* [PATCH v8 0/6] Enable CET support for guest
@ 2021-05-20 5:57 Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 1/6] target/i386: Change XSAVE related feature-word names Yang Weijiang
` (5 more replies)
0 siblings, 6 replies; 7+ messages in thread
From: Yang Weijiang @ 2021-05-20 5:57 UTC (permalink / raw)
To: pbonzini, ehabkost, mtosatti, seanjc, richard.henderson, qemu-devel, kvm
Cc: Yang Weijiang
Control-flow Enforcement Technology (CET) provides protection against
Return/Jump-Oriented Programming (ROP/JOP). It includes two features:
Shadow Stack(SHSTK) and Indirect Branch Tracking(IBT).
This patch series is to enable CET related CPUID report, XSAVES/XRSTORS
support and MSR access etc. for guest.
Change in v8:
- Extended xsave_area_size() to accommodate compacted format size calculation.
- Added CPUID(0xD,1).EBX assigment per maintain's feedback.
- Changed XSS field check and added more comments to make things clearer.
- Other ajustment per maintainer's review feedback.
- Rebased to 6.0.0.
v7 patch:
https://lore.kernel.org/kvm/20210226022058.24562-1-weijiang.yang@intel.com
CET KVM patches:
https://git.kernel.org/pub/scm/virt/kvm/kvm.git/log/?h=intel
CET kernel patches:
https://lkml.kernel.org/r/20210427204315.24153-1-yu-cheng.yu@intel.com
Yang Weijiang (6):
target/i386: Change XSAVE related feature-word names
target/i386: Enable XSS feature CPUID enumeration
target/i386: Enable XSAVES support for CET states
target/i386: Add user-space MSR access interface for CET
target/i386: Add CET state support for guest migration
target/i386: Advise CET bits in CPU/MSR feature words
target/i386/cpu.c | 138 +++++++++++++++++++++++++++++-------
target/i386/cpu.h | 52 +++++++++++++-
target/i386/kvm/kvm.c | 72 +++++++++++++++++++
target/i386/machine.c | 161 ++++++++++++++++++++++++++++++++++++++++++
4 files changed, 395 insertions(+), 28 deletions(-)
--
2.26.2
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v8 1/6] target/i386: Change XSAVE related feature-word names
2021-05-20 5:57 [PATCH v8 0/6] Enable CET support for guest Yang Weijiang
@ 2021-05-20 5:57 ` Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 2/6] target/i386: Enable XSS feature CPUID enumeration Yang Weijiang
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Yang Weijiang @ 2021-05-20 5:57 UTC (permalink / raw)
To: pbonzini, ehabkost, mtosatti, seanjc, richard.henderson, qemu-devel, kvm
Cc: Yang Weijiang
Rename XSAVE related feature-words for introducing XSAVES related
feature-words.
Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
---
target/i386/cpu.c | 24 ++++++++++++------------
target/i386/cpu.h | 4 ++--
2 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index ad99cad0e7..5c76186883 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1077,7 +1077,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
.cpuid = { .eax = 6, .reg = R_EAX, },
.tcg_features = TCG_6_EAX_FEATURES,
},
- [FEAT_XSAVE_COMP_LO] = {
+ [FEAT_XSAVE_XCR0_LO] = {
.type = CPUID_FEATURE_WORD,
.cpuid = {
.eax = 0xD,
@@ -1090,7 +1090,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
XSTATE_OPMASK_MASK | XSTATE_ZMM_Hi256_MASK | XSTATE_Hi16_ZMM_MASK |
XSTATE_PKRU_MASK,
},
- [FEAT_XSAVE_COMP_HI] = {
+ [FEAT_XSAVE_XCR0_HI] = {
.type = CPUID_FEATURE_WORD,
.cpuid = {
.eax = 0xD,
@@ -1519,8 +1519,8 @@ static inline bool accel_uses_host_cpuid(void)
static inline uint64_t x86_cpu_xsave_components(X86CPU *cpu)
{
- return ((uint64_t)cpu->env.features[FEAT_XSAVE_COMP_HI]) << 32 |
- cpu->env.features[FEAT_XSAVE_COMP_LO];
+ return ((uint64_t)cpu->env.features[FEAT_XSAVE_XCR0_HI]) << 32 |
+ cpu->env.features[FEAT_XSAVE_XCR0_LO];
}
/* Return name of 32-bit register, from a R_* constant */
@@ -4811,8 +4811,8 @@ static const char *x86_cpu_feature_name(FeatureWord w, int bitnr)
/* XSAVE components are automatically enabled by other features,
* so return the original feature name instead
*/
- if (w == FEAT_XSAVE_COMP_LO || w == FEAT_XSAVE_COMP_HI) {
- int comp = (w == FEAT_XSAVE_COMP_HI) ? bitnr + 32 : bitnr;
+ if (w == FEAT_XSAVE_XCR0_LO || w == FEAT_XSAVE_XCR0_HI) {
+ int comp = (w == FEAT_XSAVE_XCR0_HI) ? bitnr + 32 : bitnr;
if (comp < ARRAY_SIZE(x86_ext_save_areas) &&
x86_ext_save_areas[comp].bits) {
@@ -5860,8 +5860,8 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
if (count == 0) {
*ecx = xsave_area_size(x86_cpu_xsave_components(cpu));
- *eax = env->features[FEAT_XSAVE_COMP_LO];
- *edx = env->features[FEAT_XSAVE_COMP_HI];
+ *eax = env->features[FEAT_XSAVE_XCR0_LO];
+ *edx = env->features[FEAT_XSAVE_XCR0_HI];
/*
* The initial value of xcr0 and ebx == 0, On host without kvm
* commit 412a3c41(e.g., CentOS 6), the ebx's value always == 0
@@ -6431,8 +6431,8 @@ static void x86_cpu_enable_xsave_components(X86CPU *cpu)
uint64_t mask;
if (!(env->features[FEAT_1_ECX] & CPUID_EXT_XSAVE)) {
- env->features[FEAT_XSAVE_COMP_LO] = 0;
- env->features[FEAT_XSAVE_COMP_HI] = 0;
+ env->features[FEAT_XSAVE_XCR0_LO] = 0;
+ env->features[FEAT_XSAVE_XCR0_HI] = 0;
return;
}
@@ -6444,8 +6444,8 @@ static void x86_cpu_enable_xsave_components(X86CPU *cpu)
}
}
- env->features[FEAT_XSAVE_COMP_LO] = mask;
- env->features[FEAT_XSAVE_COMP_HI] = mask >> 32;
+ env->features[FEAT_XSAVE_XCR0_LO] = mask;
+ env->features[FEAT_XSAVE_XCR0_HI] = mask >> 32;
}
/***** Steps involved on loading and filtering CPUID data
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 570f916878..84cb6adcaa 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -526,8 +526,8 @@ typedef enum FeatureWord {
FEAT_SVM, /* CPUID[8000_000A].EDX */
FEAT_XSAVE, /* CPUID[EAX=0xd,ECX=1].EAX */
FEAT_6_EAX, /* CPUID[6].EAX */
- FEAT_XSAVE_COMP_LO, /* CPUID[EAX=0xd,ECX=0].EAX */
- FEAT_XSAVE_COMP_HI, /* CPUID[EAX=0xd,ECX=0].EDX */
+ FEAT_XSAVE_XCR0_LO, /* CPUID[EAX=0xd,ECX=0].EAX */
+ FEAT_XSAVE_XCR0_HI, /* CPUID[EAX=0xd,ECX=0].EDX */
FEAT_ARCH_CAPABILITIES,
FEAT_CORE_CAPABILITY,
FEAT_PERF_CAPABILITIES,
--
2.26.2
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v8 2/6] target/i386: Enable XSS feature CPUID enumeration
2021-05-20 5:57 [PATCH v8 0/6] Enable CET support for guest Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 1/6] target/i386: Change XSAVE related feature-word names Yang Weijiang
@ 2021-05-20 5:57 ` Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 3/6] target/i386: Enable XSAVES support for CET states Yang Weijiang
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Yang Weijiang @ 2021-05-20 5:57 UTC (permalink / raw)
To: pbonzini, ehabkost, mtosatti, seanjc, richard.henderson, qemu-devel, kvm
Cc: Yang Weijiang
Currently, CPUID.(EAX=0DH,ECX=01H) doesn't enumerate features in XSS
properly, so enable the support. XCR0 bits indicate user-mode XSAVE
components, and XSS bits indicate supervisor-mode XSAVE components.
Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
---
target/i386/cpu.c | 68 +++++++++++++++++++++++++++++++++++++++--------
target/i386/cpu.h | 9 +++++++
2 files changed, 66 insertions(+), 11 deletions(-)
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 5c76186883..d74d68e319 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1062,6 +1062,24 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
},
.tcg_features = TCG_XSAVE_FEATURES,
},
+ [FEAT_XSAVE_XSS_LO] = {
+ .type = CPUID_FEATURE_WORD,
+ .cpuid = {
+ .eax = 0xD,
+ .needs_ecx = true,
+ .ecx = 1,
+ .reg = R_ECX,
+ },
+ },
+ [FEAT_XSAVE_XSS_HI] = {
+ .type = CPUID_FEATURE_WORD,
+ .cpuid = {
+ .eax = 0xD,
+ .needs_ecx = true,
+ .ecx = 1,
+ .reg = R_EDX
+ },
+ },
[FEAT_6_EAX] = {
.type = CPUID_FEATURE_WORD,
.feat_names = {
@@ -1453,6 +1471,9 @@ typedef struct ExtSaveArea {
uint32_t offset, size;
} ExtSaveArea;
+/* CPUID feature bits available in XSS */
+#define CPUID_XSTATE_XSS_MASK 0
+
static const ExtSaveArea x86_ext_save_areas[] = {
[XSTATE_FP_BIT] = {
/* x87 FP state component is always enabled if XSAVE is supported */
@@ -1498,15 +1519,18 @@ static const ExtSaveArea x86_ext_save_areas[] = {
.size = sizeof(XSavePKRU) },
};
-static uint32_t xsave_area_size(uint64_t mask)
+static uint32_t xsave_area_size(uint64_t mask, bool compacted)
{
+ uint64_t ret = x86_ext_save_areas[0].size;
+ const ExtSaveArea *esa;
+ uint32_t offset = 0;
int i;
- uint64_t ret = 0;
- for (i = 0; i < ARRAY_SIZE(x86_ext_save_areas); i++) {
- const ExtSaveArea *esa = &x86_ext_save_areas[i];
+ for (i = 2; i < ARRAY_SIZE(x86_ext_save_areas); i++) {
+ esa = &x86_ext_save_areas[i];
if ((mask >> i) & 1) {
- ret = MAX(ret, esa->offset + esa->size);
+ offset = compacted ? ret : esa->offset;
+ ret = MAX(ret, offset + esa->size);
}
}
return ret;
@@ -1517,7 +1541,7 @@ static inline bool accel_uses_host_cpuid(void)
return kvm_enabled() || hvf_enabled();
}
-static inline uint64_t x86_cpu_xsave_components(X86CPU *cpu)
+static inline uint64_t x86_cpu_xsave_xcr0_components(X86CPU *cpu)
{
return ((uint64_t)cpu->env.features[FEAT_XSAVE_XCR0_HI]) << 32 |
cpu->env.features[FEAT_XSAVE_XCR0_LO];
@@ -1532,6 +1556,12 @@ static const char *get_register_name_32(unsigned int reg)
return x86_reg_info_32[reg].name;
}
+static inline uint64_t x86_cpu_xsave_xss_components(X86CPU *cpu)
+{
+ return ((uint64_t)cpu->env.features[FEAT_XSAVE_XSS_HI]) << 32 |
+ cpu->env.features[FEAT_XSAVE_XSS_LO];
+}
+
/*
* Returns the set of feature flags that are supported and migratable by
* QEMU, for a given FeatureWord.
@@ -5859,7 +5889,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
}
if (count == 0) {
- *ecx = xsave_area_size(x86_cpu_xsave_components(cpu));
+ *ecx = xsave_area_size(x86_cpu_xsave_xcr0_components(cpu), false);
*eax = env->features[FEAT_XSAVE_XCR0_LO];
*edx = env->features[FEAT_XSAVE_XCR0_HI];
/*
@@ -5868,14 +5898,25 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
* even through guest update xcr0, this will crash some legacy guest
* (e.g., CentOS 6), So set ebx == ecx to workaroud it.
*/
- *ebx = kvm_enabled() ? *ecx : xsave_area_size(env->xcr0);
+ *ebx = kvm_enabled() ? *ecx : xsave_area_size(env->xcr0, false);
} else if (count == 1) {
+ uint64_t xstate = x86_cpu_xsave_xcr0_components(cpu) |
+ x86_cpu_xsave_xss_components(cpu);
+
*eax = env->features[FEAT_XSAVE];
+ *ebx = xsave_area_size(xstate, true);
+ *ecx = env->features[FEAT_XSAVE_XSS_LO];
+ *edx = env->features[FEAT_XSAVE_XSS_HI];
} else if (count < ARRAY_SIZE(x86_ext_save_areas)) {
- if ((x86_cpu_xsave_components(cpu) >> count) & 1) {
- const ExtSaveArea *esa = &x86_ext_save_areas[count];
+ const ExtSaveArea *esa = &x86_ext_save_areas[count];
+
+ if ((x86_cpu_xsave_xcr0_components(cpu) >> count) & 1) {
*eax = esa->size;
*ebx = esa->offset;
+ } else if ((x86_cpu_xsave_xss_components(cpu) >> count) & 1) {
+ *eax = esa->size;
+ *ebx = 0;
+ *ecx = 1;
}
}
break;
@@ -6206,6 +6247,9 @@ static void x86_cpu_reset(DeviceState *dev)
}
for (i = 2; i < ARRAY_SIZE(x86_ext_save_areas); i++) {
const ExtSaveArea *esa = &x86_ext_save_areas[i];
+ if (!((1 << i) & CPUID_XSTATE_XCR0_MASK)) {
+ continue;
+ }
if (env->features[esa->feature] & esa->bits) {
xcr0 |= 1ull << i;
}
@@ -6444,8 +6488,10 @@ static void x86_cpu_enable_xsave_components(X86CPU *cpu)
}
}
- env->features[FEAT_XSAVE_XCR0_LO] = mask;
+ env->features[FEAT_XSAVE_XCR0_LO] = mask & CPUID_XSTATE_XCR0_MASK;
env->features[FEAT_XSAVE_XCR0_HI] = mask >> 32;
+ env->features[FEAT_XSAVE_XSS_LO] = mask & CPUID_XSTATE_XSS_MASK;
+ env->features[FEAT_XSAVE_XSS_HI] = mask >> 32;
}
/***** Steps involved on loading and filtering CPUID data
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 84cb6adcaa..42f835d455 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -503,6 +503,13 @@ typedef enum X86Seg {
#define XSTATE_Hi16_ZMM_MASK (1ULL << XSTATE_Hi16_ZMM_BIT)
#define XSTATE_PKRU_MASK (1ULL << XSTATE_PKRU_BIT)
+/* CPUID feature bits available in XCR0 */
+#define CPUID_XSTATE_XCR0_MASK (XSTATE_FP_MASK | XSTATE_SSE_MASK | \
+ XSTATE_YMM_MASK | XSTATE_BNDREGS_MASK | \
+ XSTATE_BNDCSR_MASK | XSTATE_OPMASK_MASK | \
+ XSTATE_ZMM_Hi256_MASK | \
+ XSTATE_Hi16_ZMM_MASK | XSTATE_PKRU_MASK)
+
/* CPUID feature words */
typedef enum FeatureWord {
FEAT_1_EDX, /* CPUID[1].EDX */
@@ -541,6 +548,8 @@ typedef enum FeatureWord {
FEAT_VMX_BASIC,
FEAT_VMX_VMFUNC,
FEAT_14_0_ECX,
+ FEAT_XSAVE_XSS_LO, /* CPUID[EAX=0xd,ECX=1].ECX */
+ FEAT_XSAVE_XSS_HI, /* CPUID[EAX=0xd,ECX=1].EDX */
FEATURE_WORDS,
} FeatureWord;
--
2.26.2
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v8 3/6] target/i386: Enable XSAVES support for CET states
2021-05-20 5:57 [PATCH v8 0/6] Enable CET support for guest Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 1/6] target/i386: Change XSAVE related feature-word names Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 2/6] target/i386: Enable XSS feature CPUID enumeration Yang Weijiang
@ 2021-05-20 5:57 ` Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 4/6] target/i386: Add user-space MSR access interface for CET Yang Weijiang
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Yang Weijiang @ 2021-05-20 5:57 UTC (permalink / raw)
To: pbonzini, ehabkost, mtosatti, seanjc, richard.henderson, qemu-devel, kvm
Cc: Yang Weijiang
CET Shadow Stack(SHSTK) and Indirect Branch Tracking(IBT) are enumerated
via CPUID.(EAX=07H,ECX=0H):ECX[bit 7] and EDX[bit 20] respectively.
Two CET bits (bit 11 and 12) are defined in MSR_IA32_XSS for XSAVES.
They correspond to CET states in user and supervisor mode respectively.
Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
---
target/i386/cpu.c | 42 +++++++++++++++++++++++++++++++++++++++++-
target/i386/cpu.h | 21 +++++++++++++++++++++
2 files changed, 62 insertions(+), 1 deletion(-)
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index d74d68e319..bae827c8d5 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1064,6 +1064,16 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
},
[FEAT_XSAVE_XSS_LO] = {
.type = CPUID_FEATURE_WORD,
+ .feat_names = {
+ NULL, NULL, NULL, NULL,
+ NULL, NULL, NULL, NULL,
+ NULL, NULL, NULL, "cet-u",
+ "cet-s", NULL, NULL, NULL,
+ NULL, NULL, NULL, NULL,
+ NULL, NULL, NULL, NULL,
+ NULL, NULL, NULL, NULL,
+ NULL, NULL, NULL, NULL,
+ },
.cpuid = {
.eax = 0xD,
.needs_ecx = true,
@@ -1472,7 +1482,7 @@ typedef struct ExtSaveArea {
} ExtSaveArea;
/* CPUID feature bits available in XSS */
-#define CPUID_XSTATE_XSS_MASK 0
+#define CPUID_XSTATE_XSS_MASK (XSTATE_CET_U_MASK)
static const ExtSaveArea x86_ext_save_areas[] = {
[XSTATE_FP_BIT] = {
@@ -1517,6 +1527,19 @@ static const ExtSaveArea x86_ext_save_areas[] = {
{ .feature = FEAT_7_0_ECX, .bits = CPUID_7_0_ECX_PKU,
.offset = offsetof(X86XSaveArea, pkru_state),
.size = sizeof(XSavePKRU) },
+ [XSTATE_CET_U_BIT] = {
+ .feature = FEAT_7_0_ECX, .bits = CPUID_7_0_ECX_CET_SHSTK,
+ /*
+ * The features enabled in XSS MSR always use compacted format
+ * to store the data, in this case .offset == 0. And CET bits
+ * fall into this category.
+ */
+ .offset = 0,
+ .size = sizeof(XSavesCETU) },
+ [XSTATE_CET_S_BIT] = {
+ .feature = FEAT_7_0_ECX, .bits = CPUID_7_0_ECX_CET_SHSTK,
+ .offset = 0,
+ .size = sizeof(XSavesCETS) },
};
static uint32_t xsave_area_size(uint64_t mask, bool compacted)
@@ -6486,6 +6509,23 @@ static void x86_cpu_enable_xsave_components(X86CPU *cpu)
if (env->features[esa->feature] & esa->bits) {
mask |= (1ULL << i);
}
+
+ /*
+ * Both CET SHSTK and IBT feature requires XSAVES support, but two
+ * features can be controlled independently by kernel, and we only
+ * have one correlated bit set in x86_ext_save_areas, so if either
+ * of two features is enabled, we set the XSAVES support bit to make
+ * the enabled feature work.
