linux-kernel - Re: [PATCH] KVM: x86: synthesize TSA CPUID bits via SCATTERED

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e19b9666-b224-4fbd-92c9-82c712916a07@suse.de>
Date: Mon, 9 Feb 2026 12:40:03 +0100
From: Carlos López <clopez@...e.de>
To: Jim Mattson <jmattson@...gle.com>, Borislav Petkov <bp@...en8.de>
Cc: seanjc@...gle.com, kvm@...r.kernel.org,
 Paolo Bonzini <pbonzini@...hat.com>, Thomas Gleixner <tglx@...nel.org>,
 Ingo Molnar <mingo@...hat.com>, Dave Hansen <dave.hansen@...ux.intel.com>,
 "maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86@...nel.org>,
 "H. Peter Anvin" <hpa@...or.com>,
 "open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)"
 <linux-kernel@...r.kernel.org>, Babu Moger <bmoger@....com>
Subject: Re: [PATCH] KVM: x86: synthesize TSA CPUID bits via SCATTERED_F()

Hi,

On 2/9/26 6:48 AM, Jim Mattson wrote:
> On Sun, Feb 8, 2026 at 1:14 PM Borislav Petkov <bp@...en8.de> wrote:
>>
>> On Sun, Feb 08, 2026 at 12:50:18PM -0800, Jim Mattson wrote:
>>>> /*
>>>>  * Synthesized Feature - For features that are synthesized into boot_cpu_data,
>>>>  * i.e. may not be present in the raw CPUID, but can still be advertised to
>>>>  * userspace.  Primarily used for mitigation related feature flags.
>>>>                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>>>>  */
>>>> #define SYNTHESIZED_F(name)
>>>>
>>>>> +             SCATTERED_F(TSA_SQ_NO),
>>>>> +             SCATTERED_F(TSA_L1_NO),
>>>>
>>>> And scattered are of the same type.
>>>>
>>>> Sean, what's the subtle difference here?
>>>
>>> SYNTHESIZED_F() sets the bit unconditionally. SCATTERED_F() propagates
>>> the bit (if set) from the host's cpufeature flags.
>>
>> Yah, and I was hinting at the scarce documentation.
>>
>> SYNTHESIZED_F() is "Primarily used for mitigation related feature flags."
>> SCATTERED_F() is "For features that are scattered by cpufeatures.h."
> 
> Ugh. I have to rescind my Reviewed-by. IIUC, SCATTERED_F() implies a
> logical and with hardware CPUID, which means that the current proposal
> will never set the ITS_NO bits.

Right, I see what you mean now. SCATTERED_F() will set kvm_cpu_caps
correctly, but then this will clear the bits, because
kvm_cpu_cap_synthesized is now 0:

    kvm_cpu_caps[leaf] &= (raw_cpuid_get(cpuid) |
        kvm_cpu_cap_synthesized);

So to me it seems like SYNTHESIZED_F() is just wrong, since it always
enables bits for KVM-only leafs. So how about the following (I think
Binbin Wu suggests this in his other email):

diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 819c176e02ff..5e863e213f54 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -769,7 +769,8 @@ do {                                                                        \
  */
 #define SYNTHESIZED_F(name)                                    \
 ({                                                             \
-       kvm_cpu_cap_synthesized |= feature_bit(name);           \
+       if (boot_cpu_has(X86_FEATURE_##name))                   \
+               kvm_cpu_cap_synthesized |= feature_bit(name);           \
        F(name);                                                \
 })