2020-10-05 15:01:47

by Tianjia Zhang

Subject: [PATCH] KVM: x86: filter guest NX capability for cpuid2

Original KVM_SET_CPUID has removed NX on non-NX hosts as it did
before. but KVM_SET_CPUID2 does not. The two should be consistent.

Signed-off-by: Tianjia Zhang <[email protected]>
---
arch/x86/kvm/cpuid.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 3fd6eec202d7..3e7ba2b11acb 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -257,6 +257,7 @@ int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
goto out;
}

+ cpuid_fix_nx_cap(vcpu);
kvm_update_cpuid_runtime(vcpu);
kvm_vcpu_after_set_cpuid(vcpu);
out:
--
2.24.3 (Apple Git-128)

2020-10-05 15:34:49

by Vitaly Kuznetsov

Subject: Re: [PATCH] KVM: x86: filter guest NX capability for cpuid2

Tianjia Zhang <[email protected]> writes:

> Original KVM_SET_CPUID has removed NX on non-NX hosts as it did
> before. but KVM_SET_CPUID2 does not. The two should be consistent.
>
> Signed-off-by: Tianjia Zhang <[email protected]>
> ---
> arch/x86/kvm/cpuid.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> index 3fd6eec202d7..3e7ba2b11acb 100644
> --- a/arch/x86/kvm/cpuid.c
> +++ b/arch/x86/kvm/cpuid.c
> @@ -257,6 +257,7 @@ int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
> goto out;
> }
>
> + cpuid_fix_nx_cap(vcpu);
> kvm_update_cpuid_runtime(vcpu);
> kvm_vcpu_after_set_cpuid(vcpu);
> out:

I stumbled upon this too and came to the conclusion this is
intentional, e.g. see this:

commit 0771671749b59a507b6da4efb931c44d9691e248
Author: Dan Kenigsberg <[email protected]>
Date: Wed Nov 21 17:10:04 2007 +0200

KVM: Enhance guest cpuid management

...

[avi: fix original KVM_SET_CPUID not removing nx on non-nx hosts as it did
before]

but this is a very, very old story.

--
Vitaly

2020-10-05 18:51:00

by Sean Christopherson

Subject: Re: [PATCH] KVM: x86: filter guest NX capability for cpuid2

On Mon, Oct 05, 2020 at 05:29:47PM +0200, Vitaly Kuznetsov wrote:
> Tianjia Zhang <[email protected]> writes:
>
> > Original KVM_SET_CPUID has removed NX on non-NX hosts as it did
> > before. but KVM_SET_CPUID2 does not. The two should be consistent.
> >
> > Signed-off-by: Tianjia Zhang <[email protected]>
> > ---
> > arch/x86/kvm/cpuid.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> > index 3fd6eec202d7..3e7ba2b11acb 100644
> > --- a/arch/x86/kvm/cpuid.c
> > +++ b/arch/x86/kvm/cpuid.c
> > @@ -257,6 +257,7 @@ int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
> > goto out;
> > }
> >
> > + cpuid_fix_nx_cap(vcpu);
> > kvm_update_cpuid_runtime(vcpu);
> > kvm_vcpu_after_set_cpuid(vcpu);
> > out:
>
> I stumbled upon this too and came to the conclusion this is
> intentional, e.g. see this:
>
> commit 0771671749b59a507b6da4efb931c44d9691e248
> Author: Dan Kenigsberg <[email protected]>
> Date: Wed Nov 21 17:10:04 2007 +0200
>
> KVM: Enhance guest cpuid management
>
> ...
>
> [avi: fix original KVM_SET_CPUID not removing nx on non-nx hosts as it did
> before]
>
> but this is a very, very old story.

Doesn't mean it's bogus though :-) _If_ we want to extend this behavior to
KVM_SET_CPUID2, there should be a justified need.

2020-10-06 07:55:44

by Vitaly Kuznetsov

Subject: Re: [PATCH] KVM: x86: filter guest NX capability for cpuid2

Sean Christopherson <[email protected]> writes:

> On Mon, Oct 05, 2020 at 05:29:47PM +0200, Vitaly Kuznetsov wrote:
>> Tianjia Zhang <[email protected]> writes:
>>
>> > Original KVM_SET_CPUID has removed NX on non-NX hosts as it did
>> > before. but KVM_SET_CPUID2 does not. The two should be consistent.
>> >
>> > Signed-off-by: Tianjia Zhang <[email protected]>
>> > ---
>> > arch/x86/kvm/cpuid.c | 1 +
>> > 1 file changed, 1 insertion(+)
>> >
>> > diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
>> > index 3fd6eec202d7..3e7ba2b11acb 100644
>> > --- a/arch/x86/kvm/cpuid.c
>> > +++ b/arch/x86/kvm/cpuid.c
>> > @@ -257,6 +257,7 @@ int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
>> > goto out;
>> > }
>> >
>> > + cpuid_fix_nx_cap(vcpu);
>> > kvm_update_cpuid_runtime(vcpu);
>> > kvm_vcpu_after_set_cpuid(vcpu);
>> > out:
>>
>> I stumbled upon this too and came to the conclusion this is
>> intentional, e.g. see this:
>>
>> commit 0771671749b59a507b6da4efb931c44d9691e248
>> Author: Dan Kenigsberg <[email protected]>
>> Date: Wed Nov 21 17:10:04 2007 +0200
>>
>> KVM: Enhance guest cpuid management
>>
>> ...
>>
>> [avi: fix original KVM_SET_CPUID not removing nx on non-nx hosts as it did
>> before]
>>
>> but this is a very, very old story.
>
> Doesn't mean it's bogus though :-) _If_ we want to extend this behavior to
> KVM_SET_CPUID2, there should be a justified need.

Yes, exactly. I meand to say that founding fathers of KVM left the
adjustment for KVM_SET_CPUID exclusively on purpose and not by mistake
:-)

--
Vitaly