This patch adds the flag to enable Memory Protection Keys.
Signed-off-by: Huaitong Han <huaitong....@intel.com>
---
docs/misc/xen-command-line.markdown | 21 +++++++++++++++++++++
xen/arch/x86/setup.c | 7 +++++++
2 files changed, 28 insertions(+)
diff --git a/docs/misc/xen-command-line.markdown
b/docs/misc/xen-command-line.markdown
index afb9548..c0bd84d 100644
--- a/docs/misc/xen-command-line.markdown
+++ b/docs/misc/xen-command-line.markdown
@@ -1177,6 +1177,27 @@ This option can be specified more than once (up to 8
times at present).
### ple\_window
> `= <integer>`
+### pku
+> `= <boolean>`
+
+> Default: `true`
+
+Flag to enable Memory Protection Keys.
+
+The protection-key feature provides an additional mechanism by which IA-32e
+paging controls access to usermode addresses.
+
+When CR4.PKE = 1, every linear address is associated with the 4-bit protection
+key located in bits 62:59 of the paging-structure entry that mapped the page
+containing the linear address. The PKRU register determines, for each
+protection key, whether user-mode addresses with that protection key may be
+read or written.
+
+The PKRU register (protection key rights for user pages) is a 32-bit register
+with the following format: for each i (0 ≤ i ≤ 15), PKRU[2i] is the
+access-disable bit for protection key i (ADi); PKRU[2i+1] is the write-disable
+bit for protection key i (WDi).
+
### psr (Intel)
> `= List of ( cmt:<boolean> | rmid_max:<integer> | cat:<boolean> |
> cos_max:<integer> | cdp:<boolean> )`
diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
index 6714473..2aa2f83 100644
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -67,6 +67,10 @@ invbool_param("smep", disable_smep);
static bool_t __initdata disable_smap;
invbool_param("smap", disable_smap);
+/* pku: Flag to enable Memory Protection Keys (default on). */
+static bool_t __initdata opt_pku = 1;
+boolean_param("pku", opt_pku);
+
/* Boot dom0 in pvh mode */
static bool_t __initdata opt_dom0pvh;
boolean_param("dom0pvh", opt_dom0pvh);
@@ -1307,6 +1311,9 @@ void __init noreturn __start_xen(unsigned long mbi_p)
if ( cpu_has_smap )
set_in_cr4(X86_CR4_SMAP);
+ if ( !opt_pku )
+ setup_clear_cpu_cap(X86_FEATURE_PKU);
+
if ( cpu_has_fsgsbase )
set_in_cr4(X86_CR4_FSGSBASE);
--
2.4.3
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
