From: Robert Hoo <robert.hu@linux.intel.com>
To: pbonzini@redhat.com, seanjc@google.com, vkuznets@redhat.com,
wanpengli@tencent.com, jmattson@google.com, joro@8bytes.org,
kvm@vger.kernel.org
Cc: x86@kernel.org, linux-kernel@vger.kernel.org,
chang.seok.bae@intel.com, robert.hu@intel.com,
robert.hu@linux.intel.com
Subject: [PATCH 10/15] kvm/vmx/nested: Support new IA32_VMX_PROCBASED_CTLS3 vmx capability MSR
Date: Tue, 1 Jun 2021 16:47:49 +0800 [thread overview]
Message-ID: <1622537274-146420-11-git-send-email-robert.hu@linux.intel.com> (raw)
In-Reply-To: <1622537274-146420-1-git-send-email-robert.hu@linux.intel.com>
Add this new VMX capability MSR in nested_vmx_msrs, and related functions
for its nested support.
Don't set its LOADIWKEY VM-Exit bit at present. It will be enabled in last
patch when everything's prepared.
Signed-off-by: Robert Hoo <robert.hu@linux.intel.com>
---
arch/x86/kvm/vmx/capabilities.h | 2 ++
arch/x86/kvm/vmx/nested.c | 22 +++++++++++++++++++++-
arch/x86/kvm/vmx/vmx.c | 6 +++---
arch/x86/kvm/x86.c | 2 ++
4 files changed, 28 insertions(+), 4 deletions(-)
diff --git a/arch/x86/kvm/vmx/capabilities.h b/arch/x86/kvm/vmx/capabilities.h
index df7550c..0a0bea9 100644
--- a/arch/x86/kvm/vmx/capabilities.h
+++ b/arch/x86/kvm/vmx/capabilities.h
@@ -33,6 +33,8 @@ struct nested_vmx_msrs {
u32 procbased_ctls_high;
u32 secondary_ctls_low;
u32 secondary_ctls_high;
+ /* Tertiary Controls is 64bit allow-1 semantics */
+ u64 tertiary_ctls;
u32 pinbased_ctls_low;
u32 pinbased_ctls_high;
u32 exit_ctls_low;
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index bced766..b04184b 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -1272,6 +1272,18 @@ static int vmx_restore_vmx_basic(struct vcpu_vmx *vmx, u64 data)
lowp = &vmx->nested.msrs.secondary_ctls_low;
highp = &vmx->nested.msrs.secondary_ctls_high;
break;
+ /*
+ * MSR_IA32_VMX_PROCBASED_CTLS3 is 64bit, all allow-1 (must-be-0)
+ * semantics.
+ */
+ case MSR_IA32_VMX_PROCBASED_CTLS3:
+ /* Check must-be-0 bits are still 0. */
+ if (!is_bitwise_subset(vmx->nested.msrs.tertiary_ctls,
+ data, GENMASK_ULL(63, 0)))
+ return -EINVAL;
+
+ vmx->nested.msrs.tertiary_ctls = data;
+ return 0;
default:
BUG();
}
@@ -1408,6 +1420,7 @@ int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
case MSR_IA32_VMX_TRUE_EXIT_CTLS:
case MSR_IA32_VMX_TRUE_ENTRY_CTLS:
case MSR_IA32_VMX_PROCBASED_CTLS2:
+ case MSR_IA32_VMX_PROCBASED_CTLS3:
return vmx_restore_control_msr(vmx, msr_index, data);
case MSR_IA32_VMX_MISC:
return vmx_restore_vmx_misc(vmx, data);
@@ -1503,6 +1516,9 @@ int vmx_get_vmx_msr(struct nested_vmx_msrs *msrs, u32 msr_index, u64 *pdata)
msrs->secondary_ctls_low,
msrs->secondary_ctls_high);
break;
+ case MSR_IA32_VMX_PROCBASED_CTLS3:
+ *pdata = msrs->tertiary_ctls;
+ break;
case MSR_IA32_VMX_EPT_VPID_CAP:
*pdata = msrs->ept_caps |
((u64)msrs->vpid_caps << 32);
@@ -6429,7 +6445,8 @@ void nested_vmx_setup_ctls_msrs(struct nested_vmx_msrs *msrs, u32 ept_caps)
CPU_BASED_USE_IO_BITMAPS | CPU_BASED_MONITOR_TRAP_FLAG |
CPU_BASED_MONITOR_EXITING | CPU_BASED_RDPMC_EXITING |
CPU_BASED_RDTSC_EXITING | CPU_BASED_PAUSE_EXITING |
- CPU_BASED_TPR_SHADOW | CPU_BASED_ACTIVATE_SECONDARY_CONTROLS;
+ CPU_BASED_TPR_SHADOW | CPU_BASED_ACTIVATE_SECONDARY_CONTROLS |
+ CPU_BASED_ACTIVATE_TERTIARY_CONTROLS;
/*
* We can allow some features even when not supported by the
* hardware. For example, L1 can specify an MSR bitmap - and we
@@ -6467,6 +6484,9 @@ void nested_vmx_setup_ctls_msrs(struct nested_vmx_msrs *msrs, u32 ept_caps)
SECONDARY_EXEC_RDSEED_EXITING |
SECONDARY_EXEC_XSAVES;
+ if (msrs->procbased_ctls_high & CPU_BASED_ACTIVATE_TERTIARY_CONTROLS)
+ rdmsrl(MSR_IA32_VMX_PROCBASED_CTLS3, msrs->tertiary_ctls);
+ msrs->tertiary_ctls &= 0;
/*
* We can emulate "VMCS shadowing," even if the hardware
* doesn't support it.
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index da4c123..44c9f16 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -1981,7 +1981,7 @@ static inline bool vmx_feature_control_msr_valid(struct kvm_vcpu *vcpu,
static int vmx_get_msr_feature(struct kvm_msr_entry *msr)
{
switch (msr->index) {
- case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
+ case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_PROCBASED_CTLS3:
if (!nested)
return 1;
return vmx_get_vmx_msr(&vmcs_config.nested, msr->index, &msr->data);
@@ -2069,7 +2069,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
msr_info->data = to_vmx(vcpu)->msr_ia32_sgxlepubkeyhash
[msr_info->index - MSR_IA32_SGXLEPUBKEYHASH0];
break;
- case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
+ case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_PROCBASED_CTLS3:
if (!nested_vmx_allowed(vcpu))
return 1;
if (vmx_get_vmx_msr(&vmx->nested.msrs, msr_info->index,
@@ -2399,7 +2399,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
vmx->msr_ia32_sgxlepubkeyhash
[msr_index - MSR_IA32_SGXLEPUBKEYHASH0] = data;
break;
- case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
+ case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_PROCBASED_CTLS3:
if (!msr_info->host_initiated)
return 1; /* they are read-only */
if (!nested_vmx_allowed(vcpu))
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 6eda283..9b87e64 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1332,6 +1332,7 @@ int kvm_emulate_rdpmc(struct kvm_vcpu *vcpu)
MSR_IA32_VMX_PROCBASED_CTLS2,
MSR_IA32_VMX_EPT_VPID_CAP,
MSR_IA32_VMX_VMFUNC,
+ MSR_IA32_VMX_PROCBASED_CTLS3,
MSR_K7_HWCR,
MSR_KVM_POLL_CONTROL,
@@ -1363,6 +1364,7 @@ int kvm_emulate_rdpmc(struct kvm_vcpu *vcpu)
MSR_IA32_VMX_PROCBASED_CTLS2,
MSR_IA32_VMX_EPT_VPID_CAP,
MSR_IA32_VMX_VMFUNC,
+ MSR_IA32_VMX_PROCBASED_CTLS3,
MSR_F10H_DECFG,
MSR_IA32_UCODE_REV,
--
1.8.3.1
next prev parent reply other threads:[~2021-06-01 8:49 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-01 8:47 [PATCH 00/15] KVM: Support Intel Key Locker Robert Hoo
2021-06-01 8:47 ` [PATCH 01/15] x86/keylocker: Move KEYSRC_{SW,HW}RAND to keylocker.h Robert Hoo
2021-06-01 8:47 ` [PATCH 02/15] x86/cpufeatures: Define Key Locker sub feature flags Robert Hoo
2021-06-01 8:47 ` [PATCH 03/15] x86/feat_ctl: Add new VMX feature, Tertiary VM-Execution control and LOADIWKEY Exiting Robert Hoo
2021-06-01 8:47 ` [PATCH 04/15] kvm/vmx: Detect Tertiary VM-Execution control when setup VMCS config Robert Hoo
2021-06-01 8:47 ` [PATCH 05/15] kvm/vmx: Extend BUILD_CONTROLS_SHADOW macro to support 64-bit variation Robert Hoo
2021-06-01 8:47 ` [PATCH 06/15] kvm/vmx: Set Tertiary VM-Execution control field When init vCPU's VMCS Robert Hoo
2021-06-01 8:47 ` [PATCH 07/15] kvm/vmx: dump_vmcs() reports tertiary_exec_control field as well Robert Hoo
2021-06-01 8:47 ` [PATCH 08/15] kvm/vmx: Add KVM support on guest Key Locker operations Robert Hoo
2021-06-01 8:47 ` [PATCH 09/15] kvm/cpuid: Enumerate Key Locker feature in KVM Robert Hoo
2021-06-01 8:47 ` Robert Hoo [this message]
2021-06-01 8:47 ` [PATCH 11/15] kvm/vmx: Implement vmx_compute_tertiary_exec_control() Robert Hoo
2021-06-01 8:47 ` [PATCH 12/15] kvm/vmx/vmcs12: Add Tertiary VM-Exec control field in vmcs12 Robert Hoo
2021-06-01 8:47 ` [PATCH 13/15] kvm/vmx/nested: Support Tertiary VM-Exec control in vmcs02 Robert Hoo
2021-06-01 8:47 ` [PATCH 14/15] kvm/vmx/nested: Support CR4.KL in nested Robert Hoo
2021-06-01 8:47 ` [PATCH 15/15] kvm/vmx/nested: Enable nested LOADIWKEY VM-exit Robert Hoo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1622537274-146420-11-git-send-email-robert.hu@linux.intel.com \
--to=robert.hu@linux.intel.com \
--cc=chang.seok.bae@intel.com \
--cc=jmattson@google.com \
--cc=joro@8bytes.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=robert.hu@intel.com \
--cc=seanjc@google.com \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.