Re: [PATCH v3 18/21] KVM:x86: Enable CET virtualization for VMX and advertise to userspace

Yang, Weijiang
2023-05-24T08:07:33Z

On 5/24/2023 2:35 PM, Chenyi Qiang wrote:
>
> On 5/11/2023 12:08 PM, Yang Weijiang wrote:

[...]

>> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
>> index 50026557fb2a..858cb68e781a 100644
>> --- a/arch/x86/kvm/x86.c
>> +++ b/arch/x86/kvm/x86.c
>> @@ -226,7 +226,7 @@ static struct kvm_user_return_msrs __percpu *user_return_msrs;
>> | XFEATURE_MASK_BNDCSR | XFEATURE_MASK_AVX512 \
>> | XFEATURE_MASK_PKRU | XFEATURE_MASK_XTILE)
>>
>> -#define KVM_SUPPORTED_XSS 0
>> +#define KVM_SUPPORTED_XSS (XFEATURE_MASK_CET_USER)
>>
>> u64 __read_mostly host_efer;
>> EXPORT_SYMBOL_GPL(host_efer);
>> @@ -9525,6 +9525,25 @@ static int __kvm_x86_vendor_init(struct kvm_x86_init_ops *ops)
>>
>> kvm_ops_update(ops);
>>
>> + /*
>> + * Check CET user bit is still set in kvm_caps.supported_xss,
>> + * if not, clear the cap bits as the user parts depends on
>> + * XSAVES support.
>> + */
>> + if (!kvm_cet_user_supported()) {
>> + kvm_cpu_cap_clear(X86_FEATURE_SHSTK);
>> + kvm_cpu_cap_clear(X86_FEATURE_IBT);
>> + }
>> +
>> + /*
>> + * If SHSTK and IBT are available in KVM, clear CET user bit in
> Should it be "If SHSTK and IBT are *not* available ..."?

Good catch, thanks! I'll change it in next version!

>
>> + * kvm_caps.supported_xss so that kvm_cet_user_supported() returns
>> + * false when called.
>> + */
>> + if (!kvm_cpu_cap_has(X86_FEATURE_SHSTK) &&
>> + !kvm_cpu_cap_has(X86_FEATURE_IBT))
>> + kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_USER;
>> +
>> for_each_online_cpu(cpu) {
>> smp_call_function_single(cpu, kvm_x86_check_cpu_compat, &r, 1);
>> if (r < 0)