Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <c9747bd0-2a1e-a7ef-4775-b5ca7c00b24e@intel.com>
Date:   Thu, 4 May 2023 09:20:41 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.10.0
Subject: Re: [PATCH v2 21/21] KVM:x86: Support CET supervisor shadow stack MSR
 access
Content-Language: en-US
To:     "Edgecombe, Rick P" <rick.p.edgecombe@intel.com>,
        "peterz@infradead.org" <peterz@infradead.org>,
        "pbonzini@redhat.com" <pbonzini@redhat.com>,
        "Christopherson,, Sean" <seanjc@google.com>,
        "john.allen@amd.com" <john.allen@amd.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "kvm@vger.kernel.org" <kvm@vger.kernel.org>
References: <20230421134615.62539-1-weijiang.yang@intel.com>
 <20230421134615.62539-22-weijiang.yang@intel.com>
 <175c826d59f1ac77fa588908d3768ffc2e79268e.camel@intel.com>
From:   "Yang, Weijiang" <weijiang.yang@intel.com>
In-Reply-To: <175c826d59f1ac77fa588908d3768ffc2e79268e.camel@intel.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?ZWMyWTNIMTcwQndJc0RzRlBka0pQcmNGcVFvOWh6NGkxRk5UVW9GdVFEUU1P?=
 =?utf-8?B?Qml4OSt6eWdiRHVxNE5KNjVpb2RvZWVKUnlrS01TUmI3RDl5NmtpUVlkQVRu?=
 =?utf-8?B?Qyt5L0ZCNkU3MEZKY1pHR21PTVNoU1RQOU5DSnBxOXNkMEhTaEJxUWRsLzNv?=
 =?utf-8?B?K0twbnk0MVlaT1RXVUlKdFRySElvNWEyTENZUUlqRG5TclJ6S3oyZUsyOVlD?=
 =?utf-8?B?WndpZnhXOVZGTnNkcFpjYVlLaWMrV0VNRGtTcnRWS3Z4dk0xaUtSWUtRbmZ5?=
 =?utf-8?B?SFlWblUzeVIzVkpoOER5a2hOeGVScWhjb2t2Qzk1M21DVmdRS0x4MkVLUSti?=
 =?utf-8?B?TDlXSHJabmVJSDNyNmVZQzF4cnlmKzYwM2grSDZrbE5QOCtncStvT3FhTW92?=
 =?utf-8?B?Tml2M0dtTzNlc1o5Wmk5K1N6VEo2Zll2dW5qcmNxaG5NVW9PMjJFQTQ2cWVa?=
 =?utf-8?B?ZmJ1QWFwNEFDeUZQdW5Fb2psTm1HZ2ZBQlNudVovbjBtM1MxYmZXVVFoSVNh?=
 =?utf-8?B?Z3RDSG9GVGFxbHpxeGNVRk1LT1BUaUNHUmlEZXhPbHpsVm1hOXo4SnpyMHRK?=
 =?utf-8?B?enU2dW9oZDMzL0VHKzJSSC9LdDZsNWQyT1hwSWtvRW5mYnljRWJSTEF5TDF0?=
 =?utf-8?B?RmpJMGgrUS9kaFc0eGduNjN5TEVEb2FSZ25sTzkrU1NxQmJpSkV2ZlMxNmJa?=
 =?utf-8?B?aHZuSzYyUy9GcitMYVVGMkVZbGgvdmcyRVVPNjVhZ3p3V1U3b1lVWi9NdUlD?=
 =?utf-8?B?MUc0WDhnZ0p3Y0hOU3E1eFdPWGRrd0drUGFmK3A4eWFmR3ptQVNPQmJncXdo?=
 =?utf-8?B?b0dva3lFY2FtNVdURnduWTZQcS9pTVdOOWVSWG1vc29Send6U0JTWWZjL3pU?=
 =?utf-8?B?QTJuVHkvQzkvYzFDM3lKUHBRUWhRcGZoaDBGZnAvVi9JSGFDemU2bmZYNDFU?=
 =?utf-8?B?UnBjenFGa1ZJK3UzTE9Gb3pWZ1dzT3BzSUI4WkFiK2h4V1VBUVRoMm5ielFI?=
 =?utf-8?B?b0FObStUL0lCVW55ZVZTWXBmUjFYUk1MWUhRZkdBTlFKK2dONWd0bUFoYlp3?=
 =?utf-8?B?aGJRdmkzV2xHTFF2a2dXbzhuQzBnSmhFaHFOeW02TG1RWXIvK3d1QWJOUlY5?=
 =?utf-8?B?cnlNSXdZUy9IRzJ5UlliZVBVVGtJQlZGRXJITkJOcUtWN0Fpc01CMGxJQUNq?=
 =?utf-8?B?VlhkMkNteG5NeUdUbk15MTVkU2srdnJyaFpkVDZadktrWVRQdEpyWDNIT2Mv?=
 =?utf-8?B?U256MXFiUHpHMW5CZTRqREpFYkZEK0MxdDFPQS9SKzVTVXR3VWFyNTNham9F?=
 =?utf-8?B?Rk4rVm5Mc21Pc2JkYmExazNHZDY0d1I2WU1BVDk3eUY0NjFTbWlWNGVPc0hX?=
 =?utf-8?B?cFNrQkVSaHBEOVMzeDVNekNDZXZaUmc0RXp1UGNkQzMxZWpiT3I4TUFGbU05?=
 =?utf-8?B?eFJob21QQTRjajdsaVdzRGRhd0V3NGdZb2k5ZnBKZ1Q5d2hWVXMxcUlPWHA4?=
 =?utf-8?B?RFkvbVhmc2VuMjVsUXU5NnZjaTVsSGtGdXUzMUhuK3hiYXVrekJabXVwSHcw?=
 =?utf-8?B?K1VTeFpCMTZtUzZkaGNJZ3N2OXduZG9wd3lhQzNGMlA5UDFTZzdkSlB0Q1Fl?=
 =?utf-8?B?cWVjTXlqMXkwaUpucm5oYmpRaC8xdDVEWjRlSXh0SFJJTFVaN1JzZTZkQlIx?=
 =?utf-8?B?dWplK1RDQk1IVmJxOHJWQlBNYm1BN0Q5Si80Y3lmajFRZXlYdktvZnFFaTNT?=
 =?utf-8?B?RlRaSHRzZSs0TjRTWTdlL0NrUlBnOUxIYzlLQnpuZ3ZTNm5RVG4vV0FwWW5S?=
 =?utf-8?B?MXRQcEpXNWYrT0hkbm9rS0k4WE1VUnQ2dVpWQ2xMVndFakQ4ekt1Vmc5eTlw?=
 =?utf-8?B?Wk5xVkFpUFRuSkw5L3E3Mmp2dUcxUEdod1NLbzF3U3pnd0FPREtWNVNwZjUw?=
 =?utf-8?B?WE5WNGFqTFVqSklDdklCdXJOU2dEWG5venllSFJQaFVUY04xWW4rRGlGNnFE?=
 =?utf-8?B?dDNaamNrUCtZdGZBUXh5MkkxVms0U1BsK2hxUjJ3NHRBWHFneFpXemZMckQx?=
 =?utf-8?B?WCtjVUJuMXFxMVJnU01LSGNkRktwK0JScFZOUnZPN20rakJBWGF6N0p1TjJl?=
 =?utf-8?B?ZFg2RHhXNktpTkVEblVya3hGcXFZWHQ5bEIrWTJtZTl1eHp5bjBFaXQ5N0xx?=
 =?utf-8?B?eWc9PQ==?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 2282fd95-f552-44c0-4754-08db4c3dcd61
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4965.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 May 2023 01:20:52.9585
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Lcgk2O4oMHdhm/7eOGl9hSGLkFtbao0FfPi0ZJTRGBIMcGex7JOUo1N6qZEESSjYaV0ToxMYcYDF9RpzMc/+dg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR11MB8031
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-8.8 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,
        RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,
        SPF_NONE,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 5/4/2023 1:07 AM, Edgecombe, Rick P wrote:
> On Fri, 2023-04-21 at 09:46 -0400, Yang Weijiang wrote:
>> +
>> +       incpt = !is_cet_state_supported(vcpu,
>> XFEATURE_MASK_CET_KERNEL);
>> +       incpt |= !guest_cpuid_has(vcpu, X86_FEATURE_SHSTK);
>> +
>> +       vmx_set_intercept_for_msr(vcpu, MSR_IA32_INT_SSP_TAB,
>> MSR_TYPE_RW, incpt);
>> +       vmx_set_intercept_for_msr(vcpu, MSR_IA32_PL0_SSP,
>> MSR_TYPE_RW, incpt);
>> +       vmx_set_intercept_for_msr(vcpu, MSR_IA32_PL1_SSP,
>> MSR_TYPE_RW, incpt);
>> +       vmx_set_intercept_for_msr(vcpu, MSR_IA32_PL2_SSP,
>> MSR_TYPE_RW, incpt);
>>   }
> Why is this tied to XFEATURE_MASK_CET_KERNEL? I don't know how the SVM
> side works, but the host kernel doesn't use this xfeature. Just not
> clear on what the intention is. Why not use
> kvm_cet_kernel_shstk_supported() again?

I don't know how SVM supports supervisor SHSTK either, here just follows 
the spec.

to add the dependency check. Maybe you're right, I need to use 
kvm_cet_kernel_shstk_supported()

in my patch set and leave the work to SVM enabling patches. I'll change 
it, thanks!