Re: [PATCH v3 18/21] KVM:x86: Enable CET virtualization for VMX and advertise to userspace

[Chenyi Qiang <chenyi.qiang@intel.com>]

On 5/11/2023 12:08 PM, Yang Weijiang wrote:
> Set the feature bits so that CET capabilities can be seen in guest via
> CPUID enumeration. Add CR4.CET bit support in order to allow guest set
> CET master control bit(CR4.CET).
> 
> Disable KVM CET feature if unrestricted_guest is unsupported/disabled as
> KVM does not support emulating CET.
> 
> Don't expose CET feature if dependent CET bits are cleared in host XSS,
> or if XSAVES isn't supported.
> 
> Co-developed-by: Sean Christopherson <sean.j.christopherson@intel.com>
> Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
> Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
> ---
>  arch/x86/include/asm/kvm_host.h |  3 ++-
>  arch/x86/kvm/cpuid.c            | 12 ++++++++++--
>  arch/x86/kvm/vmx/capabilities.h |  4 ++++
>  arch/x86/kvm/vmx/vmx.c          | 19 +++++++++++++++++++
>  arch/x86/kvm/vmx/vmx.h          |  6 ++++--
>  arch/x86/kvm/x86.c              | 21 ++++++++++++++++++++-
>  arch/x86/kvm/x86.h              |  3 +++
>  7 files changed, 62 insertions(+), 6 deletions(-)

...

> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 50026557fb2a..858cb68e781a 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -226,7 +226,7 @@ static struct kvm_user_return_msrs __percpu *user_return_msrs;
>  				| XFEATURE_MASK_BNDCSR | XFEATURE_MASK_AVX512 \
>  				| XFEATURE_MASK_PKRU | XFEATURE_MASK_XTILE)
>  
> -#define KVM_SUPPORTED_XSS     0
> +#define KVM_SUPPORTED_XSS	(XFEATURE_MASK_CET_USER)
>  
>  u64 __read_mostly host_efer;
>  EXPORT_SYMBOL_GPL(host_efer);
> @@ -9525,6 +9525,25 @@ static int __kvm_x86_vendor_init(struct kvm_x86_init_ops *ops)
>  
>  	kvm_ops_update(ops);
>  
> +	/*
> +	 * Check CET user bit is still set in kvm_caps.supported_xss,
> +	 * if not, clear the cap bits as the user parts depends on
> +	 * XSAVES support.
> +	 */
> +	if (!kvm_cet_user_supported()) {
> +		kvm_cpu_cap_clear(X86_FEATURE_SHSTK);
> +		kvm_cpu_cap_clear(X86_FEATURE_IBT);
> +	}
> +
> +	/*
> +	 * If SHSTK and IBT are available in KVM, clear CET user bit in

Should it be "If SHSTK and IBT are *not* available ..."?

> +	 * kvm_caps.supported_xss so that kvm_cet_user_supported() returns
> +	 * false when called.
> +	 */
> +	if (!kvm_cpu_cap_has(X86_FEATURE_SHSTK) &&
> +	    !kvm_cpu_cap_has(X86_FEATURE_IBT))
> +		kvm_caps.supported_xss &= ~XFEATURE_MASK_CET_USER;
> +
>  	for_each_online_cpu(cpu) {
>  		smp_call_function_single(cpu, kvm_x86_check_cpu_compat, &r, 1);
>  		if (r < 0)