summaryrefslogtreecommitdiff
path: root/Documentation/virt
AgeCommit message (Collapse)Author
3 daysMerge tag 'hyperv-next-signed-20261028' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv updates from Wei Liu: - Update to documents and code comments (Michael Kelley) - Harden Vmbus (Kameron Carr) - Rework MSHV driver page deposit logic (Mukesh Rathor) - Vmbus kexec bug fix (Shradha Gupta) - Miscellaneous bug fixes (Daehyeon Ko, Jiale Yao, Sasha Levin) * tag 'hyperv-next-signed-20261028' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: Drivers: hv: Remove leftover support for old Hyper-V versions mshv: Remove unused *_old memory deposit functions mshv: Redesign hypervisor memory deposit logic mshv: Rename memory deposit memory functions to _old mshv_vtl: reject poll files with multiple waitqueues mshv_vtl: detach poll waiter on POLLFREE mshv_vtl: initialize poll file mutex before device registration Documentation: hyperv: Update information on guest CPU offlining Documentation: hyperv: Remove support for guests on Hyper-V 2012/2012R2 Drivers: hv: Run VMBus kexec cleanup from syscore shutdown kexec: Add helper to report an active kexec reboot tools: hv: remove unused rte_smp_mb() Documentation: hyperv: Update documentation for sending VMBus packets Drivers: hv: vmbus: Check ACPI companion before use Documentation: hyperv: Describe validation of the ring buffer indices Drivers: hv: vmbus: Keep the ring byte counts sane for a bad index Drivers: hv: vmbus: Compute ring byte counts from a caller-held snapshot Drivers: hv: vmbus: Use *_ONCE() to access shared ring buffer indices Drivers: hv: vmbus: Bounds check the shared ring buffer indices
9 daysMerge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
Pull KVM updates from Paolo Bonzini: "ARM: - pKVM state isolation: years after pKVM started being enabled upstream, we finally get the basics in the form of state isolation. The vcpu state is now off-limit for the host for protected VMs - pKVM also grows a hypervisor-private memory allocator, allowing it to deal with sub-page allocation, much like everywhere else - pKVM also lands a trace_printk() equivalent, which hopefully will make debugging a bit easier - First shot at annotating portions of the KVM/arm64 code to be extracted and built on s390. The real fun is yet to come - Allow pre-faulting of stage-2 canonical mappings from userspace, joining x86 and s390 in implementing this feature - Add a reverse mapping infrastructure for shadow stage-2, significantly improving performance when MMU notifiers kick in, and avoiding full unmap of all shadow tables for this VM - Next step of GICv5 enablement, adding support for the IRS block, and providing both SPI and LPI support. This is the first point where KVM/arm64 can support an SMP GICv5 guest - As a preliminary to eventually enabling CCA, add a bunch of infrastructure to KVM/arm64, splitting some of the basic operations into individual backends (normal VM, normal pKVM VM, protected pKVM VM). This allows CCA to later slot in without polluting the rest of KVM with its firmware-driven nonsense - Make ID registers immutable from the point where a vcpu is able to run, even if it fails to run. This prevents KVM from sampling untrusted values - Restore some type checking to the EL2 object. KVM/arm64 originally had some strong type checking between the kernel and the EL2 object, but lost it along the way when the private hypercall interface was (somewhat pointlessly) converted to SMCCC. Type checking is back, syscall style, and with added sparse goodies - Expand the FFA support to FFA_NOTIFICATION_*, and add some sanitisation of the protocol that pKVM relays to the "trusted" runtime - Make GICv3 RD assignment more robust to userspace nonsense - Convert the remaining MMU fault handler backends to kvm_s2_fault_vma_info and co., fixing a number of bugs in the process - Fix the SError/SEA selftests to be both more robust and less braindead - Fix a smattering of documentation bugs, some of them as a result of our AI friends spitting out credible assertions based on non-existing symbols - The usual collection of low impact bug fixes (SMCCC, timers, PMU) Loongarch: - Add separate vmid support - Simplify MSI interrupt injection - Add crash hypercall support - Allow to set pv_feature until vCPU run - Enable HW page table walk automatically in selftests s390: - rework page allocation for secure guest variable storage - Selftests and documentation improvements - Replace get_zeroed_page with kzalloc - Fix corner cases of floating interrupt injection - Initial arm64 on s390 support x86: - Clean up the handling of vcpu->arch.xen.long_mode to be consistent and correctly handle 32-bit/64-bit alignment, and various other bug fixes have accumulated over the months since v1 - Grab KVM's SRCU "lock" in kvm_zap_gfn_range() to fix a recurring bug where callers fail to do so - Fix a variety of issues in the pre-fault code that are mostly benign in the current code base, but will show up in big ways if/when the pre-faulting logic is used to implementing prefetch-on-fault for the TDP MMU - For PREEMPT_RT=y kernels, drop the rmaps' individual bit-spinlock and just walk the rmaps' with mmu_lock taken. On the write side (which always uses mmu_lock), the bit-spinlock was assuming that preemption was disabled, but that is *not* true when rwlocks become sleepable - Prepare a memory_fault exit (paired with -EFAULT) when KVM hits an error PFN, e.g. so that userspace can resolve transient issues instead of killing the guest. Convert a variety of WARN()+EFAULT paths into KVM_BUG_ON()+EIO so that KVM can hard commit to filling memory_fault on -EFAULTs that occur in the page fault path - Fix a NX hugepage un-accounting bug where KVM would always uncharge the shadow MMU, even when handling TDP MMU pages - Mask off the address space ID when checking for illegal usage of kvm_set_internal_memslot() to prevent false negatives on the sanity check - Explicitly zero reserved flags when delivering a SynIC message to avoid leaking a byte of stack information to the guest - Rework TDX's handling of the canonical MMU root level to not rely on userspace to fill CPUID correctly, as doing so lets userspace trivially trigger a KVM_BUG_ON() - Reject KVM_SET_NESTED_STATE if userspace "restores" L1 with EFER.LMA=1 && EFER.LME=0, which confuses KVM into trying to configure an 64-bit MMU without PAE - Ignore EFER.LMA (clear it from KVM's cached save state) if EFER.LME=0 when preparing L2 state, to fix another way to confuse KVM's MMU (and because real hardware also ignores EFER.LMA) - Improve KVM's sanity checks for a misconfigured MMU to (hopefully) detect all of the ways KVM can botch EFER.LMA vs. CR4.PAE - Remove the "full" out-param from kvm_x86_ops.flush_tlb_gva() as the param is only used to avoid what effectively amounts to a single memory write - Fix a mostly-benign bug where KVM can write through a guest's read-only mapping due to not checking the error code when expediting emulated MMIO page faults - Honor the guest's view of the "EFER.LMSLE must be zero" defeature so that userspace can provide migration compatibility between Rome and Milan+ - Pend a KVM_REQ_EVENT request when an exception is morphed into a nested VM-Exit, otherwise KVM can fail to actually deliver the nested VM-Exit, e.g. when injecting a page fault - Add support for PML on SVM - Add support for virtualizing Bus Lock Detect on SVM, and fix a number of DR6 bugs and warts along the way - Fix a variety of warts in KVM's handling of guest TSC, kvmclock, and timekeeping in general, as a (big) first step towards addressing several longstanding problems with the kvmclock implementation. Most notably, fix a precision issue where get_kvmclock_ns() computed the clock from the *host* TSC without applying guest TSC scaling, causing systemic drift from the values the guest computes from its own TSC - Rip out KVM's shadow timekeeping structures, now that ktime snapshots are powerful enough to replace it - Misc fixes and cleanups x86 (AMD): - Fix a benign-in-practice bug where KVM unintentionally sets a non-zero error code when delivering exceptions to SEV-ES+ guests - Force a new ASID in both VMCBs on pCPU migration to fix a bug where KVM can run a VMCB with a stale ASID due to the tracking being per-CPU, not per-VMCB - Return INVALID_INPUT to the guest instead of exiting to userspace with -EIO if KVM can't access "guest request" buffer, i.e. try to keep the guest alive if the guest or userspace goofs x86 (Intel): - Enable Notify VM-Exits (now called Instruction Timeout in the SDM) and Bus Lock VM-Exits for TDX guests when they're enabled by userspace (KVM forgot to wire up the TDX Module knobs) - Move all common (between VMX and TDX) APIs/helpers to common.h/main.c, and change all namespace prefixes from "vmx" to "vt" - Fix a thankfully benign bug (due to other areas of KVM being hardened) where userspace can bypass INIT_MEM_REGION's address wrap check by providing a nr_pages that will overflow a u64 when converted to bytes, and fix an also- benign off-by-one bug in the check (inclusive vs. exclusive) - Set the vmcs.GUEST_ACTIVITY_STATE back to ACTIVE when userspace sets KVM's mp_state to anything other than HALTED, e.g. so that a vCPU doesn't get stuck in HLT if userspace emulates RESET guest_memfd: - Take the invalidate lock when unbinding a dying file to fix a race with kvm_gmem_invalidate_end() that results in KVM leaving the MMU invalidation count elevated. Not taking the lock in the first place was pure misguided paranoid - When binding a memslot, purge the bindings if storing the new memslot fails, as Xarray's "store range" API can subtly fail partway through - Establish memslot<=>guest_memfd bindings *after* the memslot is ready, as the memslot becomes reachable the instant the binding is installed - Don't grab a page refcount when reloading an SNP VMSA and stop returning a "struct page" from guest_memfd's PFN lookup altogether, to ensure that KVM doesn't hold any unnecessary refcounts (the lifetime of the page is ensured by MMU notifiers and similar hooks). Preventing unnecessary refcounts greatly simplifies supporting in-place SHARED=>PRIVATE conversions - Add support for in-place PRIVATE<=>SHARED conversion, i.e. allow a single guest_memfd instance to be used for both PRIVATE and SHARED variations of CoCo guests' memory (though not at the same time). This eliminates the need to double allocate guest memory for TDX and SNP, and is basically a hard requirement for pKVM, which relies on being able to preserve memory contents on conversions - Hack-a-fix a deadlock bug in ->error_remove_folio() by returning -EBUSY if the filemap invalidate lock is contended. Punt on a proper fix for the moment, as a proper fix likely involves reworking truncate_error_folio() - Add a pile of selftests for in-place conversions - Misc guest_memfd cleanups Generic: - Move some configuration items to preprocessor symbols, to help with arm-on-s390's need to compile the same code twice with different values - Allow KVM implementations to choose alternative device names, also for s390's support of ARM virtualmachines - Switch the KVM-VFIO interface and external consumers over to standard file-based reference counting, eliminating all external KVM symbol exports Selftests: - Rework KVM selftest's handling of memory regions all so that PPC can force its page table allocations to be naturally aligned - PPC support - Fix emulation of VMPTRST and VMPTRLD when eVMCS is in-use to match real Hyper-V's behavior - Saturate L2's TSC frequency if stacking L1 and L2 scaling multipliers exceeds what hardware supports, as attempting to run L2 with an illegal multiplier will either cause VM-Entry to fail (VMX) or trigger a #GP when writing MSR_AMD64_TSC_RATIO (SVM). The #GP is thankfully benign in the grand scheme as even "unsafe" WRMSRs have exception fixup - Rework KVM selftest's handling of memory regions so that PPC can force its page table allocations to be naturally aligned - Clean up selftest's VMX instruction helpers, and drop an absurd number of completely useless return values, e.g. functions that unconditionally return %true and then have every caller assert success - Add selftests support for Zhaoxin CPUs - Overhaul the TSC scaling test to add a regression test for the saturation behavior, and to increase its coverage in general - Fix selftests usage various NUMA syscalls to account for an undocumented, but known since 2007, off-by-one kernel bug. Add helpers to try and avoid re-introducing the same flaws in the future - Automatically run xAPIC IPI migration test (between NUMA nodes) when possible, as the entire point of the test is verify KVM's handling of page migration of the APIC backing page - Misc cleanups" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (506 commits) KVM: always make in-place conversion a compile-time constant when possible KVM: x86: leave the legacy private attribute in for TDX and SEV KVM: split CONFIG_KVM_PRIVATE_MEMATTR_VM out of KVM_VM_MEMORY_ATTRIBUTES selftests: kvm: remove useless comma operator arm64: Use proper include variant MAINTAINERS: Add entry for ARM on s390 KVM KVM: s390: arm64: Integrate arm on s390 KVM: s390: arm64: Implement basic page fault handler KVM: s390: arm64: Implement vCPU IOCTLs KVM: s390: arm64: Implement vm/vcpu create destroy KVM: s390: arm64: Implement required functions KVM: s390: Add basic arm64 kvm module s390/hwcaps: Report SAE support as hwcap KVM: s390: arm64: Introduce host definitions s390: Introduce Start Arm Execution instruction KVM: s390: Use arm64 code s390/tools: Use arm64 headers KVM: s390: Use dedicated function for migration mode s390/Kconfig: remove PCI dependency from HAS_IOMEM KVM: s390: Kick PV cpus at the right time for service irqs ...
10 daysMerge tag 'uml-for-7.4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull UML updates from Johannes Berg: - NOMMU support, mostly for mm/ testing The only bigger change, we added support for building with !CONFIG_MMU, mostly for testing, e.g. via kunit. Some new selftests targetted to NOMMU are moving elsewhere, but are runnable on ARCH=um without MMU. - Tighter page permissions Tighten page permissions to catch more bugs (ARCH=um is, after all, often used for testing), and also mark __init memory inaccessible for the same reason. - Various maintenance/cleanups Fix build on really old hosts, fix leaks, make the code a bit more robust, header cleanups, typo fixes, the usual. * tag 'uml-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: (38 commits) um: place large BSS inputs in an output section um: fix shutdown __inittext access um: time-travel: fix sched_yield() behaviour um: require MMU for UML PCI support um: vector: avoid NULL queue dereference in legacy RX mode um: use %pB to print functions in stack traces um: mprotect() __init memory um: move init text between __init_begin/end um: improve checking for --no-warn-rwx-segments um: make stub compilation more robust um: link .lbss/.ldata/.lrodata correctly um: add perf-event support x86/um: remove unused <asm/required-features.h> header um: fix typo "hander" in comment um: Add definition of __NR_close_range for older host OSs um: virtio_uml: switch to dynamic root device um: Tighten exec permissions on page mappings Documentation: um: document nommu UML um: allow deselecting CONFIG_MMU um: nommu: add userspace runner processes ...
12 daysDocumentation: hyperv: Update information on guest CPU offliningMichael Kelley
In Hyper-V Overview documentation, remove the out-of-date reference to explicitly reassigning VMBus channel interrupts before taking a guest CPU offline. Instead, reference the VMBus documentation, which is already up-to-date on this topic. Signed-off-by: Michael Kelley <mhklinux@outlook.com> Reviewed-by: Naman Jain <namjain@linux.microsoft.com> Reviewed-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
12 daysDocumentation: hyperv: Remove support for guests on Hyper-V 2012/2012R2Michael Kelley
Support for running Linux guests on Windows Server 2012/2012 R2 Hyper-V hosts and Windows 8/8.1 hosts has been removed, which includes removing support for operating Hyper-V synthetic timers in other than Direct Mode. Update the documentation to reflect these removals. Signed-off-by: Michael Kelley <mhklinux@outlook.com> Reviewed-by: Naman Jain <namjain@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
12 daysDrivers: hv: Run VMBus kexec cleanup from syscore shutdownShradha Gupta
ARM64 Hyper-V guests do not run the VMBus kexec cleanup before secondary CPUs are stopped. Consequently, the old VMBus connection and SynIC state remain active when the kexec kernel starts. Run the VMBus kexec handler from the existing VMBus syscore shutdown callback. syscore_shutdown() runs after device shutdown and before machine shutdown, while all CPUs needed by the SynIC CPU hotplug teardown are still available. Guard the callback with kexec_is_in_progress() so normal restart, halt, and poweroff paths are unchanged. Use the same path on x86 and remove the architecture-specific handler pointer and the weak setup/remove interfaces. VMBus teardown now precedes hv_stimer_global_cleanup() on x86. The new x86 ordering relies on commit be0cfab740e5 ("clocksource: hyper-v: Remove support for stimer interrupts in message mode"), which removed the synthetic timer's dependency on VMBus message delivery. Older kernels that retain message-mode stimer interrupts must preserve the existing x86 ordering and therefore require an ARM64-specific backport. Document the VMBus cleanup path and its position in shutdown ordering. Fixes: 9bbb888824e3 ("arm64: hyperv: Initialize hypervisor on boot") Link: https://lore.kernel.org/all/20260814093133.3191250-1-shradhagupta@linux.microsoft.com/ Suggested-by: Catalin Marinas <catalin.marinas@arm.com> Suggested-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Shradha Gupta <shradhagupta@linux.microsoft.com> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Reviewed-by: Bradley Morgan <brads@mainlining.org> Reviewed-by: Naman Jain <namjain@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
12 daysDocumentation: hyperv: Update documentation for sending VMBus packetsMichael Kelley
The functions for sending VMBus packets have changed. vmbus_sendpacket_mpb_desc() can target multiple ranges, and vmbus_sendpacket_pagebuffer() has been removed. vmbus_sendpacket_getid() has been added. Update the documentation accordingly. Fixes: 45a442fe369e ("Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer()") Cc: stable@vger.kernel.org Signed-off-by: Michael Kelley <mhklinux@outlook.com> Reviewed-by: Naman Jain <namjain@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
12 daysDocumentation: hyperv: Describe validation of the ring buffer indicesKameron Carr
Document that the guest must snapshot and validate the read and write indices before using them to index into the ring buffer or to compute the available space. Signed-off-by: Kameron Carr <kameroncarr@linux.microsoft.com> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
14 daysMerge tag 'kvm-s390-next-7.4-2' of ↵Paolo Bonzini
git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: Changes for 7.4 - rework page allocation for secure guest variable storage - selftests - documentation - replace get_zeroed_page with kzalloc - fix floating interrupt inject for corner cases - initial arm64 on s390 support This also contains the patch "arm64: Use proper include variant" as a build fix. It is also part of the arm tree.
