Re: [PATCH v16 20/51] KVM: x86: Emulate SSP[63:32]!=0 #GP(0) for FAR JMP to 32-bit mode

Xiaoyao Li
2025-09-23T14:29:50Z

On 9/20/2025 6:32 AM, Sean Christopherson wrote:
> Emulate the Shadow Stack restriction that the current SSP must be a 32-bit
> value on a FAR JMP from 64-bit mode to compatibility mode. From the SDM's
> pseudocode for FAR JMP:
>
> IF ShadowStackEnabled(CPL)
> IF (IA32_EFER.LMA and DEST(segment selector).L) = 0
> (* If target is legacy or compatibility mode then the SSP must be in low 4GB *)
> IF (SSP & 0xFFFFFFFF00000000 != 0); THEN
> #GP(0);
> FI;
> FI;
> FI;
>
> Note, only the current CPL needs to be considered, as FAR JMP can't be
> used for inter-privilege level transfers, and KVM rejects emulation of all
> other far branch instructions when Shadow Stacks are enabled.
>
> To give the emulator access to GUEST_SSP, special case handling
> MSR_KVM_INTERNAL_GUEST_SSP in emulator_get_msr() to treat the access as a
> host access (KVM doesn't allow guest accesses to internal "MSRs"). The
> ->get_msr() API is only used for implicit accesses from the emulator, i.e.
> is only used with hardcoded MSR indices, and so any access to
> MSR_KVM_INTERNAL_GUEST_SSP is guaranteed to be from KVM, i.e. not from the
> guest via RDMSR.
>
> Signed-off-by: Sean Christopherson <seanjc@google.com>

Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>