Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753776Ab1EQJcx (ORCPT ); Tue, 17 May 2011 05:32:53 -0400 Received: from mx1.redhat.com ([209.132.183.28]:13600 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753661Ab1EQJcw (ORCPT ); Tue, 17 May 2011 05:32:52 -0400 Message-ID: <4DD2409F.4030800@redhat.com> Date: Tue, 17 May 2011 12:32:15 +0300 From: Avi Kivity User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.17) Gecko/20110428 Fedora/3.1.10-1.fc14 Lightning/1.0b3pre Thunderbird/3.1.10 MIME-Version: 1.0 To: Ingo Molnar CC: "H. Peter Anvin" , Fenghua Yu , Thomas Gleixner , Asit K Mallick , Linus Torvalds , Arjan van de Ven , Andrew Morton , Andi Kleen , linux-kernel , Pekka Enberg Subject: Re: [PATCH v2 0/4] Enable SMEP CPU Feature References: <1305581685-5144-1-git-send-email-fenghua.yu@intel.com> <4DD19C81.8000902@zytor.com> <20110517070527.GD22305@elte.hu> <4DD23CB6.3050503@redhat.com> <20110517092903.GJ22093@elte.hu> In-Reply-To: <20110517092903.GJ22093@elte.hu> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1298 Lines: 31 On 05/17/2011 12:29 PM, Ingo Molnar wrote: > * Avi Kivity wrote: > > > > Some programmable configurability seems necessary on the KVM side, as KVM > > > has no control over how sane the guest kernel is. > > > > We should simply expose the cpuid bit and cr4.smep. If the guest kernel > > feels it is up to it, it can enable smep itself. > > Well, given that there's lots of legacy installations around it would be a neat > KVM feature if it was possible to enable SMEP even if the guest kernel does not > enable it. As an additional (optional) layer of security. > > For example legacy Linux guests will work just fine, even if they do not enable > SMEP themselves. It's certainly possible (set CR4.SMEP transparently and hide it from the guest). But there's no way to tell if it doesn't break something wierd. The host might not even know if the guest is Linux or something else. We could support it as a non-default feature, but that reduces its utility. -- error compiling committee.c: too many arguments to function -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/