From: Zhao Liu <zhao1.liu@intel.com>
To: Paolo Bonzini <pbonzini@redhat.com>,
Marcelo Tosatti <mtosatti@redhat.com>
Cc: qemu-devel@nongnu.org, kvm@vger.kernel.org,
Chao Gao <chao.gao@intel.com>, Xin Li <xin@zytor.com>,
John Allen <john.allen@amd.com>, Babu Moger <babu.moger@amd.com>,
Mathias Krause <minipli@grsecurity.net>,
Dapeng Mi <dapeng1.mi@intel.com>, Zide Chen <zide.chen@intel.com>,
Xiaoyao Li <xiaoyao.li@intel.com>,
Chenyi Qiang <chenyi.qiang@intel.com>,
Farrah Chen <farrah.chen@intel.com>,
Zhao Liu <zhao1.liu@intel.com>
Subject: [PATCH v4 14/23] i386/cpu: Save/restore SSP0 MSR for FRED
Date: Tue, 18 Nov 2025 11:42:22 +0800 [thread overview]
Message-ID: <20251118034231.704240-15-zhao1.liu@intel.com> (raw)
In-Reply-To: <20251118034231.704240-1-zhao1.liu@intel.com>
From: "Xin Li (Intel)" <xin@zytor.com>
Both FRED and CET shadow stack define the MSR MSR_IA32_PL0_SSP (aka
MSR_IA32_FRED_SSP0 in FRED spec).
MSR_IA32_PL0_SSP is a FRED SSP MSR, so that if a processor doesn't
support CET shadow stack, FRED transitions won't use MSR_IA32_PL0_SSP,
but this MSR would still be accessible using MSR-access instructions
(e.g., RDMSR, WRMSR).
Therefore, save/restore SSP0 MSR for FRED.
Tested-by: Farrah Chen <farrah.chen@intel.com>
Signed-off-by: Xin Li (Intel) <xin@zytor.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
---
Changes Since v3:
- New commit.
---
target/i386/cpu.h | 6 ++++++
target/i386/kvm/kvm.c | 13 +++++++++++++
2 files changed, 19 insertions(+)
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index f4cb1dc49b71..0432af1769d2 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -554,6 +554,9 @@ typedef enum X86Seg {
#define MSR_IA32_FRED_SSP3 0x000001d3 /* Stack level 3 shadow stack pointer in ring 0 */
#define MSR_IA32_FRED_CONFIG 0x000001d4 /* FRED Entrypoint and interrupt stack level */
+/* FRED and CET MSR */
+#define MSR_IA32_PL0_SSP 0x000006a4 /* ring-0 shadow stack pointer (aka MSR_IA32_FRED_SSP0 for FRED) */
+
#define MSR_IA32_BNDCFGS 0x00000d90
#define MSR_IA32_XSS 0x00000da0
#define MSR_IA32_UMWAIT_CONTROL 0xe1
@@ -1973,6 +1976,9 @@ typedef struct CPUArchState {
uint64_t fred_config;
#endif
+ /* MSR used for both FRED and CET (SHSTK) */
+ uint64_t pl0_ssp;
+
uint64_t tsc_adjust;
uint64_t tsc_deadline;
uint64_t tsc_aux;
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 60c798113823..00fead0827ed 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -4008,6 +4008,11 @@ static int kvm_put_msrs(X86CPU *cpu, KvmPutState level)
kvm_msr_entry_add(cpu, MSR_IA32_FRED_SSP2, env->fred_ssp2);
kvm_msr_entry_add(cpu, MSR_IA32_FRED_SSP3, env->fred_ssp3);
kvm_msr_entry_add(cpu, MSR_IA32_FRED_CONFIG, env->fred_config);
+ /*
+ * Aka MSR_IA32_FRED_SSP0. This MSR is accessible even if
+ * CET shadow stack is not supported.
+ */
+ kvm_msr_entry_add(cpu, MSR_IA32_PL0_SSP, env->pl0_ssp);
}
}
#endif
@@ -4495,6 +4500,11 @@ static int kvm_get_msrs(X86CPU *cpu)
kvm_msr_entry_add(cpu, MSR_IA32_FRED_SSP2, 0);
kvm_msr_entry_add(cpu, MSR_IA32_FRED_SSP3, 0);
kvm_msr_entry_add(cpu, MSR_IA32_FRED_CONFIG, 0);
+ /*
+ * Aka MSR_IA32_FRED_SSP0. This MSR is accessible even if
+ * CET shadow stack is not supported.
+ */
+ kvm_msr_entry_add(cpu, MSR_IA32_PL0_SSP, 0);
}
}
#endif
@@ -4746,6 +4756,9 @@ static int kvm_get_msrs(X86CPU *cpu)
case MSR_IA32_FRED_CONFIG:
env->fred_config = msrs[i].data;
break;
+ case MSR_IA32_PL0_SSP: /* aka MSR_IA32_FRED_SSP0 */
+ env->pl0_ssp = msrs[i].data;
+ break;
#endif
case MSR_IA32_TSC:
env->tsc = msrs[i].data;
--
2.34.1
next prev parent reply other threads:[~2025-11-18 3:22 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-18 3:42 [PATCH v4 00/23] i386: Support CET for KVM Zhao Liu
2025-11-18 3:42 ` [PATCH v4 01/23] i386/cpu: Clean up indent style of x86_ext_save_areas[] Zhao Liu
2025-11-18 3:42 ` [PATCH v4 02/23] i386/cpu: Clean up arch lbr xsave struct and comment Zhao Liu
2025-11-18 3:42 ` [PATCH v4 03/23] i386/cpu: Reorganize arch lbr structure definitions Zhao Liu
2025-11-18 3:42 ` [PATCH v4 04/23] i386/cpu: Make ExtSaveArea store an array of dependencies Zhao Liu
2025-11-18 3:42 ` [PATCH v4 05/23] i386/cpu: Add avx10 dependency for Opmask/ZMM_Hi256/Hi16_ZMM Zhao Liu
2025-11-18 3:42 ` [PATCH v4 06/23] i386/kvm: Initialize x86_ext_save_areas[] based on KVM support Zhao Liu
2025-11-18 3:42 ` [PATCH v4 07/23] i386/cpu: Use x86_ext_save_areas[] for CPUID.0XD subleaves Zhao Liu
2025-11-18 3:42 ` [PATCH v4 08/23] i386/cpu: Reorganize dependency check for arch lbr state Zhao Liu
2025-11-18 3:42 ` [PATCH v4 09/23] i386/cpu: Drop pmu check in CPUID 0x1C encoding Zhao Liu
2025-11-18 3:42 ` [PATCH v4 10/23] i386/cpu: Fix supervisor xstate initialization Zhao Liu
2025-11-18 3:42 ` [PATCH v4 11/23] i386/cpu: Add missing migratable xsave features Zhao Liu
2025-11-18 3:42 ` [PATCH v4 12/23] i386/cpu: Enable xsave support for CET states Zhao Liu
2025-11-18 3:42 ` [PATCH v4 13/23] i386/cpu: Add CET support in CR4 Zhao Liu
2025-11-18 3:42 ` Zhao Liu [this message]
2025-11-18 3:42 ` [PATCH v4 15/23] i386/kvm: Add save/restore support for CET MSRs Zhao Liu
2025-11-18 3:42 ` [PATCH v4 16/23] i386/kvm: Add save/restore support for KVM_REG_GUEST_SSP Zhao Liu
2025-11-18 3:42 ` [PATCH v4 17/23] i386/cpu: Migrate MSR_IA32_PL0_SSP for FRED and CET-SHSTK Zhao Liu
2025-11-18 3:42 ` [PATCH v4 18/23] i386/machine: Add vmstate for cet-shstk and cet-ibt Zhao Liu
2025-11-18 3:42 ` [PATCH v4 19/23] i386/cpu: Mark cet-u & cet-s xstates as migratable Zhao Liu
2025-11-18 3:42 ` [PATCH v4 20/23] i386/cpu: Advertise CET related flags in feature words Zhao Liu
2025-11-18 3:42 ` [PATCH v4 21/23] i386/cpu: Enable cet-ss & cet-ibt for supported CPU models Zhao Liu
2025-11-18 3:42 ` [PATCH v4 22/23] i386/tdx: Fix missing spaces in tdx_xfam_deps[] Zhao Liu
2025-11-18 3:42 ` [PATCH v4 23/23] i386/tdx: Add CET SHSTK/IBT into the supported CPUID by XFAM Zhao Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251118034231.704240-15-zhao1.liu@intel.com \
--to=zhao1.liu@intel.com \
--cc=babu.moger@amd.com \
--cc=chao.gao@intel.com \
--cc=chenyi.qiang@intel.com \
--cc=dapeng1.mi@intel.com \
--cc=farrah.chen@intel.com \
--cc=john.allen@amd.com \
--cc=kvm@vger.kernel.org \
--cc=minipli@grsecurity.net \
--cc=mtosatti@redhat.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=xiaoyao.li@intel.com \
--cc=xin@zytor.com \
--cc=zide.chen@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).