Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <f894d23a-5c6a-d189-57ee-8f2bae0baf6b@intel.com>
Date:   Sun, 6 Aug 2023 17:22:53 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.13.0
Subject: Re: [PATCH v5 13/19] KVM:VMX: Set up interception for CET MSRs
Content-Language: en-US
To:     Chao Gao <chao.gao@intel.com>
CC:     <seanjc@google.com>, <pbonzini@redhat.com>, <peterz@infradead.org>,
        <john.allen@amd.com>, <kvm@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>, <rick.p.edgecombe@intel.com>,
        <binbin.wu@linux.intel.com>
References: <20230803042732.88515-1-weijiang.yang@intel.com>
 <20230803042732.88515-14-weijiang.yang@intel.com>
 <ZMyz2S8A4HqhPIfy@chao-email>
From:   "Yang, Weijiang" <weijiang.yang@intel.com>
In-Reply-To: <ZMyz2S8A4HqhPIfy@chao-email>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?cUQxTHVFTThBUTdHc3c3UzFYdWNSVlRJUk1JMmNrUnc5YjFFQWFNUWF4UnJ4?=
 =?utf-8?B?bDhtQXd1cjR1ajhkNkRhR084Lzh5YzVhWFNXdmVleVY0RElIMFM4cDQyUXll?=
 =?utf-8?B?NEpjMU8xNzdSakFDYVovbWVVVXd4ckNFQXFjdTUycGF0aUlXVGFmbXUvMHlT?=
 =?utf-8?B?aVhlRHI1NG5mZm1vNjU5b3dZMmRKZ1B2c1YxMDJSbk5YOWtvSUViRTYydlNm?=
 =?utf-8?B?RlNlbERESGE3R0JVRFNJYmZmOWxiaGsrdy9rMk1USFkza1BCNXRSU1VJM2pY?=
 =?utf-8?B?UTNuN2ZrWU1KSFNHVUpMRHo1Sm9iWmVLenhtTFJOWlh6MWhXTG5qdmpnejdO?=
 =?utf-8?B?c2pPaEk5RGNKaTJ2dmFHclFUcmo5Z2xML1gyb0JDa1VvZ08ycXdkY3VhMUlC?=
 =?utf-8?B?b21FWW1VZzJTNGdjSDNuRktHK0ZkTlBZdmpNdUx2eEI4UkZjc0pMK3I1dzVa?=
 =?utf-8?B?TDk2MkNWbE9BUWo3dDl0Z1RZaXVGWjFJUkhlY2o0a1FDTUZCMGkxNFJWbXA0?=
 =?utf-8?B?M0F1WHk1TndhWU9WZEo1UldtZ01MRzhVSC9UZ0licWRZNDhvcXJpR0RWRjQ4?=
 =?utf-8?B?WVpsVVc1dzRvL25nOVhGNjZBZUQ0Zm5CL1dPTXZRK1NEejc0WWFkNkJ2Yldy?=
 =?utf-8?B?UEFzZHRKZHNVK1dYZDBQSFl4ZmpJbW5oYmRDd0ozcWxDQkZ1OXNULzhINmlS?=
 =?utf-8?B?SFlXdUNEZHptRjQvNUQvS3BBVit0bXdPR3JsMy9ZRTAxcVAxaUtpTWZKcnZw?=
 =?utf-8?B?bE9ZS2ZMYzRucGNGWlZCbGF6L2ltaUtSbzI5Zkt5UkQ3UW1ZeXFtUlNmb2tO?=
 =?utf-8?B?MEt4YVJxZU05dlRXY0dGL3ZKYzljLzV0cjJlS3BsQ05FT29hVm84WWRtUzkz?=
 =?utf-8?B?MWVMUTFFV1RiY1VKZVlaclkvQzU3WUxoZHIyajY3eDRLVmhVT1NnNENscExy?=
 =?utf-8?B?bEFLOWMzaWlaQTlRY1prbFpYSWJ1c2F5TlQrU1A4SFJjOUp5VFZBUkNSN0l1?=
 =?utf-8?B?M0VLWEhqOExVR3kxbFRlVHVreENGRlc5ZXA0THBNU2N1RE5YRkQ4dDV5Vlh3?=
 =?utf-8?B?a1ZyMmk5cm1rT0NpL1VhSmdqL3pqSTRTRThEWFFLdzdzRFlRRnpadXNRZUN2?=
 =?utf-8?B?K01IcjVEQ0hWSk15S0RDTnNudWhlYkZsSzdFS0RXUUEvdlNBbUFvTDVTQXJQ?=
 =?utf-8?B?ckdkSUZrTUR1c1NkQVp4R042K1FyZDdBcjBJWW1KZVdLKzBpRCsyUDg4UXBn?=
 =?utf-8?B?NForY2g3MzdUcElHLy9pYk0vZ1NGbXlRaDBoZW1INEdFSkErdzZCL1ZsSlNG?=
 =?utf-8?B?Q3plcVVhZmF4UHI2clc2VDNFZ2tUeUprMDNWQ0lQejA0bGpadGRTVlVjamxj?=
 =?utf-8?B?UGhkbGFMWEk5cWViUmtwZ3NmeFFFZnJTNmpMMWYwb2ticXh5NWQ3NmJUYkFM?=
 =?utf-8?B?azBSS21EbkMyLzd5RjFxaDM4bDZUeTZTODJIYVJHcU5IN3VGVmVEZnZNSE15?=
 =?utf-8?B?UlN3Q1Y4UzVuNzBjdE1sMHdEYWQ4UmhZeldOVDFHQ2wvQldhb3UyVEtkWGFR?=
 =?utf-8?B?a1pqZk8wemo1MlhMdHN4Ti9nMXBBbjlCU0cwRms2bHBLVjJKb2pMZjRKUy9Q?=
 =?utf-8?B?N2NjM1ZxRXBYb0kvMktIVG55a3N3b05jVFlHenlBb0EveDZuTENFKzQ4RFZC?=
 =?utf-8?B?Z3NaUFlmL0gwRVdXYng0c2p0aHZjUmlLRlR3Mm1HanFTejVMVTJiSjBUNko5?=
 =?utf-8?B?NEhkVUw2Qi9pY1dwUzZIdzRhK0hLaHZjMERRSlFRR0ZKWktxMDdHN0gzTHFO?=
 =?utf-8?B?ZkdOMnRTZXliSFRyWUlJdEpGNFNuY3IrdG80WHRlMEVXek41QnBRdUdRZXhp?=
 =?utf-8?B?WVNHb05xbDdkN0M0ZkJaVFhrSnpjV09KUW0xMlFpSzVDNTRyL1NsNFdIWnpB?=
 =?utf-8?B?dWlJeE9SQWxwWXNEZFcxelA2YTRBa0lJOTVTUy9GMjEyd1BHempoZk9DR2hJ?=
 =?utf-8?B?Z2dFVXNldi9XWUhXWmkrQWpzM3lKL1FvdEZPT1cwWXVPRklTdk80b0tuMG9W?=
 =?utf-8?B?RTc5UmNjYTlDVlNPNVM3NnFtWXNPb01hQk43N2czTTg5THI2VVdzRCsxRWpH?=
 =?utf-8?B?Zi9PVkpJSDFsSk55cG0wWXB6WWtZR1Ztb0JURk9YTWsyT0JaSkFUUEVLSXly?=
 =?utf-8?B?YUE9PQ==?=
X-MS-Exchange-CrossTenant-Network-Message-Id: b3c86b37-b554-435a-9e54-08db965ebc6e
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4965.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Aug 2023 09:23:03.6474
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: KTUDTFfRS9LhJpb2UZyCMNVb68fllBEAVa4ME38JbY/YXaWVyDSzGLQiC8p9Me3k8JC0pnHcPIdNG857JQfeEg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA3PR11MB8120
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-6.2 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,
        RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 8/4/2023 4:16 PM, Chao Gao wrote:
> On Thu, Aug 03, 2023 at 12:27:26AM -0400, Yang Weijiang wrote:
>> Pass through CET MSRs when the associated feature is enabled.
>> Shadow Stack feature requires all the CET MSRs to make it
>> architectural support in guest. IBT feature only depends on
>> MSR_IA32_U_CET and MSR_IA32_S_CET to enable both user and
>> supervisor IBT. Note, This MSR design introduced an architectual
>> limitation of SHSTK and IBT control for guest, i.e., when SHSTK
>> is exposed, IBT is also available to guest from architectual level
>> since IBT relies on subset of SHSTK relevant MSRs.
>>
>> Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
> Reviewed-by: Chao Gao <chao.gao@intel.com>
>
> one nit below
Thanks!
> [...]
>> +
>> +	if (kvm_cpu_cap_has(X86_FEATURE_IBT)) {
>> +		incpt = !guest_can_use(vcpu, X86_FEATURE_IBT);
> can you use guest_can_use() or guest_cpuid_has() consistently?
Hmm, the inspiration actually came from Sean:
Re: [RFC PATCH v2 3/6] KVM: x86: SVM: Pass through shadow stack MSRs - Sean Christopherson (kernel.org) <https://lore.kernel.org/all/ZMk14YiPw9l7ZTXP@google.com/>
it would make the code more reasonable on non-CET platforms.
>> +
>> +		vmx_set_intercept_for_msr(vcpu, MSR_IA32_U_CET,
>> +					  MSR_TYPE_RW, incpt);
>> +		vmx_set_intercept_for_msr(vcpu, MSR_IA32_S_CET,
>> +					  MSR_TYPE_RW, incpt);
>> +	}
>> +}
>> +
>> static void vmx_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu)
>> {
>> 	struct vcpu_vmx *vmx = to_vmx(vcpu);
>> @@ -7814,6 +7853,8 @@ static void vmx_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu)
>>
>> 	/* Refresh #PF interception to account for MAXPHYADDR changes. */
>> 	vmx_update_exception_bitmap(vcpu);
>> +
>> +	vmx_update_intercept_for_cet_msr(vcpu);
>> }
>>
>> static u64 vmx_get_perf_capabilities(void)
>> -- 
>> 2.27.0
>>