[PATCH v5 0/6] KVM: x86: Add LASS virtualization support

[Sohil Mehta <sohil.mehta@intel.com>]

Linear Address Space Separation (LASS) is a security feature that blocks
accesses across the user/kernel boundary based on bit 63 of the linear
address alone, before any page walk is performed. Host support for LASS
has been merged [1][2]. This series adds the KVM virtualization support.

Patches
-------
I am posting a refreshed version because kvm-x86/next has advanced and some
patches needed to be rebased. v5 contains only a couple of minor changes.
Overall, the series is ready for maintainer review (and potential inclusion
in the next cycle).

Changes in v5
-------------
 - Rebased the patches onto kvm-x86/next (kvm-x86-next-2026.10.13)
 - Added a function comment to vmx_is_lass_violation() (patch 4)
 - Dropped the LASS x86 selftest (already posted separately [3])
 - Avoided the LASS specific KVM CR4 write test (patch 6)
 - Replaced Binbin's SoBs with Reviewed-bys
 - Picked up review and test tags

v4: https://lore.kernel.org/all/20260806011536.4172258-1-sohil.mehta@intel.com/

Background
----------
The host support series [4] covers the motivation, base enforcement
mechanism, kernel toggling of RFLAGS and CR4.LASS, and the userspace
exception notifications. Here's a brief summary of the SDM bits [5] that
affects KVM support.

When LASS is enabled, the CPU applies a violation check using bit 63 to
every access to a linear address prior to page walks. A user-mode access
to a supervisor address, or a supervisor-mode access to a user address,
typically raises #GP (or #SS in rare cases) instead of a #PF that
SMAP/SMEP alone would produce. LASS takes effect only in IA-32e mode.

Enforcement for supervisor-mode data accesses additionally requires SMAP
to be enabled, and is suppressed for explicit accesses when RFLAGS.AC=1.
Linear addresses used for TLB invalidation (INVLPG, INVPCID, INVVPID)
are not subject to LASS. Unlike canonicality checks, LASS only applies
to code fetches and not branch targets.

Note, LASS is now part of the SDM instead of the ISE. There are minor
changes to the wording but nothing substantial. It also includes a
clarification that the relative ordering of LASS and canonicality checks
is not defined and cannot be determined by software.

KVM support
-----------
Hardware enforces LASS on guest code that runs natively, so KVM mostly needs
to let the guest turn it on. The exception is instruction emulation, when KVM
must apply the same LASS violation checks, so that emulated accesses behave
the same way.

For enabling, KVM advertises LASS to userspace, and lets the guest set
CR4.LASS, including in nested VMX, when LASS is enumerated in its CPUID.

Patch 1-4: Enhance the emulator to handle LASS violation checks.
Patch   5: Guest CPUID and CR4 handling. Expose LASS to userspace.
Patch   6: Extend set_sregs_test selftest for LASS.

Testing
-------
1. Basic enumeration and enabling in guest and nested environment.
2. LASS enforcement tests (userspace + LKDTM + test kernel module)
 - Userspace access to kernel address (read, write, instr fetch)
 - Kernel access to user address (read, write, instr fetch)
 - RFLAGS.AC=1 suppression (read, write)
 - FEP tests for the above cases

The x86 userspace selftest was posted separately and is under review for x86
inclusion [3].

KVM selftests and kvm-unit-tests run guest code in the lower half at CPL0, so
enabling CR4.LASS makes the next instruction fetch a violation and
triple-faults the guest. I used a set of LLM generated kvm-unit-tests [6] that
overcome the limitation. Planning to clean them up and post them separately.

Kishen Maloor and Farrah Chen tested v4 on Sierra Forest and Clearwater
Forest, using the QEMU support [7] to expose LASS to the guest.

Links
-----
[1]: https://lore.kernel.org/lkml/20251201231537.736899-1-dave.hansen@linux.intel.com/
[2]: https://lore.kernel.org/lkml/20260413154235.1543087-1-dave.hansen@linux.intel.com/
[3]: https://lore.kernel.org/lkml/20261009020025.4175228-1-sohil.mehta@intel.com/
[4]: https://lore.kernel.org/all/20251118182911.2983253-1-sohil.mehta@intel.com/
[5]: "Linear-Address Pre-Processing", Intel SDM (June 2026), Vol 3, Chapter 4.
[6]: https://github.com/sohilmeh/kvm-unit-tests/tree/lass-llm
[7]: https://lore.kernel.org/all/20260826035734.114685-1-kishen.maloor@intel.com/

Previous versions
-----------------
v4: https://lore.kernel.org/all/20260806011536.4172258-1-sohil.mehta@intel.com/
v3: https://lore.kernel.org/lkml/20230913124227.12574-1-binbin.wu@linux.intel.com/
v2: https://lore.kernel.org/all/20230718131844.5706-1-guang.zeng@intel.com/
v1: https://lore.kernel.org/all/20230601142309.6307-1-guang.zeng@intel.com/
v0: https://lore.kernel.org/lkml/20230420133724.11398-1-guang.zeng@intel.com/


Binbin Wu (1):
  KVM: x86: Add an emulator flag to differentiate branch targets from
    fetches

Sohil Mehta (2):
  KVM: x86: Use linear_read_system() to read the TSS I/O bitmap
  KVM: selftests: Extend set_sregs_test to cover LASS

Zeng Guang (3):
  KVM: x86: Add LASS violation checks during instruction emulation
  KVM: VMX: Implement LASS violation check
  KVM: x86: Virtualize LASS and advertise support to userspace

 arch/x86/include/asm/kvm-x86-ops.h            |  1 +
 arch/x86/include/asm/kvm_host.h               |  2 +
 arch/x86/kvm/cpuid.c                          |  1 +
 arch/x86/kvm/emulate.c                        | 28 ++++++--
 arch/x86/kvm/kvm_emulate.h                    |  4 +-
 arch/x86/kvm/regs.h                           |  4 +-
 arch/x86/kvm/vmx/main.c                       |  1 +
 arch/x86/kvm/vmx/nested.c                     | 11 +--
 arch/x86/kvm/vmx/sgx.c                        |  3 +-
 arch/x86/kvm/vmx/vmx.c                        | 68 ++++++++++++++++++-
 arch/x86/kvm/vmx/vmx.h                        |  3 +
 arch/x86/kvm/x86.c                            |  9 ++-
 .../selftests/kvm/include/x86/processor.h     |  2 +
 .../selftests/kvm/x86/set_sregs_test.c        |  3 +
 14 files changed, 125 insertions(+), 15 deletions(-)


base-commit: dea4f6380f4ec96e8f3b0aaf2343764bd0d25ef4
-- 
2.43.0