KVM: x86: Ignore cpuid faulting in SMM

[PATCH] KVM: x86: Ignore cpuid faulting in SMM

Posted by Jim Mattson 1 month, 2 weeks ago

The Intel Virtualization Technology FlexMigration Application Note says,
"When CPUID faulting is enabled, all executions of the CPUID instruction
outside system-management mode (SMM) cause a general-protection exception
(#GP(0)) if the current privilege level (CPL) is greater than 0."

Always allow the execution of CPUID in SMM.

Fixes: db2336a80489 ("KVM: x86: virtualize cpuid faulting")
Signed-off-by: Jim Mattson <jmattson@google.com>
---
 arch/x86/kvm/cpuid.c   | 3 ++-
 arch/x86/kvm/emulate.c | 6 +++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 7fe4e58a6ebf..863ce81023e9 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -2157,7 +2157,8 @@ int kvm_emulate_cpuid(struct kvm_vcpu *vcpu)
 {
 	u32 eax, ebx, ecx, edx;
 
-	if (cpuid_fault_enabled(vcpu) && !kvm_require_cpl(vcpu, 0))
+	if (!is_smm(vcpu) && cpuid_fault_enabled(vcpu) &&
+	    !kvm_require_cpl(vcpu, 0))
 		return 1;
 
 	eax = kvm_rax_read(vcpu);
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index c8e292e9a24d..4b7289a82bf8 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -3583,10 +3583,10 @@ static int em_cpuid(struct x86_emulate_ctxt *ctxt)
 	u64 msr = 0;
 
 	ctxt->ops->get_msr(ctxt, MSR_MISC_FEATURES_ENABLES, &msr);
-	if (msr & MSR_MISC_FEATURES_ENABLES_CPUID_FAULT &&
-	    ctxt->ops->cpl(ctxt)) {
+	if (!ctxt->ops->is_smm(ctxt) &&
+	    (msr & MSR_MISC_FEATURES_ENABLES_CPUID_FAULT &&
+	     ctxt->ops->cpl(ctxt)))
 		return emulate_gp(ctxt, 0);
-	}
 
 	eax = reg_read(ctxt, VCPU_REGS_RAX);
 	ecx = reg_read(ctxt, VCPU_REGS_RCX);
-- 
2.53.0.239.g8d8fc8a987-goog

Re: [PATCH] KVM: x86: Ignore cpuid faulting in SMM

Posted by Sean Christopherson 3 weeks, 6 days ago

On Tue, 10 Feb 2026 15:45:42 -0800, Jim Mattson wrote:
> The Intel Virtualization Technology FlexMigration Application Note says,
> "When CPUID faulting is enabled, all executions of the CPUID instruction
> outside system-management mode (SMM) cause a general-protection exception
> (#GP(0)) if the current privilege level (CPL) is greater than 0."
> 
> Always allow the execution of CPUID in SMM.
> 
> [...]

Applied to kvm-x86 misc, thanks!

[1/1] KVM: x86: Ignore cpuid faulting in SMM
      https://github.com/kvm-x86/linux/commit/690dc03859e7

--
https://github.com/kvm-x86/linux/tree/next

Re: [PATCH] KVM: x86: Ignore cpuid faulting in SMM

Posted by Sean Christopherson 1 month ago

On Tue, Feb 10, 2026, Jim Mattson wrote:
> The Intel Virtualization Technology FlexMigration Application Note says,
> "When CPUID faulting is enabled, all executions of the CPUID instruction
> outside system-management mode (SMM) cause a general-protection exception
> (#GP(0)) if the current privilege level (CPL) is greater than 0."
> 
> Always allow the execution of CPUID in SMM.
> 
> Fixes: db2336a80489 ("KVM: x86: virtualize cpuid faulting")

I feel like we need a Technically-fixes-but-really-just-a-bad-spec tag for things
like this.  MISC_ENABLES and MSR_K7_HWCR in particular are a bizarre game of
"Hold my beer!".

> Signed-off-by: Jim Mattson <jmattson@google.com>
> ---
>  arch/x86/kvm/cpuid.c   | 3 ++-
>  arch/x86/kvm/emulate.c | 6 +++---
>  2 files changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> index 7fe4e58a6ebf..863ce81023e9 100644
> --- a/arch/x86/kvm/cpuid.c
> +++ b/arch/x86/kvm/cpuid.c
> @@ -2157,7 +2157,8 @@ int kvm_emulate_cpuid(struct kvm_vcpu *vcpu)
>  {
>  	u32 eax, ebx, ecx, edx;
>  
> -	if (cpuid_fault_enabled(vcpu) && !kvm_require_cpl(vcpu, 0))
> +	if (!is_smm(vcpu) && cpuid_fault_enabled(vcpu) &&
> +	    !kvm_require_cpl(vcpu, 0))
>  		return 1;
>  
>  	eax = kvm_rax_read(vcpu);
> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> index c8e292e9a24d..4b7289a82bf8 100644
> --- a/arch/x86/kvm/emulate.c
> +++ b/arch/x86/kvm/emulate.c
> @@ -3583,10 +3583,10 @@ static int em_cpuid(struct x86_emulate_ctxt *ctxt)
>  	u64 msr = 0;
>  
>  	ctxt->ops->get_msr(ctxt, MSR_MISC_FEATURES_ENABLES, &msr);
> -	if (msr & MSR_MISC_FEATURES_ENABLES_CPUID_FAULT &&
> -	    ctxt->ops->cpl(ctxt)) {
> +	if (!ctxt->ops->is_smm(ctxt) &&
> +	    (msr & MSR_MISC_FEATURES_ENABLES_CPUID_FAULT &&
> +	     ctxt->ops->cpl(ctxt)))

I assume you intended the parentheses to wrap the bitwise-AND.  I'll fixup to
this when applying.

	if (!ctxt->ops->is_smm(ctxt) &&
	    (msr & MSR_MISC_FEATURES_ENABLES_CPUID_FAULT) &&
	    ctxt->ops->cpl(ctxt))

Re: [PATCH] KVM: x86: Ignore cpuid faulting in SMM

Posted by Jim Mattson 1 month ago

On Mon, Mar 2, 2026 at 2:46 PM Sean Christopherson <seanjc@google.com> wrote:


> > --- a/arch/x86/kvm/emulate.c
> > +++ b/arch/x86/kvm/emulate.c
> > @@ -3583,10 +3583,10 @@ static int em_cpuid(struct x86_emulate_ctxt *ctxt)
> >       u64 msr = 0;
> >
> >       ctxt->ops->get_msr(ctxt, MSR_MISC_FEATURES_ENABLES, &msr);
> > -     if (msr & MSR_MISC_FEATURES_ENABLES_CPUID_FAULT &&
> > -         ctxt->ops->cpl(ctxt)) {
> > +     if (!ctxt->ops->is_smm(ctxt) &&
> > +         (msr & MSR_MISC_FEATURES_ENABLES_CPUID_FAULT &&
> > +          ctxt->ops->cpl(ctxt)))
>
> I assume you intended the parentheses to wrap the bitwise-AND.  I'll fixup to
> this when applying.
>
>         if (!ctxt->ops->is_smm(ctxt) &&
>             (msr & MSR_MISC_FEATURES_ENABLES_CPUID_FAULT) &&
>             ctxt->ops->cpl(ctxt))

Yes, thanks. /facepalm