Re: [PATCH V6 0/9] KVM, pkeys: add memory protection-key support

[Paolo Bonzini <pbonzini@redhat.com>]

On 22/03/2016 09:51, Huaitong Han wrote:
> Changes in v6:
> *Optimize __read_pkru/__write_pkru in patch "save/restore PKRU when guest/host switches"
> *Squash "disable PKU feature without ept" to "expose CPUID/CR4 to guest"
> *Add patch "remove magic number with enum cpuid_leafs".
> *Accept slightly cleaner for "add pkeys support for permission_fault"
> *Accept some editing of the comments for "introduce pkru_mask to cache conditions".

Looks good, thanks!  Pushed to kvm/queue, I'll do some more testing and
send a pull request tomorrow to Linus if all oes well.

Paolo

> Changes in v5:
> *Add pkru save/restore support before FPU comes into force.
> *Introduce pkru_mask instead of update_permission_bitmask.
> *Update cpuid_leafs macro for __do_cpuid_ent.
> *Thanks for guangrong's comments and directly modification of patches.
> 
> Changes in v4:
> *Patch 2 and 4 have rebased on http://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/log/?h=mm/pkeys
> 
> Changes in v3:
> *Add comments for patch that disable PKU feature without ept.
> 
> Changes in v2:
> *Add pku.c for kvm-unit-tests.
> *Optimize permission_fault codes for patch4.
> *Delete is_long_mode and PK for patch5.
> *Squash cpuid and cr4 patches.
> 
> The protection-key feature provides an additional mechanism by which IA-32e
> paging controls access to usermode addresses.
> 
> Hardware support for protection keys for user pages is enumerated with CPUID
> feature flag CPUID.7.0.ECX[3]:PKU. Software support is CPUID.7.0.ECX[4]:OSPKE
> with the setting of CR4.PKE(bit 22).
> 
> When CR4.PKE = 1, every linear address is associated with the 4-bit protection
> key located in bits 62:59 of the paging-structure entry that mapped the page
> containing the linear address. The PKRU register determines, for each
> protection key, whether user-mode addresses with that protection key may be
> read or written.
> 
> The PKRU register (protection key rights for user pages) is a 32-bit register
> with the following format: for each i (0 ≤ i ≤ 15), PKRU[2i] is the
> access-disable bit for protection key i (ADi); PKRU[2i+1] is the write-disable
> bit for protection key i (WDi).
> 
> Software can use the RDPKRU and WRPKRU instructions with ECX = 0 to read and
> write PKRU. In addition, the PKRU register is XSAVE-managed state and can thus
> be read and written by instructions in the XSAVE feature set.
> 
> PFEC.PK (bit 5) is defined as protection key violations.
> 
> The specification of Protection Keys can be found at SDM (4.6.2, volume 3)
> http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-manual-325462.pdf.
> 
> 
> Huaitong Han (6):
>   KVM: x86: remove magic number with enum cpuid_leafs
>   KVM, pkeys: disable pkeys for guests in non-paging mode
>   KVM, pkeys: add pkeys support for xsave state
>   KVM, pkeys: introduce pkru_mask to cache conditions
>   KVM, pkeys: add pkeys support for permission_fault
>   KVM, pkeys: expose CPUID/CR4 to guest
> 
> Xiao Guangrong (3):
>   x86: pkey: introduce write_pkru() for KVM
>   KVM, pkeys: save/restore PKRU when guest/host switches
>   Revert "KVM: MMU: precompute page fault error code"
> 
>  arch/x86/include/asm/kvm_host.h      | 14 ++++++-
>  arch/x86/include/asm/pgtable.h       |  6 +++
>  arch/x86/include/asm/special_insns.h | 16 +++++++
>  arch/x86/kvm/cpuid.c                 | 65 +++++++++++++++++++----------
>  arch/x86/kvm/cpuid.h                 |  8 ++++
>  arch/x86/kvm/kvm_cache_regs.h        |  5 +++
>  arch/x86/kvm/mmu.c                   | 81 +++++++++++++++++++++++++++++++++++-
>  arch/x86/kvm/mmu.h                   | 33 ++++++++++++---
>  arch/x86/kvm/paging_tmpl.h           | 42 +++++++++++--------
>  arch/x86/kvm/svm.c                   |  8 ++++
>  arch/x86/kvm/vmx.c                   | 47 ++++++++++++++++++---
>  arch/x86/kvm/x86.c                   | 16 +++++--
>  arch/x86/kvm/x86.h                   |  3 +-
>  13 files changed, 287 insertions(+), 57 deletions(-)
>