Re: [PATCH 3/4] KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0

[Yosry Ahmed]

On Wed, Aug 26, 2026 at 2:18 PM Sean Christopherson <seanjc@xxxxxxxxxx> wrote:
>
> Bug the VM if KVM attempts to construct a CPU role with the should-be-
> impossible combination of long mode being active without PAE paging being
> enabled.  KVM's MMU construction assumes that EFER.LMA can be set if and
> only CR4.PAE is set, and will create a completely invalid MMU if that
> assumption fails.  FNAME(walk_addr_generic) already has sanity checks to
> try and mitigate the fallout, but attempt to catch such bugs earlier, as
> this is (at least) the second time KVM has had bugs that escaped into
> FNAME(walk_addr_generic), and it's entirely possible the bad state could
> cause problems elsewhere.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
> ---
>  arch/x86/kvm/mmu/mmu.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index 064ecc33b926..81c30e2c74f3 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -5910,6 +5910,9 @@ static union kvm_cpu_role kvm_calc_cpu_role(struct kvm_vcpu *vcpu,
>                 return role;
>         }
>
> +       if (KVM_BUG_ON(____is_efer_lma(regs) && !____is_cr4_pae(regs), vcpu->kvm))

Can we shove this into the existing if (____is_efer_lma(regs)) below?

> +               *(u64 *)&regs->efer &= ~EFER_LMA;

Why do this if we will crash the VM anyway (and Sashiko doesn't like it)?

> +
>         role.base.efer_nx = ____is_efer_nx(regs);
>         role.base.cr0_wp = ____is_cr0_wp(regs);
>         role.base.cr4_smep = ____is_cr4_smep(regs);
> --
> 2.55.0.887.g758fc8c411-goog
>