On Thu, Feb 12, 2026 at 07:58:49AM -0800, Jim Mattson wrote:
> When running an L2 guest and writing to MSR_IA32_CR_PAT, the host PAT value
> is stored in both vmcb01's g_pat field and vmcb02's g_pat field, but the
> clean bit was only being cleared for vmcb02.
>
> Introduce the helper vmcb_set_gpat() which sets vmcb->save.g_pat and marks
> the VMCB dirty for VMCB_NPT. Use this helper in both svm_set_msr() for
> updating vmcb01 and in nested_vmcb02_compute_g_pat() for updating vmcb02,
> ensuring both VMCBs' NPT fields are properly marked dirty.
>
> Fixes: 4995a3685f1b ("KVM: SVM: Use a separate vmcb for the nested L2 guest")
> Signed-off-by: Jim Mattson <[email protected]>
> ---
> arch/x86/kvm/svm/nested.c | 2 +-
> arch/x86/kvm/svm/svm.c | 3 +--
> arch/x86/kvm/svm/svm.h | 9 +++++----
> 3 files changed, 7 insertions(+), 7 deletions(-)
>
> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index d80b1bde6630..b72a1f3c4144 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -707,7 +707,7 @@ void nested_vmcb02_compute_g_pat(struct vcpu_svm *svm)
> return;
>
> /* FIXME: merge g_pat from vmcb01 and vmcb12. */
> - svm->nested.vmcb02.ptr->save.g_pat = svm->vmcb01.ptr->save.g_pat;
> + vmcb_set_gpat(svm->nested.vmcb02.ptr, svm->vmcb01.ptr->save.g_pat);
> }
>
> static void nested_vmcb02_prepare_save(struct vcpu_svm *svm)
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 364915f42e13..529cbac57814 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -2924,10 +2924,9 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct
> msr_data *msr)
> if (ret)
> break;
>
> - svm->vmcb01.ptr->save.g_pat = data;
> + vmcb_set_gpat(svm->vmcb01.ptr, data);
> if (is_guest_mode(vcpu))
> nested_vmcb02_compute_g_pat(svm);
> - vmcb_mark_dirty(svm->vmcb, VMCB_NPT);
> break;
> case MSR_IA32_SPEC_CTRL:
> if (!msr->host_initiated &&
> diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
> index 0bb93879abfe..9850ed01e16e 100644
> --- a/arch/x86/kvm/svm/svm.h
> +++ b/arch/x86/kvm/svm/svm.h
> @@ -434,14 +434,15 @@ static inline void vmcb_mark_dirty(struct vmcb *vmcb,
> int bit)
> vmcb->control.clean &= ~(1 << bit);
> }
>
> -static inline bool vmcb_is_dirty(struct vmcb *vmcb, int bit)
Huh, I assume the removed of vmcb_is_dirty() was not intentional?
> +static inline bool vmcb12_is_dirty(struct vmcb_ctrl_area_cached *control,
> int bit)
> {
> - return !test_bit(bit, (unsigned long *)&vmcb->control.clean);
> + return !test_bit(bit, (unsigned long *)&control->clean);
> }
>
> -static inline bool vmcb12_is_dirty(struct vmcb_ctrl_area_cached *control,
> int bit)
> +static inline void vmcb_set_gpat(struct vmcb *vmcb, u64 data)
> {
> - return !test_bit(bit, (unsigned long *)&control->clean);
> + vmcb->save.g_pat = data;
> + vmcb_mark_dirty(vmcb, VMCB_NPT);
> }
>
> static __always_inline struct vcpu_svm *to_svm(struct kvm_vcpu *vcpu)
> --
> 2.53.0.239.g8d8fc8a987-goog
>
