Messages in this thread | | | Date | Fri, 4 Aug 2023 16:23:47 +0800 | From | Chao Gao <> | Subject | Re: [PATCH v5 14/19] KVM:VMX: Set host constant supervisor states to VMCS fields |
| |
On Thu, Aug 03, 2023 at 12:27:27AM -0400, Yang Weijiang wrote: >Set constant values to HOST_{S_CET,SSP,INTR_SSP_TABLE} VMCS >fields explicitly. Kernel IBT is supported and the setting in >MSR_IA32_S_CET is static after post-boot(except is BIOS call >case but vCPU thread never across it.), i.e. KVM doesn't need >to refresh HOST_S_CET field before every VM-Enter/VM-Exit >sequence. > >Host supervisor shadow stack is not enabled now and SSP is not >accessible to kernel mode, thus it's safe to set host IA32_INT_ >SSP_TAB/SSP VMCS fields to 0s. When shadow stack is enabled for >CPL3, SSP is reloaded from IA32_PL3_SSP before it exits to userspace. >Check SDM Vol 2A/B Chapter 3/4 for SYSCALL/SYSRET/SYSENTER SYSEXIT/ >RDSSP/CALL etc. > >Prevent KVM module loading and if host supervisor shadow stack >SHSTK_EN is set in MSR_IA32_S_CET as KVM cannot co-exit with it >correctly. > >Suggested-by: Sean Christopherson <seanjc@google.com> >Suggested-by: Chao Gao <chao.gao@intel.com> >Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
Reviewed-by: Chao Gao <chao.gao@intel.com>
| |