[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <f77496b0-ee94-4690-803f-44650706640f@intel.com>
Date: Thu, 16 May 2024 15:20:21 +0800
From: "Yang, Weijiang" <weijiang.yang@...el.com>
To: Sean Christopherson <seanjc@...gle.com>
CC: <pbonzini@...hat.com>, <dave.hansen@...el.com>, <x86@...nel.org>,
<kvm@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
<peterz@...radead.org>, <chao.gao@...el.com>, <rick.p.edgecombe@...el.com>,
<mlevitsk@...hat.com>, <john.allen@....com>
Subject: Re: [PATCH v10 24/27] KVM: x86: Enable CET virtualization for VMX and
advertise to userspace
On 5/6/2024 5:41 PM, Yang, Weijiang wrote:
> On 5/2/2024 7:34 AM, Sean Christopherson wrote:
>> On Sun, Feb 18, 2024, Yang Weijiang wrote:
>>> @@ -665,7 +665,7 @@ void kvm_set_cpu_caps(void)
>>> F(AVX512_VPOPCNTDQ) | F(UMIP) | F(AVX512_VBMI2) | F(GFNI) |
>>> F(VAES) | F(VPCLMULQDQ) | F(AVX512_VNNI) | F(AVX512_BITALG) |
>>> F(CLDEMOTE) | F(MOVDIRI) | F(MOVDIR64B) | 0 /*WAITPKG*/ |
>>> - F(SGX_LC) | F(BUS_LOCK_DETECT)
>>> + F(SGX_LC) | F(BUS_LOCK_DETECT) | F(SHSTK)
>>> );
>>> /* Set LA57 based on hardware capability. */
>>> if (cpuid_ecx(7) & F(LA57))
>>> @@ -683,7 +683,8 @@ void kvm_set_cpu_caps(void)
>>> F(SPEC_CTRL_SSBD) | F(ARCH_CAPABILITIES) | F(INTEL_STIBP) |
>>> F(MD_CLEAR) | F(AVX512_VP2INTERSECT) | F(FSRM) |
>>> F(SERIALIZE) | F(TSXLDTRK) | F(AVX512_FP16) |
>>> - F(AMX_TILE) | F(AMX_INT8) | F(AMX_BF16) | F(FLUSH_L1D)
>>> + F(AMX_TILE) | F(AMX_INT8) | F(AMX_BF16) | F(FLUSH_L1D) |
>>> + F(IBT)
>>> );
>> ...
>>
>>> @@ -7977,6 +7993,18 @@ static __init void vmx_set_cpu_caps(void)
>>> if (cpu_has_vmx_waitpkg())
>>> kvm_cpu_cap_check_and_set(X86_FEATURE_WAITPKG);
>>> +
>>> + /*
>>> + * Disable CET if unrestricted_guest is unsupported as KVM doesn't
>>> + * enforce CET HW behaviors in emulator. On platforms with
>>> + * VMX_BASIC[bit56] == 0, inject #CP at VMX entry with error code
>>> + * fails, so disable CET in this case too.
>>> + */
>>> + if (!cpu_has_load_cet_ctrl() || !enable_unrestricted_guest ||
>>> + !cpu_has_vmx_basic_no_hw_errcode()) {
>>> + kvm_cpu_cap_clear(X86_FEATURE_SHSTK);
>>> + kvm_cpu_cap_clear(X86_FEATURE_IBT);
>>> + }
>> Oh! Almost missed it. This patch should explicitly kvm_cpu_cap_clear()
>> X86_FEATURE_SHSTK and X86_FEATURE_IBT. We *know* there are upcoming AMD CPUs
>> that support at least SHSTK, so enumerating support for common code would yield
>> a version of KVM that incorrectly advertises support for SHSTK.
>>
>> I hope to land both Intel and AMD virtualization in the same kernel release, but
>> there are no guarantees that will happen. And explicitly clearing both SHSTK and
>> IBT would guard against IBT showing up in some future AMD CPU in advance of KVM
>> gaining full support.
>
> Let me be clear on this, you want me to disable SHSTK/IBT with kvm_cpu_cap_clear() unconditionally
> for now in this patch, and wait until both AMD's SVM patches and this series are ready for guest CET,
> then remove the disabling code in this patch for final merge, am I right?
Hi, Sean,
I haven't got your reply on above question. Would like to get your confirmation.
Thanks!
>
>
Powered by blists - more mailing lists