Received-SPF: pass (google.com: domain of linux-kernel+bounces-39663-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Date: Fri, 26 Jan 2024 14:31:43 +0800
From: Chao Gao <chao.gao@intel.com>
To: Yang Weijiang <weijiang.yang@intel.com>
CC: <seanjc@google.com>, <pbonzini@redhat.com>, <dave.hansen@intel.com>,
	<kvm@vger.kernel.org>, <linux-kernel@vger.kernel.org>, <x86@kernel.org>,
	<yuan.yao@linux.intel.com>, <peterz@infradead.org>,
	<rick.p.edgecombe@intel.com>, <mlevitsk@redhat.com>, <john.allen@amd.com>
Subject: Re: [PATCH v9 23/27] KVM: VMX: Set host constant supervisor states
 to VMCS fields
Message-ID: <ZbNRz/c207HYuHxi@chao-email>
References: <20240124024200.102792-1-weijiang.yang@intel.com>
 <20240124024200.102792-24-weijiang.yang@intel.com>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20240124024200.102792-24-weijiang.yang@intel.com>
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?+oFGFpfRkqrvw9obSmo/szy8vFnJLUoju5Bdgmnl6/H0VKx7/9C/jzjY4Qi+?=
 =?us-ascii?Q?zaSJ+WywJmY0Pa+iQZCGsj3F8NxHS2PZg7pe7Tx3i6tPgqztfxocj50s+bju?=
 =?us-ascii?Q?viJ2jw4MqxLoaYBI9Cw1PZPTvE3iBhqauBWQj4xhMCNlfp5XN6XNVKOEujnJ?=
 =?us-ascii?Q?iXHgHTxxcxjeo/4aqSzIEeBmdzixGQfb8iUpdl7wKVSzoficcyjJjIJKRQLP?=
 =?us-ascii?Q?Sh/N9xj9iZyL0HyCmrqD+3H9AJq3jpkedEz6WuefZMS5oXZrF+um536xJBx3?=
 =?us-ascii?Q?Adglp+iE7amfkUrrl80NkeWhN+jzWc20frVvLyjyr8wGj417Aqt/2xVKYFtz?=
 =?us-ascii?Q?irbtWiFhBeE5JtSi3MGkqdhqkeZImq2HBUGUcyQkliy/KA2vh8KiVvTWID0o?=
 =?us-ascii?Q?ALXTgVUN6gi+STEtiGccS2b21bFu1KcaeLb0SYcLkfi49MqiwvmE7pBvoJaG?=
 =?us-ascii?Q?a0NThaB1jed2LdoN9r4nm8cs0odqnKZyvja5iZe7YugmQb1vJOl9Zizy1KDf?=
 =?us-ascii?Q?Fgw5Z9nJ+FbXpVhuU5c9Z1ViLonE6aKezKjlHqeqvqHDHe71CjyaCZJ0+/5b?=
 =?us-ascii?Q?Jlexq/OeJplcDBBaszMPezmmY2wDoMKGIkdW7r2mA1qxPBvG0sz9XZSn2zBP?=
 =?us-ascii?Q?mLIPf/cu2WgFOLoCDW3iEzomeX9dU636z1XBEvYKs36KrXiPpnASn1hO5CfH?=
 =?us-ascii?Q?X1SKInNJoez92xHNRXnsmrr9SiKq9tCtY7n7ktEv5rMh67edMs+YR4o6dTsp?=
 =?us-ascii?Q?zbc2yHvry7YoBCSisPjo0cU9kOuqXSyKl/PzX+XeCDlbSTtVO9NMjhNbXRp7?=
 =?us-ascii?Q?Z/LpS9he3frONy7lzIrulFpeVdBh+nS7nluyyRFFu7N8j4EOTtNl/eYIpcDo?=
 =?us-ascii?Q?NM2RonJrHv/xzgyzj7ZCWmfK2ajhcd3l6ILPHwYWn7nYnrXZ2O7/29SMmq6p?=
 =?us-ascii?Q?LJR5XsTyyPgBeK8K9Jko1z9l1vmCXICh66GM/Vc0/PdzAAVvtS+DWUVrbK0o?=
 =?us-ascii?Q?RuH5Y8qiffKYIGiilLagZf+fNyZFIF+ECvjNnmHP42FnzPD4fAYWmsA5259o?=
 =?us-ascii?Q?R6jPzyJsoCOO50/cY0G6mhCmMTLmQigY4QoFwTsqSO7fffV5327cIXrmjOjM?=
 =?us-ascii?Q?lgpivEDPqMQQ54jZxhcUKl2lOy7Hz1U+X9d5vGjCGbrODV7c+l9vacz3MP6+?=
 =?us-ascii?Q?/hRNkgdCSl73i5dQS9eoBzrsyx5mMGc7CQtVyiErjFY5ghuA1PhszMxmkteZ?=
 =?us-ascii?Q?dEYVowzhquVsh9nZ2nF+wDj3thpWHYo89FG6BiB1v45QAEb98E8RUb+PA/uW?=
 =?us-ascii?Q?dl3FJ/zBlTfSzvfjpszrT12YTkSVE8qkEE12fRL0O7fNFFYc7Gov5R0tdjEO?=
 =?us-ascii?Q?cFofXXWV9/VPu7RwzxPD/Nk+1qIyspux52G5xvSN3mQxeuMhNzJDB5l3d/pn?=
 =?us-ascii?Q?IeFjiEi5f6C6BidK3xByz9J7cM62pzOSDr12pC0jWMiiC3E+dVL+3au8RgvB?=
 =?us-ascii?Q?aPYXN6PW69eGn2H38mXCV1NynOickhqy94B5ZVCCZSvfnHKmBhWCS9AdQLNO?=
 =?us-ascii?Q?9tU415oUybBItBxiMrwsreY90NxbIJRp9Rq8oy67?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 87ce12a1-fb82-45d9-68c0-08dc1e387c86
X-MS-Exchange-CrossTenant-AuthSource: CH3PR11MB8660.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jan 2024 06:31:55.1627
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: k8W3I4+nzxhlNmSgB5z6RiSKio0tAvRG5l0uwidRu6GUNYelcYAdpls2uW9Z41keimC6nj/LA993SbfnXNy3EA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW6PR11MB8391
X-OriginatorOrg: intel.com

