Re: [PATCH 2/2] cpu: intel, amd: mask cleared cpuid features

[Borislav Petkov <bp@amd64.org>]

(+ Andre who's been doing some cross vendor stuff)

On Fri, Jul 20, 2012 at 08:37:33PM +0400, Vladimir Davydov wrote:
> If 'clearcpuid=N' is specified in boot options, CPU feature #N won't be
> reported in /proc/cpuinfo and used by the kernel. However, if a
> userpsace process checks CPU features directly using the cpuid
> instruction, it will be reported about all features supported by the CPU
> irrespective of what features are cleared.
> 
> The patch makes the clearcpuid boot option not only clear CPU features
> in kernel but also mask them in hardware for Intel and AMD CPUs that
> support it so that the features cleared won't be reported even by the
> cpuid instruction.
> 
> This can be useful for migration of virtual machines managed by
> hypervisors that do not support/use Intel VT/AMD-V hardware-assisted
> virtualization technology.

As they say in Star Wars: "I have a bad feeling about this."

So opening the floodgates to people fiddling with this (not only
migrators) makes me feel pretty uneasy. And I won't wonder if all of
a sudden strange failures start to appear because code is querying
cpuid features but some funny distro has disabled it in its kernel boot
options.

Or some other obscure case where the culprit is hidden in kernel command
line options.

If it were only needed for migration, then I'd say you guys can use
msr-tools and run a script as root on the target machine to which you
want to migrate to and toggle the feature bits you want.

I don't think cross vendor migration alone justifies having a generic
kernel feature like that.

Thanks.

-- 
Regards/Gruss,
Boris.

Advanced Micro Devices GmbH
Einsteinring 24, 85609 Dornach
GM: Alberto Bozzo
Reg: Dornach, Landkreis Muenchen
HRB Nr. 43632 WEEE Registernr: 129 19551