From mboxrd@z Thu Jan 1 00:00:00 1970 From: Avi Kivity Subject: Re: [Patch v3] Enable CPU SMEP feature for KVM Date: Fri, 27 May 2011 11:47:51 +0300 Message-ID: <4DDF6537.6040101@redhat.com> References: <5D8008F58939784290FAB48F54975198419FBE82D2@shsmsx502.ccr.corp.intel.com> <625BA99ED14B2D499DC4E29D8138F1505C9C008A5E@shsmsx502.ccr.corp.intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: "Yang, Wei Y" , "kvm@vger.kernel.org" , "Li, Xin" To: "Tian, Kevin" Return-path: Received: from mx1.redhat.com ([209.132.183.28]:23263 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752602Ab1E0Ir4 (ORCPT ); Fri, 27 May 2011 04:47:56 -0400 In-Reply-To: <625BA99ED14B2D499DC4E29D8138F1505C9C008A5E@shsmsx502.ccr.corp.intel.com> Sender: kvm-owner@vger.kernel.org List-ID: On 05/27/2011 05:56 AM, Tian, Kevin wrote: > > From: Yang, Wei Y > > Sent: Thursday, May 26, 2011 9:29 PM > > > > This patchset enables a new CPU feature SMEP (Supervisor Mode Execution > > Protection) in KVM. SMEP prevents kernel from executing code in application. > > Updated Intel SDM describes this CPU feature. The document will be published > > soon. > > > > This patchset is based on Fenghua's SMEP patch series, as referred by: > > https://lkml.org/lkml/2011/5/17/523 > > > > Changes since v2: enable SMEP for spt mode. > > another change in this version is to avoid adding SMEP to cr4_guest_owned_bits, > because architecturally it's required to flush TLB when CR4.SMEP is changed > which has to be emulated. That is actually a good change since it allows us to query SMEP without a vmcs_readl(GUEST_CR4). > Also based on your comment SMEP is now permitted based on cpuid setting. One pending > issue though is check_cr_write in emulation path. We changed cr4_reserved_bits > to vcpu specific instead of global, but check_cr_write doesn't provide a vcpu parameter. > Looks the whole emulation logic avoids using vcpu context to be neutral. Avi, do you > have any suggestion for a clean change here? Add cr_reserved_bits array into > emulation context instead of hard-coding? We can have a ->cpuid() callback so we can query it dynamically. cr4 writes will be emulated very rarely, after all. -- I have a truly marvellous patch that fixes the bug which this signature is too narrow to contain.