linux-kernel - Re: [RFC PATCH v4 2/8] KVM:CPUID: Add CET CPUID support for Guest

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190402204038.GM31303@linux.intel.com>
Date:   Tue, 2 Apr 2019 13:40:38 -0700
From:   Sean Christopherson <sean.j.christopherson@...el.com>
To:     Yang Weijiang <weijiang.yang@...el.com>
Cc:     pbonzini@...hat.com, kvm@...r.kernel.org, mst@...hat.com,
        rkrcmar@...hat.com, jmattson@...gle.com,
        linux-kernel@...r.kernel.org, yu-cheng.yu@...el.com,
        Zhang Yi Z <yi.z.zhang@...ux.intel.com>
Subject: Re: [RFC PATCH v4 2/8] KVM:CPUID: Add CET CPUID support for Guest

On Mon, Mar 18, 2019 at 11:03:45PM +0800, Yang Weijiang wrote:
> CET SHSTK and IBT capability are reported via
> CPUID.(EAX=7, ECX=0):ECX[bit 7] and EDX[bit 20] respectively.
> CR4.CET[bit 23] is CET master enable bit, it controls CET feature
> enabling. CET user mode and supervisor mode xsaves component size
> is reported via CPUID.(EAX=0xD, ECX=1):ECX[bit 11] and ECX[bit 12]
> respectively.
> 
> Note: Although SHSTK or IBT can be enabled independently,
>       both of them are controlled by CR4.CET.
> 
> Signed-off-by: Zhang Yi Z <yi.z.zhang@...ux.intel.com>
> Signed-off-by: Yang Weijiang <weijiang.yang@...el.com>
> ---
>  arch/x86/include/asm/kvm_host.h |  4 +++-
>  arch/x86/kvm/cpuid.c            | 41 ++++++++++++++++++++++-----------
>  arch/x86/kvm/vmx.c              |  6 +++++
>  arch/x86/kvm/x86.h              |  4 ++++
>  4 files changed, 40 insertions(+), 15 deletions(-)
> 
> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> index 55e51ff7e421..fc038bf1924a 100644
> --- a/arch/x86/include/asm/kvm_host.h
> +++ b/arch/x86/include/asm/kvm_host.h
> @@ -90,7 +90,8 @@
>  			  | X86_CR4_PGE | X86_CR4_PCE | X86_CR4_OSFXSR | X86_CR4_PCIDE \
>  			  | X86_CR4_OSXSAVE | X86_CR4_SMEP | X86_CR4_FSGSBASE \
>  			  | X86_CR4_OSXMMEXCPT | X86_CR4_LA57 | X86_CR4_VMXE \
> -			  | X86_CR4_SMAP | X86_CR4_PKE | X86_CR4_UMIP))
> +			  | X86_CR4_SMAP | X86_CR4_PKE | X86_CR4_UMIP \
> +			  | X86_CR4_CET))
>  
>  #define CR8_RESERVED_BITS (~(unsigned long)X86_CR8_TPR)
>  
> @@ -1185,6 +1186,7 @@ struct kvm_x86_ops {
>  
>  	int (*nested_enable_evmcs)(struct kvm_vcpu *vcpu,
>  				   uint16_t *vmcs_version);
> +	u64 (*vmx_supported_xss)(void);

Heh, the purpose of kvm_x86_ops is to abstract things a bit, i.e. drop
the "vmx" prefix.

>  };
>  
>  struct kvm_arch_async_pf {