From nobody Mon Nov 25 06:55:17 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass header.i=@amazon.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=quarantine dis=none) header.from=amazon.com ARC-Seal: i=1; a=rsa-sha256; t=1715598732; cv=none; d=zohomail.com; s=zohoarc; b=H0da7ftPzMgg0oOPj3WPXuUEw8dq9Y35rLGf5/aPQy5E0sg00ymYjjPSXoAinMHaLkFpeDrIuFWBBeROpa9G/vvO22oF3yHkHJ4PCZFsyYg9yPH4Fj8GXDcQ3JGjaPLFUx7mixT8iyP78EUf2FjTGQwR/F2z5EDQBqTtTXSdYuE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1715598732; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=YiMscZoqlqA2XJ1v3gO3e8DXR6HvvHTgLBqJAfmepmI=; b=W1gpnoJqxBOzcwiC0T5js3CcJ4aVDbwwLrZYN+aa4OGNVDswfOyhxN+EYvRkTNZaY3kLSL5e7QZWZSMwf9ku/hRv1nVIiUfSo7L08QGk6u1Vgh0tpOFlpeqIVy1thnoLmDp9UxLb89QZpoKTnxtuLHm+Nzz0h3Oq2MgWeQfJf3k= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=@amazon.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1715598732855458.62779967588153; Mon, 13 May 2024 04:12:12 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.720809.1123771 (Exim 4.92) (envelope-from ) id 1s6Taz-0004YI-Ob; Mon, 13 May 2024 11:11:53 +0000 Received: by outflank-mailman (output) from mailman id 720809.1123771; Mon, 13 May 2024 11:11:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1s6Taz-0004Y3-LI; Mon, 13 May 2024 11:11:53 +0000 Received: by outflank-mailman (input) for mailman id 720809; Mon, 13 May 2024 11:11:52 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1s6Tay-00036L-Jf for xen-devel@lists.xenproject.org; Mon, 13 May 2024 11:11:52 +0000 Received: from smtp-fw-80006.amazon.com (smtp-fw-80006.amazon.com [99.78.197.217]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id 97a85db1-1119-11ef-b4bb-af5377834399; Mon, 13 May 2024 13:11:50 +0200 (CEST) Received: from pdx4-co-svc-p1-lb2-vlan3.amazon.com (HELO smtpout.prod.us-east-1.prod.farcaster.email.amazon.dev) ([10.25.36.214]) by smtp-border-fw-80006.pdx80.corp.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 13 May 2024 11:11:44 +0000 Received: from EX19MTAUEC001.ant.amazon.com [10.0.0.204:34895] by smtpin.naws.us-east-1.prod.farcaster.email.amazon.dev [10.0.20.152:2525] with esmtp (Farcaster) id 40ab5167-bece-4296-856c-e215ecf97d24; Mon, 13 May 2024 11:11:43 +0000 (UTC) Received: from EX19D008UEC003.ant.amazon.com (10.252.135.194) by EX19MTAUEC001.ant.amazon.com (10.252.135.222) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.28; Mon, 13 May 2024 11:11:40 +0000 Received: from EX19MTAUWB001.ant.amazon.com (10.250.64.248) by EX19D008UEC003.ant.amazon.com (10.252.135.194) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.28; Mon, 13 May 2024 11:11:40 +0000 Received: from dev-dsk-eliasely-1a-fd74790f.eu-west-1.amazon.com (10.253.91.118) by mail-relay.amazon.com (10.250.64.254) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.28 via Frontend Transport; Mon, 13 May 2024 11:11:39 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 97a85db1-1119-11ef-b4bb-af5377834399 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1715598711; x=1747134711; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=YiMscZoqlqA2XJ1v3gO3e8DXR6HvvHTgLBqJAfmepmI=; b=qVbWoC8u00vno4vtdVdhIe0vQsEqzRskkIkDSL+Ee7y37BHFVAndT+k/ Os0HWQfRfGp0jWo/OV3WT03jsF6Uc0e58j+ibnY2RXJpOJJUrfDCrOMdf 1hrWUp7VE1qub3RVSXzWloD+AqsUhTws6ZlPFHgm3eLz8qhR8uEhSpoUs 8=; X-IronPort-AV: E=Sophos;i="6.08,158,1712620800"; d="scan'208";a="294662337" X-Farcaster-Flow-ID: 40ab5167-bece-4296-856c-e215ecf97d24 From: Elias El Yandouzi To: CC: , , , Hongyan Xia , Julien Grall , Elias El Yandouzi Subject: [PATCH V3 06/19] x86: Add a boot option to enable and disable the direct map Date: Mon, 13 May 2024 11:11:04 +0000 Message-ID: <20240513111117.68828-7-eliasely@amazon.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20240513111117.68828-1-eliasely@amazon.com> References: <20240513111117.68828-1-eliasely@amazon.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @amazon.com) X-ZM-MESSAGEID: 1715598733934100001 Content-Type: text/plain; charset="utf-8" From: Hongyan Xia Also add a helper function to retrieve it. Change arch_mfns_in_direct_map to check this option before returning. This is added as a Kconfig option as well as a boot command line option. While being generic, the Kconfig option is only usable for x86 at the momen= t. Note that there remains some users of the directmap at this point. The opti= on is introduced now as it will be needed in follow-up patches. Signed-off-by: Hongyan Xia Signed-off-by: Julien Grall Signed-off-by: Elias El Yandouzi ---- Changes in V2: * Introduce a Kconfig option * Reword the commit message * Make opt_directmap and helper generic Changes since Hongyan's version: * Reword the commit message * opt_directmap is only modified during boot so mark it as __ro_after_init diff --git a/docs/misc/xen-command-line.pandoc b/docs/misc/xen-command-line= .pandoc index e760f3266e..743d343ffa 100644 --- a/docs/misc/xen-command-line.pandoc +++ b/docs/misc/xen-command-line.pandoc @@ -799,6 +799,18 @@ that enabling this option cannot guarantee anything be= yond what underlying hardware guarantees (with, where available and known to Xen, respective tweaks applied). =20 +### directmap (x86) +> `=3D ` + +> Default: `true` + +Enable or disable the directmap region in Xen. + +By default, Xen creates the directmap region which maps physical memory +in that region. Setting this to no will sparsely populate the directmap, +blocking exploits that leak secrets via speculative memory access in the +directmap. + ### dma_bits > `=3D ` =20 diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 7e03e4bc55..b4ec0e582e 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -28,6 +28,7 @@ config X86 select HAS_PCI_MSI select HAS_PIRQ select HAS_SCHED_GRANULARITY + select HAS_SECRET_HIDING select HAS_UBSAN select HAS_VPCI if HVM select NEEDS_LIBELF diff --git a/xen/arch/x86/include/asm/mm.h b/xen/arch/x86/include/asm/mm.h index 98b66edaca..54d835f156 100644 --- a/xen/arch/x86/include/asm/mm.h +++ b/xen/arch/x86/include/asm/mm.h @@ -622,11 +622,17 @@ void write_32bit_pse_identmap(uint32_t *l2); /* * x86 maps part of physical memory via the directmap region. * Return whether the range of MFN falls in the directmap region. + * + * When boot command line sets directmap=3Dno, the directmap will mostly b= e empty + * so this will always return false. */ static inline bool arch_mfns_in_directmap(unsigned long mfn, unsigned long= nr) { unsigned long eva =3D min(DIRECTMAP_VIRT_END, HYPERVISOR_VIRT_END); =20 + if ( !has_directmap() ) + return false; + return (mfn + nr) <=3D (virt_to_mfn(eva - 1) + 1); } =20 diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index f84e1cd79c..bd6b1184f5 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -1517,6 +1517,8 @@ void asmlinkage __init noreturn __start_xen(unsigned = long mbi_p) if ( highmem_start ) xenheap_max_mfn(PFN_DOWN(highmem_start - 1)); =20 + printk("Booting with directmap %s\n", has_directmap() ? "on" : "off"); + /* * Walk every RAM region and map it in its entirety (on x86/64, at lea= st) * and notify it to the boot allocator. diff --git a/xen/common/Kconfig b/xen/common/Kconfig index 565ceda741..856604068c 100644 --- a/xen/common/Kconfig +++ b/xen/common/Kconfig @@ -80,12 +80,29 @@ config HAS_PMAP config HAS_SCHED_GRANULARITY bool =20 +config HAS_SECRET_HIDING + bool + config HAS_UBSAN bool =20 config MEM_ACCESS_ALWAYS_ON bool =20 +config SECRET_HIDING + bool "Secret hiding" + depends on HAS_SECRET_HIDING + help + The directmap contains mapping for most of the RAM which makes domain + memory easily accessible. While making the performance better, it also m= akes + the hypervisor more vulnerable to speculation attacks. + + Enabling this feature will allow the user to decide whether the memory + is always mapped at boot or mapped only on demand (see the command line + option "directmap"). + + If unsure, say N. + config MEM_ACCESS def_bool MEM_ACCESS_ALWAYS_ON prompt "Memory Access and VM events" if !MEM_ACCESS_ALWAYS_ON diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c index 7c1bdfc046..9b7e4721cd 100644 --- a/xen/common/page_alloc.c +++ b/xen/common/page_alloc.c @@ -174,6 +174,11 @@ paddr_t __ro_after_init mem_hotplug; static char __initdata opt_badpage[100] =3D ""; string_param("badpage", opt_badpage); =20 +bool __ro_after_init opt_directmap =3D true; +#ifdef CONFIG_HAS_SECRET_HIDING +boolean_param("directmap", opt_directmap); +#endif + /* * no-bootscrub -> Free pages are not zeroed during boot. */ diff --git a/xen/include/xen/mm.h b/xen/include/xen/mm.h index 7561297a75..9d4f1f2d0d 100644 --- a/xen/include/xen/mm.h +++ b/xen/include/xen/mm.h @@ -167,6 +167,13 @@ extern unsigned long max_page; extern unsigned long total_pages; extern paddr_t mem_hotplug; =20 +extern bool opt_directmap; + +static inline bool has_directmap(void) +{ + return opt_directmap; +} + /* * Extra fault info types which are used to further describe * the source of an access violation. --=20 2.40.1