On Tue, Feb 21, 2023 at 03:48:07PM -0800, Sean Christopherson wrote: > On Tue, Feb 21, 2023, Yu Zhang wrote: > > > Sorry, why guest_cpuid_is_intel(vcpu)? Is it becasue that a AMD host with virtual > > > VMSAVE/VMLOAD capability will always expose this feature for all AMD guests? > > > > Oh, sorry. I missed the guest_cpuid_has() in kvm_governed_feature_check_and_set(). > > So please just ignore my 2nd question. > > > > As to the check of guest_cpuid_is_intel(), is it necessary? > > Yes? The comment in init_vmcb_after_set_cpuid() says: > > /* > * We must intercept SYSENTER_EIP and SYSENTER_ESP > * accesses because the processor only stores 32 bits. > * For the same reason we cannot use virtual VMLOAD/VMSAVE. > */ > > but I'm struggling to connect the dots to SYSENTER. I suspect the comment is > misleading and has nothing to do 32-bit vs. 64-bit (or I'm reading it wrong) and > should be something like: > > /* > * Disable virtual VMLOAD/VMSAVE and intercept VMLOAD/VMSAVE if the > * guest CPU is Intel in order to inject #UD. > */ > > In other words, a non-SVM guest shouldn't be allowed to execute VMLOAD/VMSAVE. Yes. Such interpretation makes sense. And vmload/vmsave shall be intercepted if guest CPU is Intel and #UD shall be injected. I guess this is done indirectly by judging the EFER_SVME not set in EFER in nested_svm_check_permissions()? And as to X86_FEATURE_V_VMSAVE_VMLOAD, should the guest_cpuid_has() return true at all for a Intel guest? B.R. Yu
