From mboxrd@z Thu Jan 1 00:00:00 1970 From: Avi Kivity Subject: Re: [Patch v4 2/4] Add SMEP handling when setting CR4 Date: Wed, 01 Jun 2011 15:36:11 +0300 Message-ID: <4DE6323B.8090508@redhat.com> References: <5D8008F58939784290FAB48F5497519844E9278011@shsmsx502.ccr.corp.intel.com> <20110531175232.GA2721@amt.cnet> <4DE52DEF.2000009@redhat.com> <20110531184827.GA4376@amt.cnet> <4DE53B7E.4070403@redhat.com> <20110601123203.GA2429@amt.cnet> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: "Yang, Wei Y" , "kvm@vger.kernel.org" To: Marcelo Tosatti Return-path: Received: from mx1.redhat.com ([209.132.183.28]:25434 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758897Ab1FAMgX (ORCPT ); Wed, 1 Jun 2011 08:36:23 -0400 In-Reply-To: <20110601123203.GA2429@amt.cnet> Sender: kvm-owner@vger.kernel.org List-ID: On 06/01/2011 03:32 PM, Marcelo Tosatti wrote: > On Tue, May 31, 2011 at 10:03:26PM +0300, Avi Kivity wrote: > > On 05/31/2011 09:48 PM, Marcelo Tosatti wrote: > > >On Tue, May 31, 2011 at 09:05:35PM +0300, Avi Kivity wrote: > > >> >> if (is_long_mode(vcpu)) { > > >> >> if (!(cr4& X86_CR4_PAE)) > > >> >> return 1; > > >> > > > >> >A new field in vcpu->arch.mmu.base_role for smep is required > > >> >for shadow MMU (similar to nxe). > > >> > > >> I plan to add that with my cr0.wp=0 fixup (it's only needed there, right?) > > > > > >Sptes instantiated when cr4.smep = 0 should not be used when cr4.smep = > > >1, so no (unlikely that guest kernel executes user=1 code anyway, but > > >for consistency with other base_role flags). > > > > Why not? The sptes are interpreted exactly the same. > > > > sptes are interpreted differently when efer.nxe=1 - if bit 63 is > > set, it will fault when nxe=0 and will not fault when nxe=1 (for > > non-fetch accesses). So we can't share those sptes. > > A) CR4.SMEP = 0, spte instantiated via fetch fault of user pte. > B) CR4.SMEP = 1, base_role unchanged. > C) spte instantiated in A) used, but access should fault instead. > > Or if you have multiple CPUs with different settings. Why would C) not fault? The spte has U=1, any fetch access from kernel mode with SMEP=1 will fault. -- error compiling committee.c: too many arguments to function