Re: Questions about the real mode in kvm/qemu

[Maxim Levitsky]

On Thu, 2019-09-26 at 11:18 +0200, Paolo Bonzini wrote:
> On 26/09/19 10:59, Maxim Levitsky wrote:
> > If you mean to ask if there is a way to let guest access use no
> > paging at all, that is access host physical addresses directly, then
> > indeed there is no way, since regular non 'unrestricted guest' mode
> > required both protected mode and paging, and 'unrestricted guest'
> > requires EPT. Academically speaking it is of course possible to
> > create paging tables that are 1:1...
> 
> Not so academically, it's exactly what KVM does.
You mean KVM uses 1:1 EPT pages and no guest paging,
to allow guest to access host physical address space?
That would break the security completely, thus I think you
mean something else here.


>   However, indeed it
> would also be possible to switch out of EPT mode when CR0.PG=0.  I'm not
> sure why it was done this way, maybe when the code was written it was
> simpler to use the identity map.
> 
> Let's see if Avi is listening... :)
> 
> Paolo

Here a quote from the PRM:

"The first processors to support VMX operation require CR0.PE and CR0.PG to be 
1 in VMX operation (see Section
23.8). This restriction implies that guest software cannot be run in unpaged 
protected mode or in real-address
mode. Later processors support a VM-execution control called “unrestricted 
guest”. 1 If this control is 1, CR0.PE and
CR0.PG may be 0 in VMX non-root operation. Such processors allow guest software 
to run in unpaged protected
mode or in real-address mode. The following items describe the behavior of such 
software:"
...

"As noted in Section 26.2.1.1, the “enable EPT” VM-execution control must be 1 
if the “unrestricted guest” VM-execution control is 1."


Best regards,
        Maxim Levitsky