[PATCH] KVM: nSVM: Gate CET state copy in svm_copy_vmrun_state() on guest SHSTK

[PATCH] KVM: nSVM: Gate CET state copy in svm_copy_vmrun_state() on guest SHSTK

[Jim Mattson]

Like nested_vmcb02_prepare_save() and nested_svm_vmexit_update_vmcb12(),
svm_copy_vmrun_state() should gate copying s_cet, isst_addr, and ssp on
guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) (i.e. the feature is advertised
to the guest). Instead, copying is gated on
kvm_cpu_cap_has(X86_FEATURE_SHSTK) (i.e. the host supports shadow stacks).

Check guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) instead of
kvm_cpu_cap_has(X86_FEATURE_SHSTK) in svm_copy_vmrun_state().

Fixes: c5ba49458513 ("KVM: nSVM: Save/load CET Shadow Stack state to/from vmcb12/vmcb02")
Signed-off-by: Jim Mattson <jmattson@google.com>
---
 arch/x86/kvm/svm/nested.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index 1299fdadeb73..b73bc9c3ebdb 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1248,7 +1248,7 @@ void svm_copy_vmrun_state(struct kvm_vcpu *vcpu, struct vmcb_save_area *to_save,
 	to_save->rip = from_save->rip;
 	to_save->cpl = 0;
 
-	if (kvm_cpu_cap_has(X86_FEATURE_SHSTK)) {
+	if (guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK)) {
 		to_save->s_cet  = from_save->s_cet;
 		to_save->isst_addr = from_save->isst_addr;
 		to_save->ssp = from_save->ssp;
-- 
2.56.1.703.gf848ed807c-goog

Re: [PATCH] KVM: nSVM: Gate CET state copy in svm_copy_vmrun_state() on guest SHSTK

[Yosry Ahmed]

On Thu, Nov 12, 2026 at 1:26 PM Jim Mattson <jmattson@google.com> wrote:
>
> Like nested_vmcb02_prepare_save() and nested_svm_vmexit_update_vmcb12(),
> svm_copy_vmrun_state() should gate copying s_cet, isst_addr, and ssp on
> guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) (i.e. the feature is advertised
> to the guest). Instead, copying is gated on
> kvm_cpu_cap_has(X86_FEATURE_SHSTK) (i.e. the host supports shadow stacks).

This is a bit confusing, nested_vmcb02_prepare_save() and
nested_svm_vmexit_update_vmcb12() are about vmcb12 <-> vmcb02, so L2's
state, while svm_copy_vmrun_state() is for L1's state. I think the
patch is correct, but the examples are confusing.

Perhaps a better example would be __kvm_set_msr() and __kvm_get_msr()?

>
> Check guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) instead of
> kvm_cpu_cap_has(X86_FEATURE_SHSTK) in svm_copy_vmrun_state().
>
> Fixes: c5ba49458513 ("KVM: nSVM: Save/load CET Shadow Stack state to/from vmcb12/vmcb02")
> Signed-off-by: Jim Mattson <jmattson@google.com>
> ---
>  arch/x86/kvm/svm/nested.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index 1299fdadeb73..b73bc9c3ebdb 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -1248,7 +1248,7 @@ void svm_copy_vmrun_state(struct kvm_vcpu *vcpu, struct vmcb_save_area *to_save,
>         to_save->rip = from_save->rip;
>         to_save->cpl = 0;
>
> -       if (kvm_cpu_cap_has(X86_FEATURE_SHSTK)) {
> +       if (guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK)) {
>                 to_save->s_cet  = from_save->s_cet;
>                 to_save->isst_addr = from_save->isst_addr;
>                 to_save->ssp = from_save->ssp;
> --
> 2.56.1.703.gf848ed807c-goog
>

Re: [PATCH] KVM: nSVM: Gate CET state copy in svm_copy_vmrun_state() on guest SHSTK

[Jim Mattson]

On Thu, Nov 12, 2026 at 2:41 PM Yosry Ahmed <yosry@kernel.org> wrote:
>
> On Thu, Nov 12, 2026 at 1:26 PM Jim Mattson <jmattson@google.com> wrote:
> >
> > Like nested_vmcb02_prepare_save() and nested_svm_vmexit_update_vmcb12(),
> > svm_copy_vmrun_state() should gate copying s_cet, isst_addr, and ssp on
> > guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) (i.e. the feature is advertised
> > to the guest). Instead, copying is gated on
> > kvm_cpu_cap_has(X86_FEATURE_SHSTK) (i.e. the host supports shadow stacks).
>
> This is a bit confusing, nested_vmcb02_prepare_save() and
> nested_svm_vmexit_update_vmcb12() are about vmcb12 <-> vmcb02, so L2's
> state, while svm_copy_vmrun_state() is for L1's state. I think the
> patch is correct, but the examples are confusing.
>
> Perhaps a better example would be __kvm_set_msr() and __kvm_get_msr()?

Or, perhaps I should just drop the examples?