From patchwork Thu May 11 04:08:48 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Yang, Weijiang" X-Patchwork-Id: 92392 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp4171730vqo; Thu, 11 May 2023 00:16:19 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4PiHNR6gTXccbXKH7gkWqfsk4nTLQjwK1n1NAh/gjykOWkqg9nBWCdPaVqqAmuXuYhAIto X-Received: by 2002:a05:6a00:895:b0:63d:2d99:2e7c with SMTP id q21-20020a056a00089500b0063d2d992e7cmr29572291pfj.0.1683789379590; Thu, 11 May 2023 00:16:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683789379; cv=none; d=google.com; s=arc-20160816; b=UDOyn1B5FWbz8g0P1cDUbBkHhk2AqmzkNCBbJ4CjrLhfkOtt5fZnmfCL0WeYSj1zdT 5zbyvf9XdlfhyKinWwi201Jtz66GpoH+s24OABgcU6ygaLx8Sczq0UbkKSei/QWgnZmX /OnRl817w0oQejOSnNMuWgT8JYgld9QiopCPD9GRmTXbYnCkYitQs27bUVeSljuUlCT/ zgqVpVID8p/HJ0sF/5vqLacIkZkqKO2VUbBX4QFPnCd2M9isby7/suBxa1aWu1n/AIup 54G1oPKTRsShZ9QtU/uQZnlmUi5e415Lj8dp0bZOnY9CVbBADDJv5sp3ulTiH0iFhnnK MsLg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=hy3ixMNQ9fst3TuCs0id+sL+7b+4AQQ1VixlKemyiTU=; b=NkDx7Zcn2f1dEC7iidUhU3f8CAV7HJYr54apnmCae71NLXzZK8HJxHcvjVDcEz/nhe mtf1b2DGMcAxu5yLAfBiRg3VxTGlnh7V8fBDzAXUk3U60hhMKfvMkDPKCoezk4t8WNvf vMnXyxKid/M7fFP6/kL0+azEnialj4lMY1fGRu9SYaSMiE4POXhHumUDdkApd1wSWXNd AB/i4b2g0EBNHDfDfRUOfTG0gRdbQ+Z5PEGKeY2l7s/VC5apdj5amYb3CuHwstAWvwUN VNhMT4UgFGRRdNpAZs+6MGzPcJJo4LRjV6+jFfYlZZQjaWCdJ8dOPq+u/tgldesnw+Qf wz6g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=MDbHMgZP; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id r15-20020aa7962f000000b0063b1bfa94dasi6746552pfg.323.2023.05.11.00.16.07; Thu, 11 May 2023 00:16:19 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=MDbHMgZP; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229482AbjEKHPE (ORCPT + 99 others); Thu, 11 May 2023 03:15:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48448 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237521AbjEKHOV (ORCPT ); Thu, 11 May 2023 03:14:21 -0400 Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7FF2386B5; Thu, 11 May 2023 00:13:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1683789235; x=1715325235; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=mKznbbQmhJ6bKxVw03U0lSS5TRRLL1ugJjkxLjC4Lyc=; b=MDbHMgZPZKNp+vuVOAXsnE0/fOVXfBy0rUG+bmkTc9oiC+I9iSO5cZaA G0ntLFx1NA80dxDbBWkb0oONK/lGgciVtdC1dvv9AqGYySqeAhatUxoAX sHnUQbWePsasbkr+zi+7p5Vp/Kjnd4jak0XbTrVLgg3sq2E/sbPRs214s A0HS5SejnT8Mgh+X8RTy+P/ExHY20YOBTRgpI4FNrGpPGhaynJmSBjPHj 4lA+zocicAjlZfN+SwGwO7jcPsiv5FyshLvGRaTCoBtMvVcNPIZjdzjxs F5Ot0UmWbeUX8MNrVJCBQRms+DBr1ifMHDSEbfG1EvY0YlZZg9hakXefP g==; X-IronPort-AV: E=McAfee;i="6600,9927,10706"; a="334896662" X-IronPort-AV: E=Sophos;i="5.99,266,1677571200"; d="scan'208";a="334896662" Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 11 May 2023 00:13:34 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10706"; a="1029512374" X-IronPort-AV: E=Sophos;i="5.99,266,1677571200"; d="scan'208";a="1029512374" Received: from embargo.jf.intel.com ([10.165.9.183]) by fmsmga005-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 11 May 2023 00:13:25 -0700 From: Yang Weijiang To: seanjc@google.com, pbonzini@redhat.com, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: peterz@infradead.org, rppt@kernel.org, binbin.wu@linux.intel.com, rick.p.edgecombe@intel.com, weijiang.yang@intel.com, john.allen@amd.com, Sean Christopherson Subject: [PATCH v3 12/21] KVM:x86: Add fault checks for guest CR4.CET setting Date: Thu, 11 May 2023 00:08:48 -0400 Message-Id: <20230511040857.6094-13-weijiang.yang@intel.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20230511040857.6094-1-weijiang.yang@intel.com> References: <20230511040857.6094-1-weijiang.yang@intel.com> MIME-Version: 1.0 X-Spam-Status: No, score=-0.5 required=5.0 tests=BAYES_00,DATE_IN_PAST_03_06, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765581132133756325?= X-GMAIL-MSGID: =?utf-8?q?1765581132133756325?= Check potential faults for CR4.CET setting per Intel SDM. CR4.CET is the master control bit for CET features (SHSTK and IBT). In addition to basic support checks, CET can be enabled if and only if CR0.WP==1, i.e. setting CR4.CET=1 faults if CR0.WP==0 and setting CR0.WP=0 fails if CR4.CET==1. Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson Signed-off-by: Yang Weijiang --- arch/x86/kvm/x86.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index a768cbf3fbb7..b6eec9143129 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -995,6 +995,9 @@ int kvm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0) (is_64_bit_mode(vcpu) || kvm_is_cr4_bit_set(vcpu, X86_CR4_PCIDE))) return 1; + if (!(cr0 & X86_CR0_WP) && kvm_is_cr4_bit_set(vcpu, X86_CR4_CET)) + return 1; + static_call(kvm_x86_set_cr0)(vcpu, cr0); kvm_post_set_cr0(vcpu, old_cr0, cr0); @@ -1210,6 +1213,9 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) return 1; } + if ((cr4 & X86_CR4_CET) && !kvm_is_cr0_bit_set(vcpu, X86_CR0_WP)) + return 1; + static_call(kvm_x86_set_cr4)(vcpu, cr4); kvm_post_set_cr4(vcpu, old_cr4, cr4);