Add a flag to track when KVM is actively configuring its CPU caps, and
WARN if a cap is set or cleared if KVM isn't in its configuration stage.
Modifying CPU caps after {svm,vmx}_set_cpu_caps() can be fatal to KVM, as
vendor setup code expects the CPU caps to be frozen at that point, e.g.
will do additional configuration based on the caps.
Rename kvm_set_cpu_caps() to kvm_initialize_cpu_caps() to pair with the
new "finalize", and to make it more obvious that KVM's CPU caps aren't
fully configured within the function.
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
arch/x86/kvm/cpuid.c | 10 ++++++++--
arch/x86/kvm/cpuid.h | 12 +++++++++++-
arch/x86/kvm/svm/svm.c | 4 +++-
arch/x86/kvm/vmx/vmx.c | 4 +++-
4 files changed, 25 insertions(+), 5 deletions(-)
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 575244af9c9f..7fe4e58a6ebf 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -36,6 +36,9 @@
u32 kvm_cpu_caps[NR_KVM_CPU_CAPS] __read_mostly;
EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_cpu_caps);
+bool kvm_is_configuring_cpu_caps __read_mostly;
+EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_is_configuring_cpu_caps);
+
struct cpuid_xstate_sizes {
u32 eax;
u32 ebx;
@@ -826,10 +829,13 @@ do { \
/* DS is defined by ptrace-abi.h on 32-bit builds. */
#undef DS
-void kvm_set_cpu_caps(void)
+void kvm_initialize_cpu_caps(void)
{
memset(kvm_cpu_caps, 0, sizeof(kvm_cpu_caps));
+ WARN_ON_ONCE(kvm_is_configuring_cpu_caps);
+ kvm_is_configuring_cpu_caps = true;
+
BUILD_BUG_ON(sizeof(kvm_cpu_caps) - (NKVMCAPINTS * sizeof(*kvm_cpu_caps)) >
sizeof(boot_cpu_data.x86_capability));
@@ -1289,7 +1295,7 @@ void kvm_set_cpu_caps(void)
kvm_cpu_cap_clear(X86_FEATURE_RDPID);
}
}
-EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_set_cpu_caps);
+EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_initialize_cpu_caps);
#undef F
#undef SCATTERED_F
diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
index d3f5ae15a7ca..039b8e6f40ba 100644
--- a/arch/x86/kvm/cpuid.h
+++ b/arch/x86/kvm/cpuid.h
@@ -8,7 +8,15 @@
#include <uapi/asm/kvm_para.h>
extern u32 kvm_cpu_caps[NR_KVM_CPU_CAPS] __read_mostly;
-void kvm_set_cpu_caps(void);
+extern bool kvm_is_configuring_cpu_caps __read_mostly;
+
+void kvm_initialize_cpu_caps(void);
+
+static inline void kvm_finalize_cpu_caps(void)
+{
+ WARN_ON_ONCE(!kvm_is_configuring_cpu_caps);
+ kvm_is_configuring_cpu_caps = false;
+}
void kvm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu);
struct kvm_cpuid_entry2 *kvm_find_cpuid_entry2(struct kvm_cpuid_entry2 *entries,
@@ -188,6 +196,7 @@ static __always_inline void kvm_cpu_cap_clear(unsigned int x86_feature)
{
unsigned int x86_leaf = __feature_leaf(x86_feature);
+ WARN_ON_ONCE(!kvm_is_configuring_cpu_caps);
kvm_cpu_caps[x86_leaf] &= ~__feature_bit(x86_feature);
}
@@ -195,6 +204,7 @@ static __always_inline void kvm_cpu_cap_set(unsigned int x86_feature)
{
unsigned int x86_leaf = __feature_leaf(x86_feature);
+ WARN_ON_ONCE(!kvm_is_configuring_cpu_caps);
kvm_cpu_caps[x86_leaf] |= __feature_bit(x86_feature);
}
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index c00a696dacfc..5f0136dbdde6 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -5305,7 +5305,7 @@ static __init void svm_adjust_mmio_mask(void)
static __init void svm_set_cpu_caps(void)
{
- kvm_set_cpu_caps();
+ kvm_initialize_cpu_caps();
kvm_caps.supported_perf_cap = 0;
@@ -5389,6 +5389,8 @@ static __init void svm_set_cpu_caps(void)
kvm_cpu_cap_clear(X86_FEATURE_MSR_IMM);
kvm_setup_xss_caps();
+
+ kvm_finalize_cpu_caps();
}
static __init int svm_hardware_setup(void)
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 9f85c3829890..93ec1e6181e4 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -8173,7 +8173,7 @@ static __init u64 vmx_get_perf_capabilities(void)
static __init void vmx_set_cpu_caps(void)
{
- kvm_set_cpu_caps();
+ kvm_initialize_cpu_caps();
/* CPUID 0x1 */
if (nested)
@@ -8232,6 +8232,8 @@ static __init void vmx_set_cpu_caps(void)
}
kvm_setup_xss_caps();
+
+ kvm_finalize_cpu_caps();
}
static bool vmx_is_io_intercepted(struct kvm_vcpu *vcpu,
--
2.52.0.457.g6b5491de43-goog
On 1/28/2026 9:43 AM, Sean Christopherson wrote:
> Add a flag to track when KVM is actively configuring its CPU caps, and
> WARN if a cap is set or cleared if KVM isn't in its configuration stage.
> Modifying CPU caps after {svm,vmx}_set_cpu_caps() can be fatal to KVM, as
> vendor setup code expects the CPU caps to be frozen at that point, e.g.
> will do additional configuration based on the caps.
>
> Rename kvm_set_cpu_caps() to kvm_initialize_cpu_caps() to pair with the
> new "finalize", and to make it more obvious that KVM's CPU caps aren't
> fully configured within the function.
>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> ---
> arch/x86/kvm/cpuid.c | 10 ++++++++--
> arch/x86/kvm/cpuid.h | 12 +++++++++++-
> arch/x86/kvm/svm/svm.c | 4 +++-
> arch/x86/kvm/vmx/vmx.c | 4 +++-
> 4 files changed, 25 insertions(+), 5 deletions(-)
>
> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> index 575244af9c9f..7fe4e58a6ebf 100644
> --- a/arch/x86/kvm/cpuid.c
> +++ b/arch/x86/kvm/cpuid.c
> @@ -36,6 +36,9 @@
> u32 kvm_cpu_caps[NR_KVM_CPU_CAPS] __read_mostly;
> EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_cpu_caps);
>
> +bool kvm_is_configuring_cpu_caps __read_mostly;
> +EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_is_configuring_cpu_caps);
> +
> struct cpuid_xstate_sizes {
> u32 eax;
> u32 ebx;
> @@ -826,10 +829,13 @@ do { \
> /* DS is defined by ptrace-abi.h on 32-bit builds. */
> #undef DS
>
> -void kvm_set_cpu_caps(void)
> +void kvm_initialize_cpu_caps(void)
> {
> memset(kvm_cpu_caps, 0, sizeof(kvm_cpu_caps));
>
> + WARN_ON_ONCE(kvm_is_configuring_cpu_caps);
> + kvm_is_configuring_cpu_caps = true;
> +
> BUILD_BUG_ON(sizeof(kvm_cpu_caps) - (NKVMCAPINTS * sizeof(*kvm_cpu_caps)) >
> sizeof(boot_cpu_data.x86_capability));
>
> @@ -1289,7 +1295,7 @@ void kvm_set_cpu_caps(void)
> kvm_cpu_cap_clear(X86_FEATURE_RDPID);
> }
> }
> -EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_set_cpu_caps);
> +EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_initialize_cpu_caps);
>
> #undef F
> #undef SCATTERED_F
> diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
> index d3f5ae15a7ca..039b8e6f40ba 100644
> --- a/arch/x86/kvm/cpuid.h
> +++ b/arch/x86/kvm/cpuid.h
> @@ -8,7 +8,15 @@
> #include <uapi/asm/kvm_para.h>
>
> extern u32 kvm_cpu_caps[NR_KVM_CPU_CAPS] __read_mostly;
> -void kvm_set_cpu_caps(void);
> +extern bool kvm_is_configuring_cpu_caps __read_mostly;
> +
> +void kvm_initialize_cpu_caps(void);
> +
> +static inline void kvm_finalize_cpu_caps(void)
> +{
> + WARN_ON_ONCE(!kvm_is_configuring_cpu_caps);
> + kvm_is_configuring_cpu_caps = false;
