Re: [Patch v3] Enable CPU SMEP feature for KVM

[Avi Kivity <avi@redhat.com>]

On 05/27/2011 05:56 AM, Tian, Kevin wrote:
> >  From: Yang, Wei Y
> >  Sent: Thursday, May 26, 2011 9:29 PM
> >
> >  This patchset enables a new CPU feature SMEP (Supervisor Mode Execution
> >  Protection) in KVM. SMEP prevents kernel from executing code in application.
> >  Updated Intel SDM describes this CPU feature. The document will be published
> >  soon.
> >
> >  This patchset is based on Fenghua's SMEP patch series, as referred by:
> >  https://lkml.org/lkml/2011/5/17/523
> >
> >  Changes since v2: enable SMEP for spt mode.
>
> another change in this version is to avoid adding SMEP to cr4_guest_owned_bits,
> because architecturally it's required to flush TLB when CR4.SMEP is changed
> which has to be emulated.

That is actually a good change since it allows us to query SMEP without 
a vmcs_readl(GUEST_CR4).

> Also based on your comment SMEP is now permitted based on cpuid setting. One pending
> issue though is check_cr_write in emulation path. We changed cr4_reserved_bits
> to vcpu specific instead of global, but check_cr_write doesn't provide a vcpu parameter.
> Looks the whole emulation logic avoids using vcpu context to be neutral. Avi, do you
> have any suggestion for a clean change here? Add cr_reserved_bits array into
> emulation context instead of hard-coding?

We can have a ->cpuid() callback so we can query it dynamically.  cr4 
writes will be emulated very rarely, after all.


-- 
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.