Re: Weekly VMX status report. Xen: #18846 & Xen0: #749

[Gianluca Guida <gianluca.guida@eu.citrix.com>]

Keir Fraser wrote:
> Is there any guest that actually cares about having EFER_NX really cleared?
> Presumably the only way of detecting this would be reserved-bit page faults,
> which no OS is likely to want to deliberately cause?

Yes, no OS we've actually experienced at the moment rely on reserved bit 
faults (with the most notable exception of Tim's fast path for MMIO and 
non present pages in Xen's shadow entries).
I am sure about this for a very simple reason: -- some kind of secret I 
would like to share with you and xen-devel -- shadow code doesn't check 
at all for reserved bits when propagating changes from guest to shadows, 
so we never propagate reserved bit faults to guests. [working on this]

> There's been some talk of NX'ing up Xen's data areas. In that case we
> *would* need NX enabled always in host mode. Would it actually be worth
> enabling/disabling on vmexit/vmentry?
> 
> SVM actually does automatically save/restore EFER on vmentry/vmexit. Could
> we use VMX's MSR load/save support for the same effect? Would it be slow, or
> interact badly with the existing support for switching EFER.LME?

AFAIK, this should be slow.

Thanks,
Gianluca