[PATCH v2 6/6] KVM: selftests: Expect failure when trying to set EFER that violates vCPU model

From: Sean Christopherson

Date: Tue Oct 27 2026 - 18:49:46 EST


Adjust the EFER.LMSLE testcases to expect failure, not success, when
attempting to stuff EFER.LMSLE=1 even when the guest CPUID model is
configured with EFER_LMSLE_MBZ enabled, i.e. when it should be impossible
to set EFER.LMSLE=1. KVM's ABI is that userspace *must* set CPUID and
feature MSRs before restoring (or stuffing) vCPU state, i.e. before writing
normal MSRs. The previous KVM behavior of allowing usersepace to stuff
garbage was a KVM bug (that has since been fixed).

Reported-by: Sashiko Bot <sashiko-bot@xxxxxxxxxx>
Closes: https://lore.kernel.org/all/sashiko-outbox-182135@xxxxxxxxxx
Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
---
.../selftests/kvm/x86/svm_nested_efer_test.c | 20 ++++++-------------
1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/tools/testing/selftests/kvm/x86/svm_nested_efer_test.c b/tools/testing/selftests/kvm/x86/svm_nested_efer_test.c
index fa9cfe8b1242..bdec7cdb3714 100644
--- a/tools/testing/selftests/kvm/x86/svm_nested_efer_test.c
+++ b/tools/testing/selftests/kvm/x86/svm_nested_efer_test.c
@@ -193,23 +193,20 @@ static void test_host_initiated_lmsle(void)
struct kvm_vcpu *vcpu;
struct kvm_vm *vm;
u64 efer;
+ int r;

vm = vm_create_with_one_vcpu(&vcpu, NULL);
vcpu_set_cpuid_feature(vcpu, X86_FEATURE_EFER_LMSLE_MBZ);

- /*
- * EFER_LMSLE_MBZ is a guest CPUID consistency check, not a host
- * capability, i.e. must not be enforced against host-initiated writes,
- * so that userspace can set MSRs before it sets guest CPUID.
- */
efer = vcpu_get_msr(vcpu, MSR_EFER);
TEST_ASSERT(!(efer & EFER_LMSLE), "EFER.LMSLE unexpectedly set");

- vcpu_set_msr(vcpu, MSR_EFER, efer | EFER_LMSLE);
- TEST_ASSERT_EQ(vcpu_get_msr(vcpu, MSR_EFER), efer | EFER_LMSLE);
+ r = _vcpu_set_msr(vcpu, MSR_EFER, efer | EFER_LMSLE);
+ TEST_ASSERT_EQ(r, 0);
+ TEST_ASSERT_EQ(vcpu_get_msr(vcpu, MSR_EFER), efer);

kvm_vm_free(vm);
- ksft_test_result_pass("Host-initiated EFER.LMSLE=1 is allowed\n");
+ ksft_test_result_pass("KVM_SET_MSRS rejects EFER.LMSLE=1 with EFER_LMSLE_MBZ\n");
}

static void test_sregs_lmsle(void)
@@ -222,11 +219,6 @@ static void test_sregs_lmsle(void)
vm = vm_create_with_one_vcpu(&vcpu, NULL);
vcpu_set_cpuid_feature(vcpu, X86_FEATURE_EFER_LMSLE_MBZ);

- /*
- * Unlike KVM_SET_MSRS, KVM_SET_SREGS runs the full set of guest CPUID
- * checks, i.e. rejects EFER.LMSLE even though it's host-initiated.
- */
- vcpu_sregs_get(vcpu, &sregs);
TEST_ASSERT(!(sregs.efer & EFER_LMSLE), "EFER.LMSLE unexpectedly set");

sregs.efer |= EFER_LMSLE;
@@ -275,7 +267,7 @@ int main(int argc, char *argv[])
test_sregs_lmsle();
} else {
ksft_test_result_skip("Guest EFER_LMSLE_MBZ=0\n");
- ksft_test_result_skip("Host-initiated EFER.LMSLE=1 is allowed\n");
+ ksft_test_result_skip("KVM_SET_MSRS rejects EFER.LMSLE=1 with EFER_LMSLE_MBZ\n");
ksft_test_result_skip("KVM_SET_SREGS rejects EFER.LMSLE=1\n");
}

--
2.56.0.307.g5fe7bd680c-goog