From mboxrd@z Thu Jan 1 00:00:00 1970 From: Julian Stecklina Subject: Re: [PATCH] KVM: Enable VMX-related bits in MSR_IA32_FEATURE_CONTROL. Date: Tue, 06 Mar 2012 17:45:24 +0100 Message-ID: <1331052324.11643.5.camel@tabernacle> References: <1331046141-11101-1-git-send-email-js@alien8.de> <4F5629A0.8060209@redhat.com> <20120306154738.GA15125@fermat.math.technion.ac.il> Mime-Version: 1.0 Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature"; boundary="=-/WoHxSpEMqiGTBqsKkDq" Cc: Avi Kivity , kvm@vger.kernel.org To: Nadav Har'El Return-path: Received: from mail.skyhub.de ([78.46.96.112]:34104 "EHLO mail.skyhub.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755264Ab2CFQp2 (ORCPT ); Tue, 6 Mar 2012 11:45:28 -0500 In-Reply-To: <20120306154738.GA15125@fermat.math.technion.ac.il> Sender: kvm-owner@vger.kernel.org List-ID: --=-/WoHxSpEMqiGTBqsKkDq Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Am Dienstag, den 06.03.2012, 17:47 +0200 schrieb Nadav Har'El: > On Tue, Mar 06, 2012, Avi Kivity wrote about "Re: [PATCH] KVM: Enable VMX= -related bits in MSR_IA32_FEATURE_CONTROL.": > > > case MSR_IA32_FEATURE_CONTROL: > > > - *pdata =3D 0; > > > + /* > > > + * If nested VMX is enabled, set the lock bit (bit 0= ) > > > + * and the "Enable VMX outside SMX" bit (bit 2) in t= he > > > + * FEATURE_CONTROL MSR. > > > + */ > > > + *pdata =3D nested_vmx_allowed(vcpu) ? 0x5 : 0; >=20 > 0x5 can be written as FEATURE_CONTROL_LOCKED | > FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX Nice. Didn't know those constants. Next time I'll try harder to find those. :) >=20 > > > break; > > > case MSR_IA32_VMX_BASIC: > > > /* > >=20 > > The way I read it, it should be done by the guest, not the host. >=20 > This is also how I understand it. Check out KVM's own hardware_enable() > to see how a guest does turn on these bits before using VMXON - it > doesn't need to rely on the BIOS to have done it earlier (the BIOS, can, > however, prevent the guest from doing this by setting only the lock bit). After looking through the code (vmx_disabled_by_bios), it seems that KVM doesn't bother with FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX if FEATURE_CONTROL_LOCKED is not set. It seems like our kernel should do the same. Sorry for the noise. > What is true, however, is that the existing code is probably incomplete > in three ways (see section 20.7 of the SDM): >=20 > 1. It always returns 0 for this MSR, even if the guest previously set it > to something else.=20 >=20 > 2. handle_vmon() does not check the previous setting of this MSR. > If the guest (or its BIOS) doesn't set both FEATURE_CONTROL_LOCKED > and FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX, it should get a > #GP on an attempt to VMXON. This will allow L1's BIOS to disable > nested VMX if it wishes (not that I think this is a very useful > usecase...). >=20 > 3. vmx_set_vmx_msr to MSR_IA32_FEATURE_CONTROL should throw a #GP if > FEATURE_CONTROL_LOCKED is on. > =20 > I'll create a patch to do this shortly. This is greatly appreciated! Regards, Julian --=-/WoHxSpEMqiGTBqsKkDq Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.18 (GNU/Linux) iEYEABECAAYFAk9WPyQACgkQ2EtjUdW3H9kWRQCglVUkg1JwlYCp4t+t0sTAcjZp I2EAmwXKsgi+lPEdrfg0Z9JDxVQ67TJ4 =7tiC -----END PGP SIGNATURE----- --=-/WoHxSpEMqiGTBqsKkDq--