On 8/26/2026 11:57 AM, Kishen Maloor wrote: > This series adds QEMU support for Linear Address Space Separation (LASS) [1], > an Intel security feature that prevents a class of side-channel attacks > relying on speculative accesses across the user/kernel boundary. Paging, > along with SMEP and SMAP, already provides mode-based access protection, > but enforcing it requires a page walk whose timing can leak the layout of > kernel memory. LASS applies the equivalent protections during > linear-address pre-processing: given the usual partitioning of the linear > address space into a user half (bit 63 clear) and a supervisor half > (bit 63 set), an access targeting the opposite half is rejected on the > basis of bit 63 alone, before any page walk. > > This series enumerates the LASS CPUID bit, recognizes CR4.LASS, > and exposes LASS on the relevant Intel CPU models via new versioned models. > LASS is not emulated by TCG. > > Exposing LASS to a guest also requires KVM support: KVM must validate > the CPUID bit and CR4.LASS, and enforce LASS violations in its > instruction emulator. That enabling is currently under review [2]. > > Tested with a Linux guest on LASS-capable hardware: LASS is enumerated and > CR4.LASS is set under KVM, and not enumerated under TCG. > > [1] Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3A, > Section 4.3, "Linear-Address-Space Separation (LASS)". > [2] > https://lore.kernel.org/kvm/[email protected]/ > > Isaku Yamahata (2): > target/i386: Add support for LASS in CPUID enumeration > target/i386: Add LASS support in CR4 > > Kishen Maloor (3): > target/i386: Introduce DiamondRapids-v3 to enable LASS > target/i386: Introduce SierraForest-v7 to enable LASS > target/i386: Introduce ClearwaterForest-v5 to enable LASS
Reviewed-by: Binbin Wu <[email protected]> > > target/i386/cpu.c | 26 +++++++++++++++++++++++++- > target/i386/cpu.h | 7 ++++++- > target/i386/helper.c | 4 ++++ > 3 files changed, 35 insertions(+), 2 deletions(-) >
