From mboxrd@z Thu Jan 1 00:00:00 1970 From: Yang Zhang Subject: Re: [PATCH V4 2/7] KVM, pkeys: disable pkeys for guests in non-paging mode Date: Tue, 8 Mar 2016 21:02:03 +0800 Message-ID: <56DECD4B.90500@gmail.com> References: <1457177252-7577-1-git-send-email-huaitong.han@intel.com> <1457177252-7577-3-git-send-email-huaitong.han@intel.com> <56DEC10E.60903@gmail.com> <56DEC175.8030907@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Cc: kvm@vger.kernel.org To: Paolo Bonzini , Huaitong Han , gleb@kernel.org Return-path: Received: from mail-pa0-f68.google.com ([209.85.220.68]:34476 "EHLO mail-pa0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750911AbcCHNCI (ORCPT ); Tue, 8 Mar 2016 08:02:08 -0500 Received: by mail-pa0-f68.google.com with SMTP id hj7so1139277pac.1 for ; Tue, 08 Mar 2016 05:02:07 -0800 (PST) In-Reply-To: <56DEC175.8030907@redhat.com> Sender: kvm-owner@vger.kernel.org List-ID: On 2016/3/8 20:11, Paolo Bonzini wrote: > > > On 08/03/2016 13:09, Yang Zhang wrote: >>> >>> if (!enable_unrestricted_guest && !is_paging(vcpu)) >> >> The comment says "Pkeys is disabled if CPU is in non-paging mode in >> hardware". Why to check enable_unrestricted_guest here? > > If !enable_unrestricted_guest, the CPU is always running with CR0.PG=1 > and CR4 needs to be modified. > > If enable_unrestricted_guest, the CPU automatically disables > SMEP/SMAP/PKU when the guest sets CR0.PG=0. Thanks for you explanation. It would be better to add it into the below comment to tell why only care !enable_unrestricted_guest case. > > Paolo > >>> /* >>> - * SMEP/SMAP is disabled if CPU is in non-paging mode in >>> + * SMEP/SMAP/PKU is disabled if CPU is in non-paging mode in >>> * hardware. However KVM always uses paging mode without >>> * unrestricted guest. >>> - * To emulate this behavior, SMEP/SMAP needs to be manually >>> + * To emulate this behavior, SMEP/SMAP/PKU needs to be manually >>> * disabled when guest switches to non-paging mode. >>> */ >>> - hw_cr4 &= ~(X86_CR4_SMEP | X86_CR4_SMAP); >>> + hw_cr4 &= ~(X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE); -- best regards yang