From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E35672C21D5; Tue, 9 Sep 2025 09:39:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410797; cv=none; b=dfQgFIfIlZwMrDwSXRwfHntZsCk8ZTsmRaJ35+mP8Of8QmHoKMorksFyhTM2YQnB5Nu70jAUahACfidvyxtzOdLupxfydUgi0mqVbUf4kYH8W8LPTwDjm8a8cSlHKPKO3ZaBi6iaw4XL2Voo3AwPr8blCYyDTG8P9l6iCRjpEqc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410797; c=relaxed/simple; bh=awSO2SajylR+9FfF5723lqDYN0HFNJlp3YMao7mQqgA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KrPff4nZvOaUtS3Qnf6wpQd/LbdobKZCc9rnfX7iaj0C9l408RXMmayFXH2WW8l+S4iaHNhx13KqSxf0WeLy+tufv75w8JPGfYF+EgZSQ/sljfI6kKKaTzwHbTeZNt/vZ6w+yE8WLIizauSxdLOrnmcOhcgYeZ4O16ufqZUFB6Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=RePqteug; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="RePqteug" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410796; x=1788946796; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=awSO2SajylR+9FfF5723lqDYN0HFNJlp3YMao7mQqgA=; b=RePqteugm3TFCjlgXAxJRc/FQcSwSLFyALlRtIBFRKkAwpvGOCLrDQI+ W4NNMO53ZWXXzJrZQwzb0GwPCPXDAt/tBpdNDp40kcNLmjBt6OFUxKgyl It5sw03vhC3/WgFaERQPyy728RLDdYBv0nHLbG0MDXpOp6lLQ1ULjoERL orSyN+pyGonJSFpEPHhGAopbACj3OKZG6CdeN0gGb7PaKyZGXF6yQV98l q7fvzgVOGfhnJ66BM2Nk7CIESAR0ZLwExRRk3F8IHiT++kVk5V/n1Pjma CroQLejqFabB8IOEC/PWzo9UHH2qM5gboegdeP+WPrYWoaV++1mVH5RZl A==; X-CSE-ConnectionGUID: PD41bYJpSSmJ55zXy4kryA== X-CSE-MsgGUID: 7ZLmsCBqTnOQvrrvBKG6ZA== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307178" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307178" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:54 -0700 X-CSE-ConnectionGUID: Zl1dDcnHTu2Eday039ucNQ== X-CSE-MsgGUID: g6ubcS0DQSGExMHxzchO2g== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207388" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:54 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 01/22] KVM: x86: Introduce KVM_{G,S}ET_ONE_REG uAPIs support Date: Tue, 9 Sep 2025 02:39:32 -0700 Message-ID: <20250909093953.202028-2-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Enable KVM_{G,S}ET_ONE_REG uAPIs so that userspace can access MSRs and other non-MSR registers through them. This is in preparation for allowing userspace to read/write the guest SSP register, which is needed for the upcoming CET virtualization support. Currently, two types of registers are supported: KVM_X86_REG_TYPE_MSR and KVM_X86_REG_TYPE_KVM. All MSRs are in the former type; the latter type is added for registers that lack existing KVM uAPIs to access them. The "KVM" in the name is intended to be vague to give KVM flexibility to include other potential registers. We considered some specific names, like "SYNTHETIC" and "SYNTHETIC_MSR" before, but both are confusing and may put KVM itself into a corner. Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Link: https://lore.kernel.org/all/20240219074733.122080-18-weijiang.yang@in= tel.com/ [1] Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Xiaoyao Li --- v14: - Rename the group type of guest SSP register to KVM_X86_REG_KVM - Add docs for id patterns for x86 in api.rst - Update commit message --- Documentation/virt/kvm/api.rst | 2 + arch/x86/include/uapi/asm/kvm.h | 26 +++++++++++ arch/x86/kvm/x86.c | 78 +++++++++++++++++++++++++++++++++ 3 files changed, 106 insertions(+) diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst index 6aa40ee05a4a..28fc12b46eeb 100644 --- a/Documentation/virt/kvm/api.rst +++ b/Documentation/virt/kvm/api.rst @@ -2908,6 +2908,8 @@ such as set vcpu counter or reset vcpu, and they have= the following id bit patte =20 0x9030 0000 0002 =20 +x86 MSR registers have the following id bit patterns:: + 0x2030 0002 =20 4.69 KVM_GET_ONE_REG -------------------- diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kv= m.h index 0f15d683817d..508b713ca52e 100644 --- a/arch/x86/include/uapi/asm/kvm.h +++ b/arch/x86/include/uapi/asm/kvm.h @@ -411,6 +411,32 @@ struct kvm_xcrs { __u64 padding[16]; }; =20 +#define KVM_X86_REG_TYPE_MSR 2 +#define KVM_X86_REG_TYPE_KVM 3 + +#define KVM_X86_KVM_REG_SIZE(reg) \ +({ \ + reg =3D=3D KVM_REG_GUEST_SSP ? KVM_REG_SIZE_U64 : 0; \ +}) + +#define KVM_X86_REG_TYPE_SIZE(type, reg) \ +({ \ + __u64 type_size =3D (__u64)type << 32; \ + \ + type_size |=3D type =3D=3D KVM_X86_REG_TYPE_MSR ? KVM_REG_SIZE_U64 : \ + type =3D=3D KVM_X86_REG_TYPE_KVM ? KVM_X86_KVM_REG_SIZE(reg) : \ + 0; \ + type_size; \ +}) + +#define KVM_X86_REG_ENCODE(type, index) \ + (KVM_REG_X86 | KVM_X86_REG_TYPE_SIZE(type, index) | index) + +#define KVM_X86_REG_MSR(index) \ + KVM_X86_REG_ENCODE(KVM_X86_REG_TYPE_MSR, index) +#define KVM_X86_REG_KVM(index) \ + KVM_X86_REG_ENCODE(KVM_X86_REG_TYPE_KVM, index) + #define KVM_SYNC_X86_REGS (1UL << 0) #define KVM_SYNC_X86_SREGS (1UL << 1) #define KVM_SYNC_X86_EVENTS (1UL << 2) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 7ba2cdfdac44..f32d3edfc7b1 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -2254,6 +2254,31 @@ static int do_set_msr(struct kvm_vcpu *vcpu, unsigne= d index, u64 *data) return kvm_set_msr_ignored_check(vcpu, index, *data, true); } =20 +static int kvm_get_one_msr(struct kvm_vcpu *vcpu, u32 msr, u64 __user *val= ue) +{ + u64 val; + int r; + + r =3D do_get_msr(vcpu, msr, &val); + if (r) + return r; + + if (put_user(val, value)) + return -EFAULT; + + return 0; +} + +static int kvm_set_one_msr(struct kvm_vcpu *vcpu, u32 msr, u64 __user *val= ue) +{ + u64 val; + + if (get_user(val, value)) + return -EFAULT; + + return do_set_msr(vcpu, msr, &val); +} + #ifdef CONFIG_X86_64 struct pvclock_clock { int vclock_mode; @@ -4737,6 +4762,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, lon= g ext) case KVM_CAP_IRQFD_RESAMPLE: case KVM_CAP_MEMORY_FAULT_INFO: case KVM_CAP_X86_GUEST_MODE: + case KVM_CAP_ONE_REG: r =3D 1; break; case KVM_CAP_PRE_FAULT_MEMORY: @@ -5915,6 +5941,20 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu= *vcpu, } } =20 +struct kvm_x86_reg_id { + __u32 index; + __u8 type; + __u8 rsvd1; + __u8 rsvd2:4; + __u8 size:4; + __u8 x86; +}; + +static int kvm_translate_kvm_reg(struct kvm_x86_reg_id *reg) +{ + return -EINVAL; +} + long kvm_arch_vcpu_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg) { @@ -6031,6 +6071,44 @@ long kvm_arch_vcpu_ioctl(struct file *filp, srcu_read_unlock(&vcpu->kvm->srcu, idx); break; } + case KVM_GET_ONE_REG: + case KVM_SET_ONE_REG: { + struct kvm_x86_reg_id *id; + struct kvm_one_reg reg; + u64 __user *value; + + r =3D -EFAULT; + if (copy_from_user(®, argp, sizeof(reg))) + break; + + r =3D -EINVAL; + if ((reg.id & KVM_REG_ARCH_MASK) !=3D KVM_REG_X86) + break; + + id =3D (struct kvm_x86_reg_id *)®.id; + if (id->rsvd1 || id->rsvd2) + break; + + if (id->type =3D=3D KVM_X86_REG_TYPE_KVM) { + r =3D kvm_translate_kvm_reg(id); + if (r) + break; + } + + r =3D -EINVAL; + if (id->type !=3D KVM_X86_REG_TYPE_MSR) + break; + + if ((reg.id & KVM_REG_SIZE_MASK) !=3D KVM_REG_SIZE_U64) + break; + + value =3D u64_to_user_ptr(reg.addr); + if (ioctl =3D=3D KVM_GET_ONE_REG) + r =3D kvm_get_one_msr(vcpu, id->index, value); + else + r =3D kvm_set_one_msr(vcpu, id->index, value); + break; + } case KVM_TPR_ACCESS_REPORTING: { struct kvm_tpr_access_ctl tac; =20 --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0AB3E2D063C; Tue, 9 Sep 2025 09:39:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410798; cv=none; b=mQ5QWu2CtOmuUAu0kcmzGAp6vvlMWJLtCMKFlcn8288R7BeB9ADxFySip7q79jF2yYjJ/cQwk0wqoxel8E4pyzJ+yro15QJqD56uVTKV1v3+vcDsWn5fB5qonew6T8zY0RwR5840pj+SuO/yqLHDQLNpQ4axUH5O2scNjLMZujg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410798; c=relaxed/simple; bh=Fj8v4Hih6hXxJMbSs0FaWO11xw9VDfkLb23OVwiQtmg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pFaX4o+IemmHmto2ewz5wGI6HKy2+T94vLBT+i0fiCajr9dhb2emjfmbDWqyWgB9EYa4zhWfCDc1wCIDHxOxqa5Z2vqai20kkvTOpUto4S4EX2qOiVMa68vevtqvEO4u2MZIqQF3gW3aZLAojk7+mge/Vebq1bT/KjV4g+3UoDQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=Z2FmErpi; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="Z2FmErpi" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410797; x=1788946797; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Fj8v4Hih6hXxJMbSs0FaWO11xw9VDfkLb23OVwiQtmg=; b=Z2FmErpi2H1jc3B33QVvaDsz2gGegYp7ZzNl/OvUrW80/no4dRnGZd5j OjUsMAdL1Ul2jvkOTIco2xZ3BzFGvV3v29gs3/1RuJma7lsIpk1eXkpxD je6CdJALPbq1XNE2rciPEshWnPCFVwyFpVFBa/AkYkIHI55NLC1zC8qHl sRxLLbzO/brqobonPYXETHK+Pa6XLg/LF3cIhu+6mMQQZ4+1E7zctf9PW OsVCO7JZTacbngB0wiVOLxystA+UlGWcOTRFkDOEf6UOz27vIRmAi978U 8LG/9PBhy0z74KjCYz01jlfbgGDGdrR1thFXYDDzrkZE9eOIK1YoaBMdC Q==; X-CSE-ConnectionGUID: kNneRjUUStGk93vjbFAXYw== X-CSE-MsgGUID: 7x0GRDreR2mhYHOYA8V9MQ== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307185" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307185" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:54 -0700 X-CSE-ConnectionGUID: ltLyn+j9RC26luHz5KoPAA== X-CSE-MsgGUID: vZmtrfTBSrCx4pierXEUIQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207391" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:54 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 02/22] KVM: x86: Report XSS as to-be-saved if there are supported features Date: Tue, 9 Sep 2025 02:39:33 -0700 Message-ID: <20250909093953.202028-3-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Sean Christopherson Add MSR_IA32_XSS to list of MSRs reported to userspace if supported_xss is non-zero, i.e. KVM supports at least one XSS based feature. Before enabling CET virtualization series, guest IA32_MSR_XSS is guaranteed to be 0, i.e., XSAVES/XRSTORS is executed in non-root mode with XSS =3D=3D 0, which equals to the effect of XSAVE/XRSTOR. Signed-off-by: Sean Christopherson Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Reviewed-by: Xiaoyao Li Signed-off-by: Chao Gao Reviewed-by: Binbin Wu --- arch/x86/kvm/x86.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index f32d3edfc7b1..47b60f275fd7 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -335,7 +335,7 @@ static const u32 msrs_to_save_base[] =3D { MSR_IA32_RTIT_ADDR3_A, MSR_IA32_RTIT_ADDR3_B, MSR_IA32_UMWAIT_CONTROL, =20 - MSR_IA32_XFD, MSR_IA32_XFD_ERR, + MSR_IA32_XFD, MSR_IA32_XFD_ERR, MSR_IA32_XSS, }; =20 static const u32 msrs_to_save_pmu[] =3D { @@ -7470,6 +7470,10 @@ static void kvm_probe_msr_to_save(u32 msr_index) if (!(kvm_get_arch_capabilities() & ARCH_CAP_TSX_CTRL_MSR)) return; break; + case MSR_IA32_XSS: + if (!kvm_caps.supported_xss) + return; + break; default: break; } --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EBCB824111D; Tue, 9 Sep 2025 09:39:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410799; cv=none; b=VelkHAF0wP7CqiD73bqf36DCerTWWUhggWLNfmTDKFbcmufNnFtnPuCwhH6+lAUA+L7vxCyIk3i1jKESvxTXh3Wl5m6rFDhw81MC91otvZCjfEzL8gX6vpHrv/w7CasLwxkfizSDku/Dt5yjfD6x2UlFz4zCdr3timdX7mk7t2Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410799; c=relaxed/simple; bh=1WcXSx9dlRZCXMeRBkVIh2BDcgRzm0bg1BYvgxIT0VQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nFXTMd5ZekELlmqJbRsGM3HdzfQd8fvHYEh/VJuViPURlN/L9w3e4Qv2Rv4I1m8H1Qs49OylmW+gwnzOdVh9FaMn4Nnx9U0SIks/C0dscBQshShJV49DH6COuaAFWUsQxBE4gzQO9cs5mymn17KwDFI0Jd9Obtmjz6IUeIHyPX0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=UjBGN1Lw; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="UjBGN1Lw" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410798; x=1788946798; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=1WcXSx9dlRZCXMeRBkVIh2BDcgRzm0bg1BYvgxIT0VQ=; b=UjBGN1Lw+FUAOecoCP5YPrvgBnLZGjECcX6PW4SofAkdYw+qHsahb/zm jWcHjv03zEBqn+APLNQBqtNPn+wezyay429/4hbMfnTK5JZVanO0wZL7f Ciqq3fZqyDFfWqeCb48Sl0AeBwHZywwx6o/GHZ2heIc/JJ7YsgzpIVCZh r6iPypn1bW5GmvzOxhvcLZLdhpjllU+OIjBj57/CvvHP/dcAivmXBw78j m+0sTKog/uSNAyg9qOiDmwgn9wxzgCBbFcarGKuTyxgYyYgLdv25cjaSG i8NG+LlYJnHufM82/JEw0epg+gQD0hwpFOZL12cOUQX/v/MO5MJrE8VEn A==; X-CSE-ConnectionGUID: fbkSHPy7QzmAzyZSFQmBbA== X-CSE-MsgGUID: /ntMDBxaSaeCWDQ7S51zNg== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307193" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307193" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:54 -0700 X-CSE-ConnectionGUID: Xv/q8nkqScygUoUOKZeYxg== X-CSE-MsgGUID: eAHu2pMERV2LgxTEIgKZdw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207394" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:54 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 03/22] KVM: x86: Check XSS validity against guest CPUIDs Date: Tue, 9 Sep 2025 02:39:34 -0700 Message-ID: <20250909093953.202028-4-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Maintain per-guest valid XSS bits and check XSS validity against them rather than against KVM capabilities. This is to prevent bits that are supported by KVM but not supported for a guest from being set. Opportunistically return KVM_MSR_RET_UNSUPPORTED on IA32_XSS MSR accesses if guest CPUID doesn't enumerate X86_FEATURE_XSAVES. Since KVM_MSR_RET_UNSUPPORTED takes care of host_initiated cases, drop the host_initiated check. Signed-off-by: Chao Gao Reviewed-by: Xiaoyao Li --- v14 - new, introduce guest_supported_xss in a separate patch (Xiaoyao) --- arch/x86/include/asm/kvm_host.h | 3 ++- arch/x86/kvm/cpuid.c | 12 ++++++++++++ arch/x86/kvm/x86.c | 7 +++---- 3 files changed, 17 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_hos= t.h index 0d3cc0fc27af..b2983c830247 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -815,7 +815,6 @@ struct kvm_vcpu_arch { bool at_instruction_boundary; bool tpr_access_reporting; bool xfd_no_write_intercept; - u64 ia32_xss; u64 microcode_version; u64 arch_capabilities; u64 perf_capabilities; @@ -876,6 +875,8 @@ struct kvm_vcpu_arch { =20 u64 xcr0; u64 guest_supported_xcr0; + u64 ia32_xss; + u64 guest_supported_xss; =20 struct kvm_pio_request pio; void *pio_data; diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c index ad6cadf09930..46cf616663e6 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -263,6 +263,17 @@ static u64 cpuid_get_supported_xcr0(struct kvm_vcpu *v= cpu) return (best->eax | ((u64)best->edx << 32)) & kvm_caps.supported_xcr0; } =20 +static u64 cpuid_get_supported_xss(struct kvm_vcpu *vcpu) +{ + struct kvm_cpuid_entry2 *best; + + best =3D kvm_find_cpuid_entry_index(vcpu, 0xd, 1); + if (!best) + return 0; + + return (best->ecx | ((u64)best->edx << 32)) & kvm_caps.supported_xss; +} + static __always_inline void kvm_update_feature_runtime(struct kvm_vcpu *vc= pu, struct kvm_cpuid_entry2 *entry, unsigned int x86_feature, @@ -424,6 +435,7 @@ void kvm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu) } =20 vcpu->arch.guest_supported_xcr0 =3D cpuid_get_supported_xcr0(vcpu); + vcpu->arch.guest_supported_xss =3D cpuid_get_supported_xss(vcpu); =20 vcpu->arch.pv_cpuid.features =3D kvm_apply_cpuid_pv_features_quirk(vcpu); =20 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 47b60f275fd7..6c167117018c 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -4011,15 +4011,14 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struc= t msr_data *msr_info) } break; case MSR_IA32_XSS: - if (!msr_info->host_initiated && - !guest_cpuid_has(vcpu, X86_FEATURE_XSAVES)) - return 1; + if (!guest_cpuid_has(vcpu, X86_FEATURE_XSAVES)) + return KVM_MSR_RET_UNSUPPORTED; /* * KVM supports exposing PT to the guest, but does not support * IA32_XSS[bit 8]. Guests have to use RDMSR/WRMSR rather than * XSAVES/XRSTORS to save/restore PT MSRs. */ - if (data & ~kvm_caps.supported_xss) + if (data & ~vcpu->arch.guest_supported_xss) return 1; vcpu->arch.ia32_xss =3D data; vcpu->arch.cpuid_dynamic_bits_dirty =3D true; --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EBD2D2D0C76; Tue, 9 Sep 2025 09:39:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410799; cv=none; b=SZYndoQBGugyxC9/uab22nA7PoLcUBqaaby1CVBYtnYHVITYAAMhbs0sdZCra7Br8LYpYLUQbPheTDsBBWu30UbE783PwEoKplHV+9sdQcYYuHP9jeg+LparbEaGRXKUWrAmd69Qd/De+xDxYu6bjxt/HhaIhrgwlYUElMxvKDk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410799; c=relaxed/simple; bh=TAJjXB9Dhwg8HbkLhFSaXGAsICn7WJdki2ovSAWmjBs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VgJ6PHXCktsTK648bsrYq/XZ6ZeEf+Lko8AV2jBns0udu0vHd8fRm2TGFntPEp8rAwR1Lav3bNrYzSflMnXoQaATY8C/ZBjIZMcIGIrNzvF4VERtsh7OPy6hZtkp5QvTJVKOkNzXcZmuXo5K6ntfGwaCW1wtak+Ov3BoC8TTSis= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=Q1N6Ap3b; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="Q1N6Ap3b" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410798; x=1788946798; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=TAJjXB9Dhwg8HbkLhFSaXGAsICn7WJdki2ovSAWmjBs=; b=Q1N6Ap3b6g4ihJ/iSYMEp0ypRU81g8FGfgmbq+VlycAnkMqCU+toh+y4 rheKJylNHYiF/OKKWe4HqN6OUw0lrjJMVa4YHbrTThMDdMrVHVdSoR4qg LJRPx+CxysRS17j9Q6IS/erMf9IlZ8gi8zwbKbo5/xZmLua43bwIlMyVR 6bviI3NEy3PPm53h74VnsxIbFgT6nZHJoBqJVTnIi0RcD9LG/cbDLl7qJ FdsKfrqjVnyGInclfxWmGyJJQbLuSuGGVWxEZj1ge5Y1l/tX/rorj06QS 1uZl9ZVYxas7VXpTe8YEuizFtQ4onK+oYe4XEFXVFSixcc2HbXQ8F4ehB w==; X-CSE-ConnectionGUID: Zdz4iMvwTGGydrBOal/J6A== X-CSE-MsgGUID: 0NBx3CsBTUGDxEdkKa5mag== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307202" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307202" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:54 -0700 X-CSE-ConnectionGUID: Ro8f3RfdRkGXa7hzlse4eg== X-CSE-MsgGUID: Hj4gRW8PQO+Uxaa+MiRLxw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207397" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:54 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 04/22] KVM: x86: Refresh CPUID on write to guest MSR_IA32_XSS Date: Tue, 9 Sep 2025 02:39:35 -0700 Message-ID: <20250909093953.202028-5-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Update CPUID.(EAX=3D0DH,ECX=3D1).EBX to reflect current required xstate size due to XSS MSR modification. CPUID(EAX=3D0DH,ECX=3D1).EBX reports the required storage size of all enabl= ed xstate features in (XCR0 | IA32_XSS). The CPUID value can be used by guest before allocate sufficient xsave buffer. Note, KVM does not yet support any XSS based features, i.e. supported_xss is guaranteed to be zero at this time. Opportunistically skip CPUID updates if XSS value doesn't change. Suggested-by: Sean Christopherson Co-developed-by: Zhang Yi Z Signed-off-by: Zhang Yi Z Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li --- arch/x86/kvm/cpuid.c | 3 ++- arch/x86/kvm/x86.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c index 46cf616663e6..b5f87254ced7 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -316,7 +316,8 @@ static void kvm_update_cpuid_runtime(struct kvm_vcpu *v= cpu) best =3D kvm_find_cpuid_entry_index(vcpu, 0xD, 1); if (best && (cpuid_entry_has(best, X86_FEATURE_XSAVES) || cpuid_entry_has(best, X86_FEATURE_XSAVEC))) - best->ebx =3D xstate_required_size(vcpu->arch.xcr0, true); + best->ebx =3D xstate_required_size(vcpu->arch.xcr0 | + vcpu->arch.ia32_xss, true); } =20 static bool kvm_cpuid_has_hyperv(struct kvm_vcpu *vcpu) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 6c167117018c..bbae3bf405c7 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -4020,6 +4020,8 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct = msr_data *msr_info) */ if (data & ~vcpu->arch.guest_supported_xss) return 1; + if (vcpu->arch.ia32_xss =3D=3D data) + break; vcpu->arch.ia32_xss =3D data; vcpu->arch.cpuid_dynamic_bits_dirty =3D true; break; --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C777D2D192B; Tue, 9 Sep 2025 09:39:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410800; cv=none; b=IhFmOX/29RPZmUOLodw1P0toDnwUR/mcebwNHg9kerlvuMJNwfzqImh+k38MVIW2Kap+AvjSA69ljwxsUu2/wmfbmz2mue8Oa02WhgCU+N4BhkCl4jsS+8wPo9xZpJLVAAvvj1pE/FMO0sDjrRMKlF0p+7zLqTz8v9lQ0I9UVdQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410800; c=relaxed/simple; bh=Ox67ByAFpKb6tGyXo5JfoZTtunEMofk8Z5WohsiFwBc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ulVewnNGGtDllusRHyvPiKa2e/4TZPutUeUnslq73Be/gl5L0smlzPVhg3gonmNBs+GmSjkYSy/vsRFK7yzlyWuhTOLimyK3KVutgfpztldg69DisMRma1dZJx09YAunCb1CizO37BZnmzVxtIY5Wy2cXb62yxHHRVRiAvqrXhc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=h1whkgLP; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="h1whkgLP" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410799; x=1788946799; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Ox67ByAFpKb6tGyXo5JfoZTtunEMofk8Z5WohsiFwBc=; b=h1whkgLPyhyEhT7aMY5/fjX4YJi51tMYfesp7e69rfxv+IOA4VX/aDxh WGfFm2tnB277Jr4TBP1q9i+cK6FfNZwT/PajrE2IZTNScCShABvhOkXoA wIPwEKAbfVZRLHq+Bsjp0fqUZNKniaO/xIRt47HqLXCRvg8SWWEOKcHUM LLwjUNABrPfT+GszwGTYshCjbCvj1KELsUeuSKdANkO3KniHWzTs5kO77 u//rTyPXlZt6dUVjN4qCJUU957Co/NVA7OLUOZhaa0yjw0dVreMXbP4CE FCd+SslWlhUu9IpP1Qwq5pFOzZwS7Kn8Ua8BBNyy22Bl743e41VmtN/4k Q==; X-CSE-ConnectionGUID: CuFpbs5iSRenbImRdKMOZg== X-CSE-MsgGUID: Jh6sa5yORcGbXg3wDDIFVw== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307211" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307211" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:55 -0700 X-CSE-ConnectionGUID: IJKSGeycTKW9egQ26ECDHg== X-CSE-MsgGUID: ZfB+tr0xSja2kOcOlHqZDQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207400" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:55 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 05/22] KVM: x86: Initialize kvm_caps.supported_xss Date: Tue, 9 Sep 2025 02:39:36 -0700 Message-ID: <20250909093953.202028-6-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Set original kvm_caps.supported_xss to (host_xss & KVM_SUPPORTED_XSS) if XSAVES is supported. host_xss contains the host supported xstate feature bits for thread FPU context switch, KVM_SUPPORTED_XSS includes all KVM enabled XSS feature bits, the resulting value represents the supervisor xstates that are available to guest and are backed by host FPU framework for swapping {guest,host} XSAVE-managed registers/MSRs. Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Reviewed-by: Xiaoyao Li Signed-off-by: Chao Gao --- arch/x86/kvm/x86.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index bbae3bf405c7..c15e8c00dc7d 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -220,6 +220,8 @@ static struct kvm_user_return_msrs __percpu *user_retur= n_msrs; | XFEATURE_MASK_BNDCSR | XFEATURE_MASK_AVX512 \ | XFEATURE_MASK_PKRU | XFEATURE_MASK_XTILE) =20 +#define KVM_SUPPORTED_XSS 0 + bool __read_mostly allow_smaller_maxphyaddr =3D 0; EXPORT_SYMBOL_GPL(allow_smaller_maxphyaddr); =20 @@ -9789,14 +9791,17 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *op= s) kvm_host.xcr0 =3D xgetbv(XCR_XFEATURE_ENABLED_MASK); kvm_caps.supported_xcr0 =3D kvm_host.xcr0 & KVM_SUPPORTED_XCR0; } + + if (boot_cpu_has(X86_FEATURE_XSAVES)) { + rdmsrq(MSR_IA32_XSS, kvm_host.xss); + kvm_caps.supported_xss =3D kvm_host.xss & KVM_SUPPORTED_XSS; + } + kvm_caps.supported_quirks =3D KVM_X86_VALID_QUIRKS; kvm_caps.inapplicable_quirks =3D KVM_X86_CONDITIONAL_QUIRKS; =20 rdmsrq_safe(MSR_EFER, &kvm_host.efer); =20 - if (boot_cpu_has(X86_FEATURE_XSAVES)) - rdmsrq(MSR_IA32_XSS, kvm_host.xss); - kvm_init_pmu_capability(ops->pmu_ops); =20 if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC0022D2496; Tue, 9 Sep 2025 09:39:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410802; cv=none; b=suVGBXqcW500p7wjDFPiyKUne7i1vq92PMhdIOhQfSwX/U7swt3P9OPeL3+CeUifNuHgkn/T/kQonKW7483WXECtLtX7c3dPLVJQnlxQhDw2i9L7rCz8OAfMzf7kzk9hhs7T9kOY/FicagrDZ07mm8bpvlTlj26XDlYNF7UuhWY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410802; c=relaxed/simple; bh=8pLjPioMN6KH/wXQkjjfphL22gwbwTJnC2YBCe5LjCA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=O7jiP0guPZC+B8jCLAKOZKsFZpUSPEKrgaNOkk+LiL6zplm6jUbqeypAwx9nTkK85LWq9eU2K4wosuNtMNOiVZOBe+UWkd/M1rh91JNzfNThkxycftDWKxHLRG+umSs+lixGb1L57pbYzuU6MLOZrAqht7dljwZnLSXGO/sv+TY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=XU4AwdMJ; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="XU4AwdMJ" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410800; x=1788946800; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=8pLjPioMN6KH/wXQkjjfphL22gwbwTJnC2YBCe5LjCA=; b=XU4AwdMJPIxZwAZnKnqKzsc8siKsMWDlXCMYGhA+GyQy1s8XjqMrUKM8 P0vZ6EStHiz4I+nzlGI/XfaFWCm07VCbHxrqAlqS8woq8FQ1u1ZFyiXwB XqqsRzW3t/rB5y0YJlorA4b3h5Ep613e+H2YVgp8tFYdtQBjjpxsXEZZQ muuKqnmtT0W1Ovd1fQiaiv0BsfEmv3yxgJilHFbXmMWasw7Fz0VDuvaAw svDFDDXoXIHusv+n+Bvg72ZX5IkAMaV4Rck3FuQDTuOLS2lEQxsE3dJZB 8n5vIBedQ5wLY7SmsyDHmldC66toa0zCX2yh4mmuXZft+MUQ71OkhGMVM A==; X-CSE-ConnectionGUID: HKxDQvOeRBefTB0dn8005Q== X-CSE-MsgGUID: I8nZ+cm1R7mRFwmDioh+tg== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307222" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307222" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:55 -0700 X-CSE-ConnectionGUID: K+2Gp9GeS6O+KqzF+emYIw== X-CSE-MsgGUID: Aius937KS9ujdgZ7LuAdFw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207403" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:55 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 06/22] KVM: x86: Load guest FPU state when access XSAVE-managed MSRs Date: Tue, 9 Sep 2025 02:39:37 -0700 Message-ID: <20250909093953.202028-7-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Sean Christopherson Load the guest's FPU state if userspace is accessing MSRs whose values are managed by XSAVES. Introduce two helpers, kvm_{get,set}_xstate_msr(), to facilitate access to such kind of MSRs. If MSRs supported in kvm_caps.supported_xss are passed through to guest, the guest MSRs are swapped with host's before vCPU exits to userspace and after it reenters kernel before next VM-entry. Because the modified code is also used for the KVM_GET_MSRS device ioctl(), explicitly check @vcpu is non-null before attempting to load guest state. The XSAVE-managed MSRs cannot be retrieved via the device ioctl() without loading guest FPU state (which doesn't exist). Note that guest_cpuid_has() is not queried as host userspace is allowed to access MSRs that have not been exposed to the guest, e.g. it might do KVM_SET_MSRS prior to KVM_SET_CPUID2. The two helpers are put here in order to manifest accessing xsave-managed MSRs requires special check and handling to guarantee the correctness of read/write to the MSRs. Signed-off-by: Sean Christopherson Co-developed-by: Yang Weijiang Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao --- v14: - s/rdmsrl/rdmsrq, s/wrmsrl/wrmsrq (Xin) - return true in is_xstate_managed_msr() for MSR_IA32_S_CET --- arch/x86/kvm/x86.c | 36 +++++++++++++++++++++++++++++++++++- arch/x86/kvm/x86.h | 24 ++++++++++++++++++++++++ 2 files changed, 59 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index c15e8c00dc7d..7c0a07be6b64 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -136,6 +136,9 @@ static int __set_sregs2(struct kvm_vcpu *vcpu, struct k= vm_sregs2 *sregs2); static void __get_sregs2(struct kvm_vcpu *vcpu, struct kvm_sregs2 *sregs2); =20 static DEFINE_MUTEX(vendor_module_lock); +static void kvm_load_guest_fpu(struct kvm_vcpu *vcpu); +static void kvm_put_guest_fpu(struct kvm_vcpu *vcpu); + struct kvm_x86_ops kvm_x86_ops __read_mostly; =20 #define KVM_X86_OP(func) \ @@ -4566,6 +4569,22 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct= msr_data *msr_info) } EXPORT_SYMBOL_GPL(kvm_get_msr_common); =20 +/* + * Returns true if the MSR in question is managed via XSTATE, i.e. is con= text + * switched with the rest of guest FPU state. + */ +static bool is_xstate_managed_msr(u32 index) +{ + switch (index) { + case MSR_IA32_S_CET: + case MSR_IA32_U_CET: + case MSR_IA32_PL0_SSP ... MSR_IA32_PL3_SSP: + return true; + default: + return false; + } +} + /* * Read or write a bunch of msrs. All parameters are kernel addresses. * @@ -4576,11 +4595,26 @@ static int __msr_io(struct kvm_vcpu *vcpu, struct k= vm_msrs *msrs, int (*do_msr)(struct kvm_vcpu *vcpu, unsigned index, u64 *data)) { + bool fpu_loaded =3D false; int i; =20 - for (i =3D 0; i < msrs->nmsrs; ++i) + for (i =3D 0; i < msrs->nmsrs; ++i) { + /* + * If userspace is accessing one or more XSTATE-managed MSRs, + * temporarily load the guest's FPU state so that the guest's + * MSR value(s) is resident in hardware, i.e. so that KVM can + * get/set the MSR via RDMSR/WRMSR. + */ + if (vcpu && !fpu_loaded && kvm_caps.supported_xss && + is_xstate_managed_msr(entries[i].index)) { + kvm_load_guest_fpu(vcpu); + fpu_loaded =3D true; + } if (do_msr(vcpu, entries[i].index, &entries[i].data)) break; + } + if (fpu_loaded) + kvm_put_guest_fpu(vcpu); =20 return i; } diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h index eb3088684e8a..34afe43579bb 100644 --- a/arch/x86/kvm/x86.h +++ b/arch/x86/kvm/x86.h @@ -701,4 +701,28 @@ int ____kvm_emulate_hypercall(struct kvm_vcpu *vcpu, i= nt cpl, =20 int kvm_emulate_hypercall(struct kvm_vcpu *vcpu); =20 +/* + * Lock and/or reload guest FPU and access xstate MSRs. For accesses initi= ated + * by host, guest FPU is loaded in __msr_io(). For accesses initiated by g= uest, + * guest FPU should have been loaded already. + */ + +static inline void kvm_get_xstate_msr(struct kvm_vcpu *vcpu, + struct msr_data *msr_info) +{ + KVM_BUG_ON(!vcpu->arch.guest_fpu.fpstate->in_use, vcpu->kvm); + kvm_fpu_get(); + rdmsrq(msr_info->index, msr_info->data); + kvm_fpu_put(); +} + +static inline void kvm_set_xstate_msr(struct kvm_vcpu *vcpu, + struct msr_data *msr_info) +{ + KVM_BUG_ON(!vcpu->arch.guest_fpu.fpstate->in_use, vcpu->kvm); + kvm_fpu_get(); + wrmsrq(msr_info->index, msr_info->data); + kvm_fpu_put(); +} + #endif --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC2B32D2497; Tue, 9 Sep 2025 09:39:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410801; cv=none; b=cjoKfriD+eTyteLg4mDh29uxMfFkamsvbMXuS6W66rJQ9s9eMwTI8b2V2c3lyo8TL7K6VMVS/vEZ1GAwkZOY8/7ey2Yq+dbcA5gQSM80tM3dOG7kBMldukJ8iYZcgSuIdakvB54YxXaR9YhHLvksHxcKKiJzjhhF/cvkqC4c6Cg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410801; c=relaxed/simple; bh=2ft90euX3bzvoT6s9AGx3txhkNGWAbWMVK/aTnFoX5U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DMK2T4a/mfP/uMuLjUaTamCEWTqs5pSGn/5WOXfyC47po2ujD31ITeqZr2YB66oG27A1R6049x22Mql6pbl3gj3KopOd70dG50hzlDNmsS8Hp4Hw281nfkVP4tRAQOJB+Ikt255ZVkClgnNgnO13gN2tQnDR6mX4yMa7oG7aCjM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=eTweojpi; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="eTweojpi" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410800; x=1788946800; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=2ft90euX3bzvoT6s9AGx3txhkNGWAbWMVK/aTnFoX5U=; b=eTweojpixyMN/Dnt9uVJGehpQHAy1FOhtGNuPQ33ddGDkGKVzshi2lzJ MZ7FMksu2w+MXR6yhEPI+ZFBqM2nF6uz06WXUGMdlPw6clUuBV0u+mS7B Qdrt/UlW1hlwjR/p4fYKbA8c18WQJr31p241VcODuiIE5uBT5Kuj1NKoS oud2jdZacGYGT6sUPftXr7DWjqpOtazz33IAw4bqICwY/fpW5JpySb4YZ ESSqv/+XE7rT7p+lWghB2HoxrtKfWKAABze9SkKXSLYt3UthXwETwVb4u xgg4cdoaP4ZuTcuJKqFcNhwuxMfV1UWFEocoBSWRmyijir9YjpkqFdIEq Q==; X-CSE-ConnectionGUID: E2F6t7ZITI+M9tS4d7u20Q== X-CSE-MsgGUID: GwAFNa5+T/yOrMGBjzacRg== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307233" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307233" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:55 -0700 X-CSE-ConnectionGUID: 4G47zf6pSfax5We9diDSOg== X-CSE-MsgGUID: dsxDFZQUT06ywsFys9vVDQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207406" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:55 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 07/22] KVM: x86: Add fault checks for guest CR4.CET setting Date: Tue, 9 Sep 2025 02:39:38 -0700 Message-ID: <20250909093953.202028-8-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Check potential faults for CR4.CET setting per Intel SDM requirements. CET can be enabled if and only if CR0.WP =3D=3D 1, i.e. setting CR4.CET =3D= =3D 1 faults if CR0.WP =3D=3D 0 and setting CR0.WP =3D=3D 0 fails if CR4.CET = =3D=3D 1. Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson Signed-off-by: Yang Weijiang Reviewed-by: Chao Gao Reviewed-by: Maxim Levitsky Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Xiaoyao Li --- arch/x86/kvm/x86.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 7c0a07be6b64..50c192c99a7e 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1173,6 +1173,9 @@ int kvm_set_cr0(struct kvm_vcpu *vcpu, unsigned long = cr0) (is_64_bit_mode(vcpu) || kvm_is_cr4_bit_set(vcpu, X86_CR4_PCIDE))) return 1; =20 + if (!(cr0 & X86_CR0_WP) && kvm_is_cr4_bit_set(vcpu, X86_CR4_CET)) + return 1; + kvm_x86_call(set_cr0)(vcpu, cr0); =20 kvm_post_set_cr0(vcpu, old_cr0, cr0); @@ -1372,6 +1375,9 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long = cr4) return 1; } =20 + if ((cr4 & X86_CR4_CET) && !kvm_is_cr0_bit_set(vcpu, X86_CR0_WP)) + return 1; + kvm_x86_call(set_cr4)(vcpu, cr4); =20 kvm_post_set_cr4(vcpu, old_cr4, cr4); --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BA3762D3EEB; Tue, 9 Sep 2025 09:40:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410802; cv=none; b=o6fjmgCrNHPIsD5oTkyWCbalzMT06VTI0pY98wwgBKuSGn0r2qaQRo3pqzeZv95bG4nNLd6dkpvy0w6Kh0lkZVpUbT2UeS+6EmsMs3kA8AMVZ9Hl6GaPF5sEfI3rwfbrbLnbTdlhDenwNL5n51RoCB0CWKRi5CuTFyGv3mS+0Hk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410802; c=relaxed/simple; bh=rmk6W9XXngb5UEH5KiN95T6Plvs7qxwSQtmxVgI0jj8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=sMIL792PRvwtgYU4s98zHCZ92cF7lZePHORAcpIz7ezgbHLd/iRNyz4UYYtu4g/da46V4NvothqxIAVNQeqzIDeiAP9RHxADtrhcuDaa79XtuMxQLOdQ/4bwxN6d2MSSjO3pI2Yz3/hsQE4MytiUO1uc7EY/C6M/Kp/v2nZst/c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=EwjiBy/N; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="EwjiBy/N" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410801; x=1788946801; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=rmk6W9XXngb5UEH5KiN95T6Plvs7qxwSQtmxVgI0jj8=; b=EwjiBy/NGjgrCNlYqCS/Hgq/X6OEUmsI+HiBJjew4jYWMh21yZdkW1Ml oyKxavcyiBFMgtpMJv2RNccGK9ZrsYHmr7EoM5BHsOSpjyNTJjQPw2YFS IhwZVnSq2KDmG615w+9RvfnfaGVnimMCXBVAtxxNT+hE0DegHyAdo0Ib8 tj5Ll96e3lbiWxDaWIjwF/yAOelYp/cd7GrWHcnRuRs4pKOm0hFxkka61 WeSdY2FU3WbYkrshX/TKzIqZ88/jc4Bk9c87KsBwB+53ploabzp0j7dcO qWVhMhWAYZXaI4b4ftQJ7dd7b4sywKRqooxMBfsOyKFDqTb921ZGJK7IW g==; X-CSE-ConnectionGUID: DYaeCcLhRPWJXtzmYS7HMA== X-CSE-MsgGUID: /x9FJz+ESMa7lmOhXk7ExQ== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307244" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307244" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:55 -0700 X-CSE-ConnectionGUID: Fl2QWL+ZQE6nscQjdkKehQ== X-CSE-MsgGUID: MJGgP/IZRq6mog7rql6a9w== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207409" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:55 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 08/22] KVM: x86: Report KVM supported CET MSRs as to-be-saved Date: Tue, 9 Sep 2025 02:39:39 -0700 Message-ID: <20250909093953.202028-9-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Add CET MSRs to the list of MSRs reported to userspace if the feature, i.e. IBT or SHSTK, associated with the MSRs is supported by KVM. Suggested-by: Chao Gao Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao --- arch/x86/kvm/x86.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 50c192c99a7e..691f8e68046f 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -341,6 +341,10 @@ static const u32 msrs_to_save_base[] =3D { MSR_IA32_UMWAIT_CONTROL, =20 MSR_IA32_XFD, MSR_IA32_XFD_ERR, MSR_IA32_XSS, + + MSR_IA32_U_CET, MSR_IA32_S_CET, + MSR_IA32_PL0_SSP, MSR_IA32_PL1_SSP, MSR_IA32_PL2_SSP, + MSR_IA32_PL3_SSP, MSR_IA32_INT_SSP_TAB, }; =20 static const u32 msrs_to_save_pmu[] =3D { @@ -7517,6 +7521,20 @@ static void kvm_probe_msr_to_save(u32 msr_index) if (!kvm_caps.supported_xss) return; break; + case MSR_IA32_U_CET: + case MSR_IA32_S_CET: + if (!kvm_cpu_cap_has(X86_FEATURE_SHSTK) && + !kvm_cpu_cap_has(X86_FEATURE_IBT)) + return; + break; + case MSR_IA32_INT_SSP_TAB: + if (!kvm_cpu_cap_has(X86_FEATURE_LM)) + return; + fallthrough; + case MSR_IA32_PL0_SSP ... MSR_IA32_PL3_SSP: + if (!kvm_cpu_cap_has(X86_FEATURE_SHSTK)) + return; + break; default: break; } --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D83102D6409; Tue, 9 Sep 2025 09:40:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410804; cv=none; b=qzwCpjedTtuOVWazn3Be/BWuDRTazpg2W8+7HIXQ7hjR1Jda/ao40XmqHEiX8JExQq0ZWyQ3FuIzv8j5uV4ZJSb0opCxjTNjab1F97jciuW01ZG3+QAOnN0KPfidj9tuEw9NdyXMwdF/uhhQtxMoiSyJ+JyTa10cVaFVlFdFb3M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410804; c=relaxed/simple; bh=VP1WTWQxCS9TlgJCKb39srQIObO767Az9EF/mk/4CHo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GB9zfLK1ERb73d/tqEfnO61V2jIcY2JhZ4/jwC3W4RBOP3PrUVQMhy0EIhlKGysZGm8e/MJHt32emBFKmnUDwEwZIiKvdOlpLc0Si/FmPnR3+c9lLl9IiPLAL3e7nFQx6PdUKTGzO4w35ecmgnR+GcIvxGl0vcbCQ0XPileE3pk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=hh45fLlz; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="hh45fLlz" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410802; x=1788946802; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=VP1WTWQxCS9TlgJCKb39srQIObO767Az9EF/mk/4CHo=; b=hh45fLlzpM0RhQYHVsdxPf25Nwg8YWikdbgkizuLkoBVLyNYU/swu6nd G0vx5ompGMxwaI8xdgeJf5IyLBAcsDy5iUK7P0M47LIIZiT55CYgM58xF bzRuDFFA1qESSL0xvzWzLIlM5Iex0+zv2c+CHCr6y/OXrGW5uA9An2ZG1 4IQ/5AgubhN30L/58tx95z2tozG9hgizt/Kc6z72FFx1s7iC4OnGXNVOM zedtaxwTIGxf6AZNfxwzfR5OJZHNkUKqvGKeyOEH225clDjWgGf2QrZAW MqvBRQkBWHmsrZsqmI4PxQeTyPX9FCKxry7+QQcJToDAOqZuqo6Mzps8/ A==; X-CSE-ConnectionGUID: MGta7htzTXe/ITcovlOzbw== X-CSE-MsgGUID: fA7suPK5RJuz2JA1CoakEQ== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307254" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307254" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:55 -0700 X-CSE-ConnectionGUID: 7w3l5ey9R++hR0k1hPWWAg== X-CSE-MsgGUID: 9wwOur5jT6i+eAk4YN+tcw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207412" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:56 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 09/22] KVM: VMX: Introduce CET VMCS fields and control bits Date: Tue, 9 Sep 2025 02:39:40 -0700 Message-ID: <20250909093953.202028-10-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Control-flow Enforcement Technology (CET) is a kind of CPU feature used to prevent Return/CALL/Jump-Oriented Programming (ROP/COP/JOP) attacks. It provides two sub-features(SHSTK,IBT) to defend against ROP/COP/JOP style control-flow subversion attacks. Shadow Stack (SHSTK): A shadow stack is a second stack used exclusively for control transfer operations. The shadow stack is separate from the data/normal stack and can be enabled individually in user and kernel mode. When shadow stack is enabled, CALL pushes the return address on both the data and shadow stack. RET pops the return address from both stacks and compares them. If the return addresses from the two stacks do not match, the processor generates a #CP. Indirect Branch Tracking (IBT): IBT introduces instruction(ENDBRANCH)to mark valid target addresses of indirect branches (CALL, JMP etc...). If an indirect branch is executed and the next instruction is _not_ an ENDBRANCH, the processor generates a #CP. These instruction behaves as a NOP on platforms that have no CET. Several new CET MSRs are defined to support CET: MSR_IA32_{U,S}_CET: CET settings for {user,supervisor} CET respectively. MSR_IA32_PL{0,1,2,3}_SSP: SHSTK pointer linear address for CPL{0,1,2,3}. MSR_IA32_INT_SSP_TAB: Linear address of SHSTK pointer table, whose entry is indexed by IST of interrupt gate desc. Two XSAVES state bits are introduced for CET: IA32_XSS:[bit 11]: Control saving/restoring user mode CET states IA32_XSS:[bit 12]: Control saving/restoring supervisor mode CET states. Six VMCS fields are introduced for CET: {HOST,GUEST}_S_CET: Stores CET settings for kernel mode. {HOST,GUEST}_SSP: Stores current active SSP. {HOST,GUEST}_INTR_SSP_TABLE: Stores current active MSR_IA32_INT_SSP_TAB. On Intel platforms, two additional bits are defined in VM_EXIT and VM_ENTRY control fields: If VM_EXIT_LOAD_CET_STATE =3D 1, host CET states are loaded from following VMCS fields at VM-Exit: HOST_S_CET HOST_SSP HOST_INTR_SSP_TABLE If VM_ENTRY_LOAD_CET_STATE =3D 1, guest CET states are loaded from following VMCS fields at VM-Entry: GUEST_S_CET GUEST_SSP GUEST_INTR_SSP_TABLE Co-developed-by: Zhang Yi Z Signed-off-by: Zhang Yi Z Signed-off-by: Yang Weijiang Reviewed-by: Chao Gao Reviewed-by: Maxim Levitsky Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao --- arch/x86/include/asm/vmx.h | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h index cca7d6641287..ce10a7e2d3d9 100644 --- a/arch/x86/include/asm/vmx.h +++ b/arch/x86/include/asm/vmx.h @@ -106,6 +106,7 @@ #define VM_EXIT_CLEAR_BNDCFGS 0x00800000 #define VM_EXIT_PT_CONCEAL_PIP 0x01000000 #define VM_EXIT_CLEAR_IA32_RTIT_CTL 0x02000000 +#define VM_EXIT_LOAD_CET_STATE 0x10000000 =20 #define VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR 0x00036dff =20 @@ -119,6 +120,7 @@ #define VM_ENTRY_LOAD_BNDCFGS 0x00010000 #define VM_ENTRY_PT_CONCEAL_PIP 0x00020000 #define VM_ENTRY_LOAD_IA32_RTIT_CTL 0x00040000 +#define VM_ENTRY_LOAD_CET_STATE 0x00100000 =20 #define VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR 0x000011ff =20 @@ -369,6 +371,9 @@ enum vmcs_field { GUEST_PENDING_DBG_EXCEPTIONS =3D 0x00006822, GUEST_SYSENTER_ESP =3D 0x00006824, GUEST_SYSENTER_EIP =3D 0x00006826, + GUEST_S_CET =3D 0x00006828, + GUEST_SSP =3D 0x0000682a, + GUEST_INTR_SSP_TABLE =3D 0x0000682c, HOST_CR0 =3D 0x00006c00, HOST_CR3 =3D 0x00006c02, HOST_CR4 =3D 0x00006c04, @@ -381,6 +386,9 @@ enum vmcs_field { HOST_IA32_SYSENTER_EIP =3D 0x00006c12, HOST_RSP =3D 0x00006c14, HOST_RIP =3D 0x00006c16, + HOST_S_CET =3D 0x00006c18, + HOST_SSP =3D 0x00006c1a, + HOST_INTR_SSP_TABLE =3D 0x00006c1c }; =20 /* --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2D3402D661E; Tue, 9 Sep 2025 09:40:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410804; cv=none; b=m2AWlJx7ITvxnWRWHuqztQxKIKjIMTGREd4l4vTGlCiAQBja0hs+OmKeWOUGKDJKwkvGOsm3lTUaTBfPfzrfaP8OcDUncCVuRIqLXekb3kinTr0fWVdLLH/h9CDr7gM7k9gRJ6bZiw762AVm54YTwZEhOjgXrLgX/M8rkV/gag4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410804; c=relaxed/simple; bh=x3kJ51xSGR3x7Pxoo3adXv1ezy89yCQncm+vlqiyvpQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TxU585kOLl1+J/G/E4UmDJL1iL7DT2eHPqjYvoEdObODlqhgHHQ/Q5Ow1LNWcyfEuDAy0tVOIEuUkhWjftDFv1kgtkAqNe1HKUMOAVPgXwGDC5+ttomFpyVys3pZUWGzcy3x8Gr9j6rW2I0jsfELUcvhD35/3GNNADbY8XEVGKM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=D1sq38OM; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="D1sq38OM" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410802; x=1788946802; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=x3kJ51xSGR3x7Pxoo3adXv1ezy89yCQncm+vlqiyvpQ=; b=D1sq38OMKAlux3RAgLYmFma2QdJr3a81C2zkJSNJHvX58C7gP4Ll18zp pelXmPHpS0inWOFE6DHn08+XtPoM/3nAJtHrCyQBnS9ZWMlAl7RfOaI81 wzod9iE1tvgEIQLnMHQjjRTftVNpmwxmaB8XAECfNDXnzyaJANq0ydGrV dkHYIJggaTPuWjWk67VTu4ixc3bVtk7cQittVrQMABh3vgoXdvWgA9wL6 ieycwFdDJZIUHzHsfWRooQhPffUhuqJ2FlE85AFk8mDyrIzuxwvJAWb0A sLB+Y9pex7gF9vblAPw74Ka7XvMFtzGmmfwUvmKtbh9ODxmGkkskSL+qy Q==; X-CSE-ConnectionGUID: iz4pNDxST3esEdbgAqkLdA== X-CSE-MsgGUID: Ft9PMBvRRtOT65zxCZ+j6g== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307259" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307259" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:56 -0700 X-CSE-ConnectionGUID: AXOyJOM7SDqf5idMif3tkg== X-CSE-MsgGUID: UgAfiDESSEGmV8Z953Zl5A== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207415" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:56 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 10/22] KVM: x86: Enable guest SSP read/write interface with new uAPIs Date: Tue, 9 Sep 2025 02:39:41 -0700 Message-ID: <20250909093953.202028-11-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Enable guest shadow stack pointer(SSP) access interface with new uAPIs. CET guest SSP is HW register which has corresponding VMCS field to save /restore guest values when VM-{Exit,Entry} happens. KVM handles SSP as a synthetic MSR for userspace access. Use a translation helper to set up mapping for SSP synthetic index and KVM-internal MSR index so that userspace doesn't need to take care of KVM's management for synthetic MSRs and avoid conflicts. Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao --- Documentation/virt/kvm/api.rst | 7 +++++++ arch/x86/include/uapi/asm/kvm.h | 3 +++ arch/x86/kvm/x86.c | 10 +++++++++- arch/x86/kvm/x86.h | 10 ++++++++++ 4 files changed, 29 insertions(+), 1 deletion(-) diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst index 28fc12b46eeb..2b999408a768 100644 --- a/Documentation/virt/kvm/api.rst +++ b/Documentation/virt/kvm/api.rst @@ -2911,6 +2911,13 @@ such as set vcpu counter or reset vcpu, and they hav= e the following id bit patte x86 MSR registers have the following id bit patterns:: 0x2030 0002 =20 +Following are the KVM-defined registers for x86: +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D= =3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D + Encoding Register Description +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D= =3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D + 0x2030 0003 0000 0000 SSP Shadow Stack Pointer +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D= =3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D + 4.69 KVM_GET_ONE_REG -------------------- =20 diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kv= m.h index 508b713ca52e..8cc79eca34b2 100644 --- a/arch/x86/include/uapi/asm/kvm.h +++ b/arch/x86/include/uapi/asm/kvm.h @@ -437,6 +437,9 @@ struct kvm_xcrs { #define KVM_X86_REG_KVM(index) \ KVM_X86_REG_ENCODE(KVM_X86_REG_TYPE_KVM, index) =20 +/* KVM-defined registers starting from 0 */ +#define KVM_REG_GUEST_SSP 0 + #define KVM_SYNC_X86_REGS (1UL << 0) #define KVM_SYNC_X86_SREGS (1UL << 1) #define KVM_SYNC_X86_EVENTS (1UL << 2) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 691f8e68046f..a6036eab3852 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -5999,7 +5999,15 @@ struct kvm_x86_reg_id { =20 static int kvm_translate_kvm_reg(struct kvm_x86_reg_id *reg) { - return -EINVAL; + switch (reg->index) { + case KVM_REG_GUEST_SSP: + reg->type =3D KVM_X86_REG_TYPE_MSR; + reg->index =3D MSR_KVM_INTERNAL_GUEST_SSP; + break; + default: + return -EINVAL; + } + return 0; } =20 long kvm_arch_vcpu_ioctl(struct file *filp, diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h index 34afe43579bb..cf4f73a95825 100644 --- a/arch/x86/kvm/x86.h +++ b/arch/x86/kvm/x86.h @@ -101,6 +101,16 @@ do { \ #define KVM_SVM_DEFAULT_PLE_WINDOW_MAX USHRT_MAX #define KVM_SVM_DEFAULT_PLE_WINDOW 3000 =20 +/* + * KVM's internal, non-ABI indices for synthetic MSRs. The values themselv= es + * are arbitrary and have no meaning, the only requirement is that they do= n't + * conflict with "real" MSRs that KVM supports. Use values at the upper end + * of KVM's reserved paravirtual MSR range to minimize churn, i.e. these v= alues + * will be usable until KVM exhausts its supply of paravirtual MSR indices. + */ + +#define MSR_KVM_INTERNAL_GUEST_SSP 0x4b564dff + static inline unsigned int __grow_ple_window(unsigned int val, unsigned int base, unsigned int modifier, unsigned int max) { --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DFDAA2C21D5; Tue, 9 Sep 2025 09:40:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410804; cv=none; b=e+JAlQjsiGDfj3d5ANzBTSPnc/Ny26sl0P80AJZ5gk+KIuyjFBW0YpTM5jw/YAHP0awxRXzOQq+4DTuBebwX350XrT4L842pANAe625/it7IX9v9k6fU3qWRCtFNJEjVp7C07KObfQhkBmWNPdj5ihGmPuKWOj6gD2X7GxNhEQ0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410804; c=relaxed/simple; bh=+HbYP4q471SAqwfdc0ak8mqKLtcYzSvenaKEK8HA3fo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uV3/VgufbLWi0Whpd03EGho7y9DelXUQQecNjGBz4eL4o/6yzSfdgmeJTCsYCMCqW+W8iijYUBVeuzDjSwIzS6yzbnL0UEXf7+udlf5442BJsEukig3g2jcY/9yzmQ7Re3Oj9k0D8p4kY2ByOEfQgF2QUCPwJaOfDByX1JN9cS4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=aY8PGE4v; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="aY8PGE4v" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410803; x=1788946803; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=+HbYP4q471SAqwfdc0ak8mqKLtcYzSvenaKEK8HA3fo=; b=aY8PGE4v52abgKqB852V4oyMGP/gM2bb6NlzmZPvzAsOO7RscZ0AJBET QqPtTpPIp9ohb3gh7Vppf857IacTf22ozIhfnBE2vCRFstMvzi3ExFUDv Ik8aXRE0CgpFgpDXFlAXhzR3lIvEi1YL2ry2ox8wq8R/Yg9G+5jYAt6Rb 1/oQuqnC2LSiHDfBeqNZ9EoFVdrxy8raowXIxkCYcRQn7T9o1oz5yAcs3 3WerWPLB6++mu6MaARFDoNE+T6bzcALHoc7x7zwXmyuMwwAYP35ijIpc2 MO3Svtjxul80tOyFq1/WIHQ7TxsHZSzjvRJS8d/3HW1MGHbWjiLnxIvEi Q==; X-CSE-ConnectionGUID: gW48EN3gT/KXEjGxJGEDkg== X-CSE-MsgGUID: F1TNbCh1TQGp+3u3Qd28jg== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307264" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307264" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:56 -0700 X-CSE-ConnectionGUID: Caez4MCQQxqKhU0gm0gjyQ== X-CSE-MsgGUID: VgHes3RATqW72aEe2EybXQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207418" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:56 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 11/22] KVM: VMX: Emulate read and write to CET MSRs Date: Tue, 9 Sep 2025 02:39:42 -0700 Message-ID: <20250909093953.202028-12-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Add emulation interface for CET MSR access. The emulation code is split into common part and vendor specific part. The former does common checks for MSRs, e.g., accessibility, data validity etc., then passes operation to either XSAVE-managed MSRs via the helpers or CET VMCS fields. SSP can only be read via RDSSP. Writing even requires destructive and potentially faulting operations such as SAVEPREVSSP/RSTORSSP or SETSSBSY/CLRSSBSY. Let the host use a pseudo-MSR that is just a wrapper for the GUEST_SSP field of the VMCS. Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao --- v14: - Update both hardware MSR value and VMCS field when userspace writes to MSR_IA32_S_CET. This keeps guest FPU and VMCS always inconsistent regarding MSR_IA32_S_CET. --- arch/x86/kvm/vmx/vmx.c | 19 +++++++++++++ arch/x86/kvm/x86.c | 60 ++++++++++++++++++++++++++++++++++++++++++ arch/x86/kvm/x86.h | 23 ++++++++++++++++ 3 files changed, 102 insertions(+) diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 227b45430ad8..22bd71bebfad 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -2106,6 +2106,15 @@ int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_da= ta *msr_info) else msr_info->data =3D vmx->pt_desc.guest.addr_a[index / 2]; break; + case MSR_IA32_S_CET: + msr_info->data =3D vmcs_readl(GUEST_S_CET); + break; + case MSR_KVM_INTERNAL_GUEST_SSP: + msr_info->data =3D vmcs_readl(GUEST_SSP); + break; + case MSR_IA32_INT_SSP_TAB: + msr_info->data =3D vmcs_readl(GUEST_INTR_SSP_TABLE); + break; case MSR_IA32_DEBUGCTLMSR: msr_info->data =3D vmx_guest_debugctl_read(); break; @@ -2424,6 +2433,16 @@ int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_da= ta *msr_info) else vmx->pt_desc.guest.addr_a[index / 2] =3D data; break; + case MSR_IA32_S_CET: + vmcs_writel(GUEST_S_CET, data); + kvm_set_xstate_msr(vcpu, msr_info); + break; + case MSR_KVM_INTERNAL_GUEST_SSP: + vmcs_writel(GUEST_SSP, data); + break; + case MSR_IA32_INT_SSP_TAB: + vmcs_writel(GUEST_INTR_SSP_TABLE, data); + break; case MSR_IA32_PERF_CAPABILITIES: if (data & PMU_CAP_LBR_FMT) { if ((data & PMU_CAP_LBR_FMT) !=3D diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index a6036eab3852..79861b7ad44d 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1886,6 +1886,44 @@ static int __kvm_set_msr(struct kvm_vcpu *vcpu, u32 = index, u64 data, =20 data =3D (u32)data; break; + case MSR_IA32_U_CET: + case MSR_IA32_S_CET: + if (!guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) && + !guest_cpu_cap_has(vcpu, X86_FEATURE_IBT)) + return KVM_MSR_RET_UNSUPPORTED; + if (!kvm_is_valid_u_s_cet(vcpu, data)) + return 1; + break; + case MSR_KVM_INTERNAL_GUEST_SSP: + if (!host_initiated) + return 1; + fallthrough; + /* + * Note that the MSR emulation here is flawed when a vCPU + * doesn't support the Intel 64 architecture. The expected + * architectural behavior in this case is that the upper 32 + * bits do not exist and should always read '0'. However, + * because the actual hardware on which the virtual CPU is + * running does support Intel 64, XRSTORS/XSAVES in the + * guest could observe behavior that violates the + * architecture. Intercepting XRSTORS/XSAVES for this + * special case isn't deemed worthwhile. + */ + case MSR_IA32_PL0_SSP ... MSR_IA32_INT_SSP_TAB: + if (!guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK)) + return KVM_MSR_RET_UNSUPPORTED; + /* + * MSR_IA32_INT_SSP_TAB is not present on processors that do + * not support Intel 64 architecture. + */ + if (index =3D=3D MSR_IA32_INT_SSP_TAB && !guest_cpu_cap_has(vcpu, X86_FE= ATURE_LM)) + return KVM_MSR_RET_UNSUPPORTED; + if (is_noncanonical_msr_address(data, vcpu)) + return 1; + /* All SSP MSRs except MSR_IA32_INT_SSP_TAB must be 4-byte aligned */ + if (index !=3D MSR_IA32_INT_SSP_TAB && !IS_ALIGNED(data, 4)) + return 1; + break; } =20 msr.data =3D data; @@ -1930,6 +1968,20 @@ static int __kvm_get_msr(struct kvm_vcpu *vcpu, u32 = index, u64 *data, !guest_cpu_cap_has(vcpu, X86_FEATURE_RDPID)) return 1; break; + case MSR_IA32_U_CET: + case MSR_IA32_S_CET: + if (!guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) && + !guest_cpu_cap_has(vcpu, X86_FEATURE_IBT)) + return KVM_MSR_RET_UNSUPPORTED; + break; + case MSR_KVM_INTERNAL_GUEST_SSP: + if (!host_initiated) + return 1; + fallthrough; + case MSR_IA32_PL0_SSP ... MSR_IA32_INT_SSP_TAB: + if (!guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK)) + return KVM_MSR_RET_UNSUPPORTED; + break; } =20 msr.index =3D index; @@ -4220,6 +4272,10 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct= msr_data *msr_info) vcpu->arch.guest_fpu.xfd_err =3D data; break; #endif + case MSR_IA32_U_CET: + case MSR_IA32_PL0_SSP ... MSR_IA32_PL3_SSP: + kvm_set_xstate_msr(vcpu, msr_info); + break; default: if (kvm_pmu_is_valid_msr(vcpu, msr)) return kvm_pmu_set_msr(vcpu, msr_info); @@ -4569,6 +4625,10 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct= msr_data *msr_info) msr_info->data =3D vcpu->arch.guest_fpu.xfd_err; break; #endif + case MSR_IA32_U_CET: + case MSR_IA32_PL0_SSP ... MSR_IA32_PL3_SSP: + kvm_get_xstate_msr(vcpu, msr_info); + break; default: if (kvm_pmu_is_valid_msr(vcpu, msr_info->index)) return kvm_pmu_get_msr(vcpu, msr_info); diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h index cf4f73a95825..95d2a82a4674 100644 --- a/arch/x86/kvm/x86.h +++ b/arch/x86/kvm/x86.h @@ -735,4 +735,27 @@ static inline void kvm_set_xstate_msr(struct kvm_vcpu = *vcpu, kvm_fpu_put(); } =20 +#define CET_US_RESERVED_BITS GENMASK(9, 6) +#define CET_US_SHSTK_MASK_BITS GENMASK(1, 0) +#define CET_US_IBT_MASK_BITS (GENMASK_ULL(5, 2) | GENMASK_ULL(63, 10)) +#define CET_US_LEGACY_BITMAP_BASE(data) ((data) >> 12) + +static inline bool kvm_is_valid_u_s_cet(struct kvm_vcpu *vcpu, u64 data) +{ + if (data & CET_US_RESERVED_BITS) + return false; + if (!guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) && + (data & CET_US_SHSTK_MASK_BITS)) + return false; + if (!guest_cpu_cap_has(vcpu, X86_FEATURE_IBT) && + (data & CET_US_IBT_MASK_BITS)) + return false; + if (!IS_ALIGNED(CET_US_LEGACY_BITMAP_BASE(data), 4)) + return false; + /* IBT can be suppressed iff the TRACKER isn't WAIT_ENDBR. */ + if ((data & CET_SUPPRESS) && (data & CET_WAIT_ENDBR)) + return false; + + return true; +} #endif --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2C7D0307AD2; Tue, 9 Sep 2025 09:40:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410805; cv=none; b=EoXaRRsGpyLxLwBMymnqMgWGM63ubgoU3iQYXqHvEvXZuk9nfMceFiJXrXIDIfQHqxLKLVayRNrpajlRr8jRoXUYKAmkKrq11ZsG8h8mad74nkp4J+Lxi8E50oA+RbNknzIVjKjqOH4Aps8sWW8Z1J4Kocz/JacpN+SIQynebwY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410805; c=relaxed/simple; bh=Iee4CLaQXxLG8uUP5bqwP61MDqXRMZclM7eNQhokwNI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=o9tcD4zEwn8ruc0KQe2njWaIG2Ys6jcezx8xHvYC9OcM35JyjG9/EhxE3fmCnK8UUh/0s0NL5I51Lsir3NzX8159HLZvkEp/cuB1Mu9JAi1rUu77KMrDfri5uQZxPXc3g/wEqcMQSfOGwDGN0BW5gzrj/gJuu3kmZLnsidXuTDY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=FOgYSXmT; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="FOgYSXmT" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410804; x=1788946804; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Iee4CLaQXxLG8uUP5bqwP61MDqXRMZclM7eNQhokwNI=; b=FOgYSXmT6kMc7znkiqO7w1zc4Ft7T08d7U+ldfdXAuSOC+JZSq92E6OL afGcQiPvdmdA4eWOrE4PNf+TmHj0WiL7G5gl4umUhmKs/VU0PPochn4qU 9weCEG8Ofjccwuz3PSzAnVweqDI7ycxAW1+RMy8fkNvJ7FrBT3S2cq0md JFFR9szp0T1/REYF3ROIRyepJtFdvGXKP6w0J+MD7x0PF1zi9atCNYVfB rOZN64PMA3xHCKLvcqor4ko+dd3lY4cnoFnwI7q56cSXYDNGlJ3Wk9Rdu JgE8It8ypFmDA2+g2sVjzPszjgN2deVV3i004TV2UjA/pSHVvsGpnkDnF w==; X-CSE-ConnectionGUID: LfrkPiUGTB2PZ2jU9j9hxQ== X-CSE-MsgGUID: v7C/Dx82Tmmh587mXVjc2A== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307275" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307275" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:56 -0700 X-CSE-ConnectionGUID: McqjqCf1QbalR2wp4p6AiQ== X-CSE-MsgGUID: Dy76je6IQMuLwtO6kKjzhw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207421" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:56 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 12/22] KVM: x86: Save and reload SSP to/from SMRAM Date: Tue, 9 Sep 2025 02:39:43 -0700 Message-ID: <20250909093953.202028-13-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Save CET SSP to SMRAM on SMI and reload it on RSM. KVM emulates HW arch behavior when guest enters/leaves SMM mode,i.e., save registers to SMRAM at the entry of SMM and reload them at the exit to SMM. Per SDM, SSP is one of such registers on 64-bit Arch, and add the support for SSP. Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao --- arch/x86/kvm/smm.c | 8 ++++++++ arch/x86/kvm/smm.h | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/smm.c b/arch/x86/kvm/smm.c index 5dd8a1646800..b0b14ba37f9a 100644 --- a/arch/x86/kvm/smm.c +++ b/arch/x86/kvm/smm.c @@ -269,6 +269,10 @@ static void enter_smm_save_state_64(struct kvm_vcpu *v= cpu, enter_smm_save_seg_64(vcpu, &smram->gs, VCPU_SREG_GS); =20 smram->int_shadow =3D kvm_x86_call(get_interrupt_shadow)(vcpu); + + if (guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) && + kvm_msr_read(vcpu, MSR_KVM_INTERNAL_GUEST_SSP, &smram->ssp)) + kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu); } #endif =20 @@ -558,6 +562,10 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *= ctxt, kvm_x86_call(set_interrupt_shadow)(vcpu, 0); ctxt->interruptibility =3D (u8)smstate->int_shadow; =20 + if (guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK) && + kvm_msr_write(vcpu, MSR_KVM_INTERNAL_GUEST_SSP, smstate->ssp)) + return X86EMUL_UNHANDLEABLE; + return X86EMUL_CONTINUE; } #endif diff --git a/arch/x86/kvm/smm.h b/arch/x86/kvm/smm.h index 551703fbe200..db3c88f16138 100644 --- a/arch/x86/kvm/smm.h +++ b/arch/x86/kvm/smm.h @@ -116,8 +116,8 @@ struct kvm_smram_state_64 { u32 smbase; u32 reserved4[5]; =20 - /* ssp and svm_* fields below are not implemented by KVM */ u64 ssp; + /* svm_* fields below are not implemented by KVM */ u64 svm_guest_pat; u64 svm_host_efer; u64 svm_host_cr4; --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76E383081A4; Tue, 9 Sep 2025 09:40:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410806; cv=none; b=rlrJCWLgO9ZLHZHmFDfNkFV9zqiJPiNRhhb/tmeAxEGuGUOF/l47D9VQ86OtqKctT8587KtRrficphglySCq4tNcQa+hTpY3Z1M/Qy1S0eGvoGfdzX7IUwVjZ2VOvyck62FgssC8IUQRSDnBGTzS3l48L91/cyi5lrgQVLQVuzY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410806; c=relaxed/simple; bh=KOFFeBEs7QhCsltveRbSIhh4fed0gwK98txg6TSwRys=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pBAs4yRsuCxk2njxbqTVwNtYtNUNO4tJMo+z025rSklM/6o6iTTOPWgqkNVB6Ew97DpJ3iADklF5pxNeiH3VLD8bpgiWYCtZcSicCFnG28XErXadccKGOdMRSE9maHawJF0tcqTqSeU67ahWlxKs2+eX44Uw3fV8HpUoNfl+nMI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=OMjtXKKZ; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="OMjtXKKZ" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410804; x=1788946804; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=KOFFeBEs7QhCsltveRbSIhh4fed0gwK98txg6TSwRys=; b=OMjtXKKZvZPG0szpYs8TtBkvGyqSEeCWyXwCKV5ooY3tQRHMDMdM1fP8 gnNb8QsNke/1RyXpxU81ndYWgkoNiCcjXniQkPLrZWgwRR3S3UyC71Kew hwJkJSSvYv0rwmB2qMrVfExOM2eqpHRCRuJhVSsM4+0CL1by16iJCiJD0 ou7gIg8slf8cOTIjPSIra2lbjuRmPvPdTOv79ESOsrU7bN/vXu2EyWzqe 39EH9LR5tAT9nEUZ39oAEYucCjhx9h0rKsEF3VeeiNnnFpyX5wcbOs6qF sgzZXCjaw5hh6ytvxwCE3hEPiSmF0xSKQWlmKIfWTGxAyRcEYDnTwAIAM g==; X-CSE-ConnectionGUID: ACKrvq/qRgOFuBkbBj+jqg== X-CSE-MsgGUID: lNIUh4yBTwy/r4WzigLiPQ== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307279" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307279" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:56 -0700 X-CSE-ConnectionGUID: IW6j0dD0S4SFl8Nv2dpDhw== X-CSE-MsgGUID: 5ImhtPHrTbWfzrOuSBUYvw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207424" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:56 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 13/22] KVM: VMX: Set up interception for CET MSRs Date: Tue, 9 Sep 2025 02:39:44 -0700 Message-ID: <20250909093953.202028-14-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Enable/disable CET MSRs interception per associated feature configuration. Pass through CET MSRs that are managed by XSAVE, as they cannot be intercepted without also intercepting XSAVE. However, intercepting XSAVE would likely cause unacceptable performance overhead. MSR_IA32_INT_SSP_TAB is not managed by XSAVE, so it is intercepted. Note, this MSR design introduced an architectural limitation of SHSTK and IBT control for guest, i.e., when SHSTK is exposed, IBT is also available to guest from architectural perspective since IBT relies on subset of SHSTK relevant MSRs. Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao --- arch/x86/kvm/vmx/vmx.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 22bd71bebfad..70f5a9e05cec 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -4102,6 +4102,8 @@ void pt_update_intercept_for_msr(struct kvm_vcpu *vcp= u) =20 void vmx_recalc_msr_intercepts(struct kvm_vcpu *vcpu) { + bool intercept; + if (!cpu_has_vmx_msr_bitmap()) return; =20 @@ -4147,6 +4149,23 @@ void vmx_recalc_msr_intercepts(struct kvm_vcpu *vcpu) vmx_set_intercept_for_msr(vcpu, MSR_IA32_FLUSH_CMD, MSR_TYPE_W, !guest_cpu_cap_has(vcpu, X86_FEATURE_FLUSH_L1D)); =20 + if (kvm_cpu_cap_has(X86_FEATURE_SHSTK)) { + intercept =3D !guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK); + + vmx_set_intercept_for_msr(vcpu, MSR_IA32_PL0_SSP, MSR_TYPE_RW, intercept= ); + vmx_set_intercept_for_msr(vcpu, MSR_IA32_PL1_SSP, MSR_TYPE_RW, intercept= ); + vmx_set_intercept_for_msr(vcpu, MSR_IA32_PL2_SSP, MSR_TYPE_RW, intercept= ); + vmx_set_intercept_for_msr(vcpu, MSR_IA32_PL3_SSP, MSR_TYPE_RW, intercept= ); + } + + if (kvm_cpu_cap_has(X86_FEATURE_SHSTK) || kvm_cpu_cap_has(X86_FEATURE_IBT= )) { + intercept =3D !guest_cpu_cap_has(vcpu, X86_FEATURE_IBT) && + !guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK); + + vmx_set_intercept_for_msr(vcpu, MSR_IA32_U_CET, MSR_TYPE_RW, intercept); + vmx_set_intercept_for_msr(vcpu, MSR_IA32_S_CET, MSR_TYPE_RW, intercept); + } + /* * x2APIC and LBR MSR intercepts are modified on-demand and cannot be * filtered by userspace. --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E07F308F15; Tue, 9 Sep 2025 09:40:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410806; cv=none; b=mcGB9Hm/a+jmuUmBdVAzikxtq2z0yqFyIBQWcnkm468EZgoOnpvUsrnNaaeGjH6vwUVDcqr6EC5n2+YYqgx6ZEmzBJ994xpD7dR5DdRt0/za3Frj0CcVYmy04AF8ZiWMOBnMK11+AuetGWtFm1VkIWTWR4KdZmTLXguh+JUJOa0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410806; c=relaxed/simple; bh=igohFjfGtW8SELdeBSvgCImuuHQp9innMtVfFIGRIX4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=B870Su/Om4DdJTgjw3gT2zBt70Q38cLSW98e2a70vzel07nHMT+Hu7lTewCR/S1y19p/3CP49YR2FNmRok1B4OSEbhDUw/3eHjA0vmhltuY21C6w4FPuVH6T5ZKsM67ShZf7JS+3qRaMua17ne6q9m3VM1rVqFuCws5axBwyoKs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=PhOtpKHh; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="PhOtpKHh" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410805; x=1788946805; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=igohFjfGtW8SELdeBSvgCImuuHQp9innMtVfFIGRIX4=; b=PhOtpKHhzT1+boOg5abODH11MMgD6ZZInxaGThCJQ7YzLY5hSrEp0wn7 tCFjxtq0qQUEq3oNYrJL8aAJJ12BtBd5SuUwFatA8528Tw/qGLqsBoI0g JZBLMVqFUZH0qCnhqerM+UvHx2pkKnavvLxid7F7yr4nuoF1sqd/PG79v YOUzp33l8aaqWe8XRzuF0mvwFk6P8SKaU069UzaKnPEgBlOxmaM073cFQ jrO86GYY/OtKASE6rwBi4PlngtcZRFoDk2V6pNJ9w6oI6TLMNFnbhcYQi Xi9lWrC+DLnUaG65eA6L1rg/FS1IOQeCqjnFS8wnr2yFG+/arf6M8fHlh w==; X-CSE-ConnectionGUID: mmMCaDspQS+6lZsuGcPbsg== X-CSE-MsgGUID: QBvOWKepRPeXaj7C3odSLg== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307291" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307291" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:56 -0700 X-CSE-ConnectionGUID: 5mCj/D1KTZmdCoJTecswlg== X-CSE-MsgGUID: B70LiylvQtqH/Qs//eJRNg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207427" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:57 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 14/22] KVM: VMX: Set host constant supervisor states to VMCS fields Date: Tue, 9 Sep 2025 02:39:45 -0700 Message-ID: <20250909093953.202028-15-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Save constant values to HOST_{S_CET,SSP,INTR_SSP_TABLE} field explicitly. Kernel IBT is supported and the setting in MSR_IA32_S_CET is static after post-boot(The exception is BIOS call case but vCPU thread never across it) and KVM doesn't need to refresh HOST_S_CET field before every VM-Enter/ VM-Exit sequence. Host supervisor shadow stack is not enabled now and SSP is not accessible to kernel mode, thus it's safe to set host IA32_INT_SSP_TAB/SSP VMCS field to 0s. When shadow stack is enabled for CPL3, SSP is reloaded from PL3_SSP before it exits to userspace. Check SDM Vol 2A/B Chapter 3/4 for SYSCALL/ SYSRET/SYSENTER SYSEXIT/RDSSP/CALL etc. Prevent KVM module loading if host supervisor shadow stack SHSTK_EN is set in MSR_IA32_S_CET as KVM cannot co-exit with it correctly. Suggested-by: Sean Christopherson Suggested-by: Chao Gao Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao --- arch/x86/kvm/vmx/capabilities.h | 4 ++++ arch/x86/kvm/vmx/vmx.c | 15 +++++++++++++++ arch/x86/kvm/x86.c | 12 ++++++++++++ arch/x86/kvm/x86.h | 1 + 4 files changed, 32 insertions(+) diff --git a/arch/x86/kvm/vmx/capabilities.h b/arch/x86/kvm/vmx/capabilitie= s.h index 5316c27f6099..7d290b2cb0f4 100644 --- a/arch/x86/kvm/vmx/capabilities.h +++ b/arch/x86/kvm/vmx/capabilities.h @@ -103,6 +103,10 @@ static inline bool cpu_has_load_perf_global_ctrl(void) return vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL; } =20 +static inline bool cpu_has_load_cet_ctrl(void) +{ + return (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_CET_STATE); +} static inline bool cpu_has_vmx_mpx(void) { return vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_BNDCFGS; diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 70f5a9e05cec..3430a17ecd23 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -4321,6 +4321,21 @@ void vmx_set_constant_host_state(struct vcpu_vmx *vm= x) =20 if (cpu_has_load_ia32_efer()) vmcs_write64(HOST_IA32_EFER, kvm_host.efer); + + /* + * Supervisor shadow stack is not enabled on host side, i.e., + * host IA32_S_CET.SHSTK_EN bit is guaranteed to 0 now, per SDM + * description(RDSSP instruction), SSP is not readable in CPL0, + * so resetting the two registers to 0s at VM-Exit does no harm + * to kernel execution. When execution flow exits to userspace, + * SSP is reloaded from IA32_PL3_SSP. Check SDM Vol.2A/B Chapter + * 3 and 4 for details. + */ + if (cpu_has_load_cet_ctrl()) { + vmcs_writel(HOST_S_CET, kvm_host.s_cet); + vmcs_writel(HOST_SSP, 0); + vmcs_writel(HOST_INTR_SSP_TABLE, 0); + } } =20 void set_cr4_guest_host_mask(struct vcpu_vmx *vmx) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 79861b7ad44d..d67aef261638 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -9890,6 +9890,18 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *ops) return -EIO; } =20 + if (boot_cpu_has(X86_FEATURE_SHSTK)) { + rdmsrq(MSR_IA32_S_CET, kvm_host.s_cet); + /* + * Linux doesn't yet support supervisor shadow stacks (SSS), so + * KVM doesn't save/restore the associated MSRs, i.e. KVM may + * clobber the host values. Yell and refuse to load if SSS is + * unexpectedly enabled, e.g. to avoid crashing the host. + */ + if (WARN_ON_ONCE(kvm_host.s_cet & CET_SHSTK_EN)) + return -EIO; + } + memset(&kvm_caps, 0, sizeof(kvm_caps)); =20 x86_emulator_cache =3D kvm_alloc_emulator_cache(); diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h index 95d2a82a4674..3da60b046ce8 100644 --- a/arch/x86/kvm/x86.h +++ b/arch/x86/kvm/x86.h @@ -50,6 +50,7 @@ struct kvm_host_values { u64 efer; u64 xcr0; u64 xss; + u64 s_cet; u64 arch_capabilities; }; =20 --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 087BE3054F8; Tue, 9 Sep 2025 09:40:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410808; cv=none; b=f8LKswlQyeE1DtQ8ACVxsuUsaDe/CmA89INJYRSg8x9iabvxVyOwrOZTqL4zxWf3kd+5G2qeCqlkC2YXYLcyrC1WgC3fDs/UFhTNHVdmFAU2E0G5IyBLN61roEUPow/cctLfFQbNHb6Ya0nWgrTTJjSiLYGxx3aYGmynB6oQSeo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410808; c=relaxed/simple; bh=ik6x/Xx9UFsVaiaO0szvF715FVxMRj4m2V+kEZefuFc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=D01Dx4gCrADDrocd43L7DvXYMwtVqeFT3XEFHeubucxMx5BWI3VMyl4/giLyATcXH7GMGy9So1YEgb6xSiqKFR8HtKZF3nlztoA+0dRRabHjovq918NwfAhE0al7iBB4FLUk5bpF05eu5zOmeoMh2UfVw1dhOYfZ3tB4Ecvnpso= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=lL+68Jhv; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="lL+68Jhv" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410806; x=1788946806; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=ik6x/Xx9UFsVaiaO0szvF715FVxMRj4m2V+kEZefuFc=; b=lL+68JhvOyim4vlEpJlhStIUJu/y5Fh4N4I+GO1xrx84GV3HaEsdCdpX mcB33Pu0/xku9v5zH8HlbMkz6jKKchkqVhgK10Cs3MCRnjILx7G15H7xc WlovaZjNUs7yP9Imuh8rH/JUlh3nNx3hremF0kIwF7B1am25g92hCfST/ x5JwLGx07AYV+JilQkKvsnYjpigx6AJ/qSOzttikeIbzXe3hX4tKwmm3o U0wt+/glaSid/Qe8YyThrimD3LLH+0869EAGh/Fsb8MoJjWWb7HYZPOFN IDwhB8LtIbU/VwwnI4I3pTnVxBmaMsxOGQJwlz8QCXR7aDv+6ug7BR6bg w==; X-CSE-ConnectionGUID: F0TnVGPfSl+xDmJK3ZTjqw== X-CSE-MsgGUID: VWrhIh/PTjWnCxoIfbkagQ== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307297" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307297" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:56 -0700 X-CSE-ConnectionGUID: 7ReFwnCHT0yRT7oOorINKQ== X-CSE-MsgGUID: MTsRZulWQR20nJRuYLD0GA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207430" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:57 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 15/22] KVM: x86: Don't emulate instructions guarded by CET Date: Tue, 9 Sep 2025 02:39:46 -0700 Message-ID: <20250909093953.202028-16-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Don't emulate the branch instructions, e.g., CALL/RET/JMP etc., when CET is active in guest, return KVM_INTERNAL_ERROR_EMULATION to userspace to handle it. KVM doesn't emulate CPU behaviors to check CET protected stuffs while emulating guest instructions, instead it stops emulation on detecting the instructions in process are CET protected. By doing so, it can avoid generating bogus #CP in guest and preventing CET protected execution flow subversion from guest side. Suggested-by: Chao Gao Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao --- arch/x86/kvm/emulate.c | 46 ++++++++++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index 542d3664afa3..97a4d1e69583 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -178,6 +178,8 @@ #define IncSP ((u64)1 << 54) /* SP is incremented before ModRM calc= */ #define TwoMemOp ((u64)1 << 55) /* Instruction has two memory operand = */ #define IsBranch ((u64)1 << 56) /* Instruction is considered a branch.= */ +#define ShadowStack ((u64)1 << 57) /* Instruction protected by Shadow Sta= ck. */ +#define IndirBrnTrk ((u64)1 << 58) /* Instruction protected by IBT. */ =20 #define DstXacc (DstAccLo | SrcAccHi | SrcWrite) =20 @@ -4068,9 +4070,11 @@ static const struct opcode group4[] =3D { static const struct opcode group5[] =3D { F(DstMem | SrcNone | Lock, em_inc), F(DstMem | SrcNone | Lock, em_dec), - I(SrcMem | NearBranch | IsBranch, em_call_near_abs), - I(SrcMemFAddr | ImplicitOps | IsBranch, em_call_far), - I(SrcMem | NearBranch | IsBranch, em_jmp_abs), + I(SrcMem | NearBranch | IsBranch | ShadowStack | IndirBrnTrk, + em_call_near_abs), + I(SrcMemFAddr | ImplicitOps | IsBranch | ShadowStack | IndirBrnTrk, + em_call_far), + I(SrcMem | NearBranch | IsBranch | IndirBrnTrk, em_jmp_abs), I(SrcMemFAddr | ImplicitOps | IsBranch, em_jmp_far), I(SrcMem | Stack | TwoMemOp, em_push), D(Undefined), }; @@ -4332,11 +4336,11 @@ static const struct opcode opcode_table[256] =3D { /* 0xC8 - 0xCF */ I(Stack | SrcImmU16 | Src2ImmByte | IsBranch, em_enter), I(Stack | IsBranch, em_leave), - I(ImplicitOps | SrcImmU16 | IsBranch, em_ret_far_imm), - I(ImplicitOps | IsBranch, em_ret_far), - D(ImplicitOps | IsBranch), DI(SrcImmByte | IsBranch, intn), + I(ImplicitOps | SrcImmU16 | IsBranch | ShadowStack, em_ret_far_imm), + I(ImplicitOps | IsBranch | ShadowStack, em_ret_far), + D(ImplicitOps | IsBranch), DI(SrcImmByte | IsBranch | ShadowStack, intn), D(ImplicitOps | No64 | IsBranch), - II(ImplicitOps | IsBranch, em_iret, iret), + II(ImplicitOps | IsBranch | ShadowStack, em_iret, iret), /* 0xD0 - 0xD7 */ G(Src2One | ByteOp, group2), G(Src2One, group2), G(Src2CL | ByteOp, group2), G(Src2CL, group2), @@ -4352,7 +4356,7 @@ static const struct opcode opcode_table[256] =3D { I2bvIP(SrcImmUByte | DstAcc, em_in, in, check_perm_in), I2bvIP(SrcAcc | DstImmUByte, em_out, out, check_perm_out), /* 0xE8 - 0xEF */ - I(SrcImm | NearBranch | IsBranch, em_call), + I(SrcImm | NearBranch | IsBranch | ShadowStack, em_call), D(SrcImm | ImplicitOps | NearBranch | IsBranch), I(SrcImmFAddr | No64 | IsBranch, em_jmp_far), D(SrcImmByte | ImplicitOps | NearBranch | IsBranch), @@ -4371,7 +4375,8 @@ static const struct opcode opcode_table[256] =3D { static const struct opcode twobyte_table[256] =3D { /* 0x00 - 0x0F */ G(0, group6), GD(0, &group7), N, N, - N, I(ImplicitOps | EmulateOnUD | IsBranch, em_syscall), + N, I(ImplicitOps | EmulateOnUD | IsBranch | ShadowStack | IndirBrnTrk, + em_syscall), II(ImplicitOps | Priv, em_clts, clts), N, DI(ImplicitOps | Priv, invd), DI(ImplicitOps | Priv, wbinvd), N, N, N, D(ImplicitOps | ModRM | SrcMem | NoAccess), N, N, @@ -4402,8 +4407,9 @@ static const struct opcode twobyte_table[256] =3D { IIP(ImplicitOps, em_rdtsc, rdtsc, check_rdtsc), II(ImplicitOps | Priv, em_rdmsr, rdmsr), IIP(ImplicitOps, em_rdpmc, rdpmc, check_rdpmc), - I(ImplicitOps | EmulateOnUD | IsBranch, em_sysenter), - I(ImplicitOps | Priv | EmulateOnUD | IsBranch, em_sysexit), + I(ImplicitOps | EmulateOnUD | IsBranch | ShadowStack | IndirBrnTrk, + em_sysenter), + I(ImplicitOps | Priv | EmulateOnUD | IsBranch | ShadowStack, em_sysexit), N, N, N, N, N, N, N, N, N, N, /* 0x40 - 0x4F */ @@ -4941,6 +4947,24 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, v= oid *insn, int insn_len, int if (ctxt->d =3D=3D 0) return EMULATION_FAILED; =20 + if (ctxt->ops->get_cr(ctxt, 4) & X86_CR4_CET) { + u64 u_cet, s_cet; + bool stop_em; + + if (ctxt->ops->get_msr(ctxt, MSR_IA32_U_CET, &u_cet) || + ctxt->ops->get_msr(ctxt, MSR_IA32_S_CET, &s_cet)) + return EMULATION_FAILED; + + stop_em =3D ((u_cet & CET_SHSTK_EN) || (s_cet & CET_SHSTK_EN)) && + (opcode.flags & ShadowStack); + + stop_em |=3D ((u_cet & CET_ENDBR_EN) || (s_cet & CET_ENDBR_EN)) && + (opcode.flags & IndirBrnTrk); + + if (stop_em) + return EMULATION_FAILED; + } + ctxt->execute =3D opcode.u.execute; =20 if (unlikely(emulation_type & EMULTYPE_TRAP_UD) && --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78A53309EF1; Tue, 9 Sep 2025 09:40:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410809; cv=none; b=gM1D+f9rOiVBYkz1qQh1JOQCj84kFj0I3/3V6XxLfKPozkSPI90eoG+7MLWL5gLZ3l3J7QfEsJXdW0cgVVyG9YSwbVnn8QqBUTQO/NQw43Tuo+SiZgMBsloWbvA7KEITE61+E78+AjN37O9ZPoNbRphmX6zkH34TkghnVLImMks= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410809; c=relaxed/simple; bh=RsKnO7Q9T/d38atUm1Fe1ceYBiblJf/7z35RpohEpBs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hfUUEdJu6s9T6a01a1hwf/YmsKtkSPJYimw+qIt8rbPTWSw26mvd+FBjuP3bih6fkui0tCLwpq+82vHDAFmQ9UfQXCQErjlhbPWrhYxrqb/VAoQxyMrdBoPGa6f1kD2w2gt157ar6AD3CJScwMJQmwCRL96bRiWVSnIo/EktSc0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=Nmkv6lIj; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="Nmkv6lIj" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410806; x=1788946806; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=RsKnO7Q9T/d38atUm1Fe1ceYBiblJf/7z35RpohEpBs=; b=Nmkv6lIjS1fW+YZUr62+pjh697Z/erWfYbC4XloouA15zv1EaIesEgxh 