AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies only KVM userspace selftests under tools/testing/selftests/kvm/ and does not touch any kernel code or affect the compiled kernel image.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit a25c298df4a95c574778634f7f6bdb18d1e71564\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Sep 10 13:34:57 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/tools/testing/selftests/kvm/include/x86/processor.h b/tools/testing/selftests/kvm/include/x86/processor.h\nindex 6e6f70035508a..df368232cf3e1 100644\n--- a/tools/testing/selftests/kvm/include/x86/processor.h\n+++ b/tools/testing/selftests/kvm/include/x86/processor.h\n@@ -23,6 +23,8 @@ extern bool host_cpu_is_intel;\n extern bool host_cpu_is_amd;\n extern bool host_cpu_is_hygon;\n extern bool host_cpu_is_amd_compatible;\n+extern bool host_cpu_is_zhaoxin;\n+extern bool host_cpu_is_intel_compatible;\n extern u64 guest_tsc_khz;\n extern struct kvm_mmu guest_mmu;\n \n@@ -782,6 +784,12 @@ static inline bool this_cpu_is_hygon(void)\n \treturn this_cpu_vendor_string_is(\"HygonGenuine\");\n }\n \n+static inline bool this_cpu_is_zhaoxin(void)\n+{\n+\treturn this_cpu_vendor_string_is(\"CentaurHauls\") ||\n+\t       this_cpu_vendor_string_is(\"  Shanghai  \");\n+}\n+\n static inline u32 __this_cpu_has(u32 function, u32 index, u8 reg, u8 lo, u8 hi)\n {\n \tu32 gprs[4];\n@@ -1446,7 +1454,7 @@ static inline bool kvm_is_pmu_enabled(void)\n \n static inline bool kvm_is_mediated_pmu_enabled(void)\n {\n-\tif (host_cpu_is_intel)\n+\tif (host_cpu_is_intel_compatible)\n \t\treturn get_kvm_intel_param_bool(\"enable_mediated_pmu\");\n \n \treturn get_kvm_amd_param_bool(\"enable_mediated_pmu\");\ndiff --git a/tools/testing/selftests/kvm/include/x86/vmx.h b/tools/testing/selftests/kvm/include/x86/vmx.h\nindex 04f5e34dea3ae..b196651bdea26 100644\n--- a/tools/testing/selftests/kvm/include/x86/vmx.h\n+++ b/tools/testing/selftests/kvm/include/x86/vmx.h\n@@ -557,6 +557,7 @@ bool load_vmcs(struct vmx_pages *vmx);\n bool ept_1g_pages_supported(void);\n \n bool kvm_cpu_has_ept(void);\n+bool kvm_cpu_has_vmx_apic_access_virt(void);\n void vm_enable_ept(struct kvm_vm *vm);\n void prepare_virtualize_apic_accesses(struct vmx_pages *vmx, struct kvm_vm *vm);\n \ndiff --git a/tools/testing/selftests/kvm/lib/x86/processor.c b/tools/testing/selftests/kvm/lib/x86/processor.c\nindex d31fa81ea0756..bd50c1265cefa 100644\n--- a/tools/testing/selftests/kvm/lib/x86/processor.c\n+++ b/tools/testing/selftests/kvm/lib/x86/processor.c\n@@ -26,6 +26,8 @@ bool host_cpu_is_amd;\n bool host_cpu_is_intel;\n bool host_cpu_is_hygon;\n bool host_cpu_is_amd_compatible;\n+bool host_cpu_is_zhaoxin;\n+bool host_cpu_is_intel_compatible;\n bool is_forced_emulation_enabled;\n u64 guest_tsc_khz;\n struct kvm_mmu guest_mmu;\n@@ -158,7 +160,7 @@ static void sregs_dump(FILE *stream, struct kvm_sregs *sregs, u8 indent)\n \n bool kvm_is_tdp_enabled(void)\n {\n-\tif (host_cpu_is_intel)\n+\tif (host_cpu_is_intel_compatible)\n \t\treturn get_kvm_intel_param_bool(\"ept\");\n \telse\n \t\treturn get_kvm_amd_param_bool(\"npt\");\n@@ -819,6 +821,8 @@ void kvm_arch_vm_post_create(struct kvm_vm *vm, unsigned int nr_vcpus)\n \tsync_global_to_guest(vm, host_cpu_is_amd);\n \tsync_global_to_guest(vm, host_cpu_is_hygon);\n \tsync_global_to_guest(vm, host_cpu_is_amd_compatible);\n+\tsync_global_to_guest(vm, host_cpu_is_zhaoxin);\n+\tsync_global_to_guest(vm, host_cpu_is_intel_compatible);\n \tsync_global_to_guest(vm, is_forced_emulation_enabled);\n \tsync_global_to_guest(vm, pmu_errata_mask);\n \n@@ -1444,6 +1448,8 @@ void kvm_selftest_arch_init(void)\n \thost_cpu_is_amd = this_cpu_is_amd();\n \thost_cpu_is_hygon = this_cpu_is_hygon();\n \thost_cpu_is_amd_compatible = host_cpu_is_amd || host_cpu_is_hygon;\n+\thost_cpu_is_zhaoxin = this_cpu_is_zhaoxin();\n+\thost_cpu_is_intel_compatible = host_cpu_is_intel || host_cpu_is_zhaoxin;\n \tis_forced_emulation_enabled = kvm_is_forced_emulation_enabled();\n \n \tkvm_init_pmu_errata();\ndiff --git a/tools/testing/selftests/kvm/lib/x86/vmx.c b/tools/testing/selftests/kvm/lib/x86/vmx.c\nindex 089e1a8af53fc..e512191f1eed7 100644\n--- a/tools/testing/selftests/kvm/lib/x86/vmx.c\n+++ b/tools/testing/selftests/kvm/lib/x86/vmx.c\n@@ -390,6 +390,21 @@ bool kvm_cpu_has_ept(void)\n \treturn ctrl \u0026 SECONDARY_EXEC_ENABLE_EPT;\n }\n \n+bool kvm_cpu_has_vmx_apic_access_virt(void)\n+{\n+\tu64 ctrl;\n+\n+\tif (!kvm_cpu_has(X86_FEATURE_VMX))\n+\t\treturn false;\n+\n+\tctrl = kvm_get_feature_msr(MSR_IA32_VMX_TRUE_PROCBASED_CTLS) \u003e\u003e 32;\n+\tif (!(ctrl \u0026 CPU_BASED_ACTIVATE_SECONDARY_CONTROLS))\n+\t\treturn false;\n+\n+\tctrl = kvm_get_feature_msr(MSR_IA32_VMX_PROCBASED_CTLS2) \u003e\u003e 32;\n+\treturn ctrl \u0026 SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;\n+}\n+\n void prepare_virtualize_apic_accesses(struct vmx_pages *vmx, struct kvm_vm *vm)\n {\n \tvmx-\u003eapic_access = (void *)vm_alloc_page(vm);\ndiff --git a/tools/testing/selftests/kvm/x86/feature_msrs_test.c b/tools/testing/selftests/kvm/x86/feature_msrs_test.c\nindex 1585507017718..bb339709d61d8 100644\n--- a/tools/testing/selftests/kvm/x86/feature_msrs_test.c\n+++ b/tools/testing/selftests/kvm/x86/feature_msrs_test.c\n@@ -54,12 +54,25 @@ static void test_feature_msr(u32 msr)\n \tif (is_kvm_controlled_msr(msr))\n \t\treturn;\n \n+\t/*\n+\t * KVM allows userspace to query MSR_IA32_PERF_CAPABILITIES as a\n+\t * feature MSR even if KVM doesn't expose PDCM, but vCPU accesses to\n+\t * the MSR will fail in that case. Skip the vCPU checks so that the\n+\t * remaining feature MSRs can be tested.\n+\t */\n+\tif (msr == MSR_IA32_PERF_CAPABILITIES \u0026\u0026\n+\t    !kvm_cpu_has(X86_FEATURE_PDCM)) {\n+\t\tprintf(\"KVM does not expose PDCM, skipping vCPU checks for \"\n+\t\t       \"MSR_IA32_PERF_CAPABILITIES (0x%x).\\n\", msr);\n+\t\treturn;\n+\t}\n+\n \t/*\n \t * More goofy behavior.  KVM reports the host CPU's actual revision ID,\n \t * but initializes the vCPU's revision ID to an arbitrary value.\n \t */\n \tif (msr == MSR_IA32_UCODE_REV)\n-\t\treset_value = host_cpu_is_intel ? 0x100000000ULL : 0x01000065;\n+\t\treset_value = host_cpu_is_intel_compatible ? 