On Wed, Dec 11, 2019 at 09:54:23AM +0800, Yang Weijiang wrote:
> On Tue, Dec 10, 2019 at 01:23:05PM -0800, Sean Christopherson wrote:
> > On Fri, Nov 01, 2019 at 04:52:19PM +0800, Yang Weijiang wrote:
> > > @@ -2834,6 +2837,9 @@ void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
> > > struct vcpu_vmx *vmx = to_vmx(vcpu);
> > > unsigned long hw_cr0;
> > >
> > > + if (!(cr0 & X86_CR0_WP) && kvm_read_cr4_bits(vcpu, X86_CR4_CET))
> > > + cr0 |= X86_CR0_WP;
> >
> > Huh? What's the interaction between CR4.CET and CR0.WP? If there really
> > is some non-standard interaction then it needs to be documented in at least
> > the changelog and probably with a comment as well.
> >
> The processor does not allow CR4.CET to be set if CR0.WP = 0 (similarly, it
> does not allow CR0.WP to be cleared while CR4.CET = 1).
Ya, as you surmised below, this needs to be a #GP condition.
Have you tested SMM at all? The interaction between CR0 and CR4 may be
problematic for em_rsm() and/or rsm_enter_protected_mode().
> > > +
> > > hw_cr0 = (cr0 & ~KVM_VM_CR0_ALWAYS_OFF);
> > > if (enable_unrestricted_guest)
> > > hw_cr0 |= KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST;
> > > @@ -2936,6 +2942,22 @@ static bool guest_cet_allowed(struct kvm_vcpu *vcpu, u32 feature, u32 mode)
> > > return false;
> > > }
> > >
> > > +bool is_cet_bit_allowed(struct kvm_vcpu *vcpu)
> > > +{
> > > + unsigned long cr0;
> > > + bool cet_allowed;
> > > +
> > > + cr0 = kvm_read_cr0(vcpu);
> > > + cet_allowed = guest_cet_allowed(vcpu, X86_FEATURE_SHSTK,
> > > + XFEATURE_MASK_CET_USER) ||
> > > + guest_cet_allowed(vcpu, X86_FEATURE_IBT,
> > > + XFEATURE_MASK_CET_USER);
> > > + if ((cr0 & X86_CR0_WP) && cet_allowed)
> > > + return true;
> >
> > So, attempting to set CR4.CET if CR0.WP=0 takes a #GP? But attempting
> > to clear CR0.WP if CR4.CET=1 is ignored?
> >
> Per above words in spec., inject #GP to guest in either case?
>
> > > +
> > > + return false;
> > > +}
> > > +
