Re: [PATCH] KVM: nSVM: Gate CET state copy in svm_copy_vmrun_state() on guest SHSTK

[Yosry Ahmed]

On Thu, Nov 12, 2026 at 3:17 PM Jim Mattson <jmattson@xxxxxxxxxx> wrote:
>
> On Thu, Nov 12, 2026 at 2:41 PM Yosry Ahmed <yosry@xxxxxxxxxx> wrote:
> >
> > On Thu, Nov 12, 2026 at 1:26 PM Jim Mattson <jmattson@xxxxxxxxxx> wrote:
> > >
> > > Like nested_vmcb02_prepare_save() and nested_svm_vmexit_update_vmcb12(),
> > > svm_copy_vmrun_state() should gate copying s_cet, isst_addr, and ssp on
> > > guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) (i.e. the feature is advertised
> > > to the guest). Instead, copying is gated on
> > > kvm_cpu_cap_has(X86_FEATURE_SHSTK) (i.e. the host supports shadow stacks).
> >
> > This is a bit confusing, nested_vmcb02_prepare_save() and
> > nested_svm_vmexit_update_vmcb12() are about vmcb12 <-> vmcb02, so L2's
> > state, while svm_copy_vmrun_state() is for L1's state. I think the
> > patch is correct, but the examples are confusing.
> >
> > Perhaps a better example would be __kvm_set_msr() and __kvm_get_msr()?
>
> Or, perhaps I should just drop the examples?

It's probably useful to mention that without guest_cpu_cap_has(vcpu,
X86_FEATURE_SHSTK), the MSRs cannot be set, but I am fine either way.
With either changes to the changelog:

Reviewed-by: Yosry Ahmed <yosry@xxxxxxxxxx>