[PATCH v3] x86/vmx: Add force-ept command line option

[PATCH v3] x86/vmx: Add force-ept command line option

[Aravindh Puthiyaparambil]

Add a "force-ept" command line option to allow EPT to be enabled when
VMX feature VM_ENTRY_LOAD_GUEST_PAT is not present.

Due to CVE-2013-2212, this feature is required by default as a
prerequisite for using EPT. If you are not using PCI Passthrough, or
trust the guest administrator who would be using passthrough, then the
requirement can be relaxed. This option is useful for nested
virtualisation cases where the outer hypervisor does not expose the
VMX feature VM_ENTRY_LOAD_GUEST_PAT to Xen.

Signed-off-by: Aravindh Puthiyaparambil <aravindp@cisco.com>
Cc: Jun Nakajima <jun.nakajima@intel.com>
Cc: Eddie Dong <eddie.dong@intel.com>
Cc: Kevin Tian <kevin.tian@intel.com>

---
Changes from version 2:
1. Update commit and documentation description.
2. Rename command line option to "force-ept"

Changes from version 1:
1. Fix and update documentation with suggestion from Andrew Cooper.
2. Remove redundant assignment.
---
 docs/misc/xen-command-line.markdown | 16 ++++++++++++++++
 xen/arch/x86/hvm/vmx/vmx.c          |  5 ++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/docs/misc/xen-command-line.markdown b/docs/misc/xen-command-line.markdown
index 87de2dc..6587069 100644
--- a/docs/misc/xen-command-line.markdown
+++ b/docs/misc/xen-command-line.markdown
@@ -545,6 +545,22 @@ versa.  For example to change dom0 without changing domU, use
 
 Specify the font size when using the VESA console driver.
 
+### force-ept (Intel)
+> `= <boolean>`
+
+> Default: `false`
+
+Allow EPT to be enabled when VMX feature VM\_ENTRY\_LOAD\_GUEST\_PAT is not
+present.
+
+*Warning:*
+Due to CVE-2013-2212, VMX feature VM\_ENTRY\_LOAD\_GUEST\_PAT is by default
+required as a prerequisite for using EPT.  If you are not using PCI Passthrough,
+or trust the guest administrator who would be using passthrough, then the
+requirement can be relaxed.  This option is useful for nested virtualisation
+cases where the outer hypervisor does not expose the VMX feature
+VM\_ENTRY\_LOAD\_GUEST\_PAT to Xen.
+
 ### gdb
 > `= <baud>[/<clock_hz>][,DPS[,<io-base>[,<irq>[,<port-bdf>[,<bridge-bdf>]]]] | pci | amt ] `
 
diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index 180cf6c..4b3c899 100644
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -58,6 +58,9 @@
 #include <asm/hvm/nestedhvm.h>
 #include <asm/event.h>
 
+static bool_t __initdata opt_force_ept;
+boolean_param("force-ept", opt_force_ept);
+
 enum handler_return { HNDL_done, HNDL_unhandled, HNDL_exception_raised };
 
 static void vmx_ctxt_switch_from(struct vcpu *v);
@@ -1724,7 +1727,7 @@ const struct hvm_function_table * __init start_vmx(void)
      * Do not enable EPT when (!cpu_has_vmx_pat), to prevent security hole
      * (refer to http://xenbits.xen.org/xsa/advisory-60.html).
      */
-    if ( cpu_has_vmx_ept && cpu_has_vmx_pat )
+    if ( cpu_has_vmx_ept && (cpu_has_vmx_pat || opt_force_ept) )
     {
         vmx_function_table.hap_supported = 1;
 
-- 
1.8.3.2

Re: [PATCH v3] x86/vmx: Add force-ept command line option

[George Dunlap]

