Messages in this thread | | | Date | Tue, 17 May 2011 12:46:54 +0200 | From | Ingo Molnar <> | Subject | Re: [PATCH v2 0/4] Enable SMEP CPU Feature |
| |
* Avi Kivity <avi@redhat.com> wrote:
> On 05/17/2011 12:29 PM, Ingo Molnar wrote: > >* Avi Kivity<avi@redhat.com> wrote: > > > >> > Some programmable configurability seems necessary on the KVM side, as KVM > >> > has no control over how sane the guest kernel is. > >> > >> We should simply expose the cpuid bit and cr4.smep. If the guest kernel > >> feels it is up to it, it can enable smep itself. > > > > Well, given that there's lots of legacy installations around it would be a > > neat KVM feature if it was possible to enable SMEP even if the guest kernel > > does not enable it. As an additional (optional) layer of security. > > > > For example legacy Linux guests will work just fine, even if they do not > > enable SMEP themselves. > > It's certainly possible (set CR4.SMEP transparently and hide it from the > guest). But there's no way to tell if it doesn't break something wierd. The > host might not even know if the guest is Linux or something else. > > We could support it as a non-default feature, but that reduces its utility.
It would be a nice touch for tools/kvm/: we would use KVM_GET_SREGS and KVM_GET_SREGS to twiddle CR4.SMEP, even without the guest explicitly doing it.
A quick glance suggests that it could be done straight away in tools/kvm/kvm-cpu.c::kvm_cpu__setup_sregs() during vcpu setup, and hopefully that cr4 value survives boot and ends up in the guest kernel's mmu_cr4_features mask shadow register.
Thanks,
Ingo
| |