From: Paolo Bonzini <pbonzini@redhat.com>
To: Bandan Das <bsd@redhat.com>
Cc: Xiao Guangrong <guangrong.xiao@linux.intel.com>, kvm@vger.kernel.org
Subject: Re: [RFC PATCH 0/4] Add support for EPT execute only for nested hypervisors
Date: Fri, 24 Jun 2016 08:46:54 +0200 [thread overview]
Message-ID: <1e7fdf15-d3a6-4c85-b8ee-ddb4adc50cc1@redhat.com> (raw)
In-Reply-To: <jpgziqb1975.fsf@linux.bootlegged.copy>
On 24/06/2016 06:50, Bandan Das wrote:
>>> >> I am tempted to remove the FNAME version altogether and change
>>> >> is_present_gpte()
>>> >> to return (pte & PT_PRESENT_MASK) || (shadow_xonly_valid && (pte & 4)). This
>>> >> will take care of all cases. Hope I am not missing something :)
>> >
>> > Please rename the non-FNAME version to pae_is_present_pdpte or just inline
>> > it in the two callers.
> I am still not sure why the FNAME version is needed, specifically the PTTYPE_EPT
> specific check. Why can't we just check for execonly and the corresponding
> bit in the non FNAME version ?
The FNAME version encodes the right semantics:
1) for non-EPT page tables, bit 1 indicates present.
2) for EPT page tables, setting any bit 0-2 indicates present.
It's perfectly fine to find that a PTE is invalid *after* judging that
it is present. There is no difference between setting bit 51 on a PTE,
and having the invalid -W- combination on an EPT page table entry. In
both cases, the page is present but the PTE is invalid.
The SDM is very clear about it: "If bits 2:0 of an EPT paging-structure
entry are all 0, the entry is not present". So if bits 2:0 are -W- the
entry is present but invalid, and causes an EPT misconfiguration vmexit.
A non-present entry will cause an EPT violation instead.
Paolo
next prev parent reply other threads:[~2016-06-24 6:46 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-21 3:12 [RFC PATCH 0/4] Add support for EPT execute only for nested hypervisors Bandan Das
2016-06-21 3:12 ` [RFC PATCH 1/4] mmu: add a boolean to indicate host ept execute only support Bandan Das
2016-06-21 3:12 ` [RFC PATCH 2/4] mmu: Update ept specific valid bit values Bandan Das
2016-06-21 8:08 ` Paolo Bonzini
2016-06-22 4:09 ` Xiao Guangrong
2016-06-21 3:12 ` [RFC PATCH 3/4] mmu: don't set the present bit unconditionally Bandan Das
2016-06-21 8:12 ` Paolo Bonzini
2016-06-21 8:40 ` Paolo Bonzini
2016-06-22 16:10 ` Bandan Das
2016-06-22 16:12 ` Paolo Bonzini
2016-06-22 16:23 ` Bandan Das
2016-06-22 4:30 ` Xiao Guangrong
2016-06-22 16:21 ` Bandan Das
2016-06-21 3:12 ` [RFC PATCH 4/4] vmx: advertise support for ept execute only Bandan Das
2016-06-22 4:39 ` [RFC PATCH 0/4] Add support for EPT execute only for nested hypervisors Xiao Guangrong
2016-06-22 16:34 ` Bandan Das
2016-06-23 5:03 ` Xiao Guangrong
2016-06-24 2:56 ` Bandan Das
2016-06-24 4:22 ` Paolo Bonzini
2016-06-24 4:50 ` Bandan Das
2016-06-24 6:46 ` Paolo Bonzini [this message]
2016-06-24 7:02 ` Xiao Guangrong
2016-06-24 16:19 ` Bandan Das
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1e7fdf15-d3a6-4c85-b8ee-ddb4adc50cc1@redhat.com \
--to=pbonzini@redhat.com \
--cc=bsd@redhat.com \
--cc=guangrong.xiao@linux.intel.com \
--cc=kvm@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.