Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <8ae1bf2e-48d1-4c9b-4dc3-398c8e199247@intel.com>
Date:   Sat, 1 Jul 2023 09:58:51 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.12.0
Subject: Re: [PATCH v3 10/21] KVM:x86: Add #CP support in guest exception
 classification
Content-Language: en-US
To:     Sean Christopherson <seanjc@google.com>,
        Gil Neiger <gil.neiger@intel.com>
CC:     Chao Gao <chao.gao@intel.com>,
        "pbonzini@redhat.com" <pbonzini@redhat.com>,
        "kvm@vger.kernel.org" <kvm@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "peterz@infradead.org" <peterz@infradead.org>,
        "rppt@kernel.org" <rppt@kernel.org>,
        "binbin.wu@linux.intel.com" <binbin.wu@linux.intel.com>,
        Rick P Edgecombe <rick.p.edgecombe@intel.com>,
        "john.allen@amd.com" <john.allen@amd.com>
References: <20230511040857.6094-11-weijiang.yang@intel.com>
 <ZH73kDx6VCaBFiyh@chao-email>
 <21568052-eb0f-a8d6-5225-3b422e9470e9@intel.com>
 <ZIulniryqlj0hLnt@google.com>
 <dfdf6d93-a68c-bb07-e59e-8d888dd6ebb6@intel.com>
 <ZIywqx6xTAMFyDPT@google.com>
 <0a98683f-3e60-1f1b-55df-f2a781929fdf@intel.com>
 <ZJ6uKZToMPfwoXW6@chao-email>
 <8dec8b09-2568-a664-e51d-e6ff9f49e7de@intel.com>
 <CO1PR11MB5107FBC68DBA6877E390A633912AA@CO1PR11MB5107.namprd11.prod.outlook.com>
 <ZJ7xjE0qMjpYIiB/@google.com>
From:   "Yang, Weijiang" <weijiang.yang@intel.com>
In-Reply-To: <ZJ7xjE0qMjpYIiB/@google.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?RjA1dG9EZGVURzRubVl4TzZaNzRsU3FCclowQVRydDRkWVV1cXhCUkFqUlcw?=
 =?utf-8?B?ZHNIWmdod1paRnpVWVNWUnJEOVRoQjVmQ3IyRXZ3bnMvVzUzcEhOTVFkU3R3?=
 =?utf-8?B?NGRFdUtOVDgzeTY3UHRnNy9jV2FvUHhQVmUwdnlJenhlR2FmS1JhY3V6aklu?=
 =?utf-8?B?bnpXbVhpb29uU0hETlVZMVdFdk03VHNsbWFDNDAydHU3U1JqbCtWN1dkWVNy?=
 =?utf-8?B?NURZYjhYV3R5dHRSeE41eHE2OVA4bFV4aDFQRlc1U1VjUi9UY2Z2cGpWZ2F0?=
 =?utf-8?B?eC9xUXRxc2M1anQ5ZE5BdEFuNCsvdGw4VW1LclpwcmVHQUt3VFVRUytTYVcy?=
 =?utf-8?B?MEZEZXBOZWFsVGZGeExoTlg1d2MxM3FSaUhSeWpTTkxablROOE1XR3ExbGtH?=
 =?utf-8?B?NndNQWNSTWhmSWREZm11V1V0ekF6YkRMUVFWK2ZaSHZ6MkpzMlRGc1NGZllF?=
 =?utf-8?B?M0trdm9IV0h3clB2ZHBZaFBiMFRLRGRzZFUybUQ5RXQ4SUM2dzhJUHdDV1hZ?=
 =?utf-8?B?S1ovbzgwWWxXelg0MWNPU2F1VFI1WWpCd21VdGVHckJvZ0FkR1NSMk9XOW5T?=
 =?utf-8?B?cmZKZnRzYmVjYTBvSXdBVGdVcmRhTVF5TnVRWXpVeDZWZzNaYnc4c3h3a3Ew?=
 =?utf-8?B?VDhxYUJOQWZxdVVQSGxIdmhCMG9Tb3ZIdUZQM25RTVhPNHYvR2tWNjhTcUJK?=
 =?utf-8?B?TUhxOE5KYTV4cncybzV5MW9zN3E5WEE5em9nd2RLMjJiV0FIenlKbXZsNXVu?=
 =?utf-8?B?NVB2VHpNSkQ1ejljQkl1U2hheEVCTldIQXNQaElXVVBpSnN3NDRKWld0TEZZ?=
 =?utf-8?B?T3pJTkk1dGZkeEU2UzFsWkw1eHhtdVliYzlqamNCRGVyOURodnB0Zm5OVExW?=
 =?utf-8?B?UFJOclFLczhSdVlzRktXNTJuZVhVK1ZkU2dOYkRKK09HbXZHVFpYY04wN05u?=
 =?utf-8?B?cE1FTURtdURiN2dZYVBxNVBXbEJyUU84Q1MzdVN0RE50UGJtazJLaTdORFZX?=
 =?utf-8?B?cnRNM3d4US9GV1hiS0x6bndITUNjRVc5bEZNS3NyY3FKWUZxM2ZZMUZXemZM?=
