* [PATCH v7] xen/sm{e, a}p: allow disabling sm{e, a}p for Xen itself
@ 2016-10-09 8:20 He Chen
2016-10-10 12:16 ` Jan Beulich
0 siblings, 1 reply; 4+ messages in thread
From: He Chen @ 2016-10-09 8:20 UTC (permalink / raw)
To: xen-devel; +Cc: Andrew Cooper, Paul Lai, Feng Wu, Jan Beulich, He Chao
From: He Chao <he.chen@linux.intel.com>
SMEP/SMAP is a security feature to prevent kernel executing/accessing
user address involuntarily, any such behavior will lead to a page fault.
SMEP/SMAP is open (in CR4) for both Xen and HVM guest in earlier code.
SMEP/SMAP bit set in Xen CR4 would enforce security checking for 32-bit
PV guest which will suffer unknown SMEP/SMAP page fault when guest
kernel attempt to access user address although SMEP/SMAP is close for
PV guests.
This patch introduces a new boot option value "hvm" for "sm{e,a}p", it
is going to diable SMEP/SMAP for Xen hypervisor while enable them for
HVM. In this way, 32-bit PV guest will not suffer SMEP/SMAP security
issue. Users can choose whether open SMEP/SMAP for Xen itself,
especially when they are going to run 32-bit PV guests.
Signed-off-by: He Chen <he.chen@linux.intel.com>
---
Changes in v7:
* bugfix: fix the bug that this patch doesn't work on machine without SMAP.
* test: This patch has not been tested (on 32-bit PV environment).
Really sorry for that since I have took several days trying to
setup a 32-bit PV guest but finally failed.
Changes in v6:
* fix sm{e,a}p parameters parser flow.
Changes in v5:
* refine sm{e,a}p parameters parser flow.
* replace cpu_has_sm{e,a}p with boot_cpu_has(X86_FEATURE_XEN_SM{E,A}P).
* refine docs.
Changes in v4:
* introduce 2 new synthetic features X86_FEATURE_XEN_SMEP and
X86_FEATURE_XEN_SMAP for Xen itself.
* adjust SM{E,A}P related instruction patching code.
* commit message refinement.
Changes in v3:
* fix boot options.
* fix CR4 & mmu_cr4_features operations.
* disable SMEP/SMAP for Dom0.
* commit message refinement.
Changes in v2:
* allow "hvm" as a value to "smep" and "smap" command line options.
* clear SMEP/SMAP CPUID bits for pv guests if they are set to hvm only.
* refine docs.
* rewrite commit message.
---
docs/misc/xen-command-line.markdown | 10 +++---
xen/arch/x86/setup.c | 72 ++++++++++++++++++++++++++++++-------
xen/include/asm-x86/asm_defns.h | 10 +++---
xen/include/asm-x86/cpufeature.h | 2 ++
4 files changed, 73 insertions(+), 21 deletions(-)
diff --git a/docs/misc/xen-command-line.markdown b/docs/misc/xen-command-line.markdown
index 8ff57fa..b06b6ac 100644
--- a/docs/misc/xen-command-line.markdown
+++ b/docs/misc/xen-command-line.markdown
@@ -1433,19 +1433,21 @@ enabling more sockets and cores to go into deeper sleep states.
Set the serial transmit buffer size.
-### smep
+### smap
> `= <boolean>`
> Default: `true`
-Flag to enable Supervisor Mode Execution Protection
+Flag to enable Supervisor Mode Access Prevention
+Use `smap=hvm` to allow SMAP use by HVM guests only.
-### smap
+### smep
> `= <boolean>`
> Default: `true`
-Flag to enable Supervisor Mode Access Prevention
+Flag to enable Supervisor Mode Execution Protection
+Use `smep=hvm` to allow SMEP use by HVM guests only.
