KVM: x86: Explicitly configure supported XSS from {svm,vmx}_set_cpu_caps()

Explicitly configure KVM's supported XSS as part of each vendor's setup
flow to fix a bug where clearing SHSTK and IBT in kvm_cpu_caps, e.g. due
to lack of CET XFEATURE support, makes kvm-intel.ko unloadable when nested
VMX is enabled, i.e. when nested=1.  The late clearing results in
nested_vmx_setup_{entry,exit}_ctls() clearing VM_{ENTRY,EXIT}_LOAD_CET_STATE
when nested_vmx_setup_ctls_msrs() runs during the CPU compatibility checks,
ultimately leading to a mismatched VMCS config due to the reference config
having the CET bits set, but every CPU's "local" config having the bits
cleared.

Note, kvm_caps.supported_{xcr0,xss} are unconditionally initialized by
kvm_x86_vendor_init(), before calling into vendor code, and not referenced
between ops->hardware_setup() and their current/old location.

Fixes: 69cc3e886582 ("KVM: x86: Add XSS support for CET_KERNEL and CET_USER")
Cc: stable@vger.kernel.org
Cc: Mathias Krause <minipli@grsecurity.net>
Cc: John Allen <john.allen@amd.com>
Cc: Rick Edgecombe <rick.p.edgecombe@intel.com>
Cc: Chao Gao <chao.gao@intel.com>
Cc: Binbin Wu <binbin.wu@linux.intel.com>
Cc: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Link: https://patch.msgid.link/20260128014310.3255561-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 24d59ccfa40d9a79eb1d570207fa5debdff5a2fa..4394be40fe78d70439e52cbed41a4d0cdda277bd 100644 (file)
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -5284,6 +5284,8 @@ static __init void svm_set_cpu_caps(void)
         */
        kvm_cpu_cap_clear(X86_FEATURE_BUS_LOCK_DETECT);
        kvm_cpu_cap_clear(X86_FEATURE_MSR_IMM);
+
+       kvm_setup_xss_caps();
 }
 
 static __init int svm_hardware_setup(void)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 6b96f7aea20bd3f39389da8c9a1cf890d2e29b05..8c94241fbcca70e30c56d6f17c119177d444919d 100644 (file)
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -8051,6 +8051,8 @@ static __init void vmx_set_cpu_caps(void)
                kvm_cpu_cap_clear(X86_FEATURE_SHSTK);
                kvm_cpu_cap_clear(X86_FEATURE_IBT);
        }
+
+       kvm_setup_xss_caps();
 }
 
 static bool vmx_is_io_intercepted(struct kvm_vcpu *vcpu,

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 63afdb6bb078b256b065583ce26a4b22f4eb4ca1..72d37c8930ad78e55758c90540c0e3d23160ad6f 100644 (file)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -9953,6 +9953,23 @@ static struct notifier_block pvclock_gtod_notifier = {
 };
 #endif
 
+void kvm_setup_xss_caps(void)
+{
+       if (!kvm_cpu_cap_has(X86_FEATURE_XSAVES))
+               kvm_caps.supported_xss = 0;
+
+       if (!kvm_cpu_cap_has(X86_FEATURE_SHSTK) &&
+           !kvm_cpu_cap_has(X86_FEATURE_IBT))
+               kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_ALL;
+
+       if ((kvm_caps.supported_xss & XFEATURE_MASK_CET_ALL) != XFEATURE_MASK_CET_ALL) {
+               kvm_cpu_cap_clear(X86_FEATURE_SHSTK);
+               kvm_cpu_cap_clear(X86_FEATURE_IBT);
+               kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_ALL;
+       }
+}
+EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_setup_xss_caps);
+
 static inline void kvm_ops_update(struct kvm_x86_init_ops *ops)
 {
        memcpy(&kvm_x86_ops, ops->runtime_ops, sizeof(kvm_x86_ops));
@@ -10125,19 +10142,6 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *ops)
        if (!tdp_enabled)
                kvm_caps.supported_quirks &= ~KVM_X86_QUIRK_IGNORE_GUEST_PAT;
 
-       if (!kvm_cpu_cap_has(X86_FEATURE_XSAVES))
-               kvm_caps.supported_xss = 0;
-
-       if (!kvm_cpu_cap_has(X86_FEATURE_SHSTK) &&
-           !kvm_cpu_cap_has(X86_FEATURE_IBT))
-               kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_ALL;
-
-       if ((kvm_caps.supported_xss & XFEATURE_MASK_CET_ALL) != XFEATURE_MASK_CET_ALL) {
-               kvm_cpu_cap_clear(X86_FEATURE_SHSTK);
-               kvm_cpu_cap_clear(X86_FEATURE_IBT);
-               kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_ALL;
-       }
-
        if (kvm_caps.has_tsc_control) {
                /*
                 * Make sure the user can only configure tsc_khz values that

diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index fdab0ad490988e297a370c85bf4fa54b3dd5ee68..00de24f55b1fe9afe37a811d599f6716a8b4ffc9 100644 (file)
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -471,6 +471,8 @@ extern struct kvm_host_values kvm_host;
 
 extern bool enable_pmu;
 
+void kvm_setup_xss_caps(void);
+
 /*
  * Get a filtered version of KVM's supported XCR0 that strips out dynamic
  * features for which the current process doesn't (yet) have permission to use.