Received-SPF: pass (google.com: domain of linux-kernel+bounces-77642-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Thu, 22 Feb 2024 17:35:52 -0800
In-Reply-To: <20240110002340.485595-1-seanjc@google.com>
Precedence: bulk
Mime-Version: 1.0
References: <20240110002340.485595-1-seanjc@google.com>
Message-ID: <170864656017.3080257.14048100709856204250.b4-ty@google.com>
Subject: Re: [PATCH] x86/cpu: Add a VMX flag to enumerate 5-level EPT support
 to userspace
From: Sean Christopherson <seanjc@google.com>
To: Sean Christopherson <seanjc@google.com>, Paolo Bonzini <pbonzini@redhat.com>, 
	Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>, 
	Dave Hansen <dave.hansen@linux.intel.com>, x86@kernel.org
Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, 
	Yi Lai <yi1.lai@intel.com>, Tao Su <tao1.su@linux.intel.com>, 
	Xudong Hao <xudong.hao@intel.com>
Content-Type: text/plain; charset="utf-8"

On Tue, 09 Jan 2024 16:23:40 -0800, Sean Christopherson wrote:
> Add a VMX flag in /proc/cpuinfo, ept_5level, so that userspace can query
> whether or not the CPU supports 5-level EPT paging.  EPT capabilities are
> enumerated via MSR, i.e. aren't accessible to userspace without help from
> the kernel, and knowing whether or not 5-level EPT is supported is sadly
> necessary for userspace to correctly configure KVM VMs.
> 
> When EPT is enabled, bits 51:49 of guest physical addresses are consumed
> if and only if 5-level EPT is enabled.  For CPUs with MAXPHYADDR > 48, KVM
> *can't* map all legal guest memory if 5-level EPT is unsupported, e.g.
> creating a VM with RAM (or anything that gets stuffed into KVM's memslots)
> above bit 48 will be completely broken.
> 
> [...]

Applied to kvm-x86 vmx, with a massaged changelog to avoid presenting this as a
bug fix (and finally fixed the 51:49=>51:48 goof):

    Add a VMX flag in /proc/cpuinfo, ept_5level, so that userspace can query
    whether or not the CPU supports 5-level EPT paging.  EPT capabilities are
    enumerated via MSR, i.e. aren't accessible to userspace without help from
    the kernel, and knowing whether or not 5-level EPT is supported is useful
    for debug, triage, testing, etc.
    
    For example, when EPT is enabled, bits 51:48 of guest physical addresses
    are consumed by the CPU if and only if 5-level EPT is enabled.  For CPUs
    with MAXPHYADDR > 48, KVM *can't* map all legal guest memory if 5-level
    EPT is unsupported, making it more or less necessary to know whether or
    not 5-level EPT is supported.

[1/1] x86/cpu: Add a VMX flag to enumerate 5-level EPT support to userspace
      https://github.com/kvm-x86/linux/commit/b1a3c366cbc7

--
https://github.com/kvm-x86/linux/tree/next