### snb\_igd\_quirk
> `= <boolean> | cap | <integer>`
diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
index 8ae897a..f3ed247 100644
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -61,14 +61,6 @@ boolean_param("nosmp", opt_nosmp);
static unsigned int __initdata max_cpus;
integer_param("maxcpus", max_cpus);
-/* smep: Enable/disable Supervisor Mode Execution Protection (default on). */
-static bool_t __initdata opt_smep = 1;
-boolean_param("smep", opt_smep);
-
-/* smap: Enable/disable Supervisor Mode Access Prevention (default on). */
-static bool_t __initdata opt_smap = 1;
-boolean_param("smap", opt_smap);
-
unsigned long __read_mostly cr4_pv32_mask;
/* Boot dom0 in pvh mode */
@@ -112,6 +104,58 @@ struct cpuinfo_x86 __read_mostly boot_cpu_data = { 0, 0, 0, 0, -1 };
unsigned long __read_mostly mmu_cr4_features = XEN_MINIMAL_CR4;
+/* smep: Enable/disable Supervisor Mode Execution Protection (default on). */
+#define SMEP_HVM_ONLY (-1)
+static s8 __initdata opt_smep = 1;
+static void __init parse_smep_param(char *s)
+{
+ if ( !*s )
+ {
+ opt_smep = 1;
+ return;
+ }
+
+ switch ( parse_bool(s) )
+ {
+ case 0:
+ opt_smep = 0;
+ return;
+ case 1:
+ opt_smep = 1;
+ return;
+ }
+
+ if ( !strcmp(s, "hvm") )
+ opt_smep = SMEP_HVM_ONLY;
+}
+custom_param("smep", parse_smep_param);
+
+/* smap: Enable/disable Supervisor Mode Access Prevention (default on). */
+#define SMAP_HVM_ONLY (-1)
+static s8 __initdata opt_smap = 1;
+static void __init parse_smap_param(char *s)
+{
+ if ( !*s )
+ {
+ opt_smap = 1;
+ return;
+ }
+
+ switch ( parse_bool(s) )
+ {
+ case 0:
+ opt_smap = 0;
+ return;
+ case 1:
+ opt_smap = 1;
+ return;
+ }
+
+ if ( !strcmp(s, "hvm") )
+ opt_smap = SMAP_HVM_ONLY;
+}
+custom_param("smap", parse_smap_param);
+
bool_t __read_mostly acpi_disabled;
bool_t __initdata acpi_force;
static char __initdata acpi_param[10] = "";
@@ -1404,12 +1448,16 @@ void __init noreturn __start_xen(unsigned long mbi_p)
if ( !opt_smep )
setup_clear_cpu_cap(X86_FEATURE_SMEP);
- if ( cpu_has_smep )
+ else if ( cpu_has_smep && opt_smep == 1 )
+ __set_bit(X86_FEATURE_XEN_SMEP, boot_cpu_data.x86_capability);
+ if ( boot_cpu_has(X86_FEATURE_XEN_SMEP) )
set_in_cr4(X86_CR4_SMEP);
if ( !opt_smap )
setup_clear_cpu_cap(X86_FEATURE_SMAP);
- if ( cpu_has_smap )
+ else if ( cpu_has_smap && opt_smap == 1 )
+ __set_bit(X86_FEATURE_XEN_SMAP, boot_cpu_data.x86_capability);
+ if ( boot_cpu_has(X86_FEATURE_XEN_SMAP) )
set_in_cr4(X86_CR4_SMAP);
cr4_pv32_mask = mmu_cr4_features & XEN_CR4_PV32_BITS;
@@ -1551,7 +1599,7 @@ void __init noreturn __start_xen(unsigned long mbi_p)
* This saves a large number of corner cases interactions with
* copy_from_user().
*/
- if ( cpu_has_smap )
+ if ( boot_cpu_has(X86_FEATURE_XEN_SMAP) )
{
cr4_pv32_mask &= ~X86_CR4_SMAP;
write_cr4(read_cr4() & ~X86_CR4_SMAP);
@@ -1571,7 +1619,7 @@ void __init noreturn __start_xen(unsigned long mbi_p)
bootstrap_map, cmdline) != 0)
panic("Could not set up DOM0 guest OS");
- if ( cpu_has_smap )
+ if ( boot_cpu_has(X86_FEATURE_XEN_SMAP) )
{
write_cr4(read_cr4() | X86_CR4_SMAP);
cr4_pv32_mask |= X86_CR4_SMAP;
diff --git a/xen/include/asm-x86/asm_defns.h b/xen/include/asm-x86/asm_defns.h
index e36e78f..f1c6fa1 100644
--- a/xen/include/asm-x86/asm_defns.h
+++ b/xen/include/asm-x86/asm_defns.h
