[PATCH] KVM: nSVM: Gate CET state copy in svm_copy_vmrun_state() on guest SHSTK

[PATCH] KVM: nSVM: Gate CET state copy in svm_copy_vmrun_state() on guest SHSTK

[Jim Mattson]

Like nested_vmcb02_prepare_save() and nested_svm_vmexit_update_vmcb12(),
svm_copy_vmrun_state() should gate copying s_cet, isst_addr, and ssp on
guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) (i.e. the feature is advertised
to the guest). Instead, copying is gated on
kvm_cpu_cap_has(X86_FEATURE_SHSTK) (i.e. the host supports shadow stacks).

Check guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) instead of
kvm_cpu_cap_has(X86_FEATURE_SHSTK) in svm_copy_vmrun_state().

Fixes: c5ba49458513 ("KVM: nSVM: Save/load CET Shadow Stack state to/from vmcb12/vmcb02")
Signed-off-by: Jim Mattson <jmattson@google.com>
---
 arch/x86/kvm/svm/nested.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index 1299fdadeb73..b73bc9c3ebdb 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1248,7 +1248,7 @@ void svm_copy_vmrun_state(struct kvm_vcpu *vcpu, struct vmcb_save_area *to_save,
 	to_save->rip = from_save->rip;
 	to_save->cpl = 0;
 
-	if (kvm_cpu_cap_has(X86_FEATURE_SHSTK)) {
+	if (guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK)) {
 		to_save->s_cet  = from_save->s_cet;
 		to_save->isst_addr = from_save->isst_addr;
 		to_save->ssp = from_save->ssp;
-- 
2.56.1.703.gf848ed807c-goog

Re: [PATCH] KVM: nSVM: Gate CET state copy in svm_copy_vmrun_state() on guest SHSTK

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] KVM: nSVM: undeclared vcpu in svm_copy_vmrun_state() breaks
  build
--

commit 11b89023661c173dccf1cc07088879a6b4ff0bef
Author: Jim Mattson <jmattson@google.com>

KVM: nSVM: Gate CET state copy in svm_copy_vmrun_state() on guest SHSTK

This commit changes svm_copy_vmrun_state() to check
guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) instead of
kvm_cpu_cap_has(X86_FEATURE_SHSTK) before copying CET shadow stack fields.

> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index f9090b601efaa..2a1c279bd54a1 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -1218,7 +1218,7 @@ void svm_copy_vmrun_state(struct vmcb_save_area *to_save,
>  	to_save->rip = from_save->rip;
>  	to_save->cpl = 0;
>  
> -	if (kvm_cpu_cap_has(X86_FEATURE_SHSTK)) {
> +	if (guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK)) {
>  		to_save->s_cet  = from_save->s_cet;
>  		to_save->isst_addr = from_save->isst_addr;
>  		to_save->ssp = from_save->ssp;

[Severity: High]
Does this fail to build because vcpu is undeclared in
svm_copy_vmrun_state()?  The function only takes to_save and from_save, so
its signature and callers in svm_set_nested_state(), svm_enter_smm(), and
svm_leave_smm() need to pass vcpu as well.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112212628.265262-1-jmattson@google.com?part=1

Re: [PATCH] KVM: nSVM: Gate CET state copy in svm_copy_vmrun_state() on guest SHSTK

[Jim Mattson]

On Thu, Nov 12, 2026 at 1:32 PM <sashiko-bot@kernel.org> wrote:
>
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue to consider:
> - [High] KVM: nSVM: undeclared vcpu in svm_copy_vmrun_state() breaks
>   build
> --
>
> commit 11b89023661c173dccf1cc07088879a6b4ff0bef
> Author: Jim Mattson <jmattson@google.com>
>
> KVM: nSVM: Gate CET state copy in svm_copy_vmrun_state() on guest SHSTK
>
> This commit changes svm_copy_vmrun_state() to check
> guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) instead of
> kvm_cpu_cap_has(X86_FEATURE_SHSTK) before copying CET shadow stack fields.
>
> > diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> > index f9090b601efaa..2a1c279bd54a1 100644
> > --- a/arch/x86/kvm/svm/nested.c
> > +++ b/arch/x86/kvm/svm/nested.c
> > @@ -1218,7 +1218,7 @@ void svm_copy_vmrun_state(struct vmcb_save_area *to_save,
> >       to_save->rip = from_save->rip;
> >       to_save->cpl = 0;
> >
> > -     if (kvm_cpu_cap_has(X86_FEATURE_SHSTK)) {
> > +     if (guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK)) {
> >               to_save->s_cet  = from_save->s_cet;
> >               to_save->isst_addr = from_save->isst_addr;
> >               to_save->ssp = from_save->ssp;
>
> [Severity: High]
> Does this fail to build because vcpu is undeclared in
> svm_copy_vmrun_state()?  The function only takes to_save and from_save, so
> its signature and callers in svm_set_nested_state(), svm_enter_smm(), and
> svm_leave_smm() need to pass vcpu as well.

