From: Yu Zhang <yu.c.zhang@linux.intel.com>
To: Sean Christopherson <seanjc@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>,
Vitaly Kuznetsov <vkuznets@redhat.com>,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 08/12] KVM: nSVM: Use KVM-governed feature framework to track "vVM{SAVE,LOAD} enabled"
Date: Wed, 22 Feb 2023 14:49:31 +0800 [thread overview]
Message-ID: <20230222064931.ppz6berhfr4edewf@linux.intel.com> (raw)
In-Reply-To: <Y/VYN3n/lHePiDxM@google.com>
On Tue, Feb 21, 2023 at 03:48:07PM -0800, Sean Christopherson wrote:
> On Tue, Feb 21, 2023, Yu Zhang wrote:
> > > Sorry, why guest_cpuid_is_intel(vcpu)? Is it becasue that a AMD host with virtual
> > > VMSAVE/VMLOAD capability will always expose this feature for all AMD guests?
> >
> > Oh, sorry. I missed the guest_cpuid_has() in kvm_governed_feature_check_and_set().
> > So please just ignore my 2nd question.
> >
> > As to the check of guest_cpuid_is_intel(), is it necessary?
>
> Yes? The comment in init_vmcb_after_set_cpuid() says:
>
> /*
> * We must intercept SYSENTER_EIP and SYSENTER_ESP
> * accesses because the processor only stores 32 bits.
> * For the same reason we cannot use virtual VMLOAD/VMSAVE.
> */
>
> but I'm struggling to connect the dots to SYSENTER. I suspect the comment is
> misleading and has nothing to do 32-bit vs. 64-bit (or I'm reading it wrong) and
> should be something like:
>
> /*
> * Disable virtual VMLOAD/VMSAVE and intercept VMLOAD/VMSAVE if the
> * guest CPU is Intel in order to inject #UD.
> */
>
> In other words, a non-SVM guest shouldn't be allowed to execute VMLOAD/VMSAVE.
Yes. Such interpretation makes sense. And vmload/vmsave shall be intercepted
if guest CPU is Intel and #UD shall be injected. I guess this is done indirectly
by judging the EFER_SVME not set in EFER in nested_svm_check_permissions()?
And as to X86_FEATURE_V_VMSAVE_VMLOAD, should the guest_cpuid_has() return true
at all for a Intel guest?
B.R.
Yu
next prev parent reply other threads:[~2023-02-22 6:49 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-17 23:10 [PATCH 00/12] KVM: x86: Add "governed" X86_FEATURE framework Sean Christopherson
2023-02-17 23:10 ` [PATCH 01/12] KVM: x86: Add a framework for enabling KVM-governed x86 features Sean Christopherson
2023-02-21 17:12 ` Vitaly Kuznetsov
2023-06-29 2:40 ` Binbin Wu
2023-06-29 16:26 ` Sean Christopherson
2023-06-30 8:01 ` Chao Gao
2023-06-30 15:31 ` Sean Christopherson
2023-02-17 23:10 ` [PATCH 02/12] KVM: x86/mmu: Use KVM-governed feature framework to track "GBPAGES enabled" Sean Christopherson
2023-02-17 23:10 ` [PATCH 03/12] KVM: VMX: Recompute "XSAVES enabled" only after CPUID update Sean Christopherson
2023-02-17 23:10 ` [PATCH 04/12] KVM: VMX: Rename XSAVES control to follow KVM's preferred "ENABLE_XYZ" Sean Christopherson
2023-02-17 23:10 ` [PATCH 05/12] KVM: x86: Use KVM-governed feature framework to track "XSAVES enabled" Sean Christopherson
2023-02-21 14:56 ` Yu Zhang
2023-02-22 18:56 ` Sean Christopherson
2023-02-24 9:54 ` Yu Zhang
2023-02-17 23:10 ` [PATCH 06/12] KVM: nSVM: Use KVM-governed feature framework to track "NRIPS enabled" Sean Christopherson
2023-02-17 23:10 ` [PATCH 07/12] KVM: nSVM: Use KVM-governed feature framework to track "TSC scaling enabled" Sean Christopherson
2023-02-17 23:10 ` [PATCH 08/12] KVM: nSVM: Use KVM-governed feature framework to track "vVM{SAVE,LOAD} enabled" Sean Christopherson
2023-02-21 15:23 ` Yu Zhang
2023-02-21 15:33 ` Yu Zhang
2023-02-21 23:48 ` Sean Christopherson
2023-02-22 6:49 ` Yu Zhang [this message]
2023-02-22 16:39 ` Sean Christopherson
2023-02-24 9:25 ` Yu Zhang
2023-02-24 16:16 ` Sean Christopherson
[not found] ` <20230227065437.j7f7rfadut532fud@linux.intel.com>
2023-03-07 16:32 ` Sean Christopherson
2023-06-29 16:50 ` Sean Christopherson
2023-06-30 10:00 ` Yu Zhang
2023-02-17 23:10 ` [PATCH 09/12] KVM: nSVM: Use KVM-governed feature framework to track "LBRv enabled" Sean Christopherson
2023-02-17 23:10 ` [PATCH 10/12] KVM: nSVM: Use KVM-governed feature framework to track "Pause Filter enabled" Sean Christopherson
2023-02-17 23:10 ` [PATCH 11/12] KVM: nSVM: Use KVM-governed feature framework to track "vGIF enabled" Sean Christopherson
2023-02-17 23:10 ` [PATCH 12/12] KVM: x86: Disallow guest CPUID lookups when IRQs are disabled Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230222064931.ppz6berhfr4edewf@linux.intel.com \
--to=yu.c.zhang@linux.intel.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=vkuznets@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).