From: Yang Weijiang <weijiang.yang@intel.com>
To: pbonzini@redhat.com, kvm@vger.kernel.org, mst@redhat.com,
rkrcmar@redhat.com, jmattson@google.com,
linux-kernel@vger.kernel.org, yu-cheng.yu@intel.com
Cc: Yang Weijiang <weijiang.yang@intel.com>
Subject: [RFC PATCH v4 0/8] This patch-set is to enable Guest CET support
Date: Mon, 18 Mar 2019 23:03:43 +0800 [thread overview]
Message-ID: <20190318150351.15550-1-weijiang.yang@intel.com> (raw)
Control-flow Enforcement Technology (CET) provides protection against
return/jump-oriented programming (ROP) attacks. To make kvm Guest OS own
the capability, this patch-set is required. It enables CET related CPUID
report, xsaves/xrstors, vmx entry configuration etc. for Guest OS.
PATCH 1 : Define CET VMCS fields and bits.
PATCH 2/3 : Report CET feature support in CPUID.
PATCH 4 : Fix xsaves size calculation issue.
PATCH 5 : Pass through CET MSRs to Guest.
PATCH 6 : Set Guest CET state auto loading bit.
PATCH 7 : Load Guest fpu state when accessing CET XSAVES managed MSRs.
PATCH 8 : Add CET MSR user space access interface.
Changelog:
v4:
- Add Sean's patch for loading Guest fpu state before access XSAVES
managed CET MSRs.
- Melt down CET bits setting into CPUID configuration patch.
- Add VMX interface to query Host XSS.
- Check Host and Guest XSS support bits before set Guest XSS.
- Make Guest SHSTK and IBT feature enabling independent.
- Do not report CET support to Guest when Host CET feature is
Disabled.
v3:
- Modified patches to make Guest CET independent to Host enabling.
- Added patch 8 to add user space access for Guest CET MSR access.
- Modified code comments and patch description to reflect changes.
v2:
- Re-ordered patch sequence, combined one patch.
- Added more description for CET related VMCS fields.
- Added Host CET capability check while enabling Guest CET loading bit.
- Added Host CET capability check while reporting Guest CPUID(EAX=7,
EXC=0).
- Modified code in reporting Guest CPUID(EAX=D,ECX>=1), make it clearer.
- Added Host and Guest XSS mask check while setting bits for Guest XSS.
Sean Christopherson (1):
KVM:x86: load guest fpu state when accessing MSRs managed by XSAVES
Yang Weijiang (7):
KVM:VMX: Define CET VMCS fields and bits
KVM:CPUID: Add CET CPUID support for Guest
KVM:CPUID: Fix xsaves area size calculation for CPUID.(EAX=0xD,ECX=1).
KVM:VMX: Pass through host CET related MSRs to Guest.
KVM:VMX: Load Guest CET via VMCS when CET is enabled in Guest
KVM:x86: Allow Guest to set supported bits in XSS
KVM:x86: Add user-space read/write interface for CET MSRs
arch/x86/include/asm/kvm_host.h | 5 +-
arch/x86/include/asm/msr-index.h | 2 +
arch/x86/include/asm/vmx.h | 8 +++
arch/x86/kvm/cpuid.c | 53 ++++++++++++++------
arch/x86/kvm/vmx.c | 86 ++++++++++++++++++++++++++++++--
arch/x86/kvm/x86.c | 32 +++++++++++-
arch/x86/kvm/x86.h | 4 ++
7 files changed, 167 insertions(+), 23 deletions(-)
--
2.17.1
next reply other threads:[~2019-03-19 8:12 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-18 15:03 Yang Weijiang [this message]
2019-03-18 15:03 ` [RFC PATCH v4 1/8] KVM:VMX: Define CET VMCS fields and bits Yang Weijiang
2019-04-02 19:57 ` Sean Christopherson
2019-03-18 15:03 ` [RFC PATCH v4 2/8] KVM:CPUID: Add CET CPUID support for Guest Yang Weijiang
2019-04-02 20:21 ` Sean Christopherson
2019-04-02 20:40 ` Sean Christopherson
2019-03-18 15:03 ` [RFC PATCH v4 3/8] KVM:CPUID: Fix xsaves area size calculation for CPUID.(EAX=0xD,ECX=1) Yang Weijiang
2019-04-02 20:27 ` Sean Christopherson
2019-03-18 15:03 ` [RFC PATCH v4 4/8] KVM:VMX: Pass through host CET related MSRs to Guest Yang Weijiang
2019-04-02 20:27 ` Sean Christopherson
2019-04-02 20:46 ` Yang Weijiang
2019-03-18 15:03 ` [RFC PATCH v4 5/8] KVM:VMX: Load Guest CET via VMCS when CET is enabled in Guest Yang Weijiang
2019-04-02 20:30 ` Sean Christopherson
2019-03-18 15:03 ` [RFC PATCH v4 6/8] KVM:x86: Allow Guest to set supported bits in XSS Yang Weijiang
2019-03-18 15:03 ` [RFC PATCH v4 7/8] KVM:x86: load guest fpu state when accessing MSRs managed by XSAVES Yang Weijiang
2019-04-02 20:39 ` Sean Christopherson
2019-03-18 15:03 ` [RFC PATCH v4 8/8] KVM:x86: Add user-space read/write interface for CET MSRs Yang Weijiang
2019-04-02 20:35 ` Sean Christopherson
2019-03-25 20:45 ` [RFC PATCH v4 0/8] This patch-set is to enable Guest CET support Yang Weijiang
2019-03-26 22:31 ` Sean Christopherson
2019-04-02 20:10 ` Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190318150351.15550-1-weijiang.yang@intel.com \
--to=weijiang.yang@intel.com \
--cc=jmattson@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mst@redhat.com \
--cc=pbonzini@redhat.com \
--cc=rkrcmar@redhat.com \
--cc=yu-cheng.yu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).