> +}
>
> void kvm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu);
> struct kvm_cpuid_entry2 *kvm_find_cpuid_entry2(struct kvm_cpuid_entry2 *entries,
> @@ -188,6 +196,7 @@ static __always_inline void kvm_cpu_cap_clear(unsigned int x86_feature)
> {
> unsigned int x86_leaf = __feature_leaf(x86_feature);
>
> + WARN_ON_ONCE(!kvm_is_configuring_cpu_caps);
> kvm_cpu_caps[x86_leaf] &= ~__feature_bit(x86_feature);
> }
>
> @@ -195,6 +204,7 @@ static __always_inline void kvm_cpu_cap_set(unsigned int x86_feature)
> {
> unsigned int x86_leaf = __feature_leaf(x86_feature);
>
> + WARN_ON_ONCE(!kvm_is_configuring_cpu_caps);
> kvm_cpu_caps[x86_leaf] |= __feature_bit(x86_feature);
> }
>
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index c00a696dacfc..5f0136dbdde6 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -5305,7 +5305,7 @@ static __init void svm_adjust_mmio_mask(void)
>
> static __init void svm_set_cpu_caps(void)
> {
> - kvm_set_cpu_caps();
> + kvm_initialize_cpu_caps();
>
> kvm_caps.supported_perf_cap = 0;
>
> @@ -5389,6 +5389,8 @@ static __init void svm_set_cpu_caps(void)
> kvm_cpu_cap_clear(X86_FEATURE_MSR_IMM);
>
> kvm_setup_xss_caps();
> +
> + kvm_finalize_cpu_caps();
> }
>
> static __init int svm_hardware_setup(void)
> diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> index 9f85c3829890..93ec1e6181e4 100644
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -8173,7 +8173,7 @@ static __init u64 vmx_get_perf_capabilities(void)
>
> static __init void vmx_set_cpu_caps(void)
> {
> - kvm_set_cpu_caps();
> + kvm_initialize_cpu_caps();
>
> /* CPUID 0x1 */
> if (nested)
> @@ -8232,6 +8232,8 @@ static __init void vmx_set_cpu_caps(void)
> }
>
> kvm_setup_xss_caps();
> +
> + kvm_finalize_cpu_caps();
> }
>
> static bool vmx_is_io_intercepted(struct kvm_vcpu *vcpu,
On 1/28/2026 9:43 AM, Sean Christopherson wrote:
> Add a flag to track when KVM is actively configuring its CPU caps, and
> WARN if a cap is set or cleared if KVM isn't in its configuration stage.
> Modifying CPU caps after {svm,vmx}_set_cpu_caps() can be fatal to KVM, as
> vendor setup code expects the CPU caps to be frozen at that point, e.g.
> will do additional configuration based on the caps.
>
> Rename kvm_set_cpu_caps() to kvm_initialize_cpu_caps() to pair with the
> new "finalize", and to make it more obvious that KVM's CPU caps aren't
> fully configured within the function.
>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> ---
> arch/x86/kvm/cpuid.c | 10 ++++++++--
> arch/x86/kvm/cpuid.h | 12 +++++++++++-
> arch/x86/kvm/svm/svm.c | 4 +++-
> arch/x86/kvm/vmx/vmx.c | 4 +++-
> 4 files changed, 25 insertions(+), 5 deletions(-)
>
> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> index 575244af9c9f..7fe4e58a6ebf 100644
> --- a/arch/x86/kvm/cpuid.c
> +++ b/arch/x86/kvm/cpuid.c
> @@ -36,6 +36,9 @@
> u32 kvm_cpu_caps[NR_KVM_CPU_CAPS] __read_mostly;
> EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_cpu_caps);
>
> +bool kvm_is_configuring_cpu_caps __read_mostly;
I prefer the name, kvm_cpu_caps_finalized. But not strongly, so
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
On Thu, Jan 29, 2026, Xiaoyao Li wrote:
> On 1/28/2026 9:43 AM, Sean Christopherson wrote:
> > Add a flag to track when KVM is actively configuring its CPU caps, and
> > WARN if a cap is set or cleared if KVM isn't in its configuration stage.
