From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8861321ABA2 for ; Thu, 17 Jul 2025 06:59:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1752735597; cv=none; b=jP6mwyISP+ez96pA/z/xUwa4IfLy9kH5XDeEgJ7WbK3etsc3BNu7AhLI+vYlys0z9nJtFqh8NDqB50sAa1zltF/iXtYmswnF+nJDaOdcXmSprLZitxpICidWgiV5Py8/kye4wznEt2gWDwKrK7pVC19upcATt8RC/sQgnLNTJto= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1752735597; c=relaxed/simple; bh=Q3m3STGaAGQImRO1mAS4/C4kAlq0ECEIMqTvXtU3iaM=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=NW5E6kR+XBdB1HWQq5lUhBOx+SP3cq9buKXHigBuaSiTuY8uq11rDveNftV2yvs0cSK0aiWJF1w/XGtiD7FXBiw/z8p34kjuBZu7x3/g9I9K6jc8kQ2LHIqGEXpng4SwBwc10aL1PPwik0PzRqlxeH5t9lqPWK/XaGY0mXTxRBM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=grsecurity.net; spf=pass smtp.mailfrom=opensrcsec.com; dkim=pass (2048-bit key) header.d=grsecurity.net header.i=@grsecurity.net header.b=CJL8bEWu; arc=none smtp.client-ip=209.85.128.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=grsecurity.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=opensrcsec.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=grsecurity.net header.i=@grsecurity.net header.b="CJL8bEWu" Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4550709f2c1so3864425e9.3 for ; Wed, 16 Jul 2025 23:59:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=grsecurity.net; s=grsec; t=1752735594; x=1753340394; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:autocrypt:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to; bh=7sm/BKnQ8dptUdOe/NwHY/QfbOT5uaRlkVYhFHFgiyk=; b=CJL8bEWuf3m3FeG6nyctw7Nwi4MSHwwfH6xOeB1bQll8pmRgOGBO9nql+Yub/Jp1Ad 21aDW9evI+rZfOa8Ezcy5X6hWsY6kT1KEVL0G2HX4j583X6rUOx9/HwKjeTM94i9bcgI sPHQzh8ihOtr12K8lgjRClWlsXGB3YlIipD9h+nP3a4RyVNDeFwtfAroXK/yVoE9CAmY Jfd/G6marhjxmnUEChPE9+i/EwlCQZEdt9g5uKz3Spub0X3jaUnT+++9ALmWkGRNmphJ XY9tdjbJjmXzHby8mvOiohOYAWzYyLnsBkSAy64EKhHqUDHtGC25705L6Sl/VJkGqO1M 42hQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1752735594; x=1753340394; h=content-transfer-encoding:in-reply-to:autocrypt:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=7sm/BKnQ8dptUdOe/NwHY/QfbOT5uaRlkVYhFHFgiyk=; b=kyFsvRkySrWM3/84DXLI3EMWZdgydfA2NWA8x3jqLhAB9SQBe62L3B6SANjte/TPE1 ePHtVTGPTZvpZcka3t3EJX99OKFwNKf2E50xoynSWnhRg1dDG8BTx/boSLHSagazCChq ApibqbaWXKznuxhUqEEFDDPKGGhZbm0zqU9cJjPU79BZAII3RV0g4Z8LXPLNfKMqftHO 5vWQyeTxmB1e6njhP9jv9gyECuY92i4eSyBIn/C7wIsrlm0vX2Cv9oiKqzgCLDh9LPeX nAiA1M6h5Z/cvrYfmaWDbzXnswrzBfQ3tK71xW7yG8MNM4n03qDMm0Hv+jsOn1ZeqR4D vYpg== X-Forwarded-Encrypted: i=1; AJvYcCVYX0fp0BAXXcrACu2GS+nFes8+mYG5KOpZIAGNSXocmfyUL/8NJHpw050FSX7jdvfVuHy4e6ZAzOtY0kI=@vger.kernel.org X-Gm-Message-State: AOJu0YwFu9cvwa1NvsGZeFBIon49yMGIzn4hVJBrscXGyTPH1bYhdil5 Hmzq1TbLr45omc0UJK7PK1oWE5hyGhHA7bj+X+gvEITp4TIrTkq3SxkrYQF1h4O0Dr8= X-Gm-Gg: ASbGncsX1DqpovHr3//D2Qbw0NchnWzDcnqAYgK/t5QfIDI9qQaaiM9t7tRBDTyaqel gd5TgWwh7fpQUZskXiiIyx7+BvolkHYL31zYSQja3fXf4pRJNcF0nLiYsg7ct7lPWA7zxWvvW0I z8o9+cs6D1i3VhHCkQPVuoIr6SmgaBN7JJw3oVevUyAFl0vw4bLRL4Y+G2hViMVrCS2Jxi96IPN be1yFVnFECa8vz+eZhe/jN/Ik3kBYPPApviGb2J4PELxhm1l93xViP1edzJELpU57ZZMioIzZ9P XFJ8Ebh6fW6lLCAKS5FSzho9rjT90nwSNfXAI4yEYeVdPdQNHGJmJJgVg1J4BU8DdlOVpOIBiG0 seG1AoeVlsvMn/f4Mn68+HYgAJX3Uwxibrkrg/r0o3C0s/2J92WWtwztOWRmj/XOZb3cZ4DgBT3 aydPRTzbgwjWi0Btd26eeoxOmsga01W9JF8mQNmNiHTSZUlbxQiLAf0LU= X-Google-Smtp-Source: AGHT+IG1HadWvybhRZ1ckXq/8YSVpErsnzffbgEJMA67zutfkfFm6/01vHeWnGfRDKCh2X38vxB6KQ== X-Received: by 2002:a05:600c:3b8f:b0:456:8eb:a36a with SMTP id 5b1f17b1804b1-4562e04736dmr55273065e9.13.1752735593746; Wed, 16 Jul 2025 23:59:53 -0700 (PDT) Received: from ?IPV6:2003:fa:af22:cf00:2208:a86d:dff:5ae9? (p200300faaf22cf002208a86d0dff5ae9.dip0.t-ipconnect.de. [2003:fa:af22:cf00:2208:a86d:dff:5ae9]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-45634f6bc51sm12965085e9.17.2025.07.16.23.59.52 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 16 Jul 2025 23:59:53 -0700 (PDT) Message-ID: Date: Thu, 17 Jul 2025 09:00:04 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v11 00/23] Enable CET Virtualization To: John Allen , Chao Gao Cc: Xiaoyao Li , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org, seanjc@google.com, pbonzini@redhat.com, dave.hansen@intel.com, rick.p.edgecombe@intel.com, mlevitsk@redhat.com, weijiang.yang@intel.com, xin@zytor.com, Borislav Petkov , Dave Hansen , "H. Peter Anvin" , Ingo Molnar , Thomas Gleixner References: <20250704085027.182163-1-chao.gao@intel.com> <88443d81-78ac-45ad-b359-b328b9db5829@intel.com> Content-Language: en-US, de-DE From: Mathias Krause Autocrypt: addr=minipli@grsecurity.net; keydata= xsDNBF4u6F8BDAC1kCIyATzlCiDBMrbHoxLywJSUJT9pTbH9MIQIUW8K1m2Ney7a0MTKWQXp 64/YTQNzekOmta1eZFQ3jqv+iSzfPR/xrDrOKSPrw710nVLC8WL993DrCfG9tm4z3faBPHjp zfXBIOuVxObXqhFGvH12vUAAgbPvCp9wwynS1QD6RNUNjnnAxh3SNMxLJbMofyyq5bWK/FVX 897HLrg9bs12d9b48DkzAQYxcRUNfL9VZlKq1fRbMY9jAhXTV6lcgKxGEJAVqXqOxN8DgZdU aj7sMH8GKf3zqYLDvndTDgqqmQe/RF/hAYO+pg7yY1UXpXRlVWcWP7swp8OnfwcJ+PiuNc7E gyK2QEY3z5luqFfyQ7308bsawvQcFjiwg+0aPgWawJ422WG8bILV5ylC8y6xqYUeSKv/KTM1 4zq2vq3Wow63Cd/qyWo6S4IVaEdfdGKVkUFn6FihJD/GxnDJkYJThwBYJpFAqJLj7FtDEiFz LXAkv0VBedKwHeBaOAVH6QEAEQEAAc0nTWF0aGlhcyBLcmF1c2UgPG1pbmlwbGlAZ3JzZWN1 cml0eS5uZXQ+wsERBBMBCgA7AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAFiEEd7J359B9 wKgGsB94J4hPxYYBGYYFAmBbH/cCGQEACgkQJ4hPxYYBGYaX/gv/WYhaehD88XjpEO+yC6x7 bNWQbk7ea+m82fU2x/x6A9L4DN/BXIxqlONzk3ehvW3wt1hcHeF43q1M/z6IthtxSRi059RO SarzX3xfXC1pc5YMgCozgE0VRkxH4KXcijLyFFjanXe0HzlnmpIJB6zTT2jgI70q0FvbRpgc rs3VKSFb+yud17KSSN/ir1W2LZPK6er6actK03L92A+jaw+F8fJ9kJZfhWDbXNtEE0+94bMa cdDWTaZfy6XJviO3ymVe3vBnSDakVE0HwLyIKvfAEok+YzuSYm1Nbd2T0UxgSUZHYlrUUH0y tVxjEFyA+iJRSdm0rbAvzpwau5FOgxRQDa9GXH6ie6/ke2EuZc3STNS6EBciJm1qJ7xb2DTf SNyOiWdvop+eQZoznJJte931pxkRaGwV+JXDM10jGTfyV7KT9751xdn6b6QjQANTgNnGP3qs TO5oU3KukRHgDcivzp6CWb0X/WtKy0Y/54bTJvI0e5KsAz/0iwH19IB0vpYLzsDNBF4u6F8B DADwcu4TPgD5aRHLuyGtNUdhP9fqhXxUBA7MMeQIY1kLYshkleBpuOpgTO/ikkQiFdg13yIv q69q/feicsjaveIEe7hUI9lbWcB9HKgVXW3SCLXBMjhCGCNLsWQsw26gRxDy62UXRCTCT3iR qHP82dxPdNwXuOFG7IzoGBMm3vZbBeKn0pYYWz2MbTeyRHn+ZubNHqM0cv5gh0FWsQxrg1ss pnhcd+qgoynfuWAhrPD2YtNB7s1Vyfk3OzmL7DkSDI4+SzS56cnl9Q4mmnsVh9eyae74pv5w kJXy3grazD1lLp+Fq60Iilc09FtWKOg/2JlGD6ZreSnECLrawMPTnHQZEIBHx/VLsoyCFMmO 5P6gU0a9sQWG3F2MLwjnQ5yDPS4IRvLB0aCu+zRfx6mz1zYbcVToVxQqWsz2HTqlP2ZE5cdy BGrQZUkKkNH7oQYXAQyZh42WJo6UFesaRAPc3KCOCFAsDXz19cc9l6uvHnSo/OAazf/RKtTE 0xGB6mQN34UAEQEAAcLA9gQYAQoAIAIbDBYhBHeyd+fQfcCoBrAfeCeIT8WGARmGBQJeORkW AAoJECeIT8WGARmGXtgL/jM4NXaPxaIptPG6XnVWxhAocjk4GyoUx14nhqxHmFi84DmHUpMz 8P0AEACQ8eJb3MwfkGIiauoBLGMX2NroXcBQTi8gwT/4u4Gsmtv6P27Isn0hrY7hu7AfgvnK owfBV796EQo4i26ZgfSPng6w7hzCR+6V2ypdzdW8xXZlvA1D+gLHr1VGFA/ZCXvVcN1lQvIo S9yXo17bgy+/Xxi2YZGXf9AZ9C+g/EvPgmKrUPuKi7ATNqloBaN7S2UBJH6nhv618bsPgPqR SV11brVF8s5yMiG67WsogYl/gC2XCj5qDVjQhs1uGgSc9LLVdiKHaTMuft5gSR9hS5sMb/cL zz3lozuC5nsm1nIbY62mR25Kikx7N6uL7TAZQWazURzVRe1xq2MqcF+18JTDdjzn53PEbg7L VeNDGqQ5lJk+rATW2VAy8zasP2/aqCPmSjlCogC6vgCot9mj+lmMkRUxspxCHDEms13K41tH RzDVkdgPJkL/NFTKZHo5foFXNi89kA== In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 16.07.25 22:36, John Allen wrote: > On Mon, Jul 07, 2025 at 09:32:37AM +0800, Chao Gao wrote: >> On Mon, Jul 07, 2025 at 12:51:14AM +0800, Xiaoyao Li wrote: >>> Hi Chao, >>> >>> On 7/4/2025 4:49 PM, Chao Gao wrote: >>>> Tests: >>>> ====================== >>>> This series passed basic CET user shadow stack test and kernel IBT test in L1 >>>> and L2 guest. >>>> The patch series_has_ impact to existing vmx test cases in KVM-unit-tests,the >>>> failures have been fixed here[1]. >>>> One new selftest app[2] is introduced for testing CET MSRs accessibilities. >>>> >>>> Note, this series hasn't been tested on AMD platform yet. >>>> >>>> To run user SHSTK test and kernel IBT test in guest, an CET capable platform >>>> is required, e.g., Sapphire Rapids server, and follow below steps to build >>>> the binaries: >>>> >>>> 1. Host kernel: Apply this series to mainline kernel (>= v6.6) and build. >>>> >>>> 2. Guest kernel: Pull kernel (>= v6.6), opt-in CONFIG_X86_KERNEL_IBT >>>> and CONFIG_X86_USER_SHADOW_STACK options. Build with CET enabled gcc versions >>>> (>= 8.5.0). >>>> >>>> 3. Apply CET QEMU patches[3] before build mainline QEMU. >>> >>> You forgot to provide the links of [1][2][3]. >> >> Oops, thanks for catching this. >> >> Here are the links: >> >> [1]: KVM-unit-tests fixup: >> https://lore.kernel.org/all/20230913235006.74172-1-weijiang.yang@intel.com/ >> [2]: Selftest for CET MSRs: >> https://lore.kernel.org/all/20230914064201.85605-1-weijiang.yang@intel.com/ >> [3]: QEMU patch: >> https://lore.kernel.org/all/20230720111445.99509-1-weijiang.yang@intel.com/ >> >> Please note that [1] has already been merged. And [3] is an older version of >> CET for QEMU; I plan to post a new version for QEMU after the KVM series is >> merged. > > Do you happen to have a branch with the in-progress qemu patches you are > testing with? I'm working on testing on AMD and I'm having issues > getting this old version of the series to work properly. For me the old patches worked by changing the #define of MSR_KVM_GUEST_SSP from 0x4b564d09 to 0x4b564dff -- on top of QEMU 9.0.1, that is. Thanks, Mathias