From: Yang Weijiang <weijiang.yang@intel.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Yang Weijiang <weijiang.yang@intel.com>,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
jmattson@google.com, yu.c.zhang@linux.intel.com,
Sean Christopherson <seanjc@google.com>
Subject: Re: [PATCH v14 10/13] KVM: x86: Enable CET virtualization for VMX and advertise CET to userspace
Date: Mon, 1 Feb 2021 12:56:48 +0800 [thread overview]
Message-ID: <20210201045648.GA14975@local-michael-cet-test.sh.intel.com> (raw)
In-Reply-To: <1cf7e501-2c69-8b76-9332-42db1348ab08@redhat.com>
On Fri, Jan 29, 2021 at 03:38:52PM +0100, Paolo Bonzini wrote:
> On 29/01/21 13:17, Yang Weijiang wrote:
> > > > It's specific to VM case, during VM reboot, memory mode reset but VM_ENTRY_LOAD_CET_STATE
> > > > is still set, and VMCS contains stale GUEST_SSP, this hits vm-entry failure
> > > > documented in 10.7 VM Entry at:
> > > > https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf
> > > > Since CR4.CET is also reset during VM reboot, to take the change to clear the stale data.
> > > > Maybe I need to find a better place to do the things.
> > > Then you must use a field of struct vmx_vcpu instead of the VMCS to hold
> > > GUEST_SSP (while GUEST_S_CET and GUEST_INTR_SSP_TABLE should not be an
> > > issue).
> > >
> > Sorry, I don't get your point, can I just clear the GUEST_SSP field in this case?
> > Anyway save/restore GUEST_SSP via VMCS is an efficient way.
>
> You cannot clear it, because it is preserved when CR4.CET is modified.
>
> However, I checked the latest SDM and the GUEST_SSP rules are changed to
> just this:
>
> SSP. The following checks are performed if the “load CET state” VM-entry
> control is 1
> — Bits 1:0 must be 0.
> — If the processor supports the Intel 64 architecture, bits 63:N must be
> identical, where N is the CPU’s maximum linear-address width. (This check
> does not apply if the processor supports 64 linear-address bits.) The guest
> SSP value is not required to be canonical; the value of bit N-1 may differ
> from that of bit N.
>
> In particular it doesn't mention the "IA-32e mode guest" VM-entry control or
> the CS.L bit anymore, so it should not be necessary anymore to even reset
> SSP to 0, and you can keep GUEST_SSP in the VMCS.
>
The vm-entry failure issue is due to mismatch of MSR_KVM_GUEST_SSP between QEMU and KVM.
The original code is occupied by other usage, so QEMU cannot reset it properly.
Sorry for the noise!
> Paolo
next prev parent reply other threads:[~2021-02-01 4:46 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-06 1:16 [PATCH v14 00/13] Introduce support for guest CET feature Yang Weijiang
2020-11-06 1:16 ` [PATCH v14 01/13] KVM: x86: Report XSS as an MSR to be saved if there are supported features Yang Weijiang
2020-11-06 1:16 ` [PATCH v14 02/13] KVM: x86: Refresh CPUID on writes to MSR_IA32_XSS Yang Weijiang
2020-11-06 1:16 ` [PATCH v14 03/13] KVM: x86: Add #CP support in guest exception dispatch Yang Weijiang
2020-11-06 1:16 ` [PATCH v14 04/13] KVM: VMX: Introduce CET VMCS fields and flags Yang Weijiang
2020-11-06 1:16 ` [PATCH v14 05/13] KVM: x86: Add fault checks for CR4.CET Yang Weijiang
2020-11-09 10:44 ` kernel test robot
2020-11-06 1:16 ` [PATCH v14 06/13] KVM: x86: Load guest fpu state when accessing MSRs managed by XSAVES Yang Weijiang
2020-11-06 1:16 ` [PATCH v14 07/13] KVM: VMX: Emulate reads and writes to CET MSRs Yang Weijiang
2021-01-28 17:45 ` Paolo Bonzini
2021-01-29 8:07 ` Yang Weijiang
2020-11-06 1:16 ` [PATCH v14 08/13] KVM: VMX: Add a synthetic MSR to allow userspace VMM to access GUEST_SSP Yang Weijiang
2021-01-28 17:41 ` Paolo Bonzini
2021-01-28 17:42 ` Paolo Bonzini
2020-11-06 1:16 ` [PATCH v14 09/13] KVM: x86: Report CET MSRs as to-be-saved if CET is supported Yang Weijiang
2020-11-09 6:17 ` kernel test robot
2021-01-28 17:46 ` Paolo Bonzini
2021-01-29 8:08 ` Yang Weijiang
2020-11-06 1:16 ` [PATCH v14 10/13] KVM: x86: Enable CET virtualization for VMX and advertise CET to userspace Yang Weijiang
2020-11-09 7:23 ` kernel test robot
2021-01-28 17:53 ` Paolo Bonzini
[not found] ` <20210129112437.GA29715@local-michael-cet-test.sh.intel.com>
[not found] ` <68e288ee-6e09-36f1-a6c9-bed864eb7678@redhat.com>
[not found] ` <20210129121717.GA30243@local-michael-cet-test.sh.intel.com>
[not found] ` <1cf7e501-2c69-8b76-9332-42db1348ab08@redhat.com>
2021-01-30 6:32 ` Yang Weijiang
2021-02-01 4:56 ` Yang Weijiang [this message]
2020-11-06 1:16 ` [PATCH v14 11/13] KVM: VMX: Pass through CET MSRs to the guest when supported Yang Weijiang
2021-01-28 17:54 ` Paolo Bonzini
2021-01-28 18:04 ` Paolo Bonzini
2020-11-06 1:16 ` [PATCH v14 12/13] KVM: nVMX: Add helper to check the vmcs01 MSR bitmap for MSR pass-through Yang Weijiang
2020-11-06 1:16 ` [PATCH v14 13/13] KVM: nVMX: Enable CET support for nested VMX Yang Weijiang
2021-01-28 17:57 ` [PATCH v14 00/13] Introduce support for guest CET feature Paolo Bonzini
2021-01-28 18:04 ` Sean Christopherson
2021-01-28 18:06 ` Paolo Bonzini
2021-01-28 18:24 ` Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210201045648.GA14975@local-michael-cet-test.sh.intel.com \
--to=weijiang.yang@intel.com \
--cc=jmattson@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=yu.c.zhang@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox