From nobody Sat Feb 7 08:07:40 2026 Received: from mail-pg1-f202.google.com (mail-pg1-f202.google.com [209.85.215.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 239B72C0F7C for ; Fri, 23 Jan 2026 22:15:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769206548; cv=none; b=mh6X3+bmrcD8LYyB0OvRqOg2biN7Z+aEtOCLVz0GT06tVgsLJwoy+CSFKsytjydWUjgNliivG1/KBO+Tp6qcIz0bnmnrc4qmJVZGIW1dLsMbfRQpJPag4MrGXVOUEMlCTr0YZhnOVsHZkhxIpC8Mr7NB2R/bwZl2OEWNfWneFc8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769206548; c=relaxed/simple; bh=wfgo8+EpcOGxMCSLVCKL4bvA9++d8AxEC+VcuzfO8WA=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=EmrW7O9IzKRbbw+6jQmqO3RYQP9/1oEgDJIlHDszhFdbMNBPcoH19Zx7AcUiWfsESYhfWt1J9skisoamXROdKKi5edcyvwN+n8zD5nujnUzgpLi4kXN4ttjea0t1qFKgV9mG0QZLaC9b1v8MsQtVrKUNCh7pAFOa7fvTqqLL4M0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=QgYxY8hn; arc=none smtp.client-ip=209.85.215.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="QgYxY8hn" Received: by mail-pg1-f202.google.com with SMTP id 41be03b00d2f7-c5454bf50e0so4407538a12.2 for ; Fri, 23 Jan 2026 14:15:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1769206546; x=1769811346; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=IKoRiscRvqZSUVfirtAlpZBQ7vM24W6FKDPHYfN9E+0=; b=QgYxY8hnNWjXvhJN1+Os9uAXFBZLXh/oYF119Izqj9vd7DG9WA6N3bwb49hHW9M+N/ YChbnCYMbp5BxQIjVLaC9yCnz5CGZN2F94dfIoS62Yvu4xcejU09rqLLWfJUyLCsdIoD JvRRI/fRN/BJHbAxJhvoRVHsDWSzzklvlhIlXzlS71sgSqCoWIt4CZV7lua3M9QnCmQE Yb4HkwOWgSgbd8ZTTa3cepHtQ8rjzPlhWA6MRtlbTKS0yBuJGn5kSGSZWUjTegxuC3Ti vW/4z1NG5azdtKdamBJmWx8oVRBxCllvXlz5pmElBnQ1qNRLUc/KuFP/PVZ/vOqDlJRG NnEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769206546; x=1769811346; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=IKoRiscRvqZSUVfirtAlpZBQ7vM24W6FKDPHYfN9E+0=; b=XO4QkORksPzvfw2GaTsiIyxkhdg1CxyUlg4dTn4wX81ixlHuLdj9U/H3BUr1oYFOsa nOZ0Ah7kNag8RY4VfwsWJREX7OLF5HbkxfjY2ra9mWXF55yeN0UKuUHnZejSVYT4Zsi7 oZqSqOQqBNYi/FJvp3/OuFlxDMTUjOw1ps0CMvrEGkSv9MuvrOiCfZ5W15bWk2qJjNsG bBf2fLkZZNMPoEj1o+FDE2/3RGTszKwXqfu2Sj0nccTqPl/QUQ7W1Pz9JCHMcj559loT XYtKS3l+UIpZX8MsSxkRUObXvpg24rY1bhCeuZ7vCsrrxZ3/nTGIFZ+DWn5eod7l+f14 owQA== X-Forwarded-Encrypted: i=1; AJvYcCV+7xyCy7HCNG4Q65dqBklOi+w12P87P5DyMvuM/wnonRCL9ujyU8E+b81FE8VI+45buDozFHHOZv12eMg=@vger.kernel.org X-Gm-Message-State: AOJu0Yxx9H9Sh2/L1XeTRvKd+P8hy51KT7H2ND6GnUyMtHaszQpJnm6H RwRVa5EnAGmxID3GYofUZnkueFdp7FSYge/R+0yUwC+pbJjj5DYD6TGy2ldc3AXVn3/tKNAIg9u 0/tLQRQ== X-Received: from pgbfy24.prod.google.com ([2002:a05:6a02:2a98:b0:c16:a39f:5b40]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:610e:b0:38d:b865:3a2a with SMTP id adf61e73a8af0-38e6f7ce40fmr4498697637.40.1769206546472; Fri, 23 Jan 2026 14:15:46 -0800 (PST) Reply-To: Sean Christopherson Date: Fri, 23 Jan 2026 14:15:40 -0800 In-Reply-To: <20260123221542.2498217-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260123221542.2498217-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.457.g6b5491de43-goog Message-ID: <20260123221542.2498217-2-seanjc@google.com> Subject: [PATCH 1/3] KVM: x86: Finalize kvm_cpu_caps setup from {svm,vmx}_set_cpu_caps() From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Mathias Krause , John Allen , Rick Edgecombe , Chao Gao , Binbin Wu , Xiaoyao Li , Jim Mattson Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Explicitly finalize kvm_cpu_caps as part of each vendor's setup flow to fix a bug where clearing SHSTK and IBT due to lack of CET XFEATURE support makes kvm-intel.ko unloadable when nested=3D1. The late clearing results in nested_vmx_setup_{entry,exit}_ctls() clearing VM_{ENTRY,EXIT}_LOAD_CET_STATE when nested_vmx_setup_ctls_msrs() runs during the CPU compatibility checks, ultimately leading to a mismatched VMCS config due to the reference config having the CET bits set, but every CPU's "local" config having the bits cleared. Note, kvm_caps.supported_{xcr0,xss} are unconditionally initialized by kvm_x86_vendor_init(), before calling into vendor code, and not referenced between ops->hardware_setup() and their current/old location. Fixes: 69cc3e886582 ("KVM: x86: Add XSS support for CET_KERNEL and CET_USER= ") Cc: stable@vger.kernel.org Cc: Mathias Krause Cc: John Allen Cc: Rick Edgecombe Cc: Chao Gao Cc: Binbin Wu Cc: Xiaoyao Li Signed-off-by: Sean Christopherson Reviewed-by: Chao Gao --- arch/x86/kvm/cpuid.c | 21 +++++++++++++++++++-- arch/x86/kvm/cpuid.h | 3 ++- arch/x86/kvm/svm/svm.c | 4 +++- arch/x86/kvm/vmx/vmx.c | 4 +++- arch/x86/kvm/x86.c | 14 -------------- arch/x86/kvm/x86.h | 2 ++ 6 files changed, 29 insertions(+), 19 deletions(-) diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c index 575244af9c9f..267e59b405c1 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -826,7 +826,7 @@ do { \ /* DS is defined by ptrace-abi.h on 32-bit builds. */ #undef DS =20 -void kvm_set_cpu_caps(void) +void kvm_initialize_cpu_caps(void) { memset(kvm_cpu_caps, 0, sizeof(kvm_cpu_caps)); =20 @@ -1289,7 +1289,24 @@ void kvm_set_cpu_caps(void) kvm_cpu_cap_clear(X86_FEATURE_RDPID); } } -EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_set_cpu_caps); +EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_initialize_cpu_caps); + +void kvm_finalize_cpu_caps(void) +{ + if (!kvm_cpu_cap_has(X86_FEATURE_XSAVES)) + kvm_caps.supported_xss =3D 0; + + if (!kvm_cpu_cap_has(X86_FEATURE_SHSTK) && + !kvm_cpu_cap_has(X86_FEATURE_IBT)) + kvm_caps.supported_xss &=3D ~XFEATURE_MASK_CET_ALL; + + if ((kvm_caps.supported_xss & XFEATURE_MASK_CET_ALL) !=3D XFEATURE_MASK_C= ET_ALL) { + kvm_cpu_cap_clear(X86_FEATURE_SHSTK); + kvm_cpu_cap_clear(X86_FEATURE_IBT); + kvm_caps.supported_xss &=3D ~XFEATURE_MASK_CET_ALL; + } +} +EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_finalize_cpu_caps); =20 #undef F #undef SCATTERED_F diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h index d3f5ae15a7ca..3b0b4b1adb97 100644 --- a/arch/x86/kvm/cpuid.h +++ b/arch/x86/kvm/cpuid.h @@ -8,7 +8,8 @@ #include =20 extern u32 kvm_cpu_caps[NR_KVM_CPU_CAPS] __read_mostly; -void kvm_set_cpu_caps(void); +void kvm_initialize_cpu_caps(void); +void kvm_finalize_cpu_caps(void); =20 void kvm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu); struct kvm_cpuid_entry2 *kvm_find_cpuid_entry2(struct kvm_cpuid_entry2 *en= tries, diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 7803d2781144..0c23fcaedcc5 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -5305,7 +5305,7 @@ static __init void svm_adjust_mmio_mask(void) =20 static __init void svm_set_cpu_caps(void) { - kvm_set_cpu_caps(); + kvm_initialize_cpu_caps(); =20 kvm_caps.supported_perf_cap =3D 0; =20 @@ -5387,6 +5387,8 @@ static __init void svm_set_cpu_caps(void) */ kvm_cpu_cap_clear(X86_FEATURE_BUS_LOCK_DETECT); kvm_cpu_cap_clear(X86_FEATURE_MSR_IMM); + + kvm_finalize_cpu_caps(); } =20 static __init int svm_hardware_setup(void) diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 27acafd03381..7d373e32ea9c 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -8173,7 +8173,7 @@ static __init u64 vmx_get_perf_capabilities(void) =20 static __init void vmx_set_cpu_caps(void) { - kvm_set_cpu_caps(); + kvm_initialize_cpu_caps(); =20 /* CPUID 0x1 */ if (nested) @@ -8230,6 +8230,8 @@ static __init void vmx_set_cpu_caps(void) kvm_cpu_cap_clear(X86_FEATURE_SHSTK); kvm_cpu_cap_clear(X86_FEATURE_IBT); } + + kvm_finalize_cpu_caps(); } =20 static bool vmx_is_io_intercepted(struct kvm_vcpu *vcpu, diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 8acfdfc583a1..36385e6aebfa 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -220,7 +220,6 @@ static DEFINE_PER_CPU(struct kvm_user_return_msrs, user= _return_msrs); | XFEATURE_MASK_BNDCSR | XFEATURE_MASK_AVX512 \ | XFEATURE_MASK_PKRU | XFEATURE_MASK_XTILE) =20 -#define XFEATURE_MASK_CET_ALL (XFEATURE_MASK_CET_USER | XFEATURE_MASK_CET_= KERNEL) /* * Note, KVM supports exposing PT to the guest, but does not support conte= xt * switching PT via XSTATE (KVM's PT virtualization relies on perf; swappi= ng @@ -10138,19 +10137,6 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *o= ps) if (!tdp_enabled) kvm_caps.supported_quirks &=3D ~KVM_X86_QUIRK_IGNORE_GUEST_PAT; =20 - if (!kvm_cpu_cap_has(X86_FEATURE_XSAVES)) - kvm_caps.supported_xss =3D 0; - - if (!kvm_cpu_cap_has(X86_FEATURE_SHSTK) && - !kvm_cpu_cap_has(X86_FEATURE_IBT)) - kvm_caps.supported_xss &=3D ~XFEATURE_MASK_CET_ALL; - - if ((kvm_caps.supported_xss & XFEATURE_MASK_CET_ALL) !=3D XFEATURE_MASK_C= ET_ALL) { - kvm_cpu_cap_clear(X86_FEATURE_SHSTK); - kvm_cpu_cap_clear(X86_FEATURE_IBT); - kvm_caps.supported_xss &=3D ~XFEATURE_MASK_CET_ALL; - } - if (kvm_caps.has_tsc_control) { /* * Make sure the user can only configure tsc_khz values that diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h index 70e81f008030..9edfac5d5ffb 100644 --- a/arch/x86/kvm/x86.h +++ b/arch/x86/kvm/x86.h @@ -483,6 +483,8 @@ extern struct kvm_host_values kvm_host; extern bool enable_pmu; extern bool enable_mediated_pmu; =20 +#define XFEATURE_MASK_CET_ALL (XFEATURE_MASK_CET_USER | XFEATURE_MASK_CET_= KERNEL) + /* * Get a filtered version of KVM's supported XCR0 that strips out dynamic * features for which the current process doesn't (yet) have permission to= use. --=20 2.52.0.457.g6b5491de43-goog