[PATCH 0/5] target/i386: Add support for LASS

[PATCH 0/5] target/i386: Add support for LASS

[Kishen Maloor]

This series adds QEMU support for Linear Address Space Separation (LASS) [1],
an Intel security feature that prevents a class of side-channel attacks
relying on speculative accesses across the user/kernel boundary. Paging,
along with SMEP and SMAP, already provides mode-based access protection,
but enforcing it requires a page walk whose timing can leak the layout of
kernel memory. LASS applies the equivalent protections during
linear-address pre-processing: given the usual partitioning of the linear
address space into a user half (bit 63 clear) and a supervisor half
(bit 63 set), an access targeting the opposite half is rejected on the
basis of bit 63 alone, before any page walk.

This series enumerates the LASS CPUID bit, recognizes CR4.LASS,
and exposes LASS on the relevant Intel CPU models via new versioned models.
LASS is not emulated by TCG.

Exposing LASS to a guest also requires KVM support: KVM must validate
the CPUID bit and CR4.LASS, and enforce LASS violations in its
instruction emulator. That enabling is currently under review [2].

Tested with a Linux guest on LASS-capable hardware: LASS is enumerated and
CR4.LASS is set under KVM, and not enumerated under TCG.

[1] Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3A,
    Section 4.3, "Linear-Address-Space Separation (LASS)".
[2] https://lore.kernel.org/kvm/20260806011536.4172258-1-sohil.mehta@intel.com/

Isaku Yamahata (2):
  target/i386: Add support for LASS in CPUID enumeration
  target/i386: Add LASS support in CR4

Kishen Maloor (3):
  target/i386: Introduce DiamondRapids-v3 to enable LASS
  target/i386: Introduce SierraForest-v7 to enable LASS
  target/i386: Introduce ClearwaterForest-v5 to enable LASS

 target/i386/cpu.c    | 26 +++++++++++++++++++++++++-
 target/i386/cpu.h    |  7 ++++++-
 target/i386/helper.c |  4 ++++
 3 files changed, 35 insertions(+), 2 deletions(-)

-- 
2.47.1

[PATCH 1/5] target/i386: Add support for LASS in CPUID enumeration

[Kishen Maloor]

From: Isaku Yamahata <isaku.yamahata@intel.com>

Linear Address Space Separation (LASS) is a security feature that
prevents a class of side-channel attacks relying on speculative
accesses across the user/kernel boundary. Paging, along with SMEP
and SMAP, already provides mode-based access protection, but
enforcing it requires a page walk whose timing can leak the
layout of kernel memory.

LASS applies the equivalent protections during linear-address
pre-processing, before any page walk. Given the usual partitioning of
the linear address space into a user half (bit 63 clear) and a
supervisor half (bit 63 set), an access targeting the opposite half is
rejected on the basis of bit 63 alone, raising a #GP. LASS is enabled
via CR4.LASS[bit 27] and applies only in IA-32e mode.

Feature bit:
  CPUID.(EAX=7,ECX=1):EAX[6]

A CPUID_7_1_EAX_LASS macro was previously added in commit 31df29c532a9
("i386/tdx: Add supported CPUID bits related to TD Attributes"), but the
bit was left unnamed in feature_word_info[FEAT_7_1_EAX]. Add the "lass"
feature name to expose it via -cpu host, -cpu max, or an explicit +lass.

Exposing LASS to a guest also requires KVM support: KVM must validate
the CPUID bit and CR4.LASS, and enforce LASS violations in its
instruction emulator.

LASS is not implemented in TCG, so the bit is not added to
TCG_7_1_EAX_FEATURES.

More details can be found in the Intel 64 and IA-32 Architectures
Software Developer's Manual, Volume 3A, Section 4.3,
"Linear-Address-Space Separation (LASS)".

Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
[kishen: rewrote commit message, rebased]
Signed-off-by: Kishen Maloor <kishen.maloor@intel.com>
---
KVM support for LASS is currently under review:
https://lore.kernel.org/kvm/20260806011536.4172258-1-sohil.mehta@intel.com/

 target/i386/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 5805d33ab9..5496e9475b 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1243,7 +1243,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
         .type = CPUID_FEATURE_WORD,
         .feat_names = {
             "sha512", "sm3", "sm4", NULL,
-            "avx-vnni", "avx512-bf16", NULL, "cmpccxadd",
+            "avx-vnni", "avx512-bf16", "lass", "cmpccxadd",
             NULL, NULL, "fzrm", "fsrs",
             "fsrc", NULL, NULL, NULL,
             NULL, "fred", "lkgs", "wrmsrns",
-- 
2.47.1

Re: [PATCH 1/5] target/i386: Add support for LASS in CPUID enumeration

[Zhao Liu]

On Tue, Aug 25, 2026 at 08:57:30PM -0700, Kishen Maloor wrote:
> Date: Tue, 25 Aug 2026 20:57:30 -0700
> From: Kishen Maloor <kishen.maloor@intel.com>
> Subject: [PATCH 1/5] target/i386: Add support for LASS in CPUID enumeration
> X-Mailer: git-send-email 2.47.1
> 
> From: Isaku Yamahata <isaku.yamahata@intel.com>
> 
> Linear Address Space Separation (LASS) is a security feature that
> prevents a class of side-channel attacks relying on speculative
> accesses across the user/kernel boundary. Paging, along with SMEP
> and SMAP, already provides mode-based access protection, but
> enforcing it requires a page walk whose timing can leak the
> layout of kernel memory.
> 
> LASS applies the equivalent protections during linear-address
> pre-processing, before any page walk. Given the usual partitioning of
> the linear address space into a user half (bit 63 clear) and a
> supervisor half (bit 63 set), an access targeting the opposite half is
> rejected on the basis of bit 63 alone, raising a #GP. LASS is enabled
> via CR4.LASS[bit 27] and applies only in IA-32e mode.
> 
> Feature bit:
>   CPUID.(EAX=7,ECX=1):EAX[6]
> 
> A CPUID_7_1_EAX_LASS macro was previously added in commit 31df29c532a9
> ("i386/tdx: Add supported CPUID bits related to TD Attributes"), but the
> bit was left unnamed in feature_word_info[FEAT_7_1_EAX]. Add the "lass"
> feature name to expose it via -cpu host, -cpu max, or an explicit +lass.
> 
> Exposing LASS to a guest also requires KVM support: KVM must validate
> the CPUID bit and CR4.LASS, and enforce LASS violations in its
> instruction emulator.
> 
> LASS is not implemented in TCG, so the bit is not added to
> TCG_7_1_EAX_FEATURES.
> 
> More details can be found in the Intel 64 and IA-32 Architectures
> Software Developer's Manual, Volume 3A, Section 4.3,
> "Linear-Address-Space Separation (LASS)".
> 
> Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
> [kishen: rewrote commit message, rebased]
> Signed-off-by: Kishen Maloor <kishen.maloor@intel.com>
> ---
> KVM support for LASS is currently under review:
> https://lore.kernel.org/kvm/20260806011536.4172258-1-sohil.mehta@intel.com/
> 
>  target/i386/cpu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>

[PATCH 2/5] target/i386: Add LASS support in CR4

[Kishen Maloor]

From: Isaku Yamahata <isaku.yamahata@intel.com>

CR4.LASS[bit 27] enables Linear Address Space Separation, and may be set
only when CPUID.(EAX=7,ECX=1):EAX[6] enumerates LASS.

Recognize CR4.LASS as a valid bit by adding CR4_LASS_MASK to the known
bits, i.e. clearing it from CR4_RESERVED_MASK. Mark it reserved in
cr4_reserved_bits() and clear it in cpu_x86_update_cr4() when the guest
CPUID does not enumerate LASS. This keeps CR4 handling consistent on
paths that reach cpu_x86_update_cr4(), such as gdbstub register writes.

LASS is not emulated by TCG, so it is not added to TCG_7_1_EAX_FEATURES
and cannot be set under TCG (helper_write_crN() and helper_vmrun() both
reject reserved bits via cr4_reserved_bits()).

Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
[kishen: rewrote commit message, rebased, fixed formatting]
Signed-off-by: Kishen Maloor <kishen.maloor@intel.com>
---
 target/i386/cpu.h    | 7 ++++++-
 target/i386/helper.c | 4 ++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index e6a197602d..98c406db32 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -277,6 +277,7 @@ typedef enum X86Seg {
 #define CR4_PKE_MASK   (1U << 22)
 #define CR4_CET_MASK   (1U << 23)
 #define CR4_PKS_MASK   (1U << 24)
+#define CR4_LASS_MASK  (1U << 27)
 #define CR4_LAM_SUP_MASK (1U << 28)
 
