@samitouri / QOSamiQemu / commits / 01b4e06b52

target/i386/kvm: Fix CET SSP MSR read feature check

kvm_get_msrs() adds U_CET and S_CET when CET shadow stacks or IBT are enabled, but it checks FEAT_7_0_EDX with the ECX-defined CPUID_7_0_ECX_CET_SHSTK bit before adding the PL0-PL3 SSP MSRs. CPUID_7_0_ECX_CET_SHSTK belongs to FEAT_7_0_ECX. The current check therefore skips MSR_IA32_PL0_SSP through MSR_IA32_PL3_SSP even when guest shadow stacks are enabled. kvm_put_msrs() already uses FEAT_7_0_ECX for the same shadow-stack condition. Use the same feature word in kvm_get_msrs() so QEMU does not restore CET enablement with stale or zero SSP values. Fixes: b6f85c5e4527 ("i386/kvm: Add save/restore support for CET MSRs") Cc: qemu-stable@nongnu.org Signed-off-by: Saul Freedman <fre3dm4n@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260615033338.1563854-1-fre3dm4n@gmail.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Saul Freedman committed Jun 14, 2026 at 23:33 UTC 01b4e06b5225787139dae760e8b4fe0c39e5c04d

1 file changed +1 -1

target/i386/kvm/kvm.c

+1 -1

@@ -5022,7 +5022,7 @@ static int kvm_get_msrs(X86CPU *cpu)

5022 kvm_msr_entry_add(cpu, MSR_IA32_U_CET, 0);

5023 kvm_msr_entry_add(cpu, MSR_IA32_S_CET, 0);

5024

5025 - if (env->features[FEAT_7_0_EDX] & CPUID_7_0_ECX_CET_SHSTK) {

5025 + if (env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_CET_SHSTK) {

5026 kvm_msr_entry_add(cpu, MSR_IA32_PL0_SSP, 0);

5027 kvm_msr_entry_add(cpu, MSR_IA32_PL1_SSP, 0);

5028 kvm_msr_entry_add(cpu, MSR_IA32_PL2_SSP, 0);