On Thu, Apr 17, 2014 at 8:16 PM, Aravindh Puthiyaparambil
<aravindp@cisco.com> wrote:
> Add a "force-ept" command line option to allow EPT to be enabled when
> VMX feature VM_ENTRY_LOAD_GUEST_PAT is not present.
>
> Due to CVE-2013-2212, this feature is required by default as a
> prerequisite for using EPT. If you are not using PCI Passthrough, or
> trust the guest administrator who would be using passthrough, then the
> requirement can be relaxed. This option is useful for nested
> virtualisation cases where the outer hypervisor does not expose the
> VMX feature VM_ENTRY_LOAD_GUEST_PAT to Xen.
>
> Signed-off-by: Aravindh Puthiyaparambil <aravindp@cisco.com>
> Cc: Jun Nakajima <jun.nakajima@intel.com>
> Cc: Eddie Dong <eddie.dong@intel.com>
> Cc: Kevin Tian <kevin.tian@intel.com>
>
> ---
> Changes from version 2:
> 1. Update commit and documentation description.
> 2. Rename command line option to "force-ept"
>
> Changes from version 1:
> 1. Fix and update documentation with suggestion from Andrew Cooper.
> 2. Remove redundant assignment.
> ---
>  docs/misc/xen-command-line.markdown | 16 ++++++++++++++++
>  xen/arch/x86/hvm/vmx/vmx.c          |  5 ++++-
>  2 files changed, 20 insertions(+), 1 deletion(-)
>
> diff --git a/docs/misc/xen-command-line.markdown b/docs/misc/xen-command-line.markdown
> index 87de2dc..6587069 100644
> --- a/docs/misc/xen-command-line.markdown
> +++ b/docs/misc/xen-command-line.markdown
> @@ -545,6 +545,22 @@ versa.  For example to change dom0 without changing domU, use
>
>  Specify the font size when using the VESA console driver.
>
> +### force-ept (Intel)
> +> `= <boolean>`
> +
> +> Default: `false`
> +
> +Allow EPT to be enabled when VMX feature VM\_ENTRY\_LOAD\_GUEST\_PAT is not
> +present.
> +
> +*Warning:*
> +Due to CVE-2013-2212, VMX feature VM\_ENTRY\_LOAD\_GUEST\_PAT is by default
> +required as a prerequisite for using EPT.  If you are not using PCI Passthrough,
> +or trust the guest administrator who would be using passthrough, then the
> +requirement can be relaxed.  This option is useful for nested virtualisation
> +cases where the outer hypervisor does not expose the VMX feature
> +VM\_ENTRY\_LOAD\_GUEST\_PAT to Xen.

Perhaps something like the following? "This option is particularly
useful for nested virtualization, to allow the L1 hypervisor to use
EPT even if the L0 hypervisor does not provide
VM\_ENTRY\_LOAD\_GUEST\_PAT."

I'm not sure "force-ept" is quite descriptive enough; it seems like it
would be better to mention the specific thing you're ignoring.
"ept-unsafe-pat" perhaps?

 -George

Re: [PATCH v3] x86/vmx: Add force-ept command line option

[Jan Beulich]

>>> On 22.04.14 at 11:53, <George.Dunlap@eu.citrix.com> wrote:
> I'm not sure "force-ept" is quite descriptive enough; it seems like it
> would be better to mention the specific thing you're ignoring.
> "ept-unsafe-pat" perhaps?

While I suggested the current name, I'm not too happy with it either.
Otoh the way it is it would be more obviously leveragable for eventual
further overrides.

Jan

Re: [PATCH v3] x86/vmx: Add force-ept command line option

[Aravindh Puthiyaparambil (aravindp)]

>> I'm not sure "force-ept" is quite descriptive enough; it seems like it
>> would be better to mention the specific thing you're ignoring.
>> "ept-unsafe-pat" perhaps?
>
>While I suggested the current name, I'm not too happy with it either.
>Otoh the way it is it would be more obviously leveragable for eventual further
>overrides.

I will leave the name as it is and resubmit with the documentation update that George requested.

Thanks,
Aravindh