From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paolo Bonzini Subject: Re: [PATCH V4 4/7] KVM, pkeys: add pkeys support for permission_fault logic Date: Mon, 7 Mar 2016 00:29:52 +0100 Message-ID: <56DCBD70.7080302@redhat.com> References: <1457177252-7577-1-git-send-email-huaitong.han@intel.com> <1457177252-7577-5-git-send-email-huaitong.han@intel.com> <56DBE387.4080704@linux.intel.com> <56DC94C4.2050201@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Cc: kvm@vger.kernel.org To: Xiao Guangrong , Huaitong Han , gleb@kernel.org Return-path: Received: from mail-wm0-f67.google.com ([74.125.82.67]:35018 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751294AbcCFXaA (ORCPT ); Sun, 6 Mar 2016 18:30:00 -0500 Received: by mail-wm0-f67.google.com with SMTP id 1so7977546wmg.2 for ; Sun, 06 Mar 2016 15:29:59 -0800 (PST) In-Reply-To: <56DC94C4.2050201@redhat.com> Sender: kvm-owner@vger.kernel.org List-ID: On 06/03/2016 21:36, Paolo Bonzini wrote: > > > On 06/03/2016 09:00, Xiao Guangrong wrote: >>> >>> if (vcpu_match_mmio_gva(vcpu, gva) >>> && !permission_fault(vcpu, vcpu->arch.walk_mmu, >>> - vcpu->arch.access, access)) { >>> + vcpu->arch.access, 0, access)) { >> >> No. The pkey is not always 0. >> >> We should cache PKEY for the mmio access and use it here to check if the >> right is adequate. > > This is just an optimization I think, so it can have false negatives (it > won't have many in practice because MMIO accesses are usually done in > supervisor mode). The actual check is done when > vcpu->arch.walk_mmu->gva_to_gpa is called. Duh, sorry, false _positives_ are okay (i.e. you can say something faults even if it actually doesn't). One thing you could do is: - do not pass pte_pkeys to permission_fault, instead read PKRU in walk_addr_generic and pass "(pkru >> (pte_pkeys * PKRU_ATTRS)) & 3" to permission_fault. - here, pass ~0. So if CR0.PKE=0 or U=0 caching works properly, but if CR0.PKE=1 and U=1 it is disabled gracefully and gva_to_gpa does the page walk correctly. Paolo