On Thu, 2019-09-26 at 11:18 +0200, Paolo Bonzini wrote:
> On 26/09/19 10:59, Maxim Levitsky wrote:
> > If you mean to ask if there is a way to let guest access use no
> > paging at all, that is access host physical addresses directly, then
> > indeed there is no way, since regular non 'unrestricted guest' mode
> > required both protected mode and paging, and 'unrestricted guest'
> > requires EPT. Academically speaking it is of course possible to
> > create paging tables that are 1:1...
>
> Not so academically, it's exactly what KVM does.
You mean KVM uses 1:1 EPT pages and no guest paging,
to allow guest to access host physical address space?
That would break the security completely, thus I think you
mean something else here.
> However, indeed it
> would also be possible to switch out of EPT mode when CR0.PG=0. I'm not
> sure why it was done this way, maybe when the code was written it was
> simpler to use the identity map.
>
> Let's see if Avi is listening... :)
>
> Paolo
Here a quote from the PRM:
"The first processors to support VMX operation require CR0.PE and CR0.PG to be
1 in VMX operation (see Section
23.8). This restriction implies that guest software cannot be run in unpaged
protected mode or in real-address
mode. Later processors support a VM-execution control called “unrestricted
guest”. 1 If this control is 1, CR0.PE and
CR0.PG may be 0 in VMX non-root operation. Such processors allow guest software
to run in unpaged protected
mode or in real-address mode. The following items describe the behavior of such
software:"
...
"As noted in Section 26.2.1.1, the “enable EPT” VM-execution control must be 1
if the “unrestricted guest” VM-execution control is 1."
Best regards,
Maxim Levitsky
