Re: [PATCH] target/i386/kvm: Fix disabling MPX on "-cpu host" with MPX-capable host

[Maciej S. Szmigiero]

On 21.05.2022 10:54, Paolo Bonzini wrote:
> On Fri, May 20, 2022 at 8:33 PM Maciej S. Szmigiero
> <mail@maciej.szmigiero.name> wrote:
> > From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
> >
> > Since KVM commit 5f76f6f5ff96 ("KVM: nVMX: Do not expose MPX VMX controls when guest 
> > MPX disabled")
> > it is not possible to disable MPX on a "-cpu host" just by adding "-mpx"
> > there if the host CPU does indeed support MPX.
> > QEMU will fail to set MSR_IA32_VMX_TRUE_{EXIT,ENTRY}_CTLS MSRs in this case
> > and so trigger an assertion failure.
> >
> > Instead, besides "-mpx" one has to explicitly add also
> > "-vmx-exit-clear-bndcfgs" and "-vmx-entry-load-bndcfgs" to QEMU command
> > line to make it work, which is a bit convoluted.
> >
> > Sanitize MPX-related bits in MSR_IA32_VMX_TRUE_{EXIT,ENTRY}_CTLS after
> > setting the vCPU CPUID instead so such workarounds are no longer necessary.
>
> Can you use feature_dependencies instead? See for example
>
>      {
>          .from = { FEAT_7_0_EBX,             CPUID_7_0_EBX_RDSEED },
>          .to = { FEAT_VMX_SECONDARY_CTLS,    VMX_SECONDARY_EXEC_RDSEED_EXITING 
> },
>      },

The "feature_dependencies" way seems to work fine too,
and it definitely looks neater.

Thanks for the pointer, will post v2 in a moment.

> Paolo

Thanks,
Maciej