2026-10-16Merge tag 'kvm-x86-misc-7.4' of https://github.com/kvm-x86/linux into HEADPaolo Bonzini
KVM x86 misc changes for 7.4 - Mask off the address space ID when checking for illegal usage of kvm_set_internal_memslot() to prevent false negatives on the sanity check. - Explicitly zero reserved flags when delivering a SynIC message to avoid leaking a byte of stack information to the guest. - Rework TDX's handling of the canonical MMU root level to not rely on userspace to fill CPUID correctly, as doing so lets userspace trivially trigger a KVM_BUG_ON(). - Reject KVM_SET_NESTED_STATE if userspace "restores" L1 with EFER.LMA=1 && EFER.LME=0, which confuses KVM into trying to configure an 64-bit MMU without PAE. - Ignore EFER.LMA (clear it from KVM's cached save state) if EFER.LME=0 when preparing L2 state, to fix another way to confuse KVM's MMU (and because real hardware also ignores EFER.LMA). - Improve KVM's sanity checks for a misconfigured MMU to (hopefully) detect all of the ways KVM can botch EFER.LMA vs. CR4.PAE. - Remove the "full" out-param from kvm_x86_ops.flush_tlb_gva() as the param is only used to avoid what effectively amounts to a single memory write. - Fix a mostly-benign bug where KVM can write through a guest's read-only mapping due to not checking the error code when expediting emulated MMIO page faults. - Honor the guest's view of the "EFER.LMSLE must be zero" defeature so that userspace can provide migration compatibility between Rome and Milan+. - Pend a KVM_REQ_EVENT request when an exception is morphed into a nested VM-Exit, otherwise KVM can fail to actually deliver the nested VM-Exit, e.g. when injecting a page fault. - Add support for PML on SVM. - Add support for virtualizing Bus Lock Detect on SVM, and fix a number of DR6 bugs and warts along the way. - Misc fixes and cleanups.
2026-10-16Merge tag 'kvm-x86-coco-7.4' of https://github.com/kvm-x86/linux into HEADPaolo Bonzini
KVM guest_memfd and CoCo changes for 7.4 - Take the invalidate lock when unbinding a dying file to fix a race with kvm_gmem_invalidate_end() that results in KVM leaving the MMU invalidation count elevated. Not taking the lock in the first place was pure misguided paranoid. - When binding a memslot, purge the bindings if storing the new memslot fails, as Xarray's "store range" API can subtly fail partway through. - Establish memslot<=>guest_memfd bindings *after* the memslot is ready, as the memslot becomes reachable the instant the binding is installed. - Don't grab a page refcount when reloading an SNP VMSA and stop returning a "struct page" from guest_memfd's PFN lookup altogether, to ensure that KVM doesn't hold any unnecessary refcounts (the lifetime of the page is ensured by MMU notifiers and similar hooks). Preventing unnecessary refcounts greatly simplifies supporting in-place SHARED=>PRIVATE conversions. - Add support for in-place PRIVATE<=>SHARED conversion, i.e. allow a single guest_memfd instance to be used for both PRIVATE and SHARED variations of CoCo guests' memory (though not at the same time). This eliminates the need to double allocate guest memory for TDX and SNP, and is basically a hard requirement for pKVM, which relies on being able to preserve memory contents on conversions. - Hack-a-fix a deadlock bug in ->error_remove_folio() by returning -EBUSY if the filemap invalidate lock is contended. Punt on a proper fix for the moment, as a proper fix likely involves reworking truncate_error_folio(). - Add a pile of selftests for in-place conversions. - Misc guest_memfd cleanups Conflicts in arch/arm64/kvm/mmu.c: convert to use s2vi.
2026-10-15Documentation: Add missing KVM s390 crypto attributesEric Farman
Device attributes to enable/disable the AP interpretive execution support for crypto were added to KVM several years ago, but they weren't added to the documentation itself. Fixes: 37940fb0b6a2 ("KVM: s390: device attrs to enable/disable AP interpretation") Signed-off-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Anthony Krowiak <akrowiak@linux.ibm.com> Signed-off-by: Janosch Frank <frankja@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-10-11Merge branch kvm-arm64/pkvm-state-7.4 into kvmarm-master/nextMarc Zyngier
* kvm-arm64/pkvm-state-7.4: : \ : State protection for protected pKVM guests, finally starting to deliver : on its promises... Patches courtesy of Fuad Tabba. : : "Following the vCPU state-sync series, this series completes the : job for protected VMs: a protected guest's register state stays at : EL2, and the host sees only what handling each exit requires." : / KVM: arm64: Only emulate an SError's entry for vCPUs with NV KVM: arm64: Document the protected VM userspace API KVM: arm64: Advertise the capabilities that protected VMs support KVM: arm64: Reject host power-on of a vCPU that EL2 holds powered off KVM: arm64: Reject host access to protected VM private state KVM: arm64: Add per-EC entry/exit state marshalling for protected guests KVM: arm64: Inject an UNDEF at EL2 for unhandled protected guest exits KVM: arm64: Prevent host PC adjustments for protected vCPUs KVM: arm64: Restrict KVM_ARM_VCPU_INIT and PSCI version for protected VMs KVM: arm64: Handle PSCI calls for protected VMs at EL2 KVM: arm64: Implement HVC handling for protected guests at EL2 KVM: arm64: Add system register reset framework for protected VMs KVM: arm64: Add {flush,sync}_hyp_timer_state() primitives KVM: arm64: Skip fixed-feature state flush for protected vCPUs KVM: arm64: Introduce per-EC entry handlers for pKVM KVM: arm64: Disable steal time for protected VMs KVM: arm64: Pin the host vCPU before adjusting its PC under pKVM KVM: arm64: Validate the host vCPU's VM before reading it under pKVM KVM: arm64: Sync HCR_EL2.VSE back to the host vCPU under pKVM Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-10-11Merge branch kvm-arm64/pre-faulting into kvmarm-master/nextMarc Zyngier
* kvm-arm64/pre-faulting: : \ : Enable stage-2 pre-faulting in the canonical IPA space, implementing the : KVM_PRE_FAULT_MEMORY API. Patches courtesy of Lorenzo Stoakes, and based : on an initial work by Jack Thomson. : / KVM: selftests: Add nested pre-fault test for arm64 KVM: selftests: Add option for different backing in pre-fault tests KVM: selftests: Enable pre_fault_memory_test for arm64 Documentation: KVM: document arm64 KVM_PRE_FAULT_MEMORY KVM: arm64: Implement KVM_PRE_FAULT_MEMORY KVM: arm64: Pass walk flags to kvm_pgtable_get_leaf() KVM: arm64: Propagate EHWPOISON in kvm_s2_fault_pin_pfn() KVM: arm64: Size the stage-2 memcache from the fault MMU KVM: arm64: Propagate and use kvm_s2_fault_result on S2 fault KVM: arm64: Propagate and use mmu in s2fd when handling guest aborts KVM: arm64: Propagate and use esr in s2fd when handling guest aborts KVM: arm64: Use ESR helpers in guest abort handling arm64: Add ESR fault helpers KVM: Allow architectures to disallow pre-fault Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-10-11Merge branch kvm-arm64/gicv5-7.4 into kvmarm-master/nextMarc Zyngier
* kvm-arm64/gicv5-7.4: (52 commits) : \ : GICv5 IRS support, courtesy of Sascha Bischoff. From the cover letter: : : "This series builds on the initial vGICv5 support and adds support : for the GICv5 IRS, as described by the GICv5 (EAC0) specification. : With this, a GICv5 guest is no longer restricted to PPIs, and can make : use of SPIs and LPIs as well." : / KVM: arm64: vgic-v5: Correctly handle host ISTE __le32 conversion KVM: arm64: vgic-v5: Tidy-up programming of vpe descriptor address KVM: arm64: vgic-v5: Correctly reset h_lpi_ist to NULL KVM: arm64: vgic-v5: Drop __iomem attribute from {vmd,vpet}_base KVM: selftests: Add VGICv5 sparse vCPU IDs test KVM: selftests: Add VGICv5 IST save/restore coverage KVM: selftests: Add VGICv5 LPI delivery tests KVM: selftests: Add VGICv5 SPI injection tests KVM: selftests: Add VGICv5 CPU sysreg attribute tests KVM: selftests: Add VGICv5 USERSPACE_PPIS tests KVM: selftests: Add VGICv5 IST attribute tests KVM: selftests: Add VGICv5 IRS_REGS attribute tests KVM: selftests: Add VGICv5 NR_IRQS attribute tests KVM: selftests: Add VGICv5 IRS address attribute tests Documentation: KVM: Add the VGICv5 IRS save/restore sequences Documentation: KVM: Add docs for KVM_DEV_ARM_VGIC_GRP_IST Documentation: KVM: Add KVM_DEV_ARM_VGIC_GRP_IRS_REGS to VGICv5 docs Documentation: KVM: Document KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS for VGICv5 KVM: arm64: gic-v5: Implement save/restore mechanisms for ISTs KVM: arm64: gic-v5: Add VGICv5 IST save/restore UAPI ... Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-10-07KVM: arm64: Fix references to the non-existent VCPU_RUN ioctlFuad Tabba
There is no VCPU_RUN ioctl. The one that enters the guest is KVM_RUN, so refer to it by that name. Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20260915084441.3846947-3-fuad.tabba@linux.dev Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-10-02KVM: arm64: Document the protected VM userspace APIFuad Tabba
EL2 owns a protected vCPU's state once it has run, and the ioctls that would reach it fail rather than operate on the host copy, which holds the boot state the VMM wrote plus what the exit handlers copy out. Describe the resulting API in pkvm.rst, point api.rst at it from each ioctl that behaves differently, and say beside the PVTIME attribute in devices/vcpu.rst and the PSCI version register in fw-pseudo-registers.rst how protected VMs differ. The overview also states the GIC support pKVM enforces: GICv2 is not supported in protected mode (vgic-v2.c) and GICv5-based guests aren't registered under pKVM (vgic-v5.c). Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20261001135711.1640520-19-fuad.tabba@linux.dev Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-30KVM: x86: Honor the guest's EFER_LMSLE_MBZJim Mattson
Reject guest attempts to set EFER.LMSLE if userspace enumerates EFER_LMSLE_MBZ, CPUID.80000008H:EBX[bit 20], in guest CPUID, so that userspace can hide long mode segment limits from the guest even on CPUs that support LMSLE, e.g. for migration compatibility between Rome and Milan. Enumerate the defeature as *partially* emulated, i.e. as supported by KVM but never advertised, so that kvm_vcpu_after_set_cpuid() propagates userspace's bit into vcpu->arch.cpu_caps. Checking guest_cpu_cap_has() in __kvm_valid_efer() doesn't suffice on its own, because KVM clears the defeature in kvm_cpu_caps precisely on the CPUs where it needs to be emulated, i.e. cpu_caps would never hold the bit no matter what userspace puts in guest CPUID. Don't advertise the defeature in KVM_GET_SUPPORTED_CPUID, as that would take EFER.LMSLE away from userspace that blindly stuffs KVM's supported CPUID into KVM_SET_CPUID2. MONITOR/MWAIT gets the same treatment. Enforce the defeature only for guest-initiated writes, as it's a guest CPUID consistency check, not a host capability. See commit 11988499e62b ("KVM: x86: Skip EFER vs. guest CPUID checks for host-initiated writes"). Note, KVM_SET_SREGS does reject EFER.LMSLE, as it runs the full set of guest CPUID checks, as does nested VMRUN, i.e. L1 can't sneak EFER.LMSLE into L2 via vmcb12. Mask EFER_LMSLE out of the value consumed by efer_trap(), which handles SVM_EXIT_EFER_WRITE_TRAP. EFER writes are *trapped*, not intercepted, i.e. hardware has already committed the write by the time KVM gains control, and the trap is enabled if and only if the guest is SEV-ES, whose EFER lives in the encrypted VMSA and so can't be fixed up by KVM. Rejecting the write would inject a #GP *and* leave EFER.LMSLE set in the guest, which is strictly worse than honoring a write that hardware itself allowed. EFER_SVME is already masked out for a similar "KVM can't enforce this here" reason. Opportunistically fix the whitespace damage around __kvm_valid_efer(). Document the resulting two-level contract in api.rst, i.e. that userspace may set the defeature even when KVM doesn't enumerate it. Suggested-by: Sean Christopherson <seanjc@google.com> Assisted-by: LLM Signed-off-by: Jim Mattson <jmattson@google.com> Link: https://patch.msgid.link/20260930212114.3500045-3-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-30KVM: x86: Advertise EFER_LMSLE_MBZ when KVM disallows EFER.LMSLEJim Mattson
Set EFER_LMSLE_MBZ, CPUID.80000008H:EBX[bit 20], in KVM's supported CPUID whenever KVM refuses to set EFER.LMSLE, not just when hardware enumerates the defeature. KVM allows EFER.LMSLE if and only if nested SVM is supported, but passes through hardware's EFER_LMSLE_MBZ as-is, i.e. KVM tells userspace that long mode segment limits are available on an Intel CPU, and on an AMD CPU with kvm_amd.nested=0, and then rejects WRMSR(EFER) with EFER.LMSLE=1. The bit means precisely "EFER.LMSLE must be zero." Note, this is purely an enumeration change. EFER.LMSLE is already gated on nested SVM: kvm_setup_efer_caps() adds EFER_LMSLE to supported_efer_bits only if X86_FEATURE_SVM is supported, and svm_set_cpu_caps() sets X86_FEATURE_SVM if and only if "nested" is true. KVM's handling of EFER is unchanged; only what KVM tells userspace changes. Note #2, KVM now sets the defeature on Intel CPUs as well. That is no different than KVM setting NullSelectorClearsBase, another AMD-defined bit, on CPUs that don't have the errata. And LMSLE's dependency on nested SVM is a historical artifact of commit eec4b140c924 ("KVM: SVM: Allow EFER.LMSLE to be set with nested svm"), not an architectural requirement. Be aware that this changes KVM_GET_SUPPORTED_CPUID on all Intel hosts and on AMD hosts with kvm_amd.nested=0, i.e. userspace that reflects KVM's supported CPUID into the guest will start enumerating EFER_LMSLE_MBZ=1 to newly created guests. That's the correct enumeration, and it takes away only an EFER bit that KVM has never allowed to be set on such hosts, but it *is* guest visible. Deliberately omit a Fixes: tag: the misenumeration is benign in practice, as KVM's WRMSR(EFER) behavior is and always has been correct, and backporting a guest-visible CPUID change isn't worth the risk. Opportunistically key the EFER_LMSLE decision off kvm_cpu_cap_has() instead of boot_cpu_has(), as PASSTHROUGH_F() sets EFER_LMSLE_MBZ based on *raw* CPUID, i.e. "clearcpuid=13:20" would otherwise get KVM to enumerate the defeature and allow EFER.LMSLE=1, which is guaranteed to fail on VMRUN. Document KVM's enumeration of the defeature in api.rst. Assisted-by: LLM Signed-off-by: Jim Mattson <jmattson@google.com> Link: https://patch.msgid.link/20260930212114.3500045-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-28KVM: guest_memfd: Fix the in-place conversion documentationFuad Tabba
Commit dcde2f853ff46 ("KVM: guest_memfd: Ensure pages are not in use before conversion") added error_offset to struct kvm_memory_attributes2, written back on failure, and a -EAGAIN return. The KVM_SET_MEMORY_ATTRIBUTES2 section of api.rst still lists the old struct, marks it input-only and leaves EAGAIN out of the Errors table. It also refers to KVM_CAP_GUEST_MEMFD_MMAP, which had become KVM_CAP_GUEST_MEMFD_FLAGS before this ioctl was added. kvm.gmem_in_place_conversion's entry says in-place conversion is unconditionally enabled without CONFIG_KVM_VM_MEMORY_ATTRIBUTES, but a build without kvm_arch_has_private_mem has it disabled: arm64 always, and x86 without CONFIG_KVM_SW_PROTECTED_VM, CONFIG_KVM_INTEL_TDX or CONFIG_KVM_AMD_SEV. Bring both in line with the code: replace the stale capability with GUEST_MEMFD_FLAG_MMAP, and describe KVM_CAP_GUEST_MEMFD_MEMORY_ATTRIBUTES the way the KVM_CREATE_GUEST_MEMFD section describes KVM_CAP_GUEST_MEMFD_FLAGS. Fixes: 799c9fadc6399 ("KVM: guest_memfd: Add base support for KVM_SET_MEMORY_ATTRIBUTES2") Fixes: dcde2f853ff46 ("KVM: guest_memfd: Ensure pages are not in use before conversion") Fixes: 537ec2b15fdd7 ("KVM: Let userspace disable per-VM mem attributes, enable per-gmem attributes") Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20260928180250.3075584-1-fuad.tabba@linux.dev Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-28Documentation: KVM: x86: Use struct kvm_clock_pairing in hypercalls.rstKarl Mehltretter
struct kvm_clock_offset does not exist; the name is struct kvm_clock_pairing. Use struct kvm_clock_pairing. Fixes: 55dd00a73a51 ("KVM: x86: add KVM_HC_CLOCK_PAIRING hypercall") Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260905091008.40802-1-kmehltretter@gmail.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-28Documentation: KVM: SEV: Use the uapi structure namesKarl Mehltretter
The document names struct kvm_sev_launch_update, struct kvm_sev_attestation, struct kvm_sev_launch_send_update_data and struct kvm_sev_launch_receive_update_data. None of them exists in arch/x86/include/uapi/asm/kvm.h; the structures are kvm_sev_launch_update_data, kvm_sev_attestation_report, kvm_sev_send_update_data and kvm_sev_receive_update_data. Use the uapi names. Fixes: dc48bae01e5a ("KVM: Define SEV key management command id") Fixes: 2c07ded06427 ("KVM/SVM: add support for SEV attestation command") Fixes: d3d1af85e2c7 ("KVM: SVM: Add KVM_SEND_UPDATE_DATA command") Fixes: 15fb7de1a7f5 ("KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command") Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260905090912.40740-1-kmehltretter@gmail.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-24Documentation: KVM: document arm64 KVM_PRE_FAULT_MEMORYLorenzo Stoakes (ARM)
Update the KVM API documentation to reflect the fact that arm64 now supports this functionality. Also document error values and arm64-specific behaviour. Reviewed-by: Oliver Upton <oupton@kernel.org> Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev> Tested-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20260923-kvm-arm-prefault-v4-11-d4b0b4dfa8c3@kernel.org Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-24Documentation: um: document nommu UMLJohannes Berg
Add a description of nommu UML, a bit about how it works and some notes on how to use it. Partially based on Hajime's documentation. Link: https://patch.msgid.link/20260723113633.19c6669dc151.Ibd7a532eef856a1ea39699a263dfa8a9ded9dc20@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-22KVM: TDX: Make source page optional for KVM_TDX_INIT_MEM_REGIONAckerley Tng
Update tdx_gmem_post_populate() to handle cases where userspace requests "no source page". To handle "no source page", populate (perform TDH.MEM.PAGE.ADD) using memory in-place at the target PFN. Allow "no source page" only when gmem_in_place_conversion is enabled, because retroactively adding support for out-of-place conversion would mean requiring a userspace update for a feature that's being deprecated. Also, KVM supporting "no source page" without in-place conversion would effectively be an obscure zero-page optimization that relies on the page being zeroed when it is allocated by guest_memfd. Rejecting "no source page" without in-place conversion scenario is valuable for KVM developers since it helps newcomers understand what exactly is and isn't possible. Co-developed-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Ackerley Tng <ackerleytng@google.com> Tested-by: Shivank Garg <shivankg@amd.com> Tested-by: Yan Zhao <yan.y.zhao@intel.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Reviewed-by: Yan Zhao <yan.y.zhao@intel.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-20-dd6fbf94f4e1@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-22KVM: SEV: Make 'uaddr' parameter optional for KVM_SEV_SNP_LAUNCH_UPDATEMichael Roth
Make the source page for populating an SNP guest_memfd instance optional if in-place conversion/population is enabled. If KVM can convert the page in-place, then it's possible for guest memory to be initialized directly from userspace by mmap()'ing the guest_memfd and writing to it while the corresponding GPA ranges are in a 'shared' state, before converting them to the 'private' state expected by KVM_SEV_SNP_LAUNCH_UPDATE. Update the handling/documentation for KVM_SEV_SNP_LAUNCH_UPDATE to allow for 'uaddr' to be set to NULL when in-place conversion is enabled, which SNP_LAUNCH_UPDATE will then use to determine when it should/shouldn't copy in data from a separate memory location. Continue to enforce non-NULL when PRIVATE is tracked per-VM, not per-guest_memfd. [ Sean: Moved condition to snp_launch_update ] Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Ackerley Tng <ackerleytng@google.com> Tested-by: Shivank Garg <shivankg@amd.com> Tested-by: Yan Zhao <yan.y.zhao@intel.com> Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-19-dd6fbf94f4e1@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-22KVM: guest_memfd: Ensure pages are not in use before conversionAckerley Tng
When converting memory to private in guest_memfd, it is necessary to ensure that the pages are not currently being accessed by any other part of the kernel or userspace to avoid any current user writing to guest private memory. guest_memfd checks for any outstanding references to determine whether a page is still in use. The only expected references after unmapping the range requested for conversion are those that are held by guest_memfd itself. A folio will have outstanding references if it is present in a per-CPU lru_add fbatch. guest_memfd does not actually participate in LRU, but freshly-allocated folios are still added to the lru_add fbatch for batch LRU statistics processing. A folio may also have extra refcounts if it is on the mlock fbatch. These two known usages of the folio are handled by draining both the lru_add and mlock fbatches for the folio. After draining, if the refcount is still elevated, then there are truly outstanding references. If the page may be DMA-pinned, DMA is using it and hence there are outstanding references. Checking if the page may be DMA-pinned can have false positives, but that is only with a significant number of refcounts, at which point draining LRU is not going to move the needle - it can still be concluded that the folio has outstanding references. If the page is still mapped after guest_memfd tried to unmap it earlier in the conversion process, it also has outstanding references. Exit early to avoid unnecessary draining in these two cases. If an outstanding reference is detected, stop scanning, record the failing offset, and return immediately. Track the drain status to avoid repeatedly draining LRU caches across multiple folios while scanning the requested range. Update the kvm_memory_attributes2 structure to include an error_offset field. This allows KVM to report the exact offset where a conversion failed. If the safety check fails, return -EAGAIN and copy the error_offset back to userspace so that it can potentially retry the operation or handle the failure gracefully. Report error_offset if preallocating memory to track attributes fails with -ENOMEM as well, in which case the start offset of the range is returned. Update documentation to document the error_offset field and the possible -EAGAIN error. Suggested-by: David Hildenbrand <david@kernel.org> Co-developed-by: Vishal Annapurve <vannapurve@google.com> Signed-off-by: Vishal Annapurve <vannapurve@google.com> Signed-off-by: Ackerley Tng <ackerleytng@google.com> Tested-by: Shivank Garg <shivankg@amd.com> Reviewed-by: Fuad Tabba <tabba@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Tested-by: Yan Zhao <yan.y.zhao@intel.com> Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-15-dd6fbf94f4e1@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-22KVM: guest_memfd: Add base support for KVM_SET_MEMORY_ATTRIBUTES2Ackerley Tng
Add a new ioctl (and matching struct), KVM_SET_MEMORY_ATTRIBUTES2, using the same base ioctl number (0xd2), but with R/W semantics for the kernel instead of just read semantics. "Officially" documenting that KVM writes to the payload will allow KVM to support partial/incremental conversions, instead of all-or-nothing updates (which requires complex unwinding), by recording the failing offset if an error occurs. Opportunistically add a new struct as well, even though KVM could squeeze the error offset into "struct kvm_memory_attributes", as there's no cost to doing so in practice. Pad the struct with a pile of extra space to try and avoid ending up with "struct kvm_memory_attributes3" in the future. Use the same layout for the fields common to version 1 of the struct, e.g. to ease upgrading userspace, and to provide flexibility if KVM ever adds support for KVM_SET_MEMORY_ATTRIBUTES2 at VM scope. Introduce KVM_CAP_GUEST_MEMFD_MEMORY_ATTRIBUTES to advertise the availability of the KVM_SET_MEMORY_ATTRIBUTES2 ioctl. Update the KVM API documentation to define the new ioctl and its behavior, and add the necessary UAPI definitions and capability checks. The process of setting memory attributes has a clear point of no return because, for CoCo VMs, zapping stage 2 page tables is a destructive operation. Unlike regular VMs, where re-faulting pages into the stage 2 page tables merely incurs a performance penalty, CoCo guests must (re-):accept pages after every fault. To preserve CoCo security guarantees, guests will not accept pages they did not explicitly request faults for. Consequently, during memory conversions, any operation that could cause the process to abort must be completed before the stage 2 page tables are zapped. Zap only the ranges that are not already in the requested state to avoid inadvertently destroying (CoCo) data. ARM CCA guests will try to mark the entire DRAM as private at boot. If there are no shared pages at all, the to-private conversion can be skipped, but the existence of a single shared page would require the conversion process to proceed, and if it proceeds, zapping both shared and private pages would destroy data and break the guest. Suggested-by: Michael Roth <michael.roth@amd.com> Suggested-by: Suzuki K Poulose <suzuki.poulose@arm.com> Co-developed-by: Vishal Annapurve <vannapurve@google.com> Signed-off-by: Vishal Annapurve <vannapurve@google.com> Co-developed-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Ackerley Tng <ackerleytng@google.com> Tested-by: Shivank Garg <shivankg@amd.com> Reviewed-by: Fuad Tabba <tabba@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com> Tested-by: Yan Zhao <yan.y.zhao@intel.com> Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-14-dd6fbf94f4e1@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-22KVM: guest_memfd: Always fault from guest_memfd if in-place conversion is ↵Ackerley Tng
