From patchwork Thu Jun 23 15:10:29 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wei Liu X-Patchwork-Id: 9195435 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A23D46075A for ; Thu, 23 Jun 2016 15:12:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9248F2844A for ; Thu, 23 Jun 2016 15:12:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 86D7328461; Thu, 23 Jun 2016 15:12:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 5664B2844A for ; Thu, 23 Jun 2016 15:12:29 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1bG6H5-0008GB-2k; Thu, 23 Jun 2016 15:10:35 +0000 Received: from mail6.bemta6.messagelabs.com ([85.158.143.247]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1bG6H4-0008EA-GS for xen-devel@lists.xenproject.org; Thu, 23 Jun 2016 15:10:34 +0000 Received: from [85.158.143.35] by server-1.bemta-6.messagelabs.com id EF/60-09256-AEBFB675; Thu, 23 Jun 2016 15:10:34 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprAIsWRWlGSWpSXmKPExsXitHRDpO7L39n hBmtXa1p83zKZyYHR4/CHKywBjFGsmXlJ+RUJrBmbd89jLDhoVLF5wS3mBsZ+jS5GTg4JAX+J Mw/XsYHYbALKEj87e8FsEQE9iaYDzxm7GLk4mAUmMUosvrobLCEs4Cex7+hMJhCbRUBV4tnak ywgNq+As8T1WbuZIYbKSZw//hPM5hRwkei62g5WIwRU8/roXihbQaJj+jEmiF5BiZMzn4DFmQ UkJA6+eAHUywE0h1vib7f9BEa+WUiqZiGpWsDItIpRvTi1qCy1SNdYL6koMz2jJDcxM0fX0MB MLze1uDgxPTUnMalYLzk/dxMjMKQYgGAHY8c/p0OMkhxMSqK8jJuzw4X4kvJTKjMSizPii0pz UosPMcpwcChJ8PIBQ1RIsCg1PbUiLTMHGNwwaQkOHiUR3om/gNK8xQWJucWZ6RCpU4yKUuK8p 0ASAiCJjNI8uDZYRF1ilJUS5mUEOkSIpyC1KDezBFX+FaM4B6OSMK8MyHaezLwSuOmvgBYzAS 2+2w+2uCQRISXVwCgvKdGx/GPehTPWWXXrhNUL/52bH62WFl3+8aXR2/W/xOI+Xlv6d9s1u8+ HN0dW/dbXFwh+cW/tdUufzrjN31sCXaeGvpt10m3hFyeXt2658XN8J862bys69XpzKO+Jm8pT mvct2HOhWWZKdN+3O1a3VmxQOmbLfnnT4XXrC+Wbn5/Snb9BLMxXiaU4I9FQi7moOBEAREmXk 6MCAAA= X-Env-Sender: prvs=975c6da73=wei.liu2@citrix.com X-Msg-Ref: server-12.tower-21.messagelabs.com!1466694630!20604221!3 X-Originating-IP: [66.165.176.89] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogNjYuMTY1LjE3Ni44OSA9PiAyMDMwMDc=\n, received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 8.46; banners=-,-,- X-VirusChecked: Checked Received: (qmail 35545 invoked from network); 23 Jun 2016 15:10:33 -0000 Received: from smtp.citrix.com (HELO SMTP.CITRIX.COM) (66.165.176.89) by server-12.tower-21.messagelabs.com with RC4-SHA encrypted SMTP; 23 Jun 2016 15:10:33 -0000 X-IronPort-AV: E=Sophos;i="5.26,517,1459814400"; d="scan'208";a="362363971" From: Wei Liu To: Xen-devel Date: Thu, 23 Jun 2016 16:10:29 +0100 Message-ID: <1466694629-30732-4-git-send-email-wei.liu2@citrix.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1466694629-30732-1-git-send-email-wei.liu2@citrix.com> References: <1466694629-30732-1-git-send-email-wei.liu2@citrix.com> MIME-Version: 1.0 X-DLP: MIA1 Cc: Andrew Cooper , Wei Liu , Jan Beulich , Doug Goldstein Subject: [Xen-devel] [PATCH v4 3/3] xen: make available hvm_fep to non-debug build as well X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Originally hvm_fep was guarded by NDEBUG, which means it was only available to debug builds. However there is value to have it for non-debug builds as well. User can use that to run tests in setup that replicates production setup. Make it clear with a sync_console style warning that this option can't be used in production setup. Update command line documentation accordingly. Finally mark Xen as tainted when this feature is used. Add a kconfig option under x86 to configure hvm_fep. Signed-off-by: Wei Liu Acked-by: Jan Beulich Reviewed-by: Andrew Cooper Reviewed-by: Doug Goldstein --- Cc: Andrew Cooper Cc: Jan Beulich Cc: Doug Goldstein v4: 1. Fix declaration of warning_hvm_fep. 2. Remove stars in warning text. v3: 1. Make config HVM_FEP an expert option and default to DEBUG. 2. Change some ifdefs 3. Update docs 4. Use the new warning infrastructure v2: 1. unsigned -> unsigned int 2. %d -> %u 3. Add spaces around "-" 4. Update warning message 5. Only taint hv when fep is used 6. Add kconfig option --- docs/misc/xen-command-line.markdown | 8 ++++++-- xen/arch/x86/Kconfig | 17 +++++++++++++++++ xen/arch/x86/hvm/hvm.c | 12 +++++++++++- xen/common/kernel.c | 6 ++++-- xen/include/asm-x86/hvm/hvm.h | 2 +- xen/include/xen/lib.h | 1 + 6 files changed, 40 insertions(+), 6 deletions(-) diff --git a/docs/misc/xen-command-line.markdown b/docs/misc/xen-command-line.markdown index 7a271c0..045478f 100644 --- a/docs/misc/xen-command-line.markdown +++ b/docs/misc/xen-command-line.markdown @@ -886,8 +886,12 @@ Recognized in debug builds of the hypervisor only. Allow use of the Forced Emulation Prefix in HVM guests, to allow emulation of arbitrary instructions. -This option is intended for development purposes, and is only available in -debug builds of the hypervisor. +This option is intended for development and testing purposes. + +*Warning* +As this feature opens up the instruction emulator to arbitrary +instruction from an HVM guest, don't use this in production system. No +security support is provided when this flag is set. ### hvm\_port80 > `= ` diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 73f79cc..c1e9279 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -59,6 +59,23 @@ config BIGMEM If unsure, say N. +config HVM_FEP + bool "HVM Forced Emulation Prefix support" if EXPERT = "y" + default DEBUG + ---help--- + + Compiles in a feature that allows HVM guest to arbitrarily + exercise the instruction emulator. + + This feature can only be enabled during boot time with + appropriate hypervisor command line option. Please read + hypervisor command line documentation before trying to use + this feature. + + This is strictly for testing purposes, and not appropriate + for use in production. + + If unsure, say N. endmenu source "common/Kconfig" diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 5d6b921..c0f44e2 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -37,6 +37,7 @@ #include #include #include +#include #include #include #include @@ -97,9 +98,14 @@ boolean_param("hap", opt_hap_enabled); #ifndef opt_hvm_fep /* Permit use of the Forced Emulation Prefix in HVM guests */ -bool_t opt_hvm_fep; +bool_t __read_mostly opt_hvm_fep; boolean_param("hvm_fep", opt_hvm_fep); #endif +static const char __initconst warning_hvm_fep[] = + "WARNING: HVM FORCED EMULATION PREFIX IS AVAILABLE\n" + "This option is *ONLY* intended to aid testing of Xen.\n" + "It has implications on the security of the system.\n" + "Please *DO NOT* use this in production.\n"; /* Xen command-line option to enable altp2m */ static bool_t __initdata opt_altp2m_enabled = 0; @@ -182,6 +188,9 @@ static int __init hvm_enable(void) if ( !opt_altp2m_enabled ) hvm_funcs.altp2m_supported = 0; + if ( opt_hvm_fep ) + warning_add(warning_hvm_fep); + /* * Allow direct access to the PC debug ports 0x80 and 0xed (they are * often used for I/O delays, but the vmexits simply slow things down). @@ -3910,6 +3919,7 @@ void hvm_ud_intercept(struct cpu_user_regs *regs) { regs->eip += sizeof(sig); regs->eflags &= ~X86_EFLAGS_RF; + add_taint(TAINT_HVM_FEP); } } diff --git a/xen/common/kernel.c b/xen/common/kernel.c index dae7e35..5bf77aa 100644 --- a/xen/common/kernel.c +++ b/xen/common/kernel.c @@ -175,6 +175,7 @@ int __init parse_bool(const char *s) * 'M' - Machine had a machine check experience. * 'B' - System has hit bad_page. * 'C' - Console output is synchronous. + * 'H' - HVM forced emulation prefix is permitted. * * The string is overwritten by the next call to print_taint(). */ @@ -182,11 +183,12 @@ char *print_tainted(char *str) { if ( tainted ) { - snprintf(str, TAINT_STRING_MAX_LEN, "Tainted: %c%c%c%c", + snprintf(str, TAINT_STRING_MAX_LEN, "Tainted: %c%c%c%c%c", tainted & TAINT_UNSAFE_SMP ? 'S' : ' ', tainted & TAINT_MACHINE_CHECK ? 'M' : ' ', tainted & TAINT_BAD_PAGE ? 'B' : ' ', - tainted & TAINT_SYNC_CONSOLE ? 'C' : ' '); + tainted & TAINT_SYNC_CONSOLE ? 'C' : ' ', + tainted & TAINT_HVM_FEP ? 'H' : ' '); } else { diff --git a/xen/include/asm-x86/hvm/hvm.h b/xen/include/asm-x86/hvm/hvm.h index c4d04fa..314881a 100644 --- a/xen/include/asm-x86/hvm/hvm.h +++ b/xen/include/asm-x86/hvm/hvm.h @@ -27,7 +27,7 @@ #include #include -#ifndef NDEBUG +#ifdef CONFIG_HVM_FEP /* Permit use of the Forced Emulation Prefix in HVM guests */ extern bool_t opt_hvm_fep; #else diff --git a/xen/include/xen/lib.h b/xen/include/xen/lib.h index 1c652bb..b1b0fb2 100644 --- a/xen/include/xen/lib.h +++ b/xen/include/xen/lib.h @@ -142,6 +142,7 @@ uint64_t muldiv64(uint64_t a, uint32_t b, uint32_t c); #define TAINT_BAD_PAGE (1<<2) #define TAINT_SYNC_CONSOLE (1<<3) #define TAINT_ERROR_INJECT (1<<4) +#define TAINT_HVM_FEP (1<<5) extern int tainted; #define TAINT_STRING_MAX_LEN 20 extern char *print_tainted(char *str);