xen-project/xen
1
0 Fork 0
mirror of https://github.com/xen-project/xen.git synced 2026-10-28 02:01:24 +01:00
Code Issues Activity
Files
31fb44f8c02019f3a44e7ef6df0fbe0f2bce2ca3
xen/xen/common/Kconfig
T
Oleksii Kurochko 31fb44f8c0 xen: introduce CONFIG_HAS_SHARED_INFO for archs without a shared page 
On architectures that run guests in dom0less mode without the PV ABI
(currently RISC-V), no shared_info page is allocated and d->shared_info
remains NULL throughout the domain lifetime.  Several places in common
code access d->shared_info through the shared_info() macro or directly,
causing UBSAN null-pointer errors on such architectures.

Rather than adding runtime NULL guards that are logically unreachable
on x86 and Arm (where shared_info is always allocated), introduce a new
Kconfig symbol CONFIG_HAS_SHARED_INFO selected by x86 and Arm.

On !HAS_SHARED_INFO the shared_info() macro expands to a dereference
of shared_info_absent, an extern pointer that is declared but
intentionally never defined.  Any use of shared_info() that is not
dead-code-eliminated will therefore cause a link-time failure, making
missed guards impossible to overlook.

The 2L event-channel ops call shared_info() and must not be compiled on
architectures without a shared_info page, so event_2l.o is gated on
CONFIG_HAS_SHARED_INFO.  On such architectures evtchn_init() installs the
FIFO ops as a placeholder instead, so that a later guest opt-in to the
FIFO ABI via EVTCHNOP_init_control has no special-casing to do; if FIFO
support itself is also unavailable (!CONFIG_EVTCHN_FIFO), a dedicated
no-op evtchn_port_ops_none table is installed instead, so that
d->evtchn_port_ops is never NULL.  evtchn_fifo_word_from_port() is
guarded against uninitialised d->evtchn_fifo so the FIFO ops are safe
before evtchn_fifo_init_control() is called by the guest.

With CONFIG_HAS_SHARED_INFO=n all vCPUs fall back to the global
dummy_vcpu_info, so writes through vcpu_info() could leak data between
vCPUs. Reviewing the write paths in common code: the write in
map_guest_area() stores the constant ~0 so nothing serious would happen
if it were leaked; the event_2l.c paths are not compiled on
!HAS_SHARED_INFO, as event_2l.o is gated on CONFIG_HAS_SHARED_INFO; the
write in vcpu_info_populate() targets the new mapping buffer, not
dummy_vcpu_info.

Outside common code, the remaining writes are x86 PV-specific, for which
CONFIG_HAS_SHARED_INFO=y. No code changes are needed.

Finally, struct domain's shared_info field itself is gated on
CONFIG_HAS_SHARED_INFO, as it would otherwise be a permanently NULL
pointer: every user of it is either arch code for an architecture that
selects HAS_SHARED_INFO, or common code already guarded by the same
Kconfig symbol.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Michal Orzel <michal.orzel@amd.com> #Arm
2026-09-21 10:05:20 +02:00

679 lines
19 KiB
Plaintext
Raw Blame History

menu "Common Features"
config COMPAT
bool
help
32-bit interface support on 64-bit Xen which is used for both
HVM and PV guests. HVMLoader makes 32-bit hypercalls irrespective
of the destination runmode of the guest.
config CORE_PARKING
bool
depends on NR_CPUS > 1
config DEVICE_TREE_PARSE
bool
select LIBFDT
config DOM0LESS_BOOT
bool "Dom0less boot support" if EXPERT
depends on HAS_DOM0LESS && DOMAIN_BUILD_HELPERS
select DEVICE_TREE_PARSE
default y
help
Dom0less boot support enables Xen to create and start domU guests during
Xen boot without the need of a control domain (Dom0), which could be
present anyway.
config DOMAIN_BUILD_HELPERS
bool
config GRANT_TABLE
bool "Grant table support" if EXPERT
default y
help
Grant table provides a generic mechanism to memory sharing
between domains. This shared memory interface underpins the
split device drivers for block and network IO in a classic
Xen setup.
If unsure, say Y.
config HAS_GRANT_CACHE_FLUSH
bool
config EVTCHN_FIFO
bool "Event Channel Fifo support" if EXPERT
default y
help
The Event channel Fifo extends support for event channels
beyond 1024 event channels for 32-bit guests and 4096 for
64-bit guests.
Cons: They cause runtime anonymous memory allocations and expose
an additional interface to the guest. For smaller systems, you
might consider disabling this feature.
If unsure, say Y.
choice
prompt "PDX (Page inDeX) compression"
default PDX_OFFSET_COMPRESSION if X86
default PDX_MASK_COMPRESSION if !RISCV
default PDX_NONE
help
PDX compression is a technique designed to reduce the memory
overhead of physical memory management on platforms with sparse RAM
banks.
If your platform does have sparse RAM banks, enabling PDX
compression may reduce the memory overhead of Xen, but does carry a
runtime performance cost.
If your platform does not have sparse RAM banks, do not enable PDX
compression.
config PDX_MASK_COMPRESSION
bool "Mask compression"
help
Compression relying on all RAM addresses sharing a zeroed bit region.
config PDX_OFFSET_COMPRESSION
bool "Offset compression"
help
Compression relying on size and distance between RAM regions being
compressible using an offset lookup table.
config PDX_NONE
bool "None"
help
No compression
endchoice
config PDX_OFFSET_TBL_ORDER
int "PDX offset compression lookup table order" if EXPERT
depends on PDX_OFFSET_COMPRESSION
default 6
range 0 9
help
Order of the PFN to PDX and PDX to PFN translation lookup tables.
Number of table entries is calculated as 2^N.
Size of the tables can be adjusted from 1 entry (order 0) to 512
entries (order 9).
config ALTERNATIVE_CALL
bool
config ARCH_MAP_DOMAIN_PAGE
bool
config ARCH_PAGING_MEMPOOL
bool
config GENERIC_BUG_FRAME
bool
config HAS_ALTERNATIVE
bool
config HAS_COMPAT
bool
config HAS_DEVICE_TREE_DISCOVERY
bool
select DEVICE_TREE_PARSE
config HAS_DOM0LESS
bool
config HAS_DOMAIN_TYPE
bool
config HAS_DIT # Data Independent Timing
bool
config HAS_EX_TABLE
bool
config HAS_FAST_MULTIPLY
bool
config HAS_IOPORTS
bool
config HAS_KEXEC
bool
config HAS_LLC_COLORING
bool
config HAS_PIRQ
bool
config HAS_PMAP
bool
config HAS_SCHED_GRANULARITY
bool
config HAS_SHARED_INFO
bool
config HAS_STATIC_MEMORY
bool
config HAS_SOFT_RESET
bool
config HAS_STACK_PROTECTOR
bool
config HAS_SYSTEM_SUSPEND
bool
config HAS_UBSAN
bool
config HAS_VMAP
bool
config LIBFDT
bool
config VM_EVENT
bool "Memory Access and VM events"
depends on HVM
default X86
help
Framework to configure memory access types for guests and receive
related events in userspace.
config NEEDS_LIBELF
bool
config NUMA
bool
config STATIC_MEMORY
bool "Static Allocation Support (UNSUPPORTED)" if UNSUPPORTED
depends on HAS_STATIC_MEMORY
depends on DOM0LESS_BOOT && HAS_DEVICE_TREE_DISCOVERY
help
Static Allocation refers to system or sub-system(domains) for
which memory areas are pre-defined by configuration using physical
address ranges.
When enabled, memory can be statically allocated to a domain using
the property "xen,static-mem" defined in the domain configuration.
If unsure, say N.
config STATIC_SHM
bool "Statically shared memory on a dom0less system" if UNSUPPORTED
depends on STATIC_MEMORY
help
This option enables statically shared memory on a dom0less system.
config STATIC_EVTCHN
bool "Static event channel support on a dom0less system"
depends on DOM0LESS_BOOT
default y
help
This option enables establishing static event channel communication
between domains on a dom0less system (domU-domU as well as domU-dom0).
menu "Speculative hardening"
config INDIRECT_THUNK
bool "Out-of-line Indirect Call/Jumps"
depends on CC_HAS_INDIRECT_THUNK
default y
help
Compile Xen with out-of-line indirect call and jumps.
This allows Xen to mitigate a variety of speculative vulnerabilities
by choosing a hardware-dependent instruction sequence to implement
(e.g. function pointers) safely. "Retpoline" is one such sequence.
config RETURN_THUNK
bool "Out-of-line Returns"
depends on CC_HAS_RETURN_THUNK
default INDIRECT_THUNK
help
Compile Xen with out-of-line returns.
This allows Xen to mitigate a variety of speculative vulnerabilities
by choosing a hardware-dependent instruction sequence to implement
function returns safely.
config SPECULATIVE_HARDEN_ARRAY
bool "Speculative Array Hardening"
default y
help
Compile Xen with extra hardening for some array accesses.
When enabled, specific array accesses which have been deemed liable
to be speculatively abused will be hardened to avoid out-of-bounds
accesses.
This is a best-effort mitigation. There are no guarantees that all
areas of code open to abuse have been hardened.
config SPECULATIVE_HARDEN_BRANCH
bool "Speculative Conditional Branch Hardening"
default y
depends on X86
help
Compile Xen with extra hardening for some conditional branches.
When enabled, specific conditions which have been deemed liable to
be speculatively abused will be hardened to avoid entering the wrong
basic block.
This is a best-effort mitigation. There are no guarantees that all
areas of code open to abuse have been hardened, nor that
optimisations in the compiler haven't subverted the attempts to
harden.
config SPECULATIVE_HARDEN_GUEST_ACCESS
bool "Speculative PV Guest Memory Access Hardening"
default y
depends on PV
help
Compile Xen with extra hardening for PV guest memory access.
When enabled, code paths accessing PV guest memory will have guest
controlled addresses massaged such that memory accesses through them
won't touch hypervisor address space.
config SPECULATIVE_HARDEN_LOCK
bool "Speculative lock context hardening"
default y
depends on X86
help
Compile Xen with extra hardening for locked regions.
This option is disabled by default at run time, and needs to be
enabled on the command line.
endmenu
menu "Other hardening"
config STACK_PROTECTOR
bool "Stack protector"
depends on HAS_STACK_PROTECTOR
help
Enable the Stack Protector compiler hardening option. This inserts a
canary value in the stack frame of functions, and performs an integrity
check on function exit.
endmenu
config DIT_DEFAULT
bool "Data Independent Timing default"
depends on HAS_DIT
help
Hardware often surfaces instructions the timing of which is dependent
on the data they process. Some of these instructions may be used in
timing sensitive environments, e.g. cryptography. When such
instructions exist, hardware may further surface a control allowing
to make the behavior of such instructions independent of the data
they act upon. Note the build time value can be overridden at runtime
using the "dit" command line option.
NB: Intel calls the feature DOITM (Data Operand Independent Timing
Mode).
config HYPFS
bool "Hypervisor file system support"
default y
help
Support Xen hypervisor file system. This file system is used to
present various hypervisor internal data to dom0 and in some
cases to allow modifying settings. Disabling the support will
result in some features not being available, e.g. runtime parameter
setting.
If unsure, say Y.
config HYPFS_CONFIG
bool "Provide hypervisor .config via hypfs entry"
default y
depends on HYPFS
help
When enabled the contents of the .config file used to build the
hypervisor are provided via the hypfs entry /buildinfo/config.
Disable this option in case you want to spare some memory or you
want to hide the .config contents from dom0.
config IOREQ_SERVER
bool "IOREQ support (EXPERT)" if EXPERT && !X86
default X86
depends on HVM
help
Enables generic mechanism for providing emulated devices to the guests.
If unsure, say N.
config KEXEC
bool "kexec support"
default y
depends on HAS_KEXEC
help
Allows a running Xen hypervisor to be replaced with another OS
without rebooting. This is primarily used to execute a crash
environment to collect information on a Xen hypervisor or dom0 crash.
If unsure, say Y.
config EFI_SET_VIRTUAL_ADDRESS_MAP
bool "EFI: call SetVirtualAddressMap()" if EXPERT
default y
help
Call EFI SetVirtualAddressMap() runtime service to setup memory map for
further runtime services. According to UEFI spec, it isn't strictly
necessary, but many UEFI implementations misbehave when this call is
missing.
config XSM
bool "Xen Security Modules support"
default ARM
help
Enables the security framework known as Xen Security Modules which
allows administrators fine-grained control over a Xen domain and
its capabilities by defining permissible interactions between domains,
the hypervisor itself, and related resources such as memory and
devices.
If unsure, say N.
config XSM_FLASK
def_bool y
prompt "FLux Advanced Security Kernel support"
depends on XSM
help
Enables FLASK (FLux Advanced Security Kernel) as the access control
mechanism used by the XSM framework. This provides a mandatory access
control framework by which security enforcement, isolation, and
auditing can be achieved with fine granular control via a security
policy.
If unsure, say Y.
config XSM_FLASK_AVC_STATS
def_bool y
prompt "Maintain statistics on the FLASK access vector cache" if EXPERT
depends on XSM_FLASK
help
Maintain counters on the access vector cache that can be viewed using
the FLASK_AVC_CACHESTATS sub-op of the xsm_op hypercall. Disabling
this will save a tiny amount of memory and time to update the stats.
If unsure, say Y.
config XSM_FLASK_POLICY
bool "Compile Xen with a built-in FLASK security policy"
default y if "$(XEN_HAS_CHECKPOLICY)" = "y"
depends on XSM_FLASK
help
This includes a default XSM policy in the hypervisor so that the
bootloader does not need to load a policy to get sane behavior from an
XSM-enabled hypervisor. If this is disabled, a policy must be
provided by the bootloader or by Domain 0. Even if this is enabled, a
policy provided by the bootloader will override it.
This requires that the SELinux policy compiler (checkpolicy) be
available when compiling the hypervisor.
If unsure, say Y.
config XSM_SILO
def_bool y
prompt "SILO support"
depends on XSM
help
Enables SILO as the access control mechanism used by the XSM framework.
This is not the default module, add boot parameter xsm=silo to choose
it. This will deny any unmediated communication channels (grant tables
and event channels) between unprivileged VMs.
If unsure, say Y.
choice
prompt "Default XSM implementation"
depends on XSM
default XSM_SILO_DEFAULT if XSM_SILO && ARM
default XSM_FLASK_DEFAULT if XSM_FLASK
default XSM_SILO_DEFAULT if XSM_SILO
default XSM_DUMMY_DEFAULT
config XSM_DUMMY_DEFAULT
bool "Match non-XSM behavior"
config XSM_FLASK_DEFAULT
bool "FLux Advanced Security Kernel" if XSM_FLASK
config XSM_SILO_DEFAULT
bool "SILO" if XSM_SILO
endchoice
config LATE_HWDOM
bool "Dedicated hardware domain"
default n
depends on XSM && X86
help
Allows the creation of a dedicated hardware domain distinct from
domain 0 that manages devices without needing access to other
privileged functionality such as the ability to manage domains.
This requires that the actual domain 0 be a stub domain that
constructs the actual hardware domain instead of initializing the
hardware itself. Because the hardware domain needs access to
hypercalls not available to unprivileged guests, an XSM policy
is required to properly define the privilege of these domains.
This feature does nothing if the "hardware_dom" boot parameter is
not present. If this feature is being used for security, it should
be combined with an IOMMU in strict mode.
If unsure, say N.
config ARGO
bool "Argo: hypervisor-mediated interdomain communication (UNSUPPORTED)" if UNSUPPORTED
help
Enables a hypercall for domains to ask the hypervisor to perform
data transfer of messages between domains.
This allows communication channels to be established that do not
require any shared memory between domains; the hypervisor is the
entity that each domain interacts with. The hypervisor is able to
enforce Mandatory Access Control policy over the communication.
If XSM_FLASK is enabled, XSM policy can govern which domains may
communicate via the Argo system.
This feature does nothing if the "argo" boot parameter is not present.
Argo is disabled at runtime by default.
If unsure, say N.
source "common/sched/Kconfig"
config CRYPTO
bool
config LIVEPATCH
bool "Live patching support"
default X86
depends on "$(XEN_HAS_BUILD_ID)" = "y" && SYSCTL && HAS_VMAP
select CC_SPLIT_SECTIONS
help
Allows a running Xen hypervisor to be dynamically patched using
binary patches without rebooting. This is primarily used to binarily
patch in the field an hypervisor with XSA fixes.
If unsure, say Y.
config FAST_SYMBOL_LOOKUP
bool "Fast symbol lookup (bigger binary)"
default y
depends on LIVEPATCH
help
When searching for symbol addresses we can use the built-in system
that is optimized for searching symbols using addresses as the key.
However using it for the inverse (find address using the symbol name)
it is slow. This extra data and code (~55kB) speeds up the search.
The only user of this is Live patching.
If unsure, say Y.
config ENFORCE_UNIQUE_SYMBOLS
bool "Enforce unique symbols"
default LIVEPATCH
help
Multiple symbols with the same name aren't generally a problem
unless livepatching is to be used.
Livepatch loading involves resolving relocations against symbol
names, and attempting to a duplicate symbol in a livepatch will
result in incorrect livepatch application.
This option should be used to ensure that a build of Xen can have a
livepatch build and apply correctly.
config SUPPRESS_DUPLICATE_SYMBOL_WARNINGS
bool "Suppress duplicate symbol warnings"
depends on !ENFORCE_UNIQUE_SYMBOLS
help
Multiple symbols with the same name aren't generally a problem
unless Live patching is to be used, so these warnings can be
suppressed by enabling this option. Certain other options (known
to produce many duplicate names) may select this to avoid the
build becoming overly verbose.
config CMDLINE
string "Built-in hypervisor command string" if EXPERT
default ""
help
Enter arguments here that should be compiled into the hypervisor
image and used at boot time. When the system boots, this string
will be parsed prior to the bootloader command line. So if a
non-cumulative option is set both in this string and in the
bootloader command line, only the latter one will take effect.
config CMDLINE_OVERRIDE
bool "Built-in command line overrides bootloader arguments"
default n
depends on CMDLINE != ""
help
Set this option to 'Y' to have the hypervisor ignore the bootloader
command line, and use ONLY the built-in command line.
This is used to work around broken bootloaders. This should
be set to 'N' under normal conditions.
config DOM0_MEM
string "Default value for dom0_mem boot parameter"
default ""
help
Sets a default value for dom0_mem, e.g. "512M".
The specified string will be used for the dom0_mem parameter in
case it was not specified on the command line.
See docs/misc/xen-command-line.pandoc for the supported syntax.
Leave empty if you are not sure what to specify.
config DTB_FILE
string "Absolute path to device tree blob"
depends on HAS_DEVICE_TREE_DISCOVERY
help
When using a bootloader that has no device tree support or when there
is no bootloader at all, use this option to specify the absolute path
to a device tree that will be linked directly inside Xen binary.
This is an optional config. Leave empty if not needed.
config TRACEBUFFER
bool "Enable tracing infrastructure" if EXPERT
default y
depends on SYSCTL
help
Enable tracing infrastructure and pre-defined tracepoints within Xen.
This will allow live information about Xen's execution and performance
to be collected at run time for debugging or performance analysis.
Memory and execution overhead when not active is minimal.
config LLC_COLORING
bool "Last Level Cache (LLC) coloring" if EXPERT
depends on HAS_LLC_COLORING
config LLC_COLORS_ORDER
int "Maximum number of LLC colors (base-2 exponent)"
range 1 10
default 7
depends on LLC_COLORING
help
Controls the build-time size of various arrays associated with LLC
coloring. The value is a base-2 exponent. Refer to cache coloring
documentation for how to compute the number of colors supported by the
platform. This is only an upper bound. The runtime value is autocomputed
or manually set via cmdline parameters.
The default value corresponds to an 8 MiB 16-ways LLC, which should be
more than what's needed in the general case.
config BUDDY_ALLOCATOR_SIZE
int "Buddy allocator reserved memory size (MiB)"
default "64"
depends on LLC_COLORING
help
Amount of memory reserved for the buddy allocator to serve Xen heap,
working alongside the colored one.
config SYSTEM_SUSPEND_ALWAYS_ON
bool
select HAS_SYSTEM_SUSPEND
config SYSTEM_SUSPEND
bool "System suspend support" if !SYSTEM_SUSPEND_ALWAYS_ON
depends on HAS_SYSTEM_SUSPEND
default SYSTEM_SUSPEND_ALWAYS_ON
help
This option enables the system suspend support. This is the
mechanism that allows the system to be suspended to RAM and
later resumed.
If unsure, say N.
menu "Supported hypercall interfaces"
visible if EXPERT
config SYSCTL
bool "Enable sysctl hypercall"
depends on !PV_SHIM_EXCLUSIVE
default y
help
This option shall only be disabled on some dom0less systems, or
PV shim on x86, to reduce Xen footprint.
endmenu
config PM_OP
bool "Enable Performance Management Operation"
depends on ACPI && HAS_CPUFREQ && SYSCTL
default y
help
This option shall enable userspace performance management control
to do power/performance analyzing and tuning.
config PM_STATS
bool "Enable Performance Management Statistics"
depends on ACPI && HAS_CPUFREQ && SYSCTL
default y
help
Enable collection of performance management statistics to aid in
analyzing and tuning power/performance characteristics of the system
endmenu
Reference in new issue View Git Blame Copy Permalink