Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [RFC] Revert "kvm: nVMX: Restrict VMX capability MSR changes"
To:     Vitaly Kuznetsov <vkuznets@redhat.com>,
        Jim Mattson <jmattson@google.com>
Cc:     Sean Christopherson <sean.j.christopherson@intel.com>,
        kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
        Liran Alon <liran.alon@oracle.com>
References: <20200120151141.227254-1-vkuznets@redhat.com>
From:   Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <30525d58-10de-abb4-8dad-228da766ff82@redhat.com>
Date:   Mon, 20 Jan 2020 16:41:27 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.1.1
MIME-Version: 1.0
In-Reply-To: <20200120151141.227254-1-vkuznets@redhat.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 20/01/20 16:11, Vitaly Kuznetsov wrote:
> 
> RFC. I think the check for vmx->nested.vmxon is legitimate for everything
> but restore so removing it (what I do with the revert) is likely a no-go.
> I'd like to gather opinions on the proper fix: should we somehow check
> that the vCPU is in 'restore' start (has never being run) and make
> KVM_SET_MSRS pass or should we actually mandate that KVM_SET_NESTED_STATE
> is run after KVM_SET_MSRS by userspace?
> 
> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>

I think this should be fixed in QEMU, by doing KVM_SET_MSRS for feature
MSRs way earlier.  I'll do it since I'm currently working on a patch to
add a KVM_SET_MSR for the microcode revision.

Thanks,

Paolo