoring-a-vcpu-to-guest-mode.patch b/queue-5.10/kvm-nsvm-ensure-avic-is-inhibited-when-restoring-a-vcpu-to-guest-mode.patch new file mode 100644 index 0000000000..f47ecf2393 --- /dev/null +++ b/queue-5.10/kvm-nsvm-ensure-avic-is-inhibited-when-restoring-a-vcpu-to-guest-mode.patch @@ -0,0 +1,42 @@ +From 24f7d36b824b65cf1a2db3db478059187b2a37b0 Mon Sep 17 00:00:00 2001 +From: Yosry Ahmed +Date: Tue, 24 Feb 2026 22:50:17 +0000 +Subject: KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode + +From: Yosry Ahmed + +commit 24f7d36b824b65cf1a2db3db478059187b2a37b0 upstream. + +On nested VMRUN, KVM ensures AVIC is inhibited by requesting +KVM_REQ_APICV_UPDATE, triggering a check of inhibit reasons, finding +APICV_INHIBIT_REASON_NESTED, and disabling AVIC. + +However, when KVM_SET_NESTED_STATE is performed on a vCPU not in guest +mode with AVIC enabled, KVM_REQ_APICV_UPDATE is not requested, and AVIC +is not inhibited. + +Request KVM_REQ_APICV_UPDATE in the KVM_SET_NESTED_STATE path if AVIC is +active, similar to the nested VMRUN path. + +Fixes: f44509f849fe ("KVM: x86: SVM: allow AVIC to co-exist with a nested guest running") +Cc: stable@vger.kernel.org +Signed-off-by: Yosry Ahmed +Link: https://patch.msgid.link/20260224225017.3303870-1-yosry@kernel.org +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/svm/nested.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/kvm/svm/nested.c ++++ b/arch/x86/kvm/svm/nested.c +@@ -1258,6 +1258,9 @@ static int svm_set_nested_state(struct k + load_nested_vmcb_control(svm, ctl); + nested_prepare_vmcb_control(svm); + ++ if (kvm_vcpu_apicv_active(vcpu)) ++ kvm_make_request(KVM_REQ_APICV_UPDATE, vcpu); ++ + kvm_make_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu); + ret = 0; + out_free: diff --git a/queue-5.10/kvm-nsvm-mark-all-of-vmcb02-dirty-when-restoring-nested-state.patch b/queue-5.10/kvm-nsvm-mark-all-of-vmcb02-dirty-when-restoring-nested-state.patch new file mode 100644 index 0000000000..ff62d0472e --- /dev/null +++ b/queue-5.10/kvm-nsvm-mark-all-of-vmcb02-dirty-when-restoring-nested-state.patch @@ -0,0 +1,42 @@ +From e63fb1379f4b9300a44739964e69549bebbcdca4 Mon Sep 17 00:00:00 2001 +From: Yosry Ahmed +Date: Tue, 10 Feb 2026 01:08:06 +0000 +Subject: KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state + +From: Yosry Ahmed + +commit e63fb1379f4b9300a44739964e69549bebbcdca4 upstream. + +When restoring a vCPU in guest mode, any state restored before +KVM_SET_NESTED_STATE (e.g. KVM_SET_SREGS) will mark the corresponding +dirty bits in vmcb01, as it is the active VMCB before switching to +vmcb02 in svm_set_nested_state(). + +Hence, mark all fields in vmcb02 dirty in svm_set_nested_state() to +capture any previously restored fields. + +Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") +CC: stable@vger.kernel.org +Signed-off-by: Yosry Ahmed +Link: https://patch.msgid.link/20260210010806.3204289-1-yosry.ahmed@linux.dev +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/svm/nested.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/arch/x86/kvm/svm/nested.c ++++ b/arch/x86/kvm/svm/nested.c +@@ -1236,6 +1236,12 @@ static int svm_set_nested_state(struct k + goto out_free; + + /* ++ * Any previously restored state (e.g. KVM_SET_SREGS) would mark fields ++ * dirty in vmcb01 instead of vmcb02, so mark all of vmcb02 dirty here. ++ */ ++ vmcb_mark_all_dirty(svm->vmcb); ++ ++ /* + * All checks done, we can enter guest mode. L1 control fields + * come from the nested save state. Guest state is already + * in the registers, the save area of the nested state instead diff --git a/queue-5.10/kvm-nsvm-sync-interrupt-shadow-to-cached-vmcb12-after-vmrun-of-l2.patch b/queue-5.10/kvm-nsvm-sync-interrupt-shadow-to-cached-vmcb12-after-vmrun-of-l2.patch new file mode 100644 index 0000000000..a34c5fe537 --- /dev/null +++ b/queue-5.10/kvm-nsvm-sync-interrupt-shadow-to-cached-vmcb12-after-vmrun-of-l2.patch @@ -0,0 +1,52 @@ +From 03bee264f8ebfd39e0254c98e112d033a7aa9055 Mon Sep 17 00:00:00 2001 +From: Yosry Ahmed +Date: Wed, 25 Feb 2026 00:59:44 +0000 +Subject: KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 + +From: Yosry Ahmed + +commit 03bee264f8ebfd39e0254c98e112d033a7aa9055 upstream. + +After VMRUN in guest mode, nested_sync_control_from_vmcb02() syncs +fields written by the CPU from vmcb02 to the cached vmcb12. This is +because the cached vmcb12 is used as the authoritative copy of some of +the controls, and is the payload when saving/restoring nested state. + +int_state is also written by the CPU, specifically bit 0 (i.e. +SVM_INTERRUPT_SHADOW_MASK) for nested VMs, but it is not sync'd to +cached vmcb12. This does not cause a problem if KVM_SET_NESTED_STATE +preceeds KVM_SET_VCPU_EVENTS in the restore path, as an interrupt shadow +would be correctly restored to vmcb02 (KVM_SET_VCPU_EVENTS overwrites +what KVM_SET_NESTED_STATE restored in int_state). + +However, if KVM_SET_VCPU_EVENTS preceeds KVM_SET_NESTED_STATE, an +interrupt shadow would be restored into vmcb01 instead of vmcb02. This +would mostly be benign for L1 (delays an interrupt), but not for L2. For +L2, the vCPU could hang (e.g. if a wakeup interrupt is delivered before +a HLT that should have been in an interrupt shadow). + +Sync int_state to the cached vmcb12 in nested_sync_control_from_vmcb02() +to avoid this problem. With that, KVM_SET_NESTED_STATE restores the +correct interrupt shadow state, and if KVM_SET_VCPU_EVENTS follows it +would overwrite it with the same value. + +Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") +CC: stable@vger.kernel.org +Signed-off-by: Yosry Ahmed +Link: https://patch.msgid.link/20260225005950.3739782-3-yosry@kernel.org +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/svm/nested.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/kvm/svm/nested.c ++++ b/arch/x86/kvm/svm/nested.c +@@ -308,6 +308,7 @@ void sync_nested_vmcb_control(struct vcp + u32 mask; + svm->nested.ctl.event_inj = svm->vmcb->control.event_inj; + svm->nested.ctl.event_inj_err = svm->vmcb->control.event_inj_err; ++ svm->nested.ctl.int_state = svm->vmcb->control.int_state; + + /* Only a few fields of int_ctl are written by the processor. */ + mask = V_IRQ_MASK | V_TPR_MASK; diff --git a/queue-5.10/kvm-nsvm-sync-nextrip-to-cached-vmcb12-after-vmrun-of-l2.patch b/queue-5.10/kvm-nsvm-sync-nextrip-to-cached-vmcb12-after-vmrun-of-l2.patch new file mode 100644 index 0000000000..4b3f0667fc --- /dev/null +++ b/queue-5.10/kvm-nsvm-sync-nextrip-to-cached-vmcb12-after-vmrun-of-l2.patch @@ -0,0 +1,55 @@ +From 778d8c1b2a6ffe622ddcd3bb35b620e6e41f4da0 Mon Sep 17 00:00:00 2001 +From: Yosry Ahmed +Date: Wed, 25 Feb 2026 00:59:43 +0000 +Subject: KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 + +From: Yosry Ahmed + +commit 778d8c1b2a6ffe622ddcd3bb35b620e6e41f4da0 upstream. + +After VMRUN in guest mode, nested_sync_control_from_vmcb02() syncs +fields written by the CPU from vmcb02 to the cached vmcb12. This is +because the cached vmcb12 is used as the authoritative copy of some of +the controls, and is the payload when saving/restoring nested state. + +NextRIP is also written by the CPU (in some cases) after VMRUN, but is +not sync'd to the cached vmcb12. As a result, it is corrupted after +save/restore (replaced by the original value written by L1 on nested +VMRUN). This could cause problems for both KVM (e.g. when injecting a +soft IRQ) or L1 (e.g. when using NextRIP to advance RIP after emulating +an instruction). + +Fix this by sync'ing NextRIP to the cache after VMRUN of L2, but only +after completing interrupts (not in nested_sync_control_from_vmcb02()), +as KVM may update NextRIP (e.g. when re-injecting a soft IRQ). + +Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") +CC: stable@vger.kernel.org +Co-developed-by: Sean Christopherson +Signed-off-by: Yosry Ahmed +Link: https://patch.msgid.link/20260225005950.3739782-2-yosry@kernel.org +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/svm/svm.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/arch/x86/kvm/svm/svm.c ++++ b/arch/x86/kvm/svm/svm.c +@@ -3677,6 +3677,16 @@ static __no_kcsan fastpath_t svm_vcpu_ru + if (is_guest_mode(vcpu)) + return EXIT_FASTPATH_NONE; + ++ /* ++ * Update the cache after completing interrupts to get an accurate ++ * NextRIP, e.g. when re-injecting a soft interrupt. ++ * ++ * FIXME: Rework svm_get_nested_state() to not pull data from the ++ * cache (except for maybe int_ctl). ++ */ ++ if (is_guest_mode(vcpu)) ++ svm->nested.ctl.next_rip = svm->vmcb->control.next_rip; ++ + return svm_exit_handlers_fastpath(vcpu); + } + diff --git a/queue-5.10/series b/queue-5.10/series index 8fd932b794..0742622d01 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -174,3 +174,9 @@ rdma-rxe-validate-pad-and-icrc-before-payload_size-in-rxe_rcv.patch tpm-avoid-wunused-but-set-variable.patch mmc-block-use-single-block-write-in-retry.patch tpm-tpm_tis-add-error-logging-for-data-transfer.patch +userfaultfd-allow-registration-of-ranges-below-mmap_min_addr.patch +kvm-nsvm-mark-all-of-vmcb02-dirty-when-restoring-nested-state.patch +kvm-nsvm-sync-nextrip-to-cached-vmcb12-after-vmrun-of-l2.patch +kvm-nsvm-sync-interrupt-shadow-to-cached-vmcb12-after-vmrun-of-l2.patch +kvm-nsvm-ensure-avic-is-inhibited-when-restoring-a-vcpu-to-guest-mode.patch +kvm-nsvm-clear-gif-on-nested-vmexit-invalid.patch diff --git a/queue-5.10/userfaultfd-allow-registration-of-ranges-below-mmap_min_addr.patch b/queue-5.10/userfaultfd-allow-registration-of-ranges-below-mmap_min_addr.patch new file mode 100644 index 0000000000..9307817967 --- /dev/null +++ b/queue-5.10/userfaultfd-allow-registration-of-ranges-below-mmap_min_addr.patch @@ -0,0 +1,60 @@ +From 161ce69c2c89781784b945d8e281ff2da9dede9c Mon Sep 17 00:00:00 2001 +From: "Denis M. Karpov" +Date: Thu, 9 Apr 2026 13:33:45 +0300 +Subject: userfaultfd: allow registration of ranges below mmap_min_addr + +From: Denis M. Karpov + +commit 161ce69c2c89781784b945d8e281ff2da9dede9c upstream. + +The current implementation of validate_range() in fs/userfaultfd.c +performs a hard check against mmap_min_addr. This is redundant because +UFFDIO_REGISTER operates on memory ranges that must already be backed by a +VMA. + +Enforcing mmap_min_addr or capability checks again in userfaultfd is +unnecessary and prevents applications like binary compilers from using +UFFD for valid memory regions mapped by application. + +Remove the redundant check for mmap_min_addr. + +We started using UFFD instead of the classic mprotect approach in the +binary translator to track application writes. During development, we +encountered this bug. The translator cannot control where the translated +application chooses to map its memory and if the app requires a +low-address area, UFFD fails, whereas mprotect would work just fine. I +believe this is a genuine logic bug rather than an improvement, and I +would appreciate including the fix in stable. + +Link: https://lore.kernel.org/20260409103345.15044-1-komlomal@gmail.com +Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization") +Signed-off-by: Denis M. Karpov +Reviewed-by: Lorenzo Stoakes +Acked-by: Harry Yoo (Oracle) +Reviewed-by: Pedro Falcato +Reviewed-by: Liam R. Howlett +Reviewed-by: Mike Rapoport (Microsoft) +Cc: Alexander Viro +Cc: Al Viro +Cc: Christian Brauner +Cc: Jan Kara +Cc: Jann Horn +Cc: Peter Xu +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/userfaultfd.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/fs/userfaultfd.c ++++ b/fs/userfaultfd.c +@@ -1233,8 +1233,6 @@ static __always_inline int validate_rang + return -EINVAL; + if (!len) + return -EINVAL; +- if (start < mmap_min_addr) +- return -EINVAL; + if (start >= task_size) + return -EINVAL; + if (len > task_size - start) -- 2.47.3