linux-kernel - Re: [PATCH v14 14/22] KVM: VMX: Set host constant supervisor states to VMCS fields

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aMSY2e2vNe1D-hHj@google.com>
Date: Fri, 12 Sep 2025 15:04:09 -0700
From: Sean Christopherson <seanjc@...gle.com>
To: Chao Gao <chao.gao@...el.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org, acme@...hat.com, 
	bp@...en8.de, dave.hansen@...ux.intel.com, hpa@...or.com, john.allen@....com, 
	mingo@...nel.org, mingo@...hat.com, minipli@...ecurity.net, 
	mlevitsk@...hat.com, namhyung@...nel.org, pbonzini@...hat.com, 
	prsampat@....com, rick.p.edgecombe@...el.com, shuah@...nel.org, 
	tglx@...utronix.de, weijiang.yang@...el.com, x86@...nel.org, xin@...or.com, 
	xiaoyao.li@...el.com
Subject: Re: [PATCH v14 14/22] KVM: VMX: Set host constant supervisor states
 to VMCS fields

On Tue, Sep 09, 2025, Chao Gao wrote:
>  void set_cr4_guest_host_mask(struct vcpu_vmx *vmx)
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 79861b7ad44d..d67aef261638 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -9890,6 +9890,18 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *ops)
>  		return -EIO;
>  	}
>  
> +	if (boot_cpu_has(X86_FEATURE_SHSTK)) {

This needs to check for "|| IBT"

> +		rdmsrq(MSR_IA32_S_CET, kvm_host.s_cet);
> +		/*
> +		 * Linux doesn't yet support supervisor shadow stacks (SSS), so
> +		 * KVM doesn't save/restore the associated MSRs, i.e. KVM may
> +		 * clobber the host values.  Yell and refuse to load if SSS is
> +		 * unexpectedly enabled, e.g. to avoid crashing the host.
> +		 */
> +		if (WARN_ON_ONCE(kvm_host.s_cet & CET_SHSTK_EN))
> +			return -EIO;
> +	}