Re: [Xen-devel] [Patch] Disallow SMEP for PV guest

[Keir Fraser <keir.xen@xxxxxxxxx>]

On 01/06/2011 18:27, "Konrad Rzeszutek Wilk" <konrad.wilk@xxxxxxxxxx> wrote:

>> As it can't apply to ring 3, x86_64 pv guest kernel accessing user code won't
>> trigger instruction fetch page fault.  thus it makes no sense to use it here.
>> 
>> Definitely we should hide it from dom0 kernel.  The change should be in Xen
>> or pvops dom0?
> 
> Ugh, if have a patch against the paravirt kernel that would only cover the 3.1
> kernel.
> So you could still run with the SMEP enabled with the older kernels. Sounds
> like
> a candidate for Xen hypervisor?

Definitely, it's a one liner to traps.c:pv_cpuid(). Given that the domU
patching is already done by the hypervisor (in libxc) obviously it should be
done by the hypervisor for dom0 also.

And the feature should be hidden in CR4, by the hypervisor also.

 -- Keir



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel