Re: [PATCH] kvm: x86: Use KVM CPU capabilities to determine CR4 reserved bits

[Xiaoyao Li <xiaoyao.li@intel.com>]

On 5/18/2020 8:31 PM, Paolo Bonzini wrote:
> On 18/05/20 06:52, Xiaoyao Li wrote:
>> On 5/6/2020 5:44 PM, Paolo Bonzini wrote:
>>> Using CPUID data can be useful for the processor compatibility
>>> check, but that's it.  Using it to compute guest-reserved bits
>>> can have both false positives (such as LA57 and UMIP which we
>>> are already handling) and false negatives:
>>
>>> in particular, with
>>> this patch we don't allow anymore a KVM guest to set CR4.PKE
>>> when CR4.PKE is clear on the host.
>>
>> A common question about whether a feature can be exposed to guest:
>>
>> Given a feature, there is a CPUID bit to enumerate it, and a CR4 bit to
>> turn it on/off. Whether the feature can be exposed to guest only depends
>> on host CR4 setting? I.e., if CPUID bit is not cleared in cpu_data in
>> host but host kernel doesn't set the corresponding CR4 bit to turn it
>> on, we cannot expose the feature to guest. right?
> 
> It depends.  The most obvious case is that the host kernel doesn't use
> CR4.PSE but we even use 4MB pages to emulate paging disabled mode when
> the processor doesn't support unrestricted guests.
> 
> Basically, the question is whether we are able to save/restore any
> processor state attached to the CR4 bit on vmexit/vmentry.  In this case
> there is no PKRU field in the VMCS and the RDPKRU/WRPKRU instructions
> require CR4.PKE=1; therefore, we cannot let the guest enable CR4.PKE
> unless it's also enabled on the host.
> 

aha! That's reason!
Thanks for the clarification.