0x100000000ULL : 0x01000065;\n \n \t/*\n \t * For quirked MSRs, KVM's ABI is to initialize the vCPU's value to the\ndiff --git a/tools/testing/selftests/kvm/x86/fix_hypercall_test.c b/tools/testing/selftests/kvm/x86/fix_hypercall_test.c\nindex 4931ec22768ee..f11fcc520f241 100644\n--- a/tools/testing/selftests/kvm/x86/fix_hypercall_test.c\n+++ b/tools/testing/selftests/kvm/x86/fix_hypercall_test.c\n@@ -48,7 +48,7 @@ static void guest_main(void)\n \tconst u8 *other_hypercall_insn;\n \tu64 ret;\n \n-\tif (host_cpu_is_intel) {\n+\tif (host_cpu_is_intel_compatible) {\n \t\tnative_hypercall_insn = vmx_vmcall;\n \t\tother_hypercall_insn  = svm_vmmcall;\n \t} else if (host_cpu_is_amd_compatible) {\ndiff --git a/tools/testing/selftests/kvm/x86/nested_exceptions_test.c b/tools/testing/selftests/kvm/x86/nested_exceptions_test.c\nindex aeec3121c8e83..78c27fa7c1a87 100644\n--- a/tools/testing/selftests/kvm/x86/nested_exceptions_test.c\n+++ b/tools/testing/selftests/kvm/x86/nested_exceptions_test.c\n@@ -38,6 +38,7 @@\n  */\n #define GP_ERROR_CODE_AMD ((SS_VECTOR * 8) | ERROR_CODE_IDT_FLAG)\n #define GP_ERROR_CODE_INTEL ((SS_VECTOR * 8) | ERROR_CODE_IDT_FLAG | ERROR_CODE_EXT_FLAG)\n+#define GP_ERROR_CODE_ZHAOXIN ((SS_VECTOR * 8) | ERROR_CODE_IDT_FLAG)\n \n /*\n  * Intel and AMD both shove '0' into the error code on #DF, regardless of what\n@@ -139,7 +140,8 @@ static void l1_vmx_code(struct vmx_pages *vmx)\n \t */\n \tGUEST_ASSERT_EQ(vmwrite(EXCEPTION_BITMAP, INTERCEPT_SS_GP_DF), 0);\n \tvmx_run_l2(l2_ss_pending_test, SS_VECTOR, (u16)SS_ERROR_CODE);\n-\tvmx_run_l2(l2_ss_injected_gp_test, GP_VECTOR, GP_ERROR_CODE_INTEL);\n+\tvmx_run_l2(l2_ss_injected_gp_test, GP_VECTOR,\n+\t\t   host_cpu_is_zhaoxin ? GP_ERROR_CODE_ZHAOXIN : GP_ERROR_CODE_INTEL);\n \n \tGUEST_ASSERT_EQ(vmwrite(EXCEPTION_BITMAP, INTERCEPT_SS_DF), 0);\n \tvmx_run_l2(l2_ss_injected_df_test, DF_VECTOR, DF_ERROR_CODE);\ndiff --git a/tools/testing/selftests/kvm/x86/vmx_apic_access_test.c b/tools/testing/selftests/kvm/x86/vmx_apic_access_test.c\nindex 463f73aa9159a..a1b6da4c07408 100644\n--- a/tools/testing/selftests/kvm/x86/vmx_apic_access_test.c\n+++ b/tools/testing/selftests/kvm/x86/vmx_apic_access_test.c\n@@ -78,6 +78,7 @@ int main(int argc, char *argv[])\n \tstruct kvm_vm *vm;\n \n \tTEST_REQUIRE(kvm_cpu_has(X86_FEATURE_VMX));\n+\tTEST_REQUIRE(kvm_cpu_has_vmx_apic_access_virt());\n \n \tvm = vm_create_with_one_vcpu(\u0026vcpu, l1_guest_code);\n \ndiff --git a/tools/testing/selftests/kvm/x86/vmx_exception_with_invalid_guest_state.c b/tools/testing/selftests/kvm/x86/vmx_exception_with_invalid_guest_state.c\nindex 2cae86d9d5e2e..08a0caa9c52da 100644\n--- a/tools/testing/selftests/kvm/x86/vmx_exception_with_invalid_guest_state.c\n+++ b/tools/testing/selftests/kvm/x86/vmx_exception_with_invalid_guest_state.c\n@@ -109,7 +109,7 @@ int main(int argc, char *argv[])\n \tstruct kvm_vcpu *vcpu;\n \tstruct kvm_vm *vm;\n \n-\tTEST_REQUIRE(host_cpu_is_intel);\n+\tTEST_REQUIRE(host_cpu_is_intel_compatible);\n \tTEST_REQUIRE(!kvm_is_unrestricted_guest_enabled());\n \n \tvm = vm_create_with_one_vcpu(\u0026vcpu, guest_code);\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies only KVM userspace selftests under tools/testing/selftests/kvm/ and does not touch any kernel code or affect the compiled kernel image.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit a25c298df4a95c574778634f7f6bdb18d1e71564
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Sep 10 13:34:57 2026 +0000

