On Mon, Nov 21, 2022, Borislav Petkov wrote: > On Mon, Nov 21, 2022 at 03:48:06PM +0000, Sean Christopherson wrote: > > Actually, for these features that don't require additional KVM enabling, KVM isn't > > making the feature avaiable to the guest. KVM is just advertising to userspace > > that KVM "supports" these features. Userspace ultimately controls guest CPUID; > > outside of a few special cases, KVM neither rejects nor filters unsupported bits > > in CPUID. > > So is there any point to those "enable it in KVM" patches streaming constantly? Yes. Most userspace VMMs sanitize their CPUID models based on KVM_GET_SUPPORTED_CPUID, e.g. by default, QEMU will refuse to enable features in guest CPUID that aren't reported as supported by KVM. Another use case is for userspace to blindly use the result of KVM_GET_SUPPORTED_CPUID as the guest's CPUID model, e.g. for using KVM to isolate code as opposed to standing up a traditional virtual machine. For that use case, userspace again relies on KVM to enumerate support. What I was trying to call out in the above is that the KVM "enabling" technically doesn't expose the feature to the guest. E.g. a clever guest could ignore CPUID and probe the relevant instructions manually by seeing whether or not they #UD.
