Messages in this thread | | | Subject | Re: [PATCH v2 2/2] KVM: VMX: Don't expose unrestricted_guest is enabled if ept is disabled | From | Paolo Bonzini <> | Date | Tue, 10 Oct 2017 10:36:48 +0200 |
| |
On 09/10/2017 13:00, Wanpeng Li wrote: > From: Wanpeng Li <wanpeng.li@hotmail.com> > > SDM mentioned: > > "If either the “unrestricted guest” VM-execution control or the “mode-based > execute control for EPT” VM- execution control is 1, the “enable EPT” > VM-execution control must also be 1." > > However, we can still observe unrestricted_guest is Y after inserting the kvm-intel.ko > w/ ept=N. It depends on later starts a guest in order that the function > vmx_compute_secondary_exec_control() can be executed, then both the module parameter > and exec control fields will be amended. > > This patch fixes it by amending module parameter immediately during vmcs data setup. > > Reviewed-by: Jim Mattson <jmattson@google.com> > Cc: Paolo Bonzini <pbonzini@redhat.com> > Cc: Radim Krčmář <rkrcmar@redhat.com> > Cc: Jim Mattson <jmattson@google.com> > Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com> > --- > v1 -> v2: > * reduce to just "enable_ept = 0" > > arch/x86/kvm/vmx.c | 7 ++----- > 1 file changed, 2 insertions(+), 5 deletions(-) > > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c > index ab0f16e..dedff59 100644 > --- a/arch/x86/kvm/vmx.c > +++ b/arch/x86/kvm/vmx.c > @@ -6730,16 +6730,13 @@ static __init int hardware_setup(void) > if (!cpu_has_vmx_ept() || > !cpu_has_vmx_ept_4levels() || > !cpu_has_vmx_ept_mt_wb() || > - !cpu_has_vmx_invept_global()) { > + !cpu_has_vmx_invept_global()) > enable_ept = 0; > - enable_unrestricted_guest = 0; > - enable_ept_ad_bits = 0; > - } > > if (!cpu_has_vmx_ept_ad_bits() || !enable_ept) > enable_ept_ad_bits = 0; > > - if (!cpu_has_vmx_unrestricted_guest()) > + if (!cpu_has_vmx_unrestricted_guest() || !enable_ept) > enable_unrestricted_guest = 0; > > if (!cpu_has_vmx_flexpriority()) >
Queued both, thanks.
Paolo
| |