3fvN4jZUbbt39fGd+n0TOfGhIqJyd6B50mKwHEmSZANlW5/Qqu0Kyq6Ae 2NV4xrVy9djJYgDdNzMhOi+OjDPxHlA9P5/xeC0GJ/zc8kiU/yyj0lqrU NcBcZ+HMm8OuLKBqXfPrtxY4sjdUMr5p0Ixg8BxL18AbJE0k5SizwfSVZ XPolsor/r731ifA++zWH/7SbmojXVIYRdJ8n4kY/2hzhlzGmYJ/3bmPzQ p0Uu1vTw4vzErLXK1yeYH+daFPTzp8BaH9+3kvxz/4PU+XrDWvNPUT741 Q==; X-CSE-ConnectionGUID: XyCk5j6RRp+TJlLQ7Jz8ew== X-CSE-MsgGUID: lrrAhhA6SgqdWJV/2Yvmjw== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307308" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307308" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:56 -0700 X-CSE-ConnectionGUID: DUa6GX+EQ5+OD/MuGsUwYg== X-CSE-MsgGUID: 0y0HKiqNTGWy/C3U7/QNxA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207433" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:57 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 16/22] KVM: x86: Enable CET virtualization for VMX and advertise to userspace Date: Tue, 9 Sep 2025 02:39:47 -0700 Message-ID: <20250909093953.202028-17-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Expose CET features to guest if KVM/host can support them, clear CPUID feature bits if KVM/host cannot support. Set CPUID feature bits so that CET features are available in guest CPUID. Add CR4.CET bit support in order to allow guest set CET master control bit. Disable KVM CET feature if unrestricted_guest is unsupported/disabled as KVM does not support emulating CET. The CET load-bits in VM_ENTRY/VM_EXIT control fields should be set to make guest CET xstates isolated from host's. On platforms with VMX_BASIC[bit56] =3D=3D 0, inject #CP at VMX entry with e= rror code will fail, and if VMX_BASIC[bit56] =3D=3D 1, #CP injection with or wit= hout error code is allowed. Disable CET feature bits if the MSR bit is cleared so that nested VMM can inject #CP if and only if VMX_BASIC[bit56] =3D=3D 1. Don't expose CET feature if either of {U,S}_CET xstate bits is cleared in host XSS or if XSAVES isn't supported. CET MSRs are reset to 0s after RESET, power-up and INIT, clear guest CET xsave-area fields so that guest CET MSRs are reset to 0s after the events. Meanwhile explicitly disable SHSTK and IBT for SVM because CET KVM enabling for SVM is not ready. Signed-off-by: Yang Weijiang Signed-off-by: Mathias Krause Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao --- arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/include/asm/vmx.h | 1 + arch/x86/kvm/cpuid.c | 2 ++ arch/x86/kvm/svm/svm.c | 4 ++++ arch/x86/kvm/vmx/capabilities.h | 5 +++++ arch/x86/kvm/vmx/vmx.c | 30 +++++++++++++++++++++++++++++- arch/x86/kvm/vmx/vmx.h | 6 ++++-- arch/x86/kvm/x86.c | 22 +++++++++++++++++++--- arch/x86/kvm/x86.h | 3 +++ 9 files changed, 68 insertions(+), 7 deletions(-) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_hos= t.h index b2983c830247..e947204b7f21 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -142,7 +142,7 @@ | X86_CR4_OSXSAVE | X86_CR4_SMEP | X86_CR4_FSGSBASE \ | X86_CR4_OSXMMEXCPT | X86_CR4_LA57 | X86_CR4_VMXE \ | X86_CR4_SMAP | X86_CR4_PKE | X86_CR4_UMIP \ - | X86_CR4_LAM_SUP)) + | X86_CR4_LAM_SUP | X86_CR4_CET)) =20 #define CR8_RESERVED_BITS (~(unsigned long)X86_CR8_TPR) =20 diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h index ce10a7e2d3d9..c85c50019523 100644 --- a/arch/x86/include/asm/vmx.h +++ b/arch/x86/include/asm/vmx.h @@ -134,6 +134,7 @@ #define VMX_BASIC_DUAL_MONITOR_TREATMENT BIT_ULL(49) #define VMX_BASIC_INOUT BIT_ULL(54) #define VMX_BASIC_TRUE_CTLS BIT_ULL(55) +#define VMX_BASIC_NO_HW_ERROR_CODE_CC BIT_ULL(56) =20 static inline u32 vmx_basic_vmcs_revision_id(u64 vmx_basic) { diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c index b5f87254ced7..ee05b876c656 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -944,6 +944,7 @@ void kvm_set_cpu_caps(void) VENDOR_F(WAITPKG), F(SGX_LC), F(BUS_LOCK_DETECT), + X86_64_F(SHSTK), ); =20 /* @@ -970,6 +971,7 @@ void kvm_set_cpu_caps(void) F(AMX_INT8), F(AMX_BF16), F(FLUSH_L1D), + F(IBT), ); =20 if (boot_cpu_has(X86_FEATURE_AMD_IBPB_RET) && diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index cb4f81be0024..e4af4907c7d8 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -5224,6 +5224,10 @@ static __init void svm_set_cpu_caps(void) kvm_caps.supported_perf_cap =3D 0; kvm_caps.supported_xss =3D 0; =20 + /* KVM doesn't yet support CET virtualization for SVM. */ + kvm_cpu_cap_clear(X86_FEATURE_SHSTK); + kvm_cpu_cap_clear(X86_FEATURE_IBT); + /* CPUID 0x80000001 and 0x8000000A (SVM features) */ if (nested) { kvm_cpu_cap_set(X86_FEATURE_SVM); diff --git a/arch/x86/kvm/vmx/capabilities.h b/arch/x86/kvm/vmx/capabilitie= s.h index 7d290b2cb0f4..47b0dec8665a 100644 --- a/arch/x86/kvm/vmx/capabilities.h +++ b/arch/x86/kvm/vmx/capabilities.h @@ -76,6 +76,11 @@ static inline bool cpu_has_vmx_basic_inout(void) return vmcs_config.basic & VMX_BASIC_INOUT; } =20 +static inline bool cpu_has_vmx_basic_no_hw_errcode(void) +{ + return vmcs_config.basic & VMX_BASIC_NO_HW_ERROR_CODE_CC; +} + static inline bool cpu_has_virtual_nmis(void) { return vmcs_config.pin_based_exec_ctrl & PIN_BASED_VIRTUAL_NMIS && diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 3430a17ecd23..820a2d1f3bd7 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -2616,6 +2616,7 @@ static int setup_vmcs_config(struct vmcs_config *vmcs= _conf, { VM_ENTRY_LOAD_IA32_EFER, VM_EXIT_LOAD_IA32_EFER }, { VM_ENTRY_LOAD_BNDCFGS, VM_EXIT_CLEAR_BNDCFGS }, { VM_ENTRY_LOAD_IA32_RTIT_CTL, VM_EXIT_CLEAR_IA32_RTIT_CTL }, + { VM_ENTRY_LOAD_CET_STATE, VM_EXIT_LOAD_CET_STATE }, }; =20 memset(vmcs_conf, 0, sizeof(*vmcs_conf)); @@ -4883,6 +4884,14 @@ void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init= _event) =20 vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, 0); /* 22.2.1 */ =20 + if (kvm_cpu_cap_has(X86_FEATURE_SHSTK)) { + vmcs_writel(GUEST_SSP, 0); + vmcs_writel(GUEST_INTR_SSP_TABLE, 0); + } + if (kvm_cpu_cap_has(X86_FEATURE_IBT) || + kvm_cpu_cap_has(X86_FEATURE_SHSTK)) + vmcs_writel(GUEST_S_CET, 0); + kvm_make_request(KVM_REQ_APIC_PAGE_RELOAD, vcpu); =20 vpid_sync_context(vmx->vpid); @@ -6350,6 +6359,10 @@ void dump_vmcs(struct kvm_vcpu *vcpu) if (vmcs_read32(VM_EXIT_MSR_STORE_COUNT) > 0) vmx_dump_msrs("guest autostore", &vmx->msr_autostore.guest); =20 + if (vmentry_ctl & VM_ENTRY_LOAD_CET_STATE) + pr_err("S_CET =3D 0x%016lx, SSP =3D 0x%016lx, SSP TABLE =3D 0x%016lx\n", + vmcs_readl(GUEST_S_CET), vmcs_readl(GUEST_SSP), + vmcs_readl(GUEST_INTR_SSP_TABLE)); pr_err("*** Host State ***\n"); pr_err("RIP =3D 0x%016lx RSP =3D 0x%016lx\n", vmcs_readl(HOST_RIP), vmcs_readl(HOST_RSP)); @@ -6380,6 +6393,10 @@ void dump_vmcs(struct kvm_vcpu *vcpu) vmcs_read64(HOST_IA32_PERF_GLOBAL_CTRL)); if (vmcs_read32(VM_EXIT_MSR_LOAD_COUNT) > 0) vmx_dump_msrs("host autoload", &vmx->msr_autoload.host); + if (vmexit_ctl & VM_EXIT_LOAD_CET_STATE) + pr_err("S_CET =3D 0x%016lx, SSP =3D 0x%016lx, SSP TABLE =3D 0x%016lx\n", + vmcs_readl(HOST_S_CET), vmcs_readl(HOST_SSP), + vmcs_readl(HOST_INTR_SSP_TABLE)); =20 pr_err("*** Control State ***\n"); pr_err("CPUBased=3D0x%08x SecondaryExec=3D0x%08x TertiaryExec=3D0x%016llx= \n", @@ -7964,7 +7981,6 @@ static __init void vmx_set_cpu_caps(void) kvm_cpu_cap_set(X86_FEATURE_UMIP); =20 /* CPUID 0xD.1 */ - kvm_caps.supported_xss =3D 0; if (!cpu_has_vmx_xsaves()) kvm_cpu_cap_clear(X86_FEATURE_XSAVES); =20 @@ -7976,6 +7992,18 @@ static __init void vmx_set_cpu_caps(void) =20 if (cpu_has_vmx_waitpkg()) kvm_cpu_cap_check_and_set(X86_FEATURE_WAITPKG); + + /* + * Disable CET if unrestricted_guest is unsupported as KVM doesn't + * enforce CET HW behaviors in emulator. On platforms with + * VMX_BASIC[bit56] =3D=3D 0, inject #CP at VMX entry with error code + * fails, so disable CET in this case too. + */ + if (!cpu_has_load_cet_ctrl() || !enable_unrestricted_guest || + !cpu_has_vmx_basic_no_hw_errcode()) { + kvm_cpu_cap_clear(X86_FEATURE_SHSTK); + kvm_cpu_cap_clear(X86_FEATURE_IBT); + } } =20 static bool vmx_is_io_intercepted(struct kvm_vcpu *vcpu, diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h index 24d65dac5e89..08a9a0075404 100644 --- a/arch/x86/kvm/vmx/vmx.h +++ b/arch/x86/kvm/vmx/vmx.h @@ -484,7 +484,8 @@ static inline u8 vmx_get_rvi(void) VM_ENTRY_LOAD_IA32_EFER | \ VM_ENTRY_LOAD_BNDCFGS | \ VM_ENTRY_PT_CONCEAL_PIP | \ - VM_ENTRY_LOAD_IA32_RTIT_CTL) + VM_ENTRY_LOAD_IA32_RTIT_CTL | \ + VM_ENTRY_LOAD_CET_STATE) =20 #define __KVM_REQUIRED_VMX_VM_EXIT_CONTROLS \ (VM_EXIT_SAVE_DEBUG_CONTROLS | \ @@ -506,7 +507,8 @@ static inline u8 vmx_get_rvi(void) VM_EXIT_LOAD_IA32_EFER | \ VM_EXIT_CLEAR_BNDCFGS | \ VM_EXIT_PT_CONCEAL_PIP | \ - VM_EXIT_CLEAR_IA32_RTIT_CTL) + VM_EXIT_CLEAR_IA32_RTIT_CTL | \ + VM_EXIT_LOAD_CET_STATE) =20 #define KVM_REQUIRED_VMX_PIN_BASED_VM_EXEC_CONTROL \ (PIN_BASED_EXT_INTR_MASK | \ diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index d67aef261638..6f64a3355274 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -223,7 +223,8 @@ static struct kvm_user_return_msrs __percpu *user_retur= n_msrs; | XFEATURE_MASK_BNDCSR | XFEATURE_MASK_AVX512 \ | XFEATURE_MASK_PKRU | XFEATURE_MASK_XTILE) =20 -#define KVM_SUPPORTED_XSS 0 +#define KVM_SUPPORTED_XSS (XFEATURE_MASK_CET_USER | \ + XFEATURE_MASK_CET_KERNEL) =20 bool __read_mostly allow_smaller_maxphyaddr =3D 0; EXPORT_SYMBOL_GPL(allow_smaller_maxphyaddr); @@ -9988,6 +9989,20 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *ops) if (!kvm_cpu_cap_has(X86_FEATURE_XSAVES)) kvm_caps.supported_xss =3D 0; =20 + if (!kvm_cpu_cap_has(X86_FEATURE_SHSTK) && + !kvm_cpu_cap_has(X86_FEATURE_IBT)) + kvm_caps.supported_xss &=3D ~(XFEATURE_MASK_CET_USER | + XFEATURE_MASK_CET_KERNEL); + + if ((kvm_caps.supported_xss & (XFEATURE_MASK_CET_USER | + XFEATURE_MASK_CET_KERNEL)) !=3D + (XFEATURE_MASK_CET_USER | XFEATURE_MASK_CET_KERNEL)) { + kvm_cpu_cap_clear(X86_FEATURE_SHSTK); + kvm_cpu_cap_clear(X86_FEATURE_IBT); + kvm_caps.supported_xss &=3D ~(XFEATURE_MASK_CET_USER | + XFEATURE_MASK_CET_KERNEL); + } + if (kvm_caps.has_tsc_control) { /* * Make sure the user can only configure tsc_khz values that @@ -12643,10 +12658,11 @@ static void kvm_xstate_reset(struct kvm_vcpu *vcp= u, bool init_event) /* * On INIT, only select XSTATE components are zeroed, most components * are unchanged. Currently, the only components that are zeroed and - * supported by KVM are MPX related. + * supported by KVM are MPX and CET related. */ xfeatures_mask =3D (kvm_caps.supported_xcr0 | kvm_caps.supported_xss) & - (XFEATURE_MASK_BNDREGS | XFEATURE_MASK_BNDCSR); + (XFEATURE_MASK_BNDREGS | XFEATURE_MASK_BNDCSR | + XFEATURE_MASK_CET_USER | XFEATURE_MASK_CET_KERNEL); if (!xfeatures_mask) return; =20 diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h index 3da60b046ce8..728e01781ae8 100644 --- a/arch/x86/kvm/x86.h +++ b/arch/x86/kvm/x86.h @@ -681,6 +681,9 @@ static inline bool __kvm_is_valid_cr4(struct kvm_vcpu *= vcpu, unsigned long cr4) __reserved_bits |=3D X86_CR4_PCIDE; \ if (!__cpu_has(__c, X86_FEATURE_LAM)) \ __reserved_bits |=3D X86_CR4_LAM_SUP; \ + if (!__cpu_has(__c, X86_FEATURE_SHSTK) && \ + !__cpu_has(__c, X86_FEATURE_IBT)) \ + __reserved_bits |=3D X86_CR4_CET; \ __reserved_bits; \ }) =20 --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E2D630AAD2; Tue, 9 Sep 2025 09:40:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410809; cv=none; b=WDO5m2ARjrAPOlvj2DQlVapF5wfYUHqDNmbxmSV1RqTNX+zZJ4I5tydHyEjcII0wjB1XcJ6oD2mqJk7Xd0DisTRaGwYiXjHbiL+QX1XAbS43+u4/hSJdRMPOHmwdMwYbi53geo9ygLgwbdcWnD7kcMDPJRqzz810zxQUppQ1bqI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410809; c=relaxed/simple; bh=JNqRa0UFPixeO+5rVEt+vIHXdc6JK5UH9Iu5LAZURYs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=i+dhkK1tra5Txy1FoCUn9vKTi/4yu4tm6PNKbfeeArI2CFFmKOe3X4xcpGRVYk7kel66MlNN2XtIP9azh11y19cwfV4Qs67ZNMiu4SWpDgpSD+ANzhm59ERXVBSVwsEPC2F2bqbYI9F4FwH7ypdNVmWfbfZyB9sdLC2NtjFauhQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=H6KdpPgS; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="H6KdpPgS" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410807; x=1788946807; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=JNqRa0UFPixeO+5rVEt+vIHXdc6JK5UH9Iu5LAZURYs=; b=H6KdpPgSuuV+XrIVLUJnaknwQDePL0k7fs56B1GAIsQ0ynCvnTy2nmpj 9zvAJ5hvUnXg8zEsP3rEuImVO/0ln26byhlyuOJfgCEN6IY4xaNW4ZZUz cqd8nCfRfLWOaCfp0mpT+ZBVWZuW9fuadS1CChAtbH+3xrrUWciGN8ZzC xbPC4CvpsLmUktnCO9qHt4zabwa2wSZKWK1BZ9XbIOmXOH/CggfMa/8FB 62sCEqzuinbWEo/DsQeWYXRIVaqeaa/t6sunsHROtoVQPD6lhRm0Jp4GP S8y039xdWSCh+T/TX2MTsEd9KDE+Ru4RZNVVH3KwSeM2sfKt7iLW4M57U w==; X-CSE-ConnectionGUID: gSsA8jUNR5mde9/DAMW2HQ== X-CSE-MsgGUID: 3iH0TqQJSCmkPa69VV3QMQ== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307320" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307320" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:57 -0700 X-CSE-ConnectionGUID: 07vA4nkATBSwJo1ylQoEDg== X-CSE-MsgGUID: MIhQX/joTSaU5DRYGhbXUA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207436" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:57 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 17/22] KVM: nVMX: Virtualize NO_HW_ERROR_CODE_CC for L1 event injection to L2 Date: Tue, 9 Sep 2025 02:39:48 -0700 Message-ID: <20250909093953.202028-18-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Per SDM description(Vol.3D, Appendix A.1): "If bit 56 is read as 1, software can use VM entry to deliver a hardware exception with or without an error code, regardless of vector" Modify has_error_code check before inject events to nested guest. Only enforce the check when guest is in real mode, the exception is not hard exception and the platform doesn't enumerate bit56 in VMX_BASIC, in all other case ignore the check to make the logic consistent with SDM. Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao --- arch/x86/kvm/vmx/nested.c | 28 +++++++++++++++++++--------- arch/x86/kvm/vmx/nested.h | 5 +++++ 2 files changed, 24 insertions(+), 9 deletions(-) diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index 2156c9a854f4..14f9822b611d 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -1272,9 +1272,10 @@ static int vmx_restore_vmx_basic(struct vcpu_vmx *vm= x, u64 data) { const u64 feature_bits =3D VMX_BASIC_DUAL_MONITOR_TREATMENT | VMX_BASIC_INOUT | - VMX_BASIC_TRUE_CTLS; + VMX_BASIC_TRUE_CTLS | + VMX_BASIC_NO_HW_ERROR_CODE_CC; =20 - const u64 reserved_bits =3D GENMASK_ULL(63, 56) | + const u64 reserved_bits =3D GENMASK_ULL(63, 57) | GENMASK_ULL(47, 45) | BIT_ULL(31); =20 @@ -2949,7 +2950,6 @@ static int nested_check_vm_entry_controls(struct kvm_= vcpu *vcpu, u8 vector =3D intr_info & INTR_INFO_VECTOR_MASK; u32 intr_type =3D intr_info & INTR_INFO_INTR_TYPE_MASK; bool has_error_code =3D intr_info & INTR_INFO_DELIVER_CODE_MASK; - bool should_have_error_code; bool urg =3D nested_cpu_has2(vmcs12, SECONDARY_EXEC_UNRESTRICTED_GUEST); bool prot_mode =3D !urg || vmcs12->guest_cr0 & X86_CR0_PE; @@ -2966,12 +2966,20 @@ static int nested_check_vm_entry_controls(struct kv= m_vcpu *vcpu, CC(intr_type =3D=3D INTR_TYPE_OTHER_EVENT && vector !=3D 0)) return -EINVAL; =20 - /* VM-entry interruption-info field: deliver error code */ - should_have_error_code =3D - intr_type =3D=3D INTR_TYPE_HARD_EXCEPTION && prot_mode && - x86_exception_has_error_code(vector); - if (CC(has_error_code !