enabled If a guest_memfd memslot is created but the guest_memfd does not have the GUEST_MEMFD_FLAG_MMAP set, KVM still fulfils guest faults by looking up the memslot's userspace_addr. Set KVM_MEMSLOT_GMEM_ONLY if in-place conversion is enabled so that the guest_memfd's memory will be used for both shared and private memory. With in-place conversion, guest_memfd will be the only backing memory for the memslot. No validation is performed to require userspace_addr to be a mapping from the associated guest_memfd because even after validation, userspace is free to remap something else at the provided userspace_addr. userspace_addr will still be used by functions like kvm_read_guest(), and if userspace_addr does not match up with the corresponding memory in the memslot's guest_memfd (whether userspace_addr points to the wrong offset or some non-guest_memfd memory, etc), that is a user error. Requiring both shared and private memory to come from the only associated guest_memfd simplifies invalidation in stage 2 page tables. On a PUNCH_HOLE operation on a guest_memfd, the invalidation is now guaranteed to be invalidating only memory mapped from the given guest_memfd. Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Ackerley Tng <ackerleytng@google.com> Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Tested-by: Yan Zhao <yan.y.zhao@intel.com> Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-12-dd6fbf94f4e1@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-22KVM: guest_memfd: Stub in ability to enable in-place shared<=>private conversionSean Christopherson
Stub in global variable to enable in-place guest_memfd private<=>shared memory conversion, which will eventually be exposed to userspace via a module param, and wire up the __kvm_is_private_gfn() static call to the guest_memfd version when in-place conversion is enabled, i.e. when gmem is the sole authority on private vs. shared memory. Co-developed-by: Ackerley Tng <ackerleytng@google.com> Signed-off-by: Ackerley Tng <ackerleytng@google.com> Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Fuad Tabba <tabba@google.com> Cc: Xiaoyao Li <xiaoyao.li@intel.com> Tested-by: Yan Zhao <yan.y.zhao@intel.com> Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-9-dd6fbf94f4e1@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-15Documentation: virt: Fix the struct snp_guest_request_ioctl name in ↵Karl Mehltretter
sev-guest.rst struct snp_user_guest_request does not exist; the name is struct snp_guest_request_ioctl. Use the real name. Fixes: fce96cf04430 ("virt: Add SEV-SNP guest driver") Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260905092942.41558-1-kmehltretter@gmail.com>
2026-09-14KVM: arm64: Fix the KVM_ARM_PREFERRED_TARGET documentationFuad Tabba
KVM_ARM_PREFERRED_TARGET has never set a feature bit: the original arm64 implementation zeroed the bitmap, and kvm_vcpu_preferred_target(), which only ever zeroed it, was removed by commit 5346f7e13e5e ("KVM: arm64: Always return generic v8 as the preferred target"). The ENODEV error had gone earlier still, with commit 08e873cb70f3 ("KVM: arm64: Change the return type of kvm_vcpu_preferred_target()"). Document what it returns, that userspace selects vCPU features itself, and drop the error. No functional change intended. Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Reviewed-by: Wei-Lin Chang <weilin.chang@arm.com> Link: https://patch.msgid.link/20260831162815.269851-1-fuad.tabba@linux.dev Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14Documentation: KVM: Fix the struct kvm_arm_device_addr nameKarl Mehltretter
KVM_ARM_SET_DEVICE_ADDR takes struct kvm_arm_device_addr; the document names it struct kvm_arm_device_address, which does not exist. Use the real name. Fixes: 3401d54696f9 ("KVM: ARM: Introduce KVM_ARM_SET_DEVICE_ADDR ioctl") Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260905090655.40683-1-kmehltretter@gmail.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14Documentation: KVM: Fix the event_source sysfs path in the PMU attribute ↵Karl Mehltretter
description The PMU device directories live under /sys/bus/event_source/devices, the document spells the bus even_source. Fix the spelling. Fixes: 6ee7fca2a4a0 ("KVM: arm64: Add KVM_ARM_VCPU_PMU_V3_SET_PMU attribute") Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260905085849.40479-1-kmehltretter@gmail.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14Documentation: KVM: Add the VGICv5 IRS save/restore sequencesSascha Bischoff
Document the ordering requirements for saving and restoring the GICv5 IRS state. The IST state is exposed through KVM_DEV_ARM_VGIC_GRP_IST and is copied to or from userspace-provided buffers. Saving the ISTs therefore does not update guest memory, so userspace does not need to serialize guest memory after saving the IST state. On restore, userspace must create the vCPUs, configure the IRS address, restore the number of SPIs, and initialize the VGIC before restoring IRS state. The IRS MMIO registers may be restored in any order, but the final IRS_IDR* state and the IRS_IST_CFGR/IRS_IST_BASER state that describes any LPI IST must be restored before KVM_DEV_ARM_VGIC_GRP_IST. KVM uses that state to validate the userspace IST buffers and allocate any host LPI IST. The IRS_*_STATUSR registers are observational state in KVM. Userspace may save them for validation or debugging, but they are not required as restore input and do not need to be replayed. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-40-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14Documentation: KVM: Add docs for KVM_DEV_ARM_VGIC_GRP_ISTSascha Bischoff
Document the IST save/restore userspace interface for the VGICv5 device, KVM_DEV_ARM_VGIC_GRP_IST. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-39-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14Documentation: KVM: Add KVM_DEV_ARM_VGIC_GRP_IRS_REGS to VGICv5 docsSascha Bischoff
Document the KVM_DEV_ARM_VGIC_GRP_IRS_REGS attribute group used to read and write the virtual IRS's MMIO register state. This provides a GICv5-specific interface for state that is conceptually similar to the VGICv3 ITS register interface, but uses IRS terminology instead of ITS. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-38-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14Documentation: KVM: Document KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS for VGICv5Sascha Bischoff
The virtual GICv5 adopts the same mechanism as GICv3 for userspace reads and writes of the system registers, albeit operating on a different set of registers, of course. Document KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS for GICv5 in the VGICv5 documentation, explicitly calling out the registers it operates on. The main body of documentation has been directly copied from the VGICv3 documentation as it has identical operation. One key thing to note is that for two sets of GICv5 registers - those pertaining to Active and Pending state - the operation of the interface is different to how the actual registers operate. Both of these registers have C and S variants (to set and clear bits) in hardware. However for this interface, we ONLY implement the S variant, AND treat it as a raw write. This simplifies the act of reading or writing the state. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-37-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14Documentation: KVM: Extend VGICv5 device attribute docsSascha Bischoff
The VGICv5 documentation still describes the device as supporting PPIs only. Update the overview to cover PPI, SPI, and LPI interrupts. PPIs and SPIs can be injected by in-kernel devices or through KVM_IRQ_LINE, while LPI pending state is driven by the guest and handled in hardware through the LPI IST. Document the GICv5 IRS address attribute and its GPA layout requirements. The IRS region must be 64K aligned and covers a 128K range. Also document the GICv5-specific interpretation of KVM_DEV_ARM_VGIC_GRP_NR_IRQS. Unlike GICv2 and GICv3, the value describes only the number of SPIs exposed by the IRS and does not include SGIs or PPIs. The supported range is 32 through 1024 SPIs in multiples of 32, and defaults to 32 when userspace leaves it unset. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-29-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Support SPI injectionSascha Bischoff
GICv5 SPI lifecycle is handled by the GICv5 hardware once the pending state has been injected. This change adds support for injecting SPIs to the core VGIC code and GICv5 code. First of all, allow GICv5 SPIs to be looked up by ID via vgic_get_irq(). Previously, only PPIs were supported. Two irq_ops are used for GICv5 SPI injection. The set_pending_state() irq_op is used to inject the SPI's pending state into the guest. The queue_irq_unlock() irq_op releases the IRQ lock without queueing the SPI on a per-vCPU AP list, as GICv5 does not track in-flight SPI state in KVM. Tracking the affinity and lifecycle of individual SPIs in software would negate much of the benefit of their lifecycle being hardware managed. Limit injection to the configured per-VM SPI range. Since GICv5 SPI IDs start at zero, KVM_IRQ_LINE accepts IDs from zero through one less than the configured number of SPIs, up to 1023. Update the KVM_IRQ_LINE documentation accordingly. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-28-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-08-25Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
