This series adds QEMU support for Linear Address Space Separation (LASS) [1],
an Intel security feature that prevents a class of side-channel attacks
relying on speculative accesses across the user/kernel boundary. Paging,
along with SMEP and SMAP, already provides mode-based access protection,
but enforcing it requires a page walk whose timing can leak the layout of
kernel memory. LASS applies the equivalent protections during
linear-address pre-processing: given the usual partitioning of the linear
address space into a user half (bit 63 clear) and a supervisor half
(bit 63 set), an access targeting the opposite half is rejected on the
basis of bit 63 alone, before any page walk.

This series enumerates the LASS CPUID bit, recognizes CR4.LASS,
and exposes LASS on the relevant Intel CPU models via new versioned models.
LASS is not emulated by TCG.

Exposing LASS to a guest also requires KVM support: KVM must validate
the CPUID bit and CR4.LASS, and enforce LASS violations in its
instruction emulator. That enabling is currently under review [2].

Tested with a Linux guest on LASS-capable hardware: LASS is enumerated and
CR4.LASS is set under KVM, and not enumerated under TCG.

[1] Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3A,
    Section 4.3, "Linear-Address-Space Separation (LASS)".
[2] https://lore.kernel.org/kvm/20260806011536.4172258-1-sohil.mehta@intel.com/

Isaku Yamahata (2):
  target/i386: Add support for LASS in CPUID enumeration
  target/i386: Add LASS support in CR4

Kishen Maloor (3):
  target/i386: Introduce DiamondRapids-v3 to enable LASS
  target/i386: Introduce SierraForest-v7 to enable LASS
  target/i386: Introduce ClearwaterForest-v5 to enable LASS

 target/i386/cpu.c    | 26 +++++++++++++++++++++++++-
 target/i386/cpu.h    |  7 ++++++-
 target/i386/helper.c |  4 ++++
 3 files changed, 35 insertions(+), 2 deletions(-)

-- 
2.47.1

On 8/25/2026 8:57 PM, Kishen Maloor wrote:
> Isaku Yamahata (2):
>   target/i386: Add support for LASS in CPUID enumeration
>   target/i386: Add LASS support in CR4
> 
> Kishen Maloor (3):
>   target/i386: Introduce DiamondRapids-v3 to enable LASS
>   target/i386: Introduce SierraForest-v7 to enable LASS
>   target/i386: Introduce ClearwaterForest-v5 to enable LASS
> 

Acked-by: Sohil Mehta <sohil.mehta@intel.com>

>  target/i386/cpu.c    | 26 +++++++++++++++++++++++++-
>  target/i386/cpu.h    |  7 ++++++-
>  target/i386/helper.c |  4 ++++
>  3 files changed, 35 insertions(+), 2 deletions(-)
>

On 8/26/2026 11:57 AM, Kishen Maloor wrote:
> This series adds QEMU support for Linear Address Space Separation (LASS) [1],
> an Intel security feature that prevents a class of side-channel attacks
> relying on speculative accesses across the user/kernel boundary. Paging,
> along with SMEP and SMAP, already provides mode-based access protection,
> but enforcing it requires a page walk whose timing can leak the layout of
> kernel memory. LASS applies the equivalent protections during
> linear-address pre-processing: given the usual partitioning of the linear
> address space into a user half (bit 63 clear) and a supervisor half
> (bit 63 set), an access targeting the opposite half is rejected on the
> basis of bit 63 alone, before any page walk.
> 
> This series enumerates the LASS CPUID bit, recognizes CR4.LASS,
> and exposes LASS on the relevant Intel CPU models via new versioned models.
> LASS is not emulated by TCG.
> 
> Exposing LASS to a guest also requires KVM support: KVM must validate
> the CPUID bit and CR4.LASS, and enforce LASS violations in its
> instruction emulator. That enabling is currently under review [2].
> 
I tested this series on Clearwater Forest (CWF), running a KVM guest 
with -cpu host. On the host I applied the KVM LASS enabling series 
referenced as [2] in the cover letter:

https://lore.kernel.org/kvm/20260806011536.4172258-1-sohil.mehta@intel.com/

With both series applied, LASS is correctly enumerated in the guest, and 
the LASS functional tests pass with vsyscall=none/xonly/emulate.

Tested-by: Farrah Chen <farrah.chen@intel.com>

On 8/26/2026 11:57 AM, Kishen Maloor wrote:
> This series adds QEMU support for Linear Address Space Separation (LASS) [1],
> an Intel security feature that prevents a class of side-channel attacks
> relying on speculative accesses across the user/kernel boundary. Paging,
> along with SMEP and SMAP, already provides mode-based access protection,
> but enforcing it requires a page walk whose timing can leak the layout of
> kernel memory. LASS applies the equivalent protections during
> linear-address pre-processing: given the usual partitioning of the linear
> address space into a user half (bit 63 clear) and a supervisor half
> (bit 63 set), an access targeting the opposite half is rejected on the
> basis of bit 63 alone, before any page walk.
> 
> This series enumerates the LASS CPUID bit, recognizes CR4.LASS,
> and exposes LASS on the relevant Intel CPU models via new versioned models.
> LASS is not emulated by TCG.
> 
> Exposing LASS to a guest also requires KVM support: KVM must validate
> the CPUID bit and CR4.LASS, and enforce LASS violations in its
> instruction emulator. That enabling is currently under review [2].
> 
> Tested with a Linux guest on LASS-capable hardware: LASS is enumerated and
> CR4.LASS is set under KVM, and not enumerated under TCG.
> 
> [1] Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3A,
>     Section 4.3, "Linear-Address-Space Separation (LASS)".
> [2] https://lore.kernel.org/kvm/20260806011536.4172258-1-sohil.mehta@intel.com/
> 
> Isaku Yamahata (2):
>   target/i386: Add support for LASS in CPUID enumeration
>   target/i386: Add LASS support in CR4
> 
> Kishen Maloor (3):
>   target/i386: Introduce DiamondRapids-v3 to enable LASS
>   target/i386: Introduce SierraForest-v7 to enable LASS
>   target/i386: Introduce ClearwaterForest-v5 to enable LASS

Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>

> 
>  target/i386/cpu.c    | 26 +++++++++++++++++++++++++-
>  target/i386/cpu.h    |  7 ++++++-
>  target/i386/helper.c |  4 ++++
>  3 files changed, 35 insertions(+), 2 deletions(-)
>