On Fri, Apr 09, 2021, Yang Weijiang wrote: > These fields are rarely updated by L1 QEMU/KVM, sync them when L1 is trying to > read/write them and after they're changed. If CET guest entry-load bit is not > set by L1 guest, migrate them to L2 manaully. > > Opportunistically remove one blank line in previous patch. > > Suggested-by: Sean Christopherson <sea...@google.com> > Signed-off-by: Yang Weijiang <weijiang.y...@intel.com> > --- > arch/x86/kvm/cpuid.c | 1 - > arch/x86/kvm/vmx/nested.c | 30 ++++++++++++++++++++++++++++++ > arch/x86/kvm/vmx/vmx.h | 3 +++ > 3 files changed, 33 insertions(+), 1 deletion(-) > > diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c > index d191de769093..8692f53b8cd0 100644 > --- a/arch/x86/kvm/cpuid.c > +++ b/arch/x86/kvm/cpuid.c > @@ -143,7 +143,6 @@ void kvm_update_cpuid_runtime(struct kvm_vcpu *vcpu) > } > vcpu->arch.guest_supported_xss = > (((u64)best->edx << 32) | best->ecx) & supported_xss; > - > } else { > vcpu->arch.guest_supported_xss = 0; > } > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c > index 9728efd529a1..87beb1c034e1 100644 > --- a/arch/x86/kvm/vmx/nested.c > +++ b/arch/x86/kvm/vmx/nested.c > @@ -2516,6 +2516,13 @@ static void prepare_vmcs02_rare(struct vcpu_vmx *vmx, > struct vmcs12 *vmcs12) > vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.guest.nr); > > set_cr4_guest_host_mask(vmx); > + > + if (kvm_cet_supported() && vmx->nested.nested_run_pending && > + (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_CET_STATE)) { > + vmcs_writel(GUEST_SSP, vmcs12->guest_ssp); > + vmcs_writel(GUEST_S_CET, vmcs12->guest_s_cet); > + vmcs_writel(GUEST_INTR_SSP_TABLE, vmcs12->guest_ssp_tbl); > + } > } > > /* > @@ -2556,6 +2563,15 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, > struct vmcs12 *vmcs12, > if (kvm_mpx_supported() && (!vmx->nested.nested_run_pending || > !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))) > vmcs_write64(GUEST_BNDCFGS, vmx->nested.vmcs01_guest_bndcfgs); > + > + if (kvm_cet_supported() && (!vmx->nested.nested_run_pending || > + !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_CET_STATE))) { > + vmcs_writel(GUEST_SSP, vmx->nested.vmcs01_guest_ssp); > + vmcs_writel(GUEST_S_CET, vmx->nested.vmcs01_guest_s_cet); > + vmcs_writel(GUEST_INTR_SSP_TABLE, > + vmx->nested.vmcs01_guest_ssp_tbl); > + } > + > vmx_set_rflags(vcpu, vmcs12->guest_rflags); > > /* EXCEPTION_BITMAP and CR0_GUEST_HOST_MASK should basically be the > @@ -3375,6 +3391,11 @@ enum nvmx_vmentry_status > nested_vmx_enter_non_root_mode(struct kvm_vcpu *vcpu, > if (kvm_mpx_supported() && > !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS)) > vmx->nested.vmcs01_guest_bndcfgs = vmcs_read64(GUEST_BNDCFGS); > + if (kvm_cet_supported() && !vmx->nested.nested_run_pending) {
This needs to be: if (kvm_cet_supported() && (!vmx->nested.nested_run_pending || !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_CET_STATE))) otherwise the vmcs01_* members will be stale when emulating VM-Enter with vcmc12.vm_entry_controls.LOAD_CET_STATE=0. > + vmx->nested.vmcs01_guest_ssp = vmcs_readl(GUEST_SSP); > + vmx->nested.vmcs01_guest_s_cet = vmcs_readl(GUEST_S_CET); > + vmx->nested.vmcs01_guest_ssp_tbl = > vmcs_readl(GUEST_INTR_SSP_TABLE); > + }