[Xen-changelog] [xen stable-4.7] Revert "x86/hvm: disable pkeys for guests in non-paging mode"

[patchbot@xxxxxxx]

commit a2e3d27df7462fb6df3f25dedcfeb8cedf1bed7d
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Fri Jun 23 15:15:57 2017 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri Jun 23 15:15:57 2017 +0200

    Revert "x86/hvm: disable pkeys for guests in non-paging mode"
    
    This reverts commit c41e0266dd59ab50b7a153157e9bd2a3ad114b53.
    
    When determining Access Rights, Protection Keys only take effect when 
CR4.PKE
    it set, and 4-level paging is active.  All other circumstances (notibly, 
32bit
    PAE paging) skip the Protection Key control mechanism.
    
    Therefore, we do not need to clear CR4.PKE behind the back of a guest which 
is
    not using paging, as such a guest is necesserily running with EFER.LMA
    disabled.
    
    The {RD,WR}PKRU instructions are specified as being legal for use in any
    operating mode, but only if CR4.PKE is set.  By clearing CR4.PKE behind the
    back of an unpaged guest, these instructions yield #UD despite the guest
    correctly seeing PKE set if it reads CR4, and OSPKE being visible in CPUID.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Huaitong Han <huaitong.han@xxxxxxxxx>
    Acked-by: Kevin Tian <kevin.tian@xxxxxxxxx>
    master commit: 224acdd04a9f6ffe44d2f716287cac74787899ec
    master date: 2017-06-01 14:13:57 +0100
---
 xen/arch/x86/hvm/vmx/vmx.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index 3fe5083..012227f 100644
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -1588,13 +1588,12 @@ static void vmx_update_guest_cr(struct vcpu *v, 
unsigned int cr)
         if ( !hvm_paging_enabled(v) )
         {
             /*
-             * SMEP/SMAP/PKU is disabled if CPU is in non-paging mode in
-             * hardware. However Xen always uses paging mode to emulate guest
-             * non-paging mode. To emulate this behavior, SMEP/SMAP/PKU needs
-             * to be manually disabled when guest VCPU is in non-paging mode.
+             * SMEP/SMAP is disabled if CPU is in non-paging mode in hardware.
+             * However Xen always uses paging mode to emulate guest non-paging
+             * mode. To emulate this behavior, SMEP/SMAP needs to be manually
+             * disabled when guest VCPU is in non-paging mode.
              */
-            v->arch.hvm_vcpu.hw_cr[4] &=
-                ~(X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE);
+            v->arch.hvm_vcpu.hw_cr[4] &= ~(X86_CR4_SMEP | X86_CR4_SMAP);
         }
         __vmwrite(GUEST_CR4, v->arch.hvm_vcpu.hw_cr[4]);
         break;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.7

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog