On Thu, May 14, 2026, Jim Mattson wrote:
> > diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
> > index 95d09ccbf951..fc96ba86c644 100644
> > --- a/arch/x86/kvm/cpuid.h
> > +++ b/arch/x86/kvm/cpuid.h
> > @@ -185,8 +185,9 @@ static inline int guest_cpuid_stepping(struct kvm_vcpu
> > *vcpu)
> >
> > static inline bool cpuid_fault_enabled(struct kvm_vcpu *vcpu)
> > {
> > - return vcpu->arch.msr_misc_features_enables &
> > - MSR_MISC_FEATURES_ENABLES_CPUID_FAULT;
> > + return (vcpu->arch.msr_misc_features_enables &
> > + MSR_MISC_FEATURES_ENABLES_CPUID_FAULT) ||
> > + (vcpu->arch.msr_hwcr & MSR_K7_HWCR_CPUID_USER_DIS);
> > }
>
> Sashiko raises a good point here about a pre-existing issue that
Calling this pre-existing is a bit of a stretch. I'm guessing VMX doesn't check
the #GP before the VM-Exit (checking #GP before a VM-Exit is so stupid).
Yes, KVM technically emulates MSR_MISC_FEATURES_ENABLES_CPUID_FAULT for AMD, but
we're firmly in "making shit up" territory when reasoning about the interactions
between SVM and a feature that doesn't exist on real AMD CPUs.
> probably warrants a fix before propagating it further:
>
> > Does this emulation of CPUID faulting respect architectural fault
> > priorities in a nested virtualization scenario?
> >
> > According to the AMD APM, if CPUID faulting is enabled, a #GP fault takes
> > precedence over a CPUID VM-exit intercept.
Where in the APM? I can't find anything in the description of CPUID or
CpuidUserDis
that specifies the priority, and "Table 15-7. Instruction Intercepts" is flat
out
wrong because it just says:
CPUID CPUID No exceptions to check.
> > Because KVM emulates CPUID faulting in kvm_emulate_cpuid(), the fault check
> > happens after nested VM-exit intercept checks. If an L1 hypervisor enables
> > both CPUID faulting and a CPUID VM-exit intercept, L0's nested exit
> > handlers will observe L1's intercept request and immediately reflect the
> > VM-exit to L1.
> >
> > Since this reflection happens before evaluating kvm_emulate_cpuid(), does
> > this allow L2 guests to completely bypass the CPUID faulting restrictions
> > imposed by L1?