Pull kvm updates from Paolo Bonzini: "ARM64: - Add support for 'slot' based PMU events, paired with new UAPI that compels the user to select a specific PMU implementation - Lazy save/restore of vCPU state for pKVM, along with various fixes and cleanups to the management of vCPU state between the untrusted host and pKVM hypervisor - Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1 is present, guaranteeing that EL2-specific register bits are stateful in the EL1 counterpart - Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope of those instructions remains 'in host' (i.e. L1 kernel/userspace) - Pile of fixes for the management of the VNCR pseudo-TLB, such as under-invalidations and races with concurrent TLBIs on other vCPUs - Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a runtime-patched constant, allowing the same data to be shared with pKVM prior to dropping host privileges - Considerable pile of LLM-assisted fixes around the shop but mostly in the VGIC, our in-kernel generator of bugs (and sometimes interrupts) LoongArch: - Advertise already-supported capabilities - Some bug fixes about timer and MMIO - Some hardening about interrupt injection - Replace kvm_err() with kvm_pr_unimpl() - Add FPU/LSX/LASX test cases for selftests RISC-V: - Svadu/Zicfiss/Zicfilp FWFT support for Guest - Use try_cmpxchg for IMSIC MRIF RMW - More arch-specific tracepoints in KVM RISC-V - Eager page splitting when enabling dirty logging - Optimize hfence request handling for SMP Guests - Improve dirty log clearing by skipping zero bits in mask - Guard HFENCE range loops against overflow - CPU PM notifiers in KVM RISC-V for non-retentive idle states - Fix kernel-mode vector context save/restore for Guest s390: - Fixes for vfio-ap - Fixes for the gmap rework - Fixes for vsie - AI triggered fixes all over - diag9c tracing - code move preparation for the additional arm64 support - enable CONTEXT_ANALYSIS x86: - Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding regs.c (the kvm_cache_regs.h => regs.h is already applied) and msrs.{c,h}, and moving relevant code out of x86.c - Split kvm_mmu in three parts, respectively to describe the format of page tables, walking the guest page tables and building the page tables. Always use the same page table walker kvm->arch.gva_walk as the entry point to convert a guest's virtual address, where the previous code used two different kvm_mmu structs depending on whether the walk included nested EPT/NPT or not. Make page fault vmexits reuse the permission checking machinery that is used for guest page faults. This is both a cleanup and a baby step towards supporting XS/XU memory permissions - Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs on x86 - Remove a defunct masterclock update from kvm_xen_shared_info_init(). It could result in incorrect kvmclock due to triggering an unnecessary switch to/from masterclock mode - Skip Xen runstate time updates if time has effectively gone backwards, so that the guest doesn't report 100% steal time for a very, very long time - Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM was updating the wrong sub-leaf, and upstream KVM will soon provide all the information needed by userspace to populate the CPUID field itself - Fix a bug where KVM would walk a newly created rmap without holding the rmap lock (or mmu_lock) during aging - Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs - Fix a variety of #DB priority bugs - Fix a class of races related to enabling Hyper-V emulation on a vCPU after the vCPU is visible to the rest of KVM - Use static calls for nested virtualization ops - Move more KVM-internal code out of x86's kvm_host.h - Enumerate support for a variety of Zhaoxin instructions that don't require explicit virtualization - Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path - Harden kvm_vcpu_map() against double-mapping and thus leaking references - Misc fixes and cleanups, e.g. for largely benign syzkaller splats x86 (Intel): - Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI virtualization when the vCPU is freed, to fix a use-after-free where hardware will write to a freed vCPU's PID - Service local TLB flushes on a failed nested VM-Enter to fix a bug where KVM could miss a TLB on a future, successful VM-Enter with the same L2 VPID - Cap the maximum value shoved into the VMX Preemption Timer to workaround an erratum that affects all existing Intel CPUs that support CPUID 0x15 - Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs - Harden the TDX "populate" ioctls against bad input, and to prepare for supporting in-place private<=>shared conversion x86 (AMD): - Forcefully invalidate SNP VMSA pages if their backing guest_memfd page is zapped/invalidated, e.g. due to a PUNCH_HOLE in response to a Page-State Change request - Remove a dying VM from the GA Log notifier list before the VM is actually destroyed, to fix a potential use-after-free - While FOLL_WRITE was needed in the past to trigger CoW unsharing, nowadays FOLL_LONGTERM does that already even without FOLL_WRITE, and in fact, get_user_pages() actually disallows FOLL_WRITE together with FOLL_LONGTERM. So don't pass FOLL_WRITE when registering encrypted memory regions, i.e. when pinning SEV/SEV-ES guest memory, to fix a regression with file-backed memory introduced by KVM's (correct) usage of long-term pins (This was reviewed by mm maintainers; for more information, see commit ee1a586dd1fa "KVM: SEV: Drop FOLL_WRITE for encrypted region registration") - Allocate full pages for SEV/SEV-ES {DE,EN}CRYPT ops on SNP-enabled hosts to fix a data corruption issue due to the PSP driver assigning to-be-written pages to firmware (as required by the SNP specs) - Unconditionally intercept ICBEP so that KVM generates the correct guest RIP when handling an ICEBP-induced TASK_SWITCH #VMEXIT - Harden the SNP "populate" ioctls against bad input, and to prepare for supporting in-place private<=>shared conversion Generic: - Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's debugfs - Add a per-VM bitmap to track which vCPU IDs have been "claimed" but for which the vCPU isn't yet online, and use the bitmap to reject duplicate IDs before calling into arch code. This allows arch code to consume vcpu_id without having to worry about cross-vCPU clobbering (at least s390 and x86 have had related bugs) - Rework the so called "prepare" and "invalidate" guest_memfd hooks to prepare for in-place private<=>shared conversion, and clean up a few warts along the way Selftests: - Automatically allocate a full page for L2 guest stacks on x86 instead of requiring test-specific L1 guest code to carve out a portion of the L1 stack for L2 usage, and to ensure the L2 stack also adheres to the x86-64 calling convention ABI - Add a selftest to verify {Guest,Host}-Only behavior in x86's mediated PMU - Clean up nested SVM's handling of GPRs on L2<=>L1 transitions, reuse the functionality for nested VMX, and drop the ucall hack that was fudging around the lack of GPR switching on nVMX - Add a stress test to verify KVM doesn't clobber/drop #PF state, e.g. CR2, across save/restore, including when L2 is active - Add a test to verify KVM_CREATE_VM accepts exactly what is reported by KVM_CAP_VM_TYPES - Misc selftests fixes and cleanups - Fix several issues with seeding the pRNG, and rework the pRNG APIs to that the pRNG can be sanely used in host code, not just guest code - Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up via KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for triggering IRQs via writes to an assigned VFIO device - Add syscall wrappers to assert success on a variety of pthreads and CPU affinity APIs - Set vCPU pthread affinity as early as possible to reduce contention issues that were surfaced by PREEMPT_LAZY, which result in runtimes of over a minute on large hosts, versus the expected ~5 seconds - Rework the PMU counters test to run each testcase using a single VM with many vCPUs for each sub-testcase, instead of using a unique VM for each sub-testcase. This cuts the runtime by ~20x Miscellaneous: - MAINTAINERS updates for vfio-ap, guest_memfd, kvm-x86. Mostly representing the status quo more accurately, but also... welcome David Hildenbrand as guest_memfd reviewer!" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (413 commits) KVM: arm64: Validate GICv5 timer PPIs before claiming ownership KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs KVM: arm64: vgic: Prevent speculative SPI array underflow KVM: arm64: vgic: Free gic_kvm_info on initialization failure KVM: arm64: Avoid mismatched accesses to 'struct kvm_nvhe_init_params' s390/vfio-ap: Fix NULL deref in status_show() during queue probe s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove RISC-V: KVM: fix vcpu vector context handling for kernel-mode vector riscv: vector: allow non-preemptible kernel-mode vector with IRQs off riscv: vector: refactor riscv_v_start_kernel_context KVM: s390: gmap: Make prefix handling optional KVM: s390: gmap: Make CMMA optional KVM: s390: gmap: Make storage keys optional KVM: s390: Prepare gmap for a second KVM implementation ...
