linux-kernel - Re: [PATCH] KVM: x86: Disallow setting CPUID and/or feature MSRs if L2 is active

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aV7Be9k2KBEQCisT@google.com>
Date: Wed, 7 Jan 2026 12:26:35 -0800
From: Sean Christopherson <seanjc@...gle.com>
To: Yosry Ahmed <yosry.ahmed@...ux.dev>
Cc: Paolo Bonzini <pbonzini@...hat.com>, kvm@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Kevin Cheng <chengkev@...gle.com>
Subject: Re: [PATCH] KVM: x86: Disallow setting CPUID and/or feature MSRs if
 L2 is active

On Fri, Jan 02, 2026, Yosry Ahmed wrote:
> On Tue, Dec 30, 2025 at 12:56:41PM -0800, Sean Christopherson wrote:

> > diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
> > index fdab0ad49098..9084e0dfa15c 100644
> > --- a/arch/x86/kvm/x86.h
> > +++ b/arch/x86/kvm/x86.h
> > @@ -172,9 +172,9 @@ static inline void kvm_nested_vmexit_handle_ibrs(struct kvm_vcpu *vcpu)
> >  		indirect_branch_prediction_barrier();
> >  }
> >  
> > -static inline bool kvm_vcpu_has_run(struct kvm_vcpu *vcpu)
> > +static inline bool kvm_can_set_cpuid_and_feature_msrs(struct kvm_vcpu *vcpu)
> >  {
> > -	return vcpu->arch.last_vmentry_cpu != -1;
> > +	return vcpu->arch.last_vmentry_cpu == -1 && !is_guest_mode(vcpu);
> >  }
> 
> To make this self-contained (e.g. for readers not coming from
> kvm_set_cpuid()), should we add a comment here about is_guest_mode()
> only possibly being true with last_vmentry_cpu == -1 if userspace does
> the set CPUID, set nested state, set CPUID again dance?

Ya.  If this looks good, I'll add it when applying.

/*
 * Disallow modifying CPUID and feature MSRs, which affect the core virtual CPU
 * model exposed to the guest and virtualized by KVM, if the vCPU has already
 * run or is in guest mode (L2).  In both cases, KVM has already consumed the
 * current virtual CPU model, and doesn't support "unwinding" to react to the
 * new model.
 *
 * Note, the only way is_guest_mode() can be true with 'last_vmentry_cpu == -1'
 * is if userspace sets CPUID and feature MSRs (to enable VMX/SVM), then sets
 * nested state, and then attempts to set CPUID and/or feature MSRs *again*.
 */
static inline bool kvm_can_set_cpuid_and_feature_msrs(struct kvm_vcpu *vcpu)
{
	return vcpu->arch.last_vmentry_cpu == -1 && !is_guest_mode(vcpu);
}