@@ -205,7 +205,7 @@ void ret_from_intr(void);
.popsection; \
.pushsection .altinstructions, "a"; \
altinstruction_entry 661b, 661b, X86_FEATURE_ALWAYS, 3, 0; \
- altinstruction_entry 661b, 662b, X86_FEATURE_SMAP, 3, 3; \
+ altinstruction_entry 661b, 662b, X86_FEATURE_XEN_SMAP, 3, 3; \
.popsection
#define ASM_STAC ASM_AC(STAC)
@@ -217,21 +217,21 @@ void ret_from_intr(void);
668: call cr4_pv32_restore; \
.section .altinstructions, "a"; \
altinstruction_entry 667b, 667b, X86_FEATURE_ALWAYS, 5, 0; \
- altinstruction_entry 667b, 668b, X86_FEATURE_SMEP, 5, 5; \
- altinstruction_entry 667b, 668b, X86_FEATURE_SMAP, 5, 5; \
+ altinstruction_entry 667b, 668b, X86_FEATURE_XEN_SMEP, 5, 5; \
+ altinstruction_entry 667b, 668b, X86_FEATURE_XEN_SMAP, 5, 5; \
.popsection
#else
static always_inline void clac(void)
{
/* Note: a barrier is implicit in alternative() */
- alternative(ASM_NOP3, __stringify(__ASM_CLAC), X86_FEATURE_SMAP);
+ alternative(ASM_NOP3, __stringify(__ASM_CLAC), X86_FEATURE_XEN_SMAP);
}
static always_inline void stac(void)
{
/* Note: a barrier is implicit in alternative() */
- alternative(ASM_NOP3, __stringify(__ASM_STAC), X86_FEATURE_SMAP);
+ alternative(ASM_NOP3, __stringify(__ASM_STAC), X86_FEATURE_XEN_SMAP);
}
#endif
diff --git a/xen/include/asm-x86/cpufeature.h b/xen/include/asm-x86/cpufeature.h
index bcdf5d6..287419f 100644
--- a/xen/include/asm-x86/cpufeature.h
+++ b/xen/include/asm-x86/cpufeature.h
@@ -17,6 +17,8 @@ XEN_CPUFEATURE(CPUID_FAULTING, (FSCAPINTS+0)*32+ 6) /* cpuid faulting */
XEN_CPUFEATURE(CLFLUSH_MONITOR, (FSCAPINTS+0)*32+ 7) /* clflush reqd with monitor */
XEN_CPUFEATURE(APERFMPERF, (FSCAPINTS+0)*32+ 8) /* APERFMPERF */
XEN_CPUFEATURE(MFENCE_RDTSC, (FSCAPINTS+0)*32+ 9) /* MFENCE synchronizes RDTSC */
+XEN_CPUFEATURE(XEN_SMEP, (FSCAPINTS+0)*32+ 10) /* SMEP gets used by Xen itself */
+XEN_CPUFEATURE(XEN_SMAP, (FSCAPINTS+0)*32+ 11) /* SMAP gets used by Xen itself */
#define NCAPINTS (FSCAPINTS + 1) /* N 32-bit words worth of info */
--
2.7.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v7] xen/sm{e, a}p: allow disabling sm{e, a}p for Xen itself
2016-10-09 8:20 [PATCH v7] xen/sm{e, a}p: allow disabling sm{e, a}p for Xen itself He Chen
@ 2016-10-10 12:16 ` Jan Beulich
2016-10-11 2:23 ` He Chen
0 siblings, 1 reply; 4+ messages in thread
From: Jan Beulich @ 2016-10-10 12:16 UTC (permalink / raw)
To: He Chen; +Cc: Andrew Cooper, Paul Lai, Feng Wu, xen-devel
>>> On 09.10.16 at 10:20, <he.chen@linux.intel.com> wrote:
> Changes in v7:
> * bugfix: fix the bug that this patch doesn't work on machine without SMAP.
> * test: This patch has not been tested (on 32-bit PV environment).
> Really sorry for that since I have took several days trying to
> setup a 32-bit PV guest but finally failed.
Well, I don't know what to say. And since you don't say what your
problem is/was, I also don't see how anyone could help.
> @@ -1404,12 +1448,16 @@ void __init noreturn __start_xen(unsigned long mbi_p)
>
> if ( !opt_smep )
> setup_clear_cpu_cap(X86_FEATURE_SMEP);
> - if ( cpu_has_smep )
> + else if ( cpu_has_smep && opt_smep == 1 )
How about
if ( cpu_has_smep && opt_smep != SMEP_HVM_ONLY )
(i.e. I dislike both the "else" and the hard-coded 1)? Or if you dislike
this, then at least > 0 instead of == 1 please, or provide a #define
just like you do for -1.
Jan
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v7] xen/sm{e, a}p: allow disabling sm{e, a}p for Xen itself
2016-10-10 12:16 ` Jan Beulich
@ 2016-10-11 2:23 ` He Chen
2016-10-11 12:43 ` Jan Beulich
0 siblings, 1 reply; 4+ messages in thread
From: He Chen @ 2016-10-11 2:23 UTC (permalink / raw)
To: Jan Beulich; +Cc: Andrew Cooper, Paul Lai, Feng Wu, xen-devel
On Mon, Oct 10, 2016 at 06:16:41AM -0600, Jan Beulich wrote:
> >>> On 09.10.16 at 10:20, <he.chen@linux.intel.com> wrote:
> > Changes in v7:
> > * bugfix: fix the bug that this patch doesn't work on machine without SMAP.
> > * test: This patch has not been tested (on 32-bit PV environment).
> > Really sorry for that since I have took several days trying to
> > setup a 32-bit PV guest but finally failed.
>
> Well, I don't know what to say. And since you don't say what your
> problem is/was, I also don't see how anyone could help.
>
Apologies for sending out a patch without testing it entirely.
To be honest, I am not so fimilar with 32-bit PV guest...
I create a HVM guest and then compile linux kernel with the configuration
suggested by https://wiki.xen.org/wiki/Mainline_Linux_Kernel_Configs
after that, I copy vmlinuz and initramfs from guest to host and I boot
guest with PV cfg file below:
```
name="rhel32"
memory=2048
vcpus=2
on_crash="destroy"
on_poweroff="destroy"
on_reboot="restart"
localtime=0
builder="linux"
kernel="/root/xen_guest/rhel32pv/vmlinuz-4.8.0+"
ramdisk="/root/xen_guest/rhel32pv/initramfs-4.8.0+.img"
extra="root=/dev/xvda"
disk=['file:/root/xen_guest/rhel32pv/rhel32.img,xvda,w',]
vif=[ 'mac=00:15:3e:22:f5:1b','bridge=xenbr0']
```
The guest fail to boot and error message says can not find modules in
/lib/module...
I also try to install a PV guest directly by netboot way, but I am
blocked at "installing kernel" step, error shows and let me try.
The problems are trivial, and may I ask for some "how to build a 32-bit
PV guest on 64-bit host" reference wiki page or threads?
> > @@ -1404,12 +1448,16 @@ void __init noreturn __start_xen(unsigned long mbi_p)
> >
> > if ( !opt_smep )
> > setup_clear_cpu_cap(X86_FEATURE_SMEP);
> > - if ( cpu_has_smep )
> > + else if ( cpu_has_smep && opt_smep == 1 )
>
> How about
>
> if ( cpu_has_smep && opt_smep != SMEP_HVM_ONLY )
>
> (i.e. I dislike both the "else" and the hard-coded 1)? Or if you dislike
> this, then at least > 0 instead of == 1 please, or provide a #define
> just like you do for -1.
Sure, I would use `if ( cpu_has_smep && opt_smep != SMEP_HVM_ONLY )` in
next version.
BTW. In v6 patch, I missed `cpu_has_smep` and that's why this patch is
buggy on the machine without smap/smep hardware feature.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v7] xen/sm{e, a}p: allow disabling sm{e, a}p for Xen itself
2016-10-11 2:23 ` He Chen
@ 2016-10-11 12:43 ` Jan Beulich
0 siblings, 0 replies; 4+ messages in thread
From: Jan Beulich @ 2016-10-11 12:43 UTC (permalink / raw)
To: he.chen; +Cc: andrew.cooper3, paul.c.lai, feng.wu, xen-devel
>>> He Chen <he.chen@linux.intel.com> 10/11/16 4:24 AM >>>
>Apologies for sending out a patch without testing it entirely.
>To be honest, I am not so fimilar with 32-bit PV guest...
>I create a HVM guest and then compile linux kernel with the configuration
>suggested by https://wiki.xen.org/wiki/Mainline_Linux_Kernel_Configs
>after that, I copy vmlinuz and initramfs from guest to host and I boot
>guest with PV cfg file below:
>...
>The guest fail to boot and error message says can not find modules in
>/lib/module...
Obviously, as you didn't install the kernel inside the VM.
>The problems are trivial, and may I ask for some "how to build a 32-bit
>PV guest on 64-bit host" reference wiki page or threads?
I don't think anything like this exists, but where's the problem of grabbing
some 32-bit installation media and installing a PV guest from it? Also,
you running into these problems now suggests you didn't even try to test
things up to v6?
Jan
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-10-11 12:43 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-10-09 8:20 [PATCH v7] xen/sm{e, a}p: allow disabling sm{e, a}p for Xen itself He Chen
2016-10-10 12:16 ` Jan Beulich
2016-10-11 2:23 ` He Chen
2016-10-11 12:43 ` Jan Beulich
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.