2026-08-24Merge tag 'kvmarm-7.3' of ↵Paolo Bonzini
https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 changes for 7.3 - Add support for 'slot' based PMU events, paired with new UAPI that compels the user to select a specific PMU implementation - Lazy save/restore of vCPU state for pKVM, along with various fixes and cleanups to the management of vCPU state between the untrusted host and pKVM hypervisor - Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1 is present, guaranteeing that EL2-specific register bits are stateful in the EL1 counterpart - Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope of those instructions remains 'in host' (i.e. L1 kernel/userspace) - Pile of fixes for the management of the VNCR pseudo-TLB, such as under-invalidations and races with concurrent TLBIs on other vCPUs - Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a runtime-patched constant, allowing the same data to be shared with pKVM prior to dropping host privileges - Considerable pile of LLM-assisted fixes around the shop but mostly in the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
2026-08-18Merge tag 'powerpc-7.3-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Madhavan Srinivasan: - Enable Rust for ppc64le - ppc4xx gpio driver updates - Add power12 base enablement support - Validate arch_compat against host compatibility mode - Simplify bootx_scan_dt_build_struct() in powermac platform - Implement get_direction() in cpm2 - Use cpu_relax() in ps3_create_spu() - Add NULL guard for cause_ipi in smp_muxed_ipi_message_pass - Fixes to handle pseries watchdogs in kdump path - Fix missing r2 clobber in PCREL inline assembly - Set GPIO chip parent on ppc44x - KVM: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl - KVM: Use generic xfer to guest work function - Enable to run posix cpu timers in task context - Misc fixes and cleanups Thanks to Aditya Gupta, Alice Ryhl, Amit Machhiwal, Andrew Morton, Anushree Mathur, Athira Rajeev, Bartosz Golaszewski, Cédric Le Goater, Christian König, Christophe Leroy (CS GROUP), Gary Guo, Gaurav Batra, Gautam Menghani, Gou Hao, Hari Bathini, Harsh Prateek Bora, jiazhenyuan, Jinjie Ruan, Link Mauve, Linus Walleij, Mahesh Kumar G Mahesh Salgaonkar, Michael Walle, Michal Suchánek, Mukesh Kumar Chaurasiya (IBM), Nicholas Piggin, Nikhil Kumar Singh, Praveen K Pandey, Ritesh Harjani (IBM), Rosen Penev, Saket Kumar Bhaskar, Shrikanth Hegde, Sourabh Jain, Thorsten Blum, Vaibhav Jain, Venkat Rao Bagalkote, Vishal Chourasia, Wentao Guan, and Yanfei Xu. * tag 'powerpc-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (62 commits) powerpc/pseries/iommu: switch to Default DMA window during kdump powerpc/configs: enable CONFIG_RAS to fix EDAC support KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl gpio: ppc44x: use dev_name() for chip label gpio: ppc44x: fix undefined behavior in GPIO_MASK2 macro gpio: ppc44x: drop PPC-specific IO helpers gpio: ppc44x: Convert GPIO to generic MMIO gpio: ppc44x: Use platform resource helper for GPIO MMIO gpio: ppc44x: Use module platform driver helper for GPIO gpio: ppc44x: update all 4xx to 44x gpio: move ppc4xx gpio driver from arch/powerpc to drivers/gpio KVM: PPC: Use min() in kvm_vm_ioctl_check_extension() KVM: PPC: booke: Use min() in watchdog_next_timeout() powerpc/perf: Add power12 Base Performance Monitoring support powerpc: Add Power12 architected mode powerpc: Add Power12 raw mode powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation ...
2026-08-18Merge tag 'kvm-x86-generic-7.3' of https://github.com/kvm-x86/linux into HEADPaolo Bonzini
KVM arch-neutral and documentation changes for 7.3 - Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's debugfs. - Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs on x86. - Add a per-VM bitmap to track which vCPU IDs have been "claimed" but for which the vCPU isn't yet online, and use the bitmap to reject duplicate IDs before calling into arch code. This allows arch code to consume vcpu_id without having to worry about cross-vCPU clobbering (at least s390 and x86 have had related bugs). - Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI virtualization when the vCPU is freed to fix a use-after-free where hardware will write to a freed vCPU's PID.
2026-08-09KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctlAmit Machhiwal
Add documentation for the KVM_PPC_GET_COMPAT_CAPS ioctl to the KVM API documentation. The ioctl exposes host processor compatibility modes supported for nested KVM guests on PowerPC systems. The documentation covers error code descriptions including E2BIG for forward compatibility, KVM_PPC_COMPAT_CAPS_SIZE_VER0 as the minimum size floor, the rationale for rejecting non-zero reserved fields to prevent ABI ambiguity, bit numbering clarification for IBM MSB-0 convention, and KVM-specific capability bit constants. Tested-by: Gautam Menghani <gautam@linux.ibm.com> Reviewed-by: Gautam Menghani <gautam@linux.ibm.com> Tested-by: Anushree Mathur <anushree.mathur@linux.ibm.com> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260808161148.66673-5-amachhiw@linux.ibm.com
2026-07-31KVM: x86: Document APIC base address constraint for in-kernel irqchipTim Wiederhake
When virtual APIC access acceleration is enabled (APICv on Intel, AVIC on AMD), vcpu creation installs a private memory slot at the default APIC base address (0xfee00000). If a user memory region overlaps this address, vcpu creation fails with EEXIST. The same error occurs when installing an overlapping user memory region after vcpu creation. This also applies when using KVM_CAP_SPLIT_IRQCHIP. This constraint is not documented anywhere. Add a note to the KVM_CREATE_IRQCHIP and KVM_CAP_SPLIT_IRQCHIP documentation. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Link: https://patch.msgid.link/20260708133856.302151-3-twiederh@redhat.com [sean: call out "subsequent vcpu creation"] Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-31KVM: x86: Document that KVM_CREATE_IRQCHIP must precede vCPU creationTim Wiederhake
The kernel rejects KVM_CREATE_IRQCHIP with -EINVAL if any vCPUs have already been created, but the API documentation does not mention this constraint. Add a note. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Link: https://patch.msgid.link/20260708133856.302151-2-twiederh@redhat.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-30KVM: arm64: Add KVM_ARM_VCPU_PMU_V3_STRICT vCPU featureCongkai Tan
Introduce a new vCPU feature KVM_ARM_VCPU_PMU_V3_STRICT. When set, KVM does not create a default PMU when initializing the vCPU, and userspace must select one explicitly via KVM_ARM_VCPU_PMU_V3_SET_PMU before the first KVM_RUN. The flag forces the VMM to be aware of the PMU implementation of the guest to be created, so that certain information about the PMU becomes deterministic (if on a heterogeneous system) and becomes safe to be exposed to the guest. It can be used as an umbrella flag to gate future PMUv3 UAPI changes. When no default PMU is created, kvm->arch.arm_pmu stays NULL until SET_PMU runs, so kvm_arm_pmu_v3_init() now refuses to run if kvm->arch.arm_pmu is NULL. Signed-off-by: Congkai Tan <congkai@amazon.com> Reviewed-by: Geoff Blake <blakgeof@amazon.com> Reviewed-by: Haris Okanovic <harisokn@amazon.com> Reviewed-by: Stanislav Spassov <stanspas@amazon.de> Co-developed-by: Oliver Upton <oupton@kernel.org> Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev> Tested-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20260722202702.4165917-5-congkai@amazon.com Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-07-28Merge tag 'kvmarm-fixes-7.2-3' of ↵Paolo Bonzini
git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.2, take #3 - Fix a tiny buglet when propagating the deactivation of an interrupt from a nested guest, which happened to trigger a gold plated CPU bug on a particular implementation - Fix a race between LPI unmapping and mapping, resulting in leaked LPIs - Make LPI mapping more robust on memory allocation failure - Fix the handling of the EL2 tracing clock being disabled - A couple of Sashiko-driven fixes for corner cases in the EL2 tracing code - Add missing sysreg tracepoint for the EL2 code - Tidy-up the mutual exclusion of guest-memfd and MTE - Update Fuad's email address to point to @linux.dev
2026-07-27KVM: s390: Fall back to short-term pinning in MAP ioctlJaehoon Kim
FOLL_LONGTERM pinning fails for some memory types, such as file-backed guest memory. As a result, kvm_s390_adapter_map() returns -EINVAL and irqfd adapter registration fails even though interrupt delivery could still work via the existing non-atomic path. When FOLL_LONGTERM pinning fails, verify that the page is accessible using a short-term pin instead. If the short-term pin succeeds, unpin the page and add a map entry with pinned=false to preserve MAP/UNMAP symmetry. The non-atomic irqfd path already performs short-term pinning for interrupt delivery, so this restores the previous behavior for memory that cannot be pinned long-term. get_map_info() is updated to return NULL for unpinned entries so that the atomic irqfd fast path falls back to the non-atomic path. kvm_s390_adapter_unmap() and kvm_s390_unmap_all_adapters() skip dirty marking and unpin for unpinned entries. Update Documentation/virt/kvm/devices/s390_flic.rst to reflect the new MAP/UNMAP behavior. Fixes: c9a568838086 ("KVM: s390: Add map/unmap ioctl and clean mappings post-guest") Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com> Reviewed-by: Douglas Freimuth <freimuth@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>