From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933791AbdKCRyS (ORCPT ); Fri, 3 Nov 2017 13:54:18 -0400 Received: from mail-wr0-f194.google.com ([209.85.128.194]:47478 "EHLO mail-wr0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933729AbdKCRyN (ORCPT ); Fri, 3 Nov 2017 13:54:13 -0400 X-Google-Smtp-Source: ABhQp+TvLeULsLVFrnC+hy6EvdTWNnaiPrQ/UjLYINEXDniGq/tWkCLgua/ogB6jtv+fjmTvgrTn4EZCnTZMiWF+Vk4= MIME-Version: 1.0 In-Reply-To: <7c2c39a3-8b24-e89a-1c67-385a5c6a2976@oracle.com> References: <1509670249-4907-1-git-send-email-wanpeng.li@hotmail.com> <1509670249-4907-2-git-send-email-wanpeng.li@hotmail.com> <0b1d82f7-2fc6-9fc0-15a4-3500413814bd@oracle.com> <7c2c39a3-8b24-e89a-1c67-385a5c6a2976@oracle.com> From: Jim Mattson Date: Fri, 3 Nov 2017 10:54:11 -0700 Message-ID: Subject: Re: [PATCH v5 2/3] KVM: nVMX: Validate the IA32_BNDCFGS on nested VM-entry To: Krish Sadhukhan Cc: Wanpeng Li , Paolo Bonzini , Radim Krcmar , kvm , "linux-kernel@vger.kernel.org" Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id vA3HsMEJ032679 KVM chooses not to support MPX in the guest unless both of these control bits are supported by the platform. On Fri, Nov 3, 2017 at 10:13 AM, Krish Sadhukhan wrote: > > > On 11/02/2017 11:40 PM, Wanpeng Li wrote: >> >> 2017-11-03 14:31 GMT+08:00 Krish Sadhukhan : >>> >>> >>> On 11/02/2017 05:50 PM, Wanpeng Li wrote: >>>> >>>> From: Wanpeng Li >>>> >>>> According to the SDM, if the "load IA32_BNDCFGS" VM-entry controls is 1, >>>> the >>>> following checks are performed on the field for the IA32_BNDCFGS MSR: >>>> - Bits reserved in the IA32_BNDCFGS MSR must be 0. >>>> - The linear address in bits 63:12 must be canonical. >>>> >>>> Reviewed-by: Konrad Rzeszutek Wilk >>>> Cc: Paolo Bonzini >>>> Cc: Radim Krčmář >>>> Cc: Jim Mattson >>>> Signed-off-by: Wanpeng Li >>>> --- >>>> v3 -> v4: >>>> * simply condition >>>> * use && instead of nested "if"s >>>> >>>> arch/x86/kvm/vmx.c | 5 +++++ >>>> 1 file changed, 5 insertions(+) >>>> >>>> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c >>>> index e6c8ffa..6cf3972 100644 >>>> --- a/arch/x86/kvm/vmx.c >>>> +++ b/arch/x86/kvm/vmx.c >>>> @@ -10805,6 +10805,11 @@ static int check_vmentry_postreqs(struct >>>> kvm_vcpu >>>> *vcpu, struct vmcs12 *vmcs12, >>>> return 1; >>>> } >>>> + if (kvm_mpx_supported() && >>>> + (is_noncanonical_address(vmcs12->guest_bndcfgs & >>>> PAGE_MASK, vcpu) || >>>> + (vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD))) >>>> + return 1; >>>> + >>>> return 0; >>>> } >>>> >>> Hi Wanpeng, >>> The SDM check is performed only when "load IA32_BNDCFGS" VM-entry >>> control >>> is 1. But vmx_mpx_supported() returns true when both "load IA32_BNDCFGS" >>> and >>> "store IA32_BNDCFGS" VM-entry controls are 1. Therefore your check is >>> performed when both controls are 1. Did I miss something here ? >> >> https://lkml.org/lkml/2017/11/2/748 Paolo hopes the simplification. >> >> Regards, >> Wanpeng Li > > I got that simplification and your changes look good to me. > > > However, I am still curious know the reason why vmx_mpx_supported() returns > true only when both controls are true whereas the SDM states the following: > > "IA32_BNDCFGS (64 bits). This field is supported only on processors that > support either the 1-setting of the “load IA32_BNDCFGS” VM-entry control or > that of the “clear IA32_BNDCFGS” VM-exit control." > > Thanks, > Krish