Messages in this thread | | | Date | Tue, 24 Jul 2012 11:06:08 +0400 | From | Vladimir Davydov <> | Subject | Re: [PATCH 2/2] cpu: intel, amd: mask cleared cpuid features |
| |
On 07/21/2012 02:37 PM, Borislav Petkov wrote: > (+ Andre who's been doing some cross vendor stuff) > > On Fri, Jul 20, 2012 at 08:37:33PM +0400, Vladimir Davydov wrote: >> If 'clearcpuid=N' is specified in boot options, CPU feature #N won't be >> reported in /proc/cpuinfo and used by the kernel. However, if a >> userpsace process checks CPU features directly using the cpuid >> instruction, it will be reported about all features supported by the CPU >> irrespective of what features are cleared. >> >> The patch makes the clearcpuid boot option not only clear CPU features >> in kernel but also mask them in hardware for Intel and AMD CPUs that >> support it so that the features cleared won't be reported even by the >> cpuid instruction. >> >> This can be useful for migration of virtual machines managed by >> hypervisors that do not support/use Intel VT/AMD-V hardware-assisted >> virtualization technology. > As they say in Star Wars: "I have a bad feeling about this." > > So opening the floodgates to people fiddling with this (not only > migrators) makes me feel pretty uneasy. And I won't wonder if all of > a sudden strange failures start to appear because code is querying > cpuid features but some funny distro has disabled it in its kernel boot > options. > > Or some other obscure case where the culprit is hidden in kernel command > line options. > > If it were only needed for migration, then I'd say you guys can use > msr-tools and run a script as root on the target machine to which you > want to migrate to and toggle the feature bits you want.
If msr-tools are used for cpuid masking, we will either get inconsistency between /proc/cpuinfo:flags and the output of the cpuid instruction or have to "synchronize" the clearcpuid boot option and the userspace app using msr-tools, which seems to be inconvenient. So, IMO, it would be better to have such functionality implemented in the kernel.
> I don't think cross vendor migration alone justifies having a generic > kernel feature like that. > > Thanks. >
| |