From: Yang Weijiang <weijiang.yang@intel.com>
To: pbonzini@redhat.com, seanjc@google.com, jmattson@google.com,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: yu.c.zhang@linux.intel.com, Yang Weijiang <weijiang.yang@intel.com>
Subject: [PATCH v15 13/14] KVM: nVMX: Enable CET support for nested VMX
Date: Wed, 3 Feb 2021 19:34:20 +0800 [thread overview]
Message-ID: <20210203113421.5759-14-weijiang.yang@intel.com> (raw)
In-Reply-To: <20210203113421.5759-1-weijiang.yang@intel.com>
Add vmcs12 fields for all CET fields, pass-through CET MSRs to L2 when
possible, and enumerate the VMCS controls and CR4 bit as supported.
Co-developed-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
---
arch/x86/kvm/vmx/nested.c | 30 ++++++++++++++++++++++++++++--
arch/x86/kvm/vmx/vmcs12.c | 6 ++++++
arch/x86/kvm/vmx/vmcs12.h | 14 +++++++++++++-
arch/x86/kvm/vmx/vmx.c | 1 +
4 files changed, 48 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 3b405ebabb6e..9728efd529a1 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -638,6 +638,29 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
nested_vmx_disable_intercept_for_msr(msr_bitmap_l1, msr_bitmap_l0,
MSR_KERNEL_GS_BASE, MSR_TYPE_RW);
+ /* Pass CET MSRs to nested VM if L0 and L1 are set to pass-through. */
+ nested_vmx_cond_disable_intercept_for_msr(vcpu, MSR_IA32_U_CET,
+ msr_bitmap_l1, msr_bitmap_l0,
+ MSR_TYPE_RW);
+ nested_vmx_cond_disable_intercept_for_msr(vcpu, MSR_IA32_PL3_SSP,
+ msr_bitmap_l1, msr_bitmap_l0,
+ MSR_TYPE_RW);
+ nested_vmx_cond_disable_intercept_for_msr(vcpu, MSR_IA32_S_CET,
+ msr_bitmap_l1, msr_bitmap_l0,
+ MSR_TYPE_RW);
+ nested_vmx_cond_disable_intercept_for_msr(vcpu, MSR_IA32_PL0_SSP,
+ msr_bitmap_l1, msr_bitmap_l0,
+ MSR_TYPE_RW);
+ nested_vmx_cond_disable_intercept_for_msr(vcpu, MSR_IA32_PL1_SSP,
+ msr_bitmap_l1, msr_bitmap_l0,
+ MSR_TYPE_RW);
+ nested_vmx_cond_disable_intercept_for_msr(vcpu, MSR_IA32_PL2_SSP,
+ msr_bitmap_l1, msr_bitmap_l0,
+ MSR_TYPE_RW);
+ nested_vmx_cond_disable_intercept_for_msr(vcpu, MSR_IA32_INT_SSP_TAB,
+ msr_bitmap_l1, msr_bitmap_l0,
+ MSR_TYPE_RW);
+
/*
* Checking the L0->L1 bitmap is trying to verify two things:
*
@@ -6386,7 +6409,9 @@ void nested_vmx_setup_ctls_msrs(struct nested_vmx_msrs *msrs, u32 ept_caps)
VM_EXIT_HOST_ADDR_SPACE_SIZE |
#endif
VM_EXIT_LOAD_IA32_PAT | VM_EXIT_SAVE_IA32_PAT |
- VM_EXIT_CLEAR_BNDCFGS | VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
+ VM_EXIT_CLEAR_BNDCFGS | VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
+ VM_EXIT_LOAD_CET_STATE;
+
msrs->exit_ctls_high |=
VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR |
VM_EXIT_LOAD_IA32_EFER | VM_EXIT_SAVE_IA32_EFER |
@@ -6406,7 +6431,8 @@ void nested_vmx_setup_ctls_msrs(struct nested_vmx_msrs *msrs, u32 ept_caps)
VM_ENTRY_IA32E_MODE |
#endif
VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_BNDCFGS |
- VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
+ VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VM_ENTRY_LOAD_CET_STATE;
+
msrs->entry_ctls_high |=
(VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR | VM_ENTRY_LOAD_IA32_EFER);
diff --git a/arch/x86/kvm/vmx/vmcs12.c b/arch/x86/kvm/vmx/vmcs12.c
index c8e51c004f78..8fd8e0beecef 100644
--- a/arch/x86/kvm/vmx/vmcs12.c
+++ b/arch/x86/kvm/vmx/vmcs12.c
@@ -137,6 +137,9 @@ const unsigned short vmcs_field_to_offset_table[] = {
FIELD(GUEST_PENDING_DBG_EXCEPTIONS, guest_pending_dbg_exceptions),
FIELD(GUEST_SYSENTER_ESP, guest_sysenter_esp),
FIELD(GUEST_SYSENTER_EIP, guest_sysenter_eip),
+ FIELD(GUEST_S_CET, guest_s_cet),
+ FIELD(GUEST_SSP, guest_ssp),
+ FIELD(GUEST_INTR_SSP_TABLE, guest_ssp_tbl),
FIELD(HOST_CR0, host_cr0),
FIELD(HOST_CR3, host_cr3),
FIELD(HOST_CR4, host_cr4),
@@ -149,5 +152,8 @@ const unsigned short vmcs_field_to_offset_table[] = {
FIELD(HOST_IA32_SYSENTER_EIP, host_ia32_sysenter_eip),
FIELD(HOST_RSP, host_rsp),
FIELD(HOST_RIP, host_rip),
+ FIELD(HOST_S_CET, host_s_cet),
+ FIELD(HOST_SSP, host_ssp),
+ FIELD(HOST_INTR_SSP_TABLE, host_ssp_tbl),
};
const unsigned int nr_vmcs12_fields = ARRAY_SIZE(vmcs_field_to_offset_table);
diff --git a/arch/x86/kvm/vmx/vmcs12.h b/arch/x86/kvm/vmx/vmcs12.h
index 80232daf00ff..016896c9e701 100644
--- a/arch/x86/kvm/vmx/vmcs12.h
+++ b/arch/x86/kvm/vmx/vmcs12.h
@@ -115,7 +115,13 @@ struct __packed vmcs12 {
natural_width host_ia32_sysenter_eip;
natural_width host_rsp;
natural_width host_rip;
- natural_width paddingl[8]; /* room for future expansion */
+ natural_width host_s_cet;
+ natural_width host_ssp;
+ natural_width host_ssp_tbl;
+ natural_width guest_s_cet;
+ natural_width guest_ssp;
+ natural_width guest_ssp_tbl;
+ natural_width paddingl[2]; /* room for future expansion */
u32 pin_based_vm_exec_control;
u32 cpu_based_vm_exec_control;
u32 exception_bitmap;
@@ -295,6 +301,12 @@ static inline void vmx_check_vmcs12_offsets(void)
CHECK_OFFSET(host_ia32_sysenter_eip, 656);
CHECK_OFFSET(host_rsp, 664);
CHECK_OFFSET(host_rip, 672);
+ CHECK_OFFSET(host_s_cet, 680);
+ CHECK_OFFSET(host_ssp, 688);
+ CHECK_OFFSET(host_ssp_tbl, 696);
+ CHECK_OFFSET(guest_s_cet, 704);
+ CHECK_OFFSET(guest_ssp, 712);
+ CHECK_OFFSET(guest_ssp_tbl, 720);
CHECK_OFFSET(pin_based_vm_exec_control, 744);
CHECK_OFFSET(cpu_based_vm_exec_control, 748);
CHECK_OFFSET(exception_bitmap, 752);
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index b6657117191b..5856c5b81084 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -7257,6 +7257,7 @@ static void nested_vmx_cr_fixed1_bits_update(struct kvm_vcpu *vcpu)
cr4_fixed1_update(X86_CR4_PKE, ecx, feature_bit(PKU));
cr4_fixed1_update(X86_CR4_UMIP, ecx, feature_bit(UMIP));
cr4_fixed1_update(X86_CR4_LA57, ecx, feature_bit(LA57));
+ cr4_fixed1_update(X86_CR4_CET, ecx, feature_bit(SHSTK));
#undef cr4_fixed1_update
}
--
2.26.2
next prev parent reply other threads:[~2021-02-03 11:26 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-03 11:34 [PATCH v15 00/14] Introduce support for guest CET feature Yang Weijiang
2021-02-03 11:34 ` [PATCH v15 01/14] KVM: x86: Report XSS as an MSR to be saved if there are supported features Yang Weijiang
2021-02-03 11:34 ` [PATCH v15 02/14] KVM: x86: Refresh CPUID on writes to MSR_IA32_XSS Yang Weijiang
2021-02-03 11:34 ` [PATCH v15 03/14] KVM: x86: Load guest fpu state when accessing MSRs managed by XSAVES Yang Weijiang
2021-02-03 11:34 ` [PATCH v15 04/14] KVM: x86: Add #CP support in guest exception dispatch Yang Weijiang
2021-02-03 21:46 ` Sean Christopherson
2021-02-04 7:22 ` Yang Weijiang
2021-02-04 8:28 ` Paolo Bonzini
2021-02-04 8:24 ` Paolo Bonzini
2021-02-04 16:42 ` Sean Christopherson
2021-02-04 17:29 ` Paolo Bonzini
2021-02-03 11:34 ` [PATCH v15 05/14] KVM: VMX: Introduce CET VMCS fields and flags Yang Weijiang
2021-02-03 11:34 ` [PATCH v15 06/14] KVM: x86: Add fault checks for CR4.CET Yang Weijiang
2021-02-03 11:34 ` [PATCH v15 07/14] KVM: VMX: Emulate reads and writes to CET MSRs Yang Weijiang
2021-02-03 11:57 ` Paolo Bonzini
2021-02-03 12:50 ` Yang Weijiang
2022-05-18 15:55 ` John Allen
2022-05-18 16:16 ` Sean Christopherson
2022-05-19 8:49 ` Yang, Weijiang
2021-02-03 11:34 ` [PATCH v15 08/14] KVM: VMX: Add a synthetic MSR to allow userspace VMM to access GUEST_SSP Yang Weijiang
2021-02-03 11:34 ` [PATCH v15 09/14] KVM: x86: Report CET MSRs as to-be-saved if CET is supported Yang Weijiang
2021-02-03 11:34 ` [PATCH v15 10/14] KVM: x86: Enable CET virtualization for VMX and advertise CET to userspace Yang Weijiang
2021-02-03 11:34 ` [PATCH v15 11/14] KVM: VMX: Pass through CET MSRs to the guest when supported Yang Weijiang
2021-02-03 11:34 ` [PATCH v15 12/14] KVM: nVMX: Add helper to check the vmcs01 MSR bitmap for MSR pass-through Yang Weijiang
2021-02-03 11:34 ` Yang Weijiang [this message]
2021-02-03 11:34 ` [PATCH v15 14/14] KVM: x86: Save/Restore GUEST_SSP to/from SMRAM Yang Weijiang
2021-02-03 12:07 ` Paolo Bonzini
2021-02-03 12:59 ` Yang Weijiang
2021-02-03 12:40 ` [PATCH v15 00/14] Introduce support for guest CET feature Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210203113421.5759-14-weijiang.yang@intel.com \
--to=weijiang.yang@intel.com \
--cc=jmattson@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=yu.c.zhang@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).