linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Yang Weijiang <weijiang.yang@intel.com>
To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
	sean.j.christopherson@intel.com, pbonzini@redhat.com
Cc: mst@redhat.com, rkrcmar@redhat.com, jmattson@google.com,
	Yang Weijiang <weijiang.yang@intel.com>
Subject: [PATCH v6 5/8] KVM: VMX: Load Guest CET via VMCS when CET is enabled in Guest
Date: Thu, 25 Jul 2019 11:12:43 +0800	[thread overview]
Message-ID: <20190725031246.8296-6-weijiang.yang@intel.com> (raw)
In-Reply-To: <20190725031246.8296-1-weijiang.yang@intel.com>

"Load Guest CET state" bit controls whether Guest CET states
will be loaded at Guest entry. Before doing that, KVM needs
to check if CPU CET feature is enabled on host and available
to Guest.

Note: SHSTK and IBT features share one control MSR:
MSR_IA32_{U,S}_CET, which means it's difficult to hide
one feature from another in the case of SHSTK != IBT,
after discussed in community, it's agreed to allow Guest
control two features independently as it won't introduce
security hole.

Co-developed-by: Zhang Yi Z <yi.z.zhang@linux.intel.com>
Signed-off-by: Zhang Yi Z <yi.z.zhang@linux.intel.com>
Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
---
 arch/x86/kvm/vmx/vmx.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index ce5d1e45b7a5..fbf9c335cf7b 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -44,6 +44,7 @@
 #include <asm/spec-ctrl.h>
 #include <asm/virtext.h>
 #include <asm/vmx.h>
+#include <asm/cet.h>
 
 #include "capabilities.h"
 #include "cpuid.h"
@@ -2923,6 +2924,18 @@ int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
 		if (!nested_vmx_allowed(vcpu) || is_smm(vcpu))
 			return 1;
 	}
+	if (cpu_x86_cet_enabled() &&
+	    (guest_cpuid_has(vcpu, X86_FEATURE_SHSTK) ||
+	    guest_cpuid_has(vcpu, X86_FEATURE_IBT))) {
+		if (cr4 & X86_CR4_CET)
+			vmcs_set_bits(VM_ENTRY_CONTROLS,
+				      VM_ENTRY_LOAD_GUEST_CET_STATE);
+		else
+			vmcs_clear_bits(VM_ENTRY_CONTROLS,
+					VM_ENTRY_LOAD_GUEST_CET_STATE);
+	} else if (cr4 & X86_CR4_CET) {
+		return 1;
+	}
 
 	if (to_vmx(vcpu)->nested.vmxon && !nested_cr4_valid(vcpu, cr4))
 		return 1;
-- 
2.17.2


  parent reply	other threads:[~2019-07-25  3:11 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-25  3:12 [PATCH v6 0/8] Introduce support for Guest CET feature Yang Weijiang
2019-07-25  3:12 ` [PATCH v6 1/8] KVM: VMX: Define CET VMCS fields and control bits Yang Weijiang
2019-07-25  3:12 ` [PATCH v6 2/8] KVM: x86: Add a helper function for CPUID(0xD,n>=1) enumeration Yang Weijiang
2019-08-12 22:18   ` Sean Christopherson
2019-08-13  6:11     ` Yang Weijiang
2019-07-25  3:12 ` [PATCH v6 3/8] KVM: x86: Implement CET CPUID enumeration for Guest Yang Weijiang
2019-08-13  0:06   ` Sean Christopherson
2019-08-13  5:27     ` Yang Weijiang
2019-07-25  3:12 ` [PATCH v6 4/8] KVM: VMX: Pass through CET related MSRs to Guest Yang Weijiang
2019-08-12 23:53   ` Sean Christopherson
2019-08-13  5:49     ` Yang Weijiang
2019-07-25  3:12 ` Yang Weijiang [this message]
2019-08-12 23:56   ` [PATCH v6 5/8] KVM: VMX: Load Guest CET via VMCS when CET is enabled in Guest Sean Christopherson
2019-08-13  5:38     ` Yang Weijiang
2019-07-25  3:12 ` [PATCH v6 6/8] KVM: x86: Add CET bits setting in CR4 and XSS Yang Weijiang
2019-07-25  3:12 ` [PATCH v6 7/8] KVM: x86: Load Guest fpu state when accessing MSRs managed by XSAVES Yang Weijiang
2019-08-12 23:02   ` Sean Christopherson
2019-08-12 23:04     ` Sean Christopherson
2019-08-12 23:29     ` Sean Christopherson
2019-08-13  6:06       ` Yang Weijiang
2019-08-13  6:05     ` Yang Weijiang
2019-07-25  3:12 ` [PATCH v6 8/8] KVM: x86: Add user-space access interface for CET MSRs Yang Weijiang
2019-08-12 23:43   ` Sean Christopherson
2019-08-13  5:41     ` Yang Weijiang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190725031246.8296-6-weijiang.yang@intel.com \
    --to=weijiang.yang@intel.com \
    --cc=jmattson@google.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mst@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=rkrcmar@redhat.com \
    --cc=sean.j.christopherson@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).