[v3] i386: Support CET for KVM

[PATCH v3 20/20] i386/tdx: Add CET SHSTK/IBT into the supported CPUID by XFAM

Posted by Zhao Liu 3 months, 2 weeks ago

From: Chenyi Qiang <chenyi.qiang@intel.com>

So that it can be configured in TD guest.

And considerring cet-u and cet-s have the same dependencies, it's enough
to only list cet-u in tdx_xfam_deps[].

Tested-by: Farrah Chen <farrah.chen@intel.com>
Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
---
 target/i386/kvm/tdx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index a3444623657f..01619857685b 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -526,6 +526,8 @@ TdxXFAMDep tdx_xfam_deps[] = {
     { XSTATE_OPMASK_BIT,    { FEAT_7_0_EDX, CPUID_7_0_EDX_AVX512_FP16 } },
     { XSTATE_PT_BIT,        { FEAT_7_0_EBX, CPUID_7_0_EBX_INTEL_PT } },
     { XSTATE_PKRU_BIT,      { FEAT_7_0_ECX, CPUID_7_0_ECX_PKU } },
+    { XSTATE_CET_U_BIT,     { FEAT_7_0_ECX, CPUID_7_0_ECX_CET_SHSTK } },
+    { XSTATE_CET_U_BIT,     { FEAT_7_0_EDX, CPUID_7_0_EDX_CET_IBT } },
     { XSTATE_XTILE_CFG_BIT, { FEAT_7_0_EDX, CPUID_7_0_EDX_AMX_BF16 } },
     { XSTATE_XTILE_CFG_BIT, { FEAT_7_0_EDX, CPUID_7_0_EDX_AMX_TILE } },
     { XSTATE_XTILE_CFG_BIT, { FEAT_7_0_EDX, CPUID_7_0_EDX_AMX_INT8 } },
-- 
2.34.1

Re: [PATCH v3 20/20] i386/tdx: Add CET SHSTK/IBT into the supported CPUID by XFAM

Posted by Xiaoyao Li 3 months, 2 weeks ago

On 10/24/2025 2:56 PM, Zhao Liu wrote:
> From: Chenyi Qiang <chenyi.qiang@intel.com>
> 
> So that it can be configured in TD guest.
> 
> And considerring cet-u and cet-s have the same dependencies, it's enough
> to only list cet-u in tdx_xfam_deps[].

In fact, this is not the reason.

The reason is that CET_U and CET_S bits are always same in supported 
XFAM reported by TDX module, i.e., either 00 or 11. So, we only need to 
choose one of them.

> Tested-by: Farrah Chen <farrah.chen@intel.com>
> Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
> Signed-off-by: Zhao Liu <zhao1.liu@intel.com>

With commit message updated,

Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>

> ---
>   target/i386/kvm/tdx.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
> index a3444623657f..01619857685b 100644
> --- a/target/i386/kvm/tdx.c
> +++ b/target/i386/kvm/tdx.c
> @@ -526,6 +526,8 @@ TdxXFAMDep tdx_xfam_deps[] = {
>       { XSTATE_OPMASK_BIT,    { FEAT_7_0_EDX, CPUID_7_0_EDX_AVX512_FP16 } },
>       { XSTATE_PT_BIT,        { FEAT_7_0_EBX, CPUID_7_0_EBX_INTEL_PT } },
>       { XSTATE_PKRU_BIT,      { FEAT_7_0_ECX, CPUID_7_0_ECX_PKU } },
> +    { XSTATE_CET_U_BIT,     { FEAT_7_0_ECX, CPUID_7_0_ECX_CET_SHSTK } },
> +    { XSTATE_CET_U_BIT,     { FEAT_7_0_EDX, CPUID_7_0_EDX_CET_IBT } },
>       { XSTATE_XTILE_CFG_BIT, { FEAT_7_0_EDX, CPUID_7_0_EDX_AMX_BF16 } },
>       { XSTATE_XTILE_CFG_BIT, { FEAT_7_0_EDX, CPUID_7_0_EDX_AMX_TILE } },
>       { XSTATE_XTILE_CFG_BIT, { FEAT_7_0_EDX, CPUID_7_0_EDX_AMX_INT8 } },

Re: [PATCH v3 20/20] i386/tdx: Add CET SHSTK/IBT into the supported CPUID by XFAM

Posted by Zhao Liu 3 months, 1 week ago

On Tue, Oct 28, 2025 at 04:55:25PM +0800, Xiaoyao Li wrote:
> Date: Tue, 28 Oct 2025 16:55:25 +0800
> From: Xiaoyao Li <xiaoyao.li@intel.com>
> Subject: Re: [PATCH v3 20/20] i386/tdx: Add CET SHSTK/IBT into the
>  supported CPUID by XFAM
> 
> On 10/24/2025 2:56 PM, Zhao Liu wrote:
> > From: Chenyi Qiang <chenyi.qiang@intel.com>
> > 
> > So that it can be configured in TD guest.
> > 
> > And considerring cet-u and cet-s have the same dependencies, it's enough
> > to only list cet-u in tdx_xfam_deps[].
> 
> In fact, this is not the reason.
> 
> The reason is that CET_U and CET_S bits are always same in supported XFAM
> reported by TDX module, i.e., either 00 or 11. So, we only need to choose
> one of them.

Good words. Will update.

> > Tested-by: Farrah Chen <farrah.chen@intel.com>
> > Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
> > Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
> 
> With commit message updated,
> 
> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>

Thanks!

Regards,
Zhao