From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paolo Bonzini Subject: Re: [PATCH V4 2/7] KVM, pkeys: disable pkeys for guests in non-paging mode Date: Tue, 8 Mar 2016 13:11:33 +0100 Message-ID: <56DEC175.8030907@redhat.com> References: <1457177252-7577-1-git-send-email-huaitong.han@intel.com> <1457177252-7577-3-git-send-email-huaitong.han@intel.com> <56DEC10E.60903@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Cc: kvm@vger.kernel.org To: Yang Zhang , Huaitong Han , gleb@kernel.org Return-path: Received: from mx1.redhat.com ([209.132.183.28]:43109 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932068AbcCHMLh (ORCPT ); Tue, 8 Mar 2016 07:11:37 -0500 In-Reply-To: <56DEC10E.60903@gmail.com> Sender: kvm-owner@vger.kernel.org List-ID: On 08/03/2016 13:09, Yang Zhang wrote: >> >> if (!enable_unrestricted_guest && !is_paging(vcpu)) > > The comment says "Pkeys is disabled if CPU is in non-paging mode in > hardware". Why to check enable_unrestricted_guest here? If !enable_unrestricted_guest, the CPU is always running with CR0.PG=1 and CR4 needs to be modified. If enable_unrestricted_guest, the CPU automatically disables SMEP/SMAP/PKU when the guest sets CR0.PG=0. Paolo >> /* >> - * SMEP/SMAP is disabled if CPU is in non-paging mode in >> + * SMEP/SMAP/PKU is disabled if CPU is in non-paging mode in >> * hardware. However KVM always uses paging mode without >> * unrestricted guest. >> - * To emulate this behavior, SMEP/SMAP needs to be manually >> + * To emulate this behavior, SMEP/SMAP/PKU needs to be manually >> * disabled when guest switches to non-paging mode. >> */ >> - hw_cr4 &= ~(X86_CR4_SMEP | X86_CR4_SMAP); >> + hw_cr4 &= ~(X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE);