Re: [PATCH v2] Enable CPU SMEP feature for KVM

[Avi Kivity <avi@redhat.com>]

On 05/22/2011 11:08 AM, Yang, Wei Y wrote:
> >  This patch matches with "[PATCH v2] Enable CPU SMEP feature support for QEMU-KVM", no changes since v1.
> >
> >  Enable newly documented SMEP (Supervisor Mode Execution Protection) CPU feature in KVM module.
> >
> >  Intel new CPU supports SMEP (Supervisor Mode Execution Protection). SMEP prevents kernel from executing code in application. Updated Intel SDM describes this CPU feature. The document will be published soon.
> >
> >  This patch is based on Fenghua's SMEP patch series, as referred by: https://lkml.org/lkml/2011/5/17/523
> >  This patch enables guests' usage of SMEP.
> >  Currently, we don't enable this feature for guests with shadow page tables.
>
> >  Why not?  I see nothing that conflicts with shadow.
>
> We don't need to enable it for shadow page table, because shadow has mask against guest/shadow PTE, which may cause problem.  Let's keep shadow as it is because it's already very complex. Assume SMEP machines should have EPT.
>

I don't understand why.  Can you elaborate?

Shadow implements the U bit, which is all that is needed by SMEP as far 
as I can tell.


> >    update walk_addr_generic() to fault if SMEP is enabled and fetching
>
> Comments above.
>
> >  from a user page
>

Needs to be done even from EPT, in case walk_addr_generic() is invoked 
by the emulator.

-- 
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.