"Load Guest CET state" bit controls whether guest CET states will be loaded at Guest entry. Before doing that, KVM needs to check if CPU CET feature is available. Signed-off-by: Zhang Yi Z <yi.z.zhang@xxxxxxxxxxxxxxx> Signed-off-by: Yang Weijiang <weijiang.yang@xxxxxxxxx> --- arch/x86/kvm/vmx.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 89ee086e1729..d32cee9ee079 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -55,6 +55,7 @@ #include <asm/mmu_context.h> #include <asm/spec-ctrl.h> #include <asm/mshyperv.h> +#include <asm/cet.h> #include "trace.h" #include "pmu.h" @@ -4065,6 +4066,20 @@ static inline bool vmx_feature_control_msr_valid(struct kvm_vcpu *vcpu, return !(val & ~valid_bits); } +static int vmx_guest_cet_cap(struct kvm_vcpu *vcpu) +{ + u32 eax, ebx, ecx, edx; + + /* + * Guest CET can work as long as HW supports the feature, independent + * to Host SW enabling status. + */ + cpuid_count(7, 0, &eax, &ebx, &ecx, &edx); + + return ((ecx & bit(X86_FEATURE_SHSTK)) | + (edx & bit(X86_FEATURE_IBT))) ? 1 : 0; +} + static int vmx_get_msr_feature(struct kvm_msr_entry *msr) { switch (msr->index) { @@ -5409,6 +5424,23 @@ static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) return 1; } + /* + * To enable Guest CET, check whether CPU CET feature is + * available, if it's there, set Guest CET state loading bit + * per CR4.CET status, otherwise, return a fault to Guest. + */ + if (vmx_guest_cet_cap(vcpu)) { + if (cr4 & X86_CR4_CET) { + vmcs_set_bits(VM_ENTRY_CONTROLS, + VM_ENTRY_LOAD_GUEST_CET_STATE); + } else { + vmcs_clear_bits(VM_ENTRY_CONTROLS, + VM_ENTRY_LOAD_GUEST_CET_STATE); + } + } else if (cr4 & X86_CR4_CET) { + return 1; + } + if (to_vmx(vcpu)->nested.vmxon && !nested_cr4_valid(vcpu, cr4)) return 1; -- 2.17.1