=3D should_have_error_code)) - return -EINVAL; + /* + * Cannot deliver error code in real mode or if the interrupt + * type is not hardware exception. For other cases, do the + * consistency check only if the vCPU doesn't enumerate + * VMX_BASIC_NO_HW_ERROR_CODE_CC. + */ + if (!prot_mode || intr_type !=3D INTR_TYPE_HARD_EXCEPTION) { + if (CC(has_error_code)) + return -EINVAL; + } else if (!nested_cpu_has_no_hw_errcode_cc(vcpu)) { + if (CC(has_error_code !=3D + x86_exception_has_error_code(vector))) + return -EINVAL; + } =20 /* VM-entry exception error code */ if (CC(has_error_code && @@ -7214,6 +7222,8 @@ static void nested_vmx_setup_basic(struct nested_vmx_= msrs *msrs) msrs->basic |=3D VMX_BASIC_TRUE_CTLS; if (cpu_has_vmx_basic_inout()) msrs->basic |=3D VMX_BASIC_INOUT; + if (cpu_has_vmx_basic_no_hw_errcode()) + msrs->basic |=3D VMX_BASIC_NO_HW_ERROR_CODE_CC; } =20 static void nested_vmx_setup_cr_fixed(struct nested_vmx_msrs *msrs) diff --git a/arch/x86/kvm/vmx/nested.h b/arch/x86/kvm/vmx/nested.h index 6eedcfc91070..983484d42ebf 100644 --- a/arch/x86/kvm/vmx/nested.h +++ b/arch/x86/kvm/vmx/nested.h @@ -309,6 +309,11 @@ static inline bool nested_cr4_valid(struct kvm_vcpu *v= cpu, unsigned long val) __kvm_is_valid_cr4(vcpu, val); } =20 +static inline bool nested_cpu_has_no_hw_errcode_cc(struct kvm_vcpu *vcpu) +{ + return to_vmx(vcpu)->nested.msrs.basic & VMX_BASIC_NO_HW_ERROR_CODE_CC; +} + /* No difference in the restrictions on guest and host CR4 in VMX operatio= n. */ #define nested_guest_cr4_valid nested_cr4_valid #define nested_host_cr4_valid nested_cr4_valid --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C42230C36F; Tue, 9 Sep 2025 09:40:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410810; cv=none; b=qvETkx0Q4uFgIrTcyW1r5cDzAIRB/VPdXLcZkR/5cTBI1wNrXtwK8K3H6Io9ZW0xGijs7+pYQxsP3Ft6ibjBWPGJ+mXlCQ46Toefuk38vtdeOT2nVuHlfQsR0BNoNY++nEaLX215lWfh451ooPqTS46Ns8yDgBDDdbWJjc1LhTc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410810; c=relaxed/simple; bh=7E2TYCJ/zz06m+7Z6o+afvRNTuaGoHdKel2OsGUdoo8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dFKRLOhNyg1M4QlN+G62m//WTO3pzPLMMjZ448D1sPOrZQoWy9WBYP1j2VzYkZ7vl2UpODlEsCy/7UJxoESXQWX0/sCknD1sRncKFOUSZ6WNlTXfNNry41T+UWGn2TlLzsrx0fFkiGnQE6M6mMOdOzCIQgoftC5eNeHAhm5eCbU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=RbTlX2XY; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="RbTlX2XY" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410808; x=1788946808; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=7E2TYCJ/zz06m+7Z6o+afvRNTuaGoHdKel2OsGUdoo8=; b=RbTlX2XYh+6vFDW8eNAf5qd636gEpM8PtleigNPwmFTzP6fTbJ4/7S6i cfkQ/6B5OtdE5vRtOLZ7diRmq5VV2mLeXvRFblbnb55YjJ8XlFqL41VPH 20NmHXsXzJE/bbyOjTja/gcon3IWSSR1xQdhstKOilre8D/reNlSDszvy OinOTNLr9ZW3FDxl9YMLTTOPsIRsa5x3k/Z4OmbeRXRbMw5qgZsuO/RN6 6ivAnSp4V5EEEO0ZxLu8MAbrsBrbKeK97pmgjcN/BL/QBqj6tOCsZ0yyT X6l9nJsSnJzN27kBPFrldfGpKATypWH7hF5ZySos8ytZwwZo4tl2UC1W9 A==; X-CSE-ConnectionGUID: qIQP2Et3TIWjMnqdjz+I5Q== X-CSE-MsgGUID: yz+dTYiSRv+UtgMujLmFFg== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307323" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307323" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:57 -0700 X-CSE-ConnectionGUID: uKl8GOExSSam+q6zCMHBvA== X-CSE-MsgGUID: +d01As3QQgOCsz0IJdRxwg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207439" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:57 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 18/22] KVM: nVMX: Prepare for enabling CET support for nested guest Date: Tue, 9 Sep 2025 02:39:49 -0700 Message-ID: <20250909093953.202028-19-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Weijiang Set up CET MSRs, related VM_ENTRY/EXIT control bits and fixed CR4 setting to enable CET for nested VM. vmcs12 and vmcs02 needs to be synced when L2 exits to L1 or when L1 wants to resume L2, that way correct CET states can be observed by one another. Please note that consistency checks regarding CET state during VM-Entry will be added later to prevent this patch from becoming too large. Advertising the new CET VM_ENTRY/EXIT control bits are also be deferred until after the consistency checks are added. Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao --- arch/x86/kvm/vmx/nested.c | 77 +++++++++++++++++++++++++++++++++++++++ arch/x86/kvm/vmx/vmcs12.c | 6 +++ arch/x86/kvm/vmx/vmcs12.h | 14 ++++++- arch/x86/kvm/vmx/vmx.c | 2 + arch/x86/kvm/vmx/vmx.h | 3 ++ 5 files changed, 101 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index 14f9822b611d..51d69f368689 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -721,6 +721,24 @@ static inline bool nested_vmx_prepare_msr_bitmap(struc= t kvm_vcpu *vcpu, nested_vmx_set_intercept_for_msr(vmx, msr_bitmap_l1, msr_bitmap_l0, MSR_IA32_MPERF, MSR_TYPE_R); =20 + nested_vmx_set_intercept_for_msr(vmx, msr_bitmap_l1, msr_bitmap_l0, + MSR_IA32_U_CET, MSR_TYPE_RW); + + nested_vmx_set_intercept_for_msr(vmx, msr_bitmap_l1, msr_bitmap_l0, + MSR_IA32_S_CET, MSR_TYPE_RW); + + nested_vmx_set_intercept_for_msr(vmx, msr_bitmap_l1, msr_bitmap_l0, + MSR_IA32_PL0_SSP, MSR_TYPE_RW); + + nested_vmx_set_intercept_for_msr(vmx, msr_bitmap_l1, msr_bitmap_l0, + MSR_IA32_PL1_SSP, MSR_TYPE_RW); + + nested_vmx_set_intercept_for_msr(vmx, msr_bitmap_l1, msr_bitmap_l0, + MSR_IA32_PL2_SSP, MSR_TYPE_RW); + + nested_vmx_set_intercept_for_msr(vmx, msr_bitmap_l1, msr_bitmap_l0, + MSR_IA32_PL3_SSP, MSR_TYPE_RW); + kvm_vcpu_unmap(vcpu, &map); =20 vmx->nested.force_msr_bitmap_recalc =3D false; @@ -2521,6 +2539,32 @@ static void prepare_vmcs02_early(struct vcpu_vmx *vm= x, struct loaded_vmcs *vmcs0 } } =20 +static void vmcs_read_cet_state(struct kvm_vcpu *vcpu, u64 *s_cet, + u64 *ssp, u64 *ssp_tbl) +{ + if (guest_cpu_cap_has(vcpu, X86_FEATURE_IBT) || + guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK)) + *s_cet =3D vmcs_readl(GUEST_S_CET); + + if (guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK)) { + *ssp =3D vmcs_readl(GUEST_SSP); + *ssp_tbl =3D vmcs_readl(GUEST_INTR_SSP_TABLE); + } +} + +static void vmcs_write_cet_state(struct kvm_vcpu *vcpu, u64 s_cet, + u64 ssp, u64 ssp_tbl) +{ + if (guest_cpu_cap_has(vcpu, X86_FEATURE_IBT) || + guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK)) + vmcs_writel(GUEST_S_CET, s_cet); + + if (guest_cpu_cap_has(vcpu, X86_FEATURE_SHSTK)) { + vmcs_writel(GUEST_SSP, ssp); + vmcs_writel(GUEST_INTR_SSP_TABLE, ssp_tbl); + } +} + static void prepare_vmcs02_rare(struct vcpu_vmx *vmx, struct vmcs12 *vmcs1= 2) { struct hv_enlightened_vmcs *hv_evmcs =3D nested_vmx_evmcs(vmx); @@ -2637,6 +2681,10 @@ static void prepare_vmcs02_rare(struct vcpu_vmx *vmx= , struct vmcs12 *vmcs12) vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr); vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.guest.nr); =20 + if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_CET_STATE) + vmcs_write_cet_state(&vmx->vcpu, vmcs12->guest_s_cet, + vmcs12->guest_ssp, vmcs12->guest_ssp_tbl); + set_cr4_guest_host_mask(vmx); } =20 @@ -2676,6 +2724,13 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, str= uct vmcs12 *vmcs12, kvm_set_dr(vcpu, 7, vcpu->arch.dr7); vmx_guest_debugctl_write(vcpu, vmx->nested.pre_vmenter_debugctl); } + + if (!vmx->nested.nested_run_pending || + !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_CET_STATE)) + vmcs_write_cet_state(vcpu, vmx->nested.pre_vmenter_s_cet, + vmx->nested.pre_vmenter_ssp, + vmx->nested.pre_vmenter_ssp_tbl); + if (kvm_mpx_supported() && (!vmx->nested.nested_run_pending || !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))) vmcs_write64(GUEST_BNDCFGS, vmx->nested.pre_vmenter_bndcfgs); @@ -3552,6 +3607,12 @@ enum nvmx_vmentry_status nested_vmx_enter_non_root_m= ode(struct kvm_vcpu *vcpu, !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))) vmx->nested.pre_vmenter_bndcfgs =3D vmcs_read64(GUEST_BNDCFGS); =20 + if (!vmx->nested.nested_run_pending || + !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_CET_STATE)) + vmcs_read_cet_state(vcpu, &vmx->nested.pre_vmenter_s_cet, + &vmx->nested.pre_vmenter_ssp, + &vmx->nested.pre_vmenter_ssp_tbl); + /* * Overwrite vmcs01.GUEST_CR3 with L1's CR3 if EPT is disabled *and* * nested early checks are disabled. In the event of a "late" VM-Fail, @@ -4635,6 +4696,10 @@ static void sync_vmcs02_to_vmcs12(struct kvm_vcpu *v= cpu, struct vmcs12 *vmcs12) =20 if (vmcs12->vm_exit_controls & VM_EXIT_SAVE_IA32_EFER) vmcs12->guest_ia32_efer =3D vcpu->arch.efer; + + vmcs_read_cet_state(&vmx->vcpu, &vmcs12->guest_s_cet, + &vmcs12->guest_ssp, + &vmcs12->guest_ssp_tbl); } =20 /* @@ -4760,6 +4825,18 @@ static void load_vmcs12_host_state(struct kvm_vcpu *= vcpu, if (vmcs12->vm_exit_controls & VM_EXIT_CLEAR_BNDCFGS) vmcs_write64(GUEST_BNDCFGS, 0); =20 + /* + * Load CET state from host state if VM_EXIT_LOAD_CET_STATE is set. + * otherwise CET state should be retained across VM-exit, i.e., + * guest values should be propagated from vmcs12 to vmcs01. + */ + if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_CET_STATE) + vmcs_write_cet_state(vcpu, vmcs12->host_s_cet, vmcs12->host_ssp, + vmcs12->host_ssp_tbl); + else + vmcs_write_cet_state(vcpu, vmcs12->guest_s_cet, vmcs12->guest_ssp, + vmcs12->guest_ssp_tbl); + if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_PAT) { vmcs_write64(GUEST_IA32_PAT, vmcs12->host_ia32_pat); vcpu->arch.pat =3D vmcs12->host_ia32_pat; diff --git a/arch/x86/kvm/vmx/vmcs12.c b/arch/x86/kvm/vmx/vmcs12.c index 106a72c923ca..4233b5ca9461 100644 --- a/arch/x86/kvm/vmx/vmcs12.c +++ b/arch/x86/kvm/vmx/vmcs12.c @@ -139,6 +139,9 @@ const unsigned short vmcs12_field_offsets[] =3D { FIELD(GUEST_PENDING_DBG_EXCEPTIONS, guest_pending_dbg_exceptions), FIELD(GUEST_SYSENTER_ESP, guest_sysenter_esp), FIELD(GUEST_SYSENTER_EIP, guest_sysenter_eip), + FIELD(GUEST_S_CET, guest_s_cet), + FIELD(GUEST_SSP, guest_ssp), + FIELD(GUEST_INTR_SSP_TABLE, guest_ssp_tbl), FIELD(HOST_CR0, host_cr0), FIELD(HOST_CR3, host_cr3), FIELD(HOST_CR4, host_cr4), @@ -151,5 +154,8 @@ const unsigned short vmcs12_field_offsets[] =3D { FIELD(HOST_IA32_SYSENTER_EIP, host_ia32_sysenter_eip), FIELD(HOST_RSP, host_rsp), FIELD(HOST_RIP, host_rip), + FIELD(HOST_S_CET, host_s_cet), + FIELD(HOST_SSP, host_ssp), + FIELD(HOST_INTR_SSP_TABLE, host_ssp_tbl), }; const unsigned int nr_vmcs12_fields =3D ARRAY_SIZE(vmcs12_field_offsets); diff --git a/arch/x86/kvm/vmx/vmcs12.h b/arch/x86/kvm/vmx/vmcs12.h index 56fd150a6f24..4ad6b16525b9 100644 --- a/arch/x86/kvm/vmx/vmcs12.h +++ b/arch/x86/kvm/vmx/vmcs12.h @@ -117,7 +117,13 @@ struct __packed vmcs12 { natural_width host_ia32_sysenter_eip; natural_width host_rsp; natural_width host_rip; - natural_width paddingl[8]; /* room for future expansion */ + natural_width host_s_cet; + natural_width host_ssp; + natural_width host_ssp_tbl; + natural_width guest_s_cet; + natural_width guest_ssp; + natural_width guest_ssp_tbl; + natural_width paddingl[2]; /* room for future expansion */ u32 pin_based_vm_exec_control; u32 cpu_based_vm_exec_control; u32 exception_bitmap; @@ -294,6 +300,12 @@ static inline void vmx_check_vmcs12_offsets(void) CHECK_OFFSET(host_ia32_sysenter_eip, 656); CHECK_OFFSET(host_rsp, 664); CHECK_OFFSET(host_rip, 672); + CHECK_OFFSET(host_s_cet, 680); + CHECK_OFFSET(host_ssp, 688); + CHECK_OFFSET(host_ssp_tbl, 696); + CHECK_OFFSET(guest_s_cet, 704); + CHECK_OFFSET(guest_ssp, 712); + CHECK_OFFSET(guest_ssp_tbl, 720); CHECK_OFFSET(pin_based_vm_exec_control, 744); CHECK_OFFSET(cpu_based_vm_exec_control, 748); CHECK_OFFSET(exception_bitmap, 752); diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 820a2d1f3bd7..92daf63c9487 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -7750,6 +7750,8 @@ static void nested_vmx_cr_fixed1_bits_update(struct k= vm_vcpu *vcpu) cr4_fixed1_update(X86_CR4_PKE, ecx, feature_bit(PKU)); cr4_fixed1_update(X86_CR4_UMIP, ecx, feature_bit(UMIP)); cr4_fixed1_update(X86_CR4_LA57, ecx, feature_bit(LA57)); + cr4_fixed1_update(X86_CR4_CET, ecx, feature_bit(SHSTK)); + cr4_fixed1_update(X86_CR4_CET, edx, feature_bit(IBT)); =20 entry =3D kvm_find_cpuid_entry_index(vcpu, 0x7, 1); cr4_fixed1_update(X86_CR4_LAM_SUP, eax, feature_bit(LAM)); diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h index 08a9a0075404..ecfdba666465 100644 --- a/arch/x86/kvm/vmx/vmx.h +++ b/arch/x86/kvm/vmx/vmx.h @@ -181,6 +181,9 @@ struct nested_vmx { */ u64 pre_vmenter_debugctl; u64 pre_vmenter_bndcfgs; + u64 pre_vmenter_s_cet; + u64 pre_vmenter_ssp; + u64 pre_vmenter_ssp_tbl; =20 /* to migrate it to L1 if L2 writes to L1's CR8 directly */ int l1_tpr_threshold; --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 380D51D5AC6; Tue, 9 Sep 2025 09:40:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410811; cv=none; b=X0rFF+jflhj4AMvp7nF/nzTuYMNFK9bLazaWu5/+cQQKGB/yJkN7xbDbJOgij6bHjDp+ewA1IwMWc30b7rXswTDeOYQ6uh5AxlgXPqK/Ks1o8Wks273PhRMElfUOyVm9PbD5WAWNqegu1eEPtOHDwsVE7xcT/6ns7KTPEJAa7wc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410811; c=relaxed/simple; bh=wpvcrJHwYBLC5/dciOZjQsOznM/ZeVV2wM2oj/cDelA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KFVcJR/2z1v4DKFAMNmRHlM2xOQs2VOqCzR+K1mU6pDja7cTSxmaDVT7/DKzfSrpYqqVnRO4MsbxESqHOWvar17WnXjLftzIfdTdAtN+eiKsOGTqKyIIQDq+gMNxefKV0GbI+Q6QS2ZkR2WFeqyvAKU5uUAY45EACQ/UQl0/ODY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=YCm1OXhS; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="YCm1OXhS" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410809; x=1788946809; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=wpvcrJHwYBLC5/dciOZjQsOznM/ZeVV2wM2oj/cDelA=; b=YCm1OXhSEN5fSLNvT7SXMcgd/+YkrPmYgdDp0ZH/iprLYsDhlO5rpVBI dOBaoteZJIna2N7CmiMlXcd1F2pcBmwIp/6OK19bvifFXMMSfFJMOsAjB Oe75r6LQU+NTxPHOHS+GnOYqnS4JqprR7uCrZE//Rvi7Qu0j6QuxaWsZu zJMPaGt0GTzQKwi7AihP130V1eTCIcwgXlixXnC0jKjD+skCMJcyb31FU HZFWf5iNSibzVP2J3TLL5QbTz/382+HP6jo1Ieq1Rxg9BzdKA6Pys97d6 OAZYs6LRwBE+CefJXYdqfktQLhCHTMEjpOcCvtqAP7ILs3JxA+boB3Hxc g==; X-CSE-ConnectionGUID: F2eDeufRQBCr7KZD4TmrsQ== X-CSE-MsgGUID: PN0fOxfYT+u21T8nymWI7w== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307331" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307331" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:57 -0700 X-CSE-ConnectionGUID: NpBX9s3cSAmOB2EK1pFUAQ== X-CSE-MsgGUID: 5BZ5dLArRBqPMyAJQnHZfQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207442" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:57 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 19/22] KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET Date: Tue, 9 Sep 2025 02:39:50 -0700 Message-ID: <20250909093953.202028-20-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add consistency checks for CR4.CET and CR0.WP in guest-state or host-state area in the VMCS12. This ensures that configurations with CR4.CET set and CR0.WP not set result in VM-entry failure, aligning with architectural behavior. Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao --- arch/x86/kvm/vmx/nested.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index 51d69f368689..a73f38d7eea1 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -3111,6 +3111,9 @@ static int nested_vmx_check_host_state(struct kvm_vcp= u *vcpu, CC(!kvm_vcpu_is_legal_cr3(vcpu, vmcs12->host_cr3))) return -EINVAL; =20 + if (CC(vmcs12->host_cr4 & X86_CR4_CET && !