Re: [PATCH v3 05/12] KVM: x86: Serialize writes to disabled_quirks using kvm->lock

[Michael Roth]

On Tue, Jun 30, 2026 at 03:26:00PM -0700, Sean Christopherson wrote:
> Protect writes to disabled_quirks with kvm->lock to ensure KVM doesn't
> clobber state in the unlikely scenario that userspace disables disparate
> quirks from multiple tasks.  More importantly, this will allow wrapping
> accesses with {READ,WRITE}_ONCE without "needing" to also guard the writer
> with a useless and confusing READ_ONCE (since the RMW wouldn't be atomic
> anyways).
> 
> Ideally, KVM would disallow disabling quirks once quirks are "live", but
> that would be a potentially breaking userspace ABI change, and while all
> existing quirks are fully live only after vCPUs have been created, several
> MMU-related quirks, IGNORE_GUEST_PAT and SLOT_ZAP_ALL, are partially live
> at all times.  Because populating MMUs requires a vCPU, the guest-visible
> behavior of IGNORE_GUEST_PAT and SLOT_ZAP_ALL requires a vCPU, but for KVM
> itself, processing the quirk (or not) has functional impact, i.e. for all
> intents and purposes, KVM can't prevent those quirks from being disabled
> after they've been consumed.
> 
> Cc: stable@xxxxxxxxxxxxxxx # 6.12.x
> Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>

Reviewed-by: Michael Roth <michael.roth@xxxxxxx>

> ---
>  arch/x86/kvm/x86.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 6b9a1b0b1460..74f1d7169218 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -3939,7 +3939,9 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm,
>  			break;
>  		fallthrough;
>  	case KVM_CAP_DISABLE_QUIRKS:
> +		mutex_lock(&kvm->lock);
>  		kvm->arch.disabled_quirks |= cap->args[0] & kvm_caps.supported_quirks;
> +		mutex_unlock(&kvm->lock);
>  		r = 0;
>  		break;
>  	case KVM_CAP_SPLIT_IRQCHIP: {
> -- 
> 2.55.0.rc0.799.gd6f94ed593-goog
>