Commit f8ade833 authored by Sean Christopherson's avatar Sean Christopherson
Browse files

KVM: x86: Explicitly configure supported XSS from {svm,vmx}_set_cpu_caps() 



Explicitly configure KVM's supported XSS as part of each vendor's setup
flow to fix a bug where clearing SHSTK and IBT in kvm_cpu_caps, e.g. due
to lack of CET XFEATURE support, makes kvm-intel.ko unloadable when nested
VMX is enabled, i.e. when nested=1.  The late clearing results in
nested_vmx_setup_{entry,exit}_ctls() clearing VM_{ENTRY,EXIT}_LOAD_CET_STATE
when nested_vmx_setup_ctls_msrs() runs during the CPU compatibility checks,
ultimately leading to a mismatched VMCS config due to the reference config
having the CET bits set, but every CPU's "local" config having the bits
cleared.

Note, kvm_caps.supported_{xcr0,xss} are unconditionally initialized by
kvm_x86_vendor_init(), before calling into vendor code, and not referenced
between ops->hardware_setup() and their current/old location.

Fixes: 69cc3e88 ("KVM: x86: Add XSS support for CET_KERNEL and CET_USER")
Cc: stable@vger.kernel.org
Cc: Mathias Krause <minipli@grsecurity.net>
Cc: John Allen <john.allen@amd.com>
Cc: Rick Edgecombe <rick.p.edgecombe@intel.com>
Cc: Chao Gao <chao.gao@intel.com>
Cc: Binbin Wu <binbin.wu@linux.intel.com>
Cc: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: default avatarXiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: default avatarBinbin Wu <binbin.wu@linux.intel.com>
Link: https://patch.msgid.link/20260128014310.3255561-2-seanjc@google.com


Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent e396a742

arch/x86/kvm/svm/svm.c

+2 −0
Original line number Diff line number Diff line
@@ -5284,6 +5284,8 @@ static __init void svm_set_cpu_caps(void) 
	 */

	kvm_cpu_cap_clear(X86_FEATURE_BUS_LOCK_DETECT);

	kvm_cpu_cap_clear(X86_FEATURE_MSR_IMM);



	kvm_setup_xss_caps();

}



static __init int svm_hardware_setup(void)

arch/x86/kvm/vmx/vmx.c

+2 −0
Original line number Diff line number Diff line
@@ -8051,6 +8051,8 @@ static __init void vmx_set_cpu_caps(void) 
		kvm_cpu_cap_clear(X86_FEATURE_SHSTK);

		kvm_cpu_cap_clear(X86_FEATURE_IBT);

	}



	kvm_setup_xss_caps();

}



static bool vmx_is_io_intercepted(struct kvm_vcpu *vcpu,

arch/x86/kvm/x86.c

+17 −13
Original line number Diff line number Diff line
@@ -9953,6 +9953,23 @@ static struct notifier_block pvclock_gtod_notifier = { 
};

#endif



void kvm_setup_xss_caps(void)

{

	if (!kvm_cpu_cap_has(X86_FEATURE_XSAVES))

		kvm_caps.supported_xss = 0;



	if (!kvm_cpu_cap_has(X86_FEATURE_SHSTK) &&

	    !kvm_cpu_cap_has(X86_FEATURE_IBT))

		kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_ALL;



	if ((kvm_caps.supported_xss & XFEATURE_MASK_CET_ALL) != XFEATURE_MASK_CET_ALL) {

		kvm_cpu_cap_clear(X86_FEATURE_SHSTK);

		kvm_cpu_cap_clear(X86_FEATURE_IBT);

		kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_ALL;

	}

}

EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_setup_xss_caps);



static inline void kvm_ops_update(struct kvm_x86_init_ops *ops)

{

	memcpy(&kvm_x86_ops, ops->runtime_ops, sizeof(kvm_x86_ops));
@@ -10125,19 +10142,6 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *ops) 
	if (!tdp_enabled)

		kvm_caps.supported_quirks &= ~KVM_X86_QUIRK_IGNORE_GUEST_PAT;



	if (!kvm_cpu_cap_has(X86_FEATURE_XSAVES))

		kvm_caps.supported_xss = 0;



	if (!kvm_cpu_cap_has(X86_FEATURE_SHSTK) &&

	    !kvm_cpu_cap_has(X86_FEATURE_IBT))

		kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_ALL;



	if ((kvm_caps.supported_xss & XFEATURE_MASK_CET_ALL) != XFEATURE_MASK_CET_ALL) {

		kvm_cpu_cap_clear(X86_FEATURE_SHSTK);

		kvm_cpu_cap_clear(X86_FEATURE_IBT);

		kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_ALL;

	}



	if (kvm_caps.has_tsc_control) {

		/*

		 * Make sure the user can only configure tsc_khz values that

arch/x86/kvm/x86.h

+2 −0
Original line number Diff line number Diff line
@@ -471,6 +471,8 @@ extern struct kvm_host_values kvm_host; 


extern bool enable_pmu;



void kvm_setup_xss_caps(void);



/*

 * Get a filtered version of KVM's supported XCR0 that strips out dynamic

 * features for which the current process doesn't (yet) have permission to use.