On Tue, Jan 23, 2024 at 06:41:56PM -0800, Yang Weijiang wrote:
>Save constant values to HOST_{S_CET,SSP,INTR_SSP_TABLE} field explicitly.
>Kernel IBT is supported and the setting in MSR_IA32_S_CET is static after
>post-boot(The exception is BIOS call case but vCPU thread never across it)
>and KVM doesn't need to refresh HOST_S_CET field before every VM-Enter/
>VM-Exit sequence.
>
>Host supervisor shadow stack is not enabled now and SSP is not accessible
>to kernel mode, thus it's safe to set host IA32_INT_SSP_TAB/SSP VMCS field
>to 0s. When shadow stack is enabled for CPL3, SSP is reloaded from PL3_SSP
>before it exits to userspace. Check SDM Vol 2A/B Chapter 3/4 for SYSCALL/
>SYSRET/SYSENTER SYSEXIT/RDSSP/CALL etc.
>
>Prevent KVM module loading if host supervisor shadow stack SHSTK_EN is set
>in MSR_IA32_S_CET as KVM cannot co-exit with it correctly.
>
>Suggested-by: Sean Christopherson <seanjc@google.com>
>Suggested-by: Chao Gao <chao.gao@intel.com>
>Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
>Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>

Reviewed-by: Chao Gao <chao.gao@intel.com>

two nits below.

>---
> arch/x86/kvm/vmx/capabilities.h |  4 ++++
> arch/x86/kvm/vmx/vmx.c          | 15 +++++++++++++++
> arch/x86/kvm/x86.c              | 14 ++++++++++++++
> arch/x86/kvm/x86.h              |  1 +
> 4 files changed, 34 insertions(+)
>
>diff --git a/arch/x86/kvm/vmx/capabilities.h b/arch/x86/kvm/vmx/capabilities.h
>index 41a4533f9989..ee8938818c8a 100644
>--- a/arch/x86/kvm/vmx/capabilities.h
>+++ b/arch/x86/kvm/vmx/capabilities.h
>@@ -106,6 +106,10 @@ static inline bool cpu_has_load_perf_global_ctrl(void)
> 	return vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
> }
> 
>+static inline bool cpu_has_load_cet_ctrl(void)

s/cet_ctrl/cet_state

>+{
>+	return (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_CET_STATE);

nit: unnecessary brackets.