From: Yang Weijiang <weijiang.yang@intel.com>
To: pbonzini@redhat.com, rkrcmar@redhat.com,
sean.j.christopherson@intel.com, jmattson@google.com,
linux-kernel@vger.kernel.org, kvm@vger.kernel.org,
mst@redhat.com, yu-cheng.yu@intel.com
Cc: Yang Weijiang <weijiang.yang@intel.com>
Subject: [PATCH v3 0/8] This patch-set is to enable Guest CET support
Date: Mon, 25 Feb 2019 21:27:08 +0800 [thread overview]
Message-ID: <20190225132716.6982-1-weijiang.yang@intel.com> (raw)
Control-flow Enforcement Technology (CET) provides protection against
return/jump-oriented programming (ROP) attacks. To make kvm Guest OS own
the capability, this patch-set is required. It enables CET related CPUID
report, xsaves/xrstors, vmx entry configuration etc. for Guest OS.
PATCH 1 : Define CET VMCS fields and bits.
PATCH 2/3 : Report CET feature support in CPUID.
PATCH 4 : Fix xsaves size calculation issue.
PATCH 5 : Pass through CET MSRs to Guest.
PATCH 6 : Set Guest CET state auto loading bit.
PATCH 7 : Enable CET xsaves bits support in XSS.
PATCH 8 : Add CET MSR user space access interface.
Changelog:
v3:
- Modified patches to make Guest CET independent to Host enabling.
- Added patch 8 to add user space access for Guest CET MSR access.
- Modified code comments and patch description to reflect changes.
v2:
- Re-ordered patch sequence, combined one patch.
- Added more description for CET related VMCS fields.
- Added Host CET capability check while enabling Guest CET loading bit.
- Added Host CET capability check while reporting Guest CPUID(EAX=7,
EXC=0).
- Modified code in reporting Guest CPUID(EAX=D,ECX>=1), make it clearer.
- Added Host and Guest XSS mask check while setting bits for Guest XSS.
Yang Weijiang (8):
KVM:VMX: Define CET VMCS fields and bits
KVM:CPUID: Define CET CPUID bits and CR4.CET master enable bit.
KVM:CPUID: Add CPUID support for Guest CET
KVM:CPUID: Fix xsaves area size calculation for CPUID.(EAX=0xD,ECX=1).
KVM:VMX: Pass through host CET related MSRs to Guest.
KVM:VMX: Load Guest CET via VMCS when CET is enabled in Guest
KVM:X86: Add XSS bit 11 and 12 support for CET xsaves/xrstors.
KVM:X86: Add user-space read/write interface for CET MSRs.
arch/x86/include/asm/kvm_host.h | 3 +-
arch/x86/include/asm/vmx.h | 8 ++++
arch/x86/kvm/cpuid.c | 67 ++++++++++++++++++++++++---------
arch/x86/kvm/vmx.c | 53 ++++++++++++++++++++++++--
arch/x86/kvm/x86.c | 46 ++++++++++++++++++++--
arch/x86/kvm/x86.h | 4 ++
6 files changed, 157 insertions(+), 24 deletions(-)
--
2.17.1
next reply other threads:[~2019-02-26 6:32 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-25 13:27 Yang Weijiang [this message]
2019-02-25 13:27 ` [PATCH v3 1/8] KVM:VMX: Define CET VMCS fields and bits Yang Weijiang
2019-02-26 19:31 ` Jim Mattson
2019-02-26 7:52 ` Yang Weijiang
2019-02-28 15:53 ` Sean Christopherson
2019-02-28 9:51 ` Yang Weijiang
2019-02-25 13:27 ` [PATCH v3 2/8] KVM:CPUID: Define CET CPUID bits and CR4.CET master enable bit Yang Weijiang
2019-02-26 19:48 ` Jim Mattson
2019-02-26 7:57 ` Yang Weijiang
2019-03-01 2:15 ` Xiaoyao Li
2019-02-28 16:04 ` Sean Christopherson
2019-02-28 8:10 ` Yang Weijiang
2019-02-25 13:27 ` [PATCH v3 3/8] KVM:CPUID: Add CPUID support for Guest CET Yang Weijiang
2019-02-28 15:59 ` Sean Christopherson
2019-02-28 8:28 ` Yang Weijiang
2019-03-01 14:53 ` Sean Christopherson
2019-03-03 9:36 ` Yang Weijiang
2019-03-04 18:28 ` Sean Christopherson
2019-03-04 12:17 ` Yang Weijiang
2019-03-04 18:47 ` Sean Christopherson
2019-03-04 10:01 ` Yang Weijiang
2019-03-04 18:54 ` Sean Christopherson
2019-03-04 10:11 ` Yang Weijiang
2019-03-08 11:32 ` Paolo Bonzini
2019-03-10 12:18 ` Yang Weijiang
2019-02-25 13:27 ` [PATCH v3 4/8] KVM:CPUID: Fix xsaves area size calculation for CPUID.(EAX=0xD,ECX=1) Yang Weijiang
2019-02-25 13:27 ` [PATCH v3 5/8] KVM:VMX: Pass through host CET related MSRs to Guest Yang Weijiang
2019-03-04 18:53 ` Sean Christopherson
2019-03-04 10:07 ` Yang Weijiang
2019-03-05 3:21 ` Sean Christopherson
2019-02-25 13:27 ` [PATCH v3 6/8] KVM:VMX: Load Guest CET via VMCS when CET is enabled in Guest Yang Weijiang
2019-02-28 16:17 ` Sean Christopherson
2019-02-28 8:38 ` Yang Weijiang
2019-03-01 14:58 ` Sean Christopherson
2019-03-03 12:26 ` Yang Weijiang
2019-03-04 18:43 ` Sean Christopherson
2019-03-04 9:56 ` Yang Weijiang
2019-03-05 3:12 ` Sean Christopherson
2019-03-04 12:36 ` Yang Weijiang
2019-03-08 16:28 ` Sean Christopherson
2019-03-08 16:36 ` Paolo Bonzini
2019-02-25 13:27 ` [PATCH v3 7/8] KVM:X86: Add XSS bit 11 and 12 support for CET xsaves/xrstors Yang Weijiang
2019-02-28 16:25 ` Sean Christopherson
2019-02-28 8:44 ` Yang Weijiang
2019-03-08 11:32 ` Paolo Bonzini
2019-03-10 12:20 ` Yang Weijiang
2019-03-10 13:35 ` Yang Weijiang
2019-03-11 15:32 ` Paolo Bonzini
2019-03-12 14:30 ` Yang Weijiang
2019-03-08 10:49 ` Paolo Bonzini
2019-03-11 1:29 ` Kang, Luwei
2019-02-25 13:27 ` [PATCH v3 8/8] KVM:X86: Add user-space read/write interface for CET MSRs Yang Weijiang
2019-02-28 16:32 ` Sean Christopherson
2019-02-28 9:41 ` Yang Weijiang
2019-03-08 17:30 ` Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190225132716.6982-1-weijiang.yang@intel.com \
--to=weijiang.yang@intel.com \
--cc=jmattson@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mst@redhat.com \
--cc=pbonzini@redhat.com \
--cc=rkrcmar@redhat.com \
--cc=sean.j.christopherson@intel.com \
--cc=yu-cheng.yu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).