* [PATCH 1/4] target/i386: Enable XSAVES support for user mode CET states
2023-04-21 4:12 [PATCH 0/4] Enable VMM userspace support for CET virtualization Yang Weijiang
@ 2023-04-21 4:12 ` Yang Weijiang
2023-04-21 4:12 ` [PATCH 2/4] target/i386: Add CET MSRs access interfaces Yang Weijiang
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Yang Weijiang @ 2023-04-21 4:12 UTC (permalink / raw)
To: pbonzini, mtosatti, seanjc, qemu-devel; +Cc: kvm, weijiang.yang
Add CET_U bit support in XSS MSR and report data size in CPUID.
XSAVES/XRSTORS are used to boost CET states save/restore process,
XSS[bit 11] corresponds to user mode CET states.
CET Shadow Stack(SHSTK) and Indirect Branch Tracking(IBT) features
are enumerated via CPUID.(EAX=07H,ECX=0H):ECX[7] and EDX[20]
respectively, two featues share the same bit for user mode states.
Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
---
target/i386/cpu.c | 39 +++++++++++++++++++++++++++++++--------
target/i386/cpu.h | 13 +++++++++++++
2 files changed, 44 insertions(+), 8 deletions(-)
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index cab1e2a957..be86df8c1d 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -943,7 +943,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
.feat_names = {
NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL,
- NULL, NULL, NULL, NULL,
+ NULL, NULL, NULL, "cet-u",
NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL,
@@ -1420,7 +1420,7 @@ static const X86RegisterInfo32 x86_reg_info_32[CPU_NB_REGS32] = {
#undef REGISTER
/* CPUID feature bits available in XSS */
-#define CPUID_XSTATE_XSS_MASK (XSTATE_ARCH_LBR_MASK)
+#define CPUID_XSTATE_XSS_MASK (XSTATE_ARCH_LBR_MASK | XSTATE_CET_U_MASK)
ExtSaveArea x86_ext_save_areas[XSAVE_STATE_AREA_COUNT] = {
[XSTATE_FP_BIT] = {
@@ -1438,7 +1438,7 @@ ExtSaveArea x86_ext_save_areas[XSAVE_STATE_AREA_COUNT] = {
.size = sizeof(XSaveAVX) },
[XSTATE_BNDREGS_BIT] =
{ .feature = FEAT_7_0_EBX, .bits = CPUID_7_0_EBX_MPX,
- .size = sizeof(XSaveBNDREG) },
+ .size = sizeof(XSaveBNDREG) },
[XSTATE_BNDCSR_BIT] =
{ .feature = FEAT_7_0_EBX, .bits = CPUID_7_0_EBX_MPX,
.size = sizeof(XSaveBNDCSR) },
@@ -1458,14 +1458,20 @@ ExtSaveArea x86_ext_save_areas[XSAVE_STATE_AREA_COUNT] = {
.feature = FEAT_7_0_EDX, .bits = CPUID_7_0_EDX_ARCH_LBR,
.offset = 0 /*supervisor mode component, offset = 0 */,
.size = sizeof(XSavesArchLBR) },
+ [XSTATE_CET_U_BIT] = {
+ .feature = FEAT_7_0_ECX, .bits = CPUID_7_0_ECX_CET_SHSTK,
+ /*
+ * The features enabled in XSS MSR always use compacted format
+ * to store the data, in this case .offset == 0.
+ */
+ .offset = 0,
+ .size = sizeof(XSavesCETU) },
[XSTATE_XTILE_CFG_BIT] = {
.feature = FEAT_7_0_EDX, .bits = CPUID_7_0_EDX_AMX_TILE,
- .size = sizeof(XSaveXTILECFG),
- },
+ .size = sizeof(XSaveXTILECFG) },
[XSTATE_XTILE_DATA_BIT] = {
.feature = FEAT_7_0_EDX, .bits = CPUID_7_0_EDX_AMX_TILE,
- .size = sizeof(XSaveXTILEDATA)
- },
+ .size = sizeof(XSaveXTILEDATA) }
};
uint32_t xsave_area_size(uint64_t mask, bool compacted)
@@ -6258,9 +6264,26 @@ static void x86_cpu_enable_xsave_components(X86CPU *cpu)
if (env->features[esa->feature] & esa->bits) {
mask |= (1ULL << i);
}
+
+ /*
+ * Both CET SHSTK and IBT feature requires XSAVES support, but two
+ * features can be controlled independently by kernel, and we only
+ * have one correlated bit set in x86_ext_save_areas, so if either
+ * of two features is enabled, we set the XSAVES support bit to make
+ * the enabled feature work.
+ */
+ if (i == XSTATE_CET_U_BIT) {
+ uint64_t ecx = env->features[FEAT_7_0_ECX];
+ uint64_t edx = env->features[FEAT_7_0_EDX];
+
+ if ((ecx & CPUID_7_0_ECX_CET_SHSTK) ||
+ (edx & CPUID_7_0_EDX_CET_IBT)) {
+ mask |= (1ULL << i);
+ }
+ }
}
- /* Only request permission for first vcpu */
+ /* Only request permission from fisrt vcpu. */
if (kvm_enabled() && !request_perm) {
kvm_request_xsave_components(cpu, mask);
request_perm = true;
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index d243e290d3..6526a03206 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -554,6 +554,7 @@ typedef enum X86Seg {
#define XSTATE_ZMM_Hi256_BIT 6
#define XSTATE_Hi16_ZMM_BIT 7
#define XSTATE_PKRU_BIT 9
+#define XSTATE_CET_U_BIT 11
#define XSTATE_ARCH_LBR_BIT 15
#define XSTATE_XTILE_CFG_BIT 17
#define XSTATE_XTILE_DATA_BIT 18
@@ -567,6 +568,7 @@ typedef enum X86Seg {
#define XSTATE_ZMM_Hi256_MASK (1ULL << XSTATE_ZMM_Hi256_BIT)
#define XSTATE_Hi16_ZMM_MASK (1ULL << XSTATE_Hi16_ZMM_BIT)
#define XSTATE_PKRU_MASK (1ULL << XSTATE_PKRU_BIT)
+#define XSTATE_CET_U_MASK (1ULL << XSTATE_CET_U_BIT)
#define XSTATE_ARCH_LBR_MASK (1ULL << XSTATE_ARCH_LBR_BIT)
#define XSTATE_XTILE_CFG_MASK (1ULL << XSTATE_XTILE_CFG_BIT)
#define XSTATE_XTILE_DATA_MASK (1ULL << XSTATE_XTILE_DATA_BIT)
@@ -841,6 +843,8 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
#define CPUID_7_0_ECX_WAITPKG (1U << 5)
/* Additional AVX-512 Vector Byte Manipulation Instruction */
#define CPUID_7_0_ECX_AVX512_VBMI2 (1U << 6)
+/* CET SHSTK feature */
+#define CPUID_7_0_ECX_CET_SHSTK (1U << 7)
/* Galois Field New Instructions */
#define CPUID_7_0_ECX_GFNI (1U << 8)
/* Vector AES Instructions */
@@ -884,6 +888,8 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
#define CPUID_7_0_EDX_TSX_LDTRK (1U << 16)
/* Architectural LBRs */
#define CPUID_7_0_EDX_ARCH_LBR (1U << 19)
+/* CET IBT feature */
+#define CPUID_7_0_EDX_CET_IBT (1U << 20)
/* AMX_BF16 instruction */
#define CPUID_7_0_EDX_AMX_BF16 (1U << 22)
/* AVX512_FP16 instruction */
@@ -1428,6 +1434,12 @@ typedef struct XSavePKRU {
uint32_t padding;
} XSavePKRU;
+/* Ext. save area 11: User mode CET state */
+typedef struct XSavesCETU {
+ uint64_t u_cet;
+ uint64_t user_ssp;
+} XSavesCETU;
+
/* Ext. save area 17: AMX XTILECFG state */
typedef struct XSaveXTILECFG {
uint8_t xtilecfg[64];
@@ -1463,6 +1475,7 @@ QEMU_BUILD_BUG_ON(sizeof(XSaveOpmask) != 0x40);
QEMU_BUILD_BUG_ON(sizeof(XSaveZMM_Hi256) != 0x200);
QEMU_BUILD_BUG_ON(sizeof(XSaveHi16_ZMM) != 0x400);
QEMU_BUILD_BUG_ON(sizeof(XSavePKRU) != 0x8);
+QEMU_BUILD_BUG_ON(sizeof(XSavesCETU) != 0x10);
QEMU_BUILD_BUG_ON(sizeof(XSaveXTILECFG) != 0x40);
QEMU_BUILD_BUG_ON(sizeof(XSaveXTILEDATA) != 0x2000);
QEMU_BUILD_BUG_ON(sizeof(XSavesArchLBR) != 0x328);
--
2.27.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH 2/4] target/i386: Add CET MSRs access interfaces
2023-04-21 4:12 [PATCH 0/4] Enable VMM userspace support for CET virtualization Yang Weijiang
2023-04-21 4:12 ` [PATCH 1/4] target/i386: Enable XSAVES support for user mode CET states Yang Weijiang
@ 2023-04-21 4:12 ` Yang Weijiang
2023-04-21 4:12 ` [PATCH 3/4] target/i386: Enable CET states migration Yang Weijiang
2023-04-21 4:12 ` [PATCH 4/4] target/i386: Advertise CET flags in feature words Yang Weijiang
3 siblings, 0 replies; 5+ messages in thread
From: Yang Weijiang @ 2023-04-21 4:12 UTC (permalink / raw)
To: pbonzini, mtosatti, seanjc, qemu-devel; +Cc: kvm, weijiang.yang
Add access interfaces for supported CET MSRs.
These CET MSRs include:
MSR_IA32_U_CET - store user mode CET control bits.
MSR_IA32_S_CET - store supervisor mode CET control bits.
MSR_IA32_PL3_SSP - strore user mode shadow stack pointer.
MSR_KVM_GUEST_SSP - store current shadow stack pointer.
Other MSRs, i.e., MSR_IA32_PL{0,1,2}_SSP and MSR_IA32_INTR_SSP_TBL
are for non-supported supervisor mode shadow stack, are ignored now.
Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
---
target/i386/cpu.h | 10 ++++++++++
target/i386/kvm/kvm.c | 44 +++++++++++++++++++++++++++++++++++++++++++
2 files changed, 54 insertions(+)
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 6526a03206..b78ce8e5c4 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -545,6 +545,11 @@ typedef enum X86Seg {
#define MSR_IA32_VMX_TRUE_ENTRY_CTLS 0x00000490
#define MSR_IA32_VMX_VMFUNC 0x00000491
+#define MSR_IA32_U_CET 0x000006a0
+#define MSR_IA32_S_CET 0x000006a2
+#define MSR_IA32_PL3_SSP 0x000006a7
+#define MSR_KVM_GUEST_SSP 0x4b564d09
+
#define XSTATE_FP_BIT 0
#define XSTATE_SSE_BIT 1
#define XSTATE_YMM_BIT 2
@@ -1756,6 +1761,11 @@ typedef struct CPUArchState {
uintptr_t retaddr;
+ uint64_t u_cet;
+ uint64_t s_cet;
+ uint64_t pl3_ssp;
+ uint64_t guest_ssp;
+
/* Fields up to this point are cleared by a CPU reset */
struct {} end_reset_fields;
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index de531842f6..13fae898ce 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -3646,6 +3646,22 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
}
}
+ if (((env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_CET_SHSTK) ||
+ (env->features[FEAT_7_0_EDX] & CPUID_7_0_EDX_CET_IBT)) &&
+ (env->features[FEAT_XSAVE_XSS_LO] & XSTATE_CET_U_MASK)) {
+ kvm_msr_entry_add(cpu, MSR_IA32_U_CET, env->u_cet);
+ kvm_msr_entry_add(cpu, MSR_IA32_PL3_SSP, env->pl3_ssp);
+ }
+
+ if ((env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_CET_SHSTK) &&
+ (env->features[FEAT_XSAVE_XSS_LO] & XSTATE_CET_U_MASK)) {
+ kvm_msr_entry_add(cpu, MSR_KVM_GUEST_SSP, env->guest_ssp);
+ }
+
+ if (env->features[FEAT_7_0_EDX] & CPUID_7_0_EDX_CET_IBT) {
+ kvm_msr_entry_add(cpu, MSR_IA32_S_CET, env->s_cet);
+ }
+
return kvm_buf_set_msrs(cpu);
}
@@ -4024,6 +4040,22 @@ static int kvm_get_msrs(X86CPU *cpu)
kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH3, 0);
}
+ if (((env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_CET_SHSTK) ||
+ (env->features[FEAT_7_0_EDX] & CPUID_7_0_EDX_CET_IBT)) &&
+ (env->features[FEAT_XSAVE_XSS_LO] & XSTATE_CET_U_MASK)) {
+ kvm_msr_entry_add(cpu, MSR_IA32_U_CET, 0);
+ kvm_msr_entry_add(cpu, MSR_IA32_PL3_SSP, 0);
+ }
+
+ if ((env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_CET_SHSTK) &&
+ (env->features[FEAT_XSAVE_XSS_LO] & XSTATE_CET_U_MASK)) {
+ kvm_msr_entry_add(cpu, MSR_KVM_GUEST_SSP, 0);
+ }
+
+ if (env->features[FEAT_7_0_EDX] & CPUID_7_0_EDX_CET_IBT) {
+ kvm_msr_entry_add(cpu, MSR_IA32_S_CET, 0);
+ }
+
if (env->features[FEAT_XSAVE] & CPUID_D_1_EAX_XFD) {
kvm_msr_entry_add(cpu, MSR_IA32_XFD, 0);
kvm_msr_entry_add(cpu, MSR_IA32_XFD_ERR, 0);
@@ -4346,6 +4378,18 @@ static int kvm_get_msrs(X86CPU *cpu)
env->msr_ia32_sgxlepubkeyhash[index - MSR_IA32_SGXLEPUBKEYHASH0] =
msrs[i].data;
break;
+ case MSR_IA32_U_CET:
+ env->u_cet = msrs[i].data;
+ break;
+ case MSR_IA32_S_CET:
+ env->s_cet = msrs[i].data;
+ break;
+ case MSR_IA32_PL3_SSP:
+ env->pl3_ssp = msrs[i].data;
+ break;
+ case MSR_KVM_GUEST_SSP:
+ env->guest_ssp = msrs[i].data;
+ break;
case MSR_IA32_XFD:
env->msr_xfd = msrs[i].data;
break;
--
2.27.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH 3/4] target/i386: Enable CET states migration
2023-04-21 4:12 [PATCH 0/4] Enable VMM userspace support for CET virtualization Yang Weijiang
2023-04-21 4:12 ` [PATCH 1/4] target/i386: Enable XSAVES support for user mode CET states Yang Weijiang
2023-04-21 4:12 ` [PATCH 2/4] target/i386: Add CET MSRs access interfaces Yang Weijiang
@ 2023-04-21 4:12 ` Yang Weijiang
2023-04-21 4:12 ` [PATCH 4/4] target/i386: Advertise CET flags in feature words Yang Weijiang
3 siblings, 0 replies; 5+ messages in thread
From: Yang Weijiang @ 2023-04-21 4:12 UTC (permalink / raw)
To: pbonzini, mtosatti, seanjc, qemu-devel; +Cc: kvm, weijiang.yang
Add supported CET states in vmstate for VM migration.
Other MSRs, i.e., MSR_IA32_PL{0,1,2}_SSP and MSR_IA32_INTR_SSP_TBL
are for non-supported supervisor mode shadow stack, are ignored now.
Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
---
target/i386/machine.c | 81 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 81 insertions(+)
diff --git a/target/i386/machine.c b/target/i386/machine.c
index c7ac8084b2..904a7e9574 100644
--- a/target/i386/machine.c
+++ b/target/i386/machine.c
@@ -1018,6 +1018,83 @@ static const VMStateDescription vmstate_umwait = {
}
};
+static bool u_cet_needed(void *opaque)
+{
+ X86CPU *cpu = opaque;
+ CPUX86State *env = &cpu->env;
+
+ return env->u_cet != 0;
+}
+
+static const VMStateDescription vmstate_u_cet = {
+ .name = "cpu/u_cet",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .needed = u_cet_needed,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(env.u_cet, X86CPU),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static bool s_cet_needed(void *opaque)
+{
+ X86CPU *cpu = opaque;
+ CPUX86State *env = &cpu->env;
+
+ return env->s_cet != 0;
+}
+
+static const VMStateDescription vmstate_s_cet = {
+ .name = "cpu/s_cet",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .needed = s_cet_needed,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(env.s_cet, X86CPU),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+
+static bool pl3_ssp_needed(void *opaque)
+{
+ X86CPU *cpu = opaque;
+ CPUX86State *env = &cpu->env;
+
+ return env->pl3_ssp != 0;
+}
+
+static const VMStateDescription vmstate_pl3_ssp = {
+ .name = "cpu/pl3_ssp",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .needed = pl3_ssp_needed,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(env.pl3_ssp, X86CPU),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static bool guest_ssp_needed(void *opaque)
+{
+ X86CPU *cpu = opaque;
+ CPUX86State *env = &cpu->env;
+
+ return env->guest_ssp != 0;
+}
+
+static const VMStateDescription vmstate_guest_ssp = {
+ .name = "cpu/guest_ssp",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .needed = guest_ssp_needed,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(env.guest_ssp, X86CPU),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
static bool pkru_needed(void *opaque)
{
X86CPU *cpu = opaque;
@@ -1745,6 +1822,10 @@ const VMStateDescription vmstate_x86_cpu = {
&vmstate_msr_tsx_ctrl,
&vmstate_msr_intel_sgx,
&vmstate_pdptrs,
+ &vmstate_u_cet,
+ &vmstate_s_cet,
+ &vmstate_pl3_ssp,
+ &vmstate_guest_ssp,
&vmstate_msr_xfd,
#ifdef TARGET_X86_64
&vmstate_amx_xtile,
--
2.27.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH 4/4] target/i386: Advertise CET flags in feature words
2023-04-21 4:12 [PATCH 0/4] Enable VMM userspace support for CET virtualization Yang Weijiang
` (2 preceding siblings ...)
