Re: [PATCH v15 00/41] KVM: x86: Mega-CET

Mathias Krause
2025-09-15T13:18:19Z

[-- Attachment #1: Type: text/plain, Size: 1434 bytes --]

Am 13.09.25 um 01:22 schrieb Sean Christopherson:
> This series is (hopefully) all of the in-flight CET virtualization patches
> in one big bundle. Please holler if I missed a patch or three as this is what
> I am planning on applying for 6.18 (modulo fixups and whatnot), i.e. if there's
> something else that's needed to enable CET virtualization, now's the time...
>
> Patches 1-3 probably need the most attention, as they are new in v15 and I
> don't have a fully working SEV-ES setup (don't have the right guest firmware,
> ugh). Though testing on everything would be much appreciated.
>
> I kept almost all Tested-by tags even for patches that I massaged a bit, and
> only dropped tags for the "don't emulate CET stuff" patch. In theory, the
> changes I've made *should* be benign. Please yell, loudly, if I broken
> something and/or you want me to drop your Tested-by.

I retested this series on my Alder Lake NUC (i7-1260P) and with the
attached hacky patch on top of Chao's QEMU branch[1] -- which points to
commit 02364ef48c96 ("fixup! target/i386: Enable XSAVES support for CET
states") for me right now -- the KUT CET tests[2] pass just fine on the
host as well as within a guest, i.e. nested. Therefore my Tested-by
still stands -- at least for the Intel/VMX part.

Thanks,
Mathias

[1] https://github.com/gaochaointel/qemu-dev#qemu-cet
[2]
https://lore.kernel.org/kvm/20250626073459.12990-1-minipli@grsecurity.net/

[-- Attachment #2: qemu_cet_v15.diff --]
[-- Type: text/x-patch, Size: 1423 bytes --]

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index ce3c52fd0f7d..d07dfc714a3c 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -5320,8 +5320,7 @@ static int kvm_get_nested_state(X86CPU *cpu)
return ret;
}

-#define KVM_X86_REG_SYNTHETIC_MSR BIT_ULL(35)
-#define REG_MSR_INDEX(x) (KVM_X86_REG_SYNTHETIC_MSR | x)
+#define KVM_X86_REG_SSP (0x20300003ULL << 32 | 0x00000000)

static bool has_cet_ssp(CPUState *cpu)
{
@@ -5409,9 +5408,9 @@ int kvm_arch_put_registers(CPUState *cpu, int level, Error **errp)
}

if (has_cet_ssp(cpu)) {
- ret = kvm_set_one_reg(cpu, REG_MSR_INDEX(0ull), &env->guest_ssp);
+ ret = kvm_set_one_reg(cpu, KVM_X86_REG_SSP, &env->guest_ssp);
if (ret) {
- error_report("Failed to set KVM_REG_MSR, ret = %d\n", ret);
+ error_report("Failed to set KVM_REG_MSR, ret = %d", ret);
}
}

@@ -5489,9 +5488,9 @@ int kvm_arch_get_registers(CPUState *cs, Error **errp)
goto out;
}
if (has_cet_ssp(cs)) {
- ret = kvm_get_one_reg(cs, REG_MSR_INDEX(0ull), &env->guest_ssp);
+ ret = kvm_get_one_reg(cs, KVM_X86_REG_SSP, &env->guest_ssp);
if (ret) {
- error_report("Failed to get KVM_REG_MSR, ret = %d\n", ret);
+ error_report("Failed to get KVM_REG_MSR, ret = %d", ret);
}
}
ret = kvm_get_apic(cpu);