 =?utf-8?B?dDVnRndMaTQrUSt0T3VKNy9ialc3ZkZUSWl0SnpFMUtUbFVSUlBSQUVuVEdM?=
 =?utf-8?B?emc5Sm5iUnVwVFc3NkxFVGdFcGlVaU42bVFMTEdhNW1kNmgzRXgxYlk2VmJX?=
 =?utf-8?B?UzdjVkFWYitsMU96c1dNM0FOL2dmM2k3cE5LdzRYc2luRGxiU1VyYmtGN3Fk?=
 =?utf-8?B?bEJMRVFBNkI2dnB6NUw0YkZBNXZKSGNIMFF6aTA4MkJRVnN2VXFHQ3pRVStq?=
 =?utf-8?B?ZGhlT1dHMkEyWUh2TVVTNVVEbG8wQ2Yva1lsTlMyam9meXMvT3hYMGdCcjFZ?=
 =?utf-8?B?aUhVOUkyKzFiR2haSlpnZzcxZ2JrZHlwYTRkZUgyQ0phM3hCb3ZOeTJLeXdp?=
 =?utf-8?B?WGJRS3NkUHk2dDAzUGVQOWQ3VitNamQ0VDI2N1J5cHJlT1l1OURUd1ZaRGdP?=
 =?utf-8?B?L0RyelhQQXpVVHkra3I5alJGalNCczcxVWNWK0I0cmpwQ3ZBbzhHcUQ0L1pH?=
 =?utf-8?B?UGovdUdBNVN0aGhqNzN1VXp1RmJuZkZrb3lRQlRsM1lnMWtvUVFKaC8zOGJ0?=
 =?utf-8?B?b0tZcThXZ094enpSd3ppb0orazgyWHpzR3J2T1NyZi9tb2tUTGxTVzRvN3py?=
 =?utf-8?B?RmE3ZDkxeHd2ZFpxVFhnclcxSWk0VjJIclNOMEFnY0FKWTZEMXNLUlhyNzdU?=
 =?utf-8?B?dTlGMGNQckpVbS9ZZGozcGFleEdBUlFsUHY3QnhoUXBnNnRzTDI4ZENqdWZa?=
 =?utf-8?B?a2NhUVlyTjlFT281UDdOZUJUa00rYUNETXgvY1FGYmN6Q3BzSEhMWUk4WWpJ?=
 =?utf-8?B?akUvS3p1dTR6S2VTdXJDQ0hLODhaamUrSTQyVUdNMmhQdGNiZzEwOTNEV1FU?=
 =?utf-8?B?aDFaN3hkL1ZDS1hScjFBbFFTSFJYZWk3d0VGUzkrU1huUUp6VHNaenVIOU9D?=
 =?utf-8?B?YW5iL1htREZXYzYvWkdZQjh4T3B2TjlaUFJzMkhFelRhVTJHL0ZqRk50RUM2?=
 =?utf-8?B?cEtONFFHOElxL3Y0encvVXJlVDNMRDZocEllRVJ3aGU4MFhIYWViQkJ3NXlM?=
 =?utf-8?B?cWZ0RkhzYmJzbFY4aXIxTEd3UWNvVTJCTWliRVhGRWFnS2hZZkx6RFMxRStD?=
 =?utf-8?B?cHc9PQ==?=
X-MS-Exchange-CrossTenant-Network-Message-Id: a0a64db4-bf7b-48ff-b95f-08db79d6bdd0
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4965.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jul 2023 01:59:02.0739
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: lEhJd/SuhNZvP/E8rPMnQPuQ+41wKTqe8VZpmGH1dR5GzK3WqH55zL1P/6ROb2+hzvbScd6PKpzkzhtS9SsVuw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR11MB5955
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-4.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,
        RCVD_IN_DNSWL_MED,SPF_HELO_PASS,SPF_NONE,T_SCC_BODY_TEXT_LINE,
        URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 6/30/2023 11:15 PM, Sean Christopherson wrote:
> On Fri, Jun 30, 2023, Gil Neiger wrote:
>> Intel will not produce any CPU with CET that does not enumerate IA32_VMX_BASIC[56] as 1.
>>
>> One can check that bit before injecting a #CP with error code, but it should
>> not be necessary if CET is enumerated.
>>
>> Of course, if the KVM may run as a guest of another VMM/hypervisor, it may be
>> that the virtual CPU in which KVM operates may enumerate CET but clear the
>> bit in IA32_VMX_BASIC.
> Yeah, I think KVM should be paranoid and expose CET to the guest if and only if
> IA32_VMX_BASIC[56] is 1.  That'll also help validate nested support, e.g. will
> make it more obvious if userspace+KVM provides a  "bad" model to L1.

OK, will do it, thanks you two!