arch/x86/include/asm/kvm_host.h | 16 +- arch/x86/include/asm/vmx.h | 9 + arch/x86/include/uapi/asm/kvm.h | 13 ++ arch/x86/kvm/cpuid.c | 19 +- arch/x86/kvm/emulate.c | 46 +++-- arch/x86/kvm/smm.c | 12 +- arch/x86/kvm/smm.h | 2 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/vmx/capabilities.h | 9 + arch/x86/kvm/vmx/nested.c | 174 +++++++++++++++-- arch/x86/kvm/vmx/nested.h | 5 + arch/x86/kvm/vmx/vmcs12.c | 6 + arch/x86/kvm/vmx/vmcs12.h | 14 +- arch/x86/kvm/vmx/vmx.c | 85 ++++++++- arch/x86/kvm/vmx/vmx.h | 9 +- arch/x86/kvm/x86.c | 326 ++++++++++++++++++++++++++++---- arch/x86/kvm/x86.h | 61 ++++++ 17 files changed, 725 insertions(+), 85 deletions(-)
The FPU support for CET virtualization has already been merged into the tip
tree. This v11 adds Intel CET virtualization in KVM and is based on
tip/master plus Sean's MSR cleanups. For your convenience, it is also
available at
https://github.com/gaochaointel/linux-dev cet-v11
Changes in v11 (Most changes are suggested by Sean. Thanks!):
1. Rebased onto the latest tip tree + Sean's MSR cleanups
2. Made patch 1's shortlog informative and accurate
3. Slotted in two cleanup patches from Sean (patch 3/4)
4. Used KVM_GET/SET_ONE_REG ioctl for userspace to read/write SSP.
still assigned a KVM-defined MSR index for SSP but the index isn't
part of uAPI now.
5. Used KVM_MSR_RET_UNSUPPORTED to reject accesses to unsupported CET MSRs
6. Synthesized triple-fault when reading/writing SSP failed during
entering into SMM or exiting from SMM
7. Removed an inappropriate "quirk" in v10 that advertised IBT to userspace
when the hardware supports it but the host does not enable it.
8. Disabled IBT/SHSTK explicitly for SVM to avoid them being enabled on
AMD CPU accidentally before AMD CET series lands. Because IBT/SHSTK are
advertised in KVM x86 common code but only Intel support is added by
this series.
9. Re-ordered "Don't emulate branch instructions" (patch 18) before
advertising CET support to userspace.
10.Added consistency checks for CR4.CET and other CET MSRs during VM-entry
(patches 22-23)
Control-flow Enforcement Technology (CET) is a kind of CPU feature used
to prevent Return/CALL/Jump-Oriented Programming (ROP/COP/JOP) attacks.
It provides two sub-features(SHSTK,IBT) to defend against ROP/COP/JOP
style control-flow subversion attacks.
Shadow Stack (SHSTK):
A shadow stack is a second stack used exclusively for control transfer
operations. The shadow stack is separate from the data/normal stack and
can be enabled individually in user and kernel mode. When shadow stack
is enabled, CALL pushes the return address on both the data and shadow
stack. RET pops the return address from both stacks and compares them.
If the return addresses from the two stacks do not match, the processor
generates a #CP.
Indirect Branch Tracking (IBT):
IBT introduces new instruction(ENDBRANCH)to mark valid target addresses
of indirect branches (CALL, JMP etc...). If an indirect branch is
executed and the next instruction is _not_ an ENDBRANCH, the processor
generates a #CP. These instruction behaves as a NOP on platforms that
doesn't support CET.
CET states management:
======================
KVM cooperates with host kernel FPU framework to manage guest CET registers.
With CET supervisor mode state support in this series, KVM can save/restore
full guest CET xsave-managed states.
CET user mode and supervisor mode xstates, i.e., MSR_IA32_{U_CET,PL3_SSP}
and MSR_IA32_PL{0,1,2}, depend on host FPU framework to swap guest and host
xstates. On VM-Exit, guest CET xstates are saved to guest fpu area and host
CET xstates are loaded from task/thread context before vCPU returns to
userspace, vice-versa on VM-Entry. See details in kvm_{load,put}_guest_fpu().
So guest CET xstates management depends on CET xstate bits(U_CET/S_CET bit)
set in host XSS MSR.
CET supervisor mode states are grouped into two categories : XSAVE-managed
and non-XSAVE-managed, the former includes MSR_IA32_PL{0,1,2}_SSP and are
controlled by CET supervisor mode bit(S_CET bit) in XSS, the later consists
of MSR_IA32_S_CET and MSR_IA32_INTR_SSP_TBL.
VMX introduces new VMCS fields, {GUEST|HOST}_{S_CET,SSP,INTR_SSP_TABL}, to
facilitate guest/host non-XSAVES-managed states. When VMX CET entry/exit load
bits are set, guest/host MSR_IA32_{S_CET,INTR_SSP_TBL,SSP} are loaded from
equivalent fields at VM-Exit/Entry. With these new fields, such supervisor
states require no addtional KVM save/reload actions.
Tests:
======================
This series passed basic CET user shadow stack test and kernel IBT test in L1
and L2 guest.
The patch series _has_ impact to existing vmx test cases in KVM-unit-tests,the
failures have been fixed here[1].
One new selftest app[2] is introduced for testing CET MSRs accessibilities.
Note, this series hasn't been tested on AMD platform yet.
To run user SHSTK test and kernel IBT test in guest, an CET capable platform
is required, e.g., Sapphire Rapids server, and follow below steps to build
the binaries:
1. Host kernel: Apply this series to mainline kernel (>= v6.6) and build.
2. Guest kernel: Pull kernel (>= v6.6), opt-in CONFIG_X86_KERNEL_IBT
and CONFIG_X86_USER_SHADOW_STACK options. Build with CET enabled gcc versions
(>= 8.5.0).
3. Apply CET QEMU patches[3] before build mainline QEMU.
Check kernel selftest test_shadow_stack_64 output:
[INFO] new_ssp = 7f8c82100ff8, *new_ssp = 7f8c82101001
[INFO] changing ssp from 7f8c82900ff0 to 7f8c82100ff8
[INFO] ssp is now 7f8c82101000
[OK] Shadow stack pivot
[OK] Shadow stack faults
[INFO] Corrupting shadow stack
[INFO] Generated shadow stack violation successfully
[OK] Shadow stack violation test
[INFO] Gup read -> shstk access success
[INFO] Gup write -> shstk access success
[INFO] Violation from normal write
[INFO] Gup read -> write access success
[INFO] Violation from normal write
[INFO] Gup write -> write access success
[INFO] Cow gup write -> write access success
[OK] Shadow gup test
[INFO] Violation from shstk access
[OK] mprotect() test
[SKIP] Userfaultfd unavailable.
[OK] 32 bit test
Chao Gao (3):
KVM: x86: Zero XSTATE components on INIT by iterating over supported
features
KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET
KVM: nVMX: Add consistency checks for CET states
Sean Christopherson (3):
KVM: x86: Manually clear MPX state only on INIT
KVM: x86: Report XSS as to-be-saved if there are supported features
KVM: x86: Load guest FPU state when access XSAVE-managed MSRs
Yang Weijiang (17):
KVM: x86: Rename kvm_{g,s}et_msr()* to show that they emulate guest
accesses
KVM: x86: Add kvm_msr_{read,write}() helpers
KVM: x86: Introduce KVM_{G,S}ET_ONE_REG uAPIs support
KVM: x86: Refresh CPUID on write to guest MSR_IA32_XSS
KVM: x86: Initialize kvm_caps.supported_xss
KVM: x86: Add fault checks for guest CR4.CET setting
KVM: x86: Report KVM supported CET MSRs as to-be-saved
KVM: VMX: Introduce CET VMCS fields and control bits
KVM: x86: Enable guest SSP read/write interface with new uAPIs
KVM: VMX: Emulate read and write to CET MSRs
KVM: x86: Save and reload SSP to/from SMRAM
KVM: VMX: Set up interception for CET MSRs
KVM: VMX: Set host constant supervisor states to VMCS fields
KVM: x86: Don't emulate instructions guarded by CET
KVM: x86: Enable CET virtualization for VMX and advertise to userspace
KVM: nVMX: Virtualize NO_HW_ERROR_CODE_CC for L1 event injection to L2
KVM: nVMX: Enable CET support for nested guest
arch/x86/include/asm/kvm_host.h | 16 +-
arch/x86/include/asm/vmx.h | 9 +
arch/x86/include/uapi/asm/kvm.h | 13 ++
arch/x86/kvm/cpuid.c | 19 +-
arch/x86/kvm/emulate.c | 46 +++--
arch/x86/kvm/smm.c | 12 +-
arch/x86/kvm/smm.h | 2 +-
arch/x86/kvm/svm/svm.c | 4 +
arch/x86/kvm/vmx/capabilities.h | 9 +
arch/x86/kvm/vmx/nested.c | 174 +++++++++++++++--
arch/x86/kvm/vmx/nested.h | 5 +
arch/x86/kvm/vmx/vmcs12.c | 6 +
arch/x86/kvm/vmx/vmcs12.h | 14 +-
arch/x86/kvm/vmx/vmx.c | 85 ++++++++-
arch/x86/kvm/vmx/vmx.h | 9 +-
arch/x86/kvm/x86.c | 326 ++++++++++++++++++++++++++++----
arch/x86/kvm/x86.h | 61 ++++++
17 files changed, 725 insertions(+), 85 deletions(-)
--
2.47.1
On 04.07.25 10:49, Chao Gao wrote: > The FPU support for CET virtualization has already been merged into the tip > tree. This v11 adds Intel CET virtualization in KVM and is based on > tip/master plus Sean's MSR cleanups. For your convenience, it is also > available at > > https://github.com/gaochaointel/linux-dev cet-v11 > > Changes in v11 (Most changes are suggested by Sean. Thanks!): > 1. Rebased onto the latest tip tree + Sean's MSR cleanups > 2. Made patch 1's shortlog informative and accurate > 3. Slotted in two cleanup patches from Sean (patch 3/4) > 4. Used KVM_GET/SET_ONE_REG ioctl for userspace to read/write SSP. > still assigned a KVM-defined MSR index for SSP but the index isn't > part of uAPI now. > 5. Used KVM_MSR_RET_UNSUPPORTED to reject accesses to unsupported CET MSRs > 6. Synthesized triple-fault when reading/writing SSP failed during > entering into SMM or exiting from SMM > 7. Removed an inappropriate "quirk" in v10 that advertised IBT to userspace > when the hardware supports it but the host does not enable it. > 8. Disabled IBT/SHSTK explicitly for SVM to avoid them being enabled on > AMD CPU accidentally before AMD CET series lands. Because IBT/SHSTK are > advertised in KVM x86 common code but only Intel support is added by > this series. > 9. Re-ordered "Don't emulate branch instructions" (patch 18) before > advertising CET support to userspace. > 10.Added consistency checks for CR4.CET and other CET MSRs during VM-entry > (patches 22-23) > > [...] I tested this with your work-in-progress QEMU support branch from [1] and it worked well on my Alder Lake NUC (i7-1260P). The host kernel has IBT and user shadow stacks enabled, so does the guest kernel. KUT CET tests[2] ran fine on the host as well as in the guest, i.e. nested works too. Therefore, Tested-by: Mathias Krause <minipli@grsecurity.net> [1] https://github.com/gaochaointel/qemu-dev#qemu-cet [2] https://lore.kernel.org/kvm/20250626073459.12990-1-minipli@grsecurity.net/ Thanks, Mathias
Hi Chao, On 7/4/2025 4:49 PM, Chao Gao wrote: > Tests: > ====================== > This series passed basic CET user shadow stack test and kernel IBT test in L1 > and L2 guest. > The patch series_has_ impact to existing vmx test cases in KVM-unit-tests,the > failures have been fixed here[1]. > One new selftest app[2] is introduced for testing CET MSRs accessibilities. > > Note, this series hasn't been tested on AMD platform yet. > > To run user SHSTK test and kernel IBT test in guest, an CET capable platform > is required, e.g., Sapphire Rapids server, and follow below steps to build > the binaries: > > 1. Host kernel: Apply this series to mainline kernel (>= v6.6) and build. > > 2. Guest kernel: Pull kernel (>= v6.6), opt-in CONFIG_X86_KERNEL_IBT > and CONFIG_X86_USER_SHADOW_STACK options. Build with CET enabled gcc versions > (>= 8.5.0). > > 3. Apply CET QEMU patches[3] before build mainline QEMU. You forgot to provide the links of [1][2][3].
On Mon, Jul 07, 2025 at 12:51:14AM +0800, Xiaoyao Li wrote: >Hi Chao, > >On 7/4/2025 4:49 PM, Chao Gao wrote: >> Tests: >> ====================== >> This series passed basic CET user shadow stack test and kernel IBT test in L1 >> and L2 guest. >> The patch series_has_ impact to existing vmx test cases in KVM-unit-tests,the >> failures have been fixed here[1]. >> One new selftest app[2] is introduced for testing CET MSRs accessibilities. >> >> Note, this series hasn't been tested on AMD platform yet. >> >> To run user SHSTK test and kernel IBT test in guest, an CET capable platform >> is required, e.g., Sapphire Rapids server, and follow below steps to build >> the binaries: >> >> 1. Host kernel: Apply this series to mainline kernel (>= v6.6) and build. >> >> 2. Guest kernel: Pull kernel (>= v6.6), opt-in CONFIG_X86_KERNEL_IBT >> and CONFIG_X86_USER_SHADOW_STACK options. Build with CET enabled gcc versions >> (>= 8.5.0). >> >> 3. Apply CET QEMU patches[3] before build mainline QEMU. > >You forgot to provide the links of [1][2][3]. Oops, thanks for catching this. Here are the links: [1]: KVM-unit-tests fixup: https://lore.kernel.org/all/20230913235006.74172-1-weijiang.yang@intel.com/ [2]: Selftest for CET MSRs: https://lore.kernel.org/all/20230914064201.85605-1-weijiang.yang@intel.com/ [3]: QEMU patch: https://lore.kernel.org/all/20230720111445.99509-1-weijiang.yang@intel.com/ Please note that [1] has already been merged. And [3] is an older version of CET for QEMU; I plan to post a new version for QEMU after the KVM series is merged.
On Mon, Jul 07, 2025 at 09:32:37AM +0800, Chao Gao wrote: > On Mon, Jul 07, 2025 at 12:51:14AM +0800, Xiaoyao Li wrote: > >Hi Chao, > > > >On 7/4/2025 4:49 PM, Chao Gao wrote: > >> Tests: > >> ====================== > >> This series passed basic CET user shadow stack test and kernel IBT test in L1 > >> and L2 guest. > >> The patch series_has_ impact to existing vmx test cases in KVM-unit-tests,the > >> failures have been fixed here[1]. > >> One new selftest app[2] is introduced for testing CET MSRs accessibilities. > >> > >> Note, this series hasn't been tested on AMD platform yet. > >> > >> To run user SHSTK test and kernel IBT test in guest, an CET capable platform > >> is required, e.g., Sapphire Rapids server, and follow below steps to build > >> the binaries: > >> > >> 1. Host kernel: Apply this series to mainline kernel (>= v6.6) and build. > >> > >> 2. Guest kernel: Pull kernel (>= v6.6), opt-in CONFIG_X86_KERNEL_IBT > >> and CONFIG_X86_USER_SHADOW_STACK options. Build with CET enabled gcc versions > >> (>= 8.5.0). > >> > >> 3. Apply CET QEMU patches[3] before build mainline QEMU. > > > >You forgot to provide the links of [1][2][3]. > > Oops, thanks for catching this. > > Here are the links: > > [1]: KVM-unit-tests fixup: > https://lore.kernel.org/all/20230913235006.74172-1-weijiang.yang@intel.com/ > [2]: Selftest for CET MSRs: > https://lore.kernel.org/all/20230914064201.85605-1-weijiang.yang@intel.com/ > [3]: QEMU patch: > https://lore.kernel.org/all/20230720111445.99509-1-weijiang.yang@intel.com/ > > Please note that [1] has already been merged. And [3] is an older version of > CET for QEMU; I plan to post a new version for QEMU after the KVM series is > merged. Do you happen to have a branch with the in-progress qemu patches you are testing with? I'm working on testing on AMD and I'm having issues getting this old version of the series to work properly. Thanks, John
On 16.07.25 22:36, John Allen wrote: > On Mon, Jul 07, 2025 at 09:32:37AM +0800, Chao Gao wrote: >> On Mon, Jul 07, 2025 at 12:51:14AM +0800, Xiaoyao Li wrote: >>> Hi Chao, >>> >>> On 7/4/2025 4:49 PM, Chao Gao wrote: >>>> Tests: >>>> ====================== >>>> This series passed basic CET user shadow stack test and kernel IBT test in L1 >>>> and L2 guest. >>>> The patch series_has_ impact to existing vmx test cases in KVM-unit-tests,the >>>> failures have been fixed here[1]. >>>> One new selftest app[2] is introduced for testing CET MSRs accessibilities. >>>> >>>> Note, this series hasn't been tested on AMD platform yet. >>>> >>>> To run user SHSTK test and kernel IBT test in guest, an CET capable platform >>>> is required, e.g., Sapphire Rapids server, and follow below steps to build >>>> the binaries: >>>> >>>> 1. Host kernel: Apply this series to mainline kernel (>= v6.6) and build. >>>> >>>> 2. Guest kernel: Pull kernel (>= v6.6), opt-in CONFIG_X86_KERNEL_IBT >>>> and CONFIG_X86_USER_SHADOW_STACK options. Build with CET enabled gcc versions >>>> (>= 8.5.0). >>>> >>>> 3. Apply CET QEMU patches[3] before build mainline QEMU. >>> >>> You forgot to provide the links of [1][2][3]. >> >> Oops, thanks for catching this. >> >> Here are the links: >> >> [1]: KVM-unit-tests fixup: >> https://lore.kernel.org/all/20230913235006.74172-1-weijiang.yang@intel.com/ >> [2]: Selftest for CET MSRs: >> https://lore.kernel.org/all/20230914064201.85605-1-weijiang.yang@intel.com/ >> [3]: QEMU patch: >> https://lore.kernel.org/all/20230720111445.99509-1-weijiang.yang@intel.com/ >> >> Please note that [1] has already been merged. And [3] is an older version of >> CET for QEMU; I plan to post a new version for QEMU after the KVM series is >> merged. > > Do you happen to have a branch with the in-progress qemu patches you are > testing with? I'm working on testing on AMD and I'm having issues > getting this old version of the series to work properly. For me the old patches worked by changing the #define of MSR_KVM_GUEST_SSP from 0x4b564d09 to 0x4b564dff -- on top of QEMU 9.0.1, that is. Thanks, Mathias
On Thu, Jul 17, 2025 at 09:00:04AM +0200, Mathias Krause wrote: >On 16.07.25 22:36, John Allen wrote: >> On Mon, Jul 07, 2025 at 09:32:37AM +0800, Chao Gao wrote: >>> On Mon, Jul 07, 2025 at 12:51:14AM +0800, Xiaoyao Li wrote: >>>> Hi Chao, >>>> >>>> On 7/4/2025 4:49 PM, Chao Gao wrote: >>>>> Tests: >>>>> ====================== >>>>> This series passed basic CET user shadow stack test and kernel IBT test in L1 >>>>> and L2 guest. >>>>> The patch series_has_ impact to existing vmx test cases in KVM-unit-tests,the >>>>> failures have been fixed here[1]. >>>>> One new selftest app[2] is introduced for testing CET MSRs accessibilities. >>>>> >>>>> Note, this series hasn't been tested on AMD platform yet. >>>>> >>>>> To run user SHSTK test and kernel IBT test in guest, an CET capable platform >>>>> is required, e.g., Sapphire Rapids server, and follow below steps to build >>>>> the binaries: >>>>> >>>>> 1. Host kernel: Apply this series to mainline kernel (>= v6.6) and build. >>>>> >>>>> 2. Guest kernel: Pull kernel (>= v6.6), opt-in CONFIG_X86_KERNEL_IBT >>>>> and CONFIG_X86_USER_SHADOW_STACK options. Build with CET enabled gcc versions >>>>> (>= 8.5.0). >>>>> >>>>> 3. Apply CET QEMU patches[3] before build mainline QEMU. >>>> >>>> You forgot to provide the links of [1][2][3]. >>> >>> Oops, thanks for catching this. >>> >>> Here are the links: >>> >>> [1]: KVM-unit-tests fixup: >>> https://lore.kernel.org/all/20230913235006.74172-1-weijiang.yang@intel.com/ >>> [2]: Selftest for CET MSRs: >>> https://lore.kernel.org/all/20230914064201.85605-1-weijiang.yang@intel.com/ >>> [3]: QEMU patch: >>> https://lore.kernel.org/all/20230720111445.99509-1-weijiang.yang@intel.com/ >>> >>> Please note that [1] has already been merged. And [3] is an older version of >>> CET for QEMU; I plan to post a new version for QEMU after the KVM series is >>> merged. >> >> Do you happen to have a branch with the in-progress qemu patches you are >> testing with? I'm working on testing on AMD and I'm having issues >> getting this old version of the series to work properly. Hi John, Try this branch: https://github.com/gaochaointel/qemu-dev qemu-cet Disclaimer: I haven't cleaned up the QEMU patches yet, so they are not of upstream quality. > >For me the old patches worked by changing the #define of >MSR_KVM_GUEST_SSP from 0x4b564d09 to 0x4b564dff -- on top of QEMU 9.0.1, >that is. Please note that aliasing guest SSP to the virtual MSR indexed by 0x4b564dff is not part of KVM uAPI in the v11 series. This means the index 0x4b564dff isn't stable; userspace should read/write guest SSP via KVM_GET/SET_ONE_REG ioctls.
