From mboxrd@z Thu Jan  1 00:00:00 1970
From: Bandan Das <bsd@redhat.com>
Subject: Re: [RFC PATCH 0/4] Add support for EPT execute only for nested hypervisors
Date: Fri, 24 Jun 2016 12:19:54 -0400
Message-ID: <jpgeg7m8sph.fsf@linux.bootlegged.copy>
References: <1466478746-14153-1-git-send-email-bsd@redhat.com>
	<576A169B.5090608@linux.intel.com>
	<jpglh1xw5ap.fsf@linux.bootlegged.copy>
	<576B6D9F.9020806@linux.intel.com>
	<jpg8txv47mh.fsf@linux.bootlegged.copy>
	<1951526417.1647454.1466742172232.JavaMail.zimbra@redhat.com>
	<jpgziqb1975.fsf@linux.bootlegged.copy>
	<1e7fdf15-d3a6-4c85-b8ee-ddb4adc50cc1@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain
Cc: Xiao Guangrong <guangrong.xiao@linux.intel.com>,
	kvm@vger.kernel.org
To: Paolo Bonzini <pbonzini@redhat.com>
Return-path: <kvm-owner@vger.kernel.org>
Received: from mx1.redhat.com ([209.132.183.28]:56259 "EHLO mx1.redhat.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1751082AbcFXQT5 (ORCPT <rfc822;kvm@vger.kernel.org>);
	Fri, 24 Jun 2016 12:19:57 -0400
In-Reply-To: <1e7fdf15-d3a6-4c85-b8ee-ddb4adc50cc1@redhat.com> (Paolo
	Bonzini's message of "Fri, 24 Jun 2016 08:46:54 +0200")
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

Paolo Bonzini <pbonzini@redhat.com> writes:

> On 24/06/2016 06:50, Bandan Das wrote:
>>>> >> I am tempted to remove the FNAME version altogether and change
>>>> >> is_present_gpte()
>>>> >> to return (pte & PT_PRESENT_MASK) || (shadow_xonly_valid && (pte & 4)). This
>>>> >> will take care of all cases. Hope I am not missing something :)
>>> >
>>> > Please rename the non-FNAME version to pae_is_present_pdpte or just inline
>>> > it in the two callers.
>> I am still not sure why the FNAME version is needed, specifically the PTTYPE_EPT
>> specific check. Why can't we  just check for execonly and the corresponding
>> bit in the non FNAME version ?
>
> The FNAME version encodes the right semantics:
>
> 1) for non-EPT page tables, bit 1 indicates present.
>
> 2) for EPT page tables, setting any bit 0-2 indicates present.
>
> It's perfectly fine to find that a PTE is invalid *after* judging that
> it is present.  There is no difference between setting bit 51 on a PTE,
> and having the invalid -W- combination on an EPT page table entry.  In
> both cases, the page is present but the PTE is invalid.
>
> The SDM is very clear about it: "If bits 2:0 of an EPT paging-structure
> entry are all 0, the entry is not present".  So if bits 2:0 are -W- the
> entry is present but invalid, and causes an EPT misconfiguration vmexit.
>  A non-present entry will cause an EPT violation instead.

Thank you very much, this clears it. pte & 7 makes sense now.

Xiao, as Paolo suggested, I can just remove the non FNAME version and directly
do pte & PT_PRESENT_MASK at the two call sites. I hope that will future proof it.

Thanks,
Bandan

> Paolo