From mboxrd@z Thu Jan 1 00:00:00 1970 From: Xiao Guangrong Subject: Re: [PATCH V4 7/7] KVM, pkeys: disable PKU feature without ept Date: Wed, 9 Mar 2016 13:51:32 +0800 Message-ID: <56DFB9E4.1050609@linux.intel.com> References: <1457177252-7577-1-git-send-email-huaitong.han@intel.com> <1457177252-7577-8-git-send-email-huaitong.han@intel.com> <56DBF834.1020309@linux.intel.com> <56DC93D1.2070204@redhat.com> <56DE6919.4060107@linux.intel.com> <56DE91BD.4010502@redhat.com> <56DE9C45.4090504@linux.intel.com> <56DEA33B.1010005@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: QUOTED-PRINTABLE Cc: kvm@vger.kernel.org To: Paolo Bonzini , Huaitong Han , gleb@kernel.org Return-path: Received: from mga01.intel.com ([192.55.52.88]:3496 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750823AbcCIFv6 (ORCPT ); Wed, 9 Mar 2016 00:51:58 -0500 In-Reply-To: <56DEA33B.1010005@redhat.com> Sender: kvm-owner@vger.kernel.org List-ID: On 03/08/2016 06:02 PM, Paolo Bonzini wrote: > > > On 08/03/2016 10:32, Xiao Guangrong wrote: >> On 03/08/2016 04:47 PM, Paolo Bonzini wrote: >>> Some XSAVE features (currently only MPX, but in the future PKRU too= ) >>> will force eagerfpu on, see fpu__init_system_ctx_switch: >>> >>> if (xfeatures_mask & XFEATURE_MASK_EAGER) { >>> if (eagerfpu =3D=3D DISABLE) { >>> xfeatures_mask &=3D ~XFEATURE_MASK_EAGER; >> >> So if the kernel parameter, eagerfpu is set to "off", then eager is = not >> enabled, so PKRU can not work in KVM? > > Yes. Neither PKRU nor MPX. Er... I noticed fpregs is not switched if the CPU is running in KVM mod= ule (vcpu is not scheduled out and does not exit to userspace), that is why read_pkru() can be used to read guest's PKRU in the patch 4. However, then guest can fully control the access of userspace's memory = if CR4.PKRU is enabled on host and KVM needs to access QEMU's memory to do= some emulation anyway. Is it really safe=EF=BC=9F