On Thu, Jul 17, 2025 at 03:57:03PM +0800, Chao Gao wrote: > On Thu, Jul 17, 2025 at 09:00:04AM +0200, Mathias Krause wrote: > >On 16.07.25 22:36, John Allen wrote: > >> On Mon, Jul 07, 2025 at 09:32:37AM +0800, Chao Gao wrote: > >>> On Mon, Jul 07, 2025 at 12:51:14AM +0800, Xiaoyao Li wrote: > >>>> Hi Chao, > >>>> > >>>> On 7/4/2025 4:49 PM, Chao Gao wrote: > >>>>> Tests: > >>>>> ====================== > >>>>> This series passed basic CET user shadow stack test and kernel IBT test in L1 > >>>>> and L2 guest. > >>>>> The patch series_has_ impact to existing vmx test cases in KVM-unit-tests,the > >>>>> failures have been fixed here[1]. > >>>>> One new selftest app[2] is introduced for testing CET MSRs accessibilities. > >>>>> > >>>>> Note, this series hasn't been tested on AMD platform yet. > >>>>> > >>>>> To run user SHSTK test and kernel IBT test in guest, an CET capable platform > >>>>> is required, e.g., Sapphire Rapids server, and follow below steps to build > >>>>> the binaries: > >>>>> > >>>>> 1. Host kernel: Apply this series to mainline kernel (>= v6.6) and build. > >>>>> > >>>>> 2. Guest kernel: Pull kernel (>= v6.6), opt-in CONFIG_X86_KERNEL_IBT > >>>>> and CONFIG_X86_USER_SHADOW_STACK options. Build with CET enabled gcc versions > >>>>> (>= 8.5.0). > >>>>> > >>>>> 3. Apply CET QEMU patches[3] before build mainline QEMU. > >>>> > >>>> You forgot to provide the links of [1][2][3]. > >>> > >>> Oops, thanks for catching this. > >>> > >>> Here are the links: > >>> > >>> [1]: KVM-unit-tests fixup: > >>> https://lore.kernel.org/all/20230913235006.74172-1-weijiang.yang@intel.com/ > >>> [2]: Selftest for CET MSRs: > >>> https://lore.kernel.org/all/20230914064201.85605-1-weijiang.yang@intel.com/ > >>> [3]: QEMU patch: > >>> https://lore.kernel.org/all/20230720111445.99509-1-weijiang.yang@intel.com/ > >>> > >>> Please note that [1] has already been merged. And [3] is an older version of > >>> CET for QEMU; I plan to post a new version for QEMU after the KVM series is > >>> merged. > >> > >> Do you happen to have a branch with the in-progress qemu patches you are > >> testing with? I'm working on testing on AMD and I'm having issues > >> getting this old version of the series to work properly. > > Hi John, > > Try this branch: > > https://github.com/gaochaointel/qemu-dev qemu-cet > > Disclaimer: I haven't cleaned up the QEMU patches yet, so they are not of > upstream quality. > > > > >For me the old patches worked by changing the #define of > >MSR_KVM_GUEST_SSP from 0x4b564d09 to 0x4b564dff -- on top of QEMU 9.0.1, > >that is. > > Please note that aliasing guest SSP to the virtual MSR indexed by 0x4b564dff is > not part of KVM uAPI in the v11 series. This means the index 0x4b564dff isn't > stable; userspace should read/write guest SSP via KVM_GET/SET_ONE_REG ioctls. Thanks, tested on AMD. There's a couple of minor details I still need to work out, but I should have an updated SVM series out soon. Tested-by: John Allen <john.allen@amd.com>
© 2016 - 2025 Red Hat, Inc.