(vmcs12->host_cr0 & X86_CR0_WP)= )) + return -EINVAL; + if (CC(is_noncanonical_msr_address(vmcs12->host_ia32_sysenter_esp, vcpu))= || CC(is_noncanonical_msr_address(vmcs12->host_ia32_sysenter_eip, vcpu))) return -EINVAL; @@ -3225,6 +3228,9 @@ static int nested_vmx_check_guest_state(struct kvm_vc= pu *vcpu, CC(!nested_guest_cr4_valid(vcpu, vmcs12->guest_cr4))) return -EINVAL; =20 + if (CC(vmcs12->guest_cr4 & X86_CR4_CET && !(vmcs12->guest_cr0 & X86_CR0_W= P))) + return -EINVAL; + if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) && (CC(!kvm_dr7_valid(vmcs12->guest_dr7)) || CC(!vmx_is_valid_debugctl(vcpu, vmcs12->guest_ia32_debugctl, false))= )) --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DBBD930DEBD; Tue, 9 Sep 2025 09:40:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410811; cv=none; b=Opw6vrx/faolncTh7HO9BdiHb3yLGRWfTTfvkXHlpMEnCasw9HtY0Pr/hMzjAYFkcx2DMvMu/qc3ozhNrGFFva7ofU1bYoytlXsVY/r2n00WY4q54ONrc7BFbnEGv1kprwiS9fbxfLc3I4N+N/z87M+hqoeq9JgZ/M1jPQKMHO4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410811; c=relaxed/simple; bh=Vt1W25kMMM3KRJ8+sJalaI7G/MYpJOo9TAJkv7Kgokc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=M9CMOVKhBL0vMZysD2ir8/R0tmfNnTs+qCo8VGmmcMG70ra6gOsaDAJN4aAWpOZDoypeEFs+/Twl487x0OKCyYFKhfwCuOJZw4RXZVBqbgJ+/hralaXpAzHq2STnX7vR817hLDOQxyMS/TJNDRf+XMBvOP8+CNqKYmdrNzWRDXg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=QqTA63FR; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="QqTA63FR" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410810; x=1788946810; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Vt1W25kMMM3KRJ8+sJalaI7G/MYpJOo9TAJkv7Kgokc=; b=QqTA63FRGsXQTmq+cIGnOcqiHrRdcktz/uXoNPn3NFNeLeidTg/4aomi xpj8zxKEmfoVEMCAyYKSFEm50+5v+zlCfMq09i6Jc22GbPdnrpXIsNEYv U57pbn4cK35VBYbkkDbf2N7nMI8YQZ4RWqd0pFVjfFjjkAQ7ZZ8O2c7tH 7RtH74gjoiFRJLGo5YliiMpsfoRE2W2UUAjmeappehJDQKdnsDgeOis+h fkWDBpHFudFGbJEsZXea0pi61SR4rwW2MmEaHHAY8xkLoMfjAMPl7WCoV V2nmQaskoPf92k677SBoRAdsxauNp9fqgIB2trBcsTJnIoOqgoa6vIPci Q==; X-CSE-ConnectionGUID: XZFIFDIhQhClWPfhZhLm/w== X-CSE-MsgGUID: k7XPq1Y8QA+AA7NryIKoJA== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307342" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307342" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:57 -0700 X-CSE-ConnectionGUID: M+6aGOsLTFCX5BPvzoicrg== X-CSE-MsgGUID: cCb8a3JJRFiMhXZxXLfUgg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207445" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:57 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 20/22] KVM: nVMX: Add consistency checks for CET states Date: Tue, 9 Sep 2025 02:39:51 -0700 Message-ID: <20250909093953.202028-21-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Introduce consistency checks for CET states during nested VM-entry. A VMCS contains both guest and host CET states, each comprising the IA32_S_CET MSR, SSP, and IA32_INTERRUPT_SSP_TABLE_ADDR MSR. Various checks are applied to CET states during VM-entry as documented in SDM Vol3 Chapter "VM ENTRIES". Implement all these checks during nested VM-entry to emulate the architectural behavior. In summary, there are three kinds of checks on guest/host CET states during VM-entry: A. Checks applied to both guest states and host states: * The IA32_S_CET field must not set any reserved bits; bits 10 (SUPPRESS) and 11 (TRACKER) cannot both be set. * SSP should not have bits 1:0 set. * The IA32_INTERRUPT_SSP_TABLE_ADDR field must be canonical. B. Checks applied to host states only * IA32_S_CET MSR and SSP must be canonical if the CPU enters 64-bit mode after VM-exit. Otherwise, IA32_S_CET and SSP must have their higher 32 bits cleared. C. Checks applied to guest states only: * IA32_S_CET MSR and SSP are not required to be canonical (i.e., 63:N-1 are identical, where N is the CPU's maximum linear-address width). But, bits 63:N of SSP must be identical. Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao --- arch/x86/kvm/vmx/nested.c | 47 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index a73f38d7eea1..edb3b877a0f6 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -3101,6 +3101,17 @@ static bool is_l1_noncanonical_address_on_vmexit(u64= la, struct vmcs12 *vmcs12) return !__is_canonical_address(la, l1_address_bits_on_exit); } =20 +static bool is_valid_cet_state(struct kvm_vcpu *vcpu, u64 s_cet, u64 ssp, = u64 ssp_tbl) +{ + if (!kvm_is_valid_u_s_cet(vcpu, s_cet) || !IS_ALIGNED(ssp, 4)) + return false; + + if (is_noncanonical_msr_address(ssp_tbl, vcpu)) + return false; + + return true; +} + static int nested_vmx_check_host_state(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12) { @@ -3170,6 +3181,26 @@ static int nested_vmx_check_host_state(struct kvm_vc= pu *vcpu, return -EINVAL; } =20 + if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_CET_STATE) { + if (CC(!is_valid_cet_state(vcpu, vmcs12->host_s_cet, vmcs12->host_ssp, + vmcs12->host_ssp_tbl))) + return -EINVAL; + + /* + * IA32_S_CET and SSP must be canonical if the host will + * enter 64-bit mode after VM-exit; otherwise, higher + * 32-bits must be all 0s. + */ + if (ia32e) { + if (CC(is_noncanonical_msr_address(vmcs12->host_s_cet, vcpu)) || + CC(is_noncanonical_msr_address(vmcs12->host_ssp, vcpu))) + return -EINVAL; + } else { + if (CC(vmcs12->host_s_cet >> 32) || CC(vmcs12->host_ssp >> 32)) + return -EINVAL; + } + } + return 0; } =20 @@ -3280,6 +3311,22 @@ static int nested_vmx_check_guest_state(struct kvm_v= cpu *vcpu, CC((vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD)))) return -EINVAL; =20 + if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_CET_STATE) { + if (CC(!is_valid_cet_state(vcpu, vmcs12->guest_s_cet, vmcs12->guest_ssp, + vmcs12->guest_ssp_tbl))) + return -EINVAL; + + /* + * Guest SSP must have 63:N bits identical, rather than + * be canonical (i.e., 63:N-1 bits identical), where N is + * the CPU's maximum linear-address width. Similar to + * is_noncanonical_msr_address(), use the host's + * linear-address width. + */ + if (CC(!__is_canonical_address(vmcs12->guest_ssp, max_host_virt_addr_bit= s() + 1))) + return -EINVAL; + } + if (nested_check_guest_non_reg_state(vmcs12)) return -EINVAL; =20 --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 97BDF30EF9F; Tue, 9 Sep 2025 09:40:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410812; cv=none; b=mfQeBcN+3dIecpXQqOM29XVVWOOdm1mivsVReV300cQjF5e7/luhfOc/ynd/auQ93IdJt+DQCO8crb5sxytWS/m/oSGR9R9nLHkgaE/doNE04CCn9d35GRiHhNadSnSWEVQ+SVv4hen4uruzBsaE2kyI7oJpYbNIMNnpO7vKahE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410812; c=relaxed/simple; bh=iMNuByi8uUQXki/9D3JvgGOvtVFo5mIZNHM2fuUZcK8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=r3sytwhbQYJovx8sGfOEhqNCj4efitKbzLGW9F0MRmeTcM7TypId5qHDTORhFOS0k8pKDeAJeDR5b907X2oeygY3tV9176UP4IEnweMUjLocvfOC9vs8Cm0T3pxsINZE4g08nA9yuBr/0XRS+VekHE76CAtaSMSENjRXfgtTMtQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=MQ6tERyi; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="MQ6tERyi" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410810; x=1788946810; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=iMNuByi8uUQXki/9D3JvgGOvtVFo5mIZNHM2fuUZcK8=; b=MQ6tERyiV/6zZJGQnfRgELBZCiNElSbX+2lT8kg0NrialCwNYQz3qOuL D+QsTDuwhRMVQJ7tPVINe4614P9xQ99D0gHHC6eDFk++V43KHn7TTQ4Rd xuFTGKUdHjZLmzQi+H8NJ9yEULkhYpBdAxMy1GjBHYA85a0B2xRI2mq+A FD/QNYpg7gbYW1FyBesAipCRdlA6rgWn5/Fa8SotBUYGh/ZhdsmElvTy+ 2nERa7gYYz9bjdXM6UCHLo0XMlZYDWSnAKfQygsmBKdN9/0qiArfq+Na6 UrgLt7tR9nu27j9wBIIlCMubFPFmR1WTbAbjXhfLQfjA3iG6ooxpgj6/S g==; X-CSE-ConnectionGUID: CLHDU/+qTiSa28DGmu/oKQ== X-CSE-MsgGUID: Dx2wShmrTjSCfjNPK6dMgA== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307353" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307353" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:57 -0700 X-CSE-ConnectionGUID: vAdhzwSiTdSYkK+UVdxoTQ== X-CSE-MsgGUID: qFUhYb5PT4mQOYvaNTuIGw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207448" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:58 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 21/22] KVM: nVMX: Advertise new VM-Entry/Exit control bits for CET state Date: Tue, 9 Sep 2025 02:39:52 -0700 Message-ID: <20250909093953.202028-22-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Advertise new VM-Entry/Exit control bits as all nested support for CET virtualization, including consistency checks, is in place. Signed-off-by: Chao Gao --- arch/x86/kvm/vmx/nested.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index edb3b877a0f6..d7e2fb30fc1a 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -7176,7 +7176,7 @@ static void nested_vmx_setup_exit_ctls(struct vmcs_co= nfig *vmcs_conf, VM_EXIT_HOST_ADDR_SPACE_SIZE | #endif VM_EXIT_LOAD_IA32_PAT | VM_EXIT_SAVE_IA32_PAT | - VM_EXIT_CLEAR_BNDCFGS; + VM_EXIT_CLEAR_BNDCFGS | VM_EXIT_LOAD_CET_STATE; msrs->exit_ctls_high |=3D VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR | VM_EXIT_LOAD_IA32_EFER | VM_EXIT_SAVE_IA32_EFER | @@ -7198,7 +7198,8 @@ static void nested_vmx_setup_entry_ctls(struct vmcs_c= onfig *vmcs_conf, #ifdef CONFIG_X86_64 VM_ENTRY_IA32E_MODE | #endif - VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_BNDCFGS; + VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_BNDCFGS | + VM_ENTRY_LOAD_CET_STATE; msrs->entry_ctls_high |=3D (VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR | VM_ENTRY_LOAD_IA32_EFER | VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL); --=20 2.47.3 From nobody Thu Oct 2 23:57:54 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 49D0F30F93D; Tue, 9 Sep 2025 09:40:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410813; cv=none; b=UNZOHjYzPtO45mYPJXFeuyZyd4Z9M4xeeX558qdqToHGOSXz21XauYSeYCgcHCdZg+UbhQjtViauAW3rbFZYzAmVJAFH+Q1GBTla+x9wYkPHR2BZWRGGNosvYsWg/d5b/xgaRjHyEdDs8gSTvyLFqb92IHZe1v1jQpOpC4+wGRI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757410813; c=relaxed/simple; bh=C9Z/c4AV0RFEEypMIxy3Os2G0EmIpfbOJH2XRkzjquw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=U9MoUzIErfqxICOaW5DPt7YvNHkQtRDfmQpaDmtAIqf/DWRrJpuz7gLXuIULBOL0pjELnKcnSnQwcLOoHS1D0poeTYDkxPefm//zehodGxoEnGk6/xFzAWnCoWKqIurQvap9qKYODax01CFm8xhhOqpIG8jPMgffr1ELJW29VaE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=W7s1gpEo; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="W7s1gpEo" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1757410811; x=1788946811; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=C9Z/c4AV0RFEEypMIxy3Os2G0EmIpfbOJH2XRkzjquw=; b=W7s1gpEoJjb5chzGPOKjhaC3U0YrrVLBvIr+x6AuHGy18frxYe++FJuz 897+h0cGaSumXO5kYDcyXd5EV1tiTRS4JjuyCNG6aBs9Vm1Clt9A8KuPl YgXs3Aj186Q7Gfwgsvnx5sg6fq+KDM+LHAVo3WJ1e77DlwVKAbsRZxSU7 3b1qP1T63mXFg1G0ISaa1MpVfMOmqpVGbSzCG/eSNktww4zdCHaLGG/rZ 3Ftv6Ry3IoisaNcUTeTgj65mOAGM7ipoEljDbh5iCuxGLHQh9ZpyO0pFn HXR2c6kqD6I4S0y79eYARWaUQl/PzFPE8NEz0ONEn5sSdYiV29CnYlp23 w==; X-CSE-ConnectionGUID: QhPHuvbpQa+EO2ezsp/ndA== X-CSE-MsgGUID: 8gsnMi3ZTk+EftPM8HOX4Q== X-IronPort-AV: E=McAfee;i="6800,10657,11547"; a="70307373" X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="70307373" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:58 -0700 X-CSE-ConnectionGUID: VpM5hPgBTQyIZMHKzcnnJw== X-CSE-MsgGUID: XE3ouerFThOfWh7chFL/rA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,251,1751266800"; d="scan'208";a="172207451" Received: from unknown (HELO CannotLeaveINTEL.jf.intel.com) ([10.165.54.94]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2025 02:39:58 -0700 From: Chao Gao To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: acme@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, john.allen@amd.com, mingo@kernel.org, mingo@redhat.com, minipli@grsecurity.net, mlevitsk@redhat.com, namhyung@kernel.org, pbonzini@redhat.com, prsampat@amd.com, rick.p.edgecombe@intel.com, seanjc@google.com, shuah@kernel.org, tglx@linutronix.de, weijiang.yang@intel.com, x86@kernel.org, xin@zytor.com, xiaoyao.li@intel.com Subject: [PATCH v14 22/22] KVM: selftest: Add tests for KVM_{GET,SET}_ONE_REG Date: Tue, 9 Sep 2025 02:39:53 -0700 Message-ID: <20250909093953.202028-23-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250909093953.202028-1-chao.gao@intel.com> References: <20250909093953.202028-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add tests for newly added KVM_{GET,SET}_ONE_REG support for x86. Verify the new ioctls can read and write real MSRs and synthetic MSRs. Signed-off-by: Chao Gao --- tools/arch/x86/include/uapi/asm/kvm.h | 29 ++++++++++++++++++ tools/testing/selftests/kvm/Makefile.kvm | 1 + .../selftests/kvm/x86/get_set_one_reg.c | 30 +++++++++++++++++++ 3 files changed, 60 insertions(+) create mode 100644 tools/testing/selftests/kvm/x86/get_set_one_reg.c diff --git a/tools/arch/x86/include/uapi/asm/kvm.h b/tools/arch/x86/include= /uapi/asm/kvm.h index 6f3499507c5e..59ac0b46ebcc 100644 --- a/tools/arch/x86/include/uapi/asm/kvm.h +++ b/tools/arch/x86/include/uapi/asm/kvm.h @@ -411,6 +411,35 @@ struct kvm_xcrs { __u64 padding[16]; }; =20 +#define KVM_X86_REG_TYPE_MSR 2 +#define KVM_X86_REG_TYPE_KVM 3 + +#define KVM_X86_KVM_REG_SIZE(reg) \ +({ \ + reg =3D=3D KVM_REG_GUEST_SSP ? KVM_REG_SIZE_U64 : 0; \ +}) + +#define KVM_X86_REG_TYPE_SIZE(type, reg) \ +({ \ + __u64 type_size =3D (__u64)type << 32; \ + \ + type_size |=3D type =3D=3D KVM_X86_REG_TYPE_MSR ? KVM_REG_SIZE_U64 : \ + type =3D=3D KVM_X86_REG_TYPE_KVM ? KVM_X86_KVM_REG_SIZE(reg) : \ + 0; \ + type_size; \ +}) + +#define KVM_X86_REG_ENCODE(type, index) \ + (KVM_REG_X86 | KVM_X86_REG_TYPE_SIZE(type, index) | index) + +#define KVM_X86_REG_MSR(index) \ + KVM_X86_REG_ENCODE(KVM_X86_REG_TYPE_MSR, index) +#define KVM_X86_REG_KVM(index) \ + KVM_X86_REG_ENCODE(KVM_X86_REG_TYPE_KVM, index) + +/* KVM-defined registers starting from 0 */ +#define KVM_REG_GUEST_SSP 0 + #define KVM_SYNC_X86_REGS (1UL << 0) #define KVM_SYNC_X86_SREGS (1UL << 1) #define KVM_SYNC_X86_EVENTS (1UL << 2) diff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selft= ests/kvm/Makefile.kvm index f6fe7a07a0a2..9a375d5faf1c 100644 --- a/tools/testing/selftests/kvm/Makefile.kvm +++ b/tools/testing/selftests/kvm/Makefile.kvm @@ -136,6 +136,7 @@ TEST_GEN_PROGS_x86 +=3D x86/max_vcpuid_cap_test TEST_GEN_PROGS_x86 +=3D x86/triple_fault_event_test TEST_GEN_PROGS_x86 +=3D x86/recalc_apic_map_test TEST_GEN_PROGS_x86 +=3D x86/aperfmperf_test +TEST_GEN_PROGS_x86 +=3D x86/get_set_one_reg TEST_GEN_PROGS_x86 +=3D access_tracking_perf_test TEST_GEN_PROGS_x86 +=3D coalesced_io_test TEST_GEN_PROGS_x86 +=3D dirty_log_perf_test diff --git a/tools/testing/selftests/kvm/x86/get_set_one_reg.c b/tools/test= ing/selftests/kvm/x86/get_set_one_reg.c new file mode 100644 index 000000000000..8a4dbc812214 --- /dev/null +++ b/tools/testing/selftests/kvm/x86/get_set_one_reg.c @@ -0,0 +1,30 @@ +// SPDX-License-Identifier: GPL-2.0 +#include +#include +#include + +#include "test_util.h" +#include "kvm_util.h" +#include "processor.h" + +int main(int argc, char *argv[]) +{ + struct kvm_vcpu *vcpu; + struct kvm_vm *vm; + u64 data; + + TEST_REQUIRE(kvm_has_cap(KVM_CAP_ONE_REG)); + + vm =3D vm_create_with_one_vcpu(&vcpu, NULL); + + TEST_ASSERT_EQ(__vcpu_get_reg(vcpu, KVM_X86_REG_MSR(MSR_EFER), &data), 0); + TEST_ASSERT_EQ(__vcpu_set_reg(vcpu, KVM_X86_REG_MSR(MSR_EFER), data), 0); + + if (kvm_cpu_has(X86_FEATURE_SHSTK)) { + TEST_ASSERT_EQ(__vcpu_get_reg(vcpu, KVM_X86_REG_KVM(KVM_REG_GUEST_SSP), = &data), 0); + TEST_ASSERT_EQ(__vcpu_set_reg(vcpu, KVM_X86_REG_KVM(KVM_REG_GUEST_SSP), = data), 0); + } + + kvm_vm_free(vm); + return 0; +} --=20 2.47.3