+ */
+ if (i == XSTATE_CET_U_BIT || i == XSTATE_CET_S_BIT) {
+ uint64_t ecx = env->features[FEAT_7_0_ECX];
+ uint64_t edx = env->features[FEAT_7_0_EDX];
+
+ if ((ecx & CPUID_7_0_ECX_CET_SHSTK) ||
+ (edx & CPUID_7_0_EDX_CET_IBT)) {
+ mask |= (1ULL << i);
+ }
+ }
}
env->features[FEAT_XSAVE_XCR0_LO] = mask & CPUID_XSTATE_XCR0_MASK;
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 42f835d455..593a2d6823 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -492,6 +492,8 @@ typedef enum X86Seg {
#define XSTATE_ZMM_Hi256_BIT 6
#define XSTATE_Hi16_ZMM_BIT 7
#define XSTATE_PKRU_BIT 9
+#define XSTATE_CET_U_BIT 11
+#define XSTATE_CET_S_BIT 12
#define XSTATE_FP_MASK (1ULL << XSTATE_FP_BIT)
#define XSTATE_SSE_MASK (1ULL << XSTATE_SSE_BIT)
@@ -502,6 +504,8 @@ typedef enum X86Seg {
#define XSTATE_ZMM_Hi256_MASK (1ULL << XSTATE_ZMM_Hi256_BIT)
#define XSTATE_Hi16_ZMM_MASK (1ULL << XSTATE_Hi16_ZMM_BIT)
#define XSTATE_PKRU_MASK (1ULL << XSTATE_PKRU_BIT)
+#define XSTATE_CET_U_MASK (1ULL << XSTATE_CET_U_BIT)
+#define XSTATE_CET_S_MASK (1ULL << XSTATE_CET_S_BIT)
/* CPUID feature bits available in XCR0 */
#define CPUID_XSTATE_XCR0_MASK (XSTATE_FP_MASK | XSTATE_SSE_MASK | \
@@ -761,6 +765,8 @@ typedef uint64_t FeatureWordArray[FEATURE_WORDS];
#define CPUID_7_0_ECX_WAITPKG (1U << 5)
/* Additional AVX-512 Vector Byte Manipulation Instruction */
#define CPUID_7_0_ECX_AVX512_VBMI2 (1U << 6)
+/* CET SHSTK feature */
+#define CPUID_7_0_ECX_CET_SHSTK (1U << 7)
/* Galois Field New Instructions */
#define CPUID_7_0_ECX_GFNI (1U << 8)
/* Vector AES Instructions */
@@ -800,6 +806,8 @@ typedef uint64_t FeatureWordArray[FEATURE_WORDS];
#define CPUID_7_0_EDX_SERIALIZE (1U << 14)
/* TSX Suspend Load Address Tracking instruction */
#define CPUID_7_0_EDX_TSX_LDTRK (1U << 16)
+/* CET IBT feature */
+#define CPUID_7_0_EDX_CET_IBT (1U << 20)
/* AVX512_FP16 instruction */
#define CPUID_7_0_EDX_AVX512_FP16 (1U << 23)
/* Speculation Control */
@@ -1301,6 +1309,19 @@ typedef struct XSavePKRU {
uint32_t padding;
} XSavePKRU;
+/* Ext. save area 11: User mode CET state */
+typedef struct XSavesCETU {
+ uint64_t u_cet;
+ uint64_t user_ssp;
+} XSavesCETU;
+
+/* Ext. save area 12: Supervisor mode CET state */
+typedef struct XSavesCETS {
+ uint64_t kernel_ssp;
+ uint64_t pl1_ssp;
+ uint64_t pl2_ssp;
+} XSavesCETS;
+
typedef struct X86XSaveArea {
X86LegacyXSaveArea legacy;
X86XSaveHeader header;
--
2.26.2
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v8 4/6] target/i386: Add user-space MSR access interface for CET
2021-05-20 5:57 [PATCH v8 0/6] Enable CET support for guest Yang Weijiang
` (2 preceding siblings ...)
2021-05-20 5:57 ` [PATCH v8 3/6] target/i386: Enable XSAVES support for CET states Yang Weijiang
@ 2021-05-20 5:57 ` Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 5/6] target/i386: Add CET state support for guest migration Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 6/6] target/i386: Advise CET bits in CPU/MSR feature words Yang Weijiang
5 siblings, 0 replies; 7+ messages in thread
From: Yang Weijiang @ 2021-05-20 5:57 UTC (permalink / raw)
To: pbonzini, ehabkost, mtosatti, seanjc, richard.henderson, qemu-devel, kvm
Cc: Yang Weijiang
CET states are divided into user-mode and supervisor-mode states,
MSR_KVM_GUEST_SSP holds current SHSTK pointer in use, MSR_IA32_U_CET and
MSR_IA32_PL3_SSP are for user-mode states, others are for supervisor-mode
states. Expose access according to current CET supported bits in CPUID
and XSS.
Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
---
target/i386/cpu.h | 18 +++++++++++
target/i386/kvm/kvm.c | 72 +++++++++++++++++++++++++++++++++++++++++++
2 files changed, 90 insertions(+)
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 593a2d6823..a5bb049d4e 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -483,6 +483,15 @@ typedef enum X86Seg {
#define MSR_IA32_VMX_TRUE_ENTRY_CTLS 0x00000490
#define MSR_IA32_VMX_VMFUNC 0x00000491
+#define MSR_IA32_U_CET 0x000006a0
+#define MSR_IA32_S_CET 0x000006a2
+#define MSR_IA32_PL0_SSP 0x000006a4
+#define MSR_IA32_PL1_SSP 0x000006a5
+#define MSR_IA32_PL2_SSP 0x000006a6
+#define MSR_IA32_PL3_SSP 0x000006a7
+#define MSR_IA32_SSP_TBL 0x000006a8
+#define MSR_KVM_GUEST_SSP 0x4b564d08
+
#define XSTATE_FP_BIT 0
#define XSTATE_SSE_BIT 1
#define XSTATE_YMM_BIT 2
@@ -1601,6 +1610,15 @@ typedef struct CPUX86State {
uintptr_t retaddr;
+ uint64_t u_cet;
+ uint64_t s_cet;
+ uint64_t pl0_ssp;
+ uint64_t pl1_ssp;
+ uint64_t pl2_ssp;
+ uint64_t pl3_ssp;
+ uint64_t ssp_tbl;
+ uint64_t guest_ssp;
+
/* Fields up to this point are cleared by a CPU reset */
struct {} end_reset_fields;
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 7fe9f52710..c36ff7ffec 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -3047,6 +3047,30 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
}
}
+ if (((env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_CET_SHSTK) ||
+ (env->features[FEAT_7_0_EDX] & CPUID_7_0_EDX_CET_IBT)) &&
+ (env->features[FEAT_XSAVE_XSS_LO] & XSTATE_CET_U_MASK)) {
+ kvm_msr_entry_add(cpu, MSR_IA32_U_CET, env->u_cet);
+ kvm_msr_entry_add(cpu, MSR_IA32_PL3_SSP, env->pl3_ssp);
+ }
+
+ if (env->features[FEAT_XSAVE_XSS_LO] & XSTATE_CET_S_MASK) {
+ if (env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_CET_SHSTK) {
+ kvm_msr_entry_add(cpu, MSR_IA32_PL0_SSP, env->pl0_ssp);
+ kvm_msr_entry_add(cpu, MSR_IA32_PL1_SSP, env->pl1_ssp);
+ kvm_msr_entry_add(cpu, MSR_IA32_PL2_SSP, env->pl2_ssp);
+ kvm_msr_entry_add(cpu, MSR_IA32_SSP_TBL, env->ssp_tbl);
+ }
+
+ kvm_msr_entry_add(cpu, MSR_IA32_S_CET, env->s_cet);
+ }
+
+ if ((env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_CET_SHSTK) &&
+ (env->features[FEAT_XSAVE_XSS_LO] & (XSTATE_CET_U_MASK |
+ XSTATE_CET_S_MASK))) {
+ kvm_msr_entry_add(cpu, MSR_KVM_GUEST_SSP, env->guest_ssp);
+ }
+
return kvm_buf_set_msrs(cpu);
}
@@ -3369,6 +3393,30 @@ static int kvm_get_msrs(X86CPU *cpu)
}
}
+ if (((env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_CET_SHSTK) ||
+ (env->features[FEAT_7_0_EDX] & CPUID_7_0_EDX_CET_IBT)) &&
+ (env->features[FEAT_XSAVE_XSS_LO] & XSTATE_CET_U_MASK)) {
+ kvm_msr_entry_add(cpu, MSR_IA32_U_CET, 0);
+ kvm_msr_entry_add(cpu, MSR_IA32_PL3_SSP, 0);
+ }
+
+ if (env->features[FEAT_XSAVE_XSS_LO] & XSTATE_CET_S_MASK) {
+ if (env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_CET_SHSTK) {
+ kvm_msr_entry_add(cpu, MSR_IA32_PL0_SSP, 0);
+ kvm_msr_entry_add(cpu, MSR_IA32_PL1_SSP, 0);
+ kvm_msr_entry_add(cpu, MSR_IA32_PL2_SSP, 0);
+ kvm_msr_entry_add(cpu, MSR_IA32_SSP_TBL, 0);
+ }
+
+ kvm_msr_entry_add(cpu, MSR_IA32_S_CET, 0);
+ }
+
+ if ((env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_CET_SHSTK) &&
+ (env->features[FEAT_XSAVE_XSS_LO] & (XSTATE_CET_U_MASK |
+ XSTATE_CET_S_MASK))) {
+ kvm_msr_entry_add(cpu, MSR_KVM_GUEST_SSP, 0);
+ }
+
ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_MSRS, cpu->kvm_msr_buf);
if (ret < 0) {
return ret;
@@ -3658,6 +3706,30 @@ static int kvm_get_msrs(X86CPU *cpu)
case MSR_IA32_RTIT_ADDR0_A ... MSR_IA32_RTIT_ADDR3_B:
env->msr_rtit_addrs[index - MSR_IA32_RTIT_ADDR0_A] = msrs[i].data;
break;
+ case MSR_IA32_U_CET:
+ env->u_cet = msrs[i].data;
+ break;
+ case MSR_IA32_S_CET:
+ env->s_cet = msrs[i].data;
+ break;
+ case MSR_IA32_PL0_SSP:
+ env->pl0_ssp = msrs[i].data;
+ break;
+ case MSR_IA32_PL1_SSP:
+ env->pl1_ssp = msrs[i].data;
+ break;
+ case MSR_IA32_PL2_SSP:
+ env->pl2_ssp = msrs[i].data;
+ break;
+ case MSR_IA32_PL3_SSP:
+ env->pl3_ssp = msrs[i].data;
+ break;
+ case MSR_IA32_SSP_TBL:
+ env->ssp_tbl = msrs[i].data;
+ break;
+ case MSR_KVM_GUEST_SSP:
+ env->guest_ssp = msrs[i].data;
+ break;
}
}
--
2.26.2
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v8 5/6] target/i386: Add CET state support for guest migration
2021-05-20 5:57 [PATCH v8 0/6] Enable CET support for guest Yang Weijiang
` (3 preceding siblings ...)
2021-05-20 5:57 ` [PATCH v8 4/6] target/i386: Add user-space MSR access interface for CET Yang Weijiang
@ 2021-05-20 5:57 ` Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 6/6] target/i386: Advise CET bits in CPU/MSR feature words Yang Weijiang
5 siblings, 0 replies; 7+ messages in thread
From: Yang Weijiang @ 2021-05-20 5:57 UTC (permalink / raw)
To: pbonzini, ehabkost, mtosatti, seanjc, richard.henderson, qemu-devel, kvm
Cc: Yang Weijiang
Save the MSRs being used on source machine and restore them
on destination machine.
Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
---
target/i386/machine.c | 161 ++++++++++++++++++++++++++++++++++++++++++
1 file changed, 161 insertions(+)
diff --git a/target/i386/machine.c b/target/i386/machine.c
index 137604ddb8..4d63340931 100644
--- a/target/i386/machine.c
+++ b/target/i386/machine.c
@@ -1000,6 +1000,159 @@ static const VMStateDescription vmstate_umwait = {
}
};
+static bool u_cet_needed(void *opaque)
+{
+ X86CPU *cpu = opaque;
+ CPUX86State *env = &cpu->env;
+
+ return env->u_cet != 0;
+}
+
+static const VMStateDescription vmstate_u_cet = {
+ .name = "cpu/u_cet",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .needed = u_cet_needed,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(env.u_cet, X86CPU),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static bool s_cet_needed(void *opaque)
+{
+ X86CPU *cpu = opaque;
+ CPUX86State *env = &cpu->env;
+
+ return env->s_cet != 0;
+}
+
+static const VMStateDescription vmstate_s_cet = {
+ .name = "cpu/s_cet",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .needed = s_cet_needed,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(env.s_cet, X86CPU),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static bool pl0_ssp_needed(void *opaque)
+{
+ X86CPU *cpu = opaque;
+ CPUX86State *env = &cpu->env;
+
+ return env->pl0_ssp != 0;
+}
+
+static const VMStateDescription vmstate_pl0_ssp = {
+ .name = "cpu/pl0_ssp",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .needed = pl0_ssp_needed,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(env.pl0_ssp, X86CPU),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static bool pl1_ssp_needed(void *opaque)
+{
+ X86CPU *cpu = opaque;
+ CPUX86State *env = &cpu->env;
+
+ return env->pl1_ssp != 0;
+}
+
+static const VMStateDescription vmstate_pl1_ssp = {
+ .name = "cpu/pl1_ssp",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .needed = pl1_ssp_needed,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(env.pl1_ssp, X86CPU),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static bool pl2_ssp_needed(void *opaque)
+{
+ X86CPU *cpu = opaque;
+ CPUX86State *env = &cpu->env;
+
+ return env->pl2_ssp != 0;
+}
+
+static const VMStateDescription vmstate_pl2_ssp = {
+ .name = "cpu/pl2_ssp",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .needed = pl2_ssp_needed,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(env.pl2_ssp, X86CPU),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+
+static bool pl3_ssp_needed(void *opaque)
+{
+ X86CPU *cpu = opaque;
+ CPUX86State *env = &cpu->env;
+
+ return env->pl3_ssp != 0;
+}
+
+static const VMStateDescription vmstate_pl3_ssp = {
+ .name = "cpu/pl3_ssp",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .needed = pl3_ssp_needed,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(env.pl3_ssp, X86CPU),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static bool ssp_tbl_needed(void *opaque)
+{
+ X86CPU *cpu = opaque;
+ CPUX86State *env = &cpu->env;
+
+ return env->ssp_tbl != 0;
+}
+
+static const VMStateDescription vmstate_ssp_tbl = {
+ .name = "cpu/ssp_tbl",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .needed = ssp_tbl_needed,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(env.ssp_tbl, X86CPU),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static bool guest_ssp_needed(void *opaque)
+{
+ X86CPU *cpu = opaque;
+ CPUX86State *env = &cpu->env;
+
+ return env->guest_ssp != 0;
+}
+
+static const VMStateDescription vmstate_guest_ssp = {
+ .name = "cpu/guest_ssp",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .needed = guest_ssp_needed,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(env.guest_ssp, X86CPU),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
static bool pkru_needed(void *opaque)
{
X86CPU *cpu = opaque;
@@ -1531,6 +1684,14 @@ VMStateDescription vmstate_x86_cpu = {
&vmstate_nested_state,
#endif
&vmstate_msr_tsx_ctrl,
+ &vmstate_u_cet,
+ &vmstate_s_cet,
+ &vmstate_pl0_ssp,
+ &vmstate_pl1_ssp,
+ &vmstate_pl2_ssp,
+ &vmstate_pl3_ssp,
+ &vmstate_ssp_tbl,
+ &vmstate_guest_ssp,
NULL
}
};
--
2.26.2
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v8 6/6] target/i386: Advise CET bits in CPU/MSR feature words
2021-05-20 5:57 [PATCH v8 0/6] Enable CET support for guest Yang Weijiang
` (4 preceding siblings ...)
2021-05-20 5:57 ` [PATCH v8 5/6] target/i386: Add CET state support for guest migration Yang Weijiang
@ 2021-05-20 5:57 ` Yang Weijiang
5 siblings, 0 replies; 7+ messages in thread
From: Yang Weijiang @ 2021-05-20 5:57 UTC (permalink / raw)
To: pbonzini, ehabkost, mtosatti, seanjc, richard.henderson, qemu-devel, kvm
Cc: Yang Weijiang
CET SHSTK and IBT feature are enumerated via CPUID.(EAX=07H,ECX=0H):ECX[bit 7]
and EDX[bit 20]. CET state load/restore at vmentry/vmexit are enabled via
VMX_ENTRY_CTLS[bit 20] and VMX_EXIT_CTLS[bit 28].
Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
---
target/i386/cpu.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index bae827c8d5..b432b681d8 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -958,7 +958,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
.type = CPUID_FEATURE_WORD,
.feat_names = {
NULL, "avx512vbmi", "umip", "pku",
- NULL /* ospke */, "waitpkg", "avx512vbmi2", NULL,
+ NULL /* ospke */, "waitpkg", "avx512vbmi2", "shstk",
"gfni", "vaes", "vpclmulqdq", "avx512vnni",
"avx512bitalg", NULL, "avx512-vpopcntdq", NULL,
"la57", NULL, NULL, NULL,
@@ -981,7 +981,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
"avx512-vp2intersect", NULL, "md-clear", NULL,
NULL, NULL, "serialize", NULL,
"tsx-ldtrk", NULL, NULL /* pconfig */, NULL,
- NULL, NULL, NULL, "avx512-fp16",
+ "ibt", NULL, NULL, "avx512-fp16",
NULL, NULL, "spec-ctrl", "stibp",
NULL, "arch-capabilities", "core-capability", "ssbd",
},
@@ -1243,7 +1243,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
"vmx-exit-save-efer", "vmx-exit-load-efer",
"vmx-exit-save-preemption-timer", "vmx-exit-clear-bndcfgs",
NULL, "vmx-exit-clear-rtit-ctl", NULL, NULL,
- NULL, "vmx-exit-load-pkrs", NULL, NULL,
+ "vmx-exit-save-cet-ctl", "vmx-exit-load-pkrs", NULL, NULL,
},
.msr = {
.index = MSR_IA32_VMX_TRUE_EXIT_CTLS,
@@ -1258,7 +1258,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
NULL, "vmx-entry-ia32e-mode", NULL, NULL,
NULL, "vmx-entry-load-perf-global-ctrl", "vmx-entry-load-pat", "vmx-entry-load-efer",
"vmx-entry-load-bndcfgs", NULL, "vmx-entry-load-rtit-ctl", NULL,
- NULL, NULL, "vmx-entry-load-pkrs", NULL,
+ "vmx-entry-load-cet-ctl", NULL, "vmx-entry-load-pkrs", NULL,
NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL,
},
--
2.26.2
^ permalink raw reply related [flat|nested] 7+ messages in thread
end of thread, other threads:[~2021-05-20 5:43 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-20 5:57 [PATCH v8 0/6] Enable CET support for guest Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 1/6] target/i386: Change XSAVE related feature-word names Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 2/6] target/i386: Enable XSS feature CPUID enumeration Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 3/6] target/i386: Enable XSAVES support for CET states Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 4/6] target/i386: Add user-space MSR access interface for CET Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 5/6] target/i386: Add CET state support for guest migration Yang Weijiang
2021-05-20 5:57 ` [PATCH v8 6/6] target/i386: Advise CET bits in CPU/MSR feature words Yang Weijiang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).