Re: [PATCH v3 18/21] KVM:x86: Enable CET virtualization for VMX and advertise to userspace

[Yang, Weijiang]

On 5/24/2023 2:35 PM, Chenyi Qiang wrote:
> On 5/11/2023 12:08 PM, Yang Weijiang wrote:

[...]

> > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> > index 50026557fb2a..858cb68e781a 100644
> > --- a/arch/x86/kvm/x86.c
> > +++ b/arch/x86/kvm/x86.c
> > @@ -226,7 +226,7 @@ static struct kvm_user_return_msrs __percpu *user_return_msrs;
> >   				| XFEATURE_MASK_BNDCSR | XFEATURE_MASK_AVX512 \
> >   				| XFEATURE_MASK_PKRU | XFEATURE_MASK_XTILE)
> >   
> > -#define KVM_SUPPORTED_XSS     0
> > +#define KVM_SUPPORTED_XSS	(XFEATURE_MASK_CET_USER)
> >   
> >   u64 __read_mostly host_efer;
> >   EXPORT_SYMBOL_GPL(host_efer);
> > @@ -9525,6 +9525,25 @@ static int __kvm_x86_vendor_init(struct kvm_x86_init_ops *ops)
> >   
> >   	kvm_ops_update(ops);
> >   
> > +	/*
> > +	 * Check CET user bit is still set in kvm_caps.supported_xss,
> > +	 * if not, clear the cap bits as the user parts depends on
> > +	 * XSAVES support.
> > +	 */
> > +	if (!kvm_cet_user_supported()) {
> > +		kvm_cpu_cap_clear(X86_FEATURE_SHSTK);
> > +		kvm_cpu_cap_clear(X86_FEATURE_IBT);
> > +	}
> > +
> > +	/*
> > +	 * If SHSTK and IBT are available in KVM, clear CET user bit in
> Should it be "If SHSTK and IBT are *not* available ..."?

Good catch, thanks! I'll change it in next version!

> > +	 * kvm_caps.supported_xss so that kvm_cet_user_supported() returns
> > +	 * false when called.
> > +	 */
> > +	if (!kvm_cpu_cap_has(X86_FEATURE_SHSTK) &&
> > +	    !kvm_cpu_cap_has(X86_FEATURE_IBT))
> > +		kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_USER;
> > +
> >   	for_each_online_cpu(cpu) {
> >   		smp_call_function_single(cpu, kvm_x86_check_cpu_compat, &r, 1);
> >   		if (r < 0)