On 8/6/25 15:46, John Allen wrote:
> When a guest issues a cpuid instruction for Fn0000000D_x0B
This should be for Fn0000000D_{x00,x01}, not x0B, as the code below is
checking for RCX being <= 1.
> (CetUserOffset), the hypervisor may intercept and access the guest XSS
s/intercept and/be intercepting the CPUID instruction and need to/
> value. For SEV-ES, this is encrypted and needs to be included in the
s/this/the XSS value/
> GHCB to be visible to the hypervisor.
>
> Signed-off-by: John Allen <john.allen@xxxxxxx>
With the change log updates:
Reviewed-by: Tom Lendacky <thomas.lendacky@xxxxxxx>
> ---
> arch/x86/coco/sev/vc-shared.c | 11 +++++++++++
> arch/x86/include/asm/svm.h | 1 +
> 2 files changed, 12 insertions(+)
>
> diff --git a/arch/x86/coco/sev/vc-shared.c b/arch/x86/coco/sev/vc-shared.c
> index 2c0ab0fdc060..079fffdb12c0 100644
> --- a/arch/x86/coco/sev/vc-shared.c
> +++ b/arch/x86/coco/sev/vc-shared.c
> @@ -1,5 +1,9 @@
> // SPDX-License-Identifier: GPL-2.0
>
> +#ifndef __BOOT_COMPRESSED
> +#define has_cpuflag(f) boot_cpu_has(f)
> +#endif
> +
> static enum es_result vc_check_opcode_bytes(struct es_em_ctxt *ctxt,
> unsigned long exit_code)
> {
> @@ -452,6 +456,13 @@ static enum es_result vc_handle_cpuid(struct ghcb *ghcb,
> /* xgetbv will cause #GP - use reset value for xcr0 */
> ghcb_set_xcr0(ghcb, 1);
>
> + if (has_cpuflag(X86_FEATURE_SHSTK) && regs->ax == 0xd && regs->cx <= 1) {
> + struct msr m;
> +
> + raw_rdmsr(MSR_IA32_XSS, &m);
> + ghcb_set_xss(ghcb, m.q);
> + }
> +
> ret = sev_es_ghcb_hv_call(ghcb, ctxt, SVM_EXIT_CPUID, 0, 0);
> if (ret != ES_OK)
> return ret;
> diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h
> index ffc27f676243..870ebfef86d6 100644
> --- a/arch/x86/include/asm/svm.h
> +++ b/arch/x86/include/asm/svm.h
> @@ -700,5 +700,6 @@ DEFINE_GHCB_ACCESSORS(sw_exit_info_1)
> DEFINE_GHCB_ACCESSORS(sw_exit_info_2)
> DEFINE_GHCB_ACCESSORS(sw_scratch)
> DEFINE_GHCB_ACCESSORS(xcr0)
> +DEFINE_GHCB_ACCESSORS(xss)
>
> #endif
