Re: [PATCH v15 17/41] KVM: VMX: Set host constant supervisor states to VMCS fields

Xiaoyao Li
2025-09-17T08:48:52Z

On 9/13/2025 7:22 AM, Sean Christopherson wrote:
...
> +static inline bool cpu_has_load_cet_ctrl(void)
> +{
> + return (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_CET_STATE);
> +}

When looking at the patch 19, I realize that

{ VM_ENTRY_LOAD_CET_STATE, VM_EXIT_LOAD_CET_STATE }

is added into vmcs_entry_exit_pairs[] there.

So ...

> static inline bool cpu_has_vmx_mpx(void)
> {
> return vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_BNDCFGS;
> diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> index adf5af30e537..e8155635cb42 100644
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -4320,6 +4320,21 @@ void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
>
> if (cpu_has_load_ia32_efer())
> vmcs_write64(HOST_IA32_EFER, kvm_host.efer);
> +
> + /*
> + * Supervisor shadow stack is not enabled on host side, i.e.,
> + * host IA32_S_CET.SHSTK_EN bit is guaranteed to 0 now, per SDM
> + * description(RDSSP instruction), SSP is not readable in CPL0,
> + * so resetting the two registers to 0s at VM-Exit does no harm
> + * to kernel execution. When execution flow exits to userspace,
> + * SSP is reloaded from IA32_PL3_SSP. Check SDM Vol.2A/B Chapter
> + * 3 and 4 for details.
> + */
> + if (cpu_has_load_cet_ctrl()) {

... cpu_has_load_cet_ctrl() cannot ensure the existence of host CET
fields, unless we change it to check vmcs_config.vmexit_ctrl or add CET
entry_exit pair into the vmcs_entry_exit_pairs[] in this patch.

> + vmcs_writel(HOST_S_CET, kvm_host.s_cet);
> + vmcs_writel(HOST_SSP, 0);
> + vmcs_writel(HOST_INTR_SSP_TABLE, 0);
> + }
> }