 #ifdef TARGET_X86_64
@@ -293,7 +294,8 @@ typedef enum X86Seg {
                 | CR4_LA57_MASK \
                 | CR4_FSGSBASE_MASK | CR4_PCIDE_MASK | CR4_OSXSAVE_MASK \
                 | CR4_SMEP_MASK | CR4_SMAP_MASK | CR4_PKE_MASK | CR4_CET_MASK \
-                | CR4_PKS_MASK | CR4_LAM_SUP_MASK | CR4_FRED_MASK))
+                | CR4_PKS_MASK | CR4_LASS_MASK | CR4_LAM_SUP_MASK \
+                | CR4_FRED_MASK))
 
 #define DR6_BD          (1 << 13)
 #define DR6_BS          (1 << 14)
@@ -3064,6 +3066,9 @@ static inline uint64_t cr4_reserved_bits(CPUX86State *env)
     if (!(env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_PKS)) {
         reserved_bits |= CR4_PKS_MASK;
     }
+    if (!(env->features[FEAT_7_1_EAX] & CPUID_7_1_EAX_LASS)) {
+        reserved_bits |= CR4_LASS_MASK;
+    }
     if (!(env->features[FEAT_7_1_EAX] & CPUID_7_1_EAX_LAM)) {
         reserved_bits |= CR4_LAM_SUP_MASK;
     }
diff --git a/target/i386/helper.c b/target/i386/helper.c
index 6836214162..43cfcfdafe 100644
--- a/target/i386/helper.c
+++ b/target/i386/helper.c
@@ -229,6 +229,10 @@ void cpu_x86_update_cr4(CPUX86State *env, uint32_t new_cr4)
         new_cr4 &= ~CR4_PKS_MASK;
     }
 
+    if (!(env->features[FEAT_7_1_EAX] & CPUID_7_1_EAX_LASS)) {
+        new_cr4 &= ~CR4_LASS_MASK;
+    }
+
     if (!(env->features[FEAT_7_1_EAX] & CPUID_7_1_EAX_LAM)) {
         new_cr4 &= ~CR4_LAM_SUP_MASK;
     }
-- 
2.47.1

Re: [PATCH 2/5] target/i386: Add LASS support in CR4

[Zhao Liu]

On Tue, Aug 25, 2026 at 08:57:31PM -0700, Kishen Maloor wrote:
> Date: Tue, 25 Aug 2026 20:57:31 -0700
> From: Kishen Maloor <kishen.maloor@intel.com>
> Subject: [PATCH 2/5] target/i386: Add LASS support in CR4
> X-Mailer: git-send-email 2.47.1
> 
> From: Isaku Yamahata <isaku.yamahata@intel.com>
> 
> CR4.LASS[bit 27] enables Linear Address Space Separation, and may be set
> only when CPUID.(EAX=7,ECX=1):EAX[6] enumerates LASS.
> 
> Recognize CR4.LASS as a valid bit by adding CR4_LASS_MASK to the known
> bits, i.e. clearing it from CR4_RESERVED_MASK. Mark it reserved in
> cr4_reserved_bits() and clear it in cpu_x86_update_cr4() when the guest
> CPUID does not enumerate LASS. This keeps CR4 handling consistent on
> paths that reach cpu_x86_update_cr4(), such as gdbstub register writes.
> 
> LASS is not emulated by TCG, so it is not added to TCG_7_1_EAX_FEATURES
> and cannot be set under TCG (helper_write_crN() and helper_vmrun() both
> reject reserved bits via cr4_reserved_bits()).
> 
> Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
> [kishen: rewrote commit message, rebased, fixed formatting]
> Signed-off-by: Kishen Maloor <kishen.maloor@intel.com>
> ---
>  target/i386/cpu.h    | 7 ++++++-
>  target/i386/helper.c | 4 ++++
>  2 files changed, 10 insertions(+), 1 deletion(-)

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>

[PATCH 3/5] target/i386: Introduce DiamondRapids-v3 to enable LASS

[Kishen Maloor]

Add DiamondRapids-v3 to expose Linear Address Space Separation (LASS)
on the DiamondRapids CPU model.

