KVM: VMX: Set host constant supervisor states to VMCS fields

Save constant values to HOST_{S_CET,SSP,INTR_SSP_TABLE} field explicitly.
Kernel IBT is supported and the setting in MSR_IA32_S_CET is static after
post-boot(The exception is BIOS call case but vCPU thread never across it)
and KVM doesn't need to refresh HOST_S_CET field before every VM-Enter/
VM-Exit sequence.

Host supervisor shadow stack is not enabled now and SSP is not accessible
to kernel mode, thus it's safe to set host IA32_INT_SSP_TAB/SSP VMCS field
to 0s. When shadow stack is enabled for CPL3, SSP is reloaded from PL3_SSP
before it exits to userspace. Check SDM Vol 2A/B Chapter 3/4 for SYSCALL/
SYSRET/SYSENTER SYSEXIT/RDSSP/CALL etc.

Prevent KVM module loading if host supervisor shadow stack SHSTK_EN is set
in MSR_IA32_S_CET as KVM cannot co-exit with it correctly.

Suggested-by: Sean Christopherson <seanjc@google.com>
Suggested-by: Chao Gao <chao.gao@intel.com>
Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
Reviewed-by: Chao Gao <chao.gao@intel.com>
Tested-by: Mathias Krause <minipli@grsecurity.net>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Chao Gao <chao.gao@intel.com>
[sean: snapshot host S_CET if SHSTK *or* IBT is supported]
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Link: https://lore.kernel.org/r/20250919223258.1604852-18-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/vmx/capabilities.h b/arch/x86/kvm/vmx/capabilities.h
index f614428dbeda7d85a24aff245aad9ba745be8623..59c83888bdc01ba6d6cb1dfbc4678433346fae8e 100644 (file)
--- a/arch/x86/kvm/vmx/capabilities.h
+++ b/arch/x86/kvm/vmx/capabilities.h
@@ -100,6 +100,10 @@ static inline bool cpu_has_load_perf_global_ctrl(void)
        return vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
 }
 
+static inline bool cpu_has_load_cet_ctrl(void)
+{
+       return (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_CET_STATE);
+}
 static inline bool cpu_has_vmx_mpx(void)
 {
        return vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_BNDCFGS;

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index bde768c7111f67ec90e2464e2ff146b83e6c338c..4ab066a3c22f6e9e50ba35f22c2f165eddf25d9e 100644 (file)
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -4312,6 +4312,21 @@ void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
 
        if (cpu_has_load_ia32_efer())
                vmcs_write64(HOST_IA32_EFER, kvm_host.efer);
+
+       /*
+        * Supervisor shadow stack is not enabled on host side, i.e.,
+        * host IA32_S_CET.SHSTK_EN bit is guaranteed to 0 now, per SDM
+        * description(RDSSP instruction), SSP is not readable in CPL0,
+        * so resetting the two registers to 0s at VM-Exit does no harm
+        * to kernel execution. When execution flow exits to userspace,
+        * SSP is reloaded from IA32_PL3_SSP. Check SDM Vol.2A/B Chapter
+        * 3 and 4 for details.
+        */
+       if (cpu_has_load_cet_ctrl()) {
+               vmcs_writel(HOST_S_CET, kvm_host.s_cet);
+               vmcs_writel(HOST_SSP, 0);
+               vmcs_writel(HOST_INTR_SSP_TABLE, 0);
+       }
 }
 
 void set_cr4_guest_host_mask(struct vcpu_vmx *vmx)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 54d280fe9a4b04651ed22493e64e4a9ccc6c69f6..0050509a7de299d01b740e913e49b5ec128078a6 100644 (file)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -9997,6 +9997,18 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *ops)
                return -EIO;
        }
 
+       if (boot_cpu_has(X86_FEATURE_SHSTK) || boot_cpu_has(X86_FEATURE_IBT)) {
+               rdmsrq(MSR_IA32_S_CET, kvm_host.s_cet);
+               /*
+                * Linux doesn't yet support supervisor shadow stacks (SSS), so
+                * KVM doesn't save/restore the associated MSRs, i.e. KVM may
+                * clobber the host values.  Yell and refuse to load if SSS is
+                * unexpectedly enabled, e.g. to avoid crashing the host.
+                */
+               if (WARN_ON_ONCE(kvm_host.s_cet & CET_SHSTK_EN))
+                       return -EIO;
+       }
+
        memset(&kvm_caps, 0, sizeof(kvm_caps));
 
        x86_emulator_cache = kvm_alloc_emulator_cache();

diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 076eccba0f7e0955ff816877a4fe4b2072f4ed97..65cbd454c4f16c122289a6dd54f5310111c51b37 100644 (file)
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -50,6 +50,7 @@ struct kvm_host_values {
        u64 efer;
        u64 xcr0;
        u64 xss;
+       u64 s_cet;
        u64 arch_capabilities;
 };