|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH v2 2/2] xen: make available hvm_fep to non-debug build as well
Originally hvm_fep was guarded by NDEBUG, which means it was only
available to debug builds.
However there is value to have it for non-debug builds as well. User can
use that to run tests in setup that replicates production setup.
Make it clear with a sync_console style warning that this option can't
be used in production setup. Update command line documentation
accordingly. Finally mark Xen as tainted when this option is enabled.
Add a kconfig option under x86 to configure hvm_fep.
Signed-off-by: Wei Liu <wei.liu2@xxxxxxxxxx>
---
Cc: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
Cc: Jan Beulich <jbeulich@xxxxxxxx>
Cc: Doug Goldstein <cardoe@xxxxxxxxxx>
v2:
1. unsigned -> unsigned int
2. %d -> %u
3. Add spaces around "-"
4. Update warning message
5. Only taint hv when fep is used
6. Add kconfig option
---
docs/misc/xen-command-line.markdown | 8 ++++++--
xen/arch/x86/Kconfig | 14 ++++++++++++++
xen/arch/x86/hvm/hvm.c | 28 ++++++++++++++++++++++++++--
xen/common/kernel.c | 6 ++++--
xen/include/asm-x86/hvm/hvm.h | 2 +-
xen/include/xen/lib.h | 1 +
6 files changed, 52 insertions(+), 7 deletions(-)
diff --git a/docs/misc/xen-command-line.markdown
b/docs/misc/xen-command-line.markdown
index fed732c..dc53e24 100644
--- a/docs/misc/xen-command-line.markdown
+++ b/docs/misc/xen-command-line.markdown
@@ -878,8 +878,12 @@ Recognized in debug builds of the hypervisor only.
Allow use of the Forced Emulation Prefix in HVM guests, to allow emulation of
arbitrary instructions.
-This option is intended for development purposes, and is only available in
-debug builds of the hypervisor.
+This option is intended for development and testing purposes.
+
+*Warning*
+As this feature opens up the instruction emulator to HVM guest, don't
+use this in production system. No security support is provided when
+this flag is set.
### hvm\_port80
> `= <boolean>`
diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig
index 73f79cc..5e3b04a 100644
--- a/xen/arch/x86/Kconfig
+++ b/xen/arch/x86/Kconfig
@@ -59,6 +59,20 @@ config BIGMEM
If unsure, say N.
+config HVM_FEP
+ bool "HVM Forced Emulation Prefix support"
+ default y
+ ---help---
+
+ Compiles in a feature that allows HVM guest to enter
+ instruction emulator with forced emulation prefix.
+
+ This feature can only be enabled during boot time with
+ appropriate hypervisor command line option. Please read
+ hypervisor command line documentation before trying to use
+ this feature.
+
+ If unsure, say Y.
endmenu
source "common/Kconfig"
diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 78db903..373b78e 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -37,6 +37,7 @@
#include <xen/mem_access.h>
#include <xen/rangeset.h>
#include <xen/vm_event.h>
+#include <xen/delay.h>
#include <asm/shadow.h>
#include <asm/hap.h>
#include <asm/current.h>
@@ -95,9 +96,9 @@ unsigned long __section(".bss.page_aligned")
static bool_t __initdata opt_hap_enabled = 1;
boolean_param("hap", opt_hap_enabled);
-#ifndef opt_hvm_fep
+#if CONFIG_HVM_FEP
/* Permit use of the Forced Emulation Prefix in HVM guests */
-bool_t opt_hvm_fep;
+bool_t __read_mostly opt_hvm_fep;
boolean_param("hvm_fep", opt_hvm_fep);
#endif
@@ -182,6 +183,28 @@ static int __init hvm_enable(void)
if ( !opt_altp2m_enabled )
hvm_funcs.altp2m_supported = 0;
+ if ( opt_hvm_fep )
+ {
+ unsigned int i, j;
+
+ printk("**********************************************\n");
+ printk("******* WARNING: HVM FORCED EMULATION PREFIX IS AVAILABLE\n");
+ printk("******* This option is *ONLY* intended to aid testing of
Xen.\n");
+ printk("******* It has implications on the security of the system.\n");
+ printk("******* Please *DO NOT* use this in production.\n");
+ printk("**********************************************\n");
+ for ( i = 0; i < 3; i++ )
+ {
+ printk("%u... ", 3 - i);
+ for ( j = 0; j < 100; j++ )
+ {
+ process_pending_softirqs();
+ mdelay(10);
+ }
+ }
+ printk("\n");
+ }
+
/*
* Allow direct access to the PC debug ports 0x80 and 0xed (they are
* often used for I/O delays, but the vmexits simply slow things down).
@@ -3905,6 +3928,7 @@ void hvm_ud_intercept(struct cpu_user_regs *regs)
{
regs->eip += sizeof(sig);
regs->eflags &= ~X86_EFLAGS_RF;
+ add_taint(TAINT_HVM_FEP);
}
}
diff --git a/xen/common/kernel.c b/xen/common/kernel.c
index dae7e35..5bf77aa 100644
--- a/xen/common/kernel.c
+++ b/xen/common/kernel.c
@@ -175,6 +175,7 @@ int __init parse_bool(const char *s)
* 'M' - Machine had a machine check experience.
* 'B' - System has hit bad_page.
* 'C' - Console output is synchronous.
+ * 'H' - HVM forced emulation prefix is permitted.
*
* The string is overwritten by the next call to print_taint().
*/
@@ -182,11 +183,12 @@ char *print_tainted(char *str)
{
if ( tainted )
{
- snprintf(str, TAINT_STRING_MAX_LEN, "Tainted: %c%c%c%c",
+ snprintf(str, TAINT_STRING_MAX_LEN, "Tainted: %c%c%c%c%c",
tainted & TAINT_UNSAFE_SMP ? 'S' : ' ',
tainted & TAINT_MACHINE_CHECK ? 'M' : ' ',
tainted & TAINT_BAD_PAGE ? 'B' : ' ',
- tainted & TAINT_SYNC_CONSOLE ? 'C' : ' ');
+ tainted & TAINT_SYNC_CONSOLE ? 'C' : ' ',
+ tainted & TAINT_HVM_FEP ? 'H' : ' ');
}
else
{
diff --git a/xen/include/asm-x86/hvm/hvm.h b/xen/include/asm-x86/hvm/hvm.h
index f486ee9..d2e0ae5 100644
--- a/xen/include/asm-x86/hvm/hvm.h
+++ b/xen/include/asm-x86/hvm/hvm.h
@@ -27,7 +27,7 @@
#include <public/hvm/save.h>
#include <xen/mm.h>
-#ifndef NDEBUG
+#if CONFIG_HVM_FEP
/* Permit use of the Forced Emulation Prefix in HVM guests */
extern bool_t opt_hvm_fep;
#else
diff --git a/xen/include/xen/lib.h b/xen/include/xen/lib.h
index 1c652bb..b1b0fb2 100644
--- a/xen/include/xen/lib.h
+++ b/xen/include/xen/lib.h
@@ -142,6 +142,7 @@ uint64_t muldiv64(uint64_t a, uint32_t b, uint32_t c);
#define TAINT_BAD_PAGE (1<<2)
#define TAINT_SYNC_CONSOLE (1<<3)
#define TAINT_ERROR_INJECT (1<<4)
+#define TAINT_HVM_FEP (1<<5)
extern int tainted;
#define TAINT_STRING_MAX_LEN 20
extern char *print_tainted(char *str);
--
2.1.4
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel
|
 |
Lists.xenproject.org is hosted with RackSpace, monitoring our |