From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752419AbdJRLXC (ORCPT ); Wed, 18 Oct 2017 07:23:02 -0400 Received: from mx1.redhat.com ([209.132.183.28]:52560 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752978AbdJRLW7 (ORCPT ); Wed, 18 Oct 2017 07:22:59 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 85B94C0587DD Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=pbonzini@redhat.com Subject: Re: [PATCH 0/9] Intel Processor Trace virtulization enabling To: "Kang, Luwei" , "kvm@vger.kernel.org" Cc: "rkrcmar@redhat.com" , "tglx@linutronix.de" , "mingo@redhat.com" , "hpa@zytor.com" , "x86@kernel.org" , "linux-kernel@vger.kernel.org" , Chao Peng References: <1508155781-4576-1-git-send-email-luwei.kang@intel.com> <66f40c86-cdf3-84a7-6d42-c0c7f6850e19@redhat.com> <82D7661F83C1A047AF7DC287873BF1E167E1B5FB@SHSMSX101.ccr.corp.intel.com> <0ca0d53b-640a-c124-08dc-dbf009e01a8e@redhat.com> <82D7661F83C1A047AF7DC287873BF1E167E1B74A@SHSMSX101.ccr.corp.intel.com> From: Paolo Bonzini Message-ID: <5b434733-c974-9012-0e08-48ed9e1d2fa6@redhat.com> Date: Wed, 18 Oct 2017 13:22:49 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <82D7661F83C1A047AF7DC287873BF1E167E1B74A@SHSMSX101.ccr.corp.intel.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Wed, 18 Oct 2017 11:22:59 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 18/10/2017 13:06, Kang, Luwei wrote: >>>> Nested virtualization is interesting. We would like the nested >>>> hypervisor to be forced to set the "use GPA for processor tracing" >>>> secondary execution control whenever "enable EPT" is set and RTIT_CTL >>>> is nonzero. There is no way to encode that in >>>> IA32_VMX_PROCBASED_CTLS2, however. It would be nice if Intel could >>>> reserve a bit in IA32_VMX_EPT_VPID_CAP for KVM to express that >>>> constraint. >>> >>> Do you mean if nested hypervisor get the capability of "Guest PT use >>> GPA" and EPT has enable. Highly recommend nested hypervisor set " >>> Guest PT use GPA " as well. >> >> Well, it's required more than recommended. However, it's only required if "enable EPT" is set and RTIT_CTL is nonzero. >> >>> If nested hypervisor is also KVM, "use GPA for processor tracing" >>> will be set for sure. But other hypervisor may not do that. So, we'd >>> better add a flag in IA32_VMX_EPT_VPID_CAP to express that constraint. >> >> Correct. The constraint would be: >> >> * RTIT_CTL on entry is zero if EPT is disabled >> >> * RTIT_CTL on entry is zero if EPT is enabled and "Guest PT uses GPA" is zero >> >> Maybe IA32_VMX_EPT_VPID_CAP is not the best place. I'll let Intel decide that. > > Get it. I have feedback to hardware architect. I hope it can be applied but it may need wait a long time. Note that the hardware need not do anything. However it would be nice if the SDM can define a bit _for the hypervisors_ to enforce the above constraint and fail vmentry if they are not respected. Paolo