diff mbox series

[v5,15/19] KVM:x86: Optimize CET supervisor SSP save/reload

Message ID 20230803042732.88515-16-weijiang.yang@intel.com (mailing list archive)
State New, archived
Headers show
Series Enable CET Virtualization | expand

Commit Message

Yang, Weijiang Aug. 3, 2023, 4:27 a.m. UTC 
Make PL{0,1,2}_SSP as write-intercepted to detect whether
guest is using these MSRs. Disable intercept to the MSRs
if they're written with non-zero values. KVM does save/
reload for the MSRs only if they're used by guest.

Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
---
 arch/x86/include/asm/kvm_host.h |  1 +
 arch/x86/kvm/vmx/vmx.c          | 31 ++++++++++++++++++++++++++++---
 arch/x86/kvm/x86.c              |  8 ++++++--
 3 files changed, 35 insertions(+), 5 deletions(-)

Comments

Chao Gao Aug. 4, 2023, 8:43 a.m. UTC | #1 
On Thu, Aug 03, 2023 at 12:27:28AM -0400, Yang Weijiang wrote:
>Make PL{0,1,2}_SSP as write-intercepted to detect whether
>guest is using these MSRs. Disable intercept to the MSRs
>if they're written with non-zero values. KVM does save/
>reload for the MSRs only if they're used by guest.

What would happen if guest tries to use XRSTORS to load S_CET state from a
xsave area without any writes to the PL0-2_SSP (i.e., at that point, writes to
the MSRs are still intercepted)?

>@@ -2420,6 +2432,14 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
> 		else
> 			vmx->pt_desc.guest.addr_a[index / 2] = data;
> 		break;
>+	case MSR_IA32_PL0_SSP ... MSR_IA32_PL2_SSP:
>+		if (kvm_set_msr_common(vcpu, msr_info))
>+			return 1;
>+		if (data) {
>+			vmx_disable_write_intercept_sss_msr(vcpu);
>+			wrmsrl(msr_index, data);

Is it necessary to do the wrmsl()?
looks the next kvm_x86_prepare_switch_to_guest() will load PL0-2_SSP from the
caching values.
Yang, Weijiang Aug. 9, 2023, 9 a.m. UTC | #2 
On 8/4/2023 4:43 PM, Chao Gao wrote:
> On Thu, Aug 03, 2023 at 12:27:28AM -0400, Yang Weijiang wrote:
>> Make PL{0,1,2}_SSP as write-intercepted to detect whether
>> guest is using these MSRs. Disable intercept to the MSRs
>> if they're written with non-zero values. KVM does save/
>> reload for the MSRs only if they're used by guest.
> What would happen if guest tries to use XRSTORS to load S_CET state from a
> xsave area without any writes to the PL0-2_SSP (i.e., at that point, writes to
> the MSRs are still intercepted)?
I need to do some experiments to get the details, but now expect some kind
of error in guest is seen.
>> @@ -2420,6 +2432,14 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
>> 		else
>> 			vmx->pt_desc.guest.addr_a[index / 2] = data;
>> 		break;
>> +	case MSR_IA32_PL0_SSP ... MSR_IA32_PL2_SSP:
>> +		if (kvm_set_msr_common(vcpu, msr_info))
>> +			return 1;
>> +		if (data) {
>> +			vmx_disable_write_intercept_sss_msr(vcpu);
>> +			wrmsrl(msr_index, data);
> Is it necessary to do the wrmsl()?
> looks the next kvm_x86_prepare_switch_to_guest() will load PL0-2_SSP from the
> caching values.
Oh, yes, it's not necessary after moving the reload logic to kvm_x86_prepare_switch_to_guest().
Thanks!
diff mbox series

Patch

diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 69cbc9d9b277..c50b555234fb 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -748,6 +748,7 @@  struct kvm_vcpu_arch {
 	bool tpr_access_reporting;
 	bool xsaves_enabled;
 	bool xfd_no_write_intercept;
+	bool cet_sss_active;
 	u64 ia32_xss;
 	u64 microcode_version;
 	u64 arch_capabilities;
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 99bf63b2a779..96e22515ed13 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -2152,6 +2152,18 @@  static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated
 	return debugctl;
 }
 
+static void vmx_disable_write_intercept_sss_msr(struct kvm_vcpu *vcpu)
+{
+	if (guest_can_use(vcpu, X86_FEATURE_SHSTK)) {
+		vmx_set_intercept_for_msr(vcpu, MSR_IA32_PL0_SSP,
+					  MSR_TYPE_RW, false);
+		vmx_set_intercept_for_msr(vcpu, MSR_IA32_PL1_SSP,
+					  MSR_TYPE_RW, false);
+		vmx_set_intercept_for_msr(vcpu, MSR_IA32_PL2_SSP,
+					  MSR_TYPE_RW, false);
+	}
+}
+
 /*
  * Writes msr value into the appropriate "register".
  * Returns 0 on success, non-0 otherwise.
@@ -2420,6 +2432,14 @@  static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 		else
 			vmx->pt_desc.guest.addr_a[index / 2] = data;
 		break;
+	case MSR_IA32_PL0_SSP ... MSR_IA32_PL2_SSP:
+		if (kvm_set_msr_common(vcpu, msr_info))
+			return 1;
+		if (data) {
+			vmx_disable_write_intercept_sss_msr(vcpu);
+			wrmsrl(msr_index, data);
+		}
+		break;
 	case MSR_IA32_S_CET:
 	case MSR_KVM_GUEST_SSP:
 	case MSR_IA32_INT_SSP_TAB:
@@ -7777,12 +7797,17 @@  static void vmx_update_intercept_for_cet_msr(struct kvm_vcpu *vcpu)
 					  MSR_TYPE_RW, incpt);
 		vmx_set_intercept_for_msr(vcpu, MSR_IA32_S_CET,
 					  MSR_TYPE_RW, incpt);
+		/*
+		 * Supervisor shadow stack MSRs are intercepted until
+		 * they're written by guest, this is designed to
+		 * optimize the save/restore overhead.
+		 */
 		vmx_set_intercept_for_msr(vcpu, MSR_IA32_PL0_SSP,
-					  MSR_TYPE_RW, incpt);
+					  MSR_TYPE_R, incpt);
 		vmx_set_intercept_for_msr(vcpu, MSR_IA32_PL1_SSP,
-					  MSR_TYPE_RW, incpt);
+					  MSR_TYPE_R, incpt);
 		vmx_set_intercept_for_msr(vcpu, MSR_IA32_PL2_SSP,
-					  MSR_TYPE_RW, incpt);
+					  MSR_TYPE_R, incpt);
 		vmx_set_intercept_for_msr(vcpu, MSR_IA32_PL3_SSP,
 					  MSR_TYPE_RW, incpt);
 		vmx_set_intercept_for_msr(vcpu, MSR_IA32_INT_SSP_TAB,
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 01b4f10fa8ab..fa3e7f7c639f 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4060,6 +4060,8 @@  int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 		if (msr == MSR_IA32_PL0_SSP || msr == MSR_IA32_PL1_SSP ||
 		    msr == MSR_IA32_PL2_SSP) {
 			vcpu->arch.cet_s_ssp[msr - MSR_IA32_PL0_SSP] = data;
+			if (!vcpu->arch.cet_sss_active && data)
+				vcpu->arch.cet_sss_active = true;
 		} else if (msr == MSR_IA32_PL3_SSP) {
 			kvm_set_xsave_msr(msr_info);
 		}
@@ -11241,7 +11243,8 @@  static void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)
 
 void save_cet_supervisor_ssp(struct kvm_vcpu *vcpu)
 {
-	if (unlikely(guest_can_use(vcpu, X86_FEATURE_SHSTK))) {
+	if (unlikely(guest_can_use(vcpu, X86_FEATURE_SHSTK) &&
+		     vcpu->arch.cet_sss_active)) {
 		rdmsrl(MSR_IA32_PL0_SSP, vcpu->arch.cet_s_ssp[0]);
 		rdmsrl(MSR_IA32_PL1_SSP, vcpu->arch.cet_s_ssp[1]);
 		rdmsrl(MSR_IA32_PL2_SSP, vcpu->arch.cet_s_ssp[2]);
@@ -11256,7 +11259,8 @@  EXPORT_SYMBOL_GPL(save_cet_supervisor_ssp);
 
 void reload_cet_supervisor_ssp(struct kvm_vcpu *vcpu)
 {
-	if (unlikely(guest_can_use(vcpu, X86_FEATURE_SHSTK))) {
+	if (unlikely(guest_can_use(vcpu, X86_FEATURE_SHSTK) &&
+		     vcpu->arch.cet_sss_active)) {
 		wrmsrl(MSR_IA32_PL0_SSP, vcpu->arch.cet_s_ssp[0]);
 		wrmsrl(MSR_IA32_PL1_SSP, vcpu->arch.cet_s_ssp[1]);
 		wrmsrl(MSR_IA32_PL2_SSP, vcpu->arch.cet_s_ssp[2]);