Re: [Patch v5 1/4] Remove SMEP bit from CR4_RESERVED_BITS

[Avi Kivity <avi@redhat.com>]

On 05/30/2011 11:05 AM, Ingo Molnar wrote:
> * Avi Kivity<avi@redhat.com>  wrote:
>
> >  On 05/30/2011 10:40 AM, Ingo Molnar wrote:
> >  >* Yang, Wei Y<wei.y.yang@intel.com>   wrote:
> >  >
> >  >>   This patch removes SMEP bit from CR4_RESERVED_BITS.
> >  >
> >  >I'm wondering, what is the best-practice way for tools/kvm/ to set
> >  >SMEP for the guest kernel automatically, even if the guest kernel
> >  >itsef has not requested SMEP?
> >  >
> >  >  The portion i'm worried about are old KVM versions that have the
> >  >  SMEP bit in CR4_RESERVED_BITS and reject it. So we cannot just
> >  >  unilaterally add SMEP to every cr4 write of the guest.
> >
> >  tools/kvm doesn't see cr4 writes at all. [...]
>
> I feared small complications like that! :-)
>
> We can definitely use KVM_GET_SREGS, fiddle the SMEP bit in
> kvm_regs.cr4 and call KVM_SET_SREGS, once the fine patch above goes
> upstream.

It's not a good idea.  First, the guest will see cr4.smep where it 
hasn't set it before, which may confuse it.  Second, the guest may 
rewrite cr4.smep, clearing it, giving a false sense of security.

> >  [...]  The only way to do this is in kvm itself.
> >
> >  >  Is there a way to query whether the host KVM version supports
> >  >  SMEP setting in cr4?
> >  >
> >
> >  KVM_GET_SUPPORTED_CPUID (it returns whether both the host cpu and
> >  kvm support smep; if one of them doesn't, you'll see smep
> >  disabled).
>
> That looks useful.
>
> So the way to go appears to be to do a GET_SREGS/SET_SREGS sequence
> to enable SMEP in the guest, some time after it has booted and has
> enabled paging.
>
> I'm wondering whether there's a suitable place to do that, when we
> are more or less guaranteed to exit the VM for some other reason -
> such as the first MMIO done with paging enabled?
>
> This solution means that we'll slow down pre-paging MMIOs with a
> GET_SREGS call, but that's ok, they are rare and the pre-paging
> bootup phase is very short.
>
> So the only worry would be where the guest sets cr4 itself - and
> since it does not know about SMEP it will probably disable it. Guest
> suspend/resume is one such place ...
>
> Another option would be to try to set the SMEP bit *before* we enable
> paging. In theory this should not confuse a Linux guest - and while i
> have not tested it i *think* we let it survive in the
> saved_cr4_features shadow variable. That would make guest
> suspend/resume work out of box as well.

Is there any reason not to do it in a hidden way in kvm?  Why must we 
play tricks?

-- 
error compiling committee.c: too many arguments to function