[Xen-changelog] [xen master] x86/vmx: Add force-ept command line option

[patchbot@xxxxxxx]

commit 2fff2e22813d5c04effa335f9ab2d5254db065f6
Author:     Aravindh Puthiyaparambil <aravindp@xxxxxxxxx>
AuthorDate: Thu Apr 24 10:55:09 2014 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Apr 24 10:55:09 2014 +0200

    x86/vmx: Add force-ept command line option
    
    Add a "force-ept" command line option to allow EPT to be enabled when
    VMX feature VM_ENTRY_LOAD_GUEST_PAT is not present.
    
    Due to CVE-2013-2212, this feature is required by default as a
    prerequisite for using EPT. If you are not using PCI Passthrough, or
    trust the guest administrator who would be using passthrough, then the
    requirement can be relaxed. This option is particularly useful for
    nested virtualization, to allow the L1 hypervisor to use EPT even if
    the L0 hypervisor does not provide VM_ENTRY_LOAD_GUEST_PAT.
    
    Signed-off-by: Aravindh Puthiyaparambil <aravindp@xxxxxxxxx>
    Acked-by: Kevin Tian <kevin.tian@xxxxxxxxx>
---
 docs/misc/xen-command-line.markdown |   16 ++++++++++++++++
 xen/arch/x86/hvm/vmx/vmx.c          |    5 ++++-
 2 files changed, 20 insertions(+), 1 deletions(-)

diff --git a/docs/misc/xen-command-line.markdown 
b/docs/misc/xen-command-line.markdown
index e8d23b4..cf4c16e 100644
--- a/docs/misc/xen-command-line.markdown
+++ b/docs/misc/xen-command-line.markdown
@@ -545,6 +545,22 @@ versa.  For example to change dom0 without changing domU, 
use
 
 Specify the font size when using the VESA console driver.
 
+### force-ept (Intel)
+> `= <boolean>`
+
+> Default: `false`
+
+Allow EPT to be enabled when VMX feature VM\_ENTRY\_LOAD\_GUEST\_PAT is not
+present.
+
+*Warning:*
+Due to CVE-2013-2212, VMX feature VM\_ENTRY\_LOAD\_GUEST\_PAT is by default
+required as a prerequisite for using EPT.  If you are not using PCI 
Passthrough,
+or trust the guest administrator who would be using passthrough, then the
+requirement can be relaxed.  This option is particularly useful for nested
+virtualization, to allow the L1 hypervisor to use EPT even if the L0 hypervisor
+does not provide VM\_ENTRY\_LOAD\_GUEST\_PAT.
+
 ### gdb
 > `= <baud>[/<clock_hz>][,DPS[,<io-base>[,<irq>[,<port-bdf>[,<bridge-bdf>]]]] 
 > | pci | amt ] `
 
diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index 104e6e4..4a083d5 100644
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -58,6 +58,9 @@
 #include <asm/hvm/nestedhvm.h>
 #include <asm/event.h>
 
+static bool_t __initdata opt_force_ept;
+boolean_param("force-ept", opt_force_ept);
+
 enum handler_return { HNDL_done, HNDL_unhandled, HNDL_exception_raised };
 
 static void vmx_ctxt_switch_from(struct vcpu *v);
@@ -1725,7 +1728,7 @@ const struct hvm_function_table * __init start_vmx(void)
      * Do not enable EPT when (!cpu_has_vmx_pat), to prevent security hole
      * (refer to http://xenbits.xen.org/xsa/advisory-60.html).
      */
-    if ( cpu_has_vmx_ept && cpu_has_vmx_pat )
+    if ( cpu_has_vmx_ept && (cpu_has_vmx_pat || opt_force_ept) )
     {
         vmx_function_table.hap_supported = 1;
 
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog