Commit 2daf71bf authored Mar 16, 2026 by Yosry Ahmed Committed by Sean Christopherson Apr 03, 2026

KVM: nSVM: Fail emulation of VMRUN/VMLOAD/VMSAVE if mapping vmcb12 fails

KVM currently injects a #GP if mapping vmcb12 fails when emulating
VMRUN/VMLOAD/VMSAVE. This is not architectural behavior, as #GP should
only be injected if the physical address is not supported or not
aligned. Instead, handle it as an emulation failure, similar to how nVMX
handles failures to read/write guest memory in several emulation paths.

When virtual VMLOAD/VMSAVE is enabled, if vmcb12's GPA is not mapped in
the NPTs a VMEXIT(#NPF) will be generated, and KVM will install an MMIO
SPTE and emulate the instruction if there is no corresponding memslot.
x86_emulate_insn() will return EMULATION_FAILED as VMLOAD/VMSAVE are not
handled as part of the twobyte_insn cases.

Even though this will also result in an emulation failure, it will only
result in a straight return to userspace if
KVM_CAP_EXIT_ON_EMULATION_FAILURE is set. Otherwise, it would inject #UD
and only exit to userspace if not in guest mode. So the behavior is
slightly different if virtual VMLOAD/VMSAVE is enabled.

Fixes: 3d6368ef ("KVM: SVM: Add VMRUN handler")
Reported-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Yosry Ahmed <yosry@kernel.org>
Link: https://patch.msgid.link/20260316202732.3164936-8-yosry@kernel.org

Signed-off-by: Sean Christopherson <seanjc@google.com>

parent 878b8efa

arch/x86/kvm/svm/nested.c

+2 −4

Original line number	Diff line number	Diff line
		@@ -1111,10 +1111,8 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu)

		ret = nested_svm_copy_vmcb12_to_cache(vcpu, vmcb12_gpa);
		if (ret) {
		if (ret == -EFAULT) {
		kvm_inject_gp(vcpu, 0);
		return 1;
		}
		if (ret == -EFAULT)
		return kvm_handle_memory_failure(vcpu, X86EMUL_IO_NEEDED, NULL);

		/* Advance RIP past VMRUN as part of the nested #VMEXIT. */
		return kvm_skip_emulated_instruction(vcpu);

arch/x86/kvm/svm/svm.c

+2 −4

Original line number	Diff line number	Diff line
		@@ -2204,10 +2204,8 @@ static int vmload_vmsave_interception(struct kvm_vcpu *vcpu, bool vmload)
		return 1;
		}

		if (kvm_vcpu_map(vcpu, gpa_to_gfn(vmcb12_gpa), &map)) {
		kvm_inject_gp(vcpu, 0);
		return 1;
		}
		if (kvm_vcpu_map(vcpu, gpa_to_gfn(vmcb12_gpa), &map))
		return kvm_handle_memory_failure(vcpu, X86EMUL_IO_NEEDED, NULL);

		vmcb12 = map.hva;