Page MenuHomeFreeBSD

vmm: Let guests enable SMEP/SMAP if the host supports it
ClosedPublic

Authored by markj on May 26 2021, 12:01 AM.

Details

Summary

Enabling the bits in cpuid appears to be sufficient. We already allow
the guest to set CR4_SMAP and _SMEP.

Test Plan

I booted a FreeBSD VM on an Intel system that implements SMAP, and verified
that the CPU feature is recognized and that it actually works (by adding
an access to user memory into a system call).

I do not have an AMD system I can use to test this; any assistance here would be
appreciated.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

This revision is now accepted and ready to land.May 26 2021, 12:03 AM
markj added a reviewer: kib.

From dmesg on a FreeBSD-14 guest on a Ryzen 4700U.

Host:

Structured Extended Features=0x219c91a9<FSGSBASE,BMI1,AVX2,SMEP,BMI2,PQM,PQE,RDSEED,ADX,SMAP,CLFLUSHOPT,CLWB,SHA>

Guest before the change:

Structured Extended Features=0x20040129<FSGSBASE,BMI1,AVX2,BMI2,RDSEED,SHA>

Guest with the change:

Structured Extended Features=0x201401a9<FSGSBASE,BMI1,AVX2,SMEP,BMI2,RDSEED,SMAP,SHA>

I believe SMAP on AMD is very recent feature, AFAIR it is not present on Zen2.

In D30462#684409, @kib wrote:

I believe SMAP on AMD is very recent feature, AFAIR it is not present on Zen2.

See the above dmesg fragment showing SMAP present on the Zen2-based 4700U