Re: [PATCH] KVM: x86: Disallow EFER.LMSLE when EferLmsleUnsupported is set in guest CPUID

[Sean Christopherson <seanjc@google.com>]

On Fri, Sep 18, 2026, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] kvm: x86: EFER.LMSLE fix is ineffective due to dropped CPUID bit
> --
> 
> commit 0daddb3cb6cd07afcd9545a8e1643427a1542393
> Author: Jim Mattson <jmattson@google.com>
> 
> KVM: x86: Disallow EFER.LMSLE when EferLmsleUnsupported is set in guest CPUID
> 
> This commit updates KVM to reject guest writes to EFER that set EFER.LMSLE
> when the EferLmsleUnsupported bit is set in the guest's CPUID. It aims to fix
> an issue where a guest could enable EFER.LMSLE on hosts that support it, even
> if the VMM hid the feature for migration compatibility.
> 
> > diff --git a/arch/x86/kvm/msrs.c b/arch/x86/kvm/msrs.c
> > index 37d5bed3529f5..c8f894ccfb0f9 100644
> > --- a/arch/x86/kvm/msrs.c
> > +++ b/arch/x86/kvm/msrs.c
> > @@ -598,8 +598,11 @@ static bool __kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer)
> >  	if (efer & EFER_NX && !guest_cpu_cap_has(vcpu, X86_FEATURE_NX))
> >  		return false;
> >  
> > -	return true;
> > +	if (efer & EFER_LMSLE &&
> > +	    guest_cpu_cap_has(vcpu, X86_FEATURE_EFER_LMSLE_MBZ))
> 
> [Severity: High]
> Does this check actually work as intended on hosts that support LMSLE?
>
> Because X86_FEATURE_EFER_LMSLE_MBZ is defined as a PASSTHROUGH_F,
> kvm_cpu_cap_init() clears this bit in kvm_cpu_caps when the host hardware
> CPUID does not set it (which is the case when the host supports LMSLE).
> 
> Since the bit is missing from kvm_cpu_caps and is not an EMULATED_F,
> kvm_set_cpuid() ANDs the VMM-provided CPUID with 0 for this capability.
> Consequently, vcpu->arch.cpu_caps does not retain the bit, and
> guest_cpu_cap_has() here will unconditionally return false.
> 
> Does this mean the bug remains triggerable by a guest running on a host with
> LMSLE support when the VMM attempts to hide the feature?

Gah, I hate the negative "feature" bits, I've gotten completely turned around
multiple times trying to sort through this.

IIUC, you're trying to "fix" setups where host CPUID.EFER_LMSLE_MBZ=0, but userspace
configured guest CPUID.EFER_LMSLE_MBZ=1?  If so, then Sashiko is right, it needs to
be declared with EMULATED_F().  I would even argue that technically this isn't a KVM
bug, because KVM won't advertise EFER_LMSLE_MBZ in KVM_GET_SUPPORTED_CPUID on such
hosts.