Arm:

"This is a bit of an odd merge window on the KVM/arm64 front. There is
absolutely no new feature in the pull request. It is purely fixes,
because it is simply becoming too hard to review new stuff when so
many AI-fuelled fixes hit the list".

- Significant cleanup of the vgic-v5 PPI support which was merged in
  7.1. This makes the code more maintainable, and squashes a couple
  of bugs in the meantime.

- Set of fixes for the handling of the MMU in an NV context,
  particularly VNCR-triggered faults. S1POE support is fixed
  as well.

- Large set of pKVM fixes, mostly addressing recurring issues
  around hypervisor tracking of donated pages in obscure cases
  where the donation could fail and leave things in a bizarre
  state.

- Fixes for the so-called "lazy vgic init", which resulted in
  sleeping operations in non-preemptible sections. This turned
  out to be far more invasive than initially expected...

- Reduce the overhead of L1/L2 context switch by not touching
  the FP registers.

- Fix the way non-implemented page sizes are dealt with when
  a guest insist on using them for S2 translation.

- The usual set of low-impact fixes and cleanups all over the map.

Loongarch:

- On a request for lazy FPU load, load all FPU state that the VM
  supports instead of enabling only the part (FPU, LSX or LASX)
  that caused the FPU load request.

- Some enhancements about interrupt injection.

- Some bug fixes and other small changes.

RISC-V:

- Batch G-stage TLB flushes for GPA range based page table updates

- Convert HGEI line management to fully per-HART

- Fix missing CSR dirty marking when FWFT state updated via ONE_REG

- Fix stale FWFT feature exposure to Guest/VM

- Speed up dirty logging write faults using MMU rwlock and atomic
  PTE updates using cmpxchg() for permission-only changes

- Use flexible array for APLIC IRQ state

- Use kvm_slot_dirty_track_enabled() for logging enable check on
  a memslot

- Avoid skipping valid pages in kvm_riscv_gstage_wp_range()

- Avoid skipping valid pages in kvm_riscv_gstage_unmap_range()

- Use endian-specific __lelong for NACL shared memory

S390:

- KVM_PRE_FAULT_MEMORY support

- Support for 2G hugepages

- Support for the ASTFLEIE 2 facility

- Support for fast inject using kvm_arch_set_irq_inatomic

- Fix potential leak of uninitialized bytes

- A few more misc gmap fixes.

x86:

- Generic support for the more granular permissions allowed by EPT,
  namely "read" (which was previously usurping the U bit) and
  separate execution bits for kernel and userspace.

- Do not assume that all page tables start with U=1/W=1/NX=0 at the
  root, as AMD GMET needs to have U=0 at the root.

- Introduce common assembly macros for use within Intel and AMD
  vendor-specific vmentry code.  This touches the SPEC_CTRL handling,
  which is now entirely done in assembly for Intel (by reusing the
  AMD code that already existed), and register save/restore which
  uses some macro magic to compute the offsets in the struct.  Both
  of these are preparatory changes for upcoming APX support.

- Clean up KVM's register tracking and storage, primarily to prepare for
  APX support, which expands the maximum number of GPRs from 16 to 32.

- Keep a single copy of the PDPTRs rather than two, since architecturally
  there is just one.

- Handle EXIT_FASTPATH_EXIT_USERSPACE in vendor code to ensure vendor code
  gets a chance to handle things like reaping the PML buffer.

- Update KVM's view of PV async enabling if and only if the MSR write fully
  succeeds.

- Fix a variety of issues where the emulator doesn't honor guest-debug state,
  and clean up related code along the way.

- Synthesize EPT Violation and #NPF "error code" bits when injecting faults
  into L1 that didn't originate in hardware (in which case the VMCS/VMCB
  doesn't hold relevant information).

- Add support for virtualizing (well, emulating) AMD's flavor of CPL>0 CPUID
  faulting.

- Clean up the GPR APIs so that KVM's use of "raw" is consistent, and fix a
  variety of minor bugs along the way.

- Fix an OOB memory access due to not checking the VP ID when handling a
  Hyper-V PV TLB flush for L2.

- Fix a bug in the mediated PMU's handling of fixed counters that allowed the
  guest to bypass the PMU event filter.

- Allow userspace to return EAGAIN when handling SNP and TDX hypercalls, so
  the KVM can forward a "retry" status code to the guest, and reserve all
  unused error codes for future usage.

- Overhaul the TDP MMU => S-EPT code to move as much S-EPT specific logic as
  possible into the TDX code, and to funnel (almost) all S-EPT updates into
  a single chokepoint.  The motivation is largely to prepare for upcoming
  Dynamic PAMT support, but the cleanups are nice to have on their own.

- Plug a hole in shadow page table handling, where KVM fails to recursively
  zap nested EPT/NPT shadow page tables when the nested hypervisor tears
  down its own EPT/NPT page tables from the bottom up

x86 (Intel):

- Support for nested MBEC (Mode-Based Execute Control), see above in the
  generic section; also run with MBEC enabled even for non-nested mode.

- Use the kernel's "enum pg_level" in the TDX APIs instead of the TDX-Module's
  level definitions (which are 0-based).

- Rework the TDX memory APIs to not require/assume that guest memory is
  backed by "struct page" (in prepartion for guest_memfd hugepage support).

- Fix a largely benign bug where KVM TDX would incorrectly state it could
  emulate several x2APIC MSRs.

- Use the "safe" WRMSR API when proxying LBR MSR writes as the to-be-written
  value is guest controlled and completely unvalidated.

x86 (AMD):

- Support for nested GMET (Guest Mode Execution Trap), see above in the
  generic section; also run with GMET enabled even for non-nested mode.