    syz-cluster: applied patch under review

diff --git a/tools/testing/selftests/kvm/include/x86/processor.h b/tools/testing/selftests/kvm/include/x86/processor.h
index 6e6f70035508a..df368232cf3e1 100644
--- a/tools/testing/selftests/kvm/include/x86/processor.h
+++ b/tools/testing/selftests/kvm/include/x86/processor.h
@@ -23,6 +23,8 @@ extern bool host_cpu_is_intel;
 extern bool host_cpu_is_amd;
 extern bool host_cpu_is_hygon;
 extern bool host_cpu_is_amd_compatible;
+extern bool host_cpu_is_zhaoxin;
+extern bool host_cpu_is_intel_compatible;
 extern u64 guest_tsc_khz;
 extern struct kvm_mmu guest_mmu;
 
@@ -782,6 +784,12 @@ static inline bool this_cpu_is_hygon(void)
 	return this_cpu_vendor_string_is("HygonGenuine");
 }
 
+static inline bool this_cpu_is_zhaoxin(void)
+{
+	return this_cpu_vendor_string_is("CentaurHauls") ||
+	       this_cpu_vendor_string_is("  Shanghai  ");
+}
+
 static inline u32 __this_cpu_has(u32 function, u32 index, u8 reg, u8 lo, u8 hi)
 {
 	u32 gprs[4];
@@ -1446,7 +1454,7 @@ static inline bool kvm_is_pmu_enabled(void)
 
 static inline bool kvm_is_mediated_pmu_enabled(void)
 {
-	if (host_cpu_is_intel)
+	if (host_cpu_is_intel_compatible)
 		return get_kvm_intel_param_bool("enable_mediated_pmu");
 
 	return get_kvm_amd_param_bool("enable_mediated_pmu");
diff --git a/tools/testing/selftests/kvm/include/x86/vmx.h b/tools/testing/selftests/kvm/include/x86/vmx.h
index 04f5e34dea3ae..b196651bdea26 100644
--- a/tools/testing/selftests/kvm/include/x86/vmx.h
+++ b/tools/testing/selftests/kvm/include/x86/vmx.h
@@ -557,6 +557,7 @@ bool load_vmcs(struct vmx_pages *vmx);
 bool ept_1g_pages_supported(void);
 
