Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 4 Aug 2023 16:23:47 +0800
From:   Chao Gao <chao.gao@intel.com>
To:     Yang Weijiang <weijiang.yang@intel.com>
CC:     <seanjc@google.com>, <pbonzini@redhat.com>, <peterz@infradead.org>,
        <john.allen@amd.com>, <kvm@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>, <rick.p.edgecombe@intel.com>,
        <binbin.wu@linux.intel.com>
Subject: Re: [PATCH v5 14/19] KVM:VMX: Set host constant supervisor states to
 VMCS fields
Message-ID: <ZMy1k+5qDTDULWW/@chao-email>
References: <20230803042732.88515-1-weijiang.yang@intel.com>
 <20230803042732.88515-15-weijiang.yang@intel.com>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20230803042732.88515-15-weijiang.yang@intel.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?PWG2Gh0Fe45KZ3men2ZRW7Pp/mAqJh5eHmHEWPHRyLS0sB1j7C5x6Ot0B3yu?=
 =?us-ascii?Q?mwikTU7QG0F7Bmzr0U542re/u9gO7nAdyDdFWG+0m+lOw+Weu8AKTnSjpcTz?=
 =?us-ascii?Q?+SrXCjkMmEyQHjuWLyaeJW2qkGuxHItvzlPzg6NS2y/OEesxERr1mWmZtpyr?=
 =?us-ascii?Q?kkGvnuxd8wBOrakznrtAS8P/ij9ElX3s5ng2nFJy0bepzR2E5mTZs3ZUCWFU?=
 =?us-ascii?Q?+1Zt3/HOIXT2JWCCxANoxkDV12z+xdy0ObkhTkXxfpUC08z4NyJ8qnjmKNWB?=
 =?us-ascii?Q?4I4cxIRHqtdhlZ6Lfwk9C4EpvAClWXzCXvq5jFb01II9mXMkB5KJ7o23Pbbe?=
 =?us-ascii?Q?frAKMNVKxA2XU8NwlpnT7ESzB4wdSHWD/TCMBRktoG5pxrq6AoJr63w8U++z?=
 =?us-ascii?Q?8B+Wye4HXENirq0kbVhQIjglTlKIwD1cscJTIz9+5H+J9xMHIaOO4tPbQyq7?=
 =?us-ascii?Q?vOHKCFgG8VMxp+V7vbZ2DJ/kENdM6pS6n9JWY+U53Qhxe/yDdwniOwZQ0vQQ?=
 =?us-ascii?Q?z3dpqK0RfhPyIAY6TDbXvcNTOAp5dnuXaqQ/bnuIepZqNJZgWGqx+eZlMJtL?=
 =?us-ascii?Q?czTg4BgTbMvC2Pwt4IeW+uCVPpuW53dQQct+2Yvav3q1Z7RjhILAjnSo4/Bj?=
 =?us-ascii?Q?oP/5+FsXgJRo1IqrFjgjHDK3SKOx4ux4G9iHivkvCap3RRcDiEz4U5H0VWFg?=
 =?us-ascii?Q?ZpZywxiGR3+SuqH561vx5cNGqlhbioHEM3H1HVtqBc16pZr1oAUsmzVg88Es?=
 =?us-ascii?Q?tD+kwOPblBpmUWPJBbk5st8y4VmU+jZ5WPtJFJUIPK2VbaG6PJsTMMqANSqv?=
 =?us-ascii?Q?VumlHNXo2DJQ8UYAti9YFmP0dTxqFgJEY3Sr8UqA42WNR4LjLzkZu5z1Iwii?=
 =?us-ascii?Q?n0JvsluLMnNJZmFfMZ1ZVYY2ZEhtzAKzIVOXsIeBwP26SBqRIb83b0n4T9+U?=
 =?us-ascii?Q?JbI/dDGbLykCQg785O8JmFrWPfWuxgRvmzNK5BH0u5erQTd5hYslwbHXwQ9J?=
 =?us-ascii?Q?xLPKI/Nm7/Fx7AKTz2GVIlRP3HOZWBw8AyzaQQ1LamVmHSvd2GBcYdCDv5Q+?=
 =?us-ascii?Q?LtEJVBzfBsiGGe2WKhjBrWhfJsOp9Piq8CjCebvmYT1umUDec69TtFsF9Iql?=
 =?us-ascii?Q?L3bEDkrdhqUnJZ5wJH5vzufxnLkQ7HXb5brkBjA5D8w/u9SHVGyaQl0HpLn4?=
 =?us-ascii?Q?KjxsUUP0QBkPyS8ZJcF4XMPSALkE+rbJsrKysY0ZKQkw2NJ2sBUSXC1/E0bV?=
 =?us-ascii?Q?Q7eciLchg+6nCCxrDhUC+f+v/H6OlMOm8ysFwvK/2uTmK3nGfCSw0TsHNfde?=
 =?us-ascii?Q?6ocmC48ivqVKKm9PQXTxiNxxZ8taY+YsJc/dAThDguzBha2Y5fEtiNykf+X1?=
 =?us-ascii?Q?Mj9V3PtdX1mO1tfdqt/TcKbEZCRtFRh9xoac5wsOVc8FKvFrcGX93r2AhuhT?=
 =?us-ascii?Q?cTJeWmUKceA11o4ZUdm2nu65XnSw8orN56e+AbrDKUA3Ct2ML0/+k9aagjH0?=
 =?us-ascii?Q?RcaFcV8Q2yD2VmMeVrnX8B4iLc0dvxyLXyYISBYmRWXvH0FJzRH5UcaW5ULZ?=
 =?us-ascii?Q?o6AmGzeBa2AFa26+5H2TluNMGMqFJl4CXDE+rE+c?=
X-MS-Exchange-CrossTenant-Network-Message-Id: fafa1dd9-489b-44a4-a86b-08db94c426c0
X-MS-Exchange-CrossTenant-AuthSource: PH8PR11MB6780.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Aug 2023 08:23:58.8975
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: VqoBGoMBMd2lLISHlGQnIfa4p7Iwl29vvolztmTUrexEjXaWsNbhJPGw4N72/SIO5yn+OyFNj3NABfQXX3QuqA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ1PR11MB6225
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,
        SPF_NONE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, Aug 03, 2023 at 12:27:27AM -0400, Yang Weijiang wrote:
>Set constant values to HOST_{S_CET,SSP,INTR_SSP_TABLE} VMCS
>fields explicitly. Kernel IBT is supported and the setting in
>MSR_IA32_S_CET is static after post-boot(except is BIOS call
>case but vCPU thread never across it.), i.e. KVM doesn't need
>to refresh HOST_S_CET field before every VM-Enter/VM-Exit
>sequence.
>
>Host supervisor shadow stack is not enabled now and SSP is not
>accessible to kernel mode, thus it's safe to set host IA32_INT_
>SSP_TAB/SSP VMCS fields to 0s. When shadow stack is enabled for
>CPL3, SSP is reloaded from IA32_PL3_SSP before it exits to userspace.
>Check SDM Vol 2A/B Chapter 3/4 for SYSCALL/SYSRET/SYSENTER SYSEXIT/
>RDSSP/CALL etc.
>
>Prevent KVM module loading and if host supervisor shadow stack
>SHSTK_EN is set in MSR_IA32_S_CET as KVM cannot co-exit with it
>correctly.
>
>Suggested-by: Sean Christopherson <seanjc@google.com>
>Suggested-by: Chao Gao <chao.gao@intel.com>
>Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>

Reviewed-by: Chao Gao <chao.gao@intel.com>