From: Sean Christopherson <seanjc@google.com>
To: Yang Weijiang <weijiang.yang@intel.com>
Cc: pbonzini@redhat.com, kvm@vger.kernel.org,
linux-kernel@vger.kernel.org, peterz@infradead.org,
rppt@kernel.org, binbin.wu@linux.intel.com,
rick.p.edgecombe@intel.com, john.allen@amd.com
Subject: Re: [PATCH v3 00/21] Enable CET Virtualization
Date: Thu, 15 Jun 2023 16:30:55 -0700 [thread overview]
Message-ID: <ZIufL7p/ZvxjXwK5@google.com> (raw)
In-Reply-To: <20230511040857.6094-1-weijiang.yang@intel.com>
On Thu, May 11, 2023, Yang Weijiang wrote:
> The last patch is introduced to support supervisor SHSTK but the feature is
> not enabled on Intel platform for now, the main purpose of this patch is to
> facilitate AMD folks to enable the feature.
I am beyond confused by the SDM's wording of CET_SSS.
First, it says that CET_SSS says the CPU isn't buggy (or maybe "less buggy" is
more appropriate phrasing).
Bit 18: CET_SSS. If 1, indicates that an operating system can enable supervisor
shadow stacks as long as it ensures that certain supervisor shadow-stack pushes
will not cause page faults (see Section 17.2.3 of the Intel® 64 and IA-32
Architectures Software Developer’s Manual, Volume 1).
But then it says says VMMs shouldn't set the bit.
When emulating the CPUID instruction, a virtual-machine monitor should return
this bit as 0 if those pushes can cause VM exits.
Based on the Xen code (which is sadly a far better source of information than the
SDM), I *think* that what the SDM is trying to say is that VMMs should not set
CET_SS if VM-Exits can occur ***and*** the bit is not set in the host CPU. Because
if the SDM really means "VMMs should never set the bit", then what on earth is the
point of the bit.
> In summary, this new series enables CET user SHSTK/IBT and kernel IBT, but
> doesn't fully support CET supervisor SHSTK, the enabling work is left for
> the future.
Why? If my interpretation of the SDM is correct, then all the pieces are there.
> Executed all KVM-unit-test cases and KVM selftests against this series, all
> test cases passed except the vmx test, the failure is due to CR4_CET bit
> testing in test_vmxon_bad_cr(). After add CR4_CET bit to skip list, the test
> passed. I'll send a patch to fix this issue later.
Your cover letter from v2 back in April said the same thing. Why hasn't the patch
been posted? And what exactly is the issue? IIUC, setting CR4.CET with
MSR_IA32_S_CET=0 and MSR_IA32_U_CET=0 should be a nop, which suggests that there's
a KVM bug. And if that's the case, the next obvious questions is, why are you
posting known buggy code?
next prev parent reply other threads:[~2023-06-15 23:31 UTC|newest]
Thread overview: 99+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-11 4:08 [PATCH v3 00/21] Enable CET Virtualization Yang Weijiang
2023-05-11 4:08 ` [PATCH v3 01/21] x86/shstk: Add Kconfig option for shadow stack Yang Weijiang
2023-05-11 4:08 ` [PATCH v3 02/21] x86/cpufeatures: Add CPU feature flags for shadow stacks Yang Weijiang
2023-05-11 4:08 ` [PATCH v3 03/21] x86/cpufeatures: Enable CET CR4 bit for shadow stack Yang Weijiang
2023-05-11 4:08 ` [PATCH v3 04/21] x86/fpu/xstate: Introduce CET MSR and XSAVES supervisor states Yang Weijiang
2023-05-11 4:08 ` [PATCH v3 05/21] x86/fpu: Add helper for modifying xstate Yang Weijiang
2023-05-11 4:08 ` [PATCH v3 06/21] KVM:x86: Report XSS as to-be-saved if there are supported features Yang Weijiang
2023-05-24 7:06 ` Chao Gao
2023-05-24 8:19 ` Yang, Weijiang
2023-05-11 4:08 ` [PATCH v3 07/21] KVM:x86: Refresh CPUID on write to guest MSR_IA32_XSS Yang Weijiang
2023-05-25 6:10 ` Chao Gao
2023-05-30 3:51 ` Yang, Weijiang
2023-05-30 12:08 ` Chao Gao
2023-05-31 1:11 ` Yang, Weijiang
2023-06-15 23:45 ` Sean Christopherson
2023-06-16 1:58 ` Yang, Weijiang
2023-06-23 23:21 ` Sean Christopherson
2023-06-26 9:24 ` Yang, Weijiang
2023-05-11 4:08 ` [PATCH v3 08/21] KVM:x86: Init kvm_caps.supported_xss with supported feature bits Yang Weijiang
2023-06-06 8:38 ` Chao Gao
2023-06-08 5:42 ` Yang, Weijiang
2023-05-11 4:08 ` [PATCH v3 09/21] KVM:x86: Load guest FPU state when accessing xsaves-managed MSRs Yang Weijiang
2023-06-15 23:50 ` Sean Christopherson
2023-06-16 2:02 ` Yang, Weijiang
2023-05-11 4:08 ` [PATCH v3 10/21] KVM:x86: Add #CP support in guest exception classification Yang Weijiang
2023-06-06 9:08 ` Chao Gao
2023-06-08 6:01 ` Yang, Weijiang
2023-06-15 23:58 ` Sean Christopherson
2023-06-16 6:56 ` Yang, Weijiang
2023-06-16 18:57 ` Sean Christopherson
2023-06-19 9:28 ` Yang, Weijiang
2023-06-30 9:34 ` Yang, Weijiang
2023-06-30 10:27 ` Chao Gao
2023-06-30 12:05 ` Yang, Weijiang
2023-06-30 15:05 ` Neiger, Gil
2023-06-30 15:15 ` Sean Christopherson
2023-07-01 1:58 ` Yang, Weijiang
2023-07-01 1:54 ` Yang, Weijiang
2023-06-30 15:07 ` Sean Christopherson
2023-06-30 15:21 ` Neiger, Gil
2023-07-01 1:57 ` Yang, Weijiang
2023-05-11 4:08 ` [PATCH v3 11/21] KVM:VMX: Introduce CET VMCS fields and control bits Yang Weijiang
2023-05-11 4:08 ` [PATCH v3 12/21] KVM:x86: Add fault checks for guest CR4.CET setting Yang Weijiang
2023-06-06 11:03 ` Chao Gao
2023-06-08 6:06 ` Yang, Weijiang
2023-05-11 4:08 ` [PATCH v3 13/21] KVM:VMX: Emulate reads and writes to CET MSRs Yang Weijiang
2023-05-23 8:21 ` Binbin Wu
2023-05-24 2:49 ` Yang, Weijiang
2023-06-23 23:53 ` Sean Christopherson
2023-06-26 14:05 ` Yang, Weijiang
2023-06-26 21:15 ` Sean Christopherson
2023-06-27 3:32 ` Yang, Weijiang
2023-06-27 14:55 ` Sean Christopherson
2023-06-28 1:42 ` Yang, Weijiang
2023-07-07 9:10 ` Yang, Weijiang
2023-07-07 15:28 ` Neiger, Gil
2023-07-12 16:42 ` Sean Christopherson
2023-05-11 4:08 ` [PATCH v3 14/21] KVM:VMX: Add a synthetic MSR to allow userspace to access GUEST_SSP Yang Weijiang
2023-05-23 8:57 ` Binbin Wu
2023-05-24 2:55 ` Yang, Weijiang
2023-05-11 4:08 ` [PATCH v3 15/21] KVM:x86: Report CET MSRs as to-be-saved if CET is supported Yang Weijiang
2023-05-11 4:08 ` [PATCH v3 16/21] KVM:x86: Save/Restore GUEST_SSP to/from SMM state save area Yang Weijiang
2023-06-23 22:30 ` Sean Christopherson
2023-06-26 8:59 ` Yang, Weijiang
2023-06-26 21:20 ` Sean Christopherson
2023-06-27 3:50 ` Yang, Weijiang
2023-05-11 4:08 ` [PATCH v3 17/21] KVM:VMX: Pass through user CET MSRs to the guest Yang Weijiang
2023-05-11 4:08 ` [PATCH v3 18/21] KVM:x86: Enable CET virtualization for VMX and advertise to userspace Yang Weijiang
2023-05-24 6:35 ` Chenyi Qiang
2023-05-24 8:07 ` Yang, Weijiang
2023-05-11 4:08 ` [PATCH v3 19/21] KVM:nVMX: Enable user CET support for nested VMX Yang Weijiang
2023-05-11 4:08 ` [PATCH v3 20/21] KVM:x86: Enable kernel IBT support for guest Yang Weijiang
2023-06-24 0:03 ` Sean Christopherson
2023-06-26 12:10 ` Yang, Weijiang
2023-06-26 20:50 ` Sean Christopherson
2023-06-27 1:53 ` Yang, Weijiang
2023-05-11 4:08 ` [PATCH v3 21/21] KVM:x86: Support CET supervisor shadow stack MSR access Yang Weijiang
2023-06-15 23:30 ` Sean Christopherson [this message]
2023-06-16 0:00 ` [PATCH v3 00/21] Enable CET Virtualization Sean Christopherson
2023-06-16 1:00 ` Yang, Weijiang
2023-06-16 8:25 ` Yang, Weijiang
2023-06-16 17:56 ` Sean Christopherson
2023-06-19 6:41 ` Yang, Weijiang
2023-06-23 20:51 ` Sean Christopherson
2023-06-26 6:46 ` Yang, Weijiang
2023-07-17 7:44 ` Yang, Weijiang
2023-07-19 19:41 ` Sean Christopherson
2023-07-19 20:26 ` Sean Christopherson
2023-07-20 1:58 ` Yang, Weijiang
2023-07-19 20:36 ` Peter Zijlstra
2023-07-20 5:26 ` Pankaj Gupta
2023-07-20 8:03 ` Peter Zijlstra
2023-07-20 8:09 ` Peter Zijlstra
2023-07-20 9:14 ` Pankaj Gupta
2023-07-20 10:46 ` Andrew Cooper
2023-07-20 1:55 ` Yang, Weijiang
2023-07-10 0:28 ` Yang, Weijiang
2023-07-10 22:18 ` Sean Christopherson
2023-07-11 1:24 ` Yang, Weijiang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZIufL7p/ZvxjXwK5@google.com \
--to=seanjc@google.com \
--cc=binbin.wu@linux.intel.com \
--cc=john.allen@amd.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=rick.p.edgecombe@intel.com \
--cc=rppt@kernel.org \
--cc=weijiang.yang@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox