Commit 343acdd1 authored by Sean Christopherson's avatar Sean Christopherson
Browse files

KVM: x86: Disable support for IBT and SHSTK if allow_smaller_maxphyaddr is true 



Make IBT and SHSTK virtualization mutually exclusive with "officially"
supporting setups with guest.MAXPHYADDR < host.MAXPHYADDR, i.e. if the
allow_smaller_maxphyaddr module param is set.  Running a guest with a
smaller MAXPHYADDR requires intercepting #PF, and can also trigger
emulation of arbitrary instructions.  Intercepting and reacting to #PFs
doesn't play nice with SHSTK, as KVM's MMU hasn't been taught to handle
Shadow Stack accesses, and emulating arbitrary instructions doesn't play
nice with IBT or SHSTK, as KVM's emulator doesn't handle the various side
effects, e.g. doesn't enforce end-branch markers or model Shadow Stack
updates.

Note, hiding IBT and SHSTK based solely on allow_smaller_maxphyaddr is
overkill, as allow_smaller_maxphyaddr is only problematic if the guest is
actually configured to have a smaller MAXPHYADDR.  However, KVM's ABI
doesn't provide a way to express that IBT and SHSTK may break if enabled
in conjunction with guest.MAXPHYADDR < host.MAXPHYADDR.  I.e. the
alternative is to do nothing in KVM and instead update documentation and
hope KVM users are thorough readers.  Go with the conservative-but-correct
approach; worst case scenario, this restriction can be dropped if there's
a strong use case for enabling CET on hosts with allow_smaller_maxphyaddr.

Reviewed-by: default avatarBinbin Wu <binbin.wu@linux.intel.com>
Link: https://lore.kernel.org/r/20250919223258.1604852-28-seanjc@google.com


Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent f705de12

arch/x86/kvm/cpuid.c

+10 −0
Original line number Diff line number Diff line
@@ -982,6 +982,16 @@ void kvm_set_cpu_caps(void) 
		F(FLUSH_L1D),

	);



	/*

	 * Disable support for IBT and SHSTK if KVM is configured to emulate

	 * accesses to reserved GPAs, as KVM's emulator doesn't support IBT or

	 * SHSTK, nor does KVM handle Shadow Stack #PFs (see above).

	 */

	if (allow_smaller_maxphyaddr) {

		kvm_cpu_cap_clear(X86_FEATURE_SHSTK);

		kvm_cpu_cap_clear(X86_FEATURE_IBT);

	}



	if (boot_cpu_has(X86_FEATURE_AMD_IBPB_RET) &&

	    boot_cpu_has(X86_FEATURE_AMD_IBPB) &&

	    boot_cpu_has(X86_FEATURE_AMD_IBRS))