Received-SPF: pass (google.com: domain of linux-kernel+bounces-101218-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Wed, 13 Mar 2024 09:38:24 +0100
From: Gerd Hoffmann <kraxel@redhat.com>
To: Xiaoyao Li <xiaoyao.li@intel.com>
Cc: Tao Su <tao1.su@linux.intel.com>, kvm@vger.kernel.org, 
	Tom Lendacky <thomas.lendacky@amd.com>, Sean Christopherson <seanjc@google.com>, 
	Paolo Bonzini <pbonzini@redhat.com>, Thomas Gleixner <tglx@linutronix.de>, 
	Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>, 
	Dave Hansen <dave.hansen@linux.intel.com>, 
	"maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86@kernel.org>, "H. Peter Anvin" <hpa@zytor.com>, 
	"open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v3 2/2] kvm/cpuid: set proper GuestPhysBits in
 CPUID.0x80000008
Message-ID: <pcxeiwgpu6gtxibfahadopifjkehgdcb2vfjovqrc5v6mogsuu@3kcetsllglen>
References: <20240311104118.284054-1-kraxel@redhat.com>
 <20240311104118.284054-3-kraxel@redhat.com>
 <ZfD8BrVOM9gaTudC@linux.bj.intel.com>
 <76a8a880-6c8f-4c4c-bd5d-da02206967ed@intel.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <76a8a880-6c8f-4c4c-bd5d-da02206967ed@intel.com>

  Hi,

> > > -		entry->eax = phys_as | (virt_as << 8);
> > > +		entry->eax = phys_as | (virt_as << 8) | (g_phys_as << 16);
> > 
> > When g_phys_as==phys_as, I would suggest advertising g_phys_as==0,
> > otherwise application can easily know whether it is in a VM, I’m
> > concerned this could be abused by application.

There are *tons* of options to figure whenever you are running in a VM,
there is no need to go for this obscure way.

> IMO, this should be protected by userspace VMM, e.g., QEMU to set actual
> g_phys_as. On KVM side, KVM only reports the capability to userspace.

Yes, at the end of the day this is handled by qemu.

Current plan for qemu is to communicate it to the guest unconditionally
though.  When setting this only in case g_phys_as != phys_as the
firmware has the problem that it doesn't know the reason for finding
zero there.  Could be g_phys_as == phys_as, but could also be old kernel
/ qemu without GuestPhysBits support.  So the firmware doesn't know
whenever it is save to use phys_as.

take care,
  Gerd