From mboxrd@z Thu Jan  1 00:00:00 1970
From: Avi Kivity <avi@redhat.com>
Subject: Re: [PATCH 04/27] nVMX: Allow setting the VMXE bit in CR4
Date: Sun, 17 Oct 2010 14:31:16 +0200
Message-ID: <4CBAEC94.9050102@redhat.com>
References: <1287309814-nyh@il.ibm.com> <201010171005.o9HA5bWm029315@rice.haifa.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: kvm@vger.kernel.org, gleb@redhat.com
To: "Nadav Har'El" <nyh@il.ibm.com>
Return-path: <kvm-owner@vger.kernel.org>
Received: from mx1.redhat.com ([209.132.183.28]:12543 "EHLO mx1.redhat.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1753474Ab0JQMbV (ORCPT <rfc822;kvm@vger.kernel.org>);
	Sun, 17 Oct 2010 08:31:21 -0400
In-Reply-To: <201010171005.o9HA5bWm029315@rice.haifa.ibm.com>
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

  On 10/17/2010 12:05 PM, Nadav Har'El wrote:
> This patch allows the guest to enable the VMXE bit in CR4, which is a
> prerequisite to running VMXON.
>
> Whether to allow setting the VMXE bit now depends on the architecture (svm
> or vmx), so its checking has moved to kvm_x86_ops->set_cr4(). This function
> now returns an int: If kvm_x86_ops->set_cr4() returns 1, __kvm_set_cr4()
> will also return 1, and this will cause kvm_set_cr4() will throw a #GP.
>
> Turning on the VMXE bit is allowed only when the "nested" module option is on,
> and turning it off is forbidden after a vmxon.
>
>
>
> -static void vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
> +static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
>   {
>   	unsigned long hw_cr4 = cr4 | (to_vmx(vcpu)->rmode.vm86_active ?
>   		    KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON);
>
> +	if (cr4&  X86_CR4_VMXE){
> +		if (!nested)
> +			return 1;

Need to check cpuid.vmx as well, otherwise we can't turn off vmx for 
specific guests (only for the entire machine).

> +	} else {
> +		if (nested&&  to_vmx(vcpu)->nested.vmxon)
> +			return 1;
> +	}
> +

Unrelated, if nested.vmxon, shouldn't we forbid clearing certain bits of 
cr0?

It occurs to me that these bits are not fixed, instead specified by an 
MSR.  So we can simply have the MSR allow them (if we're sure that it 
would work; don't see why not).

-- 
error compiling committee.c: too many arguments to function