Received-SPF: pass (google.com: domain of linux-kernel+bounces-180690-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Message-ID: <39b95ac6-f163-4461-93f3-eaa653ab1355@intel.com>
Date: Thu, 16 May 2024 15:13:01 +0800
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH v10 24/27] KVM: x86: Enable CET virtualization for VMX and
 advertise to userspace
To: Sean Christopherson <seanjc@google.com>, <rick.p.edgecombe@intel.com>
CC: <pbonzini@redhat.com>, <dave.hansen@intel.com>, <x86@kernel.org>,
	<kvm@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
	<peterz@infradead.org>, <chao.gao@intel.com>, <mlevitsk@redhat.com>,
	<john.allen@amd.com>
References: <20240219074733.122080-1-weijiang.yang@intel.com>
 <20240219074733.122080-25-weijiang.yang@intel.com>
 <ZjLNEPwXwPFJ5HJ3@google.com>
Content-Language: en-US
From: "Yang, Weijiang" <weijiang.yang@intel.com>
In-Reply-To: <ZjLNEPwXwPFJ5HJ3@google.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?NUVKQnhVaUY4TVhrMnlFUGVJRG9JTTloTTZtZ1lVM3VnRnJpU1M1azZTYnhZ?=
 =?utf-8?B?NUNTeWtuc1ZoTkVnS0U2Sjlub2F0ZDlzdXFvMkVLV09kRkI2OG9uaDVqRExP?=
 =?utf-8?B?aXZlTW03ZFg2Yi9MYnVxMGdPZjVoVXJGenc0L1VsSVU4eWkxYzBqTHBwNFBs?=
 =?utf-8?B?UDdUT1RwRWR0d0FEWm1RamRhQUVXTndValQ2Zi9UZXlwVWFteUZwTXQ3bGZF?=
 =?utf-8?B?dUdDbTNWRFlsUTgwdEFqRnlPNEo5eGRCb0FUUTlRZldLMWNOK0dOMjdqK2FU?=
 =?utf-8?B?U0tDY2E4M1V6VmI3TVdqRlVBYWxaOXFHMlB1VjlPTUhoYjFDWWxJSGx2M3Bu?=
 =?utf-8?B?a2ZqcU9BZnB5cmVjampCVkQ0NjlYR1BoMUYrenBBV2s2WVpLOWVmUENmNHRB?=
 =?utf-8?B?Z0c2M0dwNUovZnNPNEkwNzZWYnd1eUtRcThCZXJ2eEpQUkZ1b3FLa3Y5VzFs?=
 =?utf-8?B?TFhBN1M5TlR4T2gvUFJXSml4enRFZUpqMG5sRVNuaExXWFJLVXREby9nNjZa?=
 =?utf-8?B?dDhYOS9Ld3pDdktJc2lrODRSSHBHdXFNVjhjZ2paVHUrZGZpZHJRV1lRSmp6?=
 =?utf-8?B?SzkvNU1UZjB1WlJ1anVhcSttWDBob2NXQlFrMlJReVNiZmJYelNSa1VQVGVi?=
 =?utf-8?B?L0hyWG9MNW9FbUdRTzkwc2drTEo1clErblZKTGIyaFZYQkVKNW9lV1hvQk5X?=
 =?utf-8?B?NzZqNTgyTHphQnBsYVJETkFJY254dWlJRVR1aVRjd0k3eXdXOHhGR01hcG1Y?=
 =?utf-8?B?MXhTMHNqTE1xS051dlhpNy91aUdlQzJmd05YYi9IMXFHWDZCYjl0aW90c25V?=
 =?utf-8?B?NE85VFVuM252TkZYbFVqZi9hbGtkVVA1dWgxRjh1R09rY0hwMXpURkRQY3RV?=
 =?utf-8?B?Q3RwUU9zNjZXWTVaUTFtS1o4K1RHVkpvL0NISXJ4TzF3WDY0Y2sxNEN6eXcy?=
 =?utf-8?B?YnhJS3B4bGprQUZRS3FOaDlsZVc1V05QU3o3N2NYQ0xoVWRHQkU5Y2hEQkdF?=
 =?utf-8?B?a1JvdTZBVlJGbTVqWkFRQUdxU2N5RThFK010aTFxd2JLNUptdEoyS0QzRlhU?=
 =?utf-8?B?REEwVkVaUEd6Mlo2V1lRWm1pWldZMTljQ3ZwckR2SEQ3NXY2Q2YxWUpoS2pU?=
 =?utf-8?B?VGF1VEw1UmFWNHR0OHdqc0F0SG1SbHpJTEJBSWJHRFl0U0ZMNHp5bFU2YzlK?=
 =?utf-8?B?WS9QTGtyQ2FXa2ViWUpUelhFdVoveDVDN0VMUXNIQkd4c0diTDNrVW9PYnhS?=
 =?utf-8?B?Q2NNbUNIb09GUVc2d3ZKU2hua2hqSzhLT01KZkV6cEJ6eGprRk9qVS9UV3dn?=
 =?utf-8?B?aWF6S00wY01VWmk5NlVrZUJQL3AvTG5sSVJ5cXh3WFd6YVQ5emJRNFVYOUtH?=
 =?utf-8?B?empGM20vWXgyQklMZE1xbGZtelNtOWlGZStFeW1maVUzYjNoUU5BUUtNZUpK?=
 =?utf-8?B?alRISkhLZHNKV3pGVEEybGhVTWNidy9mS1BrcVl2MUJIWG5WRGdVTzFncXU1?=
 =?utf-8?B?WEw2VU4raytiTGE3NnprRGNZZFc5RWFXRHM0M04zWnZsdjJtVjlvY0VSaE9M?=
 =?utf-8?B?OG9uQnZQbGkrVlBadFc5ZXJCdjR6M0M5UG55TDVLQnFNVnN1QWJkOWRKU1c2?=
 =?utf-8?B?MEh0OXdnVW91M01jcjNsZDV4Y0VEWWxCampaeXV5OUxmSjJRRzFmTG9CeTB6?=
 =?utf-8?B?OUpLSnIvMEdGL3Vwai9rdDRnSGpsZWFZejZHY0tTSTdXTVdVUWRTV2VyYXdq?=
 =?utf-8?B?aWZKOFh3NXg2R3krNnJyd1lSbEZYWXpFV3dUV01nS21OVmtWSzAzbGFVc1F5?=
 =?utf-8?B?MDNGS2pZU1dhaEtpWkdXQTZhajFTSTQ4NE9NaHFrV2xKeGV2QlNxeDkrWU5J?=
 =?utf-8?B?cFV3clBKRUlqQW42T3VjSzRzYU5YWngzQUV5SEVLbjZFT0NNTUVqcVo1THgr?=
 =?utf-8?B?blp2RFVRTnZOSVBBWEpvZVI1cW1kVzM4eWtHSlk3MDJJVUtnU3pLb3pNYkcv?=
 =?utf-8?B?Nm1wL084elV3M29FZ0RjUGh2ZENxRlRYRnpwRVRYNHdnWjZGTUlwaUhWMm5I?=
 =?utf-8?B?aERaRUREVndHU0ErVmJjSGl1R1JCVXJGN2RhMnBFVFpTTWg0MUZMcmdtZkRt?=
 =?utf-8?B?dHl3dVpwMHFlekgra0JMK0xYVFlNVmhrSVZjUENwOGk5OE1CbmcvZ0N1a1lE?=
 =?utf-8?B?SEE9PQ==?=
X-MS-Exchange-CrossTenant-Network-Message-Id: be5b2fa4-f7fa-449e-e4ae-08dc7577a4dc
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4965.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 May 2024 07:13:11.0742
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: kLuBivF5aYUCQcQ4tPtpxQWqgCK1DJAUXiAHvgQsGaJFWvWXFbk8HAdxb/B6vIvgdd2RuUKI0DZndtRGiPMtOQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB4805
X-OriginatorOrg: intel.com

On 5/2/2024 7:15 AM, Sean Christopherson wrote:
> On Sun, Feb 18, 2024, Yang Weijiang wrote:
>> @@ -696,6 +697,20 @@ void kvm_set_cpu_caps(void)
>>   		kvm_cpu_cap_set(X86_FEATURE_INTEL_STIBP);
>>   	if (boot_cpu_has(X86_FEATURE_AMD_SSBD))
>>   		kvm_cpu_cap_set(X86_FEATURE_SPEC_CTRL_SSBD);
>> +	/*
>> +	 * Don't use boot_cpu_has() to check availability of IBT because the
>> +	 * feature bit is cleared in boot_cpu_data when ibt=off is applied
>> +	 * in host cmdline.
> I'm not convinced this is a good reason to diverge from the host kernel.  E.g.
> PCID and many other features honor the host setup, I don't see what makes IBT
> special.
>
>
Hi, Sean,
We synced the issue internally, and got conclusion that KVM should honor host IBT config.
In this case IBT bit in boot_cpu_data should be honored.  With this policy, it can avoid CPUID
confusion to guest side due to host ibt=off config. Host side xstate support couldn't be an issue
because we already have below check in this patch:

+ if ((kvm_caps.supported_xss & (XFEATURE_MASK_CET_USER | + XFEATURE_MASK_CET_KERNEL)) != + (XFEATURE_MASK_CET_USER | XFEATURE_MASK_CET_KERNEL)) { + kvm_cpu_cap_clear(X86_FEATURE_SHSTK); + kvm_cpu_cap_clear(X86_FEATURE_IBT); + kvm_caps.supported_xss &= ~(XFEATURE_MASK_CET_USER | + XFEATURE_MASK_CET_KERNEL); + }

What's your thoughts? Should I just remove the quirk here and keep everything normal and
peaceful?