On 8/26/2026 11:57 AM, Kishen Maloor wrote:
This series adds QEMU support for Linear Address Space Separation (LASS) [1],
an Intel security feature that prevents a class of side-channel attacks
relying on speculative accesses across the user/kernel boundary. Paging,
along with SMEP and SMAP, already provides mode-based access protection,
but enforcing it requires a page walk whose timing can leak the layout of
kernel memory. LASS applies the equivalent protections during
linear-address pre-processing: given the usual partitioning of the linear
address space into a user half (bit 63 clear) and a supervisor half
(bit 63 set), an access targeting the opposite half is rejected on the
basis of bit 63 alone, before any page walk.
This series enumerates the LASS CPUID bit, recognizes CR4.LASS,
and exposes LASS on the relevant Intel CPU models via new versioned models.
LASS is not emulated by TCG.
Exposing LASS to a guest also requires KVM support: KVM must validate
the CPUID bit and CR4.LASS, and enforce LASS violations in its
instruction emulator. That enabling is currently under review [2].
I tested this series on Clearwater Forest (CWF), running a KVM guest
with -cpu host. On the host I applied the KVM LASS enabling series
referenced as [2] in the cover letter:
https://lore.kernel.org/kvm/[email protected]/
With both series applied, LASS is correctly enumerated in the guest, and
the LASS functional tests pass with vsyscall=none/xonly/emulate.
Tested-by: Farrah Chen <[email protected]>
