FAILED: patch "[PATCH] KVM: nVMX: Don't use vmcs01.GUEST_CR3 to snapshot L1's CR3" failed to apply to 6.1-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 3e6dd2b9b7b2884743ed7a0873b8743cc0df6d40
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026072016-bobbed-attribute-f507@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 3e6dd2b9b7b2884743ed7a0873b8743cc0df6d40 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <[email protected]>
Date: Fri, 12 Jun 2026 07:56:42 -0700
Subject: [PATCH] KVM: nVMX: Don't use vmcs01.GUEST_CR3 to snapshot L1's CR3
when EPT is disabled
Add a dedicated field in "struct nested_vmx" to track L1's pre-VM-Enter CR3 instead of using vmcs01.GUEST_CR3, which isn't anywhere near as safe as the comment purports it to be. E.g. in addition to the warn_on_missed_cc bug (that was fixed by relocating the consistency check), if getting vmcs12 pages (during actual nested VM-Entry) fails and EPT is disabled (in KVM), KVM will return control to userspace with vmcs01.GUEST_CR3 holding a guest- controlled value.
Alternatively, KVM could force a reload of vmcs01.GUEST_CR3 by resetting the MMU context in the error path, but as above, the safety of the vmcs01 approach is extremely questionable, e.g. it took all of ~4 months for the code to break.
arch/x86/kvm/vmx/nested.c +8 -13
@@ -3658,19 +3658,14 @@ enum nvmx_vmentry_status nested_vmx_enter_non_root_mode(struct kvm_vcpu *vcpu, &vmx->nested.pre_vmenter_ssp_tbl);/* -* Overwrite vmcs01.GUEST_CR3 with L1's CR3 if EPT is disabled. In the -* event of a "late" VM-Fail, i.e. a VM-Fail detected by hardware but -* not KVM, KVM must unwind its software model to the pre-VM-Entry host -* state. When EPT is disabled, GUEST_CR3 holds KVM's shadow CR3, not -* L1's "real" CR3, which causes nested_vmx_restore_host_state() to -* corrupt vcpu->arch.cr3. Stuffing vmcs01.GUEST_CR3 results in the -* unwind naturally setting arch.cr3 to the correct value. Smashing -* vmcs01.GUEST_CR3 is safe because nested VM-Exits, and the unwind, -* reset KVM's MMU, i.e. vmcs01.GUEST_CR3 is guaranteed to be -* overwritten with a shadow CR3 prior to re-entering L1. +* Stash L1's CR3, so that in the event of a "late" VM-Fail, i.e. a +* VM-Fail detected by hardware but not KVM, KVM can unwind its +* software model to the pre-VM-Entry host state. When EPT is +* disabled, GUEST_CR3 holds KVM's shadow CR3, not L1's "real" CR3, +* and so simply restoring from vmcs01.GUEST_CR3 would corrupt +* vcpu->arch.cr3. */ -if (!enable_ept) -vmcs_writel (GUEST_CR3 , vcpu->arch.cr3); + vmx->nested.pre_vmenter_cr3 =kvm_read_cr3 (vcpu);vmx_switch_vmcs (vcpu, &vmx->nested.vmcs02);
@@ -4982,7 +4977,7 @@ static void nested_vmx_restore_host_state(struct kvm_vcpu *vcpu)vmx_set_cr4 (vcpu,vmcs_readl (CR4_READ_SHADOW ));nested_ept_uninit_mmu_context (vcpu); - vcpu->arch.cr3 =vmcs_readl (GUEST_CR3 ); + vcpu->arch.cr3 = vmx->nested.pre_vmenter_cr3;kvm_register_mark_available (vcpu,VCPU_REG_CR3 );/*
arch/x86/kvm/vmx/vmx.h +7 -0
@@ -159,6 +159,13 @@ struct nested_vmx {bool has_preemption_timer_deadline;bool preemption_timer_expired; +/* +* Used to restore L1's CR3 if hardware detects a VM-Fail Consistency +* Check that KVM does not, in which case KVM needs to unwind CR3 back +* to its pre-VM-Enter state, NOT to vmcs01.HOST_CR3. +*/ +unsigned long pre_vmenter_cr3; +/* * Used to snapshot MSRs that are conditionally loaded on VM-Enter in * order to propagate the guest's pre-VM-Enter value into vmcs02. For