 bool kvm_cpu_has_ept(void);
+bool kvm_cpu_has_vmx_apic_access_virt(void);
 void vm_enable_ept(struct kvm_vm *vm);
 void prepare_virtualize_apic_accesses(struct vmx_pages *vmx, struct kvm_vm *vm);
 
diff --git a/tools/testing/selftests/kvm/lib/x86/processor.c b/tools/testing/selftests/kvm/lib/x86/processor.c
index d31fa81ea0756..bd50c1265cefa 100644
--- a/tools/testing/selftests/kvm/lib/x86/processor.c
+++ b/tools/testing/selftests/kvm/lib/x86/processor.c
@@ -26,6 +26,8 @@ bool host_cpu_is_amd;
 bool host_cpu_is_intel;
 bool host_cpu_is_hygon;
 bool host_cpu_is_amd_compatible;
+bool host_cpu_is_zhaoxin;
+bool host_cpu_is_intel_compatible;
 bool is_forced_emulation_enabled;
 u64 guest_tsc_khz;
 struct kvm_mmu guest_mmu;
@@ -158,7 +160,7 @@ static void sregs_dump(FILE *stream, struct kvm_sregs *sregs, u8 indent)
 
 bool kvm_is_tdp_enabled(void)
 {
-	if (host_cpu_is_intel)
+	if (host_cpu_is_intel_compatible)
 		return get_kvm_intel_param_bool("ept");
 	else
 		return get_kvm_amd_param_bool("npt");
@@ -819,6 +821,8 @@ void kvm_arch_vm_post_create(struct kvm_vm *vm, unsigned int nr_vcpus)
 	sync_global_to_guest(vm, host_cpu_is_amd);
 	sync_global_to_guest(vm, host_cpu_is_hygon);
 	sync_global_to_guest(vm, host_cpu_is_amd_compatible);
+	sync_global_to_guest(vm, host_cpu_is_zhaoxin);
+	sync_global_to_guest(vm, host_cpu_is_intel_compatible);
 	sync_global_to_guest(vm, is_forced_emulation_enabled);
 	sync_global_to_guest(vm, pmu_errata_mask);
 
@@ -1444,6 +1448,8 @@ void kvm_selftest_arch_init(void)
 	host_cpu_is_amd = this_cpu_is_amd();
 	host_cpu_is_hygon = this_cpu_is_hygon();
 	host_cpu_is_amd_compatible = host_cpu_is_amd || host_cpu_is_hygon;
+	host_cpu_is_zhaoxin = this_cpu_is_zhaoxin();
+	host_cpu_is_intel_compatible = host_cpu_is_intel || host_cpu_is_zhaoxin;
 	is_forced_emulation_enabled = kvm_is_forced_emulation_enabled();
 
 	kvm_init_pmu_errata();
diff --git a/tools/testing/selftests/kvm/lib/x86/vmx.c b/tools/testing/selftests/kvm/lib/x86/vmx.c
index 089e1a8af53fc..e512191f1eed7 100644
--- a/tools/testing/selftests/kvm/lib/x86/vmx.c
+++ b/tools/testing/selftests/kvm/lib/x86/vmx.c
@@ -390,6 +390,21 @@ bool kvm_cpu_has_ept(void)
 	return ctrl & SECONDARY_EXEC_ENABLE_EPT;
 }
 
+bool kvm_cpu_has_vmx_apic_access_virt(void)
+{
+	u64 ctrl;
+
+	if (!kvm_cpu_has(X86_FEATURE_VMX))
+		return false;
+
+	ctrl = kvm_get_feature_msr(MSR_IA32_VMX_TRUE_PROCBASED_CTLS) >> 32;
+	if (!(ctrl & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS))
+		return false;
+
+	ctrl = kvm_get_feature_msr(MSR_IA32_VMX_PROCBASED_CTLS2) >> 32;
+	return ctrl & SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+}
+
 void prepare_virtualize_apic_accesses(struct vmx_pages *vmx, struct kvm_vm *vm)
 {
 	vmx->apic_access = (void *)vm_alloc_page(vm);
diff --git a/tools/testing/selftests/kvm/x86/feature_msrs_test.c b/tools/testing/selftests/kvm/x86/feature_msrs_test.c
index 1585507017718..bb339709d61d8 100644
--- a/tools/testing/selftests/kvm/x86/feature_msrs_test.c
+++ b/tools/testing/selftests/kvm/x86/feature_msrs_test.c
@@ -54,12 +54,25 @@ static void test_feature_msr(u32 msr)
 	if (is_kvm_controlled_msr(msr))
 		return;
 
+	/*
+	 * KVM allows userspace to query MSR_IA32_PERF_CAPABILITIES as a
+	 * feature MSR even if KVM doesn't expose PDCM, but vCPU accesses to
+	 * the MSR will fail in that case. Skip the vCPU checks so that the
+	 * remaining feature MSRs can be tested.
+	 */
+	if (msr == MSR_IA32_PERF_CAPABILITIES &&
+	    !kvm_cpu_has(X86_FEATURE_PDCM)) {
+		printf("KVM does not expose PDCM, skipping vCPU checks for "
+		       "MSR_IA32_PERF_CAPABILITIES (0x%x).\n", msr);
+		return;
+	}
+
 	/*
 	 * More goofy behavior.  KVM reports the host CPU's actual revision ID,
 	 * but initializes the vCPU's revision ID to an arbitrary value.
 	 */
 	if (msr == MSR_IA32_UCODE_REV)
-		reset_value = host_cpu_is_intel ? 0x100000000ULL : 0x01000065;
+		reset_value = host_cpu_is_intel_compatible ? 0x100000000ULL : 0x01000065;
 
 	/*
 	 * For quirked MSRs, KVM's ABI is to initialize the vCPU's value to the
diff --git a/tools/testing/selftests/kvm/x86/fix_hypercall_test.c b/tools/testing/selftests/kvm/x86/fix_hypercall_test.c
index 4931ec22768ee..f11fcc520f241 100644
--- a/tools/testing/selftests/kvm/x86/fix_hypercall_test.c
+++ b/tools/testing/selftests/kvm/x86/fix_hypercall_test.c
@@ -48,7 +48,7 @@ static void guest_main(void)
 	const u8 *other_hypercall_insn;
 	u64 ret;
 
-	if (host_cpu_is_intel) {
+	if (host_cpu_is_intel_compatible) {
 		native_hypercall_insn = vmx_vmcall;
 		other_hypercall_insn  = svm_vmmcall;
 	} else if (host_cpu_is_amd_compatible) {
diff --git a/tools/testing/selftests/kvm/x86/nested_exceptions_test.c b/tools/testing/selftests/kvm/x86/nested_exceptions_test.c
index aeec3121c8e83..78c27fa7c1a87 100644
--- a/tools/testing/selftests/kvm/x86/nested_exceptions_test.c
+++ b/tools/testing/selftests/kvm/x86/nested_exceptions_test.c
@@ -38,6 +38,7 @@
  */
 #define GP_ERROR_CODE_AMD ((SS_VECTOR * 8) | ERROR_CODE_IDT_FLAG)
 #define GP_ERROR_CODE_INTEL ((SS_VECTOR * 8) | ERROR_CODE_IDT_FLAG | ERROR_CODE_EXT_FLAG)
+#define GP_ERROR_CODE_ZHAOXIN ((SS_VECTOR * 8) | ERROR_CODE_IDT_FLAG)
 
 /*
  * Intel and AMD both shove '0' into the error code on #DF, regardless of what
@@ -139,7 +140,8 @@ static void l1_vmx_code(struct vmx_pages *vmx)
 	 */
 	GUEST_ASSERT_EQ(vmwrite(EXCEPTION_BITMAP, INTERCEPT_SS_GP_DF), 0);
 	vmx_run_l2(l2_ss_pending_test, SS_VECTOR, (u16)SS_ERROR_CODE);
-	vmx_run_l2(l2_ss_injected_gp_test, GP_VECTOR, GP_ERROR_CODE_INTEL);
+	vmx_run_l2(l2_ss_injected_gp_test, GP_VECTOR,
+		   host_cpu_is_zhaoxin ? GP_ERROR_CODE_ZHAOXIN : GP_ERROR_CODE_INTEL);
 
 	GUEST_ASSERT_EQ(vmwrite(EXCEPTION_BITMAP, INTERCEPT_SS_DF), 0);
 	vmx_run_l2(l2_ss_injected_df_test, DF_VECTOR, DF_ERROR_CODE);
diff --git a/tools/testing/selftests/kvm/x86/vmx_apic_access_test.c b/tools/testing/selftests/kvm/x86/vmx_apic_access_test.c
index 463f73aa9159a..a1b6da4c07408 100644
--- a/tools/testing/selftests/kvm/x86/vmx_apic_access_test.c
+++ b/tools/testing/selftests/kvm/x86/vmx_apic_access_test.c
@@ -78,6 +78,7 @@ int main(int argc, char *argv[])
 	struct kvm_vm *vm;
 
 	TEST_REQUIRE(kvm_cpu_has(X86_FEATURE_VMX));
+	TEST_REQUIRE(kvm_cpu_has_vmx_apic_access_virt());
 
 	vm = vm_create_with_one_vcpu(&vcpu, l1_guest_code);
 
diff --git a/tools/testing/selftests/kvm/x86/vmx_exception_with_invalid_guest_state.c b/tools/testing/selftests/kvm/x86/vmx_exception_with_invalid_guest_state.c
index 2cae86d9d5e2e..08a0caa9c52da 100644
--- a/tools/testing/selftests/kvm/x86/vmx_exception_with_invalid_guest_state.c
+++ b/tools/testing/selftests/kvm/x86/vmx_exception_with_invalid_guest_state.c
@@ -109,7 +109,7 @@ int main(int argc, char *argv[])
 	struct kvm_vcpu *vcpu;
 	struct kvm_vm *vm;
 
-	TEST_REQUIRE(host_cpu_is_intel);
+	TEST_REQUIRE(host_cpu_is_intel_compatible);
 	TEST_REQUIRE(!kvm_is_unrestricted_guest_enabled());
 
 	vm = vm_create_with_one_vcpu(&vcpu, guest_code);

gemini-3.7-flash

null

null

							input: 6587
							output: 68
							thoughts: 502
						

**WorthFuzzing Assessment**

Okay, let's break this down. The patch is clearly localized to `tools/testing/selftests/kvm/`. I see the following files are being modified: `include/x86/processor.h`, `include/x86/vmx.h`, `lib/x86/processor.c`, `lib/x86/vmx.c`, and a handful of `x86/` tests: `feature_msrs_test.c`, `fix_hypercall_test.c`, `nested_exceptions_test.c`, `vmx_apic_access_test.c`, and `vmx_exception_with_invalid_guest_state.c`.

Now, according to the `WorthFuzzing` rules (specifically Section 2), we only set `WorthFuzzing=false` if all the modified code falls into specific categories. Let me see... "Non-kernel and non-executable changes, which includes modifications to user-space directories, self-tests... that do not affect the compiled kernel image (vmlinux) or kernel modules." Bingo! This is precisely what we're looking at. These are all KVM userspace selftests.

Therefore, this is a clear case for `WorthFuzzing=false`. No fuzzing needed here.

So, let's prepare the tool call:

*   **WorthFuzzing:** `false` (Unquestionably)
*   **FocusSymbols:** (Empty - not relevant here)
*   **EnableConfigs:** (Empty - also not relevant here)
*   **Reasoning:** All changes are strictly confined to KVM userspace selftests under `tools/testing/selftests/kvm/` and *do not* affect the core kernel image or modules. This aligns perfectly with the criteria for setting `WorthFuzzing=false`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies only KVM userspace selftests under tools/testing/selftests/kvm/ and does not touch any kernel code or affect the compiled kernel image.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies only KVM userspace selftests under tools/testing/selftests/kvm/ and does not touch any kernel code or affect the compiled kernel image.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null