From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754003AbdJIHyW (ORCPT ); Mon, 9 Oct 2017 03:54:22 -0400 Received: from mx1.redhat.com ([209.132.183.28]:55956 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753694AbdJIHyV (ORCPT ); Mon, 9 Oct 2017 03:54:21 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 1096378EA2 Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=pbonzini@redhat.com Subject: Re: [PATCH 1/2] KVM: VMX: Don't expose unrestricted_guest is enabled if ept is disabled To: Jim Mattson , Wanpeng Li Cc: LKML , kvm list , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Wanpeng Li References: <1507430107-4338-1-git-send-email-wanpeng.li@hotmail.com> From: Paolo Bonzini Message-ID: Date: Mon, 9 Oct 2017 09:54:17 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Mon, 09 Oct 2017 07:54:21 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 09/10/2017 00:35, Jim Mattson wrote: > If it were me, I'd apply De Morgan to that expression, but the logic looks fine. > > Reviewed-by: Jim Mattson I'm okay with the way Wanpeng wrote it, but as a follow up this: if (!cpu_has_vmx_ept() || !cpu_has_vmx_ept_4levels() || !cpu_has_vmx_ept_mt_wb()) { enable_ept = 0; enable_unrestricted_guest = 0; enable_ept_ad_bits = 0; } can be reduced to just "enable_ept = 0". Paolo > On Sat, Oct 7, 2017 at 7:35 PM, Wanpeng Li wrote: >> From: Wanpeng Li >> >> SDM mentioned: >> >> "If either the “unrestricted guest” VM-execution control or the “mode-based >> execute control for EPT” VM- execution control is 1, the “enable EPT” >> VM-execution control must also be 1." >> >> However, we can still observe unrestricted_guest is Y after inserting the kvm-intel.ko >> w/ ept=N. It depends on later starts a guest in order that the function >> vmx_compute_secondary_exec_control() can be executed, then both the module parameter >> and exec control fields will be amended. >> >> This patch fixes it by amending module parameter immediately during vmcs data setup. >> >> Cc: Paolo Bonzini >> Cc: Radim Krčmář >> Signed-off-by: Wanpeng Li >> --- >> arch/x86/kvm/vmx.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c >> index 244e366..3e664ca 100644 >> --- a/arch/x86/kvm/vmx.c >> +++ b/arch/x86/kvm/vmx.c >> @@ -6737,7 +6737,7 @@ static __init int hardware_setup(void) >> if (!cpu_has_vmx_ept_ad_bits() || !enable_ept) >> enable_ept_ad_bits = 0; >> >> - if (!cpu_has_vmx_unrestricted_guest()) >> + if (!cpu_has_vmx_unrestricted_guest() || !enable_ept) >> enable_unrestricted_guest = 0; >> >> if (!cpu_has_vmx_flexpriority()) >> -- >> 2.7.4 >>