> > Modifying CPU caps after {svm,vmx}_set_cpu_caps() can be fatal to KVM, as
> > vendor setup code expects the CPU caps to be frozen at that point, e.g.
> > will do additional configuration based on the caps.
> >
> > Rename kvm_set_cpu_caps() to kvm_initialize_cpu_caps() to pair with the
> > new "finalize", and to make it more obvious that KVM's CPU caps aren't
> > fully configured within the function.
> >
> > Signed-off-by: Sean Christopherson <seanjc@google.com>
> > ---
> > arch/x86/kvm/cpuid.c | 10 ++++++++--
> > arch/x86/kvm/cpuid.h | 12 +++++++++++-
> > arch/x86/kvm/svm/svm.c | 4 +++-
> > arch/x86/kvm/vmx/vmx.c | 4 +++-
> > 4 files changed, 25 insertions(+), 5 deletions(-)
> >
> > diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> > index 575244af9c9f..7fe4e58a6ebf 100644
> > --- a/arch/x86/kvm/cpuid.c
> > +++ b/arch/x86/kvm/cpuid.c
> > @@ -36,6 +36,9 @@
> > u32 kvm_cpu_caps[NR_KVM_CPU_CAPS] __read_mostly;
> > EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_cpu_caps);
> > +bool kvm_is_configuring_cpu_caps __read_mostly;
>
> I prefer the name, kvm_cpu_caps_finalized. But not strongly, so
"finalized" reads too much like the helper queries if the caps are already
finalized, i.e. like an accessor.
On 1/29/2026 11:12 PM, Sean Christopherson wrote:
> On Thu, Jan 29, 2026, Xiaoyao Li wrote:
>> On 1/28/2026 9:43 AM, Sean Christopherson wrote:
>>> Add a flag to track when KVM is actively configuring its CPU caps, and
>>> WARN if a cap is set or cleared if KVM isn't in its configuration stage.
>>> Modifying CPU caps after {svm,vmx}_set_cpu_caps() can be fatal to KVM, as
>>> vendor setup code expects the CPU caps to be frozen at that point, e.g.
>>> will do additional configuration based on the caps.
>>>
>>> Rename kvm_set_cpu_caps() to kvm_initialize_cpu_caps() to pair with the
>>> new "finalize", and to make it more obvious that KVM's CPU caps aren't
>>> fully configured within the function.
>>>
>>> Signed-off-by: Sean Christopherson <seanjc@google.com>
>>> ---
>>> arch/x86/kvm/cpuid.c | 10 ++++++++--
>>> arch/x86/kvm/cpuid.h | 12 +++++++++++-
>>> arch/x86/kvm/svm/svm.c | 4 +++-
>>> arch/x86/kvm/vmx/vmx.c | 4 +++-
>>> 4 files changed, 25 insertions(+), 5 deletions(-)
>>>
>>> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
>>> index 575244af9c9f..7fe4e58a6ebf 100644
>>> --- a/arch/x86/kvm/cpuid.c
>>> +++ b/arch/x86/kvm/cpuid.c
>>> @@ -36,6 +36,9 @@
>>> u32 kvm_cpu_caps[NR_KVM_CPU_CAPS] __read_mostly;
>>> EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_cpu_caps);
>>> +bool kvm_is_configuring_cpu_caps __read_mostly;
>>
>> I prefer the name, kvm_cpu_caps_finalized. But not strongly, so
>
> "finalized" reads too much like the helper queries if the caps are already
> finalized, i.e. like an accessor.
And after a second thought, I find my preference is not good. Because it
only tells the end of allowed stage while kvm_is_configuring_cpu_caps
defines both the start and end.
So withdraw my preference.
© 2016 - 2026 Red Hat, Inc.