2023-04-21 4:12 ` [PATCH 3/4] target/i386: Enable CET states migration Yang Weijiang
@ 2023-04-21 4:12 ` Yang Weijiang
3 siblings, 0 replies; 5+ messages in thread
From: Yang Weijiang @ 2023-04-21 4:12 UTC (permalink / raw)
To: pbonzini, mtosatti, seanjc, qemu-devel; +Cc: kvm, weijiang.yang
Add SHSTK and IBT flags in feature words alone with entry/exit
control flags.
CET SHSTK and IBT feature are enumerated via CPUID(EAX=7,ECX=0)
ECX[bit 7] and EDX[bit 20]. CET states load/restore at vmentry/
vmexit are controlled by VMX_ENTRY_CTLS[bit 20] and VMX_EXIT_CTLS[bit 28].
Enable these flags so that KVM can support the features properly.
Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
---
target/i386/cpu.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index be86df8c1d..f11c5ce86c 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -834,7 +834,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
.type = CPUID_FEATURE_WORD,
.feat_names = {
NULL, "avx512vbmi", "umip", "pku",
- NULL /* ospke */, "waitpkg", "avx512vbmi2", NULL,
+ NULL /* ospke */, "waitpkg", "avx512vbmi2", "shstk",
"gfni", "vaes", "vpclmulqdq", "avx512vnni",
"avx512bitalg", NULL, "avx512-vpopcntdq", NULL,
"la57", NULL, NULL, NULL,
@@ -857,7 +857,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
"avx512-vp2intersect", NULL, "md-clear", NULL,
NULL, NULL, "serialize", NULL,
"tsx-ldtrk", NULL, NULL /* pconfig */, "arch-lbr",
- NULL, NULL, "amx-bf16", "avx512-fp16",
+ "ibt", NULL, "amx-bf16", "avx512-fp16",
"amx-tile", "amx-int8", "spec-ctrl", "stibp",
NULL, "arch-capabilities", "core-capability", "ssbd",
},
@@ -1119,7 +1119,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
"vmx-exit-save-efer", "vmx-exit-load-efer",
"vmx-exit-save-preemption-timer", "vmx-exit-clear-bndcfgs",
NULL, "vmx-exit-clear-rtit-ctl", NULL, NULL,
- NULL, "vmx-exit-load-pkrs", NULL, NULL,
+ "vmx-exit-save-cet-ctl", "vmx-exit-load-pkrs", NULL, NULL,
},
.msr = {
.index = MSR_IA32_VMX_TRUE_EXIT_CTLS,
@@ -1134,7 +1134,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
NULL, "vmx-entry-ia32e-mode", NULL, NULL,
NULL, "vmx-entry-load-perf-global-ctrl", "vmx-entry-load-pat", "vmx-entry-load-efer",
"vmx-entry-load-bndcfgs", NULL, "vmx-entry-load-rtit-ctl", NULL,
- NULL, NULL, "vmx-entry-load-pkrs", NULL,
+ "vmx-entry-load-cet-ctl", NULL, "vmx-entry-load-pkrs", NULL,
NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL,
},
--
2.27.0
^ permalink raw reply related [flat|nested] 5+ messages in thread