From nobody Mon Feb 9 00:54:17 2026 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D769E258CDC for ; Wed, 28 Jan 2026 01:43:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769564596; cv=none; b=ncoPHUV7j/1uoaqYw3lmdeR0NS4wIR5C6xpEJU/nxs5cn++K1gpcomb8qGIaPiIRufLbWvtxQlT5zbvWtgiBk4TBDKqESSPuE3rfq65tEK98QPX2rDpwzcZXs+hM1w4Oz6D0fek7EVragWrEBUmLejKms511JhQebP/SaLoWBWw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769564596; c=relaxed/simple; bh=eavUFYdilWC4NDM0QmP02+ef9dX8BH7Zs1ktMcFbyJM=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=IVGecd8K/E1kJ52gGaJxLyeyxggEl7G2MiGn8s2jf/rXxI4f2NmSnnYKBvkiavrrdE+kQCz0ewt0abJNsX1ULxMGyGUTEqSttnezGQQciNzqcvGl+wvIi8dxyFswBN+K2aqE8tlR6yugO97QaIf02ppamxyolMUZmkczTc8KQ0w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=Jg+/PQQs; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Jg+/PQQs" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-2a7d7b87977so53309545ad.0 for ; Tue, 27 Jan 2026 17:43:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1769564594; x=1770169394; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=Dycno8xrJTeHUt9FVeo8HJWayzqn06ym8ZC4RBKnLqw=; b=Jg+/PQQsPFcksCp4Sxk9n/l7dLzMp0V6YM3xC+1AsMm94qmCcp8bYOTTqZWicOp7Bp YgPk9ujK0hbU6bsvh5E9mv8j8PVceJwBVJ/0j/UYLq1St1QQySZVzBnrCpXVNNjV97/L gm3dPVemUkR/djAjWfZD+thEBsy4xhYUaTwNFARYZqDeiP7FYJCHshE51xYSB8l79p0Q txXRuzznAJoqhT6J/l013ZODKMv6PFcUq0wXl5PP4tAJq+YCXOCYuNnAWwWJ+rOVFzRv PKlxJLa4WW6I/RKmm8DyShBYSRCt1/tGwWYCSit9Ur/mbrxNE9LTwPuL+kC2Cg6YvCmn vFnQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769564594; x=1770169394; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Dycno8xrJTeHUt9FVeo8HJWayzqn06ym8ZC4RBKnLqw=; b=OWxf7nrJHU9CwVxdQZ1la5F2R5CxM35PoxCOvChJAhebLZFoCZMBD5BsDCgB6SuNY3 aaQjihhdoljPb8yvF/x3iwlkjLZao7aeIUeTt7edaWDoxWh92b7EFGQDk3RzwU/GHT9k /fHvDMsuf8kCKQO7fYqErbJiBNeSGAkBb9I1QmUYG+WimkI9MeNsMikG9g6gZrxoY+AW hQ4jXjoLUyyyJccqKv4ctnBvxDGOj8/3XL/F+GVkiqTDi+6pMlHyY7N3qcrRksE4JLJT srn/ZdJhlP0zkTaVPK2QsSqys9a1xyabXK2SfC7Wy+hDesOBZiveZ/WJOt10QyST83PX R/7g== X-Forwarded-Encrypted: i=1; AJvYcCV8u8RZxo6yHo50QPfUVCTL7KHv3GPlo3fhyPlrF7OM0F9utpGiBpVOmZ+jK+bpsWMwRsx5k+VH8pmMY1Q=@vger.kernel.org X-Gm-Message-State: AOJu0YxEtxw6RUGSdWJ5Z0/Kb6VUzRVYZxRNnjOiXNE2oeT0nAn2yyXx iAKcHKaVsvxR6UH1GCUGpjQaaxiRAJqInsdr/YZhACUyD3yz7yT1NHdFILRrDbQosAkNuRfhMAo AD7N9KA== X-Received: from plbmj14.prod.google.com ([2002:a17:903:2b8e:b0:2a0:de6a:ac6c]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:2291:b0:2a1:5f23:7ddf with SMTP id d9443c01a7336-2a870d452d6mr30868615ad.6.1769564594217; Tue, 27 Jan 2026 17:43:14 -0800 (PST) Reply-To: Sean Christopherson Date: Tue, 27 Jan 2026 17:43:08 -0800 In-Reply-To: <20260128014310.3255561-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260128014310.3255561-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.457.g6b5491de43-goog Message-ID: <20260128014310.3255561-2-seanjc@google.com> Subject: [PATCH v2 1/3] KVM: x86: Explicitly configure supported XSS from {svm,vmx}_set_cpu_caps() From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Mathias Krause , John Allen , Rick Edgecombe , Chao Gao , Binbin Wu , Xiaoyao Li , Jim Mattson Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Explicitly configure KVM's supported XSS as part of each vendor's setup flow to fix a bug where clearing SHSTK and IBT in kvm_cpu_caps, e.g. due to lack of CET XFEATURE support, makes kvm-intel.ko unloadable when nested VMX is enabled, i.e. when nested=3D1. The late clearing results in nested_vmx_setup_{entry,exit}_ctls() clearing VM_{ENTRY,EXIT}_LOAD_CET_STATE when nested_vmx_setup_ctls_msrs() runs during the CPU compatibility checks, ultimately leading to a mismatched VMCS config due to the reference config having the CET bits set, but every CPU's "local" config having the bits cleared. Note, kvm_caps.supported_{xcr0,xss} are unconditionally initialized by kvm_x86_vendor_init(), before calling into vendor code, and not referenced between ops->hardware_setup() and their current/old location. Fixes: 69cc3e886582 ("KVM: x86: Add XSS support for CET_KERNEL and CET_USER= ") Cc: stable@vger.kernel.org Cc: Mathias Krause Cc: John Allen Cc: Rick Edgecombe Cc: Chao Gao Cc: Binbin Wu Cc: Xiaoyao Li Signed-off-by: Sean Christopherson Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li --- arch/x86/kvm/svm/svm.c | 2 ++ arch/x86/kvm/vmx/vmx.c | 2 ++ arch/x86/kvm/x86.c | 30 +++++++++++++++++------------- arch/x86/kvm/x86.h | 2 ++ 4 files changed, 23 insertions(+), 13 deletions(-) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 7803d2781144..c00a696dacfc 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -5387,6 +5387,8 @@ static __init void svm_set_cpu_caps(void) */ kvm_cpu_cap_clear(X86_FEATURE_BUS_LOCK_DETECT); kvm_cpu_cap_clear(X86_FEATURE_MSR_IMM); + + kvm_setup_xss_caps(); } =20 static __init int svm_hardware_setup(void) diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 27acafd03381..9f85c3829890 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -8230,6 +8230,8 @@ static __init void vmx_set_cpu_caps(void) kvm_cpu_cap_clear(X86_FEATURE_SHSTK); kvm_cpu_cap_clear(X86_FEATURE_IBT); } + + kvm_setup_xss_caps(); } =20 static bool vmx_is_io_intercepted(struct kvm_vcpu *vcpu, diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 8acfdfc583a1..cac1d6a67b49 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -9965,6 +9965,23 @@ static struct notifier_block pvclock_gtod_notifier = =3D { }; #endif =20 +void kvm_setup_xss_caps(void) +{ + if (!kvm_cpu_cap_has(X86_FEATURE_XSAVES)) + kvm_caps.supported_xss =3D 0; + + if (!kvm_cpu_cap_has(X86_FEATURE_SHSTK) && + !kvm_cpu_cap_has(X86_FEATURE_IBT)) + kvm_caps.supported_xss &=3D ~XFEATURE_MASK_CET_ALL; + + if ((kvm_caps.supported_xss & XFEATURE_MASK_CET_ALL) !=3D XFEATURE_MASK_C= ET_ALL) { + kvm_cpu_cap_clear(X86_FEATURE_SHSTK); + kvm_cpu_cap_clear(X86_FEATURE_IBT); + kvm_caps.supported_xss &=3D ~XFEATURE_MASK_CET_ALL; + } +} +EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_setup_xss_caps); + static inline void kvm_ops_update(struct kvm_x86_init_ops *ops) { memcpy(&kvm_x86_ops, ops->runtime_ops, sizeof(kvm_x86_ops)); @@ -10138,19 +10155,6 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *o= ps) if (!tdp_enabled) kvm_caps.supported_quirks &=3D ~KVM_X86_QUIRK_IGNORE_GUEST_PAT; =20 - if (!kvm_cpu_cap_has(X86_FEATURE_XSAVES)) - kvm_caps.supported_xss =3D 0; - - if (!kvm_cpu_cap_has(X86_FEATURE_SHSTK) && - !kvm_cpu_cap_has(X86_FEATURE_IBT)) - kvm_caps.supported_xss &=3D ~XFEATURE_MASK_CET_ALL; - - if ((kvm_caps.supported_xss & XFEATURE_MASK_CET_ALL) !=3D XFEATURE_MASK_C= ET_ALL) { - kvm_cpu_cap_clear(X86_FEATURE_SHSTK); - kvm_cpu_cap_clear(X86_FEATURE_IBT); - kvm_caps.supported_xss &=3D ~XFEATURE_MASK_CET_ALL; - } - if (kvm_caps.has_tsc_control) { /* * Make sure the user can only configure tsc_khz values that diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h index 70e81f008030..94d4f07aaaa0 100644 --- a/arch/x86/kvm/x86.h +++ b/arch/x86/kvm/x86.h @@ -483,6 +483,8 @@ extern struct kvm_host_values kvm_host; extern bool enable_pmu; extern bool enable_mediated_pmu; =20 +void kvm_setup_xss_caps(void); + /* * Get a filtered version of KVM's supported XCR0 that strips out dynamic * features for which the current process doesn't (yet) have permission to= use. --=20 2.52.0.457.g6b5491de43-goog