Re: [PATCH] KVM: x86: synthesize TSA CPUID bits via SCATTERED_F()

[Carlos López]

Hi,

On 2/9/26 11:02 AM, Binbin Wu wrote:
> 
> 
> On 2/9/2026 12:42 AM, Carlos López wrote:
>> KVM incorrectly synthesizes TSA_SQ_NO and TSA_L1_NO when running
>> on AMD Family 19h CPUs by using SYNTHESIZED_F(), which unconditionally
>> enables features for KVM-only CPUID leaves (as is the case with
>> CPUID_8000_0021_ECX), regardless of the kernel's synthesis logic in
>> tsa_init(). This is due to the following logic in kvm_cpu_cap_init():
>>
>>     if (leaf < NCAPINTS)
>>         kvm_cpu_caps[leaf] &= kernel_cpu_caps[leaf];
> 
> Since TSA_SQ_NO and TSA_L1_NO are defined in CPUID_8000_0021_ECX, and
> CPUID_8000_0021_ECX > NCAPINTS, the code above doesn't take effect.

I should have explained it better, but that is precisely what I meant.
Since the &= never takes place, kvm_cpu_cap_features always has the bits
set. In other words: the branch always evaluates to false for KVM-only
CPUID leaves, so the bits are always set.

> The code makes the two bits set unconditionally is:
>     SYNTHESIZED_F() sets kvm_cpu_cap_synthesized
> and later
>     kvm_cpu_caps[leaf] &= (raw_cpuid_get(cpuid) |
>                            kvm_cpu_cap_synthesized);
> 
>>
>> This can cause an unexpected failure on Family 19h CPUs during SEV-SNP
>> guest setup, when userspace issues SNP_LAUNCH_UPDATE, as setting these
>> bits in the CPUID page on vulnerable CPUs is explicitly rejected by SNP
>> firmware.
>>
>> Switch to SCATTERED_F(), so that the bits are only set if the features
>> have been force-set by the kernel in tsa_init(), or if they are reported
>> in the raw CPUID.
> 
> When you switch to SCATTERED_F(), if the two bits are not in raw cpuid, the two
> bits will not be set to kvm_cpu_caps[CPUID_8000_0021_ECX], regardless the
> setting initialized in tsa_init().

Yes, I think you're right.

> TSA_SQ_NO and TSA_L1_NO are conditional kernel synthesis bits, should
> SYNTHESIZED_F() check that the related bit is actually synthesized into
> boot_cpu_data before setting to kvm_cpu_cap_synthesized?

Right, I thought this is what SCATTERED_F() already did, but I missed
that there is the logical AND with the raw CPUID later. See the diff in
my reply to Jim Mattson, I think that is what you propose as well.