Messages in this thread | | | Subject | Re: [PATCH] kvm: x86: Use KVM CPU capabilities to determine CR4 reserved bits | From | Xiaoyao Li <> | Date | Mon, 18 May 2020 23:49:19 +0800 |
| |
On 5/18/2020 8:31 PM, Paolo Bonzini wrote: > On 18/05/20 06:52, Xiaoyao Li wrote: >> On 5/6/2020 5:44 PM, Paolo Bonzini wrote: >>> Using CPUID data can be useful for the processor compatibility >>> check, but that's it. Using it to compute guest-reserved bits >>> can have both false positives (such as LA57 and UMIP which we >>> are already handling) and false negatives: >> >>> in particular, with >>> this patch we don't allow anymore a KVM guest to set CR4.PKE >>> when CR4.PKE is clear on the host. >> >> A common question about whether a feature can be exposed to guest: >> >> Given a feature, there is a CPUID bit to enumerate it, and a CR4 bit to >> turn it on/off. Whether the feature can be exposed to guest only depends >> on host CR4 setting? I.e., if CPUID bit is not cleared in cpu_data in >> host but host kernel doesn't set the corresponding CR4 bit to turn it >> on, we cannot expose the feature to guest. right? > > It depends. The most obvious case is that the host kernel doesn't use > CR4.PSE but we even use 4MB pages to emulate paging disabled mode when > the processor doesn't support unrestricted guests. > > Basically, the question is whether we are able to save/restore any > processor state attached to the CR4 bit on vmexit/vmentry. In this case > there is no PKRU field in the VMCS and the RDPKRU/WRPKRU instructions > require CR4.PKE=1; therefore, we cannot let the guest enable CR4.PKE > unless it's also enabled on the host. >
aha! That's reason! Thanks for the clarification.
| |