On 05/22/2011 11:08 AM, Yang, Wei Y wrote:
> This patch matches with "[PATCH v2] Enable CPU SMEP feature support for QEMU-KVM", no changes since v1.
>
> Enable newly documented SMEP (Supervisor Mode Execution Protection) CPU feature in KVM module.
>
> Intel new CPU supports SMEP (Supervisor Mode Execution Protection). SMEP prevents kernel from executing code in application. Updated Intel SDM describes this CPU feature. The document will be published soon.
>
> This patch is based on Fenghua's SMEP patch series, as referred by: https://lkml.org/lkml/2011/5/17/523
> This patch enables guests' usage of SMEP.
> Currently, we don't enable this feature for guests with shadow page tables.
> Why not? I see nothing that conflicts with shadow.
We don't need to enable it for shadow page table, because shadow has mask against guest/shadow PTE, which may cause problem. Let's keep shadow as it is because it's already very complex. Assume SMEP machines should have EPT.
I don't understand why. Can you elaborate?
Shadow implements the U bit, which is all that is needed by SMEP as far
as I can tell.
> update walk_addr_generic() to fault if SMEP is enabled and fetching
Comments above.
> from a user page
Needs to be done even from EPT, in case walk_addr_generic() is invoked
by the emulator.
--
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
