Re: [Xen-devel] [Patch] Disallow SMEP for PV guest

[Keir Fraser <keir@xxxxxxx>]

On 01/06/2011 15:55, "Konrad Rzeszutek Wilk" <konrad.wilk@xxxxxxxxxx> wrote:

> On Wed, Jun 01, 2011 at 10:31:12PM +0800, Yang, Wei Y wrote:
>> This patch disallows SMEP for PV guest.
> 
> What are the reasons for it? What do we gain from it?

Good question. It looks like it would be harmless to let it through (and the
guest can see the bit in CR4 is set, and it will be getting the SMEP
experience anyhow). And this patch does not stop the flag being passed to
dom0.

 -- Keir

>> 
>>  Signed-off-by: Yang, Wei <wei.y.yang@xxxxxxxxx>
>>  Signed-off-by: Shan, Haitao <haitao.shan@xxxxxxxxx>
>>  Signed-off-by: Li, Xin <xin.li@xxxxxxxxx>
>> 
>> ---
>>  xc_cpufeature.h |    3 +++
>>  xc_cpuid_x86.c  |    5 +++++
>>  2 files changed, 8 insertions(+)
>> 
>> diff -r 6f72160d2d55 tools/libxc/xc_cpufeature.h
>> --- a/tools/libxc/xc_cpufeature.h Wed Jun 01 19:57:32 2011 +0800
>> +++ b/tools/libxc/xc_cpufeature.h Wed Jun 01 22:21:33 2011 +0800
>> @@ -141,4 +141,7 @@
>>  #define X86_FEATURE_TBM         (6*32+21) /* trailing bit manipulations */
>>  #define X86_FEATURE_TOPOEXT     (6*32+22) /* topology extensions CPUID leafs
>> */
>>  
>> +/* Intel-defined CPU features, CPUID level 0x00000007:0 (ebx), word 7 */
>> +#define X86_FEATURE_SMEP       (7*32+ 7) /* Supervisor Mode Execution
>> Protection */
>> +
>>  #endif /* __LIBXC_CPUFEATURE_H */
>> diff -r 6f72160d2d55 tools/libxc/xc_cpuid_x86.c
>> --- a/tools/libxc/xc_cpuid_x86.c Wed Jun 01 19:57:32 2011 +0800
>> +++ b/tools/libxc/xc_cpuid_x86.c Wed Jun 01 22:21:33 2011 +0800
>> @@ -470,6 +470,11 @@
>>          xc_cpuid_config_xsave(xch, domid, xfeature_mask, input, regs);
>>          break;
>>  
>> +    case 7:
>> +        if ( input[1] == 0 )
>> +            clear_bit(X86_FEATURE_SMEP, regs[1]);
>> +        break;
>> +
>>      case 0x80000001:
>>          if ( !guest_64bit )
>>          {
>> 
>> _______________________________________________
>> Xen-devel mailing list
>> Xen-devel@xxxxxxxxxxxxxxxxxxx
>> http://lists.xensource.com/xen-devel
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-devel



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel