| Message ID | 1466694629-30732-4-git-send-email-wei.liu2@citrix.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
>>> On 23.06.16 at 17:10, <wei.liu2@citrix.com> wrote: > Originally hvm_fep was guarded by NDEBUG, which means it was only > available to debug builds. > > However there is value to have it for non-debug builds as well. User can > use that to run tests in setup that replicates production setup. > > Make it clear with a sync_console style warning that this option can't > be used in production setup. Update command line documentation > accordingly. Finally mark Xen as tainted when this feature is used. > > Add a kconfig option under x86 to configure hvm_fep. > > Signed-off-by: Wei Liu <wei.liu2@citrix.com> Acked-by: Jan Beulich <jbeulich@suse.com>
On 23/06/16 16:10, Wei Liu wrote: > Originally hvm_fep was guarded by NDEBUG, which means it was only > available to debug builds. > > However there is value to have it for non-debug builds as well. User can > use that to run tests in setup that replicates production setup. That is odd phrasing. Perhaps "Users can use it to..." ? > > Make it clear with a sync_console style warning that this option can't > be used in production setup. Update command line documentation > accordingly. Finally mark Xen as tainted when this feature is used. > > Add a kconfig option under x86 to configure hvm_fep. > > Signed-off-by: Wei Liu <wei.liu2@citrix.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
On Thu, Jun 23, 2016 at 04:24:40PM +0100, Andrew Cooper wrote: > On 23/06/16 16:10, Wei Liu wrote: > > Originally hvm_fep was guarded by NDEBUG, which means it was only > > available to debug builds. > > > > However there is value to have it for non-debug builds as well. User can > > use that to run tests in setup that replicates production setup. > > That is odd phrasing. Perhaps "Users can use it to..." ? > Feel free to change it as you wish to make it sounds more native.
On 23/06/16 16:26, Wei Liu wrote: > On Thu, Jun 23, 2016 at 04:24:40PM +0100, Andrew Cooper wrote: >> On 23/06/16 16:10, Wei Liu wrote: >>> Originally hvm_fep was guarded by NDEBUG, which means it was only >>> available to debug builds. >>> >>> However there is value to have it for non-debug builds as well. User can >>> use that to run tests in setup that replicates production setup. >> That is odd phrasing. Perhaps "Users can use it to..." ? >> > Feel free to change it as you wish to make it sounds more native. Ok - I will fix it on commit. I will pick the series up in just a moment. ~Andrew
On 6/23/16 10:10 AM, Wei Liu wrote: > Originally hvm_fep was guarded by NDEBUG, which means it was only > available to debug builds. > > However there is value to have it for non-debug builds as well. User can > use that to run tests in setup that replicates production setup. "Users can use it to run tests in a setup that replicates a production setup" is what I think was meant? > > Make it clear with a sync_console style warning that this option can't > be used in production setup. Update command line documentation > accordingly. Finally mark Xen as tainted when this feature is used. > > Add a kconfig option under x86 to configure hvm_fep. > > Signed-off-by: Wei Liu <wei.liu2@citrix.com> Otherwise the change looks good. Reviewed-by: Doug Goldstein <cardoe@cardoe.com>
diff --git a/docs/misc/xen-command-line.markdown b/docs/misc/xen-command-line.markdown index 7a271c0..045478f 100644 --- a/docs/misc/xen-command-line.markdown +++ b/docs/misc/xen-command-line.markdown @@ -886,8 +886,12 @@ Recognized in debug builds of the hypervisor only. Allow use of the Forced Emulation Prefix in HVM guests, to allow emulation of arbitrary instructions. -This option is intended for development purposes, and is only available in -debug builds of the hypervisor. +This option is intended for development and testing purposes. + +*Warning* +As this feature opens up the instruction emulator to arbitrary +instruction from an HVM guest, don't use this in production system. No +security support is provided when this flag is set. ### hvm\_port80 > `= <boolean>` diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 73f79cc..c1e9279 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -59,6 +59,23 @@ config BIGMEM If unsure, say N. +config HVM_FEP + bool "HVM Forced Emulation Prefix support" if EXPERT = "y" + default DEBUG + ---help--- + + Compiles in a feature that allows HVM guest to arbitrarily + exercise the instruction emulator. + + This feature can only be enabled during boot time with + appropriate hypervisor command line option. Please read + hypervisor command line documentation before trying to use + this feature. + + This is strictly for testing purposes, and not appropriate + for use in production. + + If unsure, say N. endmenu source "common/Kconfig" diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 5d6b921..c0f44e2 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -37,6 +37,7 @@ #include <xen/mem_access.h> #include <xen/rangeset.h> #include <xen/vm_event.h> +#include <xen/warning.h> #include <asm/shadow.h> #include <asm/hap.h> #include <asm/current.h> @@ -97,9 +98,14 @@ boolean_param("hap", opt_hap_enabled); #ifndef opt_hvm_fep /* Permit use of the Forced Emulation Prefix in HVM guests */ -bool_t opt_hvm_fep; +bool_t __read_mostly opt_hvm_fep; boolean_param("hvm_fep", opt_hvm_fep); #endif +static const char __initconst warning_hvm_fep[] = + "WARNING: HVM FORCED EMULATION PREFIX IS AVAILABLE\n" + "This option is *ONLY* intended to aid testing of Xen.\n" + "It has implications on the security of the system.\n" + "Please *DO NOT* use this in production.\n"; /* Xen command-line option to enable altp2m */ static bool_t __initdata opt_altp2m_enabled = 0; @@ -182,6 +188,9 @@ static int __init hvm_enable(void) if ( !opt_altp2m_enabled ) hvm_funcs.altp2m_supported = 0; + if ( opt_hvm_fep ) + warning_add(warning_hvm_fep); + /* * Allow direct access to the PC debug ports 0x80 and 0xed (they are * often used for I/O delays, but the vmexits simply slow things down). @@ -3910,6 +3919,7 @@ void hvm_ud_intercept(struct cpu_user_regs *regs) { regs->eip += sizeof(sig); regs->eflags &= ~X86_EFLAGS_RF; + add_taint(TAINT_HVM_FEP); } } diff --git a/xen/common/kernel.c b/xen/common/kernel.c index dae7e35..5bf77aa 100644 --- a/xen/common/kernel.c +++ b/xen/common/kernel.c @@ -175,6 +175,7 @@ int __init parse_bool(const char *s) * 'M' - Machine had a machine check experience. * 'B' - System has hit bad_page. * 'C' - Console output is synchronous. + * 'H' - HVM forced emulation prefix is permitted. * * The string is overwritten by the next call to print_taint(). */ @@ -182,11 +183,12 @@ char *print_tainted(char *str) { if ( tainted ) { - snprintf(str, TAINT_STRING_MAX_LEN, "Tainted: %c%c%c%c", + snprintf(str, TAINT_STRING_MAX_LEN, "Tainted: %c%c%c%c%c", tainted & TAINT_UNSAFE_SMP ? 'S' : ' ', tainted & TAINT_MACHINE_CHECK ? 'M' : ' ', tainted & TAINT_BAD_PAGE ? 'B' : ' ', - tainted & TAINT_SYNC_CONSOLE ? 'C' : ' '); + tainted & TAINT_SYNC_CONSOLE ? 'C' : ' ', + tainted & TAINT_HVM_FEP ? 'H' : ' '); } else { diff --git a/xen/include/asm-x86/hvm/hvm.h b/xen/include/asm-x86/hvm/hvm.h index c4d04fa..314881a 100644 --- a/xen/include/asm-x86/hvm/hvm.h +++ b/xen/include/asm-x86/hvm/hvm.h @@ -27,7 +27,7 @@ #include <public/hvm/save.h> #include <xen/mm.h> -#ifndef NDEBUG +#ifdef CONFIG_HVM_FEP /* Permit use of the Forced Emulation Prefix in HVM guests */ extern bool_t opt_hvm_fep; #else diff --git a/xen/include/xen/lib.h b/xen/include/xen/lib.h index 1c652bb..b1b0fb2 100644 --- a/xen/include/xen/lib.h +++ b/xen/include/xen/lib.h @@ -142,6 +142,7 @@ uint64_t muldiv64(uint64_t a, uint32_t b, uint32_t c); #define TAINT_BAD_PAGE (1<<2) #define TAINT_SYNC_CONSOLE (1<<3) #define TAINT_ERROR_INJECT (1<<4) +#define TAINT_HVM_FEP (1<<5) extern int tainted; #define TAINT_STRING_MAX_LEN 20 extern char *print_tainted(char *str);
Originally hvm_fep was guarded by NDEBUG, which means it was only available to debug builds. However there is value to have it for non-debug builds as well. User can use that to run tests in setup that replicates production setup. Make it clear with a sync_console style warning that this option can't be used in production setup. Update command line documentation accordingly. Finally mark Xen as tainted when this feature is used. Add a kconfig option under x86 to configure hvm_fep. Signed-off-by: Wei Liu <wei.liu2@citrix.com> --- Cc: Andrew Cooper <andrew.cooper3@citrix.com> Cc: Jan Beulich <jbeulich@suse.com> Cc: Doug Goldstein <cardoe@cardoe.com> v4: 1. Fix declaration of warning_hvm_fep. 2. Remove stars in warning text. v3: 1. Make config HVM_FEP an expert option and default to DEBUG. 2. Change some ifdefs 3. Update docs 4. Use the new warning infrastructure v2: 1. unsigned -> unsigned int 2. %d -> %u 3. Add spaces around "-" 4. Update warning message 5. Only taint hv when fep is used 6. Add kconfig option --- docs/misc/xen-command-line.markdown | 8 ++++++-- xen/arch/x86/Kconfig | 17 +++++++++++++++++ xen/arch/x86/hvm/hvm.c | 12 +++++++++++- xen/common/kernel.c | 6 ++++-- xen/include/asm-x86/hvm/hvm.h | 2 +- xen/include/xen/lib.h | 1 + 6 files changed, 40 insertions(+), 6 deletions(-)