diff options
| author | Keir Fraser <keir@xen.org> | 2011-06-03 21:39:00 +0100 |
|---|---|---|
| committer | Keir Fraser <keir@xen.org> | 2011-06-03 21:39:00 +0100 |
| commit | a2e55460988adcd150c9d80b790f10a95a9203c7 (patch) | |
| tree | b25eb227735187b04a9567216b4ed28759372e1a /xen/arch/x86/setup.c | |
| parent | 997f96a28b192da35e3ed494df7d2d56804c79d9 (diff) | |
| download | xen-a2e55460988adcd150c9d80b790f10a95a9203c7.tar.gz xen-a2e55460988adcd150c9d80b790f10a95a9203c7.tar.bz2 xen-a2e55460988adcd150c9d80b790f10a95a9203c7.zip | |
x86: Enable Supervisor Mode Execution Protection (SMEP)
Intel new CPU supports SMEP (Supervisor Mode Execution
Protection). SMEP prevents software operating with CPL < 3 (supervisor
mode) from fetching instructions from any linear address with a valid
translation for which the U/S flag (bit 2) is 1 in every
paging-structure entry controlling the translation for the linear
address.
This patch enables SMEP in Xen to protect Xen hypervisor from
executing pv guest instructions, whose translation paging-structure
entries' U/S flags are all set.
Signed-off-by: Yang Wei <wei.y.yang@intel.com>
Signed-off-by: Shan Haitao <haitao.shan@intel.com>
Signed-off-by: Li Xin <xin.li@intel.com>
Signed-off-by: Keir Fraser <keir@xen.org>
Diffstat (limited to 'xen/arch/x86/setup.c')
| -rw-r--r-- | xen/arch/x86/setup.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index a872ae98e5..7a338d6d01 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -57,6 +57,10 @@ integer_param("maxcpus", max_cpus); static bool_t __initdata opt_watchdog; boolean_param("watchdog", opt_watchdog); +/* smep: Enable/disable Supervisor Mode Execution Protection (default on). */ +static bool_t __initdata disable_smep; +invbool_param("smep", disable_smep); + /* **** Linux config option: propagated to domain0. */ /* "acpi=off": Sisables both ACPI table parsing and interpreter. */ /* "acpi=force": Override the disable blacklist. */ @@ -1200,11 +1204,17 @@ void __init __start_xen(unsigned long mbi_p) arch_init_memory(); identify_cpu(&boot_cpu_data); + if ( cpu_has_fxsr ) set_in_cr4(X86_CR4_OSFXSR); if ( cpu_has_xmm ) set_in_cr4(X86_CR4_OSXMMEXCPT); + if ( disable_smep ) + setup_clear_cpu_cap(X86_FEATURE_SMEP); + if ( cpu_has_smep ) + set_in_cr4(X86_CR4_SMEP); + local_irq_enable(); #ifdef CONFIG_X86_64 |