Received-SPF: pass (google.com: domain of linux-kernel+bounces-28554-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Message-ID: <4a27b660-ac03-4ab5-bf2e-cdddb0147bdb@intel.com>
Date: Wed, 17 Jan 2024 14:16:05 +0800
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH v8 22/26] KVM: VMX: Set up interception for CET MSRs
To: Yuan Yao <yuan.yao@linux.intel.com>
CC: "seanjc@google.com" <seanjc@google.com>, "pbonzini@redhat.com"
	<pbonzini@redhat.com>, "Hansen, Dave" <dave.hansen@intel.com>,
	"kvm@vger.kernel.org" <kvm@vger.kernel.org>, "linux-kernel@vger.kernel.org"
	<linux-kernel@vger.kernel.org>, "peterz@infradead.org"
	<peterz@infradead.org>, "Gao, Chao" <chao.gao@intel.com>, "Edgecombe, Rick P"
	<rick.p.edgecombe@intel.com>, "mlevitsk@redhat.com" <mlevitsk@redhat.com>,
	"john.allen@amd.com" <john.allen@amd.com>
References: <20231221140239.4349-1-weijiang.yang@intel.com>
 <20231221140239.4349-23-weijiang.yang@intel.com>
 <20240115095854.s4smn4ppfjfa2q2z@yy-desk-7060>
 <ee2c5c91-68bd-4f78-aafc-c14093f05342@intel.com>
 <26258c1a-2908-4931-8d6f-fac6754ca2e8@intel.com>
 <20240117053114.6ykoke6gjp52ehvz@yy-desk-7060>
Content-Language: en-US
From: "Yang, Weijiang" <weijiang.yang@intel.com>
In-Reply-To: <20240117053114.6ykoke6gjp52ehvz@yy-desk-7060>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?YklldkowQkVCYjZMdmJKeUpIeVFaTUdWWktrWkx6UisvOEcxQmtGbFhzTFBO?=
 =?utf-8?B?S3AyRGI5endPVDRFUHR0YUk2L0U2UDJDeWZVNkFZblpJMWEyQUp6MTFrS2VY?=
 =?utf-8?B?a05oY05PcGE2RWtXdXhlOXk4bWR6RnVybTJxRW4xcTdIQkhnMmhsSy8vNW1H?=
 =?utf-8?B?K3BoYzF6cE16VFVBMkdQU04yY1FVa3ZhMjZwejJMYUlVd0tnV3FnVjc2V3pN?=
 =?utf-8?B?dkZHelhQWWVNNTlmT3FuWkkydlZmendueUlwK3luVVl2dHM4UFFDa1d0R2Iv?=
 =?utf-8?B?YkR4anFNZ2poN25Fd2pOdGpUQStFWjRnSXk3N3pJVmJ0ZU0raFhLVFNhaCt6?=
 =?utf-8?B?MVZ0VFZub3g5VVF5cEFJUEdPc1BJOFpEZVVPdzcvbEgxMmh2MGpTc0h3ajJM?=
 =?utf-8?B?YTdTNXQvdG90dVJJOUdMaG1aZDFEU3pEYnE3Y2FnUVhsYXV3aVZhS3Z3SXdL?=
 =?utf-8?B?UzdyZ0tOVzNwZ2RTTldrWldibC9QK20yVi83NHYwNXJhaVZxM2tiRTd3bGJV?=
 =?utf-8?B?b2RhcWI2d1dscHVpcWwzS1dTL2dRd1FJRmtMU2tEckxzWUdoSnBQajE1N3R5?=
 =?utf-8?B?RzFuU0dna1dxTFgveXNaVUNDUkJneGl1bEk2ZTlCNGxJZUM5SEQ2Mko4cTFJ?=
 =?utf-8?B?eWRIdDQxWkRmeG9MQXQ1WGRVaE1ueEtMNzdFa3VkUmFPY09IYm9tZUxNTEhJ?=
 =?utf-8?B?Unkrc2toZTNPbkJJSUFiUy91VEFrbi95cnhmdnpGTUxTNUg2VWVPVk1pMG5o?=
 =?utf-8?B?VG81dnA2Tm5nQ2JUanF1NTJKM3NUUVdEanVoSEVxNGtja0xqUDMydkpNci8y?=
 =?utf-8?B?WUVJclR1SlNvWVVBRXNISEw0amtJVklnaDd5ZEhWQTJjYTB1RE9SclUzTFdy?=
 =?utf-8?B?Q3N4Y0RQZ1pyaU5hRSthVjlrR1pDUzFENkpKNXJKd25ha3pVTm5MNmhiRHpu?=
 =?utf-8?B?MDNPTG1BbCs1eVl4ZHZjVWl2MGNWQmVlTlYxL3Q5SjlVYm56YVljRVZIT3ZJ?=
 =?utf-8?B?QVMrZEw3V0hjeEJnQ2crSkMrdmM3TGtQVmhxaisyQUY5aThobCtLUW94bzdq?=
 =?utf-8?B?Sk9jWEU5Y2orckZsVHhGUklGSGo0RTd1N2dSSGVnMG41dmpsVm15MVBNaU8y?=
 =?utf-8?B?R1FZbVFiWEJib1ZwNkgyR3RGQXphTTRsTzFUNHVLVHJodUdOdTdNT3JqZUxr?=
 =?utf-8?B?WitnMC9hQWpMeGVpRU05L2VjZVM3WWFwdExFMUNSVmg5TDNPYjJ3aWhrMmlB?=
 =?utf-8?B?ZkthL3BxTGRDU0NPbzFzekVhTHljeU1ubmc5cVJPY3g3WkFmWS9Xa2FRS2ps?=
 =?utf-8?B?R0Q5dVEwNE0rTmxiQUc0eXV3UnBMcHBTUHpUMytCdjkzNzFpRHV0eXloRENz?=
 =?utf-8?B?aEx0L203TEk1d0dGdlhVdnpaT1I4U0JudTZ4OGsrQ09ZWEhEVWNySUozcWl6?=
 =?utf-8?B?aEY3d2RJNFZhQnVMNE1MRzNhY2ZFdWJzQnJaT002TUp6NEpRSnQ5TzJOMjA3?=
 =?utf-8?B?aU1sMTVxYTRXMksvSERXUngyTlpHSngvcmRwajY1Z3M2YjdFcXhNMWc5QTlp?=
 =?utf-8?B?czNIOC9seHVkWDlvVEt2NmdhVDFJMWpWcWc5aGNXamNzS1FnVlJzTWh5VGJU?=
 =?utf-8?B?bXY1Q3VmWERNcUtaMUdIODh6K25WbjNORm94OHpoMUM0ZThXWHVsczFKd2gr?=
 =?utf-8?B?RzdtVXBFN252REk3UExMRHRoNFBNOVNOY0w0VVZ5SFZmbG9MVzJ5NG9JaG1r?=
 =?utf-8?B?eEZYeHM2M0dSbjRZSVNERkVGTVpkMUJRVmdVN3pEb2RPekhCcHd1VmV2K1JK?=
 =?utf-8?B?V3ZBV2YyZ011dGgwR2VTaU1oR2tjY0RVZ2hXZUlXdFhnZVVhdjRzQWMrMHRz?=
 =?utf-8?B?dWcwQ1dFOTJkOFVSTjVQQnpaeFMxaXpnNDVHUnN3ZXdla1JmaFdMOUEzUndO?=
 =?utf-8?B?ZUc3b0dXRERUVGRlSVJIYW9SMGtiVEZIYlB5TFlRTGVMb0MxQTcwbERDWjJL?=
 =?utf-8?B?Nkt1OTRJZFFwSlB0MHdNMXk5VXdRSnNMZ2xiMmN0cGxHeGlxZXJETUxkeVdv?=
 =?utf-8?B?UHFpUytvWkp1MHJTMk0reFhRalJlMnJMMnJkZWZsUEFDS1lsbGRDSnlPYlJO?=
 =?utf-8?B?dUZkSmt1cXVNZ1RXb05HZXdmOHc3TWNncnpEa1JoK3BqeHNweVFpaEsxcVZQ?=
 =?utf-8?B?bFE9PQ==?=
X-MS-Exchange-CrossTenant-Network-Message-Id: d4925a9a-291a-4342-e937-08dc1723d093
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4965.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Jan 2024 06:16:17.3744
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: C9e5ciQOtaw1ES9+Bx/6N+0ELFIj1k92FT8Bm66l5Gz18RJs+8Ig8b7uBa15Hiy9jX7a5q1PtYkxq+DvaLRFxg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR11MB7297
X-OriginatorOrg: intel.com

On 1/17/2024 1:31 PM, Yuan Yao wrote:
> On Wed, Jan 17, 2024 at 09:58:40AM +0800, Yang, Weijiang wrote:
>> On 1/17/2024 9:41 AM, Yang, Weijiang wrote:
>>> On 1/15/2024 5:58 PM, Yuan Yao wrote:
>>>> On Thu, Dec 21, 2023 at 09:02:35AM -0500, Yang Weijiang wrote:
>> [...]
>>>> Looks this leading to MSR_IA32_INT_SSP_TAB not intercepted
>>>> after below steps:
>>>>
>>>> Step 1. User space set cpuid w/  X86_FEATURE_LM, w/  SHSTK.
>>>> Step 2. User space set cpuid w/o X86_FEATURE_LM, w/o SHSTK.
>>>>
>>>> Then MSR_IA32_INT_SSP_TAB won't be intercepted even w/o SHSTK
>>>> on guest cpuid, will this lead to inconsistency when do
>>>> rdmsr(MSR_IA32_INT_SSP_TAB) from guest in this scenario ?
>>> Yes, theoretically it's possible, how about changing it as below?
>>>
>>> vmx_set_intercept_for_msr(vcpu, MSR_IA32_INT_SSP_TAB,
>>> 			  MSR_TYPE_RW,
>>> 			  incpt | !guest_cpuid_has(vcpu, X86_FEATURE_LM));
>>>
>> Oops, should be : incpt || !guest_cpuid_has(vcpu, X86_FEATURE_LM)
> It means guest cpuid:
>
> "has X86_FEATURE_SHSTK" + "doesn't have X86_FEATURE_LM"

No, this is invalid within this series. With patch 21 to prevent SHSTK in
32-bit guest, I think the check of LM here can be omitted.

then
vmx_set_intercept_for_msr(vcpu, MSR_IA32_INT_SSP_TAB, MSR_TYPE_RW, incpt); is OK.

>
> not sure this is valid combination or not.
> If yes it's ok, else just relies on incpt is enough ?
>