I should have mentioned that the base-commit is
dea4f6380f4ec96e8f3b0aaf2343764bd0d25ef4.

Commit cd0e6f4d7cec ("KVM: SVM: Add a vCPU-aware helper to get
supported DEBUGCTL bits") changed the signature of
svm_copy_vmrun_state().

Odd that you quote me as writing:

@@ -1218,7 +1218,7 @@ void svm_copy_vmrun_state(struct vmcb_save_area *to_save,

when, in fact, I wrote:

@@ -1248,7 +1248,7 @@ void svm_copy_vmrun_state(struct kvm_vcpu *vcpu,
struct vmcb_save_area *to_save,

Re: [PATCH] KVM: nSVM: Gate CET state copy in svm_copy_vmrun_state() on guest SHSTK

[Yosry Ahmed]

On Thu, Nov 12, 2026 at 1:26 PM Jim Mattson <jmattson@google.com> wrote:
>
> Like nested_vmcb02_prepare_save() and nested_svm_vmexit_update_vmcb12(),
> svm_copy_vmrun_state() should gate copying s_cet, isst_addr, and ssp on
> guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) (i.e. the feature is advertised
> to the guest). Instead, copying is gated on
> kvm_cpu_cap_has(X86_FEATURE_SHSTK) (i.e. the host supports shadow stacks).

This is a bit confusing, nested_vmcb02_prepare_save() and
nested_svm_vmexit_update_vmcb12() are about vmcb12 <-> vmcb02, so L2's
state, while svm_copy_vmrun_state() is for L1's state. I think the
patch is correct, but the examples are confusing.

Perhaps a better example would be __kvm_set_msr() and __kvm_get_msr()?

>
> Check guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) instead of
> kvm_cpu_cap_has(X86_FEATURE_SHSTK) in svm_copy_vmrun_state().
>
> Fixes: c5ba49458513 ("KVM: nSVM: Save/load CET Shadow Stack state to/from vmcb12/vmcb02")
> Signed-off-by: Jim Mattson <jmattson@google.com>
> ---
>  arch/x86/kvm/svm/nested.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index 1299fdadeb73..b73bc9c3ebdb 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -1248,7 +1248,7 @@ void svm_copy_vmrun_state(struct kvm_vcpu *vcpu, struct vmcb_save_area *to_save,
>         to_save->rip = from_save->rip;
>         to_save->cpl = 0;
>
> -       if (kvm_cpu_cap_has(X86_FEATURE_SHSTK)) {
> +       if (guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK)) {
>                 to_save->s_cet  = from_save->s_cet;
>                 to_save->isst_addr = from_save->isst_addr;
>                 to_save->ssp = from_save->ssp;
> --
> 2.56.1.703.gf848ed807c-goog
>

Re: [PATCH] KVM: nSVM: Gate CET state copy in svm_copy_vmrun_state() on guest SHSTK

[Jim Mattson]

On Thu, Nov 12, 2026 at 2:41 PM Yosry Ahmed <yosry@kernel.org> wrote:
>
> On Thu, Nov 12, 2026 at 1:26 PM Jim Mattson <jmattson@google.com> wrote:
> >
> > Like nested_vmcb02_prepare_save() and nested_svm_vmexit_update_vmcb12(),
> > svm_copy_vmrun_state() should gate copying s_cet, isst_addr, and ssp on
> > guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) (i.e. the feature is advertised
> > to the guest). Instead, copying is gated on
> > kvm_cpu_cap_has(X86_FEATURE_SHSTK) (i.e. the host supports shadow stacks).
>
> This is a bit confusing, nested_vmcb02_prepare_save() and
> nested_svm_vmexit_update_vmcb12() are about vmcb12 <-> vmcb02, so L2's
> state, while svm_copy_vmrun_state() is for L1's state. I think the
> patch is correct, but the examples are confusing.
>
> Perhaps a better example would be __kvm_set_msr() and __kvm_get_msr()?

Or, perhaps I should just drop the examples?