Re: [PATCH v15 17/41] KVM: VMX: Set host constant supervisor states to VMCS fields

Sean Christopherson
2025-09-17T21:25:27Z

On Wed, Sep 17, 2025, Xiaoyao Li wrote:
> On 9/13/2025 7:22 AM, Sean Christopherson wrote:
> ...
> > +static inline bool cpu_has_load_cet_ctrl(void)
> > +{
> > + return (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_CET_STATE);
> > +}
>
> When looking at the patch 19, I realize that
>
> { VM_ENTRY_LOAD_CET_STATE, VM_EXIT_LOAD_CET_STATE }
>
> is added into vmcs_entry_exit_pairs[] there.
>
> So ...
>
> > static inline bool cpu_has_vmx_mpx(void)
> > {
> > return vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_BNDCFGS;
> > diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> > index adf5af30e537..e8155635cb42 100644
> > --- a/arch/x86/kvm/vmx/vmx.c
> > +++ b/arch/x86/kvm/vmx/vmx.c
> > @@ -4320,6 +4320,21 @@ void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
> > if (cpu_has_load_ia32_efer())
> > vmcs_write64(HOST_IA32_EFER, kvm_host.efer);
> > +
> > + /*
> > + * Supervisor shadow stack is not enabled on host side, i.e.,
> > + * host IA32_S_CET.SHSTK_EN bit is guaranteed to 0 now, per SDM
> > + * description(RDSSP instruction), SSP is not readable in CPL0,
> > + * so resetting the two registers to 0s at VM-Exit does no harm
> > + * to kernel execution. When execution flow exits to userspace,
> > + * SSP is reloaded from IA32_PL3_SSP. Check SDM Vol.2A/B Chapter
> > + * 3 and 4 for details.
> > + */
> > + if (cpu_has_load_cet_ctrl()) {
>
> ... cpu_has_load_cet_ctrl() cannot ensure the existence of host CET fields,
> unless we change it to check vmcs_config.vmexit_ctrl or add CET entry_exit
> pair into the vmcs_entry_exit_pairs[] in this patch.

I *love* the attention to detail, but I think we're actually good, technically.

cpu_has_load_cet_ctrl() will always return %false until patch 19, because
VM_ENTRY_LOAD_CET_STATE isn't added to the set of OPTIONAL controls until then,
i.e. VM_ENTRY_LOAD_CET_STATE won't be set in vmcs_config.vmentry_ctrl until
the exit control is as well (and the sanity check is in place).

> > + vmcs_writel(HOST_S_CET, kvm_host.s_cet);
> > + vmcs_writel(HOST_SSP, 0);
> > + vmcs_writel(HOST_INTR_SSP_TABLE, 0);
> > + }
> > }