Re: [Patch v5 1/4] Remove SMEP bit from CR4_RESERVED_BITS

[Avi Kivity <avi@redhat.com>]

On 06/01/2011 10:18 AM, Tian, Kevin wrote:
> >  From: Ingo Molnar
> >  Sent: Monday, May 30, 2011 3:41 PM
> >
> >
> >  * Yang, Wei Y<wei.y.yang@intel.com>  wrote:
> >
> >  >  This patch removes SMEP bit from CR4_RESERVED_BITS.
> >
> >  I'm wondering, what is the best-practice way for tools/kvm/ to set
> >  SMEP for the guest kernel automatically, even if the guest kernel
> >  itsef has not requested SMEP?
> >
>
> enabling SMEP w/o guest's knowledge can be problematic if the guest
> is doing U/S 0->1 bit change w/o TLB invalidation, which is a required
> action to ensure SMEP protection working correctly. Linux versions
> known so far don't have this behavior because TLB invalidation due to
> P bit change covers U/S 0->1 change. But given that end users may
> deploy various OS within the guest, to enable SMEP this way requires
> solid understanding on internals of those OSes. Or else it's uncertain
> whether SMEP protection fully works on such uncertain guests.

That does reduce the attractiveness of the whole thing.

-- 
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.