Signed-off-by: Kishen Maloor <kishen.maloor@intel.com>
---
 target/i386/cpu.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 5496e9475b..fa6b76be27 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -5829,6 +5829,14 @@ static const X86CPUDefinition builtin_x86_defs[] = {
                     { /* end of list */ },
                 }
             },
+            {
+                .version = 3,
+                .note = "with LASS",
+                .props = (PropValue[]) {
+                    { "lass", "on" },
+                    { /* end of list */ },
+                }
+            },
             { /* end of list */ },
         },
     },
-- 
2.47.1

Re: [PATCH 3/5] target/i386: Introduce DiamondRapids-v3 to enable LASS

[Zhao Liu]

On Tue, Aug 25, 2026 at 08:57:32PM -0700, Kishen Maloor wrote:
> Date: Tue, 25 Aug 2026 20:57:32 -0700
> From: Kishen Maloor <kishen.maloor@intel.com>
> Subject: [PATCH 3/5] target/i386: Introduce DiamondRapids-v3 to enable LASS
> X-Mailer: git-send-email 2.47.1
> 
> Add DiamondRapids-v3 to expose Linear Address Space Separation (LASS)
> on the DiamondRapids CPU model.
> 
> Signed-off-by: Kishen Maloor <kishen.maloor@intel.com>
> ---
>  target/i386/cpu.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>

[PATCH 4/5] target/i386: Introduce SierraForest-v7 to enable LASS

[Kishen Maloor]

Add SierraForest-v7 to expose Linear Address Space Separation (LASS)
on the SierraForest CPU model.

Signed-off-by: Kishen Maloor <kishen.maloor@intel.com>
---
 target/i386/cpu.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index fa6b76be27..167df0e6cb 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6018,6 +6018,14 @@ static const X86CPUDefinition builtin_x86_defs[] = {
                     { /* end of list */ },
                 }
             },
+            {
+                .version = 7,
+                .note = "with LASS",
+                .props = (PropValue[]) {
+                    { "lass", "on" },
+                    { /* end of list */ },
+                }
+            },
             { /* end of list */ },
         },
     },
-- 
2.47.1

Re: [PATCH 4/5] target/i386: Introduce SierraForest-v7 to enable LASS

[Zhao Liu]

On Tue, Aug 25, 2026 at 08:57:33PM -0700, Kishen Maloor wrote:
> Date: Tue, 25 Aug 2026 20:57:33 -0700
> From: Kishen Maloor <kishen.maloor@intel.com>
> Subject: [PATCH 4/5] target/i386: Introduce SierraForest-v7 to enable LASS
> X-Mailer: git-send-email 2.47.1
> 
> Add SierraForest-v7 to expose Linear Address Space Separation (LASS)
> on the SierraForest CPU model.
> 
> Signed-off-by: Kishen Maloor <kishen.maloor@intel.com>
> ---
>  target/i386/cpu.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>

[PATCH 5/5] target/i386: Introduce ClearwaterForest-v5 to enable LASS

[Kishen Maloor]

Add ClearwaterForest-v5 to expose Linear Address Space Separation (LASS)
on the ClearwaterForest CPU model.

Signed-off-by: Kishen Maloor <kishen.maloor@intel.com>
---
 target/i386/cpu.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 167df0e6cb..1c333c2780 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6190,6 +6190,14 @@ static const X86CPUDefinition builtin_x86_defs[] = {
                     { /* end of list */ },
                 }
             },
+            {
+                .version = 5,
+                .note = "with LASS",
+                .props = (PropValue[]) {
+                    { "lass", "on" },
+                    { /* end of list */ },
+                }
+            },
             { /* end of list */ },
         },
     },
-- 
2.47.1

Re: [PATCH 5/5] target/i386: Introduce ClearwaterForest-v5 to enable LASS

[Zhao Liu]

On Tue, Aug 25, 2026 at 08:57:34PM -0700, Kishen Maloor wrote:
> Date: Tue, 25 Aug 2026 20:57:34 -0700
> From: Kishen Maloor <kishen.maloor@intel.com>
> Subject: [PATCH 5/5] target/i386: Introduce ClearwaterForest-v5 to enable
>  LASS
> X-Mailer: git-send-email 2.47.1
> 
> Add ClearwaterForest-v5 to expose Linear Address Space Separation (LASS)
> on the ClearwaterForest CPU model.
> 
> Signed-off-by: Kishen Maloor <kishen.maloor@intel.com>
> ---
>  target/i386/cpu.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>

Re: [PATCH 0/5] target/i386: Add support for LASS

[Chen, Farrah]

