Re: [PATCH v15 00/41] KVM: x86: Mega-CET

[Mathias Krause <minipli@grsecurity.net>]

[-- Attachment #1: Type: text/plain, Size: 1434 bytes --]

Am 13.09.25 um 01:22 schrieb Sean Christopherson:
> This series is (hopefully) all of the in-flight CET virtualization patches
> in one big bundle.  Please holler if I missed a patch or three as this is what
> I am planning on applying for 6.18 (modulo fixups and whatnot), i.e. if there's
> something else that's needed to enable CET virtualization, now's the time...
> 
> Patches 1-3 probably need the most attention, as they are new in v15 and I
> don't have a fully working SEV-ES setup (don't have the right guest firmware,
> ugh).  Though testing on everything would be much appreciated.
> 
> I kept almost all Tested-by tags even for patches that I massaged a bit, and
> only dropped tags for the "don't emulate CET stuff" patch.  In theory, the
> changes I've made *should* be benign.  Please yell, loudly, if I broken
> something and/or you want me to drop your Tested-by.

I retested this series on my Alder Lake NUC (i7-1260P) and with the
attached hacky patch on top of Chao's QEMU branch[1] -- which points to
commit 02364ef48c96 ("fixup! target/i386: Enable XSAVES support for CET
states") for me right now -- the KUT CET tests[2] pass just fine on the
host as well as within a guest, i.e. nested. Therefore my Tested-by
still stands -- at least for the Intel/VMX part.

Thanks,
Mathias

[1] https://github.com/gaochaointel/qemu-dev#qemu-cet
[2]
https://lore.kernel.org/kvm/20250626073459.12990-1-minipli@grsecurity.net/

[-- Attachment #2: qemu_cet_v15.diff --]
[-- Type: text/x-patch, Size: 1423 bytes --]

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index ce3c52fd0f7d..d07dfc714a3c 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -5320,8 +5320,7 @@ static int kvm_get_nested_state(X86CPU *cpu)
     return ret;
 }
 
-#define KVM_X86_REG_SYNTHETIC_MSR   BIT_ULL(35)
-#define REG_MSR_INDEX(x)            (KVM_X86_REG_SYNTHETIC_MSR | x)
+#define KVM_X86_REG_SSP     (0x20300003ULL << 32 | 0x00000000)
 
 static bool has_cet_ssp(CPUState *cpu)
 {
@@ -5409,9 +5408,9 @@ int kvm_arch_put_registers(CPUState *cpu, int level, Error **errp)
     }
 
     if (has_cet_ssp(cpu)) {
-        ret = kvm_set_one_reg(cpu, REG_MSR_INDEX(0ull), &env->guest_ssp);
+        ret = kvm_set_one_reg(cpu, KVM_X86_REG_SSP, &env->guest_ssp);
         if (ret) {
-            error_report("Failed to set KVM_REG_MSR, ret = %d\n", ret);
+            error_report("Failed to set KVM_REG_MSR, ret = %d", ret);
         }
     }
 
@@ -5489,9 +5488,9 @@ int kvm_arch_get_registers(CPUState *cs, Error **errp)
         goto out;
     }
     if (has_cet_ssp(cs)) {
-        ret = kvm_get_one_reg(cs, REG_MSR_INDEX(0ull), &env->guest_ssp);
+        ret = kvm_get_one_reg(cs, KVM_X86_REG_SSP, &env->guest_ssp);
         if (ret) {
-                error_report("Failed to get KVM_REG_MSR, ret = %d\n", ret);
+                error_report("Failed to get KVM_REG_MSR, ret = %d", ret);
         }
     }
     ret = kvm_get_apic(cpu);