Re: [PATCH] KVM: x86: Disallow EFER.LMSLE when EferLmsleUnsupported is set in guest CPUID

[Sean Christopherson <seanjc@google.com>]

On Tue, Sep 22, 2026, Jim Mattson wrote:
> On Tue, Sep 22, 2026 at 7:26 AM Sean Christopherson <seanjc@google.com> wrote:
> >
> > On Tue, Sep 22, 2026, Jim Mattson wrote:
> > > On Tue, Sep 22, 2026 at 6:57 AM Sean Christopherson <seanjc@google.com> wrote:
> > > > Gah, I hate the negative "feature" bits, I've gotten completely turned around
> > > > multiple times trying to sort through this.
> > >
> > > Me too!
> > >
> > > > IIUC, you're trying to "fix" setups where host CPUID.EFER_LMSLE_MBZ=0, but userspace
> > > > configured guest CPUID.EFER_LMSLE_MBZ=1?  If so, then Sashiko is right, it needs to
> > > > be declared with EMULATED_F().  I would even argue that technically this isn't a KVM
> > > > bug, because KVM won't advertise EFER_LMSLE_MBZ in KVM_GET_SUPPORTED_CPUID on such
> > > > hosts.
>
> > > I'm trying to make it possible to run a Rome vCPU on Milan or later.
> > >
> > > SInce this is a negative feature bit, it must be retained if the host
> > > reports it. That blocks running a Rome vCPU on Milan or later.
> > > However, a defeatured Rome (which reports LMSLE_MBZ as 1) can be run
> >
> > So, a partially defeatured Rome?  Because it sounds like the CPU reports LMSLE_MBZ=1,
> > but then still allows setting EFER.LMSLE=1?
> 
> No; it should not allow setting EFER.LMSLE=1. That will fail on later
> platforms and would block live migration from Rome to later platforms.

Oh, drat, I misread the "Rome vCPU" vs. "defeatured Rome" paragraph.  You want to
be able to migrate a vCPU with guest.CPUID.LMSLE_MBZ=1 between a non-defeatured,
vanilla Rome and Milan+ (or a defeatured Rome).  Correct?

If so, then Sashiko is right, the flag needs to be EMULATED_F() so that KVM will
advertise EFER_LMSLE_MBZ to userspace on the vanilla Rome host, and also do the
right thing when guest.CPUID.EFER_LMSLE_MBZ=0.

If not correct, then I'm even more confused, because ignoring clear_cpuid,
guest_cpu_cap_has() will only ever return true if boot_cpu_has() also returns
true, in which case KVM *will* reject the value because EFER_LMSLE will not be
listed as a supported EFER bit.

		if (!boot_cpu_has(X86_FEATURE_EFER_LMSLE_MBZ))
			kvm_caps.supported_efer_bits |= EFER_LMSLE;

> I want KVM to abide by the guest CPUID bit and disallow setting
> EFER.LMSLE even on hardware that allows it.

Right, and that requires declaring EFER_LMSLE_MBZ with EMULATED_F().