On 8/26/2026 11:57 AM, Kishen Maloor wrote:
> This series adds QEMU support for Linear Address Space Separation (LASS) [1],
> an Intel security feature that prevents a class of side-channel attacks
> relying on speculative accesses across the user/kernel boundary. Paging,
> along with SMEP and SMAP, already provides mode-based access protection,
> but enforcing it requires a page walk whose timing can leak the layout of
> kernel memory. LASS applies the equivalent protections during
> linear-address pre-processing: given the usual partitioning of the linear
> address space into a user half (bit 63 clear) and a supervisor half
> (bit 63 set), an access targeting the opposite half is rejected on the
> basis of bit 63 alone, before any page walk.
> 
> This series enumerates the LASS CPUID bit, recognizes CR4.LASS,
> and exposes LASS on the relevant Intel CPU models via new versioned models.
> LASS is not emulated by TCG.
> 
> Exposing LASS to a guest also requires KVM support: KVM must validate
> the CPUID bit and CR4.LASS, and enforce LASS violations in its
> instruction emulator. That enabling is currently under review [2].
> 
I tested this series on Clearwater Forest (CWF), running a KVM guest 
with -cpu host. On the host I applied the KVM LASS enabling series 
referenced as [2] in the cover letter:

https://lore.kernel.org/kvm/20260806011536.4172258-1-sohil.mehta@intel.com/

With both series applied, LASS is correctly enumerated in the guest, and 
the LASS functional tests pass with vsyscall=none/xonly/emulate.

Tested-by: Farrah Chen <farrah.chen@intel.com>

Re: [PATCH 0/5] target/i386: Add support for LASS

[Sohil Mehta]

On 8/25/2026 8:57 PM, Kishen Maloor wrote:
> Isaku Yamahata (2):
>   target/i386: Add support for LASS in CPUID enumeration
>   target/i386: Add LASS support in CR4
> 
> Kishen Maloor (3):
>   target/i386: Introduce DiamondRapids-v3 to enable LASS
>   target/i386: Introduce SierraForest-v7 to enable LASS
>   target/i386: Introduce ClearwaterForest-v5 to enable LASS
> 

Acked-by: Sohil Mehta <sohil.mehta@intel.com>

>  target/i386/cpu.c    | 26 +++++++++++++++++++++++++-
>  target/i386/cpu.h    |  7 ++++++-
>  target/i386/helper.c |  4 ++++
>  3 files changed, 35 insertions(+), 2 deletions(-)
> 

Re: [PATCH 0/5] target/i386: Add support for LASS

[Binbin Wu]

On 8/26/2026 11:57 AM, Kishen Maloor wrote:
> This series adds QEMU support for Linear Address Space Separation (LASS) [1],
> an Intel security feature that prevents a class of side-channel attacks
> relying on speculative accesses across the user/kernel boundary. Paging,
> along with SMEP and SMAP, already provides mode-based access protection,
> but enforcing it requires a page walk whose timing can leak the layout of
> kernel memory. LASS applies the equivalent protections during
> linear-address pre-processing: given the usual partitioning of the linear
> address space into a user half (bit 63 clear) and a supervisor half
> (bit 63 set), an access targeting the opposite half is rejected on the
> basis of bit 63 alone, before any page walk.
> 
> This series enumerates the LASS CPUID bit, recognizes CR4.LASS,
> and exposes LASS on the relevant Intel CPU models via new versioned models.
> LASS is not emulated by TCG.
> 
> Exposing LASS to a guest also requires KVM support: KVM must validate
> the CPUID bit and CR4.LASS, and enforce LASS violations in its
> instruction emulator. That enabling is currently under review [2].
> 
> Tested with a Linux guest on LASS-capable hardware: LASS is enumerated and
> CR4.LASS is set under KVM, and not enumerated under TCG.
> 
> [1] Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3A,
>     Section 4.3, "Linear-Address-Space Separation (LASS)".
> [2] https://lore.kernel.org/kvm/20260806011536.4172258-1-sohil.mehta@intel.com/
> 
> Isaku Yamahata (2):
>   target/i386: Add support for LASS in CPUID enumeration
>   target/i386: Add LASS support in CR4
> 
> Kishen Maloor (3):
>   target/i386: Introduce DiamondRapids-v3 to enable LASS
>   target/i386: Introduce SierraForest-v7 to enable LASS
>   target/i386: Introduce ClearwaterForest-v5 to enable LASS

Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>

> 
>  target/i386/cpu.c    | 26 +++++++++++++++++++++++++-
>  target/i386/cpu.h    |  7 ++++++-
>  target/i386/helper.c |  4 ++++
>  3 files changed, 35 insertions(+), 2 deletions(-)
>