- Fixes and minor cleanups to GHCB handling, on top of the earlier work
  already merged into 7.1-rc.

- Ensure KVM's copy of CR0 and CR3 are up-to-date prior to invoking
  fastpath handlers.

- Add support for virtualizing gPAT (KVM previously just used L1's PAT when
  running L2).

- Fix goofs where KVM mishandles side effects (e.g. single-step and PMC
  updates) when emulating VMRUN.

- Fix a variety of bugs in AVIC's handling of x2APIC MSR interception, most
  notably where KVM didn't disable interception of IRR, ISR, and TMR regs.

- Add support for virtualizing Host-Only/Guest-Only bits in the mediated PMU.

- Don't advertise support for unusable VM types, and account for VM types
  that are disabled by firmware, e.g. to mitigate security vulnerabilities.

- Rewrite the SEV {en,de}crypt debug ioctls as they were riddle with bugs and
  unnecessarily complicated, and add comprehensive tests.

- Clean up and deduplicate the SEV page pinning code.

- Fix minor goofs related to writing back CPUID information after firmware
  rejects a CPUID page for an SNP vCPU.

Generic:

- Rename invalidate_begin() to invalidate_start() throughout KVM to follow
  the kernel's nomenclature, e.g. for mmu_notifiers.

- Use guard() to cleanup up various KVM+VFIO flows.

- Minor cleanups.

guest_memfd:

- Return -EEXIST instead of -EINVAL if userspace attempts to bind a gmem
  range to multiple memslots, and fix the test that was supposed to ensure
  KVM returns -EEXIST.

- Treat memslot binding offsets and sizes as unsigned values to fix a bug
  where KVM interprets a large "offset + size" as a negative value and allows
  a nonsensical offset.

- Use the inode number instead of the page offset for the NUMA interleaving
  index to fix a bug where the effective index would jump by two for
  consecutive pages (the caller also adds in the page offset).

Selftests:

- Randomize the dirty log test's delay when reaping the bitmap on the first
  pass, as always waiting only 1ms hid a KVM RISC-V bug as the test reaped the
  bitmap before KVM could build up enough state to hit the bug.

- A pile of one-off fixes and cleanups.

KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level

When recovering hugepages in the shadow MMU, verify that the base gfn of
the shadow page is actually contained within the target memslot, *before*
querying the max mapping level given the shadow page's gfn.  Failure to
pre-check the validity of the gfn can lead to an out-of-bounds access to
the slot's lpage_info (which typically manifests as a host #PF because the
lpage_info is vmalloc'd) if the guest creates a hugepage mapping (in its
PTEs) that extends "below" the bounds of a memslot.

When faulting in memory for a guest, and the size of the guest mapping is
greater than KVM's (current) max mapping, then KVM will create a "direct"
shadow page (direct in that there are no gPTEs to shadow, and so the target
gfn is a direct calculation given the base gfn of the shadow page).  The
hugepage recovery flow looks for such direct shadow pages, as forcing 4KiB
mappings when dirty logging generates the guest > host mapping size case.
When the 4KiB restriction is lifted, then KVM can replace the shadow page
with a hugepage.

But if KVM originally used a smaller mapping than the guest because the
range of memory covered by the guest hugepage exceeds the bounds of a
memslot, then KVM will link a direct shadow page with a gfn that is outside
the bounds of the memslot being used to fault in memory.  The rmap entry
added for the leaf mapping is correct and within bounds, but the gfn of the
leaf SPTE's parent shadow page will be out of bounds.

  BUG: unable to handle page fault for address: ffffc90000806ffc
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 100000067 P4D 100000067 PUD 1002a7067 PMD 10612f067 PTE 0
  Oops: Oops: 0000 [#1] SMP
  CPU: 13 UID: 1000 PID: 757 Comm: mmu_stress_test Not tainted 7.1.0-rc1-48ce1e26eace-x86_pir_to_irr_comments-vm #341 PREEMPT
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:kvm_mmu_max_mapping_level+0x79/0x2b0 [kvm]
  Call Trace:
   <TASK>
   kvm_mmu_recover_huge_pages+0x21b/0x320 [kvm]
   kvm_set_memslot+0x1ee/0x590 [kvm]
   kvm_set_memory_region.part.0+0x3a1/0x4d0 [kvm]
   kvm_vm_ioctl+0x9bf/0x15d0 [kvm]
   __x64_sys_ioctl+0x8a/0xd0
   do_syscall_64+0xb7/0xbb0
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
  RIP: 0033:0x7f21c0f1a9bf
   </TASK>

Don't bother pre-checking the bounds of the potential hugepage, i.e. don't
check that e.g. sp->gfn + KVM_PAGES_PER_HPAGE(sp->role.level + 1) is also
within the memslot, as the checks performed by kvm_mmu_max_mapping_level()
are a superset of the basic bounds checks.  I.e. pre-checking the full
range would be a dubious micro-optimization.

Fixes: 9eba50f8d7fc ("KVM: x86/mmu: Consult max mapping level when zapping collapsible SPTEs")
Cc: stable@vger.kernel.org
Cc: David Matlack <dmatlack@google.com>
Cc: James Houghton <jthoughton@google.com>
Cc: Alexander Bulekov <bkov@amazon.com>
Cc: Fred Griffoul <fgriffo@amazon.co.uk>
Cc: Alexander Graf <graf@amazon.de>
Cc: David Woodhouse <dwmw@amazon.co.uk>
Cc: Filippo Sironi <sironi@amazon.de>
Cc: Ivan Orlov <iorlov@amazon.co.uk>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>