Re: [Xen-devel] [PATCH v4 08/10] x86: Enable Supervisor Mode Access Prevention (SMAP) for Xen

["Wu, Feng" <feng.wu@xxxxxxxxx>]

> -----Original Message-----
> From: Jan Beulich [mailto:JBeulich@xxxxxxxx]
> Sent: Tuesday, May 06, 2014 5:11 PM
> To: Wu, Feng
> Cc: andrew.cooper3@xxxxxxxxxx; ian.campbell@xxxxxxxxxx; Dong, Eddie;
> Nakajima, Jun; Tian, Kevin; xen-devel@xxxxxxxxxxxxx
> Subject: RE: [PATCH v4 08/10] x86: Enable Supervisor Mode Access Prevention
> (SMAP) for Xen
> 
> >>> On 06.05.14 at 10:24, <feng.wu@xxxxxxxxx> wrote:
> >> From: Jan Beulich [mailto:JBeulich@xxxxxxxx]
> >> >>> On 06.05.14 at 07:19, <feng.wu@xxxxxxxxx> wrote:
> >> >> From: Jan Beulich [mailto:JBeulich@xxxxxxxx]
> >> >> I should have noticed this on the previous round already - the way
> >> >> it's being done right now will leave APs with SMAP disabled for an
> >> >> indeterminate amount of time (until they first reload CR4 from
> >> >> mmu_cr4_features).
> >> >
> >> > Yes, that's a question. In that case, we should move this part to the 
> >> > place
> >> > where
> >> > it was. So we should come back to the question about how to handle
> >> > stac()/clac()
> >> > in construct_dom0(), right?
> >>
> >> An option might be to move it back to where it was, but clear the flag
> >> temporarily on the one CPU calling construct_dom0(). That's a little
> >> hackish, but properly commented acceptable imo.
> >
> > Do you mean clear SMAP bit in CR4 before construct_dom0() and set it after
> > that like this?
> >
> > write_cr4(read_cr4() & ~X86_CR4_SMAP);
> > construct_dom0();
> > write_cr4(read_cr4() | X86_CR4_SMAP);
> 
> Yes, properly conditionalized of course (at least the second one).
> 

Yes, need to check cpu_has_smap first. Thanks!

> Jan

Thanks,
Feng

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel