Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760542AbcDFD3H (ORCPT ); Tue, 5 Apr 2016 23:29:07 -0400 Received: from mga04.intel.com ([192.55.52.120]:46917 "EHLO mga04.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752812AbcDFD3F (ORCPT ); Tue, 5 Apr 2016 23:29:05 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.24,446,1455004800"; d="scan'208";a="939188208" Subject: Re: [PATCH 1/4] KVM: MMU: fix permission_fault() To: Paolo Bonzini References: <1458911978-19430-1-git-send-email-guangrong.xiao@linux.intel.com> <56F54983.4010508@redhat.com> <56FABECE.40601@linux.intel.com> <56FAE0F3.9090809@redhat.com> <56FB3254.5070403@linux.intel.com> <56FB73E0.7060601@redhat.com> <56FB7489.2080304@linux.intel.com> Cc: gleb@kernel.org, mtosatti@redhat.com, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, "Han, Huaitong" From: Xiao Guangrong Message-ID: <57048231.6070103@linux.intel.com> Date: Wed, 6 Apr 2016 11:27:45 +0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1 MIME-Version: 1.0 In-Reply-To: <56FB7489.2080304@linux.intel.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1173 Lines: 38 On 03/30/2016 02:39 PM, Xiao Guangrong wrote: > > > On 03/30/2016 02:36 PM, Paolo Bonzini wrote: >> >> >> On 30/03/2016 03:56, Xiao Guangrong wrote: >>>> x86/access.flat is currently using the "other" definition, i.e., PFEC.PK >>>> is only set if W=1 or CR0.WP=0 && PFEC.U=0 or PFEC.W=0. Can you use it >>>> (with ept=1 of course) to check what the processor is doing? >>> >>> Sure. >>> >>> And ept=1 is hard to trigger MMU issue, i am enabling PKEY on shadow >>> MMU, let's see what will happen. ;) >> >> No, don't do that! >> >> ept=1 lets you test what the processor does. It means you cannot test >> permission_fault(), but what we want here is just reverse engineering >> the microcode. ept=1 lets you do exactly that. > > Yes, i got this point. Huaitong will do the test once the machine gets > free. I tested it and it is failed: test pte.p pte.user pde.p pde.user pde.a pde.pse pkru.wd pkey=1 user write efer.nx cr4.pke: FAIL: error code 27 expected 7 Dump mapping: address: 0x123400000000 ------L4: 2ebe007 ------L3: 2ebf007 ------L2: 8000000020000a5 So PFEC.PKEY is set even if the ordinary check failed (caused by pde.rw = 0), the kvm code is right. :)