[PATCH] xen: enable/disable SMAP/SMEP for Xen itself

[He Chen <he.chen@linux.intel.com>]

SMAP/SMEP may affect the 32-bit pv guests.
Users can determine whether turn SMAP/SMEP on for Xen hyperviosr when
running 32-bit pv guests.

Signed-off-by: He Chen <he.chen@linux.intel.com>
---
 docs/misc/xen-command-line.markdown | 14 ++++++++++++++
 xen/arch/x86/setup.c                | 12 ++++++++++--
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/docs/misc/xen-command-line.markdown b/docs/misc/xen-command-line.markdown
index 3a250cb..a48c4aa 100644
--- a/docs/misc/xen-command-line.markdown
+++ b/docs/misc/xen-command-line.markdown
@@ -1434,6 +1434,13 @@ Set the serial transmit buffer size.
 
 Flag to enable Supervisor Mode Execution Protection
 
+### xen_smep
+> `= <boolean>`
+
+> Default: `true`
+
+Flag to enable SMEP for Xen itself
+
 ### smap
 > `= <boolean>`
 
@@ -1441,6 +1448,13 @@ Flag to enable Supervisor Mode Execution Protection
 
 Flag to enable Supervisor Mode Access Prevention
 
+### xen_smap
+> `= <boolean>`
+
+> Default: `true`
+
+Flag to enable SMAP for Xen itself
+
 ### snb\_igd\_quirk
 > `= <boolean> | cap | <integer>`
 
diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
index 217c775..84debc3 100644
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -65,10 +65,18 @@ integer_param("maxcpus", max_cpus);
 static bool_t __initdata opt_smep = 1;
 boolean_param("smep", opt_smep);
 
+/* xen_smep: Enable/disable SMEP for Xen itself (default on). */
+static bool_t __initdata opt_xen_smep = 1;
+boolean_param("xen_smep", opt_xen_smep);
+
 /* smap: Enable/disable Supervisor Mode Access Prevention (default on). */
 static bool_t __initdata opt_smap = 1;
 boolean_param("smap", opt_smap);
 
+/* xen_smap: Enable/disable SMAP for Xen itself (default on). */
+static bool_t __initdata opt_xen_smap = 1;
+boolean_param("xen_smap", opt_xen_smap);
+
 unsigned long __read_mostly cr4_pv32_mask;
 
 /* Boot dom0 in pvh mode */
@@ -1403,12 +1411,12 @@ void __init noreturn __start_xen(unsigned long mbi_p)
 
     if ( !opt_smep )
         setup_clear_cpu_cap(X86_FEATURE_SMEP);
-    if ( cpu_has_smep )
+    if ( cpu_has_smep && opt_xen_smep )
         set_in_cr4(X86_CR4_SMEP);
 
     if ( !opt_smap )
         setup_clear_cpu_cap(X86_FEATURE_SMAP);
-    if ( cpu_has_smap )
+    if ( cpu_has_smap && opt_xen_smap )
         set_in_cr4(X86_CR4_SMAP);
 
     cr4_pv32_mask = mmu_cr4_features & XEN_CR